Merge staging-next into staging

2025-07-13 21:50:33 +03:00 · 2025-03-31 12:06:34 +00:00 · 2025-03-31 12:06:34 +00:00 · 86e22e1e80
commit 86e22e1e80
parent 1065cc2594 7ce7833dc5
73 changed files with 1358 additions and 2797 deletions
--- a/lib/tests/nix-for-tests.nix
+++ b/lib/tests/nix-for-tests.nix
@ -1,4 +1,5 @@
 {
+  lib ? pkgs.lib,
  pkgs,
 }:

@ -13,20 +14,8 @@

 builtins.mapAttrs (
  attr: pkg:
-  if
-    # TODO descend in `nixComponents_*` and override `nix-store`. Also
-    # need to introduce the flag needed to do that with.
-    #
-    # This must be done before Nix 2.26 and beyond becomes the default.
-    !(builtins.elem attr [
-      "nixComponents_2_26"
-      "nix_2_26"
-      "latest"
-    ])
-    # There may-be non-package things, like functions, in there too
-    && builtins.isAttrs pkg
-  then
-    pkg.override { withAWS = false; }
+  if lib.versionAtLeast pkg.version "2.26" then
+    pkg.overrideScope (finalScope: prevScope: { aws-sdk-cpp = null; })
  else
-    pkg
+    pkg.override { withAWS = false; }
 ) pkgs.nixVersions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -23204,6 +23204,17 @@
    github = "sweenu";
    githubId = 7051978;
  };
+  sweiglbosker = {
+    email = "stefan@s00.xyz";
+    github = "sweiglbosker";
+    githubId = 124390044;
+    name = "Stefan Weigl-Bosker";
+    keys = [
+      {
+        fingerprint = "B520 0ABF BD21 3FC9 C17C  6DB9 1291 CBBC F3B9 F225";
+      }
+    ];
+  };
  swendel = {
    name = "Sebastian Wendel";
    email = "nixpkgs.aiX5ph@srx.digital";
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -10,6 +10,8 @@
  Users on old macOS versions should consider upgrading to a supported version (potentially using [OpenCore Legacy Patcher](https://dortania.github.io/OpenCore-Legacy-Patcher/) for old hardware) or installing NixOS.
  If neither of those options are viable and you require new versions of software, [MacPorts](https://www.macports.org/) supports versions back to Mac OS X Snow Leopard 10.6.

+- Initial support for the [COSMIC DE](https://system76.com/cosmic), a Rust-based desktop environment by System76, makers of Pop!_OS. Toggle the greeter (login manager) using `services.displayManager.cosmic-greeter.enable` and the DE itself with `services.desktopManager.cosmic.enable`. Mostly stable but still experimental. Please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
+
 - The default kernel package has been updated from 6.6 to 6.12. All supported kernels remain available.

 - GCC has been updated from GCC 13 to GCC 14.
@ -131,6 +133,8 @@

 - [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).

+- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](options.html#opt-services.postgrest.enable).
+
 - [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).

 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -513,6 +513,7 @@
  ./services/databases/pgbouncer.nix
  ./services/databases/pgmanage.nix
  ./services/databases/postgresql.nix
+  ./services/databases/postgrest.nix
  ./services/databases/redis.nix
  ./services/databases/surrealdb.nix
  ./services/databases/tigerbeetle.nix
@ -578,6 +579,7 @@
  ./services/development/vsmartcard-vpcd.nix
  ./services/development/zammad.nix
  ./services/display-managers/default.nix
+  ./services/display-managers/cosmic-greeter.nix
  ./services/display-managers/greetd.nix
  ./services/display-managers/sddm.nix
  ./services/display-managers/ly.nix
--- a/nixos/modules/services/databases/postgrest.nix
+++ b/nixos/modules/services/databases/postgrest.nix
@ -0,0 +1,311 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.postgrest;
+
+  # Turns an attrset of libpq connection params:
+  #   {
+  #     dbname = "postgres";
+  #     user = "authenticator";
+  #   }
+  # into a libpq connection string:
+  #   dbname=postgres user=authenticator
+  db-uri = lib.pipe (cfg.settings.db-uri or { }) [
+    (lib.filterAttrs (_: v: v != null))
+    (lib.mapAttrsToList (k: v: "${k}=${v}"))
+    (lib.concatStringsSep " ")
+  ];
+
+  # Writes a postgrest config file according to:
+  #   https://hackage.haskell.org/package/configurator-0.3.0.0/docs/Data-Configurator.html
+  # Only a subset of the functionality is used by PostgREST.
+  configFile = lib.pipe (cfg.settings // { inherit db-uri; }) [
+    (lib.filterAttrs (_: v: v != null))
+
+    (lib.mapAttrs (
+      _: v:
+      if true == v then
+        "true"
+      else if false == v then
+        "false"
+      else if lib.isInt v then
+        toString v
+      else
+        "\"${lib.escape [ "\"" ] v}\""
+    ))
+
+    (lib.mapAttrsToList (k: v: "${k} = ${v}"))
+    (lib.concatStringsSep "\n")
+    (pkgs.writeText "postgrest.conf")
+  ];
+in
+
+{
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  options.services.postgrest = {
+    enable = lib.mkEnableOption "PostgREST";
+
+    pgpassFile = lib.mkOption {
+      type =
+        with lib.types;
+        nullOr (pathWith {
+          inStore = false;
+          absolute = true;
+        });
+      default = null;
+      example = "/run/keys/db_password";
+      description = ''
+        The password to authenticate to PostgreSQL with.
+        Not needed for peer or trust based authentication.
+
+        The file must be a valid `.pgpass` file as described in:
+        <https://www.postgresql.org/docs/current/libpq-pgpass.html>
+
+        In most cases, the following will be enough:
+        ```
+        *:*:*:*:<password>
+        ```
+      '';
+    };
+
+    jwtSecretFile = lib.mkOption {
+      type =
+        with lib.types;
+        nullOr (pathWith {
+          inStore = false;
+          absolute = true;
+        });
+      default = null;
+      example = "/run/keys/jwt_secret";
+      description = ''
+        The secret or JSON Web Key (JWK) (or set) used to decode JWT tokens clients provide for authentication.
+        For security the key must be at least 32 characters long.
+        If this parameter is not specified then PostgREST refuses authentication requests.
+
+        <https://docs.postgrest.org/en/stable/references/configuration.html#jwt-secret>
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            bool
+            ints.unsigned
+            str
+          ]);
+
+        options = {
+          admin-server-port = lib.mkOption {
+            type = with lib.types; nullOr port;
+            default = null;
+            description = ''
+              Specifies the port for the admin server, which can be used for healthchecks.
+
+              <https://docs.postgrest.org/en/stable/references/admin_server.html#admin-server>
+            '';
+          };
+
+          db-config = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Enables the in-database configuration.
+
+              <https://docs.postgrest.org/en/stable/references/configuration.html#in-database-configuration>
+
+              ::: {.note}
+              This is enabled by default upstream, but disabled by default in this module.
+              :::
+            '';
+          };
+
+          db-uri = lib.mkOption {
+            type = lib.types.submodule {
+              freeformType = with lib.types; attrsOf str;
+
+              # This should not be used; use pgpassFile instead.
+              options.password = lib.mkOption {
+                default = null;
+                readOnly = true;
+                internal = true;
+              };
+              # This should not be used; use pgpassFile instead.
+              options.passfile = lib.mkOption {
+                default = null;
+                readOnly = true;
+                internal = true;
+              };
+            };
+            default = { };
+            description = ''
+              libpq connection parameters as documented in:
+
+              <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS>
+
+              ::: {.note}
+              The `settings.db-uri.password` and `settings.db-uri.passfile` options are blocked.
+              Use [`pgpassFile`](#opt-services.postgrest.pgpassFile) instead.
+              :::
+            '';
+            example = lib.literalExpression ''
+              {
+                host = "localhost";
+                dbname = "postgres";
+              }
+            '';
+          };
+
+          # This should not be used; use jwtSecretFile instead.
+          jwt-secret = lib.mkOption {
+            default = null;
+            readOnly = true;
+            internal = true;
+          };
+
+          server-host = lib.mkOption {
+            type = with lib.types; nullOr str;
+            default = "127.0.0.1";
+            description = ''
+              Where to bind the PostgREST web server.
+
+              ::: {.note}
+              The admin server will also bind here, but potentially exposes sensitive information.
+              Make sure you turn off the admin server, when opening this to the public.
+
+              <https://github.com/PostgREST/postgrest/issues/3956>
+              :::
+            '';
+          };
+
+          server-port = lib.mkOption {
+            type = with lib.types; nullOr port;
+            default = null;
+            example = 3000;
+            description = ''
+              The TCP port to bind the web server.
+            '';
+          };
+
+          server-unix-socket = lib.mkOption {
+            type = with lib.types; nullOr path;
+            default = "/run/postgrest/postgrest.sock";
+            description = ''
+              Unix domain socket where to bind the PostgREST web server.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        PostgREST configuration as documented in:
+        <https://docs.postgrest.org/en/stable/references/configuration.html#list-of-parameters>
+
+        `db-uri` is represented as an attribute set, see [`settings.db-uri`](#opt-services.postgrest.settings.db-uri)
+
+        ::: {.note}
+        The `settings.jwt-secret` option is blocked.
+        Use [`jwtSecretFile`](#opt-services.postgrest.jwtSecretFile) instead.
+        :::
+      '';
+      example = lib.literalExpression ''
+        {
+          db-anon-role = "anon";
+          db-uri.dbname = "postgres";
+          "app.settings.custom" = "value";
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.settings.server-port == null) != (cfg.settings.server-unix-socket == null);
+        message = ''
+          PostgREST can listen either on a TCP port or on a unix socket, but not both.
+          Please set one of `settings.server-port`](#opt-services.postgrest.jwtSecretFile) or `settings.server-unix-socket` to `null`.
+
+          <https://docs.postgrest.org/en/stable/references/configuration.html#server-unix-socket>
+        '';
+      }
+    ];
+
+    warnings =
+      lib.optional (cfg.settings.admin-server-port != null && cfg.settings.server-host != "127.0.0.1")
+        "The PostgREST admin server is potentially listening on a public host. This may expose sensitive information via the `/config` endpoint.";
+
+    systemd.services.postgrest = {
+      description = "PostgREST";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        "postgresql.service"
+      ];
+
+      serviceConfig = {
+        CacheDirectory = "postgrest";
+        CacheDirectoryMode = "0700";
+        Environment =
+          lib.optional (cfg.pgpassFile != null) "PGPASSFILE=%C/postgrest/pgpass"
+          ++ lib.optional (cfg.jwtSecretFile != null) "PGRST_JWT_SECRET=@%d/jwt_secret";
+        LoadCredential =
+          lib.optional (cfg.pgpassFile != null) "pgpass:${cfg.pgpassFile}"
+          ++ lib.optional (cfg.jwtSecretFile != null) "jwt_secret:${cfg.jwtSecretFile}";
+        Restart = "always";
+        RuntimeDirectory = "postgrest";
+        User = "postgrest";
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateMounts = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "" ];
+        UMask = "0077";
+      };
+
+      # Copy the pgpass file to different location, to have it report mode 0400.
+      # Fixes: https://github.com/systemd/systemd/issues/29435
+      script = ''
+        if [ -f "$CREDENTIALS_DIRECTORY/pgpass" ]; then
+            cp -f "$CREDENTIALS_DIRECTORY/pgpass" "$CACHE_DIRECTORY/pgpass"
+        fi
+        exec ${lib.getExe pkgs.postgrest} ${configFile}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@ -0,0 +1,142 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Lily Foster <lily@lily.flowers>
+# Portions of this code are adapted from nixos-cosmic
+# https://github.com/lilyinstarlight/nixos-cosmic
+
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.desktopManager.cosmic;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    thefossguy
+    HeitorAugustoLN
+    nyabinary
+    ahoneybun
+  ];
+
+  options = {
+    services.desktopManager.cosmic = {
+      enable = lib.mkEnableOption "Enable the COSMIC desktop environment";
+
+      xwayland.enable = lib.mkEnableOption "Xwayland support for the COSMIC compositor" // {
+        default = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Environment packages
+    environment.pathsToLink = [
+      "/share/backgrounds"
+      "/share/cosmic"
+    ];
+    environment.systemPackages =
+      with pkgs;
+      [
+        adwaita-icon-theme
+        alsa-utils
+        cosmic-applets
+        cosmic-applibrary
+        cosmic-bg
+        (cosmic-comp.override { useXWayland = false; })
+        cosmic-edit
+        cosmic-files
+        config.services.displayManager.cosmic-greeter.package
+        cosmic-icons
+        cosmic-idle
+        cosmic-launcher
+        cosmic-notifications
+        cosmic-osd
+        cosmic-panel
+        cosmic-player
+        cosmic-randr
+        cosmic-screenshot
+        cosmic-session
+        cosmic-settings
+        cosmic-settings-daemon
+        cosmic-term
+        cosmic-wallpapers
+        cosmic-workspaces-epoch
+        hicolor-icon-theme
+        playerctl
+        pop-icon-theme
+        pop-launcher
+        xdg-user-dirs
+      ]
+      ++ lib.optionals cfg.xwayland.enable [
+        xwayland
+      ]
+      ++ lib.optionals config.services.flatpak.enable [
+        cosmic-store
+      ];
+
+    # Distro-wide defaults for graphical sessions
+    services.graphical-desktop.enable = true;
+
+    xdg = {
+      icons.fallbackCursorThemes = lib.mkDefault [ "Cosmic" ];
+
+      portal = {
+        enable = true;
+        extraPortals = with pkgs; [
+          xdg-desktop-portal-cosmic
+          xdg-desktop-portal-gtk
+        ];
+        configPackages = lib.mkDefault [ pkgs.xdg-desktop-portal-cosmic ];
+      };
+    };
+
+    systemd = {
+      packages = [ pkgs.cosmic-session ];
+      user.targets = {
+        cosmic-session = {
+          wants = [ "xdg-desktop-autostart.target" ];
+          before = [ "xdg-desktop-autostart.target" ];
+        };
+        tray = {
+          description = "Cosmic Tray Target";
+          requires = [ "graphical-session-pre.target" ];
+        };
+      };
+    };
+
+    fonts.packages = with pkgs; [
+      fira
+      noto-fonts
+      open-sans
+    ];
+
+    # Required options for the COSMIC DE
+    environment.sessionVariables.X11_BASE_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.xml";
+    environment.sessionVariables.X11_EXTRA_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.extras.xml";
+    programs.dconf.enable = true;
+    programs.dconf.packages = [ pkgs.cosmic-session ];
+    security.polkit.enable = true;
+    security.rtkit.enable = true;
+    services.accounts-daemon.enable = true;
+    services.displayManager.sessionPackages = [ pkgs.cosmic-session ];
+    services.libinput.enable = true;
+    services.upower.enable = true;
+    # Setup PAM authentication for the `cosmic-greeter` user
+    security.pam.services.cosmic-greeter = { };
+
+    # Good to have defaults
+    hardware.bluetooth.enable = lib.mkDefault true;
+    networking.networkmanager.enable = lib.mkDefault true;
+    services.acpid.enable = lib.mkDefault true;
+    services.avahi.enable = lib.mkDefault true;
+    services.gnome.gnome-keyring.enable = lib.mkDefault true;
+    services.gvfs.enable = lib.mkDefault true;
+    services.power-profiles-daemon.enable = lib.mkDefault (
+      !config.hardware.system76.power-daemon.enable
+    );
+  };
+}
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@ -0,0 +1,70 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Lily Foster <lily@lily.flowers>
+# Portions of this code are adapted from nixos-cosmic
+# https://github.com/lilyinstarlight/nixos-cosmic
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.displayManager.cosmic-greeter;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [
+    thefossguy
+    HeitorAugustoLN
+    nyabinary
+    ahoneybun
+  ];
+
+  options.services.displayManager.cosmic-greeter = {
+    enable = lib.mkEnableOption "COSMIC greeter";
+    package = lib.mkPackageOption pkgs "cosmic-greeter" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          user = "cosmic-greeter";
+          command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-greeter ${lib.getExe pkgs.cosmic-comp} ${lib.getExe cfg.package}'';
+        };
+      };
+    };
+
+    # Daemon for querying background state and such
+    systemd.services.cosmic-greeter-daemon = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "greetd.service" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.system76.CosmicGreeter";
+        ExecStart = lib.getExe' cfg.package "cosmic-greeter-daemon";
+        Restart = "on-failure";
+      };
+    };
+
+    # The greeter user is hardcoded in `cosmic-greeter`
+    users.groups.cosmic-greeter = { };
+    users.users.cosmic-greeter = {
+      description = "COSMIC login greeter user";
+      isSystemUser = true;
+      home = "/var/lib/cosmic-greeter";
+      createHome = true;
+      group = "cosmic-greeter";
+    };
+    # Setup PAM authentication for the `cosmic-greeter` user
+    security.pam.services.cosmic-greeter = { };
+
+    hardware.graphics.enable = true;
+    services.accounts-daemon.enable = true;
+    services.dbus.packages = [ cfg.package ];
+    services.libinput.enable = true;
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -21,6 +21,7 @@ in
    ./lxqt.nix ./enlightenment.nix ./gnome.nix ./retroarch.nix ./kodi.nix
    ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
    ./cinnamon.nix ./budgie.nix ./deepin.nix ../../desktop-managers/lomiri.nix
+    ../../desktop-managers/cosmic.nix
  ];

