Merge release-26.05 into staging-nixos-26.05

ci/eval/attrpaths.nix

@@ -1,85 +0,0 @@
-# This expression will, as efficiently as possible, dump a
-# *superset* of all attrpaths of derivations which might be
-# part of a release on *any* platform.
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the attrnames:
-#
-#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  justAttrNames =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [ path ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (justAttrNames (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  paths = [
-    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-    # Until these have been removed from release.nix / hydra, we manually add them to the list.
-    [
-      "pkgsLLVM"
-      "stdenv"
-    ]
-    [
-      "pkgsArocc"
-      "stdenv"
-    ]
-    [
-      "pkgsZig"
-      "stdenv"
-    ]
-    [
-      "pkgsStatic"
-      "stdenv"
-    ]
-    [
-      "pkgsMusl"
-      "stdenv"
-    ]
-  ]
-  ++ justAttrNames [ ] outpaths;
-
-  names = map lib.showAttrPath paths;
-
-in
-{
-  inherit paths names;
-}

ci/eval/chunk.nix

@@ -2,8 +2,8 @@
 {
   lib ? import ../../lib,
   path ? ../..,
-  # The file containing all available attribute paths, which are split into chunks here
-  attrpathFile,
+  # The file containing the preEval result
+  preEvalFile,
   chunkSize,
   myChunk,
   includeBroken,
@@ -12,12 +12,13 @@
 }:
 
 let
-  attrpaths = lib.importJSON attrpathFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
+  preEvalResult = lib.importJSON preEvalFile;
+  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize preEvalResult.paths;
 
   unfiltered = import ./outpaths.nix {
     inherit path;
     inherit includeBroken systems;
+    inherit (preEvalResult) attrPathsDisallowedForInternalUse;
     extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
   };
 

ci/eval/default.nix

@@ -38,7 +38,7 @@ let
       fileset = unions (
         map (lib.path.append ../..) [
           ".version"
-          "ci/eval/attrpaths.nix"
+          "ci/eval/pre-eval.nix"
           "ci/eval/chunk.nix"
           "ci/eval/outpaths.nix"
           "default.nix"
@@ -56,11 +56,11 @@ let
     builtins.readFile ../../pkgs/top-level/release-supported-systems.json
   );
 
-  attrpathsSuperset =
+  preEval =
     {
       evalSystem,
     }:
-    runCommand "attrpaths-superset.json"
+    runCommand "pre-eval"
       {
         src = nixpkgs;
         # Don't depend on -dev outputs to reduce closure size for CI.
@@ -73,15 +73,15 @@ let
         export NIX_STATE_DIR=$(mktemp -d)
         mkdir $out
         export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
+        command time -f "Pre-eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/attrpaths.nix" \
-            -A paths \
+            "$src/ci/eval/pre-eval.nix" \
+            -A result \
             -I "$src" \
             --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/paths.json
+            --option eval-system "${evalSystem}" > $out/result.json
       '';
 
   singleSystem =
@@ -90,8 +90,8 @@ let
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem ? builtins.currentSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
+      # The path to the `result.json` file from `preEval`
+      preEvalFile ? "${preEval { inherit evalSystem; }}/result.json",
     }:
     let
       singleChunk = writeShellScript "single-chunk" ''
@@ -121,12 +121,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
+          --arg preEvalFile "${preEvalFile}" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${attrpathFile} \
+          -I ${preEvalFile} \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,7 +164,7 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
+        attrCount=$(jq '.paths | length' "${preEvalFile}")
         echo "Attribute count: $attrCount"
         echo "Chunk size: $chunkSize"
         # Same as `attrCount / chunkSize` but rounded up
@@ -316,7 +316,7 @@ let
 in
 {
   inherit
-    attrpathsSuperset
+    preEval
     singleSystem
     diff
     combine

ci/eval/outpaths.nix

@@ -6,7 +6,7 @@
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by ./attrpaths.nix
+  # used by ./pre-eval.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
@@ -14,6 +14,8 @@
     builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
   ),
 
+  attrPathsDisallowedForInternalUse ? [ ],
+
   # Customize the config used to evaluate nixpkgs
   extraNixpkgsConfig ? { },
 }:
@@ -35,6 +37,22 @@ let
             allowVariants = !attrNamesOnly;
             checkMeta = true;
 
+            # We don't need to care about problems being caught using the
+            # standard mechanism, because any problems whose kind is not
+            # nixpkgsInternalUseAllowed cause the corresponding attributes to
+            # be disallowed entirely for internal use with
+            # attrPathsDisallowedForInternalUse, see also ./pre-eval.nix
+            problems.matchers = lib.mkForce [
+              # We only need to set the broken handler to error, so that CI
+              # doesn't evaluate those. No reason it couldn't evaluate them
+              # afaik, but this is how it's been before.
+              {
+                kind = "broken";
+                handler = "error";
+              }
+            ];
+            inherit attrPathsDisallowedForInternalUse;
+
             # Silence the `x86_64-darwin` deprecation warning.
             allowDeprecatedx86_64Darwin = true;
 

ci/eval/pre-eval.nix

@@ -0,0 +1,128 @@
+# This file does a fast pre-evaluation of Nixpkgs to determine:
+# - paths: A *superset* of all attrpaths of derivations which might be part of a release on *any* platform.
+# - attrPathsDisallowedForInternalUse: Attribute paths whose meta.problems has problems whose kinds should not be used internally in Nixpkgs
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the result:
+#
+#   nix-instantiate --eval --strict --json ci/eval/pre-eval.nix -A result
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+  extraNixpkgsConfigJson ? "{}",
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  listAttrs =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [
+            {
+              inherit path value;
+            }
+          ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (listAttrs (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
+    attrNamesOnly = true;
+  };
+
+  list =
+    map
+      (path: {
+        inherit path;
+        # This looks a bit weird, but the only reason we care about this value
+        # is for the meta.problems check below, and stdenv's certainly don't
+        # have any problems, so this is fine :)
+        value = { };
+      })
+      [
+        # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+        # Until these have been removed from release.nix / hydra, we manually add them to the list.
+        [
+          "pkgsLLVM"
+          "stdenv"
+        ]
+        [
+          "pkgsArocc"
+          "stdenv"
+        ]
+        [
+          "pkgsZig"
+          "stdenv"
+        ]
+        [
+          "pkgsStatic"
+          "stdenv"
+        ]
+        [
+          "pkgsMusl"
+          "stdenv"
+        ]
+      ]
+    ++ listAttrs [ ] outpaths;
+  paths = map (attrs: attrs.path) list;
+  names = map lib.showAttrPath paths;
+
+  inherit (import ../../pkgs/stdenv/generic/problems.nix { inherit lib; })
+    disallowNixpkgsInternalUseKinds
+    ;
+
+  # Determine the list of attributes whose packages have any meta.problems
+  # with a kind that's disallowed from internal Nixpkgs use
+  attrPathsDisallowedForInternalUse = lib.pipe list [
+    (lib.map (
+      attrs:
+      attrs
+      // {
+        problematicProblems = builtins.tryEval (
+          lib.filterAttrs (name: problem: disallowNixpkgsInternalUseKinds ? ${problem.kind}) (
+            attrs.value.meta.problems or { }
+          )
+        );
+      }
+    ))
+    (lib.filter (attrs: attrs.problematicProblems.success && attrs.problematicProblems.value != { }))
+    (lib.map (attrs: {
+      attrPath = attrs.path;
+      reason = "it has certain meta.problems whose kinds are disallowed: ${
+        lib.generators.toPretty { } attrs.problematicProblems.value
+      }";
+    }))
+  ];
+in
+{
+  # TODO: Do we still need these? Probably not
+  inherit paths names;
+  result = {
+    inherit paths attrPathsDisallowedForInternalUse;
+  };
+}

nixos/tests/all-tests.nix

@@ -407,25 +407,25 @@ in
   corerad = runTest ./corerad.nix;
   corteza = runTest ./corteza.nix;
   cosmic = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin-noxwayland";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = false;
   };
   cosmic-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-noxwayland";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = false;

nixos/tests/cosmic.nix

@@ -1,147 +0,0 @@
-{
-  config,
-  lib,
-  testName,
-  enableAutologin,
-  enableXWayland,
-  ...
-}:
-
-{
-  name = testName;
-
-  meta.maintainers = lib.teams.cosmic.members;
-
-  nodes.machine = {
-    imports = [ ./common/user-account.nix ];
-
-    services = {
-      # For `cosmic-store` to be added to `environment.systemPackages`
-      # and for it to work correctly because Flatpak is a runtime
-      # dependency of `cosmic-store`.
-      flatpak.enable = true;
-
-      displayManager.cosmic-greeter.enable = true;
-      desktopManager.cosmic = {
-        enable = true;
-        xwayland.enable = enableXWayland;
-      };
-    };
-
-    services.displayManager.autoLogin = lib.mkIf enableAutologin {
-      enable = true;
-      user = "alice";
-    };
-
-    environment.systemPackages = with config.node.pkgs; [
-      # These two packages are used to check if a window was opened
-      # under the COSMIC session or not. Kinda important.
-      # TODO: Move the check from the test module to
-      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
-      # Wayland-only testing can be done using the existing testing
-      # infrastructure.
-      jq
-      lswt
-    ];
-
-    # So far, all COSMIC tests launch a few GUI applications. In doing
-    # so, the default allocated memory to the guest of 1024M quickly
-    # poses a very high risk of an OOM-shutdown which is worse than an
-    # OOM-kill. Because now, the test failed, but not for a genuine
-    # reason, but an OOM-shutdown. That's an inconclusive failure
-    # which might possibly mask an actual failure. Not enabling
-    # systemd-oomd because we need said applications running for a
-    # few seconds. So instead, bump the allocated memory to the guest
-    # from 1024M to 4x; 4096M.
-    virtualisation.memorySize = 4096;
-  };
-
-  testScript =
-    { nodes, ... }:
-    let
-      cfg = nodes.machine;
-      user = cfg.users.users.alice;
-      DISPLAY = lib.strings.optionalString enableXWayland (
-        if enableAutologin then "DISPLAY=:0" else "DISPLAY=:1"
-      );
-      emptyPDF = config.node.pkgs.stdenvNoCC.mkDerivation {
-        name = "empty-pdf";
-        dontUnpack = true;
-        nativeBuildInputs = [ config.node.pkgs.imagemagick ];
-        buildPhase = ''
-          magick xc:none -page Letter empty.pdf
-        '';
-        installPhase = ''
-          mkdir $out
-          mv empty.pdf $out/empty.pdf
-        '';
-      };
-    in
-    ''
-      #testName: ${testName}
-    ''
-    + (
-      if enableAutologin then
-        ''
-          with subtest("cosmic-greeter initialisation"):
-              machine.wait_for_unit("graphical.target", timeout=120)
-        ''
-      else
-        ''
-          from time import sleep
-
-          machine.wait_for_unit("graphical.target", timeout=120)
-          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
-          # Sleep for 10 seconds for ensuring that `greetd` loads the
-          # password prompt for the login screen properly.
-          sleep(10)
-
-          with subtest("cosmic-session login"):
-              machine.send_chars("${user.password}\n", delay=0.2)
-        ''
-    )
-    + ''
-          # _One_ of the final processes to start as part of the
-          # `cosmic-session` target is the Workspaces applet. So, wait
-          # for it to start. The process existing means that COSMIC
-          # now handles any opened windows from now on.
-          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'", timeout=30)
-
-      # The best way to test for Wayland and XWayland is to launch
-      # the GUI applications and see the results yourself.
-      with subtest("Launch applications"):
-          # key: binary_name
-          # value: "app-id" as reported by `lswt`
-          gui_apps_to_launch = {}
-
-          # We want to ensure that the first-party applications
-          # start/launch properly.
-          gui_apps_to_launch['cosmic-edit'] = 'com.system76.CosmicEdit'
-          gui_apps_to_launch['cosmic-files'] = 'com.system76.CosmicFiles'
-          gui_apps_to_launch['cosmic-player'] = 'com.system76.CosmicPlayer'
-          gui_apps_to_launch['cosmic-reader'] = 'com.system76.CosmicReader'
-          gui_apps_to_launch['cosmic-settings'] = 'com.system76.CosmicSettings'
-          gui_apps_to_launch['cosmic-store'] = 'com.system76.CosmicStore'
-          gui_apps_to_launch['cosmic-term'] = 'com.system76.CosmicTerm'
-
-          for gui_app, app_id in gui_apps_to_launch.items():
-              # Don't fail the test if binary is absent
-              if machine.execute(f"su - ${user.name} -c 'command -v {gui_app}'", timeout=5)[0] == 0:
-                  match gui_app:
-                      case 'cosmic-reader':
-                          opt_arg = '${emptyPDF}/empty.pdf'
-                      case _:
-                          opt_arg = ""
-
-                  machine.succeed(f"su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} ${DISPLAY} {gui_app} {opt_arg} >&2 &'", timeout=5)
-                  # Nix builds the following non-commented expression to the following:
-                  #                              `su - alice -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/1000 lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' `
-                  machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=60)
-                  machine.succeed(f"pkill {gui_app}", timeout=5)
-
-      machine.succeed("echo 'test completed succeessfully' > /${testName}", timeout=5)
-      machine.copy_from_machine('/${testName}')
-
-      machine.shutdown()
-    '';
-}

