Merge remote-tracking branch 'origin/staging-next' into staging

2025-06-12 04:35:41 +03:00 · 2025-04-22 21:21:57 +03:00 · 2025-04-22 21:21:57 +03:00 · df4847ebd5
commit df4847ebd5
parent aecb6f0713 d88a08943d
56 changed files with 498 additions and 1248 deletions
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -131,7 +131,7 @@
 - `binwalk` was updated to 3.1.0, which has been rewritten in rust. The python module is no longer available.
  See the release notes of [3.1.0](https://github.com/ReFirmLabs/binwalk/releases/tag/v3.1.0) for more information.

- `pkgs.nextcloud28` has been removed since it's out of support upstream.
+- `pkgs.nextcloud28` and `pkgs.nextcloud29` have been removed since they are out of support upstream.

 - `centrifugo` was updated to v6, which uses a new config format. See [upstream documentation](https://centrifugal.dev/docs/getting-started/migration_v6) for migration.

--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -142,7 +142,7 @@

 - [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](options.html#opt-programs.zoxide.enable)

- [victorialogs][https://docs.victoriametrics.com/victorialogs/], log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable)
+- [victorialogs](https://docs.victoriametrics.com/victorialogs/), log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable)

 - [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable)

--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/ppvbj1hzk77il5wd5g6q5ibyyd4jsnrl-nix-2.28.1";
-  i686-linux = "/nix/store/5lb00s5p37715jh8y9nw6ihdjlzrs2bq-nix-2.28.1";
-  aarch64-linux = "/nix/store/2zy7z2ablw09s0fj511x6d6za2vswv09-nix-2.28.1";
-  riscv64-linux = "/nix/store/m4fw1gfzx7z3lp2pra1x1bajjb5d4fvi-nix-riscv64-unknown-linux-gnu-2.28.1";
-  x86_64-darwin = "/nix/store/yi9ysd086218v1k1i16ilkmnkavgrxsi-nix-2.28.1";
-  aarch64-darwin = "/nix/store/v4g8bccvg56b8y4r93c6w1f8125qs3cm-nix-2.28.1";
+  x86_64-linux = "/nix/store/pzwdmrz94mya45m1jnsf294c0g3cwy9m-nix-2.28.2";
+  i686-linux = "/nix/store/vzqxry2dwq9nzr2y0jk1q7qv3ygv14m1-nix-2.28.2";
+  aarch64-linux = "/nix/store/52zak9psh00w8c8iz8x0ny33in5wwr83-nix-2.28.2";
+  riscv64-linux = "/nix/store/rkggav1j9wb55zc8jsl1vg81s831aqj8-nix-riscv64-unknown-linux-gnu-2.28.2";
+  x86_64-darwin = "/nix/store/afwsvhzqf936zx5v4i7ynqah2qhq7qyj-nix-2.28.2";
+  aarch64-darwin = "/nix/store/djcysgb0pgrigaqfnmraviv6nix786zi-nix-2.28.2";
 }
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -205,7 +205,7 @@ let
            'class' => '\\OC\\Files\\ObjectStore\\S3',
            'arguments' => [
              'bucket' => '${s3.bucket}',
-              'autocreate' => ${boolToString s3.autocreate},
+              'verify_bucket_exists' => ${boolToString s3.verify_bucket_exists},
              'key' => '${s3.key}',
              'secret' => nix_read_secret('s3_secret'),
              ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
@ -344,6 +344,10 @@ in
      [ "services" "nextcloud" "extraOptions" ]
      [ "services" "nextcloud" "settings" ]
    )
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "objectstore" "s3" "autocreate" ]
+      [ "services" "nextcloud" "config" "objectstore" "s3" "verify_bucket_exists" ]
+    )
  ];

  options.services.nextcloud = {
@ -420,7 +424,6 @@ in
      type = types.package;
      description = "Which package to use for the Nextcloud instance.";
      relatedPackages = [
-        "nextcloud29"
        "nextcloud30"
        "nextcloud31"
      ];
@ -654,10 +657,11 @@ in
              The name of the S3 bucket.
            '';
          };
-          autocreate = mkOption {
+          verify_bucket_exists = mkOption {
            type = types.bool;
+            default = true;
            description = ''
-              Create the objectstore if it does not exist.
+              Create the objectstore bucket if it does not exist.
            '';
          };
          key = mkOption {
@ -1041,8 +1045,7 @@ in
            nextcloud31
        );

-      services.nextcloud.phpPackage =
-        if versionOlder cfg.package.version "29" then pkgs.php82 else pkgs.php83;
+      services.nextcloud.phpPackage = pkgs.php83;

      services.nextcloud.phpOptions = mkMerge [
        (mapAttrs (const mkOptionDefault) defaultPHPSettings)
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -339,32 +339,6 @@ rec {

  );

-  # Test job for https://github.com/NixOS/nixpkgs/issues/121354 to test
-  # automatic sizing without blocking the channel.
-  amazonImageAutomaticSize = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (
-    system:
-
-    with import ./.. { inherit system; };
-
-    hydraJob (
-      (import lib/eval-config.nix {
-        inherit system;
-        modules = [
-          configuration
-          versionModule
-          ./maintainers/scripts/ec2/amazon-image.nix
-          (
-            { ... }:
-            {
-              virtualisation.diskSize = "auto";
-            }
-          )
-        ];
-      }).config.system.build.amazonImage
-    )
-
-  );
-
  # An image that can be imported into incus and used for container creation
  incusContainerImage =
    forMatchingSystems
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -594,7 +594,7 @@ in
    package = pkgs.hadoop2;
  };
  haste-server = handleTest ./haste-server.nix { };
-  haproxy = handleTest ./haproxy.nix { };
+  haproxy = runTest ./haproxy.nix;
  hardened = handleTest ./hardened.nix { };
  harmonia = runTest ./harmonia.nix;
  headscale = handleTest ./headscale.nix { };
--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@ -1,140 +1,138 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "haproxy";
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.haproxy = {
-            enable = true;
-            config = ''
-              global
-                limited-quic
+{ lib, hostPkgs, ... }:
+{
+  name = "haproxy";
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        services.haproxy = {
+          enable = true;
+          config = ''
+            global
+              limited-quic

-              defaults
-                mode http
-                timeout connect 10s
-                timeout client 10s
-                timeout server 10s
+            defaults
+              mode http
+              timeout connect 10s
+              timeout client 10s
+              timeout server 10s

-                log /dev/log local0 debug err
-                option logasap
-                option httplog
-                option httpslog
+              log /dev/log local0 debug err
+              option logasap
+              option httplog
+              option httpslog

-              backend http_server
-                server httpd [::1]:8000 alpn http/1.1
+            backend http_server
+              server httpd [::1]:8000 alpn http/1.1

-              frontend http
-                bind :80
-                bind :443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h2,http/1.1
-                bind quic4@:443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h3 allow-0rtt
+            frontend http
+              bind :80
+              bind :443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h2,http/1.1
+              bind quic4@:443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h3 allow-0rtt

-                http-after-response add-header alt-svc 'h3=":443"; ma=60' if { ssl_fc }
+              http-after-response add-header alt-svc 'h3=":443"; ma=60' if { ssl_fc }

-                http-request use-service prometheus-exporter if { path /metrics }
-                use_backend http_server
+              http-request use-service prometheus-exporter if { path /metrics }
+              use_backend http_server

-              frontend http-cert-auth
-                bind :8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt
-                bind quic4@:8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt alpn h3
+            frontend http-cert-auth
+              bind :8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt
+              bind quic4@:8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt alpn h3

-                use_backend http_server
-            '';
-          };
-          services.httpd = {
-            enable = true;
-            virtualHosts.localhost = {
-              documentRoot = pkgs.writeTextDir "index.txt" "We are all good!";
-              adminAddr = "notme@yourhost.local";
-              listen = [
-                {
-                  ip = "::1";
-                  port = 8000;
-                }
-              ];
-            };
-          };
-          networking.firewall.allowedTCPPorts = [
-            80
-            443
-            8443
-          ];
-          networking.firewall.allowedUDPPorts = [
-            443
-            8443
-          ];
+              use_backend http_server
+          '';
        };
-      client =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.curlHTTP3 ];
+        services.httpd = {
+          enable = true;
+          virtualHosts.localhost = {
+            documentRoot = pkgs.writeTextDir "index.txt" "We are all good!";
+            adminAddr = "notme@yourhost.local";
+            listen = [
+              {
+                ip = "::1";
+                port = 8000;
+              }
+            ];
+          };
        };
-    };
-    testScript = ''
-      # Helpers
-      def cmd(command):
-        print(f"+{command}")
-        r = os.system(command)
-        if r != 0:
-          raise Exception(f"Command {command} failed with exit code {r}")
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+          8443
+        ];
+        networking.firewall.allowedUDPPorts = [
+          443
+          8443
+        ];
+      };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.curlHTTP3 ];
+      };
+  };
+  testScript = ''
+    # Helpers
+    def cmd(command):
+      print(f"+{command}")
+      r = os.system(command)
+      if r != 0:
+        raise Exception(f"Command {command} failed with exit code {r}")

