Merge staging-next-26.05 into staging-26.05

maintainers/maintainer-list.nix

@@ -21387,6 +21387,12 @@
     githubId = 7420227;
     name = "Peter Tri Ho";
   };
+  peterwaller-arm = {
+    email = "peter.waller@arm.com";
+    github = "peterwaller-arm";
+    githubId = 52030119;
+    name = "Peter Waller";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - Create the first release note entry in this section!
 
+- [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -1017,6 +1017,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/flap-alerted.nix
   ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix

nixos/modules/services/display-managers/gdm.nix

@@ -455,6 +455,22 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
+            # make sure the spawned session has the same variables as `display-manager.service`
+            # https://github.com/NixOS/nixpkgs/issues/523332
+            {
+              name = "env-greeter";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.conffile =
+                let
+                  env = config.services.displayManager.generic.environment;
+                in
+                pkgs.writeText "gdm-launch-environment-env-conf" ''
+                  PATH          DEFAULT="''${PATH}:${pkgs.gnome-session}/bin"
+                  XDG_DATA_DIRS DEFAULT="''${XDG_DATA_DIRS}:${env.XDG_DATA_DIRS}"
+                '';
+              settings.readenv = 0;
+            }
             {
               name = "systemd";
               control = "optional";

nixos/modules/services/monitoring/flap-alerted.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.flap-alerted;
+
+  settingsArgs = lib.pipe cfg.settings [
+    (lib.mapAttrsToList (
+      name: value:
+      if value == null || value == false then
+        [ ]
+      else if value == true then
+        [ "-${name}" ]
+      else
+        [
+          "-${name}"
+          (toString value)
+        ]
+    ))
+    lib.concatLists
+  ];
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.flap-alerted = {
+    enable = lib.mkEnableOption "FlapAlerted";
+
+    package = lib.mkPackageOption pkgs "flap-alerted" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/flap-alerted.env" ];
+      description = ''
+        Files to load environment variables from.
+        This is useful to avoid putting secrets into the nix store.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra command line arguments to pass to FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = [ ];
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.int
+              lib.types.bool
+            ]
+          )
+        );
+
+        options = {
+          asn = lib.mkOption {
+            type = lib.types.ints.u32;
+            description = "Your ASN number";
+          };
+
+          bgpListenAddress = lib.mkOption {
+            type = lib.types.str;
+            description = "Address to listen on for incoming BGP connections";
+            default = ":1790";
+          };
+
+          debug = lib.mkOption {
+            type = lib.types.bool;
+            description = "Enable debug mode (produces a lot of output)";
+            default = false;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.flap-alerted = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "flap-alerted";
+        Group = "flap-alerted";
+        DynamicUser = true;
+
+        EnvironmentFile = cfg.environmentFiles;
+
+        ExecStart = lib.escapeShellArgs ([ (lib.getExe cfg.package) ] ++ settingsArgs ++ cfg.extraArgs);
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/modules/services/security/jitterentropy-rngd.nix

@@ -26,6 +26,11 @@ in
       default = false;
       description = "Force SP800-90B mode for entropy reading";
     };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
     verbose = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -56,6 +61,12 @@ in
           # use service from package with our configured args
           "${cfg.package}/bin/jitterentropy-rngd ${args}"
         ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
       };
     };
 

nixos/modules/virtualisation/lxcfs.nix

@@ -41,7 +41,7 @@ in
       serviceConfig = {
         ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
         ExecStart = "${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
-        ExecStopPost = "-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
+        ExecStopPost = "-${pkgs.fuse3}/bin/fusermount3 -u /var/lib/lxcfs";
         KillMode = "process";
         Restart = "on-failure";
       };

nixos/tests/all-tests.nix

@@ -596,6 +596,7 @@ in
   firezone = runTest ./firezone/firezone.nix;
   fish = runTest ./fish.nix;
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
+  flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;

