Merge 89afca31a7 into haskell-updates

ci/eval/compare/default.nix

@@ -172,6 +172,7 @@ let
       rebuildCountByKernel = lib.mapAttrs (
         kernel: kernelRebuilds: lib.length kernelRebuilds
       ) rebuildsByKernel;
+      rebuildNames = extractPackageNames diffAttrs.rebuilds;
     in
     writeText "changed-paths.json" (
       builtins.toJSON {
@@ -188,7 +189,8 @@ let
             kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
           ) rebuildsByKernel
           // {
-            "10.rebuild-nixos-tests" = lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds);
+            "10.rebuild-nixos-tests" =
+              lib.elem "nixosTests.simple-container" rebuildNames || lib.elem "nixosTests.simple-vm" rebuildNames;
           };
       }
     );

ci/eval/outpaths.nix

@@ -108,6 +108,8 @@ in
 tweak (
   (removeAttrs nixpkgsJobs blacklist)
   // {
-    nixosTests = lib.filterAttrs (name: _: name == "simple") nixosJobs.tests;
+    nixosTests = lib.filterAttrs (
+      name: _: name == "simple-container" || name == "simple-vm"
+    ) nixosJobs.tests;
   }
 )

ci/github-script/check-target-branch.js

@@ -99,7 +99,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
     ...Object.values(changed.rebuildCountByKernel),
   )
   const rebuildsAllTests =
-    changed.attrdiff.changed.includes('nixosTests.simple')
+    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
+    changed.attrdiff.changed.includes('nixosTests.simple-vm')
 
   // https://github.com/NixOS/nixpkgs/pull/481205#issuecomment-3790123921
   // These should go to staging-nixos instead of master,

maintainers/maintainer-list.nix

@@ -28117,12 +28117,6 @@
     githubId = 50843046;
     name = "tornax";
   };
-  toschmidt = {
-    email = "tobias.schmidt@in.tum.de";
-    github = "toschmidt";
-    githubId = 27586264;
-    name = "Tobias Schmidt";
-  };
   totalchaos = {
     email = "basil.keeler@outlook.com";
     github = "totalchaos05";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -132,6 +132,8 @@
 
 - [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
 
+- [SuiteNumérique Drive](https://github.com/suitenumerique/drive), a collaborative file sharing and document management platform that scales. Built with Django and React. Open source alternative to Sharepoint or Google Drive.
+
 - [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter), a tool used to set up IR cameras, used with Howdy.
 
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1475,7 +1475,6 @@ class NspawnMachine(BaseMachine):
 
         self.start_command = start_command
         self.process = None
-        self.pid = None
 
         self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"
 
@@ -1486,14 +1485,13 @@ class NspawnMachine(BaseMachine):
         return f'ssh -o User=root -o ProxyCommand="{proxy_cmd}" bash'
 
     def release(self) -> None:
-        if self.pid is None:
+        if self.process is None:
             return
 
         if self.machine_sock:
             self.machine_sock.close()
 
-        self.logger.info(f"kill NspawnMachine (pid {self.pid})")
-        assert self.process is not None
+        self.logger.info(f"kill NspawnMachine (pid {self.process.pid})")
         self.process.terminate()
         # Wait for the wrapper to finish its context-manager cleanups
         # (veth/bridge/netns teardown) before returning, so the driver's
@@ -1502,7 +1500,7 @@ class NspawnMachine(BaseMachine):
             self.process.wait(timeout=30)
         except subprocess.TimeoutExpired:
             self.logger.error(
-                f"NspawnMachine {self.name} (pid {self.pid}) did not exit after SIGTERM; sending SIGKILL"
+                f"NspawnMachine {self.name} (pid {self.process.pid}) did not exit after SIGTERM; sending SIGKILL"
             )
             self.process.kill()
             self.process.wait()
@@ -1694,9 +1692,7 @@ class NspawnMachine(BaseMachine):
             stdout=subprocess.PIPE,
         )
 
-        self.pid = self.process.pid
-
-        self.log(f"systemd-nspawn running (pid {self.pid})")
+        self.log(f"systemd-nspawn running (pid {self.process.pid})")
 
         journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
         journal_thread.start()

nixos/modules/config/terminfo.nix

@@ -50,7 +50,6 @@
           rxvt-unicode-unwrapped
           rxvt-unicode-unwrapped-emoji
           st
-          termite
           tmux
           wezterm
           yaft

nixos/modules/module-list.nix

@@ -1697,6 +1697,7 @@
   ./services/web-apps/komga.nix
   ./services/web-apps/lanraragi.nix
   ./services/web-apps/lasuite-docs.nix
+  ./services/web-apps/lasuite-drive.nix
   ./services/web-apps/lasuite-meet.nix
   ./services/web-apps/lauti.nix
   ./services/web-apps/lemmy.nix

nixos/modules/programs/wayland/river.nix

@@ -51,7 +51,7 @@ in
         with pkgs; [ swaylock foot dmenu ];
       '';
       example = lib.literalExpression ''
-        with pkgs; [ termite rofi light ]
+        with pkgs; [ alacritty rofi light ]
       '';
       description = ''
         Extra packages to be installed system wide. See

nixos/modules/programs/wayland/sway.nix

@@ -116,7 +116,7 @@ in
         with pkgs; [ brightnessctl foot grim pulseaudio swayidle swaylock wmenu ];
       '';
       example = lib.literalExpression ''
-        with pkgs; [ i3status i3status-rust termite rofi light ]
+        with pkgs; [ i3status i3status-rust alacritty rofi light ]
       '';
       description = ''
         Extra packages to be installed system wide. See

nixos/modules/services/desktops/seatd.nix

@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/display-managers/gdm.nix

@@ -45,9 +45,19 @@ let
 
   setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
 
-  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
-    DCONF_PROFILE=gdm
-  '';
+  greeterUsers = lib.genAttrs' [ null 1 2 3 4 ] (
+    i:
+    let
+      # adding 1 to create `gdm-greeter{-2,-3,-4,-5}`
+      suffix = lib.optionalString (i != null) "-${toString (i + 1)}";
+    in
+    lib.nameValuePair "gdm-greeter${suffix}" {
+      isSystemUser = true;
+      uid = 60578 + (if i == null then 0 else i);
+      group = "gdm";
+      home = "/run/gdm/home/gdm-greeter${suffix}";
+    }
+  );
 in
 
 {
@@ -190,6 +200,8 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    warnings = lib.optional config.services.pulseaudio.enable "Support for Pulseaudio + gdm will be removed in NixOS 26.11";
+
     services.xserver.displayManager.lightdm.enable = false;
 
     users.users = lib.mkMerge [
@@ -200,24 +212,8 @@ in
           group = "gdm";
           description = "GDM user";
         };
-
-        gdm-greeter = {
-          isSystemUser = true;
-          uid = 60578;
-          group = "gdm";
-          home = "/run/gdm";
-        };
       }
-
-      (lib.genAttrs' [ 1 2 3 4 ] (
-        i:
-        lib.nameValuePair "gdm-greeter-${toString i}" {
-          isSystemUser = true;
-          uid = 60578 + i;
-          group = "gdm";
-          home = "/run/gdm-${toString i}";
-        }
-      ))
+      greeterUsers
     ];
 
     users.groups.gdm.gid = config.ids.gids.gdm;
@@ -259,17 +255,20 @@ in
       };
     };
 
-    systemd.tmpfiles.rules = [
-      "d /run/gdm/.config 0711 gdm gdm"
-    ]
-    ++ lib.optionals config.services.pulseaudio.enable [
-      "d /run/gdm/.config/pulse 0711 gdm gdm"
-      "L+ /run/gdm/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
-    ]
-    ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
-      # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
-    ];
+    systemd.tmpfiles.rules =
+      lib.optionals config.services.pulseaudio.enable (
+        lib.concatLists (
+          lib.mapAttrsToList (name: user: [
+            "d ${user.home}/.config 0711 ${name} gdm"
+            "d ${user.home}/.config/pulse 0711 ${name} gdm"
+            "L+ ${user.home}/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
+          ]) greeterUsers
+        )
+      )
+      ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
+        # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
+        "f /run/gdm/gdm.ran-initial-setup 0711 gdm gdm - yes"
+      ];
 
     # Otherwise GDM will not be able to start correctly and display Wayland sessions
     systemd.packages = [
@@ -456,12 +455,6 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
-            {
-              name = "env-greeter";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.envfile = greeterEnvFile;
-            }
             {
               name = "systemd";
               control = "optional";

nixos/modules/services/networking/pihole-ftl-setup-script.nix

@@ -19,6 +19,7 @@ let
 in
 ''
   # Can't use -u (unset) because api.sh uses API_URL before it is set
+  set +u
   set -eo pipefail
   pihole="${lib.getExe pihole}"
   jq="${lib.getExe pkgs.jq}"
@@ -29,22 +30,24 @@ in
   if [ ! -f '${cfg.settings.files.gravity}' ]; then
     $pihole -g
     # Send SIGRTMIN to FTL, which makes it reload the database, opening the newly created one
-    ${lib.getExe' pkgs.procps "kill"} -s SIGRTMIN $(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})
+    ${lib.getExe' pkgs.procps "kill"} -s SIGRTMIN "$(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})"
   fi
 
+  # shellcheck disable=SC1091
   source ${pihole}/share/pihole/advanced/Scripts/api.sh
+  # shellcheck disable=SC1091
   source ${pihole}/share/pihole/advanced/Scripts/utils.sh
 
   any_failed=0
 
   addList() {
-    local payload="$1"
+    local payload="$1" result type error
 
     echo "Adding list: $payload"
-    local type=$($jq -r '.type' <<< "$payload")
-    local result=$(PostFTLData "lists?type=$type" "$payload")
+    type=$($jq -r '.type' <<< "$payload")
+    result=$(PostFTLData "lists?type=$type" "$payload")
 
-    local error="$($jq '.error' <<< "$result")"
+    error="$($jq '.error' <<< "$result")"
     if [[ "$error" != "null" ]]; then
         echo "Error: $error"
         any_failed=1
@@ -62,7 +65,7 @@ in
     echo "Added list ID $id: $result"
   }
 
-  for i in 1 2 3; do
+  for _ in 1 2 3; do
     (TestAPIAvailability) && break
     echo "Retrying API shortly..."
     ${lib.getExe' pkgs.coreutils "sleep"} .5s

nixos/modules/services/networking/pihole-ftl.nix

@@ -491,11 +491,18 @@ in
 
     users.groups.${cfg.group} = { };
 
-    environment.etc."pihole/pihole.toml" = {
-      source = settingsFile;
-      user = cfg.user;
-      group = cfg.group;
-      mode = "400";
+    environment.etc = {
+      "pihole/pihole.toml" = {
+        source = settingsFile;
+        user = cfg.user;
+        group = cfg.group;
+        mode = "400";
+      };
+
+      "pihole/versions".text = ''
+        CORE_VERSION=${cfg.piholePackage.src.src.tag}
+        FTL_VERSION=${cfg.package.src.tag}
+      '';
     };
 
     environment.systemPackages = [ cfg.pihole ];

nixos/modules/services/web-apps/lasuite-drive.nix

@@ -0,0 +1,542 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    concatMapStringsSep
+    concatStringsSep
+    escapeShellArg
+    getExe
+    hasSuffix
+    mapAttrs
+    match
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    types
+    optional
+    optionalString
+    ;
+
+  cfg = config.services.lasuite-drive;
+
+  pythonEnvironment = mapAttrs (
+    _: value:
+    if value == null then
+      "None"
+    else if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-drive";
+    StateDirectory = "lasuite-drive";
+    WorkingDirectory = "/var/lib/lasuite-drive";
+
+    User = "lasuite-drive";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-drive.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    MemoryDenyWriteExecute = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    UMask = "0077";
+    EnvironmentFile = cfg.environmentFiles;
+  };
+
+  proxySuffix = if match "unix:.*" cfg.bind != null then ":" else "";
+
+  # Convert environment variables to be used as systemd-run arguments
+  envArgs = lib.concatStringsSep " " (
+    lib.mapAttrsToList (name: value: "-E ${escapeShellArg "${name}=${value}"}") pythonEnvironment
+  );
+
+  # Easier usage of django manage.py stuff
+  manage = pkgs.writeShellScriptBin "lasuite-drive-manage" ''
+    exec ${lib.getExe' config.systemd.package "systemd-run"} \
+      -p User=${commonServiceConfig.User} \
+      -p DynamicUser=yes \
+      -p StateDirectory=${commonServiceConfig.StateDirectory} \
+      ${optionalString cfg.redis.createLocally "-p SupplementaryGroups=${config.services.redis.servers.lasuite-drive.group} \\"}
+      ${concatMapStringsSep "\n" (envFile: "-p EnvironmentFile=${envFile} \\") cfg.environmentFiles}
+      --working-directory=${commonServiceConfig.WorkingDirectory} \
+      --quiet --collect --pipe --pty \
+      ${envArgs} ${lib.getExe cfg.package} "$@"
+  '';
+in
+{
+  options.services.lasuite-drive = {
+    enable = mkEnableOption "SuiteNumérique Drive";
+
+    package = mkPackageOption pkgs "lasuite-drive" { };
+
+    bind = mkOption {
+      type = types.str;
+      default = "unix:/run/lasuite-drive/gunicorn.sock";
+      example = "127.0.0.1:8000";
+      description = ''
+        The path, host/port or file descriptior to bind the gunicorn socket to.
+
+        See  <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
+      '';
+    };
+
+    enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
+      default = true;
+    };
+
+    secretKeyPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to the Django secret key.
+
+        The key can be generated using:
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+
+        :::{.note}
+        If not specified, a secret key is automatically generated and stored in the state directory.
+        :::
+      '';
+    };
+
+    s3Url = mkOption {
+      type = types.str;
+      description = ''
+        URL of the S3 bucket.
+      '';
+    };
+
+    postgresql = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local PostgreSQL database server for drive.
+        '';
+      };
+    };
+
+    redis = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local Redis cache server for drive.
+        '';
+      };
+    };
+
+    gunicorn = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "--name=drive"
+          "--workers=3"
+        ];
+        description = ''
+          Extra arguments to pass to the gunicorn process.
+        '';
+      };
+    };
+
+    celery = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra arguments to pass to the celery process.
+        '';
+      };
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = ''
+        Domain name of the drive instance.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.bool
+              types.path
+              types.int
+            ]
+          )
+        );
+
+        options = {
+          DJANGO_CONFIGURATION = mkOption {
+            type = types.str;
+            internal = true;
+            default = "Production";
+            description = "The configuration that Django will use";
+          };
+
+          DJANGO_SETTINGS_MODULE = mkOption {
+            type = types.str;
+            internal = true;
+            default = "drive.settings";
+            description = "The configuration module that Django will use";
+          };
+
+          DJANGO_SECRET_KEY_FILE = mkOption {
+            type = types.path;
+            default =
+              if cfg.secretKeyPath == null then "/var/lib/lasuite-drive/django_secret_key" else cfg.secretKeyPath;
+            description = "The path to the file containing Django's secret key";
+          };
+
+          DATA_DIR = mkOption {
+            type = types.path;
+            default = "/var/lib/lasuite-drive";
+            description = "Path to the data directory";
+            readOnly = true;
+          };
+
+          DJANGO_ALLOWED_HOSTS = mkOption {
+            type = types.listOf types.str;
+            default =
+              if cfg.enableNginx then
+                [
+                  "localhost"
+                  "127.0.0.1"
+                  cfg.domain
+                ]
+              else
+                [ ];
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx then [ "localhost" "127.0.0.1" cfg.domain ] else [ ]
+            '';
+            apply = list: concatStringsSep "," list;
+            description = "Comma-separated list of hosts that are able to connect to the server";
+          };
+
+          DB_NAME = mkOption {
+            type = types.str;
+            default = "lasuite-drive";
+            description = "Name of the database";
+          };
+
+          DB_USER = mkOption {
+            type = types.str;
+            default = "lasuite-drive";
+            description = "User of the database";
+          };
+
+          DB_HOST = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
+            description = "Host of the database";
+          };
+
+          REDIS_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "unix://${config.services.redis.servers.lasuite-drive.unixSocket}?db=1"
+              else
+                null;
+            description = "URL of the redis backend";
+          };
+
+          CELERY_BROKER_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "redis+socket://${config.services.redis.servers.lasuite-drive.unixSocket}?db=2"
+              else
+                null;
+            description = "URL of the redis backend for celery";
+          };
+        };
+      };
+      default = { };
+      example = ''
+        {
+          AWS_S3_ENDPOINT_URL = "https://s3.us-west.amazonaws.com";
+        }
+      '';
+      description = ''
+        Configuration options of drive.
+
+        See <https://github.com/suitenumerique/drive/blob/v${cfg.package.version}/docs/env.md>
+
+        `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-drive.redis.createLocally` is true.
+        `DB_HOST` is set if `services.lasuite-drive.postgresql.createLocally` is true.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      description = ''
+        Path to environment files.
+
+        This can be useful to pass secrets to drive via tools like `agenix` or `sops`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = mkIf (cfg.enableNginx && !(hasSuffix "/" cfg.s3Url)) [
+      ''
+        services.lasuite-drive.s3Url should end with a trailing slash (/).
+        This could break the HTTP requests by nginx to the S3 backend.
+      ''
+    ];
+
+    environment.systemPackages = [ manage ];
+
+    systemd.services.lasuite-drive = {
+      description = "Drive from SuiteNumérique";
+      after = [
+        "network-online.target"
+      ]
+      ++ (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-drive/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-drive/django_secret_key
+            )
+          fi
+        ''}
+        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.package} migrate
+          echo -n "${cfg.package.version}" > .version
+        fi
+      '';
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-drive/static";
+
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.package "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "drive.wsgi:application" ]
+        );
+      }
+      // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-drive-celery = {
+      description = "Docs Celery broker from SuiteNumérique";
+      after = [
+        "network-online.target"
+      ]
+      ++ (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [ (lib.getExe' cfg.package "celery") ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=drive.celery_app"
+            "worker"
+          ]
+        );
+      }
+      // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-drive-beat = {
+      description = "Docs Celery beat from SuiteNumérique";
+      after = [
+        "network-online.target"
+      ]
+      ++ (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-drive.service");
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [ (lib.getExe' cfg.package "celery") ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=drive.celery_app"
+            "beat"
+          ]
+        );
+      }
+      // commonServiceConfig;
+    };
+
+    services.postgresql = mkIf cfg.postgresql.createLocally {
+      enable = true;
+      ensureDatabases = [ "lasuite-drive" ];
+      ensureUsers = [
+        {
+          name = "lasuite-drive";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.redis.servers.lasuite-drive = mkIf cfg.redis.createLocally { enable = true; };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        extraConfig = ''
+          error_page 401 /401.html;
+          error_page 403 /403.html;
+          error_page 404 /404.html;
+        '';
+
+        root = cfg.package.frontend;
+
+        locations."/" = {
+          tryFiles = "$uri $uri.html index.html $uri/ =404";
+        };
+
+        locations."~ '^/explorer/items/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$'" =
+          {
+            tryFiles = "$uri /explorer/items/[id].html";
+          };
+
+        locations."~ '^/explorer/items/files/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$'" =
+          {
+            tryFiles = "$uri /explorer/items/files/[id].html";
+          };
+
+        locations."~ '^/wopi/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$'" = {
+          tryFiles = "$uri /wopi/[id].html";
+        };
+
+        locations."/static/" = {
+          alias = "${cfg.package}/share/static/";
+        };
+
+        locations."/api" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/admin" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/media-auth" = {
+          proxyPass = "http://${cfg.bind}${proxySuffix}/api/v1.0/items/media-auth/";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            proxy_set_header X-Original-URL $request_uri;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Original-Method $request_method;
+          '';
+        };
+
+        locations."/media/" = {
+          proxyPass = cfg.s3Url;
+          extraConfig = ''
+            auth_request /media-auth;
+            auth_request_set $authHeader $upstream_http_authorization;
+            auth_request_set $authDate $upstream_http_x_amz_date;
+            auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+            proxy_set_header Authorization $authHeader;
+            proxy_set_header X-Amz-Date $authDate;
+            proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+            add_header Content-Disposition "attachment";
+          '';
+        };
+
+        locations."/media/preview/" = {
+          proxyPass = cfg.s3Url;
+          extraConfig = ''
+            auth_request /media-auth;
+            auth_request_set $authHeader $upstream_http_authorization;
+            auth_request_set $authDate $upstream_http_x_amz_date;
+            auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+            proxy_set_header Authorization $authHeader;
+            proxy_set_header X-Amz-Date $authDate;
+            proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.soyouzpanda ];
+  };
+}

