Merge e7713b176c into haskell-updates

2026-07-06 17:13:24 -05:00 · 2026-06-02 00:57:41 +00:00 · 2026-06-02 00:57:41 +00:00 · 41dec8b399
commit 41dec8b399
parent d217b14de6 e7713b176c
601 changed files with 5518 additions and 2408 deletions
--- a/README.md
+++ b/README.md
@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).

 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
+* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
+* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)

 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@ -19,6 +19,12 @@

 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.

+- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
+  `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
+  Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
+
+- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).

 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -40,10 +40,9 @@ rec {
    rust.rustcTarget = "powerpc-unknown-linux-gnu";
  };

-  sheevaplug = {
+  armv5tel-multiplatform = {
    config = "armv5tel-unknown-linux-gnueabi";
-  }
-  // platforms.sheevaplug;
+  };

  raspberryPi = {
    config = "armv6l-unknown-linux-gnueabihf";
@ -99,11 +98,6 @@ rec {
    useLLVM = true;
  };

-  pogoplug4 = {
-    config = "armv5tel-unknown-linux-gnueabi";
-  }
-  // platforms.pogoplug4;
-
  ben-nanonote = {
    config = "mipsel-unknown-linux-uclibc";
  }
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@ -46,138 +46,15 @@ rec {
  ## ARM
  ##

-  pogoplug4 = {
+  armv5tel-multiplatform = {
    linux-kernel = {
-      name = "pogoplug4";
+      name = "armv5tel-multiplatform";

      baseConfig = "multi_v5_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-      '';
-      makeFlags = [ "LOADADDR=0x8000" ];
-      target = "uImage";
-      # TODO reenable once manual-config's config actually builds a .dtb and this is checked to be working
-      #DTB = true;
-    };
-    gcc = {
-      arch = "armv5te";
-    };
-  };
-
-  sheevaplug = {
-    linux-kernel = {
-      name = "sheevaplug";
-
-      baseConfig = "multi_v5_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        BLK_DEV_RAM y
-        BLK_DEV_INITRD y
-        BLK_DEV_CRYPTOLOOP m
-        BLK_DEV_DM m
-        DM_CRYPT m
-        MD y
-        BTRFS_FS m
-        XFS_FS m
-        JFS_FS m
-        EXT4_FS m
-        USB_STORAGE_CYPRESS_ATACB m
-
-        # mv cesa requires this sw fallback, for mv-sha1
-        CRYPTO_SHA1 y
-        # Fast crypto
-        CRYPTO_TWOFISH y
-        CRYPTO_TWOFISH_COMMON y
-        CRYPTO_BLOWFISH y
-        CRYPTO_BLOWFISH_COMMON y
-
-        IP_PNP y
-        IP_PNP_DHCP y
-        NFS_FS y
-        ROOT_NFS y
-        TUN m
-        NFS_V4 y
-        NFS_V4_1 y
-        NFS_FSCACHE y
-        NFSD m
-        NFSD_V2_ACL y
-        NFSD_V3 y
-        NFSD_V3_ACL y
-        NFSD_V4 y
-        NETFILTER y
-        IP_NF_IPTABLES y
-        IP_NF_FILTER y
-        IP_NF_MATCH_ADDRTYPE y
-        IP_NF_TARGET_LOG y
-        IP_NF_MANGLE y
-        IPV6 m
-        VLAN_8021Q m
-
-        CIFS y
-        CIFS_XATTR y
-        CIFS_POSIX y
-        CIFS_FSCACHE y
-        CIFS_ACL y
-
-        WATCHDOG y
-        WATCHDOG_CORE y
-        ORION_WATCHDOG m
-
-        ZRAM m
-        NETCONSOLE m
-
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-
-        # Fail to build
-        DRM n
-        SCSI_ADVANSYS n
-        USB_ISP1362_HCD n
-        SND_SOC n
-        SND_ALI5451 n
-        FB_SAVAGE n
-        SCSI_NSP32 n
-        ATA_SFF n
-        SUNGEM n
-        IRDA n
-        ATM_HE n
-        SCSI_ACARD n
-        BLK_DEV_CMD640_ENHANCED n
-
-        FUSE_FS m
-
-        # systemd uses cgroups
-        CGROUPS y
-
-        # Latencytop
-        LATENCYTOP y
-
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-
-        # Kdb, for kernel troubles
-        KGDB y
-        KGDB_SERIAL_CONSOLE y
-        KGDB_KDB y
-      '';
-      makeFlags = [ "LOADADDR=0x0200000" ];
-      target = "uImage";
-      DTB = true; # Beyond 3.10
+      DTB = true;
+      autoModules = true;
+      preferBuiltin = true;
+      target = "zImage";
    };
    gcc = {
      arch = "armv5te";
@ -192,11 +69,6 @@ rec {
      DTB = true;
      autoModules = true;
      preferBuiltin = true;
-      extraConfig = ''
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-      '';
      target = "zImage";
    };
    gcc = {
@ -217,15 +89,6 @@ rec {
  };

  zero-gravitas = {
-    linux-kernel = {
-      name = "zero-gravitas";
-
-      baseConfig = "zero-gravitas_defconfig";
-      # Target verified by checking /boot on reMarkable 1 device
-      target = "zImage";
-      autoModules = false;
-      DTB = true;
-    };
    gcc = {
      fpu = "neon";
      cpu = "cortex-a9";
@ -233,15 +96,6 @@ rec {
  };

  zero-sugar = {
-    linux-kernel = {
-      name = "zero-sugar";
-
-      baseConfig = "zero-sugar_defconfig";
-      DTB = true;
-      autoModules = false;
-      preferBuiltin = true;
-      target = "zImage";
-    };
    gcc = {
      cpu = "cortex-a7";
      fpu = "neon-vfpv4";
@ -249,49 +103,6 @@ rec {
    };
  };

-  utilite = {
-    linux-kernel = {
-      name = "utilite";
-      maseConfig = "multi_v7_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-      '';
-      makeFlags = [ "LOADADDR=0x10800000" ];
-      target = "uImage";
-      DTB = true;
-    };
-    gcc = {
-      cpu = "cortex-a9";
-      fpu = "neon";
-    };
-  };
-
-  guruplug = lib.recursiveUpdate sheevaplug {
-    # Define `CONFIG_MACH_GURUPLUG' (see
-    # <http://kerneltrap.org/mailarchive/git-commits-head/2010/5/19/33618>)
-    # and other GuruPlug-specific things.  Requires the `guruplug-defconfig'
-    # patch.
-    linux-kernel.baseConfig = "guruplug_defconfig";
-  };
-
-  beaglebone = lib.recursiveUpdate armv7l-hf-multiplatform {
-    linux-kernel = {
-      name = "beaglebone";
-      baseConfig = "bb.org_defconfig";
-      autoModules = false;
-      extraConfig = ""; # TBD kernel config
-      target = "zImage";
-    };
-  };
-
  # https://developer.android.com/ndk/guides/abis#v7a
  armv7a-android = {
    linux-kernel.name = "armeabi-v7a";
@ -305,32 +116,11 @@ rec {
  armv7l-hf-multiplatform = {
    linux-kernel = {
      name = "armv7l-hf-multiplatform";
-      Major = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
-      baseConfig = "multi_v7_defconfig";
+      baseConfig = "defconfig";
      DTB = true;
      autoModules = true;
      preferBuiltin = true;
      target = "zImage";
-      extraConfig = ''
-        # Serial port for Raspberry Pi 3. Wasn't included in ARMv7 defconfig
-        # until 4.17.
-        SERIAL_8250_BCM2835AUX y
-        SERIAL_8250_EXTENDED y
-        SERIAL_8250_SHARE_IRQ y
-
-        # Hangs ODROID-XU4
-        ARM_BIG_LITTLE_CPUIDLE n
-
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-
-        # >=5.12 fails with:
-        # drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
-        # ks8851_common.c:(.text+0x179c): undefined reference to `__this_module'
-        # See: https://lore.kernel.org/netdev/20210116164828.40545-1-marex@denx.de/T/
-        KS8851_MLL y
-      '';
    };
    gcc = {
      # Some table about fpu flags:
@ -363,22 +153,6 @@ rec {
      autoModules = true;
      preferBuiltin = true;
      extraConfig = ''
-        # Raspberry Pi 3 stuff. Not needed for   s >= 4.10.
-        ARCH_BCM2835 y
-        BCM2835_MBOX y
-        BCM2835_WDT y
-        RASPBERRYPI_FIRMWARE y
-        RASPBERRYPI_POWER y
-        SERIAL_8250_BCM2835AUX y
-        SERIAL_8250_EXTENDED y
-        SERIAL_8250_SHARE_IRQ y
-
-        # Cavium ThunderX stuff.
-        PCI_HOST_THUNDER_ECAM y
-
-        # Nvidia Tegra stuff.
-        PCI_TEGRA y
-
        # The default (=y) forces us to have the XHCI firmware available in initrd,
        # which our initrd builder can't currently do easily.
        USB_XHCI_TEGRA m
@ -412,74 +186,6 @@ rec {
  };

  fuloong2f_n32 = {
-    linux-kernel = {
-      name = "fuloong2f_n32";
-      baseConfig = "lemote2f_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        MIGRATION n
-        COMPACTION n
-
-        # nixos mounts some cgroup
-        CGROUPS y
-
-        BLK_DEV_RAM y
-        BLK_DEV_INITRD y
-        BLK_DEV_CRYPTOLOOP m
-        BLK_DEV_DM m
-        DM_CRYPT m
-        MD y
-        EXT4_FS m
-        USB_STORAGE_CYPRESS_ATACB m
-
-        IP_PNP y
-        IP_PNP_DHCP y
-        IP_PNP_BOOTP y
-        NFS_FS y
-        ROOT_NFS y
-        TUN m
-        NFS_V4 y
-        NFS_V4_1 y
-        NFS_FSCACHE y
-        NFSD m
-        NFSD_V2_ACL y
-        NFSD_V3 y
-        NFSD_V3_ACL y
-        NFSD_V4 y
-
-        # Fail to build
-        DRM n
-        SCSI_ADVANSYS n
-        USB_ISP1362_HCD n
-        SND_SOC n
-        SND_ALI5451 n
-        FB_SAVAGE n
-        SCSI_NSP32 n
-        ATA_SFF n
-        SUNGEM n
-        IRDA n
-        ATM_HE n
-        SCSI_ACARD n
-        BLK_DEV_CMD640_ENHANCED n
-
-        FUSE_FS m
-
-        # Needed for udev >= 150
-        SYSFS_DEPRECATED_V2 n
-
-        VGA_CONSOLE n
-        VT_HW_CONSOLE_BINDING y
-        SERIAL_8250_CONSOLE y
-        FRAMEBUFFER_CONSOLE y
-        EXT2_FS y
-        EXT3_FS y
-        MAGIC_SYSRQ y
-
-        # The kernel doesn't boot at all, with FTRACE
-        FTRACE n
-      '';
-      target = "vmlinux";
-    };
    gcc = {
      arch = "loongson2f";
      float = "hard";
@ -525,35 +231,6 @@ rec {
    };
  };

-  # based on:
-  #   https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05179.html
-  #   https://gmplib.org/~tege/qemu.html#mips64-debian
-  mips64el-qemu-linux-gnuabi64 = {
-    linux-kernel = {
-      name = "mips64el";
-      baseConfig = "64r2el_defconfig";
-      target = "vmlinuz";
-      autoModules = false;
-      DTB = true;
-      # for qemu 9p passthrough filesystem
-      extraConfig = ''
-        MIPS_MALTA y
-        PAGE_SIZE_4KB y
-        CPU_LITTLE_ENDIAN y
-        CPU_MIPS64_R2 y
-        64BIT y
-        CPU_MIPS64_R2 y
-
-        NET_9P y
-        NET_9P_VIRTIO y
-        9P_FS y
-        9P_FS_POSIX_ACL y
-        PCI y
-        VIRTIO_PCI y
-      '';
-    };
-  };
-
  ##
  ## Other
  ##
@ -607,7 +284,7 @@ rec {
      if version == null then
        pc
      else if lib.versionOlder version "6" then
-        sheevaplug
+        armv5tel-multiplatform
      else if lib.versionOlder version "7" then
        raspberrypi
      else
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@ -935,6 +935,7 @@
      "infinisil": 20525370
    },
    "members": {
+      "andir": 638836,
      "pyrox0": 35778371
    },
    "name": "Security review"
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@ -13,6 +13,7 @@
  - If you use LUKS disk encryption, ensure that `fileSystems."/".device` is set to `"/dev/mapper/<name>"`, where `<name>` matches the name in your `boot.initrd.luks.devices.<name>` definition, to avoid systemd timing out while prompting for a passphrase. If you have a more complex setup, e.g. with LVM on top of LUKS, you may need to add `"x-systemd.device-timeout=infinity"` to `fileSystems."/".options` instead. If you need to disable the timeout before you can boot into the system, pass `systemd.default_device_timeout_sec=infinity` on the kernel command line.
  - The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
  - Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
+  - `/dev/root` is not available with the systemd stage 1. In the old scripted stage 1, `/dev/root` was a symlink created by the init script from the `root=` kernel command line. With systemd stage 1, this symlink is not provided. If your configuration uses `/dev/root` in `fileSystems`, replace it with a stable device path such as `/dev/disk/by-label/...`, `/dev/disk/by-uuid/...`, or the appropriate `/dev/mapper/...` path.

