.github: Bump korthout/backport-action from 4.5.2 to 4.6.0

Bumps [korthout/backport-action](https://github.com/korthout/backport-action) from 4.5.2 to 4.6.0.
- [Release notes](https://github.com/korthout/backport-action/releases)
- [Commits](6606540695...2e830a1d0b)

---
updated-dependencies:
- dependency-name: korthout/backport-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/backport.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@66065406958f46e82238fd59546f5a99e69e22aa # v4.5.2
+        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

ci/OWNERS

@@ -506,7 +506,7 @@ pkgs/by-name/oc/octodns/ @anthonyroussel
 pkgs/by-name/te/teleport*     @arianvp @justinas @sigma @tomberek @techknowlogick @JuliusFreudenberger
 
 # Warp-terminal
-pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
+pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 
 # Nim
 /doc/languages-frameworks/nim.section.md  @NixOS/nim

ci/default.nix

@@ -70,7 +70,7 @@ rec {
   };
   parse = pkgs.lib.recurseIntoAttrs {
     nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    stable = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.stable; };
+    nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
     lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
   };

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "6edbf1a6a03e75886a6609c088801a0856449e88",
-      "url": "https://github.com/NixOS/nixpkgs/archive/6edbf1a6a03e75886a6609c088801a0856449e88.tar.gz",
-      "hash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30="
+      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
+      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
+      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
     }
   },
   "version": 8

ci/update-pinned.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -E 'with import ../. {}; mkShell { packages = [ npins ]; }'
+#!nix-shell -i bash -p npins -I nixpkgs=../
 
 set -euo pipefail
 

doc/README.md

@@ -1,32 +1,21 @@
-# Contributing to the Nixpkgs manual
+# Contributing to the Nixpkgs reference manual
 
-This directory houses the source files for the Nixpkgs manual.
+This directory houses the source files for the Nixpkgs reference manual.
 
-> [!NOTE]
+> [!IMPORTANT]
+> We are actively restructuring our documentation to follow the [Diátaxis framework](https://diataxis.fr/)
 >
-> We are actively restructuring our documentation to be more beginner friendly.
+> Going forward, this directory should **only** contain [reference documentation](https://nix.dev/contributing/documentation/diataxis#reference).
+> For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
 >
+> We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+> This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
-When writing new docs use **Progressive Disclosure**
+For documentation only relevant for contributors, use Markdown files next to the source and regular code comments.
 
-Start simple, pick up beginners.
-Use **examples** first to show how to get something done. Keep **Explanation** lean.
-
-Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
-
-This directory contains **guides** and **reference** documentation for Nixpkgs.
-
-Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
-
-**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
-Explanations appear as prose after examples.
-
-**Reference** documentation is the specification of functions and attributes.
-
-We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
-
-See [Document structure](#document-structure) for a structural template.
+> [!TIP]
+> Feedback for improving support for parsing and rendering doc-comments is highly appreciated.
+> [Open an issue](https://github.com/NixOS/nixpkgs/issues/new?labels=6.topic%3A+documentation&title=Doc%3A+) to request bugfixes or new features.
 
 Rendered documentation:
 - [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
@@ -65,11 +54,9 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-#### Live preview
+#### `devmode`
 
-Run [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
-
-Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
+Use [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
 
 ### Testing redirects
 
@@ -222,62 +209,6 @@ You, as the writer of documentation, are still in charge of its content.
 
 **For prose style, see the [documentation styleguide](./styleguide.md).**
 
-### Document structure
-
-Organize each chapter as guide sections first, then a single `## Reference` section.
-
-A well-structured chapter looks like this:
-
-````markdown
-# Foo {#foo}
-
-`foo` builds Foo projects from a `foo.toml`.
-
-## Package a Foo application {#foo-packaging}
-
-:::{.example #ex-foo-packaging}
-
-# Package the hello app
-
-```nix
-{ foo }:
-buildFooPackage {
-  pname = "hello";
-  version = "1.0";
-}
-```
-
-:::
-
-`buildFooPackage` needs `pname` and `version`.
-Keep explanation short, and place it after the example.
-
-## Reference {#foo-reference}
-
-### `buildFooPackage` {#foo-buildFooPackage}
-
-Builds a Foo application from source.
-
-#### Inputs {#foo-buildFooPackage-inputs}
-
-`pname` (String)
-: The program name.
-
-#### Examples {#foo-buildFooPackage-examples}
-
-See [](#ex-foo-packaging).
-````
-
-Examples live in one place: the guide owns them and the reference links to them.
-
-Guides introduce minimal working examples that are goal-oriented (typical usage).
-
-Reference may introduce additional examples that are unit-oriented. (minimal usage, edge-cases).
-If the guide example is already sufficient, just link to it from the reference.
-
-Follow this structure strictly; to deviate, ping @NixOS/documentation-team.
-
-
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -353,15 +284,7 @@ Use the [admonition syntax](#admonitions) for callouts and examples.
 
 ### `callPackage`-compatible examples
 
-Provide at least one example per function, in its doc-comment.
-
-Keep each example at the level it documents:
-
-- A **reference example** might sometimes live in a doc-comment and show function call shape.
-- A **guide example** lives in a guide section and shows a complete task that may compose several functions.
-
-When the task is nothing more than the call itself, the guide example is enough.
-The reference example links to the guide example.
+Provide at least one example per function.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

doc/build-helpers.md

@@ -25,5 +25,6 @@ build-helpers/dev-shell-tools.chapter.md
 build-helpers/special.md
 build-helpers/images.md
 hooks/index.md
+languages-frameworks/index.md
 packages/index.md
 ```

doc/build-helpers/dev-shell-tools.chapter.md

@@ -2,7 +2,7 @@
 
 The `nix-shell` command has popularized the concept of transient shell environments for development or testing purposes.
 <!--
-  We should try to document the product, not its development process in the Nixpkgs manual,
+  We should try to document the product, not its development process in the Nixpkgs reference manual,
   but *something* needs to be said to provide context for this library.
   This is the most future proof sentence I could come up with while Nix itself does not yet make use of this.
   Relevant is the current status of the devShell attribute "project": https://github.com/NixOS/nix/issues/7501

doc/first-package.chapter.md

@@ -1,84 +0,0 @@
-# Package your first application {#chap-first-package}
-
-Package an application with Nixpkgs by picking the build helper for its language and setting a few attributes.
-
-Each language ecosystem has its own build helper.
-See [](#chap-language-support) for the full set.
-
-## Package a Go application {#first-package-go}
-
-`buildGoModule` builds Go programs that use Go modules.
-
-Write the package to `package.nix`:
-
-:::{.example #ex-first-package-go}
-
-# Package `pet` with `buildGoModule`
-
-```nix
-# package.nix
-{
-  buildGoModule,
-  fetchFromGitHub,
-  lib,
-}:
-buildGoModule (finalAttrs: {
-  pname = "pet";
-  version = "0.3.4";
-
-  src = fetchFromGitHub {
-    owner = "knqyf263";
-    repo = "pet";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
-  };
-
-  vendorHash = "sha256-6hCgv2/8UIRHw1kCe3nLkxF23zE/7t5RDwEjSzX3pBQ=";
-
-  meta = {
-    description = "Simple command-line snippet manager, written in Go";
-    homepage = "https://github.com/knqyf263/pet";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kalbasit ];
-  };
-})
-```
-
-:::
-
-`buildGoModule` needs `pname`, `version`, `src`, and `vendorHash`.
-
-Pin Nixpkgs and call the package from `default.nix`:
-
-```nix
-# default.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.callPackage ./package.nix { }
-```
-
-Build it:
-
-```shell
-$ nix-build ./default.nix
-# or equivalent
-$ nix-build
-```
-
-Run it:
-
-```shell
-$ ./result/bin/pet --help
-pet - Simple command-line snippet manager.
-```
-
-`vendorHash` pins the fetched dependencies.
-To find its value:
-
-1. Set `vendorHash` to an empty string `""`.
-2. Run `nix-build`.
-3. Copy the correct value from the error into `vendorHash`.
-
-See the [Go reference](#sec-language-go) for every attribute and advanced usage.

doc/languages-frameworks/index.md

@@ -2,10 +2,6 @@
 
 The [standard build environment](#chap-stdenv) makes it easy to build typical Autotools-based packages with very little code. Any other kind of package can be accommodated by overriding the appropriate phases of `stdenv`. However, there are specialised functions in Nixpkgs to easily build packages for other programming languages, such as Perl or Haskell. These are described in this chapter.
 
-::: {.tip}
-New to packaging? Start with [](#chap-first-package), then return here for the ecosystem you need.
-:::
-
 Each supported language or software ecosystem has its own package set named `<language or ecosystem>Packages`, which can be explored in various ways:
 
 - Search on [search.nixos.org](https://search.nixos.org/packages)

doc/languages-frameworks/javascript.section.md

@@ -495,7 +495,7 @@ In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by th
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `3`:
 
 ```nix
 {

doc/manual.md.in

@@ -1,9 +1,8 @@
-# Nixpkgs Manual {#nixpkgs-manual}
+# Nixpkgs Reference Manual {#nixpkgs-manual}
 ## Version @MANUAL_VERSION@
 
 ```{=include=} chapters
 preface.chapter.md
-first-package.chapter.md
 ```
 
 ```{=include=} parts
@@ -18,10 +17,6 @@ contributing.md
 interoperability.md
 ```
 
-```{=include=} chapters
-languages-frameworks/index.md
-```
-
 ```{=include=} appendix html:into-file=//release-notes.html
 release-notes/release-notes.md
 ```

doc/redirects.json

@@ -2,9 +2,6 @@
   "chap-build-helpers-finalAttrs": [
     "index.html#chap-build-helpers-finalAttrs"
   ],
-  "chap-first-package": [
-    "index.html#chap-first-package"
-  ],
   "chap-release-notes": [
     "release-notes.html#chap-release-notes"
   ],
@@ -108,9 +105,6 @@
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
-  "ex-first-package-go": [
-    "index.html#ex-first-package-go"
-  ],
   "ex-modularServiceCompliance-nixos": [
     "index.html#ex-modularServiceCompliance-nixos"
   ],
@@ -137,9 +131,6 @@
   "ex-writeShellApplication": [
     "index.html#ex-writeShellApplication"
   ],
-  "first-package-go": [
-    "index.html#first-package-go"
-  ],
   "friction-graphics": [
     "index.html#friction-graphics"
   ],

doc/release-notes/rl-2611.section.md

@@ -23,8 +23,6 @@
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
-- `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
-
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
@@ -72,8 +70,6 @@
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
-- `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
-- `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 

doc/style.css

@@ -34,6 +34,10 @@ body {
   }
 }
 
+.list-of-examples {
+  display: none;
+}
+
 h1 {
   font-size: 2em;
   margin: 0.67em 0;
@@ -212,7 +216,11 @@ h3 {
   color: var(--heading-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) h3 {
+.note h3,
+.tip h3,
+.warning h3,
+.caution h3,
+.important h3 {
   font-size: 120%;
 }
 
@@ -282,7 +290,16 @@ div.appendix .programlisting {
   color: var(--codeblock-text-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) {
+div.book .note,
+div.book .tip,
+div.book .warning,
+div.book .caution,
+div.book .important,
+div.appendix .note,
+div.appendix .tip,
+div.appendix .warning,
+div.appendix .caution,
+div.appendix .important {
   margin-bottom: 1rem;
   border-radius: 0.5rem;
   padding: 1.5rem;
@@ -290,44 +307,64 @@ div.appendix .programlisting {
   background: #f4f4f4;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > .title {
+div.book .note > .title,
+div.book .tip > .title,
+div.book .warning > .title,
+div.book .caution > .title,
+div.book .important > .title,
+div.appendix .note > .title,
+div.appendix .tip > .title,
+div.appendix .warning > .title,
+div.appendix .caution > .title,
+div.appendix .important > .title {
   font-weight: 800;
   line-height: 110%;
   color: inherit;
   margin-bottom: 0;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > :first-child {
+div.book .note > :first-child,
+div.book .tip > :first-child,
+div.book .warning > :first-child,
+div.book .caution > :first-child,
+div.book .important > :first-child,
+div.appendix .note > :first-child,
+div.appendix .tip > :first-child,
+div.appendix .warning > :first-child,
+div.appendix .caution > :first-child,
+div.appendix .important > :first-child {
   margin-top: 0;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > :last-child {
+div.book .note > :last-child,
+div.book .tip > :last-child,
+div.book .warning > :last-child,
+div.book .caution > :last-child,
+div.book .important > :last-child,
+div.appendix .note > :last-child,
+div.appendix .tip > :last-child,
+div.appendix .warning > :last-child,
+div.appendix .caution > :last-child,
+div.appendix .important > :last-child {
   margin-bottom: 0;
 }
 
-.note {
+div.book .note,
+div.book .tip,
+div.book .important,
+div.appendix .note,
+div.appendix .tip,
+div.appendix .important {
   color: var(--note-text-color);
   background: var(--note-background);
 }
 
-.tip {
-  color: var(--tip-text-color);
-  background: var(--tip-background);
-}
-
-.important {
-  color: var(--important-text-color);
-  background: var(--important-background);
-}
-
-.warning {
+div.book .warning,
+div.book .caution,
+div.appendix .warning,
+div.appendix .caution {
   color: var(--warning-text-color);
-  background: var(--warning-background);
-}
-
-.caution {
-  color: var(--caution-text-color);
-  background: var(--caution-background);
+  background-color: var(--warning-background);
 }
 
 div.book .section,
@@ -424,21 +461,10 @@ div.appendix .variablelist .term {
   --link-color: #405d99;
   --heading-color: #6586c8;
   --small-heading-color: #6a6a6a;
-  /* NOTE */
-  --note-text-color: #0065d2;
-  --note-background: #e4f5ff;
-  /* TIP */
-  --tip-text-color: #188000;
-  --tip-background: #e8fae3;
-  /* IMPORTANT */
-  --important-text-color: #8a3db8;
-  --important-background: #fbedff;
-  /* WARNING */
-  --warning-text-color: #aa4a00;
-  --warning-background: #fff0db;
-  /* CAUTION */
-  --caution-text-color: #be222a;
-  --caution-background: #ffebe8;
+  --note-text-color: #5277c3;
+  --note-background: #f2f8fd;
+  --warning-text-color: #cc3900;
+  --warning-background: #fff5e1;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
 }
@@ -449,26 +475,20 @@ div.appendix .variablelist .term {
     --main-text-color: #fff;
     --link-color: #6586c8;
     --small-heading-color: #fff;
-    /* NOTE */
-    --note-text-color: #66c6ff;
-    --note-background: #1e2f44;
-    /* TIP */
-    --tip-text-color: #80e05f;
-    --tip-background: #22331d;
-    /* IMPORTANT */
-    --important-text-color: #ea9dff;
-    --important-background: #35273f;
-    /* WARNING */
-    --warning-text-color: #ffaa00;
-    --warning-background: #3c2a13;
-    /* CAUTION */
-    --caution-text-color: #ff8c84;
-    --caution-background: #422522;
+    --note-background: none;
+    --warning-background: none;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
   }
 
-  :is(.note, .tip, .warning, .caution, .important) {
+  div.book .note,
+  div.book .tip,
+  div.appendix .note,
+  div.appendix .tip,
+  div.book .warning,
+  div.book .caution,
+  div.appendix .warning,
+  div.appendix .caution {
     border: 2px solid;
     font-weight: 400;
   }

maintainers/github-teams.json

@@ -178,12 +178,11 @@
     "members": {
       "0xMRTT": 105598867,
       "21CSM": 81891917,
-      "4evy": 57304299,
       "Aleksanaa": 42209822,
-      "Br1ght0ne": 12615679,
       "CorbanR": 1918683,
       "Emin017": 99674037,
       "Et7f3": 29592775,
+      "FlameFlag": 57304299,
       "Guanran928": 68757440,
       "LnL7": 689294,
       "Mastermindaxe": 33257997,

maintainers/maintainer-list.nix

@@ -261,13 +261,6 @@
     githubId = 3417013;
     name = "Eske Nielsen";
   };
-  _4evy = {
-    name = "_4evy";
-    email = "git@ps1.sh";
-    github = "_4evy";
-    githubId = 57304299;
-    matrix = "@donteatoreo:matrix.org";
-  };
   _4r7if3x = {
     email = "the.artifex@proton.me";
     matrix = "@4r7if3x:matrix.org";
@@ -418,8 +411,8 @@
   };
   aaravrav = {
     name = "aaravrav";
-    github = "aaravrav";
-    githubId = 37036762;
+    github = "Aarav";
+    githubId = 3279912;
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";
@@ -611,12 +604,6 @@
       { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
     ];
   };
-  ad030 = {
-    name = "Alex Dam";
-    github = "ad030";
-    githubId = 68517956;
-    email = "work.a.dam.030@proton.me";
-  };
   adam-tj = {
     github = "adam-tj";
     githubId = 9314405;
@@ -3397,13 +3384,6 @@
     githubId = 4313548;
     name = "Ben Sparks";
   };
-  benhaskins = {
-    name = "Ben Haskins";
-    email = "ben.haskins@spang.co.uk";
-    github = "benhaskins";
-    githubId = 179679961;
-    keys = [ { fingerprint = "bnYZE0VGodlVwh/eUlqGQsAHeSE0hBPbo2EN2LrGu0M"; } ];
-  };
   benhiemer = {
     name = "Benedikt Hiemer";
     email = "ben.email@posteo.de";
@@ -7012,11 +6992,6 @@
     githubId = 2096594;
     email = "Dietrich@Daroch.me";
   };
-  different-error = {
-    name = "Sanfer D'souza";
-    github = "different-error";
-    githubId = 9338001;
-  };
   different-name = {
     name = "different-name";
     email = "hello@different-name.dev";
@@ -9157,6 +9132,13 @@
     name = "Sebastian Neubauer";
     keys = [ { fingerprint = "2F93 661D AC17 EA98 A104  F780 ECC7 55EE 583C 1672"; } ];
   };
+  FlameFlag = {
+    name = "FlameFlag";
+    email = "github@flameflag.dev";
+    github = "FlameFlag";
+    githubId = 57304299;
+    matrix = "@donteatoreo:matrix.org";
+  };
   Flameopathic = {
     email = "flameopathic@gmail.com";
     github = "Flameopathic";
@@ -9540,13 +9522,6 @@
     githubId = 2881922;
     name = "Francis St-Amour";
   };
-  fstracke = {
-    email = "fritz.stracke@rwth-aachen.de";
-    github = "fstracke";
-    githubId = 31512703;
-    name = "Fritz Stracke";
-    keys = [ { fingerprint = "7A9D 6DB2 0C5A AA55 7838  EEE6 B8CA 2D9A D8F0 506F"; } ];
-  };
   ftrvxmtrx = {
     email = "ftrvxmtrx@gmail.com";
     github = "ftrvxmtrx";
@@ -14254,12 +14229,6 @@
     githubId = 48174247;
     name = "Aleksandar Nesovic";
   };
-  kayoubi13 = {
-    email = "nix@foss-daily.org";
-    github = "kayoubi13";
-    githubId = 299534864;
-    name = "Kayoubi13";
-  };
   kazcw = {
     email = "kaz@lambdaverse.org";
     github = "kazcw";
@@ -16494,12 +16463,6 @@
     githubId = 30468956;
     name = "Lukas Heiligenbrunner";
   };
-  lukas-sgx = {
-    email = "lukas.soigneux@epitech.eu";
-    github = "lukas-sgx";
-    githubId = 68616614;
-    name = "Lukas Soigneux";
-  };
   lukaslihotzki = {
     email = "lukas@lihotzki.de";
     github = "lukaslihotzki";
@@ -20884,11 +20847,6 @@
     githubId = 31112680;
     name = "oidro";
   };
-  ojii3 = {
-    github = "OJII3";
-    githubId = 84656786;
-    name = "OJII3";
-  };
   ojsef39 = {
     name = "Josef Hofer";
     github = "ojsef39";
@@ -22466,7 +22424,7 @@
     githubId = 38916722;
   };
   pradyuman = {
-    email = "me@pmn.co";
+    email = "me@pradyuman.co";
     github = "pradyuman";
     githubId = 9904569;
     name = "Pradyuman Vig";
@@ -24106,12 +24064,6 @@
     githubId = 64620440;
     name = "RoGreat";
   };
-  rohan-datar = {
-    email = "me@rohandatar.com";
-    github = "rohan-datar";
-    githubId = 37545071;
-    name = "Rohan Datar";
-  };
   rohanssrao = {
     email = "rohanssrao@gmail.com";
     github = "rohanssrao";

maintainers/scripts/luarocks-packages.csv

@@ -136,7 +136,6 @@ mpack,,,,,,
 neorg,,,,,5.1,GaetanLepage
 neorg-interim-ls,,,,,,
 neotest,,,,,5.1,mrcjkb
-neotest-nix,,,,,,khaneliman
 nginx-lua-prometheus,,,,,,ulysseszhan
 nlua,,,,,,teto
 nui.nvim,,,,,5.1,mrcjkb

nixos/doc/manual/contributing-to-this-manual.chapter.md

@@ -35,11 +35,9 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-### Live preview {#sec-contributing-devmode}
+### `devmode` {#sec-contributing-devmode}
 
-Run [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
-
-Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
+Use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
 
 ## Testing redirects {#sec-contributing-redirects}
 

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -43,11 +43,6 @@ test script).
 