nixos/modules/services/web-apps/pihole-web.nix

@@ -89,6 +89,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    environment.etc."pihole/versions".text = "WEB_VERSION=${cfg.package.src.tag}";
+
     services.pihole-ftl.settings.webserver = {
       domain = cfg.hostName;
       port = cfg.ports;

nixos/modules/system/boot/systemd/initrd.nix

@@ -7,9 +7,29 @@
   ...
 }:
 
-with lib;
-
 let
+  inherit (lib)
+    filter
+    elem
+    filterAttrs
+    concatLists
+    mapAttrsToList
+    getBin
+    concatStringsSep
+    mkEnableOption
+    mkOption
+    types
+    literalExpression
+    mkIf
+    any
+    isBool
+    isString
+    optionalAttrs
+    mapAttrs'
+    nameValuePair
+    listToAttrs
+    ;
+
   inherit (utils) systemdUtils escapeSystemdPath;
   inherit (systemdUtils.unitOptions) unitOption;
   inherit (systemdUtils.lib)
@@ -27,6 +47,12 @@ let
 
   cfg = config.boot.initrd.systemd;
 
+  withKmod =
+    let
+      kconfig = config.system.build.kernel.config;
+    in
+    kconfig.isSet "MODULES" -> kconfig.isYes "MODULES";
+
   upstreamUnits = [
     "basic.target"
     "breakpoint-pre-udev.service"
@@ -505,7 +531,7 @@ in
         pkgs.coreutils
         cfg.package
       ]
-      ++ lib.optional (config.system.build.kernel.config.isYes "MODULES") cfg.package.kmod
+      ++ lib.optional withKmod cfg.package.kmod
       ++ lib.optionals cfg.shell.enable [
         # bashInteractive is easier to use and also required by debug-shell.service
         pkgs.bashInteractive
@@ -555,7 +581,7 @@ in
       // optionalAttrs (config.environment.etc ? "modprobe.d/nixos.conf") {
         "/etc/modprobe.d/nixos.conf".source = config.environment.etc."modprobe.d/nixos.conf".source;
       }
-      // optionalAttrs (with config.system.build.kernel.config; isSet "MODULES" -> isYes "MODULES") {
+      // optionalAttrs withKmod {
         "/lib".source = "${config.system.build.modulesClosure}/lib";
 
         "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;
@@ -640,7 +666,7 @@ in
           ) cfg.automounts
         );
 
-      services."modprobe@" = lib.mkIf (config.system.build.kernel.config.isYes "MODULES") {
+      services."modprobe@" = lib.mkIf withKmod {
         serviceConfig.ExecSearchPath = lib.makeBinPath [ cfg.package.kmod ];
       };
 

nixos/modules/virtualisation/nixos-containers.nix

@@ -524,6 +524,19 @@ let
     tmpfs = null;
   };
 
+  # Parses an IPv4 address with an optional prefix
+  ipv4FromString =
+    str:
+    let
+      segments = lib.splitString "/" str;
+      prefix = lib.elemAt segments 1;
+      hasPrefix = builtins.length segments == 2;
+    in
+    {
+      address = lib.head segments;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+    };
+
 in
 
 {
@@ -594,6 +607,14 @@ in
                                 boot.isNspawnContainer = true;
                                 networking.hostName = mkDefault name;
                                 networking.useDHCP = false;
+                                networking.interfaces = lib.mkIf config.privateNetwork {
+                                  eth0.ipv4.addresses = lib.optional (config.localAddress != null) (
+                                    ipv4FromString config.localAddress
+                                  );
+                                  eth0.ipv6.addresses = lib.optional (config.localAddress6 != null) (
+                                    lib.network.ipv6.fromString config.localAddress6
+                                  );
+                                };
                                 assertions = [
                                   {
                                     assertion =

nixos/release-combined.nix

@@ -202,7 +202,8 @@ rec {
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
         (onFullSupported "nixos.tests.shadow")
-        (onFullSupported "nixos.tests.simple")
+        (onFullSupported "nixos.tests.simple-container")
+        (onFullSupported "nixos.tests.simple-vm")
         (onFullSupported "nixos.tests.sway")
         (onFullSupported "nixos.tests.switchTest")
         (onFullSupported "nixos.tests.udisks2")

nixos/release-small.nix

@@ -67,7 +67,8 @@ rec {
         php
         predictable-interface-names
         proxy
-        simple
+        simple-container
+        simple-vm
         ;
       latestKernel = {
         inherit (nixos'.tests.latestKernel)
@@ -165,7 +166,8 @@ rec {
           "nixos.tests.predictable-interface-names.unpredictable"
           "nixos.tests.predictable-interface-names.unpredictableNetworkd"
           "nixos.tests.proxy"
-          "nixos.tests.simple"
+          "nixos.tests.simple-container"
+          "nixos.tests.simple-vm"
           "nixpkgs.jdk"
           "nixpkgs.tests.stdenv.tests-stdenv-gcc-stageCompare"
           "nixpkgs.opensshTest"

nixos/tests/all-tests.nix

@@ -245,6 +245,7 @@ in
   authelia = runTest ./authelia.nix;
   auto-cpufreq = runTest ./auto-cpufreq.nix;
   autobrr = runTest ./autobrr.nix;
+  autopush-rs = runTest ./autopush-rs.nix;
   autosuspend = runTest ./autosuspend.nix;
   avahi = runTest {
     imports = [ ./avahi.nix ];
@@ -386,6 +387,7 @@ in
   containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
   containers-ephemeral = runTest ./containers-ephemeral.nix;
   containers-extra_veth = runTest ./containers-extra_veth.nix;
+  containers-gateway = runTest ./containers-gateway.nix;
   containers-hosts = runTest ./containers-hosts.nix;
   containers-imperative = runTest ./containers-imperative.nix;
   containers-ip = runTest ./containers-ip.nix;
@@ -870,6 +872,7 @@ in
   languagetool = runTest ./languagetool.nix;
   lanraragi = runTest ./lanraragi.nix;
   lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
+  lasuite-drive = runTest ./web-apps/lasuite-drive.nix;
   lasuite-meet = runTest ./web-apps/lasuite-meet.nix;
   latestKernel.login = runTest {
     imports = [ ./login.nix ];
@@ -1508,7 +1511,8 @@ in
   shoko = import ./shoko.nix { inherit runTest; };
   signal-desktop = runTest ./signal-desktop.nix;
   silverbullet = runTest ./silverbullet.nix;
-  simple = runTest ./simple.nix;
+  simple-container = runTest ./simple-container.nix;
+  simple-vm = runTest ./simple-vm.nix;
   sing-box = runTest ./sing-box.nix;
   sks = runTest ./sks.nix;
   slimserver = runTest ./slimserver.nix;
@@ -1830,6 +1834,7 @@ in
   xterm = runTest ./xterm.nix;
   xxh = runTest ./xxh.nix;
   yarr = runTest ./yarr.nix;
+  yb = pkgs.callPackage ./yb.nix { inherit (pkgs.yb.passthru) ybPivHarnessTests testFixtures; };
   ydotool = import ./ydotool.nix {
     inherit (pkgs) lib;
     inherit runTest;

nixos/tests/autopush-rs.nix

@@ -0,0 +1,60 @@
+{ lib, ... }:
+{
+  _class = "nixosTest";
+  name = "autopush-rs";
+
+  nodes = {
+    machine =
+      { pkgs, config, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+
+        services.redis.servers.autopush-rs = {
+          enable = true;
+          port = 6000;
+        };
+        system.services.autopush-autoconnect = {
+          imports = [
+            pkgs.autopush-rs.services.autoconnect
+          ];
+          autoconnect.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8000;
+          };
+        };
+        system.services.autopush-autoendpoint = {
+          imports = [
+            pkgs.autopush-rs.services.autoendpoint
+          ];
+          autoendpoint.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8080;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          8080
+          8000
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("autopush-autoconnect.service")
+    machine.wait_for_unit("autopush-autoendpoint.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_for_open_port(8000)
+    machine.succeed("curl -s -f http://localhost:8080/health")
+    machine.succeed("curl -s -f http://localhost:8000/health")
+  '';
+
+  meta.maintainers = with lib.maintainers; [ zimward ];
+}

nixos/tests/containers-gateway.nix

@@ -0,0 +1,67 @@
+let
+  hostIp4 = "192.168.0.1";
+  containerIp4 = "192.168.0.100/24";
+  hostIp6 = "fc00::1";
+  containerIp6 = "fc00::2/7";
+in
+
+{ lib, ... }:
+{
+  name = "containers-gateway";
+  meta = {
+    maintainers = with lib.maintainers; [
+      rnhmjoj
+    ];
+  };
+
+  nodes.machine = {
+    networking.bridges = {
+      br0.interfaces = [ ];
+    };
+    networking.interfaces = {
+      br0.ipv4.addresses = [
+        {
+          address = hostIp4;
+          prefixLength = 24;
+        }
+      ];
+      br0.ipv6.addresses = [
+        {
+          address = hostIp6;
+          prefixLength = 7;
+        }
+      ];
+    };
+
+    containers.test = {
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = "br0";
+      localAddress = containerIp4;
+      localAddress6 = containerIp6;
+      config.networking = {
+        defaultGateway.address = hostIp4;
+        defaultGateway6.address = hostIp6;
+      };
+    };
+  };
+
+  testScript = ''
+    def container_succeed(command: str):
+        machine.succeed(f"nixos-container run test -- {command}")
+
+    machine.wait_for_unit("default.target")
+    assert "test" in machine.succeed("nixos-container list")
+
+    with subtest("Container has started"):
+        assert "up" in machine.succeed("nixos-container status test")
+
+    with subtest("Container can ping the host"):
+        container_succeed("ping -n -c 1 ${hostIp4}")
+        container_succeed("ping -n -c 1 ${hostIp6}")
+
+    with subtest("Container default gateways are set"):
+        container_succeed("ip -4 route show default | grep 'via ${hostIp4}'")
+        container_succeed("ip -6 route show default | grep 'via ${hostIp6}'")
+  '';
+}

nixos/tests/nixos-test-driver/skip-typecheck.nix

@@ -1,5 +1,5 @@
 /**
-  nixosTests.simple, but with skipTypeCheck.
+  nixosTests.simple-vm, but with skipTypeCheck.
   This catches regressions in the wiring, e.g.
   https://github.com/NixOS/nixpkgs/pull/511225
 */

nixos/tests/simple-container.nix

@@ -0,0 +1,11 @@
+{
+  name = "simple-container";
+
+  containers.machine = { };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}

nixos/tests/simple-vm.nix

@@ -1,5 +1,5 @@
 {
-  name = "simple";
+  name = "simple-vm";
 
   nodes.machine = { };
 

nixos/tests/terminal-emulators.nix

@@ -92,8 +92,6 @@ let
     terminology.cmd = "SHELL=$command terminology --no-wizard=true";
     terminology.colourTest = false; # broken by gloss effect
 
-    termite.pkg = p: p.termite;
-
     termonad.pkg = p: p.termonad;
 
     tilda.pkg = p: p.tilda;

nixos/tests/vector/default.nix

@@ -7,5 +7,4 @@
   dnstap = runTest ./dnstap.nix;
   journald-clickhouse = runTest ./journald-clickhouse.nix;
   nginx-clickhouse = runTest ./nginx-clickhouse.nix;
-  syslog-quickwit = runTest ./syslog-quickwit.nix;
 }

nixos/tests/vector/syslog-quickwit.nix

@@ -1,160 +0,0 @@
-{ lib, pkgs, ... }:
-
-# Based on https://quickwit.io/docs/log-management/send-logs/using-vector
-
-{
-  name = "vector-syslog-quickwit";
-  meta.maintainers = [ pkgs.lib.maintainers.happysalada ];
-
-  nodes = {
-    quickwit =
-      { config, pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.jq ];
-
-        networking.firewall.allowedTCPPorts = [ 7280 ];
-
-        services.quickwit = {
-          enable = true;
-          settings = {
-            listen_address = "::";
-          };
-        };
-      };
-
-    syslog =
-      { config, pkgs, ... }:
-      {
-        services.vector = {
-          enable = true;
-
-          settings = {
-            sources = {
-              generate_syslog = {
-                type = "demo_logs";
-                format = "syslog";
-                interval = 0.5;
-              };
-            };
-
-            transforms = {
-              remap_syslog = {
-                inputs = [ "generate_syslog" ];
-                type = "remap";
-                source = ''
-                  structured = parse_syslog!(.message)
-                  .timestamp_nanos = to_unix_timestamp!(structured.timestamp, unit: "nanoseconds")
-                  .body = structured
-                  .service_name = structured.appname
-                  .resource_attributes.source_type = .source_type
-                  .resource_attributes.host.hostname = structured.hostname
-                  .resource_attributes.service.name = structured.appname
-                  .attributes.syslog.procid = structured.procid
-                  .attributes.syslog.facility = structured.facility
-                  .attributes.syslog.version = structured.version
-                  .severity_text = if includes(["emerg", "err", "crit", "alert"], structured.severity) {
-                    "ERROR"
-                  } else if structured.severity == "warning" {
-                    "WARN"
-                  } else if structured.severity == "debug" {
-                    "DEBUG"
-                  } else if includes(["info", "notice"], structured.severity) {
-                    "INFO"
-                  } else {
-                   structured.severity
-                  }
-                  .scope_name = structured.msgid
-                  del(.message)
-                  del(.host)
-                  del(.timestamp)
-                  del(.service)
-                  del(.source_type)
-                '';
-              };
-            };
-
-            sinks = {
-              #emit_syslog = {
-              #  inputs = ["remap_syslog"];
-              #  type = "console";
-              #  encoding.codec = "json";
-              #};
-              quickwit_logs = {
-                type = "http";
-                method = "post";
-                inputs = [ "remap_syslog" ];
-                encoding.codec = "json";
-                framing.method = "newline_delimited";
-                uri = "http://quickwit:7280/api/v1/otel-logs-v0_7/ingest";
-              };
-            };
-          };
-        };
-      };
-  };
-
-  testScript =
-    let
-      aggregationQuery = pkgs.writeText "aggregation-query.json" ''
-        {
-          "query": "*",
-          "max_hits": 0,
-          "aggs": {
-            "count_per_minute": {
-              "histogram": {
-                  "field": "timestamp_nanos",
-                  "interval": 60000000
-              },
-              "aggs": {
-                "severity_text_count": {
-                  "terms": {
-                    "field": "severity_text"
-                  }
-                }
-              }
-            }
-          }
-        }
-      '';
-    in
-    ''
-      quickwit.wait_for_unit("quickwit")
-      quickwit.wait_for_open_port(7280)
-      quickwit.wait_for_open_port(7281)
-
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'transitioned to ready state'"
-      )
-
-      syslog.wait_for_unit("vector")
-      syslog.wait_until_succeeds(
-        "journalctl -o cat -u vector.service | grep 'Vector has started'"
-      )
-
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'publish-new-splits'"
-      )
-
-      # Wait for logs to be generated
-      # Test below aggregates by the minute
-      syslog.sleep(60 * 2)
-
-      quickwit.wait_until_succeeds(
-        "curl -sSf -XGET http://127.0.0.1:7280/api/v1/otel-logs-v0_7/search?query=severity_text:ERROR |"
-        + " jq '.num_hits' | grep -v '0'"
-      )
-
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'SearchRequest'"
-      )
-
-      quickwit.wait_until_succeeds(
-        "curl -sSf -XPOST -H 'Content-Type: application/json' http://127.0.0.1:7280/api/v1/otel-logs-v0_7/search --data @${aggregationQuery} |"
-        + " jq '.num_hits' | grep -v '0'"
-      )
-
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'count_per_minute'"
-      )
-    '';
-}

