Merge branch 'master' into staging-next

2026-03-08 01:24:09 +01:00 · 2025-11-12 08:29:34 +01:00 · 2025-11-12 08:29:34 +01:00 · 1d8d3da257
commit 1d8d3da257
parent 61630d4ab5 584d39c25c
212 changed files with 3873 additions and 2574 deletions
--- a/doc/languages-frameworks/julia.section.md
+++ b/doc/languages-frameworks/julia.section.md
@ -4,7 +4,7 @@

 Nixpkgs includes Julia as the `julia` derivation.
 You can get specific versions by looking at the other `julia*` top-level derivations available.
-For example, `julia_19` corresponds to Julia 1.9.
+For example, `julia_112` corresponds to Julia 1.12.
 We also provide the current stable version as `julia-stable`, and an LTS version as `julia-lts`.

 Occasionally, a Julia version has been too difficult to build from source in Nixpkgs and has been fetched prebuilt instead.
--- a/lib/debug.nix
+++ b/lib/debug.nix
@ -16,6 +16,7 @@
 { lib }:
 let
  inherit (lib)
+    concatMapStringsSep
    isList
    isAttrs
    substring
@ -23,6 +24,7 @@ let
    concatLists
    const
    elem
+    foldl'
    generators
    id
    mapAttrs
@ -454,6 +456,129 @@ rec {
      )
    );

+  /**
+    Pretty-print a list of test failures.
+
+    This takes an attribute set containing `failures` (a list of test failures
+    produced by `runTests`) and pretty-prints each failing test, before
+    throwing an error containing the raw test data as JSON.
+
+    If the input list is empty, `null` is returned.
+
+    # Inputs
+
+    `failures`
+
+    : A list of test failures (produced `runTests`), each containing `name`,
+      `expected`, and `result` attributes.
+
+    # Type
+
+    ```
+    throwTestFailures :: {
+      failures = [
+        {
+          name :: String;
+          expected :: a;
+          result :: a;
+        }
+      ];
+    }
+    ->
+    null
+    ```
+
+    # Examples
+    :::{.example}
+
+    ## `lib.debug.throwTestFailures` usage example
+
+    ```nix
+    throwTestFailures {
+      failures = [
+        {
+          name = "testDerivation";
+          expected = derivation {
+            name = "a";
+            builder = "bash";
+            system = "x86_64-linux";
+          };
+          result = derivation {
+            name = "b";
+            builder = "bash";
+            system = "x86_64-linux";
+          };
+        }
+      ];
+    }
+    ->
+    trace: FAIL testDerivation:
+      Expected: <derivation a>
+        Result: <derivation b>
+
+    error:
+           … while evaluating the file '...':
+
+           … caused by explicit throw
+             at /nix/store/.../lib/debug.nix:528:7:
+              527|       in
+              528|       throw (
+                 |       ^
+              529|         builtins.seq traceFailures (
+
+           error: 1 tests failed:
+           - testDerivation
+
+           [{"expected":"/nix/store/xh7kyqp69mxkwspmi81a94m9xx74r8dr-a","name":"testDerivation","result":"/nix/store/503l84nir4zw57d1shfhai25bxxn16c6-b"}]
+    null
+    ```
+
+    :::
+  */
+  throwTestFailures =
+    {
+      failures,
+      description ? "tests",
+      ...
+    }:
+    if failures == [ ] then
+      null
+    else
+      let
+        toPretty =
+          value:
+          # Thanks to @Ma27 for this:
+          #
+          # > The `unsafeDiscardStringContext` is useful when the `toPretty`
+          # > stumbles upon a derivation that would be realized without it (I
+          # > ran into the problem when writing a test for a flake helper where
+          # > I creating a bunch of "mock" derivations for different systems
+          # > and Nix then tried to build those when the error-string got
+          # > forced).
+          #
+          # See: https://github.com/NixOS/nixpkgs/pull/416207#discussion_r2145942389
+          builtins.unsafeDiscardStringContext (generators.toPretty { allowPrettyValues = true; } value);
+
+        failureToPretty = failure: ''
+          FAIL ${toPretty failure.name}:
+          Expected:
+          ${toPretty failure.expected}
+
+          Result:
+          ${toPretty failure.result}
+        '';
+
+        traceFailures = foldl' (_accumulator: failure: traceVal (failureToPretty failure)) null failures;
+      in
+      throw (
+        builtins.seq traceFailures (
+          "${builtins.toString (builtins.length failures)} ${description} failed:\n- "
+          + (concatMapStringsSep "\n- " (failure: failure.name) failures)
+          + "\n\n"
+          + builtins.toJSON failures
+        )
+      );
+
  /**
    Create a test assuming that list elements are `true`.

--- a/lib/path/tests/unit.nix
+++ b/lib/path/tests/unit.nix
@ -15,7 +15,7 @@ let
  # This is not allowed generally, but we're in the tests here, so we'll allow ourselves.
  storeDirPath = /. + builtins.storeDir;

-  cases = lib.runTests {
+  failures = lib.runTests {
    # Test examples from the lib.path.append documentation
    testAppendExample1 = {
      expr = append /foo "bar/baz";
@ -326,7 +326,6 @@ let
    };
  };
 in
-if cases == [ ] then
-  "Unit tests successful"
-else
-  throw "Path unit tests failed: ${lib.generators.toPretty { } cases}"
+lib.debug.throwTestFailures {
+  inherit failures;
+}
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -4741,8 +4741,6 @@ runTests {
    expected = "/non-existent/this/does/not/exist/for/real/please-dont-mess-with-your-local-fs/default.nix";
  };

-  # Tests for cross index utilities
-
  testRenameCrossIndexFrom = {
    expr = lib.renameCrossIndexFrom "pkgs" {
      pkgsBuildBuild = "dummy-build-build";
@ -4819,4 +4817,31 @@ runTests {
    };
  };

+  testThrowTestFailuresEmpty = {
+    expr = lib.debug.throwTestFailures {
+      failures = [ ];
+    };
+
+    expected = null;
+  };
+
+  testThrowTestFailures = testingThrow (
+    lib.debug.throwTestFailures {
+      failures = [
+        {
+          name = "testDerivation";
+          expected = builtins.derivation {
+            name = "a";
+            builder = "bash";
+            system = "x86_64-linux";
+          };
+          result = builtins.derivation {
+            name = "b";
+            builder = "bash";
+            system = "x86_64-linux";
+          };
+        }
+      ];
+    }
+  );
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -13314,6 +13314,13 @@
    githubId = 34152449;
    name = "Karl Hallsby";
  };
+  karpfediem = {
+    name = "Karpfen";
+    github = "karpfediem";
+    githubId = 11753414;
+    email = "nixos@karpfen.dev";
+    matrix = "@karpfen:matrix.org";
+  };
  kashw2 = {
    email = "supra4keanu@hotmail.com";
    github = "kashw2";
@ -16389,6 +16396,12 @@
    githubId = 65052855;
    name = "maxicode";
  };
+  maximiliancf = {
+    email = "maximiliancf.dev@icloud.com";
+    github = "MaximilianCF";
+    githubId = 92341177;
+    name = "Maximilian Canez Fernandes";
+  };
  maximsmol = {
    email = "maximsmol@gmail.com";
    github = "maximsmol";
@ -27734,6 +27747,11 @@
    githubId = 51289041;
    name = "Vuks";
  };
+  vv01f = {
+    github = "vv01f";
+    githubId = 3034896;
+    name = "Wolf";
+  };
  vyorkin = {
    email = "vasiliy.yorkin@gmail.com";
    github = "vyorkin";
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@ -456,6 +456,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).

 - `linux_libre` & `linux_latest_libre` have been removed due to a lack of maintenance.

+- `services.nebula.networks.<name>` will now store configuration files in `/etc/nebula/<name>.yml` and supports config reloading.
+
 - `services.pds` has been renamed to `services.bluesky-pds`.

 - `services.xserver.desktopManager.deepin` and associated packages have been removed due to being unmaintained. See issue [#422090](https://github.com/NixOS/nixpkgs/issues/422090) for more details.
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -972,7 +972,7 @@ in
            ${lib.concatStringsSep "\n" (
              lib.mapAttrsToList (to: from: ''
                ln -sf ${from} /var/lib/postfix/conf/${to}
-                ${lib.getExe' cfg.package "postmap"} -o -p /var/lib/postfix/conf/${to}
+                ${lib.getExe' cfg.package "postmap"} /var/lib/postfix/conf/${to}
              '') cfg.mapFiles
            )}

--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@ -9,8 +9,54 @@ let
  cfg = config.services.nebula;
  enabledNetworks = lib.filterAttrs (n: v: v.enable) cfg.networks;

+  genSettings =
+    netName: netCfg:
+    lib.recursiveUpdate {
+      pki = {
+        ca = netCfg.ca;
+        cert = netCfg.cert;
+        key = netCfg.key;
+      };
+      static_host_map = netCfg.staticHostMap;
+      lighthouse = {
+        am_lighthouse = netCfg.isLighthouse;
+        hosts = netCfg.lighthouses;
+        serve_dns = netCfg.lighthouse.dns.enable;
+        dns.host = netCfg.lighthouse.dns.host;
+        dns.port = netCfg.lighthouse.dns.port;
+      };
+      relay = {
+        am_relay = netCfg.isRelay;
+        relays = netCfg.relays;
+        use_relays = true;
+      };
+      listen = {
+        host = netCfg.listen.host;
+        port = resolveFinalPort netCfg;
+      };
+      tun = {
+        disabled = netCfg.tun.disable;
+        dev = if (netCfg.tun.device != null) then netCfg.tun.device else "nebula.${netName}";
+      };
+      firewall = {
+        inbound = netCfg.firewall.inbound;
+        outbound = netCfg.firewall.outbound;
+      };
+    } netCfg.settings;
  format = pkgs.formats.yaml { };

+  genConfigFile =
+    netName: settings:
+    format.generate "nebula-config-${netName}.yml" (
+      lib.warnIf
+        ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0)
+        ''
+          Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}.
+          You will likely experience connectivity issues: https://nebula.defined.net/docs/config/listen/#listenport
+        ''
+        settings
+    );
+
  nameToId = netName: "nebula-${netName}";

  resolveFinalPort =
@ -60,6 +106,16 @@ in
                example = "/etc/nebula/host.key";
              };

+              enableReload = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Enable automatic config reload on config change.
+                  This setting is not enabled by default as nix cannot determine if the config change is reloadable.
+                  Please refer to the [config reference](https://nebula.defined.net/docs/config/) for documentation on reloadable changes.
+                '';
+              };
+
              staticHostMap = lib.mkOption {
                type = lib.types.attrsOf (lib.types.listOf (lib.types.str));
                default = { };
@ -212,47 +268,13 @@ in
        netName: netCfg:
        let
          networkId = nameToId netName;
-          settings = lib.recursiveUpdate {
-            pki = {
-              ca = netCfg.ca;
-              cert = netCfg.cert;
-              key = netCfg.key;
-            };
-            static_host_map = netCfg.staticHostMap;
-            lighthouse = {
-              am_lighthouse = netCfg.isLighthouse;
-              hosts = netCfg.lighthouses;
-              serve_dns = netCfg.lighthouse.dns.enable;
-              dns.host = netCfg.lighthouse.dns.host;
-              dns.port = netCfg.lighthouse.dns.port;
-            };
-            relay = {
-              am_relay = netCfg.isRelay;
-              relays = netCfg.relays;
-              use_relays = true;
-            };
-            listen = {
-              host = netCfg.listen.host;
-              port = resolveFinalPort netCfg;
-            };
-            tun = {
-              disabled = netCfg.tun.disable;
-              dev = if (netCfg.tun.device != null) then netCfg.tun.device else "nebula.${netName}";
-            };
-            firewall = {
-              inbound = netCfg.firewall.inbound;
-              outbound = netCfg.firewall.outbound;
-            };
-          } netCfg.settings;
-          configFile = format.generate "nebula-config-${netName}.yml" (
-            lib.warnIf
-              ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0)
-              ''
-                Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}.
-                You will likely experience connectivity issues: https://nebula.defined.net/docs/config/listen/#listenport
-              ''
-              settings
-          );
+          settings = genSettings netName netCfg;
+          generatedConfigFile = genConfigFile netName settings;
+          configFile =
+            if ((lib.versionAtLeast config.system.stateVersion "25.11") || netCfg.enableReload) then
+              "/etc/nebula/${netName}.yml"
+            else
+              generatedConfigFile;
          capabilities =
            let
              nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;
@ -278,6 +300,8 @@ in
            ];
            before = [ "sshd.service" ];
            wantedBy = [ "multi-user.target" ];
+            restartTriggers = lib.optional (!netCfg.enableReload) generatedConfigFile;
+            reloadTriggers = lib.optional netCfg.enableReload generatedConfigFile;
            serviceConfig = {
              Type = "notify";
              Restart = "always";
@ -313,6 +337,22 @@ in
      ) enabledNetworks
    );

+    environment.etc = lib.mkMerge (
+      lib.mapAttrsToList
+        (netName: netCfg: {
+          "nebula/${netName}.yml" = {
+            source = genConfigFile netName (genSettings netName netCfg);
+            mode = "0440";
+            user = nameToId netName;
+          };
+        })
+        (
+          lib.filterAttrs (
+            _: netCfg: netCfg.enableReload || (lib.versionAtLeast config.system.stateVersion "25.11")
+          ) enabledNetworks
+        )
+    );
+
    # Open the chosen ports for UDP.
    networking.firewall.allowedUDPPorts = lib.unique (
      lib.filter (port: port > 0) (
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -550,6 +550,7 @@ in
        "pm.min_spare_servers" = "6";
        "pm.max_spare_servers" = "18";
        "pm.max_requests" = "500";
+        "pm.status_path" = "/status";
      };
      description = ''
        Options for nextcloud's PHP pool. See the documentation on `php-fpm.conf` for details on
--- a/nixos/modules/services/web-apps/umami.nix
+++ b/nixos/modules/services/web-apps/umami.nix
@ -36,7 +36,6 @@ in
      apply =
        pkg:
        pkg.override {
-          databaseType = cfg.settings.DATABASE_TYPE;
          collectApiEndpoint = optionalString (
            cfg.settings.COLLECT_API_ENDPOINT != null
          ) cfg.settings.COLLECT_API_ENDPOINT;
@ -95,10 +94,7 @@ in
            type = types.nullOr (
              types.str
              // {
-                check =
-                  it:
-                  isString it
-                  && ((hasPrefix "postgresql://" it) || (hasPrefix "postgres://" it) || (hasPrefix "mysql://" it));
+                check = it: isString it && ((hasPrefix "postgresql://" it) || (hasPrefix "postgres://" it));
              }
            );
            # For some reason, Prisma requires the username in the connection string
@ -111,8 +107,7 @@ in
            defaultText = literalExpression ''if config.services.umami.createPostgresqlDatabase then "postgresql://umami@localhost/umami?host=/run/postgresql" else null'';
            example = "postgresql://root:root@localhost/umami";
            description = ''
-              Connection string for the database. Must start with `postgresql://`, `postgres://`
-              or `mysql://`.
+              Connection string for the database. Must start with `postgresql://` or `postgres://`.
            '';
          };
          DATABASE_URL_FILE = mkOption {
@ -128,31 +123,11 @@ in
            example = "/run/secrets/umamiDatabaseUrl";
            description = ''
              A file containing a connection string for the database. The connection string
-              must start with `postgresql://`, `postgres://` or `mysql://`.
-              If using this, then DATABASE_TYPE must be set to the appropriate value.
+              must start with `postgresql://` or `postgres://`.
              The contents of the file are read through systemd credentials, therefore the
              user running umami does not need permissions to read the file.
            '';
          };
-          DATABASE_TYPE = mkOption {
-            type = types.nullOr (
-              types.enum [
-                "postgresql"
-                "mysql"
-              ]
-            );
-            default =
-              if cfg.settings.DATABASE_URL != null && hasPrefix "mysql://" cfg.settings.DATABASE_URL then
-                "mysql"
-              else
-                "postgresql";
-            defaultText = literalExpression ''if config.services.umami.settings.DATABASE_URL != null && hasPrefix "mysql://" config.services.umami.settings.DATABASE_URL then "mysql" else "postgresql"'';
-            example = "mysql";
-            description = ''
-              The type of database to use. This is automatically inferred from DATABASE_URL, but
-              must be set manually if you are using DATABASE_URL_FILE.
-            '';
-          };
          COLLECT_API_ENDPOINT = mkOption {
            type = types.nullOr types.str;
            default = null;
@ -239,6 +214,10 @@ in
          -> cfg.settings.DATABASE_URL == "postgresql://umami@localhost/umami?host=/run/postgresql";
        message = "The option config.services.umami.createPostgresqlDatabase is enabled, but config.services.umami.settings.DATABASE_URL has been modified.";
      }
+      {
+        assertion = cfg.settings.DATABASE_TYPE or null != "mysql";
+        message = "Umami only supports PostgreSQL as of 3.0.0. Follow migration instructions if you are using MySQL: https://umami.is/docs/guides/migrate-mysql-postgresql";
+      }
    ];

    services.postgresql = mkIf cfg.createPostgresqlDatabase {
--- a/nixos/modules/virtualisation/lxc-instance-common.nix
+++ b/nixos/modules/virtualisation/lxc-instance-common.nix
@ -26,8 +26,9 @@
  services.openssh.enable = lib.mkDefault true;
  services.openssh.startWhenNeeded = lib.mkDefault true;

