Merge master into staging-next

.github/workflows/eval.yml

@@ -166,7 +166,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-24.04-arm
-    needs: [ process ]
+    needs: [ get-merge-commit, process ]
     if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write

.github/workflows/get-merge-commit.yml

@@ -40,7 +40,7 @@ jobs:
               ;;
             pull_request_target)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the commits:\n$commits"
+                echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"
               else
                 # Skipping so that no notifications are sent

ci/default.nix

@@ -63,10 +63,7 @@ let
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
-        fileset = fs.difference (fs.unions [
+        fileset = fs.difference ../. (fs.maybeMissing ../.git);
-          (fs.fileFilter (file: file.hasExt "nix") ../.)
-          ../.git-blame-ignore-revs
-        ]) (fs.maybeMissing ../.git);
       };
     in
     {

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -71,10 +71,19 @@ An SSH-based backdoor to log into machines can be enabled with
 {
   name = "…";
   nodes.machines = { /* … */ };
-  sshBackdoor.enable = true;
+  interactive.sshBackdoor.enable = true;
 }
 ```
 
+::: {.warning}
+Make sure to only enable the backdoor for interactive tests
+(i.e. by using `interactive.sshBackdoor.enable`)! This is the only
+supported configuration.
+
+Running a test in a sandbox with this will fail because `/dev/vhost-vsock` isn't available
+in the sandbox.
+:::
+
 This creates a [vsock socket](https://man7.org/linux/man-pages/man7/vsock.7.html)
 for each VM to log in with SSH. This configures root login with an empty password.
 

nixos/doc/manual/installation/installing-virtualbox-guest.section.md

@@ -8,7 +8,7 @@ up a VirtualBox guest, follow these instructions:
 
 1.  Base Memory Size: 768 MB or higher.
 
-1.  New Hard Disk of 8 GB or higher.
+1.  New Hard Disk of 10 GB or higher.
 
 1.  Mount the CD-ROM with the NixOS ISO (by clicking on CD/DVD-ROM)
 

nixos/lib/testing/run.nix

@@ -43,27 +43,30 @@ in
   };
 
   config = {
-    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
+    rawTestDerivation =
-      name = "vm-test-run-${config.name}";
+      assert lib.assertMsg (!config.sshBackdoor.enable)
+        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
+      hostPkgs.stdenv.mkDerivation {
+        name = "vm-test-run-${config.name}";
 
-      requiredSystemFeatures =
+        requiredSystemFeatures =
-        [ "nixos-test" ]
+          [ "nixos-test" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
 
-      buildCommand = ''
+        buildCommand = ''
-        mkdir -p $out
+          mkdir -p $out
 
-        # effectively mute the XMLLogger
+          # effectively mute the XMLLogger
-        export LOGFILE=/dev/null
+          export LOGFILE=/dev/null
 
-        ${config.driver}/bin/nixos-test-driver -o $out
+          ${config.driver}/bin/nixos-test-driver -o $out
-      '';
+        '';
 
-      passthru = config.passthru;
+        passthru = config.passthru;
 
-      meta = config.meta;
+        meta = config.meta;
-    };
+      };
     test = lib.lazyDerivation {
       # lazyDerivation improves performance when only passthru items and/or meta are used.
       derivation = config.rawTestDerivation;

nixos/modules/services/web-apps/nextcloud.nix

@@ -116,7 +116,8 @@ let
     ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
     ++ (lib.optional (
       cfg.config.objectstore.s3.sseCKeyFile != null
-    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
+    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}")
+    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}");
 
   requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
 
@@ -195,7 +196,6 @@ let
   overrideConfig =
     let
       c = cfg.config;
-      requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
       objectstoreConfig =
         let
           s3 = c.objectstore.s3;
@@ -232,7 +232,7 @@ let
     in
     pkgs.writeText "nextcloud-config.php" ''
       <?php
-      ${optionalString requiresReadSecretFunction ''
+      ${optionalString requiresRuntimeSystemdCredentials ''
         function nix_read_secret($credential_name) {
           $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
           if (!$credentials_directory) {
@@ -253,7 +253,19 @@ let
           }
 
           return trim(file_get_contents($credential_path));
-        }''}
+        }
+
+        function nix_read_secret_and_decode_json_file($credential_name) {
+          $decoded = json_decode(nix_read_secret($credential_name), true);
+
+          if (json_last_error() !== JSON_ERROR_NONE) {
+            error_log(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
+            exit(1);
+          }
+
+          return $decoded;
+        }
+      ''}
       function nix_decode_json_file($file, $error) {
         if (!file_exists($file)) {
           throw new \RuntimeException(sprintf($error, $file));
@@ -287,10 +299,7 @@ let
       ));
 
       ${optionalString (cfg.secretFile != null) ''
-        $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
+        $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
-          "${cfg.secretFile}",
-          "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
-        ));
       ''}
     '';
 in

nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix

@@ -84,13 +84,12 @@ runTest (
           # This file is meant to contain secret options which should
           # not go into the nix store. Here it is just used to set the
           # redis password.
-          environment.etc."nextcloud-secrets.json".text = ''
+          environment.etc."nextcloud-secrets.json" = {
-            {
+            mode = "0600";
-              "redis": {
+            text = builtins.toJSON {
-                "password": "secret"
+              redis.password = "secret";
-              }
+            };
-            }
+          };
-          '';
         };
     };
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2853,8 +2853,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.138.1";
+          version = "1.140.2";
-          hash = "sha256-r98S0J+9sKlQacUuUakCI1WE6uRJ9zhYc2foLCN8Xzo=";
+          hash = "sha256-YQwJq3QSzb2pAOLyy0w8RtrjAlxudBGN52fQtj+OmOk=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4565,8 +4565,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "4.21.0";
+          version = "4.22.0";
-          hash = "sha256-pnxHROhjbQq93CeWkBU3KwIPeXVDA4K6ifkkoGfagIM=";
+          hash = "sha256-E50BmbYgm9w+jpr8m8BdZcOuCtPhpmhXTBhbx/tsips=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };
@@ -4770,8 +4770,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.268.0";
+          version = "3.271.0";
-          hash = "sha256-Gx9hQqieXTmFudRJaySI8+8cNIaKVRMtNwJqxGH0DV8=";
+          hash = "sha256-+lNWQOfmoxT6+j+oqT4Z2QTYWSJbVwSukxEx4fwXqPc=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/emulators/libretro/cores/fceumm.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2025-04-11";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "43e6496351b544df0de692fbb01b2a6942073f5c";
+    rev = "3544ff567ecc417c170641587083b976739ef9db";
-    hash = "sha256-kGGvI1rKE/oSF2v3URDY/fLTThYc3Crk9UFN69Rcckg=";
+    hash = "sha256-eNmzWLJVPeqFFEcFIhOQCn9OMrBp0iraTcft5pJVvvE=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-04-25";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "99678a0ef3cfcca500ed01c24bbb1020d8af4c12";
+    rev = "f64e0a1e04a67a5edf79026c07dc5094f8df74bc";
-    hash = "sha256-iijYZ4+TM61EkJynDaPYBi/bYrypouFRmhaG63cxgJo=";
+    hash = "sha256-eG0lzdo/AWVAl+V71X8YNGK1Dk1oLW3jvGY3IS0ekNw=";
   };
 
   meta = {

pkgs/applications/virtualization/docker/compose.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.35.1";
+  version = "2.36.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-Dq2YYiHmtt3j+qHAzsAIW4twbD3viXIjI0MXrV7HIW0=";
+    hash = "sha256-3WaTUylmXk2urn9Pe76AdnckJvFBJBSccXCvFSRotyo=";
   };
 
   postPatch = ''
@@ -20,7 +20,7 @@ buildGoModule rec {
     rm -rf pkg/e2e/
   '';
 
-  vendorHash = "sha256-nycjWE3nFmA2csen8jT9lrhwRn5892xIRtrYEn+eVy0=";
+  vendorHash = "sha256-AcBBtetOuTnCA6ZQVUta+6lJQoSJhBXifEoToUhrpAk=";
 
   ldflags = [
     "-X github.com/docker/compose/v2/internal.Version=${version}"

pkgs/by-name/al/alt-ergo/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "alt-ergo";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchurl {
     url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-31YEWjr3n7z70d7q8JAS1bw5C0wiI+HZwlwRwwHZ7ro=";
+    hash = "sha256-OeLJEop9HonzMuMaJxbzWfO54akl/oHxH6SnSbXSTYI=";
   };
 in
 

pkgs/by-name/ca/cargo-modules/package.nix

@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = "cargo-modules";
     tag = "v${version}";
-    hash = "sha256-L5goyuYn7qRVCgbOGRlSJA0B01MuOzIw9Lx5G/TanXs=";
+    hash = "sha256-MJswCl5eJjKarB2ufeNLQL0ZPDaRPpX6OGOqszG+a0g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-txuTNuW6dJNnnLk9o5z4Pa42bJaAa9jB/ms8au+3Muc=";
+  cargoHash = "sha256-N1Bj0fqyirp51DNsrZEtRGOSUPS1YNbk+O3kdboQ+TQ=";
 
   checkFlags = [
     "--skip=cfg_test::with_tests::smoke"

pkgs/by-name/cl/clouddrive2/package.nix

@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.8.16";
+  version = "0.8.17";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-NUXafHlH/TsIW4sTDOZ01AxNSnQ1M0yMgtoHBlYBzAU=";
+        x86_64-linux = "sha256-j3QJJ6cF+dcotkMJcDbW1rf1ETdfofiTotDcV+bH8zY=";
-        aarch64-linux = "sha256-FcCz/DcNOIOm9WE2zuL3WA3mkbxO57eCtHpD9PjDG94=";
+        aarch64-linux = "sha256-0N+D0ba3+D6xfiW8RjV1XHTcypLiGyuuHZFOqYS3JZE=";
-        x86_64-darwin = "sha256-Bm5w6AgZ1cafopa+w5+0yADGS4rfsFXpHZ21NHu5tC8=";
+        x86_64-darwin = "sha256-YCn7jvpgh2+i6qWBbsqSBFmNlwPduPNExXF+QnxiQ+c=";
-        aarch64-darwin = "sha256-4dwht7AbBB6b35n8joH7sR8zUgSQqILrkORIJaSm2xI=";
+        aarch64-darwin = "sha256-EOgrnJljZVSkzjZRZSUIfn1Ly6IrTS6I/8uwRVktnzE=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/cy/cyrus-imapd/package.nix

@@ -66,13 +66,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cyrus-imapd";
-  version = "3.10.1";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "cyrusimap";
     repo = "cyrus-imapd";
     tag = "cyrus-imapd-${finalAttrs.version}";
-    hash = "sha256-jMSTduQmLB55smBmbJ32eLqiC24ufQyX/FT9d18lDCo=";
+    hash = "sha256-sdHAxlrxQHzcSt2buOGfRv/OR8BYFHrNoo+r/ePVFsg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/di/diffnav/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "diffnav";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "diffnav";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JXxeRq8OuTvzkbxDr1xVXeW0RFtCRyEbhCGvXeWHb0g=";
+    hash = "sha256-admPiEKyatdUkR89vZP8RYHTqtZVSJ8KSvtpnsBViBw=";
   };
 
   vendorHash = "sha256-2JjQF+fwl8+Xoq9T3jCvngRAOa3935zpi9qbF4w4hEI=";

pkgs/by-name/gi/git-bug-migration/package.nix

@@ -34,7 +34,10 @@ buildGoModule rec {
     description = "Tool for upgrading repositories using git-bug to new versions";
     homepage = "https://github.com/MichaelMure/git-bug-migration";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ DeeUnderscore ];
+    maintainers = with maintainers; [
+      DeeUnderscore
+      sudoforge
+    ];
     mainProgram = "git-bug-migration";
   };
 }

pkgs/by-name/go/go-task/package.nix

@@ -8,15 +8,15 @@
   versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "go-task";
-  version = "3.43.2";
+  version = "3.43.3";
 
   src = fetchFromGitHub {
     owner = "go-task";
     repo = "task";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-duq5OGUFki0OK/U09EmzBtTH5ObXdWwNYrmenUyubr0=";
+    hash = "sha256-ZIZdk0yyykjjSdH6YG8K8WpI8e8426odk8RxISsJe80=";
   };
 
   vendorHash = "sha256-3Uu0ozwOgp6vQh+s9nGKojw6xPUI49MjjPqKh9g35lQ=";
@@ -28,7 +28,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/go-task/task/v3/internal/version.version=${version}"
+    "-X=github.com/go-task/task/v3/internal/version.version=${finalAttrs.version}"
   ];
 
   env.CGO_ENABLED = 0;
@@ -56,8 +56,8 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://taskfile.dev/";
     description = "Task runner / simpler Make alternative written in Go";
-    changelog = "https://github.com/go-task/task/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/go-task/task/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ parasrah ];
   };
-}
+})

pkgs/by-name/gz/gz-cmake/package.nix

@@ -6,16 +6,22 @@
   doxygen,
   graphviz,
   pkg-config,
+  python3,
+  nix-update-script,
 }:
+let
+  version = "4.2.0";
+  versionPrefix = "gz-cmake${lib.versions.major version}";
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gz-cmake";
-  version = "4.1.1";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "gazebosim";
     repo = "gz-cmake";
-    tag = "gz-cmake${lib.versions.major finalAttrs.version}_${finalAttrs.version}";
+    tag = "${versionPrefix}_${finalAttrs.version}";
-    hash = "sha256-BWgRm+3UW65Cu7TqXtFFG05JlYF52dbpAsIE8aDnJM0=";
+    hash = "sha256-+bMOcGWfcwPhxR9CBp4iH02CZC4oplCjsTDpPDsDnSs=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +31,26 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.doCheck)
+  ];
+
+  nativeCheckInputs = [ python3 ];
+
+  # 98% tests passed, 1 tests failed out of 44
+  # 44 - c_child_requires_c_nodep (Failed)
+  #
+  # Package gz-c_child_private was not found in the pkg-config search path.