nixos/tests/web-apps/lasuite-drive.nix

@@ -0,0 +1,243 @@
+{ lib, ... }:
+let
+  domain = "drive.local";
+  oidcAddr = "127.0.0.1:8080";
+  s3Addr = "127.0.0.1:9000";
+
+  garageAccessKey = "GKaaaaaaaaaaaaaaaaaaaaaaaa";
+  garageSecretKey = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+in
+
+{
+  name = "lasuite-drive";
+  meta.maintainers = with lib.maintainers; [
+    soyouzpanda
+  ];
+
+  containers.machine =
+    { pkgs, ... }:
+    {
+      networking.hosts."127.0.0.1" = [ domain ];
+
+      environment.systemPackages = with pkgs; [
+        awscli2
+        jq
+      ];
+
+      services.lasuite-drive = {
+        enable = true;
+        enableNginx = true;
+        redis.createLocally = true;
+        postgresql.createLocally = true;
+
+        inherit domain;
+        s3Url = "http://${s3Addr}/lasuite-drive/";
+
+        settings = {
+          DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
+            8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
+          '';
+
+          OIDC_OP_JWKS_ENDPOINT = "http://${oidcAddr}/dex/keys";
+          OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcAddr}/dex/auth/mock";
+          OIDC_OP_TOKEN_ENDPOINT = "http://${oidcAddr}/dex/token";
+          OIDC_OP_USER_ENDPOINT = "http://${oidcAddr}/dex/userinfo";
+          OIDC_RP_CLIENT_ID = "lasuite-drive";
+          OIDC_RP_SIGN_ALGO = "RS256";
+          OIDC_RP_SCOPES = "openid email";
+          OIDC_RP_CLIENT_SECRET = "lasuitedriveclientsecret";
+
+          LOGIN_REDIRECT_URL = "http://${domain}";
+          LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
+          LOGOUT_REDIRECT_URL = "http://${domain}";
+
+          AWS_S3_ENDPOINT_URL = "http://${s3Addr}";
+          AWS_S3_ACCESS_KEY_ID = garageAccessKey;
+          AWS_S3_SECRET_ACCESS_KEY = garageSecretKey;
+          AWS_STORAGE_BUCKET_NAME = "lasuite-drive";
+          AWS_S3_REGION_NAME = "garage";
+          MEDIA_BASE_URL = "http://${domain}";
+
+          # Disable HTTPS feature in tests because we're running on a HTTP connection
+          DJANGO_SECURE_PROXY_SSL_HEADER = "";
+          DJANGO_SECURE_SSL_REDIRECT = false;
+          DJANGO_CSRF_COOKIE_SECURE = false;
+          DJANGO_SESSION_COOKIE_SECURE = false;
+          DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
+        };
+      };
+
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://${oidcAddr}/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
+          };
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
+            {
+              id = "lasuite-drive";
+              name = "Drive";
+              redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
+              secretFile = "/etc/dex/lasuite-drive";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
+            }
+          ];
+        };
+      };
+
+      services.garage = {
+        enable = true;
+        package = pkgs.garage_2;
+        settings = {
+          rpc_bind_addr = "127.0.0.1:3901";
+          rpc_public_addr = "127.0.0.1:3901";
+          rpc_secret = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+          replication_factor = 1;
+
+          s3_api = {
+            s3_region = "garage";
+            api_bind_addr = s3Addr;
+          };
+        };
+      };
+      environment.etc."dex/lasuite-drive" = {
+        mode = "0400";
+        user = "dex";
+        text = "lasuitedriveclientsecret";
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+  testScript = ''
+    import json
+
+    with subtest("Wait for units to start"):
+      machine.wait_for_unit("dex.service")
+      machine.wait_for_unit("garage.service")
+      machine.wait_for_unit("lasuite-drive.service")
+      machine.wait_for_unit("lasuite-drive-celery.service")
+      machine.wait_for_unit("lasuite-drive-beat.service")
+
+    with subtest("Create S3 bucket"):
+      machine.wait_for_open_port(3901)
+      garage_node_id = machine.succeed("garage status | tail -n1 | awk '{ print $1 }'")
+      machine.succeed(f"garage layout assign -c 100MB -z garage {garage_node_id}")
+      machine.succeed("garage layout apply --version 1")
+      machine.succeed("garage key import ${garageAccessKey} ${garageSecretKey} --yes")
+      machine.succeed("garage bucket create lasuite-drive")
+      machine.succeed("garage bucket allow --read --write --owner lasuite-drive --key ${garageAccessKey}")
+      machine.succeed("AWS_SECRET_ACCESS_KEY=${garageSecretKey} "
+        "AWS_ACCESS_KEY_ID=${garageAccessKey} "
+        "aws --endpoint http://${s3Addr} "
+        "s3api put-bucket-cors "
+        "--bucket lasuite-drive --cors-configuration "
+        """'{"CORSRules":[{"AllowedHeaders":["*"],"AllowedMethods":["PUT"],"AllowedOrigins":["http://${domain}"]}]}'""")
+
+    with subtest("Wait for web servers to start"):
+      machine.wait_until_succeeds("curl -fs "
+        "'http://${domain}/api/v1.0/authenticate/'",
+        timeout=120)
+      machine.wait_until_succeeds("curl -fs "
+        "'${oidcAddr}/dex/auth/mock?client_id=lasuite-drive&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'",
+        timeout=120)
+
+    with subtest("Login"):
+      state, nonce = machine.succeed("curl -fs -c cjar "
+        "'http://${domain}/api/v1.0/authenticate/' "
+        "-w '%{redirect_url}' "
+        "| sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
+
+      oidc_state = machine.succeed("curl -fs "
+        f"'${oidcAddr}/dex/auth/mock?client_id=lasuite-drive&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' "
+        "| sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+
+      code = machine.succeed("curl -fs "
+        f"'${oidcAddr}/dex/auth/mock/login?back=&state={oidc_state}' "
+        "-d 'login=admin&password=password' "
+        "-w '%{redirect_url}' "
+        "| sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
+
+      print(f"Got approval code {code}")
+
+      machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
+
+    with subtest("Upload a document"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+      upload = json.loads(
+        machine.succeed("curl -fs -c cjar -b cjar "
+          "'http://${domain}/api/v1.0/items/' "
+          "-X POST "
+          f"-H 'X-CSRFToken: {csrf_token}' "
+          "-H 'Content-Type: application/json' "
+          "-H 'Referer: http://${domain}/explorer/items/my-files' "
+          "--data-raw '{\"type\":\"file\",\"filename\":\"text.txt\"}'"
+        )
+      )
+
+      print(f"Created file with id {upload['id']}")
+
+      machine.succeed("curl -fs "
+        f"'{upload['policy']}' "
+        "-X PUT "
+        "-H 'Origin: http://${domain}' "
+        "-H 'X-amz-acl: private' "
+        "-H 'Content-Type: text/plain' "
+        "-H 'Content-Length: 8' "
+        "--data-raw 'sometext'")
+
+      print("Uploaded file")
+
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+      machine.succeed("curl -fs -c cjar -b cjar "
+        f"'http://${domain}/api/v1.0/items/{upload['id']}/upload-ended/' "
+        "-X POST "
+        f"-H 'X-CSRFToken: {csrf_token}' "
+        "-H 'Referer: http://${domain}/explorer/items/my-files'")
+
+    with subtest("Download a document"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+      items = json.loads(
+        machine.succeed("curl -fs -c cjar -b cjar "
+          f"'http://${domain}/api/v1.0/items/' "
+          "-X GET "
+          f"-H 'X-CSRFToken: {csrf_token}' "
+          "-H 'Referer: http://${domain}/explorer/items/my-files'"
+        )
+      )
+
+      assert items["count"] == 1
+
+      url = items["results"][0]["url_permalink"]
+
+      data = machine.succeed("curl -fs -c cjar -b cjar -L "
+        f"'{url}' "
+        "-X GET "
+        "-H 'Referer: http://${domain}/explorer/items/my-files'")
+
+      assert data == "sometext"
+  '';
+}

nixos/tests/web-apps/lasuite-meet.nix

@@ -8,11 +8,9 @@ in
   name = "lasuite-meet";
   meta.maintainers = with lib.maintainers; [ soyouzpanda ];
 
-  nodes.machine =
+  containers.machine =
     { pkgs, ... }:
     {
-      virtualisation.memorySize = 4 * 1024;
-
       networking.hosts."127.0.0.1" = [ domain ];
 
       environment.systemPackages = with pkgs; [ jq ];

nixos/tests/yb.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  pkgs,
+  ybPivHarnessTests,
+  testFixtures,
+}:
+
+pkgs.testers.nixosTest {
+  name = "yb-integration-tests";
+  meta.maintainers = with lib.maintainers; [ douzebis ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.pcscd = {
+        enable = true;
+        plugins = [
+          pkgs.ccid
+          pkgs.vsmartcard-vpcd
+        ];
+      };
+
+      environment.systemPackages = [
+        pkgs.yb
+        ybPivHarnessTests
+      ];
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("pcscd.socket")
+
+    # Tier-2: virtual smart card PIV tests (each test gets a fresh
+    # RAM-backed card via vsmartcard-vpcd). Serialised to avoid
+    # concurrent vpcd connections.
+    out = machine.succeed("RUST_TEST_THREADS=1 hardware_piv_tests 2>&1")
+    print(out)
+    if "test result: ok" not in out:
+      raise Exception("hardware_piv_tests failed:\n" + out)
+
+    # Tier-2: CLI subprocess tests against the Nix-built yb binary.
+    # YB_FIXTURE_DIR points to fixtures in the nix store (the build-sandbox
+    # path baked into CARGO_MANIFEST_DIR is gone at VM runtime).
+    out = machine.succeed(
+      "RUST_TEST_THREADS=1"
+      + " YB_BIN=${pkgs.yb}/bin/yb"
+      + " YB_FIXTURE_DIR=${testFixtures}"
+      + " yb_cli_tests 2>&1"
+    )
+    print(out)
+    if "test result: ok" not in out:
+      raise Exception("yb_cli_tests failed:\n" + out)
+  '';
+}

pkgs/README.md

@@ -327,7 +327,7 @@ A (typically large) program with a distinct user interface, primarily used inter
 
 - **If it’s a _terminal emulator_:**
 
-  - `applications/terminal-emulators` (e.g. `alacritty` or `rxvt` or `termite`)
+  - `applications/terminal-emulators` (e.g. `alacritty` or `rxvt`)
 
 - **If it’s a _file manager_:**
 

pkgs/applications/blockchains/groestlcoin/default.nix

@@ -90,9 +90,9 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_BENCH" false)
     (lib.cmakeBool "WITH_ZMQ" true)
-    (lib.cmakeBool "WITH_USDT" (stdenv.hostPlatform.isLinux))
-    (lib.cmakeBool "ENABLE_WALLET" (!withWallet))
-    (lib.cmakeBool "BUILD_GUI" (!withGui))
+    (lib.cmakeBool "WITH_USDT" stdenv.hostPlatform.isLinux)
+  ]
+  ++ lib.optionals (!withWallet) [
     (lib.cmakeBool "ENABLE_WALLET" false)
   ]
   ++ lib.optionals withGui [

pkgs/applications/editors/android-studio-for-platform/common.nix

@@ -25,6 +25,8 @@
   fontsConf,
   fontconfig,
   freetype,
+  libGL,
+  libsecret,
   libx11,
   libxext,
   libxi,
@@ -122,6 +124,9 @@ let
 
             # For Soong sync
             e2fsprogs
+
+            libsecret
+            libGL
           ]
         }"
     '';

pkgs/applications/editors/android-studio-for-platform/default.nix

@@ -16,15 +16,14 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2024.2.2.13";
-    # this seems to be a fuckup on google's side
-    versionPrefix = "Ladybug%20Feature%20Drop";
-    sha256Hash = "sha256-yMUTWOpYHa/Aizrgvs/mbofrDqrbL5bJYjuklIdyU/0=";
+    version = "2025.3.2.6";
+    versionPrefix = "Panda%202";
+    sha256Hash = "sha256-mAJPmDSoE9STOh45u0dIejL4TyR8CIqcGMhiixIFIWc=";
   };
   canaryVersion = {
-    version = "2024.3.1.9";
-    versionPrefix = "canary-meerkat";
-    sha256Hash = "sha256-j5KEwHbc+0eFi3GZlD5PMuM/RWw2MJ1PaXZrPMvhCik=";
+    version = "2026.1.2.1";
+    versionPrefix = "canary-Quail%202";
+    sha256Hash = "sha256-UYj+6CSmtxC11HVjPxc+m9r6b5RrXXFOzpDfSkx4mw4=";
   };
 in
 {

