Merge master into staging-next

2026-07-06 17:13:24 -05:00 · 2026-05-11 13:00:43 +00:00 · 2026-05-11 13:00:43 +00:00 · cc75f76ae5
commit cc75f76ae5
parent 609a10b4e6 169bb6b3f8
96 changed files with 1420 additions and 525 deletions
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -35,6 +35,10 @@ jobs:
            into: staging-next-25.11
          - from: staging-next-25.11
            into: staging-25.11
+          - from: master
+            into: staging-next-26.05
+          - from: staging-next-26.05
+            into: staging-26.05
          - name: merge-base(master,staging) → haskell-updates
            from: master staging
            into: haskell-updates
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@ -129,6 +129,13 @@ It has two modes:

  Example: `{ "include_verbatim" = true; }`

+`extraArgs` (list of strings, optional) {#tester-lycheeLinkCheck-param-extraArgs}
+
+: Extra command line arguments to pass to the `lychee` invocation.
+  These are passed in both the offline (build) and [`online`](#tester-lycheeLinkCheck-return) modes.
+
+  Example: `[ "--format" "json" ]`
+
 `lychee` (derivation, optional) {#tester-lycheeLinkCheck-param-lychee}

 : The `lychee` package to use.
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@ -0,0 +1,38 @@
+# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
+
+## Highlights {#sec-nixpkgs-release-26.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
+
+- Create the first release note entry in this section!
+
+
+### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
+
+- Create the first release note entry in this section!
+
+
+### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
+
+- Create the first release note entry in this section!
+
--- a/doc/style.css
+++ b/doc/style.css
@ -325,8 +325,10 @@ div.appendix .important > :last-child {

 div.book .note,
 div.book .tip,
+div.book .important,
 div.appendix .note,
-div.appendix .tip {
+div.appendix .tip,
+div.appendix .important {
  color: var(--note-text-color);
  background: var(--note-background);
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -28309,6 +28309,12 @@
    githubId = 303489;
    name = "Manuel Bärenz";
  };
+  TurnrDev = {
+    email = "jaynicholasturner@gmail.com";
+    github = "TurnrDev";
+    githubId = 11667059;
+    name = "Jay Turner";
+  };
  tuxinaut = {
    email = "trash4you@tuxinaut.de";
    github = "tuxinaut";
@ -29105,6 +29111,13 @@
    githubId = 5604643;
    name = "Mikhail Volkhov";
  };
+  vollate = {
+    name = "Vollate";
+    email = "uint44t@gmail.com";
+    github = "vollate";
+    githubId = 90166078;
+    keys = [ { fingerprint = "A5B9 B2C5 8C04 DCB6 A157  566A 9CDF DE55 0783 E7BB"; } ];
+  };
  vonfry = {
    email = "nixos@vonfry.name";
    github = "Vonfry";
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@ -262,6 +262,13 @@ of pulling the upstream container image from Docker Hub. If you want the old beh

 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

+- `services.headplane` has been updated to 0.6.2, which introduces several changes to the configuration schema:
+  - `services.headplane.settings.oidc.redirect_uri` is deprecated. Use `services.headplane.settings.server.base_url` instead; the OIDC redirect URI is now automatically derived from it. Ensure `base_url` is the bare host URL without the `/admin` suffix.
+  - `services.headplane.settings.oidc.user_storage_file` is deprecated. Headplane 0.6.2 still accepts it to migrate the old JSON user database into the new internal SQL database.
+  - `services.headplane.settings.oidc.strict_validation` is deprecated and has no effect.
+  - `services.headplane.settings.oidc.token_endpoint_auth_method` now defaults to `null` (auto-detection), which typically falls back to `client_secret_basic`. Previous versions defaulted to `client_secret_post`.
+  - `services.headplane.settings.integration.agent.cache_ttl` is deprecated and has no effect in 0.6.2.
+
 - `services.immich` no longer supports pgvecto.rs since the package has been removed from nixpkgs.
  As a result, options `services.immich.database.enableVectors` and `services.immich.database.enableVectorchord` have been removed, and VectorChord is now always used.
  If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the [migration guide](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@ -0,0 +1,25 @@
+# Release 26.11 (2026.11/??) {#sec-release-26.11}
+
+## Highlights {#sec-release-26.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## New Modules {#sec-release-26.11-new-modules}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-release-26.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@ -72,6 +72,7 @@ in
        KillSignal = "SIGINT";
        SuccessExitStatus = "0 156";
      };
+      unitConfig.RequiresMountsFor = [ cfg.dataDir ];
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
--- a/nixos/modules/services/misc/seerr.nix
+++ b/nixos/modules/services/misc/seerr.nix
@ -75,6 +75,7 @@ in
        RemoveIPC = true;
        PrivateMounts = true;
      };
+      unitConfig.RequiresMountsFor = [ cfg.configDir ];
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
--- a/nixos/modules/services/misc/servarr/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@ -57,6 +57,7 @@ in
          ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
          Restart = "on-failure";
        };
+        unitConfig.RequiresMountsFor = [ cfg.dataDir ];
      };

      tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = lib.mkIf isCustomDataDir {
--- a/nixos/modules/services/networking/headplane.nix
+++ b/nixos/modules/services/networking/headplane.nix
@ -64,6 +64,16 @@ in
                  description = "The port to listen on.";
                };

+                base_url = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    The base URL for Headplane. Used for OIDC redirect callback URL
+                    detection. Should not include the dashboard prefix (/admin).
+                  '';
+                  example = "https://headplane.example.com";
+                };
+
                cookie_secret_path = mkOption {
                  type = types.nullOr types.path;
                  default = null;
@ -84,16 +94,32 @@ in
                  '';
                };

+                cookie_max_age = mkOption {
+                  type = types.ints.positive;
+                  default = 86400;
+                  description = "The maximum age of the session cookie in seconds.";
+                };
+
+                cookie_domain = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    Restrict the cookie to a specific domain.
+                    This may not work as expected if not using a reverse proxy.
+                  '';
+                  example = "example.com";
+                };
+
                data_path = mkOption {
                  type = types.path;
                  default = "/var/lib/headplane";
                  description = ''
                    The path to persist Headplane specific data.
                    All data going forward is stored in this directory, including the internal database and any cache related files.
-                    Data formats prior to 0.6.1 will automatically be migrated.
                  '';
                  example = "/var/lib/headplane";
                };
+
              };
            };
            default = { };
@ -185,6 +211,15 @@ in
                          '';
                        };

+                        pre_authkey_path = mkOption {
+                          type = types.nullOr types.path;
+                          default = null;
+                          description = ''
+                            Path to a file containing a Headscale pre-auth key for the agent.
+                          '';
+                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                        };
+
                        executable_path = mkOption {
                          type = types.path;
                          readOnly = true;
@ -195,36 +230,25 @@ in
                          '';
                        };

-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing the agent preauth key.
-                            To connect to your Tailnet, you need to generate a pre-auth key.
-                            This can be done via the web UI or through the `headscale` CLI.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.agent_pre_authkey.path";
-                        };
-
                        host_name = mkOption {
                          type = types.str;
                          default = "headplane-agent";
-                          description = "Optionally change the name of the agent in the Tailnet";
+                          description = "Optionally change the name of the agent in the Tailnet.";
                        };

                        cache_ttl = mkOption {
-                          type = types.ints.positive;
-                          default = 180000;
+                          type = types.nullOr types.int;
+                          default = null;
                          description = ''
-                            How long to cache agent information (in milliseconds).
-                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                            Deprecated cache TTL for the agent. This option is accepted
+                            by Headplane 0.6.2 but has no effect.
                          '';
                        };

                        cache_path = mkOption {
                          type = types.path;
                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "Where to store the agent cache.";
+                          description = "The path to store the agent's cache.";
                        };

                        work_dir = mkOption {
@ -271,6 +295,15 @@ in
            type = types.nullOr (
              types.submodule {
                options = {
+                  enabled = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = ''
+                      Explicitly control OIDC availability.
+                      Set to false to define OIDC config without enabling it.
+                    '';
+                  };
+
                  issuer = mkOption {
                    type = types.str;
                    description = "URL to OpenID issuer.";
@ -292,6 +325,16 @@ in
                    example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                  };

+                  headscale_api_key_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the Headscale API key.
+                      Required for OIDC authentication.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
+                  };
+
                  disable_api_key_login = mkOption {
                    type = types.bool;
                    default = false;
@ -299,42 +342,47 @@ in
                  };

                  token_endpoint_auth_method = mkOption {
-                    type = types.enum [
-                      "client_secret_post"
-                      "client_secret_basic"
-                      "client_secret_jwt"
-                    ];
-                    default = "client_secret_post";
-                    description = "The token endpoint authentication method.";
-                  };
-
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
+                    type = types.nullOr (
+                      types.enum [
+                        "client_secret_post"
+                        "client_secret_basic"
+                        "client_secret_jwt"
+                      ]
+                    );
                    default = null;
                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required when `services.headplane.settings.oidc` is set.
+                      The token endpoint authentication method.
+                      If not set, Headplane will auto-detect the best method
+                      and fall back to client_secret_basic.
+                    '';
+                  };
+
+                  use_pkce = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = ''
+                      Whether to use PKCE when authenticating users.
+                      Your OIDC provider must support PKCE and it must be enabled on the client.
                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
                  };

                  redirect_uri = mkOption {
                    type = types.nullOr types.str;
                    default = null;
                    description = ''
-                      This should point to your publicly accessible URL
-                      for your Headplane instance with /admin/oidc/callback.
+                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
+                      instead; Headplane derives the callback URL from it.
                    '';
-                    example = "https://headscale.example.com/admin/oidc/callback";
+                    example = "https://headplane.example.com/admin/oidc/callback";
                  };

-                  user_storage_file = mkOption {
-                    type = types.path;
-                    default = "/var/lib/headplane/users.json";
+                  strict_validation = mkOption {
+                    type = types.nullOr types.bool;
+                    default = null;
                    description = ''
-                      Path to a file containing the users and their permissions for Headplane.
+                      Deprecated OIDC validation setting. This option is accepted
+                      by Headplane 0.6.2 but has no effect.
                    '';
-                    example = "/var/lib/headplane/users.json";
                  };

                  profile_picture_source = mkOption {
@ -346,12 +394,6 @@ in
                    description = "Source for user profile pictures.";
                  };

-                  strict_validation = mkOption {
-                    type = types.bool;
-                    default = true;
-                    description = "Enable strict validation of OIDC configuration.";
-                  };
-
                  scope = mkOption {
                    type = types.str;
                    default = "openid email profile";
@ -387,6 +429,16 @@ in
                    description = "Custom userinfo endpoint URL.";
                    example = "https://provider.example.com/userinfo";
                  };
+
+                  user_storage_file = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Deprecated path to the pre-0.6.2 JSON user database.
+                      Headplane uses this once to migrate users into its internal database.
+                    '';
+                    example = "/var/lib/headplane/users.json";
+                  };
                };
              }
            );
@ -400,6 +452,33 @@ in
  };