-  # As this is intended as a standalone image, undo some of the minimal profile stuff
-  documentation.enable = lib.mkDefault true;
-  documentation.nixos.enable = lib.mkDefault true;
+  # friendlier defaults than minimal profile provides
+  # but we can't use mkDefault since minimal uses it
+  documentation.enable = lib.mkOverride 890 true;
+  documentation.nixos.enable = lib.mkOverride 890 true;
  services.logrotate.enable = true;
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -889,7 +889,7 @@ in
  lorri = handleTest ./lorri/default.nix { };
  luks = runTest ./luks.nix;
  lvm2 = handleTest ./lvm2 { };
-  lxc = handleTest ./lxc { };
+  lxc = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./lxc;
  lxd-image-server = runTest ./lxd-image-server.nix;
  lxqt = runTest ./lxqt.nix;
  ly = runTest ./ly.nix;
@ -1011,7 +1011,8 @@ in
    defaults.services.ncps.cache.dataPath = "/path/to/ncps";
  };
  ndppd = runTest ./ndppd.nix;
-  nebula = runTest ./nebula.nix;
+  nebula.connectivity = runTest ./nebula/connectivity.nix;
+  nebula.reload = runTest ./nebula/reload.nix;
  neo4j = runTest ./neo4j.nix;
  netbird = runTest ./netbird.nix;
  netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@ -38,10 +38,13 @@ in
            settings = {
              server_url = "https://headscale";
              ip_prefixes = [ "100.64.0.0/10" ];
-              derp.server = {
-                enabled = true;
-                region_id = 999;
-                stun_listen_addr = "0.0.0.0:${toString stunPort}";
+              derp = {
+                server = {
+                  enabled = true;
+                  region_id = 999;
+                  stun_listen_addr = "0.0.0.0:${toString stunPort}";
+                };
+                urls = [ ];
              };
              dns = {
                base_domain = "tailnet";
--- a/nixos/tests/lxc/default.nix
+++ b/nixos/tests/lxc/default.nix
@ -1,124 +1,128 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:

-  let
-    releases = import ../../release.nix {
-      configuration = {
-        # Building documentation makes the test unnecessarily take a longer time:
-        documentation.enable = lib.mkForce false;
+let
+  releases = import ../../release.nix {
+    configuration = {
+      # Building documentation makes the test unnecessarily take a longer time:
+      documentation.enable = lib.mkForce false;
+      documentation.nixos.enable = lib.mkForce false;
+      # including a channel forces images to be rebuilt on any changes
+      system.installer.channel.enable = lib.mkForce false;
+    };
+  };
+
+  lxc-image-metadata =
+    releases.incusContainerMeta.${pkgs.stdenv.hostPlatform.system}
+    + "/tarball/nixos-image-lxc-*-${pkgs.stdenv.hostPlatform.system}.tar.xz";
+  # the incus container rootfs is in squashfs, but lxc requires tar.xz so use containerTarball
+  lxc-image-rootfs =
+    releases.containerTarball.${pkgs.stdenv.hostPlatform.system}
+    + "/tarball/nixos-image-lxc-*-${pkgs.stdenv.hostPlatform.system}.tar.xz";
+
+in
+{
+  name = "lxc-container-unprivileged";
+
+  meta = {
+    maintainers = lib.teams.lxc.members;
+  };
+
+  nodes.machine = {
+    virtualisation = {
+      diskSize = 6144;
+      cores = 2;
+      memorySize = 512;
+      writableStore = true;
+
+      lxc = {
+        enable = true;
+        unprivilegedContainers = true;
+        systemConfig = ''
+          lxc.lxcpath = /tmp/lxc
+        '';
+        defaultConfig = ''
+          lxc.net.0.type = veth
+          lxc.net.0.link = lxcbr0
+          lxc.net.0.flags = up
+          lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
+          lxc.idmap = u 0 100000 65536
+          lxc.idmap = g 0 100000 65536
+        '';
+        # Permit user alice to connect to bridge
+        usernetConfig = ''
+          @lxc-user veth lxcbr0 10
+        '';
+        bridgeConfig = ''
+          LXC_IPV6_ADDR=""
+          LXC_IPV6_MASK=""
+          LXC_IPV6_NETWORK=""
+          LXC_IPV6_NAT="false"
+        '';
      };
    };

-    lxc-image-metadata = releases.incusContainerMeta.${pkgs.stdenv.hostPlatform.system};
-    lxc-image-rootfs = releases.incusContainerImage.${pkgs.stdenv.hostPlatform.system};
+    # Needed for lxc
+    environment.systemPackages = [
+      pkgs.wget
+      pkgs.dnsmasq
+    ];

-  in
-  {
-    name = "lxc-container-unprivileged";
-
-    meta = {
-      maintainers = lib.teams.lxc.members;
+    # Create user for test
+    users.users.alice = {
+      isNormalUser = true;
+      password = "test";
+      description = "Lxc unprivileged user with access to lxcbr0";
+      extraGroups = [ "lxc-user" ];
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 65536;
+        }
+      ];
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 65536;
+        }
+      ];
    };

-    nodes.machine =
-      { lib, pkgs, ... }:
-      {
-        virtualisation = {
-          diskSize = 6144;
-          cores = 2;
-          memorySize = 512;
-          writableStore = true;
+    users.users.bob = {
+      isNormalUser = true;
+      password = "test";
+      description = "Lxc unprivileged user without access to lxcbr0";
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 65536;
+        }
+      ];
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 65536;
+        }
+      ];
+    };
+  };

-          lxc = {
-            enable = true;
-            unprivilegedContainers = true;
-            systemConfig = ''
-              lxc.lxcpath = /tmp/lxc
-            '';
-            defaultConfig = ''
-              lxc.net.0.type = veth
-              lxc.net.0.link = lxcbr0
-              lxc.net.0.flags = up
-              lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
-              lxc.idmap = u 0 100000 65536
-              lxc.idmap = g 0 100000 65536
-            '';
-            # Permit user alice to connect to bridge
-            usernetConfig = ''
-              @lxc-user veth lxcbr0 10
-            '';
-            bridgeConfig = ''
-              LXC_IPV6_ADDR=""
-              LXC_IPV6_MASK=""
-              LXC_IPV6_NETWORK=""
-              LXC_IPV6_NAT="false"
-            '';
-          };
-        };
+  testScript = ''
+    machine.wait_for_unit("lxc-net.service")

-        # Needed for lxc
-        environment.systemPackages = [
-          pkgs.wget
-          pkgs.dnsmasq
-        ];
+    # Copy config files for alice
+    machine.execute("su -- alice -c 'mkdir -p ~/.config/lxc'")
+    machine.execute("su -- alice -c 'cp /etc/lxc/default.conf ~/.config/lxc/'")
+    machine.execute("su -- alice -c 'cp /etc/lxc/lxc.conf ~/.config/lxc/'")

-        # Create user for test
-        users.users.alice = {
-          isNormalUser = true;
-          password = "test";
-          description = "Lxc unprivileged user with access to lxcbr0";
-          extraGroups = [ "lxc-user" ];
-          subGidRanges = [
-            {
-              startGid = 100000;
-              count = 65536;
-            }
-          ];
-          subUidRanges = [
-            {
-              startUid = 100000;
-              count = 65536;
-            }
-          ];
-        };
+    machine.succeed("su -- alice -c 'lxc-create -t local -n test -- --metadata ${lxc-image-metadata} --fstree ${lxc-image-rootfs}'")
+    machine.succeed("su -- alice -c 'lxc-start test'")
+    machine.succeed("su -- alice -c 'lxc-stop test'")

-        users.users.bob = {
-          isNormalUser = true;
-          password = "test";
-          description = "Lxc unprivileged user without access to lxcbr0";
-          subGidRanges = [
-            {
-              startGid = 100000;
-              count = 65536;
-            }
-          ];
-          subUidRanges = [
-            {
-              startUid = 100000;
-              count = 65536;
-            }
-          ];
-        };
-      };
+    # Copy config files for bob
+    machine.execute("su -- bob -c 'mkdir -p ~/.config/lxc'")
+    machine.execute("su -- bob -c 'cp /etc/lxc/default.conf ~/.config/lxc/'")
+    machine.execute("su -- bob -c 'cp /etc/lxc/lxc.conf ~/.config/lxc/'")

-    testScript = ''
-      machine.wait_for_unit("lxc-net.service")
-
-      # Copy config files for alice
-      machine.execute("su -- alice -c 'mkdir -p ~/.config/lxc'")
-      machine.execute("su -- alice -c 'cp /etc/lxc/default.conf ~/.config/lxc/'")
-      machine.execute("su -- alice -c 'cp /etc/lxc/lxc.conf ~/.config/lxc/'")
-
-      machine.succeed("su -- alice -c 'lxc-create -t local -n test -- --metadata ${lxc-image-metadata}/*/*.tar.xz --fstree ${lxc-image-rootfs}/*/*.tar.xz'")
-      machine.succeed("su -- alice -c 'lxc-start test'")
-      machine.succeed("su -- alice -c 'lxc-stop test'")
-
-      # Copy config files for bob
-      machine.execute("su -- bob -c 'mkdir -p ~/.config/lxc'")
-      machine.execute("su -- bob -c 'cp /etc/lxc/default.conf ~/.config/lxc/'")
-      machine.execute("su -- bob -c 'cp /etc/lxc/lxc.conf ~/.config/lxc/'")
-
-      machine.fail("su -- bob -c 'lxc-start test'")
-    '';
-  }
-)
+    machine.fail("su -- bob -c 'lxc-start test'")
+  '';
+}
--- a/nixos/tests/molly-brown.nix
+++ b/nixos/tests/molly-brown.nix
@ -14,6 +14,7 @@ in
      let
        inherit (config.networking) hostName;
        cfg = config.services.molly-brown;
+        openssl = pkgs.lib.getExe pkgs.openssl;
      in
      {

@ -47,22 +48,25 @@ in

        services.molly-brown = {
          enable = true;
-          docBase = "/tmp/docs";
-          certPath = "/tmp/cert.pem";
-          keyPath = "/tmp/key.pem";
+          docBase = "/var/lib/molly-brown/docs";
+          certPath = "/var/lib/molly-brown/cert.pem";
+          keyPath = "/var/lib/molly-brown/key.pem";
        };

-        systemd.services.molly-brown.preStart = ''
-          ${pkgs.openssl}/bin/openssl genrsa -out "/tmp/key.pem"
-          ${pkgs.openssl}/bin/openssl req -new \
-            -subj "/CN=${config.networking.hostName}" \
-            -key "/tmp/key.pem" -out /tmp/request.pem
-          ${pkgs.openssl}/bin/openssl x509 -req -days 3650 \
-            -in /tmp/request.pem -signkey "/tmp/key.pem" -out "/tmp/cert.pem"
+        systemd.services.molly-brown = {
+          serviceConfig.StateDirectory = "molly-brown";
+          preStart = ''
+            ${openssl} genrsa -out "$STATE_DIRECTORY/key.pem"
+            ${openssl} req -new \
+              -subj "/CN=${hostName}" \
+              -key "$STATE_DIRECTORY/key.pem" -out "$STATE_DIRECTORY/request.pem"
+            ${openssl} x509 -req -days 3650 \
+              -in "$STATE_DIRECTORY/request.pem" -signkey "$STATE_DIRECTORY/key.pem" -out "$STATE_DIRECTORY/cert.pem"

-          mkdir -p "${cfg.settings.DocBase}"
-          echo "${testString}" > "${cfg.settings.DocBase}/test.gmi"
-        '';
+            mkdir -p "${cfg.settings.DocBase}"
+            echo "${testString}" > "${cfg.settings.DocBase}/test.gmi"
+          '';
+        };
      };
  };
  testScript = ''
--- a/nixos/tests/nebula/connectivity.nix
+++ b/nixos/tests/nebula/connectivity.nix
@ -2,7 +2,7 @@
 let

