Merge master into staging-next

maintainers/maintainer-list.nix

@@ -28971,6 +28971,12 @@
     github = "uxodb";
     githubId = 20535246;
   };
+  uzlkav = {
+    name = "Uzlkav";
+    github = "Uzlkav";
+    githubId = 177883133;
+    matrix = "@capybara_squash:unredacted.org";
+  };
   V = {
     name = "V";
     email = "v@anomalous.eu";

pkgs/build-support/node/fetch-pnpm-deps/default.nix

@@ -49,13 +49,9 @@ in
 
       filterFlags = lib.map (package: "--filter=${package}") pnpmWorkspaces;
 
-      pnpm-fixup-state-db' =
-        if pnpm.nodejs-slim or null != null then
-          pnpm-fixup-state-db.override {
-            inherit (pnpm) nodejs-slim;
-          }
-        else
-          pnpm-fixup-state-db;
+      pnpm-fixup-state-db' = pnpm-fixup-state-db.override {
+        inherit (pnpm) nodejs-slim;
+      };
     in
     assert
       fetcherVersion != null

pkgs/by-name/al/allmytoes/package.nix

@@ -2,6 +2,8 @@
   lib,
   nix-update-script,
   rustPlatform,
+  makeWrapper,
+  shared-mime-info,
   fetchFromGitLab,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -15,8 +17,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-BYKcDJN/uKESj0pnb2xvrx1lO6rOGdi+PVT6ywZqjbQ=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   cargoHash = "sha256-Pzbruv1E4mMohw//lf1JBoK+4BHDJVr4/9xXE4FrWbA==";
 
+  postInstall = ''
+    wrapProgram "$out/bin/allmytoes" --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   __structuredAttrs = true;

pkgs/by-name/am/amule/package.nix

@@ -21,6 +21,7 @@
   gtk3,
   libayatana-appindicator,
   libsysprof-capture,
+  libmaxminddb,
   libpng,
   pkg-config,
   readline,
@@ -52,13 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString enableDaemon "-daemon"
     + lib.optionalString client "-gui"
     + lib.optionalString textClient "-cmd";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "amule-org";
     repo = "amule";
     tag = finalAttrs.version;
-    hash = "sha256-2qQof2/JFTfOmqd25+YVWBpZgCDCOwf3NBo1aHcMPds=";
+    hash = "sha256-zLd8mt+dYEilGcFn3qspZv5EkZ4TmBbKgvgcuSvswFk=";
   };
 
   __structuredAttrs = true;
@@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     libayatana-appindicator
   ]
   ++ lib.optional httpServer libpng
+  ++ lib.optional (monolithic || enableDaemon || client) libmaxminddb
   # gettext runtime for NLS; on glibc libintl is part of libc
   ++ lib.optional (!stdenv.hostPlatform.isGnu) libintl
   # line editing in the interactive consoles of amulecmd and amuleweb

pkgs/by-name/an/antigravity-cli/package.nix

@@ -6,7 +6,7 @@
   versionCheckHook,
 }:
 let
-  wholeVersion = "1.0.8-6513509081677824"; # unfortunately this has dumb versioning
+  wholeVersion = "1.0.12-6156052174077952"; # unfortunately this has dumb versioning
   version = builtins.head (lib.splitString "-" wholeVersion);
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@@ -14,19 +14,19 @@ let
   sourceData = {
     x86_64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-/BxcglSN6NqZdEbq50MypFW4bv2bCN37L0PqcuYz+e4=";
+      hash = "sha256-fjB132jrrViqHPQiMenYuDvyiVtbBYqxc2sLY4PHUAg=";
     };
     aarch64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-QWQevvVezRdubRbG3V64C/XMHunfDsdA1OM8yhHoCHA=";
+      hash = "sha256-oDZ+WHWsG4imwLFjyG69XRPJvvkH9EaaZRb/aQIb8tQ=";
     };
     aarch64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-j+/brIYCKjIOa0KSGZHt4Ic4tjTzOrfPtA4J8iY9tHE=";
+      hash = "sha256-U/cwihF/cP5+7KSmkAToI5yOoYydguR5ZrKQMytpuCk=";
     };
     x86_64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-0Cp76whEYtBdZS6GOnC+qqICGoqexX+v3KCFJmfaFAU=";
+      hash = "sha256-A8YjMmFUiHKxdlR+OpOPQGKC+68z/83vtjw1yiJGt6g=";
     };
   };
 in