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -21,20 +21,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.1.tar.gz";
-      hash = "sha256-6S0+ASWF7du0tHyfLu/6ZmxymP79m3bwxOxQTFfsoJs=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.tar.gz";
+      hash = "sha256-Q3LOhpwpU6vrPWEzA+s2ZnbRxo+EeodBUHUYs3Xikrs=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-niaHFXxXPh1iH26aAmHES2F/xbfkPJ18erDXFZign+g=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-YM105ozP78oLDmwKL0t4Z4wGjCDh6xvhf/C1oCD6Qi8=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.1.dmg";
-      hash = "sha256-LWbFIC2xhh2Co2/BOTvScGWL9Qs77WAM4A+gxtuA4B4=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.dmg";
+      hash = "sha256-UEkYDJBjRvvUUB2UFsc37kdp/i+1ctqULSKs62/t9/I=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.1-aarch64.dmg";
-      hash = "sha256-8m6SbpkVdQ9QZykVlse9cK8KysXlPn/NA9WysLHh8jk=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.dmg";
+      hash = "sha256-scMwDF+mIfx/66cBrvdxp+gU3+qA2sUWqoGCEhPItjE=";
     };
   };
   # update-script-end: urls
@@ -48,8 +48,8 @@ in
   product = "CLion";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.135";
+  version = "2026.1.2";
+  buildNumber = "261.24374.148";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.1.tar.gz";
-      hash = "sha256-hXQIvnyjosH3uEUpi43NJYnk8cMXVVlKblpiGeVlekk=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2.tar.gz";
+      hash = "sha256-9NEHD9FXekwjRHTrPMeK4xU4sHnXPge+wRXyCFMmPBk=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-nsF/Oo0p+hXqSehIhrPc7i0zURDXgtf/rBpMFKgq+7c=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-M7XiLlIl7JFKbARb9Zli0c3cHUo2X0nPVrGhs3pK2bQ=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.1.dmg";
-      hash = "sha256-1pqtAR8r2ZwU/RhFMDsyFBhhRYvsPrT5F/n3kSP2viA=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2.dmg";
+      hash = "sha256-Wuuj6/K/5xoM9+d59IGzBo19iOJusbIMigoflPLQ+ts=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.1-aarch64.dmg";
-      hash = "sha256-orFAOXR9A/0S7lhwkD9bAXyp24HaDSlXe/rL4iT6+80=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2-aarch64.dmg";
+      hash = "sha256-ADWFPMC4ptj2mZk4RJgtIQjOT2xwOkL67UahoKte6mQ=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ mkJetBrainsProduct {
   productShort = "Gateway";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.152";
+  version = "2026.1.2";
+  buildNumber = "261.24374.120";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.1.tar.gz";
-      hash = "sha256-ASzqw8xuRaSAwzoiBsL+6PRyuSvBh43tnF4mEmkur9s=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2.tar.gz";
+      hash = "sha256-1FkDEaapyDbTPe4soOdyCHLkp/UT3rZ6siGyGyjmGJo=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-25PADBycdas3n6BWSGOJhuMaLcik5P5AfcEO6mY75js=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-E8WpA4s/ePEDAs47IPC0v10C1VKl9UYU7VNX/5igpm4=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.1.dmg";
-      hash = "sha256-kKr5/7z5gbL0YORDET0y7LgczWLEQ31lqsrHgkxrzQ8=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2.dmg";
+      hash = "sha256-iWYTMImwzMh9KSJgek8a84o/KlLWBaOj80vKlB8Ftes=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.1-aarch64.dmg";
-      hash = "sha256-zfdJrXBatvAl3wNMQ3LhF9oOxo1dEyo8wr4lCoFdm9I=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.dmg";
+      hash = "sha256-TFnEMq7u51UvtaOjnxS+abJhsR3aSnaQjNFfF8EQrcQ=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.143";
+  version = "2026.1.2";
+  buildNumber = "261.24374.154";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.1.tar.gz";
-      hash = "sha256-TOSiFAphV/JYrUg9tB/BAtAGjn6P0DpaYHO2W3FcCGQ=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2.tar.gz";
+      hash = "sha256-VbXsfKahp1X4AwAC10VghE+ZkxThovnYHHYyvkOTtFc=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-fWguwgUQstCytAMKam4scziEeyOxVEhIxS1O81HO/yI=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-f0Owuq0OjVwnp4Gj/diiPFn9F1Hf4gm/MwHzkabIH2w=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.1.dmg";
-      hash = "sha256-W28NwTNZe3Vj19J32nY8Jrn2rFVVd+0H2NWzDCTG8nw=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2.dmg";
+      hash = "sha256-XzYv58bR8ts6MTREUjqQinCzHvTdrLVEDH5vg1vQ3so=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.1-aarch64.dmg";
-      hash = "sha256-tm/UFH/5FX0HQ/FnjQ/Jwwaf/cpIYb4j0NvKlazBp08=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2-aarch64.dmg";
+      hash = "sha256-dJOqdY+D5FssDAvocMOXk9O22qk+QLxwDm2MHK2Wggg=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "PhpStorm";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.149";
+  version = "2026.1.2";
+  buildNumber = "261.24374.185";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -24,20 +24,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.0.1.tar.gz";
-      hash = "sha256-moIysTTsq7abpQfNh1Bc5Pk6VQgJIT6erbyHsUXf15Y=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.tar.gz";
+      hash = "sha256-OmysaGXGMxxAAa2qrHvX8yXIwJLU7tKG8/EBGhr55EA=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.0.1-aarch64.tar.gz";
-      hash = "sha256-0gEmWObwCio3aBqmUh2u5adWO3fFJV8uFwUTT31KsMI=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-xcwd4OgobMXFQ2W+SN6O5I3mud4kedVQ/0rZBWbXIGY=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.0.1.dmg";
-      hash = "sha256-s/lppcf2gfwmFYeHjWtk2NGPAjo/PAEnaGNWhDOkKOM=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.dmg";
+      hash = "sha256-uoOP+EYB11M99MlAFF7efZSKmCk0fwjCImFiasUQPUw=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.0.1-aarch64.dmg";
-      hash = "sha256-BHHrO4DLfw4cdbrJCH1uqX2qdm/ijyFnj32WQ8rpVhI=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.dmg";
+      hash = "sha256-Mo6gxWatX6wlL3s8Li19F58cnKZtOtFUfNyGPrC6CtA=";
     };
   };
   # update-script-end: urls
@@ -51,8 +51,8 @@ in
   product = "Rider";
 
   # update-script-start: version
-  version = "2026.1.0.1";
-  buildNumber = "261.22158.394";
+  version = "2026.1.2";
+  buildNumber = "261.24374.190";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.1.tar.gz";
-      hash = "sha256-tdT8LwsHGC5jUxGsRPVw1VfKfKZ05gZsGL6kpsxcPFA=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2.tar.gz";
+      hash = "sha256-6rvtK1TsZsuuVqfya9eh7fHk7LJyyxg4SYrU/yXnK1I=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-ns9oxsMXSPJS5KWSX0oKOyOyg8bguUnd8v1TRwV9EXw=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-EvKpY3zbUHT03GVIT/HJxVkOtJgsCG+jYNcKfiX0mTI=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.1.dmg";
-      hash = "sha256-Q/W6Pe3o6qwdHQm2z4bnenyEe7DrWwnov3M+JL8bS0o=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2.dmg";
+      hash = "sha256-KWbysSPVHM0BS09rntD78i8BuP3v26zha8GatFMZtg0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.1-aarch64.dmg";
-      hash = "sha256-UPnESouBCx59e2n8inTfe+zSCkQMF2XeoNw825LTKuU=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2-aarch64.dmg";
+      hash = "sha256-NEmps3wxao9cb2wgbmIndXPs78Tmona4wC9+8DBv7cI=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "RubyMine";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.142";
+  version = "2026.1.2";
+  buildNumber = "261.24374.145";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -18,20 +18,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.1.tar.gz";
-      hash = "sha256-UYljm43s/UOEvk0Peio2Crsdx0K5U5Seo57M34A1A1c=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.2.tar.gz";
+      hash = "sha256-INIz7nGar/oHh+CHfz4jm5t9/ARPcMfpnOl99Z3kg3I=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-FUDCF4pOtovjBKaNV0dEjc5PwsDLBXTTHnc3+oNDU7A=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-PmCDYM8nqySQm6cpUJQ9PyzSkKOR6V3LuXnYpE0i7fU=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.1.dmg";
-      hash = "sha256-DxrFdxSLiyH7/davL4QeAPxlKK3IA5JXzPetTYaMtck=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.2.dmg";
+      hash = "sha256-HI2qt6wTddANqdRuKQ4X7mXQyBA4dJYz9ewfI2iAYfw=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.1-aarch64.dmg";
-      hash = "sha256-K9Gwkudx+WV25fA1IRwfDlqcK8X0I/SzrL7S2iG7IfI=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.2-aarch64.dmg";
+      hash = "sha256-JMg/vs3aVeHmr6tiZZTggRGpH9O6lKlyeP8Ot4mm24w=";
     };
   };
   # update-script-end: urls
@@ -45,8 +45,8 @@ in
   product = "RustRover";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.140";
+  version = "2026.1.2";
+  buildNumber = "261.24374.182";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/webstorm.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.1.tar.gz";
-      hash = "sha256-r9XetjreFB6qU7VQbHsFLn7boKhZylfyGsfPNumFQZw=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.tar.gz";
+      hash = "sha256-xoMOLYSuWqWUh5RLI1Q4OnAgGM6tqRDWd1VoULX17yE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-Damq3svwCOrE+fTBBVY8vi/1vtFJFFqFsSWQhY9L/x4=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-Qe9yclQj971jK8V2SL5GAlNpgUfTwP/PS2ILv2LyhuE=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.1.dmg";
-      hash = "sha256-+s6MjE4zD4YZxnYRqsaXVthTWNnCn1HS3K7Ik+lb2cI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.dmg";
+      hash = "sha256-DmsOaBjKnhbipSrIfbTqNd9+qcd2i3zkKfVvLK1GXbI=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.1-aarch64.dmg";
-      hash = "sha256-/WwGXnvYZz8MzOOQgf4BGMRP7cLIv8FA1lK8NvIgtoo=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.dmg";
+      hash = "sha256-2YyCHi7yPXnq5KWkqC+Uodnc4xj+DkTsL1vUNqLNmPg=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "WebStorm";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.141";
+  version = "2026.1.2";
+  buildNumber = "261.24374.125";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/updater/jetbrains_nix_updater/fetcher.py

@@ -65,7 +65,7 @@ class VersionFetcher:
                 new_build_number = build["@number"]
             else:
                 new_build_number = build["@fullNumber"]
-            if "EAP" not in channel["@name"]:
+            if "EAP" not in channel["@id"]:
                 version_or_build_number = new_version
             else:
                 version_or_build_number = new_build_number
@@ -111,7 +111,7 @@ class VersionFetcher:
         root = xmltodict.parse(updates_response.text)
         products = root["products"]["product"]
         return {
-            channel["@name"]: channel
+            channel["@id"]: channel
             for product in products
             if "channel" in product
             for channel in one_or_more(product["channel"])

pkgs/applications/editors/jetbrains/updater/updateInfo.json

@@ -1,6 +1,6 @@
 {
   "clion": {
-    "channel": "CLion RELEASE",
+    "channel": "CL-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
@@ -9,7 +9,7 @@
     }
   },
   "datagrip": {
-    "channel": "DataGrip RELEASE",
+    "channel": "DB-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
@@ -18,7 +18,7 @@
     }
   },
   "dataspell": {
-    "channel": "DataSpell RELEASE",
+    "channel": "DS-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
@@ -27,7 +27,7 @@
     }
   },
   "gateway": {
-    "channel": "Gateway RELEASE",
+    "channel": "GW-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
@@ -36,7 +36,7 @@
     }
   },
   "goland": {
-    "channel": "GoLand RELEASE",
+    "channel": "GO-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
@@ -45,7 +45,7 @@
     }
   },
   "idea": {
-    "channel": "IntelliJ IDEA RELEASE",
+    "channel": "IU-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
@@ -54,11 +54,11 @@
     }
   },
   "idea-oss": {
-    "channel": "IntelliJ IDEA RELEASE",
+    "channel": "IU-RELEASE-licensing-RELEASE",
     "urls": {}
   },
   "mps": {
-    "channel": "MPS RELEASE",
+    "channel": "MPS-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
@@ -67,7 +67,7 @@
     }
   },
   "phpstorm": {
-    "channel": "PhpStorm RELEASE",
+    "channel": "PS-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
@@ -76,7 +76,7 @@
     }
   },
   "pycharm": {
-    "channel": "PyCharm RELEASE",
+    "channel": "PY-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/pycharm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.tar.gz",
@@ -85,11 +85,11 @@
     }
   },
   "pycharm-oss": {
-    "channel": "PyCharm RELEASE",
+    "channel": "PY-RELEASE-licensing-RELEASE",
     "urls": {}
   },
   "rider": {
-    "channel": "Rider RELEASE",
+    "channel": "RD-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
@@ -98,7 +98,7 @@
     }
   },
   "ruby-mine": {
-    "channel": "RubyMine RELEASE",
+    "channel": "RM-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
@@ -107,7 +107,7 @@
     }
   },
   "rust-rover": {
-    "channel": "RustRover RELEASE",
+    "channel": "RR-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
@@ -116,7 +116,7 @@
     }
   },
   "webstorm": {
-    "channel": "WebStorm RELEASE",
+    "channel": "WS-RELEASE-licensing-RELEASE",
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-i8czrgJ2OUaiJudU4F4rSKHUdY+gODWFPzXdmAin9wQ=";
+          hash = "sha256-wFerIcpbXDL0p7DGh19jXuOZyUvbwq2EzlmnLf1fv5M=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-GWtoc7f0X4fbRMsfzAiEi3ZOVxfbrLD+EGFnaHskyRg=";
+          hash = "sha256-ubMVyijSI5WWPSsq6wJCk9BABpli9Kgbgn5T+XP8aMA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-XYbWWYoDTr7hsEC9L3389/GRKRstYI575qNzmHUirz0=";
+          hash = "sha256-tEQTTcI7pFgJ6S4Lb2XTe5MXxHudyldzTsYpz5OWr5E=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rC+vgMjsGp27kGk+ZWEtBtxXI1oPEBnyZVUxrOj6lPg=";
+          hash = "sha256-WskmpZBwQt2mSQpvchI5Ca9ZOyN9srVPGHeMULIGRs8=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.146";
+      version = "2.1.148";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-uksu5DyarhCxPBk8U4oD9FwQ9/1lXyu6J/J82KdCzwM=";
+          hash = "sha256-Jma7CafP5MCMmPdfxJLaOtQJsinfZUPmPZs2DhkV4k8=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-OkPCfpuPzxM4j2LtnR4V6C1XphGbGEFOL7oc6y7E26g=";
+          hash = "sha256-rNtisGPnKAWVnKNc1enOSwMeU2IBS89GWgem6SEQ7/o=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-2FE0ajMBkInNg57yn+LxHHO5CqbRa92uvZLGp1uIKw0=";
+          hash = "sha256-0HGbwuy0SgPY4Ojp3+rhRxGz4TnVmE8PKjbzxMcAeIM=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-3GtSW0druCSS06nSStKtGsD9OQzMWD8T2nNgxhoXjc0=";
+          hash = "sha256-G3HphZX5yTr1sNwjEWA1ZEGR87/gwUmuxGmzHEn9NNg=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.40.0";
+      version = "2026.42.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "flake8";
-    version = "2026.4.0";
-    hash = "sha256-2o6a0wPYVFa+XWQoKBxKcWxlH8IPOzKxtXNt7qUi9mM=";
+    version = "2026.6.0";
+    hash = "sha256-n++DEjZsNY3YkvldyWuk3dCYgFbIxqMOun42lWEHGog=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/mupen64plus.nix

@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
   core = "mupen64plus-next";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mupen64plus-libretro-nx";
-    rev = "8cdfadf266a784cd1849f7fef8adae2912240b18";
-    hash = "sha256-37A9ScN8jRX1i2aocyNr3VAJsJ7xoMsmzVgPILpoqmQ=";
+    rev = "98c1b0d877542b01314b3b04272282ba223b65b3";
+    hash = "sha256-ardO7zuuG4rqm2d88IduMs3CVYNHiHyaxQ5ZDtbMVHU=";
   };
 
   # Fix for GCC 14

pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "1.0.3";
+  version = "1.1.0";
 in
 buildGoModule {
   pname = "helm-unittest";
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "helm-unittest";
     repo = "helm-unittest";
     tag = "v${version}";
-    hash = "sha256-wArRsC52ga485rpm8ns99NY/qUZ/FImK4C/L1q460HI=";
+    hash = "sha256-tSagZzAEaJRNZwflrqoyuIMWmt3oCsyHPHwctNTrtVM=";
   };
 
-  vendorHash = "sha256-dkAzmFvLbhbIYCKsk1+TfckdNkNh6OkpDabJDDSwXJM=";
+  vendorHash = "sha256-LZOvss6wiZZi5USuXfivqtt69dTKzEmm7lM2LUDACfY=";
 
   # NOTE: Remove the install and upgrade hooks.
   postPatch = ''

pkgs/applications/terminal-emulators/termite/add_errno_header.patch

@@ -1,24 +0,0 @@
-From 95c90f302c384f410dc92e64468ac7061b57fe2d Mon Sep 17 00:00:00 2001
-From: Michael Hoang <enzime@users.noreply.github.com>
-Date: Fri, 13 Jul 2018 19:03:09 +1000
-Subject: [PATCH] Add errno.h header which isn't always included automatically.
-
----
- termite.cc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/termite.cc b/termite.cc
-index 160fe82..13e2572 100644
---- a/termite.cc
-+++ b/termite.cc
-@@ -21,6 +21,7 @@
- #include <cstdlib>
- #include <cstring>
- #include <cmath>
-+#include <errno.h>
- #include <functional>
- #include <limits>
- #include <map>
--- 
-2.17.1
-

