Merge release-26.05 into staging-nixos-26.05

2026-08-25 17:55:21 +00:00 · 2026-06-25 00:52:18 +00:00
parent 33cf3d011f ff97f214fa
commit 874a82cc55
69 changed files with 3601 additions and 3424 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -524,3 +524,6 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 # Radicle
 /pkgs/build-support/fetchradicle/      @NixOS/radicle
 /pkgs/build-support/fetchradiclepatch/ @NixOS/radicle
+
+# Zellij plugins
+/pkgs/by-name/ze/zellij/plugins/   @PerchunPak
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -507,12 +507,11 @@ with lib.maintainers;
  matrix = {
    members = [
      ma27
-      mguentner
-      dandellion
      nickcao
      teutat3s
+      transcaffeine
    ];
-    scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
+    scope = "Maintain the foundational packages of the Matrix ecosystem.";
    shortName = "Matrix";
  };

--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -14,6 +14,7 @@ let
    escapeShellArg
    filter
    flatten
+    foldl'
    getName
    hasPrefix
    hasSuffix
@@ -31,13 +32,13 @@ let
    nameValuePair
    optionalString
    removePrefix
-    removeSuffix
    replaceStrings
+    splitString
    stringToCharacters
    types
    ;

-  inherit (lib.strings) toJSON normalizePath escapeC;
+  inherit (lib.strings) toJSON escapeC;
 in

 let
@@ -98,26 +99,60 @@ let
      || hasPrefix a'.mountPoint b'.mountPoint
      || any (hasPrefix a'.mountPoint) b'.depends;

-    # Escape a path according to the systemd rules. FIXME: slow
+    # Escape a path according to the systemd rules.
    # The rules are described in systemd.unit(5) as follows:
    # The escaping algorithm operates as follows: given a string, any "/" character is replaced by "-", and all other characters which are not ASCII alphanumerics, ":", "_" or "." are replaced by C-style "\x2d" escapes. In addition, "." is replaced with such a C-style escape when it would appear as the first character in the escaped string.
    # When the input qualifies as absolute file system path, this algorithm is extended slightly: the path to the root directory "/" is encoded as single dash "-". In addition, any leading, trailing or duplicate "/" characters are removed from the string before transformation. Example: /foo//bar/baz/ becomes "foo-bar-baz".
    escapeSystemdPath =
-      s:
      let
+        # These don't depend on the path being escaped, so build them once
+        # rather than on every call.
+        escapeChar = escapeC (stringToCharacters " !\"#$%&'()*+,;<=>?@[\\]^`{|}~-");
+        escapeLeadingDot = escapeC [ "." ] ".";
+        slashesToDashes = replaceStrings [ "/" ] [ "-" ];
        replacePrefix =
          p: r: s:
-          (if (hasPrefix p s) then r + (removePrefix p s) else s);
-        trim = s: removeSuffix "/" (removePrefix "/" s);
-        normalizedPath = normalizePath s;
+          (if hasPrefix p s then r + removePrefix p s else s);
      in
-      replaceStrings [ "/" ] [ "-" ] (
-        replacePrefix "." (escapeC [ "." ] ".") (
-          escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-") (
-            if normalizedPath == "/" then normalizedPath else trim normalizedPath
-          )
-        )
-      );
+      s:
+      let
+        isAbsolute = hasPrefix "/" s;
+        # path_simplify(): collapse duplicate slashes and drop "." components.
+        rawComponents = filter (c: c != "" && c != ".") (splitString "/" s);
+        # systemd accepts ".." only where it is redundant: a leading ".." in an
+        # absolute path refers to the root's parent, i.e. the root itself, and is
+        # dropped. Any other ".." cannot be resolved without the filesystem, so
+        # the path is not normalized and systemd-escape errors on it.
+        simplified =
+          foldl'
+            (
+              acc: c:
+              if c == ".." then
+                # A leading ".." in an absolute path is the only redundant case.
+                if isAbsolute && acc.components == [ ] then acc else acc // { normalized = false; }
+              else
+                acc // { components = acc.components ++ [ c ]; }
+            )
+            {
+              components = [ ];
+              normalized = true;
+            }
+            rawComponents;
+        notNormalized = throw "escapeSystemdPath: ${s} is not a normalized path";
+        simplifiedPath =
+          if !simplified.normalized then
+            notNormalized
+          else if simplified.components != [ ] then
+            concatStringsSep "/" simplified.components
+          # The root directory, and - matching systemd-escape - the empty string.
+          else if isAbsolute || s == "" then
+            "/"
+          # A relative path that reduces to nothing (e.g. "."), which has no
+          # valid escaping.
+          else
+            notNormalized;
+      in
+      slashesToDashes (replacePrefix "." escapeLeadingDot (escapeChar simplifiedPath));

    # Quotes an argument for use in Exec* service lines.
    # systemd accepts "-quoted strings with escape sequences, toJSON produces
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -662,11 +662,6 @@ in
                ) | ${cfg.package}/bin/mysql -u ${superUser} -N
              ''}

-              # Secure root@localhost for MySQL/Percona on first initialization
-              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
-                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
-              ''}
-
              ${lib.optionalString (cfg.initialScript != null) ''
                # Execute initial script
                # using toString to avoid copying the file to nix store if given as path instead of string,
@@ -674,6 +669,11 @@ in
                cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
              ''}

+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
              rm ${cfg.dataDir}/mysql_init
          fi

--- a/nixos/modules/services/matrix/dendrite.nix
+++ b/nixos/modules/services/matrix/dendrite.nix
@@ -341,5 +341,4 @@ in
      };
    };
  };
-  meta.teams = [ lib.teams.matrix ];
 }
--- a/nixos/tests/matrix/pantalaimon.nix
+++ b/nixos/tests/matrix/pantalaimon.nix
@@ -31,9 +31,6 @@ let
 in
 {
  name = "pantalaimon";
-  meta = {
-    maintainers = pkgs.lib.teams.matrix.members;
-  };

  nodes.machine =
    { pkgs, ... }:
--- a/nixos/tests/systemd-escaping.nix
+++ b/nixos/tests/systemd-escaping.nix
@@ -36,6 +36,19 @@ in
        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
+        # escapeSystemdPath simplifies the path like systemd-escape --path does:
+        # "." components are dropped and duplicate/leading/trailing slashes removed.
+        assert utils.escapeSystemdPath "/mnt/./foo" == "mnt-foo";
+        assert utils.escapeSystemdPath "/foo//bar/baz/" == "foo-bar-baz";
+        assert utils.escapeSystemdPath "/" == "-";
+        assert utils.escapeSystemdPath "" == "-";
+        assert utils.escapeSystemdPath "/.hidden/x" == "\\x2ehidden-x";
+        assert utils.escapeSystemdPath "/foo?bar" == "foo\\x3fbar";
+        # A leading ".." in an absolute path is the root's parent, i.e. the root.
+        assert utils.escapeSystemdPath "/../foo" == "foo";
+        # Non-normalized paths can't be escaped, matching systemd-escape.
+        assert !(builtins.tryEval (utils.escapeSystemdPath "/mnt/../foo")).success;
+        assert !(builtins.tryEval (utils.escapeSystemdPath ".")).success;
        {
          description = "Echo to the journal";
          serviceConfig.Type = "oneshot";
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "149.0.7827.155",
+    "version": "149.0.7827.196",
    "chromedriver": {
-      "version": "149.0.7827.156",
-      "hash_darwin": "sha256-V7ZBijHsPzyphJPipWlIcU5Mb9l1OWzLc6PzxFKFuR8=",
-      "hash_darwin_aarch64": "sha256-sUG2Qg+nPIrYQC0iKNK78O1l92qTSDbRnJFfrqJMpts="
+      "version": "149.0.7827.197",
+      "hash_darwin": "sha256-tN7s6s/pbfAGRCMcoT3QWYHD8QRq2gcHfFSXoSG9V5Y=",
+      "hash_darwin_aarch64": "sha256-DZ8CZ4Obp67Zo2m4iyqUnShyhTK8+/75cJ/WmZZqQhE="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
-        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
+        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
+        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
-        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
+        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
+        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
-        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
+        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
+        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -817,8 +817,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
-        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
+        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
+        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
      }
    }
  },
--- a/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
@@ -64,7 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Lightweight matrix client with legacy and mobile browser support";
    homepage = "https://github.com/element-hq/hydrogen-web";
-    teams = [ lib.teams.matrix ];
    license = lib.licenses.asl20;
    platforms = lib.platforms.all;
    inherit (olm.meta) knownVulnerabilities;
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -11,6 +11,8 @@ buildGoModule (finalAttrs: {
  pname = "andcli";
  version = "2.7.0";