pkgs/by-name/aw/aws-ofi-nccl/package.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  autoAddDriverRunpath,
+  autoreconfHook,
+  numactl,
+  libuuid,
+  rdma-core,
+  libfabric,
+  hwloc,
+  cudaPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "aws-ofi-nccl";
+  version = "1.19.2";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-ofi-nccl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1gPIuZzS53cMRckiBkRRzMw3RzoAvu3v0xzt0rwyysk=";
+  };
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    numactl
+    libuuid
+    rdma-core
+    libfabric
+    hwloc
+  ]
+  ++ (with cudaPackages; [
+    cuda_cudart
+    nccl
+  ]);
+
+  postPatch = ''
+    patchShebangs m4
+    echo "$version" > .release_version
+  '';
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  configureFlags = [
+    "--enable-platform-aws"
+    "--with-cuda=${cudaPackages.cuda_nvcc}"
+    "--with-libfabric=${libfabric}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "This is a plugin which lets EC2 developers use libfabric as network provider while running NCCL applications";
+    homepage = "https://github.com/aws/aws-ofi-nccl";
+    changelog = "https://github.com/aws/aws-ofi-nccl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/bi/bisq1/package.nix

@@ -0,0 +1,258 @@
+{
+  stdenv,
+  lib,
+  makeBinaryWrapper,
+  fetchurl,
+  writeShellScript,
+  makeDesktopItem,
+  copyDesktopItems,
+  imagemagick,
+  zulu21,
+  dpkg,
+  zip,
+  xz,
+  gnupg,
+  coreutils,
+  tor,
+
+  # Native libraries required by the JavaFX natives that Bisq extracts from its bundled
+  # javafx-graphics jar into ~/.openjfx/cache at runtime. Those .so files are
+  # bare (no rpath), so every direct needed library must be on LD_LIBRARY_PATH.
+  # The set below is exactly the verified closure (readelf NEEDED + ldd not_found=0).
+  gtk3,
+  glib,
+  cairo,
+  pango,
+  atk,
+  gdk-pixbuf,
+  harfbuzz,
+  freetype,
+  fontconfig,
+  libGL,
+  libglvnd,
+  libx11,
+  libxtst,
+  libxxf86vm,
+}:
+
+let
+  version = "1.10.2";
+
+  # JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not
+  # strictly required (Bisq bundles its own JavaFX jars), but mirrors the
+  # sibling bisq2 package and gives a JDK that can host JavaFX.
+  jdk = zulu21.override {
+    enableJavaFX = true;
+  };
+
+  # JVM arguments sourced from bisq/desktop/build.gradle, applicationDefaultJvmArgs
+  bisqJvmArgs = lib.concatStringsSep " " [
+    "-XX:MaxRAM=8g"
+    "-Xss1280k"
+    "-XX:+UseG1GC"
+    "-XX:MaxHeapFreeRatio=10"
+    "-XX:MinHeapFreeRatio=5"
+    "-XX:+UseStringDeduplication"
+    "-Djava.net.preferIPv4Stack=true"
+    "--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED"
+  ];
+
+  # JVM arguments added for nixpkgs, not present in the bisq source tree.
+  nixpkgsJvmArgs = lib.concatStringsSep " " [
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXSpinnerSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.NodeHelper (in module javafx.graphics) because module javafx.graphics does not export com.sun.javafx.scene to unnamed module @0x77ec78b9
+    "--add-exports=javafx.graphics/com.sun.javafx.scene=ALL-UNNAMED"
+
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXTabPaneSkin$TabHeaderContainer (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.LambdaMultiplePropertyChangeListenerHandler (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control to unnamed module @0x77ec78b9
+    "--add-exports=javafx.controls/com.sun.javafx.scene.control=ALL-UNNAMED"
+
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXTabPaneSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.behavior.TabPaneBehavior (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control.behavior to unnamed module @0x77ec78b9
+    "--add-exports=javafx.controls/com.sun.javafx.scene.control.behavior=ALL-UNNAMED"
+  ];
+
+  bisq-launcher =
+    args:
+    writeShellScript "bisq-launcher" ''
+      exec "${lib.getExe jdk}" \
+        ${bisqJvmArgs} \
+        ${nixpkgsJvmArgs} \
+        -classpath @out@/lib/app/desktop.jar:@out@/lib/app/* \
+        ${args} bisq.desktop.app.BisqAppMain "$@"
+    '';
+
+  # keys taken from bisq/docs/release-process.md
