Merge release-26.05 into staging-next-26.05

.github/workflows/eval.yml

@@ -15,6 +15,9 @@ on:
       targetSha:
         required: true
         type: string
+      baseBranch:
+        required: true
+        type: string
       systems:
         required: true
         type: string
@@ -291,6 +294,7 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
+          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -299,6 +303,7 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
+            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

.github/workflows/merge-group.yml

@@ -97,6 +97,7 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/pull-request-target.yml

@@ -110,6 +110,7 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

ci/eval/compare/default.nix

@@ -49,6 +49,7 @@ in
 {
   combinedDir,
   touchedFilesJson,
+  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -242,7 +243,7 @@ runCommand "compare"
       echo
       echo "# Performance comparison"
       echo
-      echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
       echo
     } >> $out/step-summary.md
 

ci/eval/default.nix

@@ -288,6 +288,9 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
+      # The branch the local comparison is made against; matches the `master`
+      # used in the touched-files expression above.
+      baseBranch ? "master",
     }:
     let
       diffs = symlinkJoin {
@@ -305,7 +308,7 @@ let
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson;
+        inherit touchedFilesJson baseBranch;
       };
     in
     comparisonReport;

maintainers/maintainer-list.nix

@@ -2124,6 +2124,12 @@
     githubId = 56009;
     name = "Arcadio Rubio García";
   };
+  arcayr = {
+    email = "nixpkgs@arcayr.online";
+    github = "arcayr";
+    githubId = 11192354;
+    name = "Elliot Speck";
+  };
   archer-65 = {
     email = "mario.liguori.056@gmail.com";
     github = "archer-65";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - Create the first release note entry in this section!
 
+- [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

nixos/modules/module-list.nix

@@ -1049,6 +1049,7 @@
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
   ./services/monitoring/nezha-agent.nix
+  ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
   ./services/monitoring/osquery.nix

nixos/modules/services/monitoring/nezha.nix

@@ -0,0 +1,179 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nezha;
+
+  # nezha uses yaml as the configuration file format.
+  # Since we need to use jq to update the content, so here we generate json
+  settingsFormat = pkgs.formats.json { };
+  configFile = settingsFormat.generate "config.json" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+  options = {
+    services.nezha = {
+      enable = lib.mkEnableOption "Nezha Monitoring";
+
+      package = lib.mkPackageOption pkgs "nezha" { };
+
+      debug = lib.mkEnableOption "verbose log";
+
+      settings = lib.mkOption {
+        description = ''
+          Generate to {file}`config.yaml` as a Nix attribute set.
+          Check the [guide](https://nezha.wiki/en_US/guide/dashboard.html)
+          for possible options.
+        '';
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+
+          options = {
+            listenhost = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              description = ''
+                Host on which the nezha web interface and grpc should listen.
+              '';
+            };
+            listenport = lib.mkOption {
+              type = lib.types.port;
+              default = 8008;
+              description = ''
+                Port on which the nezha web interface and grpc should listen.
+              '';
+            };
+
+          };
+        };
+      };
+
+      mutableConfig = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether the config.yaml is writable by Nezha.
+
+          If this option is disabled, changes on the web interface won't
+          be possible. If an config.yaml is present, it will be overwritten.
+        '';
+      };
+
+      jwtSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret to sign web requests using JSON Web Tokens.
+        '';
+      };
+
+      agentSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret used by agents to connect.
+        '';
+      };
+
+      extraThemes = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.nezha-theme-nazhua ]";
+        description = ''
+          A list of additional themes.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nezha.settings.debug = cfg.debug;
+
+    systemd.services.nezha = {
+      serviceConfig = {
+        Restart = "on-failure";
+        StateDirectory = "nezha";
+        RuntimeDirectory = "nezha";
+        ConfigurationDirectory = "nezha";
+        WorkingDirectory = "/var/lib/nezha";
+        ReadWritePaths = [
+          "/var/lib/nezha"
+          "/etc/nezha"
+        ];
+
+        LoadCredential = [
+          "jwt-secret:${cfg.jwtSecretFile}"
+          "agent-secret:${cfg.agentSecretFile}"
+        ];
+
+        # Hardening
+        ProcSubset = "pid";
+        DynamicUser = true;
+        RemoveIPC = true;
+        LockPersonality = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = cfg.settings.listenport >= 1024; # incompatible with CAP_NET_BIND_SERVICE
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        AmbientCapabilities = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0066";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ]
+        ++ lib.optional (cfg.settings ? tsdb) "mincore";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        PrivateDevices = "yes";
+
+        ExecStart =
+          let
+            package = cfg.package.override { withThemes = cfg.extraThemes; };
+          in
+          ''${lib.getExe package} -c "''${CONFIGURATION_DIRECTORY}"/config.yaml -db "''${STATE_DIRECTORY}"/sqlite.db'';
+      };
+      enableStrictShellChecks = true;
+      startLimitIntervalSec = 10;
+      startLimitBurst = 3;
+      preStart = ''
+        cp "${configFile}" "''${RUNTIME_DIRECTORY}"/new
+        ${lib.getExe pkgs.jq} \
+            --arg jwt_secret "$(<"''${CREDENTIALS_DIRECTORY}"/jwt-secret)" \
+            --arg agent_secret "$(<"''${CREDENTIALS_DIRECTORY}"/agent-secret)" \
+            '. + { jwtsecretkey: $jwt_secret, agentsecretkey: $agent_secret }' \
+            < "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+        mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+
+        ${lib.optionalString cfg.mutableConfig ''
+          [ -e "''${CONFIGURATION_DIRECTORY}"/config.yaml ] && \
+            ${lib.getExe pkgs.yj} < "''${CONFIGURATION_DIRECTORY}"/config.yaml > "''${RUNTIME_DIRECTORY}"/old && \
+            ${lib.getExe pkgs.jq} -s '.[0] * .[1]' \
+              "''${RUNTIME_DIRECTORY}"/old "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+          [ -e "''${RUNTIME_DIRECTORY}"/old ] && rm "''${RUNTIME_DIRECTORY}"/old
+          [ -e "''${RUNTIME_DIRECTORY}"/tmp ] && mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+        ''}
+        mv "''${RUNTIME_DIRECTORY}"/new  "''${CONFIGURATION_DIRECTORY}"/config.yaml
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -1094,6 +1094,7 @@ in
   nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = runTest ./nexus.nix;
+  nezha = runTest ./nezha.nix;
   # TODO: Test nfsv3 + Kerberos
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };

nixos/tests/nezha.nix

@@ -0,0 +1,114 @@
+{ lib, pkgs, ... }:
+let
+  agent_host = "agent.test";
+  dashboard_host = "dashboard.test";
+
+  agentSecret = pkgs.writeText "fakeagentsecret" "fakeagentsecret";
+
+  hosts = {
+    "${agent_host}" = "192.168.0.2";
+    "${dashboard_host}" = "192.168.0.1";
+  };
+  hostsEntries = lib.mapAttrs' (k: v: {
+    name = v;
+    value = lib.singleton k;
+  }) hosts;
+in
+{
+  name = "nezha";
+
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+
+  containers = {
+    agent = _: {
+      networking = {
+        hostName = builtins.elemAt (lib.splitString "." agent_host) 0;
+        domain = builtins.elemAt (lib.splitString "." agent_host) 1;
+        firewall.enable = false;
+        hosts = hostsEntries;
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = lib.singleton {
+          address = hosts."${agent_host}";
+          prefixLength = 24;
+        };
+      };
+      services.nezha-agent = {
+        enable = true;
+        debug = true;
+        genUuid = true;
+        settings = {
+          server = hosts."${dashboard_host}" + ":80";
+        };
+        clientSecretFile = agentSecret;
+      };
+    };
+
+    dashboard =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1.ipv4.addresses = lib.singleton {
+            address = hosts."${dashboard_host}";
+            prefixLength = 24;
+          };
+        };
+        services.nezha = {
+          enable = true;
+          debug = true;
+          settings = {
+            listenhost = "0.0.0.0";
+            # Test CAP_NET_BIND_SERVICE
+            listenport = 80;
+          };
+          mutableConfig = true;
+          jwtSecretFile = pkgs.writeText "fakejwt" "fakejwt";
+          agentSecretFile = agentSecret;
+        };
+      };
+  };
+
+  testScript = ''
+    import json
+
+    with subtest("Wait for services and network"):
+        dashboard.wait_for_unit("nezha.service")
+        agent.wait_for_unit("nezha-agent.service")
+        dashboard.wait_for_open_port(80)
+        dashboard.wait_for_unit("network.target")
+        agent.wait_for_unit("network.target")
+        agent.succeed("curl --fail --max-time 10 http://dashboard.test/")
+
+    with subtest("Test mutableConfig"):
+        dashboard.succeed("systemctl stop nezha")
+        dashboard.succeed("""
+          echo '{"sitename": "Nezha on NixOS"}' > /etc/nezha/config.yaml
+        """)
+        dashboard.succeed("systemctl start nezha")
+        dashboard.wait_for_unit("nezha.service")
+        dashboard.wait_for_open_port(80)
+        result = json.loads(agent.succeed("""
+            curl --fail -X POST --json '{ "username": "admin", "password": "admin"}' \
+              'http://dashboard.test/api/v1/login'
+        """))
+        token = result['data']['token']
+        result = json.loads(agent.succeed(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/setting'
+        """))
+        assert "Nezha on NixOS" == result['data']['config']['site_name']
+
+    with subtest("Verify connection and uuid"):
+        uuid = agent.succeed(
+            "${lib.getExe' pkgs.util-linux "uuidgen"} --md5 -n @dns -N ${agent_host}"
+        )
+        # remove unprintable characters
+        uuid = "".join([char for char in uuid if char.isprintable()])
+        agent.wait_until_succeeds(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/server' | grep {uuid}
+        """)
+  '';
+}

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "149.0.7827.114",
+    "version": "149.0.7827.155",
     "chromedriver": {
-      "version": "149.0.7827.115",
-      "hash_darwin": "sha256-DOhM1knKphvLNyrkf0uvb9NZ3kBwSuVN5hkQLqAZR1Y=",
-      "hash_darwin_aarch64": "sha256-HXWvAjMdMMbeF8DsgFKNM+S0ZEYr2M8Wj0uUZC7tmxY="
+      "version": "149.0.7827.156",
+      "hash_darwin": "sha256-V7ZBijHsPzyphJPipWlIcU5Mb9l1OWzLc6PzxFKFuR8=",
+      "hash_darwin_aarch64": "sha256-sUG2Qg+nPIrYQC0iKNK78O1l92qTSDbRnJFfrqJMpts="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
-        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
+        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
+        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
-        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
+        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
+        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
-        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
+        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
+        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -192,8 +192,8 @@
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "afa2870e449ef33ad41545e7670c574cf70926a4",
-        "hash": "sha256-+N6FPtSiLQmNqf5+x5XDSksrRq/YDVSMVx5Rv1PGjfI="
+        "rev": "8ef5673404a3bbc192b0997e1c2df559cc5bd79d",
+        "hash": "sha256-NplvLz9oET6mhTuBkHH6pZc8qdfhqI7g69eZRCyae0A="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -537,8 +537,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "640d4ce27ba918783e28a0da46a8a37abe4a65b6",
-        "hash": "sha256-uCa/MEfw2s05kK91uubi/TqztHulwattzt1vfr0LR4E="
+        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
+        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -602,8 +602,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "74d747ce1d383caca3ec0e604d77bac35ccd1e58",
-        "hash": "sha256-qMY6L93hlnMgGZ5Blk5ldDnI/LUXYyuk+b7FXCiVV6s="
+        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
+        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -652,8 +652,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
-        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
+        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
+        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -787,8 +787,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
-        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
+        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
+        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -817,13 +817,13 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
-        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
+        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
+        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
       }
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.114",
+    "version": "149.0.7827.155",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.114-1",
-        "hash": "sha256-F0pIlZM/EBPLIZxD8jyLX7HWe0vFn2HXs2vkM5+Xplg="
+        "rev": "149.0.7827.155-1",
+        "hash": "sha256-+DviTrU7mdY3YQIIUzFh0DbFKUokQI8+lmQslUZdNSU="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
-        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
+        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
+        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
-        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
+        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
+        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
-        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
+        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
+        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1014,8 +1014,8 @@
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "afa2870e449ef33ad41545e7670c574cf70926a4",
-        "hash": "sha256-+N6FPtSiLQmNqf5+x5XDSksrRq/YDVSMVx5Rv1PGjfI="
+        "rev": "8ef5673404a3bbc192b0997e1c2df559cc5bd79d",
+        "hash": "sha256-NplvLz9oET6mhTuBkHH6pZc8qdfhqI7g69eZRCyae0A="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -1359,8 +1359,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "640d4ce27ba918783e28a0da46a8a37abe4a65b6",
-        "hash": "sha256-uCa/MEfw2s05kK91uubi/TqztHulwattzt1vfr0LR4E="
+        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
+        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1424,8 +1424,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "74d747ce1d383caca3ec0e604d77bac35ccd1e58",
-        "hash": "sha256-qMY6L93hlnMgGZ5Blk5ldDnI/LUXYyuk+b7FXCiVV6s="
+        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
+        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1474,8 +1474,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
-        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
+        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
+        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
-        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
+        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
+        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
-        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
+        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
+        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
       }
     }
   }