  config = mkIf cfg.enable {
+    warnings =
+      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
+        ''
+          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
+          Use services.headplane.settings.server.base_url instead; Headplane derives
+          the OIDC callback URL from it.
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
+        ''
+          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
+          in Headplane 0.6.2.
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
+        ''
+          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
+          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
+        ''
+      ]
+      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
+        ''
+          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
+          effect in Headplane 0.6.2.
+        ''
+      ];
+
    assertions = [
      {
        assertion = config.services.headscale.enable;
@ -422,23 +501,20 @@ in
          via systemd `LoadCredential` or sops-nix.
        '';
      }
-      {
-        assertion =
-          cfg.settings.integration.agent == null
-          || !cfg.settings.integration.agent.enabled
-          || cfg.settings.integration.agent.pre_authkey_path != null;
-        message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when services.headplane.settings.integration.agent.enabled is true.
-        '';
-      }
      {
        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
        message = ''
          services.headplane.settings.oidc.headscale_api_key_path must be set
          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions; upstream config
-          validation rejects an OIDC block without it.
+          flow requires a Headscale API key to mint sessions.
+        '';
+      }
+      {
+        assertion =
+          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+        message = ''
+          services.headplane.settings.integration.agent.pre_authkey_path must be set
+          when the agent is enabled.
        '';
      }
    ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -727,6 +727,7 @@ in
    imports = [ ./hbase.nix ];
    _module.args.getPackage = pkgs: pkgs.hbase_2_5;
  };
+  headplane = runTest ./headplane.nix;
  headscale = runTest ./headscale.nix;
  healthchecks = runTest ./web-apps/healthchecks.nix;
  hedgedoc = runTest ./hedgedoc.nix;
--- a/nixos/tests/headplane.nix
+++ b/nixos/tests/headplane.nix
@ -0,0 +1,69 @@
+{ lib, pkgs, ... }:
+let
+  cookieSecret = pkgs.writeText "cookie-secret" "01234567890123456789012345678901";
+  oidcClientSecret = pkgs.writeText "oidc-client-secret" "client-secret";
+  headscaleApiKey = pkgs.writeText "headscale-api-key" "headscale-api-key";
+in
+{
+  name = "headplane";
+  meta.maintainers = with lib.maintainers; [
+    igor-ramazanov
+    stealthbadger747
+  ];
+
+  nodes.machine = {
+    services.headscale = {
+      enable = true;
+      settings = {
+        server_url = "http://127.0.0.1";
+        ip_prefixes = [ "100.64.0.0/10" ];
+        dns = {
+          base_domain = "tailnet";
+          override_local_dns = false;
+        };
+      };
+    };
+    services.headplane = {
+      enable = true;
+      settings.server = {
+        cookie_secret_path = cookieSecret;
+        cookie_secure = false;
+        # Exercise the new 0.6.2 server-level options so the test fails
+        # if their option-name -> YAML-key mapping ever regresses.
+        base_url = "http://127.0.0.1:3000";
+        cookie_max_age = 3600;
+        cookie_domain = "127.0.0.1";
+      };
+      settings.oidc = {
+        enabled = false;
+        issuer = "https://provider.example.com/issuer-url";
+        client_id = "your-client-id";
+        client_secret_path = oidcClientSecret;
+        headscale_api_key_path = headscaleApiKey;
+        redirect_uri = "http://127.0.0.1:3000/admin/oidc/callback";
+        strict_validation = true;
+        user_storage_file = "/var/lib/headplane/users.json";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("headscale.service")
+    machine.wait_for_unit("headplane.service")
+    machine.wait_until_succeeds("curl -sf http://127.0.0.1:3000/admin/login")
+
+    with subtest("rendered config contains new and deprecated-compatible options"):
+        config = machine.succeed("cat /etc/headplane/config.yaml")
+        for key in ["base_url:", "cookie_max_age:", "cookie_domain:", "redirect_uri:", "strict_validation:", "user_storage_file:"]:
+            assert key in config, f"{key} missing from rendered config"
+
+    with subtest("unsupported options are not rendered"):
+        config = machine.succeed("cat /etc/headplane/config.yaml")
+        for key in ["info_secret_path:", "subject_claims:", "allow_weak_rsa_keys:", "use_end_session:", "end_session_endpoint:", "post_logout_redirect_uri:"]:
+            assert key not in config, f"unsupported option {key} still rendered"
+
+    with subtest("session cookie is set on login page"):
+        machine.succeed("curl -sf -c /tmp/cj http://127.0.0.1:3000/admin/login")
+        machine.succeed("test -s /tmp/cj")
+  '';
+}
--- a/nixos/tests/prefect.nix
+++ b/nixos/tests/prefect.nix
@ -11,6 +11,7 @@ in
      {
        services.prefect = {
          enable = true;
+          baseUrl = "http://127.0.0.1";
        };
      };
  };
@ -18,7 +19,7 @@ in
  testScript = ''
    machine.start()
    machine.wait_for_unit("prefect-server.service")
-    machine.wait_for_open_port("${mainPort}")
+    machine.wait_for_open_port(${mainPort})
  '';

  meta = with lib.maintainers; {
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -10,10 +10,13 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "tinymist";
    publisher = "myriad-dreamin";
-    version = "0.14.16";
-    hash = "sha256-R4tlQgtQaXIT6qiBg1RqQB0Usnsj0Ijs2Bhn2J1CQq4=";
+    inherit (tinymist) version;
+    hash = "sha256-EgLt/bF0pdWyfSxwTGSv2Z0GxCZ2cJ9+n3UnTWdD1LE=";
  };

+  __structuredAttrs = true;
+  strictDeps = true;
+
  nativeBuildInputs = [
    jq
    moreutils
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-10";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "744e9e4aa560d785000a2653ee3d291716aa2c0a";
-    hash = "sha256-gCFX8mWWWsSogaBDtbVx4hL/GiNk5YlsT2HP3LNY0zs=";
+    rev = "4be8a484665fb5684ccb780ed2165018a679c622";
+    hash = "sha256-kjQcKdxUMdUc+70OPzEtDeSKy/m2e0FyPDa4XR3nHmM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -101,11 +101,11 @@
    "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
  },
  "baidubce_baiducloud": {
-    "hash": "sha256-Pdtt5XY0XbnEP8qmq0Y2xDS++IGFLBYmfR/BlUDOCbU=",
+    "hash": "sha256-MsnOxJ9FlX+rh7BGL1FkOVDfdPqwPZFDc4YeU33mqCE=",
    "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
    "owner": "baidubce",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/build-support/testers/lychee.nix
+++ b/pkgs/build-support/testers/lychee.nix
@ -37,21 +37,24 @@ let
      remap ? { },
      lychee ? deps.lychee,
      extraConfig ? { },
+      extraArgs ? [ ],
    }:
    stdenv.mkDerivation (finalAttrs: {
      name = "lychee-link-check";
+      __structuredAttrs = true;
      inherit site;
      nativeBuildInputs = [
        finalAttrs.passthru.lychee
        cacert
      ];
      configFile = (formats.toml { }).generate "lychee.toml" finalAttrs.passthru.config;
+      inherit extraArgs;

      # These can be overridden with overrideAttrs if needed.
      passthru = {
        inherit lychee remap;
        config = {
-          include_fragments = true;
+          include_fragments = "full";
        }
        // lib.optionalAttrs (finalAttrs.passthru.remap != { }) {
          remap = mapAttrsToList (
@ -68,13 +71,13 @@ let
            site=${finalAttrs.site}
            configFile=${finalAttrs.configFile}
            echo Checking links on $site
-            exec lychee --config $configFile $site "$@"
+            exec lychee --config $configFile ${lib.escapeShellArgs extraArgs} $site "$@"
          '';
        };
      };
      buildCommand = ''
        echo Checking internal links on $site
-        lychee --offline --config $configFile $site
+        lychee --offline --config $configFile "''${extraArgs[@]}" $site
        touch $out
      '';
    });
--- a/pkgs/by-name/an/anda/package.nix
+++ b/pkgs/by-name/an/anda/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libgit2,
+  openssl,
+  zlib,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "anda";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "FyraLabs";
+    repo = "anda";
+    tag = finalAttrs.version;
+    hash = "sha256-z+oYerTP0xJ4QuHtB7uH2nTVEqFsGb2FTpk2wNpMZKU=";
+  };
+
+  cargoHash = "sha256-uoDAfsHIAJsgcMljDqCHwaHvfVZYok2GsuG8y7N0NAg=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A modern Build/CI System";
+    homepage = "https://github.com/FyraLabs/anda";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ isabelroses ];
+    mainProgram = "anda";
+  };
+})
--- a/pkgs/by-name/ca/canaille/package.nix
+++ b/pkgs/by-name/ca/canaille/package.nix
@ -2,6 +2,7 @@
  lib,
  python3,
  fetchFromGitLab,
+  fetchpatch2,
  openldap,
  nixosTests,
  postgresql,
@ -22,6 +23,20 @@ python.pkgs.buildPythonApplication rec {
    hash = "sha256-hreEjMrD6mRapgrSDPRWcmqfLxfsOpK7dC8lHJkAY7Y=";
  };

+  patches = [
+    # Backport authlib 1.7 compatibility.
+    (fetchpatch2 {
+      url = "https://gitlab.com/yaal/canaille/-/commit/b356baa82109a7fdf61a8258572d199ffd3c9604.patch";
+      hash = "sha256-f5zJBtm9mJpWra5x4vr07eL9xe381lLFp3lfehc4Ypk=";
+    })
+    # Update OIDC tests for authlib 1.7 behavior.
+    (fetchpatch2 {
+      url = "https://gitlab.com/yaal/canaille/-/commit/c1b6d103ebf374cd6a21d9af8376c910c2d0d5d9.patch";
+      hash = "sha256-N9kxiKU6iwXq6cw6itZQHairSOgyDgwAVByj0NnxMqY=";
+      includes = [ "tests/oidc/*" ];
+    })
+  ];
+
  build-system = with python.pkgs; [
    hatchling
    babel
@ -79,10 +94,18 @@ python.pkgs.buildPythonApplication rec {
    export SCHEMA="${openldap}/etc/schema"
  '';

+  # Cap xdist workers; concurrent slapd fixtures race the 10s bind window.
+  dontUsePytestXdist = true;
+  pytestFlags = [ "--numprocesses=4" ];
+
  disabledTests = [
    # Tries to use DNS resolution
    "test_send_new_email_error"
    "test_send_test_email_ssl"
+    # flaky: timing-sensitive intruder lockout retry window
+    "test_intruder_lockout_fail_second_attempt_then_succeed_in_third"
+    # requires external network for logo fetch
+    "test_mail_with_unreachable_external_logo"
  ];

  optional-dependencies = with python.pkgs; {
--- a/pkgs/by-name/cp/cpu-x/package.nix
+++ b/pkgs/by-name/cp/cpu-x/package.nix
@ -18,7 +18,6 @@
  vulkan-loader,
  glfw,
  libxdmcp,
-  pcre,
  util-linux,
  libselinux,
  libsepol,
@ -70,7 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
    opencl-headers
    ocl-icd
    libxdmcp
-    pcre
    util-linux
    libselinux
    libsepol
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@ -29,7 +29,7 @@ buildDotnetGlobalTool (finalAttrs: {
    description = "Roslyn-based LSP language server for C#";
    mainProgram = "csharp-ls";
    homepage = "https://github.com/razzmatazz/csharp-language-server";
-    changelog = "https://github.com/razzmatazz/csharp-language-server/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/razzmatazz/csharp-language-server/releases/tag/${finalAttrs.version}";
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ GaetanLepage ];
--- a/pkgs/by-name/di/diebahn/package.nix
+++ b/pkgs/by-name/di/diebahn/package.nix
@ -24,18 +24,18 @@

 stdenv.mkDerivation rec {
  pname = "diebahn";
-  version = "2.9.4";
+  version = "2.10.0";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "railway";
    tag = version;
-    hash = "sha256-eGXTBrzKd7dV74wAOzZV9UnIhuR/Xtb20fIWOjfPqtM=";
+    hash = "sha256-+HqCfuolnwQR/7yTITaQDoYcFQ8m82KA/uT+aubK/UM=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-YSki/pKhaKnUqyEMibpg/j06zR6E003AzRTK795NFQo=";
+    hash = "sha256-38ON9KZbF8JHbel2zPlyPOCxgDiBxG1psQLtNib6uLM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/em/emmylua-check/package.nix
+++ b/pkgs/by-name/em/emmylua-check/package.nix
@ -11,6 +11,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "emmylua_check";
  inherit (emmylua-ls) version src cargoHash;

+  __structuredAttrs = true;
+  strictDeps = true;
+
  nativeBuildInputs = [
    pkg-config
  ];
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@ -8,6 +8,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "emmylua_doc_cli";
  inherit (emmylua-ls) version src cargoHash;

+  __structuredAttrs = true;
+  strictDeps = true;
+
  buildAndTestSubdir = "crates/emmylua_doc_cli";

  nativeInstallCheckInputs = [
--- a/pkgs/by-name/em/emmylua-ls/package.nix
+++ b/pkgs/by-name/em/emmylua-ls/package.nix
@ -18,6 +18,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-2HC2BeT4x4QGjj2tKB0yM9Bh7zsQ/S0xX/KaJvlgq2o=";
  };

+  __structuredAttrs = true;
+  strictDeps = true;
+
  nativeBuildInputs = [
    pkg-config
  ];
--- a/pkgs/by-name/ev/evtx/package.nix
+++ b/pkgs/by-name/ev/evtx/package.nix
@ -6,22 +6,29 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "evtx";
-  version = "0.10.0";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "omerbenamram";
    repo = "evtx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-v57lo1ggElGJD618ojuADspmhlZAMgmzD5DxEdtp2Ak=";
+    hash = "sha256-LVGw/u5xq+m96zSMPbQDpMnfMHq7FyQnzkmGMUMVgwM=";
  };

-  cargoHash = "sha256-qjlN10YS79S0JV2MPFB9SxPDUQnoVdqVf8kYpLt4w9g=";
+  cargoHash = "sha256-RnuWlfmzOZzOMfeKo8tv9I4elLQgpn9IbVa0EpYGnI0=";

  postPatch = ''
    # CLI tests will fail in the sandbox
    rm tests/test_cli_interactive.rs
  '';

+  checkFlags = [
+    "--skip=wevt_templates_research::wevt_dll_adtschema"
+    "--skip=wevt_templates_research::wevt_dll_lsasrv"
+    "--skip=wevt_templates_research::wevt_dll_services"
+    "--skip=wevt_templates_research::wevt_dll_wevtsvc"
+  ];
+
  meta = {
    description = "Parser for the Windows XML Event Log (EVTX) format";
    homepage = "https://github.com/omerbenamram/evtx";
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "gallery-dl";
-  version = "1.31.10";
+  version = "1.32.1";
  pyproject = true;

  src = fetchFromCodeberg {
    owner = "mikf";
    repo = "gallery-dl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-npt9jbBBHgjURmayhNgkSTQZYLC1aysDR83dLOm2Z/s=";
+    hash = "sha256-5GVwCVpoxpC32VHh1Ju50bhtvwTmZQnuqEIPFu99njQ=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@ -260,6 +260,10 @@ stdenv.mkDerivation (finalAttrs: {
    "gcore/vsis3.py"
    "gdrivers/gdalhttp.py"
    "gdrivers/wms.py"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Trace/BPT trap: 5 on macOS
+    "gcore/hdf4multidim.py"
  ];
  disabledTests = [
    # tests that attempt to make network requests
--- a/pkgs/by-name/gd/gdevelop/darwin.nix
+++ b/pkgs/by-name/gd/gdevelop/darwin.nix
@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-vCbvFeSKDujyUwvgYr974OXWU7jKUHOukffBDurS1ik=";
+    hash = "sha256-B/QyB6ZdyjIBBOOZG1nnVcXyqbPGyf56AndELzi3IZY=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/gd/gdevelop/linux.nix
+++ b/pkgs/by-name/gd/gdevelop/linux.nix
@ -13,7 +13,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-SpX28ailaBpJ/ARyUVzzZ76Mf3GbTLvNpLiGHv17GQg=";
+        hash = "sha256-IRSg7/jj8QRvVYuHiYzci/mWrQ2lW6RJy9QdZs/guFI=";
      }
    else
      throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/by-name/gd/gdevelop/package.nix
+++ b/pkgs/by-name/gd/gdevelop/package.nix
@ -4,7 +4,7 @@
  callPackage,
 }:
 let
-  version = "5.6.266";
+  version = "5.6.269";
  pname = "gdevelop";
  meta = {
    description = "Graphical Game Development Studio";
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ggml";
-  version = "0.10.1";
+  version = "0.11.0";

