Merge staging-next into staging

2025-06-11 20:25:32 +03:00 · 2025-04-30 00:16:58 +00:00 · 2025-04-30 00:16:58 +00:00 · 947f44e54f
commit 947f44e54f
parent c0231d5ca7 5b10a3887c
69 changed files with 999 additions and 447 deletions
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -61,6 +61,10 @@
  OpenSMTPD 7.6.0 or later. The package has been removed in favor of a set of new
  `opensmtpd-table-*` packages.

+- `postsrsd` upgraded to `>= 2.0.0`, with some different behaviors and
+  configuration settings. Notably, it now defaults to listening on a socket
+  rather than a port. See [Migrating from version 1.x](https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x) and [Postfix Setup](https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup) for details.
+
 - The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
  `perlPackages.Xapian`.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2115,6 +2115,12 @@
    githubId = 891399;
    name = "Alessandro Sappia";
  };
+  asauzeau = {
+    email = "antoine.sauzeau3@gmail.com";
+    github = "AntoineSauzeau";
+    githubId = 72159603;
+    name = "Antoine Sauzeau";
+  };
  asbachb = {
    email = "asbachb-nixpkgs-5c2a@impl.it";
    matrix = "@asbachb:matrix.org";
@ -24059,6 +24065,13 @@
    githubId = 886074;
    name = "Matthieu Coudron";
  };
+  tetov = {
+    email = "anton@tetov.se";
+    github = "tetov";
+    githubId = 14882117;
+    keys = [ { fingerprint = "2B4D 0035 AFF0 F7DA CE5B  29D7 337D DB57 4A88 34DB"; } ];
+    name = "Anton Tetov";
+  };
  teutat3s = {
    email = "teutates@mailbox.org";
    matrix = "@teutat3s:pub.solar";
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -232,6 +232,10 @@

 - [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes.

+- [Prometheus eBPF Exporter](https://github.com/cloudflare/ebpf_exporter),
+  Prometheus exporter for custom eBPF metrics. Available as
+  [services.prometheus.exporters.ebpf](#opt-services.prometheus.exporters.ebpf.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}
@ -477,6 +481,8 @@

 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.

+- [`hardware.xone`](options.html#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](options.html#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
+
 - `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.

  Example:
--- a/nixos/modules/hardware/xone.nix
+++ b/nixos/modules/hardware/xone.nix
@ -21,6 +21,7 @@ in
      extraModulePackages = with config.boot.kernelPackages; [ xone ];
    };
    hardware.firmware = [ pkgs.xow_dongle-firmware ];
+    hardware.xpad-noone.enable = lib.mkDefault true;
  };

  meta = {
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@ -7,16 +7,52 @@
 let

  cfg = config.services.postsrsd;
+  runtimeDirectoryName = "postsrsd";
+  runtimeDirectory = "/run/${runtimeDirectoryName}";
+  # TODO: follow RFC 42, but we need a libconfuse format first:
+  #       https://github.com/NixOS/nixpkgs/issues/401565
+  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
+  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
+  #
+  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
+  # don't have exactly the same semantics as libconfuse strings. For example,
+  # "${F}" gets treated as an env var reference, see above issue for details.
+  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
+  configFile = pkgs.writeText "postsrsd.conf" ''
+    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
+    domains = ${libconfuseDomains}
+    separator = "${cfg.separator}"
+    socketmap = "unix:${runtimeDirectory}/socket"
+
+    # Disable postsrsd's jailing in favor of confinement with systemd.
+    unprivileged-user = ""
+    chroot-dir = ""
+  '';

 in
 {
-
-  ###### interface
+  imports =
+    map
+      (
+        name:
+        lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
+          `postsrsd` was upgraded to `>= 2.0.0`, with some different behaviors and configuration settings:
+            - NixOS Release Notes: https://nixos.org/manual/nixos/unstable/release-notes#sec-nixpkgs-release-25.05-incompatibilities
+            - NixOS Options Reference: https://nixos.org/manual/nixos/unstable/options#opt-services.postsrsd.enable
+            - Migration instructions: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x
+            - Postfix Setup: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#postfix-setup
+        ''
+      )
+      [
+        "domain"
+        "forwardPort"
+        "reversePort"
+        "timeout"
+        "excludeDomains"
+      ];

  options = {
-
    services.postsrsd = {
-
      enable = lib.mkOption {
        type = lib.types.bool;
        default = false;
@ -29,9 +65,11 @@ in
        description = "Secret keys used for signing and verification";
      };

-      domain = lib.mkOption {
-        type = lib.types.str;
-        description = "Domain name for rewrite";
+      domains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "Domain names for rewrite";
+        default = [ config.networking.hostName ];
+        defaultText = lib.literalExpression "[ config.networking.hostName ]";
      };

      separator = lib.mkOption {
@ -44,36 +82,6 @@ in
        description = "First separator character in generated addresses";
      };

-      # bindAddress = lib.mkOption { # uncomment once 1.5 is released
-      #   type = lib.types.str;
-      #   default = "127.0.0.1";
-      #   description = "Socket listen address";
-      # };
-
-      forwardPort = lib.mkOption {
-        type = lib.types.int;
-        default = 10001;
-        description = "Port for the forward SRS lookup";
-      };
-
-      reversePort = lib.mkOption {
-        type = lib.types.int;
-        default = 10002;
-        description = "Port for the reverse SRS lookup";
-      };
-
-      timeout = lib.mkOption {
-        type = lib.types.int;
-        default = 1800;
-        description = "Timeout for idle client connections in seconds";
-      };
-
-      excludeDomains = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = "Origin domains to exclude from rewriting in addition to primary domain";
-      };
-
      user = lib.mkOption {
        type = lib.types.str;
        default = "postsrsd";
@ -85,17 +93,10 @@ in
        default = "postsrsd";
        description = "Group for the daemon";
      };
-
    };
-
  };

-  ###### implementation
-
  config = lib.mkIf cfg.enable {
-
-    services.postsrsd.domain = lib.mkDefault config.networking.hostName;
-
    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
      postsrsd = {
        group = cfg.group;
@ -107,30 +108,42 @@ in
      postsrsd.gid = config.ids.gids.postsrsd;
    };

-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [ "network.target" ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-
+    systemd.services.postsrsd-generate-secrets = {
      path = [ pkgs.coreutils ];
-
-      serviceConfig = {
-        ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -a${cfg.separator} -f${toString cfg.forwardPort} -r${toString cfg.reversePort} -t${toString cfg.timeout} "-X${lib.concatStringsSep "," cfg.excludeDomains}"'';
-        User = cfg.user;
-        Group = cfg.group;
-        PermissionsStartOnly = true;
-      };
-
-      preStart = ''
-        if [ ! -e "${cfg.secretsFile}" ]; then
+      script = ''
+        if [ -e "${cfg.secretsFile}" ]; then
+          echo "Secrets file exists. Nothing to do!"
+        else
          echo "WARNING: secrets file not found, autogenerating!"
          DIR="$(dirname "${cfg.secretsFile}")"
          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
        fi
      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
    };

+    systemd.services.postsrsd = {
+      description = "PostSRSd SRS rewriting server";
+      after = [
+        "network.target"
+        "postsrsd-generate-secrets.service"
+      ];
+      before = [ "postfix.service" ];
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "postsrsd-generate-secrets.service" ];
+      confinement.enable = true;
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
+        User = cfg.user;
+        Group = cfg.group;
+        PermissionsStartOnly = true;
+        RuntimeDirectory = runtimeDirectoryName;
+        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      };
+    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -65,6 +65,7 @@ let
        "dnssec"
        "domain"
        "dovecot"
+        "ebpf"
        "fastly"
        "flow"
        "fritz"
--- a/nixos/modules/services/monitoring/prometheus/exporters/ebpf.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/ebpf.nix
@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.ebpf;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    ;
+in
+{
+  port = 9435;
+  extraOpts = {
+    names = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "timers" ];
+      description = ''
+        List of eBPF programs to load
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [
+        "CAP_BPF"
+        "CAP_DAC_READ_SEARCH"
+        "CAP_PERFMON"
+      ];
+      CapabilityBoundingSet = [
+        "CAP_BPF"
+        "CAP_DAC_READ_SEARCH"
+        "CAP_PERFMON"
+      ];
+      ExecStart = ''
+        ${pkgs.prometheus-ebpf-exporter}/bin/ebpf_exporter \
+        --config.dir=${pkgs.prometheus-ebpf-exporter}/examples \
+        --config.names=${concatStringsSep "," cfg.names} \
+        --web.listen-address ${cfg.listenAddress}:${toString cfg.port}
+      '';
+    };
+  };
+}
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -407,6 +407,20 @@ let
        '';
      };