+  __structuredAttrs = true;
+
  subPackages = [ "cmd/andcli" ];

  src = fetchFromGitHub {
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "blackfire";
-  version = "2026.6.0";
+  version = "2026.6.1";

  src =
    passthru.sources.${stdenv.hostPlatform.system}
@@ -60,23 +60,23 @@ stdenv.mkDerivation rec {
    sources = {
      "x86_64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        hash = "sha256-JPhh7LNiLZXLN5iycNobZ/uJQjOhKqqYSw9P78+/BKk=";
+        hash = "sha256-doeqXoS0B7AyzyhkLB9wUC6iuD0c2KIhAIEPeYaDC5E=";
      };
      "i686-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        hash = "sha256-uoqUDJ/bexqaRlf5Y692OGm91W1ErlS8Q8/l9MlsHwU=";
+        hash = "sha256-bQWhiSw9/gGyGoLEyz6BHaRPNLxuqouiobBMfB5ytYk=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        hash = "sha256-kL9s17Bnt8UYj3IiX2b7e3OWSsRLq5TSzdK6OdByD40=";
+        hash = "sha256-B+rhmnM2sVICVLDcYq2OEp402Wz6kywCRqeS95Vdzlw=";
      };
      "aarch64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        hash = "sha256-p9D87uaDVu25SG4cclmzaq9oKaFDlIy8/XLx3rHuIQ4=";
+        hash = "sha256-Ofs9raAtx/duS8dXWfvjKGzhJr3j9+gkH8lP/VLfnkE=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        hash = "sha256-ppCSvk259NNlujl9olyRlmwRdNbLu/uRs+gq71S79B8=";
+        hash = "sha256-+rMiD/vFFIA8dR3quUnpr8uDNTdvnXyYjT8brgiOxBI=";
      };
    };

--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -27,13 +27,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "pds";
-  version = "0.4.5001";
+  version = "0.4.5006";

  src = fetchFromGitHub {
    owner = "bluesky-social";
    repo = "pds";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
+    hash = "sha256-Jb2qAB6P5KlRu4L99fcK/v0/Fspr8IFaFXuYg+PBxhM=";
  };

  sourceRoot = "${finalAttrs.src.name}/service";
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
+    hash = "sha256-YfwoUkTJJ2qANqwtSWKDGfFmahAtIDNyYFwCUE72oB0=";
  };

  buildPhase = ''
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "drupal";
-  version = "11.3.10";
+  version = "11.3.13";

  src = fetchFromGitLab {
    domain = "git.drupalcode.org";
    owner = "project";
    repo = "drupal";
    tag = finalAttrs.version;
-    hash = "sha256-22oi80H8CZfafX0PFMmMinwIdKKdPs0iM0ime1aYXDI=";
+    hash = "sha256-t60EbgN3r9KmSyZcvLtUy+H4eRizqFyI3bLFHH1/ciY=";
  };

  composerNoPlugins = false;
-  vendorHash = "sha256-jwCHtpshEVzBhcXjCl5HOdkIiHRcH3V7fBxTxU39/S0=";
+  vendorHash = "sha256-DaKWrdFNHppZm4a8wexfwapSPDhlNL45ftVQ+YSY18s=";

  passthru = {
    tests = {
--- a/pkgs/by-name/fi/filebrowser-quantum/package.nix
+++ b/pkgs/by-name/fi/filebrowser-quantum/package.nix
@@ -6,13 +6,13 @@
 }:

 let
-  version = "1.3.3-stable";
+  version = "1.4.0-stable";

  src = fetchFromGitHub {
    owner = "gtsteffaniak";
    repo = "filebrowser";
    tag = "v${version}";
-    hash = "sha256-Q4TtC5x/nAbeZzICH9R9LBqe/8tbQOFR8vAImhQ5sYM=";
+    hash = "sha256-Ojz1VTtlCFUTodQ66mr0ozLKsx3kUirm79HuFJu33yQ=";
  };

  frontend = buildNpmPackage {
@@ -20,7 +20,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/frontend";
-    npmDepsHash = "sha256-+2CHRhu+cEmA0OvvU8ZKZ7Q5rTUX2KCSXFeVdievoYQ=";
+    npmDepsHash = "sha256-tisZA7v0WsynNxgbww48eERz9+om4w8MW4IMzQIyh+Y=";

    buildPhase = ''
      runHook preBuild
@@ -47,7 +47,7 @@ buildGoModule {

  sourceRoot = "${src.name}/backend";

-  vendorHash = "sha256-Fq5FqsZ4m5j+UIn1RsElhNUb4guwI9wo48SjQdvESRU=";
+  vendorHash = "sha256-WvilFCwTGXecsD/afUpLL6TrGzr/cgkQeltCKKDc4AI=";

  preBuild = ''
    mkdir -p http/embed
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@@ -16,13 +16,13 @@

 perlPackages.buildPerlPackage rec {
  pname = "glpi-agent";
-  version = "1.17";
+  version = "1.18";

  src = fetchFromGitHub {
    owner = "glpi-project";
    repo = "glpi-agent";
    tag = version;
-    hash = "sha256-ug3/ullvEn98UUg4fzDQl5PjVFlbgbaIiz0tuWz9XeA=";
+    hash = "sha256-oXnV862kb7hP1+tWIaXaFMFsGVww0/4Rw3UFEePC5KU=";
  };

  postPatch = ''
--- a/pkgs/by-name/gr/gradia/package.nix
+++ b/pkgs/by-name/gr/gradia/package.nix
@@ -27,6 +27,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
  version = "1.13.0";
  pyproject = false;

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "AlexanderVanhee";
    repo = "Gradia";
@@ -79,7 +81,9 @@ python3Packages.buildPythonApplication (finalAttrs: {

  dontWrapGApps = true;

-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2066";
+  version = "0.24.2108";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hK7QfztI3kFJcOG9OTQ5/lOusFKnv8AyNfCaU9IhdKE=";
+    hash = "sha256-MWA5gTiNjkKIaHgUGVt2XV3QBPYGTf/dVqCnmdAaJ0U=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/jo/jocalsend/package.nix
+++ b/pkgs/by-name/jo/jocalsend/package.nix
@@ -11,6 +11,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jocalsend";
  version = "1.618033988";

+  __structuredAttrs = true;
+
  src = fetchFromGitea {
    domain = "git.kittencollective.com";
    owner = "nebkor";
--- a/pkgs/by-name/li/librepods/package.nix
+++ b/pkgs/by-name/li/librepods/package.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "librepods";
  version = "0.2.5";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "kavishdevar";
    repo = "librepods";
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let

  pname = "librewolf-bin-unwrapped";

-  version = "152.0-1";
+  version = "152.0.2-1";
 in

 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
    url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
    hash =
      {
-        x86_64-linux = "sha256-sIpyCpfo9igZ0PMd1Y7sdIoui88dC9DjlwjN5M5HLsQ=";
-        aarch64-linux = "sha256-H1HtyZPcE8RpJTuqTnCOMC5gb+s1Dp80OE66KCdRM4g=";
+        x86_64-linux = "sha256-Tq2bj75oZXSH2YHXShjRRs4Aqxo86BuwONXu+IsdCuA=";
+        aarch64-linux = "sha256-xk3o5FODm5ge2I8JzgwXTpgu/SI6VcROIJ7005ew2PY=";
      }
      .${stdenv.hostPlatform.system} or throwSystem;
  };
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -27,10 +27,10 @@
    #
    # Ensure you also check ../mattermostLatest/package.nix.
    regex = "^v(11\\.7\\.[0-9]+)$";
-    version = "11.7.2";
-    srcHash = "sha256-qqBqV55Qq2zZOKIZmRB0MyCjFkHDmfvQjmuMn2cP4hY=";
+    version = "11.7.3";
+    srcHash = "sha256-73WGxvdsDZ3v4UJGDDy+nAkT9DFMsGk29ruThwxoclw=";
    vendorHash = "sha256-XaXqQN20c3DhW2/L0zhTA8dLeRp4MyBxUKpiMVwp/7s=";
-    npmDepsHash = "sha256-37nkbIMuCI0ZSFc+TXky+kkrbLJNNzX/xBXGZjp4r7o=";
+    npmDepsHash = "sha256-MRH7canRhFtFppKi1eKMqr8JnWenw29689l2GSpXyFU=";
  },
  ...
 }:
@@ -265,7 +265,7 @@ buildMattermost rec {
      buildPhase = ''
        runHook preBuild

-        for ws in platform/{types,client,components,shared} channels; do
+        for ws in platform/{types,client,shared,components} channels; do
          if [ -d "$ws" ]; then
            npm run build --workspace="$ws"
          fi
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
      # and make sure the version regex is up to date here.
      # Ensure you also check ../mattermost/package.nix for ESR releases.
      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.7.0";
-      srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
-      vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
-      npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
+      version = "11.8.1";
+      srcHash = "sha256-9EIbTwnEeZQKg5uixkMp3sp/n+9I2N9W7hxsW5juF3M=";
+      vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
+      npmDepsHash = "sha256-9GRM0VXrh1eR16ocSGEV/F2eflOflzkhrhRRnm9uB6s=";
      autoUpdate = ./package.nix;
    };
  }
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "misskey";
-  version = "2026.5.4";
+  version = "2026.6.0";

  src = fetchFromGitHub {
    owner = "misskey-dev";
    repo = "misskey";
    tag = finalAttrs.version;
-    hash = "sha256-ENq5V1lIFGKIr1xZccy1LFRYVqZVEhDzBhAbDNcG5sM=";
+    hash = "sha256-jq1HtLabix9qxaAjaCgUN3nsY438ruHgHgC3MuGeR2E=";
    fetchSubmodules = true;
  };