  __structuredAttrs = true;
  strictDeps = true;
@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "ggml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fwENyDSRq6ecq0zKC4nnpJCs9X15et+JFTQKX4gLDng=";
+    hash = "sha256-T/dacPlHo7wy1+lMYQdTPd+7exNDuKvZNeuvPDbKJJ0=";
  };

  # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
--- a/pkgs/by-name/gi/giada/package.nix
+++ b/pkgs/by-name/gi/giada/package.nix
@ -30,13 +30,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "giada";
-  version = "1.3.1";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "monocasual";
    repo = "giada";
    tag = finalAttrs.version;
-    hash = "sha256-MIGDaZLSwSIIZ2vXYuhGur0Ya1HX2yhrhafAawqU/+A=";
+    hash = "sha256-/pcBQBu2/7fkXuu2N6aLokLXNzXQf7uZI6ePnHe1r2k=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@ -56,24 +56,24 @@

 let
  pname = "gitkraken";
-  version = "12.1.0";
+  version = "12.1.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-HLo5cNkA59JBZ43Aea5W4vj2X4UDN0NtaB4VEjDQwvM=";
+      hash = "sha256-ADOoqHf0RV9MtG7MZUoSH1gzKBN4NwMq2ziiqb5cwnQ=";
    };

    x86_64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-SzGcT/2X4OXgtUqKCfE9UkKJsBCrKqj++vTdz2Rqfrc=";
+      hash = "sha256-YozqeIcfsRN+42aaX/UTSiwieDHTRvtls2d5dx9SYOk=";
    };

    aarch64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-WYhSqRR0bHB1CKGbwSYHWvaCa/GpZCO6X4q6GMLuFpI=";
+      hash = "sha256-n+V/fV5HgN6WwzTPdU+iGwI/R6f0h9ILoVHAwrOaC90=";
    };
  };

@ -88,6 +88,7 @@ let
    maintainers = with lib.maintainers; [
      nicolas-goudry
      Rishik-Y
+      TurnrDev
    ];
    mainProgram = "gitkraken";
  };
--- a/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix
+++ b/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix
@ -1,4 +1,9 @@
-{ fetchFromGitHub, libgit2, ... }:
+{
+  lib,
+  fetchFromGitHub,
+  libgit2,
+  ...
+}:

 libgit2.overrideAttrs (oldAttrs: {
  pname = "romkatv_libgit2";
@ -27,4 +32,6 @@ libgit2.overrideAttrs (oldAttrs: {
  # this is a heavy fork of the original libgit2
  # the original checkPhase does not work for this fork
  doCheck = false;
+
+  meta = lib.removeAttrs oldAttrs.meta [ "changelog" ];
 })
--- a/pkgs/by-name/go/go-exploitdb/package.nix
+++ b/pkgs/by-name/go/go-exploitdb/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "go-exploitdb";
-  version = "0.7.0";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "vulsio";
    repo = "go-exploitdb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sPBFFhQ9z5ecJMnys9U7QDaBVSEKm9V8jka19d1Eafg=";
+    hash = "sha256-xL31IvWzIaYAaHw6h8bkuLOMSWC4ogszLfHSNmYvnX0=";
  };

-  vendorHash = "sha256-qWo2PfrvO/eWIf7DjTmbi0qETOg/6jrHZ3BdfugLyGc=";
+  vendorHash = "sha256-n6vUjcU8RxNOPzZaIOXy0CZZzJjwoWxdFlE9I0TNQ6s=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "greenmask";
-  version = "0.2.19";
+  version = "0.2.20";

  src = fetchFromGitHub {
    owner = "GreenmaskIO";
    repo = "greenmask";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X/TfcXhjpY+nd5ThjY7CitvbtZMq35uwZ2yjkVYXw1k=";
+    hash = "sha256-SnljUU0GDtTlHKjbMeD7yZYh+IZM2zWuMk0wck0zJb0=";
  };

  vendorHash = "sha256-SB71/Tf9Bw8AlTYGXOaRR8sdiwx8l9wQba93p6vAbAk=";
--- a/pkgs/by-name/gu/gui-for-singbox/frontend-runtime-path.patch
+++ b/pkgs/by-name/gu/gui-for-singbox/frontend-runtime-path.patch
@ -0,0 +1,91 @@
+diff -ruN a/src/constant/kernel.ts b/src/constant/kernel.ts
+--- a/src/constant/kernel.ts
+++ b/src/constant/kernel.ts
+@@ -300,9 +300,9 @@
+       'run',
+       '--disable-color',
+       '-c',
+-      '$APP_BASE_PATH/$CORE_BASE_PATH/config.json',
+      '$CORE_BASE_PATH/config.json',
+       '-D',
+-      '$APP_BASE_PATH/$CORE_BASE_PATH',
+      '$CORE_BASE_PATH',
+     ],
+   }
+ }
+diff -ruN a/src/stores/env.ts b/src/stores/env.ts
+--- a/src/stores/env.ts
+++ b/src/stores/env.ts
+@@ -15,6 +15,7 @@
+     appName: '',
+     appVersion: '',
+     basePath: '',
+    configPath: '',
+     appPath: '',
+     os: '' as OS,
+     arch: '',
+diff -ruN a/src/stores/kernelApi.ts b/src/stores/kernelApi.ts
+--- a/src/stores/kernelApi.ts
+++ b/src/stores/kernelApi.ts
+@@ -248,8 +248,12 @@
+   const runCoreProcess = (isAlpha: boolean) => {
+     return new Promise<number | void>((resolve, reject) => {
+       let output: string
+      const coreWorkingDirectory =
+        envStore.env.os === 'linux' && envStore.env.configPath
+          ? `${envStore.env.configPath}/${CoreWorkingDirectory}`
+          : CoreWorkingDirectory
+       const pid = ExecBackground(
+-        CoreWorkingDirectory + '/' + getKernelFileName(isAlpha),
+        coreWorkingDirectory + '/' + getKernelFileName(isAlpha),
+         getKernelRuntimeArgs(isAlpha),
+         (out) => {
+           output = out
+@@ -263,8 +267,9 @@
+           reject(output)
+         },
+         {
+-          PidFile: CorePidFilePath,
+          PidFile: coreWorkingDirectory + '/pid.txt',
+           StopOutputKeyword: CoreStopOutputKeyword,
+          WorkingDirectory: envStore.env.configPath || envStore.env.basePath,
+           Env: getKernelRuntimeEnv(isAlpha),
+         },
+       ).catch((e) => reject(e))
+diff -ruN a/src/types/app.d.ts b/src/types/app.d.ts
+--- a/src/types/app.d.ts
+++ b/src/types/app.d.ts
+@@ -19,6 +19,7 @@
+   appName: string
+   appVersion: string
+   basePath: string
+  configPath: string
+   appPath: string
+   os: OS
+   arch: string
+diff -ruN a/src/utils/helper.ts b/src/utils/helper.ts
+--- a/src/utils/helper.ts
+++ b/src/utils/helper.ts
+@@ -822,9 +822,21 @@
+ export const processMagicVariables = (str: string) => {
+   const { env } = useEnvStore()
+   let result = str
+  const coreBasePath =
+    env.os === 'linux' && env.configPath
+      ? `${env.configPath}/${CoreWorkingDirectory}`
+      : CoreWorkingDirectory
+
+  if (env.os === 'linux') {
+    result = result.replaceAll('$APP_BASE_PATH/$CORE_BASE_PATH', coreBasePath)
+    result = result.replaceAll(
+      `${env.basePath}/${CoreWorkingDirectory}`,
+      coreBasePath,
+    )
+  }
+   Object.entries({
+     $APP_BASE_PATH: env.basePath,
+-    $CORE_BASE_PATH: CoreWorkingDirectory,
+    $CORE_BASE_PATH: coreBasePath,
+   }).forEach(([source, target]) => {
+     result = result.replaceAll(source, target)
+   })
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@ -5,11 +5,13 @@
  fetchFromGitHub,
  autoPatchelfHook,
  copyDesktopItems,
+  glib-networking,
  nodejs,
  pkg-config,
  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
+  wrapGAppsHook3,
  wails,
  webkitgtk_4_1,
  makeDesktopItem,
@ -18,20 +20,20 @@

 let
  pname = "gui-for-singbox";
-  version = "1.21.0";
+  version = "1.23.2";

  src = fetchFromGitHub {
    owner = "GUI-for-Cores";
    repo = "GUI.for.SingBox";
    tag = "v${version}";
-    hash = "sha256-IGsH8QHoj2CvrSEc9eIisxySXQkjPSDBXsCPOXqANVM=";
+    hash = "sha256-CEJ0yzF2smBlLgZ4EH5UWV4Pc4vA2ZH80TjoudUKWZM=";
  };

  metaCommon = {
    homepage = "https://github.com/GUI-for-Cores/GUI.for.SingBox";
    hydraPlatforms = [ ]; # https://gui-for-cores.github.io/guide/#note
    license = with lib.licenses; [ gpl3Plus ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ vollate ];
  };

  frontend = stdenv.mkDerivation (finalAttrs: {
@ -39,6 +41,8 @@ let

    sourceRoot = "${finalAttrs.src.name}/frontend";

+    patches = [ ./frontend-runtime-path.patch ];
+
    nativeBuildInputs = [
      nodejs
      pnpmConfigHook
@ -53,8 +57,8 @@ let
        sourceRoot
        ;
      pnpm = pnpm_10;
-      fetcherVersion = 2;
-      hash = "sha256-dWqwEnXPT+5N+36szm4AF1ChM9M6UJltct+EtQAofGQ=";
+      fetcherVersion = 3;
+      hash = "sha256-m9Rmc9Ww4jb2aQ+RXOwF71daZ6puspdMM/xidnk/YHs=";
    };

    buildPhase = ''
@ -85,22 +89,20 @@ buildGo126Module {

  patches = [ ./xdg-path-and-restart-patch.patch ];

-  # As we need the $out reference, we can't use `replaceVars` here.
-  postPatch = ''
-    substituteInPlace bridge/bridge.go \
-      --subst-var out
-  '';
-
-  vendorHash = "sha256-EeIxt0BzSaZh1F38btUXN9kAvj12nlqEerVgWVGkiuk=";
+  vendorHash = "sha256-9uWrctbQ+vujb1Q8zT7Bv7rVyNY1rCM577c9caOKRNo=";

  nativeBuildInputs = [
    autoPatchelfHook
    copyDesktopItems
    pkg-config
    wails
+    wrapGAppsHook3
  ];

-  buildInputs = [ webkitgtk_4_1 ];
+  buildInputs = [
+    glib-networking
+    webkitgtk_4_1
+  ];

  preBuild = ''
    cp -r ${frontend} frontend/dist
--- a/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch
+++ b/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch
@ -1,6 +1,15 @@
+diff -ruN a/bridge/bridge.go b/bridge/bridge.go
 --- a/bridge/bridge.go
 +++ b/bridge/bridge.go
-@@ -93,7 +93,10 @@
+@@ -50,6 +50,7 @@
+ 
+ 	Env.BasePath = filepath.ToSlash(filepath.Dir(exePath))
+ 	Env.AppName = filepath.Base(exePath)
+	Env.ConfigPath = filepath.ToSlash(GetConfigPath())
+ 
+ 	if slices.Contains(os.Args, "tasksch") {
+ 		Env.FromTaskSch = true
+@@ -93,7 +94,10 @@
 
 func (a *App) RestartApp() FlagResult {
 	log.Printf("RestartApp")
@ -12,3 +21,64 @@
 
