Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -9259,6 +9259,12 @@
     githubId = 119691;
     name = "Michael Gough";
   };
+  fraggerfox = {
+    email = "santhosh.raju@gmail.com";
+    github = "fraggerfox";
+    githubId = 189939;
+    name = "Santhosh Raju";
+  };
   fraioveio = {
     email = "francesco@vecchia.lol";
     github = "FraioVeio";
@@ -21438,6 +21444,12 @@
     githubId = 7420227;
     name = "Peter Tri Ho";
   };
+  peterwaller-arm = {
+    email = "peter.waller@arm.com";
+    github = "peterwaller-arm";
+    githubId = 52030119;
+    name = "Peter Waller";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
+- [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -1017,6 +1017,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/flap-alerted.nix
   ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix

nixos/modules/services/display-managers/default.nix

@@ -101,16 +101,7 @@ in
       };
 
       defaultSession = lib.mkOption {
-        type = lib.types.nullOr lib.types.str // {
-          description = "session name";
-          check =
-            d:
-            lib.assertMsg (d != null -> (lib.types.str.check d && lib.elem d cfg.sessionData.sessionNames)) ''
-              Default graphical session, '${d}', not found.
-              Valid names for 'services.displayManager.defaultSession' are:
-                ${lib.concatStringsSep "\n  " cfg.sessionData.sessionNames}
-            '';
-        };
+        type = lib.types.nullOr (lib.types.str // { description = "session name"; });
         default = null;
         example = "gnome";
         description = ''
@@ -130,26 +121,12 @@ in
 
       sessionPackages = lib.mkOption {
         type = lib.types.listOf (
-          lib.types.package
+          lib.types.addCheck lib.types.package (
+            p: p ? providedSessions && p.providedSessions != [ ] && lib.all lib.isString p.providedSessions
+          )
           // {
             description = "package with provided sessions";
-            check =
-              p:
-              lib.assertMsg
-                (
-                  lib.types.package.check p
-                  && p ? providedSessions
-                  && p.providedSessions != [ ]
-                  && lib.all lib.isString p.providedSessions
-                )
-                ''
-                  Package, '${p.name}', did not specify any session names, as strings, in
-                  'passthru.providedSessions'. This is required when used as a session package.
-
-                  The session names can be looked up in:
-                    ${p}/share/xsessions
-                    ${p}/share/wayland-sessions
-                '';
+            descriptionClass = "composite";
           }
         );
         default = [ ];
@@ -211,6 +188,14 @@ in
           services.displayManager.autoLogin.enable requires services.displayManager.autoLogin.user to be set
         '';
       }
+      {
+        assertion = cfg.defaultSession == null || lib.elem cfg.defaultSession cfg.sessionData.sessionNames;
+        message = ''
+          Default graphical session, '${toString cfg.defaultSession}', not found.
+          Valid names for 'services.displayManager.defaultSession' are:
+            ${lib.concatStringsSep "\n    " cfg.sessionData.sessionNames}
+        '';
+      }
     ];
 
     # Make xsessions and wayland sessions available in XDG_DATA_DIRS

nixos/modules/services/monitoring/flap-alerted.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.flap-alerted;
+
+  settingsArgs = lib.pipe cfg.settings [
+    (lib.mapAttrsToList (
+      name: value:
+      if value == null || value == false then
+        [ ]
+      else if value == true then
+        [ "-${name}" ]
+      else
+        [
+          "-${name}"
+          (toString value)
+        ]
+    ))
+    lib.concatLists
+  ];
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.flap-alerted = {
+    enable = lib.mkEnableOption "FlapAlerted";
+
+    package = lib.mkPackageOption pkgs "flap-alerted" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/flap-alerted.env" ];
+      description = ''
+        Files to load environment variables from.
+        This is useful to avoid putting secrets into the nix store.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra command line arguments to pass to FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = [ ];
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.int
+              lib.types.bool
+            ]
+          )
+        );
+
+        options = {
+          asn = lib.mkOption {
+            type = lib.types.ints.u32;
+            description = "Your ASN number";
+          };
+
+          bgpListenAddress = lib.mkOption {
+            type = lib.types.str;
+            description = "Address to listen on for incoming BGP connections";
+            default = ":1790";
+          };
+
+          debug = lib.mkOption {
+            type = lib.types.bool;
+            description = "Enable debug mode (produces a lot of output)";
+            default = false;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.flap-alerted = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "flap-alerted";
+        Group = "flap-alerted";
+        DynamicUser = true;
+
+        EnvironmentFile = cfg.environmentFiles;
+
+        ExecStart = lib.escapeShellArgs ([ (lib.getExe cfg.package) ] ++ settingsArgs ++ cfg.extraArgs);
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -597,6 +597,7 @@ in
   firezone = runTest ./firezone/firezone.nix;
   fish = runTest ./fish.nix;
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
+  flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;