+  publicKey = {
+    "E222AA02" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc";
+      hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+    };
+
+    "4A133008" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc";
+      hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+    };
+
+    "387C8307" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc";
+      hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+    };
+  };
+
+  binPath = lib.makeBinPath [
+    coreutils
+    tor
+  ];
+
+  libraryPath = lib.makeLibraryPath [
+    gtk3
+    glib
+    cairo
+    pango
+    atk
+    gdk-pixbuf
+    harfbuzz
+    freetype
+    fontconfig
+    libGL
+    libglvnd
+    libx11
+    libxtst
+    libxxf86vm
+    stdenv.cc.cc
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit version;
+
+  pname = "bisq1";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
+    hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A=";
+
+    # Verify the upstream Debian package's detached PGP signature prior to use.
+    # This ensures that a successful build of this Nix package requires the
+    # signed Debian package to pass verification, preserving Bisq's trust model.
+    nativeBuildInputs = [ gnupg ];
+    downloadToTemp = true;
+
+    postFetch = ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=./gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      ln -s $downloadedFile ./Bisq-64bit-${version}.deb
+      ln -s ${finalAttrs.signature} ./signature.asc
+      gpg --import ${publicKey."E222AA02"}
+      gpg --import ${publicKey."4A133008"}
+      gpg --import ${publicKey."387C8307"}
+      gpg --batch --verify signature.asc Bisq-64bit-${version}.deb
+      popd
+      mv $downloadedFile $out
+    '';
+  };
+
+  signature = fetchurl {
+    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc";
+    hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    dpkg
+    imagemagick
+    makeBinaryWrapper
+    zip
+    xz
+    gnupg
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "bisq";
+      exec = "bisq";
+      icon = "bisq";
+      desktopName = "Bisq";
+      genericName = "Decentralized bitcoin exchange";
+      categories = [
+        "Network"
+        "P2P"
+      ];
+    })
+
+    (makeDesktopItem {
+      name = "bisq-hidpi";
+      exec = "bisq-hidpi";
+      icon = "bisq";
+      desktopName = "Bisq (HiDPI)";
+      genericName = "Decentralized bitcoin exchange";
+      categories = [
+        "Network"
+        "P2P"
+      ];
+    })
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg -x $src .
+    runHook postUnpack
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Replace the Tor binary bundled in tor-binary-linux64-*.jar
+    # (native/linux/x64/tor.tar.xz) with the Tor binary from Nixpkgs. The
+    # bundled tor is a dynamically-linked ELF expecting the
+    # /lib64/ld-linux-x86-64.so.2 interpreter, which does not exist on NixOS.
+    makeWrapper ${lib.getExe' tor "tor"} ./tor
+    mkdir -p native/linux/x64
+    tar -cf - ./tor | xz > native/linux/x64/tor.tar.xz
+    zip opt/bisq/lib/app/tor-binary-linux64-*.jar native/linux/x64/tor.tar.xz >/dev/null
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib $out/bin
+    cp -r opt/bisq/lib/app $out/lib
+
+    install -D -m 777 ${bisq-launcher ""} $out/bin/bisq
+    substituteAllInPlace $out/bin/bisq
+    wrapProgram $out/bin/bisq --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
+
+    install -D -m 777 ${bisq-launcher "-Dglass.gtk.uiScale=2.0"} $out/bin/bisq-hidpi
+    substituteAllInPlace $out/bin/bisq-hidpi
+    wrapProgram $out/bin/bisq-hidpi --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
+
+    for n in 16 24 32 48 64 96 128 256; do
+      size=$n"x"$n
+      magick opt/bisq/lib/Bisq.png -resize $size bisq.png
+      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Decentralized bitcoin exchange network (Bisq 1)";
+    homepage = "https://bisq.network";
+    mainProgram = "bisq";
+    sourceProvenance = with lib.sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ pmw ];
+    platforms = [
+      "x86_64-linux"
+    ];
+  };
+})