 	cmd := exec.Command(exePath)
 	SetCmdWindowHidden(cmd)
+@@ -116,6 +120,7 @@
+ 		AppName:      Env.AppName,
+ 		AppVersion:   Env.AppVersion,
+ 		BasePath:     Env.BasePath,
+		ConfigPath:   Env.ConfigPath,
+ 		OS:           Env.OS,
+ 		ARCH:         Env.ARCH,
+ 		IsPrivileged: Env.IsPrivileged,
+@@ -258,7 +263,7 @@
+ }
+ 
+ func loadConfig() {
+-	b, err := os.ReadFile(Env.BasePath + "/data/user.yaml")
+	b, err := os.ReadFile(GetPath("data/user.yaml"))
+ 	if err == nil {
+ 		yaml.Unmarshal(b, &Config)
+ 	}
+diff -ruN a/bridge/types.go b/bridge/types.go
+--- a/bridge/types.go
+++ b/bridge/types.go
+@@ -21,6 +21,7 @@
+ 	AppName      string `json:"appName"`
+ 	AppVersion   string `json:"appVersion"`
+ 	BasePath     string `json:"basePath"`
+	ConfigPath   string `json:"configPath"`
+ 	OS           string `json:"os"`
+ 	ARCH         string `json:"arch"`
+ 	IsPrivileged bool   `json:"isPrivileged"`
+diff -ruN a/bridge/utils.go b/bridge/utils.go
+--- a/bridge/utils.go
+++ b/bridge/utils.go
+@@ -13,7 +13,29 @@
+ 	"golang.org/x/text/encoding/simplifiedchinese"
+ )
+ 
+func GetConfigPath() string {
+	if Env.OS == "linux" {
+		if xdgConfigHome := os.Getenv("XDG_CONFIG_HOME"); xdgConfigHome != "" {
+			return filepath.Join(xdgConfigHome, "GUI.for.SingBox")
+		}
+		if userConfigDir, err := os.UserConfigDir(); err == nil {
+			return filepath.Join(userConfigDir, "GUI.for.SingBox")
+		}
+	}
+
+	return Env.BasePath
+}
+
+ func GetPath(path string) string {
+	if Env.OS == "linux" && !filepath.IsAbs(path) {
+		cleanPath := filepath.ToSlash(filepath.Clean(path))
+		if cleanPath == "data" {
+			path = filepath.Join(GetConfigPath(), "data")
+		} else if strings.HasPrefix(cleanPath, "data/") {
+			path = filepath.Join(GetConfigPath(), cleanPath)
+		}
+	}
+
+ 	if !filepath.IsAbs(path) {
+ 		path = filepath.Join(Env.BasePath, path)
+ 	}
--- a/pkgs/by-name/he/headplane-agent/package.nix
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@ -7,13 +7,13 @@ buildGoModule (finalAttrs: {
  pname = "headplane-agent";
  __structuredAttrs = true;
  # Note, if you are upgrading this, you should upgrade headplane at the same time
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "tale";
    repo = "headplane";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
  };

  vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
--- a/pkgs/by-name/he/headplane/package.nix
+++ b/pkgs/by-name/he/headplane/package.nix
@ -3,8 +3,10 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  git,
+  headplane-agent,
  lib,
  makeWrapper,
+  nixosTests,
  nodejs_22,
  pnpm_10,
  pnpmConfigHook,
@ -13,13 +15,13 @@
 let
  pname = "headplane";
  # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
-  version = "0.6.1";
-  pnpmDepsHash = "sha256-AYfEL3HSRg87I+Y0fkLthFSDWgHTg5u0DBpzn6KBn1Q=";
+  version = "0.6.2";
+  pnpmDepsHash = "sha256-CsmffCo9Se/4oiOqbcuhjPMuGmR2GL+YfcyWgzBTAh8=";
  src = fetchFromGitHub {
    owner = "tale";
    repo = "headplane";
    tag = "v${version}";
-    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
  };

  headplaneSshWasm = buildGoModule {
@ -104,6 +106,11 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    agent = headplane-agent;
+    tests = { inherit (nixosTests) headplane; };
+  };
+
  meta = {
    description = "Feature-complete Web UI for Headscale";
    homepage = "https://github.com/tale/headplane";
--- a/pkgs/by-name/ht/html2pdf/package.nix
+++ b/pkgs/by-name/ht/html2pdf/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "html2pdf";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "ilaborie";
    repo = "html2pdf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Z1fb7pDjawMIhJgl4ao2VoV6zpfcGy/48Dt7JtIxgJo=";
+    hash = "sha256-JtBgM95BvCJQwF89+PXkCEdrFDlD+hdceTtI5t6KnUQ=";
  };

-  cargoHash = "sha256-T5A2b7Qcg8dQKndaD8P5RAutBZeINOqIBUHR2VDOeo0=";
+  cargoHash = "sha256-65do3FDEpGeNX/u9KS+F5yigwBfgVNUBhZImjbWFydU=";

  # Avoiding "rustfmt not found" error in auto_generate_cdp.
  # ref: https://github.com/mdrokz/auto_generate_cdp/pull/8
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@ -194,7 +194,7 @@ let
    }:
    mkDict rec {
      inherit src srcFileName dictFileName;
-      version = "2020.12.07";
+      version = "2026.02.25";
      pname = "hunspell-dict-${shortName}-wordlist";
      srcReadmeFile = "README_" + srcFileName + ".txt";
      readmeFile = "README_" + dictFileName + ".txt";
@ -376,8 +376,8 @@ rec {
    srcFileName = "en_US";
    dictFileName = "en_US";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_US-2020.12.07.zip";
-      hash = "sha256-YWNIrWRacW2RyKZkUGXnEPFendo//vYM337IpOJ5da8=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_US-2026.02.25.zip";
+      hash = "sha256-rI5zMQ6VHYjFLCzyulTOrKNPhIaoFjCsinXcX5MRefk=";
    };
  };

@ -388,8 +388,8 @@ rec {
    srcFileName = "en_US-large";
    dictFileName = "en_US";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_US-large-2020.12.07.zip";
-      hash = "sha256-WpNhcxL/t8zMVMj9ij5nEusOnNSmnx01i4LrTTUgcrc=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_US-large-2026.02.25.zip";
+      hash = "sha256-BqtaKhLCkDPxAJiNOwpeU9ytQL8kc8y3gnBhnR2pkyE=";
    };
  };

@ -400,8 +400,8 @@ rec {
    srcFileName = "en_CA";
    dictFileName = "en_CA";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_CA-2020.12.07.zip";
-      hash = "sha256-/2uR5O12g0jGGufDJuhIBZgQ+kOl1gHfaz9FrZwO9b8=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_CA-2026.02.25.zip";
+      hash = "sha256-Kf4AUECMNWFPIr6oQzi0JWliyJ9e8l2sUDgyW8uG9CQ=";
    };
  };

@ -412,8 +412,8 @@ rec {
    srcFileName = "en_CA-large";
    dictFileName = "en_CA";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_CA-large-2020.12.07.zip";
-      hash = "sha256-RjRIkIb2QDeveqpLyo1s4X90QrZiYylW5d1MCU+Hvuo=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_CA-large-2026.02.25.zip";
+      hash = "sha256-tLe/SniF3hw1+hs6poMXIJr6WPBNYOigfhJGk0hcWeM=";
    };
  };

@ -424,8 +424,8 @@ rec {
    srcFileName = "en_AU";
    dictFileName = "en_AU";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2020.12.07/hunspell-en_AU-2020.12.07.zip";
-      hash = "sha256-3CBVfEiuGXl4Tnn65vll6ZnI2y6aD4RjSOcAV/znglQ=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_AU-2026.02.25.zip";
+      hash = "sha256-+FRxWTuXRPZCmMAtB/ti1Ykmv4H7XkVS4rrGRb+kAeA=";
    };
  };

@ -436,8 +436,8 @@ rec {
    srcFileName = "en_AU-large";
    dictFileName = "en_AU";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_AU-large-2020.12.07.zip";
-      hash = "sha256-SW5HeuewGMe+Ng5gqqL5jn8cl8eJLfk7JFcRJCTGHjE=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_AU-large-2026.02.25.zip";
+      hash = "sha256-RqJliD0dAciJtxc7ocq64MqRWqQD1qL5PO5MxmEIfbQ=";
    };
  };

@ -448,8 +448,8 @@ rec {
    srcFileName = "en_GB-ise";
    dictFileName = "en_GB";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-ise-2020.12.07.zip";
-      hash = "sha256-LO1LLsnRiMO1QNu3W1FD9luZDa8XQ3dYcm/x+rXwGtM=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-ise-2026.02.25.zip";
+      hash = "sha256-1vu5GueCTFL7AvdNe8LNkJLxMPrsYPQjJqWUN/pyR6M=";
    };
  };

@ -460,8 +460,8 @@ rec {
    srcFileName = "en_GB-ize";
    dictFileName = "en_GB";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-ize-2020.12.07.zip";
-      hash = "sha256-hpt0nsmAW4fNBfQzB/IJmGUTMbWqWwRQZBOvDC3y8jE=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-ize-2026.02.25.zip";
+      hash = "sha256-xb3ZL8HiHadQOTn+QTnzbyjwHBisNeL8kLUmobe/sJk=";
    };
  };

@ -472,8 +472,8 @@ rec {
    srcFileName = "en_GB-large";
    dictFileName = "en_GB";
    src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-large-2020.12.07.zip";
-      hash = "sha256-+GvrdyKMc3yMaUaP/E6gZ1EocieIabmKXT7BjxJRB70=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-large-2026.02.25.zip";
+      hash = "sha256-cEpJQ4o6nU8RzXbbQzprIwuc6HcO4T+ihwAFLEUX3cE=";
    };
  };

--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "digital-dance";
-  version = "1.1.3-unstable-2026-04-29";
+  version = "1.1.3-unstable-2026-05-09";

  src = fetchFromCodeberg {
    owner = "JNero";
    repo = "Digital-Dance-ITGMania";
-    rev = "a26bc9f19be8b899ed5af35c01cdd21fe48ec94f";
-    hash = "sha256-4A87hM+yG6mKfYdC2fZ5lhSDVVH4FPtXStkjC95CcLs=";
+    rev = "aca637dc8f2b47a254bead472da6129f28fa55fd";
+    hash = "sha256-uKweTqF4q0YsOIOpEi5v+N60YvctDF9stcP+GYlUuO4=";
  };

  postInstall = ''
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "itg3encore";
-  version = "0-unstable-2026-04-29";
+  version = "0-unstable-2026-05-10";

  src = fetchFromGitHub {
    owner = "DarkBahamut162";
    repo = "itg3encore";
-    rev = "87ef7392f84acf3c05c03749714a8f9cd893a34e";
-    hash = "sha256-4wHDin/Nphd/BLP4HYsRQDZDWYhMRddv1D44q6Yvhto=";
+    rev = "92fa3cb3234e466891606a047e4d2d104839581b";
+    hash = "sha256-tnb9uGu4VaXlNh9QRbPtCKHS2GWmfFBOMe8/uW9hA0Q=";
  };

  postInstall = ''
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@ -22,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libgit2";
-  version = "1.9.2";
+  version = "1.9.3";
  # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib

  outputs = [
@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "libgit2";
    repo = "libgit2";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-TCeEh8DpVoxpF/HkahxM3ONDjawAkIiMo6S7ogG3fLg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nJrRdPs86oGNL4W2CJb16oSUgfzYr9A2i5sw9BAehME=";
  };

  cmakeFlags = [
@ -96,6 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
+    changelog = "https://github.com/libgit2/libgit2/releases/tag/${finalAttrs.src.tag}";
    description = "Linkable library implementation of Git that you can use in your application";
    mainProgram = "git2";
    homepage = "https://libgit2.org/";
--- a/pkgs/by-name/li/lix-diff/package.nix
+++ b/pkgs/by-name/li/lix-diff/package.nix
@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lix-diff";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "tgirlcloud";
    repo = "lix-diff";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-x2Ec3Pm80IvTzl3gw0mwWRbW1nLZ2V70KegahSDNwH0=";
+    hash = "sha256-mURA7fZ9RAhVtOx+gnEeJI48tyvi+zbKE+xUs5UMPY4=";
  };

-  cargoHash = "sha256-1HjmS5wvlX4gGf6AZQnN+37Y3Nf8HVSOHWG2kZCVg1Y=";
+  cargoHash = "sha256-yOVJjn/DaHDsBeSMKJ0bmav+I5JLa9HqII5RKFpc5Hw=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lux-cli";

-  version = "0.28.6";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "lumen-oss";
    repo = "lux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AzERusMBjc1pQbG1Sbu9LijfVIaWhXetm0LbGTmDYx8=";
+    hash = "sha256-jQkqWngHLHf0myzy7PjiNQFEI0/cq9FZQNst3BzIexs=";
  };

  buildAndTestSubdir = "lux-cli";

-  cargoHash = "sha256-JbSTMFRbj4y3DeTF54eRXPTRQGOg2A8bK/coFEWbOgs=";
+  cargoHash = "sha256-+geQjo/hvx+ZtF2n2bWfQZMbAI6zPgbDAVH2TZbrKQc=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@ -16,7 +16,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lychee";
-  version = "0.23.0";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = "lycheeverse";
@ -31,10 +31,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
          '("cargo:rustc-env=GIT_DATE={}", "'$GIT_DATE'")'
      rm -rf $out/.git
    '';
-    hash = "sha256-Rfdys16a4N6B3NsmPsB3OpKjLGElFYvd4UtiRipy8iQ=";
+    hash = "sha256-lknj0uTIWYwDm3PA/Q8paVxRn+B9qvfllYUjnp7I4jI=";
  };