pkgs/by-name/am/amazon-ssm-agent/package.nix

@@ -43,13 +43,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "amazon-ssm-agent";
-  version = "3.3.3598.0";
+  version = "3.3.4515.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     tag = finalAttrs.version;
-    hash = "sha256-keagFjifd3Ok3mgheDAb9OSGHmd3HBOo5I0WaBHWJzE=";
+    hash = "sha256-FEYziTgYIzX8tm/zgVDi2Tvbxn+lBnXAAqqO+LhlQYM=";
   };
 
   vendorHash = null;

pkgs/by-name/ar/ardour/package.nix

@@ -73,14 +73,14 @@ stdenv.mkDerivation (
   in
   {
     pname = "ardour";
-    version = "9.5";
+    version = "9.7";
 
     # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
     # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
     src = fetchgit {
       url = "git://git.ardour.org/ardour/ardour.git";
       tag = finalAttrs.version;
-      hash = "sha256-Jaq1jgiGMmLeIw66RIXfZJxc+HCho2eGl5uEqAlNk6w=";
+      hash = "sha256-6gtlnk/oPXWJcN5tcb1r7dXyLpHPTSJwd8VfOjjFnWQ=";
     };
 
     bundledContent = fetchzip {

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YXEEiWbbP6G7x/rQiihAq20OEMxJNSgky+JTEaKlNDU=";
+    hash = "sha256-FZP+RTV4pcj9pzDq3G2+sWeJnkh9WnW3Atd0CC9zDCk=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor

pkgs/by-name/en/envoy-bin/package.nix

@@ -7,7 +7,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.37.2";
+  version = "1.37.4";
   inherit (stdenvNoCC.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -20,8 +20,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-sNf78pVUOEziPnGQCQJX/rXKE28UViazre+rstU/h4s=";
-      x86_64-linux = "sha256-MtPMIDuKvc6MLtkWopgSQ2TgxI6DtxlvVR52m2pIm/g=";
+      aarch64-linux = "sha256-y5WLtcHpEkYoPHOcCPDpE+d5nJd5Hn26G6znsd6ljuA=";
+      x86_64-linux = "sha256-i8e/dn5revJhxLboUYk1bzC8fmx4ERnp2RHfHXRfgKg=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/fi/filebrowser-quantum/package.nix

@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.2.2-stable";
+  version = "1.3.3-stable";
 
   src = fetchFromGitHub {
     owner = "gtsteffaniak";
     repo = "filebrowser";
     tag = "v${version}";
-    hash = "sha256-MWFBoVr5WRfLhDUGEGS6ntb3v23HcOcm91x3fGriM2A=";
+    hash = "sha256-Q4TtC5x/nAbeZzICH9R9LBqe/8tbQOFR8vAImhQ5sYM=";
   };
 
   frontend = buildNpmPackage {
@@ -20,7 +20,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/frontend";
-    npmDepsHash = "sha256-brW5YR/DNBOCPBDMEjSzyk+YTbrP5ppdQ0US/DLbyIs=";
+    npmDepsHash = "sha256-+2CHRhu+cEmA0OvvU8ZKZ7Q5rTUX2KCSXFeVdievoYQ=";
 
     buildPhase = ''
       runHook preBuild
@@ -47,7 +47,7 @@ buildGoModule {
 
   sourceRoot = "${src.name}/backend";
 
-  vendorHash = "sha256-pU5qtWvhLbMdxzXK6uKxEkvbZdb2oa4ZHKaCPm0bIwU=";
+  vendorHash = "sha256-Fq5FqsZ4m5j+UIn1RsElhNUb4guwI9wo48SjQdvESRU=";
 
   preBuild = ''
     mkdir -p http/embed

pkgs/by-name/fl/fluent-bit/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VXf1F0TZFi8d7gil8yc3WWA/0X3QyYPnbA3luE1DE98=";
+    hash = "sha256-5X6qiwoRc7FTJSGjWYhhef9N8gaxrc9dwD8Z/8woIUo=";
   };
 