+  # Perhaps you should add the directory containing `gz-c_child_private.pc'
+  # to the PKG_CONFIG_PATH environment variable
+  # No package 'gz-c_child_private' found
+  doCheck = false;
+
+  # Extract the version by matching the tag's prefix.
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=${versionPrefix}_([\\d\\.]+)" ];
+  };
+
   meta = {
     description = "CMake modules to build Gazebo projects";
     homepage = "https://github.com/gazebosim/gz-cmake";

pkgs/by-name/ht/htcondor/package.nix

@@ -62,7 +62,8 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.asl20;
     maintainers = with maintainers; [ evey ];
-    # cannot find -lpthread: No such file or directory
+    # On Aarch64: ld: cannot find -lpthread: No such file or directory
-    broken = stdenv.hostPlatform.isAarch64;
+    # On x86_64:  ld: cannot find -ldl:      No such file or directory
+    broken = true;
   };
 }

pkgs/by-name/ju/just-lsp/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-MBkuLvMwAH0858X0TRAK1pL/JwsTIY/6Ra+Vd6X0odA=";
+    hash = "sha256-lR3VtPS96gPUj4OVZLeQSHnss22hBTRBLUV8n2Y3E9M=";
   };
 
-  cargoHash = "sha256-gVxWy8SGvAaavrdZHK/9aKfPAXUtfs98TyFKFkFa3+U=";
+  cargoHash = "sha256-eDjUYB5AN56hxolizw0KYb0Z/k28OWOUYOxhB/5pKV0=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/kr/krillinai/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KrillinAI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-espj6BFc0GA5pURyly1HV3rIqyEgd1S/bmqkUPczTqM=";
+    hash = "sha256-jQlgkpQ+UTzn6MqGa+yVQ9v04IGGlMQQim3s0Oc9Zts=";
   };
 
   vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -14,14 +14,14 @@
   cctools,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
   version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/UrMmC5DTxoN6uzvTB+V3//hGQmKlkYvi5Lv4p31fq4=";
   };
 
@@ -29,8 +29,8 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-UvRv69rHqPNqTg5nhUojTDHEFUIXF8LEB4ndzA7CHc0=";
 
   npmDeps = fetchNpmDeps {
-    name = "${pname}-${version}-npm-deps";
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    src = "${src}/${npmRoot}";
+    src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
     hash = "sha256-7EN8GIO8VutAZujVvgM67fGIXWD2aJhHhEJrTeHRiGE=";
   };
 
@@ -52,6 +52,7 @@ rustPlatform.buildRustPackage rec {
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
+    VERGEN_GIT_DESCRIBE = finalAttrs.version;
   };
 
   buildNoDefaultFeatures = true;
@@ -85,9 +86,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "OAuth2.0 + OpenID Provider for Matrix Homeservers";
     homepage = "https://github.com/element-hq/matrix-authentication-service";
-    changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${version}";
+    changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ teutat3s ];
     mainProgram = "mas-cli";
   };
-}
+})

pkgs/by-name/mo/mongosh/disable-telemetry.patch

@@ -0,0 +1,13 @@
+diff --git a/packages/cli-repl/src/cli-repl.ts b/packages/cli-repl/src/cli-repl.ts
+index b00c52e1..7a096d6d 100644
+--- a/packages/cli-repl/src/cli-repl.ts
++++ b/packages/cli-repl/src/cli-repl.ts
+@@ -159,7 +159,7 @@ export class CliRepl implements MongoshIOProvider {
+     this.config = {
+       userId: id,
+       telemetryAnonymousId: id,
+-      enableTelemetry: true,
++      enableTelemetry: false,
+     };
+ 
+     this.getCryptLibraryPaths = options.getCryptLibraryPaths;

pkgs/by-name/mo/mongosh/package.nix

@@ -1,38 +1,59 @@
 {
   lib,
   buildNpmPackage,
-  fetchurl,
+  fetchFromGitHub,
+  fetchpatch,
+  libmongocrypt,
+  krb5,
   testers,
-  mongosh,
+  nix-update-script,
 }:
 
-let
+buildNpmPackage (finalAttrs: {
-  source = lib.importJSON ./source.json;
-in
-buildNpmPackage {
   pname = "mongosh";
-  inherit (source) version;
+  version = "2.5.1";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://registry.npmjs.org/mongosh/-/${source.filename}";
+    owner = "mongodb-js";
-    hash = source.integrity;
+    repo = "mongosh";
+
+    # Tracking a few commits ahead of 2.5.1 to ensure the package-lock.json patch below applies
+    #tag = "v${finalAttrs.version}";
+    rev = "2163e8b10a77af18e0cedfa164526506c051593e";
+
+    hash = "sha256-DYX8NqAISwzBpdilcv3YVrL72byXMeC4z/nLqd2nf2c=";
   };
 
-  postPatch = ''
+  patches = [
-    ln -s ${./package-lock.json} package-lock.json
+    # https://github.com/mongodb-js/mongosh/pull/2452
+    (fetchpatch {
+      url = "https://github.com/mongodb-js/mongosh/commit/30f66260fce3e1744298d086bd2b54b2d2bfffbb.patch";
+      hash = "sha256-c2QM/toeoagfhvuh4r+/5j7ZyV6DEr9brA9mXpEy1kM=";
+    })
+
+    ./disable-telemetry.patch
+  ];
+
+  npmDepsHash = "sha256-6uXEKAAGXxaODjXIszYml5Af4zSuEzy/QKdMgSzLD84=";
+  npmFlags = [
+    "--omit=optional"
+    "--ignore-scripts"
+  ];
+  npmBuildScript = "compile";
+  dontNpmInstall = true;
+  installPhase = ''
+    runHook preInstall
+    npmWorkspace=packages/mongosh npmInstallHook
+    cp -r packages configs $out/lib/node_modules/mongosh/
+    rm $out/lib/node_modules/mongosh/node_modules/@mongosh/docker-build-scripts # dangling symlink
+    runHook postInstall
   '';
 
-  npmDepsHash = source.deps;
-
-  makeCacheWritable = true;
-  dontNpmBuild = true;
-  npmFlags = [ "--omit=optional" ];
-
   passthru = {
     tests.version = testers.testVersion {
-      package = mongosh;
+      package = finalAttrs.finalPackage;
     };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { };
   };
 
   meta = {
@@ -42,4 +63,4 @@ buildNpmPackage {
     license = lib.licenses.asl20;
     mainProgram = "mongosh";
   };
-}
+})

pkgs/by-name/mo/mongosh/source.json

@@ -1,6 +0,0 @@
-{
-  "version": "2.4.2",
-  "integrity": "sha512-sNgCITVstYsOkHDH05//wGQ/FJnFfq5gHGoHpIMehX/r2vSm3LEcCW366JlLvRmFj/f4NRGjvFI9c1Ks30W+Zw==",
-  "filename": "mongosh-2.4.2.tgz",
-  "deps": "sha256-aXjK0cW48nih2nI/m2i25zRpmLQ/KHo0KMiNJSvb13g="
-}

pkgs/by-name/mo/mongosh/update.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nodejs libarchive prefetch-npm-deps moreutils jq
-# shellcheck shell=bash
-
-set -exuo pipefail
-
-cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
-
-TMPDIR="$(mktemp -d)"
-trap 'rm -r -- "$TMPDIR"' EXIT
-
-pushd -- "$TMPDIR"
-npm pack mongosh --json | jq '.[0] | { version, integrity, filename }' > source.json
-bsdtar -x -f "$(jq -r .filename source.json)"
-
-pushd package
-npm install --omit=optional --package-lock-only
-popd
-
-DEPS="$(prefetch-npm-deps package/package-lock.json)"
-jq ".deps = \"$DEPS\"" source.json | sponge source.json