nixos/tests/flap-alerted.nix

@@ -0,0 +1,128 @@
+{ config, lib, ... }:
+
+{
+  name = "flap-alerted";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.flap-alerted = {
+      enable = true;
+      settings = {
+        asn = 4213370001;
+        bgpListenAddress = ":1790";
+        routeChangeCounter = 5;
+        overThresholdTarget = 1;
+      };
+    };
+
+    services.bird = {
+      enable = true;
+      preCheckConfig = ''
+        mkdir -p /tmp/bird
+        touch /tmp/bird/routes.conf
+      '';
+      config = ''
+        router id 192.168.1.1;
+
+        protocol device { }
+
+        protocol bgp flapalerted {
+          local 2001:db8:1::1 as 4213370001;
+          neighbor ::1 as 4213370001 port 1790;
+
+          ipv4 {
+            add paths on;
+            export all;
+            import none;
+            extended next hop on;
+          };
+
+          ipv6 {
+            add paths on;
+            export all;
+            import none;
+          };
+        }
+
+        protocol static {
+          include "/tmp/bird/routes.conf";
+
+          ipv4 {
+            import all;
+            export none;
+          };
+        }
+      '';
+    };
+
+    systemd.services.bird.serviceConfig.BindReadOnlyPaths = [ "/tmp/bird" ];
+
+    systemd.tmpfiles.settings.bird-static-routes."/tmp/bird/routes.conf".f = { };
+  };
+
+  interactive.sshBackdoor.enable = true;
+  interactive.defaults.virtualisation.graphics = false;
+
+  interactive.nodes.machine = {
+    services.flap-alerted.settings.httpAPIListenAddress = ":8699";
+    networking.firewall.allowedTCPPorts = [ 8699 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8699;
+        guest.port = 8699;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+    import random
+    import time
+
+    machine.log(machine.succeed("systemd-analyze security flap-alerted.service --threshold=11 --no-pager"))
+
+    machine.wait_for_unit("bird.service")
+    machine.wait_for_unit("flap-alerted.service")
+    machine.wait_for_open_port(1790)
+    machine.wait_for_open_port(8699)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/capabilities"))
+    expected_version = "v${config.nodes.machine.services.flap-alerted.package.version}"
+    assert resp["Version"] == expected_version
+
+    for _ in range(10):
+      resp = json.loads(machine.succeed("curl localhost:8699/sessions"))
+      if len(resp) == 1: break
+      time.sleep(1)
+    else:
+      assert False, "failed to establish bgp session"
+    assert resp[0]["RouterID"] == "192.168.1.1"
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert resp == []
+
+    def flap():
+      route = lambda idx, gw: f"""
+        route 10.0.{idx}.0/24 via 10.254.254.{gw} dev \"eth0\" onlink {{
+          bgp_path.prepend(4213370002);
+          bgp_path.prepend({4213370002 + gw});
+        }};
+      """
+      with open("routes.conf", "w") as f:
+        for i in range(1, 4): # stable routes
+          f.write(route(i, i))
+        for i in range(4, 7): # flappy routes
+          f.write(route(i, random.randint(1, 254)))
+      machine.copy_from_host("routes.conf", "/tmp/bird/routes.conf")
+      machine.succeed("birdc configure")
+
+    t = time.time()
+    while time.time() - t < 70:
+      flap()
+      time.sleep(1)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert sorted(x["Prefix"] for x in resp) == ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+  '';
+}

nixos/tests/lomiri.nix

@@ -142,7 +142,40 @@ let
       with machine.nested("Ensuring terminalTextColor {} stays present on the screen:".format(terminalTextColor)):
         retry(fn=check_for_color_continued_presence(terminalTextColor), timeout_seconds=5)
 
-    def ensure_lomiri_running() -> None:
+    def change_tty_back_forth(ttynumMain: int, ttynumDiff: int) -> None:
+      """
+      A qtmir bump made the image get stuck, a tty switch back and forth fixes it.
+      """
+
+      machine.send_key(f"ctrl-alt-f{ttynumDiff}")
+      machine.sleep(10)
+      machine.send_key(f"ctrl-alt-f{ttynumMain}")
+      machine.sleep(10)
+
+    def ensure_greeter_launched() -> None:
+      """
+      Ensure that Lomiri (in greeter mode) has started up and is responsive.
+      Execution will stop at the user selection.
+      """
+
+      machine.wait_for_unit("display-manager.service")
+      machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
+
+      # Start page shows current time
+      wait_for_text(r"(AM|PM)")
+
+      # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that time is still shown
+      # Greeter runs on: tty1
+      change_tty_back_forth(1, 2)
+      wait_for_text(r"(AM|PM)")
+      machine.screenshot("lomiri_greeter_launched")
+
+      # Advance to user selection, to make sure display really isn't stuck anymore
+      machine.send_key("ret")
+      wait_for_text("${description}")
+      machine.screenshot("lomiri_greeter_login")
+
+    def ensure_lomiri_running(ttynumMain: int = 1, ttynumDiff: int = 2) -> None:
       """
       Ensure that Lomiri has finished starting up.
       """
@@ -150,9 +183,6 @@ let
       # Process runs
       machine.wait_until_succeeds("pgrep -u ${user} -f 'lomiri --mode=full-shell'")
 
-      # Output rendering from Lomiri has started when it starts printing performance diagnostics
-      machine.wait_for_console_text("Last frame took")
-
       # One of the last UI elements that loads is the clock. In the past, we could OCR for AM/PM to ensure it's there. That is now flaky.
       # The next best thing is to look for the launcher button, and ensure it stays around for awhile (DE doesn't crash).
       launcherColor: str = "#5277C3"
@@ -161,6 +191,15 @@ let
       with machine.nested("Ensuring launcherColor {} stays present on the screen:".format(launcherColor)):
         retry(fn=check_for_color_continued_presence(launcherColor), timeout_seconds=30)
 
+      # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that launcher button is still shown
+      change_tty_back_forth(ttynumMain, ttynumDiff)
+      with machine.nested("Waiting for the screen to have launcherColor {} on it:".format(launcherColor)):
+        retry(check_for_color(launcherColor))
+
+      # First input seems to get dropped while Mir registers the new input device. Send a key that does nothing, to get that out of the way, and sleep a tiny bit for registration to finish.
+      machine.send_key("left")
+      machine.sleep(3)
+
       machine.screenshot("lomiri_launched")
 
     def wait_for_text(text) -> None:
@@ -358,17 +397,7 @@ in
 
           # Lomiri in greeter mode should work & be able to start a session
           with subtest("lomiri greeter works"):
-              machine.wait_for_unit("display-manager.service")
-              machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
-
-              # Start page shows current time
-              wait_for_text(r"(AM|PM)")
-              machine.screenshot("lomiri_greeter_launched")
-
-              # Advance to login part
-              machine.send_key("ret")
-              wait_for_text("${description}")
-              machine.screenshot("lomiri_greeter_login")
+              ensure_greeter_launched()
 
               # Login
               machine.send_chars("${password}\n")
@@ -771,24 +800,14 @@ in
 
             # Lomiri in greeter mode should use the correct keymap
             with subtest("lomiri greeter keymap works"):
-                machine.wait_for_unit("display-manager.service")
-                machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
-
-                # Start page shows current time
-                # And the greeter *actually* renders our wallpaper!
-                wait_for_text(r"(AM|PM|Lorem|ipsum)")
-                machine.screenshot("lomiri_greeter_launched")
-
-                # Advance to login part
-                machine.send_key("ret")
-                wait_for_text("${description}")
-                machine.screenshot("lomiri_greeter_login")
+                ensure_greeter_launched()
 
                 # Login
                 machine.send_chars("${pwInput}\n")
 
                 # And the desktop doesn't render the wallpaper anymore. Grumble grumble...
-                ensure_lomiri_running()
+                # When going lomiri(greeter) -> lomiri(desktop), we run on tty2
+                ensure_lomiri_running(2, 1)
 
             # Lomiri in desktop mode should use the correct keymap
             with subtest("lomiri session keymap works"):

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -13,13 +13,13 @@ let
 
   pname = "ghostel";
 