 - The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using `nix-channel`.
  This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@ -18,10 +18,12 @@

 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.

+- Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
+
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.

 ## Other Notable Changes {#sec-release-26.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- Create the first release note entry in this section!
+- The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
--- a/nixos/lib/test-driver/src/test_driver/machine/init.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/init.py
@ -1031,6 +1031,7 @@ class QemuMachine(BaseMachine):
            As soon as we read some data from the socket here, we assume that
            our root shell is operational.
            """
+            assert self.shell
            (ready, _, _) = select.select([self.shell], [], [], timeout_secs)
            return bool(ready)

--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@ -5,7 +5,12 @@
  ...
 }:
 let
-  inherit (lib) mkOption types literalMD;
+  inherit (lib)
+    mkOption
+    types
+    literalExpression
+    literalMD
+    ;

  inherit (config) sshBackdoor;

@ -117,9 +122,10 @@ in
 {
  options = {
    pythonTestDriverPackage = mkOption {
-      description = "Package containing the python NixOS test driver implemetnation";
+      description = "Package containing the python NixOS test driver implementation";
      type = types.package;
      default = hostPkgs.nixos-test-driver;
+      defaultText = literalExpression "hostPkgs.nixos-test-driver";
      readOnly = true;
    };

--- a/nixos/modules/config/fonts/packages.nix
+++ b/nixos/modules/config/fonts/packages.nix
@ -47,6 +47,8 @@ in
        gyre-fonts # TrueType substitutes for standard PostScript fonts
        liberation_ttf
        unifont
+        noto-fonts-cjk-sans
+        noto-fonts-cjk-serif
        noto-fonts-color-emoji
      ]
    );
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -787,9 +787,10 @@ in
      options = [ "mode=0755" ];
    };

-    # Note that /dev/root is a symlink to the actual root device
-    # specified on the kernel command line, created in the stage 1
-    # init script.
+    # With systemd stage 1, the ISO is identified by its volume label.
+    # With the scripted stage 1, /dev/root is a symlink to the actual
+    # root device specified on the kernel command line, created by the
+    # stage 1 init script.
    "/iso" = lib.mkImageMediaOverride {
      device =
        if config.boot.initrd.systemd.enable then
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -314,6 +314,27 @@ in
        name = "nixos-rebuild";
        package = config.system.build.nixos-rebuild;
      })
+      (
+        { config, ... }:
+        {
+          options.system.tools.nixos-rebuild.enableRun0Elevation = lib.mkEnableOption ''
+            support for being targeted by `nixos-rebuild --elevate=run0
+            --ask-elevate-password`.
+
+            This enables polkit and adds {command}`polkit-stdin-agent` to
+            {option}`environment.systemPackages` so that a deploying host
+            can find a target-architecture agent at
+            {file}`<toplevel>/sw/bin/polkit-stdin-agent` after copying the
+            closure (which is required for cross-architecture deploys and
+            mismatched nixpkgs revisions to work).
+          '';
+
+          config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
+            security.polkit.enable = lib.mkDefault true;
+            environment.systemPackages = [ pkgs.polkit-stdin-agent ];
+          };
+        }
+      )
      (mkToolModule {
        name = "nixos-version";
        package = nixos-version;
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@ -267,13 +267,22 @@ in
            group = "root";
            inherit source;
          };
+          mkCapRoot = capabilities: source: {
+            inherit capabilities source;
+            owner = "root";
+            group = "root";
+          };
        in
        {
          su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
          sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
          newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
-          newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
-          newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
+          # File capabilities instead of setuid root, mirroring shadow's
+          # own --with-fcaps install mode and what Arch/Fedora/Debian ship.
+          # The kernel only requires CAP_SETUID/CAP_SETGID over the parent
+          # userns to write a multi-line /proc/<pid>/[ug]id_map.
+          newuidmap = mkCapRoot "cap_setuid+ep" "${cfg.package.out}/bin/newuidmap";
+          newgidmap = mkCapRoot "cap_setgid+ep" "${cfg.package.out}/bin/newgidmap";
        }
        // lib.optionalAttrs config.users.mutableUsers {
          chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@ -179,10 +179,10 @@ in
          }" />
          <!-- specify the binaries to be called -->
          <!-- the comma in front of the options is necessary for empty options -->
-          <fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ,${
+          <fusemount>${pkgs.fuse3}/bin/mount.fuse3 %(VOLUME) %(MNTPT) -o ,${
            lib.concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])
          }'</fusemount>
-          <fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
+          <fuseumount>${pkgs.fuse3}/bin/fusermount3 -u %(MNTPT)</fuseumount>
          <!-- the comma in front of the options is necessary for empty options -->
          <cryptmount>${pkgs.pam_mount}/bin/mount.crypt -o ,${
            lib.concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@ -189,11 +189,15 @@ let
                        [ "--docker-image ${service.dockerImage}" ]
                        ++ optional service.dockerDisableCache "--docker-disable-cache"
                        ++ optional service.dockerPrivileged "--docker-privileged"
+                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                        ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                        ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                        ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                        ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                        ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
+                        ++ map (
+                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
+                        ) service.dockerAllowedPrivilegedServices
                      )
                    )
                  )
@ -521,6 +525,13 @@ in
                Give extended privileges to container.
              '';
            };
+            dockerServicesPrivileged = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Give extended privileges to services.
+              '';
+            };
            dockerExtraHosts = mkOption {
              type = types.listOf types.str;
              default = [ ];
@ -554,6 +565,19 @@ in
                Whitelist allowed services.
              '';
            };
+            dockerAllowedPrivilegedServices = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [
+                "docker.io/library/docker:*-dind-rootless"
+                "docker.io/library/docker:dind-rootless"
+                "docker:*-dind-rootless"
+                "docker:dind-rootless"
+              ];
+              description = ''
+                Whitelist allowed privileged services.
+              '';
+            };
            preGetSourcesScript = mkOption {
              type = types.nullOr (types.either types.str types.path);
              default = null;
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@ -40,11 +40,27 @@ let
        '';
        serial = lib.mkOption {
          type = lib.types.nullOr lib.types.path;
-          description = "Path to serial port this printer is connected to. Derived from `service.klipper.settings` by default.";
+          description = "Path to serial port this mcu is connected to. Derived from `service.klipper.settings` by default.";
          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.serial";
          default =
            if lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings then cfg.settings."${mcu}".serial else null;
        };
+        canbus_uuid = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus uuid of this mcu. Derived from `service.klipper.settings` by default.";
+          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.canbus_uuid";
+          default =
+            if lib.hasAttrByPath [ "${mcu}" "canbus_uuid" ] cfg.settings then
+              cfg.settings."${mcu}".canbus_uuid
+            else
+              null;
+        };
+        canbusNetwork = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus network this mcu is connected to. Defaults to can0 if canbus_uuid is set.";
+          defaultText = lib.literalExpression ''if canbus_uuid != null then "can0" else null'';
+          default = if subcfg.canbus_uuid != null then "can0" else null;
+        };
        configFile = lib.mkOption {
          type = lib.types.path;
          description = "Path to firmware config which is generated using `klipper-genconf`";
@ -78,6 +94,8 @@ let
              klipper-firmware = subcfg.package;
              mcu = lib.strings.sanitizeDerivationName mcu;
              flashDevice = subcfg.serial;
+              canbusDevice = subcfg.canbus_uuid;
+              canbusNetwork = subcfg.canbusNetwork;
              firmwareConfig = subcfg.configFile;
            }
          else
@ -224,12 +242,15 @@ in
      }
    ]
    ++ lib.mapAttrsToList (mcu: firmware: {
-      assertion = firmware.enableKlipperFlash -> firmware.serial != null;
+      assertion =
+        firmware.enableKlipperFlash -> (firmware.serial != null || firmware.canbus_uuid != null);
      message = ''
-        Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
+        Unable to determine the serial or canbus connection for services.klipper.firmwares."${mcu}". Please set one of the following:

          - services.klipper.firmwares."${mcu}".serial
+          - services.klipper.firmwares."${mcu}".canbus_uuid
          - services.klipper.settings."${mcu}".serial
+          - services.klipper.settings."${mcu}".canbus_uuid
      '';
    }) cfg.firmwares;

@ -308,7 +329,6 @@ in

    environment.systemPackages =
      let
-        default = a: b: if a != null then a else b;
        genconf = pkgs.klipper-genconf.override {
          klipper = cfg.package;
        };
--- a/nixos/modules/services/security/jitterentropy-rngd.nix
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@ -26,6 +26,11 @@ in
      default = false;
      description = "Force SP800-90B mode for entropy reading";
    };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
    verbose = lib.mkOption {
      type = lib.types.bool;
      default = false;
@ -56,6 +61,12 @@ in
          # use service from package with our configured args
          "${cfg.package}/bin/jitterentropy-rngd ${args}"
        ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
      };
    };

--- a/nixos/modules/services/web-apps/strichliste.nix
+++ b/nixos/modules/services/web-apps/strichliste.nix
@ -246,6 +246,16 @@ in
              };
            };

+            splitInvoice = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow splitting invoices.
+                '';
+              };
+            };
+
            transaction = {
              enabled = mkOption {
                type = types.bool;
@ -464,26 +474,22 @@ in
        wants = unitDependencies;
        after = unitDependencies;
        inherit (cfg) environment;
-        preStart = ''
-          set -ex
-          if [ ! -e "/var/lib/strichliste/.db-init" ]; then
-            ${lib.optionalString (lib.hasInfix "sqlite" cfg.environment.DATABASE_URL) ''
-              ${lib.getExe cfg.packages.backend} doctrine:database:create
-            ''}
-            ${lib.getExe cfg.packages.backend} doctrine:schema:create
-            touch "/var/lib/strichliste/.db-init"
-          fi
-        '';
        serviceConfig = {
-          Type = "exec";
+          Type = "oneshot";
          User = "strichliste";
          Group = "strichliste";
          EnvironmentFile = cfg.environmentFiles;
-          ExecStart = toString [
-            (lib.getExe cfg.packages.backend)
-            "doctrine:migrations:migrate"
-            "--allow-no-migration"
-            "--no-interaction"
+          ExecStart = map toString [
+            [
+              (lib.getExe cfg.packages.backend)
+              "cache:clear"
+            ]
+            [
+              (lib.getExe cfg.packages.backend)
+              "doctrine:migrations:migrate"
+              "--allow-no-migration"
+              "--no-interaction"
+            ]
          ];
        };
      };
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@ -322,6 +322,9 @@ in
        description = "Run user-specific NixOS activation";
        script = config.system.userActivationScripts.script;
        unitConfig.ConditionUser = "!@system";
+        # switch-to-configuration restarts this explicitly on every switch.
+        restartIfChanged = false;
+        serviceConfig.RemainAfterExit = true;
        serviceConfig.Type = "oneshot";
        wantedBy = [ "default.target" ];
      };
--- a/nixos/modules/system/boot/kernel_config.nix
+++ b/nixos/modules/system/boot/kernel_config.nix
@ -29,9 +29,7 @@ let
      };