  options = {
--- a/nixos/modules/services/x11/display-managers/startx.nix
+++ b/nixos/modules/services/x11/display-managers/startx.nix
@ -102,14 +102,6 @@ in

    environment.systemPackages = with pkgs; [ xorg.xinit ];

-    # Make graphical-session fail if the user environment has not been imported
-    systemd.user.targets.graphical-session = {
-      unitConfig.AssertEnvironment = [
-        "DISPLAY"
-        "XDG_SESSION_ID"
-      ];
-    };
-
  };

 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -715,7 +715,7 @@ in {
  miniflux = handleTest ./miniflux.nix {};
  minio = handleTest ./minio.nix {};
  miracle-wm = runTest ./miracle-wm.nix;
-  miriway = handleTest ./miriway.nix {};
+  miriway = runTest ./miriway.nix;
  misc = handleTest ./misc.nix {};
  misskey = handleTest ./misskey.nix {};
  mjolnir = handleTest ./matrix/mjolnir.nix {};
@ -734,7 +734,7 @@ in {
  moodle = handleTest ./moodle.nix {};
  moonraker = handleTest ./moonraker.nix {};
  mopidy = handleTest ./mopidy.nix {};
-  morph-browser = handleTest ./morph-browser.nix { };
+  morph-browser = runTest ./morph-browser.nix;
  morty = handleTest ./morty.nix {};
  mosquitto = handleTest ./mosquitto.nix {};
  moosefs = handleTest ./moosefs.nix {};
@ -974,6 +974,7 @@ in {
  postfix-raise-smtpd-tls-security-level = handleTest ./postfix-raise-smtpd-tls-security-level.nix {};
  postfixadmin = handleTest ./postfixadmin.nix {};
  postgresql = handleTest ./postgresql {};
+  postgrest = runTest ./postgrest.nix;
  powerdns = handleTest ./powerdns.nix {};
  powerdns-admin = handleTest ./powerdns-admin.nix {};
  power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};
--- a/nixos/tests/miriway.nix
+++ b/nixos/tests/miriway.nix
@ -1,148 +1,146 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "miriway";
+{ pkgs, lib, ... }:
+{
+  name = "miriway";

-    meta = {
-      maintainers = with lib.maintainers; [ OPNA2608 ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+  };

-    nodes.machine =
-      { config, ... }:
-      {
-        imports = [
-          ./common/auto.nix
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [
+        ./common/auto.nix
+        ./common/user-account.nix
+      ];

-        # Seems to very rarely get interrupted by oom-killer
-        virtualisation.memorySize = 2047;
+      # Seems to very rarely get interrupted by oom-killer
+      virtualisation.memorySize = 2047;

-        test-support.displayManager.auto = {
-          enable = true;
-          user = "alice";
-        };
-
-        programs.ydotool.enable = true;
-
-        services.xserver.enable = true;
-        services.displayManager.defaultSession = lib.mkForce "miriway";
-
-        programs.miriway = {
-          enable = true;
-          config = ''
-            add-wayland-extensions=all
-            enable-x11=
-
-            ctrl-alt=t:foot --maximized
-            ctrl-alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"
-
-            shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
-
-            shell-component=foot --maximized
-          '';
-        };
-
-        environment = {
-          shellAliases = {
-            test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-            test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-          };
-
-          systemPackages = with pkgs; [
-            mesa-demos
-            wayland-utils
-            foot
-            alacritty
-          ];
-
-          # To help with OCR
-          etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
-            main = {
-              font = "inconsolata:size=16";
-            };
-            colors = rec {
-              foreground = "000000";
-              background = "ffffff";
-              regular2 = foreground;
-            };
-          };
-          etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
-            font = rec {
-              normal.family = "Inconsolata";
-              bold.family = normal.family;
-              italic.family = normal.family;
-              bold_italic.family = normal.family;
-              size = 16;
-            };
-            colors = rec {
-              primary = {
-                foreground = "0x000000";
-                background = "0xffffff";
-              };
-              normal = {
-                green = primary.foreground;
-              };
-            };
-          };
-        };
-
-        fonts.packages = [ pkgs.inconsolata ];
+      test-support.displayManager.auto = {
+        enable = true;
+        user = "alice";
      };

-    enableOCR = true;
+      programs.ydotool.enable = true;

-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
+      services.xserver.enable = true;
+      services.displayManager.defaultSession = lib.mkForce "miriway";

-        # Wait for Miriway to complete startup
-        machine.wait_for_file("/run/user/1000/wayland-0")
-        machine.succeed("pgrep miriway-shell")
-        machine.screenshot("miriway_launched")
+      programs.miriway = {
+        enable = true;
+        config = ''
+          add-wayland-extensions=all
+          enable-x11=