nixos/tests/flap-alerted.nix

@@ -0,0 +1,128 @@
+{ config, lib, ... }:
+
+{
+  name = "flap-alerted";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.flap-alerted = {
+      enable = true;
+      settings = {
+        asn = 4213370001;
+        bgpListenAddress = ":1790";
+        routeChangeCounter = 5;
+        overThresholdTarget = 1;
+      };
+    };
+
+    services.bird = {
+      enable = true;
+      preCheckConfig = ''
+        mkdir -p /tmp/bird
+        touch /tmp/bird/routes.conf
+      '';
+      config = ''
+        router id 192.168.1.1;
+
+        protocol device { }
+
+        protocol bgp flapalerted {
+          local 2001:db8:1::1 as 4213370001;
+          neighbor ::1 as 4213370001 port 1790;
+
+          ipv4 {
+            add paths on;
+            export all;
+            import none;
+            extended next hop on;
+          };
+
+          ipv6 {
+            add paths on;
+            export all;
+            import none;
+          };
+        }
+
+        protocol static {
+          include "/tmp/bird/routes.conf";
+
+          ipv4 {
+            import all;
+            export none;
+          };
+        }
+      '';
+    };
+
+    systemd.services.bird.serviceConfig.BindReadOnlyPaths = [ "/tmp/bird" ];
+
+    systemd.tmpfiles.settings.bird-static-routes."/tmp/bird/routes.conf".f = { };
+  };
+
+  interactive.sshBackdoor.enable = true;
+  interactive.defaults.virtualisation.graphics = false;
+
+  interactive.nodes.machine = {
+    services.flap-alerted.settings.httpAPIListenAddress = ":8699";
+    networking.firewall.allowedTCPPorts = [ 8699 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8699;
+        guest.port = 8699;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+    import random
+    import time
+
+    machine.log(machine.succeed("systemd-analyze security flap-alerted.service --threshold=11 --no-pager"))
+
+    machine.wait_for_unit("bird.service")
+    machine.wait_for_unit("flap-alerted.service")
+    machine.wait_for_open_port(1790)
+    machine.wait_for_open_port(8699)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/capabilities"))
+    expected_version = "v${config.nodes.machine.services.flap-alerted.package.version}"
+    assert resp["Version"] == expected_version
+
+    for _ in range(10):
+      resp = json.loads(machine.succeed("curl localhost:8699/sessions"))
+      if len(resp) == 1: break
+      time.sleep(1)
+    else:
+      assert False, "failed to establish bgp session"
+    assert resp[0]["RouterID"] == "192.168.1.1"
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert resp == []
+
+    def flap():
+      route = lambda idx, gw: f"""
+        route 10.0.{idx}.0/24 via 10.254.254.{gw} dev \"eth0\" onlink {{
+          bgp_path.prepend(4213370002);
+          bgp_path.prepend({4213370002 + gw});
+        }};
+      """
+      with open("routes.conf", "w") as f:
+        for i in range(1, 4): # stable routes
+          f.write(route(i, i))
+        for i in range(4, 7): # flappy routes
+          f.write(route(i, random.randint(1, 254)))
+      machine.copy_from_host("routes.conf", "/tmp/bird/routes.conf")
+      machine.succeed("birdc configure")
+
+    t = time.time()
+    while time.time() - t < 70:
+      flap()
+      time.sleep(1)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert sorted(x["Prefix"] for x in resp) == ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+  '';
+}

nixos/tests/incus/incus-tests-module.nix

@@ -1,10 +1,12 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
 let
   jsonFormat = pkgs.formats.json { };
+  cfg = config.tests.incus;
 in
 {
   options.tests.incus = {
@@ -74,7 +76,11 @@ in
             config =
               let
                 releases = import ../../release.nix {
-                  configuration = config.nixosConfig;
+                  configuration = lib.recursiveUpdate config.nixosConfig {
+                    virtualisation.incus = {
+                      inherit (cfg) package;
+                    };
+                  };
                 };
 
                 images = {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "151.0.2";
+  version = "151.0.3";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "87308953ed354a2799a9a45be40033bf9ff8d80fa220f034aacfbd6e754716901d4164c37fa56032c659b259116603e0ba2b566c1f3651ab9cc0835d502cd739";
+    sha512 = "511723e5cf042abb66cbeda89b78d42de8d1b53544565670173f3e69c2a7ceefc76468c90576221418bfc9b122151ec117978caa4823cfb9b80797f3064bd895";
   };
 