  # We'll need to be able to trade cert files between nodes via scp.
-  inherit (import ./ssh-keys.nix pkgs)
+  inherit (import ../ssh-keys.nix pkgs)
    snakeOilPrivateKey
    snakeOilPublicKey
    ;
--- a/nixos/tests/nebula/reload.nix
+++ b/nixos/tests/nebula/reload.nix
@ -0,0 +1,92 @@
+{ pkgs, lib, ... }:
+let
+
+  inherit (import ../ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
+
+in
+{
+  name = "nebula";
+
+  nodes = {
+    lighthouse =
+      {
+        pkgs,
+        lib,
+        config,
+        ...
+      }:
+      {
+        environment.systemPackages = [ pkgs.nebula ];
+        environment.etc."nebula-key" = {
+          user = "nebula-smoke";
+          group = "nebula-smoke";
+          source = snakeOilPrivateKey;
+          mode = "0600";
+        };
+
+        services.nebula.networks.smoke = {
+          # Note that these paths won't exist when the machine is first booted.
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/lighthouse.crt";
+          key = "/etc/nebula/lighthouse.key";
+          isLighthouse = true;
+          listen = {
+            host = "0.0.0.0";
+            port = 4242;
+          };
+          enableReload = true;
+          settings.sshd = {
+            enabled = true;
+            listen = "127.0.0.1:2222";
+            host_key = "/etc/nebula-key";
+          };
+        };
+
+        # We will test that nebula is reloaded by switching specialisations.
+        specialisation.sshd-off.configuration = {
+          services.nebula.networks.smoke.settings.sshd.enabled = lib.mkForce false;
+        };
+        specialisation.sshd-on.configuration = {
+          services.nebula.networks.smoke.settings.sshd.enabled = lib.mkForce true;
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      sshd-on = "${nodes.lighthouse.system.build.toplevel}/specialisation/sshd-on";
+      sshd-off = "${nodes.lighthouse.system.build.toplevel}/specialisation/sshd-off";
+    in
+    ''
+      # Create the certificate and sign the lighthouse's keys.
+      lighthouse.succeed(
+          "mkdir -p /etc/nebula",
+          'nebula-cert ca -duration $((10*365*24*60))m -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key',
+          'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
+          'chown -R nebula-smoke:nebula-smoke /etc/nebula'
+      )
+
+      # Restart nebula to pick up the keys.
+      lighthouse.systemctl("restart nebula@smoke.service")
+      lighthouse.succeed("ping -c5 10.0.100.1")
+
+      # Verify that nebula's ssh interface is up.
+      lighthouse.succeed("${pkgs.nmap}/bin/nmap 127.0.0.1 | grep 2222/tcp")
+
+      # Switch configuration, verify nebula was reloaded and not restarted.
+      lighthouse.succeed("${sshd-off}/bin/switch-to-configuration test 2>&1 | grep 'nebula' | grep 'reload'")
+
+      # Verify that nebula's ssh interface is no longer up.
+      lighthouse.fail("${pkgs.nmap}/bin/nmap 127.0.0.1 | grep 2222/tcp")
+
+      # Switch configuration, verify reload again.
+      lighthouse.succeed("${sshd-on}/bin/switch-to-configuration test 2>&1 | grep 'nebula' | grep 'reload'")
+
+      # Verify that ssh is back.
+      lighthouse.succeed("${pkgs.nmap}/bin/nmap 127.0.0.1 | grep 2222/tcp")
+    '';
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -5854,6 +5854,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  gitportal-nvim = buildVimPlugin {
+    pname = "gitportal.nvim";
+    version = "2025-11-11";
+    src = fetchFromGitHub {
+      owner = "trevorhauter";
+      repo = "gitportal.nvim";
+      rev = "3abb1b87a48a8c07f042eb8c570dfe325ebf8702";
+      sha256 = "04f8yls7498v8ccs472zl1phr1c5p5nf37r05dpv4kr1wqlkmdq4";
+    };
+    meta.homepage = "https://github.com/trevorhauter/gitportal.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  gitv = buildVimPlugin {
    pname = "gitv";
    version = "2019-08-22";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -448,6 +448,7 @@ https://github.com/projekt0n/github-nvim-theme/,HEAD,
 https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
+https://github.com/trevorhauter/gitportal.nvim/,,
 https://github.com/gregsexton/gitv/,,
 https://github.com/DNLHC/glance.nvim/,HEAD,
 https://github.com/ellisonleao/glow.nvim/,,
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.0.35";
-    hash = "sha256-1wN82mZk3zCGGFQ8FNwLFm1793U8GEC8p46BJiPNaUo=";
+    version = "2.0.37";
+    hash = "sha256-wXYdMoJhdH5S8EGdELVFbmwrwO7LHgYiEFqiUscQo4Y=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -727,8 +727,8 @@ let
        mktplcRef = {
          name = "vscode-intelephense-client";
          publisher = "bmewburn";
-          version = "1.14.4";
-          hash = "sha256-WBtaRLAdE2Ttlq4fAS2kI3d0dUAVB+CTdksiSILJ4hY=";
+          version = "1.15.0";
+          hash = "sha256-91udkAS7pB5ia0UgfTPHCDjzVfbKKOeXi5LAp/D3EkY=";
        };
        meta = {
          description = "PHP code intelligence for Visual Studio Code";
@ -5474,8 +5474,8 @@ let
        mktplcRef = {
          name = "vscode-zig";
          publisher = "ziglang";
-          version = "0.6.14";
-          hash = "sha256-Bp0WdHTew+AZVtlHY/BBngtWJ9F4MjPx5tcR4HgXBio=";
+          version = "0.6.15";
+          hash = "sha256-iSkB99l+C82eMaSPV9D2+EJthIC4qIIzB2+YAZM8Uaw=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/ziglang.vscode-zig/changelog";
--- a/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "basedpyright";
    publisher = "detachhead";
-    version = "1.32.1";
-    hash = "sha256-nipb8ilZ43V/7WnDO0Lo7ctFdjAmHtH0WUkupFUSlMQ=";
+    version = "1.33.0";
+    hash = "sha256-y4/DYRn6DXI1DMtWfoILw1LCkR2kT9cYu0wdtNWAgpw=";
  };
  meta = {
    changelog = "https://github.com/detachhead/basedpyright/releases";
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@ -12,19 +12,19 @@ let
  vsix = stdenvNoCC.mkDerivation (finalAttrs: {
    name = "kilo-code-${finalAttrs.version}.vsix";
    pname = "kilo-code-vsix";
-    version = "4.91.0";
+    version = "4.118.0";

    src = fetchFromGitHub {
      owner = "Kilo-Org";
      repo = "kilocode";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-dUVPCTxfLcsVfy2FqdZMN8grysALUOTiTl4TXM1BcDs=";
+      hash = "sha256-k5dDgNUbOd+aOzPeub7P/uWDCeWO0ffyDaGtu2M87Wg=";
    };

    pnpmDeps = pnpm.fetchDeps {
      inherit (finalAttrs) pname version src;
      fetcherVersion = 2;
-      hash = "sha256-4LB2KY+Ksr8BQYoHrz3VNr81++zcrWN+USg3bBfr/FU=";
+      hash = "sha256-YeCrmTPOeBfsSAMMv11ipHM8AgLzcy/sOW/Jg8H5H+w=";
    };

    nativeBuildInputs = [
--- a/pkgs/applications/emulators/libretro/cores/sameboy.nix
+++ b/pkgs/applications/emulators/libretro/cores/sameboy.nix
@ -24,8 +24,8 @@ mkLibretroCore {
  makefile = "Makefile";

  meta = {
-    description = "QuickNES libretro port";
-    homepage = "https://github.com/libretro/QuickNES_Core";
+    description = "SameBoy libretro port";
+    homepage = "https://github.com/libretro/SameBoy";
    license = lib.licenses.mit;
  };
 }
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -22,7 +22,6 @@
  gsl,
  hdf5,
  libpq,
-  libspatialindex,
  libspatialite,
  libzip,
  netcdf,
@ -82,14 +81,14 @@ let
  ];
 in
 mkDerivation rec {
-  version = "3.40.11";
+  version = "3.40.12";
  pname = "qgis-ltr-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-HjdOLG/x8qXTDlMKW6+jBuwi+36rBkBFM1OCe3BcjWY=";
+    hash = "sha256-QsAiE3HC71lGsdUKW9QZ5gCLCRsOCCM2IR3MKJlJ0vk=";
  };

  passthru = {
@ -116,7 +115,6 @@ mkDerivation rec {
    gsl
    hdf5
    libpq
-    libspatialindex
    libspatialite
    libzip
    netcdf
@ -163,6 +161,9 @@ mkDerivation rec {
    # Remove for QGIS 3.42
    "-DCMAKE_POLICY_DEFAULT_CMP0175=OLD"
    "-DCMAKE_POLICY_DEFAULT_CMP0177=OLD"
+
+    # See https://github.com/libspatialindex/libspatialindex/issues/276
+    "-DWITH_INTERNAL_SPATIALINDEX=True"
  ]
  ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
  ++ lib.optional withServer [
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -96,8 +96,8 @@
  ungoogled-chromium,
  # Optional dependencies:
  libgcrypt ? null, # cupsSupport
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
 }:

 buildFun:
@ -370,7 +370,7 @@ let
      libffi
      libevdev
    ]
-    ++ lib.optional systemdSupport systemd
+    ++ lib.optional systemdSupport systemdLibs
    ++ lib.optionals cupsSupport [
      libgcrypt
      cups
@ -427,7 +427,7 @@ let
      libffi
      libevdev
    ]
-    ++ lib.optional systemdSupport systemd
+    ++ lib.optional systemdSupport systemdLibs
    ++ lib.optionals cupsSupport [
      libgcrypt
      cups
@ -686,10 +686,6 @@ let
            '${glibc}/share/locale/'

      ''
-      + lib.optionalString systemdSupport ''
-        sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${lib.getLib systemd}/lib/\1!' \
-          device/udev_linux/udev?_loader.cc
-      ''
      + ''
        # Allow to put extensions into the system-path.
        sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@ -9,11 +9,11 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "140.4.0esr";
+  version = "140.5.0esr";
  applicationName = "Firefox ESR";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "cfce0bdcf6d4599c7b96bccd9fd1390bfb3645db9276a369a30760ce6819850aaa4251869e6bd3c5d8582ea3728b920762c5f16f7ce12ce151c3e74327b8c811";
+    sha512 = "412236a25cbea171bd5bd535e45c3ba40957a94e1f8dd3ab74241e0aa1c4075fcb8d394b9619599d60ce3e4563e712c825fa8bec441794f229356802f72b2861";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "144.0.2";
+  version = "145.0";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "87eebabab2c85eb32b2d1161e520f56e271a4893c8cd4d8225fc7b498a9883496315854a758478fb4edd061674a9f7c0503e9b9f0eb4503b1f89203774d02f97";
+    sha512 = "7ba40d7de95d7b93278f1823ce460b45c6bfac01eda52bc5c28f23a6bc858bdcbf8b4b4dc359b853372fffbcff4e7f0b276fefe22c2d4a0fa303e8ce1d2629be";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -9,15 +9,15 @@

 buildGoModule (finalAttrs: {
  pname = "kubernetes-helm";
-  version = "3.19.0";
+  version = "3.19.1";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ssOebBeIFVd6N0CDWfAU3HN0j4Rw7twncokzorHWJig=";
+    sha256 = "sha256-1Cc7W6qyawcg5ZfjsGWH7gScdRhcYpqppjzD83QWV60=";
  };
-  vendorHash = "sha256-G3PLT2jE+Oitct5F+o/hr8GDAKWcvp23dcpezuBge6k=";
+  vendorHash = "sha256-81qCRwp57PpzK/eavycOLFYsuD8uVq46h12YVlJRK7Y=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -54,11 +54,11 @@
    "vendorHash": "sha256-GvnQrgczdnxpWCq8/vHcpcKeYf8v+GU/edx2CgPA/40="
  },
  "aminueza_minio": {
-    "hash": "sha256-snQZbGdHTY41aA6iK0PFO5SJ958xnsWPPLGv+H9uV2Y=",
+    "hash": "sha256-ey2+vFfa1sTc87XRSlEoV0OjuEVqs3fqZ+U+uwyKzZk=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v3.11.3",
+    "rev": "v3.11.4",
    "spdx": "AGPL-3.0",
    "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
  },
@ -181,11 +181,11 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "cloudamqp_cloudamqp": {
-    "hash": "sha256-h/QAHh5hpTtpyKcq6LqqJunN9+U2GIEpm8+yEeevHjM=",
+    "hash": "sha256-oKbLQhBtMsBby5ZcVrTIAwNFHshrGr3ujsvIgYdC0eU=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.38.0",
+    "rev": "v1.38.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-q942GCRd5czCdlpLYsXzj8Kt91GjCpyzhOkgWfkyHo8="
  },
@ -696,13 +696,13 @@
    "vendorHash": null
  },
  "hetznercloud_hcloud": {
-    "hash": "sha256-Y7W4pMH9wuiTasobEWtQOZNyeZ6MJKuegveZnlORxm0=",
+    "hash": "sha256-0udzwUrmIbcbWy8LZwLx3LevtNbFRbMW7JmGI/DdbAE=",
    "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
    "owner": "hetznercloud",
    "repo": "terraform-provider-hcloud",
-    "rev": "v1.54.0",
+    "rev": "v1.56.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jwDezL9gI6A9pCdD1CUgEOJT8dqVuPX/sFjTO4Jiqs4="
+    "vendorHash": "sha256-xkhOzwFpON6dzi/qdpBazfrpMfWSUwUWs8VXLSAsqaM="
  },
  "huaweicloud_huaweicloud": {
    "hash": "sha256-k0XUu+QyxTLGp+r+gBbHx1+wqVCC5Xy2D4fMqWTCMOo=",
@ -1309,11 +1309,11 @@
    "vendorHash": "sha256-9GjhP/Oh2HlVuMcuXFhS7MUmF3eS4qlUsW5XhugaK14="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-aBZukPo+T1GItIQLJhCRMcSMZxV71gw+HIjBN6pxtmA=",
+    "hash": "sha256-Y8U4dKsKc9EKlxadNOyDquPSQgbQX6Ebfo81nkVLvi0=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.34",
+    "rev": "v1.82.35",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1354,11 +1354,11 @@
    "vendorHash": "sha256-AlB9tC3KejgUAjjT2pY7Q2mTS/AV4QRusSnyPiOheXE="
  },
  "terraform-routeros_routeros": {
-    "hash": "sha256-X7HyHSVYNTOM1gPc9MEfs50o2pquKT8SbFXtVfQ44eQ=",
+    "hash": "sha256-Cg91s+EfooVymFNI4bTXqIAYHYjFVSMwMHagCa8VoJ0=",
    "homepage": "https://registry.terraform.io/providers/terraform-routeros/routeros",
    "owner": "terraform-routeros",
    "repo": "terraform-provider-routeros",
-    "rev": "v1.90.0",
+    "rev": "v1.91.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-AHl0rUuAASk+3qH0C1bRl8IgKWKY+g5rMhzf5/IHQIA="
  },
--- a/pkgs/build-support/fetchdarcs/nix-prefetch-darcs
+++ b/pkgs/build-support/fetchdarcs/nix-prefetch-darcs
@ -164,7 +164,7 @@ cat <<EOF
 	"repository": $(json_escape "$repository"),
 EOF
 if [ -n "$tag" ]; then cat <<EOF
-	"tag": "$(json_escape "$tag")",
+	"tag": $(json_escape "$tag"),
 EOF
 elif [ -n "$darcs_hash" ]; then cat <<EOF
 	"darcs-hash": $(json_escape "$darcs_hash"),
--- a/pkgs/by-name/_3/_3cpio/package.nix
+++ b/pkgs/by-name/_3/_3cpio/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "3cpio";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "bdrung";
    repo = "3cpio";
    tag = version;
-    hash = "sha256-TZw9IixZxQ00uFZw6RtAY4zWV22zuuaP6dAB4vkXwaM=";
+    hash = "sha256-NUOEeyYXAkQkUQuTQc+iIon0tuA5wAEZ6Q57iX++iB4=";
  };

-  cargoHash = "sha256-2IT5zdgUvzeYt81iwYssR/xEp03Qz6+Ll5u02y+R3qo=";
+  cargoHash = "sha256-wIGvEyB5DyCE62AxchW7ofrB53qOv4LM/VgpzEL+elc=";