 ## Shell access to VMs in interactive mode {#sec-nixos-test-shell-access}
 
-::: {.warning}
-Using `shell_interact()` is deprecated. Use the
-[interactive SSH backdoor](#sec-nixos-test-ssh-access) instead.
-:::
-
 The function `<yourmachine>.shell_interact()` grants access to a shell running
 inside a virtual machine. To use it, replace `<yourmachine>` with the name of a
 virtual machine defined in the test, for example: `machine.shell_interact()`.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -14,8 +14,6 @@
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
-- [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
-
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
@@ -75,8 +73,6 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
-- The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
-
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -6,7 +6,6 @@ import warnings
 from pathlib import Path
 
 import ptpython.ipython
-import ptpython.repl
 from colorama import Fore, Style
 
 from test_driver.debug import Debug, DebugAbstract, DebugNop
@@ -175,7 +174,6 @@ def main() -> None:
         if args.interactive:
             history_dir = os.getcwd()
             history_path = os.path.join(history_dir, ".nixos-test-history")
-            ptpython.repl.enable_deprecation_warnings()
             ptpython.ipython.embed(
                 user_ns=driver.test_symbols(),
                 history_filename=history_path,

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -908,7 +908,6 @@ class QemuMachine(BaseMachine):
 
         return (rc, output.decode(errors="replace"))
 
-    @warnings.deprecated("Use the SSH backdoor instead")
     def shell_interact(self, address: str | None = None) -> None:
         """
         Allows you to directly interact with the guest shell. This should
@@ -1451,7 +1450,6 @@ class NspawnMachine(BaseMachine):
 
     machine_sock_path: Path
     machine_sock: socket.socket | None
-    notify_thread: threading.Thread | None
 
     @staticmethod
     def machine_name_from_start_command(start_command: str) -> str:
@@ -1482,12 +1480,6 @@ class NspawnMachine(BaseMachine):
 
         self.start_command = start_command
         self.process = None
-        self.notify_thread = None
-        # State maintained by the notify-socket drainer thread (see
-        # `_drain_notify_socket`). Guarded by `_notify_lock`.
-        self._notify_lock = threading.Lock()
-        self._notify_ready = False
-        self._notify_leader_pid: int | None = None
 
         self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"
 
@@ -1522,76 +1514,43 @@ class NspawnMachine(BaseMachine):
     def is_up(self) -> bool:
         return self.process is not None
 
-    def _drain_notify_socket(self) -> None:
-        """Continuously drain the container's `sd_notify` socket (NOTIFY_SOCKET)
-        for the whole lifetime of the container, recording readiness and the
-        leader PID as they arrive.
-
-        Draining must not stop after boot: the container's PID 1 re-sends
-        `READY=1` on every `systemctl daemon-reexec` (the same Manager.Reexecute
-        that switch-to-configuration issues on a systemd change). If nothing
-        reads the socket, its receive buffer fills and PID 1 blocks in
-        `sendmsg()` to NOTIFY_SOCKET while re-executing -- it never finishes
-        re-initializing, and every later `systemctl` call inside the container
-        hangs or fails with `Transport endpoint is not connected`.
+    def _poll_socket(self) -> tuple[bool, int | None]:
+        """Non-blocking check of container status via socket.
+        Returns (is_ready, leader_pid).
         """
         assert self.machine_sock is not None
-        sock = self.machine_sock
-        proc = self.process
-        assert proc is not None
-        # Bound the thread to the container's lifetime: on
-        # `wait_for_shutdown()` only non-None `proc.poll()` ends the loop.
-        # On exit of PID 1, any datagrams still queued are stale, so drop them.
-        while proc.poll() is None:
-            try:
-                # Block (with a timeout so we notice the container exiting)
-                # rather than busy-poll; we just need to keep the buffer empty.
-                sock.settimeout(0.5)
-                data, _ = sock.recvfrom(4096)
-            except (TimeoutError, BlockingIOError):
-                continue
-            except OSError:
-                break
-            ready = False
-            leader_pid = None
-            for line in data.decode(errors="replace").splitlines():
+        ready = False
+        leader_pid = None
+        try:
+            data, _ = self.machine_sock.recvfrom(4096)
+            msg = data.decode()
+            for line in msg.splitlines():
                 if line == "READY=1":
                     ready = True
                 if line.startswith("X_NSPAWN_LEADER_PID="):
                     leader_pid = int(line.split("=")[1])
-            if ready or leader_pid is not None:
-                with self._notify_lock:
-                    if ready:
-                        self._notify_ready = True
-                    if leader_pid is not None:
-                        self._notify_leader_pid = leader_pid
+        except OSError:
+            pass
+        return ready, leader_pid
 
     @cached_property
     def get_systemd_process(self) -> int:
-        """Block until startup is complete and return the PID of the container's systemd process.
-
-        Readiness and the leader PID are reported over NOTIFY_SOCKET, which is
-        drained by `_drain_notify_socket` (started in `start()`); we just wait
-        for that thread to record both.
-        """
+        """Block until startup is complete and return the PID of the container's systemd process."""
         assert self.process is not None
 
+        container_pid: int | None = None
+        is_ready = False
+
         start_time = time.monotonic()
         last_warning = start_time
         delay = 0.01
         max_delay = 0.5
 
-        # Poll the socket until we have the container leader PID
-        while True:
+        while not is_ready or container_pid is None:
+            # Poll the socket until we have the container leader PID
             if self.process.poll() is not None:
                 raise MachineError("systemd-nspawn process exited unexpectedly")
 
-            with self._notify_lock:
-                is_ready = self._notify_ready
-                container_pid = self._notify_leader_pid
-            if is_ready and container_pid is not None:
-                return container_pid
-
             # Print periodic warnings every 10s so the user knows we aren't deadlocked
             now = time.monotonic()
             if now - last_warning > 10.0:
@@ -1600,8 +1559,18 @@ class NspawnMachine(BaseMachine):
                 )
                 last_warning = now
 
-            time.sleep(delay)
-            delay = min(delay * 2, max_delay)
+            # Poll and update our local tracking variables
+            ready_now, pid_now = self._poll_socket()
+            if ready_now:
+                is_ready = True
+            if pid_now:
+                container_pid = pid_now
+
+            if not (is_ready and container_pid):
+                time.sleep(delay)
+                delay = min(delay * 2, max_delay)
+
+        return container_pid
 
     def _execute(
         self,
@@ -1715,6 +1684,7 @@ class NspawnMachine(BaseMachine):
 
         self.machine_sock = socket.socket(family=socket.AF_UNIX, type=socket.SOCK_DGRAM)
         self.machine_sock.bind(str(self.machine_sock_path))
+        self.machine_sock.setblocking(False)
 
         self.process = subprocess.Popen(
             [self.start_command],
@@ -1730,13 +1700,6 @@ class NspawnMachine(BaseMachine):
 
         self.log(f"systemd-nspawn running (pid {self.process.pid})")
 
-        # Keep the notify socket drained for the container's whole lifetime, so
-        # PID 1 never blocks re-sending `READY=1` on `daemon-reexec`.
-        self.notify_thread = threading.Thread(
-            target=self._drain_notify_socket, daemon=True
-        )
-        self.notify_thread.start()
-
         journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
         journal_thread.start()
 

nixos/modules/i18n/input-method/fcitx5.nix

@@ -109,8 +109,7 @@ in
         (pkgs.writeTextDir "share/fcitx5/data/QuickPhrase.mb" (
           lib.concatStringsSep "\n" (
             lib.mapAttrsToList (
-              name: value:
-              "${name} \"${builtins.replaceStrings [ "\\" "\n" "\"" ] [ "\\\\" "\\n" "\\\"" ] value}\""
+              name: value: "${name} ${builtins.replaceStrings [ "\\" "\n" ] [ "\\\\" "\\n" ] value}"
             ) cfg.quickPhrase
           )
         ))

nixos/modules/module-list.nix

@@ -193,7 +193,6 @@
   ./programs/chrysalis.nix
   ./programs/clash-verge.nix
   ./programs/cnping.nix
-  ./programs/comma.nix
   ./programs/command-not-found/command-not-found.nix
   ./programs/coolercontrol.nix
   ./programs/corefreq.nix
@@ -1429,7 +1428,6 @@
   ./services/networking/tailscale-derper.nix
   ./services/networking/tailscale-serve.nix
   ./services/networking/tailscale.nix
-  ./services/networking/tap.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix
@@ -1850,6 +1848,7 @@
   ./services/web-servers/minio.nix
   ./services/web-servers/molly-brown.nix
   ./services/web-servers/nginx/default.nix
+  ./services/web-servers/nginx/gitweb.nix
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix

nixos/modules/programs/captive-browser.nix

@@ -21,6 +21,8 @@ let
     types
     ;
 
+  requiresSetcapWrapper = config.boot.kernelPackages.kernelOlder "5.7" && cfg.bindInterface;
+
   browserDefault =
     chromium:
     concatStringsSep " " [
@@ -28,20 +30,11 @@ let
       "${chromium}/bin/chromium"
       "--user-data-dir=\${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive"
       ''--proxy-server="socks5://$PROXY"''
-      ''--proxy-bypass-list="<-loopback>"''
+      ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
       "--no-first-run"
       "--new-window"
       "--incognito"
       "-no-default-browser-check"
-      "--no-crash-upload"
-      "--disable-extensions"
-      "--disable-sync"
-      "--disable-background-networking"
-      "--disable-client-side-phishing-detection"
-      "--disable-component-update"
-      "--disable-translate"
-      "--disable-web-resources"
-      "--safebrowsing-disable-auto-update"
       "http://cache.nixos.org/"
     ];
 
@@ -151,5 +144,12 @@ in
         else
           throw "programs.captive-browser.dhcp-dns must be set"
       );
+
+    security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_net_raw+p";
+      source = "${captive-browser-configured}/bin/captive-browser";
+    };
   };
 }

nixos/modules/programs/comma.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.comma;
-in
-{
-  options.programs.comma = {
-    enable = lib.mkEnableOption "comma";
-    package = lib.mkPackageOption pkgs "comma" { };
-    enableBashIntegration = lib.mkEnableOption "comma command-not-found handler for bash" // {
-      default = true;
-    };
-    enableZshIntegration = lib.mkEnableOption "comma command-not-found handler for zsh" // {
-      default = true;
-    };
-    enableFishIntegration = lib.mkEnableOption "comma command-not-found handler for fish" // {
-      default = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-    programs = {
-      bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
-        source ${cfg.package}/share/comma/command-not-found.sh
-      '';
-      zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
-        source ${cfg.package}/share/comma/command-not-found.sh
-      '';
-      fish.interactiveShellInit = ''
-        source ${cfg.package}/share/comma/command-not-found.fish
-      '';
-
-      # Disable *other* command-not-found handlers
-      command-not-found.enable = lib.mkIf (
-        cfg.enableBashIntegration || cfg.enableZshIntegration || cfg.enableFishIntegration
-      ) (lib.mkDefault false);
-      nix-index = {
-        enableBashIntegration = lib.mkIf (cfg.enableBashIntegration) (lib.mkDefault false);
-        enableZshIntegration = lib.mkIf (cfg.enableZshIntegration) (lib.mkDefault false);
-        enableFishIntegration = lib.mkIf (cfg.enableFishIntegration) (lib.mkDefault false);
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ pandapip1 ];
-}

nixos/modules/programs/firefox.nix

@@ -327,6 +327,7 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [
+    danth
     linsui
   ];
 }

nixos/modules/programs/fish.nix

@@ -293,8 +293,8 @@ in
                 ''
                   mkdir -p $out
                   if [ -d $package/share/man ]; then
-                    find -L $package/share/man -type f -print0 \
-                      | xargs -0 ${pkgs.python3.pythonOnBuildForHost.interpreter} \
+                    find -L $package/share/man -type f \
+                      | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} \
                           ${generator}/create_manpage_completions.py --directory $out \
                           >/dev/null
                   fi

nixos/modules/programs/immersed.nix

@@ -26,12 +26,6 @@ in
     programs.immersed = {
       enable = lib.mkEnableOption "immersed";
 
-      openFirewall = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to open firewall ports for Immersed";
-      };
-
       package = lib.mkPackageOption pkgs "immersed" { };
     };
   };
@@ -49,15 +43,6 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
-
-    # https://immersed.helpscoutdocs.com/article/23-connection-troubleshooting-linux
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 21000 ];
-      allowedUDPPorts = [
-        21000
-        21010
-      ];
-    };
   };
 
   meta.maintainers = pkgs.immersed.meta.maintainers;

nixos/modules/services/desktop-managers/cosmic.nix

@@ -20,7 +20,7 @@ let
     with pkgs;
     [
       cosmic-applets
-      cosmic-app-library
+      cosmic-applibrary
       cosmic-bg
       cosmic-comp
       cosmic-files

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -11,17 +11,11 @@ let
   inherit (lib) maintainers teams;
   inherit (lib.attrsets)
     attrByPath
+    attrsToList
     concatMapAttrs
     filterAttrs
-    mapAttrs'
-    nameValuePair
-    ;
-  inherit (lib.lists)
-    elem
-    flatten
-    optional
-    optionals
     ;
+  inherit (lib.lists) flatten optional optionals;
   inherit (lib.modules) mkIf mkRemovedOptionModule;
   inherit (lib.options)
     literalExpression
@@ -29,7 +23,7 @@ let
     mkOption
     mkPackageOption
     ;
-  inherit (lib.strings) hasPrefix optionalString;
+  inherit (lib.strings) concatMapStringsSep hasPrefix optionalString;
   inherit (lib.types)
     attrsOf
     bool
@@ -38,6 +32,17 @@ let
     ;
 
   json = pkgs.formats.json { };
+  mapToFiles =
+    location: config:
+    concatMapAttrs (name: value: {
+      "share/pipewire/${location}.conf.d/${name}.conf" = json.generate "${name}" value;
+    }) config;
+  extraConfigPkgFromFiles =
+    locations: filesSet:
+    pkgs.runCommand "pipewire-extra-config" { } ''
+      mkdir -p ${concatMapStringsSep " " (l: "$out/share/pipewire/${l}.conf.d") locations}
+      ${concatMapStringsSep ";" ({ name, value }: "ln -s ${value} $out/${name}") (attrsToList filesSet)}
+    '';
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins =
     cfg.alsa.support32Bit && pkgs.stdenv.hostPlatform.isx86_64 && pkgs.pkgsi686Linux.pipewire != null;
@@ -53,24 +58,11 @@ let
 
   configPackages = cfg.configPackages;
 
-  extraConfigPkg = pkgs.linkFarm "pipewire-extra-config" (
-    concatMapAttrs
-      (
-        location: config:
-        mapAttrs' (
-          name: value:
-          nameValuePair "share/pipewire/${location}.conf.d/${name}.conf" (json.generate name value)
-        ) config
-      )
-      # cfg.extraConfig contains deprecated options, i.e. client-rt
-      {
-        inherit (cfg.extraConfig)
-          pipewire
-          client
-          jack
-          pipewire-pulse
-          ;
-      }
+  extraConfigPkg = extraConfigPkgFromFiles [ "pipewire" "client" "jack" "pipewire-pulse" ] (
+    mapToFiles "pipewire" cfg.extraConfig.pipewire
+    // mapToFiles "client" cfg.extraConfig.client
+    // mapToFiles "jack" cfg.extraConfig.jack
+    // mapToFiles "pipewire-pulse" cfg.extraConfig.pipewire-pulse
   );
 
   configs = pkgs.buildEnv {

nixos/modules/services/mail/postfix-tlspol.nix

@@ -164,20 +164,6 @@ in
       };
       users.groups.postfix-tlspol = { };
 