   meta = {

pkgs/by-name/_1/_1password-gui/sources.json

@@ -18,11 +18,11 @@
       "sources": {
         "x86_64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-x86_64.zip",
-          "hash": "sha256-tAWgIe7mcaGANCn8Kr0h6+zmvqufDJMjzAI3FrAGNk0="
+          "hash": "sha256-1dAmyaBMo4re1aQTk16AMEol7GjeSVhx9F4SuYBGoso="
         },
         "aarch64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-aarch64.zip",
-          "hash": "sha256-1c6YbzFYNyHKzY13OZ7z1Ad5hzgTIMs3aT0nluK9l0w="
+          "hash": "sha256-WrWbGzBK65tVNl9Dc3OnJURiPpfbNLOYUJcVT0ETaAs="
         }
       }
     }

pkgs/by-name/fa/fastcdr/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastcdr";
-  version = "2.3.5";
+  version = "2.3.6";
 
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-CDR";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gWENB3zqnFll047Jv+GL4k497wrzNaIaVTbXY7feRNQ=";
+    hash = "sha256-s0cIb/83dD5W8vN/2bEBxRD35NpfCSHEpsJQjtr94aE=";
   };
 
   patches = [

pkgs/by-name/fl/flap-alerted/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  nixosTests,
+
+  # modules (https://github.com/Kioubit/FlapAlerted#module-documentation)
+  withHttpApi ? true,
+  withLog ? true,
+  withScript ? true,
+  withWebhook ? true,
+  withCollector ? true,
+  withHistory ? true,
+  withRoaFilter ? false,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "flap-alerted";
+  version = "4.5.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Kioubit";
+    repo = "FlapAlerted";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-D4+FLAMt/cHXCks4GQI33ymbZIHzBajpvKU6QQntofk=";
+  };
+
+  vendorHash = null;
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=v${finalAttrs.version}"
+  ];
+
+  tags =
+    lib.optionals (!withHttpApi) [ "disable_mod_httpAPI" ]
+    ++ lib.optionals (!withLog) [ "disable_mod_log" ]
+    ++ lib.optionals (!withScript) [ "disable_mod_script" ]
+    ++ lib.optionals (!withWebhook) [ "disable_mod_webhook" ]
+    ++ lib.optionals (!withCollector) [ "disable_mod_collector" ]
+    ++ lib.optionals (!withHistory) [ "disable_mod_history" ]
+    ++ lib.optionals withRoaFilter [ "mod_roaFilter" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) flap-alerted; };
+  };
+
+  meta = {
+    description = "BGP Update based flap detection & statistics";
+    homepage = "https://github.com/Kioubit/FlapAlerted";
+    changelog = "https://github.com/Kioubit/FlapAlerted/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "FlapAlerted";
+  };
+})

pkgs/by-name/go/google-chrome/package.nix

@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "148.0.7778.215";
+    version = "149.0.7827.53";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-IyKMotjgwLJ9AKAl+gE86DWd0GCtQoBjvbbvBiYULSQ=";
+      hash = "sha256-iqNNjJy9Wje5jcpJrQYHu/gZptaBwZg0WZzbZTKUmPg=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "148.0.7778.216";
+    version = "149.0.7827.54";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ac3wy6ujyaf3yzk7hqzmyw4nopha_148.0.7778.216/GoogleChrome-148.0.7778.216.dmg";
-      hash = "sha256-NauJr7eRVb5q1s38WXijxBAhJ2RryfrrlBc9oBg5HH4=";
+      url = "http://dl.google.com/release2/chrome/dk75rnebngodpmukle2jjrfx6u_149.0.7827.54/GoogleChrome-149.0.7827.54.dmg";
+      hash = "sha256-O48opD0Ea336/mbs5RFjBITjf8MWOL2BAuf6gX+pnmo=";
     };
 
     dontPatch = true;

pkgs/by-name/io/ios-deploy/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  privateFrameworks = "/Library/Apple/System/Library/PrivateFrameworks";
+  privateFrameworks = "/System/Library/PrivateFrameworks";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ios-deploy";
@@ -23,9 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preBuild
 
