Merge staging-next into staging

2026-07-19 15:11:30 +00:00 · 2026-05-04 00:37:46 +00:00
parent 2021eaf5ce bd1e2011ec
commit 64dd52dbdc
105 changed files with 3131 additions and 2436 deletions
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -16,6 +16,14 @@ on:
        required: true
        type: string
    secrets:
+      # Can be provided in pull requests because the job it is used in does
+      # not evaluate untrusted code.
+      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY:
+        required: false
+      # Can be provided in pull requests because the job it is used in does
+      # not evaluate untrusted code.
+      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
+        required: false
      # Should only be provided in the merge queue, not in pull requests,
      # where we're evaluating untrusted code.
      CACHIX_AUTH_TOKEN_GHA:
@@ -45,9 +53,17 @@ jobs:
      - name: Install dependencies
        run: npm install bottleneck@2.19.5

+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
+        id: app-token
+        with:
+          client-id: ${{ vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID }}
+          private-key: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
      - name: Log current API rate limits
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

      - name: Check commits
@@ -56,6 +72,7 @@ jobs:
        env:
          TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}
        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
          script: |
            const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
            require('./trusted/ci/github-script/commits.js')({
@@ -68,7 +85,7 @@ jobs:

      - name: Log current API rate limits
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

  manual-file-edits:
@@ -85,25 +102,35 @@ jobs:
          sparse-checkout: |
            ci/github-script

+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID
+        id: app-token
+        with:
+          client-id: ${{ vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID }}
+          private-key: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
      - name: Log current API rate limits
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

      - name: Discourage manual edits to certain files
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
          script: |
            require('./trusted/ci/github-script/manual-file-edits.js')({
              github,
              context,
              core,
+              dry: context.eventName == 'pull_request',
              repoPath: 'trusted',
            })

      - name: Log current API rate limits
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

  owners:
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -23,6 +23,10 @@ on:
        default: false
        type: boolean
    secrets:
+      # Can be provided in pull requests because the job it is used in does
+      # not evaluate untrusted code.
+      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY:
+        required: false
      # Should only be provided in the merge queue, not in pull requests,
      # where we're evaluating untrusted code.
      CACHIX_AUTH_TOKEN_GHA:
@@ -349,10 +353,22 @@ jobs:
              description,
              target_url
            })
+
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        if: github.event_name == 'pull_request_target' && vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
+        id: app-token
+        with:
+          client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}
+          private-key: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      # It's fine to reuse this app in the 'pull-request-target / prepare' job,
+      # because that job has to run before this one.
      - name: Request changes if PR is against an inappropriate branch
        if: ${{ github.event_name == 'pull_request_target' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
          script: |
            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
              github,
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -10,6 +10,12 @@ on:
    secrets:
      NIXPKGS_CI_APP_PRIVATE_KEY:
        required: true
+      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY:
+        required: true
+      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY:
+        required: true
+      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
+        required: true

 concurrency:
  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -36,9 +42,21 @@ jobs:
          sparse-checkout-cone-mode: true # default, for clarity
          sparse-checkout: |
            ci/github-script
+
+      # It's fine to reuse this app in the 'eval / compare' job,
+      # because this job has to run before that one.
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
+        id: app-token
+        with:
+          client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}
+          private-key: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
      - id: prepare
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
          retries: 10
          # The default for this includes code 422, which happens regularly for us when comparing commits:
          #   422 - Server Error: Sorry, this diff is taking too long to generate.
@@ -60,6 +78,9 @@ jobs:
    permissions:
      # cherry-picks
      pull-requests: write
+    secrets:
+      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
+      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
    with:
      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
      headBranch: ${{ needs.prepare.outputs.headBranch }}
@@ -82,6 +103,8 @@ jobs:
      # compare
      pull-requests: write
      statuses: write
+    secrets:
+      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
    with:
      artifact-prefix: ${{ inputs.artifact-prefix }}
      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -116,5 +116,8 @@ jobs:
      statuses: write # unused on pull_request, required by PR workflow
    secrets:
      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
+      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
+      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
    with:
      artifact-prefix: pr-
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@@ -151,11 +151,9 @@ async function checkTargetBranch({ github, context, core, dry }) {
      core,
      dry,
      body,
-      event: 'COMMENT',
+      event: 'REQUEST_CHANGES',
      reviewKey,
    })
-
-    throw new Error('This PR is against the wrong branch.')
  } else if (rebuildsAllTests && !isExemptKernelUpdate) {
    let branchText
    if (base === 'master' && maxRebuildCount >= 500) {
@@ -179,11 +177,9 @@ async function checkTargetBranch({ github, context, core, dry }) {
      core,
      dry,
      body,
-      event: 'COMMENT',
+      event: 'REQUEST_CHANGES',
      reviewKey,
    })
-
-    throw new Error('This PR is against the wrong branch.')
  } else if (
    maxRebuildCount >= 500 &&
    !isExemptKernelUpdate &&
@@ -204,7 +200,7 @@ async function checkTargetBranch({ github, context, core, dry }) {
      core,
      dry,
      body,
-      event: 'COMMENT',
+      event: 'REQUEST_CHANGES',
      reviewKey,
    })
  } else {
--- a/ci/github-script/manual-file-edits.js
+++ b/ci/github-script/manual-file-edits.js
@@ -7,9 +7,13 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 *  context: import('@actions/github/lib/context').Context,
 *  core: import('@actions/core'),
 *  repoPath?: string,
+ *  dry: boolean,
 * }} CheckManualFileEditsProps
 */
-async function checkManualFileEdits({ github, context, core, repoPath }) {
+async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
+  const { dismissReviews, postReview } = require('./reviews.js')
+  const reviewKey = 'manual-file-edits'
+
  const pull_number = context.payload.pull_request?.number
  if (!pull_number) {
    core.info('This is not a pull request. Skipping checks.')
@@ -35,8 +39,13 @@ async function checkManualFileEdits({ github, context, core, repoPath }) {
      changedPaths.includes('maintainers/github-teams.json'),
    )
  ) {
-    core.setFailed(
-      [
+    postReview({
+      github,
+      context,
+      core,
+      dry,
+      event: 'REQUEST_CHANGES',
+      body: [
        'maintainers/github-teams.json is supposed to accurately reflect the state of the teams in GitHub.\n',
        'Therefore, it should not be edited manually.\n',
        'All changes to teams listed in maintainers/github-teams.json should be performed in GitHub by a team maintainer.\n',
@@ -48,7 +57,16 @@ async function checkManualFileEdits({ github, context, core, repoPath }) {
        (prev, curr) => prev + (!prev || prev.endsWith('\n') ? '' : ' ') + curr,
        '',
      ),
-    )
+      reviewKey,
+    })
+  } else {
+    dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
  }
 }

--- a/ci/github-script/prepare.js
+++ b/ci/github-script/prepare.js
@@ -172,14 +172,20 @@ module.exports = async ({ github, context, core, dry }) => {
          '  ```',
        ].join('\n')

-        await postReview({ github, context, core, dry, body, reviewKey })
-
-        throw new Error(`The PR contains commits from a different base.`)
+        await postReview({
+          github,
+          context,
+          core,
+          dry,
+          body,
+          event: 'REQUEST_CHANGES',
+          reviewKey,
+        })
      }
+    } else {
+      await dismissReviews({ github, context, core, dry, reviewKey })
    }

-    await dismissReviews({ github, context, core, dry, reviewKey })
-
    let mergedSha, targetSha

    if (prInfo.mergeable) {
--- a/ci/github-script/reviews.js
+++ b/ci/github-script/reviews.js
@@ -5,10 +5,28 @@ const eventToState = {
  REQUEST_CHANGES: 'CHANGES_REQUESTED',
 }

+// Use substring checks in order to allow testing in forks
+// Usernames must also end in "[bot]"
+const reviewUsers = [
+  'github-actions',
+  'nixpkgs-ci',
+  'branch-check',
+  'commit-check',
+  'manual-edit',
+]
+
+/**
+ * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {typeof import('@actions/github').context} Context
+ *
+ * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
+ * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
+ */
+
 /**
 * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: import('@actions/github/lib/context').Context,
+ *  github: GitHub,
+ *  context: Context,
 *  core: import('@actions/core'),
 *  dry: boolean,
 *  reviewKey?: string,
@@ -25,18 +43,32 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
    return
  }

-  const reviews = (
-    await github.paginate(github.rest.pulls.listReviews, {
-      ...context.repo,
-      pull_number,
-    })
-  ).filter(
-    (review) =>
-      review.user?.login === 'github-actions[bot]' &&
-      review.state !== 'DISMISSED',
+  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
+    ...context.repo,
+    pull_number,
+  })
+
+  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
+    allReviews.filter(
+      (review) =>
+        review.user &&
+        review.state !== 'DISMISSED' &&
+        review.user.login.endsWith('[bot]') &&
+        reviewUsers.some((substr) => review.user?.login.includes(substr)),
+    )
  )
-  const changesRequestedReviews = reviews.filter(
-    (review) => review.state === 'CHANGES_REQUESTED',
+
+  const reviewsByUser = reviews.reduce(
+    (prev, curr) => {
+      if (!(curr.user.login in prev)) {
+        prev[curr.user.login] = []
+      }
+
+      prev[curr.user.login].push(curr)
+
+      return prev
+    },
+    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
  )

  const commentRegex = new RegExp(
@@ -50,8 +82,8 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  )

  let reviewsToMinimize = reviews
-  let /** @type {typeof reviews} */ reviewsToDismiss = []
-  let /** @type {typeof reviews} */ reviewsToResolve = []
+  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
+  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []

  if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
    reviewsToMinimize = reviews.filter((review) =>
@@ -59,29 +91,39 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
    )
  }

-  // If we want to dismiss all reviews with the key reviewKey,
-  // but there are other requested changes from CI, we can't dismiss,
-  // because then the other requested changes will be dismissed too.
-  if (
-    changesRequestedReviews.every(
-      (review) =>
-        commentResolvedRegex.test(review.body) ||
-        (reviewKey && reviewKeyRegex.test(review.body)) ||
-        // If we are called by check-commits and the review body is clearly
-        // from `commits.js`, then we can safely dismiss the review.
-        // This helps with pre-existing reviews (before the comments were added).
-        (reviewKey &&
-          reviewKey === 'check-commits' &&
-          review.body.includes('PR / Check / cherry-pick')),
-    )
-  ) {
-    reviewsToDismiss = changesRequestedReviews
-  } else if (reviewsToMinimize.length) {
-    reviewsToResolve = reviewsToMinimize.filter(
-      (review) =>
-        review.state === 'CHANGES_REQUESTED' &&
-        !commentResolvedRegex.test(review.body),
-    )
+  for (const reviewsForUser of Object.values(reviewsByUser)) {
+    // Make sure that we don't dismiss all reviews by a user if they
+    // have any reviews we don't want to dismiss.
+    if (
+      reviewsForUser.every(
+        (review) =>
+          commentResolvedRegex.test(review.body) ||
+          (reviewKey && reviewKeyRegex.test(review.body)) ||
+          // If we are called by check-commits and the review body is clearly
+          // from `commits.js`, then we can safely dismiss the review.
+          // This helps with pre-existing reviews (before the comments were added).
+          (reviewKey &&
+            reviewKey === 'check-commits' &&
+            review.body.includes('PR / Check / cherry-pick')),
+      )
+    ) {
+      reviewsToDismiss.push(
+        ...reviewsForUser.filter(
+          (review) => review.state === 'CHANGES_REQUESTED',
+        ),
+      )
+    } else {
+      reviewsToResolve.push(
+        ...reviewsForUser.filter(
+          (review) =>
+            review.state === 'CHANGES_REQUESTED' &&
+            !commentResolvedRegex.test(review.body) &&
+            reviewsToMinimize.some(
+              (toMinimize) => toMinimize.node_id === review.node_id,
+            ),
+        ),
+      )
+    }
  }

  await Promise.all([
@@ -121,8 +163,8 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {

 /**
 * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: import('@actions/github/lib/context').Context
+ *  github: GitHub,
+ *  context: Context,
 *  core: import('@actions/core'),
 *  dry: boolean,
 *  body: string,
@@ -158,11 +200,13 @@ async function postReview({
    })
  ).filter(
    (review) =>
-      review.user?.login === 'github-actions[bot]' &&
-      review.state !== 'DISMISSED',
+      review.user &&
+      review.state !== 'DISMISSED' &&
+      review.user.login.endsWith('[bot]') &&
+      reviewUsers.some((substr) => review.user?.login.includes(substr)),
  )

-  /** @type {null | typeof reviews[number]} */
+  /** @type {null | Review} */
  let pendingReview
  const matchingReviews = reviews.filter((review) =>
    reviewKeyRegex.test(review.body),
--- a/nixos/modules/services/networking/sunshine.nix
+++ b/nixos/modules/services/networking/sunshine.nix
@@ -20,7 +20,7 @@ let
  inherit (utils) escapeSystemdExecArgs;
  cfg = config.services.sunshine;

-  # ports used are offset from a single base port, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port
+  # ports used are offset from a single base port, see https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2configuration.html#port
  generatePorts = port: offsets: map (offset: port + offset) offsets;
  defaultPort = 47989;

@@ -60,7 +60,7 @@ in
      description = ''
        Settings to be rendered into the configuration file. If this is set, no configuration is possible from the web UI.

