Merge staging-next-25.05 into staging-25.05

(cherry picked from commit f71748184c)

nixos/modules/services/networking/pdns-recursor.nix

@@ -287,7 +287,10 @@ in
 
     systemd.packages = [ pkgs.pdns-recursor ];
 
-    systemd.services.pdns-recursor.wantedBy = [ "multi-user.target" ];
+    systemd.services.pdns-recursor = {
+      restartTriggers = [ config.environment.etc."/pdns-recursor/recursor.yml".source ];
+      wantedBy = [ "multi-user.target" ];
+    };
 
     users.users.pdns-recursor = {
       isSystemUser = true;

nixos/modules/services/security/kanidm.nix

@@ -465,6 +465,17 @@ in
                 apply = unique;
                 default = [ ];
               };
+
+              overwriteMembers = mkOption {
+                description = ''
+                  Whether the member list should be overwritten each time (true) or appended
+                  (false). Append mode allows interactive group management in addition to the
+                  declared members. Also, future member removals cannot be reflected
+                  automatically in append mode.
+                '';
+                type = types.bool;
+                default = true;
+              };
             };
             config.members = concatLists (
               flip mapAttrsToList cfg.provision.persons (

nixos/modules/services/web-apps/olivetin.nix

@@ -102,30 +102,16 @@ in
       inherit (cfg) path;
 
       preStart = ''
-        tmp="$(mktemp -d)"
+        shopt -s nullglob
-        trap 'rm -rf "$tmp"' EXIT
-        cd "$tmp"
 
-        cp ${settingsFormat.generate "olivetin-config.yaml" cfg.settings} config.yaml
+        tmp="$(mktemp)"
-        chmod +w config.yaml
+        ${lib.getExe pkgs.yq-go} eval-all '. as $item ireduce ({}; . *+ $item)' \
-        for ((i=0; i < ${toString (lib.length cfg.extraConfigFiles)}; i++)); do
+          ${settingsFormat.generate "olivetin-config.yaml" cfg.settings} \
-          ${lib.getExe pkgs.yq} -yi '
+          $CREDENTIALS_DIRECTORY/config-*.yaml > "$tmp"
-            def merge($y):
+        chmod -w "$tmp"
-              . as $x |
-              if ($x | type == "object") and ($y | type == "object") then
-                $x + $y + with_entries(select(.key | in($y)) | .key as $key | .value |= merge($y[$key]))
-              elif ($x | type == "array") and ($y | type == "array") then
-                $x + $y
-              else
-                $y
-              end;
-            merge($f | fromjson)
-          ' config.yaml --rawfile f <(${lib.getExe pkgs.yq} -c . "$CREDENTIALS_DIRECTORY/config-$i.yaml")
-        done
-        chmod -w config.yaml
 
         mkdir -p /run/olivetin/config
-        mv config.yaml /run/olivetin/config/config.yaml
+        mv "$tmp" /run/olivetin/config/config.yaml
       '';
 
       serviceConfig = {

nixos/tests/kanidm-provisioning.nix

@@ -74,6 +74,10 @@ import ./make-test-python.nix (
               };
 
               groups.testgroup1 = { };
+              groups.imperative = {
+                overwriteMembers = false;
+                members = [ "testuser1" ];
+              };
 
               persons.testuser1 = {
                 displayName = "Test User";
@@ -134,6 +138,11 @@ import ./make-test-python.nix (
               };
 
               groups.testgroup1 = { };
+              groups.imperative = {
+                overwriteMembers = false;
+                # Will be retained:
+                # members = [ "testuser1" ];
+              };
 
               persons.testuser1 = {
                 displayName = "Test User (changed)";
@@ -329,6 +338,10 @@ import ./make-test-python.nix (
             out = provision.succeed("kanidm group get testgroup1")
             assert_contains(out, "name: testgroup1")
 
+            out = provision.succeed("kanidm group get imperative")
+            assert_contains(out, "name: imperative")
+            assert_contains(out, "member: testuser1")
+
             out = provision.succeed("kanidm group get supergroup1")
             assert_contains(out, "name: supergroup1")
             assert_contains(out, "member: testgroup1")
@@ -339,6 +352,7 @@ import ./make-test-python.nix (
             assert_contains(out, "legalname: Jane Doe")
             assert_contains(out, "mail: jane.doe@example.com")
             assert_contains(out, "memberof: testgroup1")
+            assert_contains(out, "memberof: imperative")
             assert_contains(out, "memberof: service1-access")
 
             out = provision.succeed("kanidm person get testuser2")
@@ -383,6 +397,10 @@ import ./make-test-python.nix (
             out = provision.succeed("kanidm group get testgroup1")
             assert_contains(out, "name: testgroup1")
 