   # The source build documentation covers some dependencies and CMake options.

pkgs/by-name/hm/hmcl/package.nix

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.14.1";
+  version = "3.15.1";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-j8+PIbNySlwELKKdsYQe53++w9zunKaN9TRqZq+LpYI=";
+    hash = "sha256-Uv6w3XEySoqsKCmZVmiDkGfmeretHfvpwFmYMJz0mv4=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for

pkgs/by-name/jo/joplin-desktop/package.nix

@@ -228,7 +228,7 @@ stdenv.mkDerivation (finalAttrs: {
       icon = "joplin";
       comment = "Joplin for Desktop";
       categories = [ "Office" ];
-      startupWMClass = "@joplin/app-desktop";
+      startupWMClass = "joplin-app-desktop";
       mimeTypes = [ "x-scheme-handler/joplin" ];
     })
   ];

pkgs/by-name/kn/knot-dns/package.nix

@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "knot-dns";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-SgvIkt+qWhUP8oVfCojyJnEkvCcYGOrporH22kh8NOQ=";
+    sha256 = "38502c1472247c955aa3329bb5722e61ca765b833e3497d71f891ebf8e77fa04";
   };
 
   outputs = [

pkgs/by-name/ko/kopia/package.nix

@@ -11,18 +11,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kopia";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
+    hash = "sha256-yjeLV7N/U88oVdP4iJYgSM/QJLAMREaB/2jBcbTDWkA=";
   };
 
   __structuredAttrs = true;
 
-  vendorHash = "sha256-VMfFXGBIUtRa4JxhOn7YBfdLNmpmGrkBVKiIDn5vKTc=";
+  vendorHash = "sha256-5p/MUNkqNb+iAFxXXYRR2NB1WiGVIcNrTADsd/VjapU=";
 
   subPackages = [ "." ];
 

pkgs/by-name/le/ledger-live-desktop/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "4.4.0";
+  version = "4.6.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-diyjhQCA+rF9E8QdTbwJqUKE0N6wdlcN9Oamr81LsOc=";
+    hash = "sha256-B/ZAtf4pBZ6kjEL9qlJ4dYy7OHjMbtqqukjYvN3CC8c=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/ll/lldap/package.nix

@@ -6,7 +6,7 @@
   nixosTests,
   rustPlatform,
   rustc,
-  wasm-bindgen-cli_0_2_100,
+  wasm-bindgen-cli_0_2_120,
   wasm-pack,
   which,
   runCommand,
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lldap";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "lldap";
     repo = "lldap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
+    hash = "sha256-EafYBCorK5t8ZLoXTjqLg+Q6GDRZjalpRqSoVySdpOk=";
   };
 
-  cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  cargoHash = "sha256-GhSoPDMsWRuW6SYS/QTPgsA7fBFup5C5+DBqnlFqwlQ=";
   ## workaround for overrideAttrs on buildRustPackage
   ## see https://discourse.nixos.org/t/is-it-possible-to-override-cargosha256-in-buildrustpackage/4393/3
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -61,7 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       pname = finalAttrs.pname + "-frontend";
       nativeBuildInputs = [
         wasm-pack
-        wasm-bindgen-cli_0_2_100
+        wasm-bindgen-cli_0_2_120
         binaryen
         which
         rustc

pkgs/by-name/ma/matrix-tuwunel/package.nix

@@ -11,7 +11,6 @@
   nix-update-script,
   testers,
   matrix-tuwunel,
-  enableBlurhashing ? true,
   # upstream tuwunel enables jemalloc by default, so we follow suit
   enableJemalloc ? true,
   rust-jemalloc-sys,
@@ -89,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bB42SEa/gkFlkjb4L12Uh7xI4+3NmJgfbUPU01NXaEQ=";
+    hash = "sha256-KbcijWL4PwEUycE9pxdJjnBP0pxK6ywuf7wpuy2eA60=";
   };
 
-  cargoHash = "sha256-czCKzV/DCMJK0sN/jP5Jo98Zdii9DIAGAVnFnK0YtmY=";
+  cargoHash = "sha256-RsZWk+cm9JJ6+8xsWXNyN2QcHSMFOD3CikNm84DhXWU=";
 
   nativeBuildInputs = [
     pkg-config
@@ -127,7 +126,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildNoDefaultFeatures = true;
   # See https://github.com/matrix-construct/tuwunel/blob/main/src/main/Cargo.toml
   # for available features.
-  # We enable all default features except jemalloc, blurhashing, and io_uring, which
+  # We enable all default features except jemalloc and io_uring, which
   # we guard behind our own (default-enabled) flags.
   buildFeatures = [
     "brotli_compression"
@@ -140,7 +139,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "url_preview"
     "zstd_compression"
   ]
-  ++ lib.optional enableBlurhashing "blurhashing"
   ++ lib.optional enableJemalloc [
     "jemalloc"
     "jemalloc_conf"

pkgs/by-name/mp/mprisence/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8w4k+l0uqIFgIVBuK0H/Mhvwp2HHEzvKmExkTiRUmEM=";
+    hash = "sha256-Ss6RXxtpSI3jfq5CAwRLE0XA3tFkIBI+JMyUov2DSpM=";
   };
 
-  cargoHash = "sha256-PcQc7LpQqnTiAfTL+E67Ibbsw5UI7j0YICiHpxWrrj8=";
+  cargoHash = "sha256-AKj+DibLyoWUw+082m5wMVnZAY4Kmf3+daRJDGeLKtc=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/mu/mullvad-compass/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mullvad-compass";
-  version = "0.0.3";
+  version = "0.0.4";
 
   src = fetchFromGitHub {
     owner = "Ch00k";
     repo = "mullvad-compass";
     tag = finalAttrs.version;
-    hash = "sha256-OhaXabjkimeMXty6msqDJVvnWXu8G6jWz/E2x7ZYrDI=";
+    hash = "sha256-4Q6Pm20stbuY+KQHhIPGegCIwGiYIagduN//d+CKKXE=";
   };
 
   vendorHash = "sha256-gEdtoJjCa0nVyi7T4zzv6xUDTQCYFi4ANFaqXGeqcsI=";

pkgs/by-name/n8/n8n/package.nix

@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.23.4";
+  version = "2.25.7";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-0LROPZKLKEKHBgV0kWAfataZB2nMzdsmq1WImCA6bgA=";
+    hash = "sha256-V8CqEzCw4DcLPCao4HRXrJXFeID2+Ef8fNW1xd1b8Vs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-oqnLywIOhAZr7nmeGvq6k0brcGjHRhR3pVvBQK3Fg0k=";
+    hash = "sha256-JS4OY6CmihsbJRyPszSlNUEViFKfLm2vu+G2upIoLW8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ne/nezha-theme-user/package.nix

