Merge 691bc285bc into haskell-updates

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,7 +13,6 @@ For new packages please briefly describe the package or provide a link to its ho
 - Built on platform:
   - [ ] x86_64-linux
   - [ ] aarch64-linux
-  - [ ] x86_64-darwin
   - [ ] aarch64-darwin
 - Tested, as applicable:
   - [ ] [NixOS tests] in [nixos/tests].

.github/workflows/build.yml

@@ -34,21 +34,18 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            name: x86_64-linux
-            systems: x86_64-linux
+            system: x86_64-linux
             builds: [shell, manual-nixos, lib-tests, tarball]
             desc: shell, docs, lib, tarball
           - runner: ubuntu-24.04-arm
-            name: aarch64-linux
-            systems: aarch64-linux
+            system: aarch64-linux
             builds: [shell, manual-nixos, manual-nixpkgs]
             desc: shell, docs
           - runner: macos-14
-            name: darwin
-            systems: aarch64-darwin x86_64-darwin
+            system: aarch64-darwin
             builds: [shell]
             desc: shell
-    name: '${{ matrix.name }}: ${{ matrix.desc }}'
+    name: '${{ matrix.system }}: ${{ matrix.desc }}'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
@@ -80,7 +77,9 @@ jobs:
 
       - name: Build shell
         if: contains(matrix.builds, 'shell')
-        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
+        env:
+          system: ${{ matrix.system }}
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system "$system"
 
       - name: Build NixOS manual
         if: |
@@ -108,5 +107,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.system }}
           path: nixos-manual

ci/OWNERS

@@ -223,10 +223,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
-/pkgs/build-support/rust @winterqt
+/pkgs/development/compilers/rust @NixOS/rust @alyssais
+/pkgs/build-support/rust @NixOS/rust
 /pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @winterqt
+/doc/languages-frameworks/rust.section.md @NixOS/rust
 
 # Tcl
 /pkgs/development/interpreters/tcl  @fgaz

doc/languages-frameworks/javascript.section.md

@@ -408,6 +408,8 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.

doc/release-notes/rl-2611.section.md

@@ -18,6 +18,9 @@
 
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
+- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
+  Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:

maintainers/maintainer-list.nix

@@ -3946,6 +3946,13 @@
     githubId = 140968250;
     keys = [ { fingerprint = "8321 ED3A 8DB9 99A5 1F3B  F80F F268 2914 EA42 DE26"; } ];
   };
+  Br1ght0ne = {
+    name = "Oleksii Filonenko";
+    email = "nixpkgs@brightone.cloud";
+    matrix = "@br1ght0ne:matrix.org";
+    github = "Br1ght0ne";
+    githubId = 12615679;
+  };
   br337 = {
     email = "brian.porumb@proton.me";
     github = "br337";
@@ -4737,12 +4744,6 @@
     githubId = 32384814;
     name = "Nikita Mitasov";
   };
-  chaduffy = {
-    email = "charles@dyfis.net";
-    github = "charles-dyfis-net";
-    githubId = 22370;
-    name = "Charles Duffy";
-  };
   changlinli = {
     email = "mail@changlinli.com";
     github = "changlinli";
@@ -10208,6 +10209,11 @@
     githubId = 13297896;
     name = "David Isaksson";
   };
+  grandjeanlab = {
+    github = "grandjeanlab";
+    githubId = 22633767;
+    name = "grandjeanlab";
+  };
   gravndal = {
     email = "gaute.ravndal+nixos@gmail.com";
     github = "gravndal";
@@ -14454,6 +14460,13 @@
     githubId = 7587245;
     name = "Kit Langton";
   };
+  Kitsune = {
+    name = "Lunae V";
+    github = "KitsuneDev";
+    githubId = 11809449;
+    email = "kitsune@akitsune.dev";
+    matrix = "@kitsune:akitsune.dev";
+  };
   kitsunoff = {
     github = "kitsunoff";
     githubId = 58953114;
@@ -14619,8 +14632,7 @@
   };
   koi = {
     name = "june";
-    email = "me@koi.rip";
-    matrix = "@koi:nelliel.cv";
+    email = "packages@koi.rip";
     github = "koibtw";
     githubId = 75480869;
     keys = [
@@ -26086,6 +26098,12 @@
     githubId = 13762043;
     matrix = "@sophie:nue.soopy.moe";
   };
+  sophiebsw = {
+    name = "Sophia";
+    email = "nixpkgs@drifter.dev";
+    github = "sophiebsw";
+    githubId = 4594464;
+  };
   sophronesis = {
     email = "oleksandr.buzynnyi@gmail.com";
     github = "sophronesis";
@@ -28690,7 +28708,7 @@
   uku3lig = {
     name = "uku";
     email = "hi@uku.moe";
-    matrix = "@uku:m.uku.moe";
+    matrix = "@uku:rei.uku.moe";
     github = "uku3lig";
     githubId = 61147779;
   };

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -24,11 +24,11 @@
     # Pinned Nixpkgs archive
     #
     # Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
-    # latest commit of the stable channel and `nix --extra-experimental-features nix-command store prefetch-file --unpack`
-    # to compute its hash.
+    # latest commit of the stable channel and `nix-prefetch-url --unpack`
+    # to compute its sha256 hash.
     nixpkgs = builtins.fetchTarball {
       url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
-      hash = "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=";
+      sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
     };
   in
   import "${nixpkgs}/nixos" {

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,6 +18,8 @@
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
+- [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
@@ -60,4 +62,8 @@
 
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
+- `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
+  This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
+  This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/module-list.nix

@@ -1798,6 +1798,7 @@
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
   ./services/web-apps/strichliste.nix
+  ./services/web-apps/stump.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix

nixos/modules/programs/vscode.nix

@@ -7,6 +7,7 @@
 
 let
   cfg = config.programs.vscode;
+  jsonFormat = pkgs.formats.json { };
 in
 {
   options.programs.vscode = {
@@ -36,6 +37,21 @@ in
       description = "List of extensions to install.";
     };
 
+    enterprisePolicies = lib.mkOption {
+      type = jsonFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          "UpdateMode" = "none";
+          "TelemetryLevel" = "off";
+        }
+      '';
+      description = ''
+        System-wide policies for VSCode in `/etc/vscode/policy.json`.
+        See <https://code.visualstudio.com/docs/setup/enterprise#_centrally-manage-vs-code-settings> for more information.
+      '';
+    };
+
     finalPackage = lib.mkOption {
       type = lib.types.package;
       visible = false;
@@ -45,13 +61,19 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [
-      cfg.finalPackage
-    ];
+    environment = {
+      systemPackages = [
+        cfg.finalPackage
+      ];
 
-    environment.sessionVariables.EDITOR = lib.mkIf cfg.defaultEditor (
-      lib.mkOverride 900 cfg.finalPackage.meta.mainProgram
-    );
+      sessionVariables.EDITOR = lib.mkIf cfg.defaultEditor (
+        lib.mkOverride 900 cfg.finalPackage.meta.mainProgram
+      );
+
+      etc."vscode/policy.json" = lib.mkIf (cfg.enterprisePolicies != { }) {
+        source = jsonFormat.generate "vscode-policy.json" cfg.enterprisePolicies;
+      };
+    };
 
     programs.vscode.finalPackage = pkgs.vscode-with-extensions.override {
       vscode = cfg.package;

nixos/modules/services/databases/mysql.nix

@@ -293,6 +293,19 @@ in
         '';
       };
 
+      secureSuperUserByDefault = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to automatically secure the root@localhost user with auth_socket authentication.
+
+          ::: {.note}
+          When enabled (default), the module will ensure root@localhost uses socket authentication,
+          preventing any local user from connecting as root without proper credentials.
+          :::
+        '';
+      };
+
       replication = {
         role = lib.mkOption {
           type = lib.types.enum [
@@ -411,6 +424,10 @@ in
         assertion = !cfg.galeraCluster.enable || isMariaDB;
         message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
       }
+      {
+        assertion = !isMariaDB || cfg.secureSuperUserByDefault == true;
+        message = "'services.mysql.secureSuperUserByDefault' has no effect on MariaDB (which is already secure by default)";
+      }
     ]
     # galeraCluster options checks
     ++ lib.optionals cfg.galeraCluster.enable [
@@ -571,6 +588,7 @@ in
         let
           # The super user account to use on *first* run of MySQL server
           superUser = if isMariaDB then cfg.user else "root";
+          isStateVersion2611Plus = lib.versionAtLeast config.system.stateVersion "26.11";
         in
         ''
           ${lib.optionalString isMariaDB ''
@@ -644,6 +662,11 @@ in
                 ) | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
               ${lib.optionalString (cfg.initialScript != null) ''
                 # Execute initial script
                 # using toString to avoid copying the file to nix store if given as path instead of string,
@@ -654,6 +677,27 @@ in
               rm ${cfg.dataDir}/mysql_init
           fi
 
+          ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+            # We try to detect if we are in the default insecure auth mode for MySQL (all users can connect with password)
+            # If the configuration has been moved to the socket-peer credential authentication we do nothing
+            # If we are not able to connect it also means the default setup has been adjusted, so we also skip and do not do any changes
+            if plugin_info=$(${cfg.package}/bin/mysql -u ${superUser} --skip-column-names 2>/dev/null -e "SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';"); then
+              case "$plugin_info" in
+                *auth_socket*) ;;
+                *)
+                  ${lib.optionalString isStateVersion2611Plus ''
+                    # Attempt to auto-fix to prevent local authentication without a password
+                    echo "Securing root@localhost with auth_socket to local connection without password, see https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                    echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+                  ''}
+                  ${lib.optionalString (!isStateVersion2611Plus) ''
+                    echo "Security warning: root@localhost seems to have open authentication, consider adjusting your configuration. See https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                  ''}
+                  ;;
+              esac
+            fi
+          ''}
+
           ${lib.optionalString (cfg.ensureDatabases != [ ]) ''
             (
             ${lib.concatMapStrings (database: ''

nixos/modules/services/networking/netbird.nix

@@ -340,7 +340,8 @@ in
                         substitute ${cfg.ui.package}/share/applications/netbird.desktop \
                             "$out/share/applications/${mkBin "netbird"}.desktop" \
                           --replace-fail 'Name=Netbird' "Name=NetBird @ ${client.service.name}" \
-                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/pixmaps/netbird.png"
+                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/icons/hicolor/256x256/apps/netbird.png" \
+                          --replace-fail 'Exec=netbird-ui' "Exec=${mkBin "netbird-ui"}"
                       '')
                     ];
                   };

nixos/modules/services/security/pocket-id.nix

@@ -70,10 +70,13 @@ in
         ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key";
       };
       description = ''
-        Environment variables which are loaded from the contents of the specified file paths.
+        Credentials which are loaded from the contents of the specified file paths.
+
         This can be used to securely store tokens and secrets outside of the world-readable Nix store.
 
-        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables) (all with the `_FILE` suffix).
+
+        Accepts an attrset mapping from the variable name *without its `_FILE` suffix* to the path on disk.
 
         Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file.
       '';

nixos/modules/services/ttys/getty.nix

@@ -133,7 +133,7 @@ in
 
   ###### implementation
 
-  config = mkIf config.console.enable {
+  config = {
     # Note: this is set here rather than up there so that changing
     # nixos.label would not rebuild manual pages
     services.getty.greetingLine = mkDefault ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

nixos/modules/services/web-apps/plausible.md

@@ -20,6 +20,19 @@ After that, `plausible` can be deployed like this:
       # secretKeybaseFile is a path to the file which contains the secret generated
       # with openssl as described above.
       secretKeybaseFile = "/run/secrets/plausible-secret-key-base";
+      # With an admin user seeded (below), registration can be locked down
+      # so only invited users (or nobody) can create further accounts.
+      disableRegistration = "invite_only";
+    };
+    # If you do not declare `adminUser`, Plausible shows an unauthenticated
+    # "first launch" setup wizard where anybody reaching the instance can create
+    # the first admin account. That may be convenient, but is also a security
+    # risk if somebody else uses it before you do.
+    adminUser = {
+      email = "admin@analytics.example.org";
+      # passwordHashFile is a path to a file containing the bcrypt hash of the
+      # admin user's password, e.g. generated with `mkpasswd -m bcrypt`.
+      passwordHashFile = "/run/secrets/plausible-admin-password-hash";
     };
   };
 }

nixos/modules/services/web-apps/plausible.nix

@@ -10,6 +10,68 @@ with lib;
 let
   cfg = config.services.plausible;
 
+  seedAdminEnabled = cfg.adminUser.email != null;
+
+  # Note [plausible-seed-admin-no-wizard-race]:
+  # Plausible Community Edition shows an unauthenticated "first launch" setup
+  # wizard to create the admin user whenever no user exists in the database
+  # (`Plausible.Release.should_be_first_launch?` is
+  # `not Repo.exists?(Plausible.Auth.User)`, and `PlausibleWeb.FirstLaunchPlug`
+  # 302-redirects every page to `/register` while that is true). On an instance
+  # reachable over the network this lets any stranger create the first admin
+  # account.
+  #
+  # `DISABLE_REGISTRATION` does NOT gate this wizard (it must not, otherwise the
+  # first user could never be created), so the only robust fix is to ensure a
+  # user already exists before the web server accepts any connection.
+  #
+  # We therefore seed the admin user inside the service's main `script`, after
+  # the DB migrations and strictly before `exec plausible start`. This
+  # guarantees there is no time window in which the wizard is reachable. The
+  # seed is idempotent (it only inserts when no user exists), so it is safe to
+  # run on every (re)start.
+  #
+  # We insert the precomputed bcrypt `password_hash` directly rather than going
+  # through `Plausible.Auth.User.new/1`, so the plaintext password never has to
+  # be stored on disk. `email_verified` is set to `true` because self-hosted
+  # Plausible does not require email verification by default.
+  #
+  # This Elixir script may need updating as newer Plausible versions get
+  # released (e.g. if the `Plausible.Auth.User` schema changes). The NixOS VM
+  # test `nixos/tests/plausible.nix` validates that the wizard is unreachable
+  # once an admin user is configured.
+  seedAdminScript = pkgs.writeText "plausible-seed-admin.exs" ''
+    # This script runs via `plausible eval`, which evaluates it WITHOUT
+    # starting the `:plausible` application or its Ecto repos. We therefore
+    # start them ourselves before querying/inserting, mirroring the private
+    # `Plausible.Release.prepare/0` (the same startup the release uses for its
+    # `migrate`/`seed` commands): load the app, start the DB-related apps and
+    # start each Ecto repo. Otherwise `Repo.exists?/1` raises
+    # `could not lookup Ecto repo Plausible.Repo because it was not started`.
+    :ok = Application.ensure_loaded(:plausible)
+    Enum.each([:ssl, :postgrex, :ch, :ecto], &Application.ensure_all_started/1)
+    Enum.each(Application.fetch_env!(:plausible, :ecto_repos), & &1.start_link(pool_size: 2))
+
+    alias Plausible.Repo
+    alias Plausible.Auth.User
+
+    unless Repo.exists?(User) do
+      email = System.fetch_env!("SEED_ADMIN_USER_EMAIL")
+      name = System.fetch_env!("SEED_ADMIN_USER_NAME")
+      password_hash = System.fetch_env!("SEED_ADMIN_USER_PASSWORD_HASH")
+
+      %User{
+        email: email,
+        name: name,
+        password_hash: password_hash,
+        email_verified: true
+      }
+      |> Repo.insert!()
+
+      IO.puts("plausible: seeded admin user #{email}")
+    end
+  '';
+
 in
 {
   options.services.plausible = {
@@ -51,6 +113,57 @@ in
       };
     };
 
+    adminUser = {
+      email = mkOption {
+        default = null;
+        type = types.nullOr types.str;
+        description = ''
+          Email address of an admin user to seed into the database before the
+          Plausible web server starts accepting connections.
+
+          Plausible Community Edition shows an unauthenticated "first launch"
+          setup wizard whenever no user exists in the database, which redirects
+          every page to `/register` and lets anyone reaching the instance over
+          the network create the first admin account. Setting this option (and
+          {option}`services.plausible.adminUser.passwordHashFile`) seeds an
+          admin user before the port is opened, so the wizard is never reachable
+          by strangers.
+
+          When `null`, no user is seeded and Plausible's setup wizard is used as
+          usual.
+
+          Seeding is idempotent: if any user already exists, no user is created.
+        '';
+        example = "admin@example.org";
+      };
+
+      name = mkOption {
+        default = "Admin";
+        type = types.str;
+        description = ''
+          Display name of the seeded admin user (see
+          {option}`services.plausible.adminUser.email`).
+        '';
+      };
+
+      passwordHashFile = mkOption {
+        default = null;
+        type = with types; nullOr (either str path);
+        description = ''
+          Path to a file containing the bcrypt hash of the seeded admin user's
+          password (see {option}`services.plausible.adminUser.email`).
+
+          Using a hash file (rather than the plaintext password) means the
+          plaintext never has to be stored on disk or in the Nix store. Generate
+          a hash e.g. with `mkpasswd -m bcrypt` (the resulting `$2b$...` string).
+
+          This file is read via systemd's `LoadCredential`, so it does not enter
+          the Nix store.
+        '';
+        example = "/run/secrets/plausible-admin-password-hash";
+      };
+    };
+
     server = {
       disableRegistration = mkOption {
         default = true;
@@ -150,33 +263,34 @@ in
     (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ]
       "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed"
     )
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "name"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "email"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "passwordFile"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "activate"
-    ] "Admin user is now created using first start wizard")
+    (mkRemovedOptionModule
+      [
+        "services"
+        "plausible"
+        "adminUser"
+        "passwordFile"
+      ]
+      "Use services.plausible.adminUser.passwordHashFile instead, which keeps the plaintext password out of the Nix store"
+    )
+    (mkRemovedOptionModule
+      [
+        "services"
+        "plausible"
+        "adminUser"
+        "activate"
+      ]
+      "The seeded admin user is always created as email-verified; self-hosted Plausible does not require email verification"
+    )
   ];
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = seedAdminEnabled -> (cfg.adminUser.passwordHashFile != null);
+        message = "services.plausible.adminUser.passwordHashFile must be set when services.plausible.adminUser.email is set.";
+      }
+    ];
+
     services.postgresql = mkIf cfg.database.postgres.setup {
       enable = true;
     };
@@ -285,6 +399,18 @@ in
             ''}
 