pkgs/by-name/ca/calibre/package.nix

@@ -40,11 +40,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "9.9.0";
+  version = "9.10.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ozwoRlJThVLiFmaR0fXdfxLDTEF4935rQGLZ+MzwXLk=";
+    hash = "sha256-U7iid8dm5sP7Xfsm+ikRn0oSm/j5qVS0I1qWPIowwwE=";
   };
 
   patches =

pkgs/by-name/co/codex/package.nix

@@ -26,18 +26,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.142.0";
+  version = "0.142.2";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-F8wlv0vSuljNFDgIzoeuVxvD0dk90z2FBtpBTMih7AA=";
+    hash = "sha256-580LZSn3+lqyW5x7zkVX0TjW+d6apb/P1eG4q586dio=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-fvEFNE12J6zaLZrN6oQB8X+jXoKPSCWrL17Sl28+7/c=";
+  cargoHash = "sha256-1gDiCB3Nf/0aIm+EoL3g9C0xbCi3cv6TfH5VytjJpOY=";
 
   __structuredAttrs = true;
 

pkgs/by-name/do/dolphin-emu/package.nix

@@ -55,13 +55,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolphin-emu";
-  version = "2603a";
+  version = "2606";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
     tag = finalAttrs.version;
-    hash = "sha256-+3/JtjKFsTEkKQa0LjycqNmDz0M8o2FndWQtw5R5/jQ=";
+    hash = "sha256-Rs/b5Vnm1VAYpvC6YWj3bZqHBCw2SCHnzLro1UrvsdY=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''

pkgs/by-name/gr/gren/generated-backend-package.nix

@@ -29,11 +29,11 @@
 }:
 mkDerivation {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
   src = fetchgit {
     url = "https://github.com/gren-lang/compiler.git";
-    sha256 = "1865x63y0kcp2ax49333i5512vwh845iiyq3b30jm31pr113csvr";
-    rev = "ba2a2153b78086d75fe01ba45bdd630d6f5fc2fc";
+    sha256 = "02hin22kyh2zgxn2fklnfa60iw3ppfr3xnv4z7r39vkf6c2q7fhq";
+    rev = "03c52374f82036e7a3276a94e345a4aa98738b9b";
     fetchSubmodules = true;
   };
   isLibrary = false;
@@ -83,6 +83,6 @@ mkDerivation {
   jailbreak = true;
   homepage = "https://gren-lang.org";
   description = "The `gren` command line interface";
-  license = lib.licensesSpdx."BSD-3-Clause";
+  license = lib.meta.getLicenseFromSpdxId "BSD-3-Clause";
   mainProgram = "gren";
 }

pkgs/by-name/gr/gren/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "gren-lang";
     repo = "compiler";
     tag = finalAttrs.version;
-    hash = "sha256-eWs2Qsg3jCrBWAP7GAtBkG8RSoljjES6EpdN4IfpxaA=";
+    hash = "sha256-GLqDBTNu7jTy+WTbPrK7d/AIjHKWTidsf19AP4WwEQo=";
   };
 
   buildInputs = [ nodejs ];

pkgs/by-name/in/intel-llvm/package.nix

@@ -111,7 +111,20 @@ let
         mkdir "$rsrc"
         echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
         ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
-      '';
+      ''
+      + (lib.concatStrings (
+        lib.mapAttrsToList (k: v: ''
+          echo "export ${k}=${v}" >> $out/nix-support/setup-hook
+        '') self.unwrapped.unified-runtime.setupVars
+      ))
+
+      + (lib.optionalString (self.unwrapped.unified-runtime.setupVars ? CUDA_PATH) ''
+        # SYCL CUDA runtime libs (e.g. libonemath_blas_cublas.so) carry DT_NEEDED: libcuda.so.1.
+        # GNU ld resolves transitive DT_NEEDED via -rpath-link, not -L; point it at the stubs.
+        echo "-rpath-link,${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/lib/stubs" >> $out/nix-support/cc-ldflags
+        # The SYCL CUDA backend discovers libdevice by finding ptxas in PATH.
+        echo "export PATH=${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/bin''${PATH:+:$PATH}" >> $out/nix-support/setup-hook
+      '');
 