      freeform = mkOption {
-        type = types.nullOr types.str // {
-          merge = mergeEqualOption;
-        };
+        type = types.nullOr types.str;
        default = null;
        example = ''MMC_BLOCK_MINORS.freeform = "32";'';
        description = ''
--- a/nixos/modules/system/boot/loader/limine/limine.nix
+++ b/nixos/modules/system/boot/loader/limine/limine.nix
@ -29,7 +29,7 @@ let
      resolution = cfg.resolution;
      maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
      hostArchitecture = pkgs.stdenv.hostPlatform.parsed.cpu;
-      timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else 10;
+      timeout = if config.boot.loader.timeout == null then "no" else config.boot.loader.timeout;
      enableEditor = cfg.enableEditor;
      extraConfig = cfg.extraConfig;
      extraEntries = cfg.extraEntries;
--- a/nixos/modules/virtualisation/lxcfs.nix
+++ b/nixos/modules/virtualisation/lxcfs.nix
@ -41,7 +41,7 @@ in
      serviceConfig = {
        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
        ExecStart = "${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
-        ExecStopPost = "-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
+        ExecStopPost = "-${pkgs.fuse3}/bin/fusermount3 -u /var/lib/lxcfs";
        KillMode = "process";
        Restart = "on-failure";
      };
--- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix
+++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix
@ -3,10 +3,10 @@
  e2fsprogs,
  iproute2,
  lib,
-  mypy,
  ruff,
  setuptools,
  systemd,
+  ty,
 }:

 buildPythonApplication {
@ -35,13 +35,13 @@ buildPythonApplication {
  doCheck = true;

  nativeCheckInputs = [
-    mypy
    ruff
+    ty
  ];

  checkPhase = ''
-    echo -e "\x1b[32m## run mypy\x1b[0m"
-    mypy run_nspawn
+    echo -e "\x1b[32m## run ty\x1b[0m"
+    ty check --error-on-warning run_nspawn
    echo -e "\x1b[32m## run ruff check\x1b[0m"
    ruff check .
    echo -e "\x1b[32m## run ruff format\x1b[0m"
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -551,7 +551,7 @@ in
        y = 768;
      };
      description = ''
-        The resolution of the virtual machine display.
+        The resolution of the virtual machine display (relevant only if virtualised machine uses grub bootloader).
      '';
    };

@ -1379,7 +1379,6 @@ in
        "-device usb-tablet,bus=usb-bus.0"
      ])
      (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
        "-device usb-ehci,id=usb0"
        "-device usb-kbd"
        "-device usb-tablet"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -153,6 +153,7 @@ in
    console-log = runTest ./nixos-test-driver/console-log.nix;
    containers = runTest ./nixos-test-driver/containers.nix;
    skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
    driver-timeout =
      pkgs.runCommand "ensure-timeout-induced-failure"
        {
@ -673,6 +674,7 @@ in
  gobgpd = runTest ./gobgpd.nix;
  gocd-agent = runTest ./gocd-agent.nix;
  gocd-server = runTest ./gocd-server.nix;
+  gocryptfs = runTest ./gocryptfs.nix;
  gokapi = runTest ./gokapi.nix;
  gollum = runTest ./gollum.nix;
  gonic = runTest ./gonic.nix;
--- a/nixos/tests/gocryptfs.nix
+++ b/nixos/tests/gocryptfs.nix
@ -0,0 +1,57 @@
+{
+  name = "gocryptfs";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+
+      environment.systemPackages = [
+        pkgs.gocryptfs
+        pkgs.openssl
+      ];
+
+      specialisation.fstab-test.configuration = {
+        fileSystems."/plain" = {
+          device = "/encrypted";
+          fsType = "fuse.gocryptfs";
+          options = [
+            "nofail"
+            "allow_other"
+            "passfile=/tmp/password.txt"
+          ];
+        };
+      };
+    };
+
+  testScript = ''
+
+    # Generate a password
+    machine.execute("openssl rand -base64 32 > /tmp/password.txt")
+
+    # Initialize an encrypted vault
+    machine.execute("mkdir -p /encrypted /plain")
+    machine.execute("gocryptfs -init /encrypted  -passfile /password.txt -quiet")
+
+    # Open and mount vault
+    machine.execute("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
+
+    machine.execute("echo test > /plain/data.txt")
+    machine.execute("echo test > /tmp/data.txt")
+
+    # Unmount
+    machine.execute("fusermount -u /plain")
+
+    # Switch to the specialisation
+    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration test")
+
+    # Wait for mount
+    machine.wait_for_unit("local-fs.target")
+
+    # Check data
+    machine.succeed("diff /plain/data.txt /tmp/data.txt")
+
+  '';
+}
--- a/nixos/tests/nixos-rebuild-target-host.nix
+++ b/nixos/tests/nixos-rebuild-target-host.nix
@ -22,6 +22,8 @@
        };

        system.includeBuildDependencies = true;
+        # Needed so the offline build of the target config succeeds.
+        system.extraDependencies = [ pkgs.polkit-stdin-agent ];

        virtualisation = {
          cores = 2;
@ -49,6 +51,11 @@
          users.users.alice.extraGroups = [ "wheel" ];
          users.users.bob.extraGroups = [ "wheel" ];

+          # Needed for --elevate=run0. NixOS's default polkit admin rule is
+          # `unix-group:wheel`, so bob (in wheel) can authenticate with his
+          # own password via polkit-stdin-agent.
+          system.tools.nixos-rebuild.enableRun0Elevation = true;
+
          # Disable sudo for root to ensure sudo isn't called without `--sudo`
          security.sudo.extraRules = lib.mkForce [
            {
@ -142,6 +149,7 @@
      deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
      deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
      deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix")
+      deployer.copy_from_host("${configFile "config-4-deployed"}", "/root/configuration-4.nix")
      deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
      deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")

@ -168,6 +176,20 @@
        target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
        assert target_hostname == "config-3-deployed", f"{target_hostname=}"

+      with subtest("Deploy to bob@target with run0 and password"):
+        # polkit-stdin-agent registers an agent for systemd-run on the
+        # target and answers the PAM conversation with the password we
+        # supply locally. The agent is resolved on the target from
+        # <toplevel>/sw/bin (see Run0Elevator._remote_agent_argv).
+        deployer.send_chars("nixos-rebuild switch -I nixos-config=/root/configuration-4.nix --target-host bob@target --elevate=run0 --ask-elevate-password\n")
+        deployer.wait_until_tty_matches("1", "\\[run0\\] password for bob@target")
+        deployer.send_chars("${nodes.target.users.users.bob.password}\n")
+        deployer.wait_until_tty_matches("1", "Done. The new configuration is /nix/store/.*config-4-deployed")
+        target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
+        assert target_hostname == "config-4-deployed", f"{target_hostname=}"
+        # The target-arch agent is reachable at the stable sw/bin path.
+        target.succeed("test -x /run/current-system/sw/bin/polkit-stdin-agent")
+
      with subtest("Deploy works with very long TMPDIR"):
        tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
        deployer.succeed(f"mkdir -p {tmp_dir}")
--- a/nixos/tests/nixos-test-driver/options-doc-regression.nix
+++ b/nixos/tests/nixos-test-driver/options-doc-regression.nix
@ -0,0 +1,58 @@
+# Regression test for the `pythonTestDriverPackage` option's default value
+# leaking a `hostPkgs` reference into the NixOS manual build.
+#
+# `pythonTestDriverPackage` (added in d95261b435c4, "nixos-test-driver: Make
+# overridable") uses `default = hostPkgs.nixos-test-driver`. Without a
+# `defaultText`, the options-doc renderer force-evaluates that default when
+# building `options.json` for the NixOS manual. `hostPkgs` is only defined in
+# the VM testing framework, so evaluating its default from a regular NixOS
+# system configuration throws:
+#
+#   error: The option `hostPkgs' was accessed but has no value defined.
+#
+# In practice the bug only surfaces when `pkgs` ends up depending on
+# `config` — e.g. when `nixpkgs.config.packageOverrides` is wrapped in
+# `lib.mkIf`. Otherwise `nixos/doc/manual/default.nix`'s fallback
+# `config.hostPkgs = pkgs` rescue holds. With the dependency, that rescue
+# creates a cycle and the original `hostPkgs` error surfaces.
+#
+# The test builds a minimal system whose `pkgs` depends on `config`, and
+# asserts the toplevel (which includes `nixos-manual-html`) evaluates.
+
+{
+  pkgs,
+  ...
+}:
+let
+  evalConfig = import ../../lib/eval-config.nix;
+
+  nixos = evalConfig {
+    system = null;
+    modules = [
+      (
+        { lib, ... }:
+        {
+          system.stateVersion = "25.05";
+          fileSystems."/" = {
+            device = "/dev/null";
+            fsType = "none";
+          };
+          boot.loader.grub.device = "nodev";
+          nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system;
+
+          # This is the trigger: wrapping `packageOverrides` in `mkIf` makes
+          # the `pkgs` module argument depend on `config`, which defeats the
+          # `config.hostPkgs = pkgs` rescue in `nixos/doc/manual/default.nix`.
+          nixpkgs.config.packageOverrides = lib.mkIf false (_: { });
+        }
+      )
+    ];
+  };
+in
+pkgs.runCommand "nixos-test-driver-options-doc-regression"
+  {
+    toplevel = nixos.config.system.build.toplevel.drvPath;
+  }
+  ''
+    echo "$toplevel" > $out
+  ''
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@ -739,6 +739,22 @@ in
            '';
          };

+          # As above, but with reloadIfChanged: pass 2 must reload, not
+          # restart.
+          userServiceMigratedToNixosReloadOnly.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated = {
+              reloadIfChanged = true;
+              serviceConfig.ExecReload = "${pkgs.coreutils}/bin/true";
+            };
+          };
+
+          # As above, but with restartIfChanged = false: pass 2 must skip it.
+          userServiceMigratedToNixosNoRestart.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated.restartIfChanged = false;
+          };
+
          no_inhibitors.configuration.system.switch.inhibitors = lib.mkForce { };

          inhibitors.configuration.system.switch.inhibitors = lib.mkForce {
@ -810,6 +826,15 @@ in
        RemainAfterExit=true
        ExecStart=${pkgs.runtimeShell} -c 'echo home > %t/migrated-owner'
      '';
+
+      # Unit file placed in ~/.local/share/systemd/user (lower priority than
+      # /etc) to simulate a package-shipped unit.
+      dataMigratedUnit = pkgs.writeText "migrated.service" ''
+        [Service]
+        Type=oneshot
+        RemainAfterExit=true
+        ExecStart=${pkgs.runtimeShell} -c 'echo data > %t/migrated-owner'
+      '';
    in
    # python
    ''
@ -1729,9 +1754,10 @@ in
          out = switch_to_specialisation("${machine}", "simpleUserService")
          user_systemctl("is-active usertest.service")

-          # No-op switch does nothing
+          # No-op switch leaves the test unit alone.
          out = switch_to_specialisation("${machine}", "simpleUserService")
-          assert_lacks(out, "user units:")
+          assert_lacks(out, "usertest.service")
+          assert_contains(out, "restarting the following user units: nixos-activation.service")

          # Modifying the unit stop-starts it (default stopIfChanged=true)
          out = switch_to_specialisation("${machine}", "simpleUserServiceModified")
@ -1748,7 +1774,7 @@ in
          # reloadIfChanged=true reloads instead
          out = switch_to_specialisation("${machine}", "simpleUserServiceReload")
          assert_lacks(out, "stopping the following user units:")
-          assert_lacks(out, "restarting the following user units:")
+          assert_lacks(out, "restarting the following user units: usertest.service")
          assert_contains(out, "reloading the following user units: usertest.service")
          user_systemctl("is-active usertest.service")

@ -1818,6 +1844,59 @@ in
          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
          assert_contains(out, "nixos")