-        See <https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#configuration for syntax>.
+        See <https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2configuration.html> for syntax.
      '';
      example = literalExpression ''
        {
@@ -73,7 +73,7 @@ in
          type = port;
          default = defaultPort;
          description = ''
-            Base port -- others used are offset from this one, see <https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port> for details.
+            Base port -- others used are offset from this one, see <https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2configuration.html#port> for details.
          '';
        };
      });
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -56,8 +56,13 @@ let
      # Initialise the container side of the veth pair.
      if [[ -n "''${HOST_ADDRESS-}" ]]   || [[ -n "''${HOST_ADDRESS6-}" ]]  ||
         [[ -n "''${LOCAL_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS6-}" ]] ||
-         [[ -n "''${HOST_BRIDGE-}" ]]; then
+         [[ -n "''${HOST_BRIDGE-}" ]]    || [[ -n "''${LOCAL_MAC_ADDRESS-}" ]]; then
        ip link set host0 name eth0
+
+        if [[ -n "''${LOCAL_MAC_ADDRESS-}" ]]; then
+          ip link set dev eth0 address "$LOCAL_MAC_ADDRESS"
+        fi
+
        ip link set dev eth0 up

        if [[ -n "''${LOCAL_ADDRESS-}" ]]; then
@@ -140,7 +145,8 @@ let
    fi

    if [[ -n "''${HOST_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS-}" ]] ||
-       [[ -n "''${HOST_ADDRESS6-}" ]] || [[ -n "''${LOCAL_ADDRESS6-}" ]]; then
+       [[ -n "''${HOST_ADDRESS6-}" ]] || [[ -n "''${LOCAL_ADDRESS6-}" ]] ||
+       [[ -n "''${LOCAL_MAC_ADDRESS-}" ]]; then
      extraFlags+=("--network-veth")
    fi

@@ -207,6 +213,7 @@ let
      --setenv LOCAL_ADDRESS="''${LOCAL_ADDRESS-}" \
      --setenv HOST_ADDRESS6="''${HOST_ADDRESS6-}" \
      --setenv LOCAL_ADDRESS6="''${LOCAL_ADDRESS6-}" \
+      --setenv LOCAL_MAC_ADDRESS="''${LOCAL_MAC_ADDRESS-}" \
      --setenv HOST_PORT="''${HOST_PORT-}" \
      --setenv PATH="$PATH" \
      ${optionalString cfg.ephemeral "--ephemeral"} \
@@ -489,6 +496,18 @@ let
      '';
    };

+    localMacAddress = mkOption {
+      type = types.nullOr (lib.types.strMatching "([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}");
+      default = null;
+      example = "de:b7:73:01:10:90";
+      description = ''
+        The MAC address assigned to the interface in the container. This address
+        is assigned early during container boot, and can thus be reliably used
+        for setups like IPv6 SLAAC with router advertisements. If this option is
+        not specified, the veth devices gets assigned a random,
+        locally-administered unicast MAC address.
+      '';
+    };
  };

  dummyConfig = {
@@ -501,6 +520,7 @@ let
    hostAddress6 = null;
    localAddress = null;
    localAddress6 = null;
+    localmacAddress = null;
    tmpfs = null;
  };

@@ -1115,6 +1135,9 @@ in
                  ${optionalString (cfg.localAddress6 != null) ''
                    LOCAL_ADDRESS6=${cfg.localAddress6}
                  ''}
+                  ${optionalString (cfg.localMacAddress != null) ''
+                    LOCAL_MAC_ADDRESS=${cfg.localMacAddress}
+                  ''}
                ''}
                ${optionalString (cfg.networkNamespace != null) ''
                  NETWORK_NAMESPACE_PATH=${cfg.networkNamespace}
--- a/nixos/tests/activation/template-dropin.nix
+++ b/nixos/tests/activation/template-dropin.nix
@@ -0,0 +1,91 @@
+{ lib, ... }:
+{
+  name = "stc-template-dropin";
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      # Define the base template. This file exists in both generations.
+      systemd.services."test-template@" = {
+        description = "A base template for testing";
+        serviceConfig.ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+      };
+
+      # Define the managed instance using drop-ins.
+      systemd.services."test-template@managed" = {
+        overrideStrategy = "asDropin";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.Environment = "TEST_VAR=1";
+      };
+
+      # Also define a service which will be changed
+      systemd.services."test-template@changed" = {
+        overrideStrategy = "asDropin";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.Environment = "TEST_VAR=1";
+      };
+
+      # Create a new generation that explicitly removes the managed instance
+      specialisation.new-generation.configuration = {
+        systemd.services."test-template@managed" = {
+          enable = lib.mkForce false;
+          wantedBy = lib.mkForce [ ];
+        };
+        systemd.services."test-template@changed" = {
+          serviceConfig.Environment = lib.mkForce "TEST_VAR=2";
+        };
+      };
+    };
+
+  testScript = # python
+    ''
+      managed_unit = "test-template@managed.service"
+      changed_unit = "test-template@changed.service"
+      manual_unit = "test-template@manual.service"
+
+      with subtest("Start the machine and ensure the managed instance is running"):
+          machine.wait_for_unit("multi-user.target")
+          machine.wait_for_unit(managed_unit)
+          machine.wait_for_unit(changed_unit)
+
+      with subtest("Imperatively start an unmanaged instance"):
+          machine.succeed(f"systemctl start {manual_unit}")
+          machine.wait_for_unit(manual_unit)
+
+      with subtest("Run dry-activate on the new generation"):
+          new_gen = "/run/booted-system/specialisation/new-generation"
+
+          # switch-to-configuration prints to stderr, so we redirect it to stdout for parsing
+          output = machine.succeed(f"{new_gen}/bin/switch-to-configuration dry-activate 2>&1")
+          machine.log("dry-activate output:\n" + output)
+
+          found_stop = False
+          found_start = False
+          found_changed = False
+          found_manual_stop = False
+          for line in output.splitlines():
+              if line.startswith("would stop"):
+                  found_stop = found_stop or managed_unit in line
+                  found_manual_stop = found_manual_stop or manual_unit in line
+              elif line.startswith("would start"):
+                  found_start = found_start or managed_unit in line
+                  found_changed = found_changed or changed_unit in line
+
+          assert found_stop, "The managed instance was not marked for stopping."
+          assert found_changed, "The changed unit was not marked for stopping + starting (restarting)."
+          assert not found_start, "switch-to-configuration wants to start the removed managed instance!"
+          assert not found_manual_stop, "switch-to-configuration wants to stop the manual instance!"
+
+      with subtest("Perform the actual switch and verify system state"):
+          machine.succeed(f"{new_gen}/bin/switch-to-configuration switch")
+
+          # The managed instance should be dead
+          machine.fail(f"systemctl is-active {managed_unit}")
+
+          # The changed instance should be running
+          machine.succeed(f"systemctl is-active {changed_unit}")
+
+          # The manual instance should survive the configuration switch untouched
+          machine.succeed(f"systemctl is-active {manual_unit}")
+    '';
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -189,6 +189,7 @@ in
  activation-nix-channel = runTest ./activation/nix-channel.nix;
  activation-nixos-init = runTest ./activation/nixos-init.nix;
  activation-perlless = runTest ./activation/perlless.nix;
+  activation-template-dropin = runTest ./activation/template-dropin.nix;
  activation-var = runTest ./activation/var.nix;
  actual = runTest ./actual.nix;
  adguardhome = runTest ./adguardhome.nix;
@@ -387,6 +388,7 @@ in
  containers-hosts = runTest ./containers-hosts.nix;
  containers-imperative = runTest ./containers-imperative.nix;
  containers-ip = runTest ./containers-ip.nix;
+  containers-ipv6-slaac = runTest ./containers-ipv6-slaac.nix;
  containers-macvlans = runTest ./containers-macvlans.nix;
  containers-names = runTest ./containers-names.nix;
  containers-nested = runTest ./containers-nested.nix;
--- a/nixos/tests/containers-ipv6-slaac.nix
+++ b/nixos/tests/containers-ipv6-slaac.nix
@@ -0,0 +1,178 @@
+let
+  ulaPrefix = "fd5f:e1a2:4f0c::/64";
+  hostMAC = "72:ec:00:8b:75:44";
+  hostSLAACv6 = "fd5f:e1a2:4f0c:0:70ec:ff:fe8b:7544/64";
+  containerMAC = "b2:65:3f:c9:6b:10";
+  containerSLAACv6 = "fd5f:e1a2:4f0c:0:b065:3fff:fec9:6b10/64";
+in
+
+{ pkgs, lib, ... }:
+{
+  name = "containers-ipv6-slaac";
+  meta = {
+    maintainers = with lib.maintainers; [
+      lschuermann
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      networking.useNetworkd = true;
+      networking.useDHCP = false;
+
+      systemd.network.netdevs."br0".netdevConfig = {
+        Name = "br0";
+        Kind = "bridge";
+        MACAddress = hostMAC;
+      };
+
+      systemd.network.networks."br0" = {
+        name = "br0";
+
+        networkConfig = {
+          IPv6SendRA = true;
+
+          # Disable privacy extensions, which would assign the host a random
+          # address in the ULA prefix (defeating the purpose of setting the
+          # bridge's `MACAddress` to assign it a stable address explicitly):
+          IPv6PrivacyExtensions = false;
+        };
+
+        ipv6SendRAConfig = {
+          # We assign addresses exclusively through SLAAC, not via DHCPv6:
+          Managed = false;
+
+          # This router is not a default gateway, as we don't have an IPv6
+          # upstream. This causes no default route to be inserted with the RA.
+          RouterLifetimeSec = 0;
+          UplinkInterface = ":none";
+        };
+
+        ipv6Prefixes = [
+          {
+            # Assign addresses out of the configured ULA prefix:
+            Prefix = ulaPrefix;
+            AddressAutoconfiguration = true;
+
+            # All other addresses in this subnet are reachable via Layer 2 (don't
+            # need to go through the host as a router):
+            OnLink = true;
+
+            # Assign the host an address out of this subnet:
+            Assign = true;
+            # Use MAC address as the basis for SLAAC address generation:
+            Token = "eui64";
+          }
+        ];
+
+        # The router doesn't advertise itself as a default gateway, so we
+        # announce our ULA prefix explicitly:
+        ipv6RoutePrefixes = [
+          {
+            Route = ulaPrefix;
+            LifetimeSec = 1800;
+          }
+        ];
+
+      };
+
+      containers.webserver = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        localMacAddress = containerMAC;
+
+        config = {
+          networking.useNetworkd = true;
+          networking.useHostResolvConf = false;
+
+          systemd.network.networks."eth0" = {
+            name = "eth0";
+            DHCP = "no";
+
+            # Assign an IPv6 address out of the host-advertised prefix, disable
+            # privacy extensions (which would assign a random address in the
+            # announced prefix, defeating the purpose of setting the
+            # `localMacAddress` option to assign the container a stable
+            # address):
+            networkConfig = {
+              IPv6AcceptRA = true;
+              IPv6PrivacyExtensions = false;
+            };
+          };
+
+          services.httpd.enable = true;
+          networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+      };
+    };
+
+  testScript = ''
+    import time
+
+    machine.wait_for_unit("default.target")
+    assert "webserver" in machine.succeed("nixos-container list")
+
+    with subtest("Start the webserver container"):
+        assert "up" in machine.succeed("nixos-container status webserver")
+
+    with subtest("veth in container has correct MAC address"):
+        assert "${containerMAC}" in machine.succeed(
+            "nixos-container run webserver -- ip link show eth0",
+        )
+
+    with subtest("Host gets assigned IPv6 in and route for ULA prefix"):
+        # This is done by systemd-network internally, so should be available
+        # instantly:
+        assert "${hostSLAACv6}" in machine.succeed(
+            "ip addr show br0"
+        )
+        assert "${ulaPrefix}" in machine.succeed(
+            "ip -6 route show"
+        )
+
+    with subtest("Container gets assigned IPv6 in and route for ULA prefix"):
+        # Give the container a few seconds to assign itself a v6 out of and set
+        # up a route for the ULA prefix from the router advertisement:
+        for _ in range(3):
+            iface_ips = machine.succeed(
+                "nixos-container run webserver -- ip addr show eth0",
+            )
+            v6_routes = machine.succeed(
+                "nixos-container run webserver -- ip -6 route show",
+            )
+            if "${containerSLAACv6}" in iface_ips and "${ulaPrefix}" in v6_routes:
+                break
+            else:
+                time.sleep(1)
+        else:
+            raise AssertionError(
+                "Container either did not assign itself the expected SLAAC "
+                + "v6 out of the announced ULA prefix (${containerSLAACv6}) "
+                + "or did not assign a route for the URL prefix "
+                + f"(${ulaPrefix}).\n\n==> ip addr show eth0:\n{iface_ips}"
+                + f"\n\n==> ip -6 route show:\n{v6_routes}"
+            )
+
+    ip6 = "${containerSLAACv6}".split("/")[0]
+
+    with subtest("Container reponds to ICMPv6 echo requests"):
+        # IPv6 ND can take some time, so try at most 30 times:
+        for i in range(30):
+            print(f"Sending ICMP echo request, attempt #{i}")
+            exit_status, _out = machine.execute(f"ping -n -c 1 {ip6}")
+            if exit_status == 0:
+                break
+            else:
+                time.sleep(1)
+        else:
+            raise AssertionError("Container doesn't respond to pings!")
+
+    with subtest("Container responds to HTTP requests"):
+        machine.succeed(f"curl --fail http://[{ip6}]/ > /dev/null")
+
+    # Destroying a declarative container should fail.
+    machine.fail("nixos-container destroy webserver")
+  '';
+}
--- a/pkgs/applications/editors/vim/plugins/aliases.nix
+++ b/pkgs/applications/editors/vim/plugins/aliases.nix
@@ -40,32 +40,33 @@ mapAliases (
  with prev;
  {
    # keep-sorted start case=no
-    blueballs-neovim = throw "`blueballs-neovim` has been removed"; # added 2025-06-17
-    coc-go = throw "`vimPlugins.coc-go` was removed, as it was unmaintained"; # added 2026-02-12
-    coc-rls = throw "coc-rls has been removed, as rls has been archived since 2022. You should use coc-rust-analyzer instead, as rust-analyzer is maintained."; # added 2025-10-01
-    coc-sumneko-lua = throw "'vimPlugins.coc-sumneko-lua' was removed, as it is unmaintained and broken. You should switch to lua_ls"; # added 2026-02-04
-    coc-tsserver = throw "`vimPlugins.coc-tsserver` was removed, as it was unmaintained"; # added 2026-02-12
-    coc-vetur = throw "coc-vetur was removed, as vetur is unmaintained by Vue. You should switch to Volar, which supports Vue 3"; # added 2025-10-01
-    completion-treesitter = throw "completion-treesitter has been archived since 2024-01"; # Added 2025-12-18
-    ctags-lsp-nvim = throw "`vimPlugins.ctags-lsp-nvim` has been removed, upstream deleted the repository"; # added 2026-02-14
-    feline-nvim = throw "feline.nvim has been removed: upstream deleted repository. Consider using lualine"; # Added 2025-02-09
-    floating-nvim = throw "floating.nvim has been removed: abandoned by upstream. Use popup-nvim or nui-nvim"; # Added 2024-11-26
-    fruzzy = throw "vimPlugins.fruzzy did not update since 2019-10-28 and uses EOL version of Nim"; # Added 2025-11-12
-    gleam-vim = throw "gleam.vim has been removed: its code was merged into vim."; # Added 2025-06-10
-    minsnip-nvim = throw "the upstream repository got deleted"; # added 2025-08-30
-    neuron-nvim = throw "neuron.nvim has been removed: archived repository 2023-02-19"; # Added 2025-09-10
-    nvim-gps = throw "nvim-gps has been archived since 2022. Use nvim-navic instead."; # Added 2025-12-18
-    nvim-ts-rainbow = throw "nvim-ts-rainbow has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
-    nvim-ts-rainbow2 = throw "nvim-ts-rainbow2 has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
-    peskcolor-vim = throw "peskcolor-vim has been removed: abandoned by upstream"; # Added 2024-08-23
-    playground = throw "playground has been archived"; # Added 2025-12-18
+    blueballs-neovim = throw "'vimPlugins.blueballs-neovim' has been removed"; # Added 2025-06-17
+    coc-go = throw "'vimPlugins.coc-go' was removed, as it was unmaintained"; # Added 2026-02-12
+    coc-rls = throw "'vimPlugins.coc-rls' has been removed, as rls has been archived since 2022. You should use coc-rust-analyzer instead, as rust-analyzer is maintained."; # Added 2025-10-01
+    coc-sumneko-lua = throw "'vimPlugins.coc-sumneko-lua' was removed, as it is unmaintained and broken. You should switch to lua_ls"; # Added 2026-02-04
+    coc-tsserver = throw "'vimPlugins.coc-tsserver' was removed, as it was unmaintained"; # Added 2026-02-12
+    coc-vetur = throw "'vimPlugins.coc-vetur' was removed, as vetur is unmaintained by Vue. You should switch to Volar, which supports Vue 3"; # Added 2025-10-01
+    completion-treesitter = throw "'vimPlugins.completion-treesitter' has been archived since 2024-01"; # Added 2025-12-18
+    ctags-lsp-nvim = throw "'vimPlugins.ctags-lsp-nvim' has been removed, upstream deleted the repository"; # Added 2026-02-14
+    feline-nvim = throw "'vimPlugins.feline-nvim' has been removed: upstream deleted repository. Consider using lualine"; # Added 2025-02-09
+    floating-nvim = throw "'vimPlugins.floating-nvim' has been removed: abandoned by upstream. Use popup-nvim or nui-nvim"; # Added 2024-11-26
+    fruzzy = throw "'vimPlugins.fruzzy' did not update since 2019-10-28 and uses EOL version of Nim"; # Added 2025-11-12
+    gleam-vim = throw "'vimPlugins.gleam-vim' has been removed: its code was merged into vim."; # Added 2025-06-10
+    mind-nvim = throw "'vimPlugins.mind-nvim' has been removed: the upstream repository got deleted"; # Added 2026-05-03
+    minsnip-nvim = throw "'vimPlugins.minsnip-nvim' has been removed: the upstream repository got deleted"; # Added 2025-08-30
+    neuron-nvim = throw "'vimPlugins.neuron-nvim' has been removed: archived repository 2023-02-19"; # Added 2025-09-10
+    nvim-gps = throw "'vimPlugins.nvim-gps' has been archived since 2022. Use nvim-navic instead."; # Added 2025-12-18
+    nvim-ts-rainbow = throw "'vimPlugins.nvim-ts-rainbow' has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
+    nvim-ts-rainbow2 = throw "'vimPlugins.nvim-ts-rainbow2' has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
+    peskcolor-vim = throw "'vimPlugins.peskcolor-vim' has been removed: abandoned by upstream"; # Added 2024-08-23
+    playground = throw "'vimPlugins.playground' has been archived"; # Added 2025-12-18
    pure-lua = lib.warnOnInstantiate "Please replace 'vimPlugins.pure-lua' with 'vimPlugins.moonlight-nvim' as this name was an error" moonlight-nvim; # Added 2025-11-17
-    registers-nvim = throw "the upstream repository got deleted"; # added 2026-04-30
-    rust-tools-nvim = lib.warnOnInstantiate "'vimPlugins.rust-tools-nvim' is abandoned by upstream; you should use 'vimPlugins.rustaceanvim'" rust-tools-nvim;
+    registers-nvim = throw "'vimPlugins.registers-nvim' has been removed: the upstream repository got deleted"; # Added 2026-04-30
+    rust-tools-nvim = lib.warnOnInstantiate "'vimPlugins.rust-tools-nvim' is abandoned by upstream; you should use 'vimPlugins.rustaceanvim'" rust-tools-nvim; # Added 2026-02-04
    Spacegray-vim = throw "'vimPlugins.Spacegray-vim' has been removed: abandoned by upstream"; # Added 2025-03-24
-    SpaceVim = throw "this distribution didn't work properly in vimPlugins, please use top-level 'spacevim' instead"; # added 2024-11-27
-    spacevim = throw "this distribution was unmaintained for the last 6 years, please use top-level 'spacevim'"; # added 2024-11-27
-    sparkup = throw "'vimPlugins.sparkup' was removed: the upstream repository got deleted"; # added 2025-08-06
+    SpaceVim = throw "'vimPlugins.SpaceVim' didn't work properly in vimPlugins, please use top-level 'spacevim' instead"; # Added 2024-11-27
+    spacevim = throw "'vimPlugins.spacevim' was unmaintained for the last 6 years, please use top-level 'spacevim'"; # Added 2024-11-27
+    sparkup = throw "'vimPlugins.sparkup' was removed: the upstream repository got deleted"; # Added 2025-08-06
    syntax-tree-surfer = throw "'vimPlugins.syntax-tree-surfer' has been archived"; # Added 2025-12-18
    todo-nvim = throw "'vimPlugins.todo-nvim' has been removed: abandoned by upstream"; # Added 2023-08-23
    vim-sourcetrail = throw "'vimPlugins.vim-sourcetrail' has been removed: abandoned by upstream"; # Added 2022-08-14
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2416,13 +2416,6 @@ assertNoAdditions {
    };
  });