+    ebpf = {
+      exporterConfig = {
+        enable = true;
+        names = [ "timers" ];
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-ebpf-exporter.service")
+        wait_for_open_port(9435)
+        succeed(
+            "curl -sSf http://localhost:9435/metrics | grep 'ebpf_exporter_enabled_configs{name=\"timers\"} 1'"
+        )
+      '';
+    };
+
    fastly = {
      exporterConfig = {
        enable = true;
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "imapfilter";
-  version = "2.8.2";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "lefcha";
    repo = "imapfilter";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pYnv9slw4bRPfCnhd/tlJC9JEx+3h40nyZ3qUll7p6c=";
+    sha256 = "sha256-9uPcdxZioXfdSuZO/fgtoIbQdWtc2DRr28iTonnG05U=";
  };
  makeFlags = [
    "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
--- a/pkgs/build-support/node/fetch-yarn-deps/common.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/common.js
@ -5,7 +5,9 @@ const path = require('path')
 const urlToName = url => {
 	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')

-	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+	if (url.startsWith('file:')) {
+		return url
+	} else if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
 		return path.basename(url)
 	} else {
 		return url
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "38f05a857ff3cec50bafb594b5d0ab49d6c585ae",
-  "hash": "sha256-FFZPhQRqmL6pp5aS6qg1Dhf80PAFE2O9oDJB5kSHL50=",
-  "version": "2.20.0",
-  "depsHash": "sha256-mB57omyxV338K4LpNMfIThLc2Mz71NqEyFTjWrfAo10=",
-  "clientDepsHash": "sha256-Wnmue1aGWN9rwP3xYp5q+POP85tHY5gbYBQMKXu9H3Q="
+  "rev": "fd84cd0d7f647705a49f300b9bdb940f9725e1a7",
+  "hash": "sha256-+e8CaJaDuYsj48nF98uLf9dSeXGWEDvNy5myQ9x2Yug=",
+  "version": "2.21.0",
+  "depsHash": "sha256-AwY4TrIm5jR7lu/l9RyOzwX4N31Q8x+WKeIbxW4+g8s=",
+  "clientDepsHash": "sha256-rQT0l7Gs5xwDaP+5rhX2nUGBk5jaUMo0JR0Emo87ie4="
 }
--- a/pkgs/by-name/aw/aws-lambda-rie/package.nix
+++ b/pkgs/by-name/aw/aws-lambda-rie/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.23";
+  version = "1.25";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-lambda-runtime-interface-emulator";
    rev = "v${version}";
-    sha256 = "sha256-zbeaWbvWk3duBfdUb70G/O4gO20NSHiwuTUZjtGlM3Q=";
+    sha256 = "sha256-GHoEyTM3vDVmozcKoi5ETG4V10o82HcigmmhIMV0UJg=";
  };

  vendorHash = "sha256-fGoqKDBg+O4uzGmhEIROsBvDS+6zWCzsXe8U6t98bqk=";
--- a/pkgs/by-name/cl/cliqr/package.nix
+++ b/pkgs/by-name/cl/cliqr/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "cliqr";
-  version = "0.1.26";
+  version = "0.1.29";

  src = fetchFromGitHub {
    owner = "paepckehh";
    repo = "cliqr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JM5sWVby8dSFz2YtNXgU9z5fc6EI5nnxmpQN/71kdjI=";
+    hash = "sha256-fhNMiUaCTk4xYGJRMuZCHeYvzGeVwkS7E7LU1L+LuBg=";
  };

  vendorHash = null;
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@ -19,8 +19,8 @@ let
    src = fetchFromGitHub {
      owner = "domenkozar";
      repo = "nix";
-      rev = "090394819020afda8eae69e395b1accba9c0fab2";
-      hash = "sha256-eUYh7+PgqLXTt8/9IOxEuW2qyxADECmTic8QNhEwKSw=";
+      rev = "b455edf3505f1bf0172b39a735caef94687d0d9c";
+      hash = "sha256-bYyjarS3qSNqxfgc89IoVz8cAFDkF9yPE63EJr+h50s=";
    };
    doCheck = false;
    doInstallCheck = false;
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.41.0";
+  version = "2.42.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-7BTQiUf78CKozZAUdw0Y1U7EO+ZvMDim3N/PPebDMNg=";
+    hash = "sha256-nlhW3ftBOjb2BHz1qjOI4VGiSn1+VAUcaA9n0nPikCU=";
  };

  outputs = [
--- a/pkgs/by-name/fl/fleet/package.nix
+++ b/pkgs/by-name/fl/fleet/package.nix
@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "fleet";
+  version = "4.67.1";
+
+  src = fetchFromGitHub {
+    owner = "fleetdm";
+    repo = "fleet";
+    tag = "fleet-v${finalAttrs.version}";
+    hash = "sha256-cZ0YTFcyPt7NMZUDZCdlVPTuhwRy7mTp7JCdINqiwOM=";
+  };
+  vendorHash = "sha256-gFAotYho18Jn8MaFK6ShoMA1VLXVENcrASvHWZGFOFg=";
+
+  subPackages = [
+    "cmd/fleet"
+  ];
+
+  ldflags = [
+    "-X github.com/fleetdm/fleet/v4/server/version.appName=fleet"
+    "-X github.com/fleetdm/fleet/v4/server/version.version=${finalAttrs.version}"
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/fleet-v${finalAttrs.version}";
+    description = "CLI tool to launch Fleet server";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      asauzeau
+    ];
+    mainProgram = "fleet";
+  };
+})
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@ -1,26 +1,26 @@
 {
-  "version": "1.132.1",
-  "hash": "sha256-nZ7kG60TTOVB4yGUsRrcHuWwIamsWlJ7zBvJCP9d4zQ=",
+  "version": "1.132.3",
+  "hash": "sha256-QwQSqWSQ82R5LrbyerAZflDRM2DS+rpA8E6uzxQbs48=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-PZOYCJ5FQboy5uVZCqJ4CfxDVSHburP4kxhi01HrKns=",
-      "version": "2.2.63"
+      "npmDepsHash": "sha256-7CWJEEr/6+Duc90Qww6rhVLXEtxz3hymLcQIzv3YPg0=",
+      "version": "2.2.65"
    },
    "server": {
-      "npmDepsHash": "sha256-p46OKwRpk9n15201ImLMlDokezJPXD+GXUWtSHduGfU=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-CdE8H8+uAlthHhko5Ir+BETqkZoNzpimgHB2gVJbus8=",
+      "version": "1.132.3"
    },
    "web": {
-      "npmDepsHash": "sha256-HEwmwn1DP+9WnqYSOcR2AoOLU7tTjwi2fN17Vq9cZVE=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-3UoNfa2P4bVFQSQTSbRacSxh2UbPokDHqveCHt9bnko=",
+      "version": "1.132.3"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-Mdn7pmYJmdizQlVINCme6wv6ocqyrBO6U4F5x2xJonc=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-Rfds2/c8Q6KfWzyztxLcKS40JKOMh04JzMICsDvqMgs=",
+      "version": "1.132.3"
    },
    "geonames": {
-      "timestamp": "20250424184923",
-      "hash": "sha256-f0IMmEEyw0JSm+u3zgcE4dtTfPpAKvhDFhlqA9F8cVg="
+      "timestamp": "20250428153140",
+      "hash": "sha256-RDetKDf/qFRwlB+Jo5ivD6yp1paMWFJeUf1Vft70Kdw="
    }
  }
 }
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "1.32.3";
+  version = "1.32.4";

  src = fetchFromGitHub {
    owner = "int128";
    repo = "kubelogin";
    tag = "v${version}";
-    hash = "sha256-ZmNiFO1YGZC+vxpeliNuXfL8Azy2YmLgKqga/a3/9U8=";
+    hash = "sha256-zdUtLjILildwSOA5CV1SNzVtMj+Tz1KkHB2MH1SZ8wk=";
  };

  subPackages = [ "." ];
@ -22,7 +22,7 @@ buildGoModule rec {
    "-X main.version=v${version}"
  ];

-  vendorHash = "sha256-b8d06JhapPF8HwP1twgkcSR6RzM9x1G4zW3YBqmM3YM=";
+  vendorHash = "sha256-5NiGgZLSf/STr888JPsZZqaqXUI+g+26OEKRXp7xS4E=";

  # test all packages
  preCheck = ''
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@ -3,6 +3,7 @@
  stdenv,
  cmake,
  fetchFromGitHub,
+  fetchpatch,
  tbb_2021_11,

  useTBB ? true,
@ -19,6 +20,21 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-IABVErXWYQFXZcwsFKfQhm3ox7UZUcW5uzVrGwsSp94=";
  };

+  patches = [
+    # build(cmake): Use tbb32 pkgconfig package on 32-bit builds (BLAKE3-team/BLAKE3#482)
+    (fetchpatch {
+      url = "https://github.com/BLAKE3-team/BLAKE3/commit/dab799623310c8f4be6575002d5c681c09a0e209.patch";
+      hash = "sha256-npCtM8nOFU8Tcu//IykjMs8aLU12d93+mIfKuxHkuaQ=";
+      relative = "c";
+    })
+    # build(cmake): Relax Clang frontend variant detection (BLAKE3-team/BLAKE3#477)
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/BLAKE3-team/BLAKE3/pull/477.patch";
+      hash = "sha256-kidCMGd/i9D9HLLTt7l1DbiU71sFTEyr3Vew4XHUHls=";
+      relative = "c";
+    })
+  ];
+
  sourceRoot = finalAttrs.src.name + "/c";