-  version = "0-unstable-2026-05-23";
+  version = "0.31.0-unstable-2026-06-01";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "cd32af7bd6b9c827701a62ed8f0c3bc705800f13";
-    hash = "sha256-5XmHI+lkzLFW8VNVC3eyc+msi6y+Qh6q6WsBZpHNEf4=";
+    rev = "09aad9fefffce6370256a9888a1ed4f77535fcfd";
+    hash = "sha256-CKN0m+DVvxJhLkr/Hi/44w0m+kJVrx28axLCKLogIQs=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-EgLt/bF0pdWyfSxwTGSv2Z0GxCZ2cJ9+n3UnTWdD1LE=";
+    hash = "sha256-8EjKZl0fWpdgaYHeZDTbVS8EpwbVpt9pYWXq85u1bEQ=";
   };
 
   __structuredAttrs = true;

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "151.0.2";
+  version = "151.0.3";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "87308953ed354a2799a9a45be40033bf9ff8d80fa220f034aacfbd6e754716901d4164c37fa56032c659b259116603e0ba2b566c1f3651ab9cc0835d502cd739";
+    sha512 = "511723e5cf042abb66cbeda89b78d42de8d1b53544565670173f3e69c2a7ceefc76468c90576221418bfc9b122151ec117978caa4823cfb9b80797f3064bd895";
   };
 
   meta = {

pkgs/applications/video/vdr/default.nix

@@ -17,12 +17,12 @@
 stdenv.mkDerivation rec {
 
   pname = "vdr";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchgit {
     url = "git://git.tvdr.de/vdr.git";
     rev = version;
-    hash = "sha256-jQR+d0BEmKwPRlf4ZTtdDvq/MiIFrsmEqJYoSmk2d84=";
+    hash = "sha256-m+aSW4b9GEhJa2Tax5nkm4q5DBZVWwBMa3abRM8vw08=";
   };
 
   enableParallelBuilding = true;

pkgs/build-support/node/fetch-pnpm-deps/default.nix

@@ -59,11 +59,6 @@ in
         else
           pnpm-fixup-state-db;
     in
-    # pnpmWorkspace was deprecated, so throw if it's used.
-    assert
-      !args ? pnpmWorkspace
-      || throw "fetchPnpmDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`.";
-
     assert
       fetcherVersion != null
       || throw "fetchPnpmDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";

pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh

@@ -74,11 +74,6 @@ pnpmConfigHook() {
     # See: https://pnpm.io/settings#packageimportmethod
     pnpm config set package-import-method clone-or-copy
 
-    if [[ -n "$pnpmWorkspace" ]]; then
-        echo "'pnpmWorkspace' is deprecated, please migrate to 'pnpmWorkspaces'."
-        exit 2
-    fi
-
     echo "Installing dependencies"
     if [[ -n "$pnpmWorkspaces" ]]; then
         local IFS=" "

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -330,9 +330,9 @@
 
   storage-preview = mkAzExtension rec {
     pname = "storage-preview";
-    version = "1.0.0b7";
+    version = "1.0.0b8";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
-    hash = "sha256-wtf+4TBDzpWO55w5VXnoERAbksP2QaSc29FHL3MNOBo=";
+    hash = "sha256-qgDslmBX/XJA5nn95hJJb06vMC3izdbz7qlmQpx74T8=";
     description = "Provides a preview for upcoming storage features";
     propagatedBuildInputs = with python3Packages; [ azure-core ];
     meta.maintainers = with lib.maintainers; [ katexochen ];

pkgs/by-name/bi/bicep/0001-Pin-Grpc.Tools-To-2.68.1.patch

@@ -0,0 +1,13 @@
+diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
+index 97dddded5..4c9e3e35c 100644
+--- a/src/Directory.Packages.props
++++ b/src/Directory.Packages.props
+@@ -34,7 +34,7 @@
+     <PackageVersion Include="Grpc.AspNetCore.Server.Reflection" Version="2.71.0" />
+     <PackageVersion Include="Grpc.Core.Testing" Version="2.46.6" />
+     <PackageVersion Include="Grpc.Net.Client" Version="2.71.0" />
+-    <PackageVersion Include="Grpc.Tools" Version="2.72.0" />
++    <PackageVersion Include="Grpc.Tools" Version="2.68.1" />
+     <PackageVersion Include="JetBrains.Annotations" Version="2025.2.2" />
+     <PackageVersion Include="JsonDiffPatch.Net" Version="2.3.0" />
+     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />

pkgs/by-name/bi/bicep/0001-Revert-Bump-Grpc.Tools-from-2.68.1-to-2.69.0-16097.patch

@@ -1,33 +0,0 @@
-diff --git a/src/Bicep.Local.Extension/Bicep.Local.Extension.csproj b/src/Bicep.Local.Extension/Bicep.Local.Extension.csproj
-index e02412540..7e0fb5e90 100644
---- a/src/Bicep.Local.Extension/Bicep.Local.Extension.csproj
-+++ b/src/Bicep.Local.Extension/Bicep.Local.Extension.csproj
-@@ -17,7 +17,7 @@
-   <ItemGroup>
-     <PackageReference Include="CommandLineParser" Version="2.9.1" />
-     <PackageReference Include="Google.Protobuf" Version="3.29.2" />
--    <PackageReference Include="Grpc.Tools" Version="2.69.0">
-+    <PackageReference Include="Grpc.Tools" Version="2.68.1">
-       <PrivateAssets>all</PrivateAssets>
-       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-     </PackageReference>
-diff --git a/src/Bicep.Local.Extension/packages.lock.json b/src/Bicep.Local.Extension/packages.lock.json
-index e7297d0af..c262f0849 100644
---- a/src/Bicep.Local.Extension/packages.lock.json
-+++ b/src/Bicep.Local.Extension/packages.lock.json
-@@ -32,9 +32,9 @@
-       },
-       "Grpc.Tools": {
-         "type": "Direct",
--        "requested": "[2.69.0, )",
--        "resolved": "2.69.0",
--        "contentHash": "W5hW4R1h19FCzKb8ToqIJMI5YxnQqGmREEpV8E5XkfCtLPIK5MSHztwQ8gZUfG8qu9fg5MhItjzyPRqQBjnrbA=="
-+        "requested": "[2.68.1, )",
-+        "resolved": "2.68.1",
-+        "contentHash": "BZ96s7ijKAhJoRpIK+pqCeLaGaSwyc5/CAZFwgCcBuAnkU2naYvH0P6qnYCkl0pWDY/JBOnE2RvX9IvRX1Yc5Q=="
-       },
-       "Microsoft.CodeAnalysis.BannedApiAnalyzers": {
-         "type": "Direct",
--- 
-2.47.2
-