-  mind-nvim = super.mind-nvim.overrideAttrs (old: {
-    dependencies = [ self.plenary-nvim ];
-    meta = old.meta // {
-      license = lib.licenses.bsd3;
-    };
-  });
-
  mini-nvim = super.mini-nvim.overrideAttrs {
    # reduce closure size
    postInstall = ''
--- a/pkgs/applications/editors/vim/plugins/utils/update.py
+++ b/pkgs/applications/editors/vim/plugins/utils/update.py
@@ -95,7 +95,10 @@ class VimEditor(nixpkgs_plugin_update.Editor):
                  fetchFromGitHub,
                  fetchgit,
                }:
-
+                let
+                  inherit (lib.licenses) unfree;
+                  inherit (lib.meta) getLicenseFromSpdxId;
+                in
                final: prev: {
                """
                )
@@ -128,9 +131,9 @@ class VimEditor(nixpkgs_plugin_update.Editor):
                license_spdx_id, license_spdx_id
            )
        license_nix = (
-            f"    meta.license = lib.meta.getLicenseFromSpdxId {json.dumps(license_spdx_id)};\n"
+            f"    meta.license = getLicenseFromSpdxId {json.dumps(license_spdx_id)};\n"
            if license_spdx_id
-            else "    meta.license = lib.licenses.unfree;\n"
+            else "    meta.license = unfree;\n"
        )
        content += """{buildFn} {{
    pname = "{plugin.name}";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -687,7 +687,6 @@ https://github.com/mellow-theme/mellow.nvim/,,
 https://github.com/lsig/messenger.nvim/,,
 https://github.com/xero/miasma.nvim/,,
 https://github.com/dasupradyumna/midnight.nvim/,,
-https://github.com/hadronized/mind.nvim/,,
 https://github.com/nvim-mini/mini-git/,,
 https://github.com/nvim-mini/mini.ai/,,
 https://github.com/nvim-mini/mini.align/,,
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-05-01";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "eb4216246a2590281ffaf4aa644155c8757025d2";
-    hash = "sha256-2gaPh3Z20eCKLQAcVs49v9R+4WjDQKdJqPWasRRwUa0=";
+    rev = "252694adb9ebf2abcc7a1340d4078dce53d8954f";
+    hash = "sha256-mFij3fLDMvyby3ata47YJN7YuBKGv4/xphFQDiFKY3A=";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
@@ -1,10 +1,10 @@
 {
  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.201+up39.0.2.tgz";
-    sha256 = "0r43kny2kkrlxjniivnivzbqqbiri08cg9qjrl6mx9rjzsxfxqwg";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.701+up39.0.7.tgz";
+    sha256 = "1ii00d4r0lmzwi8n16m2fgi50j0s5cj1bm0jlsi3dbdbpq0savi3";
  };
  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.201+up39.0.2.tgz";
-    sha256 = "1ci2wns11ibgwf7x4j90vcbrsf63rrz1slsm63iayvkdq3r3ri04";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.701+up39.0.7.tgz";
+    sha256 = "1ijrh3wr4k6ydcv0ylvy4i3swbj5byam0lkk51khfl9mmz4z8y0r";
  };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "93f356bfebfd647b099aed93e9754deade10c38ef081afa858f8483503d480b1"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "234a24f45c7d767cd850a7265257d4d2d7c2cc5ac3ca8e67a94f359766ec547d"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "e368015a3d3b4d38b23ea2ef31b37c2bcb6e9488628954c33c7976a5f0f09290"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "71cd029a49fae4893970132b0136b217b133de4dbb4ba0107f3b82ec4867734d"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "4cb0a69d3c7319ee27e2c1a3a93523bbdb9c05fde4698b78187d5fb30b9df791"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "41ceeb0249f8d53cbf3ead7ff70374c292c121f991af0e3a491ff66d48a99d41"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b789ea7b1965d630d4d5346af7247da6645fa3b6ef32c9f27a6d44e64af9b5c0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "4d826c3f62a3d58f6da34e4369c4a64f0997b2c963423e1890e5bda70e55dc6b"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "1cd8c3902f215c861d9a66602df0b28c1a70e292468f6a149b8c6299da1d7cbe"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "5c5f6d62105b620cda23099b63146d3cb8698e437a2c0c8e770a17578b174eeb"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.9%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "790c4de411881c0af1d704d566d3832afc2fd91c4820423af1a3796c85b47734"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "e4ca9bf05aab34f10fa792f894ab214aeaac30be31b6d91918b036216d753efa"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
@@ -1,21 +1,21 @@
 {
-  k3sVersion = "1.33.9+k3s1";
-  k3sCommit = "f93a18d13d956f6c7f1cc6101e6048766df09ebb";
-  k3sRepoSha256 = "006g6spjfqnz5w57hls4iy1b84r9y6i6h0ybfprhsphdk5fblvkn";
-  k3sVendorHash = "sha256-PKEPdSdljMOFxwh/xbfSHziRPxMgfvNGK3fQqiNC0UI=";
+  k3sVersion = "1.33.11+k3s1";
+  k3sCommit = "c532325bce6b1fa03be983cca3a8b4b84eea72a6";
+  k3sRepoSha256 = "1gzpazgi0bhqp4bqlp1s7gxqlh2wq2s8n31khy83kdhz22i6dipb";
+  k3sVendorHash = "sha256-rFH0Z66J6NHP+iscHDsr5rDkVLLkXeVuXTlT9hEhubw=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.0";
  k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.9.0-k3s1";
-  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
-  containerdVersion = "2.1.5-k3s1.33";
-  containerdSha256 = "15iw6px3710rlsx7j933i07qd4a2r7caagfjbhhfcp33m9k19v7h";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.2.3-k3s1.33";
+  containerdSha256 = "1zkbjwnhxxkc9lqk2i9wfi10ywd4rsky3sjs2dzlid91l6xgrwhv";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.33.0-k3s2";
-  flannelVersion = "v0.28.0";
+  flannelVersion = "v0.28.4";
  flannelPluginVersion = "v1.9.0-flannel1";
  kubeRouterVersion = "v2.6.3-k3s1";
  criDockerdVersion = "v0.3.19-k3s2";
-  helmJobVersion = "v0.9.14-build20260210";
+  helmJobVersion = "v0.9.17-build20260422";
 }
--- a/pkgs/applications/networking/cluster/k3s/1_34/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_34/chart-versions.nix
@@ -1,10 +1,10 @@
 {
  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.201+up39.0.2.tgz";
-    sha256 = "0r43kny2kkrlxjniivnivzbqqbiri08cg9qjrl6mx9rjzsxfxqwg";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.701+up39.0.7.tgz";
+    sha256 = "1ii00d4r0lmzwi8n16m2fgi50j0s5cj1bm0jlsi3dbdbpq0savi3";
  };
  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.201+up39.0.2.tgz";
-    sha256 = "1ci2wns11ibgwf7x4j90vcbrsf63rrz1slsm63iayvkdq3r3ri04";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.701+up39.0.7.tgz";
+    sha256 = "1ijrh3wr4k6ydcv0ylvy4i3swbj5byam0lkk51khfl9mmz4z8y0r";
  };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "c4b6795a54bb193ea4b156c76a742dd4f93e03bbd03b739d8356d7298aa8a9be"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "4c81d96db507206816c341e79c113692d9f6c1515d0f2cd82f3c95376f09e7f3"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "dbc5a1a69162b37544ea7f4d04208355f57c696b98bb7ae47a3080c84d90debf"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "1d98b5f32c85ae41371851e6c14b81bdb8960177b28ccd1deda55c1a05586704"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "d5e882421ab3d31786d03dfceaa4cdda80fdf5c15e456bfdaf69b46627dce0ef"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "da9fb4db5e14d8ebaf173718f1df8ed68c80f56ea725e5c7b19c0c2b216f538a"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "d795d06766a1d5475123deef4bf4c869fe5c8dadba844241e983aa25818d1631"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "9880d9f56c5ec9b61714aa27caab365b237f51ec272e27cfc3bfead5ae60eeee"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "dda519d71787bc7eed33a2a1db9015158ca58d86f23a39704b4193f3e1e1a36b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "7702e62ebf167bdc9d8f4b3eda18544339c839f456746389d8fceea8be379d3e"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c5799a879b68adc996e9a09158d8ea7f04b46bff5241e9641c404809e687d29e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "4c9514a2874c592813285fac36ff6a9f7e65febc426af73a7ac3ececa1804d6d"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
@@ -1,21 +1,21 @@
 {
-  k3sVersion = "1.34.5+k3s1";
-  k3sCommit = "c2661bc1e7029f4e68a02f4a9d15c7de3428d0cf";
-  k3sRepoSha256 = "07wqbj8l48nwvx59p6wrahk7acw5bgmvkv7ij24f1514xj5y6if2";
-  k3sVendorHash = "sha256-q3/KylcuuhUMC3ggpR8DsLjdWgtPnhCqa1HjM2sgHuo=";
+  k3sVersion = "1.34.7+k3s1";
+  k3sCommit = "757f14939dd335fb5d7a839a9980382da9cdedf7";
+  k3sRepoSha256 = "0f4mp23hnn5w5km0ymj66vpjjdh6m0xkrs87lfpm0gf2j9ba1vn5";
+  k3sVendorHash = "sha256-MrWZp43SVKWboUs3RasZXBmZD3dDYWWZewKbXkJvsiA=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.0";
  k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.9.0-k3s1";
-  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
-  containerdVersion = "2.1.5-k3s1";
-  containerdSha256 = "0n0g58d352i8wz0bqn87vgrd7z54j268cbmbp19fz68wmifm7fl8";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.2.3-k3s1";
+  containerdSha256 = "0fn252icn082822r754i2bqd8rivhvjwkfk031a8g0vvw8rz46vj";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.34.0-k3s2";
-  flannelVersion = "v0.28.0";
+  flannelVersion = "v0.28.4";
  flannelPluginVersion = "v1.9.0-flannel1";
  kubeRouterVersion = "v2.6.3-k3s1";
  criDockerdVersion = "v0.3.19-k3s3";
-  helmJobVersion = "v0.9.14-build20260210";
+  helmJobVersion = "v0.9.17-build20260422";
 }
--- a/pkgs/applications/networking/cluster/k3s/1_35/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_35/chart-versions.nix
@@ -1,10 +1,10 @@
 {
  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.201+up39.0.2.tgz";
-    sha256 = "0r43kny2kkrlxjniivnivzbqqbiri08cg9qjrl6mx9rjzsxfxqwg";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-39.0.701+up39.0.7.tgz";
+    sha256 = "1ii00d4r0lmzwi8n16m2fgi50j0s5cj1bm0jlsi3dbdbpq0savi3";
  };
  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.201+up39.0.2.tgz";
-    sha256 = "1ci2wns11ibgwf7x4j90vcbrsf63rrz1slsm63iayvkdq3r3ri04";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-39.0.701+up39.0.7.tgz";
+    sha256 = "1ijrh3wr4k6ydcv0ylvy4i3swbj5byam0lkk51khfl9mmz4z8y0r";
  };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_35/go_runc_require.patch
+++ b/pkgs/applications/networking/cluster/k3s/1_35/go_runc_require.patch
@@ -1,15 +0,0 @@
-diff --git a/scripts/package-cli b/scripts/package-cli
-index a15d754926..bc450dbe4e 100755
--- a/scripts/package-cli
-+++ b/scripts/package-cli
-@@ -3,7 +3,10 @@ set -e -x
- 
- cd $(dirname $0)/..
- 
-+runc_require=$(grep "github.com/opencontainers/runc" go.mod | awk -F '=> ' '{print $2}' | xargs -0 printf 'require %s')
-+echo "$runc_require" >> go.mod
- . ./scripts/version.sh
-+sed -i '$d' go.mod
- 
- GO=${GO-go}
- 
--- a/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "5714a481d7e197cc4e41070bfd8a310dc93103fc9f23bfc32fce61d24940d9a7"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "cb7609c41885b65452fd8e4b5ad4621e39ef31a1894c9b416e2ca369aea673bd"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "a3caf6692c1495f58bbaa1411a0e2377e9f7ebd262bd33101c3cd1edade68360"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "2740585f773e1461b2a5b9976a1291a7a554b85f4538228e34cc67b03f690ca5"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "bd48d1aeee4e7643e796439ec95caef0e270e07744307a9b1d134e55837b868b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "ef1366c55b9ee109a8452d9fdeb3d5cfc00927e0f24f227ff57ec0e54b34f7ae"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "393d1de18e0ba363164d77b005d9cca045b9cd726645b9915550a429fc7920e8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "b09ebf9407e9c2901f13d4921304d83abf9bbd4e1222fb5a2a6d91ac9622a2e3"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "fe69ee52cf6a9b51667877e2eebda08a789b19d4fb0a0a38fde21aa5051eb24d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "6bba0489d0b1ac542a9fcca64a6cf367ae6423f6e17478cca40f0ea4cfd01d31"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.2%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "5ddc08b28514575c819638ee2a870b587ca4105a4465763cca276b663ce84298"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "3ddac18185a554b42d53e79d80954ca7841ce48f511afe75fdf8485e0d88efe7"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
@@ -1,21 +1,21 @@
 {
-  k3sVersion = "1.35.2+k3s1";
-  k3sCommit = "13563febb4bd4aef9c7cda43a22c8155ac937dd4";
-  k3sRepoSha256 = "0kwk4c99bn0glhyf81cmx0ly0x97hlajhh2h658cpjr97hij2fpa";
-  k3sVendorHash = "sha256-iGtGGviYfLDmagFlWfMBZ1Gm57aNhusLFR2p70SpFMQ=";
+  k3sVersion = "1.35.4+k3s1";
+  k3sCommit = "5dc8fe6894219e2156c2ba82b1bee84cad674694";
+  k3sRepoSha256 = "0ilsxhfnn30h0lfajn6awz396g7ygm9n2syzsf09k0g1mv741gib";
+  k3sVendorHash = "sha256-PzRBM5cSCF3cGIEdvUrQ4x4PyV7rBpMZVP+tYJDH6oo=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.0";
  k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.9.0-k3s1";
-  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
-  containerdVersion = "2.1.5-k3s1";
-  containerdSha256 = "0n0g58d352i8wz0bqn87vgrd7z54j268cbmbp19fz68wmifm7fl8";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.2.3-k3s1";
+  containerdSha256 = "0fn252icn082822r754i2bqd8rivhvjwkfk031a8g0vvw8rz46vj";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.35.0-k3s2";
-  flannelVersion = "v0.28.0";
+  flannelVersion = "v0.28.4";
  flannelPluginVersion = "v1.9.0-flannel1";
  kubeRouterVersion = "v2.6.3-k3s1";
  criDockerdVersion = "v0.3.19-k3s3";
-  helmJobVersion = "v0.9.14-build20260210";
+  helmJobVersion = "v0.9.17-build20260422";
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -580,13 +580,13 @@
    "vendorHash": "sha256-9Vs/ksWpdusfIHOM1jXZ6XYptLReY7LeQKflXlsOWj8="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-qiROr5WjyX2CJQ4JyhNeD0pQhhhFf45RBUotRxpjT5c=",
+    "hash": "sha256-ltqZ6nyl/leYsV2pBJVgOtcOYIyfDmDLsZLfHTPOyew=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v7.29.0",
+    "rev": "v7.30.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-s6mbjjbQ6VJvZ9Cz//CywP5vF27s5oKHg4GsC0gnYRM="
+    "vendorHash": "sha256-WMfT/gtjRDACXWDf1w3cUiEUdeFrGAnYvDQcuXiQNkk="
  },
  "hashicorp_helm": {
    "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -1148,13 +1148,13 @@
    "vendorHash": null
  },
  "sacloud_sakuracloud": {
-    "hash": "sha256-CVM56qxegsJrH+4SxHhfSR/iuXitgW0HCQH8l+Ay0G0=",
+    "hash": "sha256-qeFN+JMs/TLV/oPFjMjpUmqv6fTiY+qREXQNYHMk8vY=",
    "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
    "owner": "sacloud",
    "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.35.0",
+    "rev": "v2.35.1",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-SY13J+aguuOicQnNBgutjIGh0njrLubpNl0c0b4kNwo="
+    "vendorHash": "sha256-w2NSJv6BY7S5KHeBttxqY2cMR+yPvr2IsC5X4aJAo3A="
  },
  "sap-cloud-infrastructure_sci": {
    "hash": "sha256-eQA4mY+Rx5PLbTgGqfefYFc5gZKIvt1w2eag8ipE0PI=",
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -19,6 +19,7 @@
  glib,
  glib-networking,
  gnome2,
+  gst_all_1,
  gtk2,
  gtk2-x11,
  gtk3,
@@ -77,6 +78,7 @@
  xprop,
  xdpyinfo,
  libxcb,
+  x264,
  zlib,