pkgs/applications/terminal-emulators/termite/default.nix

@@ -1,112 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  pkg-config,
-  vte,
-  gtk3,
-  ncurses,
-  pcre2,
-  wrapGAppsHook3,
-  nixosTests,
-}:
-
-let
-
-  # termite requires VTE with some internals exposed
-  # https://github.com/thestinger/vte-ng
-  #
-  # three of the patches have been locally modified to cleanly apply on 0.62
-  vte-ng = vte.overrideAttrs (attrs: {
-    patches = attrs.patches or [ ] ++ [
-      (fetchpatch {
-        name = "0001-expose-functions-for-pausing-unpausing-output.patch";
-        url = "https://github.com/thestinger/vte-ng/commit/342e26574f50dcd40bbeaad9e839c2a6144d0c1c.patch";
-        sha256 = "1b0k9ys545q85vfki417p21kis9f36yd0hyp12phayynss6fn715";
-      })
-      # Derived from https://github.com/thestinger/vte-ng/commit/5ae3acb69474fe5bc43767a4a3625e9ed23607a1.patch
-      ./vte-ng-modified-patches/vte-0002-expose-function-for-setting-cursor-position.patch
-      # Derived from https://github.com/thestinger/vte-ng/commit/742d57ecf15e24f6a5f2133a81b6c70acc8ff03c.patch
-      ./vte-ng-modified-patches/vte-0003-add-function-for-setting-the-text-selections.patch
-      (fetchpatch {
-        name = "0004-add-functions-to-get-set-block-selection-mode.patch";
-        url = "https://github.com/thestinger/vte-ng/commit/08748fd9cb82bd191e5c476b1682ca71f7732572.patch";
-        sha256 = "1cnhd8f7ywdgcyd6xmcd2nn39jjxzkxp4d0zsj2k7m5v74nhcs1g";
-      })
-      # Derived from "https://github.com/thestinger/vte-ng/commit/dd74ae7c06e8888af2fc090ac6f8920a9d8227fb.patch";
-      ./vte-ng-modified-patches/vte-0005-expose-function-for-getting-the-selected-text.patch
-    ];
-  });
-
-in
-stdenv.mkDerivation rec {
-  pname = "termite";
-  version = "15";
-
-  src = fetchFromGitHub {
-    owner = "thestinger";
-    repo = "termite";
-    rev = "v${version}";
-    sha256 = "0hp1x6lj098m3jgna274wv5dv60lnzg22297di68g4hw9djjyd2k";
-    fetchSubmodules = true;
-  };
-
-  # https://github.com/thestinger/termite/pull/516
-  patches = [
-    ./url_regexp_trailing.patch
-    ./add_errno_header.patch
-    # Fix off-by-one in select_text() on libvte >= 0.55.0
-    # Expected to be included in next release (16).
-    (fetchpatch {
-      url = "https://github.com/thestinger/termite/commit/7e9a93b421b9596f8980645a46ac2ad5468dac06.patch";
-      sha256 = "0vph2m5919f7w1xnc8i6z0j44clsm1chxkfg7l71nahxyfw5yh4j";
-    })
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin ./remove_ldflags_macos.patch;
-
-  makeFlags = [
-    "VERSION=v${version}"
-    "PREFIX="
-    "DESTDIR=$(out)"
-  ];
-
-  buildInputs = [
-    vte-ng
-    gtk3
-    ncurses
-    pcre2
-  ];
-
-  nativeBuildInputs = [
-    wrapGAppsHook3
-    pkg-config
-  ];
-
-  outputs = [
-    "out"
-    "terminfo"
-  ];
-
-  passthru = {
-    inherit vte-ng;
-    tests = nixosTests.terminal-emulators.termite;
-  };
-
-  postInstall = ''
-    mkdir -p $terminfo/share
-    mv $out/share/terminfo $terminfo/share/terminfo
-
-    mkdir -p $out/nix-support
-    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-  '';
-
-  meta = {
-    description = "Simple VTE-based terminal";
-    license = lib.licenses.lgpl2Plus;
-    homepage = "https://github.com/thestinger/termite/";
-    maintainers = with lib.maintainers; [ koral ];
-    platforms = lib.platforms.all;
-    mainProgram = "termite";
-  };
-}

pkgs/applications/terminal-emulators/termite/remove_ldflags_macos.patch

@@ -1,25 +0,0 @@
-From 1b5a6934635c55472eb7949bd87ab3f45fa1b2f3 Mon Sep 17 00:00:00 2001
-From: Michael Hoang <enzime@users.noreply.github.com>
-Date: Fri, 13 Jul 2018 19:01:51 +1000
-Subject: [PATCH] Remove --as-needed flag from ld to fix compilation on macOS.
-
----
- Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Makefile b/Makefile
-index b115f42..ab301ba 100644
---- a/Makefile
-+++ b/Makefile
-@@ -29,7 +29,7 @@ ifeq (${CXX}, clang++)
- 	CXXFLAGS += -Wimplicit-fallthrough
- endif
- 
--LDFLAGS := -s -Wl,--as-needed ${LDFLAGS}
-+LDFLAGS := -s -Wl ${LDFLAGS}
- LDLIBS := ${shell pkg-config --libs ${GTK} ${VTE}}
- 
- termite: termite.cc url_regex.hh util/clamp.hh util/maybe.hh util/memory.hh
--- 
-2.17.1
-

pkgs/applications/terminal-emulators/termite/url_regexp_trailing.patch

@@ -1,27 +0,0 @@
-Based on https://github.com/thestinger/termite/pull/516
-Modified to apply to v13
-
-From 65a454ffa8e681f3f14729cba7c42e1570a85e8a Mon Sep 17 00:00:00 2001
-From: Paul Baecher <pbaecher@gmail.com>
-Date: Thu, 7 Sep 2017 22:58:51 +0200
-Subject: [PATCH] Do not match punctuation at the end of URLs
-
-Punctuation at the end of URLs is most likely part of natural language
-or markup (for example in Markdown). Do not match it as part of the URL.
----
- url_regex.hh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/url_regex.hh b/url_regex.hh
-index 2ec6be8..3039b53 100644
---- a/url_regex.hh
-+++ b/url_regex.hh
-@@ -9,7 +9,7 @@
- #define PORT            "(?:\\:[[:digit:]]{1,5})?"
- #define SCHEME          "(?:[[:alpha:]][+-.[:alnum:]]*:)"
- #define USERPASS        USERCHARS_CLASS "+(?:\\:" PASSCHARS_CLASS "+)?"
--#define URLPATH         "(?:/[[:alnum:]\\Q-_.!~*'();/?:@&=+$,#%\\E]*)?"
-+#define URLPATH         "(?:/[[:alnum:]\\Q-_.!~*'();/?:@&=+$,#%\\E]*(?<![\\Q.,:;()!?\\E]))?"
- 
- const char * const url_regex = SCHEME "//(?:" USERPASS "\\@)?" HOST PORT URLPATH;
- 

pkgs/applications/terminal-emulators/termite/vte-ng-modified-patches/vte-0002-expose-function-for-setting-cursor-position.patch

@@ -1,61 +0,0 @@
-From 5ae3acb69474fe5bc43767a4a3625e9ed23607a1 Mon Sep 17 00:00:00 2001
-From: Jelle van der Waa <jelle@vdwaa.nl>
-Date: Sat, 13 Feb 2016 22:18:01 +0100
-Subject: [PATCH] expose function for setting cursor position
-
----
- src/vte/vteterminal.h |  5 +++++
- src/vtegtk.cc         | 24 ++++++++++++++++++++++++
- 2 files changed, 29 insertions(+)
-
-diff --git a/src/vte/vteterminal.h b/src/vte/vteterminal.h
-index a607e5da..9701320d 100644
---- a/src/vte/vteterminal.h
-+++ b/src/vte/vteterminal.h
-@@ -378,6 +378,11 @@ _VTE_PUBLIC
- void vte_terminal_get_cursor_position(VteTerminal *terminal,
- 				      glong *column,
-                                       glong *row) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
-+_VTE_PUBLIC
-+void vte_terminal_set_cursor_position(VteTerminal *terminal,
-+                                      glong column,
-+                                      glong row) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
-+
- 
- _VTE_PUBLIC
- char *vte_terminal_hyperlink_check_event(VteTerminal *terminal,
-diff --git a/src/vtegtk.cc b/src/vtegtk.cc
-index b11b780b..bdf36eac 100644
---- a/src/vtegtk.cc
-+++ b/src/vtegtk.cc
-@@ -2415,6 +2415,30 @@ vte_terminal_get_cursor_position(VteTerminal *terminal,
- 	}
- }
- 
-+/**
-+ * vte_terminal_set_cursor_position
-+ * @terminal: a #VteTerminal
-+ * @column: the new cursor column
-+ * @row: the new cursor row
-+ *
-+ * Set the location of the cursor.
-+ */
-+void
-+vte_terminal_set_cursor_position(VteTerminal *terminal,
-+		                 long column, long row) noexcept
-+{
-+	g_return_if_fail(VTE_IS_TERMINAL(terminal));
-+
-+        auto impl = IMPL(terminal);
-+	impl->invalidate_cursor_once(FALSE);
-+	impl->m_screen->cursor.col = column;
-+	impl->m_screen->cursor.row = row;
-+	impl->invalidate_cursor_once(FALSE);
-+	impl->check_cursor_blink();
-+	impl->queue_cursor_moved();
-+
-+}
-+
- /**
-  * vte_terminal_pty_new_sync:
-  * @terminal: a #VteTerminal

pkgs/applications/terminal-emulators/termite/vte-ng-modified-patches/vte-0003-add-function-for-setting-the-text-selections.patch

@@ -1,56 +0,0 @@
-From 742d57ecf15e24f6a5f2133a81b6c70acc8ff03c Mon Sep 17 00:00:00 2001
-From: Jelle van der Waa <jelle@vdwaa.nl>
-Date: Sat, 13 Feb 2016 22:25:19 +0100
-Subject: [PATCH] add function for setting the text selections
-
----
- src/vte/vteterminal.h |  4 ++++
- src/vtegtk.cc         | 20 ++++++++++++++++++++
- 2 files changed, 24 insertions(+)
-
-diff --git a/src/vte/vteterminal.h b/src/vte/vteterminal.h
-index 9701320d..a11b4cb7 100644
---- a/src/vte/vteterminal.h
-+++ b/src/vte/vteterminal.h
-@@ -196,6 +196,10 @@ _VTE_PUBLIC
- void vte_terminal_select_all(VteTerminal *terminal) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
- _VTE_PUBLIC
- void vte_terminal_unselect_all(VteTerminal *terminal) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
-+_VTE_PUBLIC
-+void vte_terminal_select_text(VteTerminal *terminal, long start_col, long start_row,
-+			      long end_col, long end_row) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
-+
- 
- /* By-word selection */
- _VTE_PUBLIC
-diff --git a/src/vtegtk.cc b/src/vtegtk.cc
-index bdf36eac..d9e9f2ed 100644
---- a/src/vtegtk.cc
-+++ b/src/vtegtk.cc
-@@ -2390,6 +2390,26 @@ vte_terminal_unselect_all(VteTerminal *terminal)
-         IMPL(terminal)->deselect_all();
- }
- 
-+/**
-+ * vte_terminal_select_text:
-+ * @terminal: a #VteTerminal
-+ * @start_col: the starting column for the selection
-+ * @start_row: the starting row for the selection
-+ * @end_col: the end column for the selection
-+ * @end_row: the end row for the selection
-+ *
-+ * Sets the current selection region.
-+ */
-+void
-+vte_terminal_select_text(VteTerminal *terminal,
-+		         long start_col, long start_row,
-+			 long end_col, long end_row) noexcept
-+{
-+	g_return_if_fail (VTE_IS_TERMINAL (terminal));
-+
-+        IMPL(terminal)->select_text(start_col, start_row, end_col, end_row);
-+}
-+
- /**
-  * vte_terminal_get_cursor_position:
-  * @terminal: a #VteTerminal

pkgs/applications/terminal-emulators/termite/vte-ng-modified-patches/vte-0005-expose-function-for-getting-the-selected-text.patch

@@ -1,29 +0,0 @@
---- a/src/vte/vteterminal.h
-+++ b/src/vte/vteterminal.h
-@@ -204,7 +204,9 @@
- _VTE_PUBLIC
- void vte_terminal_select_text(VteTerminal *terminal, long start_col, long start_row,
- 			      long end_col, long end_row) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
--
-+_VTE_PUBLIC
-+char *
-+vte_terminal_get_selection(VteTerminal *terminal) _VTE_CXX_NOEXCEPT _VTE_GNUC_NONNULL(1);
- 
- /* By-word selection */
- _VTE_PUBLIC
---- a/src/vtegtk.cc
-+++ b/src/vtegtk.cc
-@@ -2435,6 +2435,13 @@
-         IMPL(terminal)->select_text(start_col, start_row, end_col, end_row);
- }
- 
-+char *
-+vte_terminal_get_selection(VteTerminal *terminal) noexcept
-+{
-+	g_return_val_if_fail(VTE_IS_TERMINAL(terminal), NULL);
-+	return g_strdup (IMPL(terminal)->m_selection[vte::to_integral(vte::platform::ClipboardType::PRIMARY)]->str);
-+}
-+
- /**
-  * vte_terminal_get_cursor_position:
-  * @terminal: a #VteTerminal

pkgs/applications/terminal-emulators/termite/wrapper.nix

@@ -1,23 +0,0 @@
-{
-  makeWrapper,
-  symlinkJoin,
-  configFile ? null,
-  termite,
-}:
-
-if configFile == null then
-  termite
-else
-  symlinkJoin {
-    name = "termite-with-config-${termite.version}";
-
-    paths = [ termite ];
-    nativeBuildInputs = [ makeWrapper ];
-
-    postBuild = ''
-      wrapProgram $out/bin/termite \
-        --add-flags "--config ${configFile}"
-    '';
-
-    passthru.terminfo = termite.terminfo;
-  }

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix

@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hy3";
-  version = "0.54.2.1";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "outfoxxed";
     repo = "hy3";
     tag = "hl${finalAttrs.version}";
-    hash = "sha256-qKh+SPgmUNy5p22+hFPM7nNI3izjP6fG1fOX8YRa1f8=";
+    hash = "sha256-P3wwiIfqo89evW7xzI+wOI/qM1WPZBiiSmGNtBmYeVk=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix

@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hypr-darkwindow";
-  version = "0.54.3";
+  version = "0.55.2";
 
   src = fetchFromGitHub {
     owner = "micha4w";
     repo = "Hypr-DarkWindow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nbaNBxREqiqc6bwUkgfyuCah61O89atJyNTPYq4Xij8=";
+    hash = "sha256-8Ht9yhlwOtDWFvL6VYlryNxyRethFqc0iWtBetP0xws=";
   };
 
   installPhase = ''

pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh

@@ -90,6 +90,9 @@ pnpmConfigHook() {
         echo "2. Build the derivation and wait for it to fail with a hash mismatch"
         echo "3. Copy the 'got: sha256-' value back into the pnpmDeps.hash field"
         echo
+        echo "If you see ERR_PNPM_LOCKFILE_CONFIG_MISMATCH above this, try changing the pnpm version"
+        echo "Found 'pnpm' with version '$pnpmVersion'"
+        echo
 
         exit 1
     fi

pkgs/by-name/_4/_4th/package.nix

@@ -20,6 +20,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontConfigure = true;
 
+  preBuild = ''
+    cp sources/include${if stdenv.hostPlatform.is64bit then "64" else "32"}/* sources/
+    make -C sources clean
+  '';
+
   makeFlags = [
     "-C sources"
     "CC:=$(CC)"

pkgs/by-name/al/alacritty-theme/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alacritty-theme";
-  version = "0-unstable-2026-02-13";
+  version = "0-unstable-2026-05-01";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "dcd837532011fcfc6941d0dc84b3271888309ee8";
-    hash = "sha256-NkGM9rS1FQUDlFRXqGM9dlUMy7cwKxcSz+vFjQs+Tgg=";
+    rev = "2749b407b597790e6f08b218c2bc2acdf66210a0";
+    hash = "sha256-vcacyCQ8XqnDUQ/rx+FBdcKHDfvkxUszIJRZZsvauag=";
     sparseCheckout = [ "themes" ];
   };
 

pkgs/by-name/al/alive2/package.nix

@@ -34,6 +34,10 @@ clangStdenv.mkDerivation (finalAttrs: {
   ];
   strictDeps = true;
 
+  cmakeFlags = [
+    (lib.cmakeFeature "BUILD_TV" "1")
+  ];
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail '-Werror' "" \
@@ -55,6 +59,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin
     cp alive $out/bin/
     cp alive-jobserver $out/bin/
+    cp alive-tv $out/bin/
     rm -rf $out/bin/CMakeFiles $out/bin/*.o
     runHook postInstall
   '';

pkgs/by-name/al/allure/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-3dhrL0L24suVAEeMDQDKPs7A4c+a4V8X4AYQMAXj7lE=";
+    hash = "sha256-cpEtOo/fIH9RTvVbvu4gD2idIZ5PG7S7SaOmeQ7QTf4=";
   };
 
   dontConfigure = true;

pkgs/by-name/ap/apidog/package.nix

@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.28";
+  version = "2.8.30";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-P338wk3YrNaeMwhMyMCKZOY2mIi2A6V+RG4f9qSHBhg=";
+    hash = "sha256-h5h/zhUbnYYtYVyWySLZk3QISd4VWs5Gl/JdhgMJKh8=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/at/athens/package.nix

@@ -10,14 +10,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "athens";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = applyPatches {
     src = fetchFromGitHub {
       owner = "gomods";
       repo = "athens";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-4KCPYqLtqz46zr5+LB4CyG4ZQrjQaPgMEhCuGOWIJKg=";
+      hash = "sha256-hNk0hW7R7HdE4Wt1KuKSIUarRGKbtbFqQbfls1HXTqI=";
     };
     # Trim the patch version, not needed anyway.
     postPatch = ''

pkgs/by-name/at/atlauncher/package.nix

@@ -36,6 +36,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
   };
 
