Merge staging-next into staging

2026-06-05 21:03:40 +00:00 · 2026-04-02 00:25:54 +00:00
parent e29701469f d6159b9c19
commit 91a2bcd0df
127 changed files with 991 additions and 444 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -26,10 +26,10 @@

 # Libraries
 /lib                        @infinisil @hsjobeki
-/lib/generators.nix         @infinisil @hsjobeki @Profpatsch
-/lib/cli.nix                @infinisil @hsjobeki @Profpatsch
-/lib/debug.nix              @infinisil @hsjobeki @Profpatsch
-/lib/asserts.nix            @infinisil @hsjobeki @Profpatsch
+/lib/generators.nix         @infinisil @hsjobeki
+/lib/cli.nix                @infinisil @hsjobeki
+/lib/debug.nix              @infinisil @hsjobeki
+/lib/asserts.nix            @infinisil @hsjobeki
 /lib/path/*                 @infinisil @hsjobeki
 /lib/fileset                @infinisil @hsjobeki
 /maintainers/github-teams.json @infinisil
@@ -75,7 +75,7 @@
 /pkgs/pkgs-lib                                   @Stunkymonkey @h7x4

 # Nixpkgs build-support
-/pkgs/build-support/writers @lassulus @Profpatsch
+/pkgs/build-support/writers @lassulus

 # Nixpkgs make-disk-image
 /doc/build-helpers/images/makediskimage.section.md  @raitobezarius
@@ -335,8 +335,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/dlang @jtbx @TomaSajt

 # Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
+/pkgs/development/dhall-modules      @Gabriella439
+/pkgs/development/interpreters/dhall @Gabriella439

 # Agda
 /pkgs/build-support/agda                  @NixOS/agda
@@ -349,9 +349,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/idris-modules @Infinisil
 /pkgs/development/compilers/idris2 @mattpolzin

-# Bazel
-/pkgs/by-name/ba/bazel_7 @Profpatsch
-
 # NixOS modules for e-mail and dns services
 /nixos/modules/services/mail/mailman.nix    @peti
 /nixos/modules/services/mail/postfix.nix    @peti
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -41,7 +41,6 @@
    "description": "Maintenance of https://bazel.build/ and related packages",
    "id": 5468470,
    "maintainers": {
-      "Profpatsch": 3153638
    },
    "members": {
      "aherrmann": 732652,
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -80,6 +80,28 @@ in

    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];

+    systemd.services."polkit-agent-helper@".serviceConfig = lib.mkMerge [
+      # The upstream unit inherits stderr to the polkit agent, which causes
+      # agent processes to misinterpret diagnostic output from PAM modules
+      # as protocol errors, resulting in tight re-execution loops.
+      { StandardError = "journal"; }
+
+      # The upstream unit uses PrivateDevices=yes and ProtectHome=yes,
+      # which prevents PAM modules from accessing hardware (e.g. FIDO
+      # tokens via /dev/hidraw*) or reading key files from home directories.
+      (lib.mkIf config.security.pam.u2f.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/urandom r"
+          "char-hidraw rw"
+        ];
+        # Override upstream ProtectHome=yes so pam_u2f can read
+        # ~/.config/Yubico/u2f_keys (the default key file location)
+        ProtectHome = "read-only";
+      })
+    ];
+
    # The polkit daemon reads action/rule files
    environment.pathsToLink = [ "/share/polkit-1" ];

--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -157,6 +157,7 @@ let
            --uid=nextcloud \
            --same-dir \
            --pty \
+            --pipe \
            --wait \
            --collect \
            --service-type=exec \
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -57,7 +57,6 @@ in
    boot.extraModulePackages = [
      config.boot.kernelPackages.ena
    ];
-    boot.initrd.kernelModules = [ "xen-blkfront" ];
    boot.initrd.availableKernelModules = [ "nvme" ];
    boot.kernelParams =
      let
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -87,6 +87,7 @@ rec {
        (onFullSupported "nixos.tests.containers-ip")
        (onSystems [ "x86_64-linux" ] "nixos.tests.docker")
        (onFullSupported "nixos.tests.env")
+        (onSystems [ "x86_64-linux" "aarch64-linux" ] "nixos.tests.ec2-userdata")