+          # Pass 2 must honour reloadIfChanged.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosReloadOnly")
+          assert_lacks(out, "restarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "reloading (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          # Reloaded only, so the home ExecStart never re-ran.
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Pass 2 must honour restartIfChanged = false.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosNoRestart")
+          assert_lacks(out, "\nrestarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "NOT restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Migration from a lower-priority search-path entry ($XDG_DATA_HOME
+          # here, standing in for ~/.nix-profile/share etc.). /etc outranks
+          # these, so pass 2 must restart onto the /etc definition.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          machine.succeed(
+              "sudo -u usertest mkdir -p ~usertest/.local/share/systemd/user",
+              "sudo -u usertest cp ${dataMigratedUnit} ~usertest/.local/share/systemd/user/migrated.service",
+          )
+          user_systemctl("daemon-reload")
+          user_systemctl("start migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "data")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/.local/share/systemd/user/migrated.service")
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_contains(out, "restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/etc/systemd/user/migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "nixos")
+          # Switching again must NOT touch it: /etc already had it, so it is
+          # not a candidate even though the lower-priority copy is still there.
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_lacks(out, "migrated.service")
+          machine.succeed("sudo -u usertest rm -rf ~usertest/.local/share/systemd")
+          user_systemctl("daemon-reload")
+
          # Units that remain shadowed by ~/.config must be left alone in both
          # passes even though /etc now also defines them.
          switch_to_specialisation("${machine}", "")
--- a/nixos/tests/user-activation-scripts.nix
+++ b/nixos/tests/user-activation-scripts.nix
@ -13,12 +13,14 @@
      isNormalUser = true;
    };
    systemd.user.tmpfiles.users.alice.rules = [ "r %h/file-to-remove" ];
+    specialisation.changed.configuration.system.userActivationScripts.bar = "true";
  };

  testScript = ''
    def verify_user_activation_run_count(n):
-        machine.succeed(
-            '[[ "$(find /home/alice/ -name user-activation-ran.\\* | wc -l)" == %s ]]' % n
+        t.assertEqual(
+            n,
+            int(machine.succeed('find /home/alice/ -name user-activation-ran.\\* | wc -l').rstrip())
        )


@ -36,5 +38,12 @@
    machine.succeed("/run/current-system/bin/switch-to-configuration test")
    verify_user_activation_run_count(2)
    machine.succeed("[[ ! -f /home/alice/file-to-remove ]] || false")
+    # Activation must not be killed while running.
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
+
+    # Changed activation script: still exactly one run.
+    machine.succeed("/run/current-system/specialisation/changed/bin/switch-to-configuration test")
+    verify_user_activation_run_count(3)
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
  '';
 }
--- a/nixos/tests/web-apps/strichliste.nix
+++ b/nixos/tests/web-apps/strichliste.nix
@ -7,38 +7,36 @@
  name = "strichliste";
  meta.maintainers = pkgs.strichliste.meta.maintainers;

-  nodes = {
-    server =
-      { config, ... }:
-      {
-        networking.extraHosts = ''
-          127.0.0.1 strichliste.local
-        '';
+  containers.server =
+    { config, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 strichliste.local
+      '';

-        environment.systemPackages = with pkgs; [ httpie ];
+      environment.systemPackages = with pkgs; [ httpie ];

-        time.timeZone = "Europe/Berlin";
+      time.timeZone = "Europe/Berlin";

-        services.strichliste = {
-          enable = true;
-          domain = "strichliste.local";
-          environmentFiles = [
-            (pkgs.writeText "strichliste-secret.env" ''
-              APP_SECRET=changemechangemechangeme
-            '')
-          ];
-          settings = {
-            i18n = {
-              currency = {
-                alpha3 = "EUR";
-                name = "Euro";
-                symbol = "€";
-              };
+      services.strichliste = {
+        enable = true;
+        domain = "strichliste.local";
+        environmentFiles = [
+          (pkgs.writeText "strichliste-secret.env" ''
+            APP_SECRET=changemechangemechangeme
+          '')
+        ];
+        settings = {
+          i18n = {
+            currency = {
+              alpha3 = "EUR";
+              name = "Euro";
+              symbol = "€";
            };
          };
        };
      };
-  };
+    };

  testScript =
    {
@ -52,12 +50,12 @@
      start_all()

      def get_users():
-        response = server.succeed("http --check-status http://strichliste.local/api/user")
+        response = server.succeed("http --ignore-stdin --check-status http://strichliste.local/api/user")
        users = json.loads(response)["users"]
        return users

      def get_user(uid: int):
-        response = server.succeed(f"http --check-status http://strichliste.local/api/user/{uid}")
+        response = server.succeed(f"http --ignore-stdin --check-status http://strichliste.local/api/user/{uid}")
        user = json.loads(response)["user"]
        return user

@ -67,7 +65,7 @@
          t.assertEqual(len(users), 0, "Strichliste must not have users.")

        with subtest("Create user"):
-          server.succeed("http --check-status post http://strichliste.local/api/user name=Alice")
+          server.succeed("http --ignore-stdin --check-status post http://strichliste.local/api/user name=Alice")
          users = get_users()
          t.assertEqual(len(users), 1, "Strichliste must have exactly one user.")

@ -77,27 +75,27 @@
          t.assertEqual(user["balance"], 0, "New users should have a balance of 0")

        with subtest("Deposit money"):
-          server.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=500")
+          server.succeed("http --ignore-stdin --check-status post http://strichliste.local/api/user/1/transaction amount=500")
          user = get_user(1)
          t.assertEqual(user["balance"], 500, "Balance must be 500 after depositing 500")

        with subtest("Dispense money"):
-          server.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=-1000")
+          server.succeed("http --ignore-stdin --check-status post http://strichliste.local/api/user/1/transaction amount=-1000")
          user = get_user(1)
          t.assertEqual(user["balance"], -500, "Balance must be -500 after dispensing 1000")

        with subtest("Undo transaction"):
-          response = server.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=7500")
+          response = server.succeed("http --ignore-stdin --check-status post http://strichliste.local/api/user/1/transaction amount=7500")
          transaction = json.loads(response)["transaction"]
-          server.succeed(f"http --check-status delete http://strichliste.local/api/user/1/transaction/{transaction['id']}")
+          server.succeed(f"http --ignore-stdin --check-status delete http://strichliste.local/api/user/1/transaction/{transaction['id']}")

      server.wait_for_unit("phpfpm-strichliste.service")

      # frontend
-      server.wait_until_succeeds("http --check-status http://strichliste.local/ | grep -q '<title>Strichliste</title>'")
+      server.wait_until_succeeds("http --ignore-stdin --check-status http://strichliste.local/ | grep -q '<title>Strichliste</title>'")

      # backend
-      server.wait_until_succeeds("http --check-status http://strichliste.local/api/settings")
+      server.wait_until_succeeds("http --ignore-stdin --check-status http://strichliste.local/api/settings")

      # sqlite
      test()
--- a/pkgs/applications/audio/mopidy/soundcloud.nix
+++ b/pkgs/applications/audio/mopidy/soundcloud.nix
@ -32,6 +32,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {

  meta = {
    description = "Mopidy extension for playing music from SoundCloud";
+    homepage = "https://github.com/mopidy/mopidy-soundcloud";
    license = lib.licenses.mit;
    maintainers = [ ];
  };
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -6,12 +6,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kakoune-unwrapped";
-  version = "2026.04.12";
+  version = "2026.05.21";
  src = fetchFromGitHub {
    repo = "kakoune";
    owner = "mawww";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-m8q1+TooDREbQD848ciHxeHwMajmlmhAhCqGmdbThIU=";
+    hash = "sha256-4nhhvq871mgbpKYhAAVkIi2+MaO1jlt3d3lIXNGkh6I=";
  };

  makeFlags = [
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@ -3,6 +3,7 @@
  stdenv,
  callPackage,
  fetchurl,
+  gnutls,
  guile_1_8,
  xmodmap,
  which,
@ -15,12 +16,8 @@
  python3 ? null,
  cmake,
  pkg-config,
-  wrapQtAppsHook,
  xdg-utils,
-  qtbase,
-  qtsvg,
-  qtmacextras,
-  fetchpatch,
+  qt6,
  ghostscriptX ? null,
  extraFonts ? false,
  chineseFonts ? false,
@ -30,7 +27,7 @@

 let
  pname = "texmacs";
-  version = "2.1.4";
+  version = "2.1.5";
  common = callPackage ./common.nix {
    inherit
      extraFonts
@ -46,47 +43,40 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
-    hash = "sha256-h6aSLuDdrAtVzOnNVPqMEWX9WLDHtkCjPy9JXWnBgYY=";
+    hash = "sha256-s6EnvbqOeQELI5KRQVy+NDEzNSHiRHeoFLWG4bQCc2A=";
  };

  postPatch = common.postPatch + ''
    substituteInPlace configure \
-      --replace "-mfpmath=sse -msse2" ""
+      --replace-fail "-mfpmath=sse -msse2" ""
  '';

  nativeBuildInputs = [
    guile_1_8
    pkg-config
-    wrapQtAppsHook
+    qt6.wrapQtAppsHook
    xdg-utils
    cmake
  ];

  buildInputs = [
+    gnutls
    guile_1_8
-    qtbase
-    qtsvg
+    qt6.qtbase
+    qt6.qtsvg
+    qt6.qt5compat
    ghostscriptX
    freetype
    libjpeg
    sqlite
    git
    python3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "TEXMACS_GUI" "Qt6")
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    qtmacextras
-  ];
-
-  patches = [
-    (fetchpatch {
-      name = "fix-compile-clang-19.5.patch";
-      url = "https://github.com/texmacs/texmacs/commit/e72783b023f22eaa0456d2e4cc76ae509d963672.patch";
-      hash = "sha256-oJCiXWTY89BdxwbgtFvfThid0WM83+TAUThSihfr0oA=";
-    })
-  ];
-
-  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "TEXMACS_GUI" "Qt")
    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "./TeXmacs.app/Contents/Resources")
  ];

@ -111,6 +101,11 @@ stdenv.mkDerivation {
      git
      python3
    ])
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "--set"
+    "TEXMACS_PATH"
+    "${placeholder "out"}/Applications/TeXmacs.app/Contents/Resources/share/TeXmacs"
  ];

  postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -7169,6 +7169,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  harpoon-lualine = buildVimPlugin {
+    pname = "harpoon-lualine";
+    version = "0-unstable-2025-07-28";
+    src = fetchFromGitHub {
+      owner = "letieu";
+      repo = "harpoon-lualine";
+      rev = "215c0847dfb787b19268f7b42eed83bdcf06b966";
+      hash = "sha256-HGbz/b2AVl8145BCy8I47dDrhBVMSQQIr+mWbOrmj5Q=";
+    };
+    meta.homepage = "https://github.com/letieu/harpoon-lualine/";
+    meta.license = unfree;
+    meta.hydraPlatforms = [ ];
+  };
+
  harpoon2 = buildVimPlugin {
    pname = "harpoon2";
    version = "0-unstable-2025-10-31";
@ -8164,6 +8178,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  jujutsu-nvim = buildVimPlugin {
+    pname = "jujutsu.nvim";
+    version = "0-unstable-2026-05-14";
+    src = fetchFromGitHub {
+      owner = "yannvanhalewyn";
+      repo = "jujutsu.nvim";
+      rev = "17ab008d71cbcd31f8c2891e11cb758579f597c0";
+      hash = "sha256-KygJ73YZNPtTfECWyrwK86AfO7jXDEfIMFia3yvorM0=";
+    };
+    meta.homepage = "https://github.com/yannvanhalewyn/jujutsu.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  jule-nvim = buildVimPlugin {
    pname = "jule.nvim";
    version = "0-unstable-2025-12-26";
@ -11231,6 +11259,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  neotest-bun = buildVimPlugin {
+    pname = "neotest-bun";
+    version = "0-unstable-2026-01-05";
+    src = fetchFromGitHub {
+      owner = "Arthur944";
+      repo = "neotest-bun";
+      rev = "af0f8684cd00a96f1e0359f1aeff2b9bf7a0ec88";
+      hash = "sha256-Y1I0zW8S8/Fz46rPIkHzTGbm7C8BXOfjq+V19YrzPlo=";
+    };
+    meta.homepage = "https://github.com/Arthur944/neotest-bun/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  neotest-ctest = buildVimPlugin {
    pname = "neotest-ctest";
    version = "0.3.0";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -150,7 +150,6 @@ let
      }"
      overrides;
 in
-
 assertNoAdditions {
  # keep-sorted start case=no block=yes newline_separated=yes
  ack-vim = super.ack-vim.overrideAttrs (old: {
@ -1579,7 +1578,6 @@ assertNoAdditions {
    ];
    dependencies = [ self.fzf-vim ];
    passthru = old.passthru // {
-
      initLua = "vim.g.hoogle_fzf_cache_file = vim.fn.stdpath('cache')..'/hoogle_cache.json";
    };
  });
@ -1778,6 +1776,13 @@ assertNoAdditions {
    dependencies = [ self.plenary-nvim ];
  };