-      systemd.sockets.postfix-tlspol = {
-        wantedBy = [ "sockets.target" ];
-        socketConfig = {
-          Accept = false;
-          ListenStream = [
-            (lib.removePrefix "unix:" cfg.settings.server.address)
-          ];
-          SocketUser = "postfix-tlspol";
-          SocketGroup = "postfix-tlspol";
-          SocketMode = cfg.settings.server.socket-permissions;
-          DirectoryMode = "0755";
-        };
-      };
-
       systemd.services.postfix-tlspol = {
         after = [
           "nss-lookup.target"
@@ -187,6 +173,7 @@ in
           "nss-lookup.target"
           "network-online.target"
         ];
+        wantedBy = [ "multi-user.target" ];
 
         description = "Postfix DANE/MTA-STS TLS policy socketmap service";
         documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
@@ -230,6 +217,9 @@ in
           RestrictAddressFamilies = [
             "AF_INET"
             "AF_INET6"
+          ]
+          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
+            "AF_UNIX"
           ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
@@ -247,7 +237,7 @@ in
           RuntimeDirectory = "postfix-tlspol";
           RuntimeDirectoryMode = "1750";
           WorkingDirectory = "/var/cache/postfix-tlspol";
-          UMask = "0077";
+          UMask = "0117";
         };
       };
     })

nixos/modules/services/matrix/matrix-authentication-service.nix

@@ -11,15 +11,16 @@ let
     filter
     filterAttrs
     getExe
-    getExe'
     isAttrs
     isList
     mapAttrs
+    mkDefault
     mkEnableOption
     mkIf
     mkOption
     mkPackageOption
     optional
+    optionalAttrs
     types
     ;
 
@@ -44,11 +45,6 @@ let
     else
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
-
-  extraConfigFiles = lib.imap0 (
-    i: _: "$CREDENTIALS_DIRECTORY/config-${toString i}"
-  ) cfg.extraConfigFiles;
-  runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {
   meta.maintainers = with lib.maintainers; [
@@ -374,23 +370,6 @@ in
         such as the Matrix homeserver if it's running on the same host.
       '';
     };
-
-    credentials = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      default = { };
-      description = ''
-        Mapping of credential name to  source file-path. Exposed to the unit via LoadCredential and
-        readable inside the service at `''${CREDENTIALS_DIRECTORY}/<name>`.
-
-        For example:
-
-        ```
-        services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared";
-        services.matrix-authentication-service.settings.matrix.secret_file =
-          "\''${CREDENTIALS_DIRECTORY}/synapse-secret";
-        ```
-      '';
-    };
   };
 
   config = mkIf cfg.enable {
@@ -411,20 +390,13 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         DynamicUser = true;
-        LoadCredential =
-          (lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles)
-          ++ (lib.mapAttrsToList (name: path: "${name}:${path}") cfg.credentials);
-        ExecStartPre = pkgs.writeShellScript "mas-prepare" ''
-          ${getExe' pkgs.gettext "envsubst"} \
-            '$CREDENTIALS_DIRECTORY' \
-            < ${configFile} \
-            > /run/matrix-authentication-service/config.yaml
-          ${getExe cfg.package} config check --config ${runtimeConfig} \
-            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
+        ExecStartPre = ''
+          ${getExe cfg.package} config check \
+            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
         '';
         ExecStart = ''
-          ${getExe cfg.package} server --config ${runtimeConfig} \
-            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
+          ${getExe cfg.package} server \
+            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
         '';
         Restart = "on-failure";
         RestartSec = "1s";
@@ -466,7 +438,6 @@ in
         # Working and state directories
         StateDirectory = "matrix-authentication-service";
         StateDirectoryMode = "0700";
-        RuntimeDirectory = "matrix-authentication-service";
         WorkingDirectory = "/var/lib/matrix-authentication-service";
       };
     };

nixos/modules/services/misc/gitweb.nix

@@ -6,12 +6,7 @@
 }:
 let
   cfg = config.services.gitweb;
-  cfgNginx = config.services.gitweb.nginx;
-  package = pkgs.gitweb.override (
-    lib.optionalAttrs cfg.gitwebTheme {
-      gitwebTheme = true;
-    }
-  );
+
 in
 {
 
@@ -60,104 +55,6 @@ in
       internal = true;
     };
 
-    nginx = {
-      enable = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = ''
-          If true, enable gitweb in nginx.
-        '';
-      };
-
-      location = lib.mkOption {
-        default = "/gitweb";
-        type = lib.types.str;
-        description = ''
-          Location to serve gitweb on.
-        '';
-      };
-
-      user = lib.mkOption {
-        default = "nginx";
-        type = lib.types.str;
-        description = ''
-          Existing user that the CGI process will belong to. (Default almost surely will do.)
-        '';
-      };
-
-      group = lib.mkOption {
-        default = "nginx";
-        type = lib.types.str;
-        description = ''
-          Group that the CGI process will belong to. (Set to `config.services.gitolite.group` if you are using gitolite.)
-        '';
-      };
-
-      virtualHost = lib.mkOption {
-        default = "_";
-        type = lib.types.str;
-        description = ''
-          VirtualHost to serve gitweb on. Default is catch-all.
-        '';
-      };
-    };
-
-  };
-
-  imports = [
-    (lib.mkRenamedOptionModule
-      [ "services" "nginx" "gitweb" "enable" ]
-      [ "services" "gitweb" "nginx" "enable" ]
-    )
-    (lib.mkRenamedOptionModule
-      [ "services" "nginx" "gitweb" "location" ]
-      [ "services" "gitweb" "nginx" "location" ]
-    )
-    (lib.mkRenamedOptionModule
-      [ "services" "nginx" "gitweb" "user" ]
-      [ "services" "gitweb" "nginx" "user" ]
-    )
-    (lib.mkRenamedOptionModule
-      [ "services" "nginx" "gitweb" "group" ]
-      [ "services" "gitweb" "nginx" "group" ]
-    )
-    (lib.mkRenamedOptionModule
-      [ "services" "nginx" "gitweb" "virtualHost" ]
-      [ "services" "gitweb" "nginx" "virtualHost" ]
-    )
-  ];
-
-  config = lib.mkIf cfgNginx.enable {
-
-    systemd.services.gitweb = {
-      description = "GitWeb service";
-      script = "${package}/gitweb.cgi --fastcgi --nproc=1";
-      environment = {
-        FCGI_SOCKET_PATH = "/run/gitweb/gitweb.sock";
-      };
-      serviceConfig = {
-        User = cfgNginx.user;
-        Group = cfgNginx.group;
-        RuntimeDirectory = [ "gitweb" ];
-      };
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    services.nginx = {
-      virtualHosts.${cfgNginx.virtualHost} = {
-        locations."${cfgNginx.location}/static/" = {
-          alias = "${package}/static/";
-        };
-        locations."${cfgNginx.location}/" = {
-          extraConfig = ''
-            include ${config.services.nginx.package}/conf/fastcgi_params;
-            fastcgi_param GITWEB_CONFIG ${cfg.gitwebConfigFile};
-            fastcgi_pass unix:/run/gitweb/gitweb.sock;
-          '';
-        };
-      };
-    };
-
   };
 
   meta.maintainers = [ ];

nixos/modules/services/networking/adguardhome.nix

@@ -176,32 +176,22 @@ in
         StartLimitBurst = 10;
       };
 
-      preStart =
-        let
-          installFresh = ''
-            cp --force "${configFile}" "$STATE_DIRECTORY/AdGuardHome.yaml"
-            chmod 600 "$STATE_DIRECTORY/AdGuardHome.yaml"
-          '';
-        in
-        lib.optionalString (settings != null) (
-          if cfg.mutableSettings then
-            ''
-              if [ -e "$STATE_DIRECTORY/AdGuardHome.yaml" ]; then
-                # First run a schema_version update on the existing configuration
-                # This ensures that both the new config and the existing one have the same schema_version
-                # Note: --check-config has the side effect of modifying the file at rest!
-                ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
+      preStart = lib.optionalString (settings != null) ''
+        if    [ -e "$STATE_DIRECTORY/AdGuardHome.yaml" ] \
+           && [ "${toString cfg.mutableSettings}" = "1" ]; then
+          # First run a schema_version update on the existing configuration
+          # This ensures that both the new config and the existing one have the same schema_version
+          # Note: --check-config has the side effect of modifying the file at rest!
+          ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
 
-                # Writing directly to AdGuardHome.yaml results in empty file
-                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
-                mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
-              else
-                ${installFresh}
-              fi
-            ''
-          else
-            installFresh
-        );
+          # Writing directly to AdGuardHome.yaml results in empty file
+          ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
+          mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
+        else
+          cp --force "${configFile}" "$STATE_DIRECTORY/AdGuardHome.yaml"
+          chmod 600 "$STATE_DIRECTORY/AdGuardHome.yaml"
+        fi
+      '';
 
       serviceConfig = {
         DynamicUser = true;

nixos/modules/services/networking/mptcpd.nix

@@ -5,9 +5,11 @@
   ...
 }:
 let
+
   cfg = config.services.mptcpd;
-  settingsFormat = pkgs.formats.ini { };
+
 in
+
 {
 
   options = {
@@ -18,57 +20,15 @@ in
 
       package = lib.mkPackageOption pkgs "mptcpd" { };
 
-      settings = lib.mkOption {
-        type = settingsFormat.type;
-        default = { };
-        example = lib.literalExpression ''
-          {
-            core = {
-              "addr-flags" = "subflow";
-              "notify-flags" = "existing,skip_link_local,skip_loopback,check_route";
-              "load-plugins" = "addr_adv,sspi";
-            };
-          }
-        '';
-        description = ''
-          mptcpd configuration written to {file}`/etc/mptcpd/mptcpd.conf`.
-
-          See {manpage}`mptcpd(8)` for details about available options and syntax.
-        '';
-      };
-
     };
 
   };
 
   config = lib.mkIf cfg.enable {
 
-    # Disable NetworkManager from configuring the MPTCP endpoints.
-    # See https://github.com/multipath-tcp/mptcpd/blob/48942b2110805af236ca41164fde67830efd7507/README.md?plain=1#L19-L38
-    networking.networkmanager.connectionConfig = {
-      "connection.mptcp-flags" = 1;
-    };
-
-    environment.etc."mptcpd/mptcpd.conf".source = settingsFormat.generate "mptcpd.conf" cfg.settings;
-
     environment.systemPackages = [ cfg.package ];
 
-    services.mptcpd.settings = {
-      core = {
-        log = lib.mkDefault "journal";
-        "plugin-dir" = "${cfg.package}/lib/mptcpd";
-        "path-manager" = lib.mkDefault "addr_adv";
-      };
-    };
-
     systemd.packages = [ cfg.package ];
-    systemd.services.mptcp = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = [
-        ""
-        "${cfg.package}/libexec/mptcpd"
-      ];
-    };
 
   };
 

nixos/modules/services/networking/tap.nix

@@ -1,131 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.services.tap;
-in
-{
-  options.services.tap = {
-    enable = lib.mkEnableOption "Tap, ATProtocol firehose sync utility";
-
-    package = lib.mkPackageOption pkgs "tap" { };
-
-    environmentFiles = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Files to load environment variables from. Use for secrets such as
-        {env}`TAP_ADMIN_PASSWORD` that should not be readable in the Nix store.
-      '';
-    };
-
-    settings = lib.mkOption {
-      default = { };
-      description = ''
-        Configuration for Tap as environment variables. See the
-        [README](https://github.com/bluesky-social/indigo/blob/main/cmd/tap/README.md)
-        for all available options.
-
-        Secrets such as {option}`settings.TAP_ADMIN_PASSWORD` should be set via
-        {option}`environmentFiles` rather than here, as values set here will
-        be readable in the Nix store.
-      '';
-      type = lib.types.submodule {
-        freeformType = lib.types.attrsOf (
-          lib.types.nullOr (
-            lib.types.oneOf [
-              lib.types.bool
-              lib.types.int
-              lib.types.float
-              lib.types.str
-            ]
-          )
-        );
-
-        options = {
-          TAP_BIND = lib.mkOption {
-            type = lib.types.str;
-            default = "127.0.0.1:2480";
-            description = "Address and port the HTTP server will listen on.";
-          };
-
-          TAP_DATABASE_URL = lib.mkOption {
-            type = lib.types.str;
-            default = "sqlite:///var/lib/tap/tap.db";
-            description = ''
-              Database connection string. Accepts SQLite (`sqlite://path`) or
-              PostgreSQL (`postgres://...`) connection strings.
-            '';
-          };
-        };
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.tap = {
-      description = "Tap - ATProtocol firehose sync utility";
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        User = "tap";
-        DynamicUser = true;
-
-        ExecStart = "${lib.getExe cfg.package} run";
-        Environment = lib.mapAttrsToList (
-          k: v: "${k}=${if lib.isBool v then lib.boolToString v else toString v}"
-        ) (lib.filterAttrs (_: v: v != null) cfg.settings);
-        EnvironmentFile = cfg.environmentFiles;
-
-        Restart = "on-failure";
-        RestartSec = 5;
-        StateDirectory = "tap";
-        StateDirectoryMode = "0750";
-
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProcSubset = "pid";
-        ProtectSystem = "strict";
-
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-
-        LockPersonality = true;
-        NoNewPrivileges = true;
-        AmbientCapabilities = "";
-        CapabilityBoundingSet = "";
-        RemoveIPC = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ blooym ];
-}

nixos/modules/services/networking/yggdrasil.nix

@@ -33,11 +33,17 @@ let
     else
       null;
 
+  # Build base configuration with systemd credential path override
   baseSettings =
     cfg.settings
-    // lib.optionalAttrs (effectiveKeyPath != null) {
-      PrivateKeyPath = "/run/credentials/yggdrasil.service/private-key";
-    };
+    // (
+      if effectiveKeyPath != null then
+        {
+          PrivateKeyPath = "/private-key";
+        }
+      else
+        { }
+    );
 
   # Remove null values that yggdrasil doesn't expect
   cleanSettings = lib.filterAttrs (n: v: v != null) baseSettings;
@@ -321,6 +327,7 @@ in
           StateDirectory = "yggdrasil";
           RuntimeDirectory = "yggdrasil";
           RuntimeDirectoryMode = "0750";
+          BindReadOnlyPaths = lib.optional (effectiveKeyPath != null) "%d/private-key:/private-key";
           LoadCredential = lib.optional (effectiveKeyPath != null) "private-key:${effectiveKeyPath}";
 
           AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";

nixos/modules/services/web-apps/cloudlog.nix

@@ -62,14 +62,17 @@ let
       ln -s ${configFile} $out/application/config/config.php
       ln -s ${dbFile} $out/application/config/database.php
 
-      # make a copy of the original assets/json to prime the datadir
-      cp -a "$out/assets/json/" "$out/assets/json.original/"
-
       # link writable directories
-      for directory in updates uploads backup logbook assets/qslcard images/eqsl_card_images assets/sstvimages assets/json; do
+      for directory in updates uploads backup logbook; do
         rm -rf $out/$directory
         ln -s ${cfg.dataDir}/$directory $out/$directory
       done
+
+      # link writable asset files
+      for asset in dok sota wwff; do
+        rm -rf $out/assets/json/$asset.txt
+        ln -s ${cfg.dataDir}/assets/json/$asset.txt $out/assets/json/$asset.txt
+      done
     '';
   };
 in
@@ -500,26 +503,13 @@ in
           group = config.services.nginx.group;
         in
         [
-          "d ${cfg.dataDir}                         0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/updates                 0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/uploads                 0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/backup                  0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/logbook                 0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets                  0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/json             0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/qslcard          0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/sstvimages       0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/images                  0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/images/eqsl_card_images 0750 ${cfg.user} ${group} - -"
-          "C ${cfg.dataDir}/assets/json/dok.txt                              0640 ${cfg.user} ${group} - ${package}/assets/json.original/dok.txt"
-          "C ${cfg.dataDir}/assets/json/pota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/pota.txt"
-          "C ${cfg.dataDir}/assets/json/satellite_data.json                  0640 ${cfg.user} ${group} - ${package}/assets/json.original/satellite_data.json"
-          "C ${cfg.dataDir}/assets/json/sota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/sota.txt"
-          "C ${cfg.dataDir}/assets/json/US_counties.csv                      0640 ${cfg.user} ${group} - ${package}/assets/json.original/US_counties.csv"
-          "C ${cfg.dataDir}/assets/json/us_national_parksontheair.csv        0640 ${cfg.user} ${group} - ${package}/assets/json.original/us_national_parksontheair.csv"
-          "C ${cfg.dataDir}/assets/json/WABSquares.geojson                   0640 ${cfg.user} ${group} - ${package}/assets/json.original/WABSquares.geojson"
-          "C ${cfg.dataDir}/assets/json/wwff.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/wwff.txt"
-          "C+ ${cfg.dataDir}/assets/json/datatables_languages                0750 ${cfg.user} ${group} - ${package}/assets/json.original/datatables_languages"
+          "d ${cfg.dataDir}                0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/updates        0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/uploads        0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/backup         0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/logbook        0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/json    0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/qslcard 0750 ${cfg.user} ${group} - -"
         ];
     };
 

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -36,62 +36,48 @@ let
       toString value
   ) cfg.settings;
 
-  commonSystemdConfig = {
-    after = [
-      "network.target"
-    ]
-    ++ (optional cfg.postgresql.createLocally "postgresql.service")
-    ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-meet";
+    StateDirectory = "lasuite-meet";
+    WorkingDirectory = "/var/lib/lasuite-meet";
 
-    wants =
-      (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
-
-    environment = pythonEnvironment;
-
-    serviceConfig = {
-      RuntimeDirectory = "lasuite-meet";
-      StateDirectory = "lasuite-meet";
-      WorkingDirectory = "/var/lib/lasuite-meet";
-
-      User = "lasuite-meet";
-      DynamicUser = true;
-      SupplementaryGroups = mkIf cfg.redis.createLocally [
-        config.services.redis.servers.lasuite-meet.group
-      ];
-      # hardening
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = [ "" ];
-      DevicePolicy = "closed";
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      MemoryDenyWriteExecute = true;
-      EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
-      UMask = "0077";
-    };
+    User = "lasuite-meet";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-meet.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    MemoryDenyWriteExecute = true;
+    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+    UMask = "0077";
   };
 in
 {
@@ -356,54 +342,74 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.lasuite-meet = lib.mkMerge [
-      {
-        description = "Meet from SuiteNumérique";
+    systemd.services.lasuite-meet = {
+      description = "Meet from SuiteNumérique";
+      after = [
+        "network.target"
+      ]
+      ++ (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-        wantedBy = [ "multi-user.target" ];
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-        preStart = ''
-          if [ ! -f .version ]; then
-            touch .version
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+            )
           fi
+        ''}
+        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.package} migrate
+          echo -n "${cfg.package.version}" > .version
+        fi
+      '';
 
-          ${optionalString (cfg.secretKeyPath == null) ''
-            if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
-              (
-                umask 0377
-                tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
-              )
-            fi
-          ''}
-          if [ "${cfg.package.version}" != "$(cat .version)" ]; then
-            ${getExe cfg.package} migrate
-            echo -n "${cfg.package.version}" > .version
-          fi
-        '';
+      environment = pythonEnvironment;
 
