Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

15 files changed, 318 insertions, 167 deletions

diff --git a/nixpkgs/.github/CODEOWNERS b/nixpkgs/.github/CODEOWNERS
index 278e11ce6863..15e253be5b80 100644
--- a/nixpkgs/.github/CODEOWNERS
+++ b/nixpkgs/.github/CODEOWNERS
@@ -131,13 +131,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 /pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
 
 # Haskell
-/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn @ncfavier
-/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn @ncfavier
-/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn @ncfavier
-/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn @ncfavier
-/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn @ncfavier
+/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
 
 # Perl
 /pkgs/development/interpreters/perl @stigtsp @zakame @dasJ
@@ -359,3 +359,8 @@ nixos/tests/zfs.nix                       @raitobezarius
 nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
 nixos/tests/buildbot.nix                               @Mic92 @zowoq
 pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+
+# Pretix
+pkgs/by-name/pr/pretix/ @mweinelt
+nixos/modules/services/web-apps/pretix.nix @mweinelt
+nixos/tests/web-apps/pretix.nix @mweinelt
diff --git a/nixpkgs/.github/PULL_REQUEST_TEMPLATE.md b/nixpkgs/.github/PULL_REQUEST_TEMPLATE.md
index 40ea13f131e8..1dfd8cd15abd 100644
--- a/nixpkgs/.github/PULL_REQUEST_TEMPLATE.md
+++ b/nixpkgs/.github/PULL_REQUEST_TEMPLATE.md
@@ -38,7 +38,7 @@ Reviewing helps to reduce the average time-to-merge for everyone.
 Thanks a lot if you do!
 
 List of open PRs: https://github.com/NixOS/nixpkgs/pulls
-Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-contributions
+Reviewing guidelines: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#reviewing-contributions
 -->
 
 ---
diff --git a/nixpkgs/.github/labeler.yml b/nixpkgs/.github/labeler.yml
index c3e834b0e7da..a6e8d734382e 100644
--- a/nixpkgs/.github/labeler.yml
+++ b/nixpkgs/.github/labeler.yml
@@ -1,216 +1,362 @@
 "6.topic: agda":
-  - doc/languages-frameworks/agda.section.md
-  - nixos/tests/agda.nix
-  - pkgs/build-support/agda/**/*
-  - pkgs/development/libraries/agda/**/*
-  - pkgs/top-level/agda-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/agda.section.md
+        - nixos/tests/agda.nix
+        - pkgs/build-support/agda/**/*
+        - pkgs/development/libraries/agda/**/*
+        - pkgs/top-level/agda-packages.nix
 
 "6.topic: cinnamon":
-  - pkgs/desktops/cinnamon/**/*
-  - nixos/modules/services/x11/desktop-managers/cinnamon.nix
-  - nixos/tests/cinnamon.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/desktops/cinnamon/**/*
+        - nixos/modules/services/x11/desktop-managers/cinnamon.nix
+        - nixos/tests/cinnamon.nix
 
 "6.topic: emacs":
-  - nixos/modules/services/editors/emacs.nix
-  - nixos/modules/services/editors/emacs.xml
-  - nixos/tests/emacs-daemon.nix
-  - pkgs/applications/editors/emacs/elisp-packages/**/*
-  - pkgs/applications/editors/emacs/**/*
-  - pkgs/build-support/emacs/**/*
-  - pkgs/top-level/emacs-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/editors/emacs.nix
+        - nixos/modules/services/editors/emacs.xml
+        - nixos/tests/emacs-daemon.nix
+        - pkgs/applications/editors/emacs/elisp-packages/**/*
+        - pkgs/applications/editors/emacs/**/*
+        - pkgs/build-support/emacs/**/*
+        - pkgs/top-level/emacs-packages.nix
 
 "6.topic: Enlightenment DE":
-  - nixos/modules/services/x11/desktop-managers/enlightenment.nix
-  - pkgs/desktops/enlightenment/**/*
-  - pkgs/development/python-modules/python-efl/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/enlightenment.nix
+        - pkgs/desktops/enlightenment/**/*
+        - pkgs/development/python-modules/python-efl/*
 