     awk '{ print "\""$0"\\n\""}' src/scripts/lldb.py >> src/ios-deploy/lldb.py.h
+    cp -RL ${privateFrameworks}/MobileDevice.framework MobileDevice.framework
     clang src/ios-deploy/ios-deploy.m \
       -framework Foundation \
-      -F${privateFrameworks} -framework MobileDevice \
+      -F. -framework MobileDevice \
       -o ios-deploy
 
     runHook postBuild

pkgs/by-name/ji/jitterentropy-rngd/package.nix

@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Allow the systemd service to mlock the daemon's entropy buffer.
     (fetchpatch {
-      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
-      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...cee0c7a035e9564d161053012c6ea36b2ce27383.patch";
+      hash = "sha256-zwcY9z9EikrhxZa39p4+gl+/EeZ4sAKaItQfrL1DFSo=";
     })
   ];
 

pkgs/by-name/jo/journalist/package.nix

@@ -15,7 +15,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-3MnkndG2c4P3oprIRbzj26oAutEmAgsUx8mjlaDLrkI=";
   };
 
-  vendorHash = "sha256-2EJ96dhhU7FZxMkHOmQo79WCHu8U1AGgFf47FIuQdek=s";
+  vendorHash = "sha256-2EJ96dhhU7FZxMkHOmQo79WCHu8U1AGgFf47FIuQdek=";
 
   ldflags = [
     "-s"

pkgs/by-name/ku/kubelogin-oidc/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubelogin";
-  version = "1.36.1";
+  version = "1.36.2";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-leM2C6Ba2H9AU916NAVKEk6zoAWCIn43URQ/SEA8Xwc=";
+    hash = "sha256-VzUnjqa3XnKSqcwd2jVwbQwGmyO5+YBwPIIxN0wj81A=";
   };
 
   subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-vAbPLlQEku9KySHpdTvQHYHtxyi7/mUvytuyrP9wkHE=";
+  vendorHash = "sha256-/30B7krXl0HYm+nUqGtbhNb4L8utdorjZNGkfMCYs3k=";
 
   # test all packages
   preCheck = ''

pkgs/by-name/mp/mpv/scripts/videoclip.nix

@@ -10,13 +10,13 @@
 }:
 buildLua {
   pname = "videoclip";
-  version = "0.2-unstable-2026-01-22";
+  version = "0.2-unstable-2026-05-31";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "videoclip";
-    rev = "4856934684e4490fc0cab0b58054eac5f07754d7";
-    hash = "sha256-JQGPiVRMPZa4AkxqrNlTzC2QnJ4/kQov01nIcUuFy6I=";
+    rev = "d9a3e0966b238b824b86767956eb44a11ac367c6";
+    hash = "sha256-NZaflGehxoIf9eY3/p9WrKXXQj3x6GDZ6iMLeu5BhPc=";
   };
 
   patchPhase = ''

pkgs/by-name/ns/ns-3/package.nix

@@ -63,13 +63,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ns-3";
-  version = "44";
+  version = "47";
 
   src = fetchFromGitLab {
     owner = "nsnam";
     repo = "ns-3-dev";
     rev = "ns-3.${finalAttrs.version}";
-    hash = "sha256-rw/WAMk4ZitULqkdyEh9vAFp1UrD1tw2JqgxOT5JQ5I=";
+    hash = "sha256-Av5Ret1v4RLafvYvUtCEh4Xb1ZwU3CgNOcDlRJrJsn8=";
   };
 
   nativeBuildInputs = [
@@ -118,13 +118,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
      substituteInPlace src/tap-bridge/CMakeLists.txt \
-       --replace '-DTAP_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/tap-bridge/' "-DTAP_CREATOR=\"$out/libexec/ns3/"
+       --replace-fail '-DTAP_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/tap-bridge/' "-DTAP_CREATOR=\"$out/libexec/ns3/"
 
     substituteInPlace src/fd-net-device/CMakeLists.txt \
-      --replace '-DRAW_SOCK_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DRAW_SOCK_CREATOR=\"$out/libexec/ns3/"
+      --replace-fail '-DRAW_SOCK_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DRAW_SOCK_CREATOR=\"$out/libexec/ns3/"
 