nixos/tests/cosmic/default.nix

@@ -0,0 +1,168 @@
+{
+  config,
+  lib,
+  testName,
+  enableAutologin,
+  enableXWayland,
+  ...
+}:
+
+let
+  user = config.nodes.machine.users.users.alice;
+  logFilePath = "/home/${user.name}/${testName}";
+  # Use `writeShellScriptBin` instead of `writeShellScript` so that the
+  # process name in the journald log appears as 'cosmicTest[$pid]'
+  cosmicTest = config.node.pkgs.writeShellScriptBin "cosmicTest" ''
+    exec ${lib.getExe config.node.pkgs.python3Minimal} ${./test-script.py} \
+        --log-file-path ${logFilePath} \
+        --cosmic-reader-pdf ${config.node.pkgs.empty-pdf} \
+        --polkit-agent-helper-path ${config.node.pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1 \
+        --root-user-password ${user.password}
+  '';
+  cosmicTestDesktop = config.node.pkgs.makeDesktopItem {
+    name = "cosmicTest";
+    desktopName = "COSMIC NixOS VM test (${testName})";
+    exec = "cosmicTest";
+  };
+  cosmicTestAutostartItem = config.node.pkgs.makeAutostartItem {
+    name = "cosmicTest";
+    package = cosmicTestDesktop;
+  };
+in
+
+{
+  name = testName;
+
+  meta.maintainers = lib.teams.cosmic.members;
+
+  nodes.machine = {
+    imports = [ ../common/user-account.nix ];
+
+    services = {
+      # For `cosmic-store` to be added to `environment.systemPackages`
+      # and for it to work correctly because Flatpak is a runtime
+      # dependency of `cosmic-store`.
+      flatpak.enable = true;
+
+      displayManager.cosmic-greeter.enable = true;
+      desktopManager.cosmic = {
+        enable = true;
+        xwayland.enable = enableXWayland;
+      };
+    };
+
+    services.displayManager.autoLogin = lib.mkIf enableAutologin {
+      enable = true;
+      user = user.name;
+    };
+
+    users.users = {
+      alice.extraGroups = [
+        "uinput" # for ydotoold
+      ];
+
+      root.password = user.password;
+      root.hashedPasswordFile = lib.mkForce null;
+    };
+
+    hardware.uinput.enable = true;
+
+    environment.systemPackages = with config.node.pkgs; [
+      ydotool
+      cosmicTest
+      cosmicTestAutostartItem
+
+      # These two packages are used to check if a window was opened
+      # under the COSMIC session or not. Kinda important.
+      # TODO: Move the check from the test module to
+      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
+      # Wayland-only testing can be done using the existing testing
+      # infrastructure.
+      jq
+      lswt
+    ];
+
+    # So far, all COSMIC tests launch a few GUI applications. In doing
+    # so, the default allocated memory to the guest of 1024M quickly
+    # poses a very high risk of an OOM-shutdown which is worse than an
+    # OOM-kill. Because now, the test failed, but not for a genuine
+    # reason, but an OOM-shutdown. That's an inconclusive failure
+    # which might possibly mask an actual failure. Not enabling
+    # systemd-oomd because we need said applications running for a
+    # few seconds. So instead, bump the allocated memory to the guest
+    # from 1024M to 4x; 4096M.
+    virtualisation.memorySize = 4096;
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      #testName: ${testName}
+      import sys
+    ''
+    + (
+      if enableAutologin then
+        ''
+          with subtest("cosmic-greeter initialisation"):
+              machine.wait_for_unit("graphical.target", timeout=120)
+        ''
+      else
+        ''
+          from time import sleep
+
+          machine.wait_for_unit("graphical.target", timeout=120)
+          machine.wait_until_succeeds("pgrep --uid ${config.nodes.machine.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
+          # Sleep for 10 seconds for ensuring that `greetd` loads the
+          # password prompt for the login screen properly.
+          sleep(10)
+
+          with subtest("cosmic-session login"):
+              machine.send_chars("${user.password}\n", delay=0.2)
+        ''
+    )
+    + ''
+      with subtest("xdg autostart support in cosmic"):
+          # When checking the status of our `cosmicTest` package with:
+          # `machine.wait_for_unit("app-cosmicTest@autostart.service", user="${user.name}")`
+          # We are immediately greeted with the error:
+          # ```
+          # subtest: xdg autostart support in cosmic
+          # machine: waiting for unit app-cosmicTest@autostart.service with user alice
+          # machine # [   26.497516] cosmic-comp[1352]: [EGL] 0x3008 (BAD_DISPLAY) eglCreateSync: _eglCreateSync
+          # machine # [   26.511706] su[1416]: Successful su for alice by root
+          # machine # [   26.528190] su[1416]: pam_unix(su:session): session opened for user alice(uid=1000) by (uid=0)
+          # machine # Failed to connect to user scope bus via local transport: No such file or directory
+          # machine # [   26.599563] su[1416]: pam_unix(su:session): session closed for user alice
+          # !!! Test "xdg autostart support in cosmic" failed with error: "retrieving systemctl property "ActiveState" for unit "app-cosmicTest@autostart.service" under user "alice" failed with exit code 1"
+          # ```
+          # Meaning, our session is extremely new and the D-Bus user
+          # session socket does not yet exist. Instead, lets poll for
+          # the log file that the test is guaranteed to write to, as
+          # soon as it starts.
+          machine.wait_for_file("${logFilePath}.log", timeout=120)
+
+      exit_code = 0
+      try:
+          machine.wait_for_file("${logFilePath}.done", timeout=700)
+      except Exception:
+          exit_code = 1
+
+      # The log file is created in the very beginning of the test
+      # script's execution. If we are here, it means that the
+      # `wait_for_unit`'s "guard" on the test script's autostart unit
+      # plus the 630 second combined timeout of other two
+      # `wait_for_file`s, make it extremely likely for the log file to
+      # be present.
+      machine.copy_from_machine("${logFilePath}.log")
+
+      machine.shutdown()
+
+      with open(f"{machine.out_dir}/${testName}.log") as test_log_file:
+          contents = test_log_file.read()
+          print(contents)
+          if any("Z [ERROR] [L:" in line for line in contents.splitlines()):
+              exit_code = 1
+
+      sys.exit(exit_code)
+    '';
+}

nixos/tests/cosmic/test-script.py

@@ -0,0 +1,315 @@
+#!/usr/bin/env python3
+import argparse
+import logging
+import os
+import pathlib
+import subprocess
+import time
+
+
+def parse_cli_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--log-file-path",
+        required=True,
+        type=str,
+        help="The path to the log file (without the '.log' suffix/extension)",
+    )
+    parser.add_argument(
+        "--cosmic-reader-pdf",
+        required=True,
+        type=str,
+        help="The PDF that the `cosmic-reader` should open for testing",
+    )
+    parser.add_argument(
+        "--polkit-agent-helper-path",
+        required=True,
+        type=str,
+        help="The path to the polkit agent helper (`${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1`)",
+    )
+    parser.add_argument(
+        "--root-user-password", required=True, type=str, help="The root user's password"
+    )
+    args = parser.parse_args()
+    return args
+
+
+def start_ydotool_daemon() -> tuple[str, subprocess.Popen]:
+    """
+    The ydotool requires a daemon to be running.
+    """
+    xdg_runtime_dir = os.getenv("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    ydotool_daemon_socket_path = f"{xdg_runtime_dir}/.ydotool_socket"
+    ydotool_daemon_process = subprocess.Popen(
+        [
+            "ydotoold",
+            "--socket-path",
+            ydotool_daemon_socket_path,
+            "--mouse-off",
+        ],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return ydotool_daemon_socket_path, ydotool_daemon_process
+
+
+def wait_for_cosmic_de_readiness() -> None:
+    """
+    Wait for the COSMIC DE to be ready, before running the tests. This
+    is done by waiting on the supposedly last component of the COSMIC
+    DE to be "ready." That component is the notification watcher, of
+    the `cosmic-applet` derivation.
+    """
+    logging.info("=" * 80)
+    logging.info("Waiting for COSMIC DE to complete initialization")
+
+    notification_watcher_wait_deadline = time.monotonic() + 360
+    notification_watcher_exists = False
+    while time.monotonic() < notification_watcher_wait_deadline:
+        busctl_process = subprocess.run(
+            ["busctl", "--user", "status", "com.system76.CosmicStatusNotifierWatcher"],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        if busctl_process.returncode == 0:
+            notification_watcher_exists = True
+            break
+        else:
+            time.sleep(1)
+    logging_msg = "The COSMIC DE is "
+    if notification_watcher_exists:
+        logging.info(f"{logging_msg} ready")
+    else:
+        logging.error(f"{logging_msg} not ready")
+    return
+
+
+def perform_polkit_authentication_test(
+    cli_args: argparse.Namespace,
+    ydotool_daemon_socket_path: str,
+    ydotool_daemon_process: subprocess.Popen,
+) -> None:
+    """
+    1. Run `pkexec` as a background process that produces a specific
+       output to stdout upon successful completion.
+    2. Wait unil it has been confimred that `cosmic-osd` has created
+       a pop-up requesting the root user's password.
+    3. Use ydotool to type the root user's password in the pop-up
+       prompt.
+    4. Ensure that the the `pkexec` background process' stdout matches
+       the output that we expect.
+
+    Any breakage in this flow is considered a failure of the polkit
+    authenticaion test.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing polkit authentication test")
+
+    polkit_test_passed = False
+    polkit_test_command = [
+        "pkexec",
+        "--disable-internal-agent",
+        "bash",
+        "-c",
+        "echo -n 'polkit test was successful'",
+    ]
+    logging.info(f"Running: {polkit_test_command}")
+    polkit_test_process = subprocess.Popen(
+        polkit_test_command,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    polkit_popup_deadline = time.monotonic() + 60
+    pop_up_msg = "the pop-up for polkit password authentication"
+    encountered_polkit_authentication_popup = False
+    while time.monotonic() < polkit_popup_deadline:
+        polkit_popup_check_process = subprocess.run(
+            [
+                "pgrep",
+                "-afx",
+                f"{cli_args.polkit_agent_helper_path} --socket-activated",
+            ],
+            check=False,
+        )
+        if polkit_popup_check_process.returncode == 0:
+            encountered_polkit_authentication_popup = True
+            logging.info(f"Noticed {pop_up_msg}")
+            if ydotool_daemon_process.poll() is None:
+                # The polkit-agent-helper process exists, but that
+                # doesn't necessarily mean that the pop-up is
+                # **rendered** and ready to accept the password. So we
+                # sleep for a few seconds.
+                time.sleep(20)
+                ydotool_process = subprocess.run(
+                    [
+                        "ydotool",
+                        "type",
+                        "--key-delay=500",
+                        f"{cli_args.root_user_password}\n",
+                    ],
+                    env={
+                        **os.environ.copy(),
+                        "YDOTOOL_SOCKET": ydotool_daemon_socket_path,
+                    },
+                    check=False,
+                )
+                ydotool_msg = (
+                    "the root user's password in the pop-up for polkit authentication"
+                )
+                if ydotool_process.returncode == 0:
+                    logging.info(f"ydotool typed {ydotool_msg}")
+                else:
+                    logging.error(f"ydotool did not type {ydotool_msg}")
+            else:
+                logging.error(
+                    "The ydotool daemon exited for some reason before it could be used"
+                )
+            break
+        time.sleep(1)
+    if not encountered_polkit_authentication_popup:
+        logging.error(f"Did not notice {pop_up_msg}")
+
+    polkit_test_process_stdout = ""
+    polkit_test_process_stderr = ""
+    try:
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate(timeout=45)
+        )
+    except subprocess.TimeoutExpired:
+        polkit_test_process.kill()
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate()
+        )
+
+    logging.info(f"polkit stdout: '{polkit_test_process_stdout}'")
+    logging.info(f"polkit stderr: '{polkit_test_process_stderr}'")
+
+    if polkit_test_process_stdout:
+        logging.info(f"pkexec command stdout: {polkit_test_process_stdout}")
+        polkit_test_passed = "polkit test was successful" in polkit_test_process_stdout
+    else:
+        logging.warning("Could not capture stdout from the polkit test command")
+
+    if polkit_test_passed:
+        logging.info("The polkit authentication test passed")
+    else:
+        logging.error("The polkit authentication test failed")
+    return
+
+
+def perform_gui_application_test(cli_args: argparse.Namespace) -> None:
+    """
+    1. Start one GUI application as a background process.
+    2. Wait unil it has been confimred that the GUI application is
+       running.
+    3. Kill the background process of the GUI application.
+
+    Any breakage in this flow is considered a failure of the test for
+    the GUI application.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing test to launch GUI applications")
+
+    gui_apps_to_test = {
+        "com.system76.CosmicEdit": [
+            "cosmic-edit",
+        ],
+        "com.system76.CosmicFiles": [
+            "cosmic-files",
+        ],
+        "com.system76.CosmicPlayer": [
+            "cosmic-player",
+        ],
+        "com.system76.CosmicReader": [
+            "cosmic-reader",
+            cli_args.cosmic_reader_pdf,
+        ],
+        "com.system76.CosmicSettings": [
+            "cosmic-settings",
+        ],
+        "com.system76.CosmicStore": [
+            "cosmic-store",
+        ],
+        "com.system76.CosmicTerm": [
+            "cosmic-term",
+        ],
+    }
+
+    for gui_app_id, gui_app_command in gui_apps_to_test.items():
+        logging.info(f"Running: {gui_app_command}")
+        gui_app_bg_process = subprocess.Popen(
+            gui_app_command,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        gui_app_bg_process_deadline = time.monotonic() + 30
+        gui_app_is_running = False
+
+        while time.monotonic() < gui_app_bg_process_deadline and not gui_app_is_running:
+            lswt_process = subprocess.run(
+                [
+                    "lswt",
+                    "--custom",
+                    "a",
+                ],
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.DEVNULL,
+            )
+            lswt_process_stdout = lswt_process.stdout.strip()
+            if lswt_process_stdout:
+                if gui_app_id in lswt_process_stdout.splitlines():
+                    gui_app_is_running = True
+            time.sleep(1)
+        pkill_process = subprocess.run(
+            ["pkill", gui_app_command[0]],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
+        )
+
+        log_message = (
+            f"The GUI application test for '{gui_app_command[0]}' ({gui_app_id})"
+        )
+        if gui_app_is_running:
+            logging.info(f"{log_message} passed")
+        else:
+            logging.error(f"{log_message} failed")
+    return
+
+
+def main() -> None:
+    cli_args = parse_cli_args()
+    logging.basicConfig(
+        level=logging.INFO,
+        format=f"%(asctime)sZ [%(levelname)s] [L:%(lineno)d] %(message)s",
+        datefmt="%H:%M:%S",
+        handlers=[
+            logging.StreamHandler(),
+            logging.FileHandler(f"{cli_args.log_file_path}.log", mode="w"),
+        ],
+    )
+    logging.Formatter.converter = time.gmtime
+    logging.info(f"Logging to '{cli_args.log_file_path}.log'")
+
+    ydotool_daemon_socket_path, ydotool_daemon_process = start_ydotool_daemon()
+
+    # Wait for the DE to be ready
+    wait_for_cosmic_de_readiness()
+
+    # tests go here
+    perform_polkit_authentication_test(
+        cli_args, ydotool_daemon_socket_path, ydotool_daemon_process
+    )
+    perform_gui_application_test(cli_args)
+
+    pathlib.Path(f"{cli_args.log_file_path}.done").touch()
+    return
+
+
+if __name__ == "__main__":
+    main()