@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-wEbYkfp+zfytOPBjEcyTHCaoohGRNRjG5oTUefI5BVw=";
+    hash = "sha256-GCkSASkgwUvlAlm8hiy4Yk/QMVerVGacxOh1AYouH0g=";
  };

  buildPhase = ''
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -112,10 +112,14 @@ stdenv.mkDerivation (finalAttrs: {
    connector-c = finalAttrs.finalPackage;
    server = finalAttrs.finalPackage;
    mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.mysql-secure-root-by-default =
-      nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
-    tests.mysql-root-can-be-kept-insecure =
-      nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    tests = {
+      mysql =
+        nixosTests.mysql."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-secure-root-by-default =
+        nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-root-can-be-kept-insecure =
+        nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    };
  };

  meta = {
--- a/pkgs/by-name/ne/netpeek/package.nix
+++ b/pkgs/by-name/ne/netpeek/package.nix
@@ -17,6 +17,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
  version = "0.2.7";
  pyproject = false;

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "ZingyTomato";
    repo = "NetPeek";
--- a/pkgs/by-name/ne/nezha-theme-admin/package-lock.json
+++ b/pkgs/by-name/ne/nezha-theme-admin/package-lock.json
--- a/pkgs/by-name/ne/nezha-theme-admin/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-admin/package.nix
@@ -2,26 +2,25 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  nix-update-script,
 }:

 buildNpmPackage (finalAttrs: {
  pname = "nezha-theme-admin";
-  version = "2.0.4";
+  version = "2.2.4";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "admin-frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oZFIkeHkuSLlu++FwzCUet7tmBe5zhCP5MGHhU528DA=";
+    hash = "sha256-1MS+ZOTeK3tZMCDvh0MEkF4K04cOlA+uAsYwXmasdhY=";
  };

-  # TODO: Switch to the bun build function once available in nixpkgs
+  # TODO: Remove after upstream fixes resolved missing.
  postPatch = ''
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-2DkCVefxSfnlJkaEFZrjsWbwzddtqiNg1UUajRG5tLA=";
+  npmDepsHash = "sha256-j7z4Zc2SnewnX3fXu8vqxSLx1S8Vz9+SivwpHuzNrIc=";
  npmPackFlags = [ "--ignore-scripts" ];
  npmBuildScript = "build-ignore-error";

@@ -34,7 +33,7 @@ buildNpmPackage (finalAttrs: {
    runHook postInstall
  '';

-  passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+  passthru.updateScript = ./update.sh;

  meta = {
    description = "Nezha monitoring admin frontend";
--- a/pkgs/by-name/ne/nezha-theme-admin/update.sh
+++ b/pkgs/by-name/ne/nezha-theme-admin/update.sh
@@ -0,0 +1,25 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix-update curl nodejs
+
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/nezhahq/admin-frontend/releases/latest | jq -r ".tag_name")
+version=${version#v}
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf -- "${TMPDIR}"' EXIT
+
+git clone "https://github.com/nezhahq/admin-frontend" -b "v$version" "$TMPDIR/src"
+pushd "$TMPDIR/src"
+rm package-lock.json
+npm install --package-lock-only --ignore-scripts
+popd
+
+cp "$TMPDIR/src/package-lock.json" pkgs/by-name/ne/nezha-theme-admin/
+
+nix-update "$UPDATE_NIX_ATTR_PATH"
--- a/pkgs/by-name/pi/pipeline/package.nix
+++ b/pkgs/by-name/pi/pipeline/package.nix
@@ -32,18 +32,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pipeline";
-  version = "4.0.3";
+  version = "4.0.4";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "pipeline";
    tag = finalAttrs.version;
-    hash = "sha256-sSs3fr95oERsswPGZxbCyTLZnur89DMIdtbZjY1+vGE=";
+    hash = "sha256-KVAgUAQqnpzNXpCiPZJMQEVGrz/pt8fR/JcOFBynFCs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src pname version;
-    hash = "sha256-HpFxhApmRSIVzR5ON1rF4P5gODAa538p14MaipxeS3Y=";
+    hash = "sha256-bWMTZrcdYRXsKWD3VmLcAu9J/y9LbZ6EPE8AuB87iKA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/re/repath-studio/package.nix
+++ b/pkgs/by-name/re/repath-studio/package.nix
@@ -21,13 +21,13 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "repath-studio";
-  version = "0.4.15";
+  version = "0.4.16";

  src = fetchFromGitHub {
    owner = "repath-studio";
    repo = "repath-studio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Fnu7tZ8chvnDMuMw4QD1NuQgaFOBzHfzl2ePQ5iwnao=";
+    hash = "sha256-wqDsjr+ZQDRFINzr38i7ClgREEmAaKt+U/Ma63vAH1k=";
  };

  patches = [
@@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: {

  makeCacheWritable = true;

-  npmDepsHash = "sha256-0dSFEZ02D83yplqT3GV9TyUwJ3lDjxM47pGYwUXzatw=";
+  npmDepsHash = "sha256-IvKHLxX7rTB3AGDzNQIVNhfXs0C6TVATdVGUDHGrpOo=";

  nativeBuildInputs = [
    finalAttrs.passthru.clojureWithHome
--- a/pkgs/by-name/re/repath-studio/pin-clojure.patch
+++ b/pkgs/by-name/re/repath-studio/pin-clojure.patch
@@ -1,5 +1,5 @@
 diff --git a/deps.edn b/deps.edn
-index 027cf5e..648c635 100644
+index 6abd18c..d2f8e14 100644
 --- a/deps.edn
 +++ b/deps.edn
@@ -1,5 +1,6 @@
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "spire";
-  version = "1.14.6";
+  version = "1.15.1";

  outputs = [
    "out"
@@ -21,12 +21,12 @@ buildGoModule (finalAttrs: {
    owner = "spiffe";
    repo = "spire";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-3NboIbLRxs4yPjQUKdK7B+Rhl08SxEDPuj5N8lWd1gA=";
+    sha256 = "sha256-7SmHj/st2r3ks8Bh6gVRlKoay5mHqpovH25qMxG9s40=";
  };

  # Needed for github.co/google/go-tpm-tools/simulator  which contains non-go files that `go mod vendor` strips
  proxyVendor = true;
-  vendorHash = "sha256-Ajoxxpf6oWW6jioMTgeyaIszVhp4j7E2+msE0nhfKpk=";
+  vendorHash = "sha256-wKVBqjid/PQi5JBB37c3h68Q8kUqbyaiDbLssO7Yo7A=";

  buildInputs = [ openssl ];

--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -11,23 +11,23 @@
  copyDesktopItems,
  pnpm_10,
  nodejs,
-  electron_38,
+  electron_42,
  zip,
 }:
 let
-  electron = electron_38;
+  electron = electron_42;
  stdenv = stdenvNoCC;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "stoat-desktop";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "stoatchat";
    repo = "for-desktop";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-vMXnBniA0wyoK7Pe13h/yHtf8ky59ts4VQb9k7KuUCE=";
+    hash = "sha256-l4kxlPwohaxserVyNAb3Dp4f5XhnPUKeuRJwrOl9EWc=";
  };

  postPatch = ''
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 3;
    pnpm = pnpm_10;
-    hash = "sha256-m0EuM8qTCFLxxO0RNze5WgMkuHZXeIi+U/Jiuv91eCg=";
+    hash = "sha256-bIDwEmt/8URBMx7XIQ1EP4SucwMuyGZE1hlQM0rxDnw=";
  };

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.17.36";
+  version = "2.26.5";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-tMmoq9y3NvuOoKhEN2/d0nrq2Y8+7VMYo6+OP/q67I8=";
+    hash = "sha256-4AyxNC+wODu5ltvquZWvtGYi8P+p/+py2ZLQISW6nZQ=";
  };

  nativeBuildInputs = [
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-L3uoUFks3QonOQl0kOHYwOM1deFiNSqe0chv5YFpH4o=";
+    hash = "sha256-lj93WF3mqvgaD0qnZC+X4ubw8ohz8E5ICWYWbEITYnk=";
  };

  npmConfigHook = pnpmConfigHook;
--- a/pkgs/by-name/ta/tauno-monitor/package.nix
+++ b/pkgs/by-name/ta/tauno-monitor/package.nix
@@ -17,6 +17,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
  version = "0.2.20";
  pyproject = false;

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "taunoe";
    repo = "tauno-monitor";
@@ -45,7 +47,9 @@ python3Packages.buildPythonApplication (finalAttrs: {

  dontWrapGApps = true;

