Merge branch 'staging-next' into staging

Co-authored-by: haruki7049 <tontonkirikiri@gmail.com>

nixos/lib/testing/network.nix

@@ -13,6 +13,7 @@ let
     nameValuePair
     optionalAttrs
     optionalString
+    optionals
     range
     toLower
     types
@@ -95,16 +96,18 @@ let
           name: config:
           let
             hostnames =
-              optionalString (
-                config.networking.domain != null
-              ) "${config.networking.hostName}.${config.networking.domain} "
-              + "${config.networking.hostName}\n";
+              [
+                "${config.networking.hostName}"
+              ]
+              ++ optionals (config.networking.domain != null) [
+                "${config.networking.hostName}.${config.networking.domain}"
+              ];
           in
           optionalAttrs (config.networking.primaryIPAddress != "") {
-            "${config.networking.primaryIPAddress}" = [ hostnames ];
+            "${config.networking.primaryIPAddress}" = hostnames;
           }
           // optionalAttrs (config.networking.primaryIPv6Address != "") {
-            "${config.networking.primaryIPv6Address}" = [ hostnames ];
+            "${config.networking.primaryIPv6Address}" = hostnames;
           }
         ) nodes;
 

nixos/modules/services/networking/dhcpcd.nix

@@ -6,7 +6,13 @@
 }:
 let
 
-  dhcpcd = if !config.boot.isContainer then pkgs.dhcpcd else pkgs.dhcpcd.override { udev = null; };
+  dhcpcd =
+    if !config.boot.isContainer then
+      pkgs.dhcpcd
+    else
+      pkgs.dhcpcd.override {
+        withUdev = false;
+      };
 
   cfg = config.networking.dhcpcd;
 

nixos/modules/services/networking/pihole-ftl-setup-script.nix

@@ -26,7 +26,7 @@ in
   if [ ! -f '${cfg.stateDirectory}'/gravity.db ]; then
     $pihole -g
     # Send SIGRTMIN to FTL, which makes it reload the database, opening the newly created one
-    ${pkgs.procps}/bin/kill -s SIGRTMIN $(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})
+    ${lib.getExe' pkgs.procps "kill"} -s SIGRTMIN $(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})
   fi
 
   source ${pihole}/usr/share/pihole/advanced/Scripts/api.sh
@@ -61,7 +61,7 @@ in
   for i in 1 2 3; do
     (TestAPIAvailability) && break
     echo "Retrying API shortly..."
-    ${pkgs.coreutils}/bin/sleep .5s
+    ${lib.getExe' pkgs.coreutils "sleep"} .5s
   done;
 
   LoginAPI

pkgs/applications/editors/jetbrains/bin/linux.nix

@@ -119,33 +119,43 @@ lib.makeOverridable mkDerivation (
       jdk=${jdk.home}
       item=${desktopItem}
 
-      launcher="$out/$pname/bin/${loName}"
-      if [ -e "$launcher" ]; then
-        rm "$launcher".sh # We do not wrap the old script-style launcher anymore.
-      else
-        launcher+=.sh
+      needsWrapping=()
+
+      if [ -f "$out/$pname/bin/${loName}" ]; then
+        needsWrapping+=("$out/$pname/bin/${loName}")
+      fi
+      if [ -f "$out/$pname/bin/${loName}.sh" ]; then
+        needsWrapping+=("$out/$pname/bin/${loName}.sh")
       fi
 
-      wrapProgram  "$launcher" \
-        --prefix PATH : "${
-          lib.makeBinPath [
-            jdk
-            coreutils
-            gnugrep
-            which
-            git
-          ]
-        }" \
-        --suffix PATH : "${lib.makeBinPath [ python3 ]}" \
-        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath extraLdPath}" \
-        ${lib.concatStringsSep " " extraWrapperArgs} \
-        --set-default JDK_HOME "$jdk" \
-        --set-default ANDROID_JAVA_HOME "$jdk" \
-        --set-default JAVA_HOME "$jdk" \
-        --set-default JETBRAINS_CLIENT_JDK "$jdk" \
-        --set-default ${hiName}_JDK "$jdk" \
-        --set-default LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive" \
-        --set-default ${vmoptsIDE}_VM_OPTIONS ${vmoptsFile}
+      for launcher in "''${needsWrapping[@]}"
+      do
+        wrapProgram  "$launcher" \
+          --prefix PATH : "${
+            lib.makeBinPath [
+              jdk
+              coreutils
+              gnugrep
+              which
+              git
+            ]
+          }" \
+          --suffix PATH : "${lib.makeBinPath [ python3 ]}" \
+          --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath extraLdPath}" \
+          ${lib.concatStringsSep " " extraWrapperArgs} \
+          --set-default JDK_HOME "$jdk" \
+          --set-default ANDROID_JAVA_HOME "$jdk" \
+          --set-default JAVA_HOME "$jdk" \
+          --set-default JETBRAINS_CLIENT_JDK "$jdk" \
+          --set-default ${hiName}_JDK "$jdk" \
+          --set-default LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive" \
+          --set-default ${vmoptsIDE}_VM_OPTIONS ${vmoptsFile}
+      done
+
+      launcher="$out/$pname/bin/${loName}"
+      if [ ! -e "$launcher" ]; then
+        launcher+=.sh
+      fi
 
       ln -s "$launcher" $out/bin/$pname
       rm -rf $out/$pname/plugins/remote-dev-server/selfcontained/

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1181,8 +1181,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "8.3.4";
-          hash = "sha256-rZ/xYe5Ng532XhLCzCtVmcYTDekAaMu3vLnvTagFupE=";
+          version = "8.3.5";
+          hash = "sha256-ld8M46LGF5nJEuk0iexOVnhiuX3mcNUnqnXNZE9Bl+4=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -3936,8 +3936,8 @@ let
         mktplcRef = {
           name = "prisma";
           publisher = "Prisma";
-          version = "6.8.2";
-          hash = "sha256-jortg6SQId1373+4p3Tbej2Q1oz2UhUf+o8xb4PmOVM=";
+          version = "6.9.0";
+          hash = "sha256-xXmGPQs/tmYLkyzRstr34X43P64BrTR+suwKTYtd/ac=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.17.7";
-    hash = "sha256-Sn3yyt1xMYYvUQKrY0YliCKS46g5VfvFZPgeSoc1c8E=";
+    version = "3.17.11";
+    hash = "sha256-z98AhLZwAR31u4GfEzzd41sCQ3kSu5xJTKDZQZ3ZZYQ=";
   };
 
   meta = {

pkgs/by-name/av/avalanchego/package.nix

@@ -1,37 +1,36 @@
 {
-  buildGoModule,
+  buildGo123Module,
   fetchFromGitHub,
   lib,
   nix-update-script,
-  stdenv,
 }:
 
-buildGoModule rec {
+buildGo123Module (finalAttrs: {
   pname = "avalanchego";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = "avalanchego";
-    tag = "v${version}";
-    hash = "sha256-elbY0KNsOmKSTX61nps2tjIFTJH5Nnqmwq6mWwd88aE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t6KruPHt51wJ4aJaCG/8tuwKYtaifHvQ3z9oVknNS4E=";
   };
 
   # https://github.com/golang/go/issues/57529
   proxyVendor = true;
 
-  vendorHash = "sha256-HRhgnf6vHBrJTHspH+HwR3g5o63i+dCm7kPuBKdSV8s=";
+  vendorHash = "sha256-iyx9k8mPPOwpHo9lEdNPf0sQHxbKbNTVLUZrPYY8dWM=";
 
   subPackages = [ "main" ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/ava-labs/avalanchego/version.GitCommit=${version}"
+    "-X github.com/ava-labs/avalanchego/version.GitCommit=${finalAttrs.version}"
   ];
 
   postInstall = ''
-    mv $out/bin/{main,${pname}}
+    mv $out/bin/{main,avalanchego}
   '';
 
   passthru.updateScript = nix-update-script { };
@@ -39,7 +38,7 @@ buildGoModule rec {
   meta = {
     description = "Go implementation of an Avalanche node";
     homepage = "https://github.com/ava-labs/avalanchego";
-    changelog = "https://github.com/ava-labs/avalanchego/releases/tag/v${version}";
+    changelog = "https://github.com/ava-labs/avalanchego/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       urandom
@@ -47,4 +46,4 @@ buildGoModule rec {
     ];
     mainProgram = "avalanchego";
   };
-}
+})

pkgs/by-name/cl/clapper-enhancers/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clapper-enhancers";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "Rafostar";
     repo = "clapper-enhancers";
     tag = finalAttrs.version;
-    hash = "sha256-CUfTz+YvliJXiv/nsdrpDVFSblqoSW7js8vAtJ9u5vM=";
+    hash = "sha256-uj0ZZrS2Y896EDWeBsU3Q3S2kFdEg5FQkBOcI97FFWc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clapper/package.nix