     substituteInPlace src/fd-net-device/CMakeLists.txt \
-      --replace '-DTAP_DEV_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DTAP_DEV_CREATOR=\"$out/libexec/ns3/"
+      --replace-fail '-DTAP_DEV_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DTAP_DEV_CREATOR=\"$out/libexec/ns3/"
   '';
 
   doCheck = false;

pkgs/by-name/ra/radicle-ci-broker/package.nix

@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-ci-broker";
-  version = "0.28.0";
+  version = "0.28.1";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
     node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+fOCS9Z5x8pwwgtz08wj6noY1CIGkeqQ4TKgPeBPWA=";
+    hash = "sha256-6jCMphwVhRgtLpUWBLwsODgR41wl27hyzbMdDjMISfM=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-J0tUgtK1mj/su/IxKDdWXoWpWZBOUHLr4n9gbLWc8bU=";
+  cargoHash = "sha256-fZwvjpTWWbHDSSI1tXF1JhyvZnIfP4p601GoVBJwR8k=";
 
   postPatch = ''
     substituteInPlace build.rs \

pkgs/by-name/re/recordbox/fix-glycin-paths.patch

@@ -1,24 +0,0 @@
-diff --git a/vendor/glycin/src/sandbox.rs b/vendor/glycin/src/sandbox.rs
-index 08db832..4f44b21 100644
---- a/vendor/glycin/src/sandbox.rs
-+++ b/vendor/glycin/src/sandbox.rs
-@@ -202,7 +202,7 @@ impl Sandbox {
- 
-                 args.push(self.exec());
- 
--                ("bwrap".into(), args, Some(seccomp_memfd))
-+                ("@bwrap@".into(), args, Some(seccomp_memfd))
-             }
-             SandboxMechanism::FlatpakSpawn => {
-                 let memory_limit = Self::memory_limit();
-@@ -299,8 +299,8 @@ impl Sandbox {
-                 "/",
-                 // Make /usr available as read only
-                 "--ro-bind",
--                "/usr",
--                "/usr",
-+                "/nix/store",
-+                "/nix/store",
-                 // Make tmpfs dev available
-                 "--dev",
-                 "/dev",

pkgs/by-name/re/recordbox/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   appstream-glib,
   blueprint-compiler,
-  bubblewrap,
   cargo,
   dbus,
   desktop-file-utils,
@@ -15,39 +14,32 @@
   hicolor-icon-theme,
   lcms2,
   libadwaita,
+  libglycin,
   libseccomp,
   libxml2,
   meson,
   ninja,
   nix-update-script,
   pkg-config,
-  replaceVars,
   rustPlatform,
   rustc,
   sqlite,
   wrapGAppsHook4,
 }:
-
-let
-  glycinPathsPatch = replaceVars ./fix-glycin-paths.patch {
-    bwrap = "${bubblewrap}/bin/bwrap";
-  };
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "recordbox";
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromCodeberg {
     owner = "edestcroix";
     repo = "Recordbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9rrVlD+ODl+U9bPzbXGLQBLkbnfAm4SmJHRcVife33A=";
+    hash = "sha256-HskhMZy8y61c/j/F5e5aM41AQ8t+TCUq/iY23SFB92o=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-W60X69/fEq/X6AK1sbT6rb+SsF/oPzfUvrar0fihr88=";
+    hash = "sha256-xHukIMUG5himj1umKn+IKM7kJ29MH/pt/jPEHd2EeT0=";
   };
 
   strictDeps = true;
@@ -60,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib # For `glib-compile-schemas`
     gtk4 # For `gtk-update-icon-cache`
     libxml2 # For `xmllint`
+    libglycin.patchVendorHook
     meson
     ninja
     pkg-config
@@ -70,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libglycin.setupHook
+    glycin-loaders
     dbus
     gtk4
     hicolor-icon-theme
@@ -92,22 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
   cargoCheckType = if (finalAttrs.mesonBuildType != "debug") then "release" else "debug";
 