+            out = provision.succeed("kanidm group get imperative")
+            assert_contains(out, "name: imperative")
+            assert_contains(out, "member: testuser1")
+
             out = provision.succeed("kanidm group get supergroup1")
             assert_contains(out, "name: supergroup1")
             assert_lacks(out, "member: testgroup1")
@@ -394,6 +412,7 @@ import ./make-test-python.nix (
             assert_contains(out, "mail: jane.doe@example.com")
             assert_contains(out, "mail: second.doe@example.com")
             assert_lacks(out, "memberof: testgroup1")
+            assert_contains(out, "memberof: imperative")
             assert_contains(out, "memberof: service1-access")
 
             out = provision.succeed("kanidm person get testuser2")

nixos/tests/keepassxc.nix

@@ -18,6 +18,7 @@ import ./make-test-python.nix (
         ];
 
         services.xserver.enable = true;
+        programs.dconf.enable = true;
 
         # for better OCR
         environment.etc."icewm/prefoverride".text = ''

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.7.1";
+  version = "33.7.2";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -174,11 +174,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-80L93pQaozdyqMnIswWnS+gNo+xVYv5eFVNnLiK/rcU=";
+          hash = "sha256-GE45GZ+OmNNwRLTD2pcZpqRA66k4q/+lkQnGJG+z6nQ=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-dnDQKRCqADzdotJRUeETqaGV+S+M6/de5LuBgMYYvPE=";
+          hash = "sha256-yJPmmQ9IkGzort9OPPWzv+LSeJci8VNoso3NLYev51Q=";
         };
       };
 

pkgs/by-name/cl/clapper/package.nix

@@ -29,6 +29,11 @@ stdenvNoCC.mkDerivation {
 
     mkdir -p $out
     lndir $src $out
+    dbusfile=share/dbus-1/services/com.github.rafostar.Clapper.service
+    rm $out/$dbusfile
+    cp $src/$dbusfile $out/$dbusfile
+    substituteInPlace $out/$dbusfile \
+      --replace-fail $src/bin/clapper $out/bin/clapper
 
     runHook postInstall
   '';

pkgs/by-name/ho/homebank/package.nix

@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation rec {
   pname = "homebank";
-  version = "5.9.1";
+  version = "5.9.2";
   src = fetchurl {
     url = "https://www.gethomebank.org/public/sources/homebank-${version}.tar.gz";
-    hash = "sha256-s1Dtw6bjIUFObCb4VQ4rLBMNwftFlmlVa2H/1+jy44A=";
+    hash = "sha256-63WHr9yUuNx3s2pNvTSPTLwQ2M+757Mr++Yfocb6G8c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ka/kanidm-provision/package.nix

@@ -2,7 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  yq,
   versionCheckHook,
   nix-update-script,
   nixosTests,
@@ -10,25 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kanidm-provision";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "oddlama";
     repo = "kanidm-provision";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kwxGrLz59Zk8PSsfQzPUeA/xWQZrV1NWlS5/yuqfIyI=";
+    hash = "sha256-m3bF4wFPVRc2E+E/pZc3js9T4rYbTejo/FFpysytWKw=";
   };
 
-  postPatch = ''
-    tomlq -ti '.package.version = "${finalAttrs.version}"' Cargo.toml
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uo/TGyfNChq/t6Dah0HhXhAwktyQk0V/wewezZuftNk=";
+  cargoHash = "sha256-dPTrIc/hTbMlFDXYMk/dTjqaNECazldfW43egDOwyLM=";
-
-  nativeBuildInputs = [
-    yq # for `tomlq`
-  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/by-name/me/mergiraf/package.nix

@@ -1,49 +1,49 @@
 {
-  stdenv,
   lib,
   fetchFromGitea,
   rustPlatform,
+  nix-update-script,
 
   # native check inputs
   git,
   versionCheckHook,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.8.0";
+  version = "0.10.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
-    rev = "refs/tags/v${version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-CQriH0vZ+ZBSIZcj0MKQEojpugS2g4sCuDICmwLCUBE=";
+    hash = "sha256-wnXOl7KzSvvxQP4CebOJ+fEIn7fQDKTmO2PkGMRA4t4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nsWRysIupGC3w0L7OMChcgPPTHSwnmcKv58BTn51cY4=";
+  cargoHash = "sha256-jShWfd3m9g6YlUFLOzlMPFtuXAAfjh+sBujCJ9F2Uj0=";
 