-
-popd
-
-cp -t . -- "$TMPDIR/source.json" "$TMPDIR/package/package-lock.json"

pkgs/by-name/ni/nixf-diagnose/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nixf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nixf-diagnose";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "inclyc";
+    repo = "nixf-diagnose";
+    tag = finalAttrs.version;
+    hash = "sha256-gkeU3EwAl9810eRRp5/ddf1h0qpV6FrBBdntNBpBtsM=";
+  };
+
+  env.NIXF_TIDY_PATH = lib.getExe nixf;
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nrr2/lTWPyH7MsG2hSMJjbFCpHsKWINEP8jwSYPhocg=";
+
+  meta = {
+    description = "CLI wrapper for nixf-tidy with fancy diagnostic output";
+    mainProgram = "nixf-diagnose";
+    homepage = "https://github.com/inclyc/nixf-diagnose";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ inclyc ];
+  };
+})

pkgs/by-name/ob/oboete/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oboete";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "mariinkys";
     repo = "oboete";
     tag = version;
-    hash = "sha256-tQn3ihGHkR91zNtBIiyyIEEo21Q0ZSKLEaV/3UI9pwU=";
+    hash = "sha256-Xs9o6V/rUtRkUp7F2hJXLz8PP7XWtqx4uaONo3Q23uo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-91JMgdpMXL0a7oZXAG5xgiulOIyVXQ5x09wN3XDeSy0=";
+  cargoHash = "sha256-bhSkQcDqYhkRwqLbiOLXprQnMqjDKRetZ97K1ES5hrw=";
 
   nativeBuildInputs = [ libcosmicAppHook ];
 

pkgs/by-name/pa/paretosecurity/package.nix

@@ -17,13 +17,13 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.2.15";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-8lRIDW17oyQpoGuHGckSxL++jaeX3qPr2kvXBAeszjc=";
+    hash = "sha256-2Ev6LJWa+iPV7/Y/o9HrNf4vR4dbnIOim+qb4HdRXqU=";
   };
 
   vendorHash = "sha256-YnyACP/hJYxi4AWMwr0We4YUTbWwahKAIYN6RnHmzls=";

pkgs/by-name/pl/plakativ/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+  guiSupport ? true,
+}:
+let
+  pname = "plakativ";
+  version = "0.5.3";
+in
+python3Packages.buildPythonApplication {
+  inherit pname version;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-6TvMznd5obkn/gsQTyZ6Pc/dF55I53987EbuSNAlY58=";
+  };
+
+  dependencies =
+    with python3Packages;
+    [
+      pymupdf
+    ]
+    ++ lib.optional guiSupport tkinter;
+
+  meta = {
+    description = "Convert a PDF into a large poster that can be printed on multiple smaller pages";
+    mainProgram = "plakativ";
+    homepage = "https://gitlab.mister-muffin.de/josch/plakativ";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ marcin-serwin ];
+  };
+}

pkgs/by-name/po/podman-desktop/package.nix

@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "podman-desktop";
-  version = "1.18.0";
+  version = "1.18.1";
 
   passthru.updateScript = nix-update-script { };
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "containers";
     repo = "podman-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u3Irn+hSyTNTLl8QenMZbISE5aFhb58mOSOooVoijKw=";
+    hash = "sha256-GYdetO/WiEQAvVSvu81tKqkOH7YUgkB7RVW0Crd/2ww=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {

pkgs/by-name/pr/process-compose/package.nix

@@ -10,13 +10,13 @@ let
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "1.63.0";
+  version = "1.64.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FnxpaaZLpYMqLGXv/9HP3jh0DuujXoDH2H+omRzgeyQ=";
+    hash = "sha256-qv/fVfuQD7Nan5Nn1RkwXoGZuPYSRWQaojEn6MCF9BQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -45,7 +45,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-4ktj2mRSrY81xvQJd76jo9WJw/ohHXypWuSANp9C+6U=";
+  vendorHash = "sha256-NEKHTSLEF8jBSmAnHq/q+kyV8vPz3DTNj4Jquf5rnso=";
 
   doCheck = false;
 

pkgs/by-name/si/signal-desktop-bin/generic.nix

@@ -262,6 +262,8 @@ stdenv.mkDerivation rec {
       --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
       --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"
 
+    mv $out/share/applications/signal{-desktop,}.desktop
+
     # Note: The following path contains bundled libraries:
     # $out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/
     patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
@@ -295,7 +297,6 @@ stdenv.mkDerivation rec {
       equirosa
       urandom
       bkchr
-      teutat3s
       emily
       Gliczy
     ];

pkgs/by-name/si/signal-desktop/package.nix

@@ -218,7 +218,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   desktopItems = [
     (makeDesktopItem {
-      name = finalAttrs.pname;
+      name = "signal";
       desktopName = "Signal";
       exec = "${finalAttrs.meta.mainProgram} %U";
       type = "Application";
@@ -269,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: {
       ++ lib.optional withAppleEmojis unfree;
     maintainers = with lib.maintainers; [
       marcin-serwin
+      teutat3s
     ];
     mainProgram = "signal-desktop";
     platforms = [

pkgs/by-name/sn/snipe-it/package.nix

@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.1.2";
+  version = "8.1.3";
 
   src = fetchFromGitHub {
     owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tF7lTkmowJAEz2BGNWK2yHkPYafS9Rs5Z98snsbCNQU=";
+    hash = "sha256-SzL1api9hObdvhKRtBrzgvZNuJHAoeB2GCt2etCZ6Kw=";
   };
 
-  vendorHash = "sha256-wVRmvxcrsu5ZBPYrIx9p4+ddWTgBBaeLvyqFMPj3iIg=";
+  vendorHash = "sha256-KOzPzKN1HXFidjXWe8tNPwFJ8DmdrkCDKeChNhGcTDo=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"

pkgs/by-name/sp/spotify-player/package.nix

@@ -46,17 +46,17 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.20.4";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = "spotify-player";
     tag = "v${version}";
-    hash = "sha256-5N/zTkNgcIk/Ml11Oo+jyoO0r2Hh9SxFL+tdhD/1X/4=";
+    hash = "sha256-NlMQgVkMVCVrMv4IyFtPmRkAmf2k4F0dp6e8s63aBHg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-0vIhAJ3u+PfujUGI07fddDs33P35Q4CSDz1sMuQwVws=";
+  cargoHash = "sha256-glQh6PzwJp5o35aXRW4+Pq2iSeGg9vjR5fJQomPpSOc=";
 
   nativeBuildInputs =
     [

pkgs/by-name/st/stalwart-mail/package.nix

@@ -15,10 +15,11 @@
   rocksdb,
   callPackage,
   withFoundationdb ? false,
+  stalwartEnterprise ? false,
 }:
 
 rustPlatform.buildRustPackage rec {
-  pname = "stalwart-mail";
+  pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
   version = "0.11.8";
 
   src = fetchFromGitHub {
@@ -46,15 +47,18 @@ rustPlatform.buildRustPackage rec {
 
   # Issue: https://github.com/stalwartlabs/mail-server/issues/1104
   buildNoDefaultFeatures = true;
-  buildFeatures = [
+  buildFeatures =
-    "sqlite"
+    [
-    "postgres"