-      def openssl(command):
-        cmd(f"${pkgs.openssl}/bin/openssl {command}")
+    def openssl(command):
+      cmd(f"${lib.getExe hostPkgs.openssl} {command}")

-      # Generate CA.
-      openssl("req -new -newkey rsa:4096 -nodes -x509 -days 7 -subj '/C=ZZ/ST=Cloud/L=Unspecified/O=NixOS/OU=Tests/CN=CA Certificate' -keyout cacert.key -out cacert.crt")
+    # Generate CA.
+    openssl("req -new -newkey rsa:4096 -nodes -x509 -days 7 -subj '/C=ZZ/ST=Cloud/L=Unspecified/O=NixOS/OU=Tests/CN=CA Certificate' -keyout cacert.key -out cacert.crt")

-      # Generate and sign Server.
-      openssl("req -newkey rsa:4096 -nodes -subj '/CN=server/OU=Tests/O=NixOS' -keyout server.key -out server.csr")
-      openssl("x509 -req -in server.csr -out server.crt -CA cacert.crt -CAkey cacert.key -days 7")
-      cmd("cat server.crt server.key > fullchain.pem")
+    # Generate and sign Server.
+    openssl("req -newkey rsa:4096 -nodes -subj '/CN=server/OU=Tests/O=NixOS' -keyout server.key -out server.csr")
+    openssl("x509 -req -in server.csr -out server.crt -CA cacert.crt -CAkey cacert.key -days 7")
+    cmd("cat server.crt server.key > fullchain.pem")

-      # Generate and sign Client.
-      openssl("req -newkey rsa:4096 -nodes -subj '/CN=client/OU=Tests/O=NixOS' -keyout client.key -out client.csr")
-      openssl("x509 -req -in client.csr -out client.crt -CA cacert.crt -CAkey cacert.key -days 7")
-      cmd("cat client.crt client.key > client.pem")
+    # Generate and sign Client.
+    openssl("req -newkey rsa:4096 -nodes -subj '/CN=client/OU=Tests/O=NixOS' -keyout client.key -out client.csr")
+    openssl("x509 -req -in client.csr -out client.crt -CA cacert.crt -CAkey cacert.key -days 7")
+    cmd("cat client.crt client.key > client.pem")

-      # Start the actual test.
-      start_all()
-      server.copy_from_host("fullchain.pem", "/etc/ssl/fullchain.pem")
-      server.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
-      server.succeed("chmod 0644 /etc/ssl/fullchain.pem /etc/ssl/cacert.crt")
+    # Start the actual test.
+    start_all()
+    server.copy_from_host("fullchain.pem", "/etc/ssl/fullchain.pem")
+    server.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
+    server.succeed("chmod 0644 /etc/ssl/fullchain.pem /etc/ssl/cacert.crt")

-      client.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
-      client.copy_from_host("client.pem", "/root/client.pem")
+    client.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
+    client.copy_from_host("client.pem", "/root/client.pem")

-      server.wait_for_unit("multi-user.target")
-      server.wait_for_unit("haproxy.service")
-      server.wait_for_unit("httpd.service")
+    server.wait_for_unit("multi-user.target")
+    server.wait_for_unit("haproxy.service")
+    server.wait_for_unit("httpd.service")

-      assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
-      assert "haproxy_process_pool_allocated_bytes" in client.succeed("curl -f http://server/metrics")
+    assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
+    assert "haproxy_process_pool_allocated_bytes" in client.succeed("curl -f http://server/metrics")

-      with subtest("https"):
-        assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt https://server/index.txt")
+    with subtest("https"):
+      assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt https://server/index.txt")

-      with subtest("https-cert-auth"):
-        # Client must succeed in authenticating with the right certificate.
-        assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
-        # Client must fail without certificate.
-        client.fail("curl --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")
+    with subtest("https-cert-auth"):
+      # Client must succeed in authenticating with the right certificate.
+      assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
+      # Client must fail without certificate.
+      client.fail("curl --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")

-      with subtest("h3"):
-        assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server/index.txt")
+    with subtest("h3"):
+      assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server/index.txt")

-      with subtest("h3-cert-auth"):
-        # Client must succeed in authenticating with the right certificate.
-        assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
-        # Client must fail without certificate.
-        client.fail("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")
+    with subtest("h3-cert-auth"):
+      # Client must succeed in authenticating with the right certificate.
+      assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
+      # Client must fail without certificate.
+      client.fail("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")

-      with subtest("reload"):
-          server.succeed("systemctl reload haproxy")
-          # wait some time to ensure the following request hits the reloaded haproxy
-          server.sleep(5)
-          assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
-    '';
-  }
-)
+    with subtest("reload"):
+        server.succeed("systemctl reload haproxy")
+        # wait some time to ensure the following request hits the reloaded haproxy
+        server.sleep(5)
+        assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
+  '';
+}
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@ -139,7 +139,6 @@ let
 in
 listToAttrs (
  concatMap genTests [
-    29
    30
    31
  ]
--- a/nixos/tests/postgresql/citus.nix
+++ b/nixos/tests/postgresql/citus.nix
@ -1,72 +0,0 @@
-{
-  pkgs,
-  makeTest,
-  genTests,
-}:
-
-let
-  inherit (pkgs) lib;
-
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION citus;
-
-    CREATE TABLE examples (
-      id bigserial,
-      shard_key int,
-      PRIMARY KEY (id, shard_key)
-    );
-
-    SELECT create_distributed_table('examples', 'shard_key');
-
-    INSERT INTO examples (shard_key) SELECT shard % 10 FROM generate_series(1,1000) shard;
-  '';
-
-  makeTestFor =
-    package:
-    makeTest {
-      name = "citus-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ typetetris ];
-      };
-
-      nodes.machine =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                citus
-              ];
-            settings = {
-              shared_preload_libraries = "citus";
-            };
-          };
-        };
-
-      testScript = ''
-        def check_count(statement, lines):
-            return 'test $(sudo -u postgres psql postgres -tAc "{}") -eq {}'.format(
-                statement, lines
-            )
-
-
-        machine.start()
-        machine.wait_for_unit("postgresql")
-
-        with subtest("Postgresql with extension citus is available just after unit start"):
-            machine.succeed(
-                "sudo -u postgres psql -f ${test-sql}"
-            )
-
-        machine.succeed(check_count("SELECT count(*) FROM examples;", 1000))
-
-        machine.shutdown()
-      '';
-    };
-in
-genTests {
-  inherit makeTestFor;
-  filter = _: p: !p.pkgs.citus.meta.broken;
-}
--- a/nixos/tests/postgresql/default.nix
+++ b/nixos/tests/postgresql/default.nix
@ -36,10 +36,6 @@ in