-  nativeCheckInputs = [
+  nativeCheckInputs = [ git ];
-    git
-  ];
 
   doInstallCheck = true;
-  nativeInstallCheckInputs = [
+  nativeInstallCheckInputs = [ versionCheckHook ];
-    versionCheckHook
-  ];
 
   versionCheckProgramArg = "--version";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Syntax-aware git merge driver for a growing collection of programming languages and file formats";
     homepage = "https://mergiraf.org/";
-    changelog = "https://codeberg.org/mergiraf/mergiraf/releases/tag/v${version}";
+    downloadPage = "https://codeberg.org/mergiraf/mergiraf";
+    changelog = "https://codeberg.org/mergiraf/mergiraf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       zimbatm
       genga898
+      defelo
     ];
     mainProgram = "mergiraf";
   };
-}
+})

pkgs/by-name/os/osu-lazer-bin/package.nix

@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.424.0";
+  version = "2025.607.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-fgG3SnltGxOYHwos8BTngaW4YrRdpOdURxd73sz0t7o=";
+        hash = "sha256-rfWP6vF68mE+pnKvJjSgkxzTBj3sWDRlB9NZZkPOYOE=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-0K+uAH4f8JOfzG4J37aGaStpEkH5tdUfHEqsogMtN2I=";
+        hash = "sha256-FpMugHVyhpyzCRp+EH/RSQDsgoUEQrAuIVCaMTucz88=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-8nOoSkNbzEFpDj0FivCYI20tZzT02YHcKZblfEfh+Zo=";
+        hash = "sha256-jG3KedllnVNd5TLSkKYae2V8CzN90g5lJhT4EKI+nuk=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/os/osu-lazer/deps.json

@@ -651,8 +651,8 @@
   },
   {
     "pname": "ppy.osu.Framework",
-    "version": "2025.419.0",
+    "version": "2025.604.1",
-    "hash": "sha256-fsuEdzD4pzBID7I7DNAYs4JGrCkm/ALtZkEu5/QgKVQ="
+    "hash": "sha256-TnxNneBVR6YYuaUbU1sHewwVzy15qmCpudSopHol1tM="
   },
   {
     "pname": "ppy.osu.Framework.NativeLibs",
@@ -666,8 +666,8 @@
   },
   {
     "pname": "ppy.osu.Game.Resources",
-    "version": "2025.321.0",
+    "version": "2025.605.0",
-    "hash": "sha256-vjNwUVBSOrWEc8z8QXD+CPSZMj9BCKuKIQZXxqaXldc="
+    "hash": "sha256-t9uNvlimF81LNECTBnhLidSmN8cOXi3Sn0rqI3na3zQ="
   },
   {
     "pname": "ppy.osuTK.NS20",

pkgs/by-name/os/osu-lazer/package.nix

@@ -22,13 +22,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.424.0";
+  version = "2025.607.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-+r7YeaNrUkoYoMzGqhqT+bqdO1UohvJRlAcAskF7vn4=";
+    hash = "sha256-qAKtINbWbC76a4vhEFIE6WnEtn/0brcIPp5WXBGQoEI=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

pkgs/by-name/sv/svtplay-dl/package.nix

@@ -21,7 +21,7 @@ let
     requests-mock
     ;
 
-  version = "4.109";
+  version = "4.113";
 
 in
 
@@ -34,7 +34,7 @@ buildPythonApplication {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-ApoAcYaqPIurgDM+ctyyx9+OyUmhJ+1fjdGj0ln6v7w=";
+    hash = "sha256-Yiw76PDnOpK4HAnO9VqmvmqdT4PdxAgu1MwbZ15pEyM=";
   };
 
   build-system = [ setuptools ];

pkgs/by-name/te/teleport_16/package.nix

@@ -2,9 +2,9 @@
   teleport,
 }:
 teleport.override {
-  version = "16.5.10";
+  version = "16.5.11";
-  hash = "sha256-i+2IK+X0Opyv2tQPpj2XhY64aQGdbylS/C7LsTykuXI=";
+  hash = "sha256-uLis1oRTr5J2bKaJtnVAIQ0ixYT8BYLo4jQPcdFp82s=";
-  vendorHash = "sha256-DdVBtMwz0AIGCYj/QLczG8GPP9mqKrdF+M0NqmM6J0I=";
+  vendorHash = "sha256-OcVHckqxpTVz6Gaemt3+9WxBQc5D5QBxb3IMGOMq4LI=";
   pnpmHash = "sha256-JQca2eFxcKJDHIaheJBg93ivZU95UWMRgbcK7QE4R10=";
   cargoHash = "sha256-04zykCcVTptEPGy35MIWG+tROKFzEepLBmn04mSbt7I=";
 }