  # Tests attempt to access arbitrary filepaths
  doCheck = false;
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2025-11-03";
+  version = "0-unstable-2025-11-10";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "aa23ab23e6847c77a39fe9e8ebc274ab87c391d7";
-    hash = "sha256-cSpqwzTT4Nx7PK7mLUF13w/JgPlfvRdqZW0EsuY1b8M=";
+    rev = "dce2f12c11bc335f686dddb4e1f0443c5d101dc7";
+    hash = "sha256-yUjuE6MFG8ETGyPwGqhVCzZ0y324DvplZbHTOD+RRKs=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@ -6,7 +6,7 @@
  pkg-config,
  anytype-heart,
  libsecret,
-  electron,
+  electron_37,
  makeDesktopItem,
  copyDesktopItems,
  commandLineArgs ? "",
@ -44,7 +44,7 @@ buildNpmPackage (finalAttrs: {

  npmFlags = [
    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron.headers}"
+    "--nodedir=${electron_37.headers}"
  ];

  patches = [
@ -87,7 +87,7 @@ buildNpmPackage (finalAttrs: {

    cp LICENSE.md $out/share

-    makeWrapper '${lib.getExe electron}' $out/bin/anytype \
+    makeWrapper '${lib.getExe electron_37}' $out/bin/anytype \
      --set-default ELECTRON_IS_DEV 0 \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
      --add-flags $out/lib/anytype/ \
--- a/pkgs/by-name/as/asciidoctorj/package.nix
+++ b/pkgs/by-name/as/asciidoctorj/package.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "asciidoctorj";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchzip {
    url = "mirror://maven/org/asciidoctor/asciidoctorj/${finalAttrs.version}/asciidoctorj-${finalAttrs.version}-bin.zip";
-    hash = "sha256-F4tmpdNS0PIoLpqV9gifJf2iQ/kX+cp3EssRyhzyOUw=";
+    hash = "sha256-LzmROgzHnUZaK6uKxMUoM9/3q1wmBDlU0THfOOdUgcY=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/as/assetripper/package.nix
+++ b/pkgs/by-name/as/assetripper/package.nix
@ -49,7 +49,7 @@ buildDotnetModule (finalAttrs: {
  '';

  # Patch some prebuilt libraries fetched via NuGet.
-  fixupPhase = ''
+  fixupPhase = lib.optionalString stdenv.hostPlatform.isLinux ''
    runHook preFixup

    autoPatchelf $out/lib/${finalAttrs.pname}/libnfd.so
--- a/pkgs/by-name/au/ausweiskopie/package.nix
+++ b/pkgs/by-name/au/ausweiskopie/package.nix
@ -5,7 +5,6 @@
  python3Packages,
  makeDesktopItem,
  copyDesktopItems,
-  desktopToDarwinBundle,
  enableModern ? true,
 }:

@ -21,10 +20,9 @@ python3Packages.buildPythonApplication rec {
    hash = "sha256-axy/cI5n2uvMKZ2Fkb0seFMRBKv6rpU01kgKSiQ10jE=";
  };

-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    copyDesktopItems
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
+  ];

  build-system = with python3Packages; [
    setuptools
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "automatic-timezoned";
-  version = "2.0.101";
+  version = "2.0.102";

  src = fetchFromGitHub {
    owner = "maxbrunet";
    repo = "automatic-timezoned";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-OiBFFXdaBYBSToEzWafxNLBC12J1f3mO7DMzKESRxSY=";
+    sha256 = "sha256-GErr38+e8HlpzHfI4pxLcDJJnpxKTlsMTFwIXXAL02c=";
  };

-  cargoHash = "sha256-vX7QGLPuU08KhAJUujgqtPmzW3Ji38W1YiEZ4KbI2mE=";
+  cargoHash = "sha256-Jex9im+vyLPjWtsuh0gpd6iILWICCE5jSzMXU/Oh3rw=";

  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/ba/baddns/package.nix
+++ b/pkgs/by-name/ba/baddns/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "baddns";
-  version = "1.11.236";
+  version = "1.12.294";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "blacklanternsecurity";
    repo = "baddns";
    tag = version;
-    hash = "sha256-GaUZ3WLIxACsdSe262Ie1R1m8K/5X2ILGs6PWm/poUI=";
+    hash = "sha256-HAVoCyI7yxCdAR4qq7yXJz3YxkPnhBdeXLJZmzZpwF4=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@ -28,18 +28,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.31.13";
+  version = "1.32.1";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IHc4tsEqXbxOLQXu75A3WtFqhv6NS0AlPsWt0pM8LdU=";
+    hash = "sha256-SY1dKFAlLHOyAGaBmqCMDM6pAHKByHEyTcv1EAHQBVU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-w8dcbaJBCsn02JFPXzhOj2Ozuti0Xkr6mssdZhYKEFs=";
+    hash = "sha256-LLodbtdUc8WGUkZmwiKrmjd7EaxkFP7QqEbLoESAKAQ=";
  };

  postPatch = ''
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.1.311";
+  version = "4.2.179";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-r7WPuxPlqcUQ937TcBBG93Uo9WCY1wnH3Jm2PWI9siU=";
+    hash = "sha256-tXfto291yfLv1jMJTfk2EHUqlNBvQGLSfgN97GIhmxs=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
--- a/pkgs/by-name/ca/cargo-edit/package.nix
+++ b/pkgs/by-name/ca/cargo-edit/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-edit";
-  version = "0.13.7";
+  version = "0.13.8";

  src = fetchFromGitHub {
    owner = "killercup";
    repo = "cargo-edit";
    rev = "v${version}";
-    hash = "sha256-doNQzXB+tW+5UI3PCuZo8aZErsXeafL6lldi/yXyBhs=";
+    hash = "sha256-+CWCWhdb7S4QSNAfzL2+YMTF7oKQvk18NSxSSTQtQBc=";
  };

-  cargoHash = "sha256-N3Q3rK9GsVf9mI9SFqF7lnU8CWxmueDCgBjP6n9dUoY=";
+  cargoHash = "sha256-D2klo0arp1Gv6y1a1lCM3Ht4nAirkao/Afu7FE3CTbg=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ce/cerberus/package.nix
+++ b/pkgs/by-name/ce/cerberus/package.nix
@ -12,13 +12,13 @@
 }:
 ocamlPackages.buildDunePackage rec {
  pname = "cerberus";
-  version = "0-unstable-2025-08-18";
+  version = "0-unstable-2025-11-09";

  src = fetchFromGitHub {
    owner = "rems-project";
    repo = "cerberus";
-    rev = "9eb2ce27adc4a45c69da347c660d9b5477d764a8";
-    hash = "sha256-++fCZvk4ee166eciipTQ8GId6DWrG6aonAzHpK/10f0=";
+    rev = "4a1896590a1808b6ec15967b79c544b0fcdbd76a";
+    hash = "sha256-M36dz6cQxU8b0H00Uvk6U0otWlkHJMP5CPQuCrbKncc=";
  };

  patches = [
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.0.36",
+  "version": "2.0.37",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.0.36",
+      "version": "2.0.37",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@ -7,14 +7,14 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.0.36";
+  version = "2.0.37";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-6tbbCaF1HIgdk1vpbgQnBKWghaKKphGIGZoXtmnhY2I=";
+    hash = "sha256-x4nHkwTE6qcB2PH+WPC0VyJTGeV6VTzeiiAsiQWChoo=";
  };

-  npmDepsHash = "sha256-hgIWGAXqT517B+v/M15acseSf9NJGeHk2G4gZozFssw=";
+  npmDepsHash = "sha256-CxhMbABjSEmW4srMjFOhe6YFj7OovrPkgjyOimGSUao=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
--- a/pkgs/by-name/da/dapr-cli/package.nix
+++ b/pkgs/by-name/da/dapr-cli/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "dapr-cli";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitHub {
    owner = "dapr";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-lDrVhY5dlaQe23WncUFpqsP7UuDgRPmMWrOlJezma/Y=";
+    hash = "sha256-WNihy2LkL7S5vD+lO5v+jtKNanCWc138y48QdlxKNFU=";
  };

  vendorHash = "sha256-UzZJ9mgMvewahYjhTOBC/HgIaxk312a7iqbS4D5O2VU=";
--- a/pkgs/by-name/da/davinci-resolve/package.nix
+++ b/pkgs/by-name/da/davinci-resolve/package.nix
@ -304,7 +304,6 @@ buildFHSEnv {
    license = licenses.unfree;
    maintainers = with maintainers; [
      amarshall
-      jshcmpbll
      orivej
      XBagon
    ];
--- a/pkgs/by-name/dg/dgraph/package.nix
+++ b/pkgs/by-name/dg/dgraph/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "dgraph";
-  version = "24.1.4";
+  version = "25.0.0";

  src = fetchFromGitHub {
    owner = "dgraph-io";
    repo = "dgraph";
    rev = "v${version}";
-    sha256 = "sha256-tvzX5pkaad/DrJkFIIjxAIJME9KHi/2KONw6fXcml18=";
+    sha256 = "sha256-8Lh/urzHGIepXQCXawNvJVe8IOzYs4huDOgw2m/oYiM=";
  };

-  vendorHash = "sha256-eOo2ihaabdhDRATIc5C4YEMBcA0Xl5xzBKW5GJhrTOA=";
+  vendorHash = "sha256-eArYiLfb8rsFGnPFAoRPQzONifNjds3lahIDRwqz/h0=";

  doCheck = false;

@ -48,12 +48,15 @@ buildGoModule rec {
    done
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://dgraph.io/";
    description = "Fast, Distributed Graph DB";
-    maintainers = with maintainers; [ sigma ];
+    maintainers = with lib.maintainers; [
+      sarahec
+      sigma
+    ];
    # Apache 2.0 because we use only build "oss"
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
    mainProgram = "dgraph";
  };
 }
--- a/pkgs/by-name/do/do-agent/package.nix
+++ b/pkgs/by-name/do/do-agent/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "do-agent";
-  version = "3.18.5";
+  version = "3.18.6";

  src = fetchFromGitHub {
    owner = "digitalocean";
    repo = "do-agent";
    rev = version;
-    sha256 = "sha256-Wc0VqBiIAQGtORdm0paAm9vnbThc+5seHXmpnYcyNh8=";
+    sha256 = "sha256-9JYDxHtrJn20QIcV4OHySzrwx9jRJyqx3WYfxoJX4Hw=";
  };

  ldflags = [
--- a/pkgs/by-name/do/dolfinx/package.nix
+++ b/pkgs/by-name/do/dolfinx/package.nix
@ -26,14 +26,14 @@ let
  );
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.10.0.post1";
+  version = "0.10.0.post2";
  pname = "dolfinx";

  src = fetchFromGitHub {
    owner = "fenics";
    repo = "dolfinx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZsaEcJdvsf3dxJ739/CU20+drjbAvuc/HkIGCfh9U5A=";
+    hash = "sha256-Q1dQkDU6kfP5LFS0UwPwsff2hcHLAa3ZOk/hG0gGAbs=";
  };

  preConfigure = ''
--- a/pkgs/by-name/e-/e-imzo/package.nix
+++ b/pkgs/by-name/e-/e-imzo/package.nix
@ -20,11 +20,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "e-imzo";
-  version = "4.73";
+  version = "5.00";

  src = fetchurl {
    url = "https://cdn.xinux.uz/e-imzo/E-IMZO-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-pkBpU0pyI1kmISNShhB17psLHmTZn3JdHbnRZCgLuGc==";
+    hash = "sha256-jPAZu98prkC4NQlfA8/kJuw9qdCrSSSyzySSWPlIXpY=";
  };

  installPhase = ''
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.216.0";
+  version = "0.217.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "eksctl";
    rev = version;
-    hash = "sha256-uHwBzX/85B2oKmB0N4+uNxYzeAJpKSJamgu9M7bB3fg=";
+    hash = "sha256-X7ffFnngJpp3Ki9kHLHC8FFKeBTK0OwpHRpePhXieLg=";
  };

-  vendorHash = "sha256-pELsbEy+VUkGXywJQpPNGL2o00BoO9OPnrS148gMRFA=";
+  vendorHash = "sha256-yokgbvTr65Z+tj9xVelz1cgPsNICQQfMVuRKAhEIq2E=";

  doCheck = false;

--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@ -15,6 +15,12 @@ let
  noPhoningHome = {
    disable_guests = true; # disable automatic guest account registration at matrix.org
  };
+  # Do not inherit jitsi-meet's knownVulnerabilities (libolm).
+  # https://github.com/NixOS/nixpkgs/pull/335753
+  # https://github.com/NixOS/nixpkgs/pull/334638
+  jitsi-meet-override = jitsi-meet.overrideAttrs (previousAttrs: {
+    meta = removeAttrs previousAttrs.meta [ "knownVulnerabilities" ];
+  });
 in
 stdenv.mkDerivation (
  finalAttrs:
@ -55,7 +61,7 @@ stdenv.mkDerivation (
      runHook preInstall

      cp -R webapp $out
-      cp ${jitsi-meet}/libs/external_api.min.js $out/jitsi_external_api.min.js
+      cp ${jitsi-meet-override}/libs/external_api.min.js $out/jitsi_external_api.min.js
      echo "${finalAttrs.version}" > "$out/version"
      jq -s '.[0] * $conf' "config.sample.json" --argjson "conf" '${builtins.toJSON noPhoningHome}' > "$out/config.json"

--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.54.0";
+  version = "2.55.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-HU+OqaLuepx89lSBwOTJYS5nq8d19AhzAaUXwlpEhUc=";
+    hash = "sha256-i9bTUVVQRrg3KNUGY5o2fZLy5+2urr8EGIsyBEEGHO8=";
  };

  outputs = [
--- a/pkgs/by-name/fn/fn-cli/package.nix
+++ b/pkgs/by-name/fn/fn-cli/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.45";
+  version = "0.6.46";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-iW59tennUgDfYhMGbzdLizo3u+bROWOGbeAl319lsHk=";
+    hash = "sha256-QEbOx7CLcBJbBNXHXs9LoSF7USbdC5eJ6IJrR2gKJys=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fr/frida-tools/package.nix
+++ b/pkgs/by-name/fr/frida-tools/package.nix
@ -6,12 +6,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "frida-tools";
-  version = "14.4.5";
+  version = "14.5.0";
  format = "pyproject";

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sId91KB2qLasJHsfrS6Nfqctn0kCPS6ieNwtfheai8M=";
+    inherit version;
+    pname = "frida_tools";
+    hash = "sha256-Wdjx0NDGojpaycHcgXp+UiBsiAoR3V3UaWw9948HWZ0=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "gemini-cli-bin";
-  version = "0.11.3";
+  version = "0.13.0";

  src = fetchurl {
    url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-JReB8+4+Pnbo8XsLGmcZ0xKjuFHeRC3e5uuhGOM/06I=";
+    hash = "sha256-P3haGRJrdELTPxKuaMrn/AmOAPH08R9nqNw2pwmEd+0=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ge/gersemi/package.nix
+++ b/pkgs/by-name/ge/gersemi/package.nix
@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gersemi";
-  version = "0.22.3";
+  version = "0.23.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "BlankSpruce";
    repo = "gersemi";
    tag = version;
-    hash = "sha256-B45+j53p61+LTAw7C1h+9icc27zhoYittdxn7iDmZCo=";
+    hash = "sha256-mAScW+OLHSN5idHk/Kd909sOJDBUAe2Vi55kdhTtlzQ=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/gf/gf/package.nix
+++ b/pkgs/by-name/gf/gf/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation {
  pname = "gf";
-  version = "0-unstable-2025-10-05";
+  version = "0-unstable-2025-11-09";

  src = fetchFromGitHub {
    repo = "gf";
    owner = "nakst";
-    rev = "1c988881798263c58ead08bb74b14b6861853c64";
-    hash = "sha256-EodC+kxfyNdW9r9DiX1SwiyOUbv1wBfiftMm7m4BFLI=";
+    rev = "64e7ece68a61d90db0dcc11a6d6eecab04af8561";
+    hash = "sha256-BvPgBJ/2pEoe4hIgqYi5JXI0ihOJkc/pXAJK/Kf9lVg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gi/git-repo/package.nix
+++ b/pkgs/by-name/gi/git-repo/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.58";
+  version = "2.59";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    hash = "sha256-s82v5+m+wpLEWMQiqfLegleTEs/KDzaqHGM7hn+/7fk=";
+    hash = "sha256-5ffk5B4ZA/Wy2bQNahFaXPFRSZdKz5t6TaGbN00mfxo=";
  };