@@ -29,6 +29,11 @@ stdenvNoCC.mkDerivation {
 
     mkdir -p $out
     lndir $src $out
+    dbusfile=share/dbus-1/services/com.github.rafostar.Clapper.service
+    rm $out/$dbusfile
+    cp $src/$dbusfile $out/$dbusfile
+    substituteInPlace $out/$dbusfile \
+      --replace-fail $src/bin/clapper $out/bin/clapper
 
     runHook postInstall
   '';

pkgs/by-name/cu/curlMinimal/fix-add_handle-resizing.patch

@@ -1,209 +0,0 @@
-From d16ccbd55de80c271fe822f4ba8b6271fd9166ff Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Wed, 28 May 2025 14:04:31 +0200
-Subject: [PATCH] multi: fix add_handle resizing
-
-Due to someone being stupid, the resizing of the multi's transfer
-table was actually shrinking it. Oh my.
-
-Add test751 to reproduce, add code assertion.
-
-Fixes #17473
-Reported-by: Jeroen Ooms
-Closes #17475
----
- lib/multi.c                |  3 +-
- tests/data/Makefile.am     |  2 +-
- tests/data/test751         | 33 ++++++++++++++
- tests/libtest/Makefile.inc |  4 ++
- tests/libtest/lib751.c     | 92 ++++++++++++++++++++++++++++++++++++++
- 5 files changed, 132 insertions(+), 2 deletions(-)
- create mode 100644 tests/data/test751
- create mode 100644 tests/libtest/lib751.c
-
-diff --git a/lib/multi.c b/lib/multi.c
-index 792b30515d8b..b744e03ae52f 100644
---- a/lib/multi.c
-+++ b/lib/multi.c
-@@ -347,7 +347,8 @@ static CURLMcode multi_xfers_add(struct Curl_multi *multi,
-   if(unused <= min_unused) {
-      /* make it a 64 multiple, since our bitsets frow by that and
-       * small (easy_multi) grows to at least 64 on first resize. */
--    unsigned int newsize = ((capacity + min_unused) + 63) / 64;
-+    unsigned int newsize = (((capacity + min_unused) + 63) / 64) * 64;
-+    DEBUGASSERT(newsize > capacity);
-     /* Grow the bitsets first. Should one fail, we do not need
-      * to downsize the already resized ones. The sets continue
-      * to work properly when larger than the table, but not
-diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
-index e8f9e12be71e..16bb57db8e69 100644
---- a/tests/data/Makefile.am
-+++ b/tests/data/Makefile.am
-@@ -107,7 +107,7 @@ test709 test710 test711 test712 test713 test714 test715 test716 test717 \
- test718 test719 test720 test721 test722 test723 test724 test725 test726 \
- test727 test728 test729 test730 test731 test732 test733 test734 test735 \
- test736 test737 test738 test739 test740 test741 test742 test743 test744 \
--test745 test746 test747 test748 test749 test750 \
-+test745 test746 test747 test748 test749 test750 test751 \
- \
- test780 test781 test782 test783 test784 test785 test786 test787 test788 \
- test789 test790 test791 \
-diff --git a/tests/data/test751 b/tests/data/test751
-new file mode 100644
-index 000000000000..ffc6df512f83
---- /dev/null
-+++ b/tests/data/test751
-@@ -0,0 +1,33 @@
-+<testcase>
-+<info>
-+<keywords>
-+MULTI
-+</keywords>
-+</info>
-+<reply>
-+<data>
-+</data>
-+</reply>
-+
-+# Client-side
-+<client>
-+<server>
-+none
-+</server>
-+# tool is what to use instead of 'curl'
-+<tool>
-+lib%TESTNUMBER
-+</tool>
-+
-+<name>
-+multi - add many easy handles
-+</name>
-+<command>
-+</command>
-+</file>
-+</client>
-+
-+# Verify data after the test has been "shot"
-+<verify>
-+</verify>
-+</testcase>
-diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
-index faf7eacdf6af..002e7ab5470d 100644
---- a/tests/libtest/Makefile.inc
-+++ b/tests/libtest/Makefile.inc
-@@ -50,6 +50,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq                     \
-  lib659 lib661 lib666 lib667 lib668 \
-  lib670 lib671 lib672 lib673 lib674 lib676 lib677 lib678 lib694 lib695   \
-  lib696 \
-+ lib751 \
-  lib1156 \
-  lib1301 \
-  lib1308 \
-@@ -349,6 +350,9 @@ lib695_SOURCES = lib695.c $(SUPPORTFILES)
- lib696_SOURCES = lib556.c $(SUPPORTFILES) $(WARNLESS)
- lib696_CPPFLAGS = $(AM_CPPFLAGS) -DLIB696
- 
-+lib751_SOURCES = lib751.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
-+lib751_LDADD = $(TESTUTIL_LIBS)
-+
- lib1301_SOURCES = lib1301.c $(SUPPORTFILES) $(TESTUTIL)
- lib1301_LDADD = $(TESTUTIL_LIBS)
- 
-diff --git a/tests/libtest/lib751.c b/tests/libtest/lib751.c
-new file mode 100644
-index 000000000000..ab2f923b959d
---- /dev/null
-+++ b/tests/libtest/lib751.c
-@@ -0,0 +1,92 @@
-+/***************************************************************************
-+ *                                  _   _ ____  _
-+ *  Project                     ___| | | |  _ \| |
-+ *                             / __| | | | |_) | |
-+ *                            | (__| |_| |  _ <| |___
-+ *                             \___|\___/|_| \_\_____|
-+ *
-+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-+ *
-+ * This software is licensed as described in the file COPYING, which
-+ * you should have received as part of this distribution. The terms
-+ * are also available at https://curl.se/docs/copyright.html.
-+ *
-+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
-+ * copies of the Software, and permit persons to whom the Software is
-+ * furnished to do so, under the terms of the COPYING file.
-+ *
-+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-+ * KIND, either express or implied.
-+ *
-+ * SPDX-License-Identifier: curl
-+ *
-+ ***************************************************************************/
-+#include "test.h"
-+
-+#include "testutil.h"
-+#include "warnless.h"
-+#include "memdebug.h"
-+
-+#define TEST_HANG_TIMEOUT 60 * 1000
-+
-+/*
-+ * Get a single URL without select().
-+ */
-+
-+CURLcode test(char *URL)
-+{
-+  CURL *easies[1000];
-+  CURLM *m;
-+  CURLcode res = CURLE_FAILED_INIT;
-+  CURLMcode mres;
-+  int i;
-+
-+  (void)URL;
-+  memset(easies, 0, sizeof(easies));
-+
-+  curl_global_init(CURL_GLOBAL_DEFAULT);
-+  m = curl_multi_init();
-+  if(!m) {
-+    res = CURLE_OUT_OF_MEMORY;
-+    goto test_cleanup;
-+  }
-+
-+  for(i = 0; i < 1000; i++) {
-+    CURL *e = curl_easy_init();
-+    if(!e) {
-+      res = CURLE_OUT_OF_MEMORY;
-+      goto test_cleanup;
-+    }
-+    easies[i] = e;
-+
-+    res = curl_easy_setopt(e, CURLOPT_URL, "https://www.example.com/");
-+    if(!res)
-+      res = curl_easy_setopt(e, CURLOPT_VERBOSE, 1L);
-+    if(res)
-+      goto test_cleanup;
-+
-+    mres = curl_multi_add_handle(m, e);
-+    if(mres != CURLM_OK) {
-+      printf("MULTI ERROR: %s\n", curl_multi_strerror(mres));
-+      res = CURLE_FAILED_INIT;
-+      goto test_cleanup;
-+    }
-+  }
-+
-+test_cleanup:
-+
-+  if(res)
-+    printf("ERROR: %s\n", curl_easy_strerror(res));
-+
-+  for(i = 0; i < 1000; i++) {
-+    if(easies[i]) {
-+      curl_multi_add_handle(m, easies[i]);
-+      curl_easy_cleanup(easies[i]);
-+      easies[i] = NULL;
-+    }
-+  }
-+  curl_multi_cleanup(m);
-+  curl_global_cleanup();
-+
-+  return res;
-+}

pkgs/by-name/cu/curlMinimal/package.nix

@@ -91,7 +91,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.14.0";
+  version = "8.14.1";
 
   src = fetchurl {
     urls = [
@@ -100,16 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-s2NM/FOMcsnGynlO9Mc9f9vRceje4tuDfYOl5FIxACo=";
+    hash = "sha256-9GGaHiR0xLv+3IinwhkSCcgzS0j6H05T/VhMwS6RIN0=";
   };
 