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "149.0.7827.196",
+    "version": "149.0.7827.200",
     "chromedriver": {
-      "version": "149.0.7827.197",
-      "hash_darwin": "sha256-tN7s6s/pbfAGRCMcoT3QWYHD8QRq2gcHfFSXoSG9V5Y=",
-      "hash_darwin_aarch64": "sha256-DZ8CZ4Obp67Zo2m4iyqUnShyhTK8+/75cJ/WmZZqQhE="
+      "version": "149.0.7827.201",
+      "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=",
+      "hash_darwin_aarch64": "sha256-Gwmdo9qNyV/BnCj18f0BFpNgDf28e8vjNF98e5/vVjQ="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
-        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
+        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
+        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -823,7 +823,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.196",
+    "version": "149.0.7827.200",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.196-1",
-        "hash": "sha256-nRcMTP+su+mFP/JkyLBIDrG+dKYhvPANFw0Y8qVWzrA="
+        "rev": "149.0.7827.200-1",
+        "hash": "sha256-D7c1ToAoUzAMpXoe60YPimRqe6/LRe0T95TduXUeTFo="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
-        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
+        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
+        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "152.0.2";
+  version = "152.0.3";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e4e54cffffcfd5751eac5817a7b74b0ef0aa43fc00ef29397cc9df9aa52572b2272b96e60373a70d712be4dc849170d8d5c1b449f3ea978b4ab28dee19056b03";
+    sha512 = "f0b63f4a0d4bb0080761f1a7ecb949696b4f805a33fef322ceef3b59a492e1403ea4b8cfbc7f5d4b70cf5b3c5a66ddcc988654fa77fd3021b65f452ca190bf63";
   };
 
   meta = {

pkgs/build-support/teleport/0001-fix-add-nix-path-to-exec-env-reexec.patch

@@ -0,0 +1,28 @@
+From e3651ca79c0edb66c04e0d3381f3b0b6f76d37d2 Mon Sep 17 00:00:00 2001
+From: 5aaee9 <jiduye@gmail.com>
+Date: Thu, 24 Mar 2022 17:34:38 +0800
+Subject: [PATCH] fix: add nix path to exec env
+# Adapted to new path starting from 18.8
+
+---
+ session/reexec/exec.go | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/session/reexec/exec.go b/session/reexec/exec.go
+index 253fbafef..815a2e1e0 100644
+--- a/session/reexec/exec.go
++++ b/session/reexec/exec.go
+@@ -30,8 +30,8 @@ import (
+ )
+ 
+ const (
+-	defaultPath          = "/bin:/usr/bin:/usr/local/bin:/sbin"
++	defaultPath          = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/bin:/usr/bin:/usr/local/bin:/sbin"
+ 	defaultEnvPath       = "PATH=" + defaultPath
+-	defaultRootPath      = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
++	defaultRootPath      = "/run/wrappers/bin:/etc/profiles/per-user/root/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+ 	defaultEnvRootPath   = "PATH=" + defaultRootPath
+ 	defaultLoginDefsPath = "/etc/login.defs"
+-- 
+2.32.0 (Apple Git-132)
+

pkgs/build-support/teleport/default.nix

@@ -157,10 +157,17 @@ buildGoModule (finalAttrs: {
     pkg-config
   ];
 
-  patches = extPatches ++ [
-    ./0001-fix-add-nix-path-to-exec-env.patch
-    ./rdpclient.patch
-  ];
+  patches =
+    extPatches
+    ++ [
+      ./rdpclient.patch
+    ]
+    ++ lib.optional (lib.versionOlder version "18.8.0") [
+      ./0001-fix-add-nix-path-to-exec-env.patch
+    ]
+    ++ lib.optional (lib.versionAtLeast version "18.8.0") [
+      ./0001-fix-add-nix-path-to-exec-env-reexec.patch
+    ];
 
   # Reduce closure size for client machines
   outputs = [

pkgs/by-name/al/alcom/disable-updater-artifacts.patch

@@ -1,13 +0,0 @@
-diff --git a/vrc-get-gui/Tauri.toml b/vrc-get-gui/Tauri.toml
-index cd180da8..66a81aa9 100644
---- a/vrc-get-gui/Tauri.toml
-+++ b/vrc-get-gui/Tauri.toml
-@@ -34,8 +34,6 @@ icon = [
- resources = []
- publisher = "anatawa12"
- 
--createUpdaterArtifacts = "v1Compatible"  # remove if ci # we do not generate updater artifacts in CI
--
- [[bundle.fileAssociations]]
- # note: for macOS we directory use info.plist for registering file association.
- description = "ALCOM Project Template"

pkgs/by-name/al/alcom/package.nix

@@ -17,25 +17,18 @@
   webkitgtk_4_1,
 }:
 let
+  subdir = "vrc-get-gui";
+in
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alcom";
-  version = "1.1.5";
-
+  version = "1.1.6";
   src = fetchFromGitHub {
     owner = "vrc-get";
     repo = "vrc-get";
-    tag = "gui-v${version}";
-    hash = "sha256-xucU8nXskniHOiuwrtVoZM2FIKNKU45i4DNo6iLjZvM=";
+    tag = "gui-v${finalAttrs.version}";
+    hash = "sha256-TpVHE3e3dMdBOtPVKomKvg5tQf42QWik18k5oVD2Hms=";
   };
 
-  subdir = "vrc-get-gui";
-in
-rustPlatform.buildRustPackage {
-  inherit pname version src;
-
-  patches = [
-    ./disable-updater-artifacts.patch
-  ];
-
   nativeBuildInputs = [
     cargo-about
     cargo-tauri.hook
@@ -55,13 +48,15 @@ rustPlatform.buildRustPackage {
     webkitgtk_4_1
   ];
 
-  cargoHash = "sha256-MeCx3BoEXckMZfecyBcwwVE8+6V9Di6ULkIhUvUFZIA=";
+  cargoHash = "sha256-J8vCr+B4J3ZqxkkNk+x0jr52qNJJYfBJe2oyLf0GLsc=";
+  buildFeatures = [ "no-self-updater" ];
   buildAndTestSubdir = subdir;
 
   npmDeps = fetchNpmDeps {
-    inherit src;
-    sourceRoot = "${src.name}/${subdir}";
-    hash = "sha256-snXOfAtanLPhQNo0mg/r8UUXJua2X+52t7+7QS1vOkI=";
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/${subdir}";
+    hash = "sha256-VyA2c2659Kg1DjLmmtvSAivltdraSBNArIu1XGENGmQ=";
   };
   npmRoot = subdir;
 
@@ -69,8 +64,11 @@ rustPlatform.buildRustPackage {
     description = "Experimental GUI application to manage VRChat Unity Projects";
     homepage = "https://github.com/vrc-get/vrc-get";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Scrumplex ];
+    maintainers = with lib.maintainers; [
+      Scrumplex
+      ImSapphire
+    ];
     broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "ALCOM";
   };
-}
+})

pkgs/by-name/as/asahi-audio/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "asahi-audio";
-  version = "3.4";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "asahi-audio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7AuPkR/M1a4zB9+dJuOuv9uTp+kIqPlxVOXipsyGGz8=";
+    hash = "sha256-Tp+yL7SbzowYcCrfI7UU+5GeIJtyBMuE7KhcYmA1+hw=";
   };
 
   makeFlags = [

pkgs/by-name/au/authelia/web.nix

@@ -62,4 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     runHook postInstall
   '';
+
+  # (node:24500) Warning: File descriptor 19 closed but not opened in unmanaged mode
+  # (node:24500) Warning: File descriptor 19 opened in unmanaged mode twice
+  meta.broken = stdenv.hostPlatform.isDarwin;
 })

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.70.0";
+  version = "1.71.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C06/5a4icjgI35ADQKvlZ6JmCCyW/9e0aF9VIpLCqn0=";
+    hash = "sha256-GrGtJzZoyyEoIyqc8iItH7/LhXNEuTKbDl+gdB/5bHw=";
   };
 
-  vendorHash = "sha256-Vveg7rBno66IPinVs9RJtzVJdtAJE55QZfWA3WIXGDQ=";
+  vendorHash = "sha256-8FJtJ/mHldia6t5yIPUfCvOlsKJSzT/vVcF+WxRO1Mo=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/cd/cdemu-daemon/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdemu-daemon";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/cdemu-daemon-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AYHjiOAQdu685gc6p0j2QNtCmTYTWix1kzWQZYvGPWU=";
+    hash = "sha256-rkhxivVGQ2lsCUQEXJupDenj74E3shQXExhTWysf+qo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/em/empty-pdf/package.nix

@@ -0,0 +1,41 @@
+{
+  stdenvNoCC,
+  imagemagick,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation {
+  name = "empty-pdf";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ imagemagick ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    magick xc:none -page Letter empty.pdf
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv empty.pdf $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Empty PDF file intended for testing";
+    maintainers = with lib.maintainers; [
+      pandapip1
+      thefossguy
+    ];
+    platforms = imagemagick.meta.platforms;
+  };
+}

pkgs/by-name/fo/forge-mtg/package.nix

@@ -16,13 +16,13 @@
 }:
 
 let
-  version = "2.0.12";
+  version = "2.0.13";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-OwrjpK5aqEx5HCZqU+iLJtkUtmt5yGW1bHLrX1UYf3Q=";
+    hash = "sha256-BU2RkXE3oMVLlCqebQwidH/ZtHKrrD47PAQhMnF/8pU=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.

pkgs/by-name/gi/gitaly/package.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.11.5";
+  version = "18.11.6";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-i2DgcNoGPR/B6qya+jYFU5noOSabSlwu9P7p5KwR6jI=";
+      hash = "sha256-fsr8ttV2q2iedTA5yn4iHry92Mgu775K1GW3JBz5N1U=";
     };
 
     vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";

pkgs/by-name/gi/github-runner/deps.json

@@ -36,8 +36,8 @@
   },
   {
     "pname": "Microsoft.Bcl.Cryptography",
-    "version": "10.0.6",
-    "hash": "sha256-6VaDedxTljDNE+a4ao4xSG3rzZ6lbmCShtgMgHe9aH4="
+    "version": "10.0.7",
+    "hash": "sha256-5hOu8j2jLhCj9m7MlBoCjq3Qo0ST+b8n6oG2lLHL24s="
   },
   {
     "pname": "Microsoft.CodeCoverage",
@@ -46,18 +46,18 @@
   },
   {
     "pname": "Microsoft.DevTunnels.Connections",
-    "version": "1.3.39",
-    "hash": "sha256-aJBUNv1n7b64EBrAa04+Gw1MLYC315xANCRdK3RnWlA="
+    "version": "1.3.48",
+    "hash": "sha256-/E7ik2riVOMUyPt/1pxU7laDHG1pG5JpLIf5cQ7x7K4="
   },
   {
     "pname": "Microsoft.DevTunnels.Contracts",
-    "version": "1.3.39",
-    "hash": "sha256-lREgEhQhgQJyLoMYS/N5w+i6iX0s3Ppnl0T71KhG2u8="
+    "version": "1.3.48",
+    "hash": "sha256-YYmyZWmKv03BnOKAwbAeLrKqYDbBQ4ZS26jn92QkLSc="
   },
   {
     "pname": "Microsoft.DevTunnels.Management",
-    "version": "1.3.39",
-    "hash": "sha256-twyduZ89fY69k5onUihezBwdiu3BxdOMBLIXq4aQvY0="
+    "version": "1.3.48",
+    "hash": "sha256-DyDPqIwQkKJESx5K9Y4nKtw05cHrTlTp56rg/JXuVag="
   },
   {
     "pname": "Microsoft.DevTunnels.Ssh",
@@ -536,8 +536,8 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "10.0.6",
-    "hash": "sha256-MpXUz1TiiFkD1ngApC7HKqW+i37zi5V2ApOmqZwDqiI="
+    "version": "10.0.7",
+    "hash": "sha256-fV+2RcEzBV/JUnPDOLce3VBQKqvo32zcTWMZeJcAAJg="
   },
   {
     "pname": "System.Diagnostics.EventLog",
@@ -561,8 +561,8 @@
   },
   {
     "pname": "System.Formats.Asn1",
-    "version": "10.0.6",
-    "hash": "sha256-h5f9iYBUHgG9kOV7jlVQ8HqBQ0DQJt+wy3R/FbB1kaQ="
+    "version": "10.0.7",
+    "hash": "sha256-s48DCef2td3qUMdsRRGFfzkZ/wl/kUaVseQBDDfWUzM="
   },
   {
     "pname": "System.Globalization",
@@ -856,8 +856,8 @@
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "10.0.6",
-    "hash": "sha256-7T34t/DoxxMWUGRPSnLV1l5ScAxcDnK9iYKstRvLJuA="
+    "version": "10.0.7",
+    "hash": "sha256-+3RdvoSme0k3FoutPdJLkbWPWsmqPVo80hMgpuH3FP0="
   },
   {
     "pname": "System.Security.Cryptography.Primitives",
@@ -896,8 +896,8 @@
   },
   {
     "pname": "System.ServiceProcess.ServiceController",
-    "version": "10.0.6",
-    "hash": "sha256-Lvkb2mzQT/tcJ2yxkQDmKKFpEyaUbQ75qU51FwD1dzY="
+    "version": "10.0.7",
+    "hash": "sha256-koSlZI43JaCrG3ultJ6Sj7Ic9D9N878L+6HtRRGyJSA="
   },
   {
     "pname": "System.Text.Encoding",

pkgs/by-name/gi/github-runner/package.nix

@@ -35,13 +35,13 @@ assert builtins.all (
 
 buildDotnetModule (finalAttrs: {
   pname = "github-runner";
-  version = "2.334.0";
+  version = "2.335.1";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KSfzWwIf8Vpc8H0XM1tIqdZhdY/noZCeYLBvdWjqmLA=";
+    hash = "sha256-mFwWhpFzp0pT7WaMpF/N6PGw0IJt3I6/e7GDgw9wA2U=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -211,6 +211,10 @@ buildDotnetModule (finalAttrs: {
     "RepositoryActionWithInvalidWrapperActionfile_Node"
     "RepositoryActionWithWrapperActionfile_PreSteps"
   ]
+  ++ [
+    "GitHub.Runner.Common.Tests.Worker.ActionManagerL0.GetDownloadInfoAsync_OmitsDependencies_WhenEmpty"
+    "GitHub.Runner.Common.Tests.Worker.ActionManagerL0.GetDownloadInfoAsync_PropagatesDependencies_WhenPresent"
+  ]
   ++ map (x: "GitHub.Runner.Common.Tests.DotnetsdkDownloadScriptL0.${x}") [
     "EnsureDotnetsdkBashDownloadScriptUpToDate"
     "EnsureDotnetsdkPowershellDownloadScriptUpToDate"

pkgs/by-name/gi/gitlab-pages/package.nix

@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jSTXLbzYCiCpqrbs9kAmW6um2X5hA1OFiA6fSZrQ2RI=";
+    hash = "sha256-D/AlIXbcgvPyP2TX/lXVYlnG2HXKZlxOhqRTfTXsaew=";
   };
 
   vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";

pkgs/by-name/gi/gitlab/data.json

@@ -1,17 +1,17 @@
 {
-  "version": "18.11.5",
-  "repo_hash": "sha256-/RIUqxfRjq3+TOvapYMfl0uVqQLp1adpE6bR303rH6g=",
+  "version": "18.11.6",
+  "repo_hash": "sha256-bdnBX6M4BtuA03CP/N0teKnuey3V9qHseBoxTIGXE5Q=",
   "yarn_hash": "sha256-og09R28lwYvDk4pe7z1dRMaanYiTsUSx+SUKoWc53do=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.11.5-ee",
+  "rev": "v18.11.6-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.5",
-    "GITLAB_KAS_VERSION": "18.11.5",
-    "GITLAB_PAGES_VERSION": "18.11.5",
+    "GITALY_SERVER_VERSION": "18.11.6",
+    "GITLAB_KAS_VERSION": "18.11.6",
+    "GITLAB_PAGES_VERSION": "18.11.6",
     "GITLAB_SHELL_VERSION": "14.50.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
-    "GITLAB_WORKHORSE_VERSION": "18.11.5"
+    "GITLAB_WORKHORSE_VERSION": "18.11.6"
   }
 }

pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix

@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {

pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock

@@ -537,7 +537,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.5.0)
+    devfile (0.5.2)
     device_detector (1.1.3)
     devise (4.9.4)
       bcrypt (~> 3.0)
@@ -2678,7 +2678,7 @@ CHECKSUMS
   declarative_policy (2.1.0) sha256=f9ab705da726174bde97785c319311a4abf6143c07862f882bd8bc1b69361eea
   derailed_benchmarks (2.2.1) sha256=654280664fded41c9cd8fc27fc0fcfaf096023afab90eb4ac1185ba70c5d4439
   descendants_tracker (0.0.4) sha256=e9c41dd4cfbb85829a9301ea7e7c48c2a03b26f09319db230e6479ccdc780897
-  devfile (0.5.0) sha256=6a7e3be19e3e6b4b698b64ec4d6fd85b6653ce810c65cee611907d47ebb4cccf
+  devfile (0.5.2) sha256=2398cc38726f7bce03088eb74e4157f7839b353e36a488565e3fcc7739cd613d
   device_detector (1.1.3) sha256=c5fe3fe42cab2e8aa01f193b2074b8bb1510373ce47127206f28c7dea75a9c79
   devise (4.9.4) sha256=920042fe5e704c548aa4eb65ebdd65980b83ffae67feb32c697206bfd975a7f8
   devise-pbkdf2-encryptable (0.0.0)

pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix

@@ -1621,10 +1621,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kycnkmlfzch27kcwr8ch7756rjvv1plvv34idllnsrykvhknzka";
+      sha256 = "0gb1rlwpgk1zbrb8i91n7qsrp0zpax0lxdwf101wwyvgf8wcr613";
       type = "gem";
     };
-    version = "0.5.0";
+    version = "0.5.2";
   };
   device_detector = {
     groups = [ "default" ];

pkgs/by-name/go/gotosocial/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.21.2";
+  version = "0.21.3";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z3j5/pXnNTHgBmPEfFgjOJuL03LsPtvAwbuoL9wb5bk=";
+    hash = "sha256-gemi9t4wTjmCHEXfdXz1X9Q4gcvj/3LMtlrO5UpQ19M=";
   };
 
   vendorHash = null;

pkgs/by-name/hm/hmcl/package.nix

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-Uv6w3XEySoqsKCmZVmiDkGfmeretHfvpwFmYMJz0mv4=";
+    hash = "sha256-rT+RruLMz/DTlYSOMv4D6ZCOVt36iqyx42v8ea4XSdM=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   terracottaBundleJava = fetchurl {
     name = "hmcl-terracotta-bundle-java-${finalAttrs.version}";
     url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.terracottaBundleJavaPath}";
-    hash = "sha256-05U4/TUYECPgrzZbLiSPUwo5XtIm2w+T8gCdtqpsRVs=";
+    hash = "sha256-1o/CUDeywtDlhAxqInk77aUwGCCYeZ84VMIyouN49uU=";
   };
   macOSProviderJava = fetchurl {
     name = "hmcl-macos-provider-java-${finalAttrs.version}";

pkgs/by-name/im/image-analyzer/package.nix

@@ -16,11 +16,11 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "image-analyzer";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/image-analyzer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N2aufwYEBVx7z2Vo7Qi4DP2MsDXXr5LrQdeNYOtNGnU=";
+    hash = "sha256-vsfDmtjrvAC49ynnJ7QguBfSVnt/sBpCy/Eau2l1/jQ=";
   };
 
   buildInputs = [

pkgs/by-name/ki/kikit/default.nix

@@ -2,8 +2,9 @@
   bc,
   zip,
   lib,
-  fetchFromGitHub,
   bats,
+  fetchFromGitHub,
+  python,
   buildPythonApplication,
   callPackage,
   kicad,
@@ -19,6 +20,7 @@
   versioneer,
   shapely,
   setuptools,
+  versionCheckHook,
   nix-update-script,
 }:
 let
@@ -36,7 +38,10 @@ buildPythonApplication (finalAttrs: {
     hash = "sha256-QhtdQgMgHaB0xj2hQ4MCptr5DDgCOfRClUSyYzrFQis=";
     # Upstream uses versioneer, which relies on gitattributes substitution.
     # This leads to non-reproducible archives on GitHub.
-    # See https://github.com/NixOS/nixpkgs/issues/84312
+    # See
+    # https://github.com/NixOS/nixpkgs/issues/84312
+    # https://github.com/NixOS/nixpkgs/pull/395213
+    # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       rm "$out/kikit/_version.py"
     '';
@@ -72,6 +77,7 @@ buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = [
     pytestCheckHook
+    versionCheckHook
     bats
   ];
 
@@ -79,9 +85,10 @@ buildPythonApplication (finalAttrs: {
     "kikit"
   ];
 
-  postPatch = ''
-    # Recreate _version.py, deleted at fetch time due to non-reproducibility.
-    echo 'def get_versions(): return {"version": "${finalAttrs.version}"}' > kikit/_version.py
+  # Recreate _version.py, deleted at fetch time due to non-reproducibility.
+  # should be done in postInstall to overwrite what versioneer generates again during the build phase
+  postInstall = ''
+    echo 'def get_versions(): return {"version": "${finalAttrs.version}"}' > $out/${python.sitePackages}/kikit/_version.py
   '';
 
   preCheck = ''
@@ -96,14 +103,15 @@ buildPythonApplication (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://github.com/yaqwsx/KiKit/releases/tag/${finalAttrs.src.tag}";
     description = "Automation for KiCAD boards";
     homepage = "https://github.com/yaqwsx/KiKit/";
-    changelog = "https://github.com/yaqwsx/KiKit/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    mainProgram = "kikit";
     maintainers = with lib.maintainers; [
       jfly
       matusf
     ];
     teams = with lib.teams; [ ngi ];
-    license = lib.licenses.mit;
   };
 })

pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix

@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lasuite-docs-collaboration-server";
-  version = "5.1.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ptg3C+5DbUiWVS8nMCmqmSFMmNI4NW8NYBF+G5xOqSg=";
+    hash = "sha256-GQAhCwtcp/9rSk1B1/EWL2jnfd46w1vikEMJeucD1bA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/src/frontend/yarn.lock";
-    hash = "sha256-GW60XK+iOM4A/Pyvh120MnNde8dPiZu46aOTfHOczZg=";
+    hash = "sha256-6uZF4op81QzYCAogvlcyZAkJsCqs72scyLKc1bc2QBU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/la/lasuite-docs-frontend/package.nix

@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lasuite-docs-frontend";
-  version = "5.1.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ptg3C+5DbUiWVS8nMCmqmSFMmNI4NW8NYBF+G5xOqSg=";
+    hash = "sha256-GQAhCwtcp/9rSk1B1/EWL2jnfd46w1vikEMJeucD1bA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/src/frontend/yarn.lock";
-    hash = "sha256-GW60XK+iOM4A/Pyvh120MnNde8dPiZu46aOTfHOczZg=";
+    hash = "sha256-6uZF4op81QzYCAogvlcyZAkJsCqs72scyLKc1bc2QBU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/la/lasuite-docs/package.nix

@@ -11,12 +11,12 @@
   yarnConfigHook,
 }:
 let
-  version = "5.1.0";
+  version = "5.3.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-Ptg3C+5DbUiWVS8nMCmqmSFMmNI4NW8NYBF+G5xOqSg=";
+    hash = "sha256-GQAhCwtcp/9rSk1B1/EWL2jnfd46w1vikEMJeucD1bA=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -29,7 +29,7 @@ let
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/src/mail/yarn.lock";
-      hash = "sha256-CKKGY87C5ifv0sHm9ExCzaGM3mV4C0NsWLCbw+ALqGc=";
+      hash = "sha256-MYzADDcXHGieGkygmlbZQbYcS68NdKWyHYGgoSaqDO8=";
     };
 
     nativeBuildInputs = [
@@ -52,13 +52,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
-
-    # Fix creation of unsafe C function in postgresql migrations
-    ./postgresql_fix.patch
-
-    # Fix installing all modules with uv_build
-    # https://github.com/suitenumerique/docs/pull/2295
-    ./uv.patch
   ];
 
   # They use a old version of mistralai which exported a class
@@ -91,6 +84,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       boto3
       celery
       emoji
+      dj-database-url
       django
       django-configurations
       django-cors-headers
@@ -120,6 +114,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       mozilla-django-oidc
       nested-multipart-parser
       openai
+      posthog
       psycopg
       pycrdt
       pydantic-ai-slim

pkgs/by-name/la/lasuite-docs/postgresql_fix.patch

@@ -1,16 +0,0 @@
-diff --git a/core/migrations/0027_auto_20251120_0956.py b/core/migrations/0027_auto_20251120_0956.py
-index fe795ff5..0db2090c 100644
---- a/core/migrations/0027_auto_20251120_0956.py
-+++ b/core/migrations/0027_auto_20251120_0956.py
-@@ -11,11 +11,6 @@ class Migration(migrations.Migration):
-     operations = [
-         migrations.RunSQL(
-             sql="""
--                CREATE OR REPLACE FUNCTION public.immutable_unaccent(regdictionary, text)
--                RETURNS text
--                LANGUAGE c IMMUTABLE PARALLEL SAFE STRICT AS
--                '$libdir/unaccent', 'unaccent_dict';
--
-                 CREATE OR REPLACE FUNCTION public.f_unaccent(text)
-                 RETURNS text
-                 LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT

pkgs/by-name/la/lasuite-docs/uv.patch

@@ -1,19 +0,0 @@
-diff --git a/__init__.py b/__init__.py
-deleted file mode 100644
-index e69de29b..00000000
-diff --git a/pyproject.toml b/pyproject.toml
-index eb8ef0a0..dbb9f619 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -97,6 +97,11 @@ dev = [
- ]
- 
- [tool.uv.build-backend]
-+module-name = [
-+    "core",
-+    "demo",
-+    "impress"
-+]
- module-root = ""
- source-exclude = [
-     "**/tests/**",

pkgs/by-name/m1/m1n1/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   imagemagick,
-  source-code-pro,
   python3Packages,
   nix-update-script,
   nixos-icons,
@@ -32,17 +31,23 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "m1n1";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "m1n1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rxop5r+EVXnp1OVkGT6MUwcl6yNTJxJSJuruZiaou7g=";
+    hash = "sha256-yYXB2DhLcLqxaqwP5mII+j2PMIoXdZ35bpx/d0WSZA8=";
     fetchSubmodules = true;
   };
 
-  cargoVendorDir = ".";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version;
+    src = "${finalAttrs.src}/rust";
+    sourceRoot = "rust";
+    hash = "sha256-iuiRp2FA5jnb3uh/p1gpc7Sznt1s4/UR91wEtXTf97o=";
+  };
+  cargoRoot = "rust";
 
   postPatch = lib.optionalString (customLogo != null) ''
     magick ${customLogo} -resize 128x128 data/custom_128.png
@@ -56,14 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     rustPlatform.cargoSetupHook
   ];
 
-  postConfigure = ''
-    patchShebangs --build font/makefont.sh
-    FONT_PATH=${source-code-pro}/share/fonts/opentype/SourceCodePro-Bold.otf
-    rm font/{SourceCodePro-Bold.ttf,font.bin,font_retina.bin}
-    ./font/makefont.sh 8 16 12 $FONT_PATH font/font.bin
-    ./font/makefont.sh 16 32 25 $FONT_PATH font/font_retina.bin
-  '';
-
   makeFlags = [
     "ARCH=${stdenv.cc.targetPrefix}"
     "RELEASE=1"

pkgs/by-name/ma/mastodon/source.nix

@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.1";
+  version = "4.6.2";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-vnFmyLcIeiDHsVxh6BHFjolsGM0n2thOwt3MXrkjEx8=";
+    hash = "sha256-RA9yGmWyzwiD/skPxOB27hqRxMqKGFmMMDOvHR5FjqI=";
     passthru = {
       inherit version;
       yarnHash = "sha256-G1keSWDDpp0vBAOqQI8y8n7bmAeo9Hrdbo7R+cVZQwE=";

pkgs/by-name/ma/mastodon/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p bundix coreutils diffutils nix-prefetch-github gnused jq yarn-berry_4.yarn-berry-fetcher
+#! nix-shell -i bash -p bundix coreutils diffutils nixfmt nix-prefetch-github gnused jq yarn-berry_4.yarn-berry-fetcher
 set -e
 
 OWNER=mastodon
@@ -111,6 +111,9 @@ echo "Creating gemset.nix"
 bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile"
 echo "" >> gemset.nix  # Create trailing newline to please EditorConfig checks
 
+# Fix formatting
+nixfmt gemset.nix
+
 echo "Updating yarnHash"
 yarn-berry-fetcher missing-hashes "$SOURCE_DIR/yarn.lock" > missing-hashes.json
 YARN_HASH="$(yarn-berry-fetcher prefetch "$SOURCE_DIR/yarn.lock" ./missing-hashes.json 2>/dev/null)"

pkgs/by-name/ol/olivetin/3k.nix

@@ -16,18 +16,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "olivetin";
-  version = "3000.14.0";
+  version = "3000.15.0";
 
   src = fetchFromGitHub {
     owner = "OliveTin";
     repo = "OliveTin";
     tag = finalAttrs.version;
-    hash = "sha256-bMc+fmyaRNVLVzGSAUq+TgEdq1VO3Guvw9RnV+YdrRI=";
+    hash = "sha256-AztJqhSJV9hIsnhaYZoIMC8ZE17pUT37nRUdCZ6ZiCA=";
   };
 
   modRoot = "service";
 
-  vendorHash = "sha256-MxiINWFSpbkBDOBcusr2VViGgnlEoqOmj2gZaiGGjj0=";
+  vendorHash = "sha256-lZ3KBoM+cDyYPX16wuZT3UQvB/SrRD6W2ic+GznG7hU=";
 
   subPackages = [ "." ];
 
@@ -75,14 +75,14 @@ buildGoModule (finalAttrs: {
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-EilPfKCT8byqBl2Ls5f8VrBcT8H+u8jqUQTX6brWhUE=";
+    outputHash = "sha256-v7aSikl1VSFZdNKnIucs7RdqFWoaVNIH9u27YG9Ei90=";
   };
 
   webui = buildNpmPackage {
     pname = "olivetin-webui";
     inherit (finalAttrs) version src;
 