pkgs/by-name/bi/bicep/package.nix

@@ -1,26 +1,24 @@
 {
   lib,
-  stdenv,
   buildDotnetModule,
   fetchFromGitHub,
   dotnetCorePackages,
-  mono,
   jq,
 }:
 
 buildDotnetModule rec {
   pname = "bicep";
-  version = "0.36.177";
+  version = "0.39.26";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "bicep";
     rev = "v${version}";
-    hash = "sha256-ah8g1mU2etQ/zoXcGbS+xRkTb4DjPmofe2ubZSNRhNU=";
+    hash = "sha256-CfoC9/Qe2OdPNnAa7e0BFgbPEbVrDfl9u3hM6y8msGQ=";
   };
 
   patches = [
-    ./0001-Revert-Bump-Grpc.Tools-from-2.68.1-to-2.69.0-16097.patch
+    ./0001-Pin-Grpc.Tools-To-2.68.1.patch
   ];
 
   postPatch = ''
@@ -43,9 +41,9 @@ buildDotnetModule rec {
 
   nativeBuildInputs = [ jq ];
 
-  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64); # mono is not available on aarch64-darwin
+  doCheck = true;
 
-  nativeCheckInputs = [ mono ];
+  dotnetTestFlags = "-p:UseAppHost=false";
 
   testProjectFile = "src/Bicep.Cli.UnitTests/Bicep.Cli.UnitTests.csproj";
 

pkgs/by-name/di/din/package.nix

@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  autoreconfHook,
+  libsndfile,
+  freeglut,
+  libGL,
+  libGLU,
+  libjpeg,
+  SDL,
+  tcl,
+
+  # Audio backend — exactly one must be selected.
+  # ALSA is the upstream-recommended Linux backend; JACK is used elsewhere.
+  jackSupport ? !stdenv.hostPlatform.isLinux,
+  jack2,
+  alsaSupport ? stdenv.hostPlatform.isLinux,
+  alsa-lib,
+}:
+
+assert lib.assertMsg (
+  lib.count (x: x) [
+    jackSupport
+    alsaSupport
+  ] == 1
+) "din: exactly one audio backend must be selected (jackSupport or alsaSupport)";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "din";
+  version = "64.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # Darwin binary should NOT be available on the public cache; always build from source.
+  # https://dinisnoise.org/README/
+  allowSubstitutes = !stdenv.hostPlatform.isDarwin;
+
+  src = fetchurl {
+    url = "https://dinisnoise.org/files/din-${finalAttrs.version}.tar.gz";
+    hash = "sha256-YpaGOAVJmUMDkqvu9+fzW1RbNNSRO2Id8zg8DIblGXE=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    libsndfile
+    libjpeg
+    SDL
+    tcl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    freeglut
+    libGL
+    libGLU
+  ]
+  ++ lib.optionals jackSupport [ jack2 ]
+  ++ lib.optionals alsaSupport [ alsa-lib ];
+
+  # Makefile.am hard-codes /usr/include/tcl8.6 and unconditionally links
+  # -lasound. Strip both so Nix controls all flags via configureFlags.
+  # On Darwin, also strip -lGL and -lrt since OpenGL is provided as a framework
+  # and real-time extensions are built into the system library.
+  preConfigure = ''
+    substituteInPlace src/Makefile.am \
+      --replace-fail "-I /usr/include/tcl8.6" "-I${tcl}/include" \
+      --replace-fail " -lasound" ""
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/Makefile.am \
+      --replace-fail " -lGL" "" \
+      --replace-fail " -lrt" ""
+  '';
+
+  # Pass the backend macro and linker flags via configure, matching the
+  # upstream build scripts (o3-alsa / o3-jack).
+  # On Darwin, add -framework flags for OpenGL, GLUT, and Cocoa (needed by SDLmain),
+  # silence deprecation warnings, and link SDLmain (provides the main() wrapper for SDL apps on macOS).
+  configureFlags =
+    (
+      if jackSupport then
+        [
+          "CXXFLAGS=-D__UNIX_JACK__${lib.optionalString stdenv.hostPlatform.isDarwin " -DGL_SILENCE_DEPRECATION"}"
+        ]
+      else
+        [
+          "CXXFLAGS=-D__LINUX_ALSA__${lib.optionalString stdenv.hostPlatform.isDarwin " -DGL_SILENCE_DEPRECATION"}"
+        ]
+    )
+    ++ lib.optional jackSupport "LIBS=-ljack"
+    ++ lib.optional alsaSupport "LIBS=-lasound"
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "LDFLAGS=-framework OpenGL -framework GLUT -framework Cocoa -lSDLmain"
+    ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Open source cross-platform sound synthesizer";
+    longDescription = ''
+      DIN Is Noise is a program for making sound, music and noise. Use bezier
+      curves to edit waveforms, envelopes, modulators and FX components; use
+      the keyboard (computer and MIDI) to trigger notes (or noise), use the
+      mouse to sound like the theremin, create drones on microtones, launch,
+      orbit and drag them around; bounce balls on walls to trigger notes in a
+      mondrian inspired drawing and also make binaural beats. Supports MIDI
+      input and scripting through TCL.
+    '';
+    homepage = "https://dinisnoise.org/";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ fraggerfox ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "din";
+  };
+})

pkgs/by-name/fl/flap-alerted/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  nixosTests,
+
+  # modules (https://github.com/Kioubit/FlapAlerted#module-documentation)
+  withHttpApi ? true,
+  withLog ? true,
+  withScript ? true,
+  withWebhook ? true,
+  withCollector ? true,
+  withHistory ? true,
+  withRoaFilter ? false,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "flap-alerted";
+  version = "4.5.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Kioubit";
+    repo = "FlapAlerted";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-D4+FLAMt/cHXCks4GQI33ymbZIHzBajpvKU6QQntofk=";
+  };
+
+  vendorHash = null;
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=v${finalAttrs.version}"
+  ];
+
+  tags =
+    lib.optionals (!withHttpApi) [ "disable_mod_httpAPI" ]
+    ++ lib.optionals (!withLog) [ "disable_mod_log" ]
+    ++ lib.optionals (!withScript) [ "disable_mod_script" ]
+    ++ lib.optionals (!withWebhook) [ "disable_mod_webhook" ]
+    ++ lib.optionals (!withCollector) [ "disable_mod_collector" ]
+    ++ lib.optionals (!withHistory) [ "disable_mod_history" ]
+    ++ lib.optionals withRoaFilter [ "mod_roaFilter" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) flap-alerted; };
+  };
+
+  meta = {
+    description = "BGP Update based flap detection & statistics";
+    homepage = "https://github.com/Kioubit/FlapAlerted";
+    changelog = "https://github.com/Kioubit/FlapAlerted/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "FlapAlerted";
+  };
+})