-        # Test Wayland
-        # We let Miriway start the first terminal, as we might get stuck if it's not ready to process the first keybind
-        # machine.send_key("ctrl-alt-t")
-        machine.wait_for_text(r"(alice|machine)")
-        machine.send_chars("test-wayland\n")
-        machine.wait_for_file("/tmp/test-wayland-exit-ok")
-        machine.copy_from_vm("/tmp/test-wayland.out")
-        machine.screenshot("foot_wayland_info")
+          ctrl-alt=t:foot --maximized
+          ctrl-alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"

-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+          shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY

-        machine.send_chars("exit\n")
+          shell-component=foot --maximized
+        '';
+      };

-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+      environment = {
+        shellAliases = {
+          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
+          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+        };

-        machine.wait_until_fails("pgrep foot")
+        systemPackages = with pkgs; [
+          mesa-demos
+          wayland-utils
+          foot
+          alacritty
+        ];

-        # Test XWayland
-        machine.send_key("ctrl-alt-a")
-        machine.wait_for_text(r"(alice|machine)")
-        machine.send_chars("test-x11\n")
-        machine.wait_for_file("/tmp/test-x11-exit-ok")
-        machine.copy_from_vm("/tmp/test-x11.out")
-        machine.screenshot("alacritty_glinfo")
+        # To help with OCR
+        etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
+          main = {
+            font = "inconsolata:size=16";
+          };
+          colors = rec {
+            foreground = "000000";
+            background = "ffffff";
+            regular2 = foreground;
+          };
+        };
+        etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
+          font = rec {
+            normal.family = "Inconsolata";
+            bold.family = normal.family;
+            italic.family = normal.family;
+            bold_italic.family = normal.family;
+            size = 16;
+          };
+          colors = rec {
+            primary = {
+              foreground = "0x000000";
+              background = "0xffffff";
+            };
+            normal = {
+              green = primary.foreground;
+            };
+          };
+        };
+      };

-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+      fonts.packages = [ pkgs.inconsolata ];
+    };

-        machine.send_chars("exit\n")
+  enableOCR = true;

-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")

-        machine.wait_until_fails("pgrep alacritty")
-      '';
-  }
-)
+      # Wait for Miriway to complete startup
+      machine.wait_for_file("/run/user/1000/wayland-0")
+      machine.succeed("pgrep miriway-shell")
+      machine.screenshot("miriway_launched")
+
+      # Test Wayland
+      # We let Miriway start the first terminal, as we might get stuck if it's not ready to process the first keybind
+      # machine.send_key("ctrl-alt-t")
+      machine.wait_for_text(r"(alice|machine)")
+      machine.send_chars("test-wayland\n")
+      machine.wait_for_file("/tmp/test-wayland-exit-ok")
+      machine.copy_from_vm("/tmp/test-wayland.out")
+      machine.screenshot("foot_wayland_info")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.send_chars("exit\n")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.wait_until_fails("pgrep foot")
+
+      # Test XWayland
+      machine.send_key("ctrl-alt-a")
+      machine.wait_for_text(r"(alice|machine)")
+      machine.send_chars("test-x11\n")
+      machine.wait_for_file("/tmp/test-x11-exit-ok")
+      machine.copy_from_vm("/tmp/test-x11.out")
+      machine.screenshot("alacritty_glinfo")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.send_chars("exit\n")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.wait_until_fails("pgrep alacritty")
+    '';
+}
--- a/nixos/tests/morph-browser.nix
+++ b/nixos/tests/morph-browser.nix
@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "morph-browser-standalone";
-    meta.maintainers = lib.teams.lomiri.members;
+{ pkgs, lib, ... }:
+{
+  name = "morph-browser-standalone";
+  meta.maintainers = lib.teams.lomiri.members;

-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+
+      environment = {
+        systemPackages = with pkgs.lomiri; [
+          suru-icon-theme
+          morph-browser
        ];
-
-        services.xserver.enable = true;
-
-        environment = {
-          systemPackages = with pkgs.lomiri; [
-            suru-icon-theme
-            morph-browser
-          ];
-          variables = {
-            UITK_ICON_THEME = "suru";
-          };
+        variables = {
+          UITK_ICON_THEME = "suru";
        };
-
-        i18n.supportedLocales = [ "all" ];
-
-        fonts.packages = with pkgs; [
-          # Intended font & helps with OCR
-          ubuntu-classic
-        ];
      };

-    enableOCR = true;
+      i18n.supportedLocales = [ "all" ];

-    testScript = ''
-      machine.wait_for_x()
+      fonts.packages = with pkgs; [
+        # Intended font & helps with OCR
+        ubuntu-classic
+      ];
+    };

-      with subtest("morph browser launches"):
-          machine.execute("morph-browser >&2 &")
-          machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
-          machine.screenshot("morph_open")
+  enableOCR = true;

-      with subtest("morph browser displays HTML"):
-          machine.send_chars("file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html\n")
-          machine.wait_for_text("Valgrind Documentation")
-          machine.screenshot("morph_htmlcontent")
+  testScript = ''
+    machine.wait_for_x()

-      machine.succeed("pkill -f morph-browser")
+    with subtest("morph browser launches"):
+        machine.execute("morph-browser >&2 &")
+        machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
+        machine.screenshot("morph_open")

-      with subtest("morph browser localisation works"):
-          machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
-          machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
-          machine.screenshot("morph_localised")
-    '';
-  }
-)
+    with subtest("morph browser displays HTML"):
+        machine.send_chars("file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html\n")
+        machine.wait_for_text("Valgrind Documentation")
+        machine.screenshot("morph_htmlcontent")
+
+    machine.succeed("pkill -f morph-browser")
+
+    with subtest("morph browser localisation works"):
+        machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
+        machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
+        machine.screenshot("morph_localised")
+  '';
+}
--- a/nixos/tests/postgrest.nix
+++ b/nixos/tests/postgrest.nix
@ -0,0 +1,88 @@
+{ lib, ... }:
+{
+  name = "postgrest";
+
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "init.sql" ''
+          CREATE ROLE postgrest LOGIN NOINHERIT;
+          CREATE ROLE anon ROLE postgrest;
+
+          CREATE ROLE postgrest_with_password LOGIN NOINHERIT PASSWORD 'password';
+          CREATE ROLE authenticated ROLE postgrest_with_password;
+        '';
+      };
+
+      services.postgrest = {
+        enable = true;
+        settings = {
+          admin-server-port = 3001;
+          db-anon-role = "anon";
+          db-uri.dbname = "postgres";
+        };
+      };
+
+      specialisation.withSecrets.configuration = {
+        services.postgresql.enableTCPIP = true;
+        services.postgrest = {
+          pgpassFile = "/run/secrets/.pgpass";
+          jwtSecretFile = "/run/secrets/jwt.secret";
+          settings.db-uri.host = "localhost";
+          settings.db-uri.user = "postgrest_with_password";
+          settings.server-port = 3000;
+          settings.server-unix-socket = null;
+        };
+      };
+    };
+
+  extraPythonPackages = p: [ p.pyjwt ];
+
+  testScript =
+    { nodes, ... }:
+    let
+      withSecrets = "${nodes.machine.system.build.toplevel}/specialisation/withSecrets";
+    in
+    ''
+      import jwt
+
+      machine.wait_for_unit("postgresql.service")
+
+      def wait_for_postgrest():
+          machine.wait_for_unit("postgrest.service")
+          machine.wait_until_succeeds("curl --fail -s http://localhost:3001/ready", timeout=30)
+
+      with subtest("anonymous access"):
+          wait_for_postgrest()
+          machine.succeed(
+            "curl --fail-with-body --no-progress-meter --unix-socket /run/postgrest/postgrest.sock http://localhost",
+            timeout=2
+          )
+
+      machine.execute("""
+        mkdir -p /run/secrets
+        echo "*:*:*:*:password" > /run/secrets/.pgpass
+        echo reallyreallyreallyreallyverysafe > /run/secrets/jwt.secret
+      """)
+
+      with subtest("authenticated access"):
+          machine.succeed("${withSecrets}/bin/switch-to-configuration test >&2")
+          wait_for_postgrest()
+          token = jwt.encode({ "role": "authenticated" }, "reallyreallyreallyreallyverysafe")
+          machine.succeed(
+            f"curl --fail-with-body --no-progress-meter -H 'Authorization: Bearer {token}' http://localhost:3000",
+            timeout=2
+          )
+    '';
+}
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -14,14 +14,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qpwgraph";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-BU57Iprz+kQXybKtR26Qi+3gsLv761hlg4HAnay6hIA=";
+    sha256 = "sha256-adgUpX2xfjf61//SUfhUU4NCP048q0WsTM4YkUny0UE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@ -40,14 +40,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mame";
-  version = "0.275";
+  version = "0.276";
  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
    rev = "mame${srcVersion}";
-    hash = "sha256-VD0T+zoR8fPZqRwTVrk2k5ui3tLQumEg1Fd64SJdszU=";
+    hash = "sha256-HrEQmeCTwNXcEWcpXfLkBNnZdcZag4nB6ZN+8KKf5AE=";
  };

  outputs = [
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@ -1,6 +1,17 @@
-{ lib, mkDerivation, fetchFromGitHub
-, python3, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
-, which, perl, libgit2
+{
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  python3,
+  ruby,
+  qtbase,
+  qtmultimedia,
+  qttools,
+  qtxmlpatterns,
+  which,
+  perl,
+  libgit2,
+  stdenv,
 }:

 mkDerivation rec {
@ -41,12 +52,28 @@ mkDerivation rec {
    runHook postBuild
  '';

-  postBuild = ''
-    mkdir $out/bin
-    mv $out/lib/klayout $out/bin/
+  postBuild =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir $out/bin

-    install -Dm444 etc/klayout.desktop -t $out/share/applications
-    install -Dm444 etc/logo.png $out/share/icons/hicolor/256x256/apps/klayout.png
+      install -Dm444 etc/klayout.desktop -t $out/share/applications
+      install -Dm444 etc/logo.png $out/share/icons/hicolor/256x256/apps/klayout.png
+      mv $out/lib/klayout $out/bin/
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      mv $out/lib/klayout.app $out/Applications/
+    '';
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    exec_name=$out/Applications/klayout.app/Contents/MacOS/klayout
+
+    for lib in $out/lib/libklayout_*.0.dylib; do
+      base_name=$(basename $lib)
+      install_name_tool -change "$base_name" "@rpath/$base_name" "$exec_name"
+    done
+
+    wrapQtApp "$out/Applications/klayout.app/Contents/MacOS/klayout"
  '';

  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-parentheses" ];
@ -63,8 +90,7 @@ mkDerivation rec {
    license = with licenses; [ gpl2Plus ];
    homepage = "https://www.klayout.de/";
    changelog = "https://www.klayout.de/development.html#${version}";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ ];
  };
 }
-
--- a/pkgs/applications/science/electronics/dsview/default.nix
+++ b/pkgs/applications/science/electronics/dsview/default.nix
@ -16,7 +16,7 @@
  desktopToDarwinBundle,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "dsview";

  version = "1.3.2";
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "DreamSourceLab";
    repo = "DSView";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "sha256-d/TfCuJzAM0WObOiBhgfsTirlvdROrlCm+oL1cqUrIs=";
  };

@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
    ./install.patch
  ];

+  # /build/source/libsigrok4DSL/strutil.c:343:19: error: implicit declaration of function 'strcasecmp'; did you mean 'g_strcasecmp'? []
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -49,15 +52,15 @@ stdenv.mkDerivation rec {
    python3
  ] ++ lib.optional stdenv.hostPlatform.isLinux qtwayland;