 "6.topic: erlang":
-  - doc/languages-frameworks/beam.section.md
-  - pkgs/development/beam-modules/**/*
-  - pkgs/development/interpreters/elixir/**/*
-  - pkgs/development/interpreters/erlang/**/*
-  - pkgs/development/tools/build-managers/rebar/**/*
-  - pkgs/development/tools/build-managers/rebar3/**/*
-  - pkgs/development/tools/erlang/**/*
-  - pkgs/top-level/beam-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/beam.section.md
+        - pkgs/development/beam-modules/**/*
+        - pkgs/development/interpreters/elixir/**/*
+        - pkgs/development/interpreters/erlang/**/*
+        - pkgs/development/tools/build-managers/rebar/**/*
+        - pkgs/development/tools/build-managers/rebar3/**/*
+        - pkgs/development/tools/erlang/**/*
+        - pkgs/top-level/beam-packages.nix
 
 "6.topic: fetch":
-  - pkgs/build-support/fetch*/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/build-support/fetch*/**/*
 
 "6.topic: flakes":
-  - '**/flake.nix'
-  - lib/systems/flake-systems.nix
-  - nixos/modules/config/nix-flakes.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - '**/flake.nix'
+        - lib/systems/flake-systems.nix
+        - nixos/modules/config/nix-flakes.nix
 
 "6.topic: GNOME":
-  - doc/languages-frameworks/gnome.section.md
-  - nixos/modules/services/desktops/gnome/**/*
-  - nixos/modules/services/x11/desktop-managers/gnome.nix
-  - nixos/tests/gnome-xorg.nix
-  - nixos/tests/gnome.nix
-  - pkgs/desktops/gnome/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/gnome.section.md
+        - nixos/modules/services/desktops/gnome/**/*
+        - nixos/modules/services/x11/desktop-managers/gnome.nix
+        - nixos/tests/gnome-xorg.nix
+        - nixos/tests/gnome.nix
+        - pkgs/desktops/gnome/**/*
 
 "6.topic: golang":
-  - doc/languages-frameworks/go.section.md
-  - pkgs/build-support/go/**/*
-  - pkgs/development/compilers/go/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/go.section.md
+        - pkgs/build-support/go/**/*
+        - pkgs/development/compilers/go/**/*
 
 "6.topic: haskell":
-  - doc/languages-frameworks/haskell.section.md
-  - maintainers/scripts/haskell/**/*
-  - pkgs/development/compilers/ghc/**/*
-  - pkgs/development/haskell-modules/**/*
-  - pkgs/development/tools/haskell/**/*
-  - pkgs/test/haskell/**/*
-  - pkgs/top-level/haskell-packages.nix
-  - pkgs/top-level/release-haskell.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/haskell.section.md
+        - maintainers/scripts/haskell/**/*
+        - pkgs/development/compilers/ghc/**/*
+        - pkgs/development/haskell-modules/**/*
+        - pkgs/development/tools/haskell/**/*
+        - pkgs/test/haskell/**/*
+        - pkgs/top-level/haskell-packages.nix
+        - pkgs/top-level/release-haskell.nix
 
 "6.topic: jupyter":
-  - pkgs/development/python-modules/jupyter*/**/*
-  - pkgs/development/python-modules/mkdocs-jupyter/*
-  - nixos/modules/services/development/jupyter/**/*
-  - pkgs/applications/editors/jupyter-kernels/**/*
-  - pkgs/applications/editors/jupyter/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/development/python-modules/jupyter*/**/*
+        - pkgs/development/python-modules/mkdocs-jupyter/*
+        - nixos/modules/services/development/jupyter/**/*
+        - pkgs/applications/editors/jupyter-kernels/**/*
+        - pkgs/applications/editors/jupyter/**/*
 
 "6.topic: kernel":
-  - pkgs/build-support/kernel/**/*
-  - pkgs/os-specific/linux/kernel/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/build-support/kernel/**/*
+        - pkgs/os-specific/linux/kernel/**/*
 
 "6.topic: lib":
-  - lib/**
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - lib/**
 
 "6.topic: lua":
-  - pkgs/development/interpreters/lua-5/**/*
-  - pkgs/development/interpreters/luajit/**/*
-  - pkgs/development/lua-modules/**/*
-  - pkgs/top-level/lua-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/development/interpreters/lua-5/**/*
+        - pkgs/development/interpreters/luajit/**/*
+        - pkgs/development/lua-modules/**/*
+        - pkgs/top-level/lua-packages.nix
 
 "6.topic: Lumina DE":
-  - nixos/modules/services/x11/desktop-managers/lumina.nix
-  - pkgs/desktops/lumina/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/lumina.nix
+        - pkgs/desktops/lumina/**/*
 
 "6.topic: LXQt":
-  - nixos/modules/services/x11/desktop-managers/lxqt.nix
-  - pkgs/desktops/lxqt/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/lxqt.nix
+        - pkgs/desktops/lxqt/**/*
 