+      "sqlite"
-    "mysql"
+      "postgres"
-    "rocks"
+      "mysql"
-    "elastic"
+      "rocks"
-    "s3"
+      "elastic"
-    "redis"
+      "s3"
-  ] ++ lib.optionals withFoundationdb [ "foundationdb" ];
+      "redis"
+    ]
+    ++ lib.optionals withFoundationdb [ "foundationdb" ]
+    ++ lib.optionals stalwartEnterprise [ "enterprise" ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
@@ -154,7 +158,17 @@ rustPlatform.buildRustPackage rec {
     description = "Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP)";
     homepage = "https://github.com/stalwartlabs/mail-server";
     changelog = "https://github.com/stalwartlabs/mail-server/blob/main/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
+    license =
+      [ lib.licenses.agpl3Only ]
+      ++ lib.optionals stalwartEnterprise [
+        {
+          fullName = "Stalwart Enterprise License 1.0 (SELv1) Agreement";
+          url = "https://github.com/stalwartlabs/mail-server/blob/main/LICENSES/LicenseRef-SEL.txt";
+          free = false;
+          redistributable = false;
+        }
+      ];
+
     maintainers = with lib.maintainers; [
       happysalada
       onny

pkgs/by-name/sy/synapse-admin-etkecc/package.nix

@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.10.3-etke39";
+  version = "0.10.4-etke40";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1jE4QrHAnH27FrfpgM8rKd4I2AAJArtL0jgcWVc8TrU=";
+    hash = "sha256-QIOQ25K/QCpSAz3HMOADSIVb3iqfdNCNmWrn7xD0ytU=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-60rS/OfPEQmmZ5j7mUjMPyK9prgNOX7MkYpu9djdjxQ=";
+    hash = "sha256-YQZN9tj0zGnC4gmTvHM32mdaOw5RFuUL2ZKd9/8GNZA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ue/uesave/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "uesave";
-  version = "0.5.0";
+  version = "0.6.2";
   src = fetchFromGitHub {
     owner = "trumank";
     repo = "uesave-rs";
     rev = "v${version}";
-    hash = "sha256-9gOOSLejVfR1KJMhcNuKDkuTOvPC6sNG8xQOZlt8NxI=";
+    hash = "sha256-cwkeuHmtIS8zTxTSa1qLtWfN2OZinqKngMEYvrCCAk0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rAbZfAAW+/7wjsVg9x/OkoCmSbUWeuIkRUYlF+PY0Vs=";
+  cargoHash = "sha256-QGhaaBvxKYnljrkCCcFZLALppvM15c8Xtn36SecaNJ8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ug/ugs/package.nix

@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.1.13";
+  version = "2.1.14";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-LgbZds747/ll9kwIlDR62c9GcnxTcz1TNbAAVXwg3wY=";
+    hash = "sha256-yPamI5Ww56J+jQ3IZW2VKtyW19SHZ1Cxhq2dOAOiUMo=";
   };
 
   dontUnpack = true;

pkgs/by-name/ya/yandex-music/package.nix

@@ -29,13 +29,13 @@ assert lib.assertMsg (trayStyle >= 1 && trayStyle <= 3) "Tray style must be with
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.46.0";
+  version = "5.50.0";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-JyDpJCNHmPV1l9+//3sgJGkD+pewuoAb33hgTUi5Ukc=";
+    hash = "sha256-xn/9LjRLm6CNLrnrLiYr9deeo09iRMEKCRFuM3SELjw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ya/yandex-music/ym_info.json

@@ -1,6 +1,6 @@
 {
-  "version": "5.46.0",
+  "version": "5.50.0",
-  "exe_name": "Yandex_Music_x64_5.46.0.exe",
+  "exe_name": "Yandex_Music_x64_5.50.0.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.46.0.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.50.0.exe",
-  "exe_hash": "sha256-gvdJ/ucPeSG/oSD6ullFzWdRYzu0ovxo0qK8ZjLHi+g="
+  "exe_hash": "sha256-l0QyY8iJkBO0hPUZ1gA0wyJgppO46nURa3L7JzxRBG0="
 }

pkgs/by-name/zm/zmap/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zmap";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BxvmbLZCuGsUZ+ajWUOrchojJ5lipTDOrHKb+fmKTbM=";
+    sha256 = "sha256-fHCVo8OwQUzpdDq7dMBxvK15Ojth5UmNoPTVuTGUP58=";
   };
 
   cmakeFlags = [ "-DRESPECT_INSTALL_PREFIX_CONFIG=ON" ];

pkgs/development/python-modules/docling/default.nix

@@ -52,14 +52,14 @@
 
 buildPythonPackage rec {
   pname = "docling";
-  version = "2.31.0";
+  version = "2.31.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling";
     tag = "v${version}";
-    hash = "sha256-hvNvplEjF/zEchJBN2yJ0/D5Yec/Grr6kdpzRLXeyZU=";
+    hash = "sha256-XGOEYGv5l+7PO03S1YljjU//BuJZ1xpclrVnKTff7bg=";
   };
 
   build-system = [

pkgs/development/python-modules/litellm/default.nix

@@ -37,11 +37,12 @@
   uvloop,
   uvicorn,
   nixosTests,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.65.0";
+  version = "1.69.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -50,7 +51,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     tag = "v${version}-stable";
-    hash = "sha256-q6FDgSwU3G41bVvdofsTBVG90xoqi+NP6zUg9geNz9I=";
+    hash = "sha256-W2uql9fKzwAmSgeLTuESguh+dVn+b3JNTeGlCc9NP2A=";
   };
 
   build-system = [ poetry-core ];
@@ -99,11 +100,20 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "litellm" ];
 
+  # Relax dependency check on openai, may not be needed in the future
+  pythonRelaxDeps = [ "openai" ];
+
   # access network
   doCheck = false;
 
-  passthru.tests = {
+  passthru = {
-    inherit (nixosTests) litellm;
+    tests = { inherit (nixosTests) litellm; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v([0-9]+\\.[0-9]+\\.[0-9]+)-stable"
+      ];
+    };
   };
 
   meta = {

pkgs/development/python-modules/openai/default.nix

@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.78.0";
+  version = "1.78.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     tag = "v${version}";
-    hash = "sha256-LY9px7l0xY1nnCagepm5p1USw4WW15Sc1UN7+Ep7bqo=";
+    hash = "sha256-rdK4usuFVhPpDL3jnSkapJfDfLOI5EH8zeS0a7xoy/g=";
   };
 
   postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';

pkgs/development/python-modules/plotpy/default.nix

@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "plotpy";
-  version = "2.7.3";
+  version = "2.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PlotPy";
     tag = "v${version}";
-    hash = "sha256-Z8aCDTBRdksbjjH5P+OXln3CHciw1MuYQN3K6KOcouk=";
+    hash = "sha256-FmSFcCAJZyzD9qRE+L2oxWtyh2spJSLRq+xtx4e1Rhg=";
   };
 
   build-system = [
@@ -85,27 +85,32 @@ buildPythonPackage rec {
 
   passthru = {
     tests = {
-      # Upstream doesn't officially supports all of them, although they use
-      # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20 . When this
-      # package was created, all worked besides withPySide2, with which there
-      # was a peculiar segmentation fault during the tests. In anycase, PySide2
-      # shouldn't be used for modern applications.