       extraPackages =
         # We need to explicitly link to the dev package to get headers like sycl.hpp

pkgs/by-name/in/intel-llvm/unified-runtime.nix

@@ -18,6 +18,7 @@
   pkg-config,
   lit,
   filecheck,
+  buildPackages,
   rocmPackages ? { },
   rocmGpuTargets ? lib.optionalString (rocmPackages ? clr.gpuTargets) (
     builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets
@@ -41,10 +42,22 @@ let
     ];
   };
 
+  # Minimal rocm join required at runtime
+  # We pass this to clang in its wrapper later.
+  # This is a separate join from the above because we don't
+  # need to pull in hsakmt and comgr at runtime, only build time.
+  rocmPath = symlinkJoin {
+    name = "rocm-path";
+    paths = with rocmPackages; [
+      clr
+      rocm-device-libs
+    ];
+  };
+
   cudatoolkit_joined = symlinkJoin {
     name = "cuda-merged";
 
-    paths = with cudaPackages; [
+    paths = with buildPackages.cudaPackages; [
       cuda_cudart
       cuda_nvcc
       cuda_nvml_dev.include
@@ -158,6 +171,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CUDA_cupti_LIBRARY" "${cudatoolkit_joined}/lib/libcupti.so")
   ];
 
+  passthru.setupVars =
+    lib.optionalAttrs rocmSupport { ROCM_PATH = rocmPath; }
+    // lib.optionalAttrs cudaSupport { CUDA_PATH = cudatoolkit_joined; };
+
   passthru.backends =
     lib.optionals levelZeroSupport [
       "level_zero"

pkgs/by-name/ku/kube-state-metrics/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kube-state-metrics";
-  version = "2.17.0";
+  version = "2.19.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kube-state-metrics";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w55FOWw9p7yV/bt4leZucOLqjVyHYFF+gVLWLGQKF9M=";
+    hash = "sha256-PZC3ZiVnChy7IdibZKB3IRv8+1AfmvAWY7RquwTcS1Y=";
   };
 
-  vendorHash = "sha256-pcoqeYyOehFNkwD4fWqrk9725BJkv+8sKy1NLv+HJPE=";
+  vendorHash = "sha256-vmmXEDzkv+ZQaKJ6++HpPHj2M9gaquonNjXG2DOlxwI=";
 
   excludedPackages = [
     "./tests/e2e"

pkgs/by-name/lx/lxmf-rs/package.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lxmf-rs";
-  version = "0.5.0";
+  version = "0.5.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "FreeTAKTeam";
     repo = "LXMF-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9yTteJCH/5/LGvp6AH74oKYcnue1NetD7DG3fMz+D2Y=";
+    hash = "sha256-ztJHjapogSF1qzyCBsi6mu3ByLdVTBt8y2OVEFyohKk=";
   };
 
-  cargoHash = "sha256-a6O1VslizDom6AuJKF5xZgKNSgrw1EfvJRWpG9J7Le8=";
+  cargoHash = "sha256-g80lnqJ8VxGg0zHqHsQCvJO9AgXFE0ABysSr+XjXBAk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ml/mlkit/package.nix

@@ -27,11 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
     "mlkit_libs"
     "smltojs"
     "smltojs_basislibs"
+    "barry"
   ];
 
   installTargets = [
     "install"
     "install_smltojs"
+    "install_barry"
   ];
 
   doCheck = true;
@@ -46,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     make -C test_dev test
     echo ==== Running MLKit test suite: test_prof ====
     make -C test_dev test_prof
+    echo ==== Running Barry test suite ====
+    make -C test/barry
     runHook postCheck
   '';
 