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/li/liblzf/lib_test.c
+++ b/pkgs/by-name/li/liblzf/lib_test.c
@ -0,0 +1,33 @@
+#include "lzf.h"
+#include <stdio.h>
+#include <string.h>
+
+int main(void) {
+  const char *test = "liblzf test for nixpkgs, nixpkgs for test liblzf";
+  const size_t ilen = strlen(test) + 1;
+
+  printf("Test string length: %zu\n", ilen);
+
+  char compressed[100];
+  char decompressed[100];
+
+  unsigned int clen =
+      lzf_compress(test, ilen, compressed, sizeof(compressed));
+  if (!clen)
+    return 1;
+
+  printf("Compressed length: %d\n", clen);
+
+  unsigned int dlen =
+      lzf_decompress(compressed, clen, decompressed, sizeof(decompressed));
+  if (!dlen)
+    return 2;
+
+  if (strcmp(test, decompressed) != 0) {
+    printf("Strings don't match!\n");
+    return 3;
+  }
+
+  printf("Strings match, tests passed!\n");
+  return 0;
+}
--- a/pkgs/by-name/li/liblzf/package.nix
+++ b/pkgs/by-name/li/liblzf/package.nix
@ -0,0 +1,137 @@
+{
+  lib,
+  stdenv,
+  fetchDebianPatch,
+  fetchpatch,
+  fetchurl,
+  pkg-config,
+  testers,
+  validatePkgConfig,
+  autoconf,
+  automake,
+  libtool,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "liblzf";
+  version = "3.6";
+
+  src = fetchurl {
+    url = "http://dist.schmorp.de/liblzf/liblzf-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nF3gH3ucyuQMP2GdJqer7JmGwGw20mDBec7dBLiftGo=";
+  };
+
+  patches = [
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "4";
+      patch = "0001-Make-sure-that-the-library-is-linked-with-C-symbols.patch";
+      hash = "sha256-Rgfp/TysRcEJaogOo/Xno+G4HZzj9Loa69DL43Bp1Ok=";
+    })
+    (
+      let
+        name = "liblzf-3.6-autoconf-20140314.patch";
+      in
+      fetchpatch {
+        inherit name;
+        url = "https://src.fedoraproject.org/rpms/liblzf/raw/53da654eead51a24ac81a28e1b1c531eb1afab28/f/${name}";
+        hash = "sha256-rkhI8w0HV3fGiDfHiXBzrnxqGDE/Yo5ntePrsscMiyg=";
+      }
+    )
+  ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+    validatePkgConfig
+  ];
+
+  preConfigure = ''
+    sh ./bootstrap.sh
+  '';
+
+  postInstall = ''
+    pushd $out/bin
+    ln -s lzf unlzf
+    popd
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  passthru.tests = {
+    pkgConfigTest = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      version = "${finalAttrs.version}.0";
+      versionCheck = true;
+    };
+
+    exeTest = testers.runCommand {
+      name = "${finalAttrs.pname}-exe-test";
+      buildInputs = [ finalAttrs.finalPackage ];
+      script = ''
+        lzf -h 2> /dev/null
+
+        echo "LZFLZFLZFLZFLZFLZFLZFLZF" > test.txt
+
+        # unlzf writes to filename minus ".lzf"
+        cp test.txt test.txt.orig
+
+        lzf test.txt
+        unlzf test.txt.lzf
+
+        # Compare results
+        if ! cmp -s test.txt test.txt.orig; then
+          echo "Executable test failed: files don't match"
+          exit 1
+        fi
+
+        echo "Decompressed output matches test string (lzf & unlzf)"
+
+        touch $out
+      '';
+    };
+
+    shlibTest = testers.runCommand {
+      name = "${finalAttrs.pname}-shlib-test";
+      inherit stdenv; # with CC
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [
+        finalAttrs.finalPackage.dev
+        finalAttrs.finalPackage
+      ];
+      # tests both the library and pkg-config file
+      script = ''
+        $CC -g ${./lib_test.c} -o lib_test \
+          $(pkg-config --cflags --libs liblzf)
+
+        ./lib_test >/dev/null
+
+        echo "Built and tested file linked against liblzf using pkg-config"
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    changelog =
+      "http://cvs.schmorp.de/liblzf/Changes?pathrev=rel-"
+      + builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version;
+    description = "Small data compression library";
+    downloadPage = "http://dist.schmorp.de/liblzf/";
+    homepage = "http://software.schmorp.de/pkg/liblzf.html";
+    license = with lib.licenses; [
+      bsd2
+      gpl2Plus
+    ];
+    mainProgram = "lzf";
+    maintainers = with lib.maintainers; [
+      tetov
+    ];
+    platforms = lib.platforms.unix;
+    pkgConfigModules = [ "liblzf" ];
+  };
+})
--- a/pkgs/by-name/mi/miru/darwin.nix
+++ b/pkgs/by-name/mi/miru/darwin.nix
@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-o/7CTkIVufD5ai99XZFyDUgCIV7r4PbUcqkYcMVZwKE=";
+    hash = "sha256-V4Vo9fuQ0X7Q6CBM7Akh3+MrgQOBgCuC41khFatYWi4=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/mi/miru/linux.nix
+++ b/pkgs/by-name/mi/miru/linux.nix
@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
    name = "${pname}-${version}.AppImage";
-    hash = "sha256-AhaGiZ/Vx9nJmIXrzZ1JMLqjWfQDyoKpzl55NT712Ro=";
+    hash = "sha256-nLPqEI6u5NNQ/kPbXRWPG0pIwutKNK2J8JeTPN6wHlg=";
  };

  extraInstallCommands =
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "miru";
-  version = "5.5.9";
+  version = "5.5.10";
  meta = {
    description = "Stream anime torrents, real-time with no waiting for downloads";
    homepage = "https://miru.watch";
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@ -23,7 +23,7 @@

 stdenv.mkDerivation rec {
  pname = "nextcloud-client";
-  version = "3.16.3";
+  version = "3.16.4";

  outputs = [
    "out"
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    owner = "nextcloud-releases";
    repo = "desktop";
    tag = "v${version}";
-    hash = "sha256-C/IfCNOFsSnpJMVSVhOkfx1F2IhOM8ntgdKjr7MKdkc=";
+    hash = "sha256-8P73YitjuU9SGDBNimqJsvSfGOE9lNCVUNN3f4KXWSY=";
  };

  patches = [
--- a/pkgs/by-name/or/oras/package.nix
+++ b/pkgs/by-name/or/oras/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "oras";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "oras-project";
    repo = "oras";
    rev = "v${version}";
-    hash = "sha256-iSmoD2HhzVrWQBaZ7HaIjcPmybl4JTVeVVfbn29i91Q=";
+    hash = "sha256-IXIw2prApg5iL3BPbOY4x09KjyhFvKofgfz2L6UXKR8=";
  };

-  vendorHash = "sha256-zxcRMrr0mfSiuZpXYe7N0nJrEmiBTgw03+Yp4PYieBY=";
+  vendorHash = "sha256-PLGWPoMCsmdnsKD/FdaRHGO0X9/0Y/8DWV21GsCBR04=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/po/postsrsd/package.nix
+++ b/pkgs/by-name/po/postsrsd/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  libconfuse,
  stdenv,
  fetchFromGitHub,
  cmake,
@ -8,18 +9,20 @@

 stdenv.mkDerivation rec {
  pname = "postsrsd";
-  version = "1.12";
+  version = "2.0.10";

  src = fetchFromGitHub {
    owner = "roehling";
    repo = "postsrsd";
    rev = version;
-    sha256 = "sha256-aSI9TR1wSyMA0SKkbavk+IugRfW4ZEgpzrNiXn0F5ak=";
+    sha256 = "sha256-8uy7a3wUGuLE4+6ZPqbFMdPzm6IZqQSvpZzLYAkBxNg=";
  };

  cmakeFlags = [
    "-DGENERATE_SRS_SECRET=OFF"
    "-DINIT_FLAVOR=systemd"
+    "-DFETCHCONTENT_TRY_FIND_PACKAGE_MODE=ALWAYS"
+    "-DINSTALL_SYSTEMD_SERVICE=OFF"
  ];

  preConfigure = ''
@ -31,6 +34,10 @@ stdenv.mkDerivation rec {
    help2man
  ];