-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -44,36 +44,40 @@ let

  # Pin the specific version of prisma to the one used by upstream
  # to guarantee compatibility.
-  prisma-engines' = prisma-engines_7.overrideAttrs (old: rec {
-    version = "7.6.0";
-    src = fetchFromGitHub {
-      owner = "prisma";
-      repo = "prisma-engines";
-      tag = version;
-      hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
-    };
-    cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
+  prisma-engines' = prisma-engines_7.overrideAttrs (
+    finalAttrs: prevAttrs: {
+      version = "7.6.0";
+      src = fetchFromGitHub {
+        owner = "prisma";
+        repo = "prisma-engines";
+        tag = finalAttrs.version;
+        hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+      };
+      cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";

-    cargoDeps = rustPlatform.fetchCargoVendor {
-      inherit (old) pname;
-      inherit src version;
-      patches = old.cargoDeps.vendorStaging.patches or [ ];
-      hash = cargoHash;
-    };
-  });
-  prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (old: rec {
-    version = "7.6.0";
-    src = fetchFromGitHub {
-      owner = "prisma";
-      repo = "prisma";
-      tag = version;
-      hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
-    };
-    pnpmDeps = old.pnpmDeps.override {
-      inherit src version;
-      hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
-    };
-  });
+      cargoDeps = rustPlatform.fetchCargoVendor {
+        inherit (prevAttrs) pname;
+        inherit (finalAttrs) src version;
+        patches = prevAttrs.cargoDeps.vendorStaging.patches or [ ];
+        hash = finalAttrs.cargoHash;
+      };
+    }
+  );
+  prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
+    finalAttrs: prevAttrs: {
+      version = "7.6.0";
+      src = fetchFromGitHub {
+        owner = "prisma";
+        repo = "prisma";
+        tag = finalAttrs.version;
+        hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
+      };
+      pnpmDeps = prevAttrs.pnpmDeps.override {
+        inherit (finalAttrs) src version;
+        hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
+      };
+    }
+  );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "umami";
--- a/pkgs/by-name/ze/zellij-unwrapped/package.nix
+++ b/pkgs/by-name/ze/zellij-unwrapped/package.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  mandown,
+  installShellFiles,
+  pkg-config,
+  curl,
+  openssl,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zellij-unwrapped";
+  version = "0.44.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "zellij-org";
+    repo = "zellij";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-r8GAOiau4CZPVotFmsBQJOvEu+t0Bu9UCYAOs18i3Kg=";
+  };
+
+  # Remove the `vendored_curl` feature in order to link against the libcurl from nixpkgs instead of
+  # the vendored one
+  postPatch = ''
+    substituteInPlace Cargo.toml \
+      --replace-fail ', "vendored_curl"' ""
+  '';
+
+  cargoHash = "sha256-966FpfSsF9I10SrYe3+YNsfM2kLLv+gd0/Aw8vLp4Lk=";
+
+  env.OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [
+    mandown
+    installShellFiles
+    pkg-config
+    (lib.getDev curl)
+  ];
+
+  buildInputs = [
+    curl
+    openssl
+  ];
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  # Ensure that we don't vendor curl, but instead link against the libcurl from nixpkgs
+  installCheckPhase = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
+    runHook preInstallCheck
+
+    ldd "$out/bin/zellij" | grep libcurl.so
+
+    runHook postInstallCheck
+  '';
+
+  postInstall = ''
+    mandown docs/MANPAGE.md > zellij.1
+    installManPage zellij.1
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd zellij \
+      --bash <($out/bin/zellij setup --generate-completion bash) \
+      --fish <($out/bin/zellij setup --generate-completion fish) \
+      --zsh <($out/bin/zellij setup --generate-completion zsh)
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal workspace with batteries included";
+    homepage = "https://zellij.dev/";
+    changelog = "https://github.com/zellij-org/zellij/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
+      therealansh
+      _0x4A6F
+      abbe
+      matthiasbeyer
+      ryan4yin
+    ];
+    mainProgram = "zellij";
+  };
+})
--- a/pkgs/by-name/ze/zellij/package.nix
+++ b/pkgs/by-name/ze/zellij/package.nix
@@ -1,96 +1,26 @@
 {
  lib,
-  stdenv,
-  rustPlatform,
-  fetchFromGitHub,
-  mandown,
-  installShellFiles,
-  pkg-config,
-  curl,
-  openssl,
-  writableTmpDirAsHomeHook,
-  versionCheckHook,
-  nix-update-script,
+  zellij-unwrapped,
+  makeBinaryWrapper,
+  stdenvNoCC,
+
+  extraPackages ? [ ],
 }:
-
-rustPlatform.buildRustPackage (finalAttrs: {
+stdenvNoCC.mkDerivation {
+  inherit (zellij-unwrapped) version meta;
  pname = "zellij";
-  version = "0.44.3";
+
  __structuredAttrs = true;
+  strictDeps = true;

-  src = fetchFromGitHub {
-    owner = "zellij-org";
-    repo = "zellij";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-r8GAOiau4CZPVotFmsBQJOvEu+t0Bu9UCYAOs18i3Kg=";
-  };
+  src = zellij-unwrapped;
+  dontUnpack = true;