 "6.topic: mate":
-  - nixos/modules/services/x11/desktop-managers/mate.nix
-  - nixos/tests/mate.nix
-  - pkgs/desktops/mate/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/x11/desktop-managers/mate.nix
+        - nixos/tests/mate.nix
+        - pkgs/desktops/mate/**/*
 
 "6.topic: module system":
-  - lib/modules.nix
-  - lib/types.nix
-  - lib/options.nix
-  - lib/tests/modules.sh
-  - lib/tests/modules/**
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - lib/modules.nix
+        - lib/types.nix
+        - lib/options.nix
+        - lib/tests/modules.sh
+        - lib/tests/modules/**
 
 "6.topic: nixos":
-  - nixos/**/*
-  - pkgs/os-specific/linux/nixos-rebuild/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/**/*
+        - pkgs/os-specific/linux/nixos-rebuild/**/*
 
 "6.topic: nim":
-  - doc/languages-frameworks/nim.section.md
-  - pkgs/development/compilers/nim/*
-  - pkgs/development/nim-packages/**/*
-  - pkgs/top-level/nim-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/nim.section.md
+        - pkgs/development/compilers/nim/*
+        - pkgs/development/nim-packages/**/*
+        - pkgs/top-level/nim-packages.nix
 
 "6.topic: nodejs":
-  - doc/languages-frameworks/javascript.section.md
-  - pkgs/build-support/node/**/*
-  - pkgs/development/node-packages/**/*
-  - pkgs/development/tools/yarn/*
-  - pkgs/development/tools/yarn2nix-moretea/**/*
-  - pkgs/development/web/nodejs/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/javascript.section.md
+        - pkgs/build-support/node/**/*
+        - pkgs/development/node-packages/**/*
+        - pkgs/development/tools/yarn/*
+        - pkgs/development/tools/yarn2nix-moretea/**/*
+        - pkgs/development/web/nodejs/*
 
 "6.topic: ocaml":
-  - doc/languages-frameworks/ocaml.section.md
-  - pkgs/development/compilers/ocaml/**/*
-  - pkgs/development/compilers/reason/**/*
-  - pkgs/development/ocaml-modules/**/*
-  - pkgs/development/tools/ocaml/**/*
-  - pkgs/top-level/ocaml-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/ocaml.section.md
+        - pkgs/development/compilers/ocaml/**/*
+        - pkgs/development/compilers/reason/**/*
+        - pkgs/development/ocaml-modules/**/*
+        - pkgs/development/tools/ocaml/**/*
+        - pkgs/top-level/ocaml-packages.nix
 
 "6.topic: pantheon":
-  - nixos/modules/services/desktops/pantheon/**/*
-  - nixos/modules/services/x11/desktop-managers/pantheon.nix
-  - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
-  - nixos/tests/pantheon.nix
-  - pkgs/desktops/pantheon/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/desktops/pantheon/**/*
+        - nixos/modules/services/x11/desktop-managers/pantheon.nix
+        - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+        - nixos/tests/pantheon.nix
+        - pkgs/desktops/pantheon/**/*
+
+"6.topic: php":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/php.section.md
+        - pkgs/build-support/php/**/*
+        - pkgs/development/interpreters/php/*
+        - pkgs/development/php-packages/**/*
+        - pkgs/test/php/default.nix
+        - pkgs/top-level/php-packages.nix
 
 "6.topic: policy discussion":
-  - .github/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - .github/**/*
 
 "6.topic: printing":
-  - nixos/modules/services/printing/cupsd.nix
-  - pkgs/misc/cups/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/services/printing/cupsd.nix
+        - pkgs/misc/cups/**/*
 
 "6.topic: python":
-  - doc/languages-frameworks/python.section.md
-  - pkgs/development/interpreters/python/**/*
-  - pkgs/development/python-modules/**/*
-  - pkgs/top-level/python-packages.nix
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/python.section.md
+        - pkgs/development/interpreters/python/**/*
+        - pkgs/development/python-modules/**/*
+        - pkgs/top-level/python-packages.nix
 