  homepage,
@@ -87,6 +89,18 @@
 }:

 let
+  gstPackages = [
+    gst_all_1.gstreamer
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+    gst_all_1.gst-vaapi
+  ];
+
+  gstPluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPackages;
+
  fuse3' = symlinkJoin {
    name = "fuse3-backwards-compat";
    paths = [ (lib.getLib fuse3) ];
@@ -145,6 +159,8 @@ stdenv.mkDerivation rec {

  dontBuild = true;
  dontConfigure = true;
+  strictDeps = true;
+  __structuredAttrs = true;
  sourceRoot = ".";
  preferLocalBuild = true;
  passthru.icaroot = "${placeholder "out"}/opt/citrix-icaclient";
@@ -214,8 +230,10 @@ stdenv.mkDerivation rec {
    libxaw
    libxmu
    libxtst
+    x264
    zlib
-  ];
+  ]
+  ++ gstPackages;

  runtimeDependencies = [
    glib
@@ -239,28 +257,65 @@ stdenv.mkDerivation rec {

  installPhase =
    let
+      isSelfservice = program: (builtins.match "selfservice(.*)" program) != null;
+      isWfica = program: (builtins.match "wfica(.*)" program) != null;
+
      icaFlag =
        program:
-        if (builtins.match "selfservice(.*)" program) != null then
+        if isSelfservice program then
          "--icaroot"
-        else if (builtins.match "wfica(.*)" program != null) then
+        else if isWfica program then
          null
        else
          "-icaroot";
+
+      ldLibraryPath =
+        program:
+        lib.concatStringsSep ":" (
+          lib.optional (isWfica program) "$ICAInstDir"
+          ++ [
+            "$ICAInstDir/lib"
+            "$ICAInstDir/usr/lib/x86_64-linux-gnu"
+            "$ICAInstDir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
+            # HdxRtcEngine loads libpulse.so.0 with dlopen, so autoPatchelf
+            # cannot discover it from ELF dependencies.
+            "${lib.getLib libpulseaudio}/lib"
+          ]
+        );
+
+      # Only the ICA engine needs the top-level client directory on the library
+      # path. Leaving it enabled for UI helpers exposes Citrix's session-only
+      # libproxy.so to the embedded web stack, which then fails to resolve CGP
+      # symbols.
+      wrapperArgs =
+        program:
+        lib.concatStringsSep " \\\n          " (
+          lib.optional (icaFlag program != null) ''--add-flags "${icaFlag program} $ICAInstDir"''
+          ++ [
+            ''--set ICAROOT "$ICAInstDir"''
+            ''--prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules"''
+            ''--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "${gstPluginPath}"''
+            ''--prefix LD_LIBRARY_PATH : "${ldLibraryPath program}"''
+            ''--set LD_PRELOAD "${libredirect}/lib/libredirect.so ${lib.getLib pcsclite}/lib/libpcsclite.so"''
+            ''--set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone:/usr/lib/x86_64-linux-gnu=$ICAInstDir/usr/lib/x86_64-linux-gnu"''
+          ]
+        );
+
      wrap = program: ''
        wrapProgram $out/opt/citrix-icaclient/${program} \
-          ${lib.optionalString (icaFlag program != null) ''--add-flags "${icaFlag program} $ICAInstDir"''} \
-          --set ICAROOT "$ICAInstDir" \
-          --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
-          --prefix LD_LIBRARY_PATH : "$ICAInstDir:$ICAInstDir/lib:$ICAInstDir/usr/lib/x86_64-linux-gnu:$ICAInstDir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle" \
-          --set LD_PRELOAD "${libredirect}/lib/libredirect.so ${lib.getLib pcsclite}/lib/libpcsclite.so" \
-          --set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone:/usr/lib/x86_64-linux-gnu=$ICAInstDir/usr/lib/x86_64-linux-gnu"
+          ${wrapperArgs program}
      '';
+
      wrapLink = program: ''
        ${wrap program}
        ln -sf $out/opt/citrix-icaclient/${program} $out/bin/${baseNameOf program}
      '';

+      makeBinWrapper = program: wrapperName: ''
+        makeWrapper $out/opt/citrix-icaclient/${program} $out/bin/${wrapperName} \
+          ${wrapperArgs program}
+      '';
+
      copyCert = path: ''
        cp -v ${path} $out/opt/citrix-icaclient/keystore/cacerts/${baseNameOf path}
      '';
@@ -268,7 +323,7 @@ stdenv.mkDerivation rec {
      mkWrappers = lib.concatMapStringsSep "\n";

      toWrap = [
-        "wfica"
+        "adapter"
        "selfservice"
        "util/configmgr"
        "util/conncenter"
@@ -283,15 +338,29 @@ stdenv.mkDerivation rec {
      export HOME=$(mktemp -d)

      # Run upstream installer in the store-path.
-      sed -i -e 's,^ANSWER="",ANSWER="$INSTALLER_YES",g' -e 's,/bin/true,true,g' -e 's, -C / , -C . ,g' ./linuxx64/hinst
+      sed -i \
+        -e 's,^ANSWER="",ANSWER="$INSTALLER_YES",g' \
+        -e 's,/bin/true,true,g' \
+        -e 's, -C / , -C . ,g' \
+        -e 's,^[[:space:]]*install_deviceTrust "\$ICAInstDir",      :,' \
+        -e 's,^[[:space:]]*install_EPA_with_prompt "\$ICAInstDir",      :,' \
+        -e 's,^[[:space:]]*install_fido2Service "\$CDSourceDir" "\$ICAInstDir",  :,' \
+        ./linuxx64/hinst
      source_date=$(date --utc --date=@$SOURCE_DATE_EPOCH "+%F %T")
      faketime -f "$source_date" ${stdenv.shell} linuxx64/hinst CDROM "$(pwd)"