             ${cfg.package}/migrate.sh
+
+            ${lib.optionalString seedAdminEnabled ''
+              # Seed the admin user before the web server starts, so the
+              # unauthenticated "first launch" setup wizard is never reachable;
+              # see note [plausible-seed-admin-no-wizard-race].
+              export SEED_ADMIN_USER_EMAIL=${lib.escapeShellArg cfg.adminUser.email}
+              export SEED_ADMIN_USER_NAME=${lib.escapeShellArg cfg.adminUser.name}
+              SEED_ADMIN_USER_PASSWORD_HASH="$(< "$CREDENTIALS_DIRECTORY/ADMIN_USER_PASSWORD_HASH" )"
+              export SEED_ADMIN_USER_PASSWORD_HASH
+              plausible eval "$(< ${seedAdminScript} )"
+            ''}
+
             export IP_GEOLOCATION_DB=${pkgs.dbip-country-lite}/share/dbip/dbip-country-lite.mmdb
 
             exec plausible start
@@ -300,6 +426,9 @@ in
             ]
             ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [
               "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"
+            ]
+            ++ lib.optionals seedAdminEnabled [
+              "ADMIN_USER_PASSWORD_HASH:${cfg.adminUser.passwordHashFile}"
             ];
           };
         };

nixos/modules/services/web-apps/stump.nix

@@ -0,0 +1,172 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.stump;
+
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    ;
+
+  secret = types.nullOr (
+    types.str
+    // {
+      # We don't want users to be able to pass a path literal here but
+      # it should look like a path.
+      check = it: lib.isString it && lib.types.path.check it;
+    }
+  );
+in
+{
+  options.services.stump = {
+    enable = mkEnableOption "Stump";
+    package = lib.mkPackageOption pkgs "stump" { };
+
+    configLocation = mkOption {
+      type = types.path;
+      default = "/var/lib/stump";
+      description = "Directory used to store the database and configuration files. If it is not the default, the directory has to be created manually such that the stump user is able to read and write to it.";
+    };
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        STUMP_VERBOSITY = "2";
+      };
+      description = ''
+        Extra configuration environment variables. Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = secret;
+      example = "/run/secrets/stump";
+      default = null;
+      description = ''
+        Path of a file with extra environment variables to be loaded from disk.
+        This file is not added to the nix store, so it can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    secretFiles = mkOption {
+      type = types.attrsOf secret;
+      example = {
+        STUMP_OIDC_CLIENT_SECRET = "/run/secrets/stump_client_secret";
+      };
+      default = { };
+      description = ''
+        Attribute set containing paths to files to add to the environment of stump.
+        The files are not added to the nix store, so they can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    ip = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "The IP address that Stump will listen on.";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 10001;
+      description = "The port that Stump will listen on.";
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to open the Stump port in the firewall";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The user Stump should run as.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The group stump should run as.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    services.stump.environment = {
+      STUMP_IP = cfg.ip;
+      STUMP_PORT = toString cfg.port;
+      STUMP_CONFIG_DIR = cfg.configLocation;
+    };
+
+    systemd.services.stump = {
+      description = "Stump (A free and open source comics, manga and digital book server with OPDS support)";
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment;
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = 3;
+
+        ExecStart =
+          if cfg.secretFiles == { } then
+            "${lib.getExe cfg.package}"
+          else
+            pkgs.writeShellScript "stump-env" ''
+              ${lib.strings.concatStringsSep "\n" (
+                lib.attrsets.mapAttrsToList (key: path: "export ${key}=$(< \"${path}\")") cfg.secretFiles
+              )}
+              ${lib.getExe cfg.package}
+            '';
+        EnvironmentFile = cfg.environmentFile;
+        StateDirectory = "stump";
+        User = cfg.user;
+        Group = cfg.group;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK" # is used to determine local ip
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+
+    users.users = mkIf (cfg.user == "stump") {
+      stump = {
+        name = "stump";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "stump") { stump = { }; };
+
+    meta.maintainers = with lib.maintainers; [ jvanbruegge ];
+  };
+}

nixos/modules/virtualisation/nspawn-container/default.nix

@@ -107,9 +107,6 @@ in
       }
     ];
 
-    # TODO(arianvp): Remove after https://github.com/NixOS/nixpkgs/pull/480686 is merged
-    console.enable = true;
-
     virtualisation.systemd-nspawn.options = [
       "--private-network"
       "--machine=${config.system.name}"

nixos/tests/all-tests.nix

@@ -421,25 +421,25 @@ in
   corerad = runTest ./corerad.nix;
   corteza = runTest ./corteza.nix;
   cosmic = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin-noxwayland";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = false;
   };
   cosmic-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-noxwayland";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = false;
@@ -1061,6 +1061,7 @@ in
   mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix { };
   mysql-backup = handleTest ./mysql/mysql-backup.nix { };
   mysql-replication = handleTest ./mysql/mysql-replication.nix { };
+  mysql-secure-root = handleTest ./mysql/mysql-secure-root.nix { };
   n8n = runTest ./n8n.nix;
   nagios = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix;
   nar-serve = runTest ./nar-serve.nix;
@@ -1341,7 +1342,7 @@ in
   pixelfed = import ./web-apps/pixelfed { inherit runTestOn; };
   plantuml-server = runTest ./plantuml-server.nix;
   plasma6 = runTest ./plasma6.nix;
-  plausible = runTest ./plausible.nix;
+  plausible = import ./plausible.nix { inherit runTest; };
   playwright-python = runTest ./playwright-python.nix;
   please = runTest ./please.nix;
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };
@@ -1579,6 +1580,7 @@ in
   strichliste = runTest ./web-apps/strichliste.nix;
   strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
+  stump = runTest ./web-apps/stump.nix;
   stunnel = import ./stunnel.nix { inherit runTest; };
   sudo = runTest ./sudo.nix;
   sudo-rs = runTest ./sudo-rs.nix;

nixos/tests/alps.nix

@@ -61,7 +61,7 @@ in
           certs.ca.cert
         ];
         networking.extraHosts = ''
-          ${nodes.server.config.networking.primaryIPAddress} ${domain}
+          ${nodes.server.networking.primaryIPAddress} ${domain}
         '';
         services.alps = {
           enable = true;
@@ -83,7 +83,7 @@ in
 
             baseurl = "http://localhost:${toString config.services.alps.port}"
             username = "alice"
-            password = "${nodes.server.config.users.users.alice.password}"
+            password = "${nodes.server.users.users.alice.password}"
             cookiejar = CookieJar()
             cookieprocessor = HTTPCookieProcessor(cookiejar)
             opener = build_opener(cookieprocessor)
@@ -125,7 +125,7 @@ in
 
       client.start()
       client.wait_for_unit("alps.service")
-      client.wait_for_open_port(${toString nodes.client.config.services.alps.port})
+      client.wait_for_open_port(${toString nodes.client.services.alps.port})
       client.succeed("test-alps-login")
     '';
 }

nixos/tests/cage.nix

@@ -29,7 +29,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
     in
     ''
       with subtest("Wait for cage to boot up"):

nixos/tests/cagebreak.nix

@@ -47,7 +47,7 @@ in
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
       XDG_RUNTIME_DIR = "/run/user/${toString user.uid}";
     in
     ''

nixos/tests/containers-ip.nix

@@ -47,9 +47,9 @@ in
           # need to distinguish because show-ip won't work for ipv6
           if container == "webserver4":
               ip = machine.succeed(f"nixos-container show-ip {container}").rstrip()
-              assert ip == "${nodes.machine.config.containers.webserver4.localAddress}"
+              assert ip == "${nodes.machine.containers.webserver4.localAddress}"
               return ip
-          return "${nodes.machine.config.containers.webserver6.localAddress}"
+          return "${nodes.machine.containers.webserver6.localAddress}"
 
 
       for container in "webserver4", "webserver6":

nixos/tests/cosmic.nix

@@ -1,147 +0,0 @@
-{
-  config,
-  lib,
-  testName,
-  enableAutologin,
-  enableXWayland,
-  ...
-}:
-
-{
-  name = testName;
-
-  meta.maintainers = lib.teams.cosmic.members;
-
-  nodes.machine = {
-    imports = [ ./common/user-account.nix ];
-
-    services = {
-      # For `cosmic-store` to be added to `environment.systemPackages`
-      # and for it to work correctly because Flatpak is a runtime
-      # dependency of `cosmic-store`.
-      flatpak.enable = true;
-
-      displayManager.cosmic-greeter.enable = true;
-      desktopManager.cosmic = {
-        enable = true;
-        xwayland.enable = enableXWayland;
-      };
-    };
-
-    services.displayManager.autoLogin = lib.mkIf enableAutologin {
-      enable = true;
-      user = "alice";
-    };
-
-    environment.systemPackages = with config.node.pkgs; [
-      # These two packages are used to check if a window was opened
-      # under the COSMIC session or not. Kinda important.
-      # TODO: Move the check from the test module to
-      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
-      # Wayland-only testing can be done using the existing testing
-      # infrastructure.
-      jq
-      lswt
-    ];
-
-    # So far, all COSMIC tests launch a few GUI applications. In doing
-    # so, the default allocated memory to the guest of 1024M quickly
-    # poses a very high risk of an OOM-shutdown which is worse than an
-    # OOM-kill. Because now, the test failed, but not for a genuine
-    # reason, but an OOM-shutdown. That's an inconclusive failure
-    # which might possibly mask an actual failure. Not enabling
-    # systemd-oomd because we need said applications running for a
-    # few seconds. So instead, bump the allocated memory to the guest
-    # from 1024M to 4x; 4096M.
-    virtualisation.memorySize = 4096;
-  };
-
-  testScript =
-    { nodes, ... }:
-    let
-      cfg = nodes.machine;
-      user = cfg.users.users.alice;
-      DISPLAY = lib.strings.optionalString enableXWayland (
-        if enableAutologin then "DISPLAY=:0" else "DISPLAY=:1"
-      );
-      emptyPDF = config.node.pkgs.stdenvNoCC.mkDerivation {
-        name = "empty-pdf";
-        dontUnpack = true;
-        nativeBuildInputs = [ config.node.pkgs.imagemagick ];
-        buildPhase = ''
-          magick xc:none -page Letter empty.pdf
-        '';
-        installPhase = ''
-          mkdir $out
-          mv empty.pdf $out/empty.pdf
-        '';
-      };
-    in
-    ''
-      #testName: ${testName}
-    ''
-    + (
-      if enableAutologin then
-        ''
-          with subtest("cosmic-greeter initialisation"):
-              machine.wait_for_unit("graphical.target", timeout=120)
-        ''
-      else
-        ''
-          from time import sleep
-
-          machine.wait_for_unit("graphical.target", timeout=120)
-          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
-          # Sleep for 10 seconds for ensuring that `greetd` loads the
-          # password prompt for the login screen properly.
-          sleep(10)
-
-          with subtest("cosmic-session login"):
-              machine.send_chars("${user.password}\n", delay=0.2)
-        ''
-    )
-    + ''
-          # _One_ of the final processes to start as part of the
-          # `cosmic-session` target is the Workspaces applet. So, wait
-          # for it to start. The process existing means that COSMIC
-          # now handles any opened windows from now on.
-          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'", timeout=30)
-
-      # The best way to test for Wayland and XWayland is to launch
-      # the GUI applications and see the results yourself.
-      with subtest("Launch applications"):
-          # key: binary_name
-          # value: "app-id" as reported by `lswt`
-          gui_apps_to_launch = {}
-
-          # We want to ensure that the first-party applications
-          # start/launch properly.
-          gui_apps_to_launch['cosmic-edit'] = 'com.system76.CosmicEdit'
-          gui_apps_to_launch['cosmic-files'] = 'com.system76.CosmicFiles'
-          gui_apps_to_launch['cosmic-player'] = 'com.system76.CosmicPlayer'
-          gui_apps_to_launch['cosmic-reader'] = 'com.system76.CosmicReader'
-          gui_apps_to_launch['cosmic-settings'] = 'com.system76.CosmicSettings'
-          gui_apps_to_launch['cosmic-store'] = 'com.system76.CosmicStore'
-          gui_apps_to_launch['cosmic-term'] = 'com.system76.CosmicTerm'
-
-          for gui_app, app_id in gui_apps_to_launch.items():
-              # Don't fail the test if binary is absent
-              if machine.execute(f"su - ${user.name} -c 'command -v {gui_app}'", timeout=5)[0] == 0:
-                  match gui_app:
-                      case 'cosmic-reader':
-                          opt_arg = '${emptyPDF}/empty.pdf'
-                      case _:
-                          opt_arg = ""
-
-                  machine.succeed(f"su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} ${DISPLAY} {gui_app} {opt_arg} >&2 &'", timeout=5)
-                  # Nix builds the following non-commented expression to the following:
-                  #                              `su - alice -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/1000 lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' `
-                  machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=60)
-                  machine.succeed(f"pkill {gui_app}", timeout=5)
-
-      machine.succeed("echo 'test completed succeessfully' > /${testName}", timeout=5)
-      machine.copy_from_machine('/${testName}')
-
-      machine.shutdown()
-    '';
-}

nixos/tests/cosmic/default.nix

@@ -0,0 +1,168 @@
+{
+  config,
+  lib,
+  testName,
+  enableAutologin,
+  enableXWayland,
+  ...
+}:
+
+let
+  user = config.nodes.machine.users.users.alice;
+  logFilePath = "/home/${user.name}/${testName}";
+  # Use `writeShellScriptBin` instead of `writeShellScript` so that the
+  # process name in the journald log appears as 'cosmicTest[$pid]'
+  cosmicTest = config.node.pkgs.writeShellScriptBin "cosmicTest" ''
+    exec ${lib.getExe config.node.pkgs.python3Minimal} ${./test-script.py} \
+        --log-file-path ${logFilePath} \
+        --cosmic-reader-pdf ${config.node.pkgs.empty-pdf} \
+        --polkit-agent-helper-path ${config.node.pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1 \
+        --root-user-password ${user.password}
+  '';
+  cosmicTestDesktop = config.node.pkgs.makeDesktopItem {
+    name = "cosmicTest";
+    desktopName = "COSMIC NixOS VM test (${testName})";
+    exec = "cosmicTest";
+  };
+  cosmicTestAutostartItem = config.node.pkgs.makeAutostartItem {
+    name = "cosmicTest";
+    package = cosmicTestDesktop;
+  };
+in
+
+{
+  name = testName;
+
+  meta.maintainers = lib.teams.cosmic.members;
+
+  nodes.machine = {
+    imports = [ ../common/user-account.nix ];
+
+    services = {
+      # For `cosmic-store` to be added to `environment.systemPackages`
+      # and for it to work correctly because Flatpak is a runtime
+      # dependency of `cosmic-store`.
+      flatpak.enable = true;
+
+      displayManager.cosmic-greeter.enable = true;
+      desktopManager.cosmic = {
+        enable = true;
+        xwayland.enable = enableXWayland;
+      };
+    };
+
+    services.displayManager.autoLogin = lib.mkIf enableAutologin {
+      enable = true;
+      user = user.name;
+    };
+
+    users.users = {
+      alice.extraGroups = [
+        "uinput" # for ydotoold
+      ];
+
+      root.password = user.password;
+      root.hashedPasswordFile = lib.mkForce null;
+    };
+
+    hardware.uinput.enable = true;
+
+    environment.systemPackages = with config.node.pkgs; [
+      ydotool
+      cosmicTest
+      cosmicTestAutostartItem
+
+      # These two packages are used to check if a window was opened
+      # under the COSMIC session or not. Kinda important.
+      # TODO: Move the check from the test module to
+      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
+      # Wayland-only testing can be done using the existing testing
+      # infrastructure.
+      jq
+      lswt
+    ];
+
+    # So far, all COSMIC tests launch a few GUI applications. In doing
+    # so, the default allocated memory to the guest of 1024M quickly
+    # poses a very high risk of an OOM-shutdown which is worse than an
+    # OOM-kill. Because now, the test failed, but not for a genuine
+    # reason, but an OOM-shutdown. That's an inconclusive failure
+    # which might possibly mask an actual failure. Not enabling
+    # systemd-oomd because we need said applications running for a
+    # few seconds. So instead, bump the allocated memory to the guest
+    # from 1024M to 4x; 4096M.
+    virtualisation.memorySize = 4096;
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      #testName: ${testName}
+      import sys
+    ''
+    + (
+      if enableAutologin then
+        ''
+          with subtest("cosmic-greeter initialisation"):
+              machine.wait_for_unit("graphical.target", timeout=120)
+        ''
+      else
+        ''
+          from time import sleep
+
+          machine.wait_for_unit("graphical.target", timeout=120)
+          machine.wait_until_succeeds("pgrep --uid ${config.nodes.machine.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
+          # Sleep for 10 seconds for ensuring that `greetd` loads the
+          # password prompt for the login screen properly.
+          sleep(10)
+
+          with subtest("cosmic-session login"):
+              machine.send_chars("${user.password}\n", delay=0.2)
+        ''
+    )
+    + ''
+      with subtest("xdg autostart support in cosmic"):
+          # When checking the status of our `cosmicTest` package with:
+          # `machine.wait_for_unit("app-cosmicTest@autostart.service", user="${user.name}")`
+          # We are immediately greeted with the error:
+          # ```
+          # subtest: xdg autostart support in cosmic
+          # machine: waiting for unit app-cosmicTest@autostart.service with user alice
+          # machine # [   26.497516] cosmic-comp[1352]: [EGL] 0x3008 (BAD_DISPLAY) eglCreateSync: _eglCreateSync
+          # machine # [   26.511706] su[1416]: Successful su for alice by root
+          # machine # [   26.528190] su[1416]: pam_unix(su:session): session opened for user alice(uid=1000) by (uid=0)
+          # machine # Failed to connect to user scope bus via local transport: No such file or directory
+          # machine # [   26.599563] su[1416]: pam_unix(su:session): session closed for user alice
+          # !!! Test "xdg autostart support in cosmic" failed with error: "retrieving systemctl property "ActiveState" for unit "app-cosmicTest@autostart.service" under user "alice" failed with exit code 1"
+          # ```
+          # Meaning, our session is extremely new and the D-Bus user
+          # session socket does not yet exist. Instead, lets poll for
+          # the log file that the test is guaranteed to write to, as
+          # soon as it starts.
+          machine.wait_for_file("${logFilePath}.log", timeout=120)
+
+      exit_code = 0
+      try:
+          machine.wait_for_file("${logFilePath}.done", timeout=700)
+      except Exception:
+          exit_code = 1
+
+      # The log file is created in the very beginning of the test
+      # script's execution. If we are here, it means that the
+      # `wait_for_unit`'s "guard" on the test script's autostart unit
+      # plus the 630 second combined timeout of other two
+      # `wait_for_file`s, make it extremely likely for the log file to
+      # be present.
+      machine.copy_from_machine("${logFilePath}.log")
+
+      machine.shutdown()
+
+      with open(f"{machine.out_dir}/${testName}.log") as test_log_file:
+          contents = test_log_file.read()
+          print(contents)
+          if any("Z [ERROR] [L:" in line for line in contents.splitlines()):
+              exit_code = 1
+
+      sys.exit(exit_code)
+    '';
+}