 "6.topic: qt/kde":
-  - doc/languages-frameworks/qt.section.md
-  - nixos/modules/services/x11/desktop-managers/plasma5.nix
-  - nixos/tests/plasma5.nix
-  - pkgs/applications/kde/**/*
-  - pkgs/desktops/plasma-5/**/*
-  - pkgs/development/libraries/kde-frameworks/**/*
-  - pkgs/development/libraries/qt-5/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/qt.section.md
+        - nixos/modules/services/x11/desktop-managers/plasma5.nix
+        - nixos/tests/plasma5.nix
+        - pkgs/applications/kde/**/*
+        - pkgs/desktops/plasma-5/**/*
+        - pkgs/development/libraries/kde-frameworks/**/*
+        - pkgs/development/libraries/qt-5/**/*
 
 "6.topic: ruby":
-  - doc/languages-frameworks/ruby.section.md
-  - pkgs/development/interpreters/ruby/**/*
-  - pkgs/development/ruby-modules/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/ruby.section.md
+        - pkgs/development/interpreters/ruby/**/*
+        - pkgs/development/ruby-modules/**/*
 
 "6.topic: rust":
-  - doc/languages-frameworks/rust.section.md
-  - pkgs/build-support/rust/**/*
-  - pkgs/development/compilers/rust/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/rust.section.md
+        - pkgs/build-support/rust/**/*
+        - pkgs/development/compilers/rust/**/*
 
 "6.topic: stdenv":
-  - pkgs/stdenv/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/stdenv/**/*
 
 "6.topic: steam":
-  - pkgs/games/steam/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/games/steam/**/*
 
 "6.topic: systemd":
-  - pkgs/os-specific/linux/systemd/**/*
-  - nixos/modules/system/boot/systemd*/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/os-specific/linux/systemd/**/*
+        - nixos/modules/system/boot/systemd*/**/*
 
 "6.topic: TeX":
-  - doc/languages-frameworks/texlive.section.md
-  - pkgs/test/texlive/**
-  - pkgs/tools/typesetting/tex/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/texlive.section.md
+        - pkgs/test/texlive/**
+        - pkgs/tools/typesetting/tex/**/*
+
+"6.topic: testing":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        # NOTE: Let's keep the scope limited to test frameworks that are
+        #       *developed in this repo*;
+        #       - not individual tests
+        #       - not packages for test frameworks
+        - nixos/lib/testing/**
+        - nixos/lib/test-driver/**
+        - nixos/tests/nixos-test-driver/**
+        - nixos/lib/testing-python.nix      # legacy
+        - nixos/tests/make-test-python.nix  # legacy
+        # lib/debug.nix has a test framework (runTests) but it's not the main focus
 
 "6.topic: vim":
-  - doc/languages-frameworks/vim.section.md
-  - pkgs/applications/editors/vim/**/*
-  - pkgs/applications/editors/vim/plugins/**/*
-  - nixos/modules/programs/neovim.nix
-  - pkgs/applications/editors/neovim/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/vim.section.md
+        - pkgs/applications/editors/vim/**/*
+        - pkgs/applications/editors/vim/plugins/**/*
+        - nixos/modules/programs/neovim.nix
+        - pkgs/applications/editors/neovim/**/*
 
 "6.topic: vscode":
-  - pkgs/applications/editors/vscode/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/applications/editors/vscode/**/*
 
 "6.topic: xfce":
-  - nixos/doc/manual/configuration/xfce.xml
-  - nixos/modules/services/x11/desktop-managers/xfce.nix
-  - nixos/tests/xfce.nix
-  - pkgs/desktops/xfce/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/doc/manual/configuration/xfce.xml
+        - nixos/modules/services/x11/desktop-managers/xfce.nix
+        - nixos/tests/xfce.nix
+        - pkgs/desktops/xfce/**/*
 
 "6.topic: zig":
-  - pkgs/development/compilers/zig/**/*
-  - doc/hooks/zig.section.md
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/development/compilers/zig/**/*
+        - doc/hooks/zig.section.md
 
 "8.has: changelog":
-  - nixos/doc/manual/release-notes/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/doc/manual/release-notes/**/*
 
 "8.has: documentation":
-  - doc/**/*
-  - nixos/doc/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/**/*
+        - nixos/doc/**/*
 