-  # Remove the `vendored_curl` feature in order to link against the libcurl from nixpkgs instead of
-  # the vendored one
-  postPatch = ''
-    substituteInPlace Cargo.toml \
-      --replace-fail ', "vendored_curl"' ""
+  nativeBuildInputs = [ makeBinaryWrapper ];
+  buildPhase = ''
+    cp -rs --no-preserve=mode "$src" "$out"
+
+    wrapProgram "$out/bin/zellij" \
+      --prefix PATH : '${lib.makeBinPath extraPackages}'
  '';
-
-  cargoHash = "sha256-966FpfSsF9I10SrYe3+YNsfM2kLLv+gd0/Aw8vLp4Lk=";
-
-  env.OPENSSL_NO_VENDOR = 1;
-
-  nativeBuildInputs = [
-    mandown
-    installShellFiles
-    pkg-config
-    (lib.getDev curl)
-  ];
-
-  buildInputs = [
-    curl
-    openssl
-  ];
-
-  nativeCheckInputs = [
-    writableTmpDirAsHomeHook
-  ];
-
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
-
-  # Ensure that we don't vendor curl, but instead link against the libcurl from nixpkgs
-  installCheckPhase = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
-    runHook preInstallCheck
-
-    ldd "$out/bin/zellij" | grep libcurl.so
-
-    runHook postInstallCheck
-  '';
-
-  postInstall = ''
-    mandown docs/MANPAGE.md > zellij.1
-    installManPage zellij.1
-  ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd $pname \
-      --bash <($out/bin/zellij setup --generate-completion bash) \
-      --fish <($out/bin/zellij setup --generate-completion fish) \
-      --zsh <($out/bin/zellij setup --generate-completion zsh)
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Terminal workspace with batteries included";
-    homepage = "https://zellij.dev/";
-    changelog = "https://github.com/zellij-org/zellij/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [
-      therealansh
-      _0x4A6F
-      abbe
-      matthiasbeyer
-      ryan4yin
-    ];
-    mainProgram = "zellij";
-  };
-})
+}
--- a/pkgs/by-name/ze/zellij/plugins/README.md
+++ b/pkgs/by-name/ze/zellij/plugins/README.md
@@ -0,0 +1,83 @@
+# Zellij plugins
+
+Zellij offers a Webassembly / WASI plugin system, allowing plugin developers to
+develop plugins in many different languages. Currently, nixpkgs focuses only on
+Rust plugins (the majority of them).
+
+Most of the plugins were generated using `nix-init` on [awesome-zellij].
+Excluded plugins from that list (should be packaged later anyway):
+
+- [bar-theme-config](https://github.com/allisonhere/zellij-bar-theme-config): not a plugin, but a separate application
+- [fzf-zellij](https://github.com/k-kuroguro/fzf-zellij): [closed source](https://github.com/k-kuroguro/fzf-zellij/issues/1)
+- [gitpod-zellij](https://github.com/ona-samples/gitpod.zellij): not a plugin, but a separate application?
+- [opencode-zellij-namer](https://github.com/24601/opencode-zellij-namer): written in TypeScript, not Rust
+- [theme-configurator](https://rosmur.github.io/zellij-theme-configurator/): not a plugin, but a separate application
+- [yazelix](https://github.com/luccahuguet/yazelix): written in Nushell
+- [zeco](https://github.com/julianbuettner/zeco): not a plugin, but a separate application?
+- [zellij-load](https://github.com/Christian-Prather/zellij-load): has daemon, so that needs to be packaged too
+- [zellij-vscode-toolkit](https://github.com/atoolz/zellij-vscode-toolkit): not a plugin, but a VSCode plugin
+- [zellix](https://github.com/EmeraldPandaTurtle/zellix): written in Nushell
+- [zj-quit](https://github.com/cristiand391/zj-quit): archived
+- [zj-status-bar](https://github.com/cristiand391/zj-status-bar): archived
+- [zrw](https://github.com/ivoronin/zrw): written in Go
+
+Contributions are welcome!
+
+[awesome-zellij]: https://github.com/zellij-org/awesome-zellij/blob/95fce2c02a2dcca33e4972eed3eba64d516693c9/README.md
+
+## Specifying runtime dependencies
+
+Runtime dependencies are packages, that will be used by the plugin inside
+a Zellij session. Those are specified in `passthru.runtimeDeps` attribute from
+`pkgsBuildBuild` attrset.
+
+Since we compile all plugins on WASI, everything that the plugin gets as
+derivation arguments are also get compiled for WASI. However, `coreutils` is
+not available on WASI and so is the vast majority of packages. This is why
+runtime dependencies need to be specified from `pkgsBuildBuild` attrs set
+(which points to the user's system).
+
+```nix
+# assume we build the plugin on a x86_64-linux machine
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+
+  # these will be compiled for WASI, not x86_64-linux!
+  just,
+  bacon,
+  # but pkgsBuildBuild points to x86_64-linux
+  pkgsBuildBuild,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "jbz";
+  version = "0.39.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = "jbz";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3n3Bv3YDb1+MYJTTAmMkIgGY7kX9IVUoDNV4c/n0Ydo=";
+  };
+
+  cargoHash = "sha256-U+P2LlhmXwaZy2a2eigrg545HTuV1T01jZfUOEUQ5+w=";
+
+  # this is the only way how to specify dependencies
+  passthru.runtimeDeps = with pkgsBuildBuild; [
+    bacon
+    just
+  ];
+
+  meta = {
+    description = "Display your Just commands wrapped in Bacon";
+    homepage = "https://github.com/nim65s/jbz";
+    changelog = "https://github.com/nim65s/jbz/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ PerchunPak ];
+  };
+})
+```
+
+If you are wondering why `pkgsBuildBuild` is named like that, refer to
+[the docs on cross-compilation](https://nixos.org/manual/nixpkgs/unstable/#possible-dependency-types).
--- a/pkgs/by-name/ze/zellij/plugins/default.nix
+++ b/pkgs/by-name/ze/zellij/plugins/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  callPackage,
+  nix-update-script,
+  stdenvNoCC,
+  zellij,
+}:
+let
+  # wrapper for changing the output path from directory to single file
+  # from /nix/store/...-zsm-static-wasm32-unknown-wasi-0.4.1/bin/zsm.wasm
+  # to   /nix/store/...-zellij-plugin-zsm-0.4.1.wasm
+  wrapper =
+    attrName: pkg:
+    assert lib.assertMsg (
+      !((lib.hasAttr "runtimeDeps" pkg) && (!lib.hasAttr "runtimeDeps" pkg.passthru))
+    ) "Plugin ${pkg.pname} has specified `runtimeDeps` instead of `passthru.runtimeDeps`";
+    stdenvNoCC.mkDerivation (finalAttrs: {
+      inherit (pkg)
+        pname
+        version
+        ;
+      name = "zellij-plugin-${finalAttrs.pname}-${finalAttrs.version}.wasm";
+
+      src = pkg;
+
+      dontUnpack = true;
+      buildPhase = ''
+        resultFile=$(find "$src" -name '*.wasm')
+        if [ $(echo "$resultFile" | wc -l) -ne 1 ]; then
+          echo "The unwrapped plugin ($src) contains more than one WASM file"
+          echo "$resultFile"
+          exit 1
+        fi
+
+        # there should probably be `ln -s` here, but it produces a permission error for me
+        cp "$resultFile" "$out"
+      '';
+
+      passthru = pkg.passthru or { } // {
+        unwrapped = pkg;
+        updateScript = pkg.passthru.updateScript or nix-update-script {
+          attrPath = "zellijPlugins.${attrName}.unwrapped";
+        };
+      };
+
+      meta = pkg.meta // {
+        maintainers = pkg.meta.maintainers or [ ] ++ [ lib.maintainers.PerchunPak ];
+        platforms = pkg.meta.platforms or zellij.platforms;
+      };
+    });
+  rustPlugins = lib.mapAttrs wrapper (callPackage ./rust { });
+in
+rustPlugins // { inherit wrapper; }
--- a/pkgs/by-name/ze/zellij/plugins/rust/default.nix
+++ b/pkgs/by-name/ze/zellij/plugins/rust/default.nix
@@ -0,0 +1,25 @@
+{ pkgsCross, lib }:
+let
+  root = ./.;
+  pkgs' = pkgsCross.wasi32;
+
+  call = name: override (pkgs'.callPackage (root + "/${name}") { });
+  override =
+    pkg:
+    pkg.overrideAttrs (old: {
+      # these hacks are needed until https://github.com/NixOS/nixpkgs/pull/463720#pullrequestreview-3841639011 is resolved
+      nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkgs'.lld ];
+      env = old.env or { } // {
+        RUSTFLAGS = old.env.RUSTFLAGS or "" + " -C linker=wasm-ld";
+      };
+
+      meta = old.meta or { } // {
+        platforms = old.meta.platforms or lib.platforms.linux;
+      };
+    });
+in
+lib.pipe root [
+  builtins.readDir
+  (lib.filterAttrs (name: _: name != "default.nix" && name != "README.md"))
+  (lib.mapAttrs' (name: _: lib.nameValuePair (lib.removeSuffix ".nix" name) (call name)))
+]
--- a/pkgs/by-name/ze/zellij/plugins/rust/jbz.nix
+++ b/pkgs/by-name/ze/zellij/plugins/rust/jbz.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkgsBuildBuild,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "jbz";
+  version = "0.39.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = "jbz";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3n3Bv3YDb1+MYJTTAmMkIgGY7kX9IVUoDNV4c/n0Ydo=";
+  };
+
+  cargoHash = "sha256-U+P2LlhmXwaZy2a2eigrg545HTuV1T01jZfUOEUQ5+w=";
+
+  passthru.runtimeDeps = with pkgsBuildBuild; [
+    bacon
+    just
+  ];
+
+  meta = {
+    description = "Display your Just commands wrapped in Bacon";
+    homepage = "https://github.com/nim65s/jbz";
+    changelog = "https://github.com/nim65s/jbz/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ PerchunPak ];
+  };
+})
--- a/pkgs/by-name/ze/zellij/plugins/rust/vim-zellij-navigator.nix
+++ b/pkgs/by-name/ze/zellij/plugins/rust/vim-zellij-navigator.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "vim-zellij-navigator";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "hiasr";
+    repo = "vim-zellij-navigator";
+    tag = finalAttrs.version;
+    hash = "sha256-1zzY1Z8ZpiNTdFW+gKRYaRR+oCzMnbJA2szY0k24bGg=";
+  };
+
+  cargoHash = "sha256-AbfgDhQEbm5qULw2HHxG5EMCYdML4VhHxJaAqP2g3u0=";
+
+  meta = {
+    description = "Seamless navigation between Zellij panes and Vim splits";
+    homepage = "https://github.com/hiasr/vim-zellij-navigator";
+    changelog = "https://github.com/hiasr/vim-zellij-navigator/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ PerchunPak ];
+  };
+})
--- a/pkgs/by-name/ze/zellij/plugins/rust/zjframes.nix
+++ b/pkgs/by-name/ze/zellij/plugins/rust/zjframes.nix
@@ -0,0 +1,12 @@
+{ callPackage }:
+# zjstatus and zjframes are contained in the same repository, but as different crates
+let
+  zjstatus = callPackage ./zjstatus.nix { _binaryName = "zjframes"; };
+in
+zjstatus.overrideAttrs (old: {
+  pname = "zjframes";
+
+  meta = old.meta // {
+    description = "Toggle Zellij pane frames based on different conditions";
+  };
+})
--- a/pkgs/by-name/ze/zellij/plugins/rust/zjstatus.nix
+++ b/pkgs/by-name/ze/zellij/plugins/rust/zjstatus.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+
+  _binaryName ? "zjstatus", # passed to `cargo build --bin`
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zjstatus";
+  version = "0.23.0";
+
+  src = fetchFromGitHub {
+    owner = "dj95";
+    repo = "zjstatus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sjMs63OaRhwCrl46v1A+K2EJdqnw63Pc7BMnHqiU790=";
+  };
+
+  cargoHash = "sha256-jg7EpcA3o/Qdb1eIspZQI3TX3+7gc3YX+FB4l4FZX44=";
+
+  cargoBuildFlags = [ "--bin=${_binaryName}" ];
+
+  meta = {
+    description = "Configurable statusbar plugin for Zellij";
+    homepage = "https://github.com/dj95/zjstatus";
+    changelog = "https://github.com/dj95/zjstatus/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ PerchunPak ];
+  };
+})
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -18,8 +18,8 @@ let
  param =
    if lib.versionAtLeast ppxlib.version "0.36" then
      {
-        version = "3.17.3";
-        hash = "sha256-AcRZG4ITrYxxtunx0YDqvSANRBk27if+n5lka3X5hlw=";
+        version = "3.18.0";
+        hash = "sha256-T7pqFvVFUbeOHZDrLBZ/bulkyvU4O8LS+TzszH5k3EQ=";
      }
    else
      {
--- a/pkgs/development/cuda-modules/_cuda/lib/default.nix
+++ b/pkgs/development/cuda-modules/_cuda/lib/default.nix
@@ -29,6 +29,7 @@