  # extensions
  anonymizer = importWithArgs ./anonymizer.nix;
-  citus = importWithArgs ./citus.nix;
  pgjwt = importWithArgs ./pgjwt.nix;
-  pgvecto-rs = importWithArgs ./pgvecto-rs.nix;
-  timescaledb = importWithArgs ./timescaledb.nix;
-  tsja = importWithArgs ./tsja.nix;
  wal2json = importWithArgs ./wal2json.nix;
 }
--- a/nixos/tests/postgresql/pgvecto-rs.nix
+++ b/nixos/tests/postgresql/pgvecto-rs.nix
@ -1,78 +0,0 @@
-{
-  pkgs,
-  makeTest,
-  genTests,
-}:
-
-let
-  inherit (pkgs) lib;
-
-  # Test cases from https://docs.vectorchord.ai/use-case/hybrid-search.html
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION vectors;
-
-    CREATE TABLE items (
-      id bigserial PRIMARY KEY,
-      content text NOT NULL,
-      embedding vectors.vector(3) NOT NULL -- 3 dimensions
-    );
-
-    INSERT INTO items (content, embedding) VALUES
-      ('a fat cat sat on a mat and ate a fat rat', '[1, 2, 3]'),
-      ('a fat dog sat on a mat and ate a fat rat', '[4, 5, 6]'),
-      ('a thin cat sat on a mat and ate a thin rat', '[7, 8, 9]'),
-      ('a thin dog sat on a mat and ate a thin rat', '[10, 11, 12]');
-  '';
-
-  makeTestFor =
-    package:
-    makeTest {
-      name = "pgvecto-rs-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ diogotcorreia ];
-      };
-
-      nodes.machine =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                pgvecto-rs
-              ];
-            settings.shared_preload_libraries = "vectors";
-          };
-        };
-
-      testScript =
-        { nodes, ... }:
-        let
-          inherit (nodes.machine.services.postgresql.package.pkgs) pgvecto-rs;
-        in
-        ''
-          def check_count(statement, lines):
-              return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
-                  statement, lines
-              )
-
-
-          machine.start()
-          machine.wait_for_unit("postgresql")
-
-          with subtest("Postgresql with extension vectors is available just after unit start"):
-              machine.succeed(check_count("SELECT * FROM pg_available_extensions WHERE name = 'vectors' AND default_version = '${pgvecto-rs.version}';", 1))
-
-          machine.succeed("sudo -u postgres psql -f ${test-sql}")
-
-          machine.succeed(check_count("SELECT content, embedding FROM items WHERE to_tsvector('english', content) @@ 'cat & rat'::tsquery;", 2))
-
-          machine.shutdown()
-        '';
-    };
-in
-genTests {
-  inherit makeTestFor;
-  filter = _: p: !p.pkgs.pgvecto-rs.meta.broken;
-}
--- a/nixos/tests/postgresql/timescaledb.nix
+++ b/nixos/tests/postgresql/timescaledb.nix
@ -1,97 +0,0 @@
-{
-  pkgs,
-  makeTest,
-  genTests,
-}:
-
-let
-  inherit (pkgs) lib;
-
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION timescaledb;
-    CREATE EXTENSION timescaledb_toolkit;
-
-    CREATE TABLE sth (
-      time TIMESTAMPTZ NOT NULL,
-      value DOUBLE PRECISION
-    );
-
-    SELECT create_hypertable('sth', 'time');
-
-    INSERT INTO sth (time, value) VALUES
-    ('2003-04-12 04:05:06 America/New_York', 1.0),
-    ('2003-04-12 04:05:07 America/New_York', 2.0),
-    ('2003-04-12 04:05:08 America/New_York', 3.0),
-    ('2003-04-12 04:05:09 America/New_York', 4.0),
-    ('2003-04-12 04:05:10 America/New_York', 5.0)
-    ;
-
-    WITH t AS (
-      SELECT
-        time_bucket('1 day'::interval, time) AS dt,
-        stats_agg(value) AS stats
-      FROM sth
-      GROUP BY time_bucket('1 day'::interval, time)
-    )
-    SELECT
-      average(stats)
-    FROM t;
-
-    SELECT * FROM sth;
-  '';
-
-  makeTestFor =
-    package:
-    makeTest {
-      name = "timescaledb-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ typetetris ];
-      };
-
-      nodes.machine =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                timescaledb
-                timescaledb_toolkit
-              ];
-            settings = {
-              shared_preload_libraries = "timescaledb, timescaledb_toolkit";
-            };
-          };
-        };
-
-      testScript = ''
-        def check_count(statement, lines):
-            return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
-                statement, lines
-            )
-
-
-        machine.start()
-        machine.wait_for_unit("postgresql")
-
-        with subtest("Postgresql with extensions timescaledb and timescaledb_toolkit is available just after unit start"):
-            machine.succeed(
-                "sudo -u postgres psql -f ${test-sql}"
-            )
-
-        machine.fail(check_count("SELECT * FROM sth;", 3))
-        machine.succeed(check_count("SELECT * FROM sth;", 5))
-        machine.fail(check_count("SELECT * FROM sth;", 4))
-
-        machine.shutdown()
-      '';
-    };
-in
-# Not run by default, because this requires allowUnfree.
-# To run these tests:
-#   NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.postgresql.timescaledb
-lib.dontRecurseIntoAttrs (genTests {
-  inherit makeTestFor;
-  filter = _: p: !p.pkgs.timescaledb.meta.broken;
-})
--- a/nixos/tests/postgresql/tsja.nix
+++ b/nixos/tests/postgresql/tsja.nix
@ -1,47 +0,0 @@
-{
-  pkgs,
-  makeTest,
-  genTests,
-}:
-
-let
-  inherit (pkgs) lib;
-
-  makeTestFor =
-    package:
-    makeTest {
-      name = "tsja-${package.name}";
-      meta = {
-        maintainers = with lib.maintainers; [ chayleaf ];
-      };
-
-      nodes.master =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                tsja
-              ];
-          };
-        };
-
-      testScript = ''
-        start_all()
-        master.wait_for_unit("postgresql")
-        master.succeed("sudo -u postgres psql -f /run/current-system/sw/share/postgresql/extension/libtsja_dbinit.sql")
-        # make sure "日本語" is parsed as a separate lexeme
-        master.succeed("""
-          sudo -u postgres \\
-            psql -c "SELECT * FROM ts_debug('japanese', 'PostgreSQLで日本語のテキスト検索ができます。')" \\
-              | grep "{日本語}"
-        """)
-      '';
-    };
-in
-genTests {
-  inherit makeTestFor;
-  filter = _: p: !p.pkgs.tsja.meta.broken;
-}
--- a/pkgs/by-name/al/alpaca/package.nix
+++ b/pkgs/by-name/al/alpaca/package.nix
@ -20,14 +20,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "alpaca";
-  version = "5.3.0";
+  version = "5.2.0";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Alpaca";
    tag = version;
-    hash = "sha256-dp/v5PZoDqSp2h0gtZk97ImDKO201VZMiCBv2XnqoGQ=";
+    hash = "sha256-uUGsdHrqzA5fZ4LNtX04H4ue9n4JQrkTYW2PCCFYFHc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@ -70,6 +70,10 @@ stdenv.mkDerivation (finalAttrs: {
    "PREFIX=${placeholder "out"}"
    "VERSION=${finalAttrs.version}"
    "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
+
+    # Tries to install to the 'systemd-minimal' and 'udev' nix installation paths
+    "PKGCONFIG_SERVICEDIR=$(out)/lib/systemd/system"
+    "PKGCONFIG_UDEVDIR=$(out)/lib/udev"
  ] ++ lib.optional fuseSupport "BCACHEFS_FUSE=1";

  env = {
@ -90,12 +94,6 @@ stdenv.mkDerivation (finalAttrs: {
  '';
  checkFlags = [ "BCACHEFS_TEST_USE_VALGRIND=no" ];

-  # Tries to install to the 'systemd-minimal' and 'udev' nix installation paths
-  installFlags = [
-    "PKGCONFIG_SERVICEDIR=$(out)/lib/systemd/system"
-    "PKGCONFIG_UDEVDIR=$(out)/lib/udev"
-  ];
-
  postInstall =
    ''
      substituteInPlace $out/libexec/bcachefsck_all \
--- a/pkgs/by-name/cl/clapper-unwrapped/package.nix
+++ b/pkgs/by-name/cl/clapper-unwrapped/package.nix
@ -44,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    ninja
    pkg-config
    desktop-file-utils # for update-desktop-database
+    gtk4 # for gtk4-update-icon-cache
    shared-mime-info # for update-mime-database
    vala
  ];
@ -69,7 +70,10 @@ stdenv.mkDerivation (finalAttrs: {

  preFixup = ''
    mkdir -p $out/share/gsettings-schemas
-    cp -r $lib/share/gsettings-schemas/clapper-unwrapped-$version $out/share/gsettings-schemas/clapper-$version
+    # alias clapper-unwrapped schemas to also provide clapper schemas.
+    # the precise schema patch can vary based on host platform.
+    schemas=$(basename $lib/share/gsettings-schemas/clapper-unwrapped-*)
+    cp -r $lib/share/gsettings-schemas/$schemas $out/share/gsettings-schemas/''${schemas/clapper-unwrapped-/clapper-}
  '';