nixos/tests/cosmic/test-script.py

@@ -0,0 +1,315 @@
+#!/usr/bin/env python3
+import argparse
+import logging
+import os
+import pathlib
+import subprocess
+import time
+
+
+def parse_cli_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--log-file-path",
+        required=True,
+        type=str,
+        help="The path to the log file (without the '.log' suffix/extension)",
+    )
+    parser.add_argument(
+        "--cosmic-reader-pdf",
+        required=True,
+        type=str,
+        help="The PDF that the `cosmic-reader` should open for testing",
+    )
+    parser.add_argument(
+        "--polkit-agent-helper-path",
+        required=True,
+        type=str,
+        help="The path to the polkit agent helper (`${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1`)",
+    )
+    parser.add_argument(
+        "--root-user-password", required=True, type=str, help="The root user's password"
+    )
+    args = parser.parse_args()
+    return args
+
+
+def start_ydotool_daemon() -> tuple[str, subprocess.Popen]:
+    """
+    The ydotool requires a daemon to be running.
+    """
+    xdg_runtime_dir = os.getenv("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    ydotool_daemon_socket_path = f"{xdg_runtime_dir}/.ydotool_socket"
+    ydotool_daemon_process = subprocess.Popen(
+        [
+            "ydotoold",
+            "--socket-path",
+            ydotool_daemon_socket_path,
+            "--mouse-off",
+        ],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return ydotool_daemon_socket_path, ydotool_daemon_process
+
+
+def wait_for_cosmic_de_readiness() -> None:
+    """
+    Wait for the COSMIC DE to be ready, before running the tests. This
+    is done by waiting on the supposedly last component of the COSMIC
+    DE to be "ready." That component is the notification watcher, of
+    the `cosmic-applet` derivation.
+    """
+    logging.info("=" * 80)
+    logging.info("Waiting for COSMIC DE to complete initialization")
+
+    notification_watcher_wait_deadline = time.monotonic() + 360
+    notification_watcher_exists = False
+    while time.monotonic() < notification_watcher_wait_deadline:
+        busctl_process = subprocess.run(
+            ["busctl", "--user", "status", "com.system76.CosmicStatusNotifierWatcher"],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        if busctl_process.returncode == 0:
+            notification_watcher_exists = True
+            break
+        else:
+            time.sleep(1)
+    logging_msg = "The COSMIC DE is "
+    if notification_watcher_exists:
+        logging.info(f"{logging_msg} ready")
+    else:
+        logging.error(f"{logging_msg} not ready")
+    return
+
+
+def perform_polkit_authentication_test(
+    cli_args: argparse.Namespace,
+    ydotool_daemon_socket_path: str,
+    ydotool_daemon_process: subprocess.Popen,
+) -> None:
+    """
+    1. Run `pkexec` as a background process that produces a specific
+       output to stdout upon successful completion.
+    2. Wait unil it has been confimred that `cosmic-osd` has created
+       a pop-up requesting the root user's password.
+    3. Use ydotool to type the root user's password in the pop-up
+       prompt.
+    4. Ensure that the the `pkexec` background process' stdout matches
+       the output that we expect.
+
+    Any breakage in this flow is considered a failure of the polkit
+    authenticaion test.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing polkit authentication test")
+
+    polkit_test_passed = False
+    polkit_test_command = [
+        "pkexec",
+        "--disable-internal-agent",
+        "bash",
+        "-c",
+        "echo -n 'polkit test was successful'",
+    ]
+    logging.info(f"Running: {polkit_test_command}")
+    polkit_test_process = subprocess.Popen(
+        polkit_test_command,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    polkit_popup_deadline = time.monotonic() + 60
+    pop_up_msg = "the pop-up for polkit password authentication"
+    encountered_polkit_authentication_popup = False
+    while time.monotonic() < polkit_popup_deadline:
+        polkit_popup_check_process = subprocess.run(
+            [
+                "pgrep",
+                "-afx",
+                f"{cli_args.polkit_agent_helper_path} --socket-activated",
+            ],
+            check=False,
+        )
+        if polkit_popup_check_process.returncode == 0:
+            encountered_polkit_authentication_popup = True
+            logging.info(f"Noticed {pop_up_msg}")
+            if ydotool_daemon_process.poll() is None:
+                # The polkit-agent-helper process exists, but that
+                # doesn't necessarily mean that the pop-up is
+                # **rendered** and ready to accept the password. So we
+                # sleep for a few seconds.
+                time.sleep(20)
+                ydotool_process = subprocess.run(
+                    [
+                        "ydotool",
+                        "type",
+                        "--key-delay=500",
+                        f"{cli_args.root_user_password}\n",
+                    ],
+                    env={
+                        **os.environ.copy(),
+                        "YDOTOOL_SOCKET": ydotool_daemon_socket_path,
+                    },
+                    check=False,
+                )
+                ydotool_msg = (
+                    "the root user's password in the pop-up for polkit authentication"
+                )
+                if ydotool_process.returncode == 0:
+                    logging.info(f"ydotool typed {ydotool_msg}")
+                else:
+                    logging.error(f"ydotool did not type {ydotool_msg}")
+            else:
+                logging.error(
+                    "The ydotool daemon exited for some reason before it could be used"
+                )
+            break
+        time.sleep(1)
+    if not encountered_polkit_authentication_popup:
+        logging.error(f"Did not notice {pop_up_msg}")
+
+    polkit_test_process_stdout = ""
+    polkit_test_process_stderr = ""
+    try:
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate(timeout=45)
+        )
+    except subprocess.TimeoutExpired:
+        polkit_test_process.kill()
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate()
+        )
+
+    logging.info(f"polkit stdout: '{polkit_test_process_stdout}'")
+    logging.info(f"polkit stderr: '{polkit_test_process_stderr}'")
+
+    if polkit_test_process_stdout:
+        logging.info(f"pkexec command stdout: {polkit_test_process_stdout}")
+        polkit_test_passed = "polkit test was successful" in polkit_test_process_stdout
+    else:
+        logging.warning("Could not capture stdout from the polkit test command")
+
+    if polkit_test_passed:
+        logging.info("The polkit authentication test passed")
+    else:
+        logging.error("The polkit authentication test failed")
+    return
+
+
+def perform_gui_application_test(cli_args: argparse.Namespace) -> None:
+    """
+    1. Start one GUI application as a background process.
+    2. Wait unil it has been confimred that the GUI application is
+       running.
+    3. Kill the background process of the GUI application.
+
+    Any breakage in this flow is considered a failure of the test for
+    the GUI application.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing test to launch GUI applications")
+
+    gui_apps_to_test = {
+        "com.system76.CosmicEdit": [
+            "cosmic-edit",
+        ],
+        "com.system76.CosmicFiles": [
+            "cosmic-files",
+        ],
+        "com.system76.CosmicPlayer": [
+            "cosmic-player",
+        ],
+        "com.system76.CosmicReader": [
+            "cosmic-reader",
+            cli_args.cosmic_reader_pdf,
+        ],
+        "com.system76.CosmicSettings": [
+            "cosmic-settings",
+        ],
+        "com.system76.CosmicStore": [
+            "cosmic-store",
+        ],
+        "com.system76.CosmicTerm": [
+            "cosmic-term",
+        ],
+    }
+
+    for gui_app_id, gui_app_command in gui_apps_to_test.items():
+        logging.info(f"Running: {gui_app_command}")
+        gui_app_bg_process = subprocess.Popen(
+            gui_app_command,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        gui_app_bg_process_deadline = time.monotonic() + 30
+        gui_app_is_running = False
+
+        while time.monotonic() < gui_app_bg_process_deadline and not gui_app_is_running:
+            lswt_process = subprocess.run(
+                [
+                    "lswt",
+                    "--custom",
+                    "a",
+                ],
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.DEVNULL,
+            )
+            lswt_process_stdout = lswt_process.stdout.strip()
+            if lswt_process_stdout:
+                if gui_app_id in lswt_process_stdout.splitlines():
+                    gui_app_is_running = True
+            time.sleep(1)
+        pkill_process = subprocess.run(
+            ["pkill", gui_app_command[0]],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
+        )
+
+        log_message = (
+            f"The GUI application test for '{gui_app_command[0]}' ({gui_app_id})"
+        )
+        if gui_app_is_running:
+            logging.info(f"{log_message} passed")
+        else:
+            logging.error(f"{log_message} failed")
+    return
+
+
+def main() -> None:
+    cli_args = parse_cli_args()
+    logging.basicConfig(
+        level=logging.INFO,
+        format=f"%(asctime)sZ [%(levelname)s] [L:%(lineno)d] %(message)s",
+        datefmt="%H:%M:%S",
+        handlers=[
+            logging.StreamHandler(),
+            logging.FileHandler(f"{cli_args.log_file_path}.log", mode="w"),
+        ],
+    )
+    logging.Formatter.converter = time.gmtime
+    logging.info(f"Logging to '{cli_args.log_file_path}.log'")
+
+    ydotool_daemon_socket_path, ydotool_daemon_process = start_ydotool_daemon()
+
+    # Wait for the DE to be ready
+    wait_for_cosmic_de_readiness()
+
+    # tests go here
+    perform_polkit_authentication_test(
+        cli_args, ydotool_daemon_socket_path, ydotool_daemon_process
+    )
+    perform_gui_application_test(cli_args)
+
+    pathlib.Path(f"{cli_args.log_file_path}.done").touch()
+    return
+
+
+if __name__ == "__main__":
+    main()

nixos/tests/docker-rootless.nix

@@ -22,7 +22,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
       sudo = lib.concatStringsSep " " [
         "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
         "DOCKER_HOST=unix:///run/user/${toString user.uid}/docker.sock"

nixos/tests/enlightenment.nix

@@ -33,7 +33,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
     in
     ''
       with subtest("Ensure x starts"):

nixos/tests/iscsi-multipath-root.nix

@@ -126,7 +126,7 @@ in
         ];
 
         environment.etc."initiator-root-disk-closure".source =
-          nodes.initiatorRootDisk.config.system.build.toplevel;
+          nodes.initiatorRootDisk.system.build.toplevel;
 
         nix.settings = {
           substituters = lib.mkForce [ ];

nixos/tests/iscsi-root.nix

@@ -169,7 +169,7 @@ in
       initiatorAuto.succeed("mkfs.xfs /dev/sda")
       initiatorAuto.succeed("mkdir /mnt && mount /dev/sda /mnt")
       initiatorAuto.succeed(
-          "nixos-install --no-bootloader --no-root-passwd --system ${nodes.initiatorRootDisk.config.system.build.toplevel}"
+          "nixos-install --no-bootloader --no-root-passwd --system ${nodes.initiatorRootDisk.system.build.toplevel}"
       )
       initiatorAuto.succeed("umount /mnt && rmdir /mnt")
       initiatorAuto.shutdown()

nixos/tests/kerberos/heimdal.nix

@@ -169,7 +169,7 @@ import ../make-test-python.nix (
         with subtest("Server: initialize host principal with keytab"):
           server.send_chars("sudo ktutil get -p alice/admin host/server.foo.bar\n")
           server.wait_until_tty_matches("1", "password for alice:")
-          server.send_chars("${nodes.server.config.users.users.alice.password}\n")
+          server.send_chars("${nodes.server.users.users.alice.password}\n")
           server.wait_until_tty_matches("1", "alice/admin@FOO.BAR's Password:")
           server.send_chars(f'{alice_krb_admin_pw}\n')
           server.wait_for_file("/etc/krb5.keytab")
@@ -194,7 +194,7 @@ import ../make-test-python.nix (
 
           client.send_chars("sudo ktutil get -p alice/admin host/client.foo.bar\n")
           client.wait_until_tty_matches("1", "password for alice:")
-          client.send_chars("${nodes.client.config.users.users.alice.password}\n")
+          client.send_chars("${nodes.client.users.users.alice.password}\n")
           client.wait_until_tty_matches("1", "alice/admin@FOO.BAR's Password:")
           client.send_chars(f"{alice_krb_admin_pw}\n")
           client.wait_for_file("/etc/krb5.keytab")

nixos/tests/knot.nix

@@ -209,11 +209,11 @@ in
   testScript =
     { nodes, ... }:
     let
-      primary4 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv4.addresses).address;
-      primary6 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv6.addresses).address;
+      primary4 = (lib.head nodes.primary.networking.interfaces.eth1.ipv4.addresses).address;
+      primary6 = (lib.head nodes.primary.networking.interfaces.eth1.ipv6.addresses).address;
 
-      secondary4 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv4.addresses).address;
-      secondary6 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv6.addresses).address;
+      secondary4 = (lib.head nodes.secondary.networking.interfaces.eth1.ipv4.addresses).address;
+      secondary6 = (lib.head nodes.secondary.networking.interfaces.eth1.ipv6.addresses).address;
     in
     ''
       import re

nixos/tests/libuiohook.nix

@@ -8,7 +8,7 @@
   nodes.client =
     { nodes, ... }:
     let
-      user = nodes.client.config.users.users.alice;
+      user = nodes.client.users.users.alice;
     in
     {
       imports = [
@@ -24,7 +24,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.client.config.users.users.alice;
+      user = nodes.client.users.users.alice;
     in
     ''
       client.wait_for_x()

nixos/tests/lightdm.nix

@@ -20,7 +20,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
     in
     ''
       start_all()

nixos/tests/mysql/mysql-secure-root.nix

@@ -0,0 +1,94 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+  lib ? pkgs.lib,
+}:
+
+let
+  makeTest = import ./../make-test-python.nix;
+  inherit (import ./common.nix { inherit pkgs lib; })
+    mysqlPackages
+    ;
+
+  makeSecureRootTest =
+    {
+      package,
+      name ? "mysql_secure_root_" + (builtins.replaceStrings [ "-" "." ] [ "_" "" ] package.pname),
+    }:
+    makeTest {
+      inherit name;
+
+      nodes.${name} = { pkgs, ... }: {
+        services.mysql = {
+          enable = true;
+          package = package;
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        machine = ${name}
+        machine.wait_for_unit("mysql")
+
+        # Verify that non-root user cannot connect as root
+        machine.fail("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+
+        # Verify that system root can connect as root via socket
+        machine.succeed("mysql -u root -e 'SELECT 1;'")
+
+        # Verify that root@localhost has auth_socket plugin
+        machine.succeed("[ \"$(mysql -u root -N -e \"SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';\")\" = \"auth_socket\" ]")
+
+        # Test service restart - verify it still works
+        machine.succeed("systemctl restart mysql")
+        machine.wait_for_unit("mysql")
+
+        # After restart, verify non-root user still cannot connect as root
+        machine.fail("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+
+        # After restart, verify system root can still connect
+        machine.succeed("mysql -u root -e 'SELECT 1;'")
+
+        # After restart, verify root@localhost still has auth_socket
+        machine.succeed("[ \"$(mysql -u root -N -e \"SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';\")\" = \"auth_socket\" ]")
+      '';
+    };
+
+  makeInsecureRootTest =
+    {
+      package,
+      name ? "mysql_insecure_root_" + (builtins.replaceStrings [ "-" "." ] [ "_" "" ] package.pname),
+    }:
+    makeTest {
+      inherit name;
+
+      nodes.${name} = { pkgs, ... }: {
+        services.mysql = {
+          enable = true;
+          package = package;
+          secureSuperUserByDefault = false;
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        machine = ${name}
+        machine.wait_for_unit("mysql")
+
+        # With secureRootByDefault = false, anyone can connect as root (default --initialize-insecure behavior)
+        machine.succeed("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+      '';
+    };
+
+in
+{
+  "secure-by-default" = lib.mapAttrs (
+    _: package: makeSecureRootTest { inherit package; }
+  ) mysqlPackages;
+  "can-be-insecure" = lib.mapAttrs (
+    _: package: makeInsecureRootTest { inherit package; }
+  ) mysqlPackages;
+}

nixos/tests/nsd.nix

@@ -21,7 +21,7 @@ in
       {
         imports = [ common ];
         networking.nameservers = lib.mkForce [
-          (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
+          (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address
         ];
         networking.interfaces.eth1.ipv4.addresses = [
           {
@@ -36,7 +36,7 @@ in
       {
         imports = [ common ];
         networking.nameservers = lib.mkForce [
-          (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
+          (lib.head nodes.server.networking.interfaces.eth1.ipv6.addresses).address
         ];
         networking.interfaces.eth1.ipv4.addresses = [
           {

nixos/tests/parsedmarc/default.nix

@@ -93,8 +93,8 @@ in
     testScript =
       { nodes, ... }:
       let
-        esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
-        valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
+        esPort = toString nodes.parsedmarc.services.elasticsearch.port;
+        valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.services.elasticsearch.package.version "7") ".value";
       in
       ''
         parsedmarc.start()
@@ -143,7 +143,7 @@ in
 
             networking.extraHosts = ''
               127.0.0.1 ${parsedmarcDomain}
-              ${nodes.mail.config.networking.primaryIPAddress} ${mailDomain}
+              ${nodes.mail.networking.primaryIPAddress} ${mailDomain}
             '';
 
             services.parsedmarc = {
@@ -170,7 +170,7 @@ in
 
             networking.extraHosts = ''
               127.0.0.1 ${mailDomain}
-              ${nodes.parsedmarc.config.networking.primaryIPAddress} ${parsedmarcDomain}
+              ${nodes.parsedmarc.networking.primaryIPAddress} ${parsedmarcDomain}
             '';
 
             services.dovecot2 = {
@@ -204,8 +204,8 @@ in
       testScript =
         { nodes, ... }:
         let
-          esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
-          valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
+          esPort = toString nodes.parsedmarc.services.elasticsearch.port;
+          valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.services.elasticsearch.package.version "7") ".value";
         in
         ''
           mail.start()

nixos/tests/pass-secret-service.nix

@@ -39,7 +39,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
       gpg-uid = "alice@example.net";
       gpg-pw = "foobar9000";
       ready-file = "/tmp/secrets-dbus-init.done";

nixos/tests/plausible.nix

@@ -1,34 +1,142 @@
-{ lib, ... }:
-{
-  name = "plausible";
-  meta = {
-    maintainers = [ ];
-  };
+{ runTest }:
 
-  nodes.machine =
-    { pkgs, ... }:
+let
+  secretKeybase = "nannannannannannannannannannannannannannannannannannannan_batman!";
+
+  # A fixed bcrypt password hash is fine for a test; the plaintext is never
+  # needed because the test only checks that an admin user exists (and thus the
+  # "first launch" setup wizard is unreachable), not that login with the
+  # password works.
+  adminEmail = "admin@localhost";
+
+  mkPlausibleTest =
     {
-      virtualisation.memorySize = 4096;
-      services.plausible = {
-        enable = true;
-        server = {
-          baseUrl = "http://localhost:8000";
-          secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
+      seedAdmin ? false,
+    }:
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        adminPassword = "correct-horse-battery-staple";
+        adminPasswordHashFile = pkgs.runCommand "plausible-admin-password-hash" { } ''
+          ${lib.getExe pkgs.mkpasswd} -m bcrypt ${lib.escapeShellArg adminPassword} > "$out"
+        '';
+      in
+      {
+        name = "plausible" + lib.optionalString seedAdmin "-declarative-admin-user";
+        meta = {
+          maintainers = with lib.maintainers; [
+            nh2
+            stepbrobd
+          ];
         };
-      };
-    };
 
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("plausible.service")
-    machine.wait_for_open_port(8000)
+        nodes.machine = {
+          # On first boot, the ClickHouse migrations run by Plausible's
+          # `migrate.sh` intermittently fail with `(Mint.TransportError) socket
+          # closed`, which aborts startup before the web server opens its port.
+          # The failure is transient and succeeds on a subsequent attempt, so
+          # retry startup without a rate limit until the port opens. (Without
+          # this, the test is flaky.)
+          systemd.services.plausible.serviceConfig.Restart = lib.mkForce "always";
+          systemd.services.plausible.serviceConfig.RestartSec = 1;
+          systemd.services.plausible.unitConfig.StartLimitIntervalSec = 0;
 
-    # Ensure that the software does not make not make the machine
-    # listen on any public interfaces by default.
-    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+          services.plausible = {
+            enable = true;
+            adminUser = lib.mkIf seedAdmin {
+              email = adminEmail;
+              name = "Test Admin";
+              passwordHashFile = "${adminPasswordHashFile}";
+            };
+            server = {
+              baseUrl = "http://localhost:8000";
+              secretKeybaseFile = builtins.toFile "plausible-test-secret-keybase-file" secretKeybase;
+            };
+          };
+        };
 
-    machine.succeed("curl -f localhost:8000 >&2")
+        testScript = ''
+          machine.wait_for_unit("plausible.service")
+          machine.wait_for_open_port(8000)
 