+  buildInputs = [
+    libconfuse
+  ];
+
  meta = with lib; {
    homepage = "https://github.com/roehling/postsrsd";
    description = "Postfix Sender Rewriting Scheme daemon";
--- a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
@ -0,0 +1,82 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  pkgs,
+  libbpf,
+  libelf,
+  libsystemtap,
+  libz,
+}:
+
+let
+  version = "2.4.2";
+  tag = "v${version}";
+in
+buildGoModule.override
+  {
+    stdenv = pkgs.clangStdenv;
+  }
+  {
+    name = "ebpf_exporter";
+
+    src = fetchFromGitHub {
+      inherit tag;
+      owner = "cloudflare";
+      repo = "ebpf_exporter";
+      hash = "sha256-gXzaMx9Z6LzrlDaQnagQIi183uKhJvdYiolYb8P+MIs=";
+    };
+
+    vendorHash = "sha256-GhQvPp8baw2l91OUOg+/lrG27P/D4Uzng8XevJf8Pj4=";
+
+    postPatch = ''
+      substituteInPlace examples/Makefile \
+        --replace-fail "-Wall -Werror" ""
+    '';
+
+    buildInputs = [
+      libbpf
+      libelf
+      libsystemtap
+      libz
+    ];
+
+    CGO_LDFLAGS = "-l bpf";
+
+    hardeningDisable = [ "zerocallusedregs" ];
+
+    # Tests fail on trying to access cgroups.
+    doCheck = false;
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X github.com/prometheus/common/version.Version=${version}"
+      "-X github.com/prometheus/common/version.Revision=${tag}"
+      "-X github.com/prometheus/common/version.Branch=unknown"
+      "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+      "-X github.com/prometheus/common/version.BuildDate=unknown"
+    ];
+
+    postBuild = ''
+      BUILD_LIBBPF=0 make examples
+    '';
+
+    postInstall = ''
+      mkdir -p $out/examples
+      mv examples/*.o examples/*.yaml $out/examples
+    '';
+
+    passthru.tests = { inherit (nixosTests.prometheus-exporters) ebpf; };
+
+    meta = {
+      description = "Prometheus exporter for custom eBPF metrics";
+      mainProgram = "ebpf_exporter";
+      homepage = "https://github.com/cloudflare/ebpf_exporter";
+      changelog = "https://github.com/cloudflare/ebpf_exporter/releases/tag/v${tag}";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ jpds ];
+      platforms = lib.platforms.linux;
+    };
+  }
--- a/pkgs/by-name/ta/tail-tray/package.nix
+++ b/pkgs/by-name/ta/tail-tray/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "tail-tray";
-  version = "0.2.20";
+  version = "0.2.21";

  src = fetchFromGitHub {
    owner = "SneWs";
    repo = "tail-tray";
    tag = "v${version}";
-    sha256 = "sha256-vsxWGXpmkznfqFwtuLdG6yGAS/Lhs6NLRuzQ/g/WLu8=";
+    sha256 = "sha256-zdmU4GdEVOT8wUgOxJAGsLQEb35O/RUjc8HcYpwIkiM=";
  };

  nativeBuildInputs = with kdePackages; [
--- a/pkgs/by-name/x2/x264/package.nix
+++ b/pkgs/by-name/x2/x264/package.nix
@ -41,7 +41,7 @@ stdenv.mkDerivation {
      # `AS' is set to the binutils assembler, but we need nasm
      unset AS
    ''
-    + lib.optionalString stdenv.hostPlatform.isAarch ''
+    + lib.optionalString (stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isLoongArch64) ''
      export AS=$CC
    '';

--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@ -3,7 +3,6 @@
  stdenv,
  fetchFromGitHub,
  autoreconfHook,
-  pcre,
  pkg-config,
  protobufc,
  withCrypto ? true,
@ -36,7 +35,6 @@ stdenv.mkDerivation rec {

  buildInputs =
    [
-      pcre
      protobufc
    ]
    ++ lib.optionals withCrypto [ openssl ]
--- a/pkgs/development/cuda-modules/nccl-tests/default.nix
+++ b/pkgs/development/cuda-modules/nccl-tests/default.nix
@ -25,13 +25,13 @@ in
 backendStdenv.mkDerivation (finalAttrs: {

  pname = "nccl-tests";
-  version = "2.14.1";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "nccl-tests";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PntD5seMq7s0x4hOO/wBDQdElhKCY6mFrTf073mf7zM=";
+    hash = "sha256-OgffbW9Vx/sm1I1tpaPGdAhIpV4jbB4hJa9UcEAWkdE=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/tbb/2022_0.nix
+++ b/pkgs/development/libraries/tbb/2022_0.nix
@ -34,11 +34,12 @@ stdenv.mkDerivation rec {
      url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/899.patch";
      hash = "sha256-kU6RRX+sde0NrQMKlNtW3jXav6J4QiVIUmD50asmBPU=";
    })
-  ];
-
-  cmakeFlags = [
-    # Skip tests to work around https://github.com/uxlfoundation/oneTBB/issues/1695
-    (lib.cmakeBool "TBB_TEST" (!stdenv.hostPlatform.isWindows))
+    # Fix tests on FreeBSD and Windows
+    (fetchpatch {
+      name = "fix-tbb-freebsd-and-windows-tests.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1696.patch";
+      hash = "sha256-yjX2FkOK8bz29a/XSA7qXgQw9lxzx8VIgEBREW32NN4=";
+    })
  ];

  # Fix build with modern gcc
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@ -44,11 +44,12 @@ stdenv.mkDerivation rec {
      url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/1193.patch";
      hash = "sha256-ZQbwUmuIZoGVBof8QNR3V8vU385e2X7EvU3+Fbj4+M8=";
    })
-  ];
-
-  cmakeFlags = [
-    # Skip tests to work around https://github.com/uxlfoundation/oneTBB/issues/1695
-    (lib.cmakeBool "TBB_TEST" (!stdenv.hostPlatform.isWindows))
+    # Fix tests on FreeBSD and Windows
+    (fetchpatch {
+      name = "fix-tbb-freebsd-and-windows-tests.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1696.patch";
+      hash = "sha256-yjX2FkOK8bz29a/XSA7qXgQw9lxzx8VIgEBREW32NN4=";
+    })
  ];

  # Fix build with modern gcc
--- a/pkgs/development/python-modules/circus/default.nix
+++ b/pkgs/development/python-modules/circus/default.nix
@ -2,11 +2,10 @@
  lib,
  stdenv,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  flit-core,
  psutil,
  pytestCheckHook,
-  pythonOlder,
  pyyaml,
  pyzmq,
  tornado,
@ -17,11 +16,11 @@ buildPythonPackage rec {
  version = "0.19.0";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-++alApmYrBI5sX6904JRrIsiYn0w5OxvaMsQIzkRsPQ=";
+  src = fetchFromGitHub {
+    owner = "circus-tent";
+    repo = "circus";
+    tag = version;
+    hash = "sha256-MiZXiGb6F8LAJLAdmEDBO8Y5cJxHJy7jMFi50Ac3Bsc=";
  };

  build-system = [ flit-core ];
@ -43,42 +42,11 @@ buildPythonPackage rec {
  '';

  disabledTests = [
-    # these tests raise circus.tests.support.TimeoutException
-    "test_add_start"
-    "test_add"
-    "test_command_already_running"
-    "test_dummy"
-    "test_exits_within_graceful_timeout"
-    "test_full_stats"
-    "test_handler"
-    "test_handler"
-    "test_inherited"
-    "test_kills_after_graceful_timeout"
-    "test_launch_cli"
-    "test_max_age"
-    "test_reload_sequential"
-    "test_reload_uppercase"
-    "test_reload_wid_1_worker"
-    "test_reload_wid_4_workers"
-    "test_reload1"
-    "test_reload2"
-    "test_resource_watcher_max_cpu"
-    "test_resource_watcher_max_mem_abs"
+    # Depends on the build machine configuration
    "test_resource_watcher_max_mem"
-    "test_resource_watcher_min_cpu"
    "test_resource_watcher_min_mem_abs"
-    "test_resource_watcher_min_mem"
-    "test_set_before_launch"
-    "test_set_by_arbiter"
-    "test_signal"
-    "test_stdin_socket"
-    "test_stop_and_restart"
-    "test_stream"
-    "test_venv"
-    "test_watchdog_discovery_found"
-    "test_watchdog_discovery_not_found"
-    # this test requires socket communication
-    "test_plugins"
+    # Compares with magic string
+    "test_streams"
  ];

  pythonImportsCheck = [ "circus" ];
--- a/pkgs/development/python-modules/django-axes/default.nix
+++ b/pkgs/development/python-modules/django-axes/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "django-axes";
-  version = "7.0.2";
+  version = "7.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jazzband";
    repo = "django-axes";
    tag = version;
-    hash = "sha256-yPHS9CgtAQeokq7ClI1fUcgR5YCjmcHjQHNcfQdTZtc=";
+    hash = "sha256-qSXrPa49JDkcW0bmisYzZy40E3O5i6WfD0t9HXFhgqQ=";
  };

  build-system = [ setuptools-scm ];
--- a/pkgs/development/python-modules/flowmc/default.nix
+++ b/pkgs/development/python-modules/flowmc/default.nix
@ -8,7 +8,6 @@