-  # Workaround copied from https://github.com/NixOS/nixpkgs/blob/e39fe935fc7537bee0440935c12f5c847735a291/pkgs/by-name/lo/loupe/package.nix#L60-L74
-  preConfigure = ''
-    # Dirty approach to add patches after cargoSetupPostUnpackHook
-    # We should eventually use a cargo vendor patch hook instead
-    pushd ../$(stripHash $cargoDeps)/glycin-2.*
-      patch -p3 < ${glycinPathsPatch}
-    popd
-  '';
-  preFixup = ''
-    # Needed for the glycin crate to find loaders.
-    # https://gitlab.gnome.org/sophie-h/glycin/-/blob/0.1.beta.2/glycin/src/config.rs#L44
-    gappsWrapperArgs+=(
-      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
-    )
-  '';
-
   checkPhase = ''
     runHook preCheck
 

pkgs/by-name/rh/rhvoice/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rhvoice";
-  version = "1.16.5";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     owner = "RHVoice";
     repo = "RHVoice";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-4l4S4MUnVGN/El1BBuZvzPPcavUefjMyBk1hk0ux7zo=";
+    hash = "sha256-CwwWZE60YxLL4kZBHdNqI/gk5yi6MFAJ2pg8LApwwl4=";
   };
 
   patches = [

pkgs/by-name/ry/ryzenadj/package.nix

@@ -4,20 +4,22 @@
   fetchFromGitHub,
   pciutils,
   cmake,
+  pkg-config,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ryzenadj";
-  version = "0.17.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-28ld8htm3DewTSV3WTG4dFOcX4JAEUMK9rq4AAm1/zY=";
+    sha256 = "sha256-SNtCKZ3bugawzD8R3DjwPs/ls3kyTw1LdIcXuR6fumc=";
   };
 
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [

pkgs/by-name/st/stellar-core/package.nix

@@ -129,10 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  postgresqlTestUserOptions = "LOGIN CREATEDB";
+  postgresqlTestUserOptions = "LOGIN SUPERUSER";
 
   postgresqlTestSetupPost = ''
-    for database in $(seq 0 15); do
+    for database in $(seq 0 3); do
       createdb "test$database"
     done
   '';

pkgs/by-name/ta/tail-tray/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tail-tray";
-  version = "0.2.32";
+  version = "0.2.33";
 
   src = fetchFromGitHub {
     owner = "SneWs";
     repo = "tail-tray";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8xo+4k3bdEZ7RHPLvkEWTddIwkwd5GQ3c+rFfq5kAw=";
+    hash = "sha256-OCzvdD1b3Rwk+dI9gmuFkaOwvfjUzFVXpslvfwKtDyk=";
   };
 
   nativeBuildInputs = with kdePackages; [

pkgs/by-name/xw/xwayland/package.nix

@@ -56,11 +56,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xwayland";
-  version = "24.1.11";
+  version = "24.1.12";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xwayland-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JxFaGogZB4QJv2/s/rdyToE3vTZCbecAWls6rgohOP8=";
+    hash = "sha256-bfAsURuSwbmEhzTZ0bA6TCT4N1ujytpE6WhKIbX3jiE=";
   };
 
   postPatch = ''

pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix

@@ -291,7 +291,7 @@
     };
 
     # No changes from 13.1 to 13.2
-    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    # https://docs.nvidia.com/cuda/archive/13.2.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
     "13.2" = {
       clang = {
         maxMajorVersion = "21";
@@ -302,5 +302,18 @@
         minMajorVersion = "6";
       };
     };
+
+    # No changes from 13.2 to 13.3
+    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "13.3" = {
+      clang = {
+        maxMajorVersion = "21";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "15";
+        minMajorVersion = "6";
+      };
+    };
   };
 }

pkgs/development/interpreters/python/default.nix

@@ -92,9 +92,9 @@
         major = "3";
         minor = "15";
         patch = "0";
-        suffix = "b1";
+        suffix = "b2";
       };
-      hash = "sha256-1NUsz6HXJ+9SNfu31w+h26zxC4s3YNtiKHXaBay+Q3w=";
+      hash = "sha256-0U9HSrZ56QvHNLAv9YRHtuyZqCGvYdb/DB2g+G40GnE=";
       inherit passthruFun;
     };
 

pkgs/development/ocaml-modules/chrome-trace/default.nix

@@ -1,21 +1,18 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
 }:
 