       withPyQt6 = plotpy.override {
         pyqt6 = pyqt6;
         qt6 = qt6;
       };
-      withPySide6 = plotpy.override {
-        pyqt6 = pyside6;
-        qt6 = qt6;
-      };
       withPyQt5 = plotpy.override {
         pyqt6 = pyqt5;
         qt6 = qt5;
       };
+    };
+    # Upstream doesn't officially supports all of them, although they use
+    # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20
+    knownFailingTests = {
+      # Was failing with a peculiar segmentation fault during the tests, since
+      # this package was added to Nixpkgs. This is not too bad as PySide2
+      # shouldn't be used for modern applications.
       withPySide2 = plotpy.override {
         pyqt6 = pyside2;
         qt6 = qt5;
       };
+      # Has started failing too similarly to pyside2, ever since a certain
+      # version bump. See also:
+      # https://github.com/PlotPyStack/PlotPy/blob/v2.7.4/README.md?plain=1#L62
+      withPySide6 = plotpy.override {
+        pyqt6 = pyside6;
+        qt6 = qt6;
+      };
     };
   };
 

pkgs/os-specific/linux/kernel/manual-config.nix

@@ -412,9 +412,17 @@ lib.makeOverridable (
             if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
               "uinstall"
             else if
-              kernelConf.target == "zImage"
+              (
-              || kernelConf.target == "Image.gz"
+                kernelConf.target == "zImage"
-              || kernelConf.target == "vmlinuz.efi"
+                || kernelConf.target == "Image.gz"
+                || kernelConf.target == "vmlinuz.efi"
+              )
+              && builtins.elem stdenv.hostPlatform.linuxArch [
+                "arm"
+                "arm64"
+                "parisc"
+                "riscv"
+              ]
             then
               "zinstall"
             else

pkgs/os-specific/linux/kernel/zen-kernels.nix

@@ -16,16 +16,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.14.5"; # zen
+      version = "6.14.6"; # zen
       suffix = "zen1"; # zen
-      sha256 = "12ikiicar6agap4i7qpzlxabqrgqdc69im3ly9m6rrydhb5ig2an"; # zen
+      sha256 = "0qrx0c8bza9jj84ax209h3b9w2yn2sh122qj9ki77c8wgp6rwvrm"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.14.5"; # lqx
+      version = "6.14.6"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "18h9qxd1ljkqff4nh96nviqzhss2jzaia3h0wijwa6r7d5w4nk2z"; # lqx
+      sha256 = "0l2k4c1jv167dxx99r62anb1jwp4hz698z6ysdaagary103x8wk3"; # lqx
       isLqx = true;
     };
   };

pkgs/os-specific/linux/rtl8821ce/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtl8821ce";
-  version = "0-unstable-2025-03-31";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "98cff1d7dcbf17b36a98bac342df75dfe0b79017";
+    rev = "6208d1dd190b7cb60bbbf760505bcb1c250518c2";
-    hash = "sha256-23UJE3EzWufjuAU+iBOk5Ia2xUWxQQGI6/eCp1UmRUA=";
+    hash = "sha256-d2KWiUxx3/rZvobOzvK5nyGdovovOf8g2MaEd2QW+Pc=";
   };
 
   hardeningDisable = [ "pic" ];

pkgs/tools/audio/beets/default.nix

@@ -4,7 +4,6 @@
   config,
   fetchFromGitHub,
   python3Packages,
-  fetchpatch,
 }:
 /*
   ** To customize the enabled beets plugins, use the pluginOverrides input to the
@@ -21,24 +20,8 @@
 */
 let
   extraPatches = [
-    (fetchpatch {
-      # Already on master. TODO: remove when updating to the next release
-      # Issue: https://github.com/beetbox/beets/issues/5527
-      # PR: https://github.com/beetbox/beets/pull/5650
-      name = "fix-im-backend";
-      url = "https://github.com/beetbox/beets/commit/1f938674015ee71431fe9bd97c2214f58473efd2.patch";
-      hash = "sha256-koCYeiUhk1ifo6CptOSu3p7Nz0FFUeiuArTknM/tpVQ=";
-      excludes = [
-        "docs/changelog.rst"
-      ];
-    })
     # Bash completion fix for Nix
     ./patches/bash-completion-always-print.patch
-    # Remove after next release.