pkgs/by-name/go/golazo/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "golazo";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "0xjuanma";
     repo = "golazo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MSFH6IuSeMi98Ri/YVIxLFn7eYozodosfk8ZYz+Q2K0=";
+    hash = "sha256-udZ3F6DQAzRZpPukkeGE4Ho0zl4pAt2CinIOQqmYe5Q=";
   };
 
   vendorHash = "sha256-M2gfqU5rOfuiVSZnH/Dr8OVmDhyU2jYkgW7RuIUTd+E=";

pkgs/by-name/js/jsmn/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv, # for tests
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "jsmn";
+  version = "1.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zserge";
+    repo = "jsmn";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Vv8Cqb+WZZVnmtVZ12JYd5/qUrqLqi4lvNsUyj9NnRQ=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 jsmn.h $out/include/jsmn.h
+
+    runHook postInstall
+  '';
+
+  passthru.tests.suite = stdenv.mkDerivation {
+    pname = "jsmn-tests";
+
+    inherit (finalAttrs) version src;
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    doCheck = true;
+    checkPhase = ''
+      runHook preCheck
+
+      make test
+
+      runHook postCheck
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      touch $out
+
+      runHook postInstall
+    '';
+  };
+
+  meta = {
+    description = "Minimalistic JSON parser in C";
+    maintainers = with lib.maintainers; [ BatteredBunny ];
+    homepage = "https://github.com/zserge/jsmn";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ku/kubelogin-oidc/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubelogin";
-  version = "1.36.1";
+  version = "1.36.2";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-leM2C6Ba2H9AU916NAVKEk6zoAWCIn43URQ/SEA8Xwc=";
+    hash = "sha256-VzUnjqa3XnKSqcwd2jVwbQwGmyO5+YBwPIIxN0wj81A=";
   };
 
   subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-vAbPLlQEku9KySHpdTvQHYHtxyi7/mUvytuyrP9wkHE=";
+  vendorHash = "sha256-/30B7krXl0HYm+nUqGtbhNb4L8utdorjZNGkfMCYs3k=";
 
   # test all packages
   preCheck = ''

pkgs/by-name/le/leanify/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation {
   pname = "leanify";
-  version = "0-unstable-2025-12-12";
+  version = "0.4.3-unstable-2025-12-12";
 
   src = fetchFromGitHub {
     owner = "JayXon";

pkgs/by-name/li/libexttextcat/package.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libexttextcat";
-  version = "3.4.6";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "https://dev-www.libreoffice.org/src/libexttextcat/libexttextcat-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-bXfqziDp6hBsEzDiaO3nDJpKiXRN3CVxVoJ1TsozaN8=";
+    sha256 = "sha256-k+uJ/U/I9WWAY1ThAOd4s6yaJOX8BMJOaoP7HptsnVk=";
   };
 
   meta = {

pkgs/by-name/mk/mkbootimage/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   elfutils,
-  pcre,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,7 +20,6 @@ stdenv.mkDerivation (finalAttrs: {
   # See https://github.com/NixOS/nixpkgs/pull/271568
   buildInputs = [
     elfutils
-    pcre
   ];
 
   postPatch = ''

pkgs/by-name/ns/ns-3/package.nix

@@ -63,13 +63,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ns-3";
-  version = "44";
+  version = "47";
 
   src = fetchFromGitLab {
     owner = "nsnam";
     repo = "ns-3-dev";
     rev = "ns-3.${finalAttrs.version}";
-    hash = "sha256-rw/WAMk4ZitULqkdyEh9vAFp1UrD1tw2JqgxOT5JQ5I=";
+    hash = "sha256-Av5Ret1v4RLafvYvUtCEh4Xb1ZwU3CgNOcDlRJrJsn8=";
   };
 
   nativeBuildInputs = [
@@ -118,13 +118,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
      substituteInPlace src/tap-bridge/CMakeLists.txt \
-       --replace '-DTAP_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/tap-bridge/' "-DTAP_CREATOR=\"$out/libexec/ns3/"
+       --replace-fail '-DTAP_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/tap-bridge/' "-DTAP_CREATOR=\"$out/libexec/ns3/"
 
     substituteInPlace src/fd-net-device/CMakeLists.txt \
-      --replace '-DRAW_SOCK_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DRAW_SOCK_CREATOR=\"$out/libexec/ns3/"
+      --replace-fail '-DRAW_SOCK_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DRAW_SOCK_CREATOR=\"$out/libexec/ns3/"
 
     substituteInPlace src/fd-net-device/CMakeLists.txt \
-      --replace '-DTAP_DEV_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DTAP_DEV_CREATOR=\"$out/libexec/ns3/"
+      --replace-fail '-DTAP_DEV_CREATOR="''${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/src/fd-net-device/' "-DTAP_DEV_CREATOR=\"$out/libexec/ns3/"
   '';
 
   doCheck = false;

pkgs/by-name/ob/oboete/package.nix

@@ -11,18 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oboete";
-  version = "0.2.4";
-
-  strictDeps = true;
+  version = "0.2.5";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "mariinkys";
     repo = "oboete";
     tag = finalAttrs.version;
-    hash = "sha256-QP0ZK6E3rz9WCvglJek8S25O8X5b8iyPAk7eph4lqMg=";
+    hash = "sha256-hOOpx1R7U5fJwWPATJaoT7VbODZJWMTg7v4ro00NZZc=";
   };
 
-  cargoHash = "sha256-ZEve4uKhbcps8FFRGizA6tedz2aH0j4gKTi3HauxpFE=";
+  cargoHash = "sha256-i2fGYVt3axF74B66ics36xk+17joiArfFJcqkv3v40c=";
 
   nativeBuildInputs = [
     libcosmicAppHook

pkgs/by-name/pi/pict-rs/package.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pict-rs";
-  version = "0.5.19";
+  version = "0.5.23";
 
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
     repo = "pict-rs";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ifuN3Kb7Hhq8H/eoZcumO5yyrxOCA+nWQQvAdFk7w2Q=";
+    sha256 = "sha256-9FEVqN/j+VCK0CihpfNXSp1JZ3G7/mB5R+NJKQQtwc0=";
   };
 