-  meta = with lib; {
+  meta = {
    description = "GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
    mainProgram = "DSView";
    homepage = "https://www.dreamsourcelab.com/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
      bachp
      carlossless
    ];
  };
-}
+})
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-studio";
-  version = "31.0.2";
+  version = "31.0.3";

  src = fetchFromGitHub {
    owner = "obsproject";
    repo = "obs-studio";
    rev = finalAttrs.version;
-    hash = "sha256-I8VExGFr0thEaT8vHvdNwck7AYSpdpfLVPjij1Utt0E=";
+    hash = "sha256-i1wkGlafPvfMTsQr5Ww5iwmUu+23cr0YmN10llJfohA=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/al/aligator/package.nix
+++ b/pkgs/by-name/al/aligator/package.nix
@ -8,7 +8,7 @@
  gbenchmark,
  graphviz,
  lib,
-  llvmPackages, # llvm/Support/Host.h required by casadi 3.6.5 and not available in llvm 18
+  llvmPackages,
  pinocchio,
  pkg-config,
  proxsuite-nlp,
@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "aligator";
-  version = "0.8.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "Simple-Robotics";
    repo = "aligator";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-o4QjxTaZUa17hZsCv4hCI2cedaHoojBtLe8SVUkl0bo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oy2qcJbIGr5pe+XYWKntfsc6Ie7oEU1qqrPXjuqULmY=";
  };

  outputs = [
@ -36,13 +36,21 @@ stdenv.mkDerivation (finalAttrs: {

  strictDeps = true;

-  nativeBuildInputs = [
-    doxygen
-    cmake
-    graphviz
-    pkg-config
-  ] ++ lib.optional pythonSupport python3Packages.pythonImportsCheckHook;
-  buildInputs = [ fmt ] ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+  nativeBuildInputs =
+    [
+      doxygen
+      cmake
+      graphviz
+      pkg-config
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.pythonImportsCheckHook
+    ];
+  buildInputs =
+    [ fmt ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.openmp
+    ];
  propagatedBuildInputs =
    [ suitesparse ]
    ++ lib.optionals pythonSupport [
@ -74,14 +82,19 @@ stdenv.mkDerivation (finalAttrs: {
    ]
    ++ lib.optionals (stdenv.hostPlatform.isDarwin && pythonSupport) [
      # ignore one failing test for now
-      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;aligator-test-py-integrators")
+      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;aligator-test-py-rollout")
    ];

  # Fontconfig error: Cannot load default config file: No such file: (null)
  env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";

-  # Fontconfig error: No writable cache directories
-  preBuild = "export XDG_CACHE_HOME=$(mktemp -d)";
+  preBuild = ''
+    # silence matplotlib warning
+    export MPLCONFIGDIR=$(mktemp -d)
+
+    # Fontconfig error: No writable cache directories
+    export XDG_CACHE_HOME=$(mktemp -d)
+  '';

  doCheck = true;
  pythonImportsCheck = [ "aligator" ];
--- a/pkgs/by-name/ay/ayatana-indicator-display/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-display/package.nix
@ -17,6 +17,7 @@
  libgudev,
  libqtdbusmock,
  libqtdbustest,
+  librda,
  libsForQt5,
  lomiri,
  mate,
@ -30,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-display";
-  version = "24.5.0";
+  version = "24.5.1";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-display";
    tag = finalAttrs.version;
-    hash = "sha256-ZEmJJtVK1dHIrY0C6pqVu1N5PmQtYqX0K5v5LvzNfFA=";
+    hash = "sha256-vvDgJVFrgtjAzDXXas19osDydS+C3brZOctXIIWrkyM=";
  };

  postPatch = ''
@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
      glib
      libayatana-common
      libgudev
+      librda
      libsForQt5.qtbase
      systemd
    ]
--- a/pkgs/by-name/ay/ayatana-indicator-messages/fix-pie.patch
+++ b/pkgs/by-name/ay/ayatana-indicator-messages/fix-pie.patch
@ -1,29 +0,0 @@
-From 316457cf70dd105905d5d4925f43de280f08ab10 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Sat, 11 Jan 2025 20:55:29 +0100
-Subject: [PATCH] tests/CMakeLists.txt: Drop hardcoded -no-pie linker flags
-
---
- tests/CMakeLists.txt | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 63beacb..5b0812c 100644
--- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -32,7 +32,6 @@ add_dependencies("indicator-messages-service" "ayatana-indicator-messages-servic
- # test-gactionmuxer
- 
- add_executable("test-gactionmuxer" test-gactionmuxer.cpp)
-target_link_options("test-gactionmuxer" PRIVATE -no-pie)
- target_include_directories("test-gactionmuxer" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/src")
- target_link_libraries("test-gactionmuxer" "indicator-messages-service" ${PROJECT_DEPS_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
- add_test("test-gactionmuxer" "test-gactionmuxer")
-@@ -59,7 +58,6 @@ add_custom_target("gschemas-compiled" ALL DEPENDS gschemas.compiled)
- 
- pkg_check_modules(DBUSTEST REQUIRED dbustest-1)
- add_executable("indicator-test" indicator-test.cpp)
-target_link_options("indicator-test" PRIVATE -no-pie)
- target_include_directories("indicator-test" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} ${DBUSTEST_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/libmessaging-menu")
- target_link_libraries("indicator-test" "messaging-menu" ${PROJECT_DEPS_LIBRARIES} ${DBUSTEST_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
- target_compile_definitions(
--- a/pkgs/by-name/ay/ayatana-indicator-messages/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-messages/package.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-messages";
-  version = "24.5.0";
+  version = "24.5.1";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-messages";
    tag = finalAttrs.version;
-    hash = "sha256-D1181eD2mAVXEa7RLXXC4b2tVGrxbh0WWgtbC1anHH0=";
+    hash = "sha256-M6IXI0ZnWPZod2ewxxfCeHhdYUrWDW/BFc1vMHmjObA=";
  };

  outputs = [
@ -40,16 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ] ++ lib.optionals withDocumentation [ "devdoc" ];

-  patches = [
-    # Remove when https://github.com/AyatanaIndicators/ayatana-indicator-messages/pull/39 merged & in release
-    ./fix-pie.patch
-  ];
-
  postPatch =
    ''
      # Uses pkg_get_variable, cannot substitute prefix with that
      substituteInPlace data/CMakeLists.txt \
-        --replace-fail "\''${SYSTEMD_USER_DIR}" "$out/lib/systemd/user"
+        --replace-fail 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir DEFINE_VARIABLES prefix=''${CMAKE_INSTALL_PREFIX})'

      # Bad concatenation
      substituteInPlace libmessaging-menu/messaging-menu.pc.in \
@ -61,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
        --replace-fail 'GI_TYPELIB_PATH=\"' 'GI_TYPELIB_PATH=\"$GI_TYPELIB_PATH$\{GI_TYPELIB_PATH\:+\:\}'
    ''
    + lib.optionalString (!withDocumentation) ''
-      sed -i CMakeLists.txt \
-        '/add_subdirectory(doc)/d'
+      substituteInPlace CMakeLists.txt \
+        --replace-fail 'add_subdirectory(doc)' '# add_subdirectory(doc)'
    '';

  strictDeps = true;
@ -105,9 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DENABLE_TESTS=${lib.boolToString finalAttrs.finalPackage.doCheck}"
-    "-DGSETTINGS_LOCALINSTALL=ON"
-    "-DGSETTINGS_COMPILE=ON"
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "GSETTINGS_COMPILE" true)
  ];

  makeFlags = lib.optionals withDocumentation [
@ -163,6 +158,9 @@ stdenv.mkDerivation (finalAttrs: {
      others, e.g. XFCE, LXDE).
    '';
    homepage = "https://github.com/AyatanaIndicators/ayatana-indicator-messages";
+    changelog = "https://github.com/AyatanaIndicators/ayatana-indicator-messages/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ OPNA2608 ];
--- a/pkgs/by-name/b3/b3sum/package.nix
+++ b/pkgs/by-name/b3/b3sum/package.nix
@ -6,15 +6,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "b3sum";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchCrate {
    inherit version pname;
-    hash = "sha256-bDydKLPJgeUngkWO8L5BkJP9rGy3mx0QJhWAN2CCYhE=";
+    hash = "sha256-FWblGKr/ZQsLZkPOax20FYEyoLiPREf7UjfOtFCljZU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-yB0noD5eabr+HANPRhIhBEG4PCwtJPULNIy+Wx/tC3U=";
+  cargoHash = "sha256-vSxAG0CKtTHZ/3fSDtZqmqvfY+swDBBPZ8YZP1Vlj0w=";

  meta = {
    description = "BLAKE3 cryptographic hash function";
--- a/pkgs/by-name/ca/casadi/package.nix
+++ b/pkgs/by-name/ca/casadi/package.nix
@ -38,13 +38,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "casadi";
-  version = "3.6.7";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "casadi";
    repo = "casadi";
    rev = finalAttrs.version;
-    hash = "sha256-Mft0qhjdAbU82RgjYuKue5p7EqbTbt3ii5yXSsCFHrQ=";
+    hash = "sha256-WumXAWO65XnNQqHMqAwfj2Y+KGOVTWx95qIuyE1M9us=";
  };

  patches = [
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "44.0";
+  version = "45.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = "cloud-hypervisor";
    rev = "v${version}";
-    hash = "sha256-2nA8bhezmGa6Gu420nxDrgW0SonTQv1WoGYmBwm7/bI=";
+    hash = "sha256-PmgHO3gRE/LfLiRC+sAQXKUeclweVUNJV2ihpkvx0Wg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-e2VbzBPfoy5+YrqZ5mkbxMLpQIOG0x5tIhNG6Tv+u0M=";
+  cargoHash = "sha256-h9ydLEp7GpW5jMkt5jObR09lPWGs+rmvdoEZntIZwxY=";

  separateDebugInfo = true;

--- a/pkgs/by-name/cr/crocoddyl/package.nix
+++ b/pkgs/by-name/cr/crocoddyl/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "crocoddyl";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "loco-3d";
    repo = "crocoddyl";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-oWcclzzuswiR1SaQJd6GnMltJ2vgt7AgJPT0FJzD1Gs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eUH9fMhuIUp5kuDKNo4B8iJ3JlMIqv7wX6meOpyPTJk=";
  };

  outputs = [
@ -59,17 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
      python3Packages.scipy
    ];

-  cmakeFlags =
-    [
-      (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-      (lib.cmakeBool "BUILD_EXAMPLES" pythonSupport)
-      (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # ref. https://github.com/stack-of-tasks/pinocchio/issues/2563
-      # remove this for crocoddyl >= 3.0.0
-      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;test_pybinds_*")
-    ];
+  cmakeFlags = [
+    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+    (lib.cmakeBool "BUILD_EXAMPLES" pythonSupport)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+  ];

  prePatch = ''
    substituteInPlace \
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.91.1";
+  version = "1.91.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-BIfyuZ7bf1P/8JfavIJNi06k8zEcCL1jwxAEnknpqq4=";
+    hash = "sha256-7f1qJ9dgouhj+DGikdIzUREPraAA/1y/5lYA8fbIoJo=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fe/feather/package.nix
+++ b/pkgs/by-name/fe/feather/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "feather";
-  version = "2.7.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "feather-wallet";
    repo = "feather";
    rev = finalAttrs.version;
-    hash = "sha256-CwydKX8cCtmrUSLUHNCDOteVmkjzj0zMHgwUyrWrWm8=";
+    hash = "sha256-c7qa6MmENCEjZz8b/xyCcCO2+iI5dI8hJynBW3haSWE=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@ -6,6 +6,7 @@
  installShellFiles,
  nix-update-script,
  versionCheckHook,
+  git,
 }:

 buildGoModule rec {
@ -32,8 +33,7 @@ buildGoModule rec {
    versionCheckHook
  ];