  # See ./redist.nix for documentation.
  inherit (import ./redist.nix { inherit _cuda lib; })
+    _getJetsonMinSbsaCapability
    _redistSystemIsSupported
    getNixSystems
    getRedistSystem
--- a/pkgs/development/cuda-modules/_cuda/lib/redist.nix
+++ b/pkgs/development/cuda-modules/_cuda/lib/redist.nix
@@ -108,13 +108,35 @@
    else
      [ ];

+  /**
+    The lowest Jetson CUDA capability which uses the `linux-sbsa` redist (rather than `linux-aarch64`) for a given
+    CUDA version. Jetson capabilities below this threshold use `linux-aarch64`.
+
+    The threshold depends on the CUDA version because NVIDIA moved Jetson onto the SBSA software stack incrementally:
+    - CUDA 12 (JetPack 6): only Thor (10.1) is SBSA; Orin (8.7) is `linux-aarch64`.
+    - CUDA 13 (JetPack 7.2): Orin (8.7) and Thor (11.0) are both SBSA.
+
+    # Type
+
+    ```
+    _getJetsonMinSbsaCapability :: (cudaMajorMinorVersion :: String) -> CudaCapability
+    ```
+
+    # Inputs
+
+    `cudaMajorMinorVersion`
+
+    : The major and minor version of CUDA (e.g. "12.6")
+  */
+  _getJetsonMinSbsaCapability =
+    cudaMajorMinorVersion: if lib.versionAtLeast cudaMajorMinorVersion "13.0" then "8.7" else "10.1";
+
  /**
    Maps a Nix system to a NVIDIA redistributable system.

    NOTE: Certain Nix systems can map to multiple NVIDIA redistributable systems. In particular, ARM systems can map to
    either `linux-sbsa` (for server-grade ARM chips) or `linux-aarch64` (for Jetson devices). Complicating matters
-    further, as of CUDA 13.0, Jetson Thor devices use `linux-sbsa` instead of `linux-aarch64`. (It is unknown whether
-    NVIDIA plans to make the Orin series use `linux-sbsa` as well for the CUDA 13.0 release.)
+    further, as of CUDA 13.0, Jetson Thor and Orin devices use `linux-sbsa` instead of `linux-aarch64`.

    NOTE: This function *will* be called by unsupported systems because `cudaPackages` is evaluated on all systems. As
    such, we need to handle unsupported systems gracefully.
@@ -189,11 +211,13 @@
    if system == "x86_64-linux" then
      "linux-x86_64"
    else if system == "aarch64-linux" then
-      # If all the Jetson devices are at least 10.1 (Thor, CUDA 12.9; CUDA 13.0 and later use 11.0 for Thor), then
-      # we've got SBSA.
+      # If all the Jetson devices are SBSA-compatible, then we've got SBSA.
      if
+        let
+          sbsaJetsonCapability = _cuda.lib._getJetsonMinSbsaCapability cudaMajorMinorVersion;
+        in
        lib.all (
-          cap: _cuda.db.cudaCapabilityToInfo.${cap}.isJetson -> lib.versionAtLeast cap "10.1"
+          cap: _cuda.db.cudaCapabilityToInfo.${cap}.isJetson -> lib.versionAtLeast cap sbsaJetsonCapability
        ) cudaCapabilities
      then
        "linux-sbsa"
--- a/pkgs/development/cuda-modules/_cuda/manifests/tensorrt/redistrib_10.16.1.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/tensorrt/redistrib_10.16.1.json
@@ -0,0 +1,37 @@
+
+{
+    "release_date": "2026-04-07",
+    "release_label": "10.16.1",
+    "release_product": "tensorrt",
+    "tensorrt": {
+        "name": "NVIDIA TensorRT",
+        "license": "TensorRT",
+        "version": "10.16.1.11",
+        "cuda_variant": [
+            "12",
+            "13"
+        ],
+        "linux-sbsa": {
+          "cuda13": {
+            "md5": "141f8346668152f5ae31b13d1280066d",
+            "relative_path": "tensorrt/10.16.1/tars/TensorRT-10.16.1.11.Linux.aarch64-gnu.cuda-13.2.tar.gz",
+            "sha256": "63ecfb16d2df932cc5c3f2a362ae6281919f565c5ca3a5e1299c95780e165c91",
+            "size": "5617960358"
+          }
+        },
+        "linux-x86_64": {
+          "cuda12": {
+            "md5": "df43a636866bc933c4794383ae9fd7bd",
+            "relative_path": "tensorrt/10.16.1/tars/TensorRT-10.16.1.11.Linux.x86_64-gnu.cuda-12.9.tar.gz",
+            "sha256": "48e64fc9231fe3aeaa18be13385b486ea7c7131dd64f09b54e5fcb051386f014",
+            "size": "8546982998"
+          },
+          "cuda13": {
+            "md5": "523a08f532cb88cad8384793df555221",
+            "relative_path": "tensorrt/10.16.1/tars/TensorRT-10.16.1.11.Linux.x86_64-gnu.cuda-13.2.tar.gz",
+            "sha256": "08334948c57c3bcf2de171ef4bd53d15f48a61a942b048abea12e32f892284e8",
+            "size": "7568035730"
+          }
+        }
+    }
+}
--- a/pkgs/development/cuda-modules/backendStdenv/default.nix
+++ b/pkgs/development/cuda-modules/backendStdenv/default.nix
@@ -24,6 +24,7 @@ let
  inherit (_cuda.lib)
    _cudaCapabilityIsDefault
    _cudaCapabilityIsSupported
+    _getJetsonMinSbsaCapability
    _mkFailedAssertionsString
    getRedistSystem
    mkVersionedName
@@ -121,11 +122,12 @@ let

  assertions =
    let
-      # Jetson devices (pre-Thor) cannot be targeted by the same binaries which target non-Jetson devices. While
+      # Jetson devices (pre-Orin) cannot be targeted by the same binaries which target non-Jetson devices. While
      # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
      # they are built with different settings and cannot be mixed.
-      preThorJetsonCudaCapabilities = filter (flip versionOlder "10.1") passthruExtra.requestedJetsonCudaCapabilities;
-      postThorJetsonCudaCapabilities = filter (flip versionAtLeast "10.1") passthruExtra.requestedJetsonCudaCapabilities;
+      sbsaJetsonCapability = _getJetsonMinSbsaCapability cudaMajorMinorVersion;
+      preSbsaJetsonCudaCapabilities = filter (flip versionOlder sbsaJetsonCapability) passthruExtra.requestedJetsonCudaCapabilities;
+      postSbsaJetsonCudaCapabilities = filter (flip versionAtLeast sbsaJetsonCapability) passthruExtra.requestedJetsonCudaCapabilities;

      # Remove all known capabilities from the user's list to find unrecognized capabilities.
      unrecognizedCudaCapabilities = subtractLists allSortedCudaCapabilities passthruExtra.cudaCapabilities;
@@ -166,25 +168,25 @@ let
      }
      {
        message =
-          "Requested pre-Thor (10.1) Jetson CUDA capabilities (${toJSON preThorJetsonCudaCapabilities}) cannot be "
-          + "specified with other capabilities (${toJSON (subtractLists preThorJetsonCudaCapabilities passthruExtra.cudaCapabilities)})";
+          "Requested pre-SBSA (${sbsaJetsonCapability}) Jetson CUDA capabilities (${toJSON preSbsaJetsonCudaCapabilities}) cannot be "
+          + "specified with other capabilities (${toJSON (subtractLists preSbsaJetsonCudaCapabilities passthruExtra.cudaCapabilities)})";
        assertion =
          # If there are preThorJetsonCudaCapabilities, they must be the only requested capabilities.
-          preThorJetsonCudaCapabilities != [ ]
-          -> preThorJetsonCudaCapabilities == passthruExtra.cudaCapabilities;
+          preSbsaJetsonCudaCapabilities != [ ]
+          -> preSbsaJetsonCudaCapabilities == passthruExtra.cudaCapabilities;
      }
      {
        message =
-          "Requested pre-Thor (10.1) Jetson CUDA capabilities (${toJSON preThorJetsonCudaCapabilities}) require "
+          "Requested pre-SBSA (${sbsaJetsonCapability}) Jetson CUDA capabilities (${toJSON preSbsaJetsonCudaCapabilities}) require "
          + "computed NVIDIA hostRedistSystem (${passthruExtra.hostRedistSystem}) to be linux-aarch64";
        assertion =
-          preThorJetsonCudaCapabilities != [ ] -> passthruExtra.hostRedistSystem == "linux-aarch64";
+          preSbsaJetsonCudaCapabilities != [ ] -> passthruExtra.hostRedistSystem == "linux-aarch64";
      }
      {
        message =
-          "Requested post-Thor (10.1) Jetson CUDA capabilities (${toJSON postThorJetsonCudaCapabilities}) require "
+          "Requested post-SBSA (${sbsaJetsonCapability}) Jetson CUDA capabilities (${toJSON postSbsaJetsonCudaCapabilities}) require "
          + "computed NVIDIA hostRedistSystem (${passthruExtra.hostRedistSystem}) to be linux-sbsa";
-        assertion = postThorJetsonCudaCapabilities != [ ] -> passthruExtra.hostRedistSystem == "linux-sbsa";
+        assertion = postSbsaJetsonCudaCapabilities != [ ] -> passthruExtra.hostRedistSystem == "linux-sbsa";
      }
    ];