-  cargoHash = "sha256-wZRWusETLl32BJy5lza4Bvix500VkpXLUpQb5aO8yJ0=";
+  cargoHash = "sha256-LYCLGu569sJkEIm6oHWebIH4+AX7cGnRzPn7U29LNuQ=";
 
   env = {
     # needed for internal protobuf c wrapper library

pkgs/by-name/re/reaction/nftables-aarch64-linux-compat.patch

@@ -1,33 +0,0 @@
-From 94fafae651077be5e7a6dfd29fc06327a2f218ed Mon Sep 17 00:00:00 2001
-From: ppom <reaction@ppom.me>
-Date: Thu, 28 May 2026 12:00:00 +0200
-Subject: [PATCH] nftables: fix compilation on aarch64-linux
-
----
- plugins/reaction-plugin-nftables/src/nft.rs | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/plugins/reaction-plugin-nftables/src/nft.rs b/plugins/reaction-plugin-nftables/src/nft.rs
-index c234f77..2ac49df 100644
---- a/plugins/reaction-plugin-nftables/src/nft.rs
-+++ b/plugins/reaction-plugin-nftables/src/nft.rs
-@@ -1,5 +1,6 @@
- use std::{
-     ffi::{CStr, CString},
-+    os::raw::c_char,
-     thread,
- };
- 
-@@ -71,7 +72,7 @@ struct NftCommand {
-     ret: oneshot::Sender<Result<String, String>>,
- }
- 
--fn to_rust_string(c_ptr: *const i8) -> Option<String> {
-+fn to_rust_string(c_ptr: *const c_char) -> Option<String> {
-     if c_ptr.is_null() {
-         None
-     } else {
--- 
-GitLab
-
-

pkgs/by-name/re/reaction/package.nix

@@ -4,7 +4,6 @@
   callPackage,
   rustPlatform,
   fetchFromGitLab,
-  fetchpatch,
 
   versionCheckHook,
   installShellFiles,
@@ -14,22 +13,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "ppom";
     repo = "reaction";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y6scgbcwhg56SQ1DefNtdja+n89Gc5bJUHKHKn2EYwQ=";
+    hash = "sha256-1+kliU3TfXhAz/vRh/UamTdcv8UIXrcF1q+Qy1jsjD4=";
   };
 
-  patches = [
-    # nftables: fix compilation on aarch64-linux; remove in 2.4.1
-    ./nftables-aarch64-linux-compat.patch
-  ];
-
-  cargoHash = "sha256-NAcMpASvphAqjBjbAPWLG5qZbSgdaFC3GvU25exCS3g=";
+  cargoHash = "sha256-FQCYCSKk8SLO2ddM6hklUuTvSK7+4dElaNQ3ZNnci3M=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ry/ryzenadj/package.nix

@@ -4,20 +4,22 @@
   fetchFromGitHub,
   pciutils,
   cmake,
+  pkg-config,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ryzenadj";
-  version = "0.17.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-28ld8htm3DewTSV3WTG4dFOcX4JAEUMK9rq4AAm1/zY=";
+    sha256 = "sha256-SNtCKZ3bugawzD8R3DjwPs/ls3kyTw1LdIcXuR6fumc=";
   };
 
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [

pkgs/by-name/ta/tail-tray/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tail-tray";
-  version = "0.2.32";
+  version = "0.2.33";
 
   src = fetchFromGitHub {
     owner = "SneWs";
     repo = "tail-tray";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8xo+4k3bdEZ7RHPLvkEWTddIwkwd5GQ3c+rFfq5kAw=";
+    hash = "sha256-OCzvdD1b3Rwk+dI9gmuFkaOwvfjUzFVXpslvfwKtDyk=";
   };
 
   nativeBuildInputs = with kdePackages; [

pkgs/by-name/ta/tailscale/package.nix

@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.98.3";
+  version = "1.98.5";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+NEJVLLcwUNf3ZCXZEXAnTA5Pd6FlneMBZ0BcDYgXk=";
+    hash = "sha256-JaVCmMdZMaP/8RaNRmYpQOj+y/NfHuXdqp8qyWNYEqM=";
   };
 
   vendorHash = "sha256-mbxLXR2TBgiwyVGfLmMR5xWk+0f66mPDas95Wla70Lk=";

pkgs/by-name/te/teamspeak6-client/package.nix

@@ -36,11 +36,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "teamspeak6-client";
-  version = "6.0.0-beta4";
+  version = "6.0.0-beta4.1";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/pre_releases/client/${finalAttrs.version}/teamspeak-client.tar.gz";
-    hash = "sha256-tDMECBWmh4QJzyVdvlkQW7Mqu8Mn6JjFiXMJJS45Efg=";
+    hash = "sha256-7f0VQQLa4Gg7qgXMVfoPYPazPRA9uYeX251j3mHaSLo=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ti/tinymist/package.nix

@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.14.18";
+  version = "0.14.21";
 
   __structuredAttrs = true;
 
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udA5W6AhK11zuFmfedDueRY01Rr2ZXmbN5DrIcuvbVo=";
+    hash = "sha256-8u3hWzbFY/qwUKDvoESVJODNQdxyV/c36iz6M1sCQ5A=";
   };
 
-  cargoHash = "sha256-L+U47ZYtU51wRjDD1lMyxoYaKZIUnyuZ0C885YnBauA=";
+  cargoHash = "sha256-Wt885VcPCv7uNSuhHa9LuuWsfCOwz711N6E8YqXYsMI=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/tu/tutanota-desktop/package.nix

@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "348.260519.0";
+  version = "348.260529.2";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-SqD6pErUUeq/m0IdhL4EVyYINmyIME6pucGH3sAUL5g=";
+    hash = "sha256-lBBI+Jhmm0+jmsV2Vq3UFU5ViyeuHVOluRoLrHIwyiM=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];

pkgs/desktops/lomiri/development/qtmir/default.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitLab,
+  nixosTests,
   testers,
   cmake,
   cmake-extras,
@@ -36,13 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
   # Not regular qtmir, experimental support for Mir 2.x
   # Currently following https://gitlab.com/ubports/development/core/qtmir/-/tree/personal/sunweaver/debian-upstream
   pname = "qtmir-debian-upstream";
-  version = "0.8.0-unstable-2025-05-20";
+  version = "0.8.0-unstable-2026-03-11";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/qtmir";
-    rev = "b35762f5198873560138a810b387ae9401615c02";
-    hash = "sha256-v5mdu3XLK4F5O56GDItyeCFsFMey4JaNWwXRlgjKFMA=";
+    rev = "57d9e9763933a5d6ca696676ebdde934529a71fe";
+    hash = "sha256-xlMxBnEru4YK0BxUOd/jni9OTb6lZlw6nyHLNqdfY20=";
   };
 