-    npmDepsHash = "sha256-+XWucYyYHRC1usQ95HjlFVct2h8njuxfAKDFKNwwJLI=";
+    npmDepsHash = "sha256-fr5RTPNXNd8sD/LphnDsekIbB333LgEHCb/NUEqSBIE=";
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
 

pkgs/by-name/os/osu-lazer-bin/package.nix

@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2026.620.0";
+  version = "2026.624.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.app.Apple.Silicon.zip";
-        hash = "sha256-SHqi+RFMwYkChmCc0i1X/bmMajVSLaWuNCx9+cDkg7E=";
+        hash = "sha256-kL2XGJzTRC+AtHH4+byaR1df9EYyIriuxzawDtAFWZ4=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.app.Intel.zip";
-        hash = "sha256-WXMyeoTixCNPin+hIK+1v2bX26MWnsQ7ZQGwJQ7jbyc=";
+        hash = "sha256-NOBKnsZpMYU6uBfVqYK3ZrPzZBQURw6bN5rr1iZG9nA=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.AppImage";
-        hash = "sha256-rLom/UwqVOXUk/ayLvekRQMD49p5MB9BA6RCohtuPfg=";
+        hash = "sha256-EKmCq656djPGK5I1JqSDcTKtpbQZbO8WGWcPv+PT0q4=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/os/osu-lazer/deps.json

@@ -586,8 +586,8 @@
   },
   {
     "pname": "ppy.LocalisationAnalyser.Tools",
-    "version": "2025.1208.0",
-    "hash": "sha256-diVAckS1zNyVE1UGkbiu9jH/25j/c+Ad5XC3EjdLDsg="
+    "version": "2026.611.0",
+    "hash": "sha256-f3QNC84ynXUHW0wvDZvCTCbNYpqdHzq12uNNwaB6M1g="
   },
   {
     "pname": "ppy.managed-midi",
@@ -616,8 +616,8 @@
   },
   {
     "pname": "ppy.osu.Framework",
-    "version": "2026.616.0",
-    "hash": "sha256-Q9pyMPIpyiAp63VYiWEM8Zbiek0aXdsNBZY2ECaaZ/U="
+    "version": "2026.623.0",
+    "hash": "sha256-IcCFJvj5ydy0r6mEpHgV+UK9N7cd/3CtjOCV2GT8HOY="
   },
   {
     "pname": "ppy.osu.Framework.NativeLibs",
@@ -646,8 +646,8 @@
   },
   {
     "pname": "ppy.SDL3-CS",
-    "version": "2026.520.0",
-    "hash": "sha256-Owz9gClqs1Dnb+EHk4Xpl/tdbXSOwqrL67tTatj+HRU="
+    "version": "2026.623.0",
+    "hash": "sha256-LMT2AVjP/HIC3a7PZDR4Vhlr6CCEhPu5ZF1eSYDIjeY="
   },
   {
     "pname": "ppy.Veldrid",

pkgs/by-name/os/osu-lazer/package.nix

@@ -22,13 +22,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2026.620.0";
+  version = "2026.624.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = "${version}-lazer";
-    hash = "sha256-I2cziF/XRZhMRZCyjoec7G03IxldDMNQ//A7CmFW6/Y=";
+    hash = "sha256-qZPComGBdVReWQ0rVQeB9v8N2ul02AhGe8BlIzhz0+s=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

pkgs/by-name/re/redmine/Gemfile

@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 ruby '>= 3.2.0', '< 3.5.0'
 
-gem 'rails', '7.2.3'
+gem 'rails', '7.2.3.1'
 gem 'rouge', '~> 4.5'
 gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"

pkgs/by-name/re/redmine/Gemfile.lock

@@ -1,29 +1,29 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3)
-      actionpack (= 7.2.3)
-      activesupport (= 7.2.3)
+    actioncable (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3)
-      actionpack (= 7.2.3)
-      activejob (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionmailbox (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       mail (>= 2.8.0)
-    actionmailer (7.2.3)
-      actionpack (= 7.2.3)
-      actionview (= 7.2.3)
-      activejob (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionmailer (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3)
-      actionview (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionpack (7.2.3.1)
+      actionview (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       cgi
       nokogiri (>= 1.8.5)
       racc
@@ -36,36 +36,36 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (7.2.3)
-      actionpack (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    actiontext (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3)
-      activesupport (= 7.2.3)
+    actionview (7.2.3.1)
+      activesupport (= 7.2.3.1)
       builder (~> 3.1)
       cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3)
-      activesupport (= 7.2.3)
+    activejob (7.2.3.1)
+      activesupport (= 7.2.3.1)
       globalid (>= 0.3.6)
-    activemodel (7.2.3)
-      activesupport (= 7.2.3)
-    activerecord (7.2.3)
-      activemodel (= 7.2.3)
-      activesupport (= 7.2.3)
+    activemodel (7.2.3.1)
+      activesupport (= 7.2.3.1)
+    activerecord (7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       timeout (>= 0.4.0)
-    activestorage (7.2.3)
-      actionpack (= 7.2.3)
-      activejob (= 7.2.3)
-      activerecord (= 7.2.3)
-      activesupport (= 7.2.3)
+    activestorage (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       marcel (~> 1.0)
-    activesupport (7.2.3)
+    activesupport (7.2.3.1)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -74,18 +74,20 @@ GEM
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
-    addressable (2.8.9)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
+    auth-sanitizer (0.2.1)
+      version_gem (~> 1.1, >= 1.1.10)
     base64 (0.3.0)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
     benchmark (0.5.0)
-    bigdecimal (4.0.1)
+    bigdecimal (4.1.2)
     builder (3.3.0)
-    bullet (8.1.0)
+    bullet (8.1.3)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     bundle-audit (0.2.0)
@@ -106,10 +108,10 @@ GEM
     chunky_png (1.4.0)
     commonmarker (2.3.2)
       rb_sys (~> 0.9)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
     crass (1.0.6)
-    css_parser (1.21.1)
+    css_parser (2.2.0)
       addressable
     csv (3.3.5)
     date (3.5.1)
@@ -120,18 +122,18 @@ GEM
     domain_name (0.6.20240107)
     doorkeeper (5.8.2)
       railties (>= 5)
-    doorkeeper-i18n (5.2.8)
+    doorkeeper-i18n (5.2.9)
       doorkeeper (>= 5.2)
     drb (2.2.3)
-    erb (6.0.2)
+    erb (6.0.4)
     erubi (1.13.1)
-    faraday (2.14.1)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
       net-http (~> 0.5)
-    ffi (1.17.3)
+    ffi (1.17.4)
     globalid (1.3.0)
       activesupport (>= 6.1)
     hashie (5.1.0)
@@ -141,7 +143,7 @@ GEM
       nokogiri (>= 1.4)
     htmlentities (4.4.2)
     http-accept (1.7.0)
-    http-cookie (1.1.0)
+    http-cookie (1.1.6)
       domain_name (~> 0.5)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
@@ -150,13 +152,13 @@ GEM
       activesupport (>= 6.0.0)
       railties (>= 6.0.0)
     io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.1)
-    jwt (3.1.2)
+    json (2.19.9)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
@@ -165,7 +167,7 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -173,12 +175,12 @@ GEM
       net-imap
       net-pop
       net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
     matrix (0.4.3)
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0303)
+    mime-types-data (3.2026.0414)
     mini_magick (5.2.0)
       benchmark
       logger
@@ -187,13 +189,13 @@ GEM
     minitest (5.27.0)
     mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
-    multi_xml (0.8.1)
+    multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     mysql2 (0.5.7)
       bigdecimal
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.5.13)
+    net-imap (0.5.15)
       date
       net-protocol
     net-ldap (0.17.1)
@@ -205,19 +207,20 @@ GEM
       net-protocol
     netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.1)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oauth2 (2.0.18)
+    oauth2 (2.0.23)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0, >= 2.0.3)
-      version_gem (~> 1.1, >= 1.1.9)
-    parallel (1.27.0)
-    parser (3.3.10.2)
+      snaky_hash (~> 2.0, >= 2.0.6)
+      version_gem (~> 1.1, >= 1.1.11)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     pg (1.5.9)
@@ -230,35 +233,35 @@ GEM
       activesupport (>= 7.0.0)
       rack
       railties (>= 7.0.0)
-    psych (5.3.1)
+    psych (5.4.0)
       date
       stringio
     public_suffix (7.0.5)
-    puma (7.2.0)
+    puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.5)
-    rack-session (2.1.1)
+    rack (3.2.6)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3)
-      actioncable (= 7.2.3)
-      actionmailbox (= 7.2.3)
-      actionmailer (= 7.2.3)
-      actionpack (= 7.2.3)
-      actiontext (= 7.2.3)
-      actionview (= 7.2.3)
-      activejob (= 7.2.3)
-      activemodel (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    rails (7.2.3.1)
+      actioncable (= 7.2.3.1)
+      actionmailbox (= 7.2.3.1)
+      actionmailer (= 7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actiontext (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       bundler (>= 1.15.0)
-      railties (= 7.2.3)
+      railties (= 7.2.3.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -266,9 +269,9 @@ GEM
     rails-html-sanitizer (1.7.0)
       loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3)
-      actionpack (= 7.2.3)
-      activesupport (= 7.2.3)
+    railties (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       cgi
       irb (~> 1.13)
       rackup (>= 1.0.0)
@@ -277,13 +280,13 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
-    rake-compiler-dock (1.11.0)
+    rake (13.4.2)
+    rake-compiler-dock (1.12.0)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rb_sys (0.9.124)
-      rake-compiler-dock (= 1.11.0)
+    rb_sys (0.9.128)
+      rake-compiler-dock (= 1.12.0)
     rbpdf (1.21.4)
       htmlentities
       rbpdf-font (~> 1.19.0)
@@ -292,7 +295,7 @@ GEM
       erb
       psych (>= 4.0.0)
       tsort
-    regexp_parser (2.11.3)
+    regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
     requestjs-rails (0.0.14)
@@ -303,8 +306,8 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     rexml (3.4.4)
-    roadie (5.2.1)
-      css_parser (~> 1.4)
+    roadie (5.3.0)
+      css_parser (>= 1.4, < 3.0)
       nokogiri (~> 1.15)
     roadie-rails (3.3.0)
       railties (>= 5.1, < 8.1)
@@ -346,7 +349,7 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     securerandom (0.4.1)
-    selenium-webdriver (4.41.0)
+    selenium-webdriver (4.45.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -358,7 +361,7 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
-    snaky_hash (2.0.3)
+    snaky_hash (2.0.6)
       hashie (>= 0.1.0, < 6)
       version_gem (>= 1.1.8, < 3)
     sqlite3 (2.5.0)
@@ -384,10 +387,10 @@ GEM
     uniform_notifier (1.18.0)
     uri (1.1.1)
     useragent (0.16.11)
-    version_gem (1.1.9)
+    version_gem (1.1.12)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.1)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -396,8 +399,8 @@ GEM
       zeitwerk (>= 2.7)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.38)
-    zeitwerk (2.7.5)
+    yard (0.9.44)
+    zeitwerk (2.8.2)
 
 PLATFORMS
   ruby
@@ -436,7 +439,7 @@ DEPENDENCIES
   propshaft (~> 1.1.0)
   puma
   rack (>= 3.1.3)
-  rails (= 7.2.3)
+  rails (= 7.2.3.1)
   rails-dom-testing (>= 2.3.0)
   rbpdf (~> 1.21.4)
   requestjs-rails (~> 0.0.13)
@@ -462,7 +465,7 @@ DEPENDENCIES
   yard
 