-    machine.succeed("curl -f localhost:8000/js/script.js >&2")
-  '';
+          # Ensure that the software does not make the machine
+          # listen on any public interfaces by default.
+          machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+
+          machine.succeed("curl -f localhost:8000 >&2")
+          machine.succeed("curl -f localhost:8000/js/script.js >&2")
+
+          def user_count():
+            # Plausible's "first launch" state is defined as "no user exists"
+            # (`Plausible.Release.should_be_first_launch?` is
+            # `not Repo.exists?(Plausible.Auth.User)`), so we inspect the `users`
+            # table directly. Local Postgres connections use `trust` auth in this
+            # VM, so the `postgres` superuser can query without a password.
+            return machine.succeed(
+              "sudo -u postgres psql --dbname plausible --tuples-only --no-align "
+              "--command 'SELECT count(*) FROM users'"
+            ).strip()
+
+          def login_redirect_url():
+            return machine.succeed(
+              "curl -s -o /dev/null -w '%{redirect_url}' localhost:8000/login"
+            ).strip()
+        ''
+        + (
+          if seedAdmin then
+            ''
+              with subtest("the admin user is seeded"):
+                assert user_count() == "1", "expected exactly one seeded admin user"
+                email = machine.succeed(
+                  "sudo -u postgres psql --dbname plausible --tuples-only --no-align "
+                  "--command 'SELECT email FROM users'"
+                ).strip()
+                assert email == "${adminEmail}", f"unexpected seeded admin email: {email!r}"
+
+              with subtest("the setup wizard is NOT reachable"):
+                # `/login` must render normally (HTTP 200) and must not redirect
+                # to the first-launch `/register` wizard.
+                status = machine.succeed(
+                  "curl -s -o /dev/null -w '%{http_code}' localhost:8000/login"
+                ).strip()
+                assert status == "200", f"expected /login to render (200), got: {status!r}"
+                location = login_redirect_url()
+                assert "/register" not in location, (
+                  f"/login unexpectedly redirected to the setup wizard: {location!r}"
+                )
+
+              with subtest("seeding is idempotent across restarts"):
+                machine.succeed("systemctl restart plausible.service")
+                machine.wait_for_open_port(8000)
+                assert user_count() == "1", "expected still exactly one user after restart"
+            ''
+          else
+            ''
+              with subtest("without an admin user, the setup wizard is reachable"):
+                assert user_count() == "0", "expected no users in first-launch state"
+                # With no user seeded, `should_be_first_launch?` is true and the
+                # browser pipeline's `FirstLaunchPlug` 302-redirects every page to
+                # `/register`.
+                location = login_redirect_url()
+                assert "/register" in location, (
+                  f"expected /login to redirect to the setup wizard /register, but redirect was: {location!r}"
+                )
+            ''
+        );
+      }
+    );
+in
+{
+  # Basic test: Plausible without a declaratively configured admin user is in
+  # the "first launch" state, so the unauthenticated setup wizard is reachable.
+  # This also asserts that the way the `declarative-admin-user` test detects
+  # "wizard reachable" actually fires for this Plausible version, so a future
+  # Plausible change that breaks the detection would make that test fail rather
+  # than silently pass.
+  basic = mkPlausibleTest { seedAdmin = false; };
+
+  # Tests that a declaratively configured admin user is seeded before the web
+  # server accepts connections, so the unauthenticated "first launch" setup
+  # wizard is never reachable.
+  declarative-admin-user = mkPlausibleTest { seedAdmin = true; };
 }

nixos/tests/proxy.nix

@@ -41,8 +41,8 @@ in
 
               <Proxy balancer://cluster>
                 Require all granted
-                BalancerMember http://${nodes.backend1.config.networking.hostName} retry=0
-                BalancerMember http://${nodes.backend2.config.networking.hostName} retry=0
+                BalancerMember http://${nodes.backend1.networking.hostName} retry=0
+                BalancerMember http://${nodes.backend2.networking.hostName} retry=0
               </Proxy>
 
               ProxyStatus       full

nixos/tests/service-runner.nix

@@ -29,7 +29,7 @@
           machine.succeed(
               """
               mkdir -p /run/nginx /var/log/nginx /var/cache/nginx
-              ${nodes.machine.config.systemd.services.nginx.runner} >&2 &
+              ${nodes.machine.systemd.services.nginx.runner} >&2 &
               echo $!>my-nginx.pid
               """
           )

nixos/tests/signal-desktop.nix

@@ -42,7 +42,7 @@ in
   testScript =
     { nodes, ... }:
     let
-      user = nodes.machine.config.users.users.alice;
+      user = nodes.machine.users.users.alice;
     in
     ''
       start_all()

nixos/tests/sway.nix

@@ -194,7 +194,7 @@
       swaymsg("exec swaylock")
       machine.wait_until_succeeds("pgrep -xf swaylock")
       machine.sleep(3)
-      machine.send_chars("${nodes.machine.config.users.users.alice.password}")
+      machine.send_chars("${nodes.machine.users.users.alice.password}")
       machine.send_key("ret")
       machine.wait_until_fails("pgrep -xf swaylock")
 

nixos/tests/thanos.nix

@@ -322,7 +322,7 @@ in
       # and check if the blocks have the correct labels:
       store.succeed(
           "thanos tools bucket ls "
-          + "--objstore.config-file=${nodes.store.config.services.thanos.store.objstore.config-file} "
+          + "--objstore.config-file=${nodes.store.services.thanos.store.objstore.config-file} "
           + "--output=json | "
           + "jq .thanos.labels.some_label | "
           + "grep 'required by thanos'"

nixos/tests/txredisapi.nix

@@ -25,7 +25,7 @@
   testScript =
     { nodes, ... }:
     let
-      inherit (nodes.machine.config.services) redis;
+      inherit (nodes.machine.services) redis;
     in
     ''
       start_all()

nixos/tests/web-apps/stump.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+  name = "stump-nixos";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.stump.enable = true;
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("stump.service")
+
+    machine.wait_for_open_port(10001)
+    machine.succeed("curl --fail -s http://localhost:10001/")
+
+    machine.succeed("curl --fail -s --data '{\"username\":\"admin\",\"password\":\"admin\"}' -H 'Content-Type: application/json' -X POST http://localhost:10001/api/v2/auth/register")
+
+    response = machine.succeed("curl --fail -s -X GET http://localhost:10001/api/v2/claim")
+    is_claimed = json.loads(response)['isClaimed']
+
+    assert is_claimed
+  '';
+}

nixos/tests/xrdp-with-audio-pulseaudio.nix

@@ -73,7 +73,7 @@
   testScript =
     { nodes, ... }:
     let
-      user = nodes.client.config.users.users.alice;
+      user = nodes.client.users.users.alice;
     in
     ''
       start_all()

pkgs/README.md

@@ -906,10 +906,14 @@ stdenv.mkDerivation {
 ## Automatic package updates
 [automatic-package-updates]: #automatic-package-updates
 
-Nixpkgs periodically tries to update all packages that have a `passthru.updateScript` attribute.
+The [community bot `r-ryantm`](https://nix-community.org/update-bot/), periodically tries to update all packages in Nixpkgs.
+`r-ryantm` runs the program [`nixpkgs-update`](https://nix-community.github.io/nixpkgs-update/) to find new versions of packages.
+In most cases, `nixpkgs-update` will be capable of finding new versions and perform the update with out any special instructions.
+Putting a `passthru.updateScript` attribute sets an explicit update procedure for `nixpkgs-update`, but this is not required for most cases.
+To learn more about the default update procedures, read their [FAQ for Nixpkgs maintainers](https://nix-community.github.io/nixpkgs-update/nixpkgs-maintainer-faq/).
 
 > [!Note]
-> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
+> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) function provided in Nixpkgs, which makes automatic updates use [`nix-update`](https://github.com/Mic92/nix-update):
 >
 > ```nix
 > { stdenv, nix-update-script }:
@@ -919,9 +923,10 @@ Nixpkgs periodically tries to update all packages that have a `passthru.updateSc
 > }
 > ```
 >
-> For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://github.com/nix-community/nixpkgs-update) when a new version is released.
-> The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set.
-> While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
+> `nix-update` is a little bit more flexible than `nixpkgs-update` in performing updates, so it can be useful for cases such as:
+>
+>  - A `nix-update` CLI flag like `--version branch` or `--version-regex` are needed to make the update work.
+>  - You don't want to rely upon new versions to be listed in [Repology](https://repology.org/), and `nix-update` finds new versions easily (e.g GitLab projects).
 
 The `passthru.updateScript` attribute can contain one of the following:
 

pkgs/applications/editors/android-studio/default.nix

@@ -21,9 +21,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.10/android-studio-quail1-patch2-linux.tar.gz";
   };
   betaVersion = {
-    version = "2026.1.1.7"; # "Android Studio Quail 1 | 2026.1.1 RC 2"
-    sha256Hash = "sha256-TB9hPynvVq1axv6oAw8un6WHVHakZPvEBjfPCs+Dwj0=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.7/android-studio-quail1-rc2-linux.tar.gz";
+    version = "2026.1.2.8"; # "Android Studio Quail 2 | 2026.1.2 RC 1"
+    sha256Hash = "sha256-tTMD3wgEg0W7WsJb/hWXMdzqNDD04uJ7imAzgWG9Jmc=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.8/android-studio-quail2-rc1-linux.tar.gz";
   };
   latestVersion = {
     version = "2026.1.3.1"; # "Android Studio Quail 3 | 2026.1.3 Canary 1"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/holo-layer/package.nix

@@ -22,7 +22,7 @@ let
       pyqt6-sip
       sexpdata
       six
-      xlib
+      python-xlib
     ];
   pythonEnv = python3.withPackages pythonPkgs;
 

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -13,18 +13,18 @@
   writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.9.4";
+  version = "0.9.6";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff.nvim";
     tag = "v${version}";
-    hash = "sha256-q/RfjfVZMM8RyfOP1o2NjUP6NrOh7D2ribgq5Dvwxkc=";
+    hash = "sha256-JOoc4RDPIggZaoPtPEWhQ2msWfgOOuI4PPguFMczJls=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-NmQDTsevfJq6UGfoxaHwEX4+eJZLXebndpFAsbUNvl8=";
+    cargoHash = "sha256-nHVQccbKSfX9fZXh0aPRP33n4nHWhaRdz9k49apULME=";
 
     cargoBuildFlags = [
       "-p"

pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix

@@ -0,0 +1,15 @@
+{ vimUtils, mirth }:
+
+vimUtils.buildVimPlugin {
+  pname = "mirth";
+  inherit (mirth) version;
+  src = mirth.vim;
+  meta = {
+    inherit (mirth.meta)
+      homepage
+      license
+      platforms
+      ;
+    description = "Syntax highlighting & filetype detection for the Mirth programming language";
+  };
+}

pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-wakatime";
     publisher = "WakaTime";
-    version = "30.2.0";
-    hash = "sha256-abXaPmdxBNsIEYvyuHu1fZGmCgv1Tpp9azj6O2zKXLs=";
+    version = "30.2.1";
+    hash = "sha256-FlH8uobKgUAAOr+6TCG9xYPiNN3FhlFp18dWKX8pFtE=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-hjj2PRcpRsC6kWqwhGlBt071rHVq9ZN+OcNsT78IuWc=";
+          hash = "sha256-tCasNLg/Tu3uP69Mve9Kcqam1+JQkA/XyCMPy6aNPJM=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-7lhfn95LI8vg2MvzTuQw57bmhJOXInl+T/e3ZSLNMKA=";
+          hash = "sha256-o+y3Oz/lZd9gEQL3q+ivzkWchQ/dJ5QuU9fJwRpEYrE=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-/aSCQP6yQ30qmgz1ZcgZ91MiLwpxkr77m3NIlidfgnw=";
+          hash = "sha256-vovdNDX0m55a7sazBCixnun89gb/dknzUbeMSU5q8KU=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-uDVR6Y1GoY8G8OLBoAGY6YMLL2Qj7eHpZ6p0Z0OCN/4=";
+          hash = "sha256-JbLeoeAzOUVbmpM1CN5QajsK8QT8KjZRUD4UxR6C7bU=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.179";
+      version = "2.1.185";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/continue.continue/default.nix

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/D6d0qfgl8+cTEQ5ZeMjGgo1/Uzw5BxwBdM2m0fBjNU=";
+          hash = "sha256-4GiTNT+UPdTth9VDhHTXfqhQ5gM6vfLAaU5Cy3VMTCI=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-jIyFt1ZLNPS4DbQLnZJ3p30AnPJz3qNFDj/rL6EdnKw=";
+          hash = "sha256-XJfDXWYpxYV5YHIBINqNJdyVho7Xd9OGMu11WE0LENM=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-6At96R7jSDAjvC7Bugpg4L/aHgHFQmBOdKcOTa3Y940=";
+          hash = "sha256-QngCharrjiDKrY7RgWtKzIJxjXazuRvpuHVUAxknWfA=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-GB/QLRmtY/cVs4lrU8OFnWgztJSF8e07VADIra/et2s=";
+          hash = "sha256-QPRZG7/Pjo9uboJl/RH0cdNf+zGM+ZRxdaMULxl34Jk=";
         };
       };
     in
     {
       name = "continue";
       publisher = "Continue";
-      version = "1.2.22";
+      version = "2.0.0";
     }
     // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1145,8 +1145,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "8.5.1";
-          hash = "sha256-adpTh4tNlWFdAGultTLZ9SfN9sMOpMaMWq8x6diGzBg=";
+          version = "9.0.1";
+          hash = "sha256-P2GoE92SwGMb45On5ziTZ9dBjPb0VnFSo+4TEwrcWuM=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.22.1";
-          hash = "sha256-ln9DcfjW0QO7V6hF+QNqy+V13hbjWwhsisrgZPrk1R4=";
+          version = "3.23.0";
+          hash = "sha256-bbyFdb/hGPV93RJecdx6uozJIOaKitBBhwlI04s50NU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1226,8 +1226,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.11.0";
-          hash = "sha256-9izhQvZmfUVeKS0H89XXkN1bNP4+AZyUuetfD0kRJ/c=";
+          version = "2.11.1";
+          hash = "sha256-QegVk1SJM/RegAVj7isgFcHwAJyQj9YDuP90u/7weSo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1567,8 +1567,8 @@ let
         mktplcRef = {
           name = "elixir-ls";
           publisher = "JakeBecker";
-          version = "0.30.0";
-          hash = "sha256-vHD16liYmcWeiSP16QqKhPst8e7iT9wZ1vGT5gV6xoo=";
+          version = "0.31.1";
+          hash = "sha256-eF0OGWpiu5aDiFp8MFP7j2r2+3QCPb1q93gWg7L/Xzc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.43.1";
-          hash = "sha256-rZjdBzqXpSG4aCMjRCmIrWtQdmmh7vEJQLIuH65Ewf0=";
+          version = "0.44.1";
+          hash = "sha256-OH4i4cGh/ivHQNAI55FHjM9ZjnhMaJSnsuQUnxub9/g=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -1884,8 +1884,8 @@ let
         mktplcRef = {
           name = "godot-tools";
           publisher = "geequlim";
-          version = "2.6.1";
-          hash = "sha256-x+u5t4HB+uM2CbhSw0h/zoYPgBPTZNFaMuzL+KB9mAM=";
+          version = "2.7.1";
+          hash = "sha256-TNCMSmZdBXxAHkcFLpTDkCzaXNO4yvkCfQ8Xrb9gquo=";
         };
         meta = {
           description = "VS Code extension for game development with Godot Engine and GDScript";
@@ -2015,8 +2015,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.81.0";
-          hash = "sha256-0IN00IpgON/2nNl5/eQn+KABNtmG2ymVULOBPvi2dYA=";
+          version = "6.83.2";
+          hash = "sha256-IsiK3A+aVlYKnTSkgeTz4ZZc1rXiYCKDXPVrJsnSFRk=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2184,8 +2184,8 @@ let
         mktplcRef = {
           publisher = "haskell";
           name = "haskell";
-          version = "2.8.0";
-          hash = "sha256-Tp4Ahfp3Ma9aJtghD+mgsCBTMOP1GI1vGE5xzvHO+d4=";
+          version = "2.8.1";
+          hash = "sha256-mAlEy5a83BRhUhA22AKheP6PPpfbrdGT6HsTKbFwJYs=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2670,8 +2670,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.215.2";
-          hash = "sha256-/3ULGcywO6SHvABRxaLXJQpjcrVs/vZxUGpG+NaSx3s=";
+          version = "1.219.2";
+          hash = "sha256-LQ7UL+/FtzRxn/M85fv3oh8g622KEPS35lque3kqby8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -2906,8 +2906,8 @@ let
         mktplcRef = {
           name = "vscode-ltex-plus";
           publisher = "ltex-plus";
-          version = "15.6.1";
-          hash = "sha256-UOiYjA11P7xqPFgdR7eS63wOQl9dqWAqBxz3nklapqo=";
+          version = "15.7.1";
+          hash = "sha256-wOwOD/rsUdwGJ24n6NkH1XY5Hf4T6LE34nFDOteubLY=";
         };
         meta = {
           description = "VS Code extension for grammar/spell checking using LanguageTool with support for LaTeX, Markdown, and others";
@@ -5266,8 +5266,8 @@ let
         mktplcRef = {
           name = "csharp-ls";
           publisher = "vytautassurvila";
-          version = "0.0.32";
-          hash = "sha256-dc7aIUb+5fdmqVeHrysy8jjk0Sx6ThIsO9KagdQpx+M=";
+          version = "0.0.33";
+          hash = "sha256-VsNjdPmnstXgmgxzbC7+IGFggfLtYlQFsH3tGWjdUhM=";
         };
         meta = {
           changelog = "https://github.com/vytautassurvila/vscode-csharp-ls/blob/master/CHANGELOG.md";
@@ -5482,8 +5482,8 @@ let
         mktplcRef = {
           name = "markdown-editor";
           publisher = "zaaack";
-          version = "0.1.13";
-          hash = "sha256-Si8/piNNktcyRY8o8o9my9sP9NEwrNuySVjlyadDjtU=";
+          version = "0.1.15";
+          hash = "sha256-wNGIps0Y/p5X/lutOh1gTPWXh0zpdTm5fFiccba6Pww=";
         };
         meta = {
           description = "Visual Studio Code extension for WYSIWYG markdown editing";

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -1,4 +1,5 @@
 {
+  stdenvNoCC,
   lib,
   vscode-utils,
   vscode-extension-update-script,
@@ -13,7 +14,12 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-nK97C9ZYSI6dh4w1ntDP0mbmv6ez3pyAfv/4D30I2sA=";
+
+    # Because the binary is removed in favor of the harper package,
+    # it does not matter which binary is fetched. Using only a single
+    # hash makes this easier to maintain.
+    arch = "linux-x64";
+    hash = "sha256-xCkGgDc2XfM1A2RkXC4CiMadVCuizrCqR7ZKAjh34RE=";
   };
 
   nativeBuildInputs = [
@@ -23,8 +29,11 @@ vscode-utils.buildVscodeMarketplaceExtension {
 
   postInstall = ''
     cd "$out/$installPrefix"
-    jq '.contributes.configuration.properties."harper.path".default = "${harper}/bin/harper-ls"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."harper.path".default = "${lib.getExe harper}"' package.json | sponge package.json
+
+    rm ./bin/harper-ls
   '';
+
   passthru.updateScript = vscode-extension-update-script { };
 
   meta = {
@@ -34,5 +43,11 @@ vscode-utils.buildVscodeMarketplaceExtension {
     homepage = "https://github.com/automattic/harper";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ MasterEvarior ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
   };
 }