+  patches = [
+    # Launch4j does not publish the Linux workdir artifact selected on aarch64.
+    # Nixpkgs only needs the cross-platform jar, so remove the Windows exe task.
+    ./remove-launch4j.patch
+  ];
+
   nativeBuildInputs = [
     gradle
     makeWrapper
@@ -52,8 +58,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   gradleFlags = [
     "-Dorg.gradle.java.home=${jdk17_headless.home}"
-    "--exclude-task"
-    "createExe"
   ];
 
   installPhase =

pkgs/by-name/at/atlauncher/remove-launch4j.patch

@@ -0,0 +1,71 @@
+diff --git a/build.gradle b/build.gradle
+index 474c0c0..59fc2d2 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -24,7 +24,6 @@ plugins {
+     id 'org.cadixdev.licenser' version '0.6.1'
+     id 'com.adarshr.test-logger' version '4.0.0'
+     id 'edu.sc.seis.macAppBundle' version '2.3.0'
+-    id 'edu.sc.seis.launch4j' version '3.0.6'
+     id 'de.undercouch.download' version '5.6.0'
+     id 'com.github.johnrengelman.shadow' version '8.1.1'
+     id 'com.github.ben-manes.versions' version '0.52.0'
+@@ -282,34 +281,15 @@ def currentYear() {
+     return df.format(new Date())
+ }
+ 
+-launch4j {
+-    outfile = "ATLauncher-${project.version}.exe"
+-    jreMinVersion = "${project.targetCompatibility.toString()}"
+-    mainClassName = 'com.atlauncher.App'
+-    icon = "${projectDir}/src/main/resources/assets/image/icon.ico"
+-    version = "${project.version}"
+-    textVersion = "${project.version}"
+-    copyright = "2013-${currentYear()} ${project.name}"
+-    companyName = "${project.name}"
+-    bundledJrePath = "jre/;%JAVA_HOME%;%PATH%"
+-    jvmOptions = [
+-        "-Djna.nosys=true",
+-        "-Djava.net.preferIPv4Stack=true",
+-        "-Dawt.useSystemAAFontSettings=on",
+-        "-Dswing.aatext=true"
+-    ]
+-}
+ 
+ artifacts {
+     archives shadowJar
+-    archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+ }
+ 
+ task copyArtifacts(type: Copy) {
+     dependsOn build
+     from shadowJar
+-    from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+     into "${projectDir}/dist"
+ }
+@@ -368,14 +348,6 @@ clean.doFirst {
+     delete "${projectDir}/dist"
+ }
+ 
+-project.afterEvaluate {
+-    tasks.check {
+-        dependsOn -= tasks.find {
+-            it.name.equals("checkLicenses")
+-        }
+-    }
+-}
+-
+ def shouldIgnoreUpdate = { String version -> return ['ALPHA', 'BETA', 'RC', '-M'].any { it -> version.toUpperCase(Locale.ENGLISH).contains(it) } }
+ tasks.named("dependencyUpdates").configure {
+     rejectVersionIf {
+@@ -385,8 +357,6 @@ tasks.named("dependencyUpdates").configure {
+ 
+ build.finalizedBy copyArtifacts
+ shadowJar.dependsOn jar
+-build.dependsOn createExe, createMacApp
+ startScripts.dependsOn shadowJar
+-createExe.dependsOn shadowJar
+ createAppZip.dependsOn downloadNewerUniversalJavaApplicationStub
+ createDmg.dependsOn downloadNewerUniversalJavaApplicationStub

pkgs/by-name/at/atril/package.nix

@@ -33,14 +33,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atril";
-  version = "1.28.4";
+  version = "1.28.5";
 
   src = fetchFromGitHub {
     owner = "mate-desktop";
     repo = "atril";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-0BrD897SRf26A4Z1wdizfwoVEEQ7c7EEhAV4vmkBc8E=";
+    hash = "sha256-iG+FFvxxL2/6HqGchoaIDqx8Gfo1wxqM4GW66ScZlao=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/autopush-rs/package.nix

@@ -0,0 +1,136 @@
+{
+  lib,
+  pkgs,
+  nixosTests,
+  fetchFromGitHub,
+  rustPlatform,
+  stdenv,
+  pkg-config,
+  cmake,
+  openssl,
+  libffi,
+  grpc,
+  nix-update-script,
+  python3Packages,
+}:
+let
+  #script to generate the fernet key
+  fernetKey =
+    {
+      src,
+      version,
+    }:
+    python3Packages.buildPythonApplication {
+      pname = "fernet_key";
+      inherit version src;
+
+      __structuredAttrs = true;
+
+      format = "other";
+
+      # this would run the upstream docker makefile
+      dontBuild = true;
+
+      dependencies = [ python3Packages.cryptography ];
+
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!/usr/bin/env python3" |  \
+        cat - $src/scripts/fernet_key.py > $out/bin/fernet_key
+        chmod +x $out/bin/fernet_key
+      '';
+
+      postFixup = ''
+        wrapPythonPrograms
+      '';
+    };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "autopush";
+  version = "1.81.3";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    "fernet"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "mozilla-services";
+    repo = "autopush-rs";
+    tag = finalAttrs.version;
+    hash = "sha256-DP02mcEMoQoJqi5rw5eSuep0i7zeJ0LLYsakikt9hho=";
+  };
+
+  cargoHash = "sha256-LqmuUtFF30TO6iw7LPFB7yJGrzrhh7R0OKCWMhe/OjU=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    cmake
+  ];
+
+  buildInputs = [
+    openssl
+    libffi
+    grpc
+  ];
+
+  # by default only google bigtable is supported as a db
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "postgres"
+    "redis"
+    "reliable_report"
+  ];
+
+  env = {
+    #needed for bingen to find libc
+    BINDGEN_EXTRA_CLANG_ARGS = "-I${stdenv.cc.libc.dev}/include";
+    CMAKE_POLICY_VERSION_MINIMUM = "3.5";
+  };
+
+  #check build fails
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $fernet/bin
+    ln -s ${fernetKey { inherit (finalAttrs) src version; }}/bin/fernet_key $fernet/bin/fernet_key
+  '';
+
+  passthru = {
+    tests = nixosTests.autopush-rs;
+    services.autoconnect = {
+      imports = [
+        (lib.modules.importApply ./service-autoconnect.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+    services.autoendpoint = {
+      imports = [
+        (lib.modules.importApply ./service-autoendpoint.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Mozilla Push server and Push Endpoint";
+    homepage = "https://mozilla-services.github.io/autopush-rs/index.html";
+    changelog = "https://github.com/mozilla-services/autopush-rs/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = [
+      lib.maintainers.zimward
+    ];
+    # install the fernet_key script in devshells as users will only use it once most likely
+    outputsToInstall = [
+      "out"
+      "fernet"
+    ];
+  };
+})

pkgs/by-name/au/autopush-rs/service-autoconnect.nix

@@ -0,0 +1,96 @@
+#v Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  options,
+  config,
+  ...
+}:
+let
+  cfg = config.autoconnect;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoconnect.settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = tomlFmt.type;
+        options = {
+          db_dsn = lib.mkOption {
+            description = "Endpoint of the database server.";
+            type = lib.types.str;
+            default = "";
+            example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+          };
+        };
+      };
+      default = { };
+      description = "";
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoconnect.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoconnect"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}

pkgs/by-name/au/autopush-rs/service-autoendpoint.nix

@@ -0,0 +1,98 @@
+# Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  config,
+  options,
+  ...
+}:
+let
+  cfg = config.autoendpoint;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoendpoint = {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = tomlFmt.type;
+          options = {
+            db_dsn = lib.mkOption {
+              description = "Endpoint of the database server.";
+              type = lib.types.str;
+              default = "";
+              example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+            };
+          };
+        };
+        default = { };
+        description = "";
+      };
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoendpoint.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoendpoint"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}

pkgs/by-name/az/azure-cli/extensions-generated.json

@@ -22,9 +22,9 @@
   },
   "acrtransfer": {
     "pname": "acrtransfer",
-    "version": "1.1.1b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-1.1.1b1-py3-none-any.whl",
-    "hash": "sha256-9rbBiFCxK0cInu5puF5y2kAYcQ7xFa/X3/va5n5i/J0=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-2.0.0-py3-none-any.whl",
+    "hash": "sha256-nG+BxgBHoi4hCF/j4wLbpOlI2MIKB8JjdJoz2LRD+iE=",
     "description": "Microsoft Azure Command-Line Tools Acrtransfer Extension"
   },
   "ad": {
@@ -50,9 +50,9 @@
   },
   "aks-preview": {
     "pname": "aks-preview",
-    "version": "20.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-arH7mhRieuEn5s2G8dpZsqk/RKyuslEphOi62FviS7U=",
+    "version": "20.0.0b8",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b8-py2.py3-none-any.whl",
+    "hash": "sha256-ugLew461nhWWg73OZJW7g/xblclV5IfNHKm1it6j+Dc=",
     "description": "Provides a preview for upcoming AKS features"
   },
   "alb": {
@@ -153,11 +153,18 @@
     "hash": "sha256-sdk0uNtQX6yBiEboywNE8FAreY1pBiimah0PdmCDRYg=",
     "description": "Microsoft Azure Command-Line Tools AutomationClient Extension"
   },
+  "azure-changesafety": {
+    "pname": "azure-changesafety",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_changesafety-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ZR2Bm9U9C4rXrCfPVGRu65MBFjZ4iUtXS44l+ClJXsY=",
+    "description": "Microsoft Azure Command-Line Tools ChangeSafety Extension"
+  },
   "azure-firewall": {
     "pname": "azure-firewall",
-    "version": "2.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.1.1-py2.py3-none-any.whl",
-    "hash": "sha256-gjt7/Ba38xrpdRyc4oybPbqmhOqZ8Ik/dNP8XRzm4Wc=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.0-py2.py3-none-any.whl",
+    "hash": "sha256-f1ZxkLZVI4+kzUmwOnY8hMaR/nuxqnLM92xlLQG3rIw=",
     "description": "Manage Azure Firewall resources"
   },
   "azurelargeinstance": {
@@ -202,6 +209,13 @@
     "hash": "sha256-w+HDLtCIAIhlFTpR4iUMEKPC2vInPWWmMTX0VT9q1lg=",
     "description": "Microsoft Azure Command-Line Tools Carbon Extension"
   },
+  "cdn": {
+    "pname": "cdn",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cdn-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-YybIrCjZnZQ0IFgOZbm4JfMnXNC/Sah8YaZuss1M5B4=",
+    "description": "Microsoft Azure Command-Line Tools CDN and AFD Extension"
+  },
   "change-analysis": {
     "pname": "change-analysis",
     "version": "0.1.0",
@@ -309,9 +323,9 @@
   },
   "databricks": {
     "pname": "databricks",
-    "version": "1.3.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.1-py3-none-any.whl",
-    "hash": "sha256-D6+Sbp49vxPP/IENPPn6TSL3qhwgBZyWBB3KjSgjdCc=",
+    "version": "1.3.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.2-py3-none-any.whl",
+    "hash": "sha256-iGI+Fk/kVT2/4CspDu/r2UlDrXimUWWx9IAknnNjqhg=",
     "description": "Microsoft Azure Command-Line Tools DatabricksClient Extension"
   },
   "datadog": {
@@ -337,9 +351,9 @@
   },
   "dataprotection": {
     "pname": "dataprotection",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.9.0-py3-none-any.whl",
-    "hash": "sha256-YGJlWG4VPvcyKJ2qOnkgt1JYXqPF9LTrnvdTkIZcF30=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.10.0-py3-none-any.whl",
+    "hash": "sha256-cssrKqmWbQv3qlr8A3GUNklnIGOQ9V2x3e+YWpXeCvQ=",
     "description": "Microsoft Azure Command-Line Tools DataProtectionClient Extension"
   },
   "datashare": {
@@ -482,6 +496,13 @@
     "hash": "sha256-x1mbd/Y28BcYqEf+T1rZcOHT8wrq9VnWnCfw9rBnl80=",
     "description": "Microsoft Azure Command-Line Tools ExpressRouteCrossConnection Extension"
   },
+  "fileshares": {
+    "pname": "fileshares",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fileshares-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-IrJwPQaMuX9VItIEkJzK3cmANHzU50fIaWn2s32nDVk=",
+    "description": "Commands for managing Azure file shares, snapshots, and private endpoint connections"
+  },
   "firmwareanalysis": {
     "pname": "firmwareanalysis",
     "version": "2.0.1",
@@ -491,9 +512,9 @@
   },
   "fleet": {
     "pname": "fleet",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.9.0-py3-none-any.whl",
-    "hash": "sha256-5CsWYP0r2UfUTekKDsqWBNonDOPaR5TrhxZDF7hAtXI=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.10.0-py3-none-any.whl",
+    "hash": "sha256-hgAwdLExAvKR0G9Ey81rTSa2QLxeoMnUZ7KRaCYhfM8=",
     "description": "Microsoft Azure Command-Line Tools Fleet Extension"
   },
   "fluid-relay": {
@@ -512,9 +533,9 @@
   },
   "front-door": {
     "pname": "front-door",
-    "version": "2.1.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.1.0-py3-none-any.whl",
-    "hash": "sha256-7aa9A+tq+qXzMuabG9McHkXpU3TRZVjQWDbmuHTTsFk=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.2.0-py3-none-any.whl",
+    "hash": "sha256-5vj/OzbfMmv/SI8qS659o+QiMfPofoBCJR/mQV3XZNE=",
     "description": "Manage networking Front Doors"
   },
   "fzf": {
@@ -573,6 +594,13 @@
     "hash": "sha256-VTL1/L/UfORNWvyY0hvSJrvoz5zHabLPFX/sEdQaLhI=",
     "description": "Microsoft Azure Command-Line Tools HealthcareApisManagementClient Extension"
   },
+  "horizondb": {
+    "pname": "horizondb",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-bvjD6FSGjkuMjnc1XYnglbzd2cLMDuwRiPW9+7n6efA=",
+    "description": "Microsoft Azure Command-Line Tools HorizonDB Extension"
+  },
   "hpc-cache": {
     "pname": "hpc-cache",
     "version": "0.1.6",
@@ -680,9 +708,9 @@
   },
   "maintenance": {
     "pname": "maintenance",
-    "version": "1.7.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-1.7.0b2-py3-none-any.whl",
-    "hash": "sha256-ebiJ8U5FyRLG9VHBGB75AqkjPVars8kGxWnjUCMiiCI=",
+    "version": "2.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-2.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ax3HeCaCq9p5fokc9W3y2XtVHsRYNTZQRkNfXqwpPGk=",
     "description": "Microsoft Azure Command-Line Tools MaintenanceManagementClient Extension"
   },
   "managedccfs": {
@@ -694,10 +722,10 @@
   },
   "managednetworkfabric": {
     "pname": "managednetworkfabric",
-    "version": "9.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-9.1.1-py3-none-any.whl",
-    "hash": "sha256-bLPE5Spy4Lhtv6ZEWx2E2nLRqkrZ/LfJVmDQWjqEZi0=",
-    "description": "Support for managednetworkfabric commands based on 2025-07-15 API version"
+    "version": "10.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-10.0.0b1-py3-none-any.whl",
+    "hash": "sha256-7veSgSJp7isa+JwAiep+3dMTJFLohIAHNcF9UVIFaNc=",
+    "description": "Support for managednetworkfabric commands based on 2026-01-15-preview API version"
   },
   "managementpartner": {
     "pname": "managementpartner",
@@ -757,9 +785,9 @@
   },
   "monitor-pipeline-group": {
     "pname": "monitor-pipeline-group",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-skfHQJ7vGnKZtaDmAGmjPLtuxNfyHE44pxi1Usl9X9s=",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0-py3-none-any.whl",
+    "hash": "sha256-oVPbg8B2TMiHSNKMakl45zkfJenXX5el0tEjirIi9/k=",
     "description": "Microsoft Azure Command-Line Tools MonitorPipelineGroup Extension"
   },
   "multicloud-connector": {
@@ -853,6 +881,13 @@
     "hash": "sha256-/k47qFwfZZZqBZKR5G6+t8lW8o2isVtUGwSSdltiOZI=",
     "description": "Microsoft Azure Command-Line Tools PeeringManagementClient Extension"
   },
+  "planetarycomputer": {
+    "pname": "planetarycomputer",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/planetarycomputer-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-FPvUcZx5yHHB2du7F6ulDjoNsNCek2HtuVMJd6g0mBE=",
+    "description": "Microsoft Azure Command-Line Tools Planetary Computer Extension"
+  },
   "portal": {
     "pname": "portal",
     "version": "1.0.0b2",
@@ -890,9 +925,9 @@
   },
   "quantum": {
     "pname": "quantum",
-    "version": "1.0.0b12",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b12-py3-none-any.whl",
-    "hash": "sha256-9tjBvpu1F2/2JYKUD2IbxUckYofUH0rEnimkpRXF2wY=",
+    "version": "1.0.0b13",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b13-py3-none-any.whl",
+    "hash": "sha256-zNyvYvtJY2AgASUoMvN/cCXWIOJ1d3JEQ7G/tuyV/o4=",
     "description": "Microsoft Azure Command-Line Tools Quantum Extension"
   },
   "qumulo": {
@@ -909,6 +944,13 @@
     "hash": "sha256-i0w0dd8MNUTbzCjkh161sWPXK0Cv9CUKr9rZQYDD+ZU=",
     "description": "Microsoft Azure Command-Line Tools AzureQuotaExtensionAPI Extension"
   },
+  "relationship": {
+    "pname": "relationship",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/relationship-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-pEXG6+Gf/JlzjeQGw0VadoArnX+2yjhYVMxg78Qg06g=",
+    "description": "Microsoft Azure Command-Line Tools Relationship Extension"
+  },
   "reservation": {
     "pname": "reservation",
     "version": "0.3.1",
@@ -965,11 +1007,18 @@
     "hash": "sha256-VRFUS040KwOkpCY2F8YD2HRCrVF5zp2MDR/RCRX5O3o=",
     "description": "Microsoft Azure Command-Line Tools Sentinel Extension"
   },
+  "servicegroup": {
+    "pname": "servicegroup",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/servicegroup-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-6vOfQdjX+/4Sba1qswxVcDBy+xLCgNOEG01wLL10GvQ=",
+    "description": "Microsoft Azure Command-Line Tools ServiceGroup Extension"
+  },
   "sftp": {
     "pname": "sftp",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-3ugWIeKK9U8vKgFMbQfMKXxbgW+zO9IB6lPYJFHZm/E=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b3-py3-none-any.whl",
+    "hash": "sha256-hCpM/ZAJjn4hLElyLzwZzthR4OF36tPDevC2UlR0q0U=",
     "description": "Secure access to Azure Storage blob data via SFTP with SSH certificates"
   },
   "site": {
@@ -995,9 +1044,9 @@
   },
   "stack-hci-vm": {
     "pname": "stack-hci-vm",
-    "version": "1.13.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.13.0-py3-none-any.whl",
-    "hash": "sha256-/GKJy7+iT33evnZ4UpNXB9GNBWtiLIOJXhk5VZowIos=",
+    "version": "1.14.5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.14.5-py3-none-any.whl",
+    "hash": "sha256-JE2Qq5OPy+AnTn4GxFeDhiyuCnUV3v1ciu7AqP2TwR4=",
     "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
   },
   "standbypool": {
@@ -1051,9 +1100,9 @@
   },
   "stream-analytics": {
     "pname": "stream-analytics",
-    "version": "1.0.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.2-py3-none-any.whl",
-    "hash": "sha256-HAkhteF4LaAO3YnOrWHvHJ+9K6Kd4ns9GCcnDXDJtLg=",
+    "version": "1.0.3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.3-py3-none-any.whl",
+    "hash": "sha256-FFRNCsg9Put3GcARODA6HpwGXbWfD1kb7qDvc+/TAkg=",
     "description": "Microsoft Azure Command-Line Tools StreamAnalyticsManagementClient Extension"
   },
   "subscription": {

pkgs/by-name/az/azure-cli/package.nix

@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.85.0";
+  version = "2.86.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     tag = "azure-cli-${version}";
-    hash = "sha256-fNch6QiiHffyHOHw30dlRoe5UFvGVIZkneULjNihGdU=";
+    hash = "sha256-3C39e9C3m9M0faGUgOEWo66fFGDytfGohgUYX55VN8g=";
   };
 