  # Fix 'NameError: name 'ssl' is not defined'
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@ -61,5 +61,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
      asl20
    ];
    maintainers = with lib.maintainers; [ syberant ];
+    # NB: `ein` is also provided by this package, but `nix run
+    # nixpkgs#gitoxide` doesn't work at all without this set.
+    mainProgram = "gix";
  };
 })
--- a/pkgs/by-name/gr/grafana-kiosk/package.nix
+++ b/pkgs/by-name/gr/grafana-kiosk/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "grafana-kiosk";
-  version = "1.0.9";
+  version = "1.0.10";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "grafana-kiosk";
    rev = "v${version}";
-    hash = "sha256-kh62qGMVHNTssQMEBwLaEW0tRtP3iWMrxXeQU+fe+44=";
+    hash = "sha256-dp+yKpPm11/LfRXjgFZrDAwstnz6vALJBANBqwlEXFo=";
  };

-  vendorHash = "sha256-LZLmXGPYvNR4meqen0h0UHj62392hfPs9BLNK+X6sKA=";
+  vendorHash = "sha256-3ctFiBgR7Lzhy7M3USWD3mv6FZ6cSfdjHhtOVFNLQag=";

  nativeBuildInputs = [ makeWrapper ];
  postFixup = ''
--- a/pkgs/by-name/ha/haruna/package.nix
+++ b/pkgs/by-name/ha/haruna/package.nix
@ -34,7 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
    kdePackages.breeze
    kdePackages.qqc2-desktop-style
    yt-dlp
-
    ffmpeg-headless
    kdsingleapplication
    libass
@ -49,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
    kdePackages.kxmlgui
    kdePackages.kdoctools
    kdePackages.mpvqt
+    kdePackages.kitemmodels
    qt6.qtbase
  ];