-  cargoHash = "sha256-5KL/PmBSU8xkOE9/w7uUBkJSOBPsj3Z4o/2VmzA/f3Q=";
+  cargoHash = "sha256-ivLx48qbagjw5zGkYC+ygK83p8q110iEn2YEfUjTFHs=";

  nativeBuildInputs = [
    installShellFiles
@ -45,6 +45,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
  postFixup = lib.optionalString canRun ''
    ${lychee} --generate man > lychee.1
    installManPage lychee.1
+
+    installShellCompletion --cmd lychee \
+      --bash <(${lychee} --generate complete-bash) \
+      --fish <(${lychee} --generate complete-fish) \
+      --zsh <(${lychee} --generate complete-zsh)
  '';

  cargoTestFlags = [
--- a/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix
+++ b/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix
@ -2,6 +2,7 @@
  runCommand,
  testers,
  emptyDirectory,
+  jq,
 }:
 let
  sitePkg = runCommand "site" { } ''
@ -19,14 +20,30 @@ let
      # cannot check URI: InvalidUrlRemap("The remapping pattern must produce a valid URL, but it is not: /nix/store/4d0ix...empty-directory/foo
      "https://example.com" = emptyDirectory;
    };
+    extraArgs = [
+      "--format"
+      "json"
+      "--output"
+      "${placeholder "out"}"
+    ];
  };

  failure = testers.testBuildFailure check;
 in
-runCommand "link-check-fail" { inherit failure; } ''
-  # The details of the message might change, but we have to make sure the
-  # correct error is reported, so that we know it's not something else that
-  # went wrong.
-  grep 'empty-directory/foo.*Cannot find file' $failure/testBuildFailure.log >/dev/null
-  touch $out
-''
+runCommand "link-check-fail"
+  {
+    nativeBuildInputs = [ jq ];
+    inherit failure;
+  }
+  ''
+    # The details of the message might change, but we have to make sure the
+    # correct error is reported, so that we know it's not something else that
+    # went wrong.
+    jq -e '.error_map | to_entries[] | .value[] | select(.url | test("empty-directory/foo")) | .status.text | test("File not found")' $failure/result > /dev/null || {
+      echo Lychee output:
+      jq . $failure/result
+      echo 'Did not find expected error in JSON output. Adjust test if behavior is acceptable. It should find the broken link to non-existent `foo`.'
+      exit 1
+    }
+    touch $out
+  ''
--- a/pkgs/by-name/ly/lychee/tests/network.nix
+++ b/pkgs/by-name/ly/lychee/tests/network.nix
@ -14,10 +14,21 @@ let
  check = config.node.pkgs.testers.lycheeLinkCheck {
    site = sitePkg;
  };
+  checkJson = config.node.pkgs.testers.lycheeLinkCheck {
+    site = sitePkg;
+    extraArgs = [
+      "--format"
+      "json"
+    ];
+  };
 in
 {
  name = "testers-lychee-link-check-run";
-  nodes.client = { ... }: { };
+  nodes.client =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+    };
  nodes.example = {
    networking.firewall.allowedTCPPorts = [ 80 ];
    services.nginx = {
@ -44,28 +55,34 @@ in
        curl --fail -v http://example
    """)

-    # FAILURE CASE
+    # TEST CASES

-    client.succeed("""
-        exec 1>&2
-        r=0
-        ${lib.getExe check.online} || {
-          r=$?
-        }
-        if [[ $r -ne 2 ]]; then
-            echo "lycheeLinkCheck unexpected exit code $r"
-            exit 1
-        fi
-    """)
+    with subtest("online check detects broken links"):
+        client.succeed("""
+            exec 1>&2
+            r=0
+            ${lib.getExe check.online} || {
+              r=$?
+            }
+            if [[ $r -ne 2 ]]; then
+                echo "lycheeLinkCheck unexpected exit code $r"
+                exit 1
+            fi
+        """)

-    # SUCCESS CASE
+    with subtest("online check succeeds when links are fixed"):
+        example.succeed("""
+            echo '<h1>foo</h1>' > /var/www/example/foo.html
+        """)

-    example.succeed("""
-        echo '<h1>foo</h1>' > /var/www/example/foo.html
-    """)
+        client.succeed("""
+            ${lib.getExe check.online}
+        """)

-    client.succeed("""
-        ${lib.getExe check.online}
-    """)
+    with subtest("extraArgs are passed to the online wrapper"):
+        client.succeed("""
+            ${lib.getExe checkJson.online} --output /tmp/lychee.json
+            jq -e .total /tmp/lychee.json
+        """)
  '';
 }
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "misconfig-mapper";
-  version = "1.15.5";
+  version = "1.16.0";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FZN/FGp2hQWaO0OnRzSmHx10Wb2rvhC6MpX/q97N/uQ=";
+    hash = "sha256-WHVNUdzYDC3vV1UDYSAHkwWUlfBvMg1OCh/BwE7shWE=";
  };

-  vendorHash = "sha256-eQetkCrVlYtiXezFzj35TnYAt6tntzUuJHqRvWEkuC4=";
+  vendorHash = "sha256-jM+td4OUDK7Z4zZy/w0foupQMYpFhOTIefSUoovgEeE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ne/nerdctl/package.nix
+++ b/pkgs/by-name/ne/nerdctl/package.nix
@ -14,16 +14,16 @@

 buildGoModule (finalAttrs: {
  pname = "nerdctl";
-  version = "2.2.2";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "nerdctl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Xf4Nit8egVYk5EhPrazgu/xC8LvKT5U2eLIwUjqvFEs=";
+    hash = "sha256-DCAgxqjJruoSTTZqWKOrz/6ZbOubGi4B7tdf2Kg/UGc=";
  };

-  vendorHash = "sha256-f/fm4lrt4d1kjwHAyVwkyqalApozOAlAT8WQ/qMtGdI=";
+  vendorHash = "sha256-gOpzsPq0w+85KKa3QMKb+rWuRSfbCFECfHB3PadJNE8=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/nq/nqptp/package.nix
+++ b/pkgs/by-name/nq/nqptp/package.nix
@ -8,14 +8,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.2.6";
+  version = "1.2.7";
  pname = "nqptp";

  src = fetchFromGitHub {
    owner = "mikebrady";
    repo = "nqptp";
    tag = finalAttrs.version;
-    hash = "sha256-bU7eTNnPhBA+XTW0SCps/iUCGuxObnv72/Lm+yKEgao=";
+    hash = "sha256-A87sIwn8NgfUGiCsCq/iiwcqnkfZtLbE9LrjLiWiiWc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@ -26,14 +26,14 @@ in

 py.pkgs.buildPythonApplication (finalAttrs: {
  pname = "oci-cli";
-  version = "3.81.0";
+  version = "3.81.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "oci-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8fZxGvgk46BDeNraEfzA4V/Lptk4QpjlZ+2mvfsWMb0=";
+    hash = "sha256-c4aWIgJ3LJ2a+e6mXJif112oIhEmU//zPYQQguOmqhU=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
      ];
      text = ''
        version="$(curl -s https://updater.osmium.chat/alpha-linux.yml | yq .version)"
-        update-source-version osmium "${version}"
+        update-source-version osmium "$version"
      '';
    });
  };
--- a/pkgs/by-name/pa/panache/package.nix
+++ b/pkgs/by-name/pa/panache/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "panache";
-  version = "2.41.1";
+  version = "2.45.0";

  src = fetchFromGitHub {
    owner = "jolars";
    repo = "panache";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-creORKgAByvWK6yH1WT/zRlFKStY85eUq8WJottaUCM=";
+    hash = "sha256-IBWZmDqbDt4zf2wL6hVhWGq+JAwte+NO90jUvVtr/YE=";
  };

-  cargoHash = "sha256-xReCjJ1eLdzw/LyLVU62RKSyjBBrenCR4YTmt52C2ls=";
+  cargoHash = "sha256-vXSVNPc4h3yAAdWxVg9/7Fkxq6PXEjDcWGjFj6FREEI=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/pr/prefect/package.nix
+++ b/pkgs/by-name/pr/prefect/package.nix
@ -1,207 +1 @@
-{
-  lib,
-  python3Packages,
-  fetchPypi,
-  nixosTests,
-  nix-update-script,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "prefect";
-  version = "3.5.0";
-  pyproject = true;
-
-  # Trying to install from source is challenging
-  # the packaging is using versioningit and looking for
-  # .git directory
-  # Source will be missing sdist, uv.lock, ui artefacts ...
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-BazzO+gR/mLcx+tlysPMJzcqmctUU0LSYL0YMZMyVrg=";
-  };
-
-  pythonRelaxDeps = [
-    "websockets"
-    "typer"
-  ];
-
-  build-system = with python3Packages; [
-    hatchling
-    versioningit
-  ];
-
-  dependencies =
-    with python3Packages;
-    [
-      aiosqlite
-      alembic
-      apprise
-      asyncpg
-      click
-      cryptography
-      dateparser
-      docker
-      graphviz
-      jinja2
-      jinja2-humanize-extension
-      humanize
-      pytz
-      readchar
-      sqlalchemy
-      typer
-      # client dependencies
-      anyio
-      asgi-lifespan
-      cachetools
-      cloudpickle
-      coolname
-      exceptiongroup
-      fastapi
-      fsspec
-      # graphviz already included
-      griffe
-      httpcore
-      httpx
-      jsonpatch
-      jsonschema
-      opentelemetry-api
-      orjson
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      prometheus-client
-      pydantic
-      pydantic-core
-      pydantic-extra-types
-      pydantic-settings
-      python-dateutil
-      python-slugify
-      python-socks
-      pyyaml
-      rfc3339-validator
-      rich
-      ruamel-yaml
-      semver
-      sniffio
-      toml
-      typing-extensions
-      ujson
-      uvicorn
-      websockets
-      whenever
-      uv
-      semver
-    ]
-    ++ sqlalchemy.optional-dependencies.asyncio
-    ++ httpx.optional-dependencies.http2;
-
-  optional-dependencies = with python3Packages; {
-    aws = [
-      # prefect-aws
-    ];
-    azure = [
-      # prefect-azure
-    ];
-    bitbucket = [
-      # prefect-bitbucket
-    ];
-    dask = [
-      # prefect-dask
-    ];
-    databricks = [
-      # prefect-databricks
-    ];
-    dbt = [
-      # prefect-dbt
-    ];
-    docker = [
-      # prefect-docker
-    ];
-    email = [
-      # prefect-email
-    ];
-    gcp = [
-      # prefect-gcp
-    ];
-    github = [
-      # prefect-github
-    ];
-    gitlab = [
-      # prefect-gitlab
-    ];
-    kubernetes = [
-      # prefect-kubernetes
-    ];
-    otel = [
-      opentelemetry-distro
-      opentelemetry-exporter-otlp
-      opentelemetry-instrumentation
-      opentelemetry-instrumentation-logging
-      opentelemetry-test-utils
-    ];
-    ray = [
-      # prefect-ray
-    ];
-    redis = [
-      # prefect-redis
-    ];
-    shell = [
-      # prefect-shell
-    ];
-    slack = [
-      # prefect-slack
-    ];
-    snowflake = [
-      # prefect-snowflake
-    ];
-    sqlalchemy = [
-      # prefect-sqlalchemy
-    ];
-  };
-
-  makeWrapperArgs = [
-    # Add the installed directories to the python path so the worker can find them
-    "--prefix PYTHONPATH : ${python3Packages.makePythonPath dependencies}"
-    "--prefix PYTHONPATH : $out/${python3Packages.python.sitePackages}"
-  ];
-
-  passthru.tests = {
-    inherit (nixosTests) prefect;
-
-    updateScript = nix-update-script {
-      extraArgs = [
-        # avoid pre‐releases
-        "--version-regex"
-        "^(\\d+\\.\\d+\\.\\d+)$"
-      ];
-    };
-  };
-
-  # Tests are not included in the pypi source
-  doCheck = false;
-  # nativeCheckInputs = (
-  #   with python3Packages;
-  #   [
-  #     pytestCheckHook
-  #     pytest-asyncio
-  #     pytest-cov
-  #     pytest-env
-  #     # pytest-flakefinder
-  #     pytest-mypy-plugins
-  #     pytest-timeout
-  #     pytest-xdist
-  #   ]
-  # );
-
-  meta = {
-    description = "Workflow orchestration framework for building resilient data pipelines in Python";
-    homepage = "https://github.com/PrefectHQ/prefect";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      happysalada
-      mrmebelman
-    ];
-    mainProgram = "prefect";
-  };
-}
+{ python3Packages }: python3Packages.toPythonApplication python3Packages.prefect
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2026-04-30";
+  version = "0-unstable-2026-05-05";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "6a1339b59a0ba5823c812f96d8fcc44c7691660f";
-    hash = "sha256-bMPdMJbxzk+/DYgU4lminLjuWEB5nhvxFU9FlO3UcqE=";
+    rev = "3137db4ec2c85749cfc57bf05b460529d4e52a94";
+    hash = "sha256-PHtt31DGvOWgutgqbBcOr2vjdvnjaJmCTpRbHtx8MJw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/so/sone/package.nix
+++ b/pkgs/by-name/so/sone/package.nix
@ -22,21 +22,21 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sone";
-  version = "0.14.1";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "lullabyX";
    repo = "sone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8vdpEjo2UP3vh/PL8+lhLPDfuHeI9kI2/AQvVsWlR1w=";
+    hash = "sha256-QxA9ab/BVmYvsZb++ykWZ80TDpIMWQb5LJazdUab+pM=";
  };

-  cargoHash = "sha256-zsEO/YnipPNm7TSWcM3tQ+oOF8M5VK5BiUMhsvPcGwQ=";
+  cargoHash = "sha256-zWW/x92/HAa6AsXe0fIQmQrGKtsR2sX/vyG7uwsl3Bc=";