 RUBY VERSION
-   ruby 3.3.10p183
+   ruby 3.4.9p82
 
 BUNDLED WITH
    2.7.2

pkgs/by-name/re/redmine/gemset.nix

@@ -11,10 +11,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yfl7blz9zlww0al921kmyqsmsx8gdphqjnszp5fgpzi8nr1fpg1";
+      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionmailbox = {
     dependencies = [
@@ -29,10 +29,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pjdrdlv14mzq24qx95hpxhfza0k72qc3qymaa6x1wihqfkz1fqn";
+      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionmailer = {
     dependencies = [
@@ -47,10 +47,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1f4axhrdhk9z3hjv6xzxqyj7c3y17mn7kz1li1fv5lm6aaw4dmk8";
+      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionpack = {
     dependencies = [
@@ -70,10 +70,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kq7fbgb5yfsjd1na2ghc7assk18ca24kbvsx90p0xwm8v3f851a";
+      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionpack-xml_parser = {
     dependencies = [
@@ -102,10 +102,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ds0m7qp55qkprhdkzpxrvbfiam95s58xj7555hf5d5pnzpxkzx6";
+      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionview = {
     dependencies = [
@@ -120,10 +120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cpc91crvavdgvc3jqj1nqr9q6s581bm64894pbh8f5l85x7shhz";
+      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activejob = {
     dependencies = [
@@ -134,10 +134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c7zwmhkg9fpkl2isiggs9b2xbf8jf0hhbvmjfgbcrz25m3n8jg4";
+      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -145,10 +145,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nrr8w3hxkssgx13bcph8lb876hg57w01fbapy7fj4ijp6p6dbxv";
+      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activerecord = {
     dependencies = [
@@ -160,10 +160,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mx087zngip62400z44p969l6fja1fjxliq6kym6npzbii3vgb3g";
+      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activestorage = {
     dependencies = [
@@ -177,10 +177,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0bya6k7i8s6538fa4j2c0a0xrf6kggg8mhrwnkkqj356zaxj452c";
+      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activesupport = {
     dependencies = [
@@ -204,10 +204,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "043vbilaw855c91n5l7g0k0wxj63kngj911685qy74xc1mvwjxan";
+      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -218,10 +218,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11ali533wx91fh93xlk88gjqq8w0p7kxw09nlh41hwc9wv5ly5fc";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
       type = "gem";
     };
-    version = "2.8.9";
+    version = "2.9.0";
   };
   ast = {
     groups = [
@@ -236,6 +236,20 @@
     };
     version = "2.4.3";
   };
+  auth-sanitizer = {
+    dependencies = [ "version_gem" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xy5gjb12kv6zjn4zyd16yfv4bygd02ykbr6cz10d6sqyw0wyzci";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
   base64 = {
     groups = [
       "default"
@@ -255,10 +269,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
       type = "gem";
     };
-    version = "3.1.21";
+    version = "3.1.22";
   };
   benchmark = {
     groups = [
@@ -284,10 +298,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.2";
   };
   builder = {
     groups = [ "default" ];
@@ -308,10 +322,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zwq7g98c1mdigahb50c980a0fcc4ib1m9ivmgf3f8gc6qk7wjv0";
+      sha256 = "1jy7yfn94acbcn23g9zh48b8j9jphwcqgr2vfy013zi4fd93q5n8";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "8.1.3";
   };
   bundle-audit = {
     dependencies = [ "bundler-audit" ];
@@ -398,10 +412,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.7";
   };
   connection_pool = {
     groups = [
@@ -433,10 +447,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
+      sha256 = "09b3zwmx95jhdp3da6qx9w0d6s2yfpxjjip55wpwny5wsx3v5l93";
       type = "gem";
     };
-    version = "1.21.1";
+    version = "2.2.0";
   };
   csv = {
     groups = [ "default" ];
@@ -522,10 +536,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lpmvaglypxlmaiqv4sjrf1b1sc8f589cv7xq3rr4j26vw0lf1g4";
+      sha256 = "195l8nfay1yb4igg348mjffikvh1m16b4899gyzz7ysgwkx3m9yy";
       type = "gem";
     };
-    version = "5.2.8";
+    version = "5.2.9";
   };
   drb = {
     groups = [
@@ -550,10 +564,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ar4nmvk1sk7drjigqyh9nnps3mxg625b8chfk42557p8i6jdrlz";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
       type = "gem";
     };
-    version = "6.0.2";
+    version = "6.0.4";
   };
   erubi = {
     groups = [ "default" ];
@@ -578,10 +592,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.14.1";
+    version = "2.14.3";
   };
   faraday-net_http = {
     dependencies = [ "net-http" ];
@@ -592,10 +606,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
       type = "gem";
     };
-    version = "3.4.2";
+    version = "3.4.4";
   };
   ffi = {
     groups = [
@@ -622,10 +636,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k1xaqw2jk13q3ss7cnyvkp8fzp75dk4kazysrxgfd1rpgvkk7qf";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.3";
+    version = "1.17.4";
   };
   globalid = {
     dependencies = [ "activesupport" ];
@@ -698,10 +712,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06dvmngd4hwrr6k774i1h6c50h2l8nww9f1id0wvrvi72l6yd99q";
+      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.6";
   };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
@@ -762,10 +776,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bishrxfn2anwlagw8rzly7i2yicjnr947f48nh638yqjgdlv30n";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.18.0";
   };
   json = {
     groups = [
@@ -775,10 +789,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b888h9v2y4aasi9aapxqimiaj1i1csk56l22dczigs8kv2zv56x";
+      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
       type = "gem";
     };
-    version = "2.19.1";
+    version = "2.19.9";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -789,10 +803,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dfm4bhl4fzn076igh0bmh2v1vphcrxdv6ldc46hdd3bkbqr2sdg";
+      sha256 = "1mqps8z4ly74hpksfajcfamqk1wb79biy187pn10knmi6zzb26al";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "3.2.0";
   };
   language_server-protocol = {
     groups = [
@@ -859,10 +873,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -885,10 +899,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vhb1sbzlq42k2pzd9v0w5ws4kjx184y8h4d63296bn57jiwzkzx";
+      sha256 = "17w53z6vka8ddmxvi936biqv443d5yg0503wj7xfmy9j1qvfjy0n";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   matrix = {
     groups = [
@@ -928,10 +942,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09627cnx432528j7j73711fbd0r30ri0lfsh9dfiki94b3gg2jhn";
+      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
       type = "gem";
     };
-    version = "3.2026.0303";
+    version = "3.2026.0414";
   };
   mini_magick = {
     dependencies = [
@@ -1008,10 +1022,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nnzdswa9l6w8k5ndgbv5al9f0jkg14dqwzyic4fjd5c1cls1nxd";
+      sha256 = "0msflv26i6i3jr9w761k4qdl7cp9zbhymjkn57b1w90pkjsndrvw";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.9.1";
   };
   mysql2 = {
     dependencies = [ "bigdecimal" ];
@@ -1047,10 +1061,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c9p0r2z6j14g0vi323r6x4cs6w87xjvphlkxf7x63h2wsscgc7d";
+      sha256 = "0506bhwr62szwcagcvxayhwz0d20k5ax1sh742va3mjnnkqcfkgn";
       type = "gem";
     };
-    version = "0.5.13";
+    version = "0.5.15";
   };
   net-ldap = {
     groups = [ "ldap" ];
@@ -1134,13 +1148,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lss1nh526n3h1qsig2kjchi8vlsjwc8pdjpplm1f2yz6rzk52sr";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
       type = "gem";
     };
-    version = "1.19.1";
+    version = "1.19.3";
   };
   oauth2 = {
     dependencies = [
+      "auth-sanitizer"
       "faraday"
       "jwt"
       "logger"
@@ -1153,10 +1168,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11rj80dgjz05x5xx93y4bfk9rcn7fl56srj8fgqn7ffzf3j13kxs";
+      sha256 = "0k428i1mlk6g7c054iks86g2h4h2p1y0mg2l3g6w84gd9l8604g6";
       type = "gem";
     };
-    version = "2.0.18";
+    version = "2.0.23";
   };
   parallel = {
     groups = [
@@ -1166,10 +1181,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
       type = "gem";
     };
-    version = "1.27.0";
+    version = "1.28.0";
   };
   parser = {
     dependencies = [
@@ -1183,10 +1198,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mwk9syajzdradzqzp3agf03d0cazqwbfd1439nxpkmxli5chq3g";
+      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
       type = "gem";
     };
-    version = "3.3.10.2";
+    version = "3.3.11.1";
   };
   pg = {
     groups = [ "default" ];
@@ -1270,10 +1285,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0x0r3gc66abv8i4dw0x0370b5hrshjfp6kpp7wbp178cy775fypb";
+      sha256 = "1dx5bc3s1mb1i53np4cdkypg7ccygnvagr3hglyndbqilrljvxql";
       type = "gem";
     };
-    version = "5.3.1";
+    version = "5.4.0";
   };
   public_suffix = {
     groups = [
@@ -1294,10 +1309,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
+      sha256 = "1yw6nvkvddriacmva8hm0za0961d6j96dm7zm6748rmyzcfqgvf8";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "8.0.2";
   };
   racc = {
     groups = [
@@ -1321,10 +1336,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rack-session = {
     dependencies = [
@@ -1335,10 +1350,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -1384,10 +1399,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zwvc2fa0hm27ygfz1yc2bs52h4wzj1nhpv6cip6g28i2gmi564s";
+      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   rails-dom-testing = {
     dependencies = [
@@ -1434,10 +1449,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08h44mkf91861agp7xw778gqpf5mppydsfgphgkj7wp6pyk11c3f";
+      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   rainbow = {
     groups = [
@@ -1457,20 +1472,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.3.1";
+    version = "13.4.2";
   };
   rake-compiler-dock = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hpq52ab86s70yv5hk56f0z14izhh59af95nlv73bsrksln1zdga";
+      sha256 = "08w033c3p25wr0zwbgx0b4mb4ha5kqd4j0ydmx9j0gcgfg10acpi";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.0";
   };
   rb-fsevent = {
     groups = [
@@ -1505,10 +1520,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rvshyirm32lzf2sggcrhvz5hi828s3rznmkchvzgshjgdapcd2i";
+      sha256 = "1z9q0l9l5r210jsmcmq3lxd4fr0j5lv348kn33g9a62fdm6izf4s";
       type = "gem";
     };
-    version = "0.9.124";
+    version = "0.9.128";
   };
   rbpdf = {
     dependencies = [
@@ -1561,10 +1576,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "192mzi0wgwl024pwpbfa6c2a2xlvbh3mjd75a0sakdvkl60z64ya";
+      sha256 = "1fwfw26a32rps78920nn29shqg2zmqv72i89j1fap41isshida9m";
       type = "gem";
     };
-    version = "2.11.3";
+    version = "2.12.0";
   };
   reline = {
     dependencies = [ "io-console" ];
@@ -1630,10 +1645,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mh1a0m0i0xrm20nry4d3gf0q5kbmm5lp15n52r93gcjwwfgd974";
+      sha256 = "1jlzxlq52qbsacxkz4gny988j2pcip73ydp1fg9s1q98ra4h6554";
       type = "gem";
     };
-    version = "5.2.1";
+    version = "5.3.0";
   };
   roadie-rails = {
     dependencies = [
@@ -1843,10 +1858,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08nxpr0lxn95ml19n0vy6dnw1gnhq9n1b0za5h18dwawsly1ghfd";
+      sha256 = "1lg22fmcalwnzgnanswn5g7vc24wmancnvbyf1ynzb46vyj6bb7c";
       type = "gem";
     };
-    version = "4.41.0";
+    version = "4.45.0";
   };
   simplecov = {
     dependencies = [
@@ -1901,10 +1916,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mnllrwhs7psw6xxs8x5yx85k12qjfdgs8zs0bxm70bfascx58r5";
+      sha256 = "0jk50mjq69065ygdhkhbmxp9k2c7knizhp022ysq5xfyikjclqrn";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.0.6";
   };
   sqlite3 = {
     dependencies = [ "mini_portile2" ];
@@ -2105,10 +2120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "195r5qylwxwqbllnpli9c2pzin0lky6h3fw912h88g2lmri0j6hc";
+      sha256 = "0gfv1qxfn202xffasw2mrrrf2jkdp6hsps0177k9fyc0fwb6k3xp";
       type = "gem";
     };
-    version = "1.1.9";
+    version = "1.1.12";
   };
   webrick = {
     groups = [ "default" ];
@@ -2142,10 +2157,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qj9dmkmgahmadgh88kydb7cv15w13l1fj3kk9zz28iwji5vl3gd";
+      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.1";
   };
   websocket-extensions = {
     groups = [ "default" ];
@@ -2190,19 +2205,19 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03q1hf12csqy5q2inafzi44179zaq9n5yrb0k2j2llqhzcmbh7vj";
+      sha256 = "0a3zi3v7qjm7lm4yp9z2sm959533k543sc4z0ixqik8wcfdpw27b";
       type = "gem";
     };
-    version = "0.9.38";
+    version = "0.9.44";
   };
   zeitwerk = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
+      sha256 = "04hx33lsnp4q0qf8982mz0acs1dap5s2bsmihi0n0g08249sc4kj";
       type = "gem";
     };
-    version = "2.7.5";
+    version = "2.8.2";
   };
 }

pkgs/by-name/re/redmine/package.nix

@@ -15,7 +15,7 @@
 }:
 
 let
-  version = "6.1.2";
+  version = "6.1.3";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -69,7 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.redmine.org/releases/redmine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-k46XXoCMz7Sw3LrYtC8Cqs8Mqe8VSRw4xa9HVnQMzwg=";
+    hash = "sha256-YdswCMf9GKOvxVntZW/Tj9+N+CIKxpWYsxkJUYMZC3o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/se/servarr-ffmpeg/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "5.1.4";
+  version = "5.1.10";
 in
 
 (ffmpeg-headless.override {
@@ -17,8 +17,8 @@ in
   source = fetchFromGitHub {
     owner = "Servarr";
     repo = "FFmpeg";
-    rev = "e9230b4c9027435dd402a68833f144643a3df43a";
-    hash = "sha256-oMIblMOnnYpKvYeleCZpFZURGVc3fDAlYpOJu+u7HkU=";
+    rev = "9eecad42d64ab888b9bb366df998b5b7cac0e2bc";
+    hash = "sha256-8qXQIbBNFRX3HsEHD2m4STHyxALqTSoIkKrVLc6vX/4=";
   };
 
   buildFfmpeg = false;

pkgs/by-name/si/sing-box/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.13.13";
+  version = "1.13.14";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RsiBxPQOE4rE3cFRjl81x1uIG2A4/smSBUg+G0vm7uQ=";
+    hash = "sha256-ODQ1i2lOuQLb3LDq6ONqHJQ7sT7dXICCJoyW/I9zF38=";
   };
 
-  vendorHash = "sha256-FUzGQx0TIJdWWYtF6781BSXLViFrXbPEdLKjuvtuleM=";
+  vendorHash = "sha256-Znk4bsm9TUseEuCQszs9rvVx8TDu+cwEVfVOhw7exYA=";
 
   tags = [
     "with_gvisor"

pkgs/by-name/so/sonarr/package.nix

@@ -21,7 +21,7 @@
   applyPatches,
 }:
 let
-  version = "4.0.17.2952";
+  version = "4.0.18.2971";
   # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
   # the already patched lockfile to `fetchYarnDeps`.
   src = applyPatches {
@@ -29,7 +29,7 @@ let
       owner = "Sonarr";
       repo = "Sonarr";
       tag = "v${version}";
-      hash = "sha256-nOpCKQqX6lHBcLtIC18CZ0nCrhXTjpEPcO0L2/kcNEo=";
+      hash = "sha256-83qbbBNk42KjKZNvYaAINoWZa3uEgaV0eveGl9dKTd8=";
     };
     postPatch = ''
       mv src/NuGet.Config NuGet.Config
@@ -208,6 +208,7 @@ buildDotnetModule {
       tie
       niklaskorz
       karaolidis
+      nyanloutre
     ];
     mainProgram = "Sonarr";
     # platforms inherited from dotnet-sdk.

pkgs/by-name/sp/speakersafetyd/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "speakersafetyd";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "speakersafetyd";
     tag = finalAttrs.version;
-    hash = "sha256-tHHoVJqWcip5u/e7M9l74opdzfe0Y9Q6ItIT7w7XfA8=";
+    hash = "sha256-duIPpTzZqVSZLxF/CYlxa1PPtnzeABTCYfZZ7lomkls=";
   };
 
-  cargoHash = "sha256-v0w/eA/qd9xBivgq7BgdaGRGDdX2NA1gbRgv84cB6d4=";
+  cargoHash = "sha256-gg1VcCrXKk5QsNvU7wz039md0gpFom6SrLuW6tjNQog=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/te/teleport_17/package.nix

@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "17.7.23";
-  hash = "sha256-o1aYmNN4yytgJFQ7V1sPjq6r2pDzf4mG/juyYK5IF3A=";
-  vendorHash = "sha256-cL2U1GOV6PtxSl8N8gjKOHCpj5jhun5D+DbeWBixnxI=";
+  version = "17.7.24";
+  hash = "sha256-45vaxznxRfa4X/V7hZsQKVIWvbVG8F2cEQN19xp4WQg=";
+  vendorHash = "sha256-ERwCdWdp230wkqsRUCnd1hbO4PqXo+gDPsoGbxQqt04=";
   cargoHash = "sha256-cDcDfptq8z0pwjImuAovv/5XwoaPb/ostyxkyNEbkRM=";
-  pnpmHash = "sha256-NTH5YnqeZg/jEkjguSXGS3/MI/r8us11By/fZ1m1caQ=";
+  pnpmHash = "sha256-hk9DI3GSBm2XttCYCi5kjhEhUMm5ToRQcbT+RYI+S2Q=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
   inherit buildGoModule withRdpClient extPatches;

pkgs/by-name/te/teleport_18/package.nix

@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "18.7.6";
-  hash = "sha256-p7qwsUr6n6OAl/b20SgropAubfPfwBiVTvbReb2HpO8=";
-  vendorHash = "sha256-/ZY0J0yB/8qMG6vEIta7Nf2Uv3xTZ/WPoMz+Dj5hwZA=";
-  pnpmHash = "sha256-uRsS5m0Q4fAFvJ3Qp6xcEAB8QFriLXbeGtD0o0n46RE=";
-  cargoHash = "sha256-KkFwMSBXsRmDuaPU1n6FPq2P5UQiQnb7+HEDOhhmjd0=";
+  version = "18.8.3";
+  hash = "sha256-DHPOWIvzBCOT3GU0YHBtG46ctB0Nh8XwSmpl9vgCET8=";
+  vendorHash = "sha256-0+fIoprAQyoom9xBpXGiEgmE4dWktcqlZQOzkRXYlKo=";
+  pnpmHash = "sha256-8FlC9Sm12A5kfS9X0qYDNJOePZjeJU7LDTRlWUIEneA=";
+  cargoHash = "sha256-IX0HCeCosXCe/oTYa8PImemf9op2AeagSnl44uBnSbM=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_99;
   buildGoModule = buildGo125Module;

pkgs/by-name/te/temporal_capi/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "temporal_capi";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "boa-dev";
     repo = "temporal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wD4pTVgQZrGONgSTDm9Eq3fo3Ez7aIC0/n4Rqgksad4=";
+    hash = "sha256-0JhYANVsVvNC0OZe1E6WzGc+pH9j7Z9SGCmhk8TQanU=";
   };
 