  # dependencies
  chex,
-  coveralls,
  equinox,
  jax,
  jaxtyping,
@ -22,14 +21,14 @@

 buildPythonPackage rec {
  pname = "flowmc";
-  version = "0.4.3";
+  version = "0.4.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kazewong";
    repo = "flowMC";
    tag = "flowMC-${version}";
-    hash = "sha256-M0FrIe7q0YI6f+IwQeMsZKahw9wcQd42hf/dmXJp2Fk=";
+    hash = "sha256-hyrsL8agY+bNcRcEmgEtv97cFROgeLFxxtKTfx0HoH8=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/ipydatawidgets/default.nix
+++ b/pkgs/development/python-modules/ipydatawidgets/default.nix
@ -40,6 +40,17 @@ buildPythonPackage rec {
    nbval
  ];

+  # Tests bind ports
+  __darwinAllowLocalNetworking = true;
+
+  pytestFlagsArray = [
+    # https://github.com/vidartf/ipydatawidgets/issues/62
+    "--deselect=ipydatawidgets/tests/test_ndarray_trait.py::test_dtype_coerce"
+
+    # https://github.com/vidartf/ipydatawidgets/issues/63
+    "--deselect=examples/test.ipynb::Cell\\\ 3"
+  ];
+
  meta = {
    description = "Widgets to help facilitate reuse of large datasets across different widgets";
    homepage = "https://github.com/vidartf/ipydatawidgets";
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@ -1,16 +1,26 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # nativeBuildInputs
  nodejs,
  yarn-berry_3,
+  distutils,
+
+  # build-system
  hatch-jupyter-builder,
  hatchling,
-  jupyter-server,
  jupyterlab,
+
+  # dependencies
+  jupyter-server,
  jupyterlab-server,
  notebook-shim,
  tornado,
+
+  # tests
  pytest-jupyter,
  pytestCheckHook,
 }:
@ -29,13 +39,17 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace "timeout = 300" ""
+      --replace-fail "timeout = 300" ""
  '';

-  nativeBuildInputs = [
-    nodejs
-    yarn-berry_3.yarnBerryConfigHook
-  ];
+  nativeBuildInputs =
+    [
+      nodejs
+      yarn-berry_3.yarnBerryConfigHook
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      distutils
+    ];

  missingHashes = ./missing-hashes.json;

--- a/pkgs/development/python-modules/pylint-odoo/default.nix
+++ b/pkgs/development/python-modules/pylint-odoo/default.nix
@ -0,0 +1,44 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pylint-plugin-utils,
+  pytestCheckHook,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "pylint-odoo";
+  version = "9.3.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "OCA";
+    repo = "pylint-odoo";
+    tag = "v${version}";
+    hash = "sha256-HPai1HQlfHJUHLqEYn4U6qdupJLLrynwtfm7Q8IbRps=";
+  };
+
+  pythonRelaxDeps = [
+    "pylint-plugin-utils"
+    "pylint"
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pylint-plugin-utils
+  ];
+
+  pythonImportsCheck = [ "pylint_odoo" ];
+
+  BUILD_README = true; # Enables more tests
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Odoo plugin for Pylint";
+    homepage = "https://github.com/OCA/pylint-odoo";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yajo ];
+  };
+}
--- a/pkgs/development/python-modules/pynvim-pp/default.nix
+++ b/pkgs/development/python-modules/pynvim-pp/default.nix
@ -8,20 +8,22 @@

 buildPythonPackage {
  pname = "pynvim-pp";
-  version = "unstable-2024-07-31";
+  version = "0-unstable-2025-02-08";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ms-jpq";
    repo = "pynvim_pp";
-    rev = "6d3c298b7eb9543bce7ab515b0a39f256c1d37ca";
-    hash = "sha256-W6YaxI/fa2HL6+FIBTTA+7K2Be02iuIfFFVO/hhYnpo=";
+    rev = "781f6beda5f5966857792af040d5e2ecff5467e4";
+    hash = "sha256-ggZqlaCP9WNECO+eRwi968EvQb8zuHCic6+9Zngsd24=";
  };

  build-system = [ setuptools ];

  dependencies = [ pynvim ];

+  pythonImportsCheck = [ "pynvim_pp" ];
+
  meta = {
    homepage = "https://github.com/ms-jpq/pynvim_pp";
    description = "Dependency to chadtree and coq_nvim plugins";
--- a/pkgs/development/python-modules/pythreejs/default.nix
+++ b/pkgs/development/python-modules/pythreejs/default.nix
@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  jupyterlab,
+  setuptools,
+
+  ipywidgets,
+  ipydatawidgets,
+  numpy,
+  traitlets,
+}:
+
+buildPythonPackage rec {
+  pname = "pythreejs";
+  version = "2.4.2";
+  pyproject = true;
+
+  # github sources need to invoke npm, but no package-lock.json present:
+  # https://github.com/jupyter-widgets/pythreejs/issues/419
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-pWi/3Ew3l8TCM5FYko7cfc9vpKJnsI487FEh4geLW9Y=";
+  };
+
+  build-system = [
+    jupyterlab
+    setuptools
+  ];
+
+  # It seems pythonRelaxDeps doesn't work for these
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "jupyterlab~=" "jupyterlab>="
+
+    # https://github.com/jupyter-widgets/pythreejs/pull/420
+    substituteInPlace setupbase.py \
+      --replace-fail "import pipes" "" \
+      --replace-fail "pipes.quote" "shlex.quote"
+  '';
+
+  # Don't run npm install, all files are already where they should be present.
+  # If we would run npm install, npm would detect package-lock.json is an old format,
+  # and try to fetch more metadata from the registry, which cannot work in the sandbox.
+  setupPyBuildFlags = [ "--skip-npm" ];
+
+  dependencies = [
+    ipywidgets
+    ipydatawidgets
+    numpy
+    traitlets
+  ];
+
+  # There are no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pythreejs" ];
+
+  meta = {
+    description = "Interactive 3D graphics for the Jupyter Notebook and JupyterLab, using Three.js and Jupyter Widgets";
+    homepage = "https://github.com/jupyter-widgets/pythreejs";
+    changelog = "https://github.com/jupyter-widgets/pythreejs/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ flokli ];
+  };
+}
--- a/pkgs/development/python-modules/pythreejs/fix-re.error.patch
+++ b/pkgs/development/python-modules/pythreejs/fix-re.error.patch
@ -0,0 +1,13 @@
+diff --git a/setupbase.py b/setupbase.py
+index 0ce0ac8..7762e23 100644
+--- a/setupbase.py
+++ b/setupbase.py
+@@ -659,7 +659,7 @@ def _translate_glob(pat):
+         translated_parts.append(_translate_glob_part(part))
+     os_sep_class = '[%s]' % re.escape(SEPARATORS)
+     res = _join_translated(translated_parts, os_sep_class)
+-    return '{res}\\Z(?ms)'.format(res=res)
+    return '(?ms){res}\\Z'.format(res=res)
+ 
+ 
+ def _join_translated(translated_parts, os_sep_class):
--- a/pkgs/development/python-modules/std2/default.nix
+++ b/pkgs/development/python-modules/std2/default.nix
@ -7,17 +7,19 @@

 buildPythonPackage {
  pname = "std2";
-  version = "0-unstable-2024-09-02";
+  version = "0-unstable-2025-02-06";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ms-jpq";
    repo = "std2";
-    rev = "205d1f52e9b5438ef2b732c77e1144847cafa8d0";
-    hash = "sha256-WdUefadEk92cGnDI+KbQBpjg+d7KgI6bjlQlyhRRRFA=";
+    rev = "47fda91f8c8db9d5a8faa6f55d739d74afffc440";
+    hash = "sha256-n+6FxVQjzYhjQMJr+i+D8uSiVjI7HFkegxy5keVjKGs=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "std2" ];

  meta = {
    homepage = "https://github.com/ms-jpq/std2";
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@ -1,44 +1,56 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,

  # build-system
+  pybind11,
  setuptools,
-  torch,
+  setuptools-scm,
+
+  # nativeBuildInputs
+  cmake,

  # dependencies
  cloudpickle,
+  importlib-metadata,
  numpy,
  orjson,
  packaging,
+  torch,

  # tests
  h5py,
  pytestCheckHook,
-
-  stdenv,
 }:

 buildPythonPackage rec {
  pname = "tensordict";
-  version = "0.7.2";
+  version = "0.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "tensordict";
    tag = "v${version}";
-    hash = "sha256-ZDfRvfyBashU4kIoo8JX/EoCv4tpDOyggOlpdVCudT8=";
+    hash = "sha256-2S0xpsJNDdIGoLbALAIcSEVqYD5Nq2YXs3mWFtSUvsA=";
  };

  build-system = [
+    pybind11
    setuptools
-    torch
+    setuptools-scm
  ];

+  nativeBuildInputs = [
+    cmake
+  ];
+  dontUseCmakeConfigure = true;
+
  dependencies = [
    cloudpickle
+    importlib-metadata
    numpy
    orjson
    packaging
@ -66,10 +78,15 @@ buildPythonPackage rec {
    "test_map_iter_interrupt_early"
  ];