 "8.has: module (update)":
-  - nixos/modules/**/*
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/**/*
diff --git a/nixpkgs/.github/workflows/backport.yml b/nixpkgs/.github/workflows/backport.yml
index c49eeac5a20b..3a93eb4fd624 100644
--- a/nixpkgs/.github/workflows/backport.yml
+++ b/nixpkgs/.github/workflows/backport.yml
@@ -20,11 +20,11 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@08bafb375e6e9a9a2b53a744b987e5d81a133191 # v2.1.1
+        uses: korthout/backport-action@e8161d6a0dbfa2651b7daa76cbb75bc7c925bbf3 # v2.4.1
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
diff --git a/nixpkgs/.github/workflows/basic-eval.yml b/nixpkgs/.github/workflows/basic-eval.yml
index a0cd990ebc73..9008ca208e17 100644
--- a/nixpkgs/.github/workflows/basic-eval.yml
+++ b/nixpkgs/.github/workflows/basic-eval.yml
@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/nixpkgs/.github/workflows/check-by-name.yml b/nixpkgs/.github/workflows/check-by-name.yml
index 94875e67b649..bf6acf3701da 100644
--- a/nixpkgs/.github/workflows/check-by-name.yml
+++ b/nixpkgs/.github/workflows/check-by-name.yml
@@ -87,7 +87,7 @@ jobs:
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}
@@ -98,7 +98,7 @@ jobs:
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       - name: Fetching the pinned tool
         # Update the pinned version using pkgs/test/nixpkgs-check-by-name/scripts/update-pinned-tool.sh
         run: |
diff --git a/nixpkgs/.github/workflows/check-maintainers-sorted.yaml b/nixpkgs/.github/workflows/check-maintainers-sorted.yaml
index 074644153204..eb7d22ea66bb 100644
--- a/nixpkgs/.github/workflows/check-maintainers-sorted.yaml
+++ b/nixpkgs/.github/workflows/check-maintainers-sorted.yaml
@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/nixpkgs/.github/workflows/editorconfig.yml b/nixpkgs/.github/workflows/editorconfig.yml
index 6b151d45be2a..168e5bccaea4 100644
--- a/nixpkgs/.github/workflows/editorconfig.yml
+++ b/nixpkgs/.github/workflows/editorconfig.yml
@@ -24,11 +24,11 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0
diff --git a/nixpkgs/.github/workflows/labels.yml b/nixpkgs/.github/workflows/labels.yml
index 4dc690e88bbc..2912e64c115b 100644
--- a/nixpkgs/.github/workflows/labels.yml
+++ b/nixpkgs/.github/workflows/labels.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: true
diff --git a/nixpkgs/.github/workflows/manual-nixos.yml b/nixpkgs/.github/workflows/manual-nixos.yml
index c9c2451a9df2..545f0c95c47b 100644
--- a/nixpkgs/.github/workflows/manual-nixos.yml
+++ b/nixpkgs/.github/workflows/manual-nixos.yml
@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/nixpkgs/.github/workflows/manual-nixpkgs.yml b/nixpkgs/.github/workflows/manual-nixpkgs.yml
index d9a425a494ab..9d675c385feb 100644
--- a/nixpkgs/.github/workflows/manual-nixpkgs.yml
+++ b/nixpkgs/.github/workflows/manual-nixpkgs.yml
@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/nixpkgs/.github/workflows/nix-parse.yml b/nixpkgs/.github/workflows/nix-parse.yml
index e625cca93c5c..da2e942414e2 100644
--- a/nixpkgs/.github/workflows/nix-parse.yml
+++ b/nixpkgs/.github/workflows/nix-parse.yml
@@ -24,12 +24,12 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
       if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         nix_path: nixpkgs=channel:nixpkgs-unstable
     - name: Parse all changed or added nix files
diff --git a/nixpkgs/.github/workflows/periodic-merge-24h.yml b/nixpkgs/.github/workflows/periodic-merge-24h.yml
index bd7aadfbade1..6adada59c5a5 100644
--- a/nixpkgs/.github/workflows/periodic-merge-24h.yml
+++ b/nixpkgs/.github/workflows/periodic-merge-24h.yml
@@ -41,7 +41,7 @@ jobs:
             into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/nixpkgs/.github/workflows/periodic-merge-6h.yml b/nixpkgs/.github/workflows/periodic-merge-6h.yml
index 61a489ad7156..6f188ee28d17 100644
--- a/nixpkgs/.github/workflows/periodic-merge-6h.yml
+++ b/nixpkgs/.github/workflows/periodic-merge-6h.yml
@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/nixpkgs/.github/workflows/update-terraform-providers.yml b/nixpkgs/.github/workflows/update-terraform-providers.yml
index 77486c722287..9b7ec5cc59b0 100644
--- a/nixpkgs/.github/workflows/update-terraform-providers.yml
+++ b/nixpkgs/.github/workflows/update-terraform-providers.yml
@@ -16,8 +16,8 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # v6.0.1
+        uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # v6.0.2
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.