--- a/pkgs/by-name/io/iosevka-bin/package.nix
+++ b/pkgs/by-name/io/iosevka-bin/package.nix
@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "33.3.3";
+  version = "33.3.4";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/PkgTTC-${name}-${version}.zip";
--- a/pkgs/by-name/io/iosevka-bin/variants.nix
+++ b/pkgs/by-name/io/iosevka-bin/variants.nix
@ -1,93 +1,93 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  Iosevka = "1ml8abhvb6jishi3a2q3ysd5zj0153697wypzjkj5hzxwmx6r7nv";
-  IosevkaAile = "13m46frkmczcn94dx27gamf4jwnqlngqrk5bxmfxzn56pzyavpyh";
-  IosevkaCurly = "0i97zbfidqvzgxi6pr7qc50y5g740d4hgbg2fyjdiiyacp1a4bpq";
-  IosevkaCurlySlab = "1rp3z7083adc9l5cxwygc4ln58z6iy79hxbbf1lqmfi9p6vjgq97";
-  IosevkaEtoile = "1cc3kwq4skd5gg420l1599hzaxhs3fh33jwsrh4fclrqbhhsgdb9";
-  IosevkaSlab = "1q0bgz7a3jn59sjdaql13ij9sa3qbxcjnhnfvc9fb3v6vaxlhqmi";
-  IosevkaSS01 = "0fsbiisllg673359xfxn1izhcnhkdsfp2h6n7y58la692i967vjm";
-  IosevkaSS02 = "1wc1hcsmf6yl99rjk3ncmn7dbnylids68l21i21dfj4k13x6mvyi";
-  IosevkaSS03 = "125m32asdvdfks08dangmv86phkf0if4in6050klf45a7q9818ad";
-  IosevkaSS04 = "0m10d5l88dnsaxcb959g6g17kzrxh91hk083ip5mxq1wjrx1bcfq";
-  IosevkaSS05 = "0q34293px1gj9jgh810mhgidcf7lj2vdvdn48ljq9hg4ni7yvzn8";
-  IosevkaSS06 = "067pz09b9iminj2960qdqipaxgaawxnbxzndi1gw33kpl5lgrjak";
-  IosevkaSS07 = "1f078l8vxcyb6lbf1ywf3s4s0bdrni4my6n70m77vi7vgawvfwz0";
-  IosevkaSS08 = "0mk0il1c4h06xvgxgaqh2z79m7k286smjs4swl09skqjab3nmssx";
-  IosevkaSS09 = "1pcwbi6ajy4i0likmdfgs9c4nwa852fsz9cmcjw12dmf0zirv7cn";
-  IosevkaSS10 = "1lv58ypcz1d4azz9m9xnbw2n6l5fs67kyx5zrh5mqd51qcigr1bx";
-  IosevkaSS11 = "1w37535g96js8iy5r3s6xaz0mjjivv06rdazaxdx0j4frh743lng";
-  IosevkaSS12 = "1p9lwdbngpsm4a7viz04137ckbpimknznibln39sscykc6j93lqx";
-  IosevkaSS13 = "0p1ffg507xcclwp117ikjzbkixlh95a21l7mmpd9cnckdvj1xz45";
-  IosevkaSS14 = "1dcikdxbbr82amzhwn310qkzx95h4dprxw5rwlgn8wcvx9pk96sc";
-  IosevkaSS15 = "0lsgkc1qz4f1rqhasvadjl90qwyf2hxz2d0svwmig7q91jaii4nz";
-  IosevkaSS16 = "1a6k40i1p1l94fwr4mi2m82rspjc9l93vxilgla1kpqm40bsspng";
-  IosevkaSS17 = "0v9zvi8d0ll0kdryjjglf6m1a53hjnsj73bcdaxyprni5f88qpvy";
-  IosevkaSS18 = "0g8b6drc98l08zdp4by7c4zr6c5rkaxsplbm1csyhcrpaxc43r71";
-  SGr-Iosevka = "0g5lklzmyhpych8hkx4ssa3iir7dscc8q1jbzpfsla36r5sf91jl";
-  SGr-IosevkaCurly = "1h3vgshs6l92l8r87kji7ln6ncq36iwrf439vzzramb34izy8ixr";
-  SGr-IosevkaCurlySlab = "0rsl1f9bc1hhy3wzbq5ls6vkc0y0qaw5yb67i7rda5xv50m8bqxi";
-  SGr-IosevkaFixed = "0s6d7kprgrkmdwklzhv0hz85y9w5lgrwc5mams21akmnchjqrgzf";
-  SGr-IosevkaFixedCurly = "0q5n1axnpl5p51lg4zrarsjn5aglb5s0axn9qp7ddh5gxv2n0knq";
-  SGr-IosevkaFixedCurlySlab = "04pn89y4jpgdllk0xziigjf2p8836a6zmwvzkix2kqsmbvpjj4kn";
-  SGr-IosevkaFixedSlab = "1zm06h0z43j31qzd6ndgamr3r5b9av5qcp39sr16fxr8hhnjrqhn";
-  SGr-IosevkaFixedSS01 = "0jkv4f529y934il9qzdaav8acqqgnrgf4anf6zcgx52zrzgrkg0x";
-  SGr-IosevkaFixedSS02 = "1zkibhlsfyhxbi84dwc6w90n2p8w6zwkszk1z5a3db6lyz824z88";
-  SGr-IosevkaFixedSS03 = "15r5q0bg2109z52nwygr85vx3svg6q3j26q0y0syxnrxq4iksdg7";
-  SGr-IosevkaFixedSS04 = "0bhgd1mmsdlcwp3nz7wf992g75zwkp625xc7fbqwsrpd81111566";
-  SGr-IosevkaFixedSS05 = "1nmhs4ya6bm2j4bq5jz3m5r7gbwd4i16m3zsblvif1lb6flb89dj";
-  SGr-IosevkaFixedSS06 = "0a1wxqlm8fchbg68vzwac7p8nvx8hiy565qcqjjs73m33bpp00zj";
-  SGr-IosevkaFixedSS07 = "0s1jh060hkbb7idqzgvc3f6czfhdkiw8ylmyjfa3vh851lpnxym2";
-  SGr-IosevkaFixedSS08 = "0ncdhg8cha9imy6bb72p39bvadzmdrncr2p0di80yfiimdbcfbp4";
-  SGr-IosevkaFixedSS09 = "1wl0bf1phhjzw988r7v3fprb4ljwikpkn7yvs8hskmgi3fkvji9q";
-  SGr-IosevkaFixedSS10 = "08cr4zkfjrnj3105kj70dswaf8zjdhzbjwyav0x054s32j4yrs54";
-  SGr-IosevkaFixedSS11 = "0vgx6zycbqcnrar537ym7ra949q0f8zvrmb1d823rfavy0zkpv9q";
-  SGr-IosevkaFixedSS12 = "0jw73v1bci7w2z5354cfwqgxd3r56fa03i7mr19y6y8pi9i5l9yn";
-  SGr-IosevkaFixedSS13 = "1dy29fhjncsxgsqfyz091qssps4a6xbr27157bawvjn4nlm12cab";
-  SGr-IosevkaFixedSS14 = "047ql1fqsv98mp7ihg1r71y90qjk0sgkygjs79b20smzvzapcs7g";
-  SGr-IosevkaFixedSS15 = "14njl7x94yicb7nzjsv0j8h8f4ikawn01899pccr617mf3xxyap4";
-  SGr-IosevkaFixedSS16 = "14p00n6gw7fwqxdwrz2lxrjkicw1mk1qk8z5mazr45s5pq9sz7wf";
-  SGr-IosevkaFixedSS17 = "0gca50g55csx86wksa1ch1ay2chzj4p11dmhsf4pf4jyq3ziihw8";
-  SGr-IosevkaFixedSS18 = "18q8sjnz9dfv7whjjm4a6cqm8ffwz46bkwna8giqsplhyca1c9sd";
-  SGr-IosevkaSlab = "176pr90h53hf1cbgwaqbdd11pd5d3p14d5lll057dlmws63lhk71";
-  SGr-IosevkaSS01 = "05fwnmziyas7l53sywi6g39pdi6jpnalw35gjl3dvyp93jk5f9sn";
-  SGr-IosevkaSS02 = "00cyqsng2izf1cjkmz1pf2h1h17ph69f0nz38n9jlynsffp2rkv8";
-  SGr-IosevkaSS03 = "0xg4kss5kvl7ihzvdq9gcv869x8nr8ds8hw5lrvqx2010pfvzksc";
-  SGr-IosevkaSS04 = "0mpzyj404081in6ymgajcyy2ips6d12k9ng00cw92v7shjpz6cqh";
-  SGr-IosevkaSS05 = "1kzw92nb7wxrjfhp0cf29xny86ga6libsfy2pzdc7hs499f0fsss";
-  SGr-IosevkaSS06 = "12qw1grnwq8lgdgz25vx0pcdyd5zgwln99w8cafrl6y3ckrasnrx";
-  SGr-IosevkaSS07 = "0fjdnf0lr0kfbfddc1ar4wj2if9xsyqlp4cl2gmczy5b3zkmmhrn";
-  SGr-IosevkaSS08 = "1v7crn5i2v12dh8b34hbm418zxyc8xhh3bnbfgif3v36885rxd8g";
-  SGr-IosevkaSS09 = "0jipz18pgncwfb75c1bb6bh5ar33q8kk579l6zyvqm39w2ik98f6";
-  SGr-IosevkaSS10 = "0c1w2kgy4gk3a3979x47d5hjg19bbam3s4hzd0wyal1wn9m98xl6";
-  SGr-IosevkaSS11 = "1sqagzb28xbkpn30s24ydf2da8n2dvsqzfvkbc3p1469jihzfviq";
-  SGr-IosevkaSS12 = "1n1d85drb3m0f8cnrcqxh1la7y75z3a2k9af8q6z48843ddx4qmg";
-  SGr-IosevkaSS13 = "1ynr47avzywrpf5zdjwmpybs6kf71pmjbrvlssx60z6b4hc0w42i";
-  SGr-IosevkaSS14 = "0r87wlvrd7xgcsibymmdkwd0pqbf5wn2c7mcssqwi3zwxpi12s83";
-  SGr-IosevkaSS15 = "03av6w7x4w00hxyhmz1qp00aj5b47qkma666y3c7ylsfql2b5ybh";
-  SGr-IosevkaSS16 = "01m5sz7lid4v68v8vagyj6zd61hs969lc4igf48a4jz0ip9367sl";
-  SGr-IosevkaSS17 = "0rl4g8iv8hz25ns52zb2n2ymcf2l26dhza1glp79l9swk3xgvpx2";
-  SGr-IosevkaSS18 = "0zyjl2x8i8d5m4ymm6sa5nm3916nwykh718k02aii2gl2p33faqs";
-  SGr-IosevkaTerm = "0rkvwizyr3bhkm518kq57n7n3rygvbgjahi9r5nm6jhyvjjf85d6";
-  SGr-IosevkaTermCurly = "041xhkw4b379zkwbcbmsg7d0w434dy48ppmgpy5gxaa4fzxvfihl";
-  SGr-IosevkaTermCurlySlab = "0kc62bllcrzmlj2ynzk3n1z3znhlsbsy0pwnfjx80zbirnj19dwh";
-  SGr-IosevkaTermSlab = "00l8hzhsrqrsp8izh4mzg2gvzzpd54psn15v3fgc1bs1c84wgxw5";
-  SGr-IosevkaTermSS01 = "0mifbc9vm8yassfp5r5bv8a7jxq14dpnbby09dbfdg3273yx1dv9";
-  SGr-IosevkaTermSS02 = "0ami4zdg0cpgszp8c5xary6crfhx3vx3bdcbvnsmzr5zbaf189fi";
-  SGr-IosevkaTermSS03 = "1yfd99sb3y469qzszrgfdd3m6m6rg49kv5l2swf4yijr1zmb5wfa";
-  SGr-IosevkaTermSS04 = "14ccwjilzrrzikhaj5rnarvw9y78m4d8w7817akg4wg2gh5jsxvr";
-  SGr-IosevkaTermSS05 = "1byaypapwq1zai701sq8qyxp9sb4b62jjin9vgzqcchdy32gnr38";
-  SGr-IosevkaTermSS06 = "0qcwpw10qn34awv0w43xg3l81w3cn949hcsci8802layrwq7lfas";
-  SGr-IosevkaTermSS07 = "0nyrg2fqc6828mq72lhkjn8hdv5s5r5931y38wdriy81yl5lqm9j";
-  SGr-IosevkaTermSS08 = "02mjjz04pqyvaiwm5wsr7h3r2la3wfsi8nnq1njgbaglp25hx6f1";
-  SGr-IosevkaTermSS09 = "07w12z244iaic5cpqkxl20ya03pnirjh9n5yy30r6wx79d1p7q57";
-  SGr-IosevkaTermSS10 = "19w59qs3p5ww7bg5a0k9f6065311ngj583mx9xb8aawc2v9hrhjr";
-  SGr-IosevkaTermSS11 = "10l4sk924w94pah96xipwhqi6x43j62k75ng4lsy0rw3lbs9lyvk";
-  SGr-IosevkaTermSS12 = "018m8wwxip1l5argplcim513zvwrihdl7xbz5i8hsmjjvia225v6";
-  SGr-IosevkaTermSS13 = "1b7nca31yj0vc2j4h804wlllpzjjphnh1bfgv6zcgvd4qmpk4qna";
-  SGr-IosevkaTermSS14 = "1pqrsvnnqb86300hkil4x093r9ybrkpdxvhcp56ph4pshijypb08";
-  SGr-IosevkaTermSS15 = "0inrfcrajmlqxzm87l4l4myrz4bw4wz7y79ibwcjqa0f395jlms3";
-  SGr-IosevkaTermSS16 = "13w9j3sp1lg9wrsj9n5bf3cm38rkkjifk5kqbrkpg9p98k4lfsx5";
-  SGr-IosevkaTermSS17 = "0gcf73bs21phvrjg083l61s37glqvwzckm03gndbqyw7a64k9fdc";
-  SGr-IosevkaTermSS18 = "1aa8hy10wa4zgyrzsnmx4rkbrjjqv56nd4prijdn50qbc5qfw18a";
+  Iosevka = "0jjh5mp23cbvia3mrvmjpvkfzg5i6wwzlfx2i474jr72vn0bh09m";
+  IosevkaAile = "07n0g0vb8fjay20ixrklsl7fmr3p2cl2x0x22ckb9z336w6mpnxv";
+  IosevkaCurly = "0r4ab15j4wa82kbarilxjmzhcc035jkglf1w1vjpawjc2izrq5lx";
+  IosevkaCurlySlab = "14vsixyw4gfq40l58drr8w17vja3k898520zfiabgs70r8d44kd3";
+  IosevkaEtoile = "0kaykx4i8ij6q5csz72r4pi107lf31q8mbgqw2ycgl4cr4k694fp";
+  IosevkaSlab = "0whxy6pxmm96lvmh3rln1jzynkxf02b1afzvb8md7dl795znddks";
+  IosevkaSS01 = "0rdfwa2773i1wrwhvy3spz4c7p0h229zdpjc41ara2lxbibkfzn9";
+  IosevkaSS02 = "17f02yqcnkqq6jfi95vcp92p3y8p5zxm2r9cgb05pr7xpwxhbpss";
+  IosevkaSS03 = "1rns4x777lsxshr6i7xmrcl65si5ppsmjm34dsqx9f5i1v2lx7nr";
+  IosevkaSS04 = "0m13vyrfzpzppakqdazgklpxhi49hcsiwbdi7b21zj5nkq09mm7l";
+  IosevkaSS05 = "1l2l81vvwa62zqrhz4f0xsiqgvkx8g4vx5w1h856gqanj9mxhyy4";
+  IosevkaSS06 = "1j8q3fximf9acz5br03frnhzfj24zh6iq94s6ywwgjsghb25xf3i";
+  IosevkaSS07 = "0q84a4dm6kx18yr17mds60vfp3s89xcp9c9gjjsbx5bw5gc0260n";
+  IosevkaSS08 = "0r5jvmzp61nj8fxbwismkrz414y816hchp3v8asyc7631g00lc3v";
+  IosevkaSS09 = "0n7sm4sa1v79bv7kn6nkl2r70p63qa3r9fjaaz6x88dmrwbqdswr";
+  IosevkaSS10 = "0sw6c3lakcc898shybkpmdwkzc09ia2x5fa9ycv0ffshyig1br2z";
+  IosevkaSS11 = "02dsh5rn2ixcrxrna2rl295flv2pa6w4ncsgzphzqmhmi2ks615p";
+  IosevkaSS12 = "1s4v4x951770fy1v8m8mpnnpna0w2p56pcfd99raf14icq70q4q6";
+  IosevkaSS13 = "0qxwbvh9ahzi5bgixy3fk1mqqaxylm001095laa5z2ijscxz9rk3";
+  IosevkaSS14 = "02r8bzw5dsj7qkwrahp4fqb8n7chdxx64qk2d1wwh0065151iis5";
+  IosevkaSS15 = "03vig7c3m7z47nki0p87rjnn79y54gh3ifhw91lmnkkvc2qa9l9c";
+  IosevkaSS16 = "1af0x7adknav0mj9w1c0hrjy989dk6dfxz097400mbmhhj838azh";
+  IosevkaSS17 = "1pzfcfdjpbinh32ph0aq5x1l0nz634vi3vsmcrqyip3kpfpyzjj3";
+  IosevkaSS18 = "0mwdxmmdq8779nrk5iw17235sbn82cfam45nkkgmrmsxyzin54my";
+  SGr-Iosevka = "0q135jighn5a4nxbcwfr8y60qmvrhhwi5f8bqs99f7i46145n932";
+  SGr-IosevkaCurly = "000aw2w8m07b2ilylyxh04ki827a81pn22wmvynfiilkd5gzqnw9";
+  SGr-IosevkaCurlySlab = "1aaq5acvjg5z721z7cy4c9wjl3417f8hlqn71g2pk7jdb0lbknv2";
+  SGr-IosevkaFixed = "1ghp8yihfc8gmyyls7f70xnqjq08wsf0f3xvg7jbg1s71rjdlvjd";
+  SGr-IosevkaFixedCurly = "0724k2yg5zilzz6fqaxsjxw8yjyipr6pc6g8znjn1c7bx9g3xqyq";
+  SGr-IosevkaFixedCurlySlab = "04w9czw10y04jaylxij1rkh3n6pcj1rylr3xj1aqkq0pn7x2y79s";
+  SGr-IosevkaFixedSlab = "0qpsy942dmh8hwfx7ykxpz27hnv21ybrp1v2hqcpjig1da5wsw72";
+  SGr-IosevkaFixedSS01 = "0ia8j5r2z34mgdx2rlk8i9pfk7mmpdhgp66qv1dks0kwvf8q5mkl";
+  SGr-IosevkaFixedSS02 = "0ahhrzavzpi3q2g640ac0s62r3lvx4gn675pq97r7kzjgfp8034f";
+  SGr-IosevkaFixedSS03 = "16hdzpjzkq7m2df3avjk8kj0akrv8ds7lak8a9v78invhwkd2hn2";
+  SGr-IosevkaFixedSS04 = "1iyl6acrly2rg4dzbvsznkkv9llcb2fdlr0mfhhj6snnvfnfcf8i";
+  SGr-IosevkaFixedSS05 = "1cphajcy21yigwy5g1lc9f5d9y1fmrppql0d62vhvcjkr1mdzq1z";
+  SGr-IosevkaFixedSS06 = "1k0kaihvm4fmfdq8vdvaadjsajd3sfky8g1ddd6vp57ra4s5jpbr";
+  SGr-IosevkaFixedSS07 = "0xg26a4n29lji0nbhsxzkkazarcvwahv8p6cz0c7nxz6am57lld1";
+  SGr-IosevkaFixedSS08 = "0h14y3m3w8g6vwl71d5wmkj8qahrkzavca9v0nhf52xq5chmn1rq";
+  SGr-IosevkaFixedSS09 = "17f7smhy85fj5wnkxg2sm65csgyhb4l4yvj8m3b5zgm3pqk5b68q";
+  SGr-IosevkaFixedSS10 = "1hz7rgp1b4r8kwwsx1lcvnx5layni88m57z9dcgz1gbipz0133bk";
+  SGr-IosevkaFixedSS11 = "1nzp0880vmjmcjmq06a16gkgy4jyd681ip93qqxn46rxmc822dc6";
+  SGr-IosevkaFixedSS12 = "0ipyy7c7f8siq4s03inrvl8m6das84az09lsmi0zpdqk403xszin";
+  SGr-IosevkaFixedSS13 = "1y49hhvz759g54c4sci75pljz9c65qhl6slyr6xkrpnr31c5g06y";
+  SGr-IosevkaFixedSS14 = "0r6y1mk43ax2qyla44phknnwvzj4k5lckmrm8wf27myk3fs332wj";
+  SGr-IosevkaFixedSS15 = "1cihz4rljjxrn11l283ivgy28xmrzixc3gc6s7mm2v05d40ixhyi";
+  SGr-IosevkaFixedSS16 = "0iihsqz1bm6s0isydpygqckh58qwwvkkp0yd75cd4w1fwfmb69h9";
+  SGr-IosevkaFixedSS17 = "1xqk39nygyxxmgffl9vv3251qf5ghl28gh03x0bs0zhgwkhcwck4";
+  SGr-IosevkaFixedSS18 = "130fk2mfn05102h7ch0xzrkf7sv6jr9z45ina05cld1y9d3ycmhr";
+  SGr-IosevkaSlab = "14f9snc4iji7vffsmghnr9b3g759sxlsq43526jd2rqxd3j4nzb8";
+  SGr-IosevkaSS01 = "1nwbp2gi6d1aqncnpi65f8r8f7g52qn1jai1hvfm0jp0ks1hi5w4";
+  SGr-IosevkaSS02 = "0r2sx5z7hj6x2b2gppz6b6g13h2rv3vpba5mh36sgdn71l5scy4b";
+  SGr-IosevkaSS03 = "16a38j2hz02rymf6a7wv07b6bi8kmyv9ffmqa48v4gmp3lvfh2dx";
+  SGr-IosevkaSS04 = "0hv1j3z6ygk0gzz6iz0ry09ixsaj42r0nlldj40w89sxg9v1cflf";
+  SGr-IosevkaSS05 = "0jjnbgznykfpbqk9gmklg4rp9aq1b89c94fxjgvmgj3h53y0fp1g";
+  SGr-IosevkaSS06 = "07wzw907n9jmfll4xbpq31wbsdvq84s44q7jv9v2wbsz94kifwxv";
+  SGr-IosevkaSS07 = "1znd0brxym2rb5cfsavf1rw11nbzwc62vbxjsxf3kq5ihr1898h7";
+  SGr-IosevkaSS08 = "15bjxqf9jndxnrzg1gn0j5rrpxca5s5jp81j6lq7yka3xzx7c0q4";
+  SGr-IosevkaSS09 = "08i8gqb7k2k1cipmf2k4zk0mp4cykf8g4prhvbcx8ycja5pa5sqi";
+  SGr-IosevkaSS10 = "1x2cx5pnxh1smgs7niqmyd2iqfghdqkcrl2vq1pxmk8r9rcvh9js";
+  SGr-IosevkaSS11 = "1249h0kdfnp4hsxgih5ww52phb800wrslzlzd6j12n7raqv81yx0";
+  SGr-IosevkaSS12 = "1dshykbsq4d0hfl2cys6m0sdxx06g4lbsv7ypq15rvlry240qj2h";
+  SGr-IosevkaSS13 = "0kh5rczvq8bm2gwc3ydy56adbk065r599nl5x57scyyz6awsndyv";
+  SGr-IosevkaSS14 = "1lbzdxsx6wla19ha9hiv4jk6x4gc5xs9pshqdzni9248mi7c4zr0";
+  SGr-IosevkaSS15 = "0hpprlkapagmiwbl6pm8wl4c092n4c3ands01vb1q7jf6ck37iaz";
+  SGr-IosevkaSS16 = "1inhaiw3vp0z3aisivi1hg3ckb6a2rfs4kn5hck3mwhpmfpws6s9";
+  SGr-IosevkaSS17 = "02g2sb0iqclw4v6j9jlxsgrhanl4jrydw8f9cvzmqbw7wdnfvalh";
+  SGr-IosevkaSS18 = "06myf35ahcadwi0abhbm0y8cn4jb814sjagi3j8fagn3vb7bckci";
+  SGr-IosevkaTerm = "1s2xwgjdmwamgf6yyz3bj749rql2i7yncgkp7an44zr93rpc1vjh";
+  SGr-IosevkaTermCurly = "1yv113mq7d7l9jda6zlzdj2pghp2zbsfdvhw54bxvs0kww985ni0";
+  SGr-IosevkaTermCurlySlab = "00r6jqdli66qsfldpx2l67bxhayf8s71ki4mdyplbbh9ln6983n6";
+  SGr-IosevkaTermSlab = "11ixxpkicrxw1vjz67khp5rc6gk9p5ckcs1a7r1qk91aakqx14r4";
+  SGr-IosevkaTermSS01 = "1gvjgq2x259mb05raqf8qjpz2lbjp9xnvxhihwmwi12jiq9sxw3c";
+  SGr-IosevkaTermSS02 = "04w716r0xr3xmkxckn2prv8gnqhks3p75zyrnmiqlcghy0gcbzwr";
+  SGr-IosevkaTermSS03 = "04y7wj1pwpw9xpwsc1c964pq94sx1gjv8jps5p00dynhg65p24m7";
+  SGr-IosevkaTermSS04 = "17skw1p81mqvy2mf4sf6ap8n1sp6g1a63pmz84sar4bgpq1zqq8h";
+  SGr-IosevkaTermSS05 = "17iwkv3pdsrfwm4vpw5yq5h0p4axir1mis8rslkj7gd7sxjks758";
+  SGr-IosevkaTermSS06 = "0cl187wd90ajgyjl4v7j824mqsckbz7i9w2l4zdi3a7861whd7vj";
+  SGr-IosevkaTermSS07 = "0cvw2y0880v19p38bpp497kyap28a8fi7wzv8lnbw60nh3s15vyx";
+  SGr-IosevkaTermSS08 = "046njfjx4lp4fy2cy9r04y2hcqvkx6npqvfcm726h1xs5zlvd6qs";
+  SGr-IosevkaTermSS09 = "08zfz0wj84myc0kgzlcqw3b33gak4099286p5xgdxd7xhgk90bkb";
+  SGr-IosevkaTermSS10 = "1sx4hrsn9y19n2fs48mpnrrj02p5m3ij3qinlg1hygy166n6qq77";
+  SGr-IosevkaTermSS11 = "1wpyggy5pkq0w9clhilri7igbg7zzf6w2c6d6yllwlk060998vm6";
+  SGr-IosevkaTermSS12 = "074chz4xnj537igxf0a1zms3vpm77qx3i5i76s9gvp3i6npa65sm";
+  SGr-IosevkaTermSS13 = "0vz6lfzxz148jjw6m4s4h75ffynzi5r8963cqswqydma9bmkqjxa";
+  SGr-IosevkaTermSS14 = "1an5pxaa2zbdczjacp41v15an979lagws8mlc86xrn4ldjk2wdmx";
+  SGr-IosevkaTermSS15 = "1y6f28gayijj7vflna6p0wrminy8d9dlay1ri38zr2lrnhlazl7r";
+  SGr-IosevkaTermSS16 = "1cgrjfxwp7vwi1klhsiskcwwdwnxmz6iwhglnbxa1kwax9qphwm8";
+  SGr-IosevkaTermSS17 = "0j9fikrfirb62mq35as6cyvhx5m3wgpv1byzjbcsmanxmn6n53dx";
+  SGr-IosevkaTermSS18 = "0h0q9ig2xcy1kb6afgdqfbpc743czhpqdx3xd8rmyxj4yggp6kxs";
 }
--- a/pkgs/by-name/is/isle-portable/package.nix
+++ b/pkgs/by-name/is/isle-portable/package.nix
@ -29,13 +29,13 @@
 stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;
  name = "isle-portable";
-  version = "0-unstable-2025-11-03";
+  version = "0-unstable-2025-11-10";

  src = fetchFromGitHub {
    owner = "isledecomp";
    repo = "isle-portable";
-    rev = "d6aaa6b9daf3dd2a858ec127bbb14099bb3886b4";
-    hash = "sha256-azNB3oVQl4yxr4LG0NUY8XomWphlizpf6bqmfcrMqsw=";
+    rev = "39d2f52987b4c511158fa77748f72bb0c7301970";
+    hash = "sha256-Ds45zDRPNuVWi7AdjzZEZYWaZH2z4LwT/xqAnvMSX5U=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/is/ispc/package.nix
+++ b/pkgs/by-name/is/ispc/package.nix
@ -19,15 +19,15 @@
      [ "sse2-i32x4" ],
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ispc";
  version = "1.28.2";

  src = fetchFromGitHub {
    owner = "ispc";
    repo = "ispc";
-    rev = "v${version}";
-    sha256 = "sha256-dmpOvJ5dVhjGKpJ9xw/lXbvk2FgLv2vjzmUExUfLRmo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dmpOvJ5dVhjGKpJ9xw/lXbvk2FgLv2vjzmUExUfLRmo=";
  };

  nativeBuildInputs = [
@ -48,12 +48,21 @@ stdenv.mkDerivation rec {
    ncurses
  ];