-  disabledTestPaths = [
-    # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
-    "test/test_compile.py"
-  ];
+  disabledTestPaths =
+    [
+      # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
+      "test/test_compile.py"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Hangs forever
+      "test/test_distributed.py"
+    ];

  meta = {
    description = "Pytorch dedicated tensor container";
--- a/pkgs/development/python-modules/xgrammar/default.nix
+++ b/pkgs/development/python-modules/xgrammar/default.nix
@ -74,6 +74,9 @@ buildPythonPackage rec {

    # Torch not compiled with CUDA enabled
    "test_token_bitmask_operations"
+
+    # AssertionError
+    "test_json_schema_converter"
  ];

  pythonImportsCheck = [ "xgrammar" ];
--- a/pkgs/development/tools/devpod/add-tauri-updater-feature.patch
+++ b/pkgs/development/tools/devpod/add-tauri-updater-feature.patch
@ -1,12 +0,0 @@
-diff --git a/Cargo.toml b/Cargo.toml
-index 03f64e53..9e2ddcb6 100644
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -15,6 +15,7 @@ serde_json = "1.0"
- serde = { version = "1.0", features = ["derive"] }
- # Tauri
- tauri = { version = "1.2.4", features = [
-+        "updater",
-         "dialog-save",
-         "process-relaunch",
-         "window-close",
--- a/pkgs/development/tools/devpod/default.nix
+++ b/pkgs/development/tools/devpod/default.nix
@ -1,53 +1,54 @@
 {
  lib,
+  stdenv,
  buildGoModule,
-  copyDesktopItems,
-  desktopToDarwinBundle,
+  rustPlatform,
  fetchFromGitHub,
  fetchYarnDeps,
-  gtk3,
+
+  cargo-tauri,
+  desktop-file-utils,
  installShellFiles,
  jq,
-  libayatana-appindicator,
-  libsoup_2_4,
-  makeDesktopItem,
-  mkYarnPackage,
-  openssl,
+  makeBinaryWrapper,
+  moreutils,
+  nodejs,
  pkg-config,
-  rust,
-  rustPlatform,
-  stdenv,
+  yarnConfigHook,
+  wrapGAppsHook3,
+
+  glib-networking,
+  libayatana-appindicator,
+  openssl,
+  webkitgtk_4_1,
+
  testers,
-  webkitgtk_4_0,
 }:

 let
-  pname = "devpod";
-  version = "0.5.20";
+  version = "0.6.15";

  src = fetchFromGitHub {
    owner = "loft-sh";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-8LbqrOKC1als3Xm6ZuU2AySwT0UWjLN2xh+/CvioYew=";
+    repo = "devpod";
+    tag = "v${version}";
+    hash = "sha256-fLUJeEwNDyzMYUEYVQL9XGQv/VAxjH4IZ1SJa6jx4Mw=";
  };

-  meta = with lib; {
+  meta = {
    description = "Codespaces but open-source, client-only and unopinionated: Works with any IDE and lets you use any cloud, kubernetes or just localhost docker";
    mainProgram = "devpod";
    homepage = "https://devpod.sh";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ maxbrunet ];
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      maxbrunet
+      tomasajt
+    ];
  };
-in
-rec {
-  devpod = buildGoModule {
-    inherit
-      version
-      src
-      pname
-      meta
-      ;
+
+  devpod = buildGoModule (finalAttrs: {
+    pname = "devpod";
+    inherit version src meta;

    vendorHash = null;

@ -69,123 +70,123 @@ rec {
    '';

    passthru.tests.version = testers.testVersion {
-      package = devpod;
+      package = finalAttrs.finalPackage;
      command = "devpod version";
      version = "v${version}";
    };
-  };
+  });

-  devpod-desktop =
-    let
-      frontend-build = mkYarnPackage {
-        inherit version;
-        pname = "devpod-frontend";
+  devpod-desktop = rustPlatform.buildRustPackage {
+    pname = "devpod-desktop";
+    inherit version src;

-        src = "${src}/desktop";
+    sourceRoot = "${src.name}/desktop";

-        offlineCache = fetchYarnDeps {
-          yarnLock = "${src}/desktop/yarn.lock";
-          hash = "sha256-vUV4yX+UvEKrP0vHxjGwtW2WyONGqHVmFor+WqWbkCc=";
-        };
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/desktop/yarn.lock";
+      hash = "sha256-0Ov+Ik+th2IiuuqJyiO9t8vTyMqxDa9juEwbwHFaoi4=";
+    };

-        packageJSON = ./package.json;
+    cargoRoot = "src-tauri";
+    buildAndTestSubdir = "src-tauri";

-        buildPhase = ''
-          export HOME=$(mktemp -d)
-          yarn --offline run build
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-BwuV5nAQcTAtdfK4+NKEt8Cj7gqnatRwHh/BYJJrIPo=";

-          cp -r deps/devpod/dist $out
-        '';
+    patches = [
+      # don't create a .desktop file automatically registered to open the devpod:// URI scheme
+      # we edit the in-store .desktop file in postInstall to support opening the scheme,
+      # but users will have to configure the default handler manually
+      ./dont-auto-register-scheme.patch

-        doDist = false;
-        dontInstall = true;
-      };
+      # disable the button that symlinks the `devpod-cli` binary to ~/.local/bin/devpod
+      # and don't show popup where it prompts you to press the above mentioned button
+      # we'll symlink it manually to $out/bin/devpod in postInstall
+      ./dont-copy-sidecar-out-of-store.patch

-      rustTargetPlatformSpec = stdenv.hostPlatform.rust.rustcTarget;
-    in
-    rustPlatform.buildRustPackage {
-      inherit version src;
-      pname = "devpod-desktop";
+      # otherwise it's going to get stuck in an endless error cycle, quickly increasing the log file size
+      ./exit-update-checker-loop.patch
+    ];

-      sourceRoot = "${src.name}/desktop/src-tauri";
+    postPatch =
+      ''
+        ln -s ${lib.getExe devpod} src-tauri/bin/devpod-cli-${stdenv.hostPlatform.rust.rustcTarget}

-      useFetchCargoVendor = true;
-      cargoHash = "sha256-HD9b7OWilltL5Ymj28zoZwv5TJV3HT3LyCdagMqLH6E=";
-
-      # Workaround:
-      #   The `tauri` dependency features on the `Cargo.toml` file does not match the allowlist defined under `tauri.conf.json`.
-      #   Please run `tauri dev` or `tauri build` or add the `updater` feature.
-      # Upstream is not interested in fixing that: https://github.com/loft-sh/devpod/pull/648
-      patches = [ ./add-tauri-updater-feature.patch ];
-
-      postPatch =
-        ''
-          ln -s ${devpod}/bin/devpod bin/devpod-cli-${rustTargetPlatformSpec}
-          cp -r ${frontend-build} frontend-build
-
-          substituteInPlace tauri.conf.json --replace '"distDir": "../dist",' '"distDir": "frontend-build",'
-        ''
-        + lib.optionalString stdenv.hostPlatform.isLinux ''
-          substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-            --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
-
-          # Since `cargo build` is used instead of `tauri build`, configs are merged manually.
-          jq --slurp '.[0] * .[1]' tauri.conf.json tauri-linux.conf.json >tauri.conf.json.merged
-          mv tauri.conf.json.merged tauri.conf.json
-        '';
-
-      nativeBuildInputs =
-        [
-          copyDesktopItems
-          pkg-config
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [
-          jq
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          desktopToDarwinBundle
-        ];
-
-      buildInputs =
-        [
-          libsoup_2_4
-          openssl
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [
-          gtk3
-          libayatana-appindicator
-          webkitgtk_4_0
-        ];
-
-      desktopItems = [
-        (makeDesktopItem {
-          name = "DevPod";
-          categories = [ "Development" ];
-          comment = "Spin up dev environments in any infra";
-          desktopName = "DevPod";
-          exec = "DevPod %U";
-          icon = "DevPod";
-          terminal = false;
-          type = "Application";
-          mimeTypes = [ "x-scheme-handler/devpod" ];
-        })
-      ];
-
-      postInstall = ''
-        ln -sf ${devpod}/bin/devpod $out/bin/devpod-cli
-        mv $out/bin/devpod-desktop $out/bin/DevPod
-
-        mkdir -p $out/share/icons/hicolor/{256x256@2,128x128,32x32}/apps
-        cp icons/128x128@2x.png $out/share/icons/hicolor/256x256@2/apps/DevPod.png
-        cp icons/128x128.png $out/share/icons/hicolor/128x128/apps/DevPod.png
-        cp icons/32x32.png $out/share/icons/hicolor/32x32/apps/DevPod.png
+        # disable upstream updater
+        jq '.plugins.updater.endpoints = [ ] | .bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json \
+          | sponge src-tauri/tauri.conf.json
+      ''
+      + lib.optionalString stdenv.hostPlatform.isLinux ''
+        substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+          --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
      '';