 buildDunePackage {
   pname = "chrome-trace";
-  inherit (dune_3) src version;
-
-  minimalOCamlVersion = "4.08";
-  duneVersion = "3";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 
   meta = {
     description = "Chrome trace event generation library";
-    inherit (dune_3.meta) homepage;
+    inherit (dune.meta) homepage;
     license = lib.licenses.mit;
   };
 }

pkgs/development/ocaml-modules/dune-action-plugin/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   dune-glob,
   dune-private-libs,
   dune-rpc,
@@ -9,9 +9,7 @@
 
 buildDunePackage {
   pname = "dune-action-plugin";
-  inherit (dune_3) src version;
-
-  duneVersion = "3";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 
@@ -22,7 +20,7 @@ buildDunePackage {
   ];
 
   meta = {
-    inherit (dune_3.meta) homepage;
+    inherit (dune.meta) homepage;
     description = "API for writing dynamic Dune actions";
     maintainers = [ ];
     license = lib.licenses.mit;

pkgs/development/ocaml-modules/dune-configurator/default.nix

@@ -1,16 +1,14 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   csexp,
 }:
 
 buildDunePackage {
   pname = "dune-configurator";
 
-  inherit (dune_3) src version patches;
-
-  minimalOCamlVersion = "4.05";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 

pkgs/development/ocaml-modules/dune-glob/default.nix

@@ -1,16 +1,14 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   dune-private-libs,
   re,
 }:
 
 buildDunePackage {
   pname = "dune-glob";
-  inherit (dune_3) src version;
-
-  duneVersion = "3";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 
@@ -20,7 +18,7 @@ buildDunePackage {
   ];
 
   meta = {
-    inherit (dune_3.meta) homepage;
+    inherit (dune.meta) homepage;
     description = "Glob string matching language supported by dune";
     maintainers = [ ];
     license = lib.licenses.mit;

pkgs/development/ocaml-modules/dune-private-libs/default.nix

@@ -1,18 +1,14 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   stdune,
 }:
 
 buildDunePackage {
   pname = "dune-private-libs";
 
-  duneVersion = "3";
-
-  inherit (dune_3) src version;
-
-  minimalOCamlVersion = "4.08";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 

pkgs/development/ocaml-modules/dune-rpc/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   csexp,
   stdune,
   ocamlc-loc,
@@ -13,9 +13,7 @@
 
 buildDunePackage {
   pname = "dune-rpc";
-  inherit (dune_3) src version;
-
-  duneVersion = "3";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 
@@ -31,7 +29,7 @@ buildDunePackage {
 
   meta = {
     description = "Library to connect and control a running dune instance";
-    inherit (dune_3.meta) homepage;
+    inherit (dune.meta) homepage;
     maintainers = [ ];
     license = lib.licenses.mit;
   };

pkgs/development/ocaml-modules/dune-site/default.nix

@@ -1,15 +1,13 @@
 {
   lib,
   buildDunePackage,
-  dune_3,
+  dune,
   dune-private-libs,
 }:
 
 buildDunePackage {
   pname = "dune-site";
-  inherit (dune_3) src version;
-
-  duneVersion = "3";
+  inherit (dune) src version;
 
   dontAddPrefix = true;
 
@@ -17,7 +15,7 @@ buildDunePackage {
 
   meta = {
     description = "Library for embedding location information inside executable and libraries";
-    inherit (dune_3.meta) homepage;
+    inherit (dune.meta) homepage;
     maintainers = [ ];
     license = lib.licenses.mit;
   };

pkgs/development/ocaml-modules/dyn/default.nix

@@ -1,14 +1,13 @@
 {
   buildDunePackage,
-  dune_3,
+  dune,
   ordering,
   pp,
 }:
 
 buildDunePackage {
   pname = "dyn";
-  inherit (dune_3) version src;
-  duneVersion = "3";
+  inherit (dune) version src;
 
   dontAddPrefix = true;
 
@@ -17,7 +16,7 @@ buildDunePackage {
     pp
   ];
 