-  # With v8 the config tests are blocking
-  doCheck = false;
+  nativeCheckInputs = [ git ];

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd ${pname} \
--- a/pkgs/by-name/go/go-grip/package.nix
+++ b/pkgs/by-name/go/go-grip/package.nix
@ -0,0 +1,29 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  gitUpdater,
+}:
+buildGoModule rec {
+  pname = "go-grip";
+  version = "0.5.6";
+
+  src = fetchFromGitHub {
+    owner = "chrishrb";
+    repo = "go-grip";
+    tag = "v${version}";
+    hash = "sha256-c3tl5nALPqIAMSqjbbQDi6mN6M1mKJvzxxDHcj/QyuY=";
+  };
+
+  vendorHash = "sha256-aU6vo/uqJzctD7Q8HPFzHXVVJwMmlzQXhAA6LSkRAow=";
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Preview Markdown files locally before committing them";
+    homepage = "https://github.com/chrishrb/go-grip";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ heisfer ];
+    mainProgram = "go-grip";
+  };
+}
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@ -7,13 +7,13 @@

 buildGo124Module rec {
  pname = "golangci-lint";
-  version = "2.0.0";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    hash = "sha256-1TDYMjFEyI9ULnLn+1RYxRWrGkJZcEDDGvLb4qiVLNc=";
+    hash = "sha256-+IndC9znKgVGiFWW0aCNjhxPwX1kDFnfG2+SKEQ15Rc=";
  };

  vendorHash = "sha256-B6mCvJtIfRbAv6fZ8Ge82nT9oEcL3WR4D+AAVs9R3zM=";
--- a/pkgs/by-name/la/lakectl/package.nix
+++ b/pkgs/by-name/la/lakectl/package.nix
@ -7,18 +7,18 @@

 buildGoModule (finalAttrs: {
  pname = "lakectl";
-  version = "1.53.0";
+  version = "1.53.1";

  src = fetchFromGitHub {
    owner = "treeverse";
    repo = "lakeFS";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AYFhkwnlK8RU/HPemJkoZiJ1DCSszIFybJRsUIGhs4g=";
+    hash = "sha256-kZ7GvrrZq9XAq//jC6sP4uudTJsGJw6/vYXAPs63Wq8=";
  };

  subPackages = [ "cmd/lakectl" ];
  proxyVendor = true;
-  vendorHash = "sha256-p5eHkVbUrcSC4i+R/HGh2nSTIWVkFNiN+TVh10rdWqs=";
+  vendorHash = "sha256-X7rXEM+8fgbmG+K05KOJp8345muASgnrWGW0jbJ9WSM=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/la/lazysql/package.nix
+++ b/pkgs/by-name/la/lazysql/package.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "lazysql";
-  version = "0.3.6";
+  version = "0.3.7";

  src = fetchFromGitHub {
    owner = "jorgerojas26";
    repo = "lazysql";
    rev = "v${version}";
-    hash = "sha256-tQZ8thL3rmTtxDG0Z/DgxH1PjDL4Kxx9LXDLqVTZ7Lc=";
+    hash = "sha256-fpzcCCLkUJGuTfQiADwLL2238LP0TJJMYAXUwCfPkFM=";
  };

  vendorHash = "sha256-LLOUTml/mz7edCUy82k+S5PfpFovgUTQr0BoQQXiVGs=";
--- a/pkgs/by-name/li/libpsm2/package.nix
+++ b/pkgs/by-name/li/libpsm2/package.nix
@ -53,5 +53,7 @@ stdenv.mkDerivation rec {
    ];
    platforms = [ "x86_64-linux" ];
    maintainers = [ maintainers.bzizou ];
+    # uses __off64_t, srand48_r, lrand48_r, drand48_r
+    broken = stdenv.hostPlatform.isMusl;
  };
 }
--- a/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/Cargo.lock
+++ b/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/Cargo.lock
--- a/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix
+++ b/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix
@ -21,13 +21,9 @@ stdenv.mkDerivation rec {
    hash = "sha256-g86RPfhF9XHpbXhHRbyhl920VazCrQyRQrYV6tVCHy4=";
  };

-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "matrix-sdk-base-0.7.0" = "sha256-nCiG4T/MB7gvGrmadKOEbh8+54081PHee9Bm8oY/nl0=";
-      "ruma-0.10.1" = "sha256-Yc5RKk4aRjNIoQsMl30fFehTDCkRO9VvenAvLoVHzXo=";
-      "vodozemac-0.6.0" = "sha256-jJgrJJ0SFcy2oRRZ3ubuKnM2pLO8Tx6NyXordWJjz8o=";
-    };
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-5+nW5g9oxe4L39wJUkSuP3ul5yH8V+E7IdhQVfvzhNk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/me/meld/package.nix
+++ b/pkgs/by-name/me/meld/package.nix
@ -22,13 +22,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "meld";
-  version = "3.22.3";
+  version = "3.23.0";

  format = "other";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N/fynrH/D+xNiwiNVIPFVt4QifbQGP5tSBmTyvJJnYQ=";
+    url = "mirror://gnome/sources/meld/${lib.versions.majorMinor version}/meld-${version}.tar.xz";
+    hash = "sha256-mDwqQkDgJaIQnHc4GYcQ6dawY8kQsEgzLRRpDPU4wqY=";
  };

  nativeBuildInputs = [
@ -62,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {

  passthru = {
    updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "meld";
      versionPolicy = "none"; # should be odd-unstable but we are tracking unstable versions for now
    };
  };
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@ -30,19 +30,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miracle-wm";
-  version = "0.4.1";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "miracle-wm-org";
    repo = "miracle-wm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LPcVLpskpmHc8EzdNqMT6BnbY8Le/BVojpXPIqy6tGI=";
+    hash = "sha256-PCY6vAnDjyoIL66oREUGRypQFX90EKB1RlXTkQDyXMw=";
  };

  postPatch =
    ''
      substituteInPlace CMakeLists.txt \
-        --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}'
+        --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
+        --replace-fail '-march=native' '# -march=native' \
+        --replace-fail '-flto' '# -flto'
    ''
    + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
      substituteInPlace CMakeLists.txt \
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@ -23,17 +23,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mise";
-  version = "2025.3.6";
+  version = "2025.3.11";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    rev = "v${version}";
-    hash = "sha256-wp/C7RrMcpk/BFath9zZbEMzhQWFYagnT2zimnPRpPI=";
+    hash = "sha256-n7A6LGjcVz6LWz8fkkG5XS2WZf3FFkbidnt/S5jxy5g=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-49C4MzvGUiO16kNEKoHtlvkOxG16jsD2iW5upaVuYGI=";
+  cargoHash = "sha256-On2+ROA71RyZdFPvH4Zem/494Q4uCYS4EZSvQL1DDWQ=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/na/narsil/package.nix
+++ b/pkgs/by-name/na/narsil/package.nix
@ -14,16 +14,16 @@
 }:
 stdenv.mkDerivation rec {
  pname = "narsil";
-  version = "7c20b01e055491e86a44201504e8d36873ef1822";
+  version = "1.4.0-48-gaf7c8c1b3";

  src = fetchFromGitHub {
    owner = "NickMcConnell";
    repo = "NarSil";
-    rev = version;
-    hash = "sha256-6J9WCWXhKiTRLiH08DTGzAXe8QZFQOLYJkfNVONgWU0=";
+    tag = version;
+    hash = "sha256-w/rXKD66Kx+XE1ItOwurf5XWE02OHirofVMUQqpf6WQ=";
  };

-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=main" ]; };
+  passthru.updateScript = nix-update-script { };

  nativeBuildInputs = [ autoreconfHook ];
  buildInputs =
--- a/pkgs/by-name/om/omake/package.nix
+++ b/pkgs/by-name/om/omake/package.nix
@ -1,18 +1,19 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  ocaml,
 }:

-stdenv.mkDerivation rec {
-
+stdenv.mkDerivation (finalAttrs: {
  pname = "omake";
-  version = "0.10.6";
+  version = "0.10.7";

-  src = fetchurl {
-    url = "http://download.camlcity.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-AuSZEnybyk8HaDZ7mbwDqjFXMXVQ7TDRuRU/aRY8/yE=";
+  src = fetchFromGitHub {
+    owner = "ocaml-omake";
+    repo = "omake";
+    tag = "omake-${finalAttrs.version}";
+    hash = "sha256-5ZOdY3uGcI0KGpnr7epUwe2ueKCoLeaHGzaiTiXLNoc=";
  };

  strictDeps = true;
@ -28,4 +29,4 @@ stdenv.mkDerivation rec {
    ];
    inherit (ocaml.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/pi/pinentry-dmenu/package.nix
+++ b/pkgs/by-name/pi/pinentry-dmenu/package.nix
@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fontconfig,
+  gpgme,
+  libX11,
+  libXinerama,
+  libXft,
+  pkg-config,
+  zlib,
+  writeText,
+  libassuan,
+  libconfig,
+  libgpg-error,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pinentry-dmenu";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "ritze";
+    repo = "pinentry-dmenu";
+    tag = finalAttrs.version;
+    hash = "sha256-FmP9tI/oU7VM8x+Wu6bbeg1CVopZc6oOWnd4qUptVV8=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    fontconfig
+    gpgme
+    libassuan
+    libconfig
+    libgpg-error
+    libX11
+    libXinerama
+    libXft
+  ];
+
+  preConfigure = ''
+    makeFlagsArray+=(
+      PREFIX="$out"
+      CC="$CC"
+      # default config.mk hardcodes dependent libraries and include paths
+      INCS="`$PKG_CONFIG --cflags fontconfig x11 xft xinerama`"
+      LIBS="`$PKG_CONFIG --libs   fontconfig x11 xft xinerama`"
+    )
+  '';
+
+  meta = {
+    description = "Pinentry implementation based on dmenu";
+    homepage = "https://github.com/ritze/pinentry-dmenu";
+    changelog = "https://github.com/ritze/pinentry-dmenu/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ sweiglbosker ];
+    mainProgram = "pinentry-dmenu";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/pp/pplite/package.nix
+++ b/pkgs/by-name/pp/pplite/package.nix
@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchurl,
+  fetchpatch,
  flint3,
  gmp,
 }:
@ -20,6 +21,15 @@ stdenv.mkDerivation {
    gmp
  ];