+  harpoon-lualine = super.harpoon-lualine.overrideAttrs {
+    dependencies = [
+      self.lualine-nvim
+      self.harpoon2
+    ];
+  };
+
  harpoon2 = super.harpoon2.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
    nvimSkipModules = [
@ -2809,6 +2814,13 @@ assertNoAdditions {
    ];
  };

+  neotest-bun = super.neotest-bun.overrideAttrs {
+    dependencies = with self; [
+      neotest
+      nvim-nio
+    ];
+  };
+
  neotest-ctest = super.neotest-ctest.overrideAttrs {
    dependencies = with self; [
      neotest
@ -4122,7 +4134,6 @@ assertNoAdditions {
          }
      '';
    };
-
  });

  rtorrent-syntax-file = super.rtorrent-syntax-file.overrideAttrs (old: {
@ -4419,6 +4430,7 @@ assertNoAdditions {
      # the vim plugin expects evinceSync.py to be a python file, but it is a C wrapper
      pythonWrapper =
        writeText "evinceSync-wrapper.py" # python
+
          ''
            #!${python3}/bin/python3
            import os
@ -4824,7 +4836,6 @@ assertNoAdditions {
       --replace-fail "['tinymist'] = nil," "tinymist = '${lib.getExe tinymist}'," \
       --replace-fail "['websocat'] = nil," "websocat = '${lib.getExe websocat}',"
    '';
-
  };

  unicode-vim =
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -510,6 +510,7 @@ https://github.com/TheSnakeWitcher/hardhat.nvim/,,
 https://github.com/m4xshen/hardtime.nvim/,,
 https://git.sr.ht/~sircmpwn/hare.vim,,
 https://github.com/ThePrimeagen/harpoon/,,
+https://github.com/letieu/harpoon-lualine/,,
 https://github.com/ThePrimeagen/harpoon/,harpoon2,harpoon2
 https://github.com/kiyoon/haskell-scope-highlighting.nvim/,,
 https://github.com/mrcjkb/haskell-snippets.nvim/,,
@ -581,6 +582,7 @@ https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,,
@ -800,6 +802,7 @@ https://github.com/Shougo/neosnippet.vim/,,
 https://github.com/kawre/neotab.nvim/,,
 https://github.com/kassio/neoterm/,,
 https://github.com/rcasia/neotest-bash/,,
+https://github.com/Arthur944/neotest-bun/,,
 https://github.com/orjangj/neotest-ctest/,,
 https://github.com/sidlatau/neotest-dart/,,
 https://github.com/MarkEmmons/neotest-deno/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1145,8 +1145,8 @@ let
        mktplcRef = {
          name = "vscode-database-client2";
          publisher = "cweijan";
-          version = "8.4.6";
-          hash = "sha256-GBz0hS75VgfuGuHY/K/VHxp5sFptUCJaz/CXrm6wFPc=";
+          version = "8.4.7";
+          hash = "sha256-HiyLNVtdJgzwn6BSR4ojHOkLrQ49PhRQa4twst69j7Q=";
        };
        meta = {
          description = "Database Client For Visual Studio Code";
@ -1760,8 +1760,8 @@ let
        mktplcRef = {
          name = "foam-vscode";
          publisher = "foam";
-          version = "0.40.4";
-          hash = "sha256-WqFIWt3c3XtdsXys+V4tQWxzDMefYOQ88MzTSPDHOKE=";
+          version = "0.42.0";
+          hash = "sha256-mk4ZgaBxLFPvrm3EU+hdidorhdWp7EGfRP0e/kARd1A=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@ -2014,8 +2014,8 @@ let
        mktplcRef = {
          name = "gleam";
          publisher = "gleam";
-          version = "2.12.1";
-          hash = "sha256-zU/iwaJ6ShEHYq7OeM6+RF/RVIx6SmJJKxtebN/tSGI=";
+          version = "2.12.2";
+          hash = "sha256-41HgkDcgyStJtyeE0x1H9rFOZ18imcKF7XQixDOmurE=";
        };
        meta = {
          description = "Support for the Gleam programming language";
@ -3967,8 +3967,8 @@ let
          publisher = "rocq-prover";
          name = "vsrocq";
          # When updating the version here, also update the language server vsrocq-language-server
-          version = "2.3.4";
-          hash = "sha256-2zYoCUtyhboQt68UJEmWOvrTrIOV2QmpaXU5mUhJfsA=";
+          version = "2.4.3";
+          hash = "sha256-o9rsSDCDYRWZQBMDA7DtWay50tBI76kw7H7CivrZpKo=";
        };
        meta = {
          description = "VsRocq is an extension for Visual Studio Code with support for the Rocq Prover";
--- a/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "basedpyright";
    publisher = "detachhead";
-    version = "1.39.3";
-    hash = "sha256-uuWkSxjsY7ZL1QUwqkiwPTN8oGUktfm7/Hgv3Enmgqc=";
+    version = "1.39.6";
+    hash = "sha256-shxV0g1XDu7qjrGiwyHGpY2qBCJt23tz7SuDbm5AXws=";
  };
  meta = {
    changelog = "https://github.com/detachhead/basedpyright/releases";
--- a/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix
@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "fstar-vscode-assistant";
    publisher = "FStarLang";
-    version = "0.24.0";
-    hash = "sha256-2XFisNp/TvkBNytzs56kdMnaZTX6f1qWp1k59uLwcuE=";
+    version = "0.25.0";
+    hash = "sha256-sya3P9Kn3DM/z5p8xF6TLEUPgrCs5+jgD89Y1KSJAgY=";
  };
  meta = {
    description = "Interactive editing mode VS Code extension for F*";
--- a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ms-python";
    name = "mypy-type-checker";
-    version = "2026.4.0";
-    hash = "sha256-N0zml16XSBwjGHzCR1L0W9WiSgqD/375VIQGpGfCkFE=";
+    version = "2026.6.0";
+    hash = "sha256-Sis9Tm5uWTyAIJnHvdh/dwOs580YprqDQ3XP8FhWvw0=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/update-vscodium.sh
+++ b/pkgs/applications/editors/vscode/update-vscodium.sh
@ -5,9 +5,11 @@ set -eou pipefail

 latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/VSCodium/vscodium/releases/latest | jq -r ".tag_name")
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; vscodium.version or (lib.getVersion vscodium)" | tr -d '"')
+latestUpstream=$(curl -sL "https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/$latestVersion/upstream/stable.json" | jq -r ".tag")

 echo "latest  version: $latestVersion"
 echo "current version: $currentVersion"
+echo "latest upstream version: $latestUpstream"

 if [[ "$latestVersion" == "$currentVersion" ]]; then
    echo "package is up-to-date"
@ -25,3 +27,5 @@ for i in \
    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
    update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
+
+update-source-version vscodium $latestUpstream --version-key=vscodeVersion --ignore-same-version --ignore-same-hash
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -44,6 +44,7 @@ buildVscode rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
  version = "1.116.02821";
+  vscodeVersion = "1.116.0";
  pname = "vscodium";

  executableName = "codium";
--- a/pkgs/applications/emulators/cdemu/vhba.nix
+++ b/pkgs/applications/emulators/cdemu/vhba.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vhba";
-  version = "20250329";
+  version = "20260313";

  src = fetchurl {
    url = "mirror://sourceforge/cdemu/vhba-module-${finalAttrs.version}.tar.xz";
-    hash = "sha256-piog1yDd8M/lpTIo9FE9SY2JwurZ6a8LG2lZ/4EmB14=";
+    hash = "sha256-KTADv12dwrOG2w0F9ZXFVINVpTXW38Bv03n9mLsZAXQ=";
  };

  makeFlags = kernelModuleMakeFlags ++ [
--- a/pkgs/applications/emulators/libretro/cores/yabause.nix
+++ b/pkgs/applications/emulators/libretro/cores/yabause.nix
@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "yabause";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "yabause";
-    rev = "7cb15b8f9eea5a6fa7cae34468a6989522bcba75";
-    hash = "sha256-UWZgt0vdjncM7JCzdSWa4XZMJBJ/pnk4QpSKz459Fq0=";
+    rev = "8926b0c6c347f8c5c755911ddb0ac695420ffbf8";
+    hash = "sha256-6MTUq1p3PWNwPqFmLu21BVOrHBl1koEQ98d9+B8qYq8=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@ -264,6 +264,7 @@ lib.makeScope pkgs.newScope (

      meta = {
        broken = gimp.apiVersion != "2.0";
+        homepage = "https://github.com/lmanul/gimp-texturize";
      };
    };

@ -321,6 +322,7 @@ lib.makeScope pkgs.newScope (

      meta = {
        broken = gimp.apiVersion != "2.0";
+        homepage = "https://github.com/carlobaldassi/gimp-lqr-plugin";
      };
    };

--- a/pkgs/applications/misc/ape/clex.nix
+++ b/pkgs/applications/misc/ape/clex.nix
@ -22,6 +22,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Large lexicon for APE (~100,000 entries)";
+    homepage = "https://github.com/Attempto/Clex";
    license = lib.licenses.gpl3;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ yrashk ];
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -535,11 +535,11 @@
    "vendorHash": null
  },
  "hashicorp_azurerm": {
-    "hash": "sha256-1WglgZrVUQXMLI/01QxhJ19Nv5+SdR3eEjOJ3PKEwCI=",
+    "hash": "sha256-DR68u61zP/eyllRkwNqKSXktAKjJJ0psXd9WWa2zA20=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.73.0",
+    "rev": "v4.75.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1238,11 +1238,11 @@
    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
  },
  "spacelift-io_spacelift": {
-    "hash": "sha256-m8l0fmDo8lFu8xIqO3tVD0vHIvgWSKVE7J6BxKm7LSY=",
+    "hash": "sha256-pWj9K8+ssAuSz1oufi/Ce701xaBDmHKtyijA/R/kQ/g=",
    "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
    "owner": "spacelift-io",
    "repo": "terraform-provider-spacelift",
-    "rev": "v1.49.0",
+    "rev": "v1.51.0",
    "spdx": "MIT",
    "vendorHash": "sha256-C8TE7uxMf6LOTS6v22mXwUdk2eqQRinwrCH4ZVUCx4k="
  },
--- a/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix
@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
  meta = {
    inherit (weechat.meta) platforms;
    description = "This simple weechat plugin allows you to compose messages in your $EDITOR";
+    homepage = "https://github.com/keith/edit-weechat";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ eraserhd ];
  };
--- a/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+++ b/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
@ -0,0 +1,22 @@
+From: "Matthias J. Kannwischer" <matthias@zerorisc.com>
+Date: Sat, 30 May 2026 16:37:44 +0800
+Subject: pa_j: accept camlp5 8.05 for OCaml 5.4
+
+Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
+---
+ pa_j/chooser.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pa_j/chooser.sh b/pa_j/chooser.sh
+index 5ec8d00..de5c8c8 100755
+--- a/pa_j/chooser.sh
+++ b/pa_j/chooser.sh
+@@ -20,7 +20,7 @@ CAMLP5_FULL_VERSION=`camlp5 -v 2>&1 | cut -f3 -d' ' | cut -f1-3 -d'.' | cut -f1
+ 
+ if test ${OCAML_BINARY_VERSION} = "3.0"
+ then echo "pa_j_${OCAML_VERSION}.ml"
+-elif test ${CAMLP5_FULL_VERSION} = "8.04.00"
+elif test ${CAMLP5_BINARY_VERSION} = "8.04" -o ${CAMLP5_BINARY_VERSION} = "8.05"
+ then
+   if test ${OCAML_BINARY_VERSION} = "5.4"
+   then echo "pa_j_5.4_8.04.00.ml"
--- a/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
+++ b/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
+++ b/Makefile
+@@ -128,7 +128,7 @@
+ hol.sh: pa_j.cmo ${HOLSRC} bignum.cmo hol_loader.cmo update_database.ml
+ 	if [ `uname` = "Linux" ] || [ `uname` = "Darwin" ] ; then \
+ 		if [ ${OCAML_UNARY_VERSION} = "5" ] || [ ${OCAML_VERSION} = "4.14" ] ; then \
+-			ocamlfind ocamlmktop -package zarith -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+			ocamlfind ocamlmktop -package zarith,findlib -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+ 			sed "s^__DIR__^`pwd`^g; s^__USE_MODULE__^$(HOLLIGHT_USE_MODULE)^g" hol_4.14.sh > hol.sh ; \
+ 		else \
+ 			ocamlmktop -o ocaml-hol nums.cma bignum.cmo hol_loader.cmo ; \
--- a/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
+++ b/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
@ -1,66 +0,0 @@
-From: Stephane Glondu <steph@glondu.net>
-Date: Wed, 12 Feb 2020 05:42:32 +0100
-Subject: Fix compilation with camlp5 7.11
-
---
- pa_j_4.xx_7.xx.ml | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/pa_j_4.xx_7.xx.ml b/pa_j_4.xx_7.xx.ml
-index 4f7ed60..e834058 100755
--- a/pa_j/pa_j_4.xx_7.xx.ml
-+++ b/pa_j/pa_j_4.xx_7.xx.ml
-@@ -410,9 +410,10 @@ and reloc_module_type floc sh =
-     | MtApp loc x1 x2 →
-         let loc = floc loc in
-         MtApp loc (self x1) (self x2)
-    | MtFun loc x1 x2 x3 →
-+    | MtFun loc x x3 →
-         let loc = floc loc in
-        MtFun loc x1 (self x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, self x2))) x in
-+        MtFun loc x (self x3)
-     | MtLid loc x1 →
-         let loc = floc loc in
-         MtLid loc x1
-@@ -507,9 +508,10 @@ and reloc_module_expr floc sh =
-     | MeApp loc x1 x2 →
-         let loc = floc loc in
-         MeApp loc (self x1) (self x2)
-    | MeFun loc x1 x2 x3 →
-+    | MeFun loc x x3 →
-         let loc = floc loc in
-        MeFun loc x1 (reloc_module_type floc sh x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, reloc_module_type floc sh x2))) x in
-+        MeFun loc x (self x3)
-     | MeStr loc x1 →
-         let loc = floc loc in
-         MeStr loc (vala_map (List.map (reloc_str_item floc sh)) x1)
-@@ -2007,7 +2009,7 @@ EXTEND
-       | -> <:vala< [] >> ] ]
-   ;
-   mod_binding:
-    [ [ i = V UIDENT; me = mod_fun_binding -> (i, me) ] ]
-+    [ [ i = V uidopt "uidopt"; me = mod_fun_binding -> (i, me) ] ]
-   ;
-   mod_fun_binding:
-     [ RIGHTA
-@@ -2070,7 +2072,7 @@ EXTEND
-           <:sig_item< value $lid:i$ : $t$ >> ] ]
-   ;
-   mod_decl_binding:
-    [ [ i = V UIDENT; mt = module_declaration -> (i, mt) ] ]
-+    [ [ i = V uidopt "uidopt"; mt = module_declaration -> (i, mt) ] ]
-   ;
-   module_declaration:
-     [ RIGHTA
-@@ -2092,6 +2094,9 @@ EXTEND
-       | "module"; i = V mod_ident ""; ":="; me = module_expr ->
-           <:with_constr< module $_:i$ := $me$ >> ] ]
-   ;
-+  uidopt:
-+    [ [ m = V UIDENT -> Some m ] ]
-+  ;
-   (* Core expressions *)
-   expr:
-     [ "top" RIGHTA
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@ -1,61 +1,51 @@
 {
  lib,
  stdenv,
-  runtimeShell,
  fetchFromGitHub,
+  makeBinaryWrapper,
+  writeText,
  ocaml,
  findlib,
-  num,
  zarith,
  camlp5,
  camlp-streams,
+  fmt,
  pcre2,
+  ledit,
  bash,
 }:

 let
-  use_zarith = lib.versionAtLeast ocaml.version "4.14";
-  load_num =
-    if use_zarith then
-      ''
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-        -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-      ''
-    else
-      lib.optionalString (num != null) ''
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/top-num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs
-      '';
-
-  start_script = ''
-    #!${runtimeShell}
-    cd $out/lib/hol_light
-    export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}${camlp5}/lib/ocaml/${ocaml.version}/site-lib/"
-    exec ${ocaml}/bin/ocaml \
-      -I \`${camlp5}/bin/camlp5 -where\` \
-      ${load_num} \
-      -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ \
-      -I ${camlp-streams}/lib/ocaml/${ocaml.version}/site-lib/camlp-streams camlp_streams.cma \
-      -init make.ml
-  '';
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib" [
+    camlp5
+    camlp-streams
+    fmt
+    pcre2
+    zarith
+  ];
+  stublibsPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib/stublibs" [
+    zarith
+    pcre2
+  ];
 in

 stdenv.mkDerivation {
  pname = "hol_light";
-  version = "unstable-2024-07-07";
+  version = "0-unstable-2026-05-19";

  src = fetchFromGitHub {
    owner = "jrh13";
    repo = "hol-light";
-    rev = "16b184e30e7e3fe9add7d1ee93242323ed2e1726";
-    hash = "sha256-V0OtsmX5pa+CH3ZXmNG3juXwXZ5+A0k13eMCAfaRziQ=";
+    rev = "9b510bc76da4cecf6e509be44d327c9236ec273f";
+    hash = "sha256-QaTDrGHpHvEde2AK/SD7eM+bAC9vN5o+dQqW1oau1Yo=";
  };

-  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
-
-  buildInputs = [ bash ];
+  patches = [
+    # Accept camlp5 8.05 in the pa_j chooser; submitted upstream.
+    ./0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+    # Link findlib into ocaml-hol so `#use "topfind"` works in the sandbox.
+    ./0002-link-findlib-into-ocaml-hol.patch
+  ];

  strictDeps = true;

@ -63,28 +53,77 @@ stdenv.mkDerivation {
    ocaml
    findlib
    camlp5
+    makeBinaryWrapper
+  ];
+  buildInputs = [
+    bash
+    ocaml
+    findlib
+    camlp5
+    ledit
  ];
  propagatedBuildInputs = [
    camlp-streams
+    fmt
    pcre2
-    (if use_zarith then zarith else num)
+    zarith
  ];

+  setupHook = writeText "hol-light-setup-hook.sh" ''
+    addHolLight () {
+      if test -d "''$1/lib/hol_light"; then
+        export HOLLIGHT_DIR="''$1/lib/hol_light"
+      fi
+    }
+    addEnvHooks "$targetOffset" addHolLight
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs .
+    HOLLIGHT_USE_MODULE=1 make hol.sh
+    HOLLIGHT_USE_MODULE=1 make
+    runHook postBuild
+  '';
+
  installPhase = ''
-    mkdir -p "$out/lib/hol_light" "$out/bin"
-    cp -a  . $out/lib/hol_light
-    echo "${start_script}" > "$out/bin/hol_light"
-    chmod a+x "$out/bin/hol_light"
+    runHook preInstall
+    mkdir -p "$out/lib/hol_light"
+    cp -a . "$out/lib/hol_light"
+    # The Makefile bakes the build directory into hol.sh; regenerate it
+    # pointing at the install location.
+    sed "s^__DIR__^$out/lib/hol_light^g; s^__USE_MODULE__^1^g" hol_4.14.sh \
+      > "$out/lib/hol_light/hol.sh"
+    chmod +x "$out/lib/hol_light/hol.sh"
+    # Add the findlib site-lib so the toplevel can `#use "topfind"`.
+    substituteInPlace "$out/lib/hol_light/hol.sh" \
+      --replace-fail '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR}' \
+        '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib'
+    makeWrapper "$out/lib/hol_light/hol.sh" "$out/bin/hol_light" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          ocaml
+          findlib
+          camlp5
+          ledit
+        ]
+      } \
+      --set OCAMLPATH "${ocamlPath}" \
+      --prefix CAML_LD_LIBRARY_PATH : "${stublibsPath}"
+    ln -s hol_light "$out/bin/hol.sh"
+    runHook postInstall
  '';

  meta = {
    description = "Interactive theorem prover based on Higher-Order Logic";
    homepage = "http://www.cl.cam.ac.uk/~jrh13/hol-light/";
+    mainProgram = "hol_light";
    license = lib.licenses.bsd2;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [
      thoughtpolice
      vbgl
+      mkannwischer
    ];
  };
 }
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@ -109,6 +109,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Free distributed version control system";
+    homepage = "https://github.com/7c6f434c/monotone-mirror";
    maintainers = [ lib.maintainers.raskin ];
    platforms = lib.platforms.unix;
    license = lib.licenses.gpl2Plus;
--- a/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix
+++ b/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix
@ -17,6 +17,7 @@ buildKodiAddon rec {

  meta = {
    description = "Addon that allows to manage bluetooth devices from within a Linux based Kodi";
+    homepage = "https://github.com/wastis/BluetoothManager";
    platforms = lib.platforms.all;
    maintainers = lib.teams.kodi.members;
    license = lib.licenses.gpl3Plus;
--- a/pkgs/applications/video/kodi/addons/joystick/default.nix
+++ b/pkgs/applications/video/kodi/addons/joystick/default.nix
@ -25,6 +25,7 @@ buildKodiBinaryAddon rec {

  meta = {
    description = "Binary addon for raw joystick input";
+    homepage = "https://github.com/xbmc/peripheral.joystick";
    platforms = lib.platforms.all;
    license = lib.licenses.gpl2Only;
    teams = [ lib.teams.kodi ];
--- a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
+++ b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
  ];

  meta = {
+    homepage = "https://github.com/xbmc/kodi-platform";
    license = lib.licenses.gpl2Plus;
  };
 }
--- a/pkgs/applications/video/kodi/addons/steam-controller/default.nix
+++ b/pkgs/applications/video/kodi/addons/steam-controller/default.nix
@ -20,6 +20,7 @@ buildKodiBinaryAddon rec {

  meta = {
    description = "Binary addon for steam controller";
+    homepage = "https://github.com/kodi-game/peripheral.steamcontroller";
    platforms = lib.platforms.all;
    teams = [ lib.teams.kodi ];
    license = lib.licenses.gpl2Only;
--- a/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix
@ -35,6 +35,7 @@ buildKodiBinaryAddon rec {

  meta = {
    description = "LibArchive Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.libarchive";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
    teams = [ lib.teams.kodi ];
--- a/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
@ -21,6 +21,7 @@ buildKodiBinaryAddon rec {

  meta = {
    description = "RAR archive Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.rar";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
    teams = [ lib.teams.kodi ];
--- a/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix
@ -27,6 +27,7 @@ buildKodiBinaryAddon rec {

  meta = {
    description = "SFTP Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.sftp";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
    teams = [ lib.teams.kodi ];
--- a/pkgs/applications/video/vdr/plugins.nix
+++ b/pkgs/applications/video/vdr/plugins.nix
@ -19,6 +19,9 @@ let
      buildInputs = [ vdr ];
      preConfigure = "cd PLUGINS/src/${name}";
      installFlags = [ "DESTDIR=$(out)" ];
+      meta = {
+        homepage = "https://git.tvdr.de/?p=vdr.git";
+      };
    };
 in
 {
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@ -7,13 +7,13 @@

 mkHyprlandPlugin {
  pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2026-03-09";
+  version = "0-unstable-2026-05-29";

  src = fetchFromGitHub {
    owner = "VirtCode";
    repo = "hypr-dynamic-cursors";
-    rev = "57e14edd0ae265b01828e466e287e96eb1e84dd3";
-    hash = "sha256-hHMMP4h9VvacDLb8lkI6gZcUnhDbEt+GP2RLLL2s2C4=";
+    rev = "1de08deb7d495124ce88b342fecc7e7542d0672f";
+    hash = "sha256-Ck9dFUfj/zDSab16CzsGWEMNeSNDhhDOB0JWeHzVvjk=";
  };

  dontUseCmakeConfigure = true;
--- a/pkgs/build-support/kernel/initrd-compressor-meta.nix
+++ b/pkgs/build-support/kernel/initrd-compressor-meta.nix
@ -1,18 +1,15 @@
 rec {
  cat = {
    executable = pkgs: "cat";
-    ubootName = "none";
    extension = ".cpio";
  };
  gzip = {
    executable = pkgs: "${pkgs.gzip}/bin/gzip";
    defaultArgs = [ "-9n" ];
-    ubootName = "gzip";
    extension = ".gz";
  };
  bzip2 = {
    executable = pkgs: "${pkgs.bzip2}/bin/bzip2";
-    ubootName = "bzip2";
    extension = ".bz2";
  };
  xz = {
@ -29,24 +26,20 @@ rec {
      "--check=crc32"
      "--lzma1=dict=512KiB"
    ];
-    ubootName = "lzma";
    extension = ".lzma";
  };
  lz4 = {
    executable = pkgs: "${pkgs.lz4}/bin/lz4";
    defaultArgs = [ "-l" ];
-    ubootName = "lz4";
    extension = ".lz4";
  };
  lzop = {
    executable = pkgs: "${pkgs.lzop}/bin/lzop";
-    ubootName = "lzo";
    extension = ".lzo";
  };
  zstd = {
    executable = pkgs: "${pkgs.zstd}/bin/zstd";
    defaultArgs = [ "-10" ];
-    ubootName = "zstd";
    extension = ".zst";
  };
  pigz = gzip // {
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@ -4,14 +4,13 @@ let
  # from it.
  compressors = import ./initrd-compressor-meta.nix;
  # Get the basename of the actual compression program from the whole
-  # compression command, for the purpose of guessing the u-boot
+  # compression command, for the purpose of guessing the
  # compression type and filename extension.
  compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;
 in
 {
  stdenvNoCC,
  cpio,
-  ubootTools,
  lib,
  pkgsBuildHost,
  makeInitrdNGTool,
@ -57,22 +56,13 @@ in
  # symlinks to store paths.
  prepend ? [ ],