-  patches = [
-    # Backport of https://github.com/curl/curl/commit/d16ccbd55de80c271fe822f4ba8b6271fd9166ff
-    # Fixes a regression introduced in 8.14.0
-    # Remove with 8.14.1
-    ./fix-add_handle-resizing.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

pkgs/by-name/dq/dqlite/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   autoreconfHook,
   pkg-config,
   file,
@@ -22,6 +23,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-7ou077ozbpH21PcvEEcprr4UYJ/X398Ph9dh5C3YyBQ=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/canonical/dqlite/commit/be453628ce782167f6652c055e600908e2641da7.patch?full_index=1";
+      hash = "sha256-5DvZ1TW6QmE/heh/RjV395gSgwKM5XnqxqznfYQPC/Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     file

pkgs/by-name/ea/easytier/package.nix

@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "easytier";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "EasyTier";
     repo = "EasyTier";
     tag = "v${version}";
-    hash = "sha256-F///8C7lyJZj5+u80nauDdrPFrEE40s0DeNzQeblImw=";
+    hash = "sha256-urcwzM5nup3+guvSngw+I2QBjmjSc/WV7BWFpISVDBg=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-f64tOU8AKC14tqX9Q3MLa7/pmIuI4FeFGOct8ZTAe+k=";
+  cargoHash = "sha256-rqL8tnLPeXK2BLvSFrzMRvtJAqHgOqNh4fE0w8c0ThU=";
 
   nativeBuildInputs = [
     protobuf

pkgs/by-name/fa/fabric-ai/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.195";
+  version = "1.4.196";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-83LlJ697CyW8Hmp6cB3RqeVk1OGuF6TUHcfKLqjgLPk=";
+    hash = "sha256-g2f8xpS+KA1USt7lArodTo7m7OXnzew2LSFKeVclQOE=";
   };
 
   vendorHash = "sha256-xfNvmhHNYpanhZKT9o8kImzw4gzigpgc8ri9O1iOqwc=";

pkgs/by-name/gr/gridtracker2/package.nix

@@ -0,0 +1,149 @@
+{
+  lib,
+  stdenv,
+  copyDesktopItems,
+  buildNpmPackage,
+  electron_35,
+  fetchFromGitLab,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  at-spi2-atk,
+  gtk3,
+  libappindicator-gtk3,
+  libnotify,
+  libsecret,
+  libuuid,
+  nss,
+  xdg-utils,
+  xorg,
+}:
+let
+  version = "2.250507.0";
+  electron = electron_35;
+in
+buildNpmPackage (finalAttrs: {
+  pname = "gridtracker2";
+  inherit version;
+
+  src = fetchFromGitLab {
+    owner = "gridtracker.org";
+    repo = "gridtracker2";
+    tag = "v${version}";
+    hash = "sha256-8JFEVGy3Wz94FUK8V+JF+HHKBngT3VvwDBh+O2Bin6E=";
+  };
+
+  npmDepsHash = "sha256-ioocL1/k3aDmgVwxS09PFbMmteNrGncQz2yz7HUPX90=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    copyDesktopItems
+  ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = true;
+
+  makeCacheWritable = true;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "GridTracker2";
+      desktopName = "GridTracker2";
+      exec = "gridtracker2 %U";
+      terminal = false;
+      type = "Application";
+      icon = "gridtracker2";
+      startupWMClass = "GridTracker2";
+      comment = "A warehouse of amateur radio information";
+      categories = [
+        "HamRadio"
+        "Network"
+      ];
+    })
+  ];
+
+  postPatch = ''
+    install -Dvm644 ${./package-lock.json} package-lock.json
+  '';
+
+  buildPhase =
+    ''
+      runHook preBuild
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # electronDist needs to be modifiable on Darwin
+      cp -r ${electron.dist} electron-dist
+      chmod -R u+w electron-dist
+
+      # Disable code signing during build on macOS.
+      # https://github.com/electron-userland/electron-builder/blob/fa6fc16/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
+      export CSC_IDENTITY_AUTO_DISCOVERY=false
+
+      npm exec electron-builder -- \
+        --dir \
+        -c.electronDist=electron-dist \
+        -c.electronVersion=${electron.version}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      npm exec electron-builder -- \
+        --dir \
+        -c.electronDist=${electron.dist} \
+        -c.electronVersion=${electron.version}
+    ''
+    + ''
+      runHook postBuild
+    '';
+
+  runtimeInputs =
+    [
+      at-spi2-atk
+      gtk3
+      libnotify
+      libsecret
+      libuuid
+      nss
+      xdg-utils
+      xorg.libXScrnSaver
+      xorg.libXtst
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      libappindicator-gtk3
+    ];
+
+  installPhase =
+    ''
+      runHook preInstall
+
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      install -Dvm644 -t "$out/share/gridtracker2/resources" \
+       ./dist/linux*/resources/*
+      install -Dvm644 -t "$out/share/gridtracker2/locales" \
+        ./dist/linux*/locales/*
+      install -Dvm644 ./resources/icon.png \
+        "$out/share/pixmaps/gridtracker2.png"
+
+      makeWrapper ${lib.getExe electron} $out/bin/gridtracker2 \
+        --add-flags $out/share/gridtracker2/resources/app.asar \
+        --prefix PATH : "${lib.makeBinPath finalAttrs.runtimeInputs}" \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.runtimeInputs}" \
+        --add-flags "--no-sandbox --disable-gpu-sandbox" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --inherit-argv0
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications $out/bin
+      cp -r dist/mac*/GridTracker2.app $out/Applications
+      ln -s $out/Applications/GridTracker2.app/Contents/MacOS/GridTracker2 $out/bin/gridtracker2
+    ''
+    + ''
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "Warehouse of amateur radio information";
+    homepage = "https://gridtracker.org/";
+    license = lib.licenses.bsd3;
+    platforms = electron.meta.platforms;
+    maintainers = with lib.maintainers; [ Cryolitia ];
+    mainProgram = "gridtracker2";
+  };
+})

pkgs/by-name/mi/mitra/package.nix

@@ -6,18 +6,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mitra";
-  version = "4.3.1";
+  version = "4.4.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "silverpill";
     repo = "mitra";
     rev = "v${version}";
-    hash = "sha256-SUcapWfsIqohFsZY1Bpce5txLe2DtpgAGBJKTUwdzVI=";
+    hash = "sha256-ZonEMbafZWfURW7WKUAVmDq7bvi7oXBpKVudbrTF6eE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-B0Ba4ZGTw+FJLcXSy+VfKrp5hqGWoW3ugfnkDXFDlok=";
+  cargoHash = "sha256-n96B51fVkJcBDwcbYHNP6ZWWdU8fu0a0Y72IVbNAAMQ=";
 
   # require running database
   doCheck = false;

pkgs/by-name/pi/pihole-ftl/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pihole-ftl";
-  version = "6.1";
+  version = "6.2.2";
 
   src = fetchFromGitHub {
     owner = "pi-hole";
     repo = "FTL";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b3/kyDQa6qDK2avvDObWLvwUpAn6TFr1ZBdQC9AZWa4=";
+    hash = "sha256-VFoltLlzKJCeJWQ2SzbvQxcYNBhZtWqFjzO3rjuBAdE=";
   };
 
   nativeBuildInputs = [
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "execv" "execvp"
 
     substituteInPlace src/database/network-table.c \
-      --replace-fail "ip neigh show" "${iproute2}/bin/ip neigh show" \
-      --replace-fail "ip address show" "${iproute2}/bin/ip address show"
+      --replace-fail "ip neigh show" "${lib.getExe' iproute2 "ip"} neigh show" \
+      --replace-fail "ip address show" "${lib.getExe' iproute2 "ip"} address show"
   '';
 
   installPhase = ''
@@ -77,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Pi-hole FTL engine";
     homepage = "https://github.com/pi-hole/FTL";
+    changelog = "https://github.com/pi-hole/FTL/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.eupl12;
     maintainers = with lib.maintainers; [ averyvigolo ];
     platforms = lib.platforms.linux;

pkgs/by-name/po/podman-tui/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "podman-tui";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t9VhDl4pBW5H5RhpskU8Us9NxpPJmyishKROvbAc2V0=";
+    hash = "sha256-U+oQUdqOhF6p52bEvMBqoxn4Z5WexsYe97XFOEMSFpk=";
   };
 
   vendorHash = null;

pkgs/by-name/ro/rofi-calc/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-calc";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "rofi-calc";
     rev = "v${version}";
-    sha256 = "sha256-YDij0j/AOl69FlsGfolzv8lI+iQfDmJrXo2duTIoMRA=";
+    sha256 = "sha256-1Sdi7SN5ZhBJB5qyqDZQC5QcBz0Fydb1az8yDSuTlnE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/rq/rqlite/package.nix