+  patches = [
+    # https://github.com/ezaffanella/PPLite/pull/1
+    (fetchpatch {
+      name = "flint-3_2.patch";
+      url = "https://github.com/ezaffanella/PPLite/commit/96fd1e50131f70bb78efdd60985525e970c9df06.patch";
+      hash = "sha256-8FNyL8h/rBm2Hegib2l08vqEmFDU0PhMCV8Ui2G4xHQ=";
+    })
+  ];
+
  meta = {
    homepage = "https://github.com/ezaffanella/PPLite";
    description = "Convex polyhedra library for Abstract Interpretation";
--- a/pkgs/by-name/rk/rke/package.nix
+++ b/pkgs/by-name/rk/rke/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "rke";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-5KL9XAd0CnJ7yTfU1KpYqHBu9DxTTqo2fMPAr9IqqZY=";
+    hash = "sha256-mTSeUFmkXI9yZ1yeBXzudf2BmLtdmoiTlB/wtn++NAo=";
  };

  vendorHash = "sha256-5+BjXPh52RNoaU/ABpvgbAO+mKcW4Hg2SRxRhV9etIo=";
--- a/pkgs/by-name/ro/roslyn-ls/deps.json
+++ b/pkgs/by-name/ro/roslyn-ls/deps.json
@ -199,15 +199,15 @@
  },
  {
    "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "9.0.0-beta.25111.5",
-    "hash": "sha256-gwzSdsu6YfLYxjltDOUouvajClMQ/BW8aiJQlYyxtlk=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25111.5/microsoft.dotnet.arcade.sdk.9.0.0-beta.25111.5.nupkg"
+    "version": "9.0.0-beta.25161.4",
+    "hash": "sha256-NrQSPWnG7RlhNMyrqcz4sR0+WWpJpoTrrRtVLkIGFms=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25161.4/microsoft.dotnet.arcade.sdk.9.0.0-beta.25161.4.nupkg"
  },
  {
    "pname": "Microsoft.DotNet.XliffTasks",
-    "version": "9.0.0-beta.25111.5",
-    "hash": "sha256-ZOwHiBzSiJ9PJwLP1iw18sZoxW+78ej+gGg4yt9dei4=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/9.0.0-beta.25111.5/microsoft.dotnet.xlifftasks.9.0.0-beta.25111.5.nupkg"
+    "version": "9.0.0-beta.25161.4",
+    "hash": "sha256-l4CTmNsxuFP3Bjs2mS1/zdmsb/ZvyHpddTX2HT+MVu4=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/9.0.0-beta.25161.4/microsoft.dotnet.xlifftasks.9.0.0-beta.25161.4.nupkg"
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@ -32,18 +32,18 @@ in
 buildDotnetModule rec {
  inherit pname dotnet-sdk dotnet-runtime;

-  vsVersion = "2.69.22";
+  vsVersion = "2.70.15";
  src = fetchFromGitHub {
    owner = "dotnet";
    repo = "roslyn";
    rev = "VSCode-CSharp-${vsVersion}";
-    hash = "sha256-z3DDbLFKH5u0w6LswZcghLkkqDYEtCRFNIfoq7N+P2c=";
+    hash = "sha256-vXRt/scWxekd8U04MGfD4W8aj05H0CqkbIYZy8+0OdU=";
  };

  # versioned independently from vscode-csharp
  # "roslyn" in here:
  # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "4.14.0-3.25156.1";
+  version = "4.14.0-3.25164.3";
  projectFile = "src/LanguageServer/${project}/${project}.csproj";
  useDotnetFromEnv = true;
  nugetDeps = ./deps.json;
--- a/pkgs/by-name/so/sops/package.nix
+++ b/pkgs/by-name/so/sops/package.nix
@ -1,29 +1,24 @@
 {
  lib,
-  buildGo122Module,
+  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
  versionCheckHook,
  nix-update-script,
 }:

-buildGo122Module rec {
+buildGoModule rec {
  pname = "sops";
-  version = "3.9.4";
+  version = "3.10.0";

  src = fetchFromGitHub {
    owner = "getsops";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-w2RMK1Fl/k8QXV68j0Kc6shtx4vQa07RCnpgHLM8c8Q=";
+    hash = "sha256-NOZvVL4b7+TVlB6iM4HJDa5PHOjvcN0BXDMOHmqg7lU=";
  };

-  vendorHash = "sha256-wxmSj3QaFChGE+/2my7Oe2mhprwi404izUxteecyggY=";
-
-  postPatch = ''
-    substituteInPlace go.mod \
-      --replace-fail "go 1.22" "go 1.22.7"
-  '';
+  vendorHash = "sha256-I+iwimrNdKABZFP2etZTQJAXKigh+0g/Jhip86Cl5Rg=";

  subPackages = [ "cmd/sops" ];

--- a/pkgs/by-name/ti/tiledb/FindMagic_EP.cmake.patch
+++ b/pkgs/by-name/ti/tiledb/FindMagic_EP.cmake.patch
@ -0,0 +1,14 @@
+diff --git a/FindMagic_EP.cmake b/FindMagic_EP.cmake
+--- a/cmake/Modules/FindMagic_EP.cmake
+++ b/cmake/Modules/FindMagic_EP.cmake
+@@ -126,9 +126,7 @@ if(NOT TILEDB_LIBMAGIC_EP_BUILT)
+     # that was modified by tiledb to also build with cmake for nix
+     ExternalProject_Add(ep_magic
+       PREFIX "externals"
+-      GIT_REPOSITORY "https://github.com/TileDB-Inc/file-windows.git"
+-      GIT_TAG "5.38.2.tiledb"
+-      GIT_SUBMODULES_RECURSE TRUE
+      DOWNLOAD_COMMAND true
+       UPDATE_COMMAND ""
+       CMAKE_ARGS
+         -DCMAKE_INSTALL_PREFIX=${TILEDB_EP_INSTALL_PREFIX}
--- a/pkgs/by-name/ti/tiledb/package.nix
+++ b/pkgs/by-name/ti/tiledb/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+
  cmake,
  zlib,
  lz4,
@ -15,56 +16,70 @@
  clang-tools,
  catch2_3,
  python3,
+  gtest,
  doxygen,
  fixDarwinDylibNames,
-  gtest,
-  rapidcheck,
-  libpng,
-  file,
-  runCommand,
-  catch2,
  useAVX2 ? stdenv.hostPlatform.avx2Support,
 }:

 let
-  rapidcheck' = runCommand "rapidcheck" { } ''
-    cp -r ${rapidcheck.out} $out
-    chmod -R +w $out
-    cp -r ${rapidcheck.dev}/* $out
-  '';
+  # pre-fetch ExternalProject from cmake/Modules/FindMagic_EP.cmake
+  ep-file-windows = fetchFromGitHub {
+    owner = "TileDB-Inc";
+    repo = "file-windows";
+    rev = "5.38.2.tiledb";
+    hash = "sha256-TFn30VCuWZr252VN1T5NNCZe2VEN3xQSomS7XxxKGF8=";
+    fetchSubmodules = true;
+  };
+
 in
 stdenv.mkDerivation rec {
  pname = "tiledb";
-  version = "2.27.2";
+  version = "2.18.2";

  src = fetchFromGitHub {
    owner = "TileDB-Inc";
    repo = "TileDB";
-    tag = version;
-    hash = "sha256-zk4jkXJMh6wpuEKaCvuKUDod+F8B/6W5Lw8gwelcPEM=";
+    rev = version;
+    hash = "sha256-uLiXhigYz3v7NgY38twot3sBHxZS5QCrOiPfME4wWzE=";
  };

-  # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
-  # without the -fexperimental-library flag. Tiledb adds its own
-  # implementations in the std namespace which conflict with libcxx. This
-  # test can be re-enabled once libcxx supports stop_token and jthread.
-  postPatch = lib.optionalString (stdenv.cc.libcxx != null) ''
-    truncate -s0 tiledb/stdx/test/CMakeLists.txt
-  '';
+  patches = [
+    ./FindMagic_EP.cmake.patch
+  ];

-  env.TILEDB_DISABLE_AUTO_VCPKG = "1";
+  postPatch =
+    ''
+      # copy pre-fetched external project to directory where it is expected to be
+      mkdir -p build/externals/src
+      cp -a ${ep-file-windows} build/externals/src/ep_magic
+      chmod -R u+w build/externals/src/ep_magic
+
+      # add openssl on path
+      sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \
+        cmake/Modules/FindOpenSSL_EP.cmake
+    ''
+    # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
+    # without the -fexperimental-library flag. Tiledb adds its own
+    # implementations in the std namespace which conflict with libcxx. This
+    # test can be re-enabled once libcxx supports stop_token and jthread.
+    + lib.optionalString (stdenv.cc.libcxx != null) ''
+      truncate -s0 tiledb/stdx/test/CMakeLists.txt
+    '';
+
+  # upstream will hopefully fix this in some newer release
+  env.CXXFLAGS = "-include random";

  # (bundled) blosc headers have a warning on some archs that it will be using
  # unaccelerated routines.
  cmakeFlags = [
+    "-DTILEDB_VCPKG=OFF"
    "-DTILEDB_WEBP=OFF"
    "-DTILEDB_WERROR=OFF"
-    # https://github.com/NixOS/nixpkgs/issues/144170
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
  ] ++ lib.optional (!useAVX2) "-DCOMPILER_SUPPORTS_AVX2=FALSE";

  nativeBuildInputs = [
+    ep-file-windows
    catch2_3
    clang-tools
    cmake
@ -72,6 +87,10 @@ stdenv.mkDerivation rec {
    doxygen
  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

+  nativeCheckInputs = [
+    gtest
+  ];
+
  buildInputs = [
    zlib
    lz4
@ -82,34 +101,20 @@ stdenv.mkDerivation rec {
    openssl
    boost
    libpqxx
-    libpng
-    file
-    rapidcheck'
-    catch2
-  ];
-
-  # fatal error: catch.hpp: No such file or directory
-  doCheck = false;
-
-  nativeCheckInputs = [
-    gtest
-    catch2
  ];

  # test commands taken from
  # https://github.com/TileDB-Inc/TileDB/blob/dev/.github/workflows/unit-test-runs.yml
  checkPhase = ''
    runHook preCheck
-
-    pushd ..
-    cmake --build build --target tests
-    ctest --test-dir build -R '(^unit_|test_assert)' --no-tests=error
-    ctest --test-dir build -R 'test_ci_asserts'
-    popd
-
+    make -C tiledb tests -j$NIX_BUILD_CORES
+    make -C tiledb test ARGS="-R '^unit_'" -R "test_assert"
+    make -C tiledb test ARGS="-R 'test_ci_asserts'"
    runHook postCheck
  '';

+  doCheck = true;
+
  installTargets = [
    "install-tiledb"
    "doc"
@ -119,11 +124,11 @@ stdenv.mkDerivation rec {
    install_name_tool -add_rpath ${tbb}/lib $out/lib/libtiledb.dylib
  '';