@@ -54,7 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://elsman.com/mlkit/";
     changelog = "https://github.com/melsman/mlkit/blob/v${finalAttrs.version}/NEWS.md";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
+    platforms = [
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
     maintainers = with lib.maintainers; [ athas ];
   };
 })

pkgs/by-name/np/npm-groovy-lint/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  buildNpmPackage,
+  versionCheckHook,
+  jdk,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "npm-groovy-lint";
+  version = "17.0.5";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "nvuillam";
+    repo = "npm-groovy-lint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Cq4SPOqR2mb2Foc1jlrA6B7qJBcmgLfcC84iTc4+tcw=";
+  };
+
+  npmDepsHash = "sha256-XGXiuqA0JmuFVretXDjWejV9HJAK6eWR9/LR3rUI99s=";
+
+  passthru.updateScript = nix-update-script { };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ jdk ])
+  ];
+
+  meta = {
+    description = "Lint, format and auto-fix your Groovy / Jenkinsfile / Gradle files using command line";
+    homepage = "https://github.com/nvuillam/npm-groovy-lint";
+    changelog = "https://github.com/nvuillam/npm-groovy-lint/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "npm-groovy-lint";
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/pe/pear-desktop/package.nix

@@ -7,7 +7,7 @@
   python3,
   copyDesktopItems,
   nodejs,
-  pnpm_10_29_2,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeDesktopItem,
@@ -31,9 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10_29_2;
-    fetcherVersion = 3;
-    hash = "sha256-BHxieFMMUFbHJHWu8spz0z803kx+kwJ99oYkDpm6a58=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-BNvAGM9ECtptDwxWsmJVq82Bky1AxslYt51FyvOBEvs=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     nodejs
     pnpmConfigHook
-    pnpm_10_29_2
+    pnpm_10
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ copyDesktopItems ];
 

pkgs/by-name/pr/protonup-qt/package.nix

@@ -3,25 +3,27 @@
   appimageTools,
   fetchurl,
   makeWrapper,
+  nix-update-script,
 }:
-
-appimageTools.wrapAppImage rec {
+let
   pname = "protonup-qt";
-  version = "2.14.0";
+  version = "2.15.1";
 
-  src = appimageTools.extractType2 {
-    inherit pname version;
-    src = fetchurl {
-      url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-      hash = "sha256-OdogpqqNZiwKqj2ELfmAw/601iVHMsTqxl5CUjqRQBs=";
-    };
+  src = fetchurl {
+    url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
+    hash = "sha256-/Xjvsf+gkHpSV4RGJJS5tCk4+f18AZ8+rqO4+vg36ME=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
   nativeBuildInputs = [ makeWrapper ];
 
   extraInstallCommands = ''
-    install -Dm644 ${src}/net.davidotek.pupgui2.desktop $out/share/applications/protonup-qt.desktop
-    install -Dm644 ${src}/net.davidotek.pupgui2.png $out/share/pixmaps/protonup-qt.png
+    install -Dm644 ${appimageContents}/net.davidotek.pupgui2.desktop $out/share/applications/protonup-qt.desktop
+    install -Dm644 ${appimageContents}/net.davidotek.pupgui2.png $out/share/pixmaps/protonup-qt.png
     substituteInPlace $out/share/applications/protonup-qt.desktop \
       --replace-fail "Exec=net.davidotek.pupgui2" "Exec=protonup-qt" \
       --replace-fail "Icon=net.davidotek.pupgui2" "Icon=protonup-qt"
@@ -32,6 +34,8 @@ appimageTools.wrapAppImage rec {
 
   extraPkgs = pkgs: with pkgs; [ zstd ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://davidotek.github.io/protonup-qt/";
     description = "Install and manage Proton-GE and Luxtorpeda for Steam and Wine-GE for Lutris with this graphical user interface";

pkgs/by-name/ru/rura/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rura";
-  version = "1.5.0";
+  version = "1.7.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tlipinski";
     repo = "rura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AL8qrO6QlHD+cLMEjgfH/4cLqxsRapp9nxJ/eMe0uic=";
+    hash = "sha256-rz8Hmxse1THGH3inGP3K+7JY3Lh9qaGUdESSHkai82c=";
   };
 