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -13,26 +13,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-VZKvoTJ/IKxYsEJl0XhtglsggmrYdaRUlXCpDv/9fQ0=";
+          hash = "sha256-htZGjy7ZnQLGZUncokGaGHyLpvPM5jzWUvCdnfN1vbM=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-jo+fET/IyOl2zI/xxYy3KwnyOegTOXFhO1hDg5QtWrQ=";
+          hash = "sha256-OFdrXunh63xBZW/HwDDjj17TTiOLGY1Enb6ARxNc4bI=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-HOSKZjozJlWn++P5bSwWdK3I+fgsPtS8kyvDWHMJQAY=";
+          hash = "sha256-rgeNJbl6G2yKAWYW7NarQwVLmd3oZ4YTOVeCUat6ZqQ=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-ABBYsSR3HQgSnnXUJXsg1DwqwFj9W6CT59/1fuqWsTc=";
+          hash = "sha256-YBapB9XZ1/fUOflFDxZGT9rnPTumHQR/PfmyISHAAkY=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.29.0";
+      version = "0.30.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
@@ -48,8 +48,9 @@ vscode-utils.buildVscodeMarketplaceExtension {
 
   meta = {
     description = "Jujutsu version control integration, for simpler Git workflow";
-    downloadPage = "https://www.visualjj.com";
     homepage = "https://www.visualjj.com";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=visualjj.visualjj";
+    changelog = "https://marketplace.visualstudio.com/items/visualjj.visualjj/changelog";
     license = lib.licenses.unfree;
     platforms = [
       "aarch64-linux"

pkgs/applications/editors/vscode/generic.nix

@@ -149,6 +149,7 @@ stdenv.mkDerivation (
           extraBwrapArgs = [
             "--bind-try /etc/nixos/ /etc/nixos/"
             "--ro-bind-try /etc/xdg/ /etc/xdg/"
+            "--ro-bind-try /etc/vscode/policy.json /etc/vscode/policy.json"
           ];
 
           # symlink shared assets, including icons and desktop entries

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "9723c47c2d782ccb8cf48f96568a89a44631e6ba";
-    hash = "sha256-zYIC0up0tkvq0TLjSiypxwSTYAF1XnmHXsUTKsUQejA=";
+    rev = "845a1fd30f895ab69669f03c97eb5cfbf0f8d97a";
+    hash = "sha256-fy6LSeOlIQkrLGnMQhXSR4EwC+4crAirQKnWt+7S1cI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-06-10";
+  version = "0-unstable-2026-06-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "e126237dcf44622deaf18e7668f07ba96c363673";
-    hash = "sha256-6M4revCs32ffmUjhl10nL/MsVl8QRn6JQmC7NzDW1Mo=";
+    rev = "0108c5ef3a2261a20c54186ce76cfb4d9ea384a4";
+    hash = "sha256-O/L6+JFCOZtRec40S4xMaKh7A8HteZ5L8GQjrhhRfUw=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -73,13 +73,13 @@
     "vendorHash": "sha256-FHBpTYSmVivoqz+Eaa/r5y1f/saIx4l6mjOtZhxZVRw="
   },
   "auth0_auth0": {
-    "hash": "sha256-WXqZ0566/BrpidrxbtbTf5VOqBmuXTZiqHlw9x2Wkug=",
+    "hash": "sha256-QNVACeebepZMCYMn284KUulqnYMU5Mt/e65o+dSRTxg=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.49.0",
+    "rev": "v1.50.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6bWfFGBa19Po/26ktT5BKKiowNsQwxnpOI6orA2GweY="
+    "vendorHash": "sha256-wW3dAmDl1qhWlCcTlujdEGB0GFQsgD0YmrGENYhg/qY="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -319,11 +319,11 @@
     "vendorHash": null
   },
   "digitalocean_digitalocean": {
-    "hash": "sha256-gvLdDUFg8WoBg8+351CCK84LhLJlsV6Nqm9kbxlQQ50=",
+    "hash": "sha256-SguubBNjYqWuxeYkCKoPAK3Vvdv8wdBJfnvySwBQt8c=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.89.0",
+    "rev": "v2.91.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -517,13 +517,13 @@
     "vendorHash": "sha256-Msl/Mn0GK3D+QyLnSFU3m9ux/ThkwDCDh85b0Yzpnjo="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-/4NhHZs/8LwrL+TXoOGyszvHZcKps5tDu7uewKeNmb4=",
+    "hash": "sha256-ZQaBYZTsF68IjbRYa3Z7VRqKfaHCvOtMkJHsybJn+ec=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.88.0",
+    "rev": "v1.89.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vTJI/71O8u6DqAF3E7pde1Z1qsoyTTJMNen3AvRomls="
+    "vendorHash": "sha256-9FzpBgb3BzIVhx8kqhyDJw/liH6X8jUhFmwtbic4uVw="
   },
   "hashicorp_azuread": {
     "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -833,13 +833,13 @@
     "vendorHash": "sha256-7mJ+BX7laBKsr4DX1keMXnGi79CZp8M1jD0COQ1lcmU="
   },
   "kreuzwerker_docker": {
-    "hash": "sha256-wC0XYOGx3CBrXOkISmYFMMqcNijl3u2XZzrVOPF+EDo=",
+    "hash": "sha256-prvQBNT2OhKmH0ABIs7saRqpURZwO+ntfIxoGe/KmMc=",
     "homepage": "https://registry.terraform.io/providers/kreuzwerker/docker",
     "owner": "kreuzwerker",
     "repo": "terraform-provider-docker",
-    "rev": "v4.4.0",
+    "rev": "v4.5.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PIltVJ3o3ROFi1ensrJyFYEsCm6nEFXHkkTPU3ho+gU="
+    "vendorHash": "sha256-EAv8EeNn0PJ3BElmg6sKkd/LXNe0lFjEIjHuZRG3CoQ="
   },
   "launchdarkly_launchdarkly": {
     "hash": "sha256-PgAK0BUTSyW4CXssQkENohnhtd2O5GPuFVvSDcHWjQ8=",
@@ -968,11 +968,11 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-eteX6j+gtWsxN8UdttP1YjCrBlzXVVrhOT+kiw98gFo=",
+    "hash": "sha256-sUawDMMhwCo2xqnPNiaRMGKo3rRxNGjLEl2NYwfVuMk=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.93.0",
+    "rev": "v3.93.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-fCdwTWYbwuJUh+9WeVN5WmpPxdop49oHZ2cUm3K5w6w="
   },