-      meta = meta // {
-        mainProgram = "DevPod";
-        # darwin does not build
-        # https://github.com/h4llow3En/mac-notification-sys/issues/28
-        platforms = lib.platforms.linux;
-      };
+    nativeBuildInputs =
+      [
+        cargo-tauri.hook
+        jq
+        moreutils
+        nodejs
+        yarnConfigHook
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        desktop-file-utils
+        pkg-config
+        wrapGAppsHook3
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        makeBinaryWrapper
+      ];
+
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+      glib-networking
+      libayatana-appindicator
+      openssl
+      webkitgtk_4_1
+    ];
+
+    postInstall =
+      lib.optionalString stdenv.hostPlatform.isDarwin ''
+        # replace sidecar binary with symlink
+        ln -sf ${lib.getExe devpod} "$out/Applications/DevPod.app/Contents/MacOS/devpod-cli"
+
+        makeWrapper "$out/Applications/DevPod.app/Contents/MacOS/DevPod Desktop" "$out/bin/DevPod Desktop"
+      ''
+      + lib.optionalString stdenv.hostPlatform.isLinux ''
+        # replace sidecar binary with symlink
+        ln -sf ${lib.getExe devpod} "$out/bin/devpod-cli"
+
+        # set up scheme handling
+        desktop-file-edit "$out/share/applications/DevPod.desktop" \
+          --set-key="Exec"     --set-value="\"DevPod Desktop\" %u" \
+          --set-key="MimeType" --set-value="x-scheme-handler/devpod"
+
+        # whitespace in the icon name causes gtk-update-icon-cache to fail
+        desktop-file-edit "$out/share/applications/DevPod.desktop" \
+          --set-key="Icon"     --set-value="DevPod-Desktop"
+
+        for dir in "$out"/share/icons/hicolor/*/apps; do
+          mv "$dir/DevPod Desktop.png" "$dir/DevPod-Desktop.png"
+        done
+      ''
+      + ''
+        # propagate the `devpod` command
+        ln -s ${lib.getExe devpod} "$out/bin/devpod"
+      '';
+
+    # we only want to wrap the main binary
+    dontWrapGApps = true;
+
+    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapGApp "$out/bin/DevPod Desktop"
+    '';
+
+    meta = meta // {
+      mainProgram = "DevPod Desktop";
+      platforms = lib.platforms.linux ++ lib.platforms.darwin;
    };
+  };
+in
+{
+  inherit devpod devpod-desktop;
 }
--- a/pkgs/development/tools/devpod/dont-auto-register-scheme.patch
+++ b/pkgs/development/tools/devpod/dont-auto-register-scheme.patch
@ -0,0 +1,13 @@
+diff --git a/src-tauri/src/custom_protocol.rs b/src-tauri/src/custom_protocol.rs
+index b6ed6e7..5434337 100644
+--- a/src-tauri/src/custom_protocol.rs
+++ b/src-tauri/src/custom_protocol.rs
+@@ -162,7 +162,7 @@ impl CustomProtocol {
+     pub fn setup(&self, app: AppHandle) {
+         let app_handle = app.clone();
+ 
+-        let result = tauri_plugin_deep_link::register(APP_URL_SCHEME, move |url_scheme| {
+        let result = tauri_plugin_deep_link::listen(move |url_scheme| {
+             tauri::async_runtime::block_on(async {
+                 info!("App opened with URL: {:?}", url_scheme.to_string());
+ 
--- a/pkgs/development/tools/devpod/dont-copy-sidecar-out-of-store.patch
+++ b/pkgs/development/tools/devpod/dont-copy-sidecar-out-of-store.patch
@ -0,0 +1,25 @@
+diff --git a/src/client/client.ts b/src/client/client.ts
+index 3e1747e..a842534 100644
+--- a/src/client/client.ts
+++ b/src/client/client.ts
+@@ -250,6 +250,7 @@ class Client {
+   }
+ 
+   public async isCLIInstalled(): Promise<Result<boolean>> {
+    return Return.Value(true);
+     try {
+       // we're in a flatpak, we need to check in other paths.
+       if (import.meta.env.TAURI_IS_FLATPAK === "true") {
+diff --git a/src/components/useInstallCLI.tsx b/src/components/useInstallCLI.tsx
+index ba3be79..ad25f3f 100644
+--- a/src/components/useInstallCLI.tsx
+++ b/src/components/useInstallCLI.tsx
+@@ -77,7 +77,7 @@ export function useInstallCLI() {
+           variant="outline"
+           isLoading={isLoading}
+           onClick={() => addBinaryToPath({})}
+-          isDisabled={status === "success"}>
+          isDisabled={true}>
+           Add CLI to Path
+         </Button>
+         <AlertDialog isOpen={isOpen} onClose={onClose} leastDestructiveRef={cancelRef}>
--- a/pkgs/development/tools/devpod/exit-update-checker-loop.patch
+++ b/pkgs/development/tools/devpod/exit-update-checker-loop.patch
@ -0,0 +1,13 @@
+diff --git a/src-tauri/src/updates.rs b/src-tauri/src/updates.rs
+index 51b8c41..9cc954d 100644
+--- a/src-tauri/src/updates.rs
+++ b/src-tauri/src/updates.rs
+@@ -176,7 +176,7 @@ impl<'a> UpdateHelper<'a> {
+             if updater.is_err() {
+                 error!("Failed to get updater");
+ 
+-                continue;
+                return;
+             }
+             info!("Attempting to check update");
+             if let Ok(update) = updater.unwrap().check().await {
--- a/pkgs/development/tools/devpod/package.json
+++ b/pkgs/development/tools/devpod/package.json
@ -1,66 +0,0 @@
-{
-  "name": "devpod",
-  "private": true,
-  "version": "0.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "tsc && vite build",
-    "preview": "vite preview",
-    "tauri": "tauri",
-    "desktop:dev": "tauri dev --config src-tauri/tauri-dev.conf.json",
-    "desktop:dev:debug": "export DEBUG=true; yarn desktop:dev",
-    "desktop:build:dev": "DEBUG=true tauri build --config src-tauri/tauri-dev.conf.json",
-    "desktop:build:debug": "tauri build --debug",
-    "desktop:build": "tauri build --features enable-updater",
-    "format:check": "prettier --check .",
-    "format:fix": "prettier --write .",
-    "types:check": "tsc -p ./tsconfig.json --noEmit"
-  },
-  "dependencies": {
-    "@chakra-ui/icons": "2.1.1",
-    "@chakra-ui/react": "2.8.1",
-    "@emotion/react": "11.11.1",
-    "@emotion/styled": "11.11.0",
-    "@headlessui/react": "1.7.17",
-    "@tanstack/react-query": "4.36.1",
-    "@tanstack/react-query-devtools": "4.36.1",
-    "@tanstack/react-table": "8.10.7",
-    "@tauri-apps/api": "1.5.3",
-    "dayjs": "1.11.10",
-    "framer-motion": "10.16.9",
-    "markdown-to-jsx": "7.3.2",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
-    "react-hook-form": "7.48.2",
-    "react-icons": "4.12.0",
-    "react-router": "6.20.0",
-    "react-router-dom": "6.20.0",
-    "tauri-plugin-store-api": "https://github.com/tauri-apps/tauri-plugin-store#v1",
-    "uuid": "9.0.1",
-    "xterm": "5.3.0",
-    "xterm-addon-fit": "0.7.0"
-  },
-  "devDependencies": {
-    "@tanstack/eslint-plugin-query": "4.36.1",
-    "@tauri-apps/cli": "1.5.11",
-    "@types/node": "18.15.3",
-    "@types/react": "18.2.28",
-    "@types/react-dom": "18.2.13",
-    "@types/uuid": "9.0.5",
-    "@typescript-eslint/eslint-plugin": "5.59.11",
-    "@typescript-eslint/parser": "5.59.11",
-    "@vitejs/plugin-react": "4.1.0",
-    "eslint": "8.44.0",
-    "eslint-config-prettier": "8.8.0",
-    "eslint-config-react-app": "7.0.1",
-    "eslint-plugin-react": "7.34.1",
-    "eslint-plugin-react-hooks": "4.6.0",
-    "prettier": "3.0.3",
-    "typescript": "5.0.4",
-    "vite": "4.4.9"
-  },
-  "resolutions": {
-    "lodash": "4.17.21"
-  }
-}
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "tokei";
-  version = "12.1.2";
+  version = "13.0.0-alpha.8";

  src = fetchFromGitHub {
    owner = "XAMPPRocky";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-jqDsxUAMD/MCCI0hamkGuCYa8rEXNZIR8S+84S8FbgI=";
+    sha256 = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-hCFFqvnbm0MXDvC5ea7Uo3xQdMO2e4tU7dEAvZxTM3s=";
+  cargoHash = "sha256-LzlyrKaRjUo6JnVLQnHidtI4OWa+GrhAc4D8RkL+nmQ=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    libiconv
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -16,16 +16,16 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.14.3"; # zen
+      version = "6.14.4"; # zen
      suffix = "zen1"; # zen
-      sha256 = "17r4gmxbgs0aizlp35pdq515ag50zc3q20fxapbya4yp5qs6ncz0"; # zen
+      sha256 = "186rrmsi5y1nwhrd0f1bxjmkr5bhlagr0ih6pfdp5ks25is721ca"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.14.3"; # lqx
+      version = "6.14.4"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "1xqhjvi7a6gbsm3zq3gwc5hl8xw17afqx1b1db0p1cp5c9xn3vxa"; # lqx
+      sha256 = "1j255qi5r2y2n3dks50b2kna2qdm43skggjrgi362yjhb11psvw6"; # lqx
      isLqx = true;
    };
  };
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@ -6,18 +6,18 @@

 buildNpmPackage rec {
  pname = "universal-remote-card";
-  version = "4.4.0";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "android-tv-card";
    rev = version;
-    hash = "sha256-YbzPnKiVPjkVAsJwpKIbjFRa9tqJidYN3AeyKskddA4=";
+    hash = "sha256-LhA4yDodTyeKxSr3BAYea/gohrHdsQIb2+MVixOBjC8=";
  };

  patches = [ ./dont-call-git.patch ];