-  meta = dune_3.meta // {
+  meta = dune.meta // {
     description = "Dynamic type";
   };
 }

pkgs/development/ocaml-modules/fs-io/default.nix

@@ -1,12 +1,12 @@
-{ buildDunePackage, dune_3 }:
+{ buildDunePackage, dune }:
 
 buildDunePackage {
   pname = "fs-io";
-  inherit (dune_3) version src;
+  inherit (dune) version src;
 
   dontAddPrefix = true;
 
-  meta = dune_3.meta // {
+  meta = dune.meta // {
     description = "Dune's file system IO library";
   };
 }

pkgs/development/ocaml-modules/top-closure/default.nix

@@ -1,12 +1,12 @@
-{ buildDunePackage, dune_3 }:
+{ buildDunePackage, dune }:
 
 buildDunePackage {
   pname = "top-closure";
-  inherit (dune_3) version src;
+  inherit (dune) version src;
 
   dontAddPrefix = true;
 
-  meta = dune_3.meta // {
+  meta = dune.meta // {
     description = "Dune's topological closure library";
   };
 }

pkgs/development/python-modules/biopandas/default.nix

@@ -22,6 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-dUeGjDDz9VA1NrFLGKy0ebaa+MU4c1tHi5YYkAspLRk=";
   };
 
+  postPatch = ''
+    substituteInPlace biopandas/mmtf/pandas_mmtf.py --replace-fail \
+      'int(np.argwhere(np.array(model_indices) > ch_idx)[0]) + 1' \
+      'int(np.argwhere(np.array(model_indices) > ch_idx)[0][0]) + 1'
+  '';
+
   pythonRelaxDeps = [ "looseversion" ];
 
   build-system = [ setuptools ];

pkgs/development/python-modules/coverage/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "coverage";
-  version = "7.14.0";
+  version = "7.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coveragepy";
     repo = "coveragepy";
     tag = finalAttrs.version;
-    hash = "sha256-tDq7s+bRt+cxy20Jskjr8sDfg3H+AOTSh3Tt+l5clkg=";
+    hash = "sha256-3/Q6TQfoZNM7bHjviw/C70i2ZgjobHnynmqX9qvreYQ=";
   };
 
   build-system = [ setuptools ];

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.33";
-      hash = "sha256-J/dbwzxkNE7bnhFygInJ3Ve67yrMQ34z10nMb/vtoWY=";
+      version = "6.18.34";
+      hash = "sha256-lDHBPXY716pDs+Hr6qS7zPJPEN1shMSK/V32SBLv4/s=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.0.10";
-      hash = "sha256-6sanwas9XXjeGVHe7WvLOVnbHJ6g0RXek9sfOCE8080=";
+      version = "7.0.11";
+      hash = "sha256-33/oVWqVRITtYeGfOATSe9Wckm/PeI1mioDrTPe8OmY=";
     };
   };
 

pkgs/top-level/all-packages.nix

@@ -2065,6 +2065,7 @@ with pkgs;
     cudaPackages_13_0
     cudaPackages_13_1
     cudaPackages_13_2
+    cudaPackages_13_3
     ;
 
   cudaPackages_12 = cudaPackages_12_9;

pkgs/top-level/cuda-packages.nix

@@ -174,6 +174,29 @@ let
       tensorrt =
         if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.14.1";
     };
+
+  cudaPackages_13_3 =
+    let
+      inherit (cudaPackages_13_3.backendStdenv) requestedJetsonCudaCapabilities;
+    in
+    mkCudaPackages {
+      cublasmp = "0.8.1";
+      cuda = "13.3.0";
+      cudnn =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "9.13.0" else "9.22.0";
+      cudss = "0.6.0";
+      cuquantum = "25.09.0";
+      cusolvermp = "0.8.0";
+      cusparselt = "0.8.1";
+      cutensor = "2.3.1";
+      nppplus = "0.10.0";
+      nvcomp = "5.0.0.6";
+      nvjpeg2000 = "0.9.0";
+      nvpl = "25.5";
+      nvtiff = "0.5.1";
+      tensorrt =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.14.1";
+    };
 in
 {
   inherit
@@ -183,5 +206,6 @@ in
     cudaPackages_13_0
     cudaPackages_13_1
     cudaPackages_13_2
+    cudaPackages_13_3
     ;
 }