pkgs/by-name/to/tokei/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
+  fetchpatch2,
   libiconv,
   zlib,
 }:
@@ -18,6 +19,14 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/XAMPPRocky/tokei/pull/1209
+      url = "https://github.com/XAMPPRocky/tokei/commit/ce8d8535276a2e41878981a8199232986ab96c6b.patch";
+      hash = "sha256-1tb+WmjVsTxs8Awf1mbKOBIhJ3ddoOT8ZjBKA2BMocg=";
+    })
+  ];
+
   useFetchCargoVendor = true;
   cargoHash = "sha256-LzlyrKaRjUo6JnVLQnHidtI4OWa+GrhAc4D8RkL+nmQ=";
 

pkgs/by-name/ze/zed-editor/0001-linux-linker.patch

@@ -1,5 +1,5 @@
 diff --git a/.cargo/config.toml b/.cargo/config.toml
-index 07cbc23195..b3c4d43e0f 100644
+index 717c5e1..0bb7b6c 100644
 --- a/.cargo/config.toml
 +++ b/.cargo/config.toml
 @@ -5,14 +5,6 @@ rustflags = ["-C", "symbol-mangling-version=v0", "--cfg", "tokio_unstable"]
@@ -14,6 +14,6 @@ index 07cbc23195..b3c4d43e0f 100644
 -linker = "clang"
 -rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 -
- [target.aarch64-apple-darwin]
+ [target.'cfg(target_os = "windows")']
- rustflags = ["-C", "link-args=-Objc -all_load"]
+ rustflags = [
- 
+     "--cfg",

pkgs/by-name/ze/zed-editor/package.nix

@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.186.8";
+  version = "0.189.5";
 
   outputs =
     [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oSmwEtF8VWSKcBlL11MMThBAJFisXwWQjZAzcNIptt0=";
+    hash = "sha256-d1d3WgUVamrYWVosljQiEPZGNNDldtM1YwZhxseX4+w=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WH6cQa6DChkUtqh+irIz2hJd5/RW/oln+TZPHunEmNk=";
+  cargoHash = "sha256-YhdwCNTbBphWugguoWQqrGf2fRB5Jv40MElW6hbcxtk=";
 
   nativeBuildInputs =
     [

pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix

@@ -2,7 +2,9 @@
   stdenv,
   lib,
   fetchFromGitLab,
+  fetchpatch,
   gitUpdater,
+  nixosTests,
   testers,
   cmake,
   cmake-extras,
@@ -31,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-content-hub";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-content-hub";
     rev = finalAttrs.version;
-    hash = "sha256-eA5oCoAZB7fWyWm0Sy6wXh0EW+h76bdfJ2dotr7gUC0=";
+    hash = "sha256-S/idjDdcRvqZqKmflkYJyQckz4/9k/8JY6eRDACk9Ag=";
   };
 
   outputs = [
@@ -47,9 +49,18 @@ stdenv.mkDerivation (finalAttrs: {
     "examples"
   ];
 
+  patches = [
+    # Remove when version > 2.1.0
+    (fetchpatch {
+      name = "0001-lomiri-content-hub-treewide-Add-missing-LDM-include-dirs.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-content-hub/-/commit/cdd3371714c183d4caf166157082288c022bb98d.patch";
+      hash = "sha256-Uubd425T+0KxPR9lJW6+ejO2fFzcDwEIpJATSZ9jYD4=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace import/*/Content/CMakeLists.txt \
-      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt\''${QT_VERSION_MAJOR}/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
 
     # Look for peer files in running system
     substituteInPlace src/com/lomiri/content/service/registry-updater.cpp \
@@ -101,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "ENABLE_DOC" true)
     (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" true) # in case something still depends on it
@@ -145,7 +157,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+      # Tests content-hub functionality, up to the point where one app receives a content exchange request
+      # from another and changes into a mode to pick the content to send
+      vm = nixosTests.lomiri.desktop-appinteractions;
+    };
     updateScript = gitUpdater { };
   };