--- a/pkgs/development/cuda-modules/packages/tensorrt-samples/package.nix
+++ b/pkgs/development/cuda-modules/packages/tensorrt-samples/package.nix
@@ -117,6 +117,10 @@ backendStdenv.mkDerivation (finalAttrs: {
        tag = "v10.14";
        hash = "sha256-pWvXpXiUriLDYHqro3HWAmO/9wbGznyUrc9qxq/t0/U=";
      };
+      "10.16.1" = {
+        tag = "v10.16";
+        hash = "sha256-Wm5oOXxAIpIlwiJKhH0WjgUAuTB9H2xFEVpM/sO36qk=";
+      };
    }
  );

--- a/pkgs/development/cuda-modules/packages/tensorrt-samples/passthru.nix
+++ b/pkgs/development/cuda-modules/packages/tensorrt-samples/passthru.nix
@@ -27,6 +27,7 @@ in
      else
        lib.getAttr finalAttrs.version {
          "10.14.1" = sample-data_10_14_1;
+          "10.16.1" = sample-data_10_14_1; # Release 10.16 is missing sample data
        }
    );

--- a/pkgs/development/interpreters/elixir/1.20.nix
+++ b/pkgs/development/interpreters/elixir/1.20.nix
@@ -1,6 +1,6 @@
 import ./generic-builder.nix {
-  version = "1.20.0";
-  hash = "sha256-cTogrKyG2SkJFlnB43pwKiowf41eTHPTHbIS5f44b0Q=";
+  version = "1.20.2";
+  hash = "sha256-KSRsXQhh3PX7SUNhuw/POg74XfjkPiZDsv9wdNwFrwA=";
  # https://hexdocs.pm/elixir/1.20.0/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
  minimumOTPVersion = "27";
  maximumOTPVersion = "29";
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -271,7 +271,9 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "USE_OPENMP" false) # openblas will refuse building with both USE_OPENMP=ON and USE_THREAD=OFF
  ];

-  doCheck = true;
+  # FIXME: this broke some time between a0374025a863d007d98e3297f6aa46cc3141c2f0 and 34268251cf5547d39063f2c5ea9a196246f7f3a6
+  # This just serves to unbreak stable
+  doCheck = stdenv.hostPlatform.system != "i686-linux";

  postInstall = ''
        # Provide headers in /include directly for compat with some consumers like flint
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -19,13 +19,13 @@

 buildDunePackage (finalAttrs: {
  pname = "eliom";
-  version = "12.0.1";
+  version = "12.1.0";

  src = fetchFromGitHub {
    owner = "ocsigen";
    repo = "eliom";
    tag = finalAttrs.version;
-    hash = "sha256-Lja3Xe3FszzyILhpOXWTyA0ippaU6aW5CJ06WEKgbkA=";
+    hash = "sha256-VJHt64XheW+JPZ3pynlOvpTgXf5nE9HCB4K1bWUXmAs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/ocaml-protoc/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-protoc/default.nix
@@ -1,7 +1,10 @@
 {
+  lib,
+  ocaml,
  buildDunePackage,
  pbrt,
  stdlib-shims,
+  pbrt_services,
 }:

 buildDunePackage {
@@ -12,7 +15,8 @@ buildDunePackage {
  buildInputs = [ stdlib-shims ];
  propagatedBuildInputs = [ pbrt ];

-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "5.1";
+  checkInputs = [ pbrt_services ];

  meta = pbrt.meta // {
    description = "Protobuf Compiler for OCaml";
--- a/pkgs/development/ocaml-modules/pbrt/default.nix
+++ b/pkgs/development/ocaml-modules/pbrt/default.nix
@@ -6,15 +6,13 @@

 buildDunePackage (finalAttrs: {
  pname = "pbrt";
-  version = "2.4";
-
-  minimalOCamlVersion = "4.03";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "mransan";
    repo = "ocaml-protoc";
-    rev = "${finalAttrs.version}.0";
-    hash = "sha256-EXugdcjALukSjB31zAVG9WiN6GMGXi2jlhHWaZ+p+uM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UrgrzI5Pgi79C/OhqYxwSNfqsoBULUZ13XVaB71fGes=";
  };

  meta = {
--- a/pkgs/development/ocaml-modules/pbrt/services.nix
+++ b/pkgs/development/ocaml-modules/pbrt/services.nix
@@ -0,0 +1,19 @@
+{
+  buildDunePackage,
+  pbrt,
+  pbrt_yojson,
+}:
+
+buildDunePackage {
+  pname = "pbrt_services";
+  inherit (pbrt) version src;
+
+  propagatedBuildInputs = [
+    pbrt
+    pbrt_yojson
+  ];
+
+  meta = pbrt.meta // {
+    description = "Runtime library for ocaml-protoc to support RPC services";
+  };
+}
--- a/pkgs/development/ocaml-modules/pbrt/yojson.nix
+++ b/pkgs/development/ocaml-modules/pbrt/yojson.nix
@@ -0,0 +1,21 @@
+{
+  buildDunePackage,
+  pbrt,
+  base64,
+  yojson,
+}:
+
+buildDunePackage {
+  pname = "pbrt_yojson";
+  inherit (pbrt) version src;
+
+  propagatedBuildInputs = [
+    pbrt
+    base64
+    yojson
+  ];
+
+  meta = pbrt.meta // {
+    description = "Runtime library for ocaml-protoc to support JSON encoding/decoding";
+  };
+}
--- a/pkgs/development/tools/ocaml/melange/default.nix
+++ b/pkgs/development/tools/ocaml/melange/default.nix
@@ -21,15 +21,20 @@
 let
  pname = "melange";
  versionHash =
-    if lib.versionAtLeast ocaml.version "5.4" then
+    if lib.versionAtLeast ocaml.version "5.5" then
      {
-        version = "6.0.1-54";
-        hash = "sha256-bV5TD8qlLt7wQdm9W0TyhDDBFFo/PdJXGgiscnsBFmc=";
+        version = "7.0.0-55";
+        hash = "sha256:f71d2910599c230506efe01f43e02d16d4468fdaea34b537e9e3dfd7383cdf56";
+      }
+    else if lib.versionAtLeast ocaml.version "5.4" then
+      {
+        version = "7.0.0-54";
+        hash = "sha256:cb78172b329c1a0a1c120801d2b915c03c83d2027014ba88416e7cafc1251a7c";
      }
    else if lib.versionAtLeast ocaml.version "5.3" then
      {
-        version = "6.0.1-53";
-        hash = "sha256-e1/RIsFsKeAbc2wgQf1Hhta+nyAXIuEP7uatXrU9cLs=";
+        version = "7.0.0-53";
+        hash = "sha256:2b3d94a770d1ce7d9cf43a83c1e61e176b0a13b7472c166bb6856121b5bd6e64";
      }
    else if lib.versionAtLeast ocaml.version "5.2" then
      {
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -316,6 +316,9 @@ python3Packages.buildPythonApplication rec {
    # No scaring our users about not running in a docker or a venv
    ./patches/pythonpath-is-a-venv.patch

+    # No scaring our users about our install method
+    ./patches/nixos-was-never-supported.patch
+
    # Patch path to ffmpeg binary
    (replaceVars ./patches/ffmpeg-path.patch {
      ffmpeg = "${lib.getExe ffmpeg-headless}";
@@ -333,6 +336,9 @@ python3Packages.buildPythonApplication rec {
      url = "https://github.com/home-assistant/core/commit/e796d9c46744097585bfada483108a55ae16344a.patch";
      hash = "sha256-T0Nb6LcL/21WdUm8RmczhHaVX92n5O/rpMdpqDVQ2VU=";
    })
+
+    # https://github.com/home-assistant/core/pull/172893
+    ./patches/pyjwt-2.13-compat.patch
  ];