  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
    inherit (finalAttrs) src;
-    hash = "sha256-EOmoryKKWCttpOpIAOpdIz7yOA5hm/Hg1WFbcXWr5tc=";
+    hash = "sha256-MORNCIA/LC6DTNUqXvKk4hHnoKDZEC+poANcNOHQPyM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@ -12,16 +12,16 @@

 buildGoModule (finalAttrs: {
  pname = "stackit-cli";
-  version = "0.61.0";
+  version = "0.62.0";

  src = fetchFromGitHub {
    owner = "stackitcloud";
    repo = "stackit-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-kuo0Fj/LgkbTLp+F6xvPUOS5vabjigwX4fVWLQVwO2I=";
+    hash = "sha256-vgG2F2fI8whwAoHKU5f+LEeI+mmJ2oPzObwtmKSrsoo=";
  };

-  vendorHash = "sha256-NYvqQVDqSV5wyQGEkoAHnT0i+iNF6DKIYIwyiYY5G6M=";
+  vendorHash = "sha256-7Zxxom+RJJ4cjQ8Knl/96MUMRrQp3P4wQjSNUccLTYw=";

  subPackages = [ "." ];

--- a/pkgs/by-name/ta/tasks/package.nix
+++ b/pkgs/by-name/ta/tasks/package.nix
@ -13,16 +13,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tasks";
-  version = "0.2.0";
+  version = "0.2.4";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "tasks";
    tag = finalAttrs.version;
-    hash = "sha256-R8wXIw9Gn4uyLoXxyjp/bcK8vK7NkG/chcHe8LtTvo8=";
+    hash = "sha256-u8TYKXFbrF2fseMNGNOBAkgCA53af5gi1PDKS2FIE5I=";
  };

-  cargoHash = "sha256-iJutA18TvsWJceacfhzfEQa5zaQBMVC7fmtF1uPN3sQ=";
+  cargoHash = "sha256-96uk8tQgvDbgZTC0ypzWRmWNToCUGnVefPyhI69nxxs=";

  nativeBuildInputs = [
    libcosmicAppHook
--- a/pkgs/by-name/tf/tfmigrate/package.nix
+++ b/pkgs/by-name/tf/tfmigrate/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "tfmigrate";
-  version = "0.4.4";
+  version = "0.4.5";

  src = fetchFromGitHub {
    owner = "minamijoyo";
    repo = "tfmigrate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-633b7VZ0/JNWuBh0C9CtbG5XdgTD2zLuotBbgv0a2e8=";
+    hash = "sha256-NXsAwJTIVlgSC+RdumXsfHIjXfNm37PjLrEWaf+85aM=";
  };

  vendorHash = "sha256-TqZi5NZ+4eSzq98/ZM4Gab7Sud7bz1DNHrp5nGaGHDE=";
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@ -10,14 +10,14 @@ let
  platform =
    if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
  hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-TkgrZQNlgB039sVlqOST0oEzwpk7d04ujrw5GM+Hemo=";
-    "x86_64-linux" = "sha256-tzN5BB1jNAuQi6cLEoRylflAJZgd7WhQ8QV+bx276jM=";
-    "aarch64-linux" = "sha256-Ny+N9k6J6++yhBGeMVbIG6Mh5H048Lf+2iCja/2pVOU=";
+    "universal-macos" = "sha256-1Zn/JeRCwLH1kC+sZGNdez2Um6VZgEvCf4BwbWTfMSs=";
+    "x86_64-linux" = "sha256-T2CjzbpxfOPYgJpAqOqcID1pvGW7FJFpRk6/hdgKiOk=";
+    "aarch64-linux" = "sha256-Y4UsPOno5bfWGHYh2BwV2L9xLiFjv/wuVAW+FSevuV8=";
  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tigerbeetle";
-  version = "0.17.2";
+  version = "0.17.3";

  src = fetchzip {
    url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@ -15,16 +15,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.14.16";
+  version = "0.14.18";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lcv/yAH+4LlzaFhTk5GA3WHxm8gHWO+7560zolTCIIM=";
+    hash = "sha256-udA5W6AhK11zuFmfedDueRY01Rr2ZXmbN5DrIcuvbVo=";
  };

-  cargoHash = "sha256-D9G08K2rp0uBFz+1LktdH8thGNpzaTD2QCCV2P3Hl9M=";
+  cargoHash = "sha256-L+U47ZYtU51wRjDD1lMyxoYaKZIUnyuZ0C885YnBauA=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@ -17,14 +17,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.34";
+  version = "0.0.35";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-pLe25JRy6xrFVuNCQKwp9k3Mvc4pfYKF6Xi17yMgSzw=";
+    hash = "sha256-ce3v/ZUlMNMGlikWSriGybScUrRharFswq5Z47dTtKY=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@ -38,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-A/oJeFIY/+Pu9jYp3hwGwkSAXfF0VLTHKGP48wsnheo=";
+  cargoHash = "sha256-9/4+cK7BdJbXQKK7xC9MMfqARlivbuyYZ8j02srakxU=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ];
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@ -10,20 +10,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wayscriber";
-  version = "0.9.16";
+  version = "0.9.17";

  src = fetchFromGitHub {
    owner = "devmobasa";
    repo = "wayscriber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gfWvepANARgXXdpTRdAr9zZNfAxwi9icEbvP3AMFsUI=";
+    hash = "sha256-ylvZ+U8et9McvZrHsJFLoWWAtruQnKMk/5lg4uCw/rg=";
  };
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    pango
    libxkbcommon
  ];
-  cargoHash = "sha256-SqTWkbuW2Dy/e5oCr7G7m/T5/kLpf+ZPKxXKPDeRX9U=";
+  cargoHash = "sha256-/q4ux2MXDfrqbUfO1M2lykpDl03MTnVS4ottxSgDFEQ=";
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@ -74,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
    "LIBDIR=$(lib)/lib"
  ];

+  enableParallelBuilding = true;
+
  postInstall = ''
    # Note that even the static libxdp would refer to BPF_OBJECT_DIR ?=$(LIBDIR)/bpf
    rm "$lib"/lib/*.a
--- a/pkgs/by-name/zf/zfs-replicate/package.nix
+++ b/pkgs/by-name/zf/zfs-replicate/package.nix
@ -8,14 +8,15 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "zfs_replicate";
-  version = "4.0.0";
+  version = "4.1.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "alunduil";
    repo = "zfs-replicate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VajMSoFZ4SQXpuF1Lo6S9IhxvspCfUwpNw5zg16uA3M=";
+    hash = "sha256-7UoFx2XtadsQqavR5BTwbylaDksWSRxy5o+2hCOzfBw=";
  };

  # For compression to work, both local and remote systems must have lz4 installed.
@ -42,8 +43,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    pytestCheckHook
  ];

-  doCheck = true;
-
  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
    # AssertionError: Expected SystemExit or FileNotFoundError
    "zfs_test/replicate_test/cli_test/main_test.py"
--- a/pkgs/by-name/zl/zlint/package.nix
+++ b/pkgs/by-name/zl/zlint/package.nix
@ -7,18 +7,18 @@

 buildGoModule (finalAttrs: {
  pname = "zlint";
-  version = "3.6.8";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "zmap";
    repo = "zlint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mi7ySXVqnL/LVi4YS1r4hBcM/JrjThJEkw3+1k1vjRQ=";
+    hash = "sha256-e12GMbUsZFm0yPD4yh+kuK47YKvDC+VcSfth2radyUk=";
  };

  modRoot = "v3";

-  vendorHash = "sha256-AdJxcJ/qjY6lzoK4PGNjR+7lYAypgCOk6Nt5sqP+ayA=";
+  vendorHash = "sha256-7g/97DjtXOsWFguWeYi7jLe7xeW1sfY0BrQxYbtIZyM=";

  excludedPackages = [
    "cmd/genTestCerts"
--- a/pkgs/by-name/zs/zsh-completion-sync/package.nix
+++ b/pkgs/by-name/zs/zsh-completion-sync/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "zsh-completion-sync";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "BronzeDeer";
    repo = "zsh-completion-sync";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-GTW4nLVW1/09aXNnZJuKs12CoalzWGKB79VsQ2a2Av4=";
+    sha256 = "sha256-GMZ0W8d0Qd5EhrwA/SkeOqDzoUchxDermcTR0iKYP8M=";
  };

  strictDeps = true;
--- a/pkgs/development/coq-modules/trakt/default.nix
+++ b/pkgs/development/coq-modules/trakt/default.nix
@ -10,6 +10,7 @@
 mkCoqDerivation {
  pname = "trakt";
  owner = "ecranceMERCE";
+  opam-name = "rocq-trakt";

  release."1.0".sha256 = "sha256-Qhw5fWFYxUFO2kIWWz/og+4fuy9aYG27szfNk3IglhY=";
  release."1.1".sha256 = "sha256-JmrtM9WcT8Bfy0WZCw8xdubuMomyXmfLXJwpnCNrvsg=";
@ -42,6 +43,8 @@ mkCoqDerivation {
    stdlib
  ];

+  useDuneifVersion = v: v != null && (v == "dev" || lib.versions.isGt "1.2.1" v);
+
  meta = {
    description = "Generic goal preprocessing tool for proof automation tactics in Coq";
    maintainers = with lib.maintainers; [ siraben ];
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@ -28,14 +28,14 @@

 buildPythonPackage rec {
  pname = "aiogram";
-  version = "3.27.0";
+  version = "3.28.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aiogram";
    repo = "aiogram";
    tag = "v${version}";
-    hash = "sha256-asMTUfC2hRL8vSmv+q86kKzVNFrT5Nk9pGkSjrFsMuo=";
+    hash = "sha256-jy0OOeDiDh2ff3wIR6mYc8P8dOIgVeK0WVQYeug4yEI=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/amplitude-analytics/default.nix
+++ b/pkgs/development/python-modules/amplitude-analytics/default.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "amplitude-analytics";
+  version = "1.2.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "amplitude";
+    repo = "Amplitude-Python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-on4TJPiPyznYkBeJsTd7W59KhN7UaSX5+XJaSjkqFaE=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "amplitude" ];
+
+  meta = {
+    description = "Official Amplitude backend Python SDK for server-side instrumentation";
+    homepage = "https://github.com/amplitude/Amplitude-Python";
+    downloadPage = "https://github.com/amplitude/Amplitude-Python/releases";
+    changelog = "https://github.com/amplitude/Amplitude-Python/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+  };
+})
--- a/pkgs/development/python-modules/burner-redis/default.nix
+++ b/pkgs/development/python-modules/burner-redis/default.nix
@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  rustPlatform,
+
+  pytest-asyncio,
+  redis,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "burner-redis";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "prefectlabs";
+    repo = "burner-redis";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-soXwXxo8vVGEEM5iDNFa86zlPA+e74b+AS9diUoOdME=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-0qdmcoRje7OkHnGhO8CaR/g38yL9K8Jc+1KjfW4xPTQ=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "burner_redis" ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    pytestCheckHook
+
+    pytest-asyncio
+    redis
+  ];
+
+  meta = {
+    description = "Embedded, in-process Redis-compatible database";
+    homepage = "https://github.com/prefectlabs/burner-redis";
+    downloadPage = "https://github.com/prefectlabs/burner-redis/releases";
+    changelog = "https://github.com/prefectlabs/burner-redis/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+  };
+})
--- a/pkgs/development/python-modules/esp-idf-size/default.nix
+++ b/pkgs/development/python-modules/esp-idf-size/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "esp-idf-size";
-  version = "2.2.0";
+  version = "2.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "espressif";
    repo = "esp-idf-size";
    tag = "v${version}";
-    hash = "sha256-tiNk1yh8FPwLEKAw+h+Lp5n0aY/FpTwqZjtAQtZK6eY=";
+    hash = "sha256-kjGO9uLj7/k8WCH6mARFOI4r8IhH/urGKR/23waaOFo=";
  };

  patches = [
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@ -2,30 +2,32 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  pytestCheckHook,
+  redisTestHook,
+
+  hatchling,
  hypothesis,
  jsonpath-ng,
  lupa,
-  hatchling,
+  numpy,
  pyprobables,
  pytest-asyncio,
  pytest-mock,
-  pytestCheckHook,
  redis,
-  redisTestHook,
  sortedcontainers,
  valkey,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "fakeredis";
-  version = "2.33.0";
+  version = "2.35.1";
  pyproject = true;

  src = fetchFromGitHub {
-    owner = "dsoftwareinc";
+    owner = "cunla";
    repo = "fakeredis-py";
-    tag = "v${version}";
-    hash = "sha256-uvbvrziVdoa/ip8MbZG8GcpN1FoINxUV+SDVRmg78Qs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-euhWKXFERpRoXX7G81ffAygt5e1mt7uy9Y9zAGacu38=";
  };

  build-system = [ hatchling ];
@ -42,6 +44,10 @@ buildPythonPackage rec {
    cf = [ pyprobables ];
    probabilistic = [ pyprobables ];
    valkey = [ valkey ];
+    vectorset = [
+      jsonpath-ng
+      numpy
+    ];
  };

  nativeCheckInputs = [
@ -58,23 +64,8 @@ buildPythonPackage rec {
  disabledTestMarks = [ "slow" ];

  disabledTests = [
-    "test_init_args" # AttributeError: module 'fakeredis' has no attribute 'FakeValkey'
-    "test_async_init_kwargs" # AttributeError: module 'fakeredis' has no attribute 'FakeAsyncValkey'"
-
    # redis.exceptions.ResponseError: unknown command 'evalsha'
    "test_async_lock"
-
-    # AssertionError: assert [0, b'1'] == [0, 1.0]
-    "test_zrank_redis7_2"
-    "test_zrevrank_redis7_2"
-
-    # KeyError: 'tot-mem'
-    "test_acl_log_auth_exist"
-    "test_acl_log_invalid_channel"
-    "test_acl_log_invalid_key"
-    "test_client_id"
-    "test_client_info"
-    "test_client_list"
  ];

  preCheck = ''
@ -83,9 +74,9 @@ buildPythonPackage rec {

  meta = {
    description = "Fake implementation of Redis API";
-    homepage = "https://github.com/dsoftwareinc/fakeredis-py";
-    changelog = "https://github.com/cunla/fakeredis-py/releases/tag/${src.tag}";
+    homepage = "https://github.com/cunla/fakeredis-py";
+    changelog = "https://github.com/cunla/fakeredis-py/releases/tag/${finalAttrs.src.tag}";
    license = with lib.licenses; [ bsd3 ];
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-qdrant";
-  version = "0.10.0";
+  version = "0.10.1";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_vector_stores_qdrant";
    inherit version;
-    hash = "sha256-FzhV/4L//t2lskwlYfim3NnaJDGBQxiN6FRw9mZ6hOo=";
+    hash = "sha256-/vTKhBHD4zY2qrz4g5Qf3nqdbeqkUlTugGJ/LQ/79VE=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@ -18,6 +18,11 @@ buildPythonPackage rec {
    hash = "sha256-SsjNiLavEzwm3BV/t49asXRipZtKDaMwTjrxK75LQ0M=";
  };