  meta = {
--- a/pkgs/by-name/cr/criu/package.nix
+++ b/pkgs/by-name/cr/criu/package.nix
@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
    asciidoc
    xmlto
    libpaper
-    libuuid
    docbook_xsl
    which
    makeWrapper
@ -64,6 +63,7 @@ stdenv.mkDerivation rec {
    libnet
    nftables
    libbsd
+    libuuid
  ];
  propagatedBuildInputs =
    [
@ -95,6 +95,7 @@ stdenv.mkDerivation rec {
        "powerpc" = "ppc64";
        "s390" = "s390";
        "mips" = "mips";
+        "loongarch" = "loongarch64";
      };
    in
    [
@ -146,6 +147,7 @@ stdenv.mkDerivation rec {
      "x86_64-linux"
      "aarch64-linux"
      "armv7l-linux"
+      "loongarch64-linux"
    ];
    maintainers = [ maintainers.thoughtpolice ];
  };
--- a/pkgs/by-name/cu/curlie/bump-golang-x-sys.patch
+++ b/pkgs/by-name/cu/curlie/bump-golang-x-sys.patch
@ -1,37 +0,0 @@
-diff --git a/go.mod b/go.mod
-index bebd23f..2ad575f 100644
--- a/go.mod
-+++ b/go.mod
-@@ -1,8 +1,8 @@
- module github.com/rs/curlie
-
- require (
-	golang.org/x/crypto v0.1.0
-	golang.org/x/sys v0.1.0
-+	golang.org/x/crypto v0.0.0-20180524125353-159ae71589f3
-+	golang.org/x/sys v0.0.0-20211110154304-99a53858aa08
- )
-
- go 1.13
-diff --git a/go.sum b/go.sum
-index 6b2e5c3..452bcf9 100644
--- a/go.sum
-+++ b/go.sum
-@@ -1,4 +1,6 @@
- github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-+golang.org/x/crypto v0.0.0-20180524125353-159ae71589f3 h1:mPCVkWhSH1DSDQg4ZwAFYMo/+evpqK1WzBt33b9TXRE=
-+golang.org/x/crypto v0.0.0-20180524125353-159ae71589f3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
- golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
- golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
- golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-@@ -10,6 +12,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
- golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
- golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
- golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-+golang.org/x/sys v0.0.0-20211110154304-99a53858aa08 h1:WecRHqgE09JBkh/584XIE6PMz5KKE/vER4izNUi30AQ=
-+golang.org/x/sys v0.0.0-20211110154304-99a53858aa08/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
- golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
- golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
- golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
--
-2.40.1
--- a/pkgs/by-name/cu/curlie/package.nix
+++ b/pkgs/by-name/cu/curlie/package.nix
@ -1,32 +1,28 @@
 {
+  lib,
  buildGoModule,
  fetchFromGitHub,
-  lib,
  curlie,
  testers,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "curlie";
-  version = "1.7.2";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "rs";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-YOsq3cB+Pn2eC1Dky3fobBRR7GMxcf/tvWr6i3Vq/BE=";
+    repo = "curlie";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BlpIDik4hkU4c+KCyAmgUURIN362RDQID/qo6Ojp2Ek=";
  };

-  patches = [
-    ./bump-golang-x-sys.patch
-  ];
-
-  vendorHash = "sha256-VsPdMUfS4UVem6uJgFISfFHQEKtIumDQktHQFPC1muc=";
+  vendorHash = "sha256-GBccl8V87u26dtrGpHR+rKqRBqX6lq1SBwfsPvj/+44=";

  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
  ];

  passthru.tests.version = testers.testVersion {
@ -34,11 +30,11 @@ buildGoModule rec {
    command = "curlie version";
  };

-  meta = with lib; {
+  meta = {
    description = "Frontend to curl that adds the ease of use of httpie, without compromising on features and performance";
    homepage = "https://curlie.io/";
-    maintainers = with maintainers; [ ma27 ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ ma27 ];
+    license = lib.licenses.mit;
    mainProgram = "curlie";
  };
-}
+})
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "flaresolverr";
-  version = "3.3.21";
+  version = "3.3.21-unstable-2025-03-04";

  src = fetchFromGitHub {
    owner = "FlareSolverr";
    repo = "FlareSolverr";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-M/snpYKZK3pgzlhYjRYEiAPlK9DUKYRiiu43KcrAy9g=";
+    rev = "ce5369dd413cd71a81ce38a5ccd379f6c9352e23";
+    hash = "sha256-cZ/YT4H2OU5l3AosROnkoyT5qrva5lxKshQMS626f2E=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -79,7 +79,5 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "flaresolverr";
    maintainers = with maintainers; [ paveloom ];
    inherit (undetected-chromedriver.meta) platforms;
-    # See https://github.com/NixOS/nixpkgs/issues/332776
-    broken = true;
  };
 })
--- a/pkgs/by-name/fn/fntsample/package.nix
+++ b/pkgs/by-name/fn/fntsample/package.nix
@ -1,87 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  cairo,
-  fontconfig,
-  freetype,
-  glib,
-  libXdmcp,
-  makeWrapper,
-  pango,
-  pcre,
-  perlPackages,
-}:
-
-let
-  ucd-blocks = fetchurl {
-    url = "https://www.unicode.org/Public/15.0.0/ucd/Blocks.txt";
-    hash = "sha256-Up3F0PY4bVLy9W4AS7+rSM4tWH7qnTi6VGxAUkkb2CA=";
-  };
-in
-stdenv.mkDerivation rec {
-  pname = "fntsample";
-  version = "5.4";
-
-  src = fetchFromGitHub {
-    owner = "eugmes";
-    repo = "fntsample";
-    rev = "release/${version}";
-    hash = "sha256-O5RT68wPWwzCb51JZWWNcIubWoM7NZw/MRiaHXPDmF0=";
-  };
-
-  cmakeFlags = [
-    "-DUNICODE_BLOCKS=${ucd-blocks.outPath}"
-  ];
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-    pkg-config
-  ];
-
-  buildInputs = [
-    cairo
-    fontconfig
-    freetype
-    glib
-    libXdmcp
-    pango
-    perlPackages.perl
-    pcre
-  ];
-
-  postFixup =
-    let
-      perlPath =
-        with perlPackages;
-        makePerlPath [
-          ExporterTiny
-          ListMoreUtils
-          PDFAPI2
-          libintl-perl
-        ];
-    in
-    ''
-      for cmd in pdfoutline pdf-extract-outline; do
-        wrapProgram "$out/bin/$cmd" --prefix PERL5LIB : "${perlPath}"
-      done
-    '';
-
-  meta = with lib; {
-    homepage = "https://github.com/eugmes/fntsample";
-    description = "PDF and PostScript font samples generator";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
-    platforms = platforms.unix;
-  };
-}
-# TODO: factor/package ucd-blocks
--- a/pkgs/by-name/ke/keymapp/package.nix
+++ b/pkgs/by-name/ke/keymapp/package.nix
@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "keymapp";
-  version = "1.3.5";
+  version = "1.3.6";

  src = fetchurl {
    url = "https://oryx.nyc3.cdn.digitaloceanspaces.com/keymapp/keymapp-${version}.tar.gz";
-    hash = "sha256-GXmmQssrsEpsqfERSa8ZFGo0r72qsdsbFtmic8+SCfQ=";
+    hash = "sha256-LWO4aeNmGgZ+T41pb6HwC3tnwaiGviDIq63QMsrlkEc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lo/lon/package.nix
+++ b/pkgs/by-name/lo/lon/package.nix
@ -6,24 +6,28 @@

 rustPlatform.buildRustPackage rec {
  pname = "lon";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "nikstur";
    repo = "lon";
    tag = version;
-    hash = "sha256-VGvK0ahBl440NMs03WqmP7T4a1DP13yfX47YI84rlGU=";
+    hash = "sha256-LtZhEfdO/kTbeDG/lhiH+9QPw3kgov72Xn1NelgNsE0=";
  };

  sourceRoot = "source/rust/lon";

  useFetchCargoVendor = true;
-  cargoHash = "sha256-YzQ6A1dH2D56/3inAmsE6G5rCnpWhDawxk6+FMWfhkc=";
+  cargoHash = "sha256-cr1+WBlq/uuOVDIbgN5UhsQ0ISLDYOxyGRnQ6ntEH5w=";

  meta = {
    description = "Lock & update Nix dependencies";
    homepage = "https://github.com/nikstur/lon";
-    maintainers = with lib.maintainers; [ ma27 ];
+    changelog = "https://github.com/nikstur/lon/blob/${version}/CHANGELOG.md";
+    maintainers = with lib.maintainers; [
+      ma27
+      nikstur
+    ];
    license = lib.licenses.mit;
    mainProgram = "lon";
  };
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@ -7,18 +7,18 @@
  okteto,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "okteto";
-  version = "3.4.0";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "okteto";
    repo = "okteto";
-    rev = version;
-    hash = "sha256-vi2ow95a3btiR4yINunEa56SUGWlbgNdMdS/T747a+U=";
+    rev = finalAttrs.version;
+    hash = "sha256-EPo8pSGh6NHeVrVwHkLUfmpB/O4aqtlC7SrPKnMz05Q=";
  };