   outputs = [
@@ -50,19 +51,24 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  postPatch = ''
-    # 10s timeout for Mir startup is too tight for VM tests on weaker hardwre (aarch64)
-    substituteInPlace src/platforms/mirserver/qmirserver_p.cpp \
-      --replace-fail 'const int timeout = RUNNING_ON_VALGRIND ? 100 : 10' 'const int timeout = RUNNING_ON_VALGRIND ? 900 : 90' \
-      --replace-fail 'const int timeout = 10' 'const int timeout = 90'
-
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}" \
-      --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt5/plugins/platforms" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtPluginPrefix}/platforms" \
-
-    substituteInPlace data/xwayland.qtmir.desktop \
-      --replace-fail '/usr/bin/Xwayland' 'Xwayland'
-  '';
+  postPatch =
+    # 10s timeout for Mir startup is too tight for VM tests on weaker hardware (aarch64)
+    ''
+      substituteInPlace src/platforms/mirserver/qmirserver_p.cpp \
+        --replace-fail 'const int timeout = RUNNING_ON_VALGRIND ? 100 : 10' 'const int timeout = RUNNING_ON_VALGRIND ? 900 : 90' \
+        --replace-fail 'const int timeout = 10' 'const int timeout = 90'
+    ''
+    # Fix where Qt plugins & QML modules should be installed to. We don't use "qt5" for Qt5.
+    + ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}" \
+        --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt5/plugins/platforms" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtPluginPrefix}/platforms"
+    ''
+    # Look up Xwayland in environment
+    + ''
+      substituteInPlace data/xwayland.qtmir.desktop \
+        --replace-fail '/usr/bin/Xwayland' 'Xwayland'
+    '';
 
   strictDeps = true;
 
@@ -120,7 +126,9 @@ stdenv.mkDerivation (finalAttrs: {
   # Tests currently unavailable when building with Mir2
   doCheck = false;
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru.tests = nixosTests.lomiri // {
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = {
     description = "QPA plugin to make Qt a Mir server";

pkgs/desktops/lxqt/lxqt-panel/default.nix

@@ -23,7 +23,7 @@
   lxqt-build-tools,
   lxqt-globalkeys,
   lxqt-menu-data,
-  pcre,
+  pcre2,
   qtbase,
   qtsvg,
   qttools,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     lm_sensors
     lxqt-globalkeys
     lxqt-menu-data
-    pcre
+    pcre2
     qtbase
     qtsvg
     qtwayland

pkgs/desktops/lxqt/lxqt-runner/default.nix

@@ -10,7 +10,7 @@
   lxqt-build-tools,
   lxqt-globalkeys,
   muparser,
-  pcre,
+  pcre2,
   pkg-config,
   qtbase,
   qtsvg,
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     libqtxdg
     lxqt-globalkeys
     muparser
-    pcre
+    pcre2
     qtbase
     qtsvg
     qtwayland

pkgs/development/python-modules/aiopyarr/default.nix

@@ -8,26 +8,29 @@
   orjson,
   pytest-asyncio,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiopyarr";
   version = "23.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tkdrob";
     repo = "aiopyarr";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-CzNB6ymvDTktiOGdcdCvWLVQ3mKmbdMpc/vezSXCpG4=";
   };
 
+  build-system = [ setuptools ];
+
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'version="master"' 'version="${version}"'
+      --replace-fail 'version="master"' 'version="${finalAttrs.version}"'
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     ciso8601
     orjson
@@ -44,8 +47,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API client for Lidarr/Radarr/Readarr/Sonarr";
     homepage = "https://github.com/tkdrob/aiopyarr";
-    changelog = "https://github.com/tkdrob/aiopyarr/releases/tag/${version}";
+    changelog = "https://github.com/tkdrob/aiopyarr/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/ansi2image/default.nix

@@ -5,21 +5,24 @@
   fetchFromGitHub,
   pillow,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ansi2image";
   version = "0.1.5";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "helviojunior";
     repo = "ansi2image";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-GWrVo1WJux+ATvG5F9J4WMDlI0XAeTpQg7NrkN1P4Co=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     colorama
     pillow
   ];
@@ -34,8 +37,8 @@ buildPythonPackage rec {
     description = "Module to convert ANSI text to an image";
     mainProgram = "ansi2image";
     homepage = "https://github.com/helviojunior/ansi2image";
-    changelog = "https://github.com/helviojunior/ansi2image/blob/${version}/CHANGELOG";
+    changelog = "https://github.com/helviojunior/ansi2image/blob/${finalAttrs.version}/CHANGELOG";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.18";
+  version = "1.43.19";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-Cb9IDGK8VM9ZvQrROz2w7ZoAWSZ1/QEki8uk+T6qdmA=";
+    hash = "sha256-0Wc9i9REkPu/OT6Gmo3cGPzYq0zrx/sq6/KYybtD+8s=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/exllamav3/default.nix

@@ -8,6 +8,7 @@
   setuptools,
 
   flash-attn,
+  flash-linear-attention,
   formatron,
   kbnf,
   marisa-trie,
@@ -28,14 +29,14 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "0.0.38";
+  version = "0.0.39";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WlHIbnQX1Jd7y5yQzlqXVgBLQ92rnDSWy4z9bEm3WLA=";
+    hash = "sha256-auAOnsNOr22TTIBR9L81tp9ZCrSLY4RxXWAJ1E39EwM=";
   };
 
   pythonRelaxDeps = [
@@ -60,6 +61,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
   dependencies = [
     flash-attn
+    flash-linear-attention
     formatron
     kbnf
     marisa-trie

pkgs/development/python-modules/flash-linear-attention/default.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  einops,
+  torch,
+  transformers,
+
+  # optional-dependencies
+  causal-conv1d,
+  matplotlib,
+  datasets,
+  pytest,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "flash-linear-attention";
+  version = "0.5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "fla-org";
+    repo = "flash-linear-attention";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g66yGHaBwEyjb+of76tKTtV/7as/2xQuqcjbGs4E3rU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    einops
+    torch
+    transformers
+  ];
+
+  optional-dependencies = {
+    # tilelang = [ tilelang ];
+    conv1d = [ causal-conv1d ];
+    benchmark = [
+      matplotlib
+      datasets
+    ];
+    test = [ pytest ];
+  };
+
+  # Tests require a GPU
+  doCheck = false;
+
+  pythonImportsCheck = [ "fla" ];
+
+  meta = {
+    description = "Triton-based implementations of causal linear attention";
+    homepage = "https://github.com/fla-org/flash-linear-attention";
+    changelog = "https://github.com/fla-org/flash-linear-attention/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ BatteredBunny ];
+  };
+})