-        serviceConfig = {
-          BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
+      serviceConfig = {
+        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
-          ExecStart = utils.escapeSystemdExecArgs (
-            [
-              (lib.getExe' cfg.package "gunicorn")
-              "--bind=${cfg.bind}"
-            ]
-            ++ cfg.gunicorn.extraArgs
-            ++ [ "meet.wsgi:application" ]
-          );
-        };
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.package "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "meet.wsgi:application" ]
+        );
       }
-      commonSystemdConfig
-    ];
+      // commonServiceConfig;
+    };
 
-    systemd.services.lasuite-meet-celery = lib.mkMerge [
-      {
-        description = "Meet Celery broker from SuiteNumérique";
+    systemd.services.lasuite-meet-celery = {
+      description = "Meet Celery broker from SuiteNumérique";
+      after = [
+        "network.target"
+      ]
+      ++ (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-        wantedBy = [ "multi-user.target" ];
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-        serviceConfig.ExecStart = utils.escapeSystemdExecArgs (
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
           [ (lib.getExe' cfg.package "celery") ]
           ++ cfg.celery.extraArgs
           ++ [
@@ -412,26 +418,8 @@ in
           ]
         );
       }
-      commonSystemdConfig
-    ];
-
-    systemd.services.lasuite-meet-clean-pending-files = lib.mkMerge [
-      {
-        description = "Scheduled job to clean up pending uploads from LaSuite Meet";
-        startAt = "daily";
-        serviceConfig.ExecStart = "${getExe cfg.package} clean_pending_files";
-      }
-      commonSystemdConfig
-    ];
-
-    systemd.services.lasuite-meet-purge-deleted-files = lib.mkMerge [
-      {
-        description = "Scheduled job to purge deleted files from LaSuite Meet";
-        startAt = "daily";
-        serviceConfig.ExecStart = "${getExe cfg.package} purge_deleted_files";
-      }
-      commonSystemdConfig
-    ];
+      // commonServiceConfig;
+    };
 
     services.postgresql = mkIf cfg.postgresql.createLocally {
       enable = true;

nixos/modules/services/web-apps/ocis.nix

@@ -202,6 +202,7 @@ in
 
   meta.maintainers = with lib.maintainers; [
     bhankas
+    danth
     ramblurr
   ];
 }

nixos/modules/services/web-apps/papra.nix

@@ -80,8 +80,8 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Restart = "on-failure";
-        ExecStartPre = "${lib.getExe' cfg.package "papra-migrate-up"}";
-        ExecStart = "${lib.getExe' cfg.package "papra"}";
+        ExecStartPre = "${lib.getExe pkgs.tsx} ${cfg.package}/lib/src/scripts/migrate-up.script.ts";
+        ExecStart = "${cfg.package}/bin/papra";
         User = cfg.user;
         Group = cfg.group;
         StateDirectory = "papra";

nixos/modules/services/web-servers/nginx/default.nix

@@ -412,7 +412,7 @@ let
             "
             listen ${addr}${optionalString (port != null) ":${toString port}"} quic "
             + optionalString vhost.default "default_server "
-            + optionalString (vhost.reuseport && !(lib.hasPrefix "unix:" addr)) "reuseport "
+            + optionalString vhost.reuseport "reuseport "
             + optionalString (extraParameters != [ ]) (
               concatStringsSep " " (
                 let
@@ -438,7 +438,7 @@ let
           + optionalString (ssl && vhost.http2 && oldHTTP2) "http2 "
           + optionalString ssl "ssl "
           + optionalString vhost.default "default_server "
-          + optionalString (vhost.reuseport && !(lib.hasPrefix "unix:" addr)) "reuseport "
+          + optionalString vhost.reuseport "reuseport "
           + optionalString proxyProtocol "proxy_protocol "
           + optionalString (extraParameters != [ ]) (concatStringsSep " " extraParameters)
           + ";";
@@ -1691,7 +1691,9 @@ in
       )
     );
 
-    environment.etc."nginx/nginx.conf".source = configFile;
+    environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
+      source = configFile;
+    };
 
     security.acme.certs =
       let

nixos/modules/services/web-servers/nginx/gitweb.nix

@@ -0,0 +1,101 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.nginx.gitweb;
+  gitwebConfig = config.services.gitweb;
+  package = pkgs.gitweb.override (
+    optionalAttrs gitwebConfig.gitwebTheme {
+      gitwebTheme = true;
+    }
+  );
+
+in
+{
+
+  options.services.nginx.gitweb = {
+
+    enable = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        If true, enable gitweb in nginx.
+      '';
+    };
+
+    location = mkOption {
+      default = "/gitweb";
+      type = types.str;
+      description = ''
+        Location to serve gitweb on.
+      '';
+    };
+
+    user = mkOption {
+      default = "nginx";
+      type = types.str;
+      description = ''
+        Existing user that the CGI process will belong to. (Default almost surely will do.)
+      '';
+    };
+
+    group = mkOption {
+      default = "nginx";
+      type = types.str;
+      description = ''
+        Group that the CGI process will belong to. (Set to `config.services.gitolite.group` if you are using gitolite.)
+      '';
+    };
+
+    virtualHost = mkOption {
+      default = "_";
+      type = types.str;
+      description = ''
+        VirtualHost to serve gitweb on. Default is catch-all.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.gitweb = {
+      description = "GitWeb service";
+      script = "${package}/gitweb.cgi --fastcgi --nproc=1";
+      environment = {
+        FCGI_SOCKET_PATH = "/run/gitweb/gitweb.sock";
+      };
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        RuntimeDirectory = [ "gitweb" ];
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    services.nginx = {
+      virtualHosts.${cfg.virtualHost} = {
+        locations."${cfg.location}/static/" = {
+          alias = "${package}/static/";
+        };
+        locations."${cfg.location}/" = {
+          extraConfig = ''
+            include ${config.services.nginx.package}/conf/fastcgi_params;
+            fastcgi_param GITWEB_CONFIG ${gitwebConfig.gitwebConfigFile};
+            fastcgi_pass unix:/run/gitweb/gitweb.sock;
+          '';
+        };
+      };
+    };
+
+  };
+
+  meta.maintainers = [ ];
+
+}

nixos/modules/virtualisation/incus.nix

@@ -93,9 +93,6 @@ let
     ]
     ++ lib.optionals nvidiaEnabled [
       libnvidia-container
-    ]
-    ++ lib.optionals cfg.storage.truenas.enable [
-      truenas-incus-ctl
     ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
@@ -287,8 +284,6 @@ in
         '';
       };
 
-      storage.truenas.enable = lib.mkEnableOption "TrueNAS storage driver support";
-
       ui = {
         enable = lib.mkEnableOption "Incus Web UI";
 
@@ -319,10 +314,6 @@ in
           );
         message = "Incus on NixOS is unsupported using iptables. Set `networking.nftables.enable = true;`";
       }
-      {
-        assertion = cfg.storage.truenas.enable -> config.services.openiscsi.enable;
-        messages = "`virtualisation.incus.storage.truenas.enable` requires `services.openiscsi.enable`";
-      }
     ];
 
     # https://github.com/lxc/incus/blob/f145309929f849b9951658ad2ba3b8f10cbe69d1/doc/reference/server_settings.md
@@ -355,9 +346,6 @@ in
 
       # gui console support
       pkgs.spice-gtk
-    ]
-    ++ lib.optionals cfg.storage.truenas.enable [
-      pkgs.truenas-incus-ctl
     ];
 
     # Note: the following options are also declared in virtualisation.lxc, but

nixos/modules/virtualisation/nixos-containers.nix

@@ -520,7 +520,7 @@ let
     hostAddress6 = null;
     localAddress = null;
     localAddress6 = null;
-    localMacAddress = null;
+    localmacAddress = null;
     tmpfs = null;
   };
 

nixos/tests/all-tests.nix

@@ -152,7 +152,6 @@ in
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
-    nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =

nixos/tests/matrix/matrix-authentication-service.nix

@@ -237,14 +237,13 @@ in
               {
                 id = masULID;
                 client_id = oidcClientID;
-                client_secret_file = "\${CREDENTIALS_DIRECTORY}/oidc_client_secret";
+                client_secret = oidcClientSecret;
                 issuer = "https://${dexDomain}:5556";
                 scope = "openid email profile";
                 token_endpoint_auth_method = "client_secret_post";
               }
             ];
           };
-          credentials.oidc_client_secret = "${pkgs.writeText "oidc-client-secret" oidcClientSecret}";
         };
         services.postgresql.authentication = pkgs.lib.mkOverride 10 ''
           local all all trust

nixos/tests/mattermost/default.nix

@@ -66,7 +66,12 @@ import ../make-test-python.nix (
 
             # Upgrade to the latest Mattermost.
             specialisation.latest.configuration = {
-              services.mattermost.package = lib.mkForce pkgs.mattermostLatest;
+              services.mattermost.package = lib.mkForce (
+                pkgs.mattermostLatest.override {
+                  removeFreeBadge = true;
+                  removeUserLimit = true;
+                }
+              );
               system.stateVersion = lib.mkVMOverride (lib.versions.majorMinor lib.version);
             };
           }

nixos/tests/nspawn-daemon-reexec-dbus.nix

@@ -1,79 +0,0 @@
-# Regression test for an nspawn-only systemd re-exec failure that broke D-Bus.
-#
-# Demonstrates `systemctl show` keeps working on `daemon-reexec`.
-#
-# Trigger: `systemctl daemon-reexec` issues a D-Bus `Manager.Reexecute`, like
-# `switch-to-configuration-ng` on a systemd package change.
-#
-# Root cause: inside nspawn test containers PID 1 re-send `READY=1` on the
-# `NOTIFY_SOCKET` on re-exec. The test driver stopped draining that socket
-# after boot, so until drained its receive buffer filled and `systemctl` hung /
-# errored `Failed to connect to bus: Transport endpoint is not connected`.
-{ ... }:
-{
-  name = "nspawn-daemon-reexec-dbus";
-
-  # `containers.<name>` => systemd-nspawn machine (vs `nodes.<name>` => QEMU).
-  # An empty container boots full systemd + D-Bus, which is all we need.
-  containers.machine = { };
-
-  testScript = # python
-    ''
-      import re
-
-      BUS_BROKEN = re.compile(
-          r"Transport endpoint is not connected|Failed to connect to bus"
-      )
-
-      # Without the fix the notify socket's receive buffer fills after 10
-      # undrained `READY=1` resends, so PID 1 blocks then.
-      REEXECS = 10
-
-
-      def bus_broken():
-          """Whether the in-container D-Bus is unusable. A broken bus prints a
-          transport error or hangs until `timeout` kills it (status 124); both
-          count as broken."""
-          status, out = machine.execute(
-              "timeout 10 systemctl show -p ActiveState --value "
-              "multi-user.target 2>&1",
-              check_return=False,
-              timeout=20,
-          )
-          return status != 0 or bool(BUS_BROKEN.search(out)), status, out
-
-
-      machine.start()
-      machine.wait_for_unit("multi-user.target", timeout=120)
-
-      # Pre-reexec sanity: the bus works and shows no break.
-      broken, status, out = bus_broken()
-      assert not broken, (
-          f"bus already broken before any reexec: status={status} out={out!r}"
-      )
-      machine.log(f"pre-reexec sanity OK: {out.strip()!r}")
-
-      broke_at = None
-      for i in range(1, REEXECS + 1):
-          # The same D-Bus Manager.Reexecute that switch-to-configuration issues
-          # on a systemd change.
-          machine.execute(
-              "timeout 30 systemctl daemon-reexec",
-              check_return=False,
-              timeout=45,
-          )
-          broken, status, out = bus_broken()
-          machine.log(f"[reexec {i}] status={status} out={out.strip()!r}")
-          if broken:
-              broke_at = i
-              break
-
-      assert broke_at is None, (
-          f"nspawn D-Bus broke after daemon-reexec #{broke_at} of {REEXECS} "
-          "(systemctl hung or returned a bus transport error). The re-exec'd "
-          "PID 1 never finished re-initialising -- the test driver stopped "
-          "draining the notify socket, so PID 1's READY=1 resend blocked. "
-          "Never observed on QEMU."
-      )
-    '';
-}

nixos/tests/playwright-python.nix

@@ -29,7 +29,7 @@
               "firefox": {},
               "webkit": {}
             }
-            needle = re.compile("Nix.* Manual")
+            needle = re.compile("Nix.*Reference Manual")
             if len(sys.argv) != 3 or sys.argv[1] not in browsers.keys():
                 print(f"usage: {sys.argv[0]} [{'|'.join(browsers.keys())}] <url>")
                 sys.exit(1)

nixos/tests/postfix-tlspol.nix

@@ -9,10 +9,7 @@
 
   containers.machine = {
     services.postfix.enable = true;
-    services.postfix-tlspol = {
-      enable = true;
-      settings.server.metrics-address = "127.0.0.1:8642";
-    };
+    services.postfix-tlspol.enable = true;
 
     services.dnsmasq = {
       enable = true;
@@ -29,19 +26,13 @@
     with subtest("Interact with the service"):
       machine.succeed("postfix-tlspol -purge")
 
-      response = machine.log(machine.succeed("postfix-tlspol -query localhost"))
-      response = json.loads(machine.succeed("postfix-tlspol -query localhost"))
+      response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
       machine.log(json.dumps(response, indent=2))
 
       assert response["dane"]["policy"] == "", f"Unexpected DANE policy for localhost: {response["dane"]["policy"]}"
       assert response["mta-sts"]["policy"] == "TEMP", f"Unexpected MTA-STS policy for localhost: {response["mta-sts"]["policy"]}"
 
-    with subtest("Metrics listener"):
-      machine.log(machine.succeed("curl --silent --fail http://localhost:8642/metrics | grep --quiet postfix_tlspol_queries_total"))
-
-
-    with subtest("Hardening"):
-      machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
+    machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
   '';
 
 }

nixos/tests/scx/default.nix

@@ -13,19 +13,16 @@
     specialisation = {
       beerland.configuration.services.scx.scheduler = "scx_beerland";
       bpfland.configuration.services.scx.scheduler = "scx_bpfland";
-      cake.configuration.services.scx.scheduler = "scx_cake";
-      chaos.configuration.services.scx.scheduler = "scx_chaos";
       cosmos.configuration.services.scx.scheduler = "scx_cosmos";
       flash.configuration.services.scx.scheduler = "scx_flash";
-      flow.configuration.services.scx.scheduler = "scx_flow";
-      forge.configuration.services.scx.scheduler = "scx_forge";
+      flatcg.configuration.services.scx.scheduler = "scx_flatcg";
       lavd.configuration.services.scx.scheduler = "scx_lavd";
+      nest.configuration.services.scx.scheduler = "scx_nest";
       p2dq.configuration.services.scx.scheduler = "scx_p2dq";
-      pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
       rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
       rustland.configuration.services.scx.scheduler = "scx_rustland";
       rusty.configuration.services.scx.scheduler = "scx_rusty";
-      tickless.configuration.services.scx.scheduler = "scx_tickless";
+      simple.configuration.services.scx.scheduler = "scx_simple";
     };
   };
 
@@ -33,19 +30,16 @@
     specialisation = [
       "beerland",
       "bpfland",
-      "cake",
-      "chaos",
       "cosmos",
       "flash",
-      "flow",
-      "forge",
+      "flatcg",
       "lavd",
+      "nest",
       "p2dq",
-      "pandemonium",
       "rlfifo",
       "rustland",
       "rusty",
-      "tickless",
+      "simple"
     ]
 
     def activate_specialisation(name: str):

nixos/tests/unbound.nix

@@ -7,7 +7,6 @@
     * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via TCP/853 (DoT)
     * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/53 & UDP/53
     * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/853 (DoT)
-    * running a recursive DNS resolver on a machine in the network awaiting input from clients over UDP/853 (DoQ)
 
   In the below test setup we are trying to implement all of those use cases.
 
@@ -101,7 +100,7 @@ in
       };
 
     # The resolver that knows that forwards (only) to the authoritative server
-    # and listens on UDP/53, TCP/53, TCP/853 & UDP/853.
+    # and listens on UDP/53, TCP/53 & TCP/853.
     resolver =
       { lib, nodes, ... }:
       {
@@ -123,10 +122,7 @@ in
           853 # DNS over TLS
           443 # DNS over HTTPS
         ];
-        networking.firewall.allowedUDPPorts = [
-          53 # regular DNS
-          853 # DNS over QUIC
-        ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
 
         services.unbound = {
           enable = true;
@@ -154,8 +150,6 @@ in
               ];
               tls-service-pem = "${cert}/cert.pem";
               tls-service-key = "${cert}/key.pem";
-              quic-port = 853;
-              quic-size = "8m";
             };
             forward-zone = [
               {
@@ -312,7 +306,7 @@ in
               assert expected == out, f"Expected `{expected}` but got `{out}`"
 
 
-      def test(machine, remotes, /, doh=False, doq=False, zone=zone, records=records, args=[]):
+      def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
           """
           Run queries for the given remotes on the given machine.
           """
@@ -337,15 +331,6 @@ in
                           expected,
                           ["+https"] + args,
                       )
-                  if doq:
-                      query(
-                          machine,
-                          remote,
-                          query_type,
-                          zone,
-                          expected,
-                          ["+quic"] + args,
-                      )
 
 
       client.start()
@@ -363,12 +348,12 @@ in
 
       # verify that the resolver is able to resolve on all the local protocols
       with subtest("test that the resolver resolves on all protocols and transports"):
-          test(resolver, ["::1", "127.0.0.1"], doh=True, doq=True)
+          test(resolver, ["::1", "127.0.0.1"], doh=True)
 
       resolver.wait_for_unit("multi-user.target")
 
       with subtest("client should be able to query the resolver"):
-          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True, doq=True)
+          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
 
       # discard the client we do not need anymore
       client.shutdown()

nixos/tests/web-apps/immich.nix

@@ -8,7 +8,7 @@
       # These tests need a little more juice
       virtualisation = {
         cores = 2;
-        memorySize = 4096;
+        memorySize = 2048;
         diskSize = 4096;
       };
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -14,13 +14,13 @@ let
 
   pname = "ghostel";
 
-  version = "0.41.0-unstable-2026-07-05";
+  version = "0.39.0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "f77efee9172854abc08652637d23adc26faa25a2";
-    hash = "sha256-6ME+aStZ9X1pkTr0uwwhrJXEHu/uLStPHsKtbudXl9I=";
+    rev = "92bfcc57dc85f254ce95dcb51dbdd2411fea5f02";
+    hash = "sha256-havDs3fZENB/ozMWWKQkdsyHUIBIeewmrjL+3xJKM94=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ let
     deps = zig.fetchDeps {
       inherit (finalAttrs) src pname version;
       fetchAll = true;
-      hash = "sha256-lFU0ywNyP1q2NL9MkIfWciH03VAA/Act5dGYAV4V7EY=";
+      hash = "sha256-CTsG3dXu3DECDbklBAtr2fYou82WNvQ1Q3JET0TmuyM=";
     };
 
     nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
@@ -48,6 +48,19 @@ let
 
     zigBuildFlags = finalAttrs.zigCheckFlags;
 