-    (fetchpatch {
-      url = "https://github.com/beetbox/beets/commit/bcc79a5b09225050ce7c88f63dfa56f49f8782a8.patch?full_index=1";
-      hash = "sha256-Y2Q5Co3UlDGKuzfxUvdUY3rSMNpsBoDW03ZWZOfzp3Y=";
-    })
   ];
 in
 lib.makeExtensible (
@@ -48,12 +31,12 @@ lib.makeExtensible (
 
     beets-stable = callPackage ./common.nix rec {
       inherit python3Packages extraPatches;
-      version = "2.2.0";
+      version = "2.3.0";
       src = fetchFromGitHub {
         owner = "beetbox";
         repo = "beets";
         tag = "v${version}";
-        hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
       };
     };
 
@@ -61,18 +44,19 @@ lib.makeExtensible (
 
     beets-unstable = callPackage ./common.nix {
       inherit python3Packages;
-      version = "2.2.0-unstable-2025-03-12";
+      version = "2.3.0";
       src = fetchFromGitHub {
         owner = "beetbox";
         repo = "beets";
-        rev = "670a3bcd17a46883c71cf07dd313fcd0dff4be9d";
+        rev = "250b0da900c095a09bedc1a0717381010c01a3c6";
-        hash = "sha256-hSY7FhpPL4poOY1/gqk7oLNgQ7KA/MJqx50xOLIP0QA=";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
       };
     };
 
     alternatives = callPackage ./plugins/alternatives.nix { beets = self.beets-minimal; };
     audible = callPackage ./plugins/audible.nix { beets = self.beets-minimal; };
     copyartifacts = callPackage ./plugins/copyartifacts.nix { beets = self.beets-minimal; };
+    filetote = callPackage ./plugins/filetote.nix { beets = self.beets-minimal; };
   }
   // lib.optionalAttrs config.allowAliases {
     extrafiles = throw "extrafiles is unmaintained since 2020 and broken since beets 2.0.0";

pkgs/tools/audio/beets/plugins/alternatives.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "beets-alternatives";
-  version = "0.13.2";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "beets-alternatives";
     owner = "geigerzaehler";
     tag = "v${version}";
-    hash = "sha256-OoQsP+QVIOnSA4oy1a8JJ3VeCUS+GR8sPPOysvmRMqI=";
+    hash = "sha256-j56AzbpZFACXy5KqafE8PCC+zM6pXrxr/rWy9UjZPQg=";
   };
 
   nativeBuildInputs = [

pkgs/tools/audio/beets/plugins/audible.nix

@@ -17,19 +17,21 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-Sds16h+W9t7N755ADPXXDi+SxwouBMxP9ApUqaXedqY=";
   };
 
+  nativeBuildInputs = [
+    beets
+  ];
+
   pythonRelaxDeps = true;
 
   build-system = with python3Packages; [
     hatchling
   ];
 
-  dependencies =
+  dependencies = with python3Packages; [
-    [ beets ]
+    markdownify
-    ++ (with python3Packages; [
+    natsort
-      markdownify
+    tldextract
-      natsort
+  ];
-      tldextract
-    ]);
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/tools/audio/beets/plugins/copyartifacts.nix

@@ -19,7 +19,6 @@ python3Packages.buildPythonApplication rec {
   };
 
   postPatch = ''
-    sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
     sed -i -e '/namespace_packages/d' setup.py
     printf 'from pkgutil import extend_path\n__path__ = extend_path(__path__, __name__)\n' >beetsplug/__init__.py
 
@@ -28,13 +27,20 @@ python3Packages.buildPythonApplication rec {
     sed -i -e 's/util\.py3_path/os.fsdecode/g' tests/_common.py
   '';
 
-  build-system = with python3Packages; [ setuptools ];
+  nativeBuildInputs = [
+    beets
+  ];
 
-  dependencies = with python3Packages; [ six ];
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    six
+  ];
 
   nativeCheckInputs = [
     python3Packages.pytestCheckHook
-    beets
     writableTmpDirAsHomeHook
   ];
 

pkgs/tools/audio/beets/plugins/filetote.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  beets,
+  beetsPackages,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "beets-filetote";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "gtronset";
+    repo = "beets-filetote";
+    tag = "v${version}";
+    hash = "sha256-LTJwZI/kQc+Iv0y8jAi5Xdh4wLEwbTA9hV76ndQsQzU=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail "poetry-core<2.0.0" "poetry-core"
+  '';
+
+  nativeBuildInputs = [
+    beets
+  ];
+
+  build-system = [ python3Packages.poetry-core ];
+
+  dependencies = with python3Packages; [
+    mediafile
+    reflink
+    toml
+    typeguard
+  ];
+
+  optional-dependencies = {
+    lint = with python3Packages; [
+      black
+      check-manifest
+      flake8
+      flake8-bugbear
+      flake8-bugbear-pyi
+      isort
+      mypy
+      pylint
+      typing_extensions
+    ];
+    test = with python3Packages; [
+      beetsPackages.audible
+      mediafile
+      pytest
+      reflink
+      toml
+      typeguard
+    ];
+    dev = optional-dependencies.lint ++ optional-dependencies.test ++ [ python3Packages.tox ];
+  };
+
+  pytestFlagsArray = [ "-r fEs" ];
+
+  disabledTestPaths = [
+    "tests/test_cli_operation.py"
+    "tests/test_pruning.py"
+    "tests/test_version.py"
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    writableTmpDirAsHomeHook
+  ] ++ optional-dependencies.test;
+
+  meta = with lib; {
+    description = "Beets plugin to move non-music files during the import process";
+    homepage = "https://github.com/gtronset/beets-filetote";
+    changelog = "https://github.com/gtronset/beets-filetote/blob/${src.rev}/CHANGELOG.md";
+    maintainers = with maintainers; [ dansbandit ];
+    license = licenses.mit;
+    inherit (beets.meta) platforms;
+  };
+}

pkgs/tools/filesystems/ceph/arrow-cpp-19.nix

@@ -0,0 +1,335 @@
+# This is is arrow-cpp < 20 used as a workaround for
+# Ceph not supporting >= yet, taken from nixpkgs commit
+#     97ae53798f6a7c7c3c259ad8c2cbcede6ca34b2a~
+# This should be entirely removed when upstream bug
+#     https://tracker.ceph.com/issues/71269
+# is fixed.
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchFromGitHub,
+  fixDarwinDylibNames,
+  autoconf,
+  aws-sdk-cpp,
+  aws-sdk-cpp-arrow ? aws-sdk-cpp.override {
+    apis = [
+      "cognito-identity"
+      "config"
+      "identity-management"
+      "s3"
+      "sts"
+      "transfer"
+    ];
+  },
+  boost,
+  brotli,
+  bzip2,
+  cmake,
+  crc32c,
+  curl,
+  flatbuffers,
+  gflags,
+  glog,
+  google-cloud-cpp,
+  grpc,
+  gtest,
+  libbacktrace,
+  lz4,
+  minio,
+  ninja,
+  nlohmann_json,
+  openssl,
+  perl,
+  pkg-config,
+  protobuf_29,
+  python3,
+  rapidjson,
+  re2,
+  snappy,
+  sqlite,
+  thrift,
+  tzdata,
+  utf8proc,
+  which,
+  zlib,
+  zstd,
+  testers,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableFlight ? stdenv.buildPlatform == stdenv.hostPlatform,
+  # Disable also on RiscV
+  # configure: error: cannot determine number of significant virtual address bits
+  enableJemalloc ?