   # put packages that needs to be overridden in the py package scope

pkgs/by-name/ba/ballerburg/package.nix

@@ -34,6 +34,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ SDL ];
 
+  # CMake's default framework search order on Darwin finds Kernel.framework
+  # headers while detecting SDL 1.2, which makes standard includes like
+  # <string.h> resolve to the wrong SDK header and breaks the build.
+  # Keep this package on the old Nixpkgs search order without restoring it
+  # globally: https://github.com/NixOS/nixpkgs/pull/455592
+  # CMake docs: https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_FRAMEWORK.html
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_FIND_FRAMEWORK=LAST"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "Ballerburg";

pkgs/by-name/ba/bark-server/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bark-server";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "Finb";
     repo = "bark-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ANOGAzm+25WUoRMGE5b70uKE4EhlGkuC4QWvpa2K7Uo=";
+    hash = "sha256-s02nLAlKO5SGX0Nx5z/5fZBf6R0kkY4IofbGW8ica50=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-yStMk1U6FmF2Ldqnm5HKsu6Pn3xjm5pGLMWAGyYxb2c=";
+  vendorHash = "sha256-+WyTKyWVzJAgCQ6bXbOjrJUZkw5XVrvAdgALL2eXU64=";
 
   ldflags = [
     "-s"

pkgs/by-name/be/better-commits/package.nix

@@ -8,13 +8,13 @@
 
 buildNpmPackage rec {
   pname = "better-commits";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "Everduin94";
     repo = "better-commits";
     tag = "v${version}";
-    hash = "sha256-d2e+vA8qPr5H70X6caeW+s4yjI1zGByvmZd50j2nAQI=";
+    hash = "sha256-4ixxgpqyjU1juU200Dc0YTSC+bvVYHpqzylCR3Yy+Yk=";
   };
 
   npmDepsHash = "sha256-18fkqQ3Y0fflSGXDPaMpHW7nC0ARMoCStxBzkEXiujs=";

pkgs/by-name/bi/bind/package.nix

@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.22";
+  version = "9.20.23";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-y6kv9jG5SWVfR1/ktUKQ9oYP0AcNOZ8iefZDfA04PsY=";
+    hash = "sha256-XUR1rtP55QDvVUsrFNlyvbg9M94hSps76SkY6kaQg3E=";
   };
 
   outputs = [

pkgs/by-name/bi/bite/package.nix

@@ -21,16 +21,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bite";
-  version = "0.3";
+  version = "0.43";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "WINSDK";
     repo = "bite";
-    rev = "V${finalAttrs.version}";
-    hash = "sha256-gio4J+V8achSuR2vQa2dnvOR/u4Zbb5z0UE0xP0gGCU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-akwkTV1bZJ3GcEtObyF+qN5IkBRoXdztUSOghjQy7A0=";
   };
 
-  cargoHash = "sha256-ESGX1hnDnU2taKQXre4AQRzQxTC7W+0cEIoQPPC9Lfs=";
+  cargoHash = "sha256-OlxUHYTbljWGWdiceBmW3J0oB4w0/5izgNnwCafV6xY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -90,7 +92,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Disassembler focused on comprehensive rust support";
     homepage = "https://github.com/WINSDK/bite";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ vinnymeller ];
+    maintainers = with lib.maintainers; [
+      vinnymeller
+      kybe236
+    ];
     mainProgram = "bite";
   };
 })

pkgs/by-name/bo/borgbackup/package.nix

@@ -70,11 +70,15 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     acl
   ];
 
-  dependencies = with python.pkgs; [
-    msgpack
-    packaging
-    (if stdenv.hostPlatform.isLinux then pyfuse3 else llfuse)
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      msgpack
+      packaging
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      pyfuse3
+    ];
 
   makeWrapperArgs = [
     ''--prefix PATH ':' "${openssh}/bin"''

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.90.122";
+  version = "1.90.124";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-RjmldIesTEVkIlLM9+nHGb4sPjLGKhJTOtLLBsJLYN8=";
+      hash = "sha256-+ZJxwwL5jPO49anc+6aBA5jlAsFw7BSHt6lXjFseJ3c=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-jeEFsbXmPykkzOBIdB4Oe9towuwSHjApa485w2NO6A8=";
+      hash = "sha256-mcqe531FqdBVIgZrQLOVDgIi2JBPSKadD4fCLQMimwI=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-0QH9hJGCXRjSRANLPp3ivLvKfbH3qIfFs8i/p5BduKE=";
+      hash = "sha256-u3KmZffPQpHzS9IxZ7UsL7D6ETGJxExil20vmD6flMo=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-CZhfmjMbXwDizEk6xNzIZfGhiCUwHrJ/V1mqoCMV7TM=";
+      hash = "sha256-jSWamdWVBCR9uPY/i0awwdhTG3pD/iVdJIeYBnG747k=";
     };
   };
 

pkgs/by-name/bu/butler/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "butler";
-  version = "15.26.1";
+  version = "15.27.0";
 
   src = fetchFromGitHub {
     owner = "itchio";
     repo = "butler";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/Sdk9uYWjYtJFvc/xmrewgHlC+6cpqPoUP22xIfowj8=";
+    hash = "sha256-AnyZhfBjajWAM/pzCQjHOjY3sOQzU20y+LWHBZxbU3Y=";
   };
 
   buildInputs = [ brotli ];
 
   doCheck = false; # disabled because the tests don't work in a non-FHS compliant environment.
 
-  vendorHash = "sha256-8f4EVARMtdzXL3YxGimgLM/A7BF/GOaEoxffkQ1SlHw=";
+  vendorHash = "sha256-zDovN9J6IOE3TrXP60PPcsIc0PpXyEaqSR8i4i9MiHk=";
 
   meta = {
     description = "Command-line itch.io helper";

pkgs/by-name/ch/chess-tui/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chess-tui";
-  version = "2.5.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "thomas-mauran";
     repo = "chess-tui";
     tag = finalAttrs.version;
-    hash = "sha256-jO3pa4N7XNyKQCbPjFByYmLlOtrrdpzS5lkxU9giE+w=";
+    hash = "sha256-BGJOPsePE5S5ySrOg63cNKn9pT+7MmDLHZrW3YhUFz8=";
   };
 
-  cargoHash = "sha256-9LXg4zX/irLt2MCq7V0dQA3o1QRqGgfRcX4HneNGAns=";
+  cargoHash = "sha256-n9rjr5vUK619XIfuHIlf+lxUAeTbhTAzmdysliKNOFY=";
 
   checkFlags = [
     # assertion failed: result.is_ok()

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.146",
-  "commit": "c900a8c71aa966a1a8bf14c49139d87fac9ae881",
-  "buildDate": "2026-05-20T01:57:57Z",
+  "version": "2.1.148",
+  "commit": "650a3d6e4b17f2fd01a8432a7691d9fb147adf8d",
+  "buildDate": "2026-05-21T23:11:38Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "b16f466a2213a04cecf1ad958201655148a49f42952134e6ae182257ccfc08f3",
-      "size": 211056288
+      "checksum": "f4a1860d3d9b01653dde4183e2f1216ca9e0c1a404dd63caa4edf07c904102aa",
+      "size": 211584672
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "6bc14f45e28ea6c8c34220c88327bb72a38c5f978b9aa44d0cb34375cbf78837",
-      "size": 213570448
+      "checksum": "7c52d8419cc22b8355c6309d4542df32b3f245d1a7c3329a30797244ef3c4629",
+      "size": 214082320
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "af25334c7a2632a531b34e3f4c0d69763b997149d31d5f0d748e44813758806f",
-      "size": 236435080
+      "checksum": "b53c29b1fe003372636048c16d57a74f1ca2c57d8413dd5b14e2ca77710823ed",
+      "size": 236959368
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "825d5301380f1f5f466c5268de25a062927be658938fc1d630cfa02c521b8185",
-      "size": 236512976
+      "checksum": "3b38836a1801a6397f8431c6a62b127ce47e3e9d103c1a700fca7f9c8ab5f8ac",
+      "size": 237037264
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "256703637576ef323b8f87695b81e65a7bdc66327f1512dacc9257b7896e7a0f",
-      "size": 229289816
+      "checksum": "06b54aef9989ea379933239c3f2dbee254034523ff67f9a0c8ed31ac6982c077",
+      "size": 229814104
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "e8ab94b1ffb9d9213134d4addfe5d3fe6fd10c524aa2927667e543ac165a7242",
-      "size": 230906928
+      "checksum": "ad0077c9ec67ec2eaeee8be7624cc2e55b9e012e1c19154e5b80ef0a47d0e360",
+      "size": 231431216
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "b585bbaf085554757b627e5ed87aa5c153abb90ef408fb43b0311453b72e8bc2",
-      "size": 232326816
+      "checksum": "1bb46bdb06ef092b0af29cafbfec6ab73251ea34562cfe1d3a5bdf67fe3a5f93",
+      "size": 232827552
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "159488363d937bbac11c55364246513f677e94e681d7431e1622336250091c00",
-      "size": 228292256
+      "checksum": "d86eeb4d84a2bbee253913843a4a507192a37512a2d918a4c91e3f583cb310a5",
+      "size": 228792992
     }
   }
 }

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.4.2.10-stable";
-  rev = "184f682d431389803dd383668f52729cf26e23db";
-  hash = "sha256-UCRwnrIY/j0gdjFnNmR5U7VZeBRqA96mIt6AEKRJQ5Q=";
+  version = "26.5.1.882-stable";
+  rev = "5b96a8d8a5e2f4800b43a780911a39dc5a666e1c";
+  hash = "sha256-Z+xcmHIkCuYSqOFdWSRWk2BFuCeI9yXnJIntSa4zXUk=";
   lts = false;
 }

pkgs/by-name/co/cosmic-ext-tweaks/package.nix

@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-ext-tweaks";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "tweaks";
     tag = finalAttrs.version;
-    hash = "sha256-0P/KtfNUlS6E68aR3uLHJ2D4aMAdc05Svl6xSEG8XJA=";
+    hash = "sha256-kREYDT42Xh/APrZAs3uho6Mw2MNEGeG0jc00I2yQemI=";
   };
 
-  cargoHash = "sha256-Zl7c/3q5J+9y1vRJdR77NJ6y62bV1bxaVMuiyxDbLX4=";
+  cargoHash = "sha256-mC19GLLHrjqYXl052HoNFscz9zzQWVBBm0OxzXoUd8U=";
 
   separateDebugInfo = true;
 

pkgs/by-name/cp/cppitertools/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cppitertools";
-  version = "2.1";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "ryanhaining";
     repo = "cppitertools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mii4xjxF1YC3H/TuO/o4cEz8bx2ko6U0eufqNVw5LNA=";
+    hash = "sha256-1lHpy+9e17lP/58EEIzrmyBwbmMD665ypDJtkSFrN9E=";
   };
 
   __structuredAttrs = true;
@@ -25,13 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
   # tests. The CMake system defines tests and install targets, including a
   # cppitertools-config.cmake, which is really helpful for downstream consumers
   # to detect this package since it has no pkg-config.
-  # However the CMake system also specifies the entire source repo as an install
-  # target, including support files, the build directory, etc.
-  # We can't simply take cppitertools-config.cmake for ourselves because before
-  # install it's placed in non-specific private CMake subdirectory of the build
-  # directory.
-  # Therefore, we instead simply patch CMakeLists.txt to make the target that
-  # installs the entire directory non-default, and then install the headers manually.
 
   strictDeps = true;
 
@@ -47,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
   # files that are also in that repo.
   cmakeBuildDir = "cmake-build";
 
-  includeInstallDir = "${placeholder "out"}/include/cppitertools";
   cmakeInstallDir = "${placeholder "out"}/share/cmake";
 
   # This version of cppitertools considers itself as having used the default value,
@@ -58,12 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ "-Dcppitertools_INSTALL_CMAKE_DIR=${finalAttrs.cmakeInstallDir}" ];
 
-  prePatch = ''
-    # Mark the `.` install target as non-default.
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "  DIRECTORY ." "  DIRECTORY . EXCLUDE_FROM_ALL"
-  ''
-  + lib.optionalString finalAttrs.finalPackage.doCheck ''
+  prePatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
     # Required for tests.
     cp ${lib.getDev catch2}/include/catch2/catch.hpp test/
   '';
@@ -77,11 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     runHook preInstall
-    # Install the -config.cmake files.
     cmake --install . "--prefix=$out"
-    # Install the headers.
-    mkdir -p "$includeInstallDir"
-    cp -r ../*.hpp ../internal "$includeInstallDir"
     runHook postInstall
   '';
 

pkgs/by-name/cr/crossplane-cli/package.nix

@@ -9,32 +9,28 @@
 
 buildGoModule (finalAttrs: {
   pname = "crossplane-cli";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "crossplane";
-    repo = "crossplane";
+    repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sQ2sCgFDGogQIIWdNCAKVkorsVuNtUOcaALqE/PGwJ4=";
+    hash = "sha256-FZx31AvGC70iSX3KcLyb5GpwiItO0LliLNeNk8WIX8s=";
   };
 
-  vendorHash = "sha256-DD0I4XLcN3pHhJKc5wBaldQU7gndszqCExSW4jqLMKQ=";
+  vendorHash = "sha256-QZyKX94a9iMvB2NCNr27M7hrQJG9Por0mLW3lCf8f58=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/crossplane/crossplane/v2/internal/version.version=v${finalAttrs.version}"
+    "-X github.com/crossplane/crossplane-runtime/v2/pkg/version.version=v${finalAttrs.version}"
   ];
 
-  subPackages = [ "cmd/crank" ];
-
-  postInstall = ''
-    mv $out/bin/crank $out/bin/crossplane
-  '';
+  subPackages = [ "cmd/crossplane" ];
 
   passthru.tests.version = testers.testVersion {
     package = crossplane-cli;
-    command = "crossplane version --client || true";
+    command = "crossplane version --client";
     version = "v${finalAttrs.version}";
   };
 
@@ -46,6 +42,9 @@ buildGoModule (finalAttrs: {
     description = "Utility to make using Crossplane easier";
     mainProgram = "crossplane";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ selfuryon ];
+    maintainers = with lib.maintainers; [
+      selfuryon
+      LorenzBischof
+    ];
   };
 })

pkgs/by-name/cr/crush/package.nix

@@ -11,16 +11,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "crush";
-  version = "0.65.3";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X+bCwpyAFUkM1ljj5I6w6gts6b6IWYm1d4veV0mR0gA=";
+    hash = "sha256-rLLgGes902mZvya2rcTCNji0FR2AlMzA4vdYieHZIoc=";
   };
 