+    postPatch = ''
+      # https://github.com/dakra/ghostel/issues/446
+      substituteInPlace build.zig \
+        --replace-fail 'addInstallFile(version_file, "../ghostel-module.version")' \
+                       'addInstallFile(version_file, "ghostel-module.version")'
+
+      # remove copy_step
+      substituteInPlace build.zig \
+        --replace-fail 'b.getInstallStep().dependOn(&copy_step.step);' ' ' \
+        --replace-fail 'const copy_step = b.addInstallFile' \
+                       '_ = b.addInstallFile'
+    '';
+
     postConfigure = ''
       cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
       chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
@@ -64,7 +77,7 @@ melpaBuild {
   '';
 
   preBuild = ''
-    install ${module}/ghostel-module${libExt} ghostel-module${libExt}
+    install ${module}/lib/libghostel-module${libExt} ghostel-module${libExt}
     install --mode=444 ${module}/ghostel-module.version ghostel-module.version
   '';
 
@@ -77,10 +90,7 @@ melpaBuild {
   meta = {
     homepage = "https://github.com/dakra/ghostel";
     description = "Terminal emulator powered by libghostty";
-    maintainers = with lib.maintainers; [
-      rohan-datar
-      vonfry
-    ];
+    maintainers = with lib.maintainers; [ vonfry ];
     license = lib.licenses.gpl3Plus;
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix

@@ -15,9 +15,9 @@ let
 
   # Usage:
   # treesit-grammars.with-grammars (p: [ p.tree-sitter-bash p.tree-sitter-c ... ])
-  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter-grammars.derivations);
+  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter.builtGrammars);
 
-  with-all-grammars = grammarPackage pkgs.tree-sitter-grammars.allGrammars;
+  with-all-grammars = grammarPackage pkgs.tree-sitter.allGrammars;
 in
 {
   inherit with-grammars with-all-grammars;

pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix

@@ -12,16 +12,16 @@ let
 
   tsc-dyn = rustPlatform.buildRustPackage (finalAttrs: {
     pname = "tsc-dyn";
-    version = "0.19.4";
+    version = "0.18.0";
 
     src = fetchFromGitHub {
       owner = "emacs-tree-sitter";
       repo = "emacs-tree-sitter";
       tag = finalAttrs.version;
-      hash = "sha256-7B9Q8ke8gY9cFIAjpyH21P240goKUEKgppfqP3PSxYA=";
+      hash = "sha256-LrakDpP3ZhRQqz47dPcyoQnu5lROdaNlxGaQfQT6u+k=";
     };
 
-    cargoHash = "sha256-mjR8PehbhY1o/5L2l/OMh/NwjjmQXErPHh00cAD94pw=";
+    cargoHash = "sha256-Tua3ZFfSyWVYXU9mPLWXE6ejGlXowTNe3nvZBaicmSQ=";
 
     sourceRoot = "${finalAttrs.src.name}/core";
 

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -21,20 +21,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.tar.gz";
-      hash = "sha256-uOhFuDqVw3pxtqBvOQH+FpJTFrneaD/R0VcpJZRYD2o=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.tar.gz";
+      hash = "sha256-Q3LOhpwpU6vrPWEzA+s2ZnbRxo+EeodBUHUYs3Xikrs=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-YM105ozP78oLDmwKL0t4Z4wGjCDh6xvhf/C1oCD6Qi8=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
-      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.dmg";
+      hash = "sha256-UEkYDJBjRvvUUB2UFsc37kdp/i+1ctqULSKs62/t9/I=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
-      hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.dmg";
+      hash = "sha256-scMwDF+mIfx/66cBrvdxp+gU3+qA2sUWqoGCEhPItjE=";
     };
   };
   # update-script-end: urls
@@ -48,8 +48,8 @@ in
   product = "CLion";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.59";
+  version = "2026.1.2";
+  buildNumber = "261.24374.148";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.tar.gz";
-      hash = "sha256-pHSbmAZ+tSfa0wdtDp/3Ib/GNMP30OFNQlHWUfMwrW0=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2.tar.gz";
+      hash = "sha256-1FkDEaapyDbTPe4soOdyCHLkp/UT3rZ6siGyGyjmGJo=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-E8WpA4s/ePEDAs47IPC0v10C1VKl9UYU7VNX/5igpm4=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
-      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2.dmg";
+      hash = "sha256-iWYTMImwzMh9KSJgek8a84o/KlLWBaOj80vKlB8Ftes=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
-      hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.dmg";
+      hash = "sha256-TFnEMq7u51UvtaOjnxS+abJhsR3aSnaQjNFfF8EQrcQ=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.72";
+  version = "2026.1.2";
+  buildNumber = "261.24374.154";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -15,20 +15,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.tar.gz";
-      hash = "sha256-MQTYXZUH/4ggZeP465UGQCtKgSkJLSaCZiu26cTwY/w=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.tar.gz";
+      hash = "sha256-pvBJcW2h0J2eDsFQDGC/AaX/ig/iQZF43R/y/bK3dWM=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-dlnnkWCSM8Pmv2fBv8yG9foRdkd8pYFa5hJbDq6EqIs=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
-      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.dmg";
+      hash = "sha256-Sv6A37Y5yIkaE+qnFEGDBq/q9fSSSZPjJC59NB2Fsns=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
-      hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.dmg";
+      hash = "sha256-LRyg2DLmTgChdFKR8NMGGjWDZTAWnjQpoTp3NIBvYrI=";
     };
   };
   # update-script-end: urls
@@ -43,8 +43,8 @@ mkJetBrainsProduct {
   productShort = "IDEA";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.65";
+  version = "2026.1.3";
+  buildNumber = "261.25134.95";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.tar.gz";
-      hash = "sha256-SF25D7dDn7b6AzcXEDLKwhpjTnCqYz1fEmvND5dl8Is=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.tar.gz";
+      hash = "sha256-hXb2KcCaNKIJOGbN0ZUDxMKuX++dO1FRoxvC580VIHQ=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-+As41qcyCvAICIttMEi30b8mBTZoWKK4rjxjkVx4TXs=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
-      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.dmg";
+      hash = "sha256-Q9m/XIgDg4F4yH0P35IaInk/se5CXqewvp248VqA4uc=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
-      hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.dmg";
+      hash = "sha256-Yo50EhVQDg7c/C3JZ9utZxpsOY0DuZfgYzYtBN9Nmwk=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "PhpStorm";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.71";
+  version = "2026.1.3";
+  buildNumber = "261.25134.104";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -13,20 +13,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.tar.gz";
-      hash = "sha256-RIufgZhg/n+D1uEdcDyYRjTDfh8Jicyz4h0B1kTbVXs=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.tar.gz";
+      hash = "sha256-kcd1vhb7CFn5sY69RW2I4THK3zN7DOn52O0YeIZWGWY=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-5rTyUmevreBL5nZPa7FuodFhWcrjSQ+7T1jMFo7P/uM=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
-      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.dmg";
+      hash = "sha256-Fej8KylKSFKVxCMrBAcUIDwb0v5B5r1RysMAvcBVgh8=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
-      hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.dmg";
+      hash = "sha256-oau/wa9spYnn7XE07NGsINyqof3Mu9t9WQLuPAQ4TDc=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ in
   product = "PyCharm";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.68";
+  version = "2026.1.2";
+  buildNumber = "261.24374.152";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -24,20 +24,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.tar.gz";
-      hash = "sha256-K+X2M4idv+oDqC/dkbzMTX3W3zx0b0e8ZTsxkP7rAfI=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.tar.gz";
+      hash = "sha256-OmysaGXGMxxAAa2qrHvX8yXIwJLU7tKG8/EBGhr55EA=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-xcwd4OgobMXFQ2W+SN6O5I3mud4kedVQ/0rZBWbXIGY=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
-      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.dmg";
+      hash = "sha256-uoOP+EYB11M99MlAFF7efZSKmCk0fwjCImFiasUQPUw=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
-      hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.dmg";
+      hash = "sha256-Mo6gxWatX6wlL3s8Li19F58cnKZtOtFUfNyGPrC6CtA=";
     };
   };
   # update-script-end: urls
@@ -51,8 +51,8 @@ in
   product = "Rider";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.60";
+  version = "2026.1.2";
+  buildNumber = "261.24374.190";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.tar.gz";
-      hash = "sha256-0EhtU4XKWI9i7ij+m5uvxHSYnbQaYJy8Sa6S1OW4CFU=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.tar.gz";
+      hash = "sha256-0KF/IEVRT8kgHpULEmqMy9gOf06IIDA4vEV3RujjQoE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-kiuRp9JhdS0aUFPX1brI1T9ik/iWhglIckHvv4bdPWk=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
-      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.dmg";
+      hash = "sha256-UjpwMCXhI+bMOvyyEbRBoNW3GGCDpi7aF6hUxffW/h0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
-      hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.dmg";
+      hash = "sha256-lqa3L+rBiEH/hPmFcevWBumvvyBBzoUR3ttvA8s0uT0=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "RubyMine";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.67";
+  version = "2026.1.3";
+  buildNumber = "261.25134.97";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -18,20 +18,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.tar.gz";
-      hash = "sha256-8x/AP6uKSVJavwjA9tYT1IM1xVspOZZzwmcwpGloIcw=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3.tar.gz";
+      hash = "sha256-0+v05zxvFqXV13c8oV9dTTwtO+shgywD75cwUiZAab0=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
-      hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-SZ4OkWgAGeSafFo1ml5dv5tN5su+HgzbEhQ5GzPqGdo=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
-      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3.dmg";
+      hash = "sha256-JA++mbKvRTvjHEblbgmjBzbWbxcV7ss3+W9M6i6ePu0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
-      hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3-aarch64.dmg";
+      hash = "sha256-ndipMTztrYeUdo4MfOHjJHk3liHutWmMj+J6G8xjtWA=";
     };
   };
   # update-script-end: urls
@@ -45,8 +45,8 @@ in
   product = "RustRover";
 
   # update-script-start: version
-  version = "2026.1.4";
-  buildNumber = "261.26222.73";
+  version = "2026.1.3";
+  buildNumber = "261.25134.134";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/vim/plugins/generated.nix

@@ -11735,20 +11735,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  neovim-project = buildVimPlugin {
-    pname = "neovim-project";
-    version = "0.1";
-    src = fetchFromGitHub {
-      owner = "coffebar";
-      repo = "neovim-project";
-      tag = "0.1";
-      hash = "sha256-OCo4rF+mJ5it1S7UhlzpPpbi6Zxt211c4v6t1IPf1rw=";
-    };
-    meta.homepage = "https://github.com/coffebar/neovim-project/";
-    meta.license = getLicenseFromSpdxId "Apache-2.0";
-    meta.hydraPlatforms = [ ];
-  };
-
   neovim-sensible = buildVimPlugin {
     pname = "neovim-sensible";
     version = "0-unstable-2017-09-20";
@@ -11763,20 +11749,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  neovim-session-manager = buildVimPlugin {
-    pname = "neovim-session-manager";
-    version = "0-unstable-2026-01-26";
-    src = fetchFromGitHub {
-      owner = "shatur";
-      repo = "neovim-session-manager";
-      rev = "89d253a6c68af60b49570044591d5b8701866601";
-      hash = "sha256-d7lXPIy6qJDPvFk8twwkqKUWI205HfTqXMspnVRkng0=";
-    };
-    meta.homepage = "https://github.com/shatur/neovim-session-manager/";
-    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
-    meta.hydraPlatforms = [ ];
-  };
-
   neovim-tips = buildVimPlugin {
     pname = "neovim-tips";
     version = "0.8.4";

pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix

@@ -29,7 +29,6 @@ let
     "neorg"
     "neorg-interim-ls"
     "neotest"
-    "neotest-nix"
     "nui-nvim"
     "nvim-cmp"
     "nvim-nio"

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   perl,
 }:
 let
-  version = "0.1.2";
+  version = "release-v0.1";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    tag = "v${version}";
-    hash = "sha256-x7OhVz4rWj2x1UsUm8iqkB5PQVAELvAYJ0yo2beU9TY=";
+    rev = "2033b42ab72fb9f27b35769f9cb7a9f4f1993db4";
+    hash = "sha256-Ql/17DSHpBVbihUHssyZe3MGC5fgasbjgxdABp8xk24=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
@@ -76,6 +76,7 @@ vimUtils.buildVimPlugin {
 
   passthru = {
     updateScript = nix-update-script {
+      extraArgs = [ "--version=branch" ];
       attrPath = "vimPlugins.avante-nvim.avante-nvim-lib";
     };
 

pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix

@@ -8,9 +8,11 @@ vimUtils.buildVimPlugin {
   preInstall = "cd data/syntax-highlighting/vim";
 
   meta = {
-    description = "Vim plugin for meson providing syntax highlighting";
     inherit (meson.meta)
       homepage
+      description
+      mainProgram
+      longDescription
       license
       platforms
       ;

pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

@@ -4,7 +4,6 @@
   symlinkJoin,
   vimUtils,
   tree-sitter,
-  tree-sitter-grammars,
   neovim,
   neovimUtils,
   runCommand,
@@ -128,7 +127,7 @@ let
   withPlugins =
     f:
     let
-      selectedGrammars = f (tree-sitter-grammars.derivations // builtGrammars);
+      selectedGrammars = f (tree-sitter.builtGrammars // builtGrammars);
 
       grammarPlugins = map grammarToPlugin selectedGrammars;
 

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3024,25 +3024,12 @@ assertNoAdditions {
     ];
   };
 
-  neovim-project = super.neovim-project.overrideAttrs {
-    dependencies = with self; [
-      plenary-nvim
-      neovim-session-manager
-    ];
-  };
-
   neovim-sensible = super.neovim-sensible.overrideAttrs (old: {
     meta = old.meta // {
       license = lib.licenses.mit;
     };
   });
 
-  neovim-session-manager = super.neovim-session-manager.overrideAttrs {
-    dependencies = with self; [
-      plenary-nvim
-    ];
-  };
-
   neovim-tips = super.neovim-tips.overrideAttrs {
     dependencies = [
       self.nui-nvim

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -836,9 +836,7 @@ https://github.com/marilari88/neotest-vitest/,,
 https://github.com/lawrence-laz/neotest-zig/,,
 https://github.com/Shatur/neovim-ayu/,,
 https://github.com/cloudhead/neovim-fuzzy/,,
-https://github.com/coffebar/neovim-project/,,
 https://github.com/jeffkreeftmeijer/neovim-sensible/,,
-https://github.com/shatur/neovim-session-manager/,,
 https://github.com/saxon1964/neovim-tips/,,
 https://github.com/trunk-io/neovim-trunk/,,
 https://github.com/Shougo/neoyank.vim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/uvQIg773WUzalc9XFtBrocsGye3v5y1rvKyJVpXWS0=";
+          hash = "sha256-0iSA2ck0tJdOiiDlhwp7XaqYDFEAMZyI9mALIvYD6Zw=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-zC0iYoAxmymxdqo2JgDcMOvUOA3pFbkx0s9C4F6E75k=";
+          hash = "sha256-35dMOAr9pb7Tb5gkiDp2K0xdodGduOEcJ9IFSenD03s=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-mhZBWpV3Gl5TLieIEvrtDmtqQBKeiCcDCwOShQnp++Y=";
+          hash = "sha256-rojFi5393B56j86IAtWWVP0XiNeCsnAvTFIr3CcGZYY=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-I570YO5mvXgzXG52NdoGjgVgHbyshm6fIkCIN0li9+4=";
+          hash = "sha256-X8nXfpfaM9KtZLvL4ACyevrtdm+eihtjXVlYHSSas78=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.201";
+      version = "2.1.198";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -396,8 +396,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.16.17";
-          hash = "sha256-k54hpRlzjtNWv0mIUBKFxJYc5T2jpWxB9U8nuXXmjJ0=";
+          version = "2.16.14";
+          hash = "sha256-WuDsYSQ5B2xA3LnU1fiXBx8yqOplGstZO0qYaLtPF0A=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
@@ -1145,8 +1145,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "9.0.2";
-          hash = "sha256-RCjtYpGDEjFkKvTspvgopccNVvMt1imeAGHZYRsle/Q=";
+          version = "9.0.1";
+          hash = "sha256-P2GoE92SwGMb45On5ziTZ9dBjPb0VnFSo+4TEwrcWuM=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -1215,8 +1215,8 @@ let
         mktplcRef = {
           name = "flutter";
           publisher = "dart-code";
-          version = "3.138.0";
-          hash = "sha256-FkaUKApoN6e8ET2o/71GVhyNWdZ34t6fqEzlraH7QBc=";
+          version = "3.136.0";
+          hash = "sha256-RK493qHjEK/k8oy/OIzO3bvNnFo+ZftQhZMIAmBCaJk=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1346,8 +1346,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.29.7";
-          hash = "sha256-l0CTWC16Aw2u8uob5tKauYIT3KaDsptV/L8WR54eN64=";
+          version = "2.29.6";
+          hash = "sha256-CHpRetKZnGzShIePnbVUdR06/1AAO2I1RX7NiZ7GBNs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -4135,8 +4135,8 @@ let
         mktplcRef = {
           name = "sas-lsp";
           publisher = "SAS";
-          version = "1.20.0";
-          hash = "sha256-s2CAzAXMXdmCyOoMmyHjz5GRPHi5riDf/Og3SVrW7QI=";
+          version = "1.19.1";
+          hash = "sha256-aVtMiSbPLs6zIdcD0TopIAVKvJksSdTy9ND+jGw/G0A=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/SAS.sas-lsp/changelog";

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "1.6.2";
-    hash = "sha256-irI7rcyCUc3jUhrEa449pDix3MhwMh18ezvri3bi0Gk=";
+    version = "1.6.1";
+    hash = "sha256-9q3rK/7Q7XiaH9DZN8Yvar/WTdYdEdRXH02WK1tfk5k=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/sysdig.sysdig-vscode-ext/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "sysdig-vscode-ext";
     publisher = "sysdig";
-    version = "0.2.17";
-    hash = "sha256-8qYDp6IcUvlFdCPmMozHVocsgGqK8b2+tve1wBO3bhU=";
+    version = "0.2.14";
+    hash = "sha256-b4e5Qgk8YfI1nAB8yrM5k0svgebgZSucXRktkK0EItk=";
   };
 
   meta = {

pkgs/applications/editors/vscode/generic.nix

@@ -308,6 +308,11 @@ stdenv.mkDerivation (
     dontConfigure = true;
     noDumpEnvVars = true;
 