-  cargoHash = "sha256-t/ylPVTi0AAumiixU5oaFgldtKkwYvuETjaxCwzveDk=";
+  cargoHash = "sha256-Ytbo8fVf6oAHGQvicU3TFGQxoYh36CISuRaMwd1Ysf4=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/sc/scotch/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scotch";
-  version = "7.0.11";
+  version = "7.0.12";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
     owner = "scotch";
     repo = "scotch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ljz4Xu3ztxhx8c+gRYABG85T9SuauQc4UsVHPmREvkk=";
+    hash = "sha256-DE0VCGCSOOeSRIz/LQPCBNSBTNmXQtYAUKm3EeqnDBs=";
   };
 
   outputs = [

pkgs/by-name/st/starc/package.nix

@@ -6,10 +6,10 @@
 }:
 let
   pname = "starc";
-  version = "0.8.0";
+  version = "0.8.2";
   src = fetchurl {
     url = "https://github.com/story-apps/starc/releases/download/v${version}/starc-setup.AppImage";
-    hash = "sha256-0lD2mpHslOGgvGG8edPqlhyNi9ewzSgN+Eaabbcs7CI=";
+    hash = "sha256-7uwc4gD+AlbYGMffaWj3v2Zt2x6P5edPXY3BsznBNdQ=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/sw/swaytreesave/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  versionCheckHook,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "swaytreesave";
+  version = "0.4.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "fabienjuif";
+    repo = "swaytreesave";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aAJBbauOiFERABF13hMhxyvRBzcx5c1F+vbm/U+JS8o=";
+  };
+
+  cargoHash = "sha256-5nI7YJyCu7kZTa+Gsp0LCQXNjwVhUqOAxLC7XGtfKVk=";
+
+  meta = {
+    description = "CLI to save and load your compositors tree/layout";
+    homepage = "https://github.com/fabienjuif/swaytreesave";
+    changelog = "https://github.com/fabienjuif/swaytreesave/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      uzlkav
+    ];
+    mainProgram = "swaytreesave";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/development/python-modules/hacking/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "hacking";
-  version = "8.0.0";
+  version = "8.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-N89wYj7PMkdMTNYWSCeuff9HU62n+e/HBeiIOhAPi7I=";
+    hash = "sha256-PHjOx8Wkq7SQmlJS1mq5PpswayGthmV+LCA8eLUiQx8=";
   };
 
   postPatch = ''

pkgs/development/python-modules/mcstatus/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mcstatus";
-  version = "13.1.0";
+  version = "14.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-mine";
     repo = "mcstatus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fn2i9CCO5wESKSpeM8YlqrzF6RCwBbYQs2wSEgOYAcE=";
+    hash = "sha256-EyBaBC1Ly2549oFohtEulQMXIeRhQjtzvO+XPmwl8Zs=";
   };
 
   build-system = [

pkgs/development/python-modules/pyenphase/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyenphase";
-  version = "2.4.9";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyenphase";
     repo = "pyenphase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-owjJEIaaF6J4IukNtT9IGXGXINgK2c+yaOS9xYV5kRU=";
+    hash = "sha256-yc9Klsaly4+eMM6v3NFMc948drq/Wum8ILfdTCNJx/c=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];

pkgs/development/tools/pnpm/default.nix

@@ -20,6 +20,15 @@ let
     "10_29_2" = {
       version = "10.29.2";
       hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "10" = {
       version = "10.34.0";
@@ -35,6 +44,7 @@ let
     variant:
     callPackage ./generic.nix {
       inherit (variant) version hash;
+      knownVulnerabilities = variant.knownVulnerabilities or [ ];
       #FIXME: remove this hack in a future version.
       nodejs = null; # Passing null to detect out-of-tree overrides
     };

pkgs/development/tools/pnpm/generic.nix

@@ -17,6 +17,7 @@
   withNode ? true,
   version,
   hash,
+  knownVulnerabilities,
 }:
 let
   majorVersion = lib.versions.major version;
@@ -170,5 +171,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.all;
     mainProgram = "pnpm";
+    inherit knownVulnerabilities;
   };
 })