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606011";
+  version = "0.1.202606021";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O2TrzMml1mCbWN4yFotixnXVMSINeAY/iK4jWJWCtAA=";
+    hash = "sha256-/MZUx/BgpDBFBAdJw8xQmgrcQKxSwq5tt9PHw5XZHMQ=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/ical/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ical";
-  version = "13.2.2";
+  version = "13.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "allenporter";
     repo = "ical";
     tag = finalAttrs.version;
-    hash = "sha256-7EKnwfXRU7hzFVre5EVil8/HN+XnCh2qz0BF69sLDHc=";
+    hash = "sha256-u7HVutdUHwUsGfKj+PYjTrhX9I5lDUzWRhsBnjJYWOg=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/lxmf/default.nix

@@ -8,14 +8,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lxmf";
-  version = "0.9.8";
+  version = "1.0.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "lxmf";
     tag = finalAttrs.version;
-    hash = "sha256-26T8f4WCf5q5/2RKA2Dh5xxqUOR3XXRFOzezCuDRA6c=";
+    hash = "sha256-ohbZSpjIyCiiwXUjvr0UBXKN4OScdTzxx5QimPWnCAI=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -311,8 +311,8 @@ in
       "sha256-CavBKgp+dEMR2poR+bG2PgZb+wX1zlNmuOyJsV3LfVM=";
 
   mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.43.0"
-      "sha256-oxmjIvweCKsN/QybmuHCKeGPzQMZsJOZ4HXvUnA15h8=";
+    buildMypyBoto3Package "cognito-idp" "1.43.19"
+      "sha256-Aihq5V9TmK5erGX06KeGzHftyu68BYhkifn2HnMXBG0=";
 
   mypy-boto3-cognito-sync =
     buildMypyBoto3Package "cognito-sync" "1.43.0"
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.18"
-      "sha256-+cfQUyFlqWRQtkX28raVgZjdwnqhyK5vNyZjpWW3aEI=";
+    buildMypyBoto3Package "quicksight" "1.43.19"
+      "sha256-7KjkPWai+mZzPUwwC93YyvSQVbWgpvFlr41T08YzT6M=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"

pkgs/development/python-modules/nomadnet/default.nix

@@ -12,14 +12,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "NomadNet";
     tag = finalAttrs.version;
-    hash = "sha256-2XbEJfB9Qj58u3rdTQA4DY2ZsVk/6FBhvlggBdrwRBk=";
+    hash = "sha256-BaRZfqQ9oNpWQc5uQ0PvVduauW3+gTnDljYeBXlmJ9w=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/paddleocr/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   setuptools,
   setuptools-scm,
+  aiohttp,
   attrdict,
   beautifulsoup4,
   cython,
@@ -32,14 +33,14 @@
 
 buildPythonPackage rec {
   pname = "paddleocr";
-  version = "3.5.0";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
     tag = "v${version}";
-    hash = "sha256-bcunbaocltKGeIeLG8447y6wMFXL08XF7pEhHgoqmrY=";
+    hash = "sha256-I6ZDQ+u8c/Txumq/rRwyulv3mGCi6hjAXvQohEpxpiE=";
   };
 
   patches = [
@@ -65,6 +66,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    aiohttp
     attrdict
     beautifulsoup4
     cython

pkgs/development/python-modules/pyfaup-rs/default.nix

@@ -8,19 +8,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyfaup-rs";
-  version = "0.4.9";
+  version = "0.4.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "faup-rs";
     tag = "pyfaup-rs-v${finalAttrs.version}";
-    hash = "sha256-eL03QC2UINONXUyWwgiL4WYsq3/pXYffK5LcK9qVo0w=";
+    hash = "sha256-cbKmvUoqID87mtVM9AocUviyzZvWT18Qoxot23qFdJM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Wv1dT3TmZ8Dviv/FXdHa5ptM/ZleoUGSJTuPLhMfBVw=";
+    hash = "sha256-maMMuuH7GIpRCRe1GoKXpFrOntdsnM8gHJg0lWC3kZ0=";
   };
 
   buildAndTestSubdir = "python";

pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix

@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "homeassistant-ai";
   domain = "ha_mcp_tools";
-  version = "7.5.0";
+  version = "7.6.0";
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${version}";
-    hash = "sha256-qRWNh7kKFQZpgZjkpc/Qv2s16DdWFX35HLHIToYXccU=";
+    hash = "sha256-1jIOSv13p9MUC5SiGcXIIojY4tGERw5lfOQsZsSMW40=";
   };
 
   dependencies = [

pkgs/servers/home-assistant/custom-components/local_openai/package.nix

@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "local_openai";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "hass_local_openai_llm";
     tag = finalAttrs.version;
-    hash = "sha256-S7gtm9JRaxNh6xbeKRyW6l6nXqE4+h9kgyUZ9RkbLR0=";
+    hash = "sha256-hY5pBuQQ3/Ayr9jZ5clYaxn5aAZcub0XXtiqgBjdfxM=";
   };
 
   dependencies = [

pkgs/tools/text/highlight/default.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   getopt,
   lua,
   boost,
@@ -25,14 +24,6 @@ let
       hash = "sha256-fMIyMR9RA60hdy1eniJkvLHK+WJPuVehWMyS9Lt6iQ4=";
     };
 
-    patches = [
-      (fetchpatch {
-        name = "shellscript-crash-fix.patch";
-        url = "https://gitlab.com/saalen/highlight/-/commit/2c0e95290fe7ca26185851f38ac205d81e4b7015.patch";
-        hash = "sha256-aan2s7wKzBO/QbK+Q+Zq1RiyFORJjEYDcscjCAxMJg8=";
-      })
-    ];
-
     enableParallelBuilding = true;
 
     nativeBuildInputs = [

pkgs/top-level/python-packages.nix

@@ -5716,6 +5716,8 @@ self: super: with self; {
 
   flash-attn-4 = callPackage ../development/python-modules/flash-attn-4 { };
 
+  flash-linear-attention = callPackage ../development/python-modules/flash-linear-attention { };
+
   flash-mla = callPackage ../development/python-modules/flash-mla { };
 
   flashinfer = callPackage ../development/python-modules/flashinfer { };