        # Way too many manual retries required on Hydra.
        #  Apparently it's hard to track down the cause.
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -489,9 +489,8 @@ in
  early-mount-options = runTest ./early-mount-options.nix;
  earlyoom = runTestOn [ "x86_64-linux" ] ./earlyoom.nix;
  easytier = runTest ./easytier.nix;
-  ec2-config = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-config or { };
  ec2-image = runTest ./ec2-image.nix;
-  ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
+  ec2-userdata = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).ec2-userdata or { };
  echoip = runTest ./echoip.nix;
  ejabberd = runTest ./xmpp/ejabberd.nix;
  elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
@@ -1221,6 +1220,7 @@ in
  pam-oath-login = runTest ./pam/pam-oath-login.nix;
  pam-pgsql = runTest ./pam/pam-pgsql.nix;
  pam-u2f = runTest ./pam/pam-u2f.nix;
+  pam-u2f-polkit = runTest ./pam/pam-u2f-polkit.nix;
  pam-ussh = runTest ./pam/pam-ussh.nix;
  pam-zfs-key = runTest ./pam/zfs-key.nix;
  pangolin = runTest ./pangolin.nix;
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -18,12 +18,6 @@ let
        ../modules/testing/test-instrumentation.nix
        ../modules/profiles/qemu-guest.nix
        {
-          # Hack to make the partition resizing work in QEMU.
-          boot.initrd.postDeviceCommands = mkBefore ''
-            ln -s vda /dev/xvda
-            ln -s vda1 /dev/xvda1
-          '';
-
          amazonImage.format = "qcow2";

          # In a NixOS test the serial console is occupied by the "backdoor"
@@ -31,30 +25,6 @@ let
          # the configuration in virtualisation/amazon-image.nix.
          systemd.services."serial-getty@ttyS0".enable = mkForce false;

-          # Needed by nixos-rebuild due to the lack of network
-          # access. Determined by trial and error.
-          system.extraDependencies = with pkgs; [
-            # Needed for a nixos-rebuild.
-            busybox
-            cloud-utils
-            desktop-file-utils
-            libxslt.bin
-            mkinitcpio-nfs-utils
-            stdenv
-            stdenvNoCC
-            texinfo
-            unionfs-fuse
-            lndir
-
-            # These are used in the configure-from-userdata tests
-            # for EC2. Httpd and valgrind are requested by the
-            # configuration.
-            apacheHttpd
-            apacheHttpd.doc
-            apacheHttpd.man
-            valgrind.doc
-          ];
-
          nixpkgs.pkgs = pkgs;
        }
      ];
@@ -68,8 +38,8 @@ let