+  patches = [
+    # https://github.com/ultrafunkamsterdam/nodriver/pull/36
+    ./python-3.14-network-py-encoding.patch
+  ];
+
  dependencies = [
    deprecated
    mss
--- a/pkgs/development/python-modules/nodriver/python-3.14-network-py-encoding.patch
+++ b/pkgs/development/python-modules/nodriver/python-3.14-network-py-encoding.patch
@ -0,0 +1,11 @@
+--- a/nodriver/cdp/network.py
+++ b/nodriver/cdp/network.py
+@@ -1362,7 +1362,7 @@
+     #: Cookie expiration date as the number of seconds since the UNIX epoch.
+     #: The value is set to -1 if the expiry date is not set.
+     #: The value can be null for values that cannot be represented in
+-    #: JSON (±Inf).
+    #: JSON (Â±Inf).
+     expires: typing.Optional[float] = None
+ 
+     #: Cookie SameSite type.
--- a/pkgs/development/python-modules/pipcl/default.nix
+++ b/pkgs/development/python-modules/pipcl/default.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pipcl";
+  version = "4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ArtifexSoftware";
+    repo = "pipcl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1dTjxMuOFWeK4L+m4dbllNVwV36MmhsICTplfEKIOxk=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pipcl"
+  ];
+
+  meta = {
+    description = "Python packaging operations for use by a `setup.py";
+    homepage = "https://github.com/ArtifexSoftware/pipcl";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+})
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@ -0,0 +1,305 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  replaceVars,
+  writableTmpDirAsHomeHook,
+  writeShellScriptBin,
+
+  aiosqlite,
+  alembic,
+  amplitude-analytics,
+  anyio,
+  apprise,
+  asgi-lifespan,
+  asyncpg,
+  boto3,
+  cachetools,
+  click,
+  cloudpickle,
+  coolname,
+  cryptography,
+  cyclopts,
+  dateparser,
+  docker,
+  exceptiongroup,
+  fastapi,
+  fsspec,
+  graphviz,
+  griffe,
+  hatchling,
+  httpcore,
+  httpx,
+  humanize,
+  jinja2-humanize-extension,
+  jinja2,
+  jsonpatch,
+  jsonschema,
+  moto,
+  numpy,
+  opentelemetry-api,
+  opentelemetry-distro,
+  opentelemetry-exporter-otlp,
+  opentelemetry-instrumentation,
+  opentelemetry-instrumentation-logging,
+  opentelemetry-instrumentation-system-metrics,
+  opentelemetry-sdk,
+  opentelemetry-test-utils,
+  orjson,
+  packaging,
+  pathspec,
+  pendulum,
+  pluggy,
+  prometheus-client,
+  pydantic-core,
+  pydantic-extra-types,
+  pydantic-settings,
+  pydantic,
+  pydocket,
+  pytest-asyncio,
+  pytest-env,
+  pytest-timeout,
+  pytest-xdist,
+  python-dateutil,
+  python-on-whales,
+  python-slugify,
+  pytz,
+  pyyaml,
+  readchar,
+  respx,
+  rfc3339-validator,
+  rich,
+  ruamel-yaml-clib,
+  ruamel-yaml,
+  semver,
+  sniffio,
+  sqlalchemy,
+  toml,
+  typing-extensions,
+  uv,
+  uvicorn,
+  versioningit,
+  watchfiles,
+  websockets,
+  whenever,
+  yamllint,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "prefect";
+  version = "3.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PrefectHQ";
+    repo = "prefect";
+    tag = finalAttrs.version;
+    hash = "sha256-AfiXH9u6W6UpE8hepNzPGIm1cxC+5RonhtBYWMu2IaQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        'default-version = "3.6.24+nogit"' \
+        'default-version = "${finalAttrs.version}"'
+  ''
+  + lib.optionalString finalAttrs.doCheck ''
+    substituteInPlace src/prefect/__init__.py \
+      --replace-fail \
+        '__development_base_path__: pathlib.Path = __module_path__.parents[1]' \
+        '__development_base_path__: pathlib.Path = pathlib.Path("${finalAttrs.src}")'
+  '';
+
+  # versioningit: NotVCSError: Git not installed; assuming this isn't a Git repository
+  nativeBuildInputs = [
+    (writeShellScriptBin "git" "false")
+  ];
+
+  build-system = [
+    hatchling
+    versioningit
+  ];
+
+  dependencies = [
+    aiosqlite
+    alembic
+    apprise
+    asyncpg
+    click
+    cryptography
+    cyclopts
+    dateparser
+    docker
+    jinja2
+    jinja2-humanize-extension
+    pytz
+    readchar
+    sqlalchemy
+    # client dependencies
+    amplitude-analytics
+    anyio
+    asgi-lifespan
+    cachetools
+    cloudpickle
+    coolname
+    exceptiongroup
+    fastapi
+    fsspec
+    graphviz
+    griffe
+    httpcore
+    httpx
+    humanize
+    jsonpatch
+    jsonschema
+    opentelemetry-api
+    orjson
+    packaging
+    pathspec
+    pluggy
+    prometheus-client
+    pydantic
+    pydantic-core
+    pydantic-extra-types
+    pydantic-settings
+    pydocket
+    python-dateutil
+    python-slugify
+    pyyaml
+    rfc3339-validator
+    rich
+    ruamel-yaml
+    ruamel-yaml-clib
+    semver
+    sniffio
+    toml
+    typing-extensions
+    uvicorn
+    websockets
+  ]
+  ++ sqlalchemy.optional-dependencies.asyncio
+  ++ httpx.optional-dependencies.http2
+  ++ lib.optional (pythonOlder "3.13") pendulum
+  ++ lib.optional (pythonAtLeast "3.13") whenever;
+
+  optional-dependencies = {
+    aws = [
+      # prefect-aws
+    ];
+    azure = [
+      # prefect-azure
+    ];
+    bitbucket = [
+      # prefect-bitbucket
+    ];
+    buildx = [
+      python-on-whales
+    ];
+    bundles = [
+      uv
+    ];
+    dask = [
+      # prefect-dask
+    ];
+    databricks = [
+      # prefect-databricks
+    ];
+    dbt = [
+      # prefect-dbt
+    ];
+    docker = [
+      # prefect-docker
+    ];
+    email = [
+      # prefect-email
+    ];
+    gcp = [
+      # prefect-gcp
+    ];
+    github = [
+      # prefect-github
+    ];
+    gitlab = [
+      # prefect-gitlab
+    ];
+    kubernetes = [
+      # prefect-kubernetes
+    ];
+    otel = [
+      opentelemetry-distro
+      opentelemetry-exporter-otlp
+      opentelemetry-instrumentation
+      opentelemetry-instrumentation-logging
+      opentelemetry-instrumentation-system-metrics
+      opentelemetry-test-utils
+    ];
+    ray = [
+      # prefect-ray
+    ];
+    redis = [
+      # prefect-redis
+    ];
+    shell = [
+      # prefect-shell
+    ];
+    slack = [
+      # prefect-slack
+    ];
+    snowflake = [
+      # prefect-snowflake
+    ];
+    sqlalchemy = [
+      # prefect-sqlalchemy
+    ];
+  };
+
+  passthru.tests = {
+    inherit (nixosTests) prefect;
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        # avoid pre‐releases
+        "--version-regex"
+        "^(\\d+\\.\\d+\\.\\d+)$"
+      ];
+    };
+  };
+
+  # FIXME: build killed at ~30%
+  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+
+    boto3
+    moto
+    numpy
+    opentelemetry-sdk
+    opentelemetry-test-utils
+    pytest-asyncio
+    pytest-env
+    pytest-timeout
+    pytest-xdist
+    respx
+    uv
+    uvicorn
+    watchfiles
+    yamllint
+  ];
+
+  meta = {
+    description = "Workflow orchestration framework for building resilient data pipelines in Python";
+    homepage = "https://github.com/PrefectHQ/prefect";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      happysalada
+      mrmebelman
+    ];
+    mainProgram = "prefect";
+  };
+})
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@ -2,17 +2,18 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  pytestCheckHook,

  # build-system
  hatch-vcs,
  hatchling,

  # dependencies
+  burner-redis,
  cloudpickle,
-  fakeredis,
+  cronsim,
  opentelemetry-api,
-  opentelemetry-exporter-prometheus,
-  opentelemetry-instrumentation,
+  opentelemetry-sdk,
  prometheus-client,
  py-key-value-aio,
  python-json-logger,
@ -20,18 +21,25 @@
  rich,
  typer,
  typing-extensions,
+  uncalled-for,
+
+  docker,
+  pytest-asyncio,
+  pytest-cov,
+  pytest-timeout,
+  pytest-xdist,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "pydocket";
-  version = "0.17.1";
+  version = "0.20.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "chrisguidry";
    repo = "docket";
    tag = finalAttrs.version;
-    hash = "sha256-p3FqIHulsBxI7oyiahEruARXBuA2QAYdQeVh83OFHbg=";
+    hash = "sha256-QCx1tpiMkyIveay3OwnjcTRb8pTJNcTjOyor59oYHqQ=";
  };

  build-system = [
@ -39,17 +47,11 @@ buildPythonPackage (finalAttrs: {
    hatchling
  ];

-  pythonRelaxDeps = [
-    "fakeredis"
-    "opentelemetry-exporter-prometheus"
-    "opentelemetry-instrumentation"
-  ];
  dependencies = [
+    burner-redis
    cloudpickle
-    fakeredis
+    cronsim
    opentelemetry-api
-    opentelemetry-exporter-prometheus
-    opentelemetry-instrumentation
    prometheus-client
    py-key-value-aio
    python-json-logger
@ -57,15 +59,31 @@ buildPythonPackage (finalAttrs: {
    rich
    typer
    typing-extensions
+    uncalled-for
  ]
-  ++ fakeredis.optional-dependencies.lua
  ++ py-key-value-aio.optional-dependencies.memory
  ++ py-key-value-aio.optional-dependencies.redis;

+  optional-dependencies = {
+    metrics = [
+      opentelemetry-sdk
+    ];
+  };
+
  pythonImportsCheck = [ "docket" ];

  # All tests require internet access
  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+
+    docker
+    opentelemetry-sdk
+    pytest-asyncio
+    pytest-cov
+    pytest-timeout
+    pytest-xdist
+  ];

  meta = {
    description = "Distributed background task system for Python";
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@ -8,6 +8,7 @@