@@ -2,36 +2,44 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_11,
   nix-update-script,
 }:
 
+let
+  pnpm = pnpm_11;
+in
 buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-user";
-  version = "2.0.1";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "hamster1963";
-    repo = "nezha-dash-v1";
+    repo = "nezha-dash-v2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3zaA3T4zW18caOQe5DBF8Zsms3cjks3Ywyfkyk6N2N0=";
+    hash = "sha256-X7NRpDeZqLijgbUQOEdML00TPRM2D55zlJkzWB2TKfM=";
   };
 
-  # TODO: Switch to the bun build function once available in nixpkgs
   postPatch = ''
-    cp ${./package-lock.json} package-lock.json
-
     # We cannot directly get the git commit hash from the tarball
     substituteInPlace vite.config.ts \
-      --replace-fail 'git rev-parse --short HEAD' 'echo refs/tags/v${finalAttrs.version}'
+      --replace-fail 'git rev-parse --short HEAD' 'echo ${finalAttrs.src.rev}'
     substituteInPlace src/components/Footer.tsx \
       --replace-fail '/commit/' '/tree/'
   '';
 
-  npmDepsHash = "sha256-hjVvp2dWBHqXrq/7+kLDmcUUrV15ln/8tNNqDmJ/Sh4=";
+  nativeBuildInputs = [ pnpm ];
 
-  npmPackFlags = [ "--ignore-scripts" ];
-
-  npmFlags = [ "--legacy-peer-deps" ];
+  npmDeps = null;
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-4Zfiw//9w16I2CXOEy/ocAI5frK5w4g3b8pxguGWOdA=";
+  };
+  npmConfigHook = pnpmConfigHook;
 
   dontNpmInstall = true;
   installPhase = ''
@@ -42,13 +50,13 @@ buildNpmPackage (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Nezha monitoring user frontend based on next.js";
-    changelog = "https://github.com/hamster1963/nezha-dash-v1/releases/tag/v${finalAttrs.version}";
-    homepage = "https://github.com/hamster1963/nezha-dash-v1";
-    license = lib.licenses.apsl20;
+    changelog = "https://github.com/hamster1963/nezha-dash-v2/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/hamster1963/nezha-dash-v2";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ moraxyc ];
   };
 })

pkgs/by-name/ne/nezha/package.nix

@@ -7,6 +7,7 @@
   dbip-country-lite,
   formats,
   nix-update-script,
+  nixosTests,
   nezha-theme-admin,
   nezha-theme-user,
   withThemes ? [ ],
@@ -48,13 +49,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "nezha";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-40GirWaa03sX5UNL0ZI8qcFqYV2ZuRniWofKluKeW+0=";
+    hash = "sha256-Vj9vgLT38HbdF4mWQkv3Yrshdv/kQpWk51teyl9qzF0=";
   };
 
   proxyVendor = true;
@@ -114,6 +115,9 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) nezha;
+    };
   };
 
   meta = {

pkgs/by-name/ni/nixseparatedebuginfod2/package.nix

@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nixseparatedebuginfod2";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "symphorien";
     repo = "nixseparatedebuginfod2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D327Pz3oHOHgfekXnDRQ0l+GrIcFUK1zcIqzR2Y3zqU=";
+    hash = "sha256-PG/TqfXTuricAcwCB+2dKlVgHXxhCVVRJaVJ5v0xd4o=";
   };
 
-  cargoHash = "sha256-iAhm54jb+5Nv/XG6GYpoEgPjYmBTHvEnnmynFF8D8n4=";
+  cargoHash = "sha256-XDkW1tCSvmiTU0GN3L0oL0uhgWYQSlxRIV0xcwSlgkY=";
 
   buildInputs = [
     libarchive
@@ -56,12 +56,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru.tests = { inherit (nixosTests) nixseparatedebuginfod2; };
 
-  # flaky tests
-  checkFlags = [ "--skip=substituter::http" ];
-
   meta = {
     description = "Downloads and provides debug symbols and source code for nix derivations to gdb and other debuginfod-capable debuggers as needed";
     homepage = "https://github.com/symphorien/nixseparatedebuginfod2";
+    changelog = "https://https://github.com/symphorien/nixseparatedebuginfod2/blob/v${finalAttrs.version}/CHANGELOG.md/";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       symphorien

pkgs/by-name/op/openbao/package.nix

@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openbao";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gf/2/3XLzCnmU8hJfctUra6mamBsH/4QEiC89FolKQ4=";
+    hash = "sha256-75Rm9EGkvUKJ05d55bboPAE+Nm/GLLgH1TqDrExkJO0=";
   };
 
-  vendorHash = "sha256-TPBKqIa9ZkxqXbMXSY4tuVne4ed19tzZp7+LvH0to9M=";
+  vendorHash = "sha256-3d3g6f0O7X+aedYCfLbqLNuITKNQuxZkApWTTKSk7lA=";
 
   proxyVendor = true;
 

pkgs/by-name/rc/rclone/package.nix

@@ -17,7 +17,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "rclone";
-  version = "1.74.2";
+  version = "1.74.3";
 
   outputs = [
     "out"
@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
     owner = "rclone";
     repo = "rclone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ynPRzzS0aoEbDiCgeIyi2Ce3+NHjQcazm7KJeK6cdiM=";
+    hash = "sha256-GLl8juSCVKEjsVZAzvvfKx1TxC/rcM7lMBek9BLosi0=";
   };
 