+    !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isRiscV64,
+  enableS3 ? true,
+  # google-cloud-cpp fails to build on RiscV
+  enableGcs ? !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isRiscV64,
+}:
+
+let
+  # https://github.com/apache/arrow/issues/45807
+  protobuf = protobuf_29;
+
+  arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "4d209492d514c2d3cb2d392681b9aa00e6d8da1c";
+    hash = "sha256-IkiCbuy0bWyClPZ4ZEdkEP7jFYLhM7RCuNLd6Lazd4o=";
+  };
+
+  parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "c7cf1374cf284c0c73024cd1437becea75558bf8";
+    hash = "sha256-DThjyZ34LajHwXZy1IhYKUGUG/ejQ9WvBNuI8eUKmSs=";
+  };
+
+  version = "19.0.1";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arrow-cpp";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow";
+    rev = "apache-arrow-${version}";
+    hash = "sha256-toHwUIOZRpgR0K7pQtT5nqWpO9G7AuHYTcvA6UVg9lA=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/cpp";
+
+  # versions are all taken from
+  # https://github.com/apache/arrow/blob/apache-arrow-${version}/cpp/thirdparty/versions.txt
+
+  # jemalloc: arrow uses a custom prefix to prevent default allocator symbol
+  # collisions as well as custom build flags
+  ${if enableJemalloc then "ARROW_JEMALLOC_URL" else null} = fetchurl {
+    url = "https://github.com/jemalloc/jemalloc/releases/download/5.3.0/jemalloc-5.3.0.tar.bz2";
+    hash = "sha256-LbgtHnEZ3z5xt2QCGbbf6EeJvAU3mDw7esT3GJrs/qo=";
+  };
+
+  # mimalloc: arrow uses custom build flags for mimalloc
+  ARROW_MIMALLOC_URL = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "mimalloc";
+    rev = "v2.0.6";
+    hash = "sha256-u2ITXABBN/dwU+mCIbL3tN1f4c17aBuSdNTV+Adtohc=";
+  };
+
+  ARROW_XSIMD_URL = fetchFromGitHub {
+    owner = "xtensor-stack";
+    repo = "xsimd";
+    rev = "13.0.0";
+    hash = "sha256-qElJYW5QDj3s59L3NgZj5zkhnUMzIP2mBa1sPks3/CE=";
+  };
+
+  ARROW_SUBSTRAIT_URL = fetchFromGitHub {
+    owner = "substrait-io";
+    repo = "substrait";
+    rev = "v0.44.0";
+    hash = "sha256-V739IFTGPtbGPlxcOi8sAaYSDhNUEpITvN9IqdPReug=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    ninja
+    autoconf # for vendored jemalloc
+    flatbuffers
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  buildInputs =
+    [
+      boost
+      brotli
+      bzip2
+      flatbuffers
+      gflags
+      glog
+      gtest
+      libbacktrace
+      lz4
+      nlohmann_json # alternative JSON parser to rapidjson
+      protobuf # substrait requires protobuf
+      rapidjson
+      re2
+      snappy
+      thrift
+      utf8proc
+      zlib
+      zstd
+    ]
+    ++ lib.optionals enableFlight [
+      grpc
+      openssl
+      protobuf
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [
+      aws-sdk-cpp-arrow
+      openssl
+    ]
+    ++ lib.optionals enableGcs [
+      crc32c
+      curl
+      google-cloud-cpp
+      grpc
+      nlohmann_json
+    ];
+
+  preConfigure = ''
+    patchShebangs build-support/
+    substituteInPlace "src/arrow/vendored/datetime/tz.cpp" \
+      --replace-fail 'discover_tz_dir();' '"${tzdata}/share/zoneinfo";'
+  '';
+
+  cmakeFlags =
+    [
+      "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
+      "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
+      "-DARROW_BUILD_TESTS=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_INTEGRATION=ON"
+      "-DARROW_BUILD_UTILITIES=ON"
+      "-DARROW_EXTRA_ERROR_CONTEXT=ON"
+      "-DARROW_VERBOSE_THIRDPARTY_BUILD=ON"
+      "-DARROW_DEPENDENCY_SOURCE=SYSTEM"
+      "-Dxsimd_SOURCE=AUTO"
+      "-DARROW_DEPENDENCY_USE_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_COMPUTE=ON"
+      "-DARROW_CSV=ON"
+      "-DARROW_DATASET=ON"
+      "-DARROW_FILESYSTEM=ON"
+      "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_HDFS=ON"
+      "-DARROW_IPC=ON"
+      "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
+      "-DARROW_JSON=ON"
+      "-DARROW_USE_GLOG=ON"
+      "-DARROW_WITH_BACKTRACE=ON"
+      "-DARROW_WITH_BROTLI=ON"
+      "-DARROW_WITH_BZ2=ON"
+      "-DARROW_WITH_LZ4=ON"
+      "-DARROW_WITH_NLOHMANN_JSON=ON"
+      "-DARROW_WITH_SNAPPY=ON"
+      "-DARROW_WITH_UTF8PROC=ON"
+      "-DARROW_WITH_ZLIB=ON"
+      "-DARROW_WITH_ZSTD=ON"
+      "-DARROW_MIMALLOC=ON"
+      "-DARROW_SUBSTRAIT=ON"
+      "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
+      "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+      # Parquet options:
+      "-DARROW_PARQUET=ON"
+      "-DPARQUET_BUILD_EXECUTABLES=ON"
+      "-DPARQUET_REQUIRE_ENCRYPTION=ON"
+    ]
+    ++ lib.optionals (!enableShared) [ "-DARROW_TEST_LINKAGE=static" ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+    ++ lib.optionals enableS3 [
+      "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
+    ];
+
+  doInstallCheck = true;
+  ARROW_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${parquet-testing}/data";
+  GTEST_FILTER =
+    let
+      # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
+      filteredTests =
+        lib.optionals stdenv.hostPlatform.isAarch64 [
+          "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
+          "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
+          "TestCompareKernel.PrimitiveRandomTests"
+        ]
+        ++ lib.optionals enableS3 [
+          "S3OptionsTest.FromUri"
+          "S3RegionResolutionTest.NonExistentBucket"
+          "S3RegionResolutionTest.PublicBucket"
+          "S3RegionResolutionTest.RestrictedBucket"
+          "TestMinioServer.Connect"
+          "TestS3FS.*"
+          "TestS3FSGeneric.*"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # TODO: revisit at 12.0.0 or when
+          # https://github.com/apache/arrow/commit/295c6644ca6b67c95a662410b2c7faea0920c989
+          # is available, see
+          # https://github.com/apache/arrow/pull/15288#discussion_r1071244661
+          "ExecPlanExecution.StressSourceSinkStopped"
+        ];
+    in
+    lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs =
+    [
+      perl
+      which
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
+
+  installCheckPhase =
+    let
+      disabledTests = [
+        # flaky
+        "arrow-flight-test"
+        # requires networking
+        "arrow-gcsfs-test"
+        "arrow-flight-integration-test"
+      ];
+    in
+    ''
+      runHook preInstallCheck
+
+      ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+      runHook postInstallCheck
+    '';
+
+  meta = with lib; {
+    description = "Cross-language development platform for in-memory data";
+    homepage = "https://arrow.apache.org/docs/cpp/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      tobim
+      veprbl
+      cpcloud
+    ];
+    pkgConfigModules = [
+      "arrow"
+      "arrow-acero"
+      "arrow-compute"
+      "arrow-csv"
+      "arrow-dataset"
+      "arrow-filesystem"
+      "arrow-flight"
+      "arrow-flight-sql"
+      "arrow-flight-testing"
+      "arrow-json"
+      "arrow-substrait"
+      "arrow-testing"
+      "parquet"
+    ];
+  };
+  passthru = {
+    inherit
+      enableFlight
+      enableJemalloc
+      enableS3
+      enableGcs
+      ;
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+})

pkgs/top-level/all-packages.nix

@@ -2538,6 +2538,11 @@ with pkgs;
       # If we want to switch for that before upstream fixes it, use this patch:
       # https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899648638
       fmt = fmt_9;
+
+      # Remove once Ceph supports arrow-cpp >= 20, see:
+      # * https://tracker.ceph.com/issues/71269
+      # * https://github.com/NixOS/nixpkgs/issues/406306
+      arrow-cpp = callPackage ../tools/filesystems/ceph/arrow-cpp-19.nix { };
     })
     ceph
     ceph-client
@@ -10909,6 +10914,10 @@ with pkgs;
 
   stalwart-mail-webadmin = stalwart-mail.webadmin;
 
+  stalwart-mail-enterprise = stalwart-mail.override {
+    stalwartEnterprise = true;
+  };
+
   ruby-zoom = callPackage ../tools/text/ruby-zoom { };
 
   inherit (callPackages ../servers/monitoring/sensu-go { })