@@ -4,18 +4,18 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "rqlite";
-  version = "8.37.1";
+  version = "8.37.4";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = "rqlite";
-    rev = "v${version}";
-    sha256 = "sha256-GouVEUqxqNUtc9jyqhfLiX2M+I4ykQRsmbEvWmOaINc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PMoQg3QjG0hyWKWIf5JIj7X9XbjpHpy1Hwo9DMsutW0=";
   };
 
-  vendorHash = "sha256-jvZ2ZRA/DkjDNnYauS9sJLE8KROS197kSeNVZ363Htk=";
+  vendorHash = "sha256-3ZoMpmWOf3wIK0R1mY2GRzPA+Xb6YIdk+hLfzsC84/U=";
 
   subPackages = [
     "cmd/rqlite"
@@ -28,16 +28,17 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/rqlite/rqlite/cmd.Version=${src.rev}"
+    "-X github.com/rqlite/rqlite/cmd.Version=${finalAttrs.version}"
   ];
 
   # Tests are in a different subPackage which fails trying to access the network
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Lightweight, distributed relational database built on SQLite";
     homepage = "https://github.com/rqlite/rqlite";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dit7ya ];
+    changelog = "https://github.com/rqlite/rqlite/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dit7ya ];
   };
-}
+})

pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix

@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-05-12";
+  version = "2025-06-02";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Y6/1xr08KXj+KQVJgLO7LhwsNGE2ooFdTR9GoAgAwKk=";
+  cargoHash = "sha256-ewV/rccDgRR/iMSRihkG/1aZyGHoobeX2LQItdzCy68=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-h3LQYZgyv2l3U7r+mcsrEOGRldaK0zJFwAAva4hV/6g=";
+    hash = "sha256-VwSuuRF4NvAoeHZJRRlX8zAFZ+nZyuiIvmVqBAX0Bcg=";
   };
 
   cargoBuildFlags = [

pkgs/by-name/ru/rutorrent/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rutorrent";
-  version = "5.2.6";
+  version = "5.2.8";
 
   src = fetchFromGitHub {
     owner = "Novik";
     repo = "ruTorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AoCS7LiCKB1lGvXaabXk8dqsqU9WL95XuEcddvl22ug=";
+    hash = "sha256-+HvWjValI80lUJJo5ohDMU1NUnmkD6Utif4oOnUKZyg=";
   };
 
   installPhase = ''

pkgs/by-name/sh/showmethekey/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "showmethekey";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     owner = "AlynxZhou";
     repo = "showmethekey";
     tag = "v${version}";
-    hash = "sha256-lLlNWMqVrtXVfXwObCjtmcOOQ2xfe7gK+izmxr4crlc=";
+    hash = "sha256-vVcP+m6rZgNti/NEk4fQpZ8bkv4z13NIZN1p/eVmBI4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/si/siyuan/package.nix

@@ -35,20 +35,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.1.31";
+  version = "3.1.32";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-l9FAGZzu8z5Q4gRoaZ8Z8tYkBEw9Yq9mfmWOKO39KLI=";
+    hash = "sha256-xhiQe9lopKhruwUSTi2GHQ9NPlkaezl1j70z/KOnZEc=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-uREgNsDGFLzkOBkO2D2/vbJJ8A2rfy0nK2Dx/OvWf9c=";
+    vendorHash = "sha256-GRKBZe9cd2/sYstiCD/f/ckF0G1GYBPBc8FSFmjw3Mo=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       postPatch
       ;
-    hash = "sha256-U8n9FLwJqBq16CTmiIDSh0u4lguSn0rF4jUkU25iu98=";
+    hash = "sha256-PnuU4TWG10JP69BdGz+Uqz+WPUJU/Rb+Hicxy0+gB2Q=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

pkgs/by-name/sv/svtplay-dl/package.nix

@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   installShellFiles,
+  nix-update-script,
   python3Packages,
   perl,
   ffmpeg,
@@ -21,7 +22,7 @@ let
     requests-mock
     ;
 
-  version = "4.109";
+  version = "4.113";
 
 in
 
@@ -34,7 +35,7 @@ buildPythonApplication {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-ApoAcYaqPIurgDM+ctyyx9+OyUmhJ+1fjdGj0ln6v7w=";
+    hash = "sha256-Yiw76PDnOpK4HAnO9VqmvmqdT4PdxAgu1MwbZ15pEyM=";
   };
 
   build-system = [ setuptools ];
@@ -76,6 +77,8 @@ buildPythonApplication {
     $out/bin/svtplay-dl --help > /dev/null
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://github.com/spaam/svtplay-dl";
     description = "Command-line tool to download videos from svtplay.se and other sites";

pkgs/by-name/ue/uefi-firmware-parser/package.nix

@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
     python3.pkgs.wheel
   ];
 
-  dependencies = [ python3.pkgs.future ];
+  pythonRemoveDeps = [ "future" ];
 
   pythonImportsCheck = [ "uefi_firmware" ];
 

pkgs/by-name/ve/vectorcode/package.nix

@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
   dependencies =
     with python3Packages;
     [
-      chromadb
+      chromadb_0
       colorlog
       httpx
       json5

pkgs/by-name/wa/wastebin/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wastebin";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "matze";
     repo = "wastebin";
     rev = version;
-    hash = "sha256-7+Ufin68gMQtKv8SC8Gmn0Ra2qpumsKYgpURTkVqzt8=";
+    hash = "sha256-emhPa4VuXOjTZ6AU/4S8acjjz68byBg4x4MW0M5hvD4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-j9Wpo3N1kwCvjDEqmn87rGSYFVw1ZGkSps72zVpXNls=";
+  cargoHash = "sha256-Ub6BQhrLkIoOM9XFVIfm6mI4pP1Rloo3DnZXB8C4CjE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/compilers/ghc/common-make-native-bignum.nix

@@ -364,6 +364,18 @@ stdenv.mkDerivation (
           else
             ./Cabal-3.2-3.4-paths-fix-cycle-aarch64-darwin.patch
         )
+      ]
+      # Fixes stack overrun in rts which crashes an process whenever
+      # freeHaskellFunPtr is called with nixpkgs' hardening flags.
+      # https://gitlab.haskell.org/ghc/ghc/-/issues/25485
+      # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13599
+      # TODO: patch doesn't apply for < 9.4, but may still be necessary?
+      ++ lib.optionals (lib.versionAtLeast version "9.4") [
+        (fetchpatch {
+          name = "ghc-rts-adjustor-fix-i386-stack-overrun.patch";
+          url = "https://gitlab.haskell.org/ghc/ghc/-/commit/39bb6e583d64738db51441a556d499aa93a4fc4a.patch";
+          sha256 = "0w5fx413z924bi2irsy1l4xapxxhrq158b5gn6jzrbsmhvmpirs0";
+        })
       ];
 
     postPatch = "patchShebangs .";
@@ -593,6 +605,13 @@ stdenv.mkDerivation (
     # Hydra which already warrants a significant speedup
     requiredSystemFeatures = [ "big-parallel" ];
 