-  cargoHash = "sha256-8m4fWMEZxQ4g3h+81K9KnQvHHewmExOq0nouJ7wec8M=";
+  cargoHash = "sha256-atS6chUiKa9VVbsyar00YCdlVOuZ52qQWkz6HIvEqP4=";
 
   postPatch = ''
     # Force crate-type to include staticlib

pkgs/by-name/to/tor/package.nix

@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
-  version = "0.4.9.10";
+  version = "0.4.9.11";
 
   src = fetchurl {
     url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-3+6QTq6Pw4ouOzURVPisD8oqZkkDjxp+allGHeV9pH8=";
+    hash = "sha256-LmwXIBGMgSrPAHn9R8+Rtr+rpddmwyHE09KijWoRqO0=";
   };
 
   outputs = [

pkgs/development/libraries/ffmpeg/default.nix

@@ -16,18 +16,18 @@ let
     );
 
   v4 = {
-    version = "4.4.7";
-    hash = "sha256-A/75BOHNhoal0VLJPOoQmyBHF4BIVk8iZOdM3RBU6iE=";
+    version = "4.4.8";
+    hash = "sha256-byCiCiuwrikID6hCe0CD2KyPVUYuGmas5Zs0fd6dJRQ=";
   };
 
   v6 = {
-    version = "6.1.5";
-    hash = "sha256-iLAqdv1Dn7qln8Ag5lbGKOrWQZVLNREAgXbdDbHiMjc=";
+    version = "6.1.6";
+    hash = "sha256-7Mu0D9AVR+rVfqtZMmNV9EUNpUyMr09p/PuET0muS0U=";
   };
 
   v7 = {
-    version = "7.1.4";
-    hash = "sha256-GDN0+tJY8Nap9UkNUfzqT9cGV1IVCuy5Du/64G+8QdE=";
+    version = "7.1.5";
+    hash = "sha256-DjmW5LeI9OJmPeIh61znAns4+kolxwKguEvKawgxy8I=";
   };
   v8 = {
     version = "8.1.1";

pkgs/development/libraries/ffmpeg/generic.nix

@@ -460,15 +460,7 @@ stdenv.mkDerivation (
           hash = "sha256-ulB5BujAkoRJ8VHou64Th3E94z6m+l6v9DpG7/9nYsM=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
-        (fetchpatch2 {
-          # this can be removed post 6.1
-          name = "fix_build_failure_due_to_PropertyKey_EncoderID";
-          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
-          hash = "sha256-sxRXKKgUak5vsQTiV7ge8vp+N22CdTIvuczNgVRP72c=";
-        })
-      ]
-      ++ optionals (lib.versionOlder version "7.1.1") [
+      ++ optionals (lib.versionOlder version "7.1.1" && lib.versions.major version != "5") [
         (fetchpatch2 {
           name = "texinfo-7.1.patch";
           url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/4d9cdf82ee36a7da4f065821c86165fe565aeac2";

pkgs/development/ocaml-modules/landmarks-ppx/default.nix

@@ -1,8 +1,5 @@
 {
-  lib,
   buildDunePackage,
-  fetchpatch,
-  ocaml,
   landmarks,
   ppxlib,
 }:
@@ -10,17 +7,14 @@
 buildDunePackage {
   pname = "landmarks-ppx";
 
-  inherit (landmarks) src version;
+  minimalOCamlVersion = "5.3";
 
-  patches = lib.optional (lib.versionAtLeast ppxlib.version "0.36") (fetchpatch {
-    url = "https://github.com/LexiFi/landmarks/commit/367c229e3275a83f81343ba116374bb68abc9d83.patch";
-    hash = "sha256-Qxue+++sNV6EHJGX1mbIeY2E2D5NuFpmIIBkTyvGvo8=";
-  });
+  inherit (landmarks) src version;
 
   buildInputs = [ ppxlib ];
   propagatedBuildInputs = [ landmarks ];
 
-  doCheck = lib.versionAtLeast ocaml.version "5.1";
+  doCheck = true;
 
   meta = landmarks.meta // {
     description = "Preprocessor instrumenting code using the landmarks library";

pkgs/development/ocaml-modules/landmarks/default.nix

@@ -2,25 +2,23 @@
   lib,
   fetchFromGitHub,
   buildDunePackage,
-  ocaml,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "landmarks";
-  version = "1.5";
-  minimalOCamlVersion = "4.08";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "LexiFi";
     repo = "landmarks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eIq02D19OzDOrMDHE1Ecrgk+T6s9vj2X6B2HY+z+K8Q=";
+    hash = "sha256-9o9jf0M3zKc+Xojs4dqPRctYswSYqIo0jeOvkfdLfZ4=";
   };
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08" && lib.versionOlder ocaml.version "5.0";
+  doCheck = true;
 
   meta = {
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://github.com/LexiFi/landmarks";
     description = "Simple Profiling Library for OCaml";
     longDescription = ''
       Landmarks is a simple profiling library for OCaml. It provides

pkgs/development/ocaml-modules/ocsipersist/lib.nix

@@ -1,41 +1,30 @@
 {
   lib,
   buildDunePackage,
-  applyPatches,
-  fetchpatch,
   fetchFromGitHub,
+  js_of_ocaml,
   lwt_ppx,
   lwt,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "ocsipersist-lib";
-  version = "2.0.0";
+  version = "2.1.0";
 
-  src = applyPatches {
+  minimalOCamlVersion = "4.13";
 
-    src = fetchFromGitHub {
-      owner = "ocsigen";
-      repo = "ocsipersist";
-      tag = finalAttrs.version;
-      hash = "sha256-7CKKwJxqxUpCMNs4xGbsMZ6Qud9AnczBStTXS+N21DU=";
-    };
-
-    patches = [
-      # Migrate to logs
-      (fetchpatch {
-        url = "https://github.com/ocsigen/ocsipersist/commit/1fc0088b4dc2226f01863dd25f8ed56528c5543d.patch";
-        hash = "sha256-WR7SW8jAAo47AIQ7UMQNF8FTXgj6FbxIqFjrLhu7wFs=";
-        excludes = [
-          "*.opam"
-          "dune-project"
-        ];
-      })
-    ];
+  src = fetchFromGitHub {
+    owner = "ocsigen";
+    repo = "ocsipersist";
+    tag = finalAttrs.version;
+    hash = "sha256-YJzfgeyNXgBXAK607ROUXUmSpMKYx63ofZaBB8dnsq4=";
   };
 
   buildInputs = [ lwt_ppx ];
-  propagatedBuildInputs = [ lwt ];
+  propagatedBuildInputs = [
+    js_of_ocaml
+    lwt
+  ];
 
   meta = {
     description = "Persistent key/value storage (for Ocsigen) - support library";

pkgs/development/python-modules/itables/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "itables";
-  version = "2.8.0";
+  version = "2.8.1";
 
   # itables has 4 different node packages, each with their own
   # package-lock.json, and partially depending on each other.
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   # the source tarball from pypi, which includes the javascript bundle already.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uDJfvb0GEATyHqYkJZROXnGmTCpkhJlk4KSwAM3nA2I=";
+    hash = "sha256-Vix9cW1mfz+vh//hBEoZdHo7Ix7mqncl62+QjKoYxCk=";
   };
 
   pyproject = true;

pkgs/development/tools/pnpm/default.nix

@@ -22,12 +22,12 @@ let
       hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
     };
     "10" = {
-      version = "10.33.4";
-      hash = "sha256-jnDdxmSbGLw9iVzzqQjAKR6kw4A5rYcixH4Bja8enPw=";
+      version = "10.34.0";
+      hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.8.0";
-      hash = "sha256-HpY6XEylFoVQugP8TujYc6dysHK3/OY7SP/yfXIOLpg=";
+      version = "11.9.0";
+      hash = "sha256-K1Z6pmAmI4B4rC4KM77D/r1g6WKYeqxpdFbzGAgZsoc=";
     };
   };
 

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -181,8 +181,8 @@ rec {
       # Source corresponding to https://aur.archlinux.org/packages/nvidia-470xx-dkms
       aurPatches = fetchgit {
         url = "https://aur.archlinux.org/nvidia-470xx-utils.git";
-        rev = "7c1c2c124147d960a6c7114eb26a4eadae9b9f3d";
-        hash = "sha256-sNW+I4dkPSudfORLEp1RNGHyQKWBYnBEeGrfJU7SYTs=";
+        rev = "7abbeeb510742be09e1eb806c14bab2833a25783";
+        hash = "sha256-hRBws0o4DWI5fvZRn0OwitXRSR9HCkRkgnvnkiZI6Ko=";
       };
     in
     generic {
@@ -203,6 +203,9 @@ rec {
         "nvidia-470xx-fix-linux-6.14.patch"
         "nvidia-470xx-fix-linux-6.15.patch"
         "nvidia-470xx-fix-linux-6.17.patch"
+        "nvidia-470xx-fix-linux-6.19-part1.patch"
+        "nvidia-470xx-fix-linux-6.19-part2.patch"
+        "nvidia-470xx-fix-linux-7.0.patch"
       ];
       patchFlags = [
         "-p1"

pkgs/os-specific/linux/zfs/2_4.nix

@@ -18,6 +18,15 @@ callPackage ./generic.nix args {
   # this package should point to the latest release.
   version = "2.4.2";
 
+  extraPatches = [
+    # https://github.com/openzfs/zfs/issues/18366
+    # dedup data corruption fix unreleased as of OpenZFS 2.4.3
+    (fetchpatch {
+      url = "https://github.com/openzfs/zfs/commit/6fb72fda0f60d9efb591e320f83f78b19ec451cc.patch?full_index=1";
+      hash = "sha256-UuSVmO61Ux5S3F+JAtRnHyeVS4EFobDTKBuD5s8PI+k=";
+    })
+  ];
+
   tests = {
     inherit (nixosTests.zfs) series_2_4;
   }

pkgs/servers/http/nginx/mainline.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.31.1";
-  hash = "sha256-n8quuPIlRLCaGadh80EsQRIhVCJAFjS+vdEpakA8xLw=";
+  version = "1.31.2";
+  hash = "sha256-ryqVfEHaY23cT4g+RSPG0UC0eE285CAAw2SuUJKqRzw=";
 }

pkgs/servers/http/nginx/stable.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.30.2";
-  hash = "sha256-ffMJCQf8o8wORW1twAzrIw2nTqiAJs7/Cv/CnbvZrEw=";
+  version = "1.30.3";
+  hash = "sha256-5YI9xvRWEJk975Pr9s/OaCZK9JWMd+h0t9IPNwkAG48=";
 }

pkgs/stdenv/generic/check-meta.nix

@@ -50,6 +50,7 @@ let
   inherit (import ./problems.nix { inherit lib; })
     problemsType
     genCheckProblems
+    completeMetaProblems
     ;
   checkProblems = genCheckProblems config;
 
@@ -639,6 +640,8 @@ let
       unsupported = hasUnsupportedPlatform attrs;
       insecure = isMarkedInsecure attrs;
 
+      problems = completeMetaProblems config attrs;
+
       available =
         validity.valid != "no"
         && ((config.checkMetaRecursively or false) -> all (d: d.meta.available or true) references);

pkgs/stdenv/generic/problems.nix

@@ -48,6 +48,8 @@ rec {
     groupBy
     subtractLists
     genAttrs
+    concatMap
+    unique
     ;
 
   handlers = rec {
@@ -70,66 +72,81 @@ rec {
     max = a: b: if lessThan a b then b else a;
   };
 
-  # TODO: Combine this and automaticProblems into a `{ removal = { manual = true; ... }; ... }` structure for less error-prone changes
-  kinds = rec {
-    # Automatic and manual problem kinds
-    known = map (problem: problem.kindName) automaticProblems ++ manual;
-    # Problem kinds that are currently allowed to be specified in `meta.problems`
-    manual = [
-      "removal"
-      "deprecated"
-      "broken"
-    ];
-    # Problem kinds that are currently only allowed to be specified once
-    unique = [
-      "removal"
-    ];
+  kinds = {
+    maintainerless = {
+      manualAllowed = false;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = true;
+      automatic = {
+        condition =
+          # To get usable output, we want to avoid flagging "internal" derivations.
+          # Because we do not have a way to reliably decide between internal or
+          # external derivation, some heuristics are required to decide.
+          #
+          # If `outputHash` is defined, the derivation is a FOD, such as the output of a fetcher.
+          # If `description` is not defined, the derivation is probably not a package.
+          # Simply checking whether `meta` is defined is insufficient,
+          # as some fetchers and trivial builders do define meta.
+          config: attrs:
+          # Order of checks optimised for short-circuiting the common case of having maintainers
+          (attrs.meta.maintainers or [ ] == [ ])
+          && (attrs.meta.teams or [ ] == [ ])
+          && (!attrs ? outputHash)
+          && (attrs ? meta.description);
+        value.message = "This package has no declared maintainer, i.e. an empty `meta.maintainers` and `meta.teams` attribute.";
+      };
+    };
+    broken = {
+      manualAllowed = true;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = true;
+      automatic = {
+        condition =
+          config:
+          let
+            # TODO: Consider deprecating this or making it generic for all problems
+            allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
 