+      mkdir -p "$ICAInstDir/usr"
+      tar -xzf ./linuxx64/linuxx64.cor/Webkit2gtk4.0/webkit2gtk-4.0.tar.gz \
+        --strip-components=2 \
+        -C "$ICAInstDir/usr" \
+        webkit2gtk-4.0-package/usr/lib
+
      if [ -f "$ICAInstDir/util/setlog" ]; then
        chmod +x "$ICAInstDir/util/setlog"
        ln -sf "$ICAInstDir/util/setlog" "$out/bin/citrix-setlog"
      fi
      ${mkWrappers wrapLink toWrap}
+      ${makeBinWrapper "wfica" "wfica"}
      ${mkWrappers wrap [
        "PrimaryAuthManager"
        "ServiceRecord"
@@ -314,12 +383,42 @@ stdenv.mkDerivation rec {
      rm $ICAInstDir/util/{gst_aud_{play,read},gst_*0.10,libgstflatstm0.10.so} || true
      ln -sf $ICAInstDir/util/gst_play1.0 $ICAInstDir/util/gst_play
      ln -sf $ICAInstDir/util/gst_read1.0 $ICAInstDir/util/gst_read
+      # `hinst` disables multimedia when it cannot link into FHS plugin
+      # directories. In Nix we provide the plugin path via wrappers instead.
+      sed -i 's/^MultiMedia=Off$/MultiMedia=On/' "$ICAInstDir/config/module.ini"

      echo "We arbitrarily set the timezone to UTC. No known consequences at this point."
      echo UTC > "$ICAInstDir/timezone"

      echo "Copy .desktop files."
      cp $out/opt/citrix-icaclient/desktop/* $out/share/applications/
+      for desktop in $out/share/applications/*.desktop; do
+        sed -i \
+          -e "s#/opt/Citrix/ICAClient#$ICAInstDir#g" \
+          -e "s#$ICAInstDir/util/ctxwebhelper#ctxwebhelper#g" \
+          "$desktop"
+
+        case "$(basename "$desktop")" in
+          citrixapp.desktop)
+            sed -i \
+              -e 's#^TryExec=.*#TryExec=selfservice#' \
+              -e 's#^Exec=.*#Exec=selfservice %u#' \
+              "$desktop"
+            ;;
+          selfservice.desktop)
+            sed -i \
+              -e 's#^TryExec=.*#TryExec=selfservice#' \
+              -e 's#^Exec=.*#Exec=selfservice#' \
+              "$desktop"
+            ;;
+          wfica.desktop)
+            sed -i \
+              -e 's#^TryExec=.*#TryExec=adapter#' \
+              -e 's#^Exec=.*#Exec=adapter %f#' \
+              "$desktop"
+            ;;
+        esac
+      done

      # We introduce a dependency on the source file so that it need not be redownloaded everytime
      echo $src >> "$out/share/workspace_dependencies.pin"
@@ -335,6 +434,9 @@ stdenv.mkDerivation rec {
    ${lib.getExe perl} -0777 -pi -e 's{/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/}{"\0" x length($&)}e' \
      $out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4

+    addAutoPatchelfSearchPath --no-recurse "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu"
+    addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
+    addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/lib"
    autoPatchelf -- "$out"

    $out/opt/citrix-icaclient/util/ctx_rehash
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -21,6 +21,15 @@ let
  #
  # The latest versions can be found at https://www.citrix.com/downloads/workspace-app/linux/
  supportedVersions = lib.mapAttrs mkVersionInfo {
+    "26.01.0" = {
+      major = "26";
+      minor = "01";
+      patch = "0";
+      hash = "0avrf9jpqhijvp6w4jgs7xgp4gg1q2mdzak9h9klkqrbsgrvjr3p";
+      suffix = "150";
+      homepage = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+    };
+
    "25.08.10" = {
      major = "25";
      minor = "08";
--- a/pkgs/applications/video/kodi/addons/jurialmunkey/default.nix
+++ b/pkgs/applications/video/kodi/addons/jurialmunkey/default.nix
@@ -9,13 +9,13 @@
 buildKodiAddon rec {
  pname = "jurialmunkey";
  namespace = "script.module.jurialmunkey";
-  version = "0.2.29";
+  version = "0.2.35";

  src = fetchFromGitHub {
    owner = "jurialmunkey";
    repo = namespace;
    rev = "v${version}";
-    hash = "sha256-qVS3vwYFicDXZ8ls/5MfZL8iwmz+CAwB6ZWUV4Zjmbw=";
+    hash = "sha256-3qcLh1vZ4Y7Sf5NHl4j6cmb+n6KodwOBjmBmHLDinCY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/by-name/al/algol68g/package.nix
+++ b/pkgs/by-name/al/algol68g/package.nix
@@ -15,12 +15,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "algol68g";
-  version = "3.11.3";
+  version = "3.12.0";

  src = fetchurl {
    # Uses archive.org because the original site removes older versions.
-    url = "https://web.archive.org/web/20260419212716/https://jmvdveer.home.xs4all.nl/algol68g-3.11.3.tar.gz";
-    hash = "sha256-P8hKm5lFG3P8+OigX2mFPzL1bN30bblAvijajJzTcxA=";
+    url = "https://web.archive.org/web/20260503173638/https://algol68genie.nl/algol68g-3.12.0.tar.gz";
+    hash = "sha256-fYjuivr6AKRK4Nn45Q+oglpTMnp+PhO6KOkGZjwVKn0=";
  };

  outputs = [
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
  postInstall =
    let
      pdfdoc = fetchurl {
-        url = "https://jmvdveer.home.xs4all.nl/learning-algol-68-genie.pdf";
-        hash = "sha256-QCwn1e/lVfTYTeolCFErvfMhvwCgsBnASqq2K+NYmlU=";
+        url = "https://web.archive.org/web/20260503174213/https://algol68genie.nl/learning-algol-68-genie.pdf";
+        hash = "sha256-eLMRf3XcAkr/Dmk7ieRe62x76VcCj+2QltHH7YtL15s=";
      };
    in
    lib.optionalString withPDFDoc ''
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';

  meta = {
-    homepage = "https://jmvdveer.home.xs4all.nl/en.algol-68-genie.html";
+    homepage = "https://algol68genie.nl/en/algol-68-genie/";
    description = "Algol 68 Genie compiler-interpreter";
    longDescription = ''
      Algol 68 Genie (a68g) is a recent checkout hybrid compiler-interpreter,
--- a/pkgs/by-name/at/atool/package.nix
+++ b/pkgs/by-name/at/atool/package.nix
@@ -4,6 +4,8 @@
  fetchurl,
  perl,
  bash,
+  makeDesktopItem,
+  copyDesktopItems,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -16,8 +18,33 @@ stdenv.mkDerivation (finalAttrs: {
  };

  buildInputs = [ perl ];
+  nativeBuildInputs = [ copyDesktopItems ];
  configureScript = "${bash}/bin/bash configure";

+  desktopItems = [
+    (makeDesktopItem {
+      name = "aunpack";
+      desktopName = "Aunpack";
+      exec = "atool -x %f";
+      terminal = true;
+      noDisplay = true;
+      mimeTypes = [
+        "application/gzip"
+        "application/x-7z-compressed"
+        "application/x-bzip2"
+        "application/x-compressed-tar"
+        "application/x-cpio"
+        "application/x-gtar"
+        "application/x-lha"
+        "application/x-lzop"
+        "application/x-tar"
+        "application/x-xz-compressed-tar"
+        "application/zip"
+        "application/x-rar"
+      ];
+    })
+  ];
+
  meta = {
    homepage = "https://www.nongnu.org/atool";
    description = "Archive command line helper";
--- a/pkgs/by-name/bi/bio-gappa/fix-cstdint.patch
+++ b/pkgs/by-name/bi/bio-gappa/fix-cstdint.patch
@@ -0,0 +1,12 @@
+diff --git a/libs/CLI11/include/CLI/Validators.hpp b/libs/CLI11/include/CLI/Validators.hpp
+index 536f8a6..3371905 100644
+--- a/libs/CLI11/include/CLI/Validators.hpp
+++ b/libs/CLI11/include/CLI/Validators.hpp
+@@ -18,6 +18,7 @@
+ // Could be swapped for filesystem in C++17
+ #include <sys/stat.h>
+ #include <sys/types.h>
+#include <cstdint>
+ 
+ namespace CLI {
+ 
--- a/pkgs/by-name/bi/bio-gappa/package.nix
+++ b/pkgs/by-name/bi/bio-gappa/package.nix
@@ -8,6 +8,7 @@
  libz,
  bzip2,
  xz,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -34,8 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
    xz
  ];

-  # CMake 2.8.7 is deprecated and is no longer supported by CMake > 4
-  # https://github.com/NixOS/nixpkgs/issues/445447
+  patches = [
+    ./fix-cstdint.patch
+  ];
+
  postPatch = ''
    substituteInPlace CMakeLists.txt --replace-fail \
      "cmake_minimum_required (VERSION 2.8.7 FATAL_ERROR)" \
@@ -52,6 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = !stdenv.hostPlatform.isDarwin; # skip on Darwin - missing /libz.1.dylib in sandbox
+
  meta = {
    homepage = "https://github.com/lczech/gappa";
    description = "Toolkit for analyzing and visualizing phylogenetic (placement) data";
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "bootdev-cli";
-  version = "1.29.2";
+  version = "1.29.3";

  src = fetchFromGitHub {
    owner = "bootdotdev";
    repo = "bootdev";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-POOxwveDSQ3hiybFKmI2eQQEbxN45ubmfEUkLk7i/ng=";
+    hash = "sha256-6fdzSwCtJG8SFqInVsOc5EO4g9esMU/z9MYtou1ylFI=";
  };

  vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-tarpaulin";
-  version = "0.35.2";
+  version = "0.35.4";

  src = fetchFromGitHub {
    owner = "xd009642";
    repo = "tarpaulin";
    tag = finalAttrs.version;
-    hash = "sha256-DI1xkRLW/RAAw41SfsoJqk8D7cGTrTV1jj63Rwe+E4A=";
+    hash = "sha256-fm9q3VTZh5QKXXw4+t4xngz5gyiZqKpUHShpz0nf2Is=";
  };

-  cargoHash = "sha256-+OBjBo5PtcqrePQc9qEAUYyErLsHMZaGYrU2kIyuKZE=";
+  cargoHash = "sha256-4og97E5zdRIO7swsfgh87MdWh4E4onMIcrCb1/KCJEc=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-zigbuild";
-  version = "0.22.2";
+  version = "0.22.3";

  src = fetchFromGitHub {
    owner = "rust-cross";
    repo = "cargo-zigbuild";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kQnbein4NcZ8IpwCsw7hg+d+Dlg1HChnjXp3lWzECrA=";
+    hash = "sha256-f9jmt3UXniXVeX2NyuRx30DrpRtczLO7ZioNi4TI3Zk=";
  };

-  cargoHash = "sha256-QUE7rNPe0eYPSA2Dd1pSsCz2B+ZLaZBZ+psEwTMdsZ0=";
+  cargoHash = "sha256-7ZQpAePAIqSNiKM8bTAhyx4QyDQda1J8TSnZX0W2tfY=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2026-04-18";
+  version = "0.4.0-unstable-2026-04-30";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "e7347e6a66ef8f9edb50e3e534510c2d3ae6b329";
-    hash = "sha256-TK+lwoEoETcpVe0Xfevg3GUKPQlSKXof+gfmAs6R27Q=";
+    rev = "68546632f7dd949a8861c3cc3358de9747a70ef2";
+    hash = "sha256-TOV1jks2HFw0OqKgtD67WLtimBRtxMWNG3hSnYszldA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -25,21 +25,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.125.0";
+  version = "0.128.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-q175gmBw+edb5+w8TM36yUeFsyIdB1/IwWzbxBbBmoA=";
+    hash = "sha256-v2W0eslPOPHxHX76+bnkE/f4y+MnQuopeOoAC5X16TA=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-fDVlj7zAZnwP9YBaYaSQZXYYWrBm5IEyLT9zoorvzFg=";
+  cargoHash = "sha256-3NQ4UCfBpANhyoJJatd8m31cEugsd42Ye2BXuzlKC0c=";

-  # Match upstream's release build (codex only) and drop the expensive
-  # release profile tweaks that dominate cold build time in nixpkgs.
+  # Match upstream's release build for the codex binary only.
  cargoBuildFlags = [
    "--package"
    "codex-cli"
@@ -57,6 +56,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    substituteInPlace $cargoDepsCopy/*/webrtc-sys-*/build.rs \
      --replace-fail "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dylib=webrtc"

+  ''
+  # Keep upstream's release profile on Darwin. Without LTO/codegen-units=1,
+  # the aarch64-darwin binary grows enough for ld64 to hit ARM64 branch range
+  # limits while linking codex-cli.
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    substituteInPlace Cargo.toml \
      --replace-fail 'lto = "fat"' "" \
      --replace-fail 'codegen-units = 1' ""
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  nix-update-script,
+  versionCheckHook,
+
+  nodejs,
+  pnpm,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ctx7";
+  version = "0.3.9";
+
+  src = fetchFromGitHub {
+    owner = "upstash";
+    repo = "context7";
+    tag = "${finalAttrs.pname}@${finalAttrs.version}";
+    hash = "sha256-nrJCYezH9VDd1Ptpg5xATx0ByweTw8dkKT2y3rnFHd8=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm
+    pnpmConfigHook
+    makeWrapper
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 3;
+    hash = "sha256-8RRHfCTZVC91T1Qx+ACCo2oG4ZwMNy5WYakCjmBhe3Q=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter ${finalAttrs.pname} build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    pnpm \
+      --filter ${finalAttrs.pname} \
+      --offline \
+      --config.inject-workspace-packages=true \
+      --config.shamefully-hoist=true \
+      deploy $out/lib/ctx7
+
+    mkdir -p $out/bin
+    makeWrapper ${nodejs}/bin/node $out/bin/ctx7 \
+      --add-flags "$out/lib/ctx7/dist/index.js"
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "${finalAttrs.pname}@(.*)"
+    ];
+  };
+
+  meta = {
+    description = "Context7 CLI - Manage AI coding skills and documentation context";
+    homepage = "https://context7.com/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ arunoruto ];
+    mainProgram = "ctx7";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/cy/cyclone-scheme/package.nix
+++ b/pkgs/by-name/cy/cyclone-scheme/package.nix
@@ -21,6 +21,8 @@ let

    enableParallelBuilding = true;