+    # Install occasionally fails due to a race condition in minimal builds.
+    # > /nix/store/wyzpysxwgs3qpvmylm9krmfzh2plicix-coreutils-9.7/bin/install -c -m 755 -d "/nix/store/xzb3390rhvhg2a0cvzmrvjspw1d8nf8h-ghc-riscv64-unknown-linux-gnu-9.4.8/bin"
+    # > install: cannot create regular file '/nix/store/xzb3390rhvhg2a0cvzmrvjspw1d8nf8h-ghc-riscv64-unknown-linux-gnu-9.4.8/lib/ghc-9.4.8': No such file or directory
+    preInstall = ''
+      mkdir -p "$out/lib/${passthru.haskellCompilerName}"
+    '';
+
     postInstall =
       ''
         settingsFile="$out/lib/${targetPrefix}${passthru.haskellCompilerName}/settings"

pkgs/development/libraries/libxml2/default.nix

@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  fetchurl,
+  fetchFromGitLab,
   pkg-config,
   autoreconfHook,
   libintl,
@@ -46,9 +46,12 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-beVcrMjCvHWPLvb5PDE8sw5N1dhKxdPHzL2TRNjMaDM=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libxml2";
+    rev = "5133461b05f0f66e6c5b0fecd5f29dc5cd967302"; # some security- and bugfixes ahead of 2.14
+    hash = "sha256-xLRey6mRsRhgfASIQWOTofcQcLU0Daeg33pxGN0l66I=";
   };
 
   strictDeps = true;

pkgs/development/ocaml-modules/bencode/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  ounit,
+  qcheck,
+}:
+
+buildDunePackage rec {
+  pname = "bencode";
+  version = "2.0";
+  minimalOCamlVersion = "4.02.0";
+
+  src = fetchFromGitHub {
+    owner = "rgrinberg";
+    repo = "bencode";
+    tag = version;
+    hash = "sha256-sEMS9oBOPeFX1x7cHjbQhCD2QI5yqC+550pPqqMsVws=";
+  };
+
+  doCheck = true;
+  checkInputs = [
+    ounit
+    qcheck
+  ];
+
+  meta = {
+    description = "Bencode (.torrent file format) reader/writer in OCaml ";
+    homepage = "https://github.com/rgrinberg/bencode";
+    changelog = "https://github.com/rgrinberg/bencode/blob/${version}/Changelog.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/cbor/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  ocplib-endian,
+  yojson,
+}:
+
+buildDunePackage rec {
+  pname = "cbor";
+  version = "0.5";
+
+  minimalOCamlVersion = "4.07.0";
+
+  src = fetchurl {
+    url = "https://github.com/ygrek/ocaml-cbor/releases/download/${version}/ocaml-cbor-${version}.tar.gz";
+    hash = "sha256-4mpm/fv9X5uFRQO8XqBhOpxYwZreEtJ3exIwN6YulKM=";
+  };
+
+  propagatedBuildInputs = [
+    ocplib-endian
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    yojson
+  ];
+
+  meta = {
+    description = "CBOR encoder/decoder (RFC 7049) - native OCaml implementation";
+    homepage = "https://github.com/ygrek/ocaml-cbor";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-bencode/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  bencode,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-bencode";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    bencode
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Bencode backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-cbor/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  cbor,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-cbor";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    cbor
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "CBOR backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-ezjsonm/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  ezjsonm,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-ezjsonm";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    ezjsonm
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Ezjsonm backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-ezxmlm/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  ezxmlm,
+  containers,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-ezxmlm";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    ezxmlm
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+  ];
+
+  meta = {
+    description = "Ezxmlm backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-jsonaf/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  jsonaf ? null,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-jsonaf";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.11.0";
+
+  propagatedBuildInputs = [
+    decoders
+    jsonaf
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Jsonaf backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-jsonm/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  jsonm,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-jsonm";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    jsonm
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Jsonm backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-msgpck/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  msgpck,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-msgpck";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    msgpck
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Msgpck backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-sexplib/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  sexplib,
+  sexplib0,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-sexplib";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    sexplib
+    sexplib0
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "sexplib backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders-yojson/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDunePackage,
+  decoders,
+  yojson,
+  containers,
+  ounit2,
+}:
+
+buildDunePackage rec {
+  pname = "decoders-yojson";
+
+  # sub-package built separately from the same source
+  inherit (decoders) src version;
+
+  minimalOCamlVersion = "4.03.0";
+
+  propagatedBuildInputs = [
+    decoders
+    yojson
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    ounit2
+  ];
+
+  meta = {
+    description = "Yojson backend for decoders";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/ocaml-modules/decoders/default.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  containers,
+}:
+
+buildDunePackage rec {
+  pname = "decoders";
+  version = "1.0.0";
+
+  minimalOCamlVersion = "4.03.0";
+
+  src = fetchurl {
+    url = "https://github.com/mattjbray/ocaml-decoders/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-R/55xBAtD3EO/zzq7zExANnfPHlFg00884o5dCpXNZc=";
+  };
+
+  doCheck = true;
+  checkInputs = [
+    containers
+  ];
+
+  meta = {
+    description = "Elm-inspired decoders for Ocaml";
+    homepage = "https://github.com/mattjbray/ocaml-decoders";
+    changelog = "https://github.com/mattjbray/ocaml-decoders/blob/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}

pkgs/development/python-modules/chromadb/0.nix

@@ -0,0 +1,220 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools-scm,
+  setuptools,
+
+  # build inputs
+  cargo,
+  pkg-config,
+  protobuf,
+  rustc,
+  rustPlatform,
+  openssl,
+
+  # dependencies
+  bcrypt,
+  build,
+  fastapi,
+  grpcio,
+  httpx,
+  importlib-resources,
+  kubernetes,
+  mmh3,
+  numpy,
+  onnxruntime,
+  opentelemetry-api,
+  opentelemetry-exporter-otlp-proto-grpc,
+  opentelemetry-instrumentation-fastapi,
+  opentelemetry-sdk,
+  orjson,
+  overrides,
+  posthog,
+  pulsar-client,
+  pydantic,
+  pypika,
+  pyyaml,
+  requests,
+  tenacity,
+  tokenizers,
+  tqdm,
+  typer,
+  typing-extensions,
+  uvicorn,
+  zstd,
+
+  # optional dependencies
+  chroma-hnswlib,
+
+  # tests
+  hypothesis,
+  psutil,
+  pytest-asyncio,
+  pytestCheckHook,
+
+  # passthru
+  nixosTests,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "chromadb_0";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "chroma-core";
+    repo = "chroma";
+    tag = version;
+    hash = "sha256-yvAX8buETsdPvMQmRK5+WFz4fVaGIdNlfhSadtHwU5U=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-lHRBXJa/OFNf4x7afEJw9XcuDveTBIy3XpQ3+19JXn4=";
+  };
+
+  pythonRelaxDeps = [
+    "chroma-hnswlib"
+    "orjson"
+    "tokenizers"
+  ];
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeBuildInputs = [
+    cargo
+    pkg-config
+    protobuf
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    openssl
+    zstd
+  ];
+
+  dependencies = [
+    bcrypt
+    build
+    chroma-hnswlib
+    fastapi
+    grpcio
+    httpx
+    importlib-resources
+    kubernetes
+    mmh3
+    numpy
+    onnxruntime
+    opentelemetry-api
+    opentelemetry-exporter-otlp-proto-grpc
+    opentelemetry-instrumentation-fastapi
+    opentelemetry-sdk
+    orjson
+    overrides
+    posthog
+    pulsar-client
+    pydantic
+    pypika
+    pyyaml
+    requests
+    tenacity
+    tokenizers
+    tqdm
+    typer
+    typing-extensions
+    uvicorn
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    psutil
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  # Disable on aarch64-linux due to broken onnxruntime
+  # https://github.com/microsoft/onnxruntime/issues/10038
+  pythonImportsCheck = lib.optionals (stdenv.hostPlatform.system != "aarch64-linux") [ "chromadb" ];
+
+  # Test collection breaks on aarch64-linux
+  doCheck = stdenv.hostPlatform.system != "aarch64-linux";
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  pytestFlagsArray = [
+    "-x" # these are slow tests, so stop on the first failure
+    "-v"
+  ];
+
+  preCheck = ''
+    (($(ulimit -n) < 1024)) && ulimit -n 1024
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # Tests are flaky / timing sensitive
+    "test_fastapi_server_token_authn_allows_when_it_should_allow"
+    "test_fastapi_server_token_authn_rejects_when_it_should_reject"
+
+    # Issue with event loop
+    "test_http_client_bw_compatibility"
+
+    # httpx ReadError
+    "test_not_existing_collection_delete"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "chromadb/test/auth/test_simple_rbac_authz.py"
+    "chromadb/test/db/test_system.py"
+    "chromadb/test/ef/test_default_ef.py"
+    "chromadb/test/property/"
+    "chromadb/test/property/test_cross_version_persist.py"
+    "chromadb/test/stress/"
+    "chromadb/test/test_api.py"
+
+    # httpx failures
+    "chromadb/test/api/test_delete_database.py"
+
+    # Cannot be loaded by pytest without path hacks (fixed in 1.0.0)
+    "chromadb/test/test_logservice.py"
+    "chromadb/test/proto/test_utils.py"
+    "chromadb/test/segment/distributed/test_protobuf_translation.py"
+
+    # Hypothesis FailedHealthCheck due to nested @given tests
+    "chromadb/test/cache/test_cache.py"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.tests = {
+    inherit (nixosTests) chromadb;
+  };
+
+  # nixpkgs-update: no auto update
+  # 0.6.3 is the last of the 0.x series
+
+  meta = {
+    description = "AI-native open-source embedding database";
+    homepage = "https://github.com/chroma-core/chroma";
+    changelog = "https://github.com/chroma-core/chroma/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      fab
+      sarahec
+    ];
+    mainProgram = "chroma";
+  };
+}