+    stripExclude = lib.optional hasVsceSign [
+      # vsce-sign is a single executable application built with Node.js, and it becomes non-functional if stripped
+      "lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
+    ];
+
     installPhase = ''
       runHook preInstall
     ''
@@ -469,11 +474,9 @@ stdenv.mkDerivation (
           --add-needed ${libglvnd}/lib/libEGL.so.1 \
           $out/lib/${libraryName}/${executableName}
       ''
-      # restore original vsce-sign, which has integrity checks
       + (lib.optionalString hasVsceSign ''
-        cp -r ./resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign "$out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
         patchelf \
-          --add-needed ${lib.getLib openssl}/lib/libssl.so.3 \
+          --add-needed ${lib.getLib openssl}/lib/libssl.so \
           $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
       '')
     );

pkgs/applications/emulators/libretro/cores/dolphin.nix

@@ -20,13 +20,13 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "894fdda35688f3ac33c680ef6fe17ce965a16bf1";
-    hash = "sha256-Dkvv8EgQjLjyt0muSVF0Cnex/3xUcZXvWTzgUw61Sv0=";
+    rev = "fec5e8e106489e0d00e69dd4afaabc3d95688047";
+    hash = "sha256-GNAZgFHZCnokL3HYU+xsFtghpN09QbsZpwMW1eMtSvU=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/fceumm.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-06-30";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "6e00afac498903586330492cdd81354a6c4c0d4c";
-    hash = "sha256-0WPMqXj/hNtFxUAIL16B80SxZ8FW31M4g/8wVMZLv/w=";
+    rev = "f87bc875bd68262211e2e01ffbaf3662626a3e4f";
+    hash = "sha256-TUrhDbRArO/RISZawu5p9FIZlFf8pPlBrD9WRrdSRPk=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/mame2010.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "mame2010";
-  version = "0-unstable-2026-07-03";
+  version = "0-unstable-2026-06-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2010-libretro";
-    rev = "484456818393505dd4367e6e4c116c573c04a1ec";
-    hash = "sha256-CstMUeTxOsL419R2kzSK6hDd1okxsbtwMvqjwzSf3bI=";
+    rev = "36c36bb0a59902aa75af3e80853f7f893d7ffe91";
+    hash = "sha256-tudxNTySzhoN4SzlzqhzuDE9Qmyr9Ud87fCiW+0MITc=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2015.nix

@@ -22,8 +22,7 @@ mkLibretroCore {
   extraBuildInputs = [ alsa-lib ];
   makefile = "Makefile";
   # Build failures when this is set to a bigger number
-  env.NIX_BUILD_CORES = 8;
-
+  NIX_BUILD_CORES = 8;
   meta = {
     description = "Port of MAME ~2015 to libretro, compatible with MAME 0.160 sets";
     homepage = "https://github.com/libretro/mame2015-libretro";

pkgs/applications/emulators/libretro/cores/melondsds.nix

@@ -1,27 +1,17 @@
 {
   lib,
-  applyPatches,
-  coreutils,
   fetchFromGitHub,
-  fmt_11,
   glm,
-  gnugrep,
-  gnused,
+  libslirp,
+  fmt_11,
+  span-lite,
   howard-hinnant-date,
-  jq,
   libGL,
   libGLU,
-  libslirp,
-  mkLibretroCore,
-  nix,
-  nix-prefetch-git,
   cmake,
-  span-lite,
-  unstableGitUpdater,
-  writeShellApplication,
+  mkLibretroCore,
 }:
 let
-  # NOTE: before changing the following fetches, see the updateScript below
   # https://github.com/JesseTG/melonds-ds/blob/33c48260402865ef77667487528efd5ca7ce1233/cmake/FetchDependencies.cmake#L44
   melonDS-src = fetchFromGitHub {
     owner = "JesseTG";
@@ -38,8 +28,8 @@ let
   embed-binaries-src = fetchFromGitHub {
     owner = "andoalon";
     repo = "embed-binaries";
-    rev = "078b62beba97e8192c99bfb16d5e17220cfc7598";
-    hash = "sha256-EkK+ZCbrZ2Y9wJ864OIwRWDfHcmxzKMco0QAkLOQOwY=";
+    rev = "21f28cabbba02cd657578c70b7aedd0f141467ff";
+    hash = "sha256-iW3DBGdp/ykE3EoGcuirq5V5lKV0vemzIjDFrINzQPM=";
   };
   pntr-src = fetchFromGitHub {
     owner = "robloach";
@@ -54,33 +44,35 @@ let
     hash = "sha256-J5wAqF5yQ5KYArJJyKzaqscWsXq+KAPKXybYfVgasXs=";
   };
   # using nixpkgs zlib gives a linking error
-  zlib-src = applyPatches {
-    src = fetchFromGitHub {
-      owner = "madler";
-      repo = "zlib";
-      rev = "925af44f3cde53c6b076611c297850091b5dc7bb";
-      hash = "sha256-TkPLWSN5QcPlL9D0kc/yhH0/puE9bFND24aj5NVDKYs=";
-    };
-    patches = [ ./patches/melondsds-zlib-no-zconf-rename.patch ];
+  zlib-src = fetchFromGitHub {
+    owner = "madler";
+    repo = "zlib";
+    rev = "570720b0c24f9686c33f35a1b3165c1f568b96be";
+    hash = "sha256-5g/Jo8M/jvkgV0NofSAV4JdwJSk5Lyv9iGRb2Kz/CC0=";
   };
 in
 mkLibretroCore rec {
   core = "melondsds";
-  version = "0-unstable-2026-03-03";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "JesseTG";
     repo = "melonds-ds";
-    rev = "bac0256dc6a8736c5a228f57c562257e45fd49f3";
-    hash = "sha256-EeXYibPV9BPazC/i5UqXEd4BKlIZbNbPNgpsoo4ws7k=";
+    rev = "33c48260402865ef77667487528efd5ca7ce1233";
+    hash = "sha256-n5MZ6BWUWRi+jz34EbL+SeSkjFZeqQNXE3hS6JzS424=";
   };
 
+  patches = [ ./patches/melondsds-noslirpcopy.patch ];
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail "find_package(Git REQUIRED)" ""
 
     substituteInPlace src/libretro/CMakeLists.txt \
       --replace-fail "include(embed-binaries)" "include(${embed-binaries-src}/cmake/embed-binaries.cmake)"
+
+    substituteInPlace cmake/FetchDependencies.cmake \
+      --replace-fail "set_target_properties(example" "set_target_properties(zlib_example" \
+      --replace-fail "set_target_properties(zlib_example64 minigzip64" "set_target_properties(zlib_example64"
   '';
 
   makefile = "";
@@ -108,79 +100,6 @@ mkLibretroCore rec {
 
   postBuild = "cd src/libretro";
 
-  passthru.updateScript = [
-    (lib.getExe (writeShellApplication {
-      name = "update-libretro-melondsds";
-      runtimeInputs = [
-        coreutils
-        gnugrep
-        gnused
-        jq
-        nix
-        nix-prefetch-git
-      ];
-      text = ''
-        ${lib.escapeShellArgs (unstableGitUpdater {
-          hardcodeZeroVersion = true;
-        })}
-
-        src=$(nix-build --no-out-link -A "$UPDATE_NIX_ATTR_PATH.src")
-        core_file="pkgs/applications/emulators/libretro/cores/melondsds.nix"
-
-        # find lines in the format:
-        #   fetch_dependency(name url rev)
-        # and extracts name, url and rev
-        grep "^fetch_dependency" "''${src}/cmake/FetchDependencies.cmake" |
-          sed 's/"//g' |
-          sed 's/fetch_dependency(\(.*\))/\1/' |
-          while read -r name url rev
-          do
-            echo >&2
-
-            # example: if there is fetch_dependency(melonDS ...) and no melonDS-src
-            if ! fetch_block=$(grep -A10 "''${name}-src =" "$core_file")
-            then
-
-              # if the dependency comes from nix, we just skip it
-              if grep -q "FETCHCONTENT_SOURCE_DIR_''${name^^}" "$core_file"
-              then
-                echo "> skipped: ''${name} is provided by nixpkgs" >&2
-                continue
-              fi
-
-              # otherwise, its a new dependency not specified on the config, and the updater can't continue
-              echo "> ERROR: dependency missing: ''${name}" >&2
-              exit 1
-            fi
-
-            echo "> ''${name}: ''${url} (''${rev})" >&2
-
-            prefetch=$(nix-prefetch-git --url "''${url}" --rev "''${rev}" --quiet)
-            rev=$(echo "$prefetch" | jq -r ".rev")
-            hash=$(echo "$prefetch" | jq -r ".hash")
-
-            old_rev=$(echo "$fetch_block" | grep -m1 "rev =" | sed 's/\s*rev = "\(.*\)".*/\1/')
-            old_hash=$(echo "$fetch_block" | grep -m1 "hash =" | sed 's/\s*hash = "\(.*\)".*/\1/')
-
-            if [[ "$old_hash" == "$hash" ]]
-            then
-              echo "> skipped: same hash" >&2
-              continue
-            fi
-
-            echo "rev - old: $old_rev" >&2
-            echo "rev - new: $rev" >&2
-            echo "hash - old: $old_hash" >&2
-            echo "hash - new: $hash" >&2
-
-            # finally replace old revision and old hash by the new one
-            sed -i "s|$old_hash|$hash|" "$core_file"
-            sed -i "s/$old_rev/$rev/" "$core_file"
-          done
-      '';
-    }))
-  ];
-
   meta = {
     description = "A remake of the libretro MelonDS core";
     homepage = "https://github.com/JesseTG/melonds-ds";

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "340f9e9014c292fc47a8844a871a71dafe072b6d";
-    hash = "sha256-geBK8RIlaRcWn4CDzVl3pjK0WOFQcMZl7zFMXE2oZNo=";
+    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
+    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/patches/melondsds-noslirpcopy.patch

@@ -0,0 +1,17 @@
+diff --git a/cmake/libslirp.cmake b/cmake/libslirp.cmake
+index 1cb6758..bef1793 100644
+--- a/cmake/libslirp.cmake
++++ b/cmake/libslirp.cmake
+@@ -2,12 +2,6 @@ add_library(slirp STATIC
+         src/glib-stub/glib.c
+ )
+ 
+-# Copy libslirp's files to another directory so that we can include it as <slirp/libslirp.h>
+-file(MAKE_DIRECTORY "${libslirp_BINARY_DIR}/include")
+-file(REMOVE_RECURSE "${libslirp_BINARY_DIR}/include/slirp")
+-file(COPY "${libslirp_SOURCE_DIR}/src" DESTINATION "${libslirp_BINARY_DIR}/include")
+-file(RENAME "${libslirp_BINARY_DIR}/include/src" "${libslirp_BINARY_DIR}/include/slirp")
+-
+ target_include_directories(slirp PUBLIC
+     "${libslirp_BINARY_DIR}/include"
+     "${libslirp_SOURCE_DIR}/src"

pkgs/applications/emulators/libretro/cores/patches/melondsds-zlib-no-zconf-rename.patch

@@ -1,23 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 13dd268..69779cf 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -62,18 +62,6 @@ if(MSVC)
-     include_directories(${CMAKE_CURRENT_SOURCE_DIR})
- endif()
- 
--if(NOT CMAKE_CURRENT_SOURCE_DIR STREQUAL CMAKE_CURRENT_BINARY_DIR)
--    # If we're doing an out of source build and the user has a zconf.h
--    # in their source tree...
--    if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h)
--        message(STATUS "Renaming")
--        message(STATUS "    ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h")
--        message(STATUS "to 'zconf.h.included' because this file is included with zlib")
--        message(STATUS "but CMake generates it automatically in the build directory.")
--        file(RENAME ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h ${CMAKE_CURRENT_SOURCE_DIR}/zconf.h.included)
--  endif()
--endif()
--
- set(ZLIB_PC ${CMAKE_CURRENT_BINARY_DIR}/zlib.pc)
- configure_file( ${CMAKE_CURRENT_SOURCE_DIR}/zlib.pc.cmakein
- 		${ZLIB_PC} @ONLY)

pkgs/applications/emulators/libretro/cores/pcsx2.nix

@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2026-06-29";
+  version = "0-unstable-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "b03969a333f38de21f866c2a10da4300d170364d";
-    hash = "sha256-djGM6hMQCvJQG2+PWDRLeM+13/Q8upD25uhH4vU/yko=";
+    rev = "6d11ca54728b0c9e0a4bf3da743d56c7d29abb4e";
+    hash = "sha256-JE2EU/ugtXwEqYIzd0JSWXUy29X44hYHiC/LfaaOjkw=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-07-01";
+  version = "0-unstable-2026-06-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "141978db577b52cb943641629401776e49ccbbe6";
-    hash = "sha256-USRBq+h2HAoDIdYVd47wGLEnUzJAEOvikuvSNTHpboI=";
+    rev = "b760de6a1eb1bfcd7833c5b677ff9170d104302f";
+    hash = "sha256-JZrQbhntCGV4WIktUbtVXCSGAEmh9gTPn+tLiMyt6ZY=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/stella2014.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella2014";
-  version = "0-unstable-2026-07-04";
+  version = "0-unstable-2026-04-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "stella2014-libretro";
-    rev = "8ddf2146ed2d2053cff9df64192f920e57709629";
-    hash = "sha256-VDywbP7PhcQPHhu/KMvV1LlI/iOGjMzRooqvoT+Tnxc=";
+    rev = "eed47e154d1bbda3305e9ef2d486b6710c8973f4";
+    hash = "sha256-QpPjVnFCkn6xlB7LxpE6bsNfYe3HSsEKUjqmEf2yTvA=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/wine/base.nix

@@ -64,7 +64,6 @@
   x11Support ? false,
   ffmpegSupport ? false,
   embedInstallers ? false,
-  smartcardSupport ? false,
 }:
 
 let
@@ -252,9 +251,6 @@ stdenv.mkDerivation (
         ++ lib.optionals ffmpegSupport [
           pkgs.ffmpeg-headless
         ]
-        ++ lib.optionals smartcardSupport [
-          pkgs.pcsclite
-        ]
       );
 
     inherit patches;
@@ -279,8 +275,7 @@ stdenv.mkDerivation (
       ++ lib.optionals vulkanSupport [ "--with-vulkan" ]
       ++ lib.optionals ((stdenv.hostPlatform.isDarwin && !xineramaSupport) || !x11Support) [
         "--without-x"
-      ]
-      ++ lib.optionals smartcardSupport [ "--with-pcsclite" ];
+      ];
 
     # Wine locates a lot of libraries dynamically through dlopen().  Add
     # them to the RPATH so that the user doesn't have to set them in

pkgs/applications/emulators/wine/default.nix

@@ -51,7 +51,6 @@ args@{
   ffmpegSupport ? false,
   embedInstallers ? false, # The Mono and Gecko MSI installers
   moltenvk, # Allow users to override MoltenVK easily
-  smartcardSupport ? false,
 }:
 
 let

pkgs/applications/misc/electrum/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  protobuf,
   wrapQtAppsHook,
   python3,
   zbar,
@@ -20,14 +21,14 @@ let
     else
       "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
 in
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3.pkgs.buildPythonApplication rec {
   pname = "electrum";
-  version = "4.8.0";
+  version = "4.7.2";
   pyproject = true;
 
   src = fetchurl {
-    url = "https://download.electrum.org/${finalAttrs.version}/Electrum-${finalAttrs.version}.tar.gz";
-    hash = "sha256-z14bzs81eJNTMSWSBLTyCmsljDNztG54SVkoTcSqvsM=";
+    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
+    hash = "sha256-qzA/HLw+QPTdE6qsg8TNqr0DuOgfMrs8UcEnfp1uBpc=";
   };
 
   build-system = with python3.pkgs; [
@@ -35,6 +36,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    protobuf
     python3.pkgs.pythonRelaxDepsHook
   ]
   ++ lib.optionals enableQt [
@@ -99,7 +101,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "tests/test_qml_types.py"
   ];
 