-  meta = {
+  meta = with lib; {
    description = "TileDB allows you to manage the massive dense and sparse multi-dimensional array data";
    homepage = "https://github.com/TileDB-Inc/TileDB";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ rakesh4g ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ rakesh4g ];
  };
 }
--- a/pkgs/by-name/wa/waybackurls/package.nix
+++ b/pkgs/by-name/wa/waybackurls/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "waybackurls";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tomnomnom";
+    repo = "waybackurls";
+    tag = "v${version}";
+    hash = "sha256-aX6pCEp2809oYn1BUwdfKzJzMttnZItGXC1QL4yMztg=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Tool to fetch all the URLs that the Wayback Machine knows about for a domain";
+    homepage = "https://github.com/tomnomnom/waybackurls";
+    changelog = "https://github.com/tomnomnom/waybackurls/releases/tag/${src.tag}";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "waybackurls";
+  };
+}
--- a/pkgs/by-name/yg/yggstack/package.nix
+++ b/pkgs/by-name/yg/yggstack/package.nix
@ -2,20 +2,21 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nix-update-script,
 }:

 buildGoModule rec {
  pname = "yggstack";
-  version = "1.0.1";
+  version = "1.0.4";

  src = fetchFromGitHub {
    owner = "yggdrasil-network";
    repo = "yggstack";
    rev = "${version}";
-    hash = "sha256-RQ7AvVv+VLfgzlb7orZbSB7TNz/hj2fo832ed4WUN80=";
+    hash = "sha256-S3yk2v2RPGFeGDJ8Lmjr7VM2kIswIREfPpDLXM/P1YU=";
  };

-  vendorHash = "sha256-Hjb3KSh+2qYYKdgv4+dsSp0kAbzz8gu9qnQdA7wB5fA=";
+  vendorHash = "sha256-7EIUsMhAJ+uPD5LG7Yucpo82aJYYRt9vrmAbsQzNmEw=";

  ldflags = [
    "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildVersion=${version}"
@ -26,6 +27,8 @@ buildGoModule rec {

  doCheck = false;

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Yggdrasil as SOCKS proxy / port forwarder";
    homepage = "https://yggdrasil-network.github.io/";
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@ -1,5 +1,6 @@
 { lib
 , mkXfceDerivation
+, fetchpatch
 , polkit
 , exo
 , libxfce4util
@ -17,9 +18,25 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-session";
-  version = "4.20.0";
+  version = "4.20.2";

-  sha256 = "sha256-mn3ky1NzrpQZRkhc605mj+GFhbFq26eW59YKUfnX9X8=";
+  sha256 = "sha256-wd+8W9Z0dH7bqILBUNG9YxpRf8TnRJ/7b3QviM1HVnY=";
+
+  patches = [
+    # Use syntax compatible with most sh shells
+    # The `**` syntax is a bash extension
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/53d6e20a29948ae7aa179447cef0704786b77f8b.patch";
+      hash = "sha256-c8IU1VOcEYdZJy8Eq2wqSL5tTXt7gKfGOs7jxb8npOE=";
+    })
+
+    # wayland: start a D-Bus session only if there isn't one already
+    # https://gitlab.xfce.org/xfce/xfce4-session/-/issues/218
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/f6e2805b8a7742172f399d78618313bcb28bf095.patch";
+      hash = "sha256-EViVialDbdLH2SGUtcroo5iGc+B4HVJajV7PMl5q6vs=";
+    })
+  ];

  buildInputs = [
    exo
--- a/pkgs/development/ada-modules/gnatprove/0002-mute-aarch64-warnings.patch
+++ b/pkgs/development/ada-modules/gnatprove/0002-mute-aarch64-warnings.patch
@ -0,0 +1,22 @@
+--- a/src/counterexamples/ce_parsing.adb	2025-03-14 21:48:15.657409808 +0100
+++ b/src/counterexamples/ce_parsing.adb	2025-03-14 22:04:32.114664704 +0100
+@@ -975,6 +975,9 @@
+                elsif Is_Extended_Precision_Floating_Point_Type (Ty) then
+                   pragma Assert (Size (Exp) = 15);
+                   pragma Assert (Size (Significand) = 63);
+                  pragma Warnings (Off, "assertion will fail at run time");
+                  pragma Warnings (Off,
+                      "types for unchecked conversion have different sizes");
+                   declare
+                      package P is new Parse_Conversion
+                        (Interfaces.Unsigned_128, Long_Long_Float);
+@@ -983,6 +986,9 @@
+                   begin
+                      return (Float_K, (Extended_K, F));
+                   end;
+                  pragma Warnings (On,
+                      "types for unchecked conversion have different sizes");
+                  pragma Warnings (On, "assertion will fail at run time");
+                else
+                   raise Program_Error;
+                end if;
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@ -56,6 +56,9 @@ let
      patches = [
        # Disable Coq related targets which are missing in the fsf-14 branch
        ./0001-fix-install.patch
+
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
      ];
      commit_date = "2024-01-11";
    };
--- a/pkgs/development/ada-modules/gprbuild/nixpkgs-gnat.xml
+++ b/pkgs/development/ada-modules/gprbuild/nixpkgs-gnat.xml
@ -53,4 +53,37 @@
      <grep regexp="[^\r\n]+"></grep>
    </target>
  </compiler_description>
+  <configuration>
+    <!-- aarch64-linux - native compiler. -->
+    <targets>
+      <target name="^aarch64-unknown-linux-gnu$" />
+    </targets>
+    <hosts>
+      <host name="^aarch64-unknown-linux-gnu$" />
+    </hosts>
+    <config>
+   for Archive_Builder  use ("ar", "cr");
+   for Archive_Builder_Append_Option use ("q");
+   for Archive_Indexer  use ("ranlib");
+   for Archive_Suffix   use ".a";
+    </config>
+  </configuration>
+  <configuration>
+    <!-- aarch64-linux - native compiler. -->
+    <targets>
+      <target name="^aarch64-unknown-linux-gnu$" />
+    </targets>
+    <hosts>
+      <host name="^aarch64-unknown-linux-gnu$" />
+    </hosts>
+    <config>
+   for Object_Lister use ("nm", "-g");
+   for Object_Lister_Matcher use " [TDRBSG] (.*)";
+
+   package Linker is
+      for Export_File_Format use "GNU";
+      for Export_File_Switch use "-Wl,--version-script=";
+   end Linker;
+    </config>
+  </configuration>
 </gprconfig>
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -439,6 +439,7 @@ self: super: builtins.intersectAttrs super {
    dontCheck
    enableSeparateBinOutput
    (self.generateOptparseApplicativeCompletions [ "postgrest" ])
+    (overrideCabal { passthru.tests = pkgs.nixosTests.postgrest; })
  ];

  # Tries to mess with extended POSIX attributes, but can't in our chroot environment.
--- a/pkgs/development/libraries/flint/3.nix
+++ b/pkgs/development/libraries/flint/3.nix
@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  fetchpatch,
  fetchurl,
  gmp,
  mpfr,
@ -23,26 +22,13 @@ assert

 stdenv.mkDerivation rec {
  pname = "flint3";
-  version = "3.1.2";
+  version = "3.2.1";

  src = fetchurl {
-    url = "https://www.flintlib.org/flint-${version}.tar.gz";
-    sha256 = "sha256-/bOkMaN0ZINKz/O9wUX0/o0PlR3VMnxMb5P0y6xcJwA=";
+    url = "https://flintlib.org/download/flint-${version}.tar.gz";
+    hash = "sha256-ynvkbXeXInfrb+DE92dUhDL1a7U0qhfW26LXzOFc0j8=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/flintlib/flint/commit/e7d005c369754243cba32bd782ea2a5fc874fde5.diff";
-      hash = "sha256-IqEtYEpNVXfoTeerh/0ig+eDqUpAlGdBB3uO8ShYh3o=";
-    })
-    # C99 compliance (avoid using I as identifier): https://github.com/flintlib/flint/pull/2027
-    (fetchpatch {
-      name = "flint3-reserved-identifier.patch";
-      url = "https://github.com/flintlib/flint/commit/b579cdd2d45aa1109a764f6838e9888b937e7ac5.patch";
-      hash = "sha256-8GLlA9ACzzxSiYaxLv9+p0oJA5TS7289b0EyoNcsSaU=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoconf
    automake
@ -68,8 +54,6 @@ stdenv.mkDerivation rec {
  # We're not using autoreconfHook because flint's bootstrap
  # script calls autoreconf, among other things.
  preConfigure = ''
-    # the following configure.ac fix is only needed for flint 3.1.X
-    sed -i 's/if "$ac_cv_prog_cxx_g" = "yes"/if test "$ac_cv_prog_cxx_g" = "yes"/' configure.ac
    echo "Executing bootstrap.sh"
    ./bootstrap.sh
  '';
@ -92,7 +76,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Fast Library for Number Theory";
-    license = licenses.gpl2Plus;
+    license = licenses.lgpl3Plus;
    maintainers = with maintainers; [ smasher164 ] ++ teams.sage.members;
    platforms = platforms.unix;
    homepage = "https://www.flintlib.org/";
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -200,7 +200,11 @@ in stdenv.mkDerivation {

    (lib.mesonBool "gallium-nine" false) # Direct3D9 in Wine, largely supplanted by DXVK
    (lib.mesonBool "osmesa" false) # deprecated upstream
-    (lib.mesonEnable "gallium-xa" false) # old and mostly dead
+
+    # Only used by xf86-video-vmware, which has more features than VMWare's KMS driver,
+    # so we're keeping it for now. Should be removed when that's no longer the case.
+    # See: https://github.com/NixOS/nixpkgs/pull/392492
+    (lib.mesonEnable "gallium-xa" true)

    (lib.mesonBool "teflon" true) # TensorFlow frontend

--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "aiohomekit";
-  version = "3.2.8";
+  version = "3.2.13";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "Jc2k";
    repo = "aiohomekit";
    tag = version;
-    hash = "sha256-b197P2hTk6lhLKm+4VvyvyPZDqb7NqO0aqoIf3BQBfs=";
+    hash = "sha256-J6VxfuLHdxJ92V1puOWv+dnlpBKRBww1iP6IcRMqamk=";
  };

  build-system = [ poetry-core ];
@ -68,7 +68,7 @@ buildPythonPackage rec {
      Homekit accessories.
    '';
    homepage = "https://github.com/Jc2k/aiohomekit";
-    changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${version}";
+    changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
    mainProgram = "aiohomekitctl";
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "databricks-sdk";
-  version = "0.46.0";
+  version = "0.49.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "databricks-sdk-py";
    tag = "v${version}";
-    hash = "sha256-bvtIeysj3FW4Kj2WZeKSGwkqKoWIxKIzJFiduNlaBWE=";
+    hash = "sha256-lNP3ETmRK6sRx9mP2JuIe/OcBbCDEvipST2LUjycgjs=";
  };

  build-system = [
--- a/pkgs/development/python-modules/httpx-ws/default.nix
+++ b/pkgs/development/python-modules/httpx-ws/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "httpx-ws";
-  version = "0.7.1";
+  version = "0.7.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "frankie567";
    repo = "httpx-ws";
    tag = "v${version}";
-    hash = "sha256-UO9O4d7QfPdIWL4CtlOuwQRsk/9sEFknahDLWIOfeA0=";
+    hash = "sha256-ixaD7X6V/tUalZbYtic7D9lRqv8yGnwl+j5m832n/hQ=";
  };