-  # Whether to wrap the initramfs in a u-boot image.
-  makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target == "uImage",
-
-  # If generating a u-boot image, the architecture to use. The default
-  # guess may not align with u-boot's nomenclature correctly, so it can
-  # be overridden.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.
-  uInitrdArch ? stdenvNoCC.hostPlatform.ubootArch,
-
-  # The name of the compression, as recognised by u-boot.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.
-  # If this isn't guessed, you may want to complete the metadata above and send a PR :)
-  uInitrdCompression ?
-    _compressorMeta.ubootName
-      or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
+  # Deprecated; remove in 27.05.
+  makeUInitrd ? null,
+  uInitrdArch ? null,
+  uInitrdCompression ? null,
 }:
+assert lib.assertMsg (makeUInitrd == null && uInitrdArch == null && uInitrdCompression == null)
+  "makeInitrdNg: U‐Boot legacy image support has been removed as it is deprecated upstream and ARMv5 kernels no longer default to uImage";
 stdenvNoCC.mkDerivation (finalAttrs: {
  __structuredAttrs = true;

@ -83,11 +73,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  inherit
    name
    extension
-    makeUInitrd
-    uInitrdArch
    prepend
    ;
-  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;

  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
  contentsJSON = builtins.toJSON contents;
@ -95,8 +82,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeInitrdNGTool
    cpio
-  ]
-  ++ lib.optional makeUInitrd ubootTools;
+  ];

  buildCommand = ''
    mkdir -p ./root/{run,tmp,var/empty}
@ -109,13 +95,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    done
    (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")

-    if [ -n "$makeUInitrd" ]; then
-      mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-      # Compatibility symlink
-      ln -sf "initrd.img" "$out/initrd"
-    else
-      ln -s "initrd" "$out/initrd$extension"
-    fi
+    ln -s "initrd" "$out/initrd$extension"
  '';

  passthru = {
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@ -10,18 +10,16 @@
 # of algorithms.
 let
  # Some metadata on various compression programs, relevant to naming
-  # the initramfs file and, if applicable, generating a u-boot image
-  # from it.
+  # the initramfs file.
  compressors = import ./initrd-compressor-meta.nix;
  # Get the basename of the actual compression program from the whole
-  # compression command, for the purpose of guessing the u-boot
+  # compression command, for the purpose of guessing the
  # compression type and filename extension.
  compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;
 in
 {
  stdenvNoCC,
  cpio,
-  ubootTools,
  lib,
  pkgsBuildHost,
  # Name of the derivation (not of the resulting file!)
@ -65,22 +63,13 @@ in
  # symlinks to store paths.
  prepend ? [ ],

-  # Whether to wrap the initramfs in a u-boot image.
-  makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target or "dummy" == "uImage",
-
-  # If generating a u-boot image, the architecture to use. The default
-  # guess may not align with u-boot's nomenclature correctly, so it can
-  # be overridden.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.
-  uInitrdArch ? stdenvNoCC.hostPlatform.linuxArch,
-
-  # The name of the compression, as recognised by u-boot.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.
-  # If this isn't guessed, you may want to complete the metadata above and send a PR :)
-  uInitrdCompression ?
-    _compressorMeta.ubootName
-      or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
+  # Deprecated; remove in 27.05.
+  makeUInitrd ? null,
+  uInitrdArch ? null,
+  uInitrdCompression ? null,
 }:
+assert lib.assertMsg (makeUInitrd == null && uInitrdArch == null && uInitrdCompression == null)
+  "makeInitrd: U‐Boot legacy image support has been removed as it is deprecated upstream and ARMv5 kernels no longer default to uImage";
 stdenvNoCC.mkDerivation (finalAttrs: {
  __structuredAttrs = true;

@ -91,18 +80,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  inherit
    name
    extension
-    makeUInitrd
-    uInitrdArch
    prepend
    ;
-  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;

  builder = ./make-initrd.sh;

  nativeBuildInputs = [
    cpio
-  ]
-  ++ lib.optional makeUInitrd ubootTools;
+  ];

  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";

--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@ -36,10 +36,4 @@ done
 (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
 (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")

-if [ -n "$makeUInitrd" ]; then
-  mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-  # Compatibility symlink
-  ln -sf "initrd.img" "$out/initrd"
-else
-  ln -s "initrd" "$out/initrd$extension"
-fi
+ln -s "initrd" "$out/initrd$extension"
--- a/pkgs/by-name/_8/_86box/package.nix
+++ b/pkgs/by-name/_8/_86box/package.nix
@ -2,7 +2,6 @@
  stdenv,
  lib,
  fetchFromGitHub,
-  fetchpatch,
  cmake,
  kdePackages,
  pkg-config,
@ -21,6 +20,7 @@
  discord-gamesdk,
  libpcap,
  libslirp,
+  libserialport,
  wayland,
  wayland-scanner,
  libsndfile,
@ -41,24 +41,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "86box";
-  version = "5.3";
+  version = "6.0";

  src = fetchFromGitHub {
    owner = "86Box";
    repo = "86Box";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n68Ghhsv15TzpOMH4dBTNxa6AYwqN5s2C5pyO9VVaco=";
+    hash = "sha256-Qm7y/7LpBopti0K+jrC9TgORfFGjFYP/4rYPr7802gw=";
  };

  patches = [
    ./darwin.patch
-    # Fix build: Only make the fallthrough define available in C code
-    # https://github.com/86Box/86Box/issues/6607
-    (fetchpatch {
-      name = "fix-fallthrough-define-c-only.patch";
-      url = "https://github.com/86Box/86Box/commit/0092ce15de3efac108b961882f870a8c05e8c38f.patch";
-      hash = "sha256-DqjOtnyk6Zv9XHCLeuxD1wcLfvjGwGFvUWS0alXcchs=";
-    })
  ];

  postPatch = ''
@ -87,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
    jack2
    libpcap
    libslirp
+    libserialport
    qt5.qtbase
    qt5.qttools
    libsndfile
@ -105,6 +99,9 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags =
    lib.optional stdenv.hostPlatform.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"
+    # On Darwin, 86Box ignores pkg-config for libserialport and links
+    # $LIBSERIALPORT_ROOT/lib/libserialport.dylib directly, so point it at the store path.
+    ++ lib.optional stdenv.hostPlatform.isDarwin "-DLIBSERIALPORT_ROOT=${libserialport}"
    ++ lib.optional enableNewDynarec "-DNEW_DYNAREC=ON"
    ++ lib.optional enableVncRenderer "-DVNC=ON"
    ++ lib.optional (!enableDynarec) "-DDYNAREC=OFF"
@ -114,9 +111,9 @@ stdenv.mkDerivation (finalAttrs: {
    lib.optionalString stdenv.hostPlatform.isLinux ''
      install -Dm644 -t $out/share/applications $src/src/unix/assets/net.86box.86Box.desktop

-      for size in 48 64 72 96 128 192 256 512; do
-        install -Dm644 -t $out/share/icons/hicolor/"$size"x"$size"/apps \
-          $src/src/unix/assets/"$size"x"$size"/net.86box.86Box.png
+      for icon in $src/src/unix/assets/*x*/net.86box.86Box.png; do
+        size=$(basename "$(dirname "$icon")")
+        install -Dm644 -t $out/share/icons/hicolor/"$size"/apps "$icon"
      done;
    ''
    + lib.optionalString unfreeEnableRoms ''
@ -129,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
      owner = "86Box";
      repo = "roms";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-7/xhhT29ijGNVlW7oJXdyJuhUwVs0b4dIUjc3lVtNEY=";
+      hash = "sha256-AjFxyxW6Op4w637k5AXPtibqablVoPK03Axh2h2JWdI=";
    };
    updateScript = ./update.sh;
  };
--- a/pkgs/by-name/_9/_90secondportraits/package.nix
+++ b/pkgs/by-name/_9/_90secondportraits/package.nix
@ -77,6 +77,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Silly speed painting game";
+    homepage = "https://github.com/SimonLarsen/90-Second-Portraits";
    mainProgram = "90secondportraits";
    platforms = love.meta.platforms;
    license = with lib.licenses; [
--- a/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
+++ b/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "agkozak-zsh-prompt";
-  version = "3.11.4";
+  version = "3.11.5";

  src = fetchFromGitHub {
    owner = "agkozak";
    repo = "agkozak-zsh-prompt";
    tag = "v${version}";
-    sha256 = "sha256-FC9LIZaS6fV20qq6cJC/xQvfsM3DHXatVleH7yBgoNg=";
+    sha256 = "sha256-C9lyOm2+RVLOUSO5Vz013uTobnN+SBE1Jm8GuJZ7T7U=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ai/aitrack/package.nix
+++ b/pkgs/by-name/ai/aitrack/package.nix
@ -44,6 +44,7 @@ stdenv.mkDerivation {

  meta = {
    description = "6DoF Head tracking software";
+    homepage = "https://github.com/mdk97/aitrack-linux";
    mainProgram = "aitrack";
    maintainers = with lib.maintainers; [ ck3d ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/al/alkimia/package.nix
+++ b/pkgs/by-name/al/alkimia/package.nix
@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Library used by KDE finance applications";
+    homepage = "https://invent.kde.org/office/alkimia";
    mainProgram = "onlinequoteseditor5";
    longDescription = ''
      Alkimia is the infrastructure for common storage and business
--- a/pkgs/by-name/al/alpaca-proxy/package.nix
+++ b/pkgs/by-name/al/alpaca-proxy/package.nix
@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "alpaca-proxy";
-  version = "2.0.12";
+  version = "2.0.13";

  src = fetchFromGitHub {
    owner = "samuong";
    repo = "alpaca";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yz90kJGyf2iA3LCj9d/oG5rLVUZVI//cqI6w67iV9Tc=";
+    hash = "sha256-dzTWruf/1eU34UeLzZkTSxbAqhCfxRuXMPYuKPGImUc=";
  };

-  vendorHash = "sha256-3A88gc8j0OrxBIAFBNlz3Np5CV9xpwwIDCnnfXyBj4Q=";
+  vendorHash = "sha256-pxCMomMmHqPWdjLi7C4LfcjbgdjMzJVvyhOd1YmHWTU=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/an/anytype-cli/package.nix
+++ b/pkgs/by-name/an/anytype-cli/package.nix
@ -9,16 +9,16 @@ buildGoModule (finalAttrs: {
  __structuredAttrs = true;

  pname = "anytype-cli";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "anyproto";
    repo = "anytype-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9jJ4FV4ASUrhUvW/lI4qs7AmK06OkPfnD0+okl5blrs=";
+    hash = "sha256-t1EdNrXmG1kTMx17Ni5jM81V1bfZTGA2jMDm+wdqKAE=";
  };