-  vendorHash = "sha256-fiZyN94l0Eq3BjJzW3lF5ld37VBurWjtr1v5kVWCc/Q=";
+  vendorHash = "sha256-FuSqI5fCmt/fr4AwJhdFaolYugZDTYeOcity/VZzYZ0=";
 
   subPackages = [ "." ];
 

pkgs/by-name/sa/sabnzbd/package.nix

@@ -73,14 +73,14 @@ let
   ];
 in
 stdenv.mkDerivation rec {
-  version = "5.0.3";
+  version = "5.0.4";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = "sabnzbd";
     repo = "sabnzbd";
     rev = version;
-    hash = "sha256-UTzdBM64fCbyY8+h94G8XbTIdoXk0mDZjlnGPywRB4Q=";
+    hash = "sha256-Fi42ctRVNv3fJwNF/5CW/EJjdrjgotJS5sD2jHoc7/I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/uv/uv/package.nix

@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.19";
+  version = "0.11.21";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-2NZVsYK0lZHX5xQqQXXczoaBzEMIGHjT0ls55BVu0RM=";
+    hash = "sha256-2PhGJbgCSqOiDVv8ktVkAaADhPxvKp1/JqkNQspt2Pc=";
   };
 
-  cargoHash = "sha256-gMCvZUzqLe/Q7O1tWWPJs7pxWklb3LN9QQIULIq4oUU=";
+  cargoHash = "sha256-0hfLpfU2WaWFkqcSMJctLM5UDeTnIibuog/0U+DBzmI=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/za/zapzap/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zapzap";
-  version = "6.5.1";
+  version = "6.5.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rafatosta";
     repo = "zapzap";
     tag = finalAttrs.version;
-    hash = "sha256-elSMrH62oKZ2F6W9gkormdUi60u0r7Yy3AYOm47vGcE=";
+    hash = "sha256-6W4Crf3zNRLOvBqnM6K9r2u8Z/lF4JnEse0ctMM+1m4=";
   };
 
   nativeBuildInputs = [

pkgs/development/coq-modules/coqeal/default.nix

@@ -58,6 +58,7 @@ let
     release."1.0.3".sha256 = "0hc63ny7phzbihy8l7wxjvn3haxx8jfnhi91iw8hkq8n29i23v24";
 
     propagatedBuildInputs = [
+      mathcomp.ssreflect
       mathcomp.algebra
       bignums
       multinomials

pkgs/development/coq-modules/mathcomp-abel/default.nix

@@ -43,6 +43,7 @@ mkCoqDerivation {
   release."1.0.0".sha256 = "190jd8hb8anqsvr9ysr514pm5sh8qhw4030ddykvwxx9d9q6rbp3";
 
   propagatedBuildInputs = [
+    mathcomp.ssreflect
     mathcomp.field
     mathcomp-real-closed
   ];

pkgs/development/coq-modules/mathcomp-analysis/default.nix

@@ -4,7 +4,6 @@
   mathcomp,
   mathcomp-finmap,
   mathcomp-bigenough,
-  mathcomp-real-closed,
   hierarchy-builder,
   stdlib,
   single ? false,
@@ -105,7 +104,6 @@ let
       analysis-deps = [
         mathcomp.field
         mathcomp-bigenough
-        mathcomp-real-closed
       ];
       intra-deps = lib.optionals (package != "single") (map mathcomp_ packages.${package});
       pkgpath = lib.switch package [

pkgs/development/coq-modules/mathcomp-real-closed/default.nix

@@ -7,69 +7,89 @@
   version ? null,
 }:
 