pkgs/applications/networking/instant-messengers/discord/sources.json

@@ -1,627 +1,622 @@
 {
   "linux-canary": {
     "distro": {
-      "hash": "sha256-S1GwB+65+Y3uEr6h54IB8d2CWwCcMevfXZGTyspMZ2w=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/full.distro"
+      "hash": "sha256-9YJW4dp8VUDItpIQ/D/24aoTv9BBzewHskbO423DI4I=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-If+B4uqvOvS7NTnnstequpolrxIcM9MZhAsDCkFMhgM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_cloudsync/1/full.distro",
+        "hash": "sha256-q9PUaa4kUTuNzoICdKa+CLY1A0E2X6+GJWeN9wZzx4E=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-N7To9vgdOc20omNyOEWnOexsE83nO5imp9/coliuJZY=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_desktop_core/1/full.distro",
+        "hash": "sha256-PfyNWcY8pXFV0imNwMMDX9cy8nJbib/4CxoLxcrnKHo=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-BQ3bPkjNGS8v171JMayHdRyqbB2PX0Xxdrukz3MpJJU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_dispatch/1/full.distro",
+        "hash": "sha256-dIX2q5JyyeIfZw8hu8H7mu+GfSnDym09ePIVRN89YbM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-E/rjqsFNFLWLZxHqAzVHvRmoI1pSWt7my4C+2mNUuJE=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_erlpack/1/full.distro",
+        "hash": "sha256-kInDtc5xfygCjVXcMgXhuJjA8etUBAH8YBAp9Ap2JnY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-oUlod+YECmdqy4c+sWPZt1yYvGZwYimoIVRPA5v6r+8=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_game_utils/1/full.distro",
+        "hash": "sha256-0jbPTDyXQoXffwH+1+J1s6zbgvUljVL+mPWGtGVuTBk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-xDEDlwIInDVSRISoWb07KQvVOqdNxzjWM/s5R/1Ra44=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_krisp/1/full.distro",
+        "hash": "sha256-2TInlgg96P6elUWnLyd9hOU8i/gdKqXpze1K7ioPA2Y=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-Gh0JBMfaX63sUIGQ+OKqrSzDuADhjKJB3ger9ONkz9k=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_modules/1/full.distro",
+        "hash": "sha256-XC+1tSCpM9ZuJMQloVcuslH7grRog6ojrkOSpgDcQuA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-texX0BTDW0Pef2gMmkOFjxikKIBYIKSTT+Rsk8Zdn5A=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_rpc/1/full.distro",
+        "hash": "sha256-HiOy+5mxBRMa+McDqIACF2e5ImYd8Ovqr4d9XTAeUR8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-NrhpLEVLW3SqoGGiFcNbcM4sQQzW+6mkUaI50Ry66dY=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_spellcheck/1/full.distro",
+        "hash": "sha256-ORY9xLnjdcCrZaHQMnyzJdJmQUYy+3bk+xsQSYyrGYE=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-uXPBkrdnXQnYs3+oTn2gds+au+ZDMYNvOBXTjjhcFsQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_utils/1/full.distro",
+        "hash": "sha256-SOt8SpaC+tfE0fhXjqdWQ2y6UcPV/ynuGki8UizwK1w=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-UeXNXR+BHljnW5Xb/E9CrJhBv5hchPS6R1P0dvKoZGQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_voice/1/full.distro",
+        "hash": "sha256-sDutxfcbq5aGI5G63Ta4jbj5ny5yNYBUJx8pklnvkYw=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-llG+0+Z0boy5ZhtPGiCDUr4sVa4mdR6FjT71ZSX5ez4=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1177/discord_zstd/1/full.distro",
+        "hash": "sha256-bwOySuEuD59oKIy/clAiqc3Kt4jclQej7kU/vB7gGDc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1317/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.1177"
+    "version": "1.0.1317"
   },
   "linux-development": {
     "distro": {
-      "hash": "sha256-Je/HUlN3aWGXRKj7yFv4S5YtlrCyEZNJ+GPJlG3GA/U=",
-      "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/full.distro"
+      "hash": "sha256-1HZQdXs1DlEjwK1L4m1c/LxWhDC0MvDg61usSVpOebI=",
+      "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-tZVDeeocUb4lcx8fBGLvzW7cdws4vB0Tsu6LzwS7Jyc=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_cloudsync/1/full.distro",
+        "hash": "sha256-hdBSBtBAlA+U62YMM5H0kOeGiGklXrvRJQ3mGAc4+UA=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-qVhVFbRuUYMWoONhmc1aQFRYtCOBh59xiMUIBsIInng=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_desktop_core/1/full.distro",
+        "hash": "sha256-ZPLsRV8WY2pwuzwx8UOVrYowMxgPLx4twwA1efgvz8c=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-hGGTK6xHBTyMHXTs4uRcms9hA8zpv2h13xuZW/K6FHk=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_dispatch/1/full.distro",
+        "hash": "sha256-Bu/0l7/tHr4MN9oHuRPPJ68v4Q12FxCscDbQUdshmJ8=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-2i4dMQQQV0EO2rafVG7no1bMVOb++qkwga5I4hNiJ1c=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_erlpack/1/full.distro",
+        "hash": "sha256-OcwmhtXtvzBDTXmZqJzv4Borscxk56nqQMzMI4zhYIk=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-l5STKk1FYHIWLpq/dVwsY5Q8ce89EiSYZyKE5drzpTQ=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_game_utils/1/full.distro",
+        "hash": "sha256-FYbvqD1hqDARMz9WBPoDpfP9k66hzT0Yk1O5wEdTi1A=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-93GXORqBh2IDZz7gwC1lLP/dHwfXK1wqfOdDl7nmy6w=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_krisp/1/full.distro",
+        "hash": "sha256-4ENv3/G1h2dhzWvQwbxRHLVn4U8GqXkVqI+Vs5S39Jc=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-sMsii7pOnusjkmj9gzhRbyLGzAusYhizzZ0Unry+oYQ=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_modules/1/full.distro",
+        "hash": "sha256-r2j3yDQzsQMVn7mjICuPiMVgznAVwgvCip8P75piUb4=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-M6FtXDTGWsqafyQPsVIPJ3F0zUiJZxejuAGJg5MxF+E=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_rpc/1/full.distro",
+        "hash": "sha256-cgGk6IvD2cLTugbKtS+23WxLckGPiFIwHa9X6hiwmEU=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-pkJLh3aZ99E5wuBF08uEU4fP9QqDn9Xrwtbk4i0Q/Rw=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_spellcheck/1/full.distro",
+        "hash": "sha256-7WL+UYrZaw1uDZXRqsGgjaPdcLOKb85SkDAF4xeyQkQ=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-f01INbXJ1l/L5VuskTnz32YF9NH2R9/Apla2iYoEF5M=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_utils/1/full.distro",
+        "hash": "sha256-Djt6iqhFbNBRUecbaHOKkNYTprwA4DOei30l6B4f1Vs=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-YDij0YVearAetTN/1j14eBle+7LKcYGdE1TDIbWH27Y=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_voice/1/full.distro",
+        "hash": "sha256-R0X6K5EsSr2/whZZda2NDY2+gX9jpEfOddJWIz3xW0c=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-PC5yxqN/ky/ThGRMCCKBSZBqVUJjAV+sl41LlPCvHc0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.992/discord_zstd/1/full.distro",
+        "hash": "sha256-MKXHjhRm/Nxxt8eAIx2axXUzAqm9hgPadFNe60HE9HE=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.997/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.992"
+    "version": "1.0.997"
   },
   "linux-ptb": {
     "distro": {
-      "hash": "sha256-hZi+7k6+KoroSosJ5jOmhfKCrXqK5mzMlChvd+O57lE=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/full.distro"
+      "hash": "sha256-S1Nyb7mkVX7BZ1QuCFy9mMENY5PYOD5ZoPYExiExWMo=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-g63Wz47H63bOiyLJ2V4/4z6ZpCVZFWkdJUEaYtTzv5U=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_cloudsync/1/full.distro",
+        "hash": "sha256-J+c8FEtoACGGCD38fA+IWJw9cKLEuz8xwAASOa/4AMs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-78r6lth+V0OPEEJQ53FZhDGAS8RJ2/gGXqROi508Rzk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_desktop_core/1/full.distro",
+        "hash": "sha256-7nguOkkH1uLyVX6F70wLAZZzo0IMetyc5MS+GxqWdfI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-Q+1rU46jP3/GuJ3yjvVk4xC0xHuY866JCPVsiqE2/Dk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_dispatch/1/full.distro",
+        "hash": "sha256-rWvu1QPaBLRWPs/VTFzGWVigKDapRs/Tx2i60ieYb3Q=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-Zxv+pZIiX/dgWLtQu+ouJIiaDECBGgcbxzVst/x5QtI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_erlpack/1/full.distro",
+        "hash": "sha256-Eih3jAe4+q6xzKPHZtdg1nB/ugeHdqR26pvIaSYL0xM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-HxQldTPK3dGuJyRKw6q23iyR4rO9UkASHa/F7zzHbX0=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_game_utils/1/full.distro",
+        "hash": "sha256-Je5KFZ5pAU3SOPAbQJHpD2eE/Qzj7g+a7SXlvwfvQSI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-ptVbz0AcEttoldc7WV/nD1lYptJTnIy8p6QUD5pbkYg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_krisp/1/full.distro",
+        "hash": "sha256-DVESIQCdKIBlrpFw7PtO154JFgyhWQkUlxDiIooUY4E=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-ex9Jud2OTjcWZbcx+D39uyIrh6K5OJANCMc+zfx0Sv8=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_modules/1/full.distro",
+        "hash": "sha256-sGv+1aWjwFXC0FN/ZvyWloqRZ1+x0EhdR76UcZqSosI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-TZqW1pxrqVIszGLBcoKErZUoNGNeepRHNqaOXoG9rHs=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_rpc/1/full.distro",
+        "hash": "sha256-0TJv3qj7j6wWyQE7ux8Bx3tJ87P4fj6W6ike+1cT09w=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-a20ZUdyDnnG31DnJP1+ADZxQbk3B1YKPrNPcb13S//4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_spellcheck/1/full.distro",
+        "hash": "sha256-JcNMteYTvz7jf0IXCQPi2e8yifIcSgiYviQ1UlPmin8=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-W7m6Ql9L5GwRQnx9TUjbRZ8c0HGFfFriMoF6HC/RfZg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_utils/1/full.distro",
+        "hash": "sha256-+WMYNrb0H0rR6decBoUloWDUvkq4TeRYsyRbMbKdh38=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-S9z/eS5P4sn5yuPdHP9HrmreEIU5vE44Np6QtHVdZm0=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_voice/1/full.distro",
+        "hash": "sha256-AFQ49Kk3WPB0sz/ZwhNXhZleU5CFTwQvXaSrnx1NzSo=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-rhoLsPy3zW5+bQuGYGxMtgDHaICrSKapTQD4Zcw3GHo=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.193/discord_zstd/1/full.distro",
+        "hash": "sha256-mBnF4mFTBQjKAAGoQyoJds9wjVfJXnuwFflIc8f8eiI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.196/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.193"
+    "version": "1.0.196"
   },
   "linux-stable": {
     "distro": {
-      "hash": "sha256-XqiD6DtJgFPmh4cSBgbvz52uBnJ7FUZ+VMcB9KxBzeE=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/full.distro"
+      "hash": "sha256-EHDShPB/ytnwKaVtMSZ8Z475TFxDVX5eZlH9+8a5yEQ=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-NHT/o5cb0VQZQ4CaItCHTOkfXEjYqPlIA3gSSLvCgJk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_cloudsync/1/full.distro",
+        "hash": "sha256-0kZ5XGJl4k0zQDJd3dW9bhzYn7n0R/3zZ++6Ls81UWA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-THCGUwshMlNWCHgTf0d/W2SlBDEUcZ5dg255O4DwQHQ=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_desktop_core/1/full.distro",
+        "hash": "sha256-cjWUlqhyk4/YQ0ST35ujWQ4FgzWV2ufynvUgJFXD7OM=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-C1742juma1bCGVWMCT903BFHNedc6V+iws8kKTQBE4M=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_dispatch/1/full.distro",
+        "hash": "sha256-YeInPLTYIm2Yts2w+YQm3LKyU8YDVoPVqa3mu8BAGnE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-IrLq1n96rm1YE1UA/P2b9VHzX09Wa4DT9yj5wHhytno=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_erlpack/1/full.distro",
+        "hash": "sha256-7bCspbkjmFJ4hznqjoIyEFSpFk+sIc6Tzc6nrWSQOfw=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-Y3shNsfjcBvSvUt+D56qIMaa73lpF/+c/jURWd9hV/g=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_game_utils/1/full.distro",
+        "hash": "sha256-4QZ6F90heQGk3uER85X/JXAKKIirwWFT9zG5tkW7qEY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-b+n1X67Iscs1Cjq7KbpXBqqIC35tWqaQh/hPEbq0vuc=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_krisp/1/full.distro",
+        "hash": "sha256-bkhdL8hiREog48HmxZVdhHNbI/ruErb7Liu0NbuI0eQ=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-U3f+1y1WlGZuP5OlJ4AeakhNYXlx5xbKqHjiCFfGg0E=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_modules/1/full.distro",
+        "hash": "sha256-JQaSnEx7vDbrlwYatKApt2N1C6WzUZhOO+ScjsdtSAI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-rtBhw5MHG/MCAVG2YvzKOEVmN8f02DPI5LBKg8Qj9ZA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_rpc/1/full.distro",
+        "hash": "sha256-MVq1mbdRkXrz7Zwi1tPgdnlCpnkq9NF5R7F26Wr4NHg=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-BFTkMV1n9ann2c+GMiuIHZexGO8C/yOi8sbBWrqErKE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_spellcheck/1/full.distro",
+        "hash": "sha256-mWb79Esw9/ddMVNMUrmRX45N+EMW8Kz+ugbGkQelDlA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-isXprPxivFIdD1Cvb7tbhdWSNPbU3Rrv2muYg6tXW0M=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_utils/1/full.distro",
+        "hash": "sha256-TtDw051M2y29TvLdXbcq8Wy75KsvYy+Bt9dDHkY7ExM=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-v60GjLJ3LuAppMRSjZQNWSLEamswDcTm/AjtwG04fgM=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_voice/1/full.distro",
+        "hash": "sha256-8x/uLNdrpIsPM9L3uPdGu3r3o1M0O12918dTKdfPh5s=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-Db8KbISU5W8G0qfqGaumrOZU75B6IWBzf3JFIyUzadU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.141/discord_zstd/1/full.distro",
+        "hash": "sha256-5iGxBV1thj4WM/eRcv9ous31/tRgr4OVc3xgbneC4Nw=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.143/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.141"
+    "version": "1.0.143"
   },
   "osx-canary": {
     "distro": {
-      "hash": "sha256-cKGa089UswaZzoAHzkStkROitXDNUMmGENQzUkrmTlY=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/full.distro"
+      "hash": "sha256-BQuscZlHaaozENpmeQiHAEi8H6ReyUT7L3nmzXB95gU=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-9QGggOph9Xs4Q/LjnZ3KFwhXxgNRyli9fNoFz6H3jqM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_cloudsync/1/full.distro",
+        "hash": "sha256-o6UxvrqBRzEr7V588VnoYzkJ2InPX/rgn46c6hDVPGI=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-UNTm7ItVQkEIEb6htmc13DxEJdqli0uL69OR9ADVAEk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_desktop_core/1/full.distro",
+        "hash": "sha256-tRF0Y7LvzvARLjmRdnFQgjQBICknzPyxb/4YAyxJXyo=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-TihLreO5lbuQGAxljjAaPZVr+KGmmveqTd6tUYvKV1I=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_dispatch/1/full.distro",
+        "hash": "sha256-SQK+Z6gtAu35Idx854zxQrwAV5FvYUYECkp3a6saG1Y=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-oaUEWbrxizY/kP1IPHhumErlTKQVQMRyt5P/7dJU9DI=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_erlpack/1/full.distro",
+        "hash": "sha256-ifjvoD8qhtciEcMc+bSC/y77bCwKqmwqUWTTwPNJF8k=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-KCA77WXi9MFBfH04DLpiJCcUnX6V03UbiN2ZhvR951k=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_game_utils/1/full.distro",
+        "hash": "sha256-h8fnthereq6ocgaxRQCXrCAod1VzWu9FSkCZOAQudeU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-LDzacYKK1/6blKRI+9fLMz83GT7QpAkw7R9pFzpO2Rg=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_intents/1/full.distro",
+        "hash": "sha256-ZDOy4W3jm3kRwV8IynOR4AUKoKq86Jf5GZUnUHz7ohk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-Xmcukut0dljr87fHH3hLuuum1aKaEbyz6/Doy+5aOOc=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_krisp/1/full.distro",
+        "hash": "sha256-/v2bmmi6+jmIhtwaJFY8ZxUH9u/glnlxGtTvmre2mS0=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-EAPj4leGDWMV/80fZUJjgsJDea5e+GAEhl8fyU7i/7o=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_modules/1/full.distro",
+        "hash": "sha256-4NR0Y87njkeavPvBNRHREqT2DNeRZyw9ic2hMFfyuRg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-N5ZsYM7Y/XcMG6nOc3xVd4zg16MlozmZXK1xO3ARW/8=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_notifications/1/full.distro",
+        "hash": "sha256-0znPK/iGXuNJRNzyA7atiSDs6jSQi2Yak+PS3cmgM/U=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-NvwdAvR6fZd/Hlcw3Kb5sINche3ZdiTwQO0P0nY3jVQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_rpc/1/full.distro",
+        "hash": "sha256-TUICpdWb+aHJbD1OwDbSkrWmkkgI4tEyaApwax9ZlJg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-4V0Ij/kniCO46cmy8pYOc7Hu2VFRuSYx1EmTV+wZDsQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_spellcheck/1/full.distro",
+        "hash": "sha256-Q8QJAVjPgEzFh9kR+9g9LeY73QDXSqLZBXIrn4O+aPk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-zPVB5RaxPLSyakY8ZqyyVNWuZEJog78KOROHbupxTSs=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_utils/8/full.distro",
-        "version": 8
+        "hash": "sha256-3t5uyx7jPOnMWtt4a70HOQs01U8mqUVyc5k2SJ1ZANA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_utils/5/full.distro",
+        "version": 5
       },
       "discord_voice": {
-        "hash": "sha256-1CSPUCxqeLQxSHZWlSeAYIj9XqCXWD2gxcR4F9kd+54=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_voice/6/full.distro",
-        "version": 6
+        "hash": "sha256-S5YJPauGurgYnjE568uZ0SGgNTIHkttcQr3D0W5RJxc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_voice/3/full.distro",
+        "version": 3
       },
       "discord_webauthn": {
-        "hash": "sha256-ZMo19cg7Q0uXdDATAHkYWzDrU44jXicHeqpsIiA0iEs=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_webauthn/1/full.distro",
+        "hash": "sha256-GClieyAeMa6N0ulE5IdsOfnTEPm0X5Xms5KG2U7nZP8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-NyK4eH6joep5BzM91AZLRU3jXC2sXdSp3/s4w/Xqkn0=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1132/discord_zstd/1/full.distro",
+        "hash": "sha256-Xj4P5YsJKQcyfVxhGFOTpmcxycExj8qxAhP7ptB3D4M=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1165/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.1132"
+    "version": "0.0.1165"
   },
   "osx-development": {
     "distro": {
-      "hash": "sha256-9rlxgLp8PxtuFSjK+nDshIiDigjsBjox2bUI7cp1XXs=",
-      "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/full.distro"
+      "hash": "sha256-NDTB54CLKI6Ib9bZecjLxulbMHE1+5baW8MZkFR+fR4=",
+      "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-6DAvT/Rocsu6tYMMt4VJMmfhYxLw1Hl0EgJK6hmw6j0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_cloudsync/1/full.distro",
+        "hash": "sha256-JMuSMLvHf0yGAShv0UqKxgf0vbe+RU8pDVG0QdRpCd0=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-xA53RC1WAcsmyKl5c2f2CGhFzficibB/h7psEsr3IRs=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_desktop_core/1/full.distro",
+        "hash": "sha256-l0n/Q/0DTAaqVery5ZezKK/TWcNW5FvroytdzInBpqY=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-ebWRxbIIsrf72bj1NoxamL2cxZNrmvkRxfB/jXS6HmI=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_dispatch/1/full.distro",
+        "hash": "sha256-Jp1Q+8GtvH5uM06NDRFhRjQXwFjNnlXpX0K4ziYdsKQ=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-GLaAXTePgAWeRwVskt+tBtrVTn3miadBWImPMibG/+Y=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_erlpack/1/full.distro",
+        "hash": "sha256-0SR35QaALv/01OxXK1hV6V6hY8INOgOm0CRgEQrk9+U=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-A2+GyRC/RXTMnDagsT6zP1S5T+PCyMK55eiEF2JMV84=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_game_utils/1/full.distro",
+        "hash": "sha256-nwiDtajSk3TzzCubr6Xqqf4mKQaNk0T9HfLhtHq78Ws=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-sjylilIyOziJgH4gl+1Y6oIB1drMF7EWrt2mVMliCoU=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_intents/1/full.distro",
+        "hash": "sha256-NoqCBRCFQ9TwvrLLYLRtdsr1nnEJTDS0q6rsWhnOL/s=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-w4ZRMT30/KzMrXv0wxUd0U9yv95jOVhSG/6zzbrBaG8=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_krisp/1/full.distro",
-        "version": 1
-      },
-      "discord_ml": {
-        "hash": "sha256-TVyM430eeKoq9RNXoLmd1xe2t3xqgxmbQd5G5+chcnI=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_ml/1/full.distro",
+        "hash": "sha256-ARHk9F3I+B6G3wFxWhWeIekAfARjyw0WJr/muxkNEQM=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-TKsAh8tNHzQELizvKfMcfLvm0h4F69iON2VBIWq3qxY=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_modules/1/full.distro",
+        "hash": "sha256-8dWTYBh8nzJOFGCTWyLLZhMOF9Q/fc5YoHAL8S5h0tU=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-O1+hqRWztrhlYvyHv/oYTO82Ru5VRwPxo7FyAQSbgkI=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_notifications/1/full.distro",
+        "hash": "sha256-QuzxdrGVmdXS9N/25iXGYqoJVXxOmw4ku2Avg8XNR2g=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-zcx4PDynhCApRWJyI1KA8t4IS0flDxtc9NGiT3mqaKY=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_rpc/1/full.distro",
+        "hash": "sha256-zA8o1tDIKL2gmXOPF6VKgT3g0uclgXL58pmW1Vc88Og=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-A0gObDSLQWb3Fp+f/xQC8ij2mGBdzeHMuC+A5+XpZdo=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_spellcheck/1/full.distro",
+        "hash": "sha256-/ys5eUpR2YqphdAQkw7cuuGgAnn7k2ChBNeV/RQTFbQ=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-SvipA8cXIeeFkBC9RdcNHielVmpwlilGB0mmHFXNUx0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_utils/1/full.distro",
+        "hash": "sha256-mDpF72Uu7/SGyqN6XKlNzo0vgCsPatAq7iX3bK5vSeY=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-BQhaZXj8jVuNtVvGN5nmSfkv2OpETTu+VRt/AZzkSms=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_voice/1/full.distro",
+        "hash": "sha256-P0+ef7UvYffv1Zar0dy5AnbINAEWAgcyMdIdZdNJrbk=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-XRs6HhQ5XOhQZ2CjhzNW8jMFORby80eWUU5FHBN0Ui8=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_webauthn/1/full.distro",
+        "hash": "sha256-i+NSW+yDWZZhK2Yan2JP2zC6N4OBvF4YBjwajwEUfBw=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-9cRSkG1gVP6+casDOnJ1gSknXh1kumIeUQd+EcLtNZM=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.993/discord_zstd/1/full.distro",
+        "hash": "sha256-mzf/Nu6tHl4g+pHWY3sZHDAQrR9IraIZtASQAsIJ9/c=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.999/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.993"
+    "version": "1.0.999"
   },
   "osx-ptb": {
     "distro": {
-      "hash": "sha256-yxbYcpaoUkUlHIC2wf3yVYlxM1KBcCA6vnXqeUctRhQ=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/full.distro"
+      "hash": "sha256-gjtVP0dhhU0d/B1ix61JfyMtqoGAGP1aUxS3Vqx7x5k=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-RDTWKgPcehCjcR1J+jmj+ICZz65ozCMS1zPxroTcxE0=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_cloudsync/1/full.distro",
+        "hash": "sha256-BfU2fW6ok1OkCVtA2Y1LYIeJMelFFsRv/MzZZtZqoZ8=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-w3yILQKWaqX6rXFmDhpakUlw5xFW6LI7Z3CL1lPddsI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_desktop_core/1/full.distro",
+        "hash": "sha256-rI9DtxV6/SvHx29slu9y/tFfsHJ5Xryw5I4iUDZkJ6s=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-RnOLwaCiWS04PFD/d3XLL6erxtDYYrNJ0D6YCcE0uMk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_dispatch/1/full.distro",
+        "hash": "sha256-+UTH+tfh7rxyrgiVXrxBXBnNsneaOmbxE4pC41xLsdU=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-IgeoTXiFWw4BcljPwl7fqAL+Av6bRLFT80tfG5v2Muw=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_erlpack/1/full.distro",
+        "hash": "sha256-Zbwj8Ajq6Sw+ABzRPDaCAXxRfBoDTd9iLKwawHIeCnM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-dOSI1OTNkfxfWisrl9DTA8WRU/PjS05c0ZDzNBbBpRg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_game_utils/1/full.distro",
+        "hash": "sha256-e7/nOrzcQO7rn2no3zScTklYDcp5+BsCuSex93pWaLo=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-EFeUxVEPex20Mrfd04dHYCpfKZM4zIZqOEyREixPcqI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_intents/1/full.distro",
+        "hash": "sha256-MJWw3vfD8mNea/of5KBl2+L/KZkaVI7ong4f2mo7hdM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-XkzYfeQ32JpdzmIOnYBi9bsSSJFCzbSDFNHAPFcAwGc=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_krisp/1/full.distro",
+        "hash": "sha256-EM2P2MCBGaEVfu7drkiz5aA7nLeoA4O9l1x6XwNUSzQ=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-v7Hdk7WO2wCRbJD6SOHfUKAFX8ZVYfe5qhNHnTZvsZk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_modules/1/full.distro",
+        "hash": "sha256-PLlZFGnwf7Yk5ve2tHLWseIv6ycPzbA5MGE7uOhhqWc=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-T+4YM57ZbYZSSCPsAgfqcdVl3Ifuf5q/j3p9YUGHfwM=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_notifications/1/full.distro",
+        "hash": "sha256-QhjNyzXzhpIfHaZBHsL7CHh7WVgfHlGyPFagjIMM9rs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-hPPQ5+jHeJSMG3SythZrndhU2F5sl6am3K1lVtDrE40=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_rpc/1/full.distro",
+        "hash": "sha256-tnLRRUm2Q4zRwdxtfW06Ugad6uczwVYyN10bMis4IyE=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-yIHkUjjWaPTwvlVaKlucpZUimVWbGd3dDOKOoWcJJAc=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_spellcheck/1/full.distro",
+        "hash": "sha256-FQE/W9tKg32IQ1MAiJ/5LoWRvSrt22m2s8+tF4Ye4EI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-DgAQns2Ky1nBABIhTuSfjvLLOry0/sDx6TRUfVqy8PA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_utils/1/full.distro",
+        "hash": "sha256-ECv8ciVQjoxycMF4Gnq37vRmIfoKA8mOM+dmSglfKn4=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-esidGrZQjLpOix2HWYYEPwCoU/QcU6AGM7XZPMvSzsA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_voice/1/full.distro",
+        "hash": "sha256-IS42+iy6WVyNwb4LBDVKMs2AOcOqzn4GYzts7qYU6XA=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-Iwl0cgBmJdAFUSyq+l6wuIAS633yxwBl0lxUktmKa5Y=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_webauthn/1/full.distro",
+        "hash": "sha256-Q9tSvZxrlKObIA7WgQdNpEkeSSwFG6Fp2zWb1LObdn0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-GTWMUSTNYa4ZdmSBy0a3+PejYRITwTLrj5MOZsCVW4U=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.237/discord_zstd/1/full.distro",
+        "hash": "sha256-eQzO+gJC68UI4mf1Pl/reiL4D1QLKHcEVRJ7uyPgajo=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.240/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.237"
+    "version": "0.0.240"
   },
   "osx-stable": {
     "distro": {
-      "hash": "sha256-y8Dr+me5JFnw5/kMcnce1YCjiAN1mqOw77NHykAYQKY=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/full.distro"
+      "hash": "sha256-s8nqZR2Lir7V0uVMA5vOLr2hz1g9Jh3orTHkLEpW7rM=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_cloudsync": {
-        "hash": "sha256-+MaEpY7bCNqJNOk2VcHDBM1ZEEctvkjDJIoO0dCTa/0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_cloudsync/1/full.distro",
+        "hash": "sha256-XHm1w6ruwHeYa3QGzcZyD8j/2zBV2D2nu9ojio/hjoI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-n0i+FEtNF6ZOrZNBzSex5pMUtnR9j6kllCsVk7yYN70=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_desktop_core/1/full.distro",
+        "hash": "sha256-Dm0rh22QooDw76IIR1TaJEC+UMtROJONIn6cTVf0L78=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-Qo1cGTH5wQe4Cpzfld5Z/D/C+BKzjAw/d2nk/EUgj3c=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_dispatch/1/full.distro",
+        "hash": "sha256-BeZdWCWaKu8sHRlpd3arZEcZSzkoGdYHSub84EOAcvc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-jC+2AXMlD0d2+Bcme1lHsAXYn1Dj+vvxjvWK41SvODg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_erlpack/1/full.distro",
+        "hash": "sha256-3GjnZf8WMh5XKLrkFi8o1Cf8j6niiRjMGjEgKQSXE5U=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-HoEsai4W/z6W3sLCGoP6v1BWmuZQvmzOXLLCIUkXNqk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_game_utils/1/full.distro",
+        "hash": "sha256-Gx3AFmew9NtY6jPCjyZAugIBA3R59q1BJpW7JcmcJvg=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-Tk3D3Ail8Bu9+mYbASLJDsSAltD/f/g7q1/vUlIIutc=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_intents/1/full.distro",
+        "hash": "sha256-nNU4xwPopCOcuqnxwfCq1O+j06YJLbouj5V9pk2Wi8U=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-6Vt93M5bwstZEn7mb33w2IlgpvstGa6kGTV+Tza92B4=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_krisp/1/full.distro",
+        "hash": "sha256-BQ5+Gcp9UdKy/rSSYes8nQPu3HL4XbsQTSTcOB6WDMk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-Hl+q4s2zYWa57RwpyZ4p9oEfkUl1ekq6xrKitS4BPN0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_modules/1/full.distro",
+        "hash": "sha256-ZMpIo3KFDhRhzvYisgh9rPZz8BiZT2RhvkiRhBHKOTk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-rnHE+V90VsR9DWDZ9jN2+pRrQu96clqNq9sFoMpiNZg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_notifications/1/full.distro",
+        "hash": "sha256-2gWZFlKvGvD6hESlbwP1SCENIQ6s5V7hTt3HobhRofE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-azkCFwPM51sqHjbgsRCOyoPlBMwf+wVt2qrlTl1v+1c=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_rpc/1/full.distro",
+        "hash": "sha256-pDQ7FUB3xmPBa9lshlctUB/NmhpeuXOeuo0LJ8yruE4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-x7qjYGYC4LDbk3wDxDOjqo/cBoyRJQlzsXpoyJyzFnU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_spellcheck/1/full.distro",
+        "hash": "sha256-u+bno6GbefJDhJFMA05cFUIBGMrF9R8+W8piO6G9q1s=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-sdvSFA7GZS6dUXiemSJpsn92UhaRlNCH9N8UkgQRV/Y=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_utils/1/full.distro",
+        "hash": "sha256-lISFU3glD1xjUOA6tOtQl6hk99vTGZIPnuaMUv/V+4k=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-2/oH5L7MIIsKLavU4J0O8/hqzFx9BpY9LSuSJKaSwDo=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_voice/1/full.distro",
+        "hash": "sha256-Do5yMMz6xoXWExRYwcNw3NHmFIIV3NqQBIU4BJh0FVc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-z0sbteCmrXjvWathL+c1oXL63UV9fhGYtTEOXnBqa4o=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_webauthn/1/full.distro",
+        "hash": "sha256-TRQGedxqhCu9Ge0CcsT+M2Y4ZEdhPdGk5V8IAL3jQOQ=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-mCzmStANoOc4b/UPZmkndzhnxZ1H6Q+rnNsroObPnCg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.393/discord_zstd/1/full.distro",
+        "hash": "sha256-INQGfOUMoGQ7Udb95t3AXYbJxihoaChVs1suvs9WLIY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.395/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.393"
+    "version": "0.0.395"
   }
 }