-  npmDepsHash = "sha256-RC2j3Zf3t75Xi4RbUgRVittEosbfJxcBBg6Tm8cy7L8=";
+  npmDepsHash = "sha256-/0bxOC9e8+mfWAyj/yPXVGS4OAdFNU5H3x8z9aS0LBA=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@ -13,11 +13,11 @@
 callPackage ../nginx/generic.nix args rec {
  pname = "openresty";
  nginxVersion = "1.27.1";
-  version = "${nginxVersion}.1";
+  version = "${nginxVersion}.2";

  src = fetchurl {
    url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "sha256-ebBx4nvcFD1fQB0Nv1BN5EIAcNhnU4xe3CVG0DUf1cA=";
+    sha256 = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg=";
  };

  # generic.nix applies fixPatch on top of every patch defined there.
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@ -367,7 +367,6 @@ let
    };
 in
 self: {
-  mariadb_105 = throw "'mariadb_105' has been removed because it reached its End of Life. Consider upgrading to 'mariadb_106'.";
  # see https://mariadb.org/about/#maintenance-policy for EOLs
  mariadb_106 = self.callPackage generic {
    # Supported until 2026-07-06
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@ -43,6 +43,7 @@ let
    x86_64-linux.target = "x86_64";
    armv7l-linux.target = "arm";
    aarch64-linux.target = "aarch64";
+    loongarch64-linux.target = "loongarch64";
    riscv32-linux.target = "riscv32";
    riscv64-linux.target = "riscv64";
  };
@ -54,6 +55,7 @@ let
    x86_64-linux.target = "x86_64";
    armv7l-linux.target = "arm";
    aarch64-linux.target = "arm64";
+    loongarch64-linux.target = "loongarch64";
    riscv32-linux.target = "riscv32";
    riscv64-linux.target = "riscv64";
  };
--- a/pkgs/tools/networking/octodns/default.nix
+++ b/pkgs/tools/networking/octodns/default.nix
@ -1,26 +1,28 @@
 {
  lib,
-  buildPythonPackage,
-  dnspython,
  fetchFromGitHub,
-  fqdn,
-  idna,
-  natsort,
-  pytestCheckHook,
-  python-dateutil,
-  python,
-  pythonOlder,
-  pyyaml,
+  python3,
  runCommand,
-  setuptools,
-}:

-buildPythonPackage rec {
+  # passthru
+  octodns,
+}:
+let
+  # Export `python` with `octodns` as a module for `octodns-providers`.
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      octodns = final.toPythonModule octodns;
+    };
+  };
+  python3Packages = python.pkgs;
+in
+python3Packages.buildPythonApplication rec {
  pname = "octodns";
  version = "1.10.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
+  disabled = python.pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "octodns";
@ -29,11 +31,11 @@ buildPythonPackage rec {
    hash = "sha256-L3c4lYt/fgMctJFArc1XlR+hvpz10kcBcYYXajnNQr0=";
  };

-  build-system = [
+  build-system = with python3Packages; [
    setuptools
  ];

-  dependencies = [
+  dependencies = with python3Packages; [
    dnspython
    fqdn
    idna
@ -42,21 +44,30 @@ buildPythonPackage rec {
    pyyaml
  ];

-  nativeCheckInputs = [
+  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
  ];

  pythonImportsCheck = [ "octodns" ];

-  passthru.withProviders =
-    ps:
-    let
-      pyEnv = python.withPackages ps;
-    in
-    runCommand "octodns-with-providers" { } ''
-      mkdir -p $out/bin
-      ln -st $out/bin ${pyEnv}/bin/octodns-*
-    '';
+  passthru = {
+    providers = lib.recurseIntoAttrs (
+      lib.packagesFromDirectoryRecursive {
+        inherit (python3Packages) callPackage;
+        directory = ./providers;
+      }
+    );
+
+    withProviders =
+      ps:
+      let
+        pyEnv = python.withPackages ps;
+      in
+      runCommand "octodns-with-providers" { } ''
+        mkdir -p $out/bin
+        ln -st $out/bin ${pyEnv}/bin/octodns-*
+      '';
+  };

  meta = with lib; {
    description = "Tools for managing DNS across multiple providers";
--- a/pkgs/tools/networking/octodns/providers/bind/package.nix
+++ b/pkgs/tools/networking/octodns/providers/bind/package.nix
--- a/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
+++ b/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
--- a/pkgs/tools/networking/octodns/providers/ddns/package.nix
+++ b/pkgs/tools/networking/octodns/providers/ddns/package.nix
--- a/pkgs/tools/networking/octodns/providers/gandi/package.nix
+++ b/pkgs/tools/networking/octodns/providers/gandi/package.nix
--- a/pkgs/tools/networking/octodns/providers/hetzner/package.nix
+++ b/pkgs/tools/networking/octodns/providers/hetzner/package.nix
--- a/pkgs/tools/networking/octodns/providers/powerdns/package.nix
+++ b/pkgs/tools/networking/octodns/providers/powerdns/package.nix
--- a/pkgs/tools/networking/octodns/providers/transip/package.nix
+++ b/pkgs/tools/networking/octodns/providers/transip/package.nix
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1105,6 +1105,7 @@ mapAliases {
  MACS2 = macs2; # Added 2023-06-12
  mailctl = throw "mailctl has been renamed to oama"; # Added 2024-08-19
  mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
+  mariadb_105 = throw "'mariadb_105' has been removed because it reached its End of Life. Consider upgrading to 'mariadb_106'."; # Added 2025-04-26
  mariadb_110 = throw "mariadb_110 has been removed from nixpkgs, please switch to another version like mariadb_114"; # Added 2024-08-15
  mariadb-client = hiPrio mariadb.client; # added 2019.07.28
  maligned = throw "maligned was deprecated upstream in favor of x/tools/go/analysis/passes/fieldalignment"; # Added 20204-08-24
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -419,17 +419,9 @@ with pkgs;

  deviceTree = callPackage ../os-specific/linux/device-tree { };

-  octodns = python3Packages.callPackage ../tools/networking/octodns { };
+  octodns = callPackage ../tools/networking/octodns { };

-  octodns-providers = recurseIntoAttrs {
-    bind = python3Packages.callPackage ../tools/networking/octodns/providers/bind { };
-    gandi = python3Packages.callPackage ../tools/networking/octodns/providers/gandi { };
-    hetzner = python3Packages.callPackage ../tools/networking/octodns/providers/hetzner { };
-    powerdns = python3Packages.callPackage ../tools/networking/octodns/providers/powerdns { };
-    cloudflare = python3Packages.callPackage ../tools/networking/octodns/providers/cloudflare { };
-    ddns = python3Packages.callPackage ../tools/networking/octodns/providers/ddns { };
-    transip = python3Packages.callPackage ../tools/networking/octodns/providers/transip { };
-  };
+  octodns-providers = octodns.providers;

  oletools = with python3.pkgs; toPythonApplication oletools;

@ -11233,7 +11225,6 @@ with pkgs;
  mariadb-connector-c_3_3 = callPackage ../servers/sql/mariadb/connector-c/3_3.nix { };

  inherit (import ../servers/sql/mariadb pkgs)
-    mariadb_105
    mariadb_106
    mariadb_1011
    mariadb_114
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -12599,6 +12599,8 @@ self: super: with self; {

  pylint-flask = callPackage ../development/python-modules/pylint-flask { };

+  pylint-odoo = callPackage ../development/python-modules/pylint-odoo { };
+
  pylint-plugin-utils = callPackage ../development/python-modules/pylint-plugin-utils { };

  pylint-venv = callPackage ../development/python-modules/pylint-venv { };
@ -14325,6 +14327,8 @@ self: super: with self; {

  pythran = callPackage ../development/python-modules/pythran { inherit (pkgs.llvmPackages) openmp; };

+  pythreejs = callPackage ../development/python-modules/pythreejs { };
+
  pytibber = callPackage ../development/python-modules/pytibber { };

  pytikz-allefeld = callPackage ../development/python-modules/pytikz-allefeld { };