pkgs/development/python-modules/chromadb/default.nix

@@ -1,81 +1,110 @@
 {
   lib,
   stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchurl,
+
+  # build inputs
+  cargo,
+  pkg-config,
+  protobuf,
+  rustc,
+  rustPlatform,
+  pkgs, # zstd hidden by python3Packages.zstd
+  openssl,
+
+  # dependencies
   bcrypt,
   build,
-  buildPythonPackage,
-  cargo,
-  chroma-hnswlib,
   fastapi,
-  fetchFromGitHub,
   grpcio,
   httpx,
-  hypothesis,
   importlib-resources,
+  jsonschema,
   kubernetes,
   mmh3,
-  nixosTests,
   numpy,
   onnxruntime,
-  openssl,
   opentelemetry-api,
   opentelemetry-exporter-otlp-proto-grpc,
   opentelemetry-instrumentation-fastapi,
   opentelemetry-sdk,
   orjson,
   overrides,
-  pkg-config,
   posthog,
-  protobuf,
-  psutil,
   pulsar-client,
   pydantic,
   pypika,
-  pytest-asyncio,
-  pytestCheckHook,
-  pythonOlder,
   pyyaml,
   requests,
-  rustc,
-  rustPlatform,
-  setuptools-scm,
-  setuptools,
   tenacity,
   tokenizers,
   tqdm,
   typer,
   typing-extensions,
   uvicorn,
-  zstd,
+
+  # optional dependencies
+  chroma-hnswlib,
+
+  # tests
+  hnswlib,
+  hypothesis,
+  pandas,
+  psutil,
+  pytest-asyncio,
+  pytest-xdist,
+  pytestCheckHook,
+  sqlite,
+  starlette,
+
+  # passthru
+  nixosTests,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "0.5.20";
+  version = "1.0.12";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = version;
-    hash = "sha256-DQHkgCHtrn9xi7Kp7TZ5NP1EtFtTH5QOvne9PUvxsWc=";
+    hash = "sha256-Q4PhJTRNzJeVx6DIPWirnI9KksNb8vfOtqb/q9tSK3c=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-ZtCTg8qNCiqlH7RsZxaWUNAoazdgmXP2GtpjDpRdvbk=";
+    inherit src;
+    name = "${pname}-${version}-vendor";
+    hash = "sha256-+Ea2aRrsBGfVCLdOF41jeMehJhMurc8d0UKrpR6ndag=";
   };
 
+  # Can't use fetchFromGitHub as the build expects a zipfile
+  swagger-ui = fetchurl {
+    url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.22.0.zip";
+    hash = "sha256-H+kXxA/6rKzYA19v7Zlx2HbIg/DGicD5FDIs0noVGSk=";
+  };
+
+  patches = [
+    # The fastapi servers can't set up their networking in the test environment, so disable for testing
+    ./disable-fastapi-fixtures.patch
+  ];
+
+  postPatch = ''
+    # Nixpkgs is taking the version from `chromadb_rust_bindings` which is versioned independently
+    substituteInPlace pyproject.toml \
+      --replace-fail "dynamic = [\"version\"]" "version = \"${version}\""
+  '';
+
   pythonRelaxDeps = [
-    "chroma-hnswlib"
-    "orjson"
+    "fastapi"
   ];
 
   build-system = [
-    setuptools
-    setuptools-scm
+    rustPlatform.maturinBuildHook
   ];
 
   nativeBuildInputs = [
@@ -88,17 +117,17 @@ buildPythonPackage rec {
 
   buildInputs = [
     openssl
-    zstd
+    pkgs.zstd
   ];
 
   dependencies = [
     bcrypt
     build
-    chroma-hnswlib
     fastapi
     grpcio
     httpx
     importlib-resources
+    jsonschema
     kubernetes
     mmh3
     numpy
@@ -123,20 +152,43 @@ buildPythonPackage rec {
     uvicorn
   ];
 
+  optional-dependencies = {
+    dev = [ chroma-hnswlib ];
+  };
+
   nativeCheckInputs = [
+    chroma-hnswlib
+    hnswlib
     hypothesis
+    pandas
     psutil
     pytest-asyncio
+    pytest-xdist
     pytestCheckHook
+    sqlite
+    starlette
   ];
 
-  pythonImportsCheck = [ "chromadb" ];
+  # Disable on aarch64-linux due to broken onnxruntime
+  # https://github.com/microsoft/onnxruntime/issues/10038
+  pythonImportsCheck = lib.optionals (stdenv.hostPlatform.system != "aarch64-linux") [ "chromadb" ];
+
+  # Test collection breaks on aarch64-linux
+  doCheck = stdenv.hostPlatform.system != "aarch64-linux";
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
+    SWAGGER_UI_DOWNLOAD_URL = "file://${swagger-ui}";
   };
 
-  pytestFlagsArray = [ "-x" ];
+  pytestFlagsArray = [
+    "-x" # these are slow tests, so stop on the first failure
+    "-v"
+    "-W"
+    "ignore:DeprecationWarning"
+    "-W"
+    "ignore:PytestCollectionWarning"
+  ];
 
   preCheck = ''
     (($(ulimit -n) < 1024)) && ulimit -n 1024
@@ -144,39 +196,80 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    # Tests are laky / timing sensitive
+    # Tests are flaky / timing sensitive
     "test_fastapi_server_token_authn_allows_when_it_should_allow"
     "test_fastapi_server_token_authn_rejects_when_it_should_reject"
+
     # Issue with event loop
     "test_http_client_bw_compatibility"
-    # Issue with httpx
+
+    # httpx ReadError
     "test_not_existing_collection_delete"
+
+    # Tests launch a server and try to connect to it
+    # These either have https connection errors or name resolution errors
+    "test_collection_query_with_invalid_collection_throws"
+    "test_collection_update_with_invalid_collection_throws"
+    "test_default_embedding"
+    "test_invalid_index_params"
+    "test_peek"
+    "test_persist_index_loading"
+    "test_query_id_filtering_e2e"
+    "test_query_id_filtering_medium_dataset"
+    "test_query_id_filtering_small_dataset"
+    "test_ssl_self_signed_without_ssl_verify"
+    "test_ssl_self_signed"
+
+    # Apparent race condition with sqlite
+    # See https://github.com/chroma-core/chroma/issues/4661
+    "test_multithreaded_get_or_create"
   ];
 
   disabledTestPaths = [
     # Tests require network access
-    "chromadb/test/auth/test_simple_rbac_authz.py"
-    "chromadb/test/db/test_system.py"
+    "bin/rust_python_compat_test.py"
+    "chromadb/test/configurations/test_collection_configuration.py"
     "chromadb/test/ef/test_default_ef.py"
+    "chromadb/test/ef/test_onnx_mini_lm_l6_v2.py"
+    "chromadb/test/ef/test_voyageai_ef.py"
     "chromadb/test/property/"
     "chromadb/test/property/test_cross_version_persist.py"
     "chromadb/test/stress/"
     "chromadb/test/test_api.py"
+
+    # Tests time out (waiting for server)
+    "chromadb/test/test_cli.py"
+
+    # Cannot find protobuf file while loading test
+    "chromadb/test/distributed/test_log_failover.py"
   ];
 
   __darwinAllowLocalNetworking = true;
 
-  passthru.tests = {
-    inherit (nixosTests) chromadb;
+  passthru = {
+    tests = {
+      inherit (nixosTests) chromadb;
+    };
+
+    updateScript = nix-update-script {
+      # we have to update both the python hash and the cargo one,
+      # so use nix-update-script
+      extraArgs = [
+        "--versionRegex"
+        "([0-9].+)"
+      ];
+    };
   };
 