  postPatch = ''
--- a/pkgs/servers/home-assistant/patches/nixos-was-never-supported.patch
+++ b/pkgs/servers/home-assistant/patches/nixos-was-never-supported.patch
@@ -0,0 +1,13 @@
+diff --git a/homeassistant/components/homeassistant/__init__.py b/homeassistant/components/homeassistant/__init__.py
+index 54c6454167b..026fda54578 100644
+--- a/homeassistant/components/homeassistant/__init__.py
+++ b/homeassistant/components/homeassistant/__init__.py
+@@ -420,7 +420,7 @@ async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:  # noqa:
+ 
+         installation_type = info["installation_type"][15:]
+         if installation_type in {"Core", "Container"}:
+-            deprecated_method = installation_type == "Core"
+            deprecated_method = False
+             bit32 = _is_32_bit()
+             arch = info["arch"]
+             if bit32 and installation_type == "Container":
--- a/pkgs/servers/home-assistant/patches/pyjwt-2.13-compat.patch
+++ b/pkgs/servers/home-assistant/patches/pyjwt-2.13-compat.patch
@@ -0,0 +1,48 @@
+diff --git a/homeassistant/auth/__init__.py b/homeassistant/auth/__init__.py
+index e16c29ceaa8..8224aca0e43 100644
+--- a/homeassistant/auth/__init__.py
+++ b/homeassistant/auth/__init__.py
+@@ -656,6 +656,8 @@ class AuthManager:
+         try:
+             unverif_claims = jwt_wrapper.unverified_hs256_token_decode(token)
+         except jwt.InvalidTokenError:
+            # PyJWT 2.13 raises InvalidKeyError (not an InvalidTokenError) when
+            # the refresh token's key has been removed and is therefore empty.
+             return None
+ 
+         refresh_token = self.async_get_refresh_token(
+@@ -673,7 +675,7 @@ class AuthManager:
+             jwt_wrapper.verify_and_decode(
+                 token, jwt_key, leeway=10, issuer=issuer, algorithms=["HS256"]
+             )
+-        except jwt.InvalidTokenError:
+        except jwt.InvalidTokenError, jwt.InvalidKeyError:
+             return None
+ 
+         if refresh_token is None or not refresh_token.user.is_active:
+diff --git a/homeassistant/components/html5/notify.py b/homeassistant/components/html5/notify.py
+index c3ea03d01b9..98878696139 100644
+--- a/homeassistant/components/html5/notify.py
+++ b/homeassistant/components/html5/notify.py
+@@ -327,7 +327,7 @@ class HTML5PushCallbackView(HomeAssistantView):
+         if target_check.get(ATTR_TARGET) in self.registrations:
+             possible_target = self.registrations[target_check[ATTR_TARGET]]
+             key = possible_target["subscription"]["keys"]["auth"]
+-            with suppress(jwt.exceptions.DecodeError):
+            with suppress(jwt.exceptions.DecodeError, jwt.exceptions.InvalidKeyError):
+                 return jwt.decode(token, key, algorithms=["ES256", "HS256"])
+ 
+         return self.json_message(
+diff --git a/tests/components/elmax/conftest.py b/tests/components/elmax/conftest.py
+index 02f01036996..c9c3f13e9e3 100644
+--- a/tests/components/elmax/conftest.py
+++ b/tests/components/elmax/conftest.py
+@@ -82,7 +82,7 @@ def httpx_mock_direct_fixture(base_uri: str) -> Generator[respx.MockRouter]:
+         expiration = datetime.now() + timedelta(hours=1)
+         decoded_jwt["payload"]["exp"] = int(expiration.timestamp())
+         jws_string = jwt.encode(
+-            payload=decoded_jwt["payload"], algorithm="HS256", key=""
+            payload=decoded_jwt["payload"], algorithm="HS256", key="test"
+         )
+         login_json["token"] = f"JWT {jws_string}"
+         login_route.return_value = Response(200, json=login_json)
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -134,6 +134,10 @@ let
      # 2026.5.0: after reload device is in loaded state instead of retry state
      "test_usb_device_reactivity"
    ];
+    homeassistant = [
+      # disabled via nixos-was-never-supported.patch
+      "test_deprecated_installation_issue_core"
+    ];
    homeassistant_connect_zbt2 = [
      # 2026.5.0: after reload device is in loaded state instead of retry state
      "test_usb_device_reactivity"
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -359,8 +359,20 @@ let
          + lib.optionalString withStorageMroonga ''
            mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
          ''
-          + lib.optionalString (!stdenv.hostPlatform.isDarwin && lib.versionAtLeast common.version "10.4") ''
-            mv "$out"/OFF/suite/plugins/pam/pam_mariadb_mtr.so "$out"/share/pam/lib/security
+          +
+            lib.optionalString
+              (
+                !stdenv.hostPlatform.isDarwin
+                && lib.versionAtLeast common.version "10.6"
+                && lib.versionOlder common.version "10.11"
+              )
+              ''
+                mv "$out"/OFF/suite/plugins/pam/pam_mariadb_mtr.so "$out"/share/pam/lib/security
+              ''
+          + lib.optionalString (!stdenv.hostPlatform.isDarwin && lib.versionAtLeast common.version "10.11") ''
+            mv "$out"/lib/mysql/plugin/test_pam_modules/pam_mariadb_mtr.so "$out"/share/pam/lib/security
+          ''
+          + lib.optionalString (!stdenv.hostPlatform.isDarwin && lib.versionAtLeast common.version "10.6") ''
            mv "$out"/OFF/suite/plugins/pam/mariadb_mtr "$out"/share/pam/etc/security
            rm -r "$out"/OFF
          '';
@@ -382,22 +394,22 @@ self: {
  # see https://mariadb.org/about/#maintenance-policy for EOLs
  mariadb_106 = self.callPackage generic {
    # Supported until 2026-07-06
-    version = "10.6.24";
-    hash = "sha256-SeK63GdFcMhg48t6LAFhJKpmKMlfMBMwMEEeXImqFy8=";
+    version = "10.6.27";
+    hash = "sha256-jrdq07Gz0UxWYRzMkQQoFB/lYWAEOBnmR0FgOF9pZl4=";
  };
  mariadb_1011 = self.callPackage generic {
    # Supported until 2028-02-16
-    version = "10.11.15";
-    hash = "sha256-UxHoV2VAK95agamnsmQ6c3jSAxaigiv61LbdzxBHWaU=";
+    version = "10.11.18";
+    hash = "sha256-pGhSxoB1vnwxx7M/7iM8W1oAyMKBF/UgTRJOTy/Vb6g=";
  };
  mariadb_114 = self.callPackage generic {
    # Supported until 2029-05-29
-    version = "11.4.9";
-    hash = "sha256-jkgcoptadARE1FRRyOotk3Ec9SXW+l0nvJUSz4lzsHU=";
+    version = "11.4.12";
+    hash = "sha256-WreIPbUZv86/3SqsCbxVRKEs4yjznt1G0L8BaQYV72w=";
  };
  mariadb_118 = self.callPackage generic {
    # Supported until 2028-06-04
-    version = "11.8.5";
-    hash = "sha256-vLc5RWnAiHfCg+FkmGlQRTG+6MqvowKI8HjjDZn8ufY=";
+    version = "11.8.8";
+    hash = "sha256-vQI6SVn68BLbfw6/wNJ2cp5n5UQ98ZMWP5jYD9/FJMk=";
  };
 }
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -126,6 +126,19 @@ let
      ''
        substitute $inputPath $out --replace-fail @deps@ "$(cat ${deps})"
      '';
+
+  # https://github.com/NixOS/nixpkgs/pull/525953 backported a performance patch
+  # that /somehow/ breaks Lix unit tests.
+  # FIXME revert when the patch is gone in curl drv
+  curl-fixed = curl.overrideAttrs (
+    {
+      patches ? [ ],
+      ...
+    }:
+    {
+      patches = lib.filter (patch: !lib.strings.hasSuffix "fix-wakeup-consumption.patch" patch) patches;
+    }
+  );
 in
 # gcc miscompiles coroutines at least until 13.2, possibly longer
 # do not remove this check unless you are sure you (or your users) will not report bugs to Lix upstream about GCC miscompilations.
@@ -243,14 +256,14 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linuxMinimal ]
  ++ lib.optionals (lib.versionAtLeast version "2.94") [ zstd ]
  ++ lib.optionals (withPlugins && finalAttrs.doInstallCheck) [
-    curl
+    curl-fixed
  ];

  buildInputs = [
    boost
    brotli
    bzip2
-    curl
+    curl-fixed
    capnproto
    editline
    openssl
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nix-eval-jobs";
-  version = "2.34.1";
+  version = "2.34.3";

  src = fetchFromGitHub {
-    owner = "nix-community";
+    owner = "NixOS";
    repo = "nix-eval-jobs";
    tag = "v${version}";
-    hash = "sha256-OFGRoJOYhvZ3Enk5a8vMy0QNcG5ZxyzFhyHMrwKXde8=";
+    hash = "sha256-YaVQAgBxWbUBFHXLBLzdUyVvuA/DDw80SEnn9iq0Veo=";
  };

  buildInputs = [
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Hydra's builtin hydra-eval-jobs as a standalone";
-    homepage = "https://github.com/nix-community/nix-eval-jobs";
+    homepage = "https://github.com/NixOS/nix-eval-jobs";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [
      adisbladis
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3314,6 +3314,8 @@ with pkgs;
    nvidiaSupport = true;
  };

+  zellijPlugins = recurseIntoAttrs (callPackage ../by-name/ze/zellij/plugins { });
+
  zstd = callPackage ../tools/compression/zstd {
    cmake = buildPackages.cmakeMinimal;
  };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1713,6 +1713,10 @@ let

        pbrt = callPackage ../development/ocaml-modules/pbrt { };

+        pbrt_services = callPackage ../development/ocaml-modules/pbrt/services.nix { };
+
+        pbrt_yojson = callPackage ../development/ocaml-modules/pbrt/yojson.nix { };
+
        pcre2 = callPackage ../development/ocaml-modules/pcre2 {
          inherit (pkgs) pcre2;
        };