-mkCoqDerivation {
+let
+  derivation = mkCoqDerivation {
 
-  namePrefix = [
-    "coq"
-    "mathcomp"
-  ];
-  pname = "real-closed";
-  owner = "math-comp";
-  inherit version;
-  release = {
-    "2.0.3".sha256 = "sha256-heZ7aZ7TO9YNAESIvbAc1qqzO91xMyLAox8VKueIk/s=";
-    "2.0.2".sha256 = "sha256-hBo9JMtmXDYBmf5ihKGksQLHv3c0+zDBnd8/aI2V/ao=";
-    "2.0.1".sha256 = "sha256-tQTI3PCl0q1vWpps28oATlzOI8TpVQh1jhTwVmhaZic=";
-    "2.0.0".sha256 = "sha256-sZvfiC5+5Lg4nRhfKKqyFzovCj2foAhqaq/w9F2bdU8=";
-    "1.1.4".sha256 = "sha256-8Hs6XfowbpeRD8RhMRf4ZJe2xf8kE0e8m7bPUzR/IM4=";
-    "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
-    "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
-    "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
-    "1.0.5".sha256 = "0q8nkxr9fba4naylr5xk7hfxsqzq2pvwlg1j0xxlhlgr3fmlavg2";
-    "1.0.4".sha256 = "058v9dj973h9kfhqmvcy9a6xhhxzljr90cf99hdfcdx68fi2ha1b";
-    "1.0.3".sha256 = "1xbzkzqgw5p42dx1liy6wy8lzdk39zwd6j14fwvv5735k660z7yb";
-    "1.0.1".sha256 = "0j81gkjbza5vg89v4n9z598mfdbql416963rj4b8fzm7dp2r4rxg";
+    namePrefix = [
+      "coq"
+      "mathcomp"
+    ];
+    pname = "real-closed";
+    owner = "math-comp";
+    inherit version;
+    release = {
+      "2.0.3".sha256 = "sha256-heZ7aZ7TO9YNAESIvbAc1qqzO91xMyLAox8VKueIk/s=";
+      "2.0.2".sha256 = "sha256-hBo9JMtmXDYBmf5ihKGksQLHv3c0+zDBnd8/aI2V/ao=";
+      "2.0.1".sha256 = "sha256-tQTI3PCl0q1vWpps28oATlzOI8TpVQh1jhTwVmhaZic=";
+      "2.0.0".sha256 = "sha256-sZvfiC5+5Lg4nRhfKKqyFzovCj2foAhqaq/w9F2bdU8=";
+      "1.1.4".sha256 = "sha256-8Hs6XfowbpeRD8RhMRf4ZJe2xf8kE0e8m7bPUzR/IM4=";
+      "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
+      "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
+      "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
+      "1.0.5".sha256 = "0q8nkxr9fba4naylr5xk7hfxsqzq2pvwlg1j0xxlhlgr3fmlavg2";
+      "1.0.4".sha256 = "058v9dj973h9kfhqmvcy9a6xhhxzljr90cf99hdfcdx68fi2ha1b";
+      "1.0.3".sha256 = "1xbzkzqgw5p42dx1liy6wy8lzdk39zwd6j14fwvv5735k660z7yb";
+      "1.0.1".sha256 = "0j81gkjbza5vg89v4n9z598mfdbql416963rj4b8fzm7dp2r4rxg";
+    };
+
+    defaultVersion =
+      let
+        case = coq: mc: out: {
+          cases = [
+            coq
+            mc
+          ];
+          inherit out;
+        };
+      in
+      with lib.versions;
+      lib.switch
+        [ coq.version mathcomp.version ]
+        [
+          (case (range "8.18" "9.1") (isGe "2.2.0") "2.0.3")
+          (case (range "8.17" "9.0") (range "2.1.0" "2.3.0") "2.0.2")
+          (case (range "8.17" "8.20") (range "2.0.0" "2.2.0") "2.0.1")
+          (case (range "8.16" "8.19") (range "2.0.0" "2.2.0") "2.0.0")
+          (case (range "8.13" "8.19") (range "1.13.0" "1.19.0") "1.1.4")
+          (case (isGe "8.13") (range "1.12.0" "1.18.0") "1.1.3")
+          (case (isGe "8.10") (range "1.12.0" "1.18.0") "1.1.2")
+          (case (isGe "8.7") "1.11.0" "1.1.1")
+          (case (isGe "8.7") (range "1.9.0" "1.10.0") "1.0.4")
+          (case (isGe "8.7") "1.8.0" "1.0.3")
+          (case (isGe "8.7") "1.7.0" "1.0.1")
+        ]
+        null;
+
+    propagatedBuildInputs = [
+      mathcomp.ssreflect
+      mathcomp.algebra
+      mathcomp.field
+      mathcomp.fingroup
+      mathcomp.solvable
+      mathcomp-bigenough
+    ];
+
+    meta = {
+      description = "Mathematical Components Library on real closed fields";
+      license = lib.licenses.cecill-c;
+    };
   };
-
-  defaultVersion =
-    let
-      case = coq: mc: out: {
-        cases = [
-          coq
-          mc
-        ];
-        inherit out;
-      };
-    in
-    with lib.versions;
-    lib.switch
-      [ coq.version mathcomp.version ]
-      [
-        (case (range "8.18" "9.1") (isGe "2.2.0") "2.0.3")
-        (case (range "8.17" "9.0") (range "2.1.0" "2.3.0") "2.0.2")
-        (case (range "8.17" "8.20") (range "2.0.0" "2.2.0") "2.0.1")
-        (case (range "8.16" "8.19") (range "2.0.0" "2.2.0") "2.0.0")
-        (case (range "8.13" "8.19") (range "1.13.0" "1.19.0") "1.1.4")
-        (case (isGe "8.13") (range "1.12.0" "1.18.0") "1.1.3")
-        (case (isGe "8.10") (range "1.12.0" "1.18.0") "1.1.2")
-        (case (isGe "8.7") "1.11.0" "1.1.1")
-        (case (isGe "8.7") (range "1.9.0" "1.10.0") "1.0.4")
-        (case (isGe "8.7") "1.8.0" "1.0.3")
-        (case (isGe "8.7") "1.7.0" "1.0.1")
-      ]
-      null;
-
-  propagatedBuildInputs = [
-    mathcomp.ssreflect
-    mathcomp.algebra
-    mathcomp.field
-    mathcomp.fingroup
-    mathcomp.solvable
-    mathcomp-bigenough
-  ];
-
-  meta = {
-    description = "Mathematical Components Library on real closed fields";
-    license = lib.licenses.cecill-c;
-  };
-}
+in
+# this is just a wrapper for rocqPackages.mathcomp-real-closed for Rocq >= 9.0
+if
+  coq.rocqPackages ? mathcomp-real-closed
+  && !(lib.elem version [
+    "2.0.2"
+    "2.0.3"
+  ])
+then
+  coq.rocqPackages.mathcomp-real-closed.override {
+    inherit version;
+    inherit
+      mathcomp
+      mathcomp-bigenough
+      ;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation

pkgs/development/ocaml-modules/camlpdf/default.nix

@@ -4,17 +4,18 @@
   fetchFromGitHub,
   ocaml,
   findlib,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.9";
+  version = "2.9.1";
   pname = "ocaml${ocaml.version}-camlpdf";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "camlpdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8xBna7GDFbFf48069/ct71uFxLJU0eBfKVRWDnyYocs=";
+    hash = "sha256-f3Bm64T27eiIzOY2nwdzMRH68VlyNp2jXpOPyBouSCs=";
   };
 
   nativeBuildInputs = [
@@ -28,11 +29,15 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "OCaml library for reading, writing and modifying PDF files";
     homepage = "https://github.com/johnwhitington/camlpdf";
+    changelog = "https://github.com/johnwhitington/camlpdf/blob/${finalAttrs.src.rev}/Changes.txt";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ vbgl ];
+    teams = with lib.teams; [ ngi ];
     broken = lib.versionOlder ocaml.version "4.10";
   };
 })

pkgs/development/ocaml-modules/cpdf/default.nix

@@ -5,17 +5,18 @@
   ocaml,
   findlib,
   camlpdf,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-cpdf";
-  version = "2.9";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "cpdf-source";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6fGKFM9Q2YxW8FoyewGNTkF9XBtjdq0Bur6KgVi5T4=";
+    hash = "sha256-P3CQwYp23URVBDcdnrRAg7gAsOMIifwraIcFSJh8pd0=";
   };
 