-  postPatch =
+  postPatch = ''
+    # Upstream tarball omits regenerated protobuf bindings in some releases.
+    protoc --python_out=. electrum/paymentrequest.proto
+  ''
+  + (
     if enableQt then
       ''
         substituteInPlace ./electrum/qrscanner.py \
@@ -108,7 +114,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     else
       ''
         sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
-      '';
+      ''
+  );
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $out/share/applications/electrum.desktop \
@@ -168,4 +175,4 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     ];
     mainProgram = "electrum";
   };
-})
+}

pkgs/applications/networking/browsers/chromium/info.json

@@ -838,28 +838,28 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "150.0.7871.46",
+    "version": "149.0.7827.200",
     "deps": {
       "depot_tools": {
-        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
-        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
+        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
+        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
       },
       "gn": {
-        "version": "0-unstable-2026-05-27",
-        "rev": "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
-        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
+        "version": "0-unstable-2026-05-01",
+        "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756",
+        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "150.0.7871.46-1",
-        "hash": "sha256-SuZTPUpv7onrHvDrwZO0Xo/mxLVcGUSxf2xb+OC//L8="
+        "rev": "149.0.7827.200-1",
+        "hash": "sha256-D7c1ToAoUzAMpXoe60YPimRqe6/LRe0T95TduXUeTFo="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
-        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
+        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
+        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -869,13 +869,13 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "03641f7a5b05e48e318d64369057db577cafc594",
-        "hash": "sha256-KnWESGG6aI0S+fkJ3/T1x4QSiIYaOOvWUAm6l6l9iME="
+        "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b",
+        "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "5abc7f839700f0f17338434e1c1c6a8c87c00c11",
-        "hash": "sha256-vT1km7JgVpotDoNK+ae1gplSHcwrVNLsv/QAFUrDsIM="
+        "rev": "be1c391acca009d8d80535ce924e3d285451cdfa",
+        "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@@ -884,13 +884,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "d6c7a21e978f0adaa43accaad53bc64f0b64f6ec",
-        "hash": "sha256-EuaVSYiR7qrlYqBR0UqdWCvwdzJSn0RS2wC/lnP19AE="
+        "rev": "71192be150bbe04d87bb5298512d464e38d2f654",
+        "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "6e5ec6f78d8b9f2e8a50fcc5692d1fc8b2964bde",
-        "hash": "sha256-qrkx8Z1fc088Ja32obIUPxDwklI7i1wdEw051UZ08u8="
+        "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db",
+        "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -909,8 +909,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "3da515a67f412be05ea1ea6b39832a69aef8f54e",
-        "hash": "sha256-wrkFsPX7jrsjD/Ow1gna/xLvk0E49m5GVxP1G7Vx7HM="
+        "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010",
+        "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -919,8 +919,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "997d654308b6a1a17435e472ef5190aecb12e3eb",
-        "hash": "sha256-xgDgW2foZZEWpr0ibSG21kf028FN07/1ecOqFCkNj/I="
+        "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8",
+        "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -929,8 +929,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
-        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
+        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
+        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -944,18 +944,13 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "01471f4b3846c97eceb5b16b8acad950808791b2",
-        "hash": "sha256-SrL+G3osTtJGQslfCBEYbslb2kWtHRrwO87PHi+5o6E="
+        "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b",
+        "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "92d1fdf881a932e7aa2a9b20e006136a659c7a20",
-        "hash": "sha256-llPt+UR8hY0yaJkYmq+A3ZfRRReuaXN09qpap6C28jc="
-      },
-      "src/third_party/aria-practices/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/w3c/aria-practices.git",
-        "rev": "7b134ce6d19497cce8a67db4a9f59980baf853dc",
-        "hash": "sha256-POnvoO1KfzJj4CbcMPI0pUTRk5EtHLTOyKKmJCZdXOc="
+        "rev": "208ea23596884f6d86476ea88b64e7931cdec08a",
+        "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04="
       },
       "src/third_party/readability/src": {
         "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@@ -969,13 +964,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "62501cc7db378532d7e85ea434b70d57e1ba2cb0",
-        "hash": "sha256-5cpKTUnhR+QzQJR4KbAvdvqsWnT1fpH0g9MObv8Nx0c="
+        "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7",
+        "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
-        "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
+        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
+        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -984,8 +979,8 @@
       },
       "src/third_party/dawn/third_party/directx-shader-compiler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "35c1b99e9e552267da5efaea07c003e322d65777",
-        "hash": "sha256-pzBk+jUp/FUV8ahHquE0942Qw/DjAUemSM9fxdFJ0JA="
+        "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb",
+        "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w="
       },
       "src/third_party/dawn/third_party/directx-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -994,8 +989,8 @@
       },
       "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
-        "rev": "a30033d3e812c9bf10094f1010374a6b15e192eb",
-        "hash": "sha256-xLacUOSy783bCtv+wUnjVnNLwTQ3eLwUJtYXmELqekY="
+        "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb",
+        "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I="
       },
       "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
@@ -1004,8 +999,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "f08551b0fc4d6cfa5ba582a0235b571aa363102d",
-        "hash": "sha256-f5kWMnaod/Ved1Fz/vTkdL0ihSUnNM8XN5Ht3Vs1YpU="
+        "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4",
+        "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
@@ -1029,8 +1024,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "3a9254f16eda7a4c5d2260039ff23456a0a34de4",
-        "hash": "sha256-JuMnNppWhIFHYfk6ANIZLC7ABhqMseoV5LYV7slevBE="
+        "rev": "65818adf16411ca394625f5747a1af28faf95d2c",
+        "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -1044,8 +1039,13 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "2852bb7e91e4995502ffb72b7ed21412ee157914",
-        "hash": "sha256-XYufVvzOXD4voZUWUvumQQqLNsx9sy0QmQzNzrgNEWg="
+        "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641",
+        "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA="
+      },
+      "src/third_party/catapult/third_party/webpagereplay": {
+        "url": "https://chromium.googlesource.com/webpagereplay.git",
+        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
+        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -1064,13 +1064,13 @@
       },
       "src/third_party/cpu_features/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git",
-        "rev": "81d13c49649f0714dd41fb56bb246398b6584085",
-        "hash": "sha256-TrC1WMLAhko57rAyDCiAC/IJ0unAqVhyjkh7gKibyi4="
+        "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b",
+        "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys="
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "ea6b9f1bb6e1001d8b21574d5bc78ddef62e499d",
-        "hash": "sha256-/QsOjDik0TnH3FnK7LOwsJkvX+O+2DRFX4eF3MxD3fc="
+        "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c",
+        "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1079,28 +1079,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "1c69e700a01a7fd3dd331f526c8a31ac1e5e49d0",
-        "hash": "sha256-qIwUs0KVU9xYFLN3UUayPLfz0ObA+EN6owKPW61J/5w="
+        "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f",
+        "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "7d52b4ffbc319a7d5a0e0a0ebff744e5281d60c5",
-        "hash": "sha256-iwwvvIOuRMo/ZEu8Gk0lZaS4P5uGt8zpnYMChpZPcUo="
+        "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af",
+        "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "7b3de17542cc613aaddbfc72c6e12be37eed7b73",
-        "hash": "sha256-7ly4vaK+Pj4y91t6Q+igQ0890CqKyu9jNBhJnxbNGjI="
+        "rev": "baf176aadedccc44329231d5dd40346874c2a63e",
+        "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
-        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
+        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
+        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
-        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
+        "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361",
+        "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1114,8 +1114,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "662ba79d796a2851b10cdafc6668e45b65b1120f",
-        "hash": "sha256-6bZFDeo7TqWNunkkQv8OJ+7/hfKwoIUtqZoXaeLp6M8="
+        "rev": "2cf9891537250255f50df5109ffe9e700e2a73de",
+        "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1124,18 +1124,18 @@
       },
       "src/third_party/fast_float/src": {
         "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git",
-        "rev": "cfd12ebcf1f82c4fd44a950b1815dd0549bc8d89",
-        "hash": "sha256-hzoB+Mmok3oe6B494uLc5ReWpUcB89zCGPYw4gvanK0="
+        "rev": "05087a303dad9c98768b33c829d398223a649bc6",
+        "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A="
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "8de5837b817f28abc54a387a9417631b905ba90a",
-        "hash": "sha256-GZYo0FjgW8XCplAi6jzzruwDlIzsWjNEVQuCwXBCPz8="
+        "rev": "3112513bf1a80872311e7718c5385f535a819b89",
+        "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "ad41607c61898cf7150e0fb20fe4bbabd44922a3",
-        "hash": "sha256-41qpsOTedB51WMzzHXDiXA19OIzA7wG/Qgbz6IkmWpk="
+        "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
+        "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1164,8 +1164,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b08a2eb0dd37f4a6c886fa5b0ecf5b3e1d27aac7",
-        "hash": "sha256-xnYeUAJx5n8LSg04AknfiudonfmlUdlj8nzHzSZi65I="
+        "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a",
+        "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -1174,13 +1174,13 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "d639197ed529b05c27f38ebaab365a621d5edad5",
-        "hash": "sha256-uT4zK2hwHzEH6Nrd2rAeyzpQA1TmwtrdcujKYEUbLsY="
+        "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3",
+        "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "0f9c6172b2ccc6b830ae313d522caf09e6933e06",
-        "hash": "sha256-LF+OcqNeg+KRuYmGuMZb4tmnr53sZHn/ZW1jg9ArPfc="
+        "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd",
+        "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -1204,8 +1204,8 @@
       },
       "src/third_party/libgav1/src": {
         "url": "https://chromium.googlesource.com/codecs/libgav1.git",
-        "rev": "66ac17620652635392f6ab24065c77b035e281c9",
-        "hash": "sha256-6/zMaX2DPSKpsaqirhrgi3nL/88Qr2VXacmyL5IyJ3U="
+        "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc",
+        "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo="
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
@@ -1229,8 +1229,8 @@
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
-        "rev": "d4d072177213b117fb81d4cfda140de090616161",
-        "hash": "sha256-q+DOwkjRlHacgfWf5UVY02aqfnKK9M/1YRBX6aMce9g="
+        "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
+        "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q="
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
@@ -1244,8 +1244,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "da27bcae1a8902af1ae6a5c55d3674f22709bbf5",
-        "hash": "sha256-317zRhJPc0D9A58W8fdCGFmpNZ5vACfd/tlZOsp/Cvw="
+        "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be",
+        "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1254,18 +1254,18 @@
       },
       "src/third_party/libaddressinput/src": {
         "url": "https://chromium.googlesource.com/external/libaddressinput.git",
-        "rev": "81eb9628382b07d371d8ea0b11badf7de3857fd5",
-        "hash": "sha256-6yDZpZ+CwxGqNO4+lZLFB6ESREeVku1BoOMtR+hKQ3I="
+        "rev": "e20690c8d5178bb282641d5eb06ef0298ff4cbc5",
+        "hash": "sha256-rX7LQNUgk5ZljUrayD1a/SUrBrvpomW0Cs0KBw3lYu4="
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "137bcff61e73fdd2836dc04e8258bfb49cef595e",
-        "hash": "sha256-oDubKvgqMk3w0luM//rR3NnCOk1h/WVTyRkuCmYASrw="
+        "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a",
+        "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "5e140b5abb9a91eb25b5ef66d29f6ee784ab7eab",
-        "hash": "sha256-tN+2YH2O9FTV50o4OVhKcKdwRwTI8NuNA0WqljUcrmo="
+        "rev": "c433c9a32320aed983e4106931596fbbae3f77ee",
+        "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -1279,8 +1279,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "b7babdf323e64e69bd2f6c376189c15825f5c73a",
-        "hash": "sha256-s6UMdUYWZqk/MbhyCi2zdQNgni98gGsYxcuUh/5AUy0="
+        "rev": "de88e36ae91d5bd13126fa4cc4b0e0346d779842",
+        "hash": "sha256-ZpU0ONqIVmY2VR0MxqtYj8KPNlK0L21gLJuT/Ff7KI8="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -1319,8 +1319,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "0abb2efaa3d16db861c9710b193c39e657ac3bdf",
-        "hash": "sha256-viuntf6umyLZwDR9BXG+ZOakp9f8rvpZYDBYAUkKzL4="
+        "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57",
+        "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1329,8 +1329,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "9bdfbc77e3355405ceefbe59420abed953a5657e",
-        "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU="
+        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
+        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -1339,8 +1339,8 @@
       },
       "src/third_party/libjpeg_turbo": {
         "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-        "rev": "640f254ad0fa03f6b1f29f89b7dd9366f2f6e533",
-        "hash": "sha256-wor4RTF3/5BFL9EWcGEofY+M4HN2+/KJUaOY+u86K5Q="
+        "rev": "d1f5f2393e0d51f840207342ae86e55a86443288",
+        "hash": "sha256-KGeB/lTjhm8DQBDZVSPENvZEGSHeLTkviJrYsFh5vEM="
       },
       "src/third_party/liblouis/src": {
         "url": "https://chromium.googlesource.com/external/liblouis-github.git",
@@ -1349,8 +1349,8 @@
       },
       "src/third_party/libphonenumber/src": {
         "url": "https://chromium.googlesource.com/external/libphonenumber.git",
-        "rev": "c25558e39e2bcc9f26f7a2a1ef804324169eaf8f",
-        "hash": "sha256-Lr/gB5Em+TE092McPwJdOU0Ab4zyP4/2ZxlavMZMm+s="
+        "rev": "ade546d8856475d0493863ee270eb3be9628106b",
+        "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg="
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
@@ -1374,8 +1374,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "5f00413667d19ad683674524a9d03543d86d188b",
-        "hash": "sha256-uTteQ+z7t5KOtPuBoZazmonRHd8jGS1/YZAq+RAvhX4="
+        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
+        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1389,8 +1389,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "3c5fa6ef272f6077d76816ee3d6a697ef1d6d272",
-        "hash": "sha256-FXFSC9dRb/KhSQdhJUqKEUpZbzU8ZpVnoSXtF/HPiJI="
+        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
+        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1409,8 +1409,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "525a09a813be0f75b646ee93fc2a31c27b87d722",
-        "hash": "sha256-uC6bGxSdz1V2SXIQjMsDd6555b3gAPN1Y0ZQtWoqDww="
+        "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f",
+        "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -1424,8 +1424,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "37ff938a93cb04c6b77e019b52328c8e9b320317",
-        "hash": "sha256-M57un/TVQPfTnKScVHS1VK1cUs8F/YPT3TwMVdo+mhM="
+        "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e",
+        "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -1439,13 +1439,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "c052afb72a08d79a26bcf3103d11f344981b09f1",
-        "hash": "sha256-zqfErp0pDXHXIvRpZ1TJu2UGXNZjATRbPgQWTniKTJs="
+        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
+        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "9ede949f025303868fa0c42418f122ac47312539",
-        "hash": "sha256-IRzEqgunO4Nfz+FkYir8G/Ht+Zsn6wpzncgkEFpsC+k="
+        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
+        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1454,8 +1454,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "a56dcd79c699366e7ac6466792c3025883ff7704",
+        "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1484,18 +1484,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "1aab872af8d44dcf59362d7ba8255922f74fafde",
-        "hash": "sha256-5/XnNx6Pyk4KBb9krVo9u6i7LWNrsLLOIi4qhEY2PZc="
-      },
-      "src/third_party/sframe/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/cisco/sframe",
-        "rev": "b14090904433bed0d4ec3f875b9b39f3e0555930",
-        "hash": "sha256-bw+6ycUpnFZJhtXFUzr7XTOljNrs+7oFdVY+LN0Rqek="
+        "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67",
+        "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "14d05ec761901b6e9e9193af8b347ab3a7f6fed0",
-        "hash": "sha256-KZGrztOKaT368KSCxiJAqnsgINpNODUlaXnH/maQNIA="
+        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
+        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1509,13 +1504,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "fc121d7d03cd6cbf499ec06a5112b263471b1181",
-        "hash": "sha256-hf9PxQhXEKT49GbkFYCvRPBT0Qu+hDnDpebI92yO1Oo="
+        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
+        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "fce27a96526f54c6d31fdccf57629788e3712220",
-        "hash": "sha256-bmXZLpz3wv7eQWoqTjZmjwnnILWSIjZ8iqo8CeLk5fw="
+        "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305",
+        "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1524,23 +1519,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "999d49c10046e240cd5366d349d3a5f6af16a0d4",
-        "hash": "sha256-eSqaWXtzZ4Bi9ilaJYGdZamzUjmo+AtDZ9KeZhsc/fY="
+        "rev": "2216f531fb72119745382c62f232acf9790f4b6e",
+        "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "09b4b05203fd7a9402ffcce9cc736d887ff7e3fc",
-        "hash": "sha256-skMOzpsn67mmOAp7Mf6UrJdi2lbiQQ8b6kBy4Ik2ED8="
+        "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0",
+        "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "669a28b1f31f89bfc46b74791f127bcc5e5b2f06",
-        "hash": "sha256-lsR+sh+XQP/wKgkBbie6Gp+kQNFnnC8TeNWpiWTdevw="
+        "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc",
+        "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "f6d9303ddaf2e879b9155f7186cd234f5a79079c",
-        "hash": "sha256-ru3QVyyyqxZRcvSpy9pYhHHhkjuLVhQbgOT/vQJ/oIw="
+        "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a",
+        "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1549,43 +1544,43 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "1e770e7de8373a8dd49f23416cf7ca4001d01040",
-        "hash": "sha256-t8Shkoa90TJt1MbTOefnLaguW4eYKsRFO1Jd0AUc70Y="
+        "rev": "126038020c2bd47efaa942ccc364ca5353ffccde",
+        "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "b38c4f83024546d4000b2db8e2294cf81b7f26e0",
-        "hash": "sha256-q5G4B75xBIXl1aG/vzbIDrc3Hs/MFoQ4nwh4ozb8hys="
+        "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f",
+        "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "015e25c3c91b70eb1a754d36fb14c4ba6ad9b0b9",
-        "hash": "sha256-pUxPwFGbOzP8ymTooeA1slFWEFsRoqUROSnndVtLiY8="
+        "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8",
+        "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "cf0cf82ea16c0ff0be75940f282540d6085b2d3b",
-        "hash": "sha256-uyoysS7lSBNDRfvcwPT+gQqhE20UxiYUEw1UXnYS3fY="
+        "rev": "15a84652b94e465e9a7b25eb507193929863bc2f",
+        "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "e3d18f90c0b8ef1f52539e0674a42f0adfe30381",
-        "hash": "sha256-Hs9N0FM3eWWjLm4BrDJoZIrsPDVFx0iRAJeQ4gHTM7o="
+        "rev": "7c46da2b39036a80ce088576d5794bf39e667f56",
+        "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "8383c46b129c2b3a5f3833e602d946d2fcc57e39",
-        "hash": "sha256-ZBie5uDTVEehxRQW1GZY5Ki/bnp82LoW3jfMUFL0O9A="
+        "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead",
+        "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "044eaba8a34a6e3bfb1d6aafac7c01068813a2b6",
-        "hash": "sha256-i3hochkK0LZPg8CsZMFkAL+8tf8QuuwtApAc4FDd0RM="
+        "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c",
+        "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
-        "rev": "7e55b011e16182fc349149abbd3aaf3b1db46421",
-        "hash": "sha256-fOnFkcQDEGIe5yB507qnP9nA1LBBPFblncNiJ8JxAwI="
+        "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50",
+        "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1619,23 +1614,18 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "b507bd117e53db86f2fb52d0d858d3ae7d684a85",
-        "hash": "sha256-6Y5Z0ErtsZdbuWTHa+PEiOxcZSbjBcnuOHbgtI1/+80="
+        "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3",
+        "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b2b856131e36c99e9de9c419fe8ca02f857082ba",
-        "hash": "sha256-+hcaP7C5Eh3SLl5B8mRgOVdM/tvnFnb/oqUIWPoe0NA="
-      },
-      "src/third_party/webpagereplay/third_party/clang-format/script": {
-        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git",
-        "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11",
-        "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0="
+        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
+        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "1f975dfd761af6e5d76d28333191973b258d82a8",
-        "hash": "sha256-ucH+9HBkFyOKEItAWVoYmEzyU7h/UgWIvp/eC/JqGWU="
+        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
+        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1639,8 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "56ac34b3f45fae2eca1f32584f7f0b279be2cf1f",
-        "hash": "sha256-uw3r5g5rWamlFubBkXDb4KRx3hkOAoQyFo8l95GYGZI="
+        "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80",
+        "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg="
       },
       "src/third_party/libei/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git",
@@ -1659,18 +1649,13 @@
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "5233c58e6ca0b1c4c6b353ad79649191ed195bdc",
-        "hash": "sha256-vEl0s7Mjh+5rciOMxm99PNWiamtCk+sTN4lRYKCIZ+8="
+        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
+        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
-        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
-      },
-      "src/agents/shared": {
-        "url": "https://chromium.googlesource.com/chromium/agents.git",
-        "rev": "e75efa515896f6bf1dea92eaffbcf8ee711a65d8",
-        "hash": "sha256-z2GrzF8jDkdfBdq1HP3gTgQpoqjmhc80kEZBmlue0os="
+        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
+        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
       }
     }
   }

pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.10";
+  version = "3.15.9";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-c0sbFd19cDGm7VJbbfT+FKzUbeyAO1kCgh1eYV11C3I=";
+    hash = "sha256-dZ2bXouzjX0rw9NoUJjtF4KzTuZVdHm2ik6puiOg2Tc=";
   };
 
   vendorHash = "sha256-GanQBm/g+PcMHaXA5gAaqacpOuv6kES6ng/CmH8/0j4=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-rXoDdoBK4yS/suC6lEnK+dWxcILRG+XcMNXVyVmeQYw=",
+    "hash": "sha256-+iZbQ5V8DQXBRHlt3UuSa3WKbC5A0ootY4AQ6leTHBo=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.60.0",
+    "rev": "v4.59.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-4S5uyvSjtEOO1hK5MhuAmjsPBJ6qC1KN3/mrtRHU+P4="
+    "vendorHash": "sha256-NWkgbkjaaA0dxphUWhiNqBaUKobdjsMEvD05WShZHHQ="
   },
   "akamai_akamai": {
     "hash": "sha256-M6Btq8wX1lsEs1HUaaTwGspnvS2IyE0L2ITe+ogDTlc=",
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-5IfYhOEhXRpdL7G3Op9a0Ep14el2gwcVmRMkGB7oWH4="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-PF/mGGoO8voHyUiUN3qTOsBEJ0r6TBWa+p1P4vgliDs=",
+    "hash": "sha256-wBwFtW2hbBL7YkL8o7bkd3eMCmdjObIbBiuLPsmZqQo=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.284.0",
+    "rev": "v1.282.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-sESuNlWNyjjGYb7z+tQF7RGBgicnPISuwXRzB+QJ7E4="
   },
@@ -589,13 +589,13 @@
     "vendorHash": "sha256-ayt8FR4684ZV5kd6exMw0AEgkMJLW5huvTYZqcr3q/s="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-pEdNv1MViCsCb3wFoDghCeQ5q2FErtGrQL9noL5B11g=",
+    "hash": "sha256-LbNsD7R+TP9trNaMZq+OTyGlQPR6EZoSdUx3uo+3xUo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.39.0",
+    "rev": "v7.38.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-u4zldvOO/TtNHC8B+c63DWMbk7iEix+S+y/RLExchI8="
+    "vendorHash": "sha256-JAxI/E8GlUZd3RlhsrIhGm4+G18/obms+czJORYCENY="
   },
   "hashicorp_helm": {
     "hash": "sha256-Dw6khnp0pronRKbBv2gx8ygtVvRV9uQIHCXj2BblZ6k=",
@@ -688,13 +688,13 @@
     "vendorHash": "sha256-aM9bDzYM4RW3cIeJCMnIB9VqEaPV4D0r3zMOU3d0QDs="
   },
   "hashicorp_vault": {
-    "hash": "sha256-Jl1mF2DIzLcXmevrFGLjnThUBR0TXiXvvgQYwFLwBtE=",
+    "hash": "sha256-k/S1ez6q70vvnHMfU2aweTFzRnLlYbxUEh4xZumT1mo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.10.1",
+    "rev": "v5.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-MMivACUsYhJg+wkag08NHEYkjjdJouq+QCR08CTAiKM="
+    "vendorHash": "sha256-0TJbC7gG5yduWrzp7MN5WWDjsdyL6RqXmOlIDs3OtaU="
   },
   "hashicorp_vsphere": {
     "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@@ -787,13 +787,13 @@
     "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
   },
   "jianyuan_sentry": {
-    "hash": "sha256-V0+vbeECEaeOwr8a1HohdClZKwVkjHSxbhu86Bl9ZKE=",
+    "hash": "sha256-mJVuJJzNw/nkg1OoPG2iIE30RVsnj3YTQ3VAYITB6tE=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.15.4",
+    "rev": "v0.15.3",
     "spdx": "MIT",
-    "vendorHash": "sha256-qSLy0iPPiJ9EdpU1D879bICDKwJfDA+JnxCepsvGVbA="
+    "vendorHash": "sha256-+LDSNV2Y5jDFyOu/PFtJhP7VgWAVvozC/yBXzTU7YXQ="
   },
   "joneshf_openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -905,13 +905,13 @@
     "vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
   },
   "metio_migadu": {
-    "hash": "sha256-Aef1H/L2EFeU9mhecOnlPAbJbt3XfBL0Wz67IqxCI10=",
+    "hash": "sha256-KDk/uSxycO9hiaiEKHq58ktwum88J9StpB52mNQYer4=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.7.2",
+    "rev": "2026.6.25",
     "spdx": "0BSD",
-    "vendorHash": "sha256-wUX2smEhKUftBCRi7ANq8NpHXpB+EmlVshrhI2ltY2I="
+    "vendorHash": "sha256-7/2iHstATnmeuvoIFIQw2Gi3QSIoXp5W69fnUYHipxc="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -1013,13 +1013,13 @@
     "vendorHash": "sha256-/4mktOn7qjWIkpyqeEW4vzY0w0pG+0qx7KRYBkE1IkQ="
   },
   "okta_okta": {
-    "hash": "sha256-Qpdinb4ZJRjZG4lMv5EFkicBcYU+OiLz9on3ZaQQu8s=",
+    "hash": "sha256-EuGhOCJKjhttlWVfrpBjBAVOtbFfRHl2gk7zev2w9TY=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.13.0",
+    "rev": "v6.12.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z13CKv4d+C2VsdUfiArzLLaXExq8k4Y5Y9GEidqqGb0="
+    "vendorHash": "sha256-/IbzilmyVTZh7qWogtXd+/Y7UJdjsQaf7Yjhi1fU1Vc="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1085,11 +1085,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-SBPy6elle5eSGY67JZEkfaov1jkfaqmvDGPEO9Zd8AY=",
+    "hash": "sha256-b2BPsCJe8q1oODTi9TaD4kac/wecardNv4/gEQBWK60=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.33.1",
+    "rev": "v3.33.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1157,13 +1157,13 @@
     "vendorHash": null
   },
   "sacloud_sakuracloud": {
-    "hash": "sha256-oAD+QfMqUOtbh2GNooyV1Yc1OVHuAnv86ZvuCB7zo8E=",
+    "hash": "sha256-mk5tmlx8UZXedRbSKmSg9YqX9MJFWsSrMea1dirL+HI=",
     "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
     "owner": "sacloud",
     "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.36.1",
+    "rev": "v2.36.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-zklw0YajAZZLkosLxZCsWtAbvmHuGEI8OGpVykp1Xw4="
+    "vendorHash": "sha256-vBcPWjugjqyuUdvxNQN1oC8V5D2SeW2WR0/c6OlgaXU="
   },
   "sap-cloud-infrastructure_sci": {
     "hash": "sha256-eQA4mY+Rx5PLbTgGqfefYFc5gZKIvt1w2eag8ipE0PI=",
@@ -1238,11 +1238,11 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-1f066NavFneIeH8X5CYGd0GmssPfzJACXt6GHvR/FLU=",
+    "hash": "sha256-2EGyYs8fy1y9g241spfKFwpv7ZTRJePvf06OS7EFDaU=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.52.3",
+    "rev": "v1.52.2",
     "spdx": "MIT",
     "vendorHash": "sha256-C8TE7uxMf6LOTS6v22mXwUdk2eqQRinwrCH4ZVUCx4k="
   },
@@ -1319,11 +1319,11 @@
     "vendorHash": "sha256-7ZoJg1HEVj5Nygr46lmBZeJDfZuU4F90yntrgkBVgGg="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-tADmls3GAmR3S5wdasoHrBYOtZTVXDS2alZD6Mzfo4M=",
+    "hash": "sha256-p8AW+AzezOP6N3wzlLZOMoTbSwb/cil7cmXkdwheXtE=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.7",
+    "rev": "v1.83.6",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1346,11 +1346,11 @@
     "vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
   },
   "terraform-lxd_lxd": {
-    "hash": "sha256-fGiXnP8neze47FQXVCFlScya9ih67/5TQW5xKEBnI+Y=",
+    "hash": "sha256-vrrQxld9Ymu2RcSRlkUzknTIBJteVeb9Jqr19CV3XzM=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v3.0.2",
+    "rev": "v3.0.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-jOZw/va3dA0DYmnYSKbASHvyL7levjf1Bk6WelLga+Q="
   },
@@ -1409,11 +1409,11 @@
     "vendorHash": null
   },
   "ubiquiti-community_unifi": {
-    "hash": "sha256-wqR9XIuH9QzzacdOd8Z+QcfTXwjjnTQA8SbEHcLYhig=",
+    "hash": "sha256-7lmT0ZCRfu3nL1FXAdxMxvQURtNcZiz9GY+0d7HI2N0=",
     "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
     "owner": "ubiquiti-community",
     "repo": "terraform-provider-unifi",
-    "rev": "v0.54.0",
+    "rev": "v0.53.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-XPEH1zya7e/3N/HxBPN/vZxFU5GOOXfBPTrnZEUzdpw="
   },
@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-8p6dJwGyTK+qtgplSLtIRKxnNAQAgHfs4z/EsBcg/iY="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-7IyFMqzkdZ2wd5KUo5eNXUr847f3VhyYKDxwMKYZ+j0=",
+    "hash": "sha256-/t4HHlZ/E4QM4vvJAUzn+uJIox3Duqxl0/3Hu4AGGak=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.213.0",
+    "rev": "v0.209.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JoOuqaiQFWWjnH/HjLxvznnyqQauxSef1KRQTMrhoGQ="
+    "vendorHash": "sha256-UKWLZp64nvohXqYHMhRB+nWfUKSYyGJBMpo1nk792XY="
   }
 }

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -74,7 +74,7 @@ let
     mainProgram = "discord";
     maintainers = with lib.maintainers; [
       artturin
-      _4evy
+      FlameFlag
       infinidoge
       jopejoe1
       Scrumplex

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/cstring-includes.patch

@@ -0,0 +1,74 @@
+diff --git a/src/api/video/nv12_buffer.cc b/src/api/video/nv12_buffer.cc
+index ca9dcd867..89d28f23c 100644
+--- a/src/api/video/nv12_buffer.cc
++++ b/src/api/video/nv12_buffer.cc
+@@ -16,6 +16,8 @@
+ #include "third_party/libyuv/include/libyuv/convert.h"
+ #include "third_party/libyuv/include/libyuv/scale.h"
+
++#include <cstring>
++
+ namespace webrtc {
+
+ namespace {
+diff --git a/src/audio/utility/channel_mixer.cc b/src/audio/utility/channel_mixer.cc
+index 0f1e66387..33b771b0c 100644
+--- a/src/audio/utility/channel_mixer.cc
++++ b/src/audio/utility/channel_mixer.cc
+@@ -15,6 +15,8 @@
+ #include "rtc_base/logging.h"
+ #include "rtc_base/numerics/safe_conversions.h"
+
++#include <cstring>
++
+ namespace webrtc {
+
+ ChannelMixer::ChannelMixer(ChannelLayout input_layout,
+diff --git a/src/modules/audio_processing/aec3/alignment_mixer.cc b/src/modules/audio_processing/aec3/alignment_mixer.cc
+index 7f076dea8..ffd7242b5 100644
+--- a/src/modules/audio_processing/aec3/alignment_mixer.cc
++++ b/src/modules/audio_processing/aec3/alignment_mixer.cc
+@@ -10,6 +10,7 @@
+ #include "modules/audio_processing/aec3/alignment_mixer.h"
+
+ #include <algorithm>
++#include <cstring>
+
+ #include "rtc_base/checks.h"
+
+diff --git a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+index 7ef1a030e..5b9ab7137 100644
+--- a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
++++ b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+@@ -18,6 +18,7 @@
+ #include <spa/param/video/format-utils.h>
+ #include <sys/mman.h>
+
++#include <cstring>
+ #include <vector>
+
+ #include "absl/memory/memory.h"
+diff --git a/src/modules/video_coding/utility/ivf_file_reader.cc b/src/modules/video_coding/utility/ivf_file_reader.cc
+index 4c08ca613..f82f2bfcb 100644
+--- a/src/modules/video_coding/utility/ivf_file_reader.cc
++++ b/src/modules/video_coding/utility/ivf_file_reader.cc
+@@ -10,6 +10,7 @@
+
+ #include "modules/video_coding/utility/ivf_file_reader.h"
+
++#include <cstring>
+ #include <string>
+ #include <vector>
+
+diff --git a/src/net/dcsctp/packet/bounded_byte_writer.h b/src/net/dcsctp/packet/bounded_byte_writer.h
+index d754549e4..bf5e3ed42 100644
+--- a/src/net/dcsctp/packet/bounded_byte_writer.h
++++ b/src/net/dcsctp/packet/bounded_byte_writer.h
+@@ -12,6 +12,7 @@
+ #define NET_DCSCTP_PACKET_BOUNDED_BYTE_WRITER_H_
+
+ #include <algorithm>
++#include <cstring>
+
+ #include "api/array_view.h"
+ 

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -1,28 +1,97 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
-  telegram-desktop,
+  fetchpatch,
+  libsForQt5,
+  yasm,
+  alsa-lib,
+  jemalloc,
+  libopus,
+  libpulseaudio,
   withWebkit ? true,
 }:
 
 let
+  telegram-desktop = libsForQt5.callPackage ../telegram-desktop {
+    inherit stdenv;
+    # N/A on Qt5
+    kimageformats = null;
+    unwrapped = libsForQt5.callPackage ../telegram-desktop/unwrapped.nix {
+      inherit stdenv;
+      kcoreaddons = null;
+      qtshadertools = null;
+    };
+  };
   version = "1.4.9";
+  tg_owt = telegram-desktop.tg_owt.overrideAttrs (oldAttrs: {
+    version = "0-unstable-2024-06-15";
+
+    src = fetchFromGitHub {
+      owner = "desktop-app";
+      repo = "tg_owt";
+      rev = "c9cc4390ab951f2cbc103ff783a11f398b27660b";
+      hash = "sha256-FfWmSYaeryTDbsGJT3R7YK1oiyJcrR7YKKBOF+9PmpY=";
+      fetchSubmodules = true;
+    };
+
+    patches = [
+      # fix build with latest glibc
+      # upstream PR: https://github.com/desktop-app/tg_owt/pull/172
+      ./cstring-includes.patch
+      (fetchpatch {
+        url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
+        decode = "base64 -d";
+        stripLen = 1;
+        extraPrefix = "src/";
+        hash = "sha256-goxnuRRbwcdfIk1jFaKGiKCTCYn2saEj7En1Iyglzko=";
+      })
+    ];
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++11-narrowing";
+  });
 in
 telegram-desktop.override {
   pname = "kotatogram-desktop";
   inherit withWebkit;
-  unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: {
+  unwrapped = (telegram-desktop.unwrapped.override { inherit tg_owt; }).overrideAttrs (old: {
     pname = "kotatogram-desktop-unwrapped";
-    version = "${version}-unstable-2026-07-03";
+    version = "${version}-unstable-2024-09-27";
 
     src = fetchFromGitHub {
       owner = "kotatogram";
       repo = "kotatogram-desktop";
-      rev = "7263a1b53c9e6b45a416532644fff7a4c7f90d54";
-      hash = "sha256-xOfHZ7oUJKk65j7o/AgxtFfc5NqsAoA9E+8U6rHlSmc=";
+      rev = "0581eb6219343b3cfcbb81124b372df1039b7568";
+      hash = "sha256-rvn8GZmHdMkVutLUe/LmUNIawlb9VgU3sYhPwZ2MWsI=";
       fetchSubmodules = true;
     };
 
+    patches = [
+      ./macos-qt5.patch
+      ./glib-2.86.patch
+      (fetchpatch {
+        url = "https://gitlab.com/mnauw/cppgir/-/commit/c8bb1c6017a6f7f2e47bd10543aea6b3ec69a966.patch";
+        stripLen = 1;
+        extraPrefix = "cmake/external/glib/cppgir/";
+        hash = "sha256-8B4h3BTG8dIlt3+uVgBI569E9eCebcor9uohtsrZpnI=";
+      })
+    ];
+
+    buildInputs =
+      (old.buildInputs or [ ])
+      ++ [
+        libopus
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        alsa-lib
+        jemalloc
+        libpulseaudio
+      ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-missing-template-arg-list-after-template-kw";
+
     meta = {
       description = "Kotatogram – experimental Telegram Desktop fork";
       longDescription = ''
@@ -35,7 +104,7 @@ telegram-desktop.override {
       homepage = "https://kotatogram.github.io";
       changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k${version}";
       maintainers = with lib.maintainers; [ ilya-fedin ];
-      mainProgram = "Kotatogram";
+      mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
     };
   });
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/glib-2.86.patch

@@ -0,0 +1,37 @@
+Submodule Telegram/lib_base contains modified content
+diff --git a/Telegram/lib_base/base/platform/linux/base_url_scheme_linux.cpp b/Telegram/lib_base/base/platform/linux/base_url_scheme_linux.cpp
+index 4197367..f79d2fa 100644
+--- a/Telegram/lib_base/base/platform/linux/base_url_scheme_linux.cpp
++++ b/Telegram/lib_base/base/platform/linux/base_url_scheme_linux.cpp
+@@ -15,7 +15,7 @@
+ #include <kshell.h>
+ #include <ksandbox.h>
+ 
+-#include <gio/gio.hpp>
++#include <giounix/giounix.hpp>
+ #include <snapcraft/snapcraft.hpp>
+ 
+ namespace base::Platform {
+@@ -125,7 +125,7 @@ void RegisterUrlScheme(const UrlSchemeDescriptor &descriptor) {
+ 
+     const auto appId = QGuiApplication::desktopFileName().toStdString();
+     if (!appId.empty()) {
+-        Gio::AppInfo appInfo = Gio::DesktopAppInfo::new_(appId + ".desktop");
++        Gio::AppInfo appInfo = GioUnix::DesktopAppInfo::new_(appId + ".desktop");
+         if (appInfo) {
+             if (appInfo.get_commandline() == commandlineForCreator + " %u") {
+                 appInfo.set_as_default_for_type(handlerType);
+Submodule cmake contains modified content
+diff --git a/cmake/external/glib/CMakeLists.txt b/cmake/external/glib/CMakeLists.txt
+index 3c6fe4b..6f73dc5 100644
+--- a/cmake/external/glib/CMakeLists.txt
++++ b/cmake/external/glib/CMakeLists.txt
+@@ -16,7 +16,7 @@ endfunction()
+ add_cppgir()
+ 
+ include(generate_cppgir.cmake)
+-generate_cppgir(external_glib Gio-2.0)
++generate_cppgir(external_glib GioUnix-2.0)
+ 
+ find_package(PkgConfig REQUIRED)
+ pkg_check_modules(GLIB2 REQUIRED IMPORTED_TARGET glib-2.0 gobject-2.0 gio-2.0 gio-unix-2.0)