-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace CURSES_CURSES_LIBRARY CURSES_NCURSES_LIBRARY
-    substituteInPlace cmake/GenerateBuiltins.cmake \
-      --replace 'bit 32 64' 'bit 64'
-  '';
+  postPatch =
+    # Workaround for LLVM version mismatch: the build uses libcxx 19 (from darwin
+    # stdenv), while LLVM 21 is provided as a runtime dependency.
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace src/util.cpp \
+        --replace-fail "#ifdef _LIBCPP_VERSION" "#if FALSE"
+    ''
+    # These tests fail on x86_64-darwin, see ispc/ispc#{3529, 3623}
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
+      substituteInPlace tests/func-tests/round-float16-uniform.ispc \
+        --replace-fail "// See issue #3529" "// rule: skip on OS=mac"
+
+      substituteInPlace tests/func-tests/round-float16-varying.ispc \
+        --replace-fail "// See issue #3529" "// rule: skip on OS=mac"
+    '';

  inherit testedTargets;

@ -79,39 +88,33 @@ stdenv.mkDerivation rec {
  '';

  cmakeFlags = [
-    "-DFILE_CHECK_EXECUTABLE=${llvmPackages.llvm}/bin/FileCheck"
-    "-DLLVM_AS_EXECUTABLE=${llvmPackages.llvm}/bin/llvm-as"
-    "-DLLVM_CONFIG_EXECUTABLE=${llvmPackages.llvm.dev}/bin/llvm-config"
-    "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
-    "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
-    "-DISPC_INCLUDE_EXAMPLES=OFF"
-    "-DISPC_INCLUDE_UTILS=OFF"
-    (
-      "-DARM_ENABLED="
-      + (if stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32 then "TRUE" else "FALSE")
-    )
-    (
-      "-DX86_ENABLED="
-      + (if stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isx86_32 then "TRUE" else "FALSE")
-    )
+    (lib.cmakeFeature "FILE_CHECK_EXECUTABLE" "${llvmPackages.llvm}/bin/FileCheck")
+    (lib.cmakeFeature "LLVM_AS_EXECUTABLE" "${llvmPackages.llvm}/bin/llvm-as")
+    (lib.cmakeFeature "LLVM_CONFIG_EXECUTABLE" "${llvmPackages.llvm.dev}/bin/llvm-config")
+    (lib.cmakeFeature "CLANG_EXECUTABLE" "${llvmPackages.clang}/bin/clang")
+    (lib.cmakeFeature "CLANGPP_EXECUTABLE" "${llvmPackages.clang}/bin/clang++")
+    (lib.cmakeBool "ISPC_INCLUDE_EXAMPLES" false)
+    (lib.cmakeBool "ISPC_INCLUDE_UTILS" false)
+    (lib.cmakeFeature "ARM_ENABLED=" (
+      if stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32 then "TRUE" else "FALSE"
+    ))
+    (lib.cmakeFeature "X86_ENABLED=" (
+      if stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isx86_32 then "TRUE" else "FALSE"
+    ))
  ];

-  meta = with lib; {
-    homepage = "https://ispc.github.io/";
+  meta = {
    description = "Intel 'Single Program, Multiple Data' Compiler, a vectorised language";
-    mainProgram = "ispc";
-    license = licenses.bsd3;
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-linux"
-      "aarch64-darwin"
-    ]; # TODO: buildable on more platforms?
-    maintainers = with maintainers; [
+    homepage = "https://ispc.github.io/";
+    changelog = "https://github.com/ispc/ispc/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
      aristid
      thoughtpolice
      athas
      alexfmpe
    ];
+    mainProgram = "ispc";
+    platforms = with lib.platforms; linux ++ darwin; # TODO: buildable on more platforms?
  };
-}
+})
--- a/pkgs/by-name/ji/jigasi/package.nix
+++ b/pkgs/by-name/ji/jigasi/package.nix
@ -9,10 +9,10 @@

 let
  pname = "jigasi";
-  version = "1.1-311-g3de47d0";
+  version = "1.1-395-g3bb4143";
  src = fetchurl {
-    url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    hash = "sha256-pwUgkId7AHFjbqYo02fBgm0gsiMqEz+wvwkdy6sgTD0=";
+    url = "https://download.jitsi.org/stable/jigasi_${version}-1_all.deb";
+    hash = "sha256-kBUo9TZZs3/OUrV1t813jk8Pf2vNrKEP7hZL2L2oMNE=";
  };
 in
 stdenv.mkDerivation {
@ -24,13 +24,13 @@ stdenv.mkDerivation {

  installPhase = ''
    runHook preInstall
-    substituteInPlace usr/share/${pname}/${pname}.sh \
-      --replace "exec java" "exec ${jdk11}/bin/java"
+    substituteInPlace usr/share/jigasi/jigasi.sh \
+      --replace-fail "exec java" "exec ${jdk11}/bin/java"

    mkdir -p $out/{share,bin}
-    mv usr/share/${pname} $out/share/
+    mv usr/share/jigasi $out/share/
    mv etc $out/
-    ln -s $out/share/${pname}/${pname}.sh $out/bin/${pname}
+    ln -s $out/share/jigasi/jigasi.sh $out/bin/jigasi
    runHook postInstall
  '';

@ -38,15 +38,15 @@ stdenv.mkDerivation {
    single-node-smoke-test = nixosTests.jitsi-meet;
  };

-  meta = with lib; {
+  meta = {
    description = "Server-side application that allows regular SIP clients to join Jitsi Meet conferences";
    mainProgram = "jigasi";
    longDescription = ''
      Jitsi Gateway to SIP: a server-side application that allows regular SIP clients to join Jitsi Meet conferences hosted by Jitsi Videobridge.
    '';
    homepage = "https://github.com/jitsi/jigasi";
-    license = licenses.asl20;
-    teams = [ teams.jitsi ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.jitsi ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/ke/keepassxc/package.nix
+++ b/pkgs/by-name/ke/keepassxc/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch2,
  cmake,
  libsForQt5,

@ -54,7 +55,16 @@ stdenv.mkDerivation (finalAttrs: {

  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-rpath ${libargon2}/lib";

-  patches = [ ./darwin.patch ];
+  patches = [
+    ./darwin.patch
+    # Fixes a static_cast related compilation issue by converting to dynamic cast.
+    # Will be included in next release > 2.7.10 and can be dropped on bump.
+    (fetchpatch2 {
+      name = "fix-botan-3.10.patch";
+      url = "https://github.com/keepassxreboot/keepassxc/commit/fedcbf60c5c0dc7c3602c49a984d53a45c154c73.patch";
+      hash = "sha256-UntT7/LDjslyqHqt5gJjzC/vMw/RVZLNj2ZxzBPL9xI=";
+    })
+  ];

  cmakeFlags = [
    (lib.cmakeFeature "KEEPASSXC_BUILD_TYPE" "Release")
--- a/pkgs/by-name/kr/kryoptic/cargo-lock.patch
+++ b/pkgs/by-name/kr/kryoptic/cargo-lock.patch
--- a/pkgs/by-name/kr/kryoptic/package.nix
+++ b/pkgs/by-name/kr/kryoptic/package.nix
@ -0,0 +1,85 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  clang,
+  glibc,
+  openssl,
+  pkg-config,
+  sqlite,
+  fips ? false,
+}:
+
+rustPlatform.buildRustPackage (finalPackage: {
+  pname = "kryoptic";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "latchset";
+    repo = "kryoptic";
+    tag = "v${finalPackage.version}";
+    hash = "sha256-EzWZQLAtO7ZR28aOSfwXQOyHbL8Ss75dCxVnPkJIEbw=";
+  };
+
+  postPatch =
+    let
+      # Creates an -I command line for overriding an include.
+      inc = name: ''format!("-I{}", env!("${name}_INCLUDE")).as_str()'';
+      fipsArgs = lib.optionalString fips ''"-D_KRYOPTIC_FIPS"'';
+    in
+    ''
+      substituteInPlace ossl/build.rs \
+        --replace-fail 'ossl_bindings(&["-std=c90"], out_file)' 'ossl_bindings(&["-std=c90", ${inc "OPENSSL"}, ${inc "LIBC"}, ${fipsArgs}], out_file)'
+    '';
+
+  env = {
+    # Pass these include paths for bindgen in via the environment.
+    OPENSSL_INCLUDE = "${lib.getInclude openssl}/include";
+    LIBC_INCLUDE = "${lib.getInclude glibc}/include";
+    LIBCLANG_PATH = "${lib.getLib clang.cc}/lib";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+    sqlite
+  ];
+
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoHash = "sha256-NWtL1ZzxGqTn8SS4XitOYJvGRYA/j52f14oul4ZPoyw=";
+
+  cargoBuildFlags = [
+    "--no-default-features"
+    "--features=${
+      lib.concatStringsSep "," (
+        [
+          (if fips then "fips" else "standard")
+          "dynamic" # dynamic linking
+          "sqlitedb"
+          "nssdb"
+          "log"
+        ]
+        ++ lib.optionals (!fips) [
+          "pqc" # post-quantum
+        ]
+      )
+    }"
+  ];
+
+  doCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A PKCS#11 soft token written in Rust.";
+    homepage = "https://github.com/latchset/kryoptic";
+    maintainers = with lib.maintainers; [
+      numinit
+    ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "2.25.0";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "chatmail";
    repo = "core";
    tag = "v${version}";
-    hash = "sha256-pW1+9aljtnYJmlJOj+m0aQekYO5IsL0fduR7kIAPdN8=";
+    hash = "sha256-ULOnR1YvNmKr7iEuf8cZ+WgN4JRIG3md9gwyXK81vPQ=";
  };

  patches = [
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "chatmail-core";
    inherit version src;
-    hash = "sha256-iIC9wE7P2SKeCMtc/hFTRaOGXD2F7kh1TptOoes/Qi0=";
+    hash = "sha256-EkYlG32EhtIFFDpVgbKw8TSqHhPHgxd6Kh3wYN4Moq8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@ -22,13 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20251021";
+  version = "20251111";

  src = fetchFromGitLab {
    owner = "kernel-firmware";
    repo = "linux-firmware";
    tag = version;
-    hash = "sha256-hG5PGLmeVqe/kyr9Q113mlLZvP32GTi20vxHRhxKalw=";
+    hash = "sha256-YGcG2MxZ1kjfcCAl6GmNnRb0YI+tqeFzJG0ejnicXqY=";
  };

  postUnpack = ''
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luau";
-  version = "0.698";
+  version = "0.699";

  src = fetchFromGitHub {
    owner = "luau-lang";
    repo = "luau";
    tag = finalAttrs.version;
-    hash = "sha256-OfOBbO1FHLEvqeCo8cojVpMPZl6pjWF5z+BL2uffwIU=";
+    hash = "sha256-EuhLQwj+1bxNK9E0DdfsBpsqbkZHQUrtyejn5bfErKg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/lu/luminous-ttv/package.nix
+++ b/pkgs/by-name/lu/luminous-ttv/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "luminous-ttv";
-  version = "0.5.8";
+  version = "0.5.11";

  src = fetchFromGitHub {
    owner = "AlyoshaVasilieva";
    repo = "luminous-ttv";
    rev = "v${version}";
-    hash = "sha256-pT+hiREKdzw9MKv28QpLK6LmHvnRci26f0DlcXns2rA=";
+    hash = "sha256-DlKoRP9ibJMrpX8YBWThYZdaVGCUsV4D+Gqme0J0cFg=";
  };

-  cargoHash = "sha256-A5fUATbOuwSt0n1KV/+bbd65mDwWhllGraf2RrBTK6s=";
+  cargoHash = "sha256-I3oZiAxhsFCxOTztegK6jjH/sJ4eJZNNFAoJfg/DALw=";

  meta = {
    description = "Rust server to retrieve and relay a playlist for Twitch livestreams/VODs";
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@ -87,16 +87,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-tuwunel";
-  version = "1.4.5";
+  version = "1.4.6";

  src = fetchFromGitHub {
    owner = "matrix-construct";
    repo = "tuwunel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tZKq8ypDU1MkWORHFQhieDSUOqOzBcfqIQ40amyc1ls=";
+    hash = "sha256-EmIBhSxYD52BzwewcIL53e3/7GLY+5nccmAYGf1LPqI=";
  };

-  cargoHash = "sha256-x+LhpwDytwH/NzKWqAuRRbX77OZ2JGaYSaQxqinf81Q=";
+  cargoHash = "sha256-aVMJr216gkYpanCee6UhNGINAi/EZ0V5m0WaTYpQJcY=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/mc/mcaselector/package.nix
+++ b/pkgs/by-name/mc/mcaselector/package.nix
@ -13,11 +13,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "mcaselector";
-  version = "2.5.3";
+  version = "2.6.1";

  src = fetchurl {
    url = "https://github.com/Querz/mcaselector/releases/download/${finalAttrs.version}/mcaselector-${finalAttrs.version}.jar";
-    hash = "sha256-PQCXwtEK+Tq1cRJDkzlQ43dhdQ3J+bd8x/ymvsfIfdA=";
+    hash = "sha256-yDTXD0CKjCi2DuJHmMuypeAY3sm3tJOmu2OWt4p+czM=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdns-scanner";
-  version = "0.25.0";
+  version = "0.25.1";

  src = fetchFromGitHub {
    owner = "CramBL";
    repo = "mdns-scanner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-twEzu9GpyhmFFA1vo7fufROku0ZJE+K8g5lHOJn7/VA=";
+    hash = "sha256-6TbAtIz+DXZdazwPKZYVqvvXB2qivoRBrX0vJdsH6vo=";
  };

-  cargoHash = "sha256-bqAhhdy4ekgYc5PCrfQtr3PirMxY44BnIP/JVsNW1S0=";
+  cargoHash = "sha256-FHG2/ZS/MRsqim67ylL5glladdVJ+2FAfkqZfDmsEcI=";

  meta = {
    homepage = "https://github.com/CramBL/mdns-scanner";
--- a/pkgs/by-name/me/memcached-exporter/package.nix
+++ b/pkgs/by-name/me/memcached-exporter/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "memcached-exporter";
-  version = "0.15.3";
+  version = "0.15.4";

  src = fetchFromGitHub {
    owner = "prometheus";
    repo = "memcached_exporter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y2y8XMR+YHbxFQFYqwtQ4aRi71jD6l3witEwjxAjuOc=";
+    hash = "sha256-3xqMq9bxxz7/GChHlCBIHb8HZ5TT5MsfBVE8ap533nc=";
  };

-  vendorHash = "sha256-Q2b8/QA12HI6ynLU5aNmwOal+snHd1Be6p3UWk4DJhw=";
+  vendorHash = "sha256-Fcz02viZxXhzTW23GchU4lKi+WriMdpSZKoqXCCn9MA=";