-  vendorHash = "sha256-7J/nW4Jn2vdAs8sN+rV3wg6nV3JhtQrnLwlxNI0uja0=";
+  vendorHash = "sha256-/yF5niHBEPKvIGoWUVvZ00vrEaxG5s3kK5uFNdGCYcA=";
  proxyVendor = true;

  env.CGO_ENABLED = 1;
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@ -7,11 +7,11 @@

 let
  pname = "apidog";
-  version = "2.8.30";
+  version = "2.8.32";

  src = fetchurl {
    url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-h5h/zhUbnYYtYVyWySLZk3QISd4VWs5Gl/JdhgMJKh8=";
+    hash = "sha256-7MaDC9VsiC+iHe83Vd4vDJQPoDLwUFmCu3R1OwVcTjM=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "apko";
-  version = "1.2.13";
+  version = "1.2.14";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "apko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T074IzGgs0mDX4u5L96Xa0bGwpCLVYu3hNrN/7JzF1U=";
+    hash = "sha256-+yvQK6mrDT9MOeJsEJp4maycz6jpyAnGkc4QddaCbDo=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-Sq++amIZ5jdi/D499A8JRkr7yYPHkMXjU2yHOE8p3h4=";
+  vendorHash = "sha256-ITxeRtPJmLEqD8BundfWdQO10XGHaElL2vpYFSM24pQ=";

  excludedPackages = [
    "internal/gen-jsonschema"
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@ -23,13 +23,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "aquamarine";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "aquamarine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nGiqEpbQK/tg7Mzyb8kIik9uDcm3cInWDcHRquFAOS4=";
+    hash = "sha256-TtAhxedbRAl1u6OyT+4eRxZ417G2NMJNoqEbIhjvWo0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ar/archivemount/package.nix
+++ b/pkgs/by-name/ar/archivemount/package.nix
@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
+    homepage = "https://git.sr.ht/~nabijaczleweli/archivemount-ng";
    changelog = "https://git.sr.ht/~nabijaczleweli/archivemount-ng/refs/${finalAttrs.version}";
    mainProgram = "archivemount";
    license = [
--- a/pkgs/by-name/ar/argpp/package.nix
+++ b/pkgs/by-name/ar/argpp/package.nix
@ -31,6 +31,7 @@ stdenv.mkDerivation {

  meta = {
    description = "Argument Parser for C++";
+    homepage = "https://github.com/Grumbel/argpp";
    maintainers = [ lib.maintainers.SchweGELBin ];
    platforms = lib.platforms.linux;
    license = lib.licenses.free;
--- a/pkgs/by-name/as/asterisk-module-sccp/package.nix
+++ b/pkgs/by-name/as/asterisk-module-sccp/package.nix
@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Replacement for the SCCP channel driver in Asterisk";
+    homepage = "https://github.com/chan-sccp/chan-sccp";
    license = lib.licenses.gpl1Only;
    maintainers = with lib.maintainers; [ das_j ];
    # https://github.com/chan-sccp/chan-sccp/issues/609
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "audacious";
-  version = "4.5.1";
+  version = "4.6";

  src = fetchFromGitHub {
    owner = "audacious-media-player";
    repo = "audacious";
    rev = "${pname}-${version}";
-    hash = "sha256-1+RyGMUrotFdNCNpxzKpXGafKn9kNtzEyRVefUmJexU=";
+    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/au/augustus-go/package.nix
+++ b/pkgs/by-name/au/augustus-go/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "augustus-go";
-  version = "0.0.8";
+  version = "0.0.10";

  src = fetchFromGitHub {
    owner = "praetorian-inc";
    repo = "augustus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yC7Wxx7PCWLpIMdXieks7oTdW5Ot6e6zIJHnRyZUOlo=";
+    hash = "sha256-Lh0N2wWTPCsWWaiIcntCqeMIo9ZPGhMEwy0pP42iLzY=";
  };

-  vendorHash = "sha256-4PQX87yICvP6h4IPjFTWnhbftPBx53im95V0oiL3v6E=";
+  vendorHash = "sha256-LPBv1i2F5hgJBXBcuZiBwgY0S5OGi0B9Nmy488mbaBQ=";

  ldflags = [ "-s" ];

--- a/pkgs/by-name/ba/bacnet-stack/package.nix
+++ b/pkgs/by-name/ba/bacnet-stack/package.nix
@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "BACnet open source protocol stack for embedded systems, Linux, and Windows";
+    homepage = "https://github.com/bacnet-stack/bacnet-stack";
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ WhittlesJr ];
--- a/pkgs/by-name/ba/badvpn/package.nix
+++ b/pkgs/by-name/ba/badvpn/package.nix
@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Set of network-related (mostly VPN-related) tools";
+    homepage = "https://github.com/ambrop72/badvpn";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ raskin ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/ba/bam/package.nix
+++ b/pkgs/by-name/ba/bam/package.nix
@ -37,6 +37,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Yet another build manager";
+    homepage = "https://github.com/matricks/bam";
    mainProgram = "bam";
    maintainers = with lib.maintainers; [
      raskin
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@ -31,14 +31,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "4.7.0";
+  version = "4.8.0";
  pname = "baresip";

  src = fetchFromGitHub {
    owner = "baresip";
    repo = "baresip";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IfzLwK6mDfMPug6vRfsOJwByP6LwGkefh8lBC75eVbU=";
+    hash = "sha256-QAlpOikf6T/YfAtvrOJy0lJX3vRGLCBa+g2sYBcGmt0=";
  };

  patches = [
--- a/pkgs/by-name/ba/bash_unit/package.nix
+++ b/pkgs/by-name/ba/bash_unit/package.nix
@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Bash unit testing enterprise edition framework for professionals";
+    homepage = "https://github.com/bash-unit/bash_unit";
    maintainers = with lib.maintainers; [ pamplemousse ];
    platforms = lib.platforms.all;
    license = lib.licenses.gpl3Plus;
--- a/pkgs/by-name/bg/bgs/package.nix
+++ b/pkgs/by-name/bg/bgs/package.nix
@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Extremely fast and small background setter for X";
+    homepage = "https://github.com/Gottox/bgs";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ pSub ];
--- a/pkgs/by-name/bi/bigpemu/package.nix
+++ b/pkgs/by-name/bi/bigpemu/package.nix
@ -11,12 +11,12 @@
 let
  bigpemu-unwrapped = stdenv.mkDerivation rec {
    pname = "BigPEmu";
-    version = "1.22";
+    version = "1.221";
    src = fetchurl {
      url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
        builtins.replaceStrings [ "." ] [ "" ] version
      }.tar.gz";
-      hash = "sha256-z1r04qdZ6LNqGb3HwpCMeyKP6vYJz2hAVsIyHAfJsbU=";
+      hash = "sha256-wP9hDyHV9VwBxATvmR2J92mls7iTyFcMAzvO9EEh7lc=";
    };

    installPhase = ''
--- a/pkgs/by-name/bi/biosdevname/package.nix
+++ b/pkgs/by-name/bi/biosdevname/package.nix
@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Udev helper for naming devices per BIOS names";
+    homepage = "https://github.com/dell/biosdevname";
    license = lib.licenses.gpl2Only;
    platforms = [
      "x86_64-linux"
--- a/pkgs/by-name/bl/blobfuse/package.nix
+++ b/pkgs/by-name/bl/blobfuse/package.nix
@ -36,6 +36,7 @@ buildGoModule {

  meta = {
    description = "Mount an Azure Blob storage as filesystem through FUSE";
+    homepage = "https://github.com/Azure/azure-storage-fuse";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jbgi ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/bo/bodyclose/package.nix
+++ b/pkgs/by-name/bo/bodyclose/package.nix
@ -1,35 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  unstableGitUpdater,
-}:
-
-buildGoModule {
-  pname = "bodyclose";
-  version = "0-unstable-2024-12-22";
-
-  src = fetchFromGitHub {
-    owner = "timakin";
-    repo = "bodyclose";
-    rev = "1db5c5ca4d6719fe28430df1ae8d337ee2ac09c7";
-    hash = "sha256-s5bWvpV6gHGEsuiNXJl2ZuyDaffD82/rCbusov3zsyw=";
-  };
-
-  vendorHash = "sha256-8grdJuV8aSETsJr2VazC/3ctfnGh3UgjOWD4/xf3uC8=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = {
-    description = "Golang linter to check whether HTTP response body is closed and a re-use of TCP connection is not blocked";
-    mainProgram = "bodyclose";
-    homepage = "https://github.com/timakin/bodyclose";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ meain ];
-  };
-}
--- a/pkgs/by-name/bo/boring/package.nix
+++ b/pkgs/by-name/bo/boring/package.nix
@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "boring";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "alebeck";
    repo = "boring";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cyRy7lF2wGupzDnW4zPKEuM0X0aaHrWbF/3p13xb2DA=";
+    hash = "sha256-WdohrSeq2N1zDQlYnwIMn1FF3IIb3zAiLSuOOf2GioU=";
  };

  nativeBuildInputs = [
@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/boring" ];

-  vendorHash = "sha256-4YU0l2YhlMQzcKSMhXt3oEeCk87Yu90esiPelRs5/OQ=";
+  vendorHash = "sha256-yjqJ7G9n3c1ABLWynswzLP7B6bSwH1dIYKfVZqJX30g=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/bo/boxed-cpp/package.nix
+++ b/pkgs/by-name/bo/boxed-cpp/package.nix
@ -23,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Boxing primitive types in C++";
+    homepage = "https://github.com/contour-terminal/boxed-cpp";
    license = lib.licenses.asl20;
    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.moni ];
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftrace";
-  version = "0.25.1";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "bpftrace";
    repo = "bpftrace";
    rev = "v${version}";
-    hash = "sha256-nVBIS6cgCY9ZhzVrWBY6hXI0se9zAWMKnvHuJap3x3c=";
+    hash = "sha256-NYMMQKOWCLbECQX1FPYaLcQyO3H+LHCw02bF1sWsMuY=";
  };

  buildInputs = with llvmPackages; [
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "btrfs-progs";
-  version = "6.19.1";
+  version = "7.0";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${finalAttrs.version}.tar.xz";
-    hash = "sha256-uyfh7FTnw8C3suWW+FOnPAej1y8hvJQEIHPCTb8EV5Y=";
+    hash = "sha256-wobWh2y81yMnoLQX5M/SgDU+wj43tUn9vNeACoMtmpk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/capstone/package.nix
+++ b/pkgs/by-name/ca/capstone/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "capstone";
-  version = "5.0.7";
+  version = "5.0.9";

  src = fetchFromGitHub {
    owner = "capstone-engine";
    repo = "capstone";
    rev = finalAttrs.version;
-    hash = "sha256-+6QReHZK+iIXspizy6Kvk7cj016HOKgiaKSaP4h7mao=";
+    hash = "sha256-uAiiKWKGjEATPE0Xc3g+aOLCz5ffIlDmf+7jaGwaZ4I=";
  };

  cmakeFlags = [
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "chroma";
-  version = "2.25.0";
+  version = "2.26.1";

  src = fetchFromGitHub {
    owner = "alecthomas";
    repo = "chroma";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K2r863R1ckroKVsxMXZanxfTnMrkFtch1ZFYLUb0mMc=";
+    hash = "sha256-kOhPaiqtFU3H43jz+GjfOOIVEy5acpP9SwQ1/2xsMQc=";
  };

-  vendorHash = "sha256-lamMRKrGF0b5mfXMCsQid/UO6AyuKryJX7cKIRJho1c=";
+  vendorHash = "sha256-mPB7qPPMIQLjmyN2T7qX/X1Ip0E4X0jNv5h+UfVEHrY=";

  modRoot = "./cmd/chroma";

--- a/pkgs/by-name/ci/cidrgrep/package.nix
+++ b/pkgs/by-name/ci/cidrgrep/package.nix
@ -23,6 +23,7 @@ buildGoModule {

  meta = {
    description = "Like grep but for IPv4 CIDRs";
+    homepage = "https://github.com/tomdoherty/cidrgrep";
    mainProgram = "cidrgrep";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ das_j ];
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "circumflex";
-  version = "4.1.1";
+  version = "4.3";

  src = fetchFromGitHub {
    owner = "bensadeh";
    repo = "circumflex";
    tag = finalAttrs.version;
-    hash = "sha256-2eCxk5FynwKt0T9cseesre+dumy5K5uZZAt++R+aTxw=";
+    hash = "sha256-VyUJ7qiaodLTdfGyh3/tLGfNVZCAxImxOuz4ztaaqtg=";
  };

-  vendorHash = "sha256-in6yPiT/SqRaw6hFF2gCmBwGcJ315Qej3HuM7TF5MaE=";
+  vendorHash = "sha256-4YL0N8wA8igveYfeL4uZDY5YD1InW0iD3WWq1E/vIJs=";

  nativeBuildInputs = [ makeWrapper ];

--- a/Show more
+++ b/Show more