-  meta = with lib; {
+  meta = {
     description = "AI-native open-source embedding database";
     homepage = "https://github.com/chroma-core/chroma";
     changelog = "https://github.com/chroma-core/chroma/releases/tag/${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      fab
+      sarahec
+    ];
     mainProgram = "chroma";
-    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
   };
 }

pkgs/development/python-modules/chromadb/disable-fastapi-fixtures.patch

@@ -0,0 +1,14 @@
+diff --git a/chromadb/test/conftest.py b/chromadb/test/conftest.py
+index efde1c382..163f55c57 100644
+--- a/chromadb/test/conftest.py
++++ b/chromadb/test/conftest.py
+@@ -678,9 +678,6 @@ def sqlite_persistent(request: pytest.FixtureRequest) -> Generator[System, None,
+ 
+ def system_fixtures() -> List[Callable[[], Generator[System, None, None]]]:
+     fixtures = [
+-        fastapi,
+-        async_fastapi,
+-        fastapi_persistent,
+         sqlite_fixture,
+         sqlite_persistent_fixture,
+     ]

pkgs/development/python-modules/django-crispy-bootstrap5/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "django-crispy-bootstrap5";
-  version = "2025.4";
+  version = "2025.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-crispy-forms";
     repo = "crispy-bootstrap5";
     tag = version;
-    hash = "sha256-XU0iPqtq7y74fsBgSQMyoVW48f7QMIIBYHggmvKAjYE=";
+    hash = "sha256-/WQ6GgwhIdFI/515WU2X0EPR0i9nplR7QDa/fBINJLU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/housekeeping/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  typing-extensions,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "housekeeping";
+  version = "1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "beanbaginc";
+    repo = "housekeeping";
+    tag = "release-${version}";
+    hash = "sha256-hRWZSRoXscjkUm0NUpkM6pKEdoirN6ZmpjWlNgoyCVY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
+
+  pythonImportsCheck = [ "housekeeping" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Reusable deprecation helpers for Python projects";
+    homepage = "https://github.com/beanbaginc/housekeeping";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}

pkgs/development/python-modules/kgb/default.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "kgb";
+  version = "7.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "beanbaginc";
+    repo = "kgb";
+    tag = "release-${version}";
+    hash = "sha256-hNJXoUIyrCB9PCWLCmN81F6pBRwZApDR6JWA0adyklw=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "kgb" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Python function spy support for unit tests";
+    homepage = "https://github.com/beanbaginc/kgb";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}

pkgs/development/python-modules/langchain-chroma/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-chroma";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-chroma==${version}";
-    hash = "sha256-6WOViBKXZ844g2M6pYohHsXnzJiWbTNgj9EjN+z+B+4=";
+    hash = "sha256-w4xvPPLYkPiQA34bimVHLe+vghMI9Pq36CHoE/EMnr8=";
   };
 
   sourceRoot = "${src.name}/libs/partners/chroma";

pkgs/development/python-modules/pydiffx/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  six,
+  pytestCheckHook,
+  kgb,
+}:
+
+buildPythonPackage rec {
+  pname = "pydiffx";
+  version = "1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "beanbaginc";
+    repo = "diffx";
+    tag = "pydiffx/release-${version}";
+    hash = "sha256-oJjHrg1X02SmNJKbWbTPc0kycI+jLj0C4eUFFXwb+TA=";
+  };
+
+  sourceRoot = "${src.name}/python";
+
+  postPatch = ''
+    substituteInPlace pydiffx/tests/testcases.py \
+      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ six ];
+
+  pythonImportsCheck = [ "pydiffx" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    kgb
+  ];
+
+  meta = {
+    description = "DiffX file format and utilities";
+    homepage = "https://github.com/beanbaginc/diffx";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}

pkgs/development/python-modules/pyopencl/default.nix

@@ -19,6 +19,7 @@
   # dependencies
   platformdirs,
   pytools,
+  typing-extensions,
 
   # tests
   pytestCheckHook,
@@ -29,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2025.1";
+  version = "2025.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -37,7 +38,7 @@ buildPythonPackage rec {
     repo = "pyopencl";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-wAZBDPMJbTmujP1j7LjK28ZozZaUwKPDPZLZbFFTeAs=";
+    hash = "sha256-cV4ff52qB7+zFC04swMt4s3Vrzrd+UZU3owEaJFFOms=";
   };
 
   build-system = [
@@ -60,6 +61,7 @@ buildPythonPackage rec {
     numpy
     platformdirs
     pytools
+    typing-extensions
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/rbtools/default.nix

@@ -1,43 +1,87 @@
 {
   lib,
   buildPythonPackage,
-  fetchurl,
+  fetchFromGitHub,
   isPy3k,
   setuptools,
   colorama,
-  six,
   texttable,
   tqdm,
+  certifi,
+  housekeeping,
+  puremagic,
+  pydiffx,
+  typing-extensions,
+  importlib-metadata,
+  importlib-resources,
+  packaging,
+  pytestCheckHook,
+  pytest-env,
+  kgb,
+  gitSetupHook,
+  gitFull,
+  subversion,
 }:
 
 buildPythonPackage rec {
   pname = "rbtools";
   version = "5.2.1";
-  format = "setuptools";
-
+  pyproject = true;
   disabled = !isPy3k;
 
-  src = fetchurl {
-    url = "https://downloads.reviewboard.org/releases/RBTools/${lib.versions.majorMinor version}/RBTools-${version}.tar.gz";
-    sha256 = "f2863515ef6ff1cfcd3905d5f409ab8c4d12878b364d6f805ba848dcaecb97f2";
+  src = fetchFromGitHub {
+    owner = "reviewboard";
+    repo = "rbtools";
+    tag = "release-${version}";
+    hash = "sha256-Ci9lHlP2X95y7ldHBbqb5qWozPj3TJ0AxeVhqzVsdFA=";
   };
 
-  propagatedBuildInputs = [
-    six
+  build-system = [ setuptools ];
+
+  dependencies = [
     texttable
     tqdm
     colorama
-    setuptools
+    certifi
+    housekeeping
+    puremagic
+    pydiffx
+    typing-extensions
+    importlib-metadata
+    importlib-resources
+    packaging
   ];
 
-  # The kgb test dependency is not in nixpkgs
-  doCheck = false;
+  pythonRelaxDeps = [ "pydiffx" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-env
+    kgb
+    gitSetupHook
+    gitFull
+    subversion
+  ];
+
+  disabledTestPaths = [
+    "rbtools/utils/tests/test_repository.py::RepositoryMatchTests::test_find_matching_server_repository_no_match" # AttributeError: 'APICache' object has no attribute 'db'
+    # kgb.errors.ExistingSpyError
+    "rbtools/utils/tests/test_repository.py::RepositoryMatchTests::test_find_matching_server_repository_with_mirror_path_match"
+    "rbtools/utils/tests/test_repository.py::RepositoryMatchTests::test_find_matching_server_repository_with_multiple_matches"
+    "rbtools/utils/tests/test_repository.py::RepositoryMatchTests::test_find_matching_server_repository_with_path_match"
+    "rbtools/diffs/tests/test_apple_diff_tool.py::AppleDiffToolTests::test_run_diff_file_with_text_differences" # AssertionError: b'---[38 chars]0000 +0000\n+++ /path2.txt\t2022-09-26 10:20:3[42 chars]ar\n' != b'---[38 chars]0000 -0700\n+++ /path2.txt\t2022-09-26 10:20:3[42 chars]ar\n'
+    # rbtools.utils.process.RunProcessError: Unexpected error executing the command: svn co file:///build/source/rbtools/clients/tests/testdata/svn-repo /build/rbtools._bw2ih4g/working/svn-repo
+    "rbtools/clients/tests/test_svn.py"
+    "rbtools/utils/tests/test_source_tree.py"
+    "rbtools/clients/tests/test_scanning.py::ScanningTests::test_scanning_nested_repos_1"
+    "rbtools/clients/tests/test_scanning.py::ScanningTests::test_scanning_nested_repos_2"
+  ];
+
+  meta = {
     homepage = "https://www.reviewboard.org/docs/rbtools/dev/";
     description = "RBTools is a set of command line tools for working with Review Board and RBCommons";
     mainProgram = "rbt";
-    license = licenses.mit;
-    maintainers = with maintainers; [ domenkozar ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ domenkozar ];
   };
 }

pkgs/development/python-modules/recipe-scrapers/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "15.7.1";
+  version = "15.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     tag = version;
-    hash = "sha256-DjnK6eq4sgyCNDGQIszrkvNwGLOGitcZPjeLT1woOqs=";
+    hash = "sha256-G2FKv4HZ6Kf4u/EDflkYqiY1uelWBuIE+UrqeCp2XL8=";
   };
 