   nativeBuildInputs = [
@@ -35,11 +36,15 @@ stdenv.mkDerivation (finalAttrs: {
     cp cpdfmanual.pdf $out/share/doc/cpdf/
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "PDF Command Line Tools";
     homepage = "https://www.coherentpdf.com/";
+    changelog = "https://github.com/johnwhitington/cpdf-source/blob/${finalAttrs.src.rev}/Changes.txt";
     license = lib.licenses.agpl3Only;
-    maintainers = [ lib.maintainers.vbgl ];
+    maintainers = with lib.maintainers; [ vbgl ];
+    teams = with lib.teams; [ ngi ];
     mainProgram = "cpdf";
     inherit (ocaml.meta) platforms;
     broken = lib.versionOlder ocaml.version "4.10";

pkgs/development/ocaml-modules/ocaml-version/default.nix

@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ocaml-version";
-  version = "4.1.0";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://github.com/ocurrent/ocaml-version/releases/download/v${finalAttrs.version}/ocaml-version-${finalAttrs.version}.tbz";
-    hash = "sha256-QTfVH6kNu4SkjAylM3ySyIkOYAXQFrffSFkZ2FojjgY=";
+    hash = "sha256-+NqijIAmedHTU9/5ZfZojwr0vQZ0onS6lBWIrnBqPAc=";
   };
 
   checkInputs = [ alcotest ];

pkgs/development/python-modules/exllamav3/default.nix

@@ -29,14 +29,14 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "0.0.42";
+  version = "0.0.43";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kdI2BT7T2+mrdgWE7aXTeqC49WP6qEus+LfQGk0ozhA=";
+    hash = "sha256-68v8ptvtOzRTnnRXrgU0emqmbCO0pECidgJ36bwm8/s=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/scalib/default.nix

@@ -17,6 +17,8 @@
   pytest-cov-stub,
   scikit-learn,
   scipy,
+
+  nix-update-script,
 }:
 buildPythonPackage (finalAttrs: {
   pname = "scalib";
@@ -29,6 +31,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-DVXb93W0TmOcyGyMN5GmIJNAdbLeeFnNm+3QfTw2j5s=";
   };
 
+  env = {
+    SCALIB_PORTABLE = "1";
+  };
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail '"setuptools-scm-git-archive",' ""
@@ -70,6 +76,8 @@ buildPythonPackage (finalAttrs: {
     numpy
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Side-Channel Analysis Library";
     homepage = "https://github.com/simple-crypto/scalib";

pkgs/development/rocq-modules/mathcomp-analysis/default.nix

@@ -4,6 +4,7 @@
   mathcomp,
   mathcomp-finmap,
   mathcomp-bigenough,
+  mathcomp-real-closed,
   stdlib,
   single ? false,
   rocq-core,
@@ -58,6 +59,7 @@ let
       analysis-deps = [
         mathcomp.field
         mathcomp-bigenough
+        mathcomp-real-closed
       ];
       intra-deps = lib.optionals (package != "single") (map mathcomp_ packages.${package});
       pkgpath =

pkgs/development/rocq-modules/mathcomp-real-closed/default.nix

@@ -0,0 +1,50 @@
+{
+  rocq-core,
+  mkRocqDerivation,
+  mathcomp,
+  mathcomp-bigenough,
+  lib,
+  version ? null,
+}:
+
+mkRocqDerivation {
+
+  namePrefix = [
+    "rocq-core"
+    "mathcomp"
+  ];
+  pname = "real-closed";
+  owner = "math-comp";
+  inherit version;
+  release = {
+    "2.0.5".sha256 = "sha256-nns1TF3isv8FpWqtXilfMEVKvR50fvS6MXnYVzbCzVs=";
+  };
+
+  defaultVersion =
+    let
+      case = rocq: mc: out: {
+        cases = [
+          rocq
+          mc
+        ];
+        inherit out;
+      };
+    in
+    with lib.versions;
+    lib.switch
+      [ rocq-core.version mathcomp.version ]
+      [
+        (case (range "9.0" "9.2") (isGe "2.5.0") "2.0.5")
+      ]
+      null;
+
+  propagatedBuildInputs = [
+    mathcomp.field
+    mathcomp-bigenough
+  ];
+
+  meta = {
+    description = "Mathematical Components Library on real closed fields";
+    license = lib.licenses.cecill-c;
+  };
+}

pkgs/development/rocq-modules/parseque/default.nix

@@ -18,12 +18,13 @@ mkRocqDerivation {
       [
         {
           cases = [ (lib.versions.range "9.0" "9.2") ];
-          out = "0.3.0";
+          out = "0.3.1";
         }
       ]
       null;
 
   release."0.3.0".sha256 = "sha256-W2eenv5Q421eVn2ubbninFmmdT875f3w/Zs7yGHUKP4=";
+  release."0.3.1".sha256 = "sha256-t7nHpHl6E3iXkhMO0A53URmKVpWENjf/VODVXjD9Y1A=";
 
   propagatedBuildInputs = [ stdlib ];
 

pkgs/servers/http/apache-httpd/2.4.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.67";
+  version = "2.4.68";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    hash = "sha256-Zs0gZjew1cRG+n2r51/gNSXaj7VYVYdsRiiM2IsTaqQ=";
+    hash = "sha256-aMdNTfOMJr7U372487rx61MvOHI1e+zBu6XRNva2PAY=";
   };
 
   patches = [
@@ -164,6 +164,6 @@ stdenv.mkDerivation rec {
     homepage = "https://httpd.apache.org/";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ arcayr ];
   };
 }

pkgs/top-level/rocq-packages.nix

@@ -55,6 +55,7 @@ let
       mathcomp-classical = self.mathcomp-analysis.classical;
       mathcomp-experimental-reals = self.mathcomp-analysis.experimental-reals;
       mathcomp-finmap = callPackage ../development/rocq-modules/mathcomp-finmap { };
+      mathcomp-real-closed = callPackage ../development/rocq-modules/mathcomp-real-closed { };
       mathcomp-reals = self.mathcomp-analysis.reals;
       mathcomp-reals-stdlib = self.mathcomp-analysis.reals-stdlib;
       micromega-plugin = callPackage ../development/rocq-modules/micromega-plugin { };