-  vendorHash = "sha256-tlZr1IOGOSbahd0Wh3yozbBrVL3RAWQLKNv/3XlMKqM=";
+  vendorHash = "sha256-1psVUpfRRg+86gniVg1i7RsgmEO12o0pCIQZ0roDDFc=";

  postPatch = ''
    # Disable some tests that need file system & network access.
@ -36,7 +36,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/okteto/okteto/pkg/config.VersionString=${version}"
+    "-X github.com/okteto/okteto/pkg/config.VersionString=${finalAttrs.version}"
  ];

  tags = [
@ -61,6 +61,7 @@ buildGoModule rec {
        "Test_translateJobWithoutVolumes"
        "Test_translateJobWithVolumes"
        "Test_translateService"
+        "TestProtobufTranslator_Translate_Success"
      ];
    in
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
@ -84,4 +85,4 @@ buildGoModule rec {
    maintainers = with lib.maintainers; [ aaronjheng ];
    mainProgram = "okteto";
  };
-}
+})
--- a/pkgs/by-name/pg/pgbackrest/package.nix
+++ b/pkgs/by-name/pg/pgbackrest/package.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgbackrest";
-  version = "2.54.2";
+  version = "2.55.0";

  src = fetchFromGitHub {
    owner = "pgbackrest";
    repo = "pgbackrest";
    rev = "release/${version}";
-    sha256 = "sha256-Q0WZLbtn+qJLs2jop5S92NFC6QBtCQnU3AEEcm6MSVI=";
+    sha256 = "sha256-w4jgIyZPglmI0yj8eyoIvFgNX7izpo3lBixuv7qSAxM=";
  };

  strictDeps = true;
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@ -32,10 +32,10 @@
 }:

 let
-  version = "3.1.0";
+  version = "3.3.0";
  webUiStatic = fetchurl {
    url = "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-web-ui-${version}.tar.gz";
-    hash = "sha256-05DaaDIFtADnkLFqdHe5eUvo6LRz6BduMvGVmzOeurM=";
+    hash = "sha256-hF8eLIaef4Z5ZGyjqX1Wyd/DD4Bk571ODQ11b+nHTTA=";
  };
 in
 buildGoModule rec {
@ -52,10 +52,10 @@ buildGoModule rec {
    owner = "prometheus";
    repo = "prometheus";
    tag = "v${version}";
-    hash = "sha256-Q3f0L6cRVQRL1AHgUI3VNbMG9eTfcApbXfSjOTHr7Go=";
+    hash = "sha256-WZR6c7uN8I+egoqABaWay0MfA3tv3O74jlrkC/1zt10=";
  };

-  vendorHash = "sha256-vQwBnSxoyIYTeWLk3GD9pKDuUjjsMfwPptgyVnzcTok=";
+  vendorHash = "sha256-xBopACaDrtGveVoza/WIge9m5bBAxnZC+qtsuAF20J4=";

  excludedPackages = [
    "documentation/prometheus-mixin"
--- a/pkgs/by-name/ri/rich-cli/package.nix
+++ b/pkgs/by-name/ri/rich-cli/package.nix
@ -1,11 +1,13 @@
 {
  lib,
+  python3Packages,
  fetchFromGitHub,
  fetchpatch,
-  python3,
+  versionCheckHook,
+  nix-update-script,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "rich-cli";
  version = "1.8.0";
  pyproject = true;
@ -32,17 +34,15 @@ python3.pkgs.buildPythonApplication rec {
  ];

  pythonRelaxDeps = [
+    "rich"
    "textual"
  ];

-  build-system = with python3.pkgs; [
+  build-system = with python3Packages; [
    poetry-core
  ];

-  nativeBuildInputs = with python3.pkgs; [
-  ];
-
-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
    click
    requests
    rich
@ -50,15 +50,23 @@ python3.pkgs.buildPythonApplication rec {
    textual
  ];

-  pythonImportsCheck = [
-    "rich_cli"
-  ];
+  pythonImportsCheck = [ "rich_cli" ];

-  meta = with lib; {
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/rich";
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
    description = "Command Line Interface to Rich";
    homepage = "https://github.com/Textualize/rich-cli";
    changelog = "https://github.com/Textualize/rich-cli/releases/tag/v${version}";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    maintainers = [ ];
    mainProgram = "rich";
  };
--- a/pkgs/by-name/se/seagoat/package.nix
+++ b/pkgs/by-name/se/seagoat/package.nix
@ -7,18 +7,21 @@
  gitMinimal,
  ripgrep,
  writableTmpDirAsHomeHook,
+
+  versionCheckHook,
+  nix-update-script,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "seagoat";
-  version = "0.54.6";
+  version = "0.54.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kantord";
    repo = "SeaGOAT";
    tag = "v${version}";
-    hash = "sha256-KEFA1DUfsJpeNkWui/WKazImGCSwTFlPD8qsGFJNtr0=";
+    hash = "sha256-BfZbYQ6ylMj8cn7q2AavU570/ci83ffdDbeB+F/wZlk=";
  };

  build-system = [ python3Packages.poetry-core ];
@ -26,6 +29,7 @@ python3Packages.buildPythonApplication rec {
  pythonRelaxDeps = [
    "chromadb"
    "psutil"
+    "setuptools"
  ];

  dependencies = with python3Packages; [
@ -59,8 +63,10 @@ python3Packages.buildPythonApplication rec {
    ++ [
      gitMinimal
      ripgrep
+      versionCheckHook
      writableTmpDirAsHomeHook
    ];
+  versionCheckProgramArg = "--version";

  disabledTests = import ./failing_tests.nix;

@ -80,6 +86,10 @@ python3Packages.buildPythonApplication rec {
      --prefix PATH : "${ripgrep}/bin"
  '';

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Local-first semantic code search engine";
    homepage = "https://kantord.github.io/SeaGOAT/";
--- a/pkgs/by-name/st/stm32cubemx/package.nix
+++ b/pkgs/by-name/st/stm32cubemx/package.nix
@ -52,6 +52,11 @@ let

      cat << EOF > $out/bin/${pname}
      #!${stdenvNoCC.shell}
+      updater_xml="\$HOME/.stm32cubemx/thirdparties/db/updaterThirdParties.xml"
+      if [ -e "\$updater_xml" ] && [ ! -w "\$updater_xml" ]; then
+        echo "Warning: Unwritable \$updater_xml prevents CubeMX software packages from working correctly. Fixing that."
+        (set -x; chmod u+w "\$updater_xml")
+      fi
      ${jdk21}/bin/java -jar $out/opt/STM32CubeMX/STM32CubeMX "\$@"
      EOF
      chmod +x $out/bin/${pname}
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -20,17 +20,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.6.14";
+  version = "0.6.16";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-1ZmH757yqzXCYYRJoNGzh2Jy5ACWjNHugcY0szztBRQ=";
+    hash = "sha256-udghrau7ZpLngjwL4mOMvUJT8G609HuBL51Te+h66YY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-zE6WP5rFUvx6B3ti5mlXPD4Z+1VQM0qpaScszKjTNmY=";
+  cargoHash = "sha256-1eq5gsHcf8iAR2z89WnZNdcoToE0Cpl4HgsiffSg1wk=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/ws/wsrepl/package.nix
+++ b/pkgs/by-name/ws/wsrepl/package.nix
@ -1,10 +1,11 @@
 {
  lib,
+  python3Packages,
  fetchFromGitHub,
-  python3,
+  nix-update-script,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "wsrepl";
  version = "0.2.0";
  pyproject = true;
@ -17,14 +18,15 @@ python3.pkgs.buildPythonApplication rec {
  };

  pythonRelaxDeps = [
+    "rich"
    "textual"
  ];

-  build-system = with python3.pkgs; [
+  build-system = with python3Packages; [
    poetry-core
  ];

-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
    pygments
    pyperclip
    rich
@ -39,12 +41,16 @@ python3.pkgs.buildPythonApplication rec {
    "wsrepl"
  ];