  # we don't need to use the hatch-regex-commit plugin
--- a/pkgs/development/python-modules/lnkparse3/default.nix
+++ b/pkgs/development/python-modules/lnkparse3/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "lnkparse3";
-  version = "1.5.0";
+  version = "1.5.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Matmaus";
    repo = "LnkParse3";
    tag = "v${version}";
-    hash = "sha256-oyULNRjC0pcVUOeTjjW3g3mB7KySYcwAS+/KwQEIkK4=";
+    hash = "sha256-ebaKVl7GFoJiyQR7x4AN9Md8dtuYUchaN8ORbUrj5DY=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/mcpadapt/default.nix
+++ b/pkgs/development/python-modules/mcpadapt/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "mcpadapt";
-  version = "0.0.16";
+  version = "0.0.18";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "grll";
    repo = "mcpadapt";
    tag = "v${version}";
-    hash = "sha256-l5noNvg2vQJa0kOPJG78whrnTKkYy1FUfSb9V+ICpAo=";
+    hash = "sha256-E8A4zjkS3giR6oS5SmVwFwy7g2z3CvZsJBegZ35b41Q=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.73";
+  version = "0.2.74";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-KpbrcCjG8F/Ktka7puh/7rSpEMSf5LvMH+Yd//UbhjQ=";
+    hash = "sha256-pQRyIv1wu78vNjxl5tt0kI34RvCEycEMMEtaOnlaa10=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@ -5,23 +5,20 @@
  colorlog,
  fetchFromGitHub,
  python-dateutil,
-  pythonOlder,
  requests,
  setuptools-scm,
 }:

 buildPythonPackage rec {
  pname = "pyisy";
-  version = "3.1.14";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "3.4.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "automicus";
    repo = "PyISY";
    tag = "v${version}";
-    hash = "sha256-OvWdKr8RlXRnAUMHSPhJDacvKeRa8QGPmGPQWLG2ouk=";
+    hash = "sha256-rXSkDG7AK8+r4x3ttk7GJw1hH+xLLVx0gTGK0PvQNfE=";
  };

  postPatch = ''
@ -29,9 +26,9 @@ buildPythonPackage rec {
      --replace 'version_format="{tag}"' 'version="${version}"'
  '';

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    colorlog
    python-dateutil
@ -46,7 +43,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to talk to ISY994 from UDI";
    homepage = "https://github.com/automicus/PyISY";
-    changelog = "https://github.com/automicus/PyISY/releases/tag/v${version}";
+    changelog = "https://github.com/automicus/PyISY/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ dotlambda ];
  };
--- a/pkgs/development/python-modules/scancode-toolkit/default.nix
+++ b/pkgs/development/python-modules/scancode-toolkit/default.nix
@ -61,14 +61,14 @@

 buildPythonPackage rec {
  pname = "scancode-toolkit";
-  version = "32.3.1";
+  version = "32.3.3";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Dy+umzXayQ89PiGz6JhHJ6Cuw/OwFsM0ix4vvLuyjb4=";
+    hash = "sha256-rOQR9Rhssibo6M8kovlEJVUhfLi6SbdP4RyNOWsTnCU=";
  };

  dontConfigure = true;
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1350";
+  version = "3.0.1351";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = version;
-    hash = "sha256-ITdA2Z7MWZskPlSOqS9T49v4f/JQXB8Uuq+p9AugIcA=";
+    hash = "sha256-FJ+o3lJTvpt3YTWHdIuD2jx0GV+rIjK7To+yt0ReuZQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "xiaomi-ble";
-  version = "0.33.0";
+  version = "0.35.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = "xiaomi-ble";
    tag = "v${version}";
-    hash = "sha256-7/4Ea8IiRPxhgMiazSylYZAmznqIula2yCEUAyIHBBg=";
+    hash = "sha256-+mXn5R9zRjTPKqzB0vFHSO2+Jx+61K7/Ksp+jmMUDo4=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -22,16 +22,29 @@
 let
  # Grafana seems to just set it to the latest version available
  # nowadays.
+  # NOTE: sometimes, this is a no-op (i.e. `--replace-fail "X" "X"`).
+  # This is because Grafana raises the Go version above the patch-level we have
+  # on master if a security fix landed in Go (and our go may go through staging first).
+  #
+  # I(Ma27) decided to leave the code a no-op if this is not the case because
+  # pulling it out of the Git history every few months and checking which files
+  # we need to update now is slightly annoying.
  patchGoVersion = ''
-    substituteInPlace go.{mod,work} apps/alerting/notifications/go.mod pkg/storage/unified/apistore/go.mod pkg/storage/unified/resource/go.mod \
-      --replace-fail "go 1.23.5" "go 1.23.4"
+    find . -name go.mod -not -path "./.bingo/*" -print0 | while IFS= read -r -d ''' line; do
+      substituteInPlace "$line" \
+        --replace-fail "go 1.23.7" "go 1.23.7"
+    done
+    find . -name go.work -print0 | while IFS= read -r -d ''' line; do
+      substituteInPlace "$line" \
+        --replace-fail "go 1.23.7" "go 1.23.7"
+    done
    substituteInPlace Makefile \
-      --replace-fail "GO_VERSION = 1.23.5" "GO_VERSION = 1.23.4"
+      --replace-fail "GO_VERSION = 1.23.7" "GO_VERSION = 1.23.7"
  '';
 in
 buildGoModule rec {
  pname = "grafana";
-  version = "11.5.2";
+  version = "11.6.0";

  subPackages = [
    "pkg/cmd/grafana"
@ -43,7 +56,7 @@ buildGoModule rec {
    owner = "grafana";
    repo = "grafana";
    rev = "v${version}";
-    hash = "sha256-W0wn19SqqzxHm2fRtsEOru4khNqZziAfzWWc6H+Juew=";
+    hash = "sha256-oXotHi79XBhxD/qYC7QDQwn7jiX0wKWe/RXZS5DwN9o=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@ -81,9 +94,9 @@ buildGoModule rec {
    outputHashMode = "recursive";
    outputHash =
      rec {
-        x86_64-linux = "sha256-8KoSBzcEih9UKOkbcNTN1pZz/wVTedJ8qLRe+uXV/dE=";
+        x86_64-linux = "sha256-52Sq7YJHhs0UICMOtEDta+bY7b/1SdNfzUOigQhH3E4=";
        aarch64-linux = x86_64-linux;
-        aarch64-darwin = "sha256-XW6AV0tzrEWizn4G0KEXegEcNmlTJl6mZ92ZRmz17HM=";
+        aarch64-darwin = "sha256-9AJbuA1WDGiln2ea0nqD9lDMhKWdYyVkgFyFLB6/Etc=";
        x86_64-darwin = aarch64-darwin;
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@ -93,7 +106,7 @@ buildGoModule rec {

  postPatch = patchGoVersion;

-  vendorHash = "sha256-Pt87hb0+EuGd62ld65jTszeTy7GZZbviH8X9qCGOaJQ=";
+  vendorHash = "sha256-cYE43OAagPHFhWsUJLMcJVfsJj6d0vUqzjbAviYSuSc=";

  proxyVendor = true;

--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -604,6 +604,7 @@ self: super:
  });

  xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
+    buildInputs = attrs.buildInputs ++ [ mesa ];
    env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=address" ]; # gcc12
    meta = attrs.meta // {
      platforms = ["i686-linux" "x86_64-linux"];
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@ -152,11 +152,10 @@ multiStdenv.mkDerivation (finalAttrs: {

  # Hard code wine path in wrapper scripts generated by winegcc
  postFixup = ''
-    substituteInPlace "$out/bin/yabridge-host-32.exe" \
-      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
-
-    substituteInPlace "$out/bin/yabridge-host.exe" \
-      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine64"'
+    for exe in "$out"/bin/*.exe; do
+      substituteInPlace "$exe" \
+        --replace-fail 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
+    done
  '';

  passthru.updateScript = nix-update-script { };
--- a/pkgs/tools/package-management/nix/vendor/2_26/packaging/components.nix
+++ b/pkgs/tools/package-management/nix/vendor/2_26/packaging/components.nix
@ -240,6 +240,8 @@ in

  /**
    Apply an extension function (i.e. overlay-shaped) to all component derivations.
+
+    Single argument: the extension function to apply (finalAttrs: prevAttrs: { ... })
  */
  overrideAllMesonComponents =
    f:
@ -253,7 +255,11 @@ in
    Provide an alternate source. This allows the expressions to be vendored without copying the sources,
    but it does make the build non-granular; all components will use a complete source.

-    Packaging expressions will be ignored.
+    Filesets in the packaging expressions will be ignored.
+
+    Single argument: the source to use.
+
+    See also `appendPatches`
  */
  overrideSource =
    src:
@ -294,6 +300,10 @@ in
    This affects all components.

    Changes to the packaging expressions will be ignored.
+
+    Single argument: list of patches to apply
+
+    See also `overrideSource`
  */
  appendPatches =
    patches:
@ -367,7 +377,7 @@ in
  nix-perl-bindings = callPackage ../src/perl/package.nix { };

  nix-everything = callPackage ../packaging/everything.nix { } // {
-    # Note: no `passthru.overrideAllMesonComponents`
+    # Note: no `passthru.overrideAllMesonComponents` etc
    #       This would propagate into `nix.overrideAttrs f`, but then discard
    #       `f` when `.overrideAllMesonComponents` is used.
    #       Both "methods" should be views on the same fixpoint overriding mechanism
@ -375,6 +385,8 @@ in
    #       two-fixpoint solution.
    /**
      Apply an extension function (i.e. overlay-shaped) to all component derivations, and return the nix package.
+
+      Single argument: the extension function to apply (finalAttrs: prevAttrs: { ... })
    */
    overrideAllMesonComponents = f: (scope.overrideAllMesonComponents f).nix-everything;

@ -383,6 +395,10 @@ in
      This affects all components.

      Changes to the packaging expressions will be ignored.
+
+      Single argument: list of patches to apply
+
+      See also `overrideSource`
    */
    appendPatches = ps: (scope.appendPatches ps).nix-everything;

@ -390,9 +406,25 @@ in
      Provide an alternate source. This allows the expressions to be vendored without copying the sources,
      but it does make the build non-granular; all components will use a complete source.

-      Packaging expressions will be ignored.
+      Filesets in the packaging expressions will be ignored.
+
+      Single argument: the source to use.
+
+      See also `appendPatches`
    */
    overrideSource = src: (scope.overrideSource src).nix-everything;

+    /**
+      Override any internals of the Nix package set.
+
+      Single argument: the extension function to apply to the package set (finalScope: prevScope: { ... })
+
+      Example:
+      ```
+      overrideScope (finalScope: prevScope: { aws-sdk-cpp = null; })
+      ```
+    */
+    overrideScope = f: (scope.overrideScope f).nix-everything;
+
  };
 }
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -24128,8 +24128,8 @@ with self; {
    pname = "TAP-Parser-SourceHandler-pgTAP";
    version = "3.36";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DW/DWHEELER/TAP-Parser-SourceHandler-pgTAP-3.36.tar.gz";
-      hash = "sha256-B75RUy4GPqxu2OWBUFRw7ryB1VBkQa8tzzK8Dr7pjGc=";
+      url = "mirror://cpan/authors/id/D/DW/DWHEELER/TAP-Parser-SourceHandler-pgTAP-3.37.tar.gz";
+      hash = "sha256-bpKFgUQqHmhxMfe11vT/RLf43N95jS0Ha9zQfYt6WX0=";
    };
    doCheck = !stdenv.hostPlatform.isDarwin;
    meta = {