+    env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
    nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ cctools ];

    buildInputs = [ libck ];
@@ -41,6 +43,8 @@ stdenv.mkDerivation {

  enableParallelBuilding = true;

+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  nativeBuildInputs = [ bootstrap ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools ];

  buildInputs = [ libck ];
--- a/pkgs/by-name/dc/dc3dd/package.nix
+++ b/pkgs/by-name/dc/dc3dd/package.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ perlPackages.LocaleGettext ];

+  # Remove once upstream ports to c23: https://sourceforge.net/p/dc3dd/bugs/24/
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  makeFlags = [
    "PREFIX=$out"
    "CC=${stdenv.cc.targetPrefix}cc"
--- a/pkgs/by-name/de/deno/librusty_v8.nix
+++ b/pkgs/by-name/de/deno/librusty_v8.nix
@@ -70,14 +70,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rusty-v8";
-  version = "147.2.1";
+  version = "147.4.0";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "rusty_v8";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-HompYzilJ7AC+HXfJJcvPC3L0rQfdAOhMhir/7qDXG8=";
+    hash = "sha256-cS9oBDY2+9RtdqPuOadNl0Lce89ESpBb1qPiWSHPiCg=";
  };

  patches = [
@@ -97,7 +97,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch
  ];

-  cargoHash = "sha256-2h/zATsNngMg0Tvu5oSSveQNfaVbwFbzHndmSyP4Ddo=";
+  cargoHash = "sha256-e/G9AevaJwqYdr8022kmv05Mwzi4Cishj9imLproNB0=";

  nativeBuildInputs = [
    llvmPackages.clang
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -29,17 +29,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deno";
-  version = "2.7.13";
+  version = "2.7.14";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true; # required for tests
-    hash = "sha256-LGTA2xwT939GlAaKfUU3XA0Jx0h1P+8eFgPLmddHxlo=";
+    hash = "sha256-tkZc89JOhXCdMVSAOQYGR6HDe7KmCI5/haLH1RP2p7I=";
  };

-  cargoHash = "sha256-CLI54HSEOC/OVnIf0FmizVrS0adfzukFFBDl+EUP7BE=";
+  cargoHash = "sha256-bFQLsAF4hFBRw04VaL+sxvxIZ9p7nXOLSr2BIZKcwiI=";

  patches = [
    ./patches/0002-tests-replace-hardcoded-paths.patch
--- a/pkgs/by-name/de/devede/package.nix
+++ b/pkgs/by-name/de/devede/package.nix
@@ -11,7 +11,6 @@
  wrapGAppsHook3,
  gdk-pixbuf,
  gobject-introspection,
-  nix-update-script,
 }:

 let
@@ -28,7 +27,7 @@ in
 buildPythonApplication (finalAttrs: {
  pname = "devede";
  version = "4.21.3.1";
-  format = "pyproject";
+  pyproject = true;
  namePrefix = "";

  src = fetchFromGitLab {
--- a/pkgs/by-name/di/dillo-plus/package.nix
+++ b/pkgs/by-name/di/dillo-plus/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchDebianPatch,
  fltk,
  giflib,
  libjpeg,
@@ -23,6 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-7DZ+Ruu1sb+yKHSigdFEVe0xkrsQXSQ2esPhujD3Qrc=";
  };

+  patches = [
+    (fetchDebianPatch {
+      pname = "dillo";
+      version = "3.0.5";
+      debianRevision = "7.2";
+      patch = "gcc-15.patch";
+      hash = "sha256-DFtR5h8N/vl0Lv5tRHgO2Lz0719ORGog02r0zSYMVYU=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
  ];
@@ -51,6 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ fgaz ];
    mainProgram = "dillo";
-    platforms = lib.platforms.all;
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/dm/dmarc-metrics-exporter/package.nix
+++ b/pkgs/by-name/dm/dmarc-metrics-exporter/package.nix
@@ -12,7 +12,7 @@ in

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "dmarc-metrics-exporter";
-  version = "1.2.0";
+  version = "1.3.0";

  pyproject = true;

@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    owner = "jgosmann";
    repo = "dmarc-metrics-exporter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cIsI4TNYuLK0fpUg9lnbl5KSBtzQoT/pTByI9hiy/7o=";
+    hash = "sha256-B2a/F0Ebz6zpe4apVRl7+lX0IS099EmuWOatW2HZdVM=";
  };

  pythonRelaxDeps = true;
@@ -35,6 +35,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
      bite-parser
      dataclasses-serialization
      prometheus-client
+      pydantic
      structlog
      uvicorn
      xsdata
--- a/pkgs/by-name/do/dosbox-x/package.nix
+++ b/pkgs/by-name/do/dosbox-x/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  gitUpdater,
  alsa-lib,
  autoreconfHook,
  ffmpeg,
@@ -27,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dosbox-x";
-  version = "2026.03.29";
+  version = "2026.05.02";

  src = fetchFromGitHub {
    owner = "joncampbell123";
    repo = "dosbox-x";
    rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-hOP+hmvVCdFSqXnD6+6OVIQ7allEidKt9W9AT704htA=";
+    hash = "sha256-4P6NH3LZgnV3CpakdKQhW+29hQl2Q30N5fScZgdk84E=";
  };

  # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants
@@ -110,10 +111,16 @@ stdenv.mkDerivation (finalAttrs: {
      makeWrapper $out/Applications/dosbox-x.app/Contents/MacOS/dosbox-x $out/bin/dosbox-x
    '';

-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
-    # Version output on stderr, program returns status code 1
-    command = "${lib.getExe finalAttrs.finalPackage} -version 2>&1 || true";
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      # Version output on stderr, program returns status code 1
+      command = "${lib.getExe finalAttrs.finalPackage} -version 2>&1 || true";
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "dosbox-x-v";
+      ignoredVersions = "-osfree$";
+    };
  };

  meta = {
--- a/pkgs/by-name/fe/fetchmail/package.nix
+++ b/pkgs/by-name/fe/fetchmail/package.nix
@@ -9,11 +9,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fetchmail";
-  version = "6.6.2";
+  version = "6.6.3";

  src = fetchurl {
    url = "mirror://sourceforge/fetchmail/fetchmail-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pRCSlewzGeDkXt0AnS2XcEKoMmq1LGqBeoL6mHED5PM=";
+    hash = "sha256-JG5fwONck93ho/tmd446twDhaAkjLklZxQi5EhQ3S7I=";
  };

  buildInputs = [
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -39,6 +39,8 @@ buildGoModule rec {
    rm source/cmd/flux/create_secret_git_test.go
  '';

+  env.CGO_ENABLED = 0;
+
  ldflags = [
    "-s"
    "-w"
--- a/pkgs/by-name/fs/fscan/package.nix
+++ b/pkgs/by-name/fs/fscan/package.nix
@@ -6,16 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "fscan";
-  version = "2.0.2";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "shadow1ng";
    repo = "fscan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wvtabfLoPKCmoWL083z1c3g0iOQRtTtgwZxozIaeiw0=";
+    hash = "sha256-Xc6SNmVPxBxcY7PH27562soejIrMXQtb09Djd0gONCo=";
  };

-  vendorHash = "sha256-hDe5IMvOUeAvst8mCWNMCRWcPyJ9Ufomv1Zpjxgcj/0=";
+  vendorHash = "sha256-ihaGbm4iLjwvTzM278wuwom8LrmHB3WgmbfcJxtkbYc=";
+
+  subPackages = [ "." ];

  meta = {
    description = "Intranet comprehensive scanning tool";
--- a/pkgs/by-name/gh/ghdump/package.nix
+++ b/pkgs/by-name/gh/ghdump/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ghdump";
-  version = "0.1.1";
+  version = "0.1.2";

  __structuredAttrs = true;
  strictDeps = true;
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "drupol";
    repo = "ghdump";
    tag = finalAttrs.version;
-    hash = "sha256-ozOWbncNN+Jq9jJpbHvjrIIsx5+R/hzBqQvqfoxH5ZA=";
+    hash = "sha256-XOLXrffbymuPv544g66kwo1IKkEaK5/MBA1gsg+Cj2c=";
  };

-  cargoHash = "sha256-G24vq74B8NyRq++FlyvR946MWKE0x1n1phTfxFSF8Gs=";
+  cargoHash = "sha256-kuXtBrMk1s5mDjMVL/BKV+8qRlJ/g0Svv07IQepcQE8=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/gi/git-spice/package.nix
+++ b/pkgs/by-name/gi/git-spice/package.nix
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "git-spice";
-  version = "0.26.1";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "abhinav";
    repo = "git-spice";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hE0PCjEGZE+nMLfICUjDoLzaNCsPMKSyg9y1R7tpePk=";
+    hash = "sha256-/UzEWuW1Y3CXXPfU3ntYk3r+LreyzQ8XG4hbPIwWRUE=";
  };

  vendorHash = "sha256-YPcQ3Yjn016S2bLjUKH2SXgTm6b1+q7McgEzjUzyggE=";
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -12,7 +12,7 @@

 buildGoModule (finalAttrs: {
  pname = "grype";
-  version = "0.111.1";
+  version = "0.112.0";

  # required for tests
  __darwinAllowLocalNetworking = true;
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
    owner = "anchore";
    repo = "grype";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eAiExxvLFkHsmslfhhbQG0ogaSMF9eOeCq0u2wUimp0=";
+    hash = "sha256-8gCJ+hCClpYbDOTierJJfH5JP1imuQ3ZV2xDoeE0TtM=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {

  proxyVendor = true;

-  vendorHash = "sha256-rsdZt+xKjIJpWS5pYx8A+ryY1D2WIKquKjsQBkxToUQ=";
+  vendorHash = "sha256-VDhKMg+3rovhpSFgDUqeLOrf56jtT9c0e090FvY87Yo=";

  patches = [
    # several test golden files have unstable paths based on the platform
--- a/pkgs/by-name/je/jello-lang/package.nix
+++ b/pkgs/by-name/je/jello-lang/package.nix
@@ -10,7 +10,7 @@
 python3Packages.buildPythonApplication {
  pname = "jello-lang";
  version = "0-unstable-2025-01-07";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "codereport";
--- a/pkgs/by-name/je/jellyfish/package.nix
+++ b/pkgs/by-name/je/jellyfish/package.nix
@@ -8,7 +8,7 @@
 python3Packages.buildPythonApplication {
  pname = "jellyfish";
  version = "0-unstable-2024-05-27";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "codereport";
--- a/pkgs/by-name/li/linja-sike/package.nix
+++ b/pkgs/by-name/li/linja-sike/package.nix
@@ -1,23 +1,32 @@
-{ lib, fetchurl }:
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  installFonts,
+}:

-fetchurl {
+stdenvNoCC.mkDerivation {
  pname = "linja-sike";
  version = "5.0";

-  url = "https://wyub.github.io/tokipona/linja-sike-5.otf";
+  src = fetchurl {
+    url = "https://lipamanka.gay/linja-sike-5.otf";
+    hash = "sha256-TJcKIK6byBb9/zyoKHTmhMpOGwHYG/ZPmm72huSO/Yo=";
+  };

-  downloadToTemp = true;
-  recursiveHash = true;
-  postFetch = ''
-    install -D $downloadedFile $out/share/fonts/opentype/linja-sike.otf
-  '';
+  dontUnpack = true;

-  sha256 = "sha256-LkjG1Oao/LqKwI+eRZPzShTh7lz5DkooltXm7vxZC9w=";
+  __structuredAttrs = true;
+
+  stripDeps = true;
+
+  postPatch = "cp $src linja-sike-5.otf";
+
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "Extensive sitelen pona font by lipamanka";
    homepage = "https://docs.google.com/document/d/1d8kUIAVlB-JNgK3LWr_zVCuUOZTh2hF7CfC6xQgxsBs/edit?usp=sharing";
-    downloadPage = "https://wyub.github.io/tokipona/linjasike";
    license = lib.licenses.ofl;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ somasis ];
--- a/pkgs/by-name/na/nano-syntax-highlighting/package.nix
+++ b/pkgs/by-name/na/nano-syntax-highlighting/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: rec {
  pname = "nano-syntax-highlighting";
-  version = "2026.03.14";
+  version = "2026.05.01";

  src = fetchFromGitHub {
    owner = "galenguyer";
    repo = "nano-syntax-highlighting";
    tag = version;
-    hash = "sha256-H0F57b8M+onhpVtvna03t919xk6+z/dJP37y9hcqfCY=";
+    hash = "sha256-ipnePkQEDfJ7T3GJ84D6bmo9KZ2AUkJ8aUqH0rPCsps=";
  };

  dontBuild = true;
--- a/pkgs/by-name/ne/neuron/package.nix
+++ b/pkgs/by-name/ne/neuron/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "neuron";
  version = "8.2.7";

-  # format is for pythonModule conversion
-  format = "other";
+  # pyproject is for pythonModule conversion
+  pyproject = false;

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/ni/nix-index-unwrapped/package.nix
+++ b/pkgs/by-name/ni/nix-index-unwrapped/package.nix
@@ -6,20 +6,21 @@
  openssl,
  curl,
  sqlite,
+  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nix-index";
-  version = "0.1.9-unstable-2026-04-20";
+  version = "0.1.10";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-index";
-    rev = "0f68b51886bde4014629e43d9be4b66cff450990";
-    hash = "sha256-polUDx4tWFmyxsn83XRrw9YQlDq/ggNY1hq6xw9NOoQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IBVI/4hwq84/vZx7Kr/Ci/P/CzPTsn1/oiCIF2vPHXg=";
  };