  # Tests touch the network
  doCheck = false;
--- a/pkgs/by-name/mg/mgmt/package.nix
+++ b/pkgs/by-name/mg/mgmt/package.nix
@ -10,28 +10,24 @@
  pkg-config,
  ragel,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "mgmt";
-  version = "unstable-2022-10-24";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "purpleidea";
    repo = "mgmt";
-    rev = "d8820fa1855668d9e0f7a7829d9dd0d122b2c5a9";
-    hash = "sha256-jurZvEtiaTjWeDkmCJDIFlTzR5EVglfoDxkFgOilo8s=";
+    tag = finalAttrs.version;
+    hash = "sha256-Qi9KkWzFOqmUp5CSHxzQabQ8bVnBbxxKS/W6aLBTv6k=";
  };

-  # patching must be done in prebuild, so it is shared with goModules
-  # see https://github.com/NixOS/nixpkgs/issues/208036
-  preBuild = ''
-    for file in `find -name Makefile -type f`; do
-      substituteInPlace $file --replace "/usr/bin/env " ""
-    done
+  vendorHash = "sha256-XZTDqN5nQqze41Y/jOhT3mFHXeR2oPjXpz7CJuPOi8k=";

-    substituteInPlace lang/types/Makefile \
-      --replace "unset GOCACHE && " ""
+  postPatch = ''
    patchShebangs misc/header.sh
-    make lang funcgen
+  '';
+  preBuild = ''
+    make lang resources funcgen
  '';

  buildInputs = [
@ -50,19 +46,20 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X main.program=mgmt"
-    "-X main.version=${version}"
+    "-X main.program=${finalAttrs.pname}"
+    "-X main.version=${finalAttrs.version}"
  ];

  subPackages = [ "." ];

-  vendorHash = "sha256-Dtqy4TILN+7JXiHKHDdjzRTsT8jZYG5sPudxhd8znXY=";
-
-  meta = with lib; {
+  meta = {
    description = "Next generation distributed, event-driven, parallel config management";
    homepage = "https://mgmtconfig.com";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ urandom ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      urandom
+      karpfediem
+    ];
    mainProgram = "mgmt";
  };
-}
+})
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@ -8,12 +8,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "models-dev";
-  version = "0-unstable-2025-11-06";
+  version = "0-unstable-2025-11-11";
  src = fetchFromGitHub {
    owner = "sst";
    repo = "models.dev";
-    rev = "db75a6d97efdd7a3f73cc2c0ebc3f362ebce608c";
-    hash = "sha256-pl6Ra7QPmM15ndl/skxE+XTqWP9oD2olcs+EQFW0U/0=";
+    rev = "2273498a2d97d73b19a60e611899073329499d23";
+    hash = "sha256-L+zmAq1efNv77jogWRdUqt6MmFV3zO5mUiUwnozOqZw=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@ -65,7 +65,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-otke/XlxVafkgtM3wDMU+/GBBgrbD32+3E+Wyue8+U8=";
+    outputHash = "sha256-E6QV2ruzEmglBZaQMKtAdKdVpxOiwDX7bMQM8jRsiqs=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@ -99,7 +99,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  '';

  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
+    extraArgs = [
+      "--version=branch"
+      "--subpackage"
+      "node_modules"
+    ];
  };

  meta = {
--- a/pkgs/by-name/ms/mstflint/package.nix
+++ b/pkgs/by-name/ms/mstflint/package.nix
@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  rdma-core,
  openssl,
  zlib,
@ -29,21 +28,13 @@ stdenv.mkDerivation rec {
  pname = "mstflint";

  # if you update the version of this package, also update the input hash in mstflint_access!
-  version = "4.31.0-1";
+  version = "4.34.0-1";

  src = fetchurl {
    url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/mstflint-${version}.tar.gz";
-    hash = "sha256-wBUkFOdYChiSXHcH6+LLZZ06Hte4ABWjW+pNcjtk+Oc=";
+    hash = "sha256-MOFfbrjwnWXVskFCF2pgjf1Z8nkZV0l+CLfGWzxmmIg=";
  };

-  patches = [
-    # fixes build errors due to missing declarations in headers
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/Mellanox/mstflint/pull/1131.patch";
-      sha256 = "sha256-tn8EO9HkDrMroV6byUPgjclBIK8tq4xGyi4Kx/rIj+w=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoconf
    automake
--- a/pkgs/by-name/nc/nchat/package.nix
+++ b/pkgs/by-name/nc/nchat/package.nix
@ -16,13 +16,13 @@
 }:

 let
-  version = "5.10.15";
+  version = "5.11.32";

  src = fetchFromGitHub {
    owner = "d99kris";
    repo = "nchat";
    tag = "v${version}";
-    hash = "sha256-wA0sLOcCDPi3w1naIx/Q82DJk/tl/LTnrUBbMAPvvFU=";
+    hash = "sha256-iDy3h1km7Xg6hzkRg3bO8lNSe3CPBk6JOJV8Ph/Rm2w=";
  };

  libcgowm = buildGoModule {
@ -30,7 +30,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/lib/wmchat/go";
-    vendorHash = "sha256-u64b9z/B0j3qArMfxJ8QolgDc9k7Q+LqrQRle3nN7eM=";
+    vendorHash = "sha256-f6UGMP+IASvII82XZR8GIRG2tEx9ejf6WgCkKnicnD0=";

    buildPhase = ''
      runHook preBuild
--- a/pkgs/by-name/ne/nebula/package.nix
+++ b/pkgs/by-name/ne/nebula/package.nix
@ -26,7 +26,10 @@ buildGoModule rec {
  ldflags = [ "-X main.Build=${version}" ];

  passthru.tests = {
-    inherit (nixosTests) nebula;
+    inherit (nixosTests.nebula)
+      connectivity
+      reload
+      ;
  };

  meta = {
--- a/pkgs/by-name/ne/nelm/package.nix
+++ b/pkgs/by-name/ne/nelm/package.nix
@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nelm";
-  version = "1.16.0";
+  version = "1.16.1";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "nelm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PDWx/J6OmF5/daZr5c66CD3uMjS8GL3U1dRwMlXjS5Y=";
+    hash = "sha256-0U1eLtYv4SZtsRotOzySqE0S3vWzQVvI73T4KGh6wOw=";
  };

-  vendorHash = "sha256-+57gKrXOzlKH5VRdZyKxOyg90aSKowPO9JPHVN92/GA=";
+  vendorHash = "sha256-pev4J44XMjUG8VxrZav0NyEr1Vy2xVUg4gtb126XZyM=";

  subPackages = [ "cmd/nelm" ];

--- a/pkgs/by-name/ne/netbeans/package.nix
+++ b/pkgs/by-name/ne/netbeans/package.nix
@ -13,7 +13,7 @@
 }:

 let
-  version = "27";
+  version = "28";
  desktopItem = makeDesktopItem {
    name = "netbeans";
    exec = "netbeans";
@ -29,7 +29,7 @@ stdenv.mkDerivation {
  inherit version;
  src = fetchurl {
    url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    hash = "sha256-/B8qE/Dwv1L6gZ8oTPsfq+zLb3cEyQ2YDdw6UFNim8c=";
+    hash = "sha256-ALn6XALAcQbf6zeoieKgTj4sUis24VzzfTHukPoa/DI=";
  };

  buildCommand = ''
--- a/pkgs/by-name/nv/nvitop/package.nix
+++ b/pkgs/by-name/nv/nvitop/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "nvitop";
-  version = "1.5.3";
+  version = "1.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "XuehaiPan";
    repo = "nvitop";
    tag = "v${version}";
-    hash = "sha256-cqRvjK3q9fm5HPnZFGSV59FPnAdLkeq/D5wSR5ke7Ok=";
+    hash = "sha256-Ce92O0GfOIIwHHFLBYQdvYlQmAeeJ6xBfMVXps6+B5E=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/by-name/oh/oh-my-zsh/package.nix
+++ b/pkgs/by-name/oh/oh-my-zsh/package.nix
@ -19,14 +19,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2025-11-03";
+  version = "2025-11-09";
  pname = "oh-my-zsh";

  src = fetchFromGitHub {
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    rev = "90a22b61e66dbd83928be7b9739de554a5f1c09d";
-    sha256 = "sha256-ODtuQ/jqo0caw4l/8tUe/1TizAaAA/bSqZhIEjSuVi8=";
+    rev = "18d0a63df8ed61aad7b25dc9c6f61a7cb88760dc";
+    sha256 = "sha256-cgGgWW6WNUIHKOEV7jfHQuClD2WRwSSFOQ76GG8ixrA=";
  };

  strictDeps = true;
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@ -7,7 +7,7 @@

 let
  pname = "openfga";
-  version = "1.10.4";
+  version = "1.11.0";
 in

 buildGoModule {
@ -17,7 +17,7 @@ buildGoModule {
    owner = "openfga";
    repo = "openfga";
    rev = "v${version}";
-    hash = "sha256-4Mi+fjOBwzL3iq57iz4SAESNRCm75gKnZCIsOwTQeAc=";
+    hash = "sha256-2PmTIoi7v06/Uqlj2GlBbnGpu3GB4xBondG/w3egSjs=";
  };

  vendorHash = "sha256-KK/6CNq824PBgAHnPoGza0yvLQ/paa1hznfp5p2GKyY=";
--- a/pkgs/by-name/p7/p7zip-rar/package.nix
+++ b/pkgs/by-name/p7/p7zip-rar/package.nix
@ -0,0 +1,7 @@
+{
+  p7zip,
+}:
+
+p7zip.override {
+  enableUnfree = true;
+}
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
--- a/pkgs/tools/archivers/p7zip/setup-hook.sh
+++ b/pkgs/tools/archivers/p7zip/setup-hook.sh
--- a/pkgs/tools/archivers/p7zip/update.sh
+++ b/pkgs/tools/archivers/p7zip/update.sh
--- a/pkgs/by-name/pd/pdi/package.nix
+++ b/pkgs/by-name/pd/pdi/package.nix
@ -41,12 +41,22 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-bbhsMbTVvG19vtkZyOiCRH168kCFk2ahSFc7davfXzo=";
  };

-  # Current hdf5 version in nixpkgs is 1.14.4.3 which is 4 numbers long and doesn't match the 3 number regex. :')
-  # Patch it to make it match a 4 number-long version.
-  postPatch = ''
-    substituteInPlace plugins/decl_hdf5/cmake/FindHDF5.cmake \
-      --replace-fail '"H5_VERSION[ \t]+\"([0-9]+\\.[0-9]+\\.[0-9]+)' '"H5_VERSION[ \t]+\"([0-9]+\\.[0-9]+\\.[0-9]+(\\.[0-9]+)*)'
-  '';
+  postPatch =
+    # Current hdf5 version in nixpkgs is 1.14.4.3 which is 4 numbers long and doesn't match the 3 number regex. :')
+    # Patch it to make it match a 4 number-long version.
+    ''
+      substituteInPlace plugins/decl_hdf5/cmake/FindHDF5.cmake \
+        --replace-fail '"H5_VERSION[ \t]+\"([0-9]+\\.[0-9]+\\.[0-9]+)' '"H5_VERSION[ \t]+\"([0-9]+\\.[0-9]+\\.[0-9]+(\\.[0-9]+)*)'
+    ''
+    # CMake 4 dropped support of versions lower than 3.5,
+    # versions lower than 3.10 are deprecated.
+    # "https://github.com/NixOS/nixpkgs/issues/445447"
+    + ''
+      substituteInPlace vendor/zpp-1.0.16/zpp/cmake/Zpp.cmake \
+        --replace-fail \
+          "cmake_minimum_required(VERSION 3.0)" \
+          "cmake_minimum_required(VERSION 3.10)"
+    '';

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "phrase-cli";
-  version = "2.50.0";
+  version = "2.50.2";

  src = fetchFromGitHub {
    owner = "phrase";
    repo = "phrase-cli";
    rev = version;
-    sha256 = "sha256-FXoejKKbykNKcWN+4hf3PRdhyZaiZef6c2NsMQK/saQ=";
+    sha256 = "sha256-z2n/wCgllzzEzJ5C5/fhX/NzoNQuLE99rpnLZcIoRB8=";
  };

-  vendorHash = "sha256-uJR5RjBjSZmoYJNsbbvAabYfRhd9APNHwR8SP+44fC0=";
+  vendorHash = "sha256-+WF+j288AeIHH/6vDzj/UlffU2sUE/TjaMS9czEsepA=";

  ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];

--- a/pkgs/by-name/pk/pkcs11-provider/package.nix
+++ b/pkgs/by-name/pk/pkcs11-provider/package.nix
@ -6,6 +6,8 @@
  nss,
  p11-kit,
  opensc,
+  softhsm,
+  kryoptic,
  gnutls,
  expect,
  which,
@ -44,10 +46,11 @@ stdenv.mkDerivation rec {
    which
  ];

-  # don't add SoftHSM to here: https://github.com/openssl/openssl/issues/22508
  nativeCheckInputs = [
    p11-kit.bin
    opensc
+    softhsm
+    kryoptic
    nss.tools
    gnutls
    openssl.bin
@ -56,8 +59,16 @@ stdenv.mkDerivation rec {
    pkcs11ProviderPython3
  ];

+  env = {
+    KRYOPTIC = "${lib.getLib kryoptic}/lib";
+  };
+
+  # Fix a typo in the Kryoptic test (remove this in v1.2).
  postPatch = ''
    patchShebangs --build .
+    substituteInPlace tests/kryoptic-init.sh \
+      --replace-fail /usr/local/lib/kryoptic "\\''${KRYOPTIC}" \
+      --replace-fail "libkryoptic_pkcs11so" libkryoptic_pkcs11.so
  '';

  preInstall = ''
--- a/pkgs/by-name/pk/pkcs11helper/package.nix
+++ b/pkgs/by-name/pk/pkcs11helper/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "pkcs11-helper";
-  version = "1.30.0";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "OpenSC";
    repo = "pkcs11-helper";
    rev = "${pname}-${version}";
-    hash = "sha256-FP3y/YHsPPqey4QfxIiC4QjruuK1K2Bg+2QL2gXDT+k=";
+    hash = "sha256-0U3HK/6JmdNwus9fs6g86YrTAFVjgK/o7dQb69A5zlU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -85,6 +85,7 @@ python.pkgs.buildPythonApplication rec {
    "celery"
    "css-inline"
    "django-bootstrap3"
+    "django-compressor"
    "django-formset-js-improved"
    "django-i18nfield"
    "django-localflavor"
--- a/pkgs/by-name/pr/prmt/package.nix
+++ b/pkgs/by-name/pr/prmt/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "prmt";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    repo = "prmt";
+    owner = "3axap4eHko";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CLSBthofkVdNE/ayecTRLtFDxtGesDuEGw1/Jutpu+c=";
+  };
+
+  cargoHash = "sha256-0TYjXpR3VyRdI+3ZIPnoaM1Mod0rXOinpByeOduKSdk=";
+
+  # Fail to run in sandbox environment
+  checkFlags = map (t: "--skip ${t}") [
+    "modules::path::tests::relative_path_inside_home_renders_tilde"
+    "modules::path::tests::relative_path_with_shared_prefix_is_not_tilde"
+    "test_git_module"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Ultra-fast, customizable shell prompt generator";
+    homepage = "https://github.com/3axap4eHko/prmt";
+    changelog = "https://github.com/3axap4eHko/prmt/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nartsiss ];
+    mainProgram = "prmt";
+  };
+})
--- a/Show more
+++ b/Show more