   build-system = [ setuptools ];
@@ -64,7 +64,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python package for scraping recipes data";
     homepage = "https://github.com/hhursev/recipe-scrapers";
-    changelog = "https://github.com/hhursev/recipe-scrapers/releases/tag/${version}";
+    changelog = "https://github.com/hhursev/recipe-scrapers/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ ambroisie ];
   };

pkgs/development/python-modules/tomlkit/default.nix

@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.13.2";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-//X+WahylbJ4q9Mb7JLBXZvEoGiFqxK86lLHERk5Lnk=";
+    hash = "sha256-QwzyR+5X3yuU7j++WI5x02KpQeu1Rd7Cm1OWHWGt0qE=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/tree-sitter-sql/default.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  tree-sitter-sql,
+
+  #optional-dependencies
+  tree-sitter,
+}:
+buildPythonPackage rec {
+  pname = "tree-sitter-sql";
+  version = "0.3.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DerekStride";
+    repo = "tree-sitter-sql";
+    tag = "v${version}";
+    hash = "sha256-8gdbbz187sV8I+PJHubFyyQwGUqvo05Yw1DX7rOK4DI=";
+  };
+
+  postUnpack = ''
+    cp -rf ${tree-sitter-sql.passthru.parsers}/* $sourceRoot
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  passthru = {
+    # As mentioned in https://github.com/DerekStride/tree-sitter-sql README
+    # generated tree sitter parser files necessary for compilation
+    # are separately distributed on the gh-pages branch
+    parsers = fetchFromGitHub {
+      owner = "DerekStride";
+      repo = "tree-sitter-sql";
+      rev = "9853b887c5e4309de273922b681cc7bc09e30c78/gh-pages";
+      hash = "sha256-p60nphbSN+O5fOlL06nw0qgQFpmvoNCTmLzDvUC/JGs=";
+    };
+  };
+
+  optional-dependencies = {
+    core = [
+      tree-sitter
+    ];
+  };
+
+  pythonImportsCheck = [ "tree_sitter_sql" ];
+
+  meta = {
+    description = "sql grammar for tree-sitter";
+    homepage = "https://github.com/DerekStride/tree-sitter-sql";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pcboy ];
+  };
+}

pkgs/development/tools/continuous-integration/woodpecker/common.nix

@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "3.6.0";
-  srcHash = "sha256-/vBWuCHvVaFqCbwZAXgkHpfAQaOt4dtqeCXmDuQzBoc=";
+  version = "3.7.0";
+  srcHash = "sha256-5EmvmfkAUMkmImS37jAPOoEADYeAzQgV6zhpRbP9FVk=";
   # The tarball contains vendored dependencies
   vendorHash = null;
 in

pkgs/development/tools/continuous-integration/woodpecker/update.sh

@@ -13,15 +13,13 @@ if [[ $# -gt 1 || $1 == -* ]]; then
     exit 1
 fi
 
-set -x
-
 cd "$(dirname "$0")"
 version="$1"
 
 set -euo pipefail
 
 if [ -z "$version" ]; then
-    version="$(wget -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/woodpecker-ci/woodpecker/releases?per_page=1" | jq -r '.[0].tag_name')"
+    version="$(wget -q -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/woodpecker-ci/woodpecker/releases?per_page=1" | jq -r '.[0].tag_name')"
 fi
 
 # strip leading "v"

pkgs/os-specific/linux/iptables/default.nix

@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
     description = "Program to configure the Linux IP packet filtering ruleset";
     homepage = "https://www.netfilter.org/projects/iptables/index.html";
     platforms = platforms.linux;
+    mainProgram = "iptables";
     maintainers = with maintainers; [ fpletz ];
     license = licenses.gpl2Plus;
     downloadPage = "https://www.netfilter.org/projects/iptables/files/";

pkgs/os-specific/linux/opensnitch-ebpf/default.nix

@@ -43,12 +43,21 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
+
     for file in opensnitch*.o; do
       install -Dm644 "$file" "$out/etc/opensnitchd/$file"
     done
+
     runHook postInstall
   '';
 
+  postFixup = ''
+    # reduces closure size significantly (fixes https://github.com/NixOS/nixpkgs/issues/391351)
+    for file in $out/etc/opensnitchd/*.o; do
+      llvm-strip $file
+    done
+  '';
+
   meta = with lib; {
     description = "eBPF process monitor module for OpenSnitch";
     homepage = "https://github.com/evilsocket/opensnitch";

pkgs/servers/sql/postgresql/ext/timescaledb.nix

@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.20.1";
+  version = "2.20.2";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-eB88YPoK3uUhvbKP1mob5L+pyemxvGVuGGcJAXDDets=";
+    hash = "sha256-GFM6smJv34IeDwOPdTDrHXfYFmHyPhdVxPB/0n4L3NE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/top-level/ocaml-packages.nix

@@ -88,6 +88,8 @@ let
 
         benchmark = callPackage ../development/ocaml-modules/benchmark { };
 
+        bencode = callPackage ../development/ocaml-modules/bencode { };
+
         bheap = callPackage ../development/ocaml-modules/bheap { };
 
         bigarray-compat = callPackage ../development/ocaml-modules/bigarray-compat { };
@@ -202,6 +204,8 @@ let
           git-binary = pkgs.git;
         };
 
+        cbor = callPackage ../development/ocaml-modules/cbor { };
+
         cfstream = callPackage ../development/ocaml-modules/cfstream { };
 
         chacha = callPackage ../development/ocaml-modules/chacha { };
@@ -326,6 +330,26 @@ let
 
         dbf = callPackage ../development/ocaml-modules/dbf { };
 
+        decoders = callPackage ../development/ocaml-modules/decoders { };
+
+        decoders-bencode = callPackage ../development/ocaml-modules/decoders-bencode { };
+
+        decoders-cbor = callPackage ../development/ocaml-modules/decoders-cbor { };
+
+        decoders-ezjsonm = callPackage ../development/ocaml-modules/decoders-ezjsonm { };
+
+        decoders-ezxmlm = callPackage ../development/ocaml-modules/decoders-ezxmlm { };
+
+        decoders-jsonaf = callPackage ../development/ocaml-modules/decoders-jsonaf { };
+
+        decoders-jsonm = callPackage ../development/ocaml-modules/decoders-jsonm { };
+
+        decoders-msgpck = callPackage ../development/ocaml-modules/decoders-msgpck { };
+
+        decoders-sexplib = callPackage ../development/ocaml-modules/decoders-sexplib { };
+
+        decoders-yojson = callPackage ../development/ocaml-modules/decoders-yojson { };
+
         decompress = callPackage ../development/ocaml-modules/decompress { };
 
         dedukti = callPackage ../development/ocaml-modules/dedukti { };

pkgs/top-level/python-packages.nix

@@ -2458,6 +2458,8 @@ self: super: with self; {
 
   chromadb = callPackage ../development/python-modules/chromadb { };
 
+  chromadb_0 = callPackage ../development/python-modules/chromadb/0.nix { };
+
   chromaprint = callPackage ../development/python-modules/chromaprint { };
 
   ci-info = callPackage ../development/python-modules/ci-info { };
@@ -6480,6 +6482,8 @@ self: super: with self; {
 
   horizon-eda = callPackage ../development/python-modules/horizon-eda { inherit (pkgs) horizon-eda; };
 
+  housekeeping = callPackage ../development/python-modules/housekeeping { };
+
   howdoi = callPackage ../development/python-modules/howdoi { };
 
   hpack = callPackage ../development/python-modules/hpack { };
@@ -7551,6 +7555,8 @@ self: super: with self; {
 
   kfactory = callPackage ../development/python-modules/kfactory { };
 
+  kgb = callPackage ../development/python-modules/kgb { };
+
   khanaa = callPackage ../development/python-modules/khanaa { };
 
   kicad = toPythonModule (pkgs.kicad.override { python3 = python; }).src;
@@ -12375,6 +12381,8 @@ self: super: with self; {
 
   pydicom-seg = callPackage ../development/python-modules/pydicom-seg { };
 
+  pydiffx = callPackage ../development/python-modules/pydiffx { };
+
   pydigiham = callPackage ../development/python-modules/pydigiham { };
 
   pydiscourse = callPackage ../development/python-modules/pydiscourse { };
@@ -17903,6 +17911,8 @@ self: super: with self; {
 
   tree-sitter-rust = callPackage ../development/python-modules/tree-sitter-rust { };
 
+  tree-sitter-sql = callPackage ../development/python-modules/tree-sitter-sql { };
+
   tree-sitter-yaml = callPackage ../development/python-modules/tree-sitter-yaml { };
 
   treelib = callPackage ../development/python-modules/treelib { };