-  meta = with lib; {
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
    description = "WebSocket REPL";
    homepage = "https://github.com/doyensec/wsrepl";
    changelog = "https://github.com/doyensec/wsrepl/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "wsrepl";
  };
 }
--- a/pkgs/development/coq-modules/coq-hammer/tactics.nix
+++ b/pkgs/development/coq-modules/coq-hammer/tactics.nix
@ -12,6 +12,10 @@ let
  defaultVersion =
    with lib.versions;
    lib.switch coq.coq-version [
+      {
+        case = "8.20";
+        out = "1.3.2+8.20";
+      }
      {
        case = "8.19";
        out = "1.3.2+8.19";
@ -31,6 +35,7 @@ let
    ] null;

  release = {
+    "1.3.2+8.20".sha256 = "sha256-RuX2aInSjwebs/aEOoisNxqcIPqDA2kWehN9tFYqOx4=";
    "1.3.2+8.19".sha256 = "sha256-Zd7piAWlKPAZKEz7HVWxhnzOLbA/eR9C/E0T298MJVY=";
    "1.3.2+8.18".sha256 = "sha256-D+tQ+1YrSbbqc54U5UlxW1Hhly49TB2pu1LEPL2Eo64=";
    "1.3.2+8.17".sha256 = "sha256-2fw66z3yFKs5g+zNCeYXiEyxPzjUr+lGDciiQiuuMAs=";
--- a/pkgs/development/libraries/libint/default.nix
+++ b/pkgs/development/libraries/libint/default.nix
@ -128,7 +128,7 @@ assert (

 let
  pname = "libint";
-  version = "2.9.0";
+  version = "2.10.2";

  meta = {
    description = "Library for the evaluation of molecular integrals of many-body operators over Gaussian functions";
@ -151,7 +151,7 @@ let
      owner = "evaleev";
      repo = pname;
      rev = "v${version}";
-      hash = "sha256-y+Mo8J/UWDrkkNEDAoostb/k6jrhYYeU0u9Incrd2cE=";
+      hash = "sha256-pxSqW3K76RURy1nhWJKtFNWsiSpU8jPtd+ZMICEr0IY=";
    };

    # Replace hardcoded "/bin/rm" with normal "rm"
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@ -39,12 +39,12 @@

 buildPythonPackage rec {
  pname = "coiled";
-  version = "1.90.4";
+  version = "1.92.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wICWij2mdXlV3aYNeK+vITicEKbiuaO2PcZE+h9QDBo=";
+    hash = "sha256-dwHPhXro/E0XOR2iJJkSKYIRlFi2OhD2qXO4GmzDg2I=";
  };

  build-system = [
--- a/pkgs/development/python-modules/ollama/default.nix
+++ b/pkgs/development/python-modules/ollama/default.nix
@ -2,14 +2,19 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  httpx,
-  pillow,
+
+  # build-system
  poetry-core,
+
+  # dependencies
+  httpx,
  pydantic,
+
+  # tests
+  pillow,
  pytest-asyncio,
  pytest-httpserver,
  pytestCheckHook,
-  pythonOlder,
 }:

 buildPythonPackage rec {
@ -17,8 +22,6 @@ buildPythonPackage rec {
  version = "0.4.8";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama-python";
@ -47,13 +50,15 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  __darwinAllowLocalNetworking = true;
+
  pythonImportsCheck = [ "ollama" ];

-  meta = with lib; {
+  meta = {
    description = "Ollama Python library";
    homepage = "https://github.com/ollama/ollama-python";
    changelog = "https://github.com/ollama/ollama-python/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/pdoc/default.nix
+++ b/pkgs/development/python-modules/pdoc/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pdoc";
-  version = "15.0.2";
+  version = "15.0.3";
  disabled = pythonOlder "3.9";

  pyproject = true;
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "mitmproxy";
    repo = "pdoc";
    rev = "v${version}";
-    hash = "sha256-5NOoe8TEqK+Zypv5eR/YLGwOmcigiP3RnuWQ6uC+DSI=";
+    hash = "sha256-qr0K+ZOmEPWMkm/cPisdw6gSPZI4FvICaKQNt/sef40=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@ -236,16 +236,16 @@ checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"

 [[package]]
 name = "proc-macro2"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "pycrdt"
-version = "0.12.13"
+version = "0.12.14"
 dependencies = [
 "pyo3",
 "yrs",
@ -253,9 +253,9 @@ dependencies = [

 [[package]]
 name = "pyo3"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17da310086b068fbdcefbba30aeb3721d5bb9af8db4987d6735b2183ca567229"
+checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
 dependencies = [
 "cfg-if",
 "indoc",
@ -271,9 +271,9 @@ dependencies = [

 [[package]]
 name = "pyo3-build-config"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e27165889bd793000a098bb966adc4300c312497ea25cf7a690a9f0ac5aa5fc1"
+checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
 dependencies = [
 "once_cell",
 "target-lexicon",
@ -281,9 +281,9 @@ dependencies = [

 [[package]]
 name = "pyo3-ffi"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05280526e1dbf6b420062f3ef228b78c0c54ba94e157f5cb724a609d0f2faabc"
+checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
 dependencies = [
 "libc",
 "pyo3-build-config",
@ -291,9 +291,9 @@ dependencies = [

 [[package]]
 name = "pyo3-macros"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c3ce5686aa4d3f63359a5100c62a127c9f15e8398e5fdeb5deef1fed5cd5f44"
+checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
 dependencies = [
 "proc-macro2",
 "pyo3-macros-backend",
@ -303,9 +303,9 @@ dependencies = [

 [[package]]
 name = "pyo3-macros-backend"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4cf6faa0cbfb0ed08e89beb8103ae9724eb4750e3a78084ba4017cbe94f3855"
+checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
 dependencies = [
 "heck",
 "proc-macro2",
@ -569,9 +569,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

 [[package]]
 name = "yrs"
-version = "0.23.0"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0189b51d8ab1283e7c1f1f515c610875262e629cf258bec530da5cd4aa115d59"
+checksum = "4a7cab84724ae7f361a8c92465f5160922cbb941a499e1a8cacd103351ab9c78"
 dependencies = [
 "arc-swap",
 "async-lock",
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "pycrdt";
-  version = "0.12.13";
+  version = "0.12.14";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jupyter-server";
    repo = "pycrdt";
    tag = version;
-    hash = "sha256-EI8LrT5wddmmw3D5C+IhJnViGnSbHWMD3WFp/f1hY7M=";
+    hash = "sha256-QPA9ek0szYgN6R0mnnU5MN4cYa8DVqIw10DxQ/TzaH0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@ -62,6 +62,7 @@
  pytest-xdist,
  pytest-watch,
  responses,
+  stdenv,
 }:

 buildPythonPackage rec {
@ -167,6 +168,11 @@ buildPythonPackage rec {

  __darwinAllowLocalNetworking = true;

+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # darwin: 'profiler should not be running'
+    "tests/profiler/test_continuous_profiler.py"
+  ];
+
  disabledTests = [
    # depends on git revision
    "test_default_release"
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "textual";
-  version = "3.1.0";
+  version = "3.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Textualize";
    repo = "textual";
    tag = "v${version}";
-    hash = "sha256-JBqzaSsLSCzUYdIjlPZdPJlRKrqtWWPqJPp85uMcMLc=";
+    hash = "sha256-emF6LpjVCgxC+Cf+LhFrawc3rxfMnZtyijmoVg0ZJbQ=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -16,16 +16,16 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.14.1"; # zen
+      version = "6.14.3"; # zen
      suffix = "zen1"; # zen
-      sha256 = "07fif9yj33lidp7dp8r66bsqyyh6fckjb3nhxynaikgb17hx9w5b"; # zen
+      sha256 = "17r4gmxbgs0aizlp35pdq515ag50zc3q20fxapbya4yp5qs6ncz0"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.14.1"; # lqx
+      version = "6.14.3"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "0gga9xrdp9q5jdzl3mjbx140wnwxibavvvdgxvqz9f2g3f20d69y"; # lqx
+      sha256 = "1xqhjvi7a6gbsm3zq3gwc5hl8xw17afqx1b1db0p1cp5c9xn3vxa"; # lqx
      isLqx = true;
    };
  };
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@ -3,7 +3,6 @@
  stdenvNoCC,
  fetchurl,
  nixosTests,
-  nextcloud29Packages,
  nextcloud30Packages,
  nextcloud31Packages,
 }:
@ -53,12 +52,6 @@ let
    };
 in
 {
-  nextcloud29 = generic {
-    version = "29.0.16";
-    hash = "sha256-SZv2GrGe3NTlQq+GYJJDxbT0QOtbsGwrp9oML6pSUyI=";
-    packages = nextcloud29Packages;
-  };
-
  nextcloud30 = generic {
    version = "30.0.10";
    hash = "sha256-40ldF8X1yRZFQtk/Y21pasyPOLYL7HDPGtLnnHbZlbo=";
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
--- a/pkgs/servers/nextcloud/packages/apps/recognize.nix
+++ b/pkgs/servers/nextcloud/packages/apps/recognize.nix
@ -26,11 +26,6 @@ let
      appHash = "sha256-CAORqBdxNQ0x+xIVY2zI07jvsKHaa7eH0jpVuP0eSW4=";
      modelHash = "sha256-s8MQOLU490/Vr/U4GaGlbdrykOAQOKeWE5+tCzn6Dew=";
    };
-    "29" = {
-      version = "7.1.0";
-      appHash = "sha256-qR4SrTHFAc4YWiZAsL94XcH4VZqYtkRLa0y+NdiFZus=";
-      modelHash = "sha256-M/j5wVOBLR7xMVJQWDUWAzLajRUBYEzHSNBsRSBUgfM=";
-    };
  };
  currentVersionInfo =
    latestVersionForNc.${ncVersion}
--- a/pkgs/servers/sql/postgresql/ext/citus.nix
+++ b/pkgs/servers/sql/postgresql/ext/citus.nix
@ -6,6 +6,7 @@
  lz4,
  postgresql,
  postgresqlBuildExtension,
+  postgresqlTestExtension,
  stdenv,
 }:

@ -35,6 +36,33 @@ postgresqlBuildExtension (finalAttrs: {
    lz4
  ];

+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    postgresqlExtraSettings = ''
+      shared_preload_libraries=citus
+    '';
+    sql = ''
+      CREATE EXTENSION citus;
+
+      CREATE TABLE examples (
+        id bigserial,
+        shard_key int,
+        PRIMARY KEY (id, shard_key)
+      );
+
+      SELECT create_distributed_table('examples', 'shard_key');
+
+      INSERT INTO examples (shard_key) SELECT shard % 10 FROM generate_series(1,1000) shard;
+    '';
+    asserts = [
+      {
+        query = "SELECT count(*) FROM examples";
+        expected = "1000";
+        description = "Distributed table can be queried successfully.";
+      }
+    ];
+  };
+
  meta = {
    # "Our soft policy for Postgres version compatibility is to support Citus'
    # latest release with Postgres' 3 latest releases."
--- a/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix
@ -29,6 +29,13 @@ postgresqlBuildExtension (finalAttrs: {
        CREATE EXTENSION byteamagic;
        SELECT byteamagic_mime('test');
      '';
+      asserts = [
+        {
+          query = "SELECT byteamagic_mime('test')";
+          expected = "'text/plain'";
+          description = "`byteamagic_mime(...) should return proper mimetype.";
+        }
+      ];
    };
  };

--- a/pkgs/servers/sql/postgresql/ext/pgvecto-rs/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvecto-rs/package.nix
@ -9,6 +9,7 @@
  openssl,
  pkg-config,
  postgresql,
+  postgresqlTestExtension,
  replaceVars,
  rustPlatform,
 }:
@ -80,7 +81,39 @@ in

    passthru = {
      updateScript = nix-update-script { };
-      tests = nixosTests.postgresql.pgvecto-rs.passthru.override postgresql;
+      tests.extension = postgresqlTestExtension {
+        inherit (finalAttrs) finalPackage;
+        postgresqlExtraSettings = ''
+          shared_preload_libraries='vectors'
+        '';
+        sql = ''
+          CREATE EXTENSION vectors;
+
+          CREATE TABLE items (
+            id bigserial PRIMARY KEY,
+            content text NOT NULL,
+            embedding vectors.vector(3) NOT NULL -- 3 dimensions
+          );
+
+          INSERT INTO items (content, embedding) VALUES
+            ('a fat cat sat on a mat and ate a fat rat', '[1, 2, 3]'),
+            ('a fat dog sat on a mat and ate a fat rat', '[4, 5, 6]'),
+            ('a thin cat sat on a mat and ate a thin rat', '[7, 8, 9]'),
+            ('a thin dog sat on a mat and ate a thin rat', '[10, 11, 12]');
+        '';
+        asserts = [
+          {
+            query = "SELECT default_version FROM pg_available_extensions WHERE name = 'vectors'";
+            expected = "'${finalAttrs.version}'";
+            description = "Extension vectors has correct version.";
+          }
+          {
+            query = "SELECT COUNT(embedding) FROM items WHERE to_tsvector('english', content) @@ 'cat & rat'::tsquery";
+            expected = "2";
+            description = "Stores and returns vectors.";
+          }
+        ];
+      };
    };

    meta = {
--- a/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix
@ -35,44 +35,32 @@ buildPgrxExtension (finalAttrs: {
  passthru.tests.extension = postgresqlTestExtension {
    inherit (finalAttrs) finalPackage;
    withPackages = [ "pgvector" ];
-    sql =
-      let
-        genCheck =
-          id: compare: expected:
-          let
-            vecStr = "[${lib.concatMapStringsSep "," toString compare}]";
-          in
-          ''
-            ASSERT (
-              SELECT id
-              FROM document_embedding
-              WHERE ${toString expected} = (embedding <-> '${vecStr}')
-            ) = ${toString id},
-            'Expected vector of row with ID=${toString id} to have a euclidean distance from ${vecStr} of ${toString expected}';
-          '';
-      in
-      ''
-        CREATE EXTENSION vectorscale CASCADE;
-        CREATE TABLE IF NOT EXISTS document_embedding  (
-            id BIGINT PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY,
-            embedding VECTOR(3)
-        );
+    sql = ''
+      CREATE EXTENSION vectorscale CASCADE;
+      CREATE TABLE document_embedding  (
+          id BIGINT PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY,
+          embedding VECTOR(3)
+      );

-        INSERT INTO document_embedding (id, embedding) VALUES
-        (1, '[1,2,4]'),
-        (2, '[1,2,5]');
+      INSERT INTO document_embedding (id, embedding) VALUES
+      (10, '[1,2,4]'),
+      (20, '[1,2,5]');

-        CREATE INDEX document_embedding_idx ON document_embedding
-        USING diskann (embedding vector_cosine_ops);
-
-        DO $$
-          BEGIN
-          ${genCheck 1 [ 1 2 3 ] 1}
-          ${genCheck 2 [ 1 2 3 ] 2}
-          END;
-        $$
-        LANGUAGE PLPGSQL;
-      '';
+      CREATE INDEX document_embedding_idx ON document_embedding
+      USING diskann (embedding vector_cosine_ops);
+    '';
+    asserts = [
+      {
+        query = "SELECT id FROM document_embedding WHERE embedding <-> '[1,2,3]' = 1";
+        expected = "10";
+        description = "Expected vector of row with ID=10 to have an euclidean distance from [1,2,3] of 1.";
+      }
+      {
+        query = "SELECT id FROM document_embedding WHERE embedding <-> '[1,2,3]' = 2";
+        expected = "20";
+        description = "Expected vector of row with ID=20 to have an euclidean distance from [1,2,3] of 2.";
+      }
+    ];
  };

  meta = {
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@ -125,31 +125,15 @@ postgresqlBuildExtension (finalAttrs: {
  passthru.tests.extension = postgresqlTestExtension {
    inherit (finalAttrs) finalPackage;
    sql =
-      let
-        expectedVersion = "${lib.versions.major finalAttrs.version}.${lib.versions.minor finalAttrs.version} USE_GEOS=1 USE_PROJ=1 USE_STATS=1";
-      in
      ''
        CREATE EXTENSION postgis;
        CREATE EXTENSION postgis_raster;
        CREATE EXTENSION postgis_topology;
-        select postgis_version();
-        do $$
-        begin
-          if postgis_version() <> '${expectedVersion}' then
-            raise '"%" does not match "${expectedVersion}"', postgis_version();
-          end if;
-        end$$;
        -- st_makepoint goes through c code
        select st_makepoint(1, 1);
      ''
      + lib.optionalString withSfcgal ''
        CREATE EXTENSION postgis_sfcgal;
-        do $$
-        begin
-          if postgis_sfcgal_version() <> '${sfcgal.version}' then
-            raise '"%" does not match "${sfcgal.version}"', postgis_sfcgal_version();
-          end if;
-        end$$;
        CREATE TABLE geometries (
          name varchar,
          geom geometry(PolygonZ) NOT NULL
@ -161,6 +145,19 @@ postgresqlBuildExtension (finalAttrs: {

        SELECT name from geometries where cg_isplanar(geom);
      '';
+    asserts =
+      [
+        {
+          query = "postgis_version()";
+          expected = "'${lib.versions.major finalAttrs.version}.${lib.versions.minor finalAttrs.version} USE_GEOS=1 USE_PROJ=1 USE_STATS=1'";
+          description = "postgis_version() returns correct values.";
+        }
+      ]
+      ++ lib.optional withSfcgal {
+        query = "postgis_sfcgal_version()";
+        expected = "'${sfcgal.version}'";
+        description = "postgis_sfcgal_version() returns correct value.";
+      };
  };

  meta = {
--- a/pkgs/servers/sql/postgresql/ext/rum.nix
+++ b/pkgs/servers/sql/postgresql/ext/rum.nix
@ -3,7 +3,7 @@
  lib,
  postgresql,
  postgresqlBuildExtension,
-  postgresqlTestHook,
+  postgresqlTestExtension,
  stdenv,
 }:

@ -20,32 +20,13 @@ postgresqlBuildExtension (finalAttrs: {

  makeFlags = [ "USE_PGXS=1" ];

-  passthru.tests.extension = stdenv.mkDerivation {
-    inherit (finalAttrs) version;
-    pname = "rum-test";
-
-    dontUnpack = true;
-    doCheck = true;
-    nativeCheckInputs = [
-      postgresqlTestHook
-      (postgresql.withPackages (_: [ finalAttrs.finalPackage ]))
-    ];
-    failureHook = "postgresqlStop";
-    postgresqlTestUserOptions = "LOGIN SUPERUSER";
-    passAsFile = [ "sql" ];
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
    sql = ''
      CREATE EXTENSION rum;
      CREATE TABLE test_table (t text, v tsvector);
      CREATE INDEX test_table_rumindex ON test_table USING rum (v rum_tsvector_ops);
    '';
-    checkPhase = ''
-      runHook preCheck
-
-      psql -a -v ON_ERROR_STOP=1 -f $sqlPath
-
-      runHook postCheck
-    '';
-    installPhase = "touch $out";
  };

  meta = {
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@ -7,6 +7,7 @@
  openssl,
  postgresql,
  postgresqlBuildExtension,
+  postgresqlTestExtension,
  stdenv,

  enableUnfree ? true,
@ -50,7 +51,50 @@ postgresqlBuildExtension (finalAttrs: {
    done
  '';

-  passthru.tests = nixosTests.postgresql.timescaledb.passthru.override postgresql;
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    withPackages = [ "timescaledb_toolkit" ];
+    postgresqlExtraSettings = ''
+      shared_preload_libraries='timescaledb,timescaledb_toolkit'
+    '';
+    sql = ''
+      CREATE EXTENSION timescaledb;
+      CREATE EXTENSION timescaledb_toolkit;
+
+      CREATE TABLE sth (
+        time TIMESTAMPTZ NOT NULL,
+        value DOUBLE PRECISION
+      );
+
+      SELECT create_hypertable('sth', 'time');
+
+      INSERT INTO sth (time, value) VALUES
+      ('2003-04-12 04:05:06 America/New_York', 1.0),
+      ('2003-04-12 04:05:07 America/New_York', 2.0),
+      ('2003-04-12 04:05:08 America/New_York', 3.0),
+      ('2003-04-12 04:05:09 America/New_York', 4.0),
+      ('2003-04-12 04:05:10 America/New_York', 5.0)
+      ;
+
+      WITH t AS (
+        SELECT
+          time_bucket('1 day'::interval, time) AS dt,
+          stats_agg(value) AS stats
+        FROM sth
+        GROUP BY time_bucket('1 day'::interval, time)
+      )
+      SELECT
+        average(stats)
+      FROM t;
+    '';
+    asserts = [
+      {
+        query = "SELECT count(*) FROM sth";
+        expected = "5";
+        description = "hypertable can be queried successfully.";
+      }
+    ];
+  };

  meta = {
    description = "Scales PostgreSQL for time-series data via automatic partitioning across time and space";
--- a/pkgs/servers/sql/postgresql/ext/tsja.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsja.nix
@ -4,6 +4,7 @@
  mecab,
  nixosTests,
  postgresql,
+  postgresqlTestExtension,
  stdenv,
 }:

@ -35,7 +36,19 @@ stdenv.mkDerivation (finalAttrs: {
    mv dbinit_libtsja.txt $out/share/postgresql/extension/libtsja_dbinit.sql
  '';

-  passthru.tests = nixosTests.postgresql.tsja.passthru.override postgresql;
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    sql = ''
+      \i ${finalAttrs.finalPackage}/share/postgresql/extension/libtsja_dbinit.sql
+    '';
+    asserts = [
+      {
+        query = "EXISTS (SELECT 1 FROM ts_debug('japanese', 'PostgreSQLで日本語のテキスト検索ができます。') WHERE lexemes = '{日本語}')";
+        expected = "true";
+        description = "make sure '日本語' is parsed as a separate lexeme";
+      }
+    ];
+  };

  meta = {
    description = "PostgreSQL extension implementing Japanese text search";
--- a/pkgs/servers/sql/postgresql/postgresqlTestExtension.nix
+++ b/pkgs/servers/sql/postgresql/postgresqlTestExtension.nix
@ -1,11 +1,14 @@
 {
+  lib,
  postgresql,
  postgresqlTestHook,
  stdenvNoCC,
 }:

 {
+  asserts ? [ ],
  finalPackage,
+  sql,
  withPackages ? [ ],
  ...
 }@extraArgs:
@ -21,6 +24,20 @@ stdenvNoCC.mkDerivation (
    failureHook = "postgresqlStop";
    postgresqlTestUserOptions = "LOGIN SUPERUSER";
    passAsFile = [ "sql" ];
+    sql =
+      sql
+      + lib.concatMapStrings (
+        {
+          query,
+          expected,
+          description,
+        }:
+        ''
+          DO $$ BEGIN
+            ASSERT (${query}) = (${expected}), '${lib.replaceStrings [ "'" ] [ "''" ] description}';
+          END $$;
+        ''
+      ) asserts;
    checkPhase = ''
      runHook preCheck
      psql -a -v ON_ERROR_STOP=1 -f "$sqlPath"
@ -28,5 +45,10 @@ stdenvNoCC.mkDerivation (
    '';
    installPhase = "touch $out";
  }
-  // extraArgs
+  // lib.removeAttrs extraArgs [
+    "asserts"
+    "finalPackage"
+    "sql"
+    "withPackages"
+  ]
 )
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -180,8 +180,8 @@ lib.makeExtensible (
      };

      nix_2_28 = commonMeson {
-        version = "2.28.1";
-        hash = "sha256-R+HAPvD+AjiyRHZP/elkvka33G499EKT8ntyF/EPPRI=";
+        version = "2.28.2";
+        hash = "sha256-yl+hlZ/VFHIZwPIDEs4ysOYgprW4VEORfSyvScF7Cwg=";
        self_attribute_name = "nix_2_28";
      };

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -639,6 +639,7 @@ mapAliases {
  flutter323 = throw "flutter323 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2024-10-05
  fluxus = throw "fluxus has been removed because it hasn't been updated in 9 years and depended on insecure Racket 7.9"; # Added 2024-12-06
  fmt_8 = throw "fmt_8 has been removed as it is obsolete and was no longer used in the tree"; # Added 2024-11-12
+  fntsample = throw "fntsample has been removed as it is unmaintained upstream"; # Added 2025-04-21
  foldingathome = throw "'foldingathome' has been renamed to/replaced by 'fahclient'"; # Converted to throw 2024-10-17
  forgejo-actions-runner = forgejo-runner; # Added 2024-04-04
  fornalder = throw "'fornalder' has been removed as it is unmaintained upstream"; # Added 2025-01-25
@ -1207,6 +1208,18 @@ mapAliases {
  neocities-cli = neocities; # Added 2024-07-31
  netbox_3_3 = throw "netbox 3.3 series has been removed as it was EOL"; # Added 2023-09-02
  netbox_3_5 = throw "netbox 3.5 series has been removed as it was EOL"; # Added 2024-01-22
+  nextcloud29 = throw ''
+    Nextcloud v29 has been removed from `nixpkgs` as the support for is dropped
+    by upstream in 2025-04. Please upgrade to at least Nextcloud v30 by declaring
+
+        services.nextcloud.package = pkgs.nextcloud30;
+
+    in your NixOS config.
+
+    WARNING: if you were on Nextcloud 28 you have to upgrade to Nextcloud 29
+    first on 24.11 because Nextcloud doesn't support upgrades across multiple major versions!
+  ''; # Added 2025-04-11
+  nextcloud29Packages = throw "Nextcloud 29 is EOL!"; # Added 2025-04-11
  nextcloud28 = throw ''
    Nextcloud v28 has been removed from `nixpkgs` as the support for is dropped
    by upstream in 2025-01. Please upgrade to at least Nextcloud v29 by declaring
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4157,12 +4157,10 @@ with pkgs;
  nm-tray = libsForQt5.callPackage ../tools/networking/networkmanager/tray.nix { };

  inherit (callPackages ../servers/nextcloud { })
-    nextcloud29
    nextcloud30
    nextcloud31
    ;

-  nextcloud29Packages = callPackage ../servers/nextcloud/packages { ncVersion = "29"; };
  nextcloud30Packages = callPackage ../servers/nextcloud/packages { ncVersion = "30"; };
  nextcloud31Packages = callPackage ../servers/nextcloud/packages { ncVersion = "31"; };