-  cargoHash = "sha256-2Ar7mj9r5eKdbXDC4+jSWG7HvGFTeowEPt2SBM6a6e4=";
+  cargoHash = "sha256-9xzC5PE2nyEtbhWGagCX2yZ0/tfo2v3fatnNU+GdVH8=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
@@ -37,6 +38,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    install -Dm555 command-not-found.nu -t $out/etc/profile.d
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "Files database for nixpkgs";
    homepage = "https://github.com/nix-community/nix-index";
--- a/pkgs/by-name/nu/nushell-plugin-semver/package.nix
+++ b/pkgs/by-name/nu/nushell-plugin-semver/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_semver";
-  version = "0.11.15";
+  version = "0.11.16";

  src = fetchFromGitHub {
    owner = "abusch";
    repo = "nu_plugin_semver";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hR4SIKeebgqGb1KpSw9SgqoPJKm+evcji1qQwQiGlso=";
+    hash = "sha256-LgB2a14ZIQvNpvYU4nu3AEcwjjWIpJlMS4OGB+dHj2E=";
  };

-  cargoHash = "sha256-GjiqINWZjk/0sIqojpxXjCelwjRhl+fADULQFwTDFJc=";
+  cargoHash = "sha256-PunvfZbghJzcpAMLDIozec2GAklWTosPUWlBJ76lPV8=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/oc/octodns/providers/cloudflare/package.nix
+++ b/pkgs/by-name/oc/octodns/providers/cloudflare/package.nix
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "octodns-cloudflare";
-  version = "1.0.0";
+  version = "1.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "octodns";
    repo = "octodns-cloudflare";
    tag = "v${version}";
-    hash = "sha256-8ORqUGmbmKQ1QbGLi3TFF9DCgF/raSpSEFZ62NfNAOQ=";
+    hash = "sha256-xVuUmadVhPrsfdEwShacWuf6HvFy280RrBeDjU+869M=";
  };

  build-system = [
--- a/pkgs/by-name/op/open-stage-control/package.nix
+++ b/pkgs/by-name/op/open-stage-control/package.nix
@@ -1,103 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-  makeBinaryWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-  nodejs_20,
-  electron,
-  python3,
-  nix-update-script,
-}:
-
-buildNpmPackage rec {
-  pname = "open-stage-control";
-  version = "1.26.2";
-
-  src = fetchFromGitHub {
-    owner = "jean-emmanuel";
-    repo = "open-stage-control";
-    rev = "v${version}";
-    hash = "sha256-hBQyz6VAtiC1XOADZml1MwGKtmdyiJNlRAmHRjt6QsA=";
-  };
-
-  # Remove some Electron stuff from package.json
-  postPatch = ''
-    sed -i -e '/"electron"\|"electron-installer-debian"/d' package.json
-  '';
-
-  npmDepsHash = "sha256-UqjYNXdNoQmirIgU9DRgkp14SIrawfrfi9mD2h6ACyU=";
-
-  nodejs = nodejs_20;
-
-  nativeBuildInputs = [
-    copyDesktopItems
-    makeBinaryWrapper
-  ];
-
-  buildInputs = [
-    python3.pkgs.python-rtmidi
-  ];
-
-  doInstallCheck = true;
-
-  makeCacheWritable = true;
-  npmFlags = [ "--legacy-peer-deps" ];
-
-  # Override installPhase so we can copy the only directory that matters (app)
-  installPhase = ''
-    runHook preInstall
-
-    # copy built app and node_modules directories
-    mkdir -p $out/lib/node_modules/open-stage-control
-    cp -r app $out/lib/node_modules/open-stage-control/
-
-    # copy icon
-    install -Dm644 resources/images/logo.png $out/share/icons/hicolor/256x256/apps/open-stage-control.png
-    install -Dm644 resources/images/logo.svg $out/share/icons/hicolor/scalable/apps/open-stage-control.svg
-
-    # wrap electron and include python-rtmidi
-    makeWrapper '${electron}/bin/electron' $out/bin/open-stage-control \
-      --inherit-argv0 \
-      --add-flags $out/lib/node_modules/open-stage-control/app \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
-      --prefix PATH : '${lib.makeBinPath [ python3 ]}'
-
-    runHook postInstall
-  '';
-
-  installCheckPhase = ''
-    XDG_CONFIG_HOME="$(mktemp -d)" $out/bin/open-stage-control --help
-  '';
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "open-stage-control";
-      exec = "open-stage-control";
-      icon = "open-stage-control";
-      desktopName = "Open Stage Control";
-      comment = meta.description;
-      categories = [
-        "Network"
-        "Audio"
-        "AudioVideo"
-        "Midi"
-      ];
-      startupWMClass = "open-stage-control";
-    })
-  ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Libre and modular OSC / MIDI controller";
-    homepage = "https://openstagecontrol.ammd.net/";
-    license = lib.licenses.gpl3Only;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    mainProgram = "open-stage-control";
-    # Depends on nodejs_18 that has been removed.
-    broken = true;
-  };
-}
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.14.31";
+  version = "1.14.33";

  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VHznPS2OuJ8urQqGK3K0ysQLCk+O8JV7/UCDdFyqafQ=";
+    hash = "sha256-bnAV1ApOYZngG59fxFKrGN0jmBKWKnjktsbKJiEOaSo=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-f/cWCr6Oqnq21u9+UyhwE5PGqE9X5K+NtjEGbZ4ORPg=";
+    outputHash = "sha256-dbpqhVcjWr+puZhV0x7pR38iMjjZdbrJydKJ/qJfDeY=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/sq/squishyball/package.nix
+++ b/pkgs/by-name/sq/squishyball/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  autoreconfHook,
  fetchFromGitLab,
+  fetchDebianPatch,
  fetchpatch,
  flac,
  libao,
@@ -47,6 +48,22 @@ stdenv.mkDerivation {
      url = "https://gitlab.xiph.org/xiph/squishyball/uploads/5609ceaf85ebb6dc297c0efe61b9a1b7/0001-mincurses.c-use-ncurses-API-to-enter-raw-mode-ncurse.patch";
      sha256 = "06llp7cd77f4vvhz8qdld551dnlpjxf98j7rmp3i1x1kng4f0iy3";
    })
+
+    (fetchDebianPatch {
+      pname = "squishyball";
+      version = "0.1~svn19085";
+      debianRevision = "8";
+      patch = "0006-Workaround-opaqueness-of-struct-term.patch";
+      hash = "sha256-7zXPsJxIpQI2Ro+GNIZEASxHFrRqSUiXjQl9/KeHSAk=";
+    })
+
+    (fetchDebianPatch {
+      pname = "squishyball";
+      version = "0.1~svn19085";
+      debianRevision = "8";
+      patch = "0007-ncurses-internals.patch";
+      hash = "sha256-GzYV0Oas1Amte0m5XCAUfEMRUTYI3UticCdASCn+s28=";
+    })
  ];

  postInstall = ''
--- a/pkgs/by-name/su/sunvox/package.nix
+++ b/pkgs/by-name/su/sunvox/package.nix
@@ -35,15 +35,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "sunvox";
-  version = "2.1.4";
+  version = "2.1.4d";

  src = fetchzip {
    urls = [
      "https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
      # Upstream removes downloads of older versions, please save bumped versions to archive.org
-      "https://web.archive.org/web/20251208174416/https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
+      "https://web.archive.org/web/20260501043715/https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
    ];
-    hash = "sha256-FY5DxdQN1ClFp/dS5fXgFhoU7uk/gUoPrYtsZK5q9O4=";
+    hash = "sha256-HQwA9FyK1xdcTsWWfX7ZJ0KcnuwRz25ztjlrNIDhFQY=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/sw/switch-to-configuration-ng/package.nix
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/package.nix
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage {
    cargo clippy -- -Dwarnings
  '';

-  passthru.tests = { inherit (nixosTests) switchTest; };
+  passthru.tests = { inherit (nixosTests) switchTest activation-template-dropin; };

  meta = {
    description = "NixOS switch-to-configuration program";
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
@@ -410,6 +410,14 @@ fn parse_systemd_ini(data: &mut UnitInfo, mut unit_file: impl Read) -> Result<()
    Ok(())
 }

+/// Glob for `<unit_path>.d/*.conf`, escaping any glob metacharacters in the
+/// path prefix so unit names containing e.g. `\` (from systemd-escape) are
+/// matched literally.
+fn unit_dropin_glob(unit_path: &Path) -> Result<glob::Paths> {
+    let prefix = glob::Pattern::escape(&format!("{}.d", unit_path.display()));
+    glob(&format!("{prefix}/*.conf")).context("Invalid glob pattern")
+}
+
 // This function takes the path to a systemd configuration file (like a unit configuration) and
 // parses it into a UnitInfo structure.
 //
@@ -428,9 +436,7 @@ fn parse_unit(unit_file: &Path, base_unit_path: &Path) -> Result<UnitInfo> {
        )
    })?;

-    for entry in
-        glob(&format!("{}.d/*.conf", base_unit_path.display())).context("Invalid glob pattern")?
-    {
+    for entry in unit_dropin_glob(base_unit_path)? {
        let Ok(entry) = entry else {
            continue;
        };
@@ -442,9 +448,7 @@ fn parse_unit(unit_file: &Path, base_unit_path: &Path) -> Result<UnitInfo> {

    // Handle drop-in template-unit instance overrides
    if unit_file != base_unit_path {
-        for entry in
-            glob(&format!("{}.d/*.conf", unit_file.display())).context("Invalid glob pattern")?
-        {
+        for entry in unit_dropin_glob(unit_file)? {
            let Ok(entry) = entry else {
                continue;
            };
@@ -1036,6 +1040,37 @@ fn remove_file_if_exists(p: impl AsRef<Path>) -> std::io::Result<()> {
    }
 }

+#[derive(Debug, PartialEq)]
+enum UnitFileState {
+    /// The file exists and resolves to a real unit file.
+    Present,
+    /// The file is a (chain of) symlink(s) to /dev/null, i.e. masked.
+    Masked,
+    /// The file does not exist, or is a dangling symlink.
+    Missing,
+}
+
+impl UnitFileState {
+    /// Whether the unit file is absent from the configuration, either because
+    /// it does not exist or because it has been masked to /dev/null.
+    fn is_gone(&self) -> bool {
+        matches!(self, UnitFileState::Masked | UnitFileState::Missing)
+    }
+}
+
+/// Classify a unit-file path. Unexpected I/O errors are propagated.
+fn unit_file_state(unit_file: impl AsRef<Path>) -> Result<UnitFileState> {
+    let path = unit_file.as_ref();
+    match path.canonicalize() {
+        Ok(target) if target == Path::new("/dev/null") => Ok(UnitFileState::Masked),
+        Ok(_) => Ok(UnitFileState::Present),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(UnitFileState::Missing),
+        Err(err) => {
+            Err(err).with_context(|| format!("Failed to canonicalize unit file {}", path.display()))
+        }
+    }
+}
+
 /// Iterate over currently active units in the given scope, compare the unit
 /// file in `old_unit_dir` against the one in `new_unit_dir`, and populate the
 /// action maps accordingly.
@@ -1088,6 +1123,7 @@ fn collect_unit_changes(
        let mut base_unit = unit.clone();
        let mut current_base_unit_file = current_unit_file.clone();
        let mut new_base_unit_file = new_unit_file.clone();
+        let mut dropins_removed = false;

        // Detect template instances
        if let Some((Some(template_name), Some(template_instance))) =
@@ -1102,6 +1138,33 @@ fn collect_unit_changes(
                base_unit = format!("{template_name}@.{template_instance}");
                current_base_unit_file = old_unit_dir.join(&base_unit);
                new_base_unit_file = new_unit_dir.join(&base_unit);
+
+                // Handle instances defined as drop-ins. When the unit is
+                // disabled, the override files will be a symlink to
+                // /dev/null instead.
+
+                // The instance was NixOS-managed in the old generation iff
+                // at least one current drop-in is a real file (not masked).
+                let mut currently_managed = false;
+                for entry in unit_dropin_glob(&current_unit_file)?.flatten() {
+                    if unit_file_state(&entry)? == UnitFileState::Present {
+                        currently_managed = true;
+                        break;
+                    }
+                }
+
+                // If the instance was managed before, check whether it
+                // still is: gone iff no new drop-ins remain (or all are
+                // masked to /dev/null).
+                if currently_managed {
+                    dropins_removed = true;
+                    for entry in unit_dropin_glob(&new_unit_file)?.flatten() {
+                        if unit_file_state(&entry)? == UnitFileState::Present {
+                            dropins_removed = false;
+                            break;
+                        }
+                    }
+                }
            }
        }

@@ -1116,11 +1179,9 @@ fn collect_unit_changes(
        if current_base_unit_file.exists()
            && (unit_state.state == "active" || unit_state.state == "activating")
        {
-            if new_base_unit_file
-                .canonicalize()
-                .map(|full_path| full_path == Path::new("/dev/null"))
-                .unwrap_or(true)
-            {
+            // Account for template unit instances where overrideStrategy == "asDropin"
+            // whilst also allowing manual instances to keep running.
+            if dropins_removed || unit_file_state(&new_base_unit_file)?.is_gone() {
                let current_unit_info = parse_unit(&current_unit_file, &current_base_unit_file)?;
                if parse_systemd_bool(Some(&current_unit_info), "Unit", "X-StopOnRemoval", true) {
                    _ = units_to_stop.insert(unit.to_string(), ());
--- a/pkgs/by-name/th/thc-secure-delete/package.nix
+++ b/pkgs/by-name/th/thc-secure-delete/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  installShellFiles,
  pkg-config,
 }:
@@ -17,6 +18,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-hvWuxFkzhOSCplPtyjRtn36bIk6KdPBcpr3lAmiAyfE=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/signal-handler-fix.patch?h=thc-secure-delete&id=ca83e2c6a548aaba56a0499180d15d61c75b6acd";
+      hash = "sha256-MGCl5wXHuDr0Z4MlBGlSAUrv5VeQ8FjWCNsTOnS7Evw=";
+      extraPrefix = "";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
    installShellFiles
--- a/pkgs/by-name/ti/tinyfugue/package.nix
+++ b/pkgs/by-name/ti/tinyfugue/package.nix
@@ -2,7 +2,9 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  ncurses,
+  pcre2,
  zlib,
  openssl,
  sslSupport ? true,
@@ -31,12 +33,30 @@ stdenv.mkDerivation rec {

  patches = [
    ./fix-build.patch
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/tinyfugue/raw/ce016e8fb60a51de7c9d0c45dad109b3809de048/f/tinyfigue-configure-c99.patch";
+      hash = "sha256-Ge6545PCgcvnSgtDChqUQgf6b3BMjNveBAxQ8fAy8f4=";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/tinyfugue/raw/ce016e8fb60a51de7c9d0c45dad109b3809de048/f/tf-50b8.pcre.patch";
+      hash = "sha256-T0XiadrviyuvtZZKYG/kXHQSC7RZkLKQGHOMrnfyLVg=";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/tinyfugue/raw/ce016e8fb60a51de7c9d0c45dad109b3809de048/f/tf-50b8-pcre2.patch";
+      hash = "sha256-pTtCUwMBk+t4lK0Z1fKPKaQemdpEdVPe2NScpD8QBS8=";
+    })
  ];