-    # Same thing but a set with null values (comes in handy at times)
-    manual' = genAttrs manual (k: null);
-    unique' = genAttrs unique (k: null);
-  };
-
-  automaticProblems = [
-    {
-      kindName = "maintainerless";
-      condition =
-        # To get usable output, we want to avoid flagging "internal" derivations.
-        # Because we do not have a way to reliably decide between internal or
-        # external derivation, some heuristics are required to decide.
-        #
-        # If `outputHash` is defined, the derivation is a FOD, such as the output of a fetcher.
-        # If `description` is not defined, the derivation is probably not a package.
-        # Simply checking whether `meta` is defined is insufficient,
-        # as some fetchers and trivial builders do define meta.
-        config: attrs:
-        # Order of checks optimised for short-circuiting the common case of having maintainers
-        (attrs.meta.maintainers or [ ] == [ ])
-        && (attrs.meta.teams or [ ] == [ ])
-        && (!attrs ? outputHash)
-        && (attrs ? meta.description);
-      value.message = "This package has no declared maintainer, i.e. an empty `meta.maintainers` and `meta.teams` attribute.";
-    }
-    {
-      kindName = "broken";
-      condition =
-        config:
-        let
-          # TODO: Consider deprecating this or making it generic for all problems
-          allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
-
-          allowBrokenPredicate =
-            if config ? allowBrokenPredicate then
+            allowBrokenPredicate =
               lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2605)
                 "config.allowBrokenPredicate is deprecated, use config.problems.handlers.myPackage.broken = \"warn\" for individual packages instead."
-                config.allowBrokenPredicate
-            else
-              x: false;
-        in
-        attrs: attrs.meta.broken or false && !allowBroken && !allowBrokenPredicate attrs;
-      value.message = "This package is broken.";
-    }
-  ];
+                config.allowBrokenPredicate;
+          in
+          if allowBroken then
+            attrs: false
+          else if config ? allowBrokenPredicate then
+            attrs: attrs ? meta.broken && attrs.meta.broken && !allowBrokenPredicate attrs
+          else
+            attrs: attrs ? meta.broken && attrs.meta.broken;
+        value.message = "This package is broken.";
+      };
+    };
+    removal = {
+      manualAllowed = true;
+      isUnique = true;
+      nixpkgsInternalUseAllowed = false;
+      automatic = null;
+    };
+    deprecated = {
+      manualAllowed = true;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = false;
+      automatic = null;
+    };
+  };
+
+  # Problem kinds that are currently allowed to be specified in `meta.problems`
+  manualKinds = lib.filterAttrs (name: value: value.manualAllowed) kinds;
+  # Problem kinds that are currently only allowed to be specified once
+  uniqueKinds = lib.filterAttrs (name: value: value.isUnique) kinds;
+
+  disallowNixpkgsInternalUseKinds = lib.filterAttrs (
+    name: value: !value.nixpkgsInternalUseAllowed
+  ) kinds;
+
+  automaticProblems = lib.mapAttrsToList (name: value: value.automatic // { kindName = name; }) (
+    lib.filterAttrs (name: value: value.automatic != null) kinds
+  );
 
   genAutomaticProblems =
     config: attrs:
@@ -144,7 +161,7 @@ rec {
     let
       types = lib.types;
       handlerType = types.enum handlers.levels;
-      problemKindType = types.enum kinds.known;
+      problemKindType = types.enum (attrNames kinds);
     in
     {
       handlers = lib.mkOption {
@@ -246,7 +263,8 @@ rec {
         record
         enum
         ;
-      kindType = enum kinds.manual;
+      # While we should only allow manual kinds, we need to allow `meta.problems = otherPackage.meta.problems`, which includes automatic ones as well
+      kindType = enum (attrNames kinds);
       subRecord = record {
         kind = kindType;
         message = str;
@@ -266,7 +284,7 @@ rec {
             let
               kindGroups = groupBy (kind: kind) (mapAttrsToList (name: problem: problem.kind or name) v);
             in
-            all (kind: kinds.manual' ? ${kind} && (kinds.unique' ? ${kind} -> length kindGroups.${kind} == 1)) (
+            all (kind: kinds ? ${kind} && (uniqueKinds ? ${kind} -> length kindGroups.${kind} == 1)) (
               attrNames kindGroups
             )
           );
@@ -290,14 +308,14 @@ rec {
           ++ concatLists (
             mapAttrsToList (
               kind: kindGroup:
-              optionals (!kinds.manual' ? ${kind}) (
+              optionals (!kinds ? ${kind}) (
                 map (
                   el:
                   "${ctx}.${el.name}: Problem kind ${kind}, inferred from the problem name, is invalid; expected ${kindType.name}. You can specify an explicit problem kind with `${ctx}.${el.name}.kind`"
                 ) (filter (el: !el.explicit) kindGroup)
               )
               ++
-                optional (kinds.unique' ? ${kind} && length kindGroup > 1)
+                optional (uniqueKinds ? ${kind} && length kindGroup > 1)
                   "${ctx}: Problem kind ${kind} should be unique, but is used for these problems: ${
                     concatMapStringsSep ", " (el: el.name) kindGroup
                   }"
@@ -330,7 +348,10 @@ rec {
         };
       };
 
-    Returns both the structure itself for inspection and a function that can query it with very few allocations/lookups
+      Returns:
+      - the structure itself for inspection
+      - a function that can query the structure with very few allocations/lookups
+      - a list of problem kinds/names/packages that require handling
 
     This allows collapsing arbitrarily many problem handlers/matchers into a predictable structure that can be queried in a predictable and fast way
   */
@@ -352,6 +373,20 @@ rec {
           ) config.problems.handlers
         );
 
+      # Lookup table for all the kinds/names/packages that actually need to be
+      # handled
+      definedConstraints = listToAttrs (
+        map (ident: {
+          name = "${ident}s"; # plural
+          value = unique (
+            concatMap (
+              constraint:
+              optionals (constraint.${ident} != null && constraint.handler != "ignore") [ (constraint.${ident}) ]
+            ) constraints
+          );
+        }) identOrder
+      );
+
       getHandler =
         list:
         (foldl'
@@ -410,26 +445,27 @@ rec {
       switch = doLevel 0 constraints;
     in
     {
-      inherit switch;
+      inherit switch definedConstraints;
       handlerForProblem =
         if isString switch then
-          pname: name: kind:
+          kind: name: pname:
           switch
         else
-          pname: name: kind:
+          kind:
           let
-            switch' = switch.kindSpecific.${kind} or switch.kindFallback;
+            kindSwitch = switch.kindSpecific.${kind} or switch.kindFallback;
           in
-          if isString switch' then
-            switch'
+          if isString kindSwitch then
+            name: pname: kindSwitch
           else
+            name:
             let
-              switch'' = switch'.nameSpecific.${name} or switch'.nameFallback;
+              nameSwitch = kindSwitch.nameSpecific.${name} or kindSwitch.nameFallback;
             in
-            if isString switch'' then
-              switch''
+            if isString nameSwitch then
+              pname: nameSwitch
             else
-              switch''.packageSpecific.${pname} or switch''.packageFallback;
+              pname: nameSwitch.packageSpecific.${pname} or nameSwitch.packageFallback;
     };
 
   genCheckProblems =
@@ -438,50 +474,62 @@ rec {
       # This is here so that it gets cached for a (checkProblems config) thunk
       inherit (genHandlerSwitch config)
         handlerForProblem
+        definedConstraints
         ;
-      # Makes sure that automatic problems can cache with just config applied
-      automaticProblemsConfigCache = map (
-        problem: problem // { condition = problem.condition config; }
+
+      # All the problem kinds that actually need to be checked
+      configuredProblems = definedConstraints.kinds ++ definedConstraints.names;
+
+      # Filter out any problems that are always ignored in config.problems.
+      # Makes sure to cache the condition by appliny config, and the handler
+      # by applying the problem's kind and name
+      automaticProblemsConfigCache = concatMap (
+        problem:
+        optional (elem problem.kindName configuredProblems) {
+          condition = problem.condition config;
+          handler = handlerForProblem problem.kindName problem.kindName;
+        }
       ) automaticProblems;
     in
     attrs:
-    let
-      pname = getName attrs;
-      manualProblems = attrs.meta.problems or { };
-    in
     if
       # Fast path for when there's no problem that needs to be handled
-      # No automatic problems that needs handling
       all (
-        problem:
-        problem.condition attrs -> handlerForProblem pname problem.kindName problem.kindName == "ignore"
+        problem: problem.condition attrs -> problem.handler (getName attrs) == "ignore"
       ) automaticProblemsConfigCache
       && (
         # No manual problems
-        manualProblems == { }
+        !attrs ? meta.problems
         # Or all manual problems are ignored
-        || all (name: handlerForProblem pname name (manualProblems.${name}.kind or name) == "ignore") (
-          attrNames manualProblems
-        )
+        || all (
+          name: handlerForProblem (attrs.meta.problems.${name}.kind or name) name (getName attrs) == "ignore"
+        ) (attrNames attrs.meta.problems)
       )
     then
       null
     else
       # Slow path, only here we actually figure out which problems we need to handle
       let
+        pname = getName attrs;
         problems = attrs.meta.problems or { } // genAutomaticProblems config attrs;
         problemsToHandle = filter (v: v.handler != "ignore") (
           mapAttrsToList (name: problem: rec {
             inherit name;
             # Kind falls back to the name
             kind = problem.kind or name;
-            handler = handlerForProblem pname name kind;
+            handler = handlerForProblem kind name pname;
             inherit problem;
           }) problems
         );
       in
       processProblems pname problemsToHandle;
 
+  completeMetaProblems =
+    config: attrs:
+    mapAttrs (name: problem: { kind = name; } // problem) (
+      (attrs.meta.problems or { }) // genAutomaticProblems config attrs
+    );
+
   processProblems =
     pname: problemsToHandle:
     let

pkgs/test/problems/cases/invalid-kind-error/expected-stderr

@@ -1,4 +1,4 @@
 (stack trace truncated; use '--show-trace' to show the full, detailed trace)
 
 error: Refusing to evaluate package 'a-0' in /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-default.nix:11 because it has an invalid meta attrset:
-  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<removal,deprecated,broken>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
+  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`

pkgs/test/problems/unit.nix

@@ -2,10 +2,15 @@
 let
   p = import ../../stdenv/generic/problems.nix { inherit lib; };
 
+  genConstraintsTest = problems: expected: {
+    expr = (p.genHandlerSwitch { inherit problems; }).definedConstraints;
+    inherit expected;
+  };
+
   genHandlerTest =
     let
       slowReference =
-        config: package: name: kind:
+        config: kind: name: package:
         # Try to find an explicit handler
         (config.problems.handlers.${package} or { }).${name}
           # Fall back, iterating through the matchers
@@ -31,7 +36,7 @@ let
             map
               (
                 name:
-                map (kind: f package name kind) [
+                map (kind: f kind name package) [
                   "k1"
                   "k2"
                   "k3"
@@ -150,4 +155,84 @@ lib.runTests {
     ];
     handlers = { };
   };
+
+  testDefinedConstraintsEmpty =
+    genConstraintsTest
+      {
+        matchers = [ ];
+        handlers = { };
+      }
+      {
+        kinds = [ ];
+        names = [ ];
+        packages = [ ];
+      };
+
+  testDefinedConstraintsMatchers =
+    genConstraintsTest
+      {
+        handlers = { };
+        matchers = [
+          {
+            package = null;
+            name = null;
+            kind = "k1";
+            handler = "warn";
+          }
+          {
+            package = null;
+            name = null;
+            kind = "k2";
+            handler = "error";
+          }
+          {
+            package = null;
+            name = null;
+            kind = "k3";
+            handler = "ignore";
+          }
+          {
+            package = "p1";
+            name = "n1";
+            kind = null;
+            handler = "error";
+          }
+          {
+            package = "p2";
+            name = "n1";
+            kind = null;
+            handler = "warn";
+          }
+        ];
+      }
+      {
+        kinds = [
+          "k1"
+          "k2"
+        ];
+        names = [ "n1" ];
+        packages = [
+          "p1"
+          "p2"
+        ];
+      };
+
+  testDefinedConstraintsHandlers =
+    genConstraintsTest
+      {
+        matchers = [ ];
+        handlers.p1.n1 = "warn";
+        handlers.p1.n2 = "error";
+        handlers.p2.n3 = "ignore";
+      }
+      {
+        kinds = [ ];
+        names = [
+          "n1"
+          "n2"
+        ];
+        packages = [
+          "p1"
+        ];
+      };
 }

pkgs/top-level/config.nix

@@ -58,6 +58,34 @@ let
       internal = true;
     };
 
+    attrPathsDisallowedForInternalUse = mkOption {
+      type = types.listOf (
+        types.submodule {
+          options.attrPath = lib.mkOption {
+            type = types.listOf types.str;
+            description = ''
+              Attribute path to disallow.
+            '';
+          };
+          options.reason = lib.mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = /* because */ "it's dangerous.";
+            description = ''
+              Reason for it being disallowed.
+            '';
+          };
+        }
+      );
+      internal = true;
+      default = [ ];
+      description = ''
+        List of attribute paths that may not be used by other packages in Nixpkgs.
+
+        Should usually only be defined by Nixpkgs CI.
+      '';
+    };
+
     # Config options
 
     warnUndeclaredOptions = mkOption {

pkgs/top-level/default.nix

@@ -214,7 +214,29 @@ let
       ;
   };
 
-  pkgs = boot stages;
+  fixedPoint = boot stages;
+
+  pkgs =
+    # Generally only set by CI, don't want to cause a performance hit for users
+    if config.attrPathsDisallowedForInternalUse == [ ] then
+      fixedPoint
+    else
+      # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
+      # We replace these attribute paths with their original derivations again,
+      # because CI would just error out from the aborting attributes themselves.
+      # Internally all packages still see the aborting attributes if used as dependencies,
+      # because we do this here after the fixed-point is calculated.
+      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
+      # because unlike aliases, CI still needs to check the packages to evaluate at all,
+      # which it wouldn't if they're removed entirely.
+      lib.updateManyAttrsByPath
+        (map (attrs: {
+          path = attrs.attrPath;
+          update =
+            _:
+            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
+        }) config.attrPathsDisallowedForInternalUse)
+        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
 
 in
 checked pkgs

pkgs/top-level/nixpkgs-basic-release-checks.nix

@@ -56,7 +56,7 @@ pkgs.runCommand "nixpkgs-release-checks"
           set -x
           nix-env -f $src \
               --show-trace --argstr system "$platform" \
-              --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+              --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
               --option lint-url-literals fatal \
               -qa --drv-path --system-filter \* --system \
               "''${opts[@]}" 2> eval-warnings.log > packages1
@@ -72,7 +72,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src2 \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system \
             "''${opts[@]}" > packages2
@@ -95,7 +95,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system --meta --xml \
             "''${opts[@]}" > /dev/null

pkgs/top-level/stage.nix

@@ -316,6 +316,32 @@ let
     };
   };
 
+  # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
+  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  internallyDisallowedAttrPathsOverlay =
+    final: prev:
+    # Generally only set by CI, don't want to cause a performance hit for users
+    if config.attrPathsDisallowedForInternalUse == [ ] then
+      { }
+    else
+      {
+        # So that ./default.nix can add them back again outside the fixed point
+        # Don't use this in packages!
+        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
+      }
+      // lib.updateManyAttrsByPath (map (
+        { attrPath, reason }:
+        {
+          path = attrPath;
+          update =
+            _:
+            abort "${lib.concatStringsSep "." attrPath} is disallowed from being used within Nixpkgs${
+              lib.optionalString (reason != null) ", because ${reason}"
+            }";
+        }
+      ) config.attrPathsDisallowedForInternalUse) prev;
+
   # The complete chain of package set builders, applied from top to bottom.
   # stdenvOverlays must be last as it brings package forward from the
   # previous bootstrapping phases which have already been overlaid.
@@ -331,6 +357,7 @@ let
       aliases
       variants
       configOverrides
+      internallyDisallowedAttrPathsOverlay
     ]
     ++ overlays
     ++ [