-  vendorHash = "sha256-moVpfFscZLz7mQw+pqaG132k9KTNyRdKOFNNd0RN1oo=";
+  vendorHash = "sha256-3fYDFzBN5lDDnc2rziHOc7SMvesdAevsxIY2xUU3hms=";
 
   ldflags = [
     "-s"
@@ -39,6 +39,7 @@ buildGo126Module (finalAttrs: {
         "TestOpenAIClientStreamChoices"
         "TestGrepWithIgnoreFiles"
         "TestSearchImplementations"
+        "TestDispatch_BinaryPassthroughExecutes"
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

pkgs/by-name/da/dart-sass/package.nix

@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.99.0";
+  version = "1.100.0";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     tag = version;
-    hash = "sha256-WbXjMnbBKzgX8PjFhthLj4iQCccPcwln59UoiRrf5z4=";
+    hash = "sha256-yjI89EgFHMitdVVkjutTAiV/bND/eGTNCrLyZp/As4w=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;

pkgs/by-name/da/dart-sass/pubspec.lock.json

@@ -174,11 +174,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_mappable",
-        "sha256": "97526bd5e1b1739be5c7379c51d391d074b6bbd109e6e92be49028ecb1a9853c",
+        "sha256": "960746478faaa68ed6b9d3c6fd03c87c7b8614e6c33e75fe1b0c6d7a60adcf29",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.7.0"
+      "version": "4.8.0"
     },
     "dart_style": {
       "dependency": "transitive",
@@ -324,11 +324,11 @@
       "dependency": "transitive",
       "description": {
         "name": "json_annotation",
-        "sha256": "cb09e7dac6210041fad964ed7fbee004f14258b4eca4040f72d1234062ace4c8",
+        "sha256": "2a743920d81b7910627f68ee2c9ac1fc0bfee32b9fc3403587d7c6791ca12f80",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.11.0"
+      "version": "4.12.0"
     },
     "lints": {
       "dependency": "direct dev",
@@ -364,11 +364,11 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861",
+        "sha256": "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.19"
+      "version": "0.12.20"
     },
     "meta": {
       "dependency": "direct main",
@@ -674,31 +674,31 @@
       "dependency": "direct dev",
       "description": {
         "name": "test",
-        "sha256": "8d9ceddbab833f180fbefed08afa76d7c03513dfdba87ffcec2718b02bbcbf20",
+        "sha256": "ca578dc12bb8b2f40b67b7d3bd2fac4f31c01a6ff7130a14e2597b919934507f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.31.0"
+      "version": "1.31.1"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e",
+        "sha256": "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.11"
+      "version": "0.7.12"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "1991d4cfe85d5043241acac92962c3977c8d2f2add1ee73130c7b286417d1d34",
+        "sha256": "d2e98ec12998368dc59ddd47ab709f2cd55acd6b66dc7db764455a44082f4bc5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.17"
+      "version": "0.6.18"
     },
     "test_descriptor": {
       "dependency": "direct dev",
@@ -744,11 +744,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
+        "sha256": "0016aef94fc66495ac78af5859181e3f3bf2026bd8eecc72b9565601e19ab360",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "15.0.2"
+      "version": "15.2.0"
     },
     "watcher": {
       "dependency": "direct main",

pkgs/by-name/de/debian-devscripts/hardening-check-obey-binutils-env-vars.patch

@@ -0,0 +1,72 @@
+From c6a018e0ef50a1b0cb4962a2f96dae7c6f21f1d4 Mon Sep 17 00:00:00 2001
+From: Robert Scott <code@humanleg.org.uk>
+Date: Sun, 12 Feb 2023 23:04:15 +0000
+Subject: [PATCH] hardening-check: obey READELF, LDD & OBJDUMP env vars for
+ tool names
+
+this is useful on e.g. cross-build systems where the desired
+tools may have platform-denoting prefixes
+---
+ scripts/hardening-check.pl | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/scripts/hardening-check.pl b/scripts/hardening-check.pl
+index ad7f4e43..d4b1f79e 100755
+--- a/scripts/hardening-check.pl
++++ b/scripts/hardening-check.pl
+@@ -47,6 +47,9 @@
+ pod2usage(1)                                                if $help;
+ pod2usage(-exitstatus => 0, -verbose => 2, -noperldoc => 1) if $man;
+ 
++my $ldd     = $ENV{'LDD'} || "ldd";
++my $objdump = $ENV{'OBJDUMP'} || "objdump";
++my $readelf = $ENV{'READELF'} || "readelf";
+ my $overall = 0;
+ my $rc      = 0;
+ my $report  = "";
+@@ -220,8 +223,8 @@ (@)
+ # Find the libc used in this executable, if any.
+ sub find_libc($) {
+     my ($file) = @_;
+-    my $ldd = output("ldd", $file);
+-    $ldd =~ /^\s*libc\.so\.\S+\s+\S+\s+(\S+)/m;
++    my $ldd_out = output($ldd, $file);
++    $ldd_out =~ /^\s*libc\.so\.\S+\s+\S+\s+(\S+)/m;
+     return $1 || "";
+ }
+ 
+@@ -232,7 +235,7 @@ ($$)
+     # Catch "NOTYPE" for object archives.
+     my $func_regex = " (I?FUNC|NOTYPE) ";
+ 
+-    my $relocs = output("readelf", "-sW", $file);
++    my $relocs = output($readelf, "-sW", $file);
+     for my $line (split("\n", $relocs)) {
+         next if ($line               !~ /$func_regex/);
+         next if ($undefined && $line !~ /$func_regex.* UND /);
+@@ -271,21 +274,21 @@ ($$)
+     @tags   = ();
+ 
+     # Get program headers.
+-    my $PROG_REPORT = output("readelf", "-lW", $file);
++    my $PROG_REPORT = output($readelf, "-lW", $file);
+     if (length($PROG_REPORT) == 0) {
+         $overall = 1;
+         next;
+     }
+ 
+     # Get ELF headers.
+-    my $DYN_REPORT = output("readelf", "-dW", $file);
++    my $DYN_REPORT = output($readelf, "-dW", $file);
+ 
+     # Get disassembly
+     my $DISASM
+-      = output("objdump", "-d", "--no-show-raw-insn", "-M", "intel", $file);
++      = output($objdump, "-d", "--no-show-raw-insn", "-M", "intel", $file);
+ 
+     # Get notes
+-    my $NOTES = output("readelf", "-n", $file);
++    my $NOTES = output($readelf, "-n", $file);
+ 
+     # Get list of all symbols needing external resolution.
+     my $functions = find_functions($file, 1);

pkgs/by-name/de/debian-devscripts/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   xz,
   dpkg,
   libxslt,
@@ -44,17 +43,13 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    (fetchpatch {
-      name = "hardening-check-obey-binutils-env-vars.patch";
-      url = "https://github.com/Debian/devscripts/pull/2/commits/c6a018e0ef50a1b0cb4962a2f96dae7c6f21f1d4.patch";
-      hash = "sha256-UpS239JiAM1IYxNuJLdILq2h0xlR5t0Tzhj47xiMHww=";
-    })
+    # hardening-check: obey READELF, LDD & OBJDUMP env vars for tool names
+    # https://github.com/Debian/devscripts/pull/2
+    ./hardening-check-obey-binutils-env-vars.patch
+
     # Write to stdout and exit 0 for --help, --version
     # https://salsa.debian.org/debian/devscripts/-/merge_requests/637
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/devscripts/-/commit/dbb258ea17749e2d102d4d181fe2709bda5584e7.patch";
-      hash = "sha256-+/E1UhxKk4PYD1bO1kI0qjfBpcMoFbo3xiY45IQ/FWU=";
-    })
+    ./write-to-stdout-and-exit-0.patch
   ];
 
   postPatch = ''

pkgs/by-name/de/debian-devscripts/write-to-stdout-and-exit-0.patch

@@ -0,0 +1,212 @@
+From d76aaa05cb44a6ba741c74a83a319fcabf493865 Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 20 Apr 2026 13:59:02 -0700
+Subject: [PATCH 1/5] dpkg-genbuilddeps: exit 0 for --help, --version
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ scripts/dpkg-genbuilddeps.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/dpkg-genbuilddeps.sh b/scripts/dpkg-genbuilddeps.sh
+index 04cb048d..dd140ea7 100755
+--- a/scripts/dpkg-genbuilddeps.sh
++++ b/scripts/dpkg-genbuilddeps.sh
+@@ -14,12 +14,12 @@ Options:
+    -h, --help     This help
+    -v, --version  Report version and exit
+ EOF
+-	    exit 1
++	    exit 0
+ 	    ;;
+ 	-v|--version)
+ 	    echo "$PROGNAME wrapper for dpkg-depcheck:"
+ 	    dpkg-depcheck --version
+-	    exit 1
++	    exit 0
+ 	    ;;
+     esac
+ fi
+-- 
+GitLab
+
+
+From 183ed0a70f6f72dc6bf4d9765285c62b8c7e8629 Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 20 Apr 2026 14:04:43 -0700
+Subject: [PATCH 2/5] debchange: Use ###VERSION###
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ scripts/debchange.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/debchange.pl b/scripts/debchange.pl
+index adae33d9..0b60b0b2 100755
+--- a/scripts/debchange.pl
++++ b/scripts/debchange.pl
+@@ -250,7 +250,7 @@ EOF
+ 
+ sub version () {
+     print <<"EOF";
+-This is $progname, from the Debian devscripts package, version 2.17.10
++This is $progname, from the Debian devscripts package, version ###VERSION###
+ This code is copyright 1999-2003 by Julian Gilbey, all rights reserved.
+ Based on code by Christoph Lameter.
+ This program comes with ABSOLUTELY NO WARRANTY.
+-- 
+GitLab
+
+
+From 73625a57909ea3fd7c5cdea3115c9d16f87668a9 Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 20 Apr 2026 14:12:18 -0700
+Subject: [PATCH 3/5] hardening-check: exit 0 for --help
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ scripts/hardening-check.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/hardening-check.pl b/scripts/hardening-check.pl
+index 1a2b2dfa..433c1ca6 100755
+--- a/scripts/hardening-check.pl
++++ b/scripts/hardening-check.pl
+@@ -46,7 +46,7 @@ GetOptions(
+     "help|h|?"               => \$help,
+     "man|H"                  => \$man,
+ ) or pod2usage(2);
+-pod2usage(1)                                                if $help;
++pod2usage(0)                                                if $help;
+ pod2usage(-exitstatus => 0, -verbose => 2, -noperldoc => 1) if $man;
+ 
+ my $overall = 0;
+-- 
+GitLab
+
+
+From e8fb22f6d8d7a916f66ca87fa252d03af6270105 Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 20 Apr 2026 14:46:50 -0700
+Subject: [PATCH 4/5] who-permits-upload: Write to stdout, exit 0 for --help
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ scripts/who-permits-upload.pl | 44 ++++++++++++++++++-----------------
+ 1 file changed, 23 insertions(+), 21 deletions(-)
+
+diff --git a/scripts/who-permits-upload.pl b/scripts/who-permits-upload.pl
+index 99e3e1df..60b4a1f9 100755
+--- a/scripts/who-permits-upload.pl
++++ b/scripts/who-permits-upload.pl
+@@ -189,39 +189,41 @@ if ($TYPE eq 'package') {
+ } elsif ($TYPE eq 'sponsor') {
+     $TYPE = TYPE_SPONSOR;
+ } else {
+-    usage();
++    usage(*STDERR);
++    exit 2;
+ }
+ 
+ if ($HELP) {
+-    usage();
++    usage(*STDOUT);
++    exit 0;
+ }
+ 
+ if (not @ARGUMENTS) {
+-    usage();
++    usage(*STDERR);
++    exit 2;
+ }
+ 
+ sub usage {
+-    print STDERR (
++    my ($fh) = @_;
++    print $fh (
+ "Usage: $0 [-h][-s KEYRING][-d DM_URL][-s SEARCH_TYPE] QUERY [QUERY ...]\n"
+     );
+-    print STDERR "Retrieve permissions granted to Debian Maintainers (DM)\n";
+-    print STDERR "\n";
+-    print STDERR "-h, --help\n";
+-    print STDERR "\t\t\tDisplay this usage summary and exit\n";
+-    print STDERR "-k, --keyring=KEYRING\n";
+-    print STDERR
++    print $fh "Retrieve permissions granted to Debian Maintainers (DM)\n";
++    print $fh "\n";
++    print $fh "-h, --help\n";
++    print $fh "\t\t\tDisplay this usage summary and exit\n";
++    print $fh "-k, --keyring=KEYRING\n";
++    print $fh
+       "\t\t\tUse the supplied keyring file(s) instead of the default\n";
+-    print STDERR "\t\t\tkeyring. Separate arguments by a colon (\":\")\n";
+-    print STDERR "-d, --dmfile=DM_URL\n";
+-    print STDERR "\t\t\tRetrieve DM permissions from the supplied URL.\n";
+-    print STDERR "\t\t\tDefault is https://ftp-master.debian.org/dm.txt\n";
+-    print STDERR "-s, --search=SEARCH_TYPE\n";
+-    print STDERR "\t\t\tSupplied QUERY arguments are interpreted as:\n";
+-    print STDERR
+-      "\t\t\tpackage name when SEARCH_TYPE is \"package\" (default)\n";
+-    print STDERR "\t\t\tDM user name id when SEARCH_TYPE is \"uid\"\n";
+-    print STDERR "\t\t\tsponsor user id when SEARCH_TYPE is \"sponsor\"\n";
+-    exit 2;
++    print $fh "\t\t\tkeyring. Separate arguments by a colon (\":\")\n";
++    print $fh "-d, --dmfile=DM_URL\n";
++    print $fh "\t\t\tRetrieve DM permissions from the supplied URL.\n";
++    print $fh "\t\t\tDefault is https://ftp-master.debian.org/dm.txt\n";
++    print $fh "-s, --search=SEARCH_TYPE\n";
++    print $fh "\t\t\tSupplied QUERY arguments are interpreted as:\n";
++    print $fh "\t\t\tpackage name when SEARCH_TYPE is \"package\" (default)\n";
++    print $fh "\t\t\tDM user name id when SEARCH_TYPE is \"uid\"\n";
++    print $fh "\t\t\tsponsor user id when SEARCH_TYPE is \"sponsor\"\n";
+ }
+ 
+ sub leave {
+-- 
+GitLab
+
+
+From d91e190604da139b2b492efcdeb55a099467dd03 Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 20 Apr 2026 15:36:22 -0700
+Subject: [PATCH 5/5] cowpoke: Write to stdout for --help
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ scripts/cowpoke.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/cowpoke.sh b/scripts/cowpoke.sh
+index 54dd9fc2..f7756322 100755
+--- a/scripts/cowpoke.sh
++++ b/scripts/cowpoke.sh
+@@ -111,7 +111,7 @@ GNU General Public License."
+ }
+ 
+ usage() {
+-    cat 1>&2 <<EOF
++    cat <<EOF
+ 
+ cowpoke [options] package.dsc
+ 
+@@ -258,7 +258,7 @@ for arg; do
+ 
+ 	*)
+ 	    echo "ERROR: unrecognised option '$arg'"
+-	    usage 1
++	    usage 1 >&2
+ 	    ;;
+     esac
+ done
+@@ -269,7 +269,7 @@ if [ -z "$REMOTE_SCRIPT" ]; then
+ fi
+ if [ -z "$DSC" ]; then
+     echo "ERROR: No package .dsc specified"
+-    usage 1
++    usage 1 >&2
+ fi
+ if ! [ -r "$DSC" ]; then
+     echo "ERROR: '$DSC' not found."
+-- 
+GitLab
+

pkgs/by-name/de/deezer-desktop/package.nix

@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.190";
+  version = "7.1.200";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-XoZRlFMiN5VVp3vkTwGDMekhW1KzmvuN9oYTXZFn6B4=";
+      hash = "sha256-FrAFUkxv4/GGhDO/2g+0Kym1LCV+YoIee7rmOAw17/Q=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-ChPuz8wd3SOxRmxM5bEbz3paBw7pfIVfSY23nasRI4A=";
+      hash = "sha256-FcP4jAVvIA71GCtVoWEIA4AynsHOAn0/zt3rNB6Q25Y=";
     };
   };
 

pkgs/by-name/de/deja/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "deja";
-  version = "0.2.5";
+  version = "0.2.6";
   __structuredAttrs = true;
   src = fetchFromGitHub {
     owner = "Giammarco-Ferranti";
     repo = "deja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0eRXPtm+L1C4/fc/WLn9p2LV8uhJ4w+40hhA69+CEdw=";
+    hash = "sha256-xxbClKhhSwo+jUjAZ2gS4yOS5sSI76dfPpDzA3qdV18=";
   };
 
   vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";

pkgs/by-name/dn/dnf5/package.nix

@@ -35,7 +35,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.4.1.0";
+  version = "5.4.2.1";
 
   outputs = [
     "out"
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rpm-software-management";
     repo = "dnf5";
     tag = finalAttrs.version;
-    hash = "sha256-wvWOQyY7K9fCds2am8gYpjw9mPl7IbOdHT92b8pwonc=";
+    hash = "sha256-Z+k47LC3gaBQ3y3090MLsSvPKlwPUVrYEBboKhskTik=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dw/dwproton-bin/package.nix

@@ -11,11 +11,11 @@ proton-ge-bin.overrideAttrs (
     inherit steamDisplayName;
 
     pname = "dwproton-bin";
-    version = "dwproton-11.0-1";
+    version = "dwproton-11.0-2";
 
     src = fetchzip {
       url = "https://dawn.wine/dawn-winery/dwproton/releases/download/${finalAttrs.version}/${finalAttrs.version}-x86_64.tar.xz";
-      hash = "sha256-G8VeHp0POZBHfxN78PCwwm6z7zVNMveAdwf/IMJQ/9Q=";
+      hash = "sha256-3AxBr8fQh4bbAsdSSZuyQR2GOz78vdhC6jJbLmiYEXY=";
     };
 
     preFixup = ''