+  postPatch = ''
+    # remove bundled old PCRE
+    rm -rv src/pcre-2.08
+  '';
+
  configureFlags = optional (!sslSupport) "--disable-ssl";

  buildInputs = [
    ncurses
+    pcre2
    zlib
  ]
  ++ optional sslSupport openssl;
@@ -45,7 +65,7 @@ stdenv.mkDerivation rec {
  # gcc-10. Otherwise build fails as:
  #   ld: world.o:/build/tf-50b8/src/socket.h:24: multiple definition of
  #     `world_decl'; command.o:/build/tf-50b8/src/socket.h:24: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-incompatible-pointer-types -Wno-return-mismatch";

  meta = {
    homepage = "https://tinyfugue.sourceforge.net/";
--- a/pkgs/by-name/tr/traccar/package.nix
+++ b/pkgs/by-name/tr/traccar/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
  pname = "traccar";
-  version = "6.12.2";
+  version = "6.13.0";
  nativeBuildInputs = [ pkgs.makeWrapper ];

  src = fetchzip {
    stripRoot = false;
    url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-lOzakS36B/2+UX/TwcQf4diaB/WfFff1XEZD07Sc/zc=";
+    hash = "sha256-nrAT/ewMpRXTN7bTU02VIJ4YoK5yvgfVZqMvQ1fXPo8=";
  };

  installPhase = ''
--- a/pkgs/by-name/xs/xskat/package.nix
+++ b/pkgs/by-name/xs/xskat/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "8ba52797ccbd131dce69b96288f525b0d55dee5de4008733f7a5a51deb831c10";
  };

-  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-int";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17 -Wno-implicit-int";

  preInstall = ''
    sed -i Makefile \
--- a/pkgs/by-name/ya/yasr/package.nix
+++ b/pkgs/by-name/ya/yasr/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchDebianPatch,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -19,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
    ./20_maxpathlen.patch
    ./30_conf.patch
    ./40_dectalk_extended_chars.patch
+    (fetchDebianPatch {
+      pname = "yasr";
+      version = "0.6.9";
+      debianRevision = "12";
+      patch = "gcc-15";
+      hash = "sha256-KraGxm1RegJpDGQMlo7OaLFBf8l+V8VO65ftjGDOJeg=";
+    })
  ]; # taken from the debian yasr package

  meta = {
--- a/pkgs/by-name/ye/yersinia/package.nix
+++ b/pkgs/by-name/ye/yersinia/package.nix
@@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  fetchDebianPatch,
  autoreconfHook,
  pkg-config,
  ncurses,
@@ -25,6 +26,16 @@ stdenv.mkDerivation {
    sha256 = "sha256-VShg9Nzd8dzUNiqYnKcDzRgqjwar/8XRGEJCJL25aR0=";
  };

+  patches = [
+    (fetchDebianPatch {
+      pname = "yersinia";
+      version = "0.8.2";
+      debianRevision = "2.3";
+      patch = "fix-ftbfs.patch";
+      hash = "sha256-qoD627fcIGmlWT2Uz+85tgIf7KtD11gtUu1N+Ol4T/A=";
+    })
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
--- a/pkgs/by-name/yt/ytalk/package.nix
+++ b/pkgs/by-name/yt/ytalk/package.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ ncurses ];

+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  meta = {
    homepage = "http://ytalk.ourproject.org";
    description = "Terminal based talk client";
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -17,7 +17,7 @@ let
      providing more styles and with greater coverage of Unicode.

      This package includes DejaVu Sans, DejaVu Serif, DejaVu Sans Mono, and
-      the TeX Gyre DejaVu Math font.
+      the DejaVu Math TeX Gyre font.
    '';
    homepage = "https://dejavu-fonts.github.io/";

--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -2,7 +2,7 @@
  pkgs,
  lib,
  makeWrapper,
-  nodejs ? pkgs.nodejs_20,
+  nodejs,
  config,
 }:

--- a/pkgs/development/libraries/maplibre-native-qt/default.nix
+++ b/pkgs/development/libraries/maplibre-native-qt/default.nix
@@ -1,6 +1,7 @@
 {
  cmake,
  fetchFromGitHub,
+  fetchpatch,
  lib,
  qtlocation,
  stdenv,
@@ -18,6 +19,16 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

+  patches = [
+    # fix build with gcc15
+    (fetchpatch {
+      url = "https://github.com/maplibre/maplibre-native/commit/dde3fdd398a5f7b49300b1a761057bdd3286ae24.patch";
+      hash = "sha256-UQ4Y2aoBsHQHEqlrwn4OUzICeT3MNVZlHFK/KphvV/c=";
+      stripLen = 1;
+      extraPrefix = "vendor/maplibre-native/";
+    })
+  ];
+
  postPatch = lib.optionals (lib.versionAtLeast qtlocation.version "6.10") ''
    # fix build with Qt 6.10
    # included in https://github.com/maplibre/maplibre-native-qt/pull/216
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@@ -33,6 +33,9 @@ let
    stripIdlelib = true;
    stripTests = true;
    enableOptimizations = false;
+    packageOverrides = prev: final: {
+      setuptools = removeKnownVulnerabilities final.setuptools;
+    };
  };
  callPackage = lib.callPackageWith (pkgsBuildHost // { python27 = python27'; });
  source = callPackage ./source.nix { };
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "alexapy";
-  version = "1.29.20";
+  version = "1.29.21";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "keatontaylor";
    repo = "alexapy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CHr1R2zqDlIrN3CN8d0iahi3Ytp0JlVsHY+My5t8WoA=";
+    hash = "sha256-8oUgttLAhPSB7uysoObxqu0lYre8Y1qg/8m7NhwPazI=";
  };

  pythonRelaxDeps = [ "aiofiles" ];
--- a/pkgs/development/python-modules/aliyun-python-sdk-alimt/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-alimt/default.nix
@@ -9,7 +9,7 @@
 buildPythonPackage rec {
  pname = "aliyun-python-sdk-alimt";
  version = "3.2.0";
-  format = "pyproject";
+  pyproject = true;

  # Upstream doesn't tag releases on Github
  # https://github.com/aliyun/aliyun-openapi-python-sdk/issues/551
--- a/pkgs/development/python-modules/chatlas/default.nix
+++ b/pkgs/development/python-modules/chatlas/default.nix
@@ -31,14 +31,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "chatlas";
-  version = "0.15.2";
+  version = "0.16.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "posit-dev";
    repo = "chatlas";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BHqF60JTGlnP20BLQkcofkJUs7sAZAwhtr46y2HeNxY=";
+    hash = "sha256-8dME+zY+yzPiUK2WUKlOJS6GF7UA2qSym617P2DoV68=";
  };

  build-system = [
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "disposable-email-domains";
-  version = "0.0.172";
+  version = "0.0.177";
  pyproject = true;

  # No tags on GitHub
  src = fetchPypi {
    pname = "disposable_email_domains";
    inherit (finalAttrs) version;
-    hash = "sha256-CYv8M1TdtwDiwN4HRxUR/kdJZ+JpbT7ROd1PWs3hNr4=";
+    hash = "sha256-HKm7QTtzxW8ZnuvAsE5JFr61nnr+qWjjeV/5VY1JFIc=";
  };

  build-system = [
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -14,7 +14,7 @@
 buildPythonPackage rec {
  pname = "flask-sqlalchemy";
  version = "3.1.1";
-  format = "pyproject";
+  pyproject = true;

  src = fetchPypi {
    pname = "flask_sqlalchemy";
--- a/pkgs/development/python-modules/issubclass/default.nix
+++ b/pkgs/development/python-modules/issubclass/default.nix
@@ -8,7 +8,7 @@
 buildPythonPackage rec {
  pname = "issubclass";
  version = "0.1.2";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "zmievsa";
--- a/pkgs/development/python-modules/lineax/default.nix
+++ b/pkgs/development/python-modules/lineax/default.nix
@@ -20,14 +20,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "lineax";
-  version = "0.1.0";
+  version = "0.1.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "patrick-kidger";
    repo = "lineax";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oUqJRp4pge3t9g7o/9PCZTb7e4EPkBEGLclHMIdUqiw=";
+    hash = "sha256-qclL/IE/+gLeBL4huy07npXR3sDlbrTlFfib3qVKupk=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/mistralai/default.nix
+++ b/pkgs/development/python-modules/mistralai/default.nix
@@ -30,14 +30,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "mistralai";
-  version = "2.3.2";
+  version = "2.4.4";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "mistralai";
    repo = "client-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aqKM85gBvOyfAsps29u6okuQFJ+GzS2AGFgY1H4Tkmw=";
+    hash = "sha256-e2G/bqU45hCfcPEhj4zf5X7EKjs/zWhxCkn9J0u4F7U=";
  };

  preBuild = ''
--- a/pkgs/development/python-modules/pyloadapi/default.nix
+++ b/pkgs/development/python-modules/pyloadapi/default.nix
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pyloadapi";
-  version = "2.0.0";
+  version = "2.1.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "tr4nt0r";
    repo = "pyloadapi";
    tag = "v${version}";
-    hash = "sha256-+fGrXKS7jomYMJOPneKyAV/nrvqBFrqh3ds4R46lQ48=";
+    hash = "sha256-yNv21WfuAttzPWpmgadClTx9ryMNFjMsPA31w9BGX+U=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -23,14 +23,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "pymc";
-  version = "5.28.4";
+  version = "5.28.5";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pymc-devs";
    repo = "pymc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-REQ9+II6MFZ64FlJudRRhmXA4/Cb017XrsrZFZBY7R0=";
+    hash = "sha256-neySWgFxnebW9v0Fa6+ZaxQeFQ0v6wpRvQrBj0zOHJs=";
  };

  build-system = [
--- a/pkgs/development/python-modules/python-datemath/default.nix
+++ b/pkgs/development/python-modules/python-datemath/default.nix
@@ -9,7 +9,7 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "python-datemath";
  version = "3.0.3";
  pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "nickmaccarthy";
    repo = "python-datemath";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-VwdY6Gmbmoy7EKZjUlWj56uSiE0OdegPiQv+rmigkq8=";
  };

@@ -35,11 +35,16 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "datemath" ];

+  disabledTests = [
+    # Test relies on timezone data that may not be present in the test environment
+    "testTimezone"
+  ];
+
  meta = {
    description = "Python module to emulate the date math used in SOLR and Elasticsearch";
    homepage = "https://github.com/nickmaccarthy/python-datemath";
-    changelog = "https://github.com/nickmaccarthy/python-datemath/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/nickmaccarthy/python-datemath/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/retryhttp/default.nix
+++ b/pkgs/development/python-modules/retryhttp/default.nix
@@ -16,7 +16,7 @@
 buildPythonPackage rec {
  pname = "retryhttp";
  version = "1.3.1";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "austind";
--- a/pkgs/development/python-modules/svcs/default.nix
+++ b/pkgs/development/python-modules/svcs/default.nix
@@ -23,7 +23,7 @@
 buildPythonPackage rec {
  pname = "svcs";
  version = "25.1.0";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hynek";
--- a/pkgs/development/python2-modules/setuptools/default.nix
+++ b/pkgs/development/python2-modules/setuptools/default.nix
@@ -82,6 +82,9 @@ buildPythonPackage {
      psfl
      zpl20
    ];
+    knownVulnerabilities = [
+      "CVE-2025-47273"
+    ];
    platforms = python.meta.platforms;
    priority = 10;
  };
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1552,6 +1552,7 @@ mapAliases {
  onscripter-en = throw "onscripter-en has been removed due to lack of maintenance in both upstream and Nixpkgs; onscripter is available instead"; # Added 2025-10-17
  onthespot = throw "onethespot has been removed due to lack of upstream maintenance"; # Added 2025-09-26
  opae = throw "opae has been removed because it has been marked as broken since June 2023."; # Added 2025-10-11
+  open-stage-control = throw "'open-stage-control' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-05-04
  open-timeline-io = warnAlias "'open-timeline-io' has been renamed to 'opentimelineio'" opentimelineio; # Added 2025-08-10
  openafs_1_8 = throw "'openafs_1_8' has been renamed to/replaced by 'openafs'"; # Converted to throw 2025-10-27
  openai-triton-llvm = throw "'openai-triton-llvm' has been renamed to/replaced by 'triton-llvm'"; # Converted to throw 2025-10-27
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1963,9 +1963,10 @@ with pkgs;
  };

  inherit (callPackage ../applications/networking/remote/citrix-workspace { })
+    citrix_workspace_26_01_0
    citrix_workspace_25_08_10
    ;
-  citrix_workspace = citrix_workspace_25_08_10;
+  citrix_workspace = citrix_workspace_26_01_0;

  colord-gtk4 = colord-gtk.override { withGtk4 = true; };

--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@@ -12,14 +12,6 @@
 let
  withCommas = lib.replaceStrings [ "." ] [ "," ];

-  # simulate "haxelib dev $libname ."
-  simulateHaxelibDev = libname: ''
-    devrepo=$(mktemp -d)
-    mkdir -p "$devrepo/${withCommas libname}"
-    echo $(pwd) > "$devrepo/${withCommas libname}/.dev"
-    export HAXELIB_PATH="$HAXELIB_PATH:$devrepo"
-  '';
-
  installLibHaxe =
    {
      libname,
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -27,20 +27,6 @@ let
    vanillaPackages
    rpiPackages
    ;
-
-  markBroken =
-    drv:
-    drv.overrideAttrs (
-      {
-        meta ? { },
-        ...
-      }:
-      {
-        meta = meta // {
-          broken = true;
-        };
-      }
-    );
 in
 {
  kernelPatches = callPackage ../os-specific/linux/kernel/patches.nix { };
--- a/Show More
+++ b/Show More