  # build-system
  libclang,
+  pipcl,
  psutil,
  setuptools,
  swig,
@ -44,14 +45,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "pymupdf";
-  version = "1.27.2.2";
+  version = "1.27.2.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pymupdf";
    repo = "PyMuPDF";
    tag = finalAttrs.version;
-    hash = "sha256-o70IMa64jjX+b83uW4gISOiNrWtefQ8nc8Z99DfqrQI=";
+    hash = "sha256-KeddkzRkJ/tcINftYrx/BY0Z3WUaTU9iBqL5UorvclU=";
  };

  patches = [
@ -75,6 +76,7 @@ buildPythonPackage (finalAttrs: {

  build-system = [
    libclang
+    pipcl
    swig
    setuptools
  ];
@ -151,6 +153,76 @@ buildPythonPackage (finalAttrs: {
    # Trace/BPT trap: 5 when getting widget options
    "tests/test_4505.py"
    "tests/test_widgets.py"
+
+    # Tests memory usage which is machine-dependent
+    # AssertionError: r1=403619840 r2=382353408 r=0.947310736756647.
+    "tests/test_memory.py::test_4090"
+
+    # https://github.com/pymupdf/PyMuPDF/issues/4988 triggered by
+    # https://github.com/swig/swig/issues/3279
+    "tests/test_font.py::test_load_system_font"
+    "tests/test_general.py::test_add_ink_annot"
+    "tests/test_general.py::test_2533"
+    "tests/test_general.py::test_2506"
+    "tests/test_general.py::test_2093"
+    "tests/test_general.py::test_2430"
+    "tests/test_general.py::test_2553"
+    "tests/test_general.py::test_2736"
+    "tests/test_general.py::test_subset_fonts"
+    "tests/test_general.py::test_2957_2"
+    "tests/test_general.py::test_707560"
+    "tests/test_general.py::test_3140"
+    "tests/test_general.py::test_3654"
+    "tests/test_general.py::test_3624"
+    "tests/test_general.py::test_4415"
+    "tests/test_general.py::test_4496"
+    "tests/test_general.py::test_4590"
+    "tests/test_general.py::test_4712"
+    "tests/test_general.py::test_4712m"
+    "tests/test_general.py::test_4902"
+    "tests/test_imagebbox.py::test_bboxlog"
+    "tests/test_imagebbox.py::test_image_bbox"
+    "tests/test_insertpdf.py::test_issue1417_insertpdf_in_loop"
+    "tests/test_mupdf_regressions.py::test_707673"
+    "tests/test_mupdf_regressions.py::test_3376"
+    "tests/test_nonpdf.py::test_pageids"
+    "tests/test_objectstreams.py::test_objectstream1"
+    "tests/test_objectstreams.py::test_objectstream2"
+    "tests/test_objectstreams.py::test_objectstream3"
+    "tests/test_pagedelete.py::test_3094"
+    "tests/test_pixmap.py::test_pdfpixmap"
+    "tests/test_pixmap.py::test_3854"
+    "tests/test_pixmap.py::test_4155"
+    "tests/test_pixmap.py::test_4699"
+    "tests/test_remove-rotation.py::test_remove_rotation"
+    "tests/test_spikes.py::test_spikes"
+    "tests/test_story.py::test_story"
+    "tests/test_story.py::test_2753"
+    "tests/test_story.py::test_fit_springer"
+    "tests/test_story.py::test_write_stabilized_with_links"
+    "tests/test_story.py::test_3813"
+    "tests/test_tables.py::test_2979"
+    "tests/test_tables.py::test_strict_lines"
+    "tests/test_tables.py::test_3148"
+    "tests/test_tables.py::test_battery_file"
+    "tests/test_tables.py::test_dotted_grid"
+    "tests/test_textbox.py::test_textbox4"
+    "tests/test_textbox.py::test_2637"
+    "tests/test_textbox.py::test_htmlbox1"
+    "tests/test_textbox.py::test_htmlbox2"
+    "tests/test_textbox.py::test_htmlbox3"
+    "tests/test_textbox.py::test_3559"
+    "tests/test_textbox.py::test_3916"
+    "tests/test_textbox.py::test_4613"
+    "tests/test_textextract.py::test_extract4"
+    "tests/test_textextract.py::test_3197"
+    "tests/test_textextract.py::test_3705"
+    "tests/test_textextract.py::test_4147"
+    "tests/test_textextract.py::test_4179"
+    "tests/test_textextract.py::test_extendable_textpage"
+    "tests/test_textextract.py::test_4503"
+    "tests/test_toc.py::test_simple_toc"
+    "tests/test_toc.py::test_3400"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
@ -29,6 +29,9 @@ buildPythonPackage rec {
    "test_session_scope_gen"
    "test_session_scope_async_gen"
    "test_retry"
+    # pytester outcomes shift under pytest 9 (warning -> error)
+    "test_fixture_nested_exception"
+    "test_shared_fixture_caching"
  ];

  pythonImportsCheck = [ "pytest_asyncio_cooperative" ];
--- a/pkgs/development/python-modules/python-redis-lock/default.nix
+++ b/pkgs/development/python-modules/python-redis-lock/default.nix
@ -4,8 +4,7 @@
  buildPythonPackage,
  setuptools,
  eventlet,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
  gevent,
  pkgs,
  process-tests,
@ -16,13 +15,15 @@

 buildPythonPackage rec {
  pname = "python-redis-lock";
-  version = "4.0.0";
+  version = "4.0.1";

  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Sr0Lz0kTasrWZye/VIbdJJQHjKVeSe+mk/eUB3MZCRo=";
+  src = fetchFromGitHub {
+    owner = "ionelmc";
+    repo = "python-redis-lock";
+    tag = "v${version}";
+    hash = "sha256-KlmVRglglvj3EuX1m2sLqd/yZeU7CjeRxSUJ/cT4ww4=";
  };

  # Fix django tests
@ -32,11 +33,6 @@ buildPythonPackage rec {
  '';

  patches = [
-    # https://github.com/ionelmc/python-redis-lock/pull/119
-    (fetchpatch {
-      url = "https://github.com/ionelmc/python-redis-lock/commit/ae404b7834990b833c1f0f703ec8fbcfecd201c2.patch";
-      hash = "sha256-Fo43+pCtnrEMxMdEEdo0YfJGkBlhhH0GjYNgpZeHF3U=";
-    })
    ./test_signal_expiration_increase_sleep.patch
  ];

--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "rstcheck-core";
-  version = "1.2.2";
+  version = "1.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rstcheck";
    repo = "rstcheck-core";
    tag = "v${version}";
-    hash = "sha256-D17I6pncTnrRjA/vt4lt/Bfkko3Lx58Xyti3sM0sC3s=";
+    hash = "sha256-ZQgbraIQgfhJM4JYfZjPZcMswOddGQb8pdHjTBo53jk=";
  };

  build-system = [
--- a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
+++ b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
@ -1,8 +1,8 @@
 diff --git a/transformer_engine/common/__init__.py b/transformer_engine/common/__init__.py
-index 02388d2e..f2eb337c 100644
+index 40933f17..f2eb337c 100644
 --- a/transformer_engine/common/__init__.py
 +++ b/transformer_engine/common/__init__.py
-@@ -239,117 +239,7 @@ def _get_sys_extension() -> str:
+@@ -239,119 +239,7 @@ def _get_sys_extension() -> str:
 def _nvidia_cudart_include_dir() -> str:
     """Returns the include directory for cuda_runtime.h if exists in python environment."""
 
@ -12,11 +12,13 @@ index 02388d2e..f2eb337c 100644
 -        return ""
 -
 -    # Installing some nvidia-* packages, like nvshmem, create nvidia name, so "import nvidia"
-    # above doesn't through. However, they don't set "__file__" attribute.
-    if nvidia.__file__ is None:
-        return ""
+-    # above doesn't throw. However, they don't set "__file__" attribute.
+-    if nvidia.__file__ is not None:
+-        nvidia_root = Path(nvidia.__file__).parent
+-    else:
+-        nvidia_root = Path(nvidia.__path__[0])  # namespace package
 -
-    include_dir = Path(nvidia.__file__).parent / "cuda_runtime"
+-    include_dir = nvidia_root / "cuda_runtime"
 -    return str(include_dir) if include_dir.exists() else ""
 -
 -
@ -121,7 +123,7 @@ index 02388d2e..f2eb337c 100644
 
 
 @functools.lru_cache(maxsize=None)
-@@ -364,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
+@@ -366,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
     # `_load_cuda_library` is used for packages that must be loaded
     # during runtime. Both system and pypi packages are searched
     # and an error is thrown if not found.
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@ -77,8 +77,9 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
  pname = "transformer-engine";
-  version = "2.12";
+  version = "2.14";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "NVIDIA";
@ -86,7 +87,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
    tag = "v${finalAttrs.version}";
    # Their CMakeLists.txt does not easily let us inject dependencies
    fetchSubmodules = true;
-    hash = "sha256-/e11kacSYPKdjVEKAo3x/CarzKhO3tiTsMjYWLzHbls=";
+    hash = "sha256-yxcUn75blB5ssEqGXZFDUrBv2/WM8yzumJCt5olV5Po=";
  };

  patches =
@ -102,8 +103,8 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
      # https://github.com/NVIDIA/TransformerEngine/pull/2832
      (fetchpatch {
        name = "fix-cuda-arch-cmake-logic";
-        url = "https://github.com/GaetanLepage/TransformerEngine/commit/a3cf63e0d03dd9af1d494854949387f1ae677bf0.patch";
-        hash = "sha256-g2aIF0fROsExEjuNiyI62/rrCOXYyOjyQIOn6rCrUyI=";
+        url = "https://github.com/NVIDIA/TransformerEngine/commit/fca261ecd09c318d22e7eeebda79632eed8cb9e4.patch";
+        hash = "sha256-nph01cIfmjN7RUFZif5ORoz29CEHWwetiHMEZVnnOyY=";
      })
    ]
    ++ optionals withNvshmem [
@ -118,8 +119,8 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
      # https://github.com/NVIDIA/TransformerEngine/pull/2835
      (fetchpatch {
        name = "fix-jax-extension-build-with-mpi";
-        url = "https://github.com/GaetanLepage/TransformerEngine/commit/f68cd3cab34972a899ad0069e2c4ee806e8bc6fb.patch";
-        hash = "sha256-u0ljg1FwY0QjR+ETswpzWV+Sbv00JHI5CSrNQ/9zsuA=";
+        url = "https://github.com/NVIDIA/TransformerEngine/commit/2dd31bb849e83cce51c7d169db883862063d3a95.patch";
+        hash = "sha256-QSRMetseYPGGZCgGkS9rIj9nJdazCD4hv2IgPc+ClSM=";
      })
    ];

--- a/pkgs/development/python-modules/uncalled-for/default.nix
+++ b/pkgs/development/python-modules/uncalled-for/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "uncalled-for";
-  version = "0.3.1";
+  version = "0.3.2";
  pyproject = true;

  __structuredAttrs = true;
@ -25,7 +25,7 @@ buildPythonPackage (finalAttrs: {
    owner = "chrisguidry";
    repo = "uncalled-for";
    tag = finalAttrs.version;
-    hash = "sha256-+akXLsfto3FNbkpsPPwN1DQmvu3BpTafRbqLmLwtqek=";
+    hash = "sha256-5jFMlynYaxd83SQiZ1uPs1whWFgKP4y6s473TplH4iI=";
  };

  build-system = [
--- a/pkgs/kde/frameworks/extra-cmake-modules/default.nix
+++ b/pkgs/kde/frameworks/extra-cmake-modules/default.nix
@ -1,4 +1,5 @@
 {
+  lib,
  mkKdeDerivation,
  python3,
 }:
@ -18,4 +19,7 @@ mkKdeDerivation {
  ];

  setupHook = ./ecm-hook.sh;
+
+  # Pure CMake macros, also used by non-KDE packages on all platforms.
+  meta.platforms = lib.platforms.all;
 }
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "7.1-rc2",
-        "hash": "sha256:10021wpq8pqss25d2y2rhxps88vf8akx8p4xgcx5s5xhk9bfabzw",
+        "version": "7.1-rc3",
+        "hash": "sha256:0gzk6hc880zzy63kpppqi2h347az671sg0wa0nlksyi8acg91wxm",
        "lts": false
    },
    "6.1": {
@ -30,13 +30,13 @@
        "lts": true
    },
    "6.18": {
-        "version": "6.18.28",
-        "hash": "sha256:0x3vsz25ci192zcv1vmi1lnbdmpafvzbzcja1fighv2qhfa7hq7k",
+        "version": "6.18.29",
+        "hash": "sha256:0g584ak8p9nqxysn8d1qzxbp1asfd39hqy9np35gri9v3xdsfgn3",
        "lts": true
    },
    "7.0": {
-        "version": "7.0.5",
-        "hash": "sha256:0g5c732144ig8rk2nrlsbwdh88q5ghi3n1n6c3y9jlv7q6hv0pwn",
+        "version": "7.0.6",
+        "hash": "sha256:08vm18wx6399phzgr3wz94yga3ab4fyca79445ygvbspm904996b",
        "lts": false
    }
 }
--- a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
  owner = "andrew-codechimp";
  domain = "battery_notes";
-  version = "3.4.5";
+  version = "3.4.6";

  src = fetchFromGitHub {
    inherit owner;
    repo = "HA-Battery-Notes";
    tag = version;
-    hash = "sha256-amMrXBTkDZAeMjGScdXMyTZFm90o5jN3VbR2PTydgZA=";
+    hash = "sha256-KcMQLwIm0rr5cEAKLXte/F/Iar3qnznDv76S+bsX9Ok=";
  };

  # has no tests
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -736,6 +736,8 @@ self: super: with self; {

  ament-package = callPackage ../development/python-modules/ament-package { };

+  amplitude-analytics = callPackage ../development/python-modules/amplitude-analytics { };
+
  amply = callPackage ../development/python-modules/amply { };

  amqp = callPackage ../development/python-modules/amqp { };
@ -2407,6 +2409,8 @@ self: super: with self; {

  bundlewrap-teamvault = callPackage ../development/python-modules/bundlewrap-teamvault { };

+  burner-redis = callPackage ../development/python-modules/burner-redis { };
+
  busylight-core = callPackage ../development/python-modules/busylight-core { };

  busylight-for-humans = callPackage ../development/python-modules/busylight-for-humans { };
@ -12606,6 +12610,8 @@ self: super: with self; {

  pip-tools = callPackage ../development/python-modules/pip-tools { };

+  pipcl = callPackage ../development/python-modules/pipcl { };
+
  pipdate = callPackage ../development/python-modules/pipdate { };

  pipdeptree = callPackage ../development/python-modules/pipdeptree { };
@ -12929,7 +12935,7 @@ self: super: with self; {

  precisely = callPackage ../development/python-modules/precisely { };

-  prefect = toPythonModule pkgs.prefect;
+  prefect = callPackage ../development/python-modules/prefect { };

  prefixed = callPackage ../development/python-modules/prefixed { };