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -19,7 +19,7 @@
   ffmpeg_6,
   protobuf,
   openal-soft,
-  minizip-ng,
+  minizip-ng-compat,
   range-v3,
   tl-expected,
   hunspell,
@@ -45,14 +45,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "6.8.2";
+  version = "6.9.3";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-1zKAywh6EXGDi5t7CKQRWADRKX0mFEMyeIoK4hrTFFQ=";
+    hash = "sha256-QCGtESg+38lHWCFcsevHdc0kQ7LKJQmJjUJWszphah8=";
   };
 
   nativeBuildInputs = [
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     xxhash
     ffmpeg_6
     openal-soft
-    minizip-ng
+    minizip-ng-compat
     range-v3
     tl-expected
     rnnoise

pkgs/applications/office/activitywatch/default.nix

@@ -40,7 +40,7 @@ rec {
 
     dependencies = with python3Packages; [
       aw-client
-      xlib
+      python-xlib
       pynput
     ];
 
@@ -70,7 +70,7 @@ rec {
 
     dependencies = with python3Packages; [
       aw-client
-      xlib
+      python-xlib
     ];
 
     pythonRelaxDeps = [

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -110,7 +110,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableMpi [ mpi ]
   ++ lib.optionals enableCuda [
-    cudaPackages.cuda_cccl
+    cudaPackages.cccl
     cudaPackages.cuda_cudart
     cudaPackages.libcufft
     cudaPackages.cuda_profiler_api

pkgs/applications/virtualization/virtualbox/default.nix

@@ -72,9 +72,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.2.8";
+  virtualboxVersion = "7.2.10";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "0642ed4a12b7204cd30c0abbc2c10c1cc7ad55ce1756a01e86a16d4b6b066592";
+  virtualboxSha256 = "203a02e3c33ed02fdd75211a58bc9e77c9a8042ad4fa91ddc2914afbd2d67125";
 
   kvmPatchVboxVersion = "7.2.6";
   kvmPatchVersion = "20260201";

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl rec {
   pname = "virtualbox-extpack";
-  version = "7.2.8";
+  version = "7.2.10";
   name = "Oracle_VirtualBox_Extension_Pack-${version}.vbox-extpack";
   url = "https://download.virtualbox.org/virtualbox/${version}/${name}";
   sha256 =
@@ -13,7 +13,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
     let
-      value = "d7301435ee207ff96c5ad372939dc46d39e0f9db2bcce487cf1e8f739a2e845b";
+      value = "87f03161e5b6b1ecfa0024f795eefdb68abc46aa9689f67bb69e7db4ef9033dd";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "169acb9361ade42d32500f51b48ad366fdfdb094b5e3fb422d640c1416a6b216";
+  sha256 = "306b1dea6022647bde19424816b995714fa5815ff7bdf00f6a015bf8af0839e7";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -18,9 +18,9 @@
   libx11,
 }:
 let
-  virtualboxVersion = "7.2.8";
+  virtualboxVersion = "7.2.10";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "0642ed4a12b7204cd30c0abbc2c10c1cc7ad55ce1756a01e86a16d4b6b066592";
+  virtualboxSha256 = "203a02e3c33ed02fdd75211a58bc9e77c9a8042ad4fa91ddc2914afbd2d67125";
 
   platform =
     if stdenv.hostPlatform.isAarch64 then
@@ -68,8 +68,6 @@ let
       pkg = libxt;
     }
   ];
-
-  hasVboxVideo = lib.versionOlder kernel.version "7.0";
 in
 stdenv.mkDerivation {
   pname = "VirtualBox-GuestAdditions";
@@ -135,10 +133,7 @@ stdenv.mkDerivation {
 
     # Install kernel modules.
     cd src/vboxguest-${virtualboxVersion}_NixOS
-
-    INSTALL_TARGETS=(install-vboxguest install-vboxsf ${lib.optionalString hasVboxVideo "install-vboxvideo"})
-    make INSTALL_MOD_PATH=$out KBUILD_EXTRA_SYMBOLS=$PWD/vboxsf/Module.symvers ''${INSTALL_TARGETS[@]}
-
+    make install INSTALL_MOD_PATH=$out KBUILD_EXTRA_SYMBOLS=$PWD/vboxsf/Module.symvers
     cd ../..
 
     # Install binaries

pkgs/build-support/kernel/initrd-compressor-meta.nix

@@ -29,7 +29,7 @@ rec {
     extension = ".lzma";
   };
   lz4 = {
-    executable = pkgs: "${pkgs.lz4}/bin/lz4";
+    executable = pkgs: pkgs.lib.getExe pkgs.lz4;
     defaultArgs = [ "-l" ];
     extension = ".lz4";
   };

pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh

@@ -118,4 +118,6 @@ pnpmConfigHook() {
     echo "Finished pnpmConfigHook"
 }
 
-postConfigureHooks+=(pnpmConfigHook)
+if [ -z "${dontPnpmConfigure-}" ]; then
+  postConfigureHooks+=(pnpmConfigHook)
+fi

pkgs/by-name/_6/_64gram/package.nix

@@ -10,13 +10,13 @@ telegram-desktop.override {
   inherit withWebkit;
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
     pname = "64gram-unwrapped";
-    version = "1.2.2";
+    version = "1.2.5";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       tag = "v${version}";
-      hash = "sha256-qT7GQCqIaEZmbtFeoWMChUX6J8uqs/+UZYi0YoBIYDY=";
+      hash = "sha256-CcYcdSgeVEbGKOzim+Q/gIxMIfDGaSStF4cLLttA+SM=";
       fetchSubmodules = true;
     };
 

pkgs/by-name/ac/acli/sources.json

@@ -1,21 +1,21 @@
 {
-  "version": "1.3.19-stable",
+  "version": "1.3.20-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_arm64.tar.gz",
-      "sha256": "c5f1b1f6db63972d126a2f8ac9aca9a199739c7b51ac9e352e8ae3ed2b27131c"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_arm64.tar.gz",
+      "sha256": "5fca5f021b8202f77f60ecc0ded293fb4af67afdb462ed20dce990cfedc49517"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_arm64.tar.gz",
-      "sha256": "72972e74fa9036c5b40175570234a2e79559776c06a3aa29f632a39c7d3674da"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_arm64.tar.gz",
+      "sha256": "2209f6ab1f7fb4c16247e30115d0ff7c1511161aeae4d166e0e79ec81125a4b1"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_amd64.tar.gz",
-      "sha256": "394096ecd5a6082cbbbc8b2f3e1f1fbe694cdb340e25a4014eeb78461b869beb"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_amd64.tar.gz",
+      "sha256": "4b9c4faa0d635b6e9194b101d4826b26cd6a15c46313f6a5f9436e20e8a48b78"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_amd64.tar.gz",
-      "sha256": "f29fa8b7f01710053c2f4e07723501ebfe448672b669d32d83e961686d383a6d"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_amd64.tar.gz",
+      "sha256": "4e0190233a58276001a3cdff23e4be5e30844f98c639c49cfdeb581b9eb147aa"
     }
   }
 }

pkgs/by-name/al/alacritty-theme/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alacritty-theme";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-06-12";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "2749b407b597790e6f08b218c2bc2acdf66210a0";
-    hash = "sha256-vcacyCQ8XqnDUQ/rx+FBdcKHDfvkxUszIJRZZsvauag=";
+    rev = "659d2e1d669cd5722f11e58c44fd45dc26a6ffcd";
+    hash = "sha256-1GMpnDdfzBIMm9fzQjxYgLNUGA3amvGYgO3VRcd49ro=";
     sparseCheckout = [ "themes" ];
   };
 

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2469";
+  version = "2.0.2479";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-niA8ruXOnYXrjJcciwtl1oYTuYze7ii78XxBviTJ4LE=";
+    hash = "sha256-qaqqzlAV1l43CKZq3mDEwzG1MSrrvdtI8xjo+pe8cMQ=";
   };
 
-  npmDepsHash = "sha256-DXm6gsQltoqo7A2rRwRO6d7XtlHVf1hotAZ1BYvOqSA=";
+  npmDepsHash = "sha256-QjOHebjiF1R24NVM/2u+UHEplzlyQdjzJKQbzltHTkM=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/al/alt-tab-macos/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "11.1.0";
+  version = "11.3.1";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-wVg0HjPC4MYOVNDtFdzcG5P8amrjE3tNNccUAPRGZNY=";
+    hash = "sha256-X59sFQWuT9y3/YGfG/lFoXmoeV/BjHPniDZey5Phb4w=";
   };
 
   sourceRoot = ".";
@@ -32,11 +32,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Windows alt-tab on macOS";
-    homepage = "https://alt-tab-macos.netlify.app";
+    homepage = "https://alt-tab.app";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       FlameFlag
       emilytrau
+      Br1ght0ne
     ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/by-name/am/amneziawg-go/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "amneziawg-go";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amneziawg-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zuP8j3Khw8RbpBlJxoKmTAm3V8Y+c2aL4dNuRIrxWjU=";
+    hash = "sha256-3Uy/zsdmNpcOpohwewPbSNBOzLpyV+zoTdZJJm7XxKI=";
   };
 
   postPatch = ''

pkgs/by-name/an/anki-bin/package.nix

@@ -15,22 +15,26 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "25.02.5";
+  version = "26.05";
 
   sources = {
-    linux = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      hash = "sha256-wYFqT1g+rtoqOR7+Bb5mIJLZ5JdT2M1kcHqJUCuNElA=";
+    linux-aarch64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-aarch64.tar.zst";
+      hash = "sha256-z/w7+TKLW+xi/iJMXGOp50Yjwnv7FD5O0lNsu31dfqo=";
+    };
+    linux-x86_64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-x86_64.tar.zst";
+      hash = "sha256-YiPXBVY/catAzgcqXZajkZxUbV3eHkxJ3CeXXnAGcnQ=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      hash = "sha256-PDlu+oFKWHraPdTuGDCUkO0bhPtkNVibo11B1QkCICw=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel.dmg";
+      hash = "sha256-L/TXKh0cmTop7/ROA9YC4dyBz9iAFRhpXuNRbR3wwYk=";
     };
     darwin-aarch64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      hash = "sha256-RqcGHXN29GDGGuFbrQCBmj3cctzoRQZ8svR5hMYPhxs=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple.dmg";
+      hash = "sha256-c5NZf0uWNB7XQDYBDtgrtCU+A5Cuck0rJ1xFG8hY0Sc=";
     };
   };
 
@@ -38,7 +42,7 @@ let
     inherit pname version;
 
     nativeBuildInputs = [ zstd ];
-    src = sources.linux;
+    src = if stdenv.hostPlatform.isAarch64 then sources.linux-aarch64 else sources.linux-x86_64;
 
     installPhase = ''
       runHook preInstall
@@ -64,6 +68,7 @@ let
       ;
     platforms = [
       "x86_64-linux"
+      "aarch64-linux"
       "x86_64-darwin"
       "aarch64-darwin"
     ];

pkgs/by-name/an/anytone-emu/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "anytone-emu";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "dmr-tools";
     repo = "anytone-emu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RTYLtVCKP2TW7Ery51POEZuCtyRhkgKhoDhJPe18y80=";
+    hash = "sha256-MdxnToDWnF7bLEv9wQpHUCo58RJi54q2tn2ToXOB954=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ar/arcdps-log-manager/package.nix

@@ -13,13 +13,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "arcdps-log-manager";
-  version = "1.15.1";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "gw2scratch";
     repo = "evtc";
     tag = "manager-v${finalAttrs.version}";
-    hash = "sha256-JevVLlWcPu0/inLjzsxyNCcwOTp1jwNMp/rZH9h1wO0=";
+    hash = "sha256-AiIWYb3hwkE20NdmAHlSt55QJ/d3NnQt3ZeX1COUG7k=";
   };
 
   nugetDeps = ./deps.json;

pkgs/by-name/ar/archon-lite/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  nix-update-script,
+}:
+let
+  pname = "archon-lite";
+  version = "9.3.85";
+  src = fetchurl {
+    url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
+    hash = "sha256-ooNvgbtV6HKgzRLgHZul92NLnEB8oX6fHL6iwfHajVA=";
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Application for uploading MMORPG combat logs";
+    homepage = "https://www.archon.gg/download";
+    downloadPage = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/tag/v${version}";
+    license = lib.licenses.unfree; # no license listed
+    mainProgram = "archon-lite";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      hekazu
+      sophiebsw
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/ar/arduino-cli/package.nix

@@ -13,13 +13,13 @@ let
 
   pkg = buildGoModule (finalAttrs: {
     pname = "arduino-cli";
-    version = "1.4.1";
+    version = "1.5.1";
 
     src = fetchFromGitHub {
       owner = "arduino";
       repo = "arduino-cli";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-2m0V7yj6C7Lvlu9RaM54pbGKSwrek6WYuwH1yqYHdB0=";
+      hash = "sha256-MZX6ERZwmfiJMqx6mQ0qAfv1dbXunTYHRbdzyoinOJY=";
     };
 
     nativeBuildInputs = [
@@ -31,7 +31,7 @@ let
 
     subPackages = [ "." ];
 
-    vendorHash = "sha256-5bkaHEzQ2gLV1epkScbCf1qv5XeuewLwqNcpPCSdbh4=";
+    vendorHash = "sha256-j5SpZnBWcC8K8lHgc5HOCbGD3DdHr9tVtEhXWTCCogk=";
 
     postPatch =
       let

pkgs/by-name/ar/argocd/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "argocd";
-  version = "3.3.6";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-84GlX9m1+Af9EPPdvLJcZIqhw7a1DBj1xKmUpNnngbk=";
+    hash = "sha256-I3udVhmPpOA2Lf1mkJqG+d+mGpfM16HIKBkEnTiAw0c=";
   };
 
   ui = stdenv.mkDerivation {
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${finalAttrs.src}/ui/yarn.lock";
-      hash = "sha256-kqBolkQiwZUBic0f+Ek5HwYsOmro1+FStkDLXAre79o=";
+      hash = "sha256-/B7FviD0a3VDmbbM59Ksmr8apuTRHrRbTtfX4QgO8JM=";
     };
 
     nativeBuildInputs = [
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-ABhvLf1wZm/2WdkzMOBBK/mycSjX+6/kKc0VcUhxvok=";
+  vendorHash = "sha256-w6jFNWKvcwxyeiSy+Pqb43qOfMOXF5UHr2VpyQD2dFw=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile

pkgs/by-name/at/attyx/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "attyx";
-  version = "0.4.5";
+  version = "0.4.9";
 
   src = fetchFromGitHub {
     owner = "semos-labs";
     repo = "attyx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/Zl6IrgrT8vHYllCKb977Ar5QRYQiXDmK/g+4YWcqM=";
+    hash = "sha256-lxQR8oAXH+S78jklmOsJO16i//iw0vsxjwN49Vxmb4k=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };

pkgs/by-name/au/authentik/package.nix

@@ -20,13 +20,13 @@
 let
   nodejs = nodejs_24;
 
-  version = "2025.12.5";
+  version = "2025.12.6";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     tag = "version/${version}";
-    hash = "sha256-LPGAhbtmuztDQ4CVhUXb+vBU5HjvNZ7JicI5r3lr1QQ=";
+    hash = "sha256-uIg47z4LaCawF/5ir4mKE6DpDnEpQ8DuObCNaq6TcYk=";
   };
 
   meta = {
@@ -137,8 +137,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-smm9x29z7gOI7Wq0NvP45KHtBbT6p1lH6IjEf9LRuGs=";
-        "x86_64-linux" = "sha256-K86wnn50svP+QG3i0mggH8RQgfoIqEmyQTouz35xzw8=";
+        "aarch64-linux" = "sha256-EbLneRDCyLLLBOZ2DUDpf2TbZoTL8QMXP4WlAZEzS90=";
+        "x86_64-linux" = "sha256-yDjwN/+lX2i9WYDXq4yWwf9o8nA4342iHDDQH4Jt7eQ=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-website-deps: unsupported host platform");
 

pkgs/by-name/au/autokey/package.nix

@@ -67,7 +67,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   dependencies = with python3Packages; [
     dbus-python
     pyinotify
-    xlib
+    python-xlib
     pygobject3
     packaging
     standard-imghdr

pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json

@@ -0,0 +1,57 @@
+{
+  "@esbuild/aix-ppc64@npm:0.28.1": "9b01eaa9c57542436436de762466b9a348b4596aa53dffa6e7034e4180691e1948d33fe34ec302239ab04c280e5166248880f24531011ff419fbec6986a265f3",
+  "@esbuild/android-arm64@npm:0.28.1": "7c977c8d4cea5126df4b298d5c31c3df8d14aa05d7477aa11c4147ec7baff17d25542234eea0134f279191b59cb1af18fee49c6916afda554484464129e4f9c3",
+  "@esbuild/android-arm@npm:0.28.1": "44baed9765216202f71b6aae8d9ddb930efa671d34f63f4220d980662b3df4da7972e965c0a0f12922147aa8428083686f6cb23cd9a4f140eaf922ae0b59c2a0",
+  "@esbuild/android-x64@npm:0.28.1": "1b8183640bef23f41a91598d898a04a6a8e3ca31d0100207c7e75928ee885878c04e3bcf31f27ed9c655d6d8a7c08e35e3afef035aee649488cb2d68e51abf1e",
+  "@esbuild/darwin-arm64@npm:0.28.1": "8ed80a99836df196c2b7996448eabb2d503ec8c71d0a8be59af4eed457b858fa5fd9292528b1967f0e106d2a045387e375207a2cc262cd45f89596681e94e7fd",
+  "@esbuild/darwin-x64@npm:0.28.1": "952b23f33c24aea13f5a78fd41731e06e8c7fa732e10995327fa1289115da6b4123899ca0cdb0cf0a56add29efcb9f7891ad6fda0bfb94541347275537a71e77",
+  "@esbuild/freebsd-arm64@npm:0.28.1": "cc2c4f1f13230607807c3f128680d789e85d4b93309501c4f8d84ed0674f4a2a3e60e279e3b997ee9f797047c1c5b906b25e4fe37de62d19634e4470bcb16f32",
+  "@esbuild/freebsd-x64@npm:0.28.1": "5b99b980599567ee931520a019beaeea4c7ae2874d0bfab79ee4bd6373a869251d2175946478c527490ce155d10a5bcc795e8c986dceb4a36fb6e813513fc54c",
+  "@esbuild/linux-arm64@npm:0.28.1": "9348c6bfc2d878e6213cffe482d4455d817b9e56b3c581a9f68b94aac720cddea5733d963dec57ca273039f3a7ca1714f1ac8e39e2e0f85f1af42f5d05e3ed00",
+  "@esbuild/linux-arm@npm:0.28.1": "654d7af59b4be40f585455e42ecb389657c6f11b1f2be2d5ab04caeac0514574d8b2a28b9f0f9805d92e266a44a5627c5acc8151b0d0379f75ac1490fecc013d",
+  "@esbuild/linux-ia32@npm:0.28.1": "cce27fbd8d74f34bb5507a5db8c0119aa377c7a070fd0be3881a8efddcdb8adeebe24dc97d55784d74a8bf4a60fb55b48899f41b5e931acaa3eb9f90ecc94a01",
+  "@esbuild/linux-loong64@npm:0.28.1": "47c3215d378f5da750300694b273b83db26d3e9ed36553696a1769da6d467e7557e289b46d211c93ab7a2978348b7415b66c7fec31658622f5bd356332b9d5b0",
+  "@esbuild/linux-mips64el@npm:0.28.1": "166d8888e731bdeba0c657382d429c0a979af2136100ee2491ec47b2e2ec55f6924fe2045880b48a6cdaeb3dcc44fc495f3f4b9a5aa3bb8c418d1f53f86b2ba1",
+  "@esbuild/linux-ppc64@npm:0.28.1": "a8eecb9e43a26dcb70a9805e685dec9f0caff0a8bac691b06a6db7c14ba0a69980ef0c01cb3fc1377ad63e2c4945f396fbbeaf008588bb232e9c0c37dcdb557b",
+  "@esbuild/linux-riscv64@npm:0.28.1": "cfde883f336e1811fee019a1df402000c7a8e6dc5a2b3577679fd0d9711d1a774c1faa194cc8954b18ca11f3a380ef32905ea90c241803831b61017d8a667c3b",
+  "@esbuild/linux-s390x@npm:0.28.1": "ea121d2fb6c8f6161312e0239258b584c431b4d23f320ace7cbc18da77034aac5ed383658d2a48fdfa32e38be07126a14aa26802b8e04d0e958e82646fb87f41",
+  "@esbuild/linux-x64@npm:0.28.1": "9b5458cf012247e31c6bf465e37553f2fc5aef3fccc6593bb30fee0c547958f9f00fbedd44e5bc076cf68d6791a4af2ce8714260fe341cb16843a78643773e3d",
+  "@esbuild/netbsd-arm64@npm:0.28.1": "86b5cf33fbad27ea5e7345601e711a26717bdf5ad119efa0b1bb9ad6a75f7cb2658c57ffb80f19491e3c7105f4698e76358ee2b6d57f48c9a230de9f588589c7",
+  "@esbuild/netbsd-x64@npm:0.28.1": "ff24c209715f7f122c711d3c51af099de27659837d3f7bd4cbea9a8868fa99a10b7af785058d18a1e32b2132989d1d1d82b8768df77ff25ab6cf19d58be3697d",
+  "@esbuild/openbsd-arm64@npm:0.28.1": "fe6590621116132baa0a2b9c2dc95c6342f146170ec1ffb343c29936580c369a69061676bef4e654ee27bad6491f531af3ba985aed7133eb16b758fffae6a445",
+  "@esbuild/openbsd-x64@npm:0.28.1": "2600c51c394945654f99b096fccba95e1d34fa3ecf4e78f40a7aee4573bf21dd955c274e0586768e9ebef3bff145ffe30231f1cb281ef5e679f7aa78dcc86687",
+  "@esbuild/openharmony-arm64@npm:0.28.1": "be9e1d1e4af478778ce847e28809fba0b754340a699e37ec03bc1a3cd4e84e4fde30ffea62099757877229b024d50331efd6270580492aa6be38eb2353ef5646",
+  "@esbuild/sunos-x64@npm:0.28.1": "349b9c7d879496456b2eb28f7bb3decc12a906007bb7fb24cb2b269f6b3e5138af109045b216bd0396762e63b802f0233408cc3dce802be5fcf242d4835b6bc8",
+  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
+  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
+  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
+  "@nx/nx-darwin-arm64@npm:22.7.5": "4f8435566c4b7ea0de0c8953f994849b91ad85867f6cdfce67fc0bb7404a760131dad7bdb7c789f82980d349c1a6df255be03807da260cbc5396284395865f28",
+  "@nx/nx-darwin-x64@npm:22.7.5": "3d63123766ce58602f08c5c2e9e896d9bbba402c53f3918a0ea5eebab25cd2f48fb992ac654ea648088564b1347f920509f7a20ad25c538d227a11292024ce64",
+  "@nx/nx-freebsd-x64@npm:22.7.5": "6fa6ba0ab68e6fd9742c5bdc8cacbd67d3be6334b967c9dfa3a3fa5e64b689fa1d7b50f807420227ad470c53ad5cf8343240d35ed89ca8d3e62a921a4857e8b9",
+  "@nx/nx-linux-arm-gnueabihf@npm:22.7.5": "7fd2f207688a8353012f8363cc28868e927840c2378dba466a67dff50eabbf24362e6654e183c1308479d435e8326444ae4ab803e3f5bdf84061915124183f4f",
+  "@nx/nx-linux-arm64-gnu@npm:22.7.5": "03c8fa25e5833fe4746995624b15e72258b7050ee70a6d80ed4c2b0f5e8b740774264d1decf70eea61387028886b2360953675d554f2ee8b4ae784adf738ed7b",
+  "@nx/nx-linux-arm64-musl@npm:22.7.5": "ea449f0b82c027b6eae5f2a060d26624bee91b487b601ccb5ab250ff33140f4bd60cf004e8f5f1e495b9bd391c17bda4758635ddb80f1af29b234eb067517b2c",
+  "@nx/nx-linux-x64-gnu@npm:22.7.5": "96aad2912ef8a607147cb5831ddbfc6f08b3c657c44879c738055fde274259e2dfc7e507485c52c194e79445ca2410cf618e31e2d2af00f7563f04055beea3c7",
+  "@nx/nx-linux-x64-musl@npm:22.7.5": "1f61915a2e93a6b930b81b8205407e2c961f7878a5131f136027b86bd35a579fe65b52a47088c4818c6e6426b3aa79ece8ce30119a3e44dd4d5a681efd7cde4a",
+  "@nx/nx-win32-arm64-msvc@npm:22.7.5": "3f4668ce48fd341f487b99c72e7678ebdfa0964591a58947752bf050a4bb21bf27ee920ac4554433e0efd73beca923a17a6dfc90e35c8b5ee1f92fd4a7f2caa0",
+  "@nx/nx-win32-x64-msvc@npm:22.7.5": "c44700bd537a0f2571d75285302d332c0fa31a648a822937cd81362c7b4fcb8c8ecabb98559c0b7bcdb537acd051b4f3926bcd9e369095260fc6aa8d079e3c04",
+  "@unrs/resolver-binding-android-arm-eabi@npm:1.11.1": "04dd38b694c1680bfec192b499e188700398a414886a08a8a7c72815db56ac147df03d88c73ff6fff7ac3e0a01dc41978054b3622b49463e0d684c5168557fcc",
+  "@unrs/resolver-binding-android-arm64@npm:1.11.1": "763626adc34dd2b4af677b5ced6493e7b2b1935351a5c9137f1c9561d11faf97b94015e6876e57e85c33ff563564314c92c0882a4780a57f2225cbbd779a695d",
+  "@unrs/resolver-binding-darwin-arm64@npm:1.11.1": "03b477fdfec55dbabe488fe0962417bddaa38b028d2670053469f1d24163907b097aac15b565f6974449bee398a38d5e3e1525f2b515ce57e243149021b7aa2f",
+  "@unrs/resolver-binding-darwin-x64@npm:1.11.1": "3aeff9aaf4ef6d786c517d9017b5c41b0af180cdbaf705d08e6e5b5ba9d5410d28ef6754c5f8a865f0bb5efd460dc1c4156b5e2201032c0a604a6c734ddbc848",
+  "@unrs/resolver-binding-freebsd-x64@npm:1.11.1": "b9f7a3e03db9edfc3480db056dd25229f901f21840ee768b69f349b66676a995a404e60617b3bcbd984f57f2199eb352dd6fad0f4420c3084ceef5e3293cdad5",
+  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.11.1": "4d03b8bcef5a90586a846d6d332f39cee211f3d330b6e10036969894b6ecfb70b047265e985d572def93b84f38621dec30e4b4bb42699dd784adbae3ca5e7bea",
+  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.11.1": "9f3a3c2e5e6418a5a78294fa042824f5c270e993c1a99e82dd6b0ee0d2869929bb62dd154a0acc1e4ef16273e8073e0e257901208c062e6bdd49d586d07bb419",
+  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.11.1": "05228d6fd669f404f0e3164ccf2430a52cc7b3bbd211367527b5d726b1220a1816bab70159bed55694d9b7543553f6002379e7e186c605d7055c5156977da022",
+  "@unrs/resolver-binding-linux-arm64-musl@npm:1.11.1": "8115802143396d4992bb2f6f0acb6e8bc141a57864c5fd84cbc70577c25784cb08dd163b753b1fc0decc02582cf4cb1e30d04faaf763048babbbe706bdfa26ea",
+  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.11.1": "50f9f54b2eafb1ea023671cc3070692b2b15f6e49105b08b3f588033e65e8de4183f76e080b798de710f9c41df1bf5515c01868866a21cbd35db179b4ac9f23b",
+  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.11.1": "8f8222f938cc2025ed3971e0e303f4ff5aa5df74474b835442830ebe942d050ba3f8bbb67095da64099e6fc69bb5bb73ca63db54e059c95e51aa8909880fb207",
+  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.11.1": "5c8987f7dcaf38ef27ec67dcf118141502d5ac75d28429da6d1b7037f3e5a5351f32f55094472fde11784e65d01f1da4dafd7c0fdca28423fbc8de2c2c51d16c",
+  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.11.1": "17aed6472880a82e5a05147a55efb6f0d968f5dcb584845addf89acec3824534ee741d4b162686124d17daf9131373c469c57843996a5ee2db4f1b1b55e1d11e",
+  "@unrs/resolver-binding-linux-x64-gnu@npm:1.11.1": "9495c08fc42f2d4a33e33c64adbcbf51588cd7ea07478eacb2e9143d955a760122440f4a3ac48b086cc2563ca2b2464d72ed0336fcc20c0a89ddc356f956eda8",
+  "@unrs/resolver-binding-linux-x64-musl@npm:1.11.1": "c84fadfee66eeebd16eb7cce7c4b5a1ec90260c724d0064111e9f43a1341ebfede61627cb68fd3a9735e4c10b25606fb472a4d13143cc569867b80d85c4a9824",
+  "@unrs/resolver-binding-wasm32-wasi@npm:1.11.1": "655a3990ed9b238e8f0c4858f87ca84bd3d81db300f7730c885162333055170e11207af7789ff38f619e261178718f6977729e42ce7978cc9e6ac7b6d93822d5",
+  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.11.1": "983f800ff8b5181247a7d460ab5c9704cd425d0182e93290f69fb969d93efe17be6a27c22b97546d36e9a9d9aeda96d5f753bc938b3d9a00f32c10fc228ce5a9",
+  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.11.1": "383d639e3b08fc9e4ba18127ef55610172d2d1d6adb83e1466fff2b223552384cdc6217051f749829e0c90a757ea5631e8c4ad2cfeb59bdee2bb033fbd526854",
+  "@unrs/resolver-binding-win32-x64-msvc@npm:1.11.1": "c862561f6495c0dbffb94d421e5727b25c1b61d98e22383bff23e6719a6c0125bb0b7df3be7220f5480bf54f5a605ea572f10fff1cce14fda24d42e396559940"
+}

pkgs/by-name/aw/aws-cdk-cli/package.nix

@@ -2,40 +2,42 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
   nodejs,
-  yarnBuildHook,
-  yarnConfigHook,
-  yarnInstallHook,
+  yarn-berry_4,
   diffutils,
   zip,
   jq,
+  python3,
   unzip,
   testers,
   nix-update-script,
 }:
 
+let
+  yarn-berry = yarn-berry_4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-cdk-cli";
-  version = "2.1116.0";
+  version = "2.1127.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cdk-cli";
     tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-mRr5G42RrO87AdJOTLaM+EPprTFCI7eVxzUhafrGOxA=";
+    hash = "sha256-d55JNmWi4oTNorunkDwpdfcxHE9UC2fufKDahKgoLvk=";
   };
 
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-cjJBaq65sNWOFMFB1HAgGScxJlBZKnwkGipDd4aXhDE=";
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-eGj2Gx46lyypNz5e0U1AD1dVwOgJK4hkwXp03lR+6sc=";
   };
 
   nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
     nodejs
+    python3
     zip
     jq
     # tests
@@ -49,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     NX_VERBOSE_LOGGING = "true";
     # Needed to properly embed version info
     CODEBUILD_RESOLVED_SOURCE_VERSION = finalAttrs.version;
+    YARN_LOCKFILE_VERSION_OVERRIDE = "8";
   };
 
   # Regular "build" is very heavy and does things we don't need.
@@ -62,6 +65,13 @@ stdenv.mkDerivation (finalAttrs: {
     in
     ''
       echo '${cliVersionJson}' > packages/@aws-cdk/cloud-assembly-schema/cli-version.json
+      cat >> .yarnrc.yml <<'EOF'
+      approvedGitRepositories:
+        - "**"
+      enableScripts: true
+      enableNetwork: false
+      enableHardenedMode: false
+      EOF
     '';
 
   preBuild = ''
@@ -76,10 +86,27 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  buildPhase = ''
+    runHook preBuild
+
+    yarn "$yarnBuildScript"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/aws-cdk-cli
+    cp -r . $out/lib/node_modules/aws-cdk-cli
+
+    runHook postInstall
+  '';
+
   postInstall = ''
     # Manually bundle non-bundled dependencies
-    cp -r packages/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
-    cp -r packages/aws-cdk/node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
+    cp -r node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
+    cp -r node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
 
     patchShebangs "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin"
     ln -s "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin" "$out/bin"

pkgs/by-name/ba/bashunit/package.nix

@@ -17,13 +17,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.39.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-yMzi2SFEMSNNFztapWavMmbueWwVK0GWjyFR3cJZmTg=";
+    hash = "sha256-7KH0zcoRPbY56h8FtJ0WbCqM2dSn/bklAPIthnktkpI=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 

pkgs/by-name/be/beadwork/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "beadwork";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "jallum";
     repo = "beadwork";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NlmnoFz4gYIB3g3C/7rmgKhUkh8q/Vn1drhHIuUScTg=";
+    hash = "sha256-OVwr/AUIx6k5QF2rZf25BWD+3UHYqN8tziJTa8tgDYU=";
   };
 
   vendorHash = "sha256-LjqZSI7F3C8GyNrPK/BwG9QTmNg89hFAvhUuBjmbHTU=";

pkgs/by-name/be/bees/package.nix

@@ -79,6 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = "Best-Effort Extent-Same: bees finds not just identical files, but also identical extents within files that differ";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ chaduffy ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/bi/bilibili/sources.nix

@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.17.6-2";
-  arm64-hash = "sha256-uJjVcwkbYiTdV9Ki/ur1/xZuKUCUFefRXIPSRlgRaoA=";
-  x86_64-hash = "sha256-vAKAYCbwS92Nqk0W+dN/GeYOcori4MY5e16mMDLfXPk=";
+  version = "1.17.9-1";
+  arm64-hash = "sha256-xTRGaplSpW+ax7/hJHxGq/8W3vbJF0uYbXsW1Dl04Bk=";
+  x86_64-hash = "sha256-ek7XkwWBr6dx7lV9xy/+Sl4INEbSu5g/WaPEHU4FGH4=";
 }

pkgs/by-name/bo/bobgen/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bobgen";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "stephenafamo";
     repo = "bob";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dmZ9aOiVn0QEBvPwulvFEisZRw0PIid7NH22gD3Yzuc=";
+    hash = "sha256-pWuX6TDwf8JcOamDImx/0knN1lx4lkovouRmEA2fTWA=";
   };
 
   vendorHash = "sha256-WzSUUgfWGz5XXq3iQrtpF91yOEr0QypTWq1rOJMntGQ=";

pkgs/by-name/bo/bookworm/package.nix

@@ -24,19 +24,19 @@
   unar,
   unzip,
   vala,
-  # webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
 }:
 
 stdenv.mkDerivation {
   pname = "bookworm";
-  version = "unstable-2022-01-09";
+  version = "unstable-2026-05-28";
 
   src = fetchFromGitHub {
     owner = "babluboy";
     repo = "bookworm";
-    rev = "f3df858ce748a6bbc43f03a6e261ff76a6d7d303";
-    hash = "sha256-mLyJfblF5WnWBV3rX1ZRupccou4t5mBpo3W7+ECNMVI=";
+    rev = "fa06f1b80bb2372c1f20b0cfb21dc88eed410e29";
+    hash = "sha256-xml6jOE0tJBz1CwE+0ecSbiGAajh398bw+leFapctiE=";
   };
 
   nativeBuildInputs = [
@@ -60,12 +60,18 @@ stdenv.mkDerivation {
     poppler
     python3
     sqlite
-    # webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
+    substituteInPlace meson.build \
+      --replace-fail "webkit2gtk-4.0" "webkit2gtk-4.1"
+    substituteInPlace src/window.vala \
+      --replace-fail "Soup.URI.decode" "Uri.unescape_string"
+    substituteInPlace src/utils.vala \
+      --replace-fail "Soup.URI.decode" "Uri.unescape_string"
   '';
 
   # These programs are expected in PATH from the source code and scripts
@@ -92,8 +98,6 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    # webkitgtk_4_0 was removed
-    broken = true;
     description = "Simple, focused eBook reader";
     mainProgram = "com.github.babluboy.bookworm";
     longDescription = ''

pkgs/by-name/bo/boring/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "boring";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "alebeck";
     repo = "boring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WdohrSeq2N1zDQlYnwIMn1FF3IIb3zAiLSuOOf2GioU=";
+    hash = "sha256-PU/DwYgP8pcBc21GwuMMiQIzdU4BhBvHzk9YrktYo1Y=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bu/buildkite-agent/package.nix

@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.127.2";
+  version = "3.128.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dSG/F/KtV4nBpm2EeXjGI/2uM2/CgRkjYq5uq7+vZVw=";
+    hash = "sha256-fBiIp9EyzIfoW4IbUZkePuBDyZRRWLGRClL57nio22E=";
   };
 
-  vendorHash = "sha256-N4m7Dak0EBkbJtOjatv0GQKsdxt0B/fZn08T9HpAXDA=";
+  vendorHash = "sha256-lRh5cAbg2yr+nvIaSRg3tG0tLvl7aDjyIoIjS1BvXNM=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash

pkgs/by-name/ca/carapace-bridge/package.nix

@@ -8,19 +8,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-URIRdoG/P6YrcuOdZmQHD1cvcpYg++JS39fj/wJdLWY=";
+    hash = "sha256-HEVFg9rW1UiRpcZlENTg+YgB/AwmtuEuNqTf4jXW4wU=";
   };
 
   # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on
   # the workspace if proxyVendor is off
   proxyVendor = true;
-  vendorHash = "sha256-1TTo5Maka7lp20ZC7/Sebt+/stUQSheRXrEuhykbLN0=";
+  vendorHash = "sha256-RLx5QtA3oTsDSmSWoRqV0LJ+rSifSRc+WAQyeh0Xnbw=";
 
   postPatch = ''
     substituteInPlace cmd/carapace-bridge/main.go \

pkgs/by-name/ca/cargo-rdme/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-rdme";
-  version = "1.5.1";
+  version = "2.0.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-d3WughXxh9cBzy33s3iB75paldZFokGGI1L9yTLGYoc=";
+    hash = "sha256-mSwmVfwp1wFM3Xj+ASMpvZpgemcyicduk9l2WJYsYMw=";
   };
 
-  cargoHash = "sha256-26Poh5lUCYi+a+/E7pOYwilKX+eqRmbRNYRFdVfRSCw=";
+  cargoHash = "sha256-ZnWksGby1vEsA2BgvVy3Z2HNx8vZTY7J96GONAAOZKA=";
 
   meta = {
     description = "Cargo command to create the README.md from your crate's documentation";