 in
 {
-  boot-ec2-nixops = makeEc2Test {
-    name = "nixops-userdata";
+  ec2-userdata = makeEc2Test {
+    name = "ec2-userdata";
    meta.timeout = 600;
    inherit image;
    sshPublicKey = snakeOilPublicKey; # That's right folks! My user's key is also the host key!
@@ -116,49 +86,4 @@ in
      machine.wait_for_file("/etc/ec2-metadata/user-data")
    '';
  };
-
-  boot-ec2-config = makeEc2Test {
-    name = "config-userdata";
-    meta.broken = true; # amazon-init wants to download from the internet while building the system
-    inherit image;
-    sshPublicKey = snakeOilPublicKey;
-
-    # ### https://channels.nixos.org/nixos-unstable nixos
-    userData = ''
-      { pkgs, ... }:
-
-      {
-        imports = [
-          <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
-          <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
-          <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-        ];
-        environment.etc.testFile = {
-          text = "whoa";
-        };
-
-        networking.hostName = "ec2-test-vm"; # required by services.httpd
-
-        services.httpd = {
-          enable = true;
-          adminAddr = "test@example.org";
-          virtualHosts.localhost.documentRoot = "''${pkgs.valgrind.doc}/share/doc/valgrind/html";
-        };
-        networking.firewall.allowedTCPPorts = [ 80 ];
-      }
-    '';
-    script = ''
-      machine.start()
-
-      # amazon-init must succeed. if it fails, make the test fail
-      # immediately instead of timing out in wait_for_file.
-      machine.wait_for_unit("amazon-init.service")
-
-      machine.wait_for_file("/etc/testFile")
-      assert "whoa" in machine.succeed("cat /etc/testFile")
-
-      machine.wait_for_unit("httpd.service")
-      assert "Valgrind" in machine.succeed("curl http://localhost")
-    '';
-  };
 }
--- a/nixos/tests/pam/pam-u2f-polkit.nix
+++ b/nixos/tests/pam/pam-u2f-polkit.nix
@@ -0,0 +1,90 @@
+{ hostPkgs, ... }:
+
+{
+  name = "pam-u2f-polkit";
+
+  qemu.package = hostPkgs.qemu_test.override { u2fEmuSupport = true; };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device u2f-emulated"
+      ];
+
+      security.polkit.enable = true;
+      security.pam.u2f.enable = true;
+
+      environment.systemPackages = with pkgs; [
+        libfido2
+        pam_u2f
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # The upstream polkit-agent-helper@.service has PrivateDevices=yes and
+    # DevicePolicy=strict with only /dev/null allowed. This blocks hidraw.
+    # Verify that: run a command under the upstream defaults and show it fails.
+    machine.fail(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=yes "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "test -c /dev/hidraw0"
+    )
+
+    # The PR overrides PrivateDevices=no and adds DeviceAllow for hidraw.
+    # Verify that the actual polkit-agent-helper@ unit got these overrides.
+    props = machine.succeed("systemctl show polkit-agent-helper@dummy.service")
+    assert "PrivateDevices=no" in props, f"Expected PrivateDevices=no, got: {props}"
+    assert "ProtectHome=read-only" in props, f"Expected ProtectHome=read-only, got: {props}"
+
+    # Run fido2-token under the same constraints as the fixed service.
+    # This proves the device is not just visible but actually usable
+    # inside the polkit-agent-helper@ sandbox.
+    machine.succeed(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=no "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "--property='DeviceAllow=/dev/urandom r' "
+        "--property='DeviceAllow=char-hidraw rw' "
+        "--property=ProtectHome=read-only "
+        "--property=PrivateNetwork=yes "
+        "--property=ProtectSystem=strict "
+        "--property=ProtectKernelModules=yes "
+        "--property=ProtectKernelLogs=yes "
+        "--property=ProtectKernelTunables=yes "
+        "--property=ProtectControlGroups=yes "
+        "--property=ProtectClock=yes "
+        "--property=ProtectHostname=yes "
+        "--property=LockPersonality=yes "
+        "--property=MemoryDenyWriteExecute=yes "
+        "--property=NoNewPrivileges=yes "
+        "--property=PrivateTmp=yes "
+        "--property=RemoveIPC=yes "
+        "--property='RestrictAddressFamilies=AF_UNIX' "
+        "--property=RestrictNamespaces=yes "
+        "--property=RestrictRealtime=yes "
+        "--property=RestrictSUIDSGID=yes "
+        "--property=SystemCallArchitectures=native "
+        "fido2-token -I /dev/hidraw0"
+    )
+
+    # Also verify that pamu2fcfg can register a credential inside the sandbox
+    # (needs hidraw + urandom access)
+    machine.succeed(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=no "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "--property='DeviceAllow=/dev/urandom r' "
+        "--property='DeviceAllow=char-hidraw rw' "
+        "--property=ProtectHome=read-only "
+        "pamu2fcfg"
+    )
+  '';
+}
--- a/nixos/tests/pam/pam-u2f.nix
+++ b/nixos/tests/pam/pam-u2f.nix
@@ -1,29 +1,70 @@
-{ ... }:
+{ hostPkgs, ... }:

 {
  name = "pam-u2f";

+  qemu.package = hostPkgs.qemu_test.override { u2fEmuSupport = true; };
+
  nodes.machine =
-    { ... }:
+    { pkgs, ... }:
    {
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device u2f-emulated"
+      ];
+
      security.pam.u2f = {
        enable = true;
-        control = "required";
+        control = "sufficient";
        settings = {
-          cue = true;
          debug = true;
-          interactive = true;
-          origin = "nixos-test";
-          # Freeform option
-          userpresence = 1;
+          origin = "pam://nixos-test";
        };
      };
+
+      users.users.alice = {
+        isNormalUser = true;
+        uid = 1000;
+      };
+
+      environment.systemPackages = with pkgs; [
+        libfido2
+        pam_u2f
+      ];
+
+      # Allow non-root users to access the virtual U2F device
+      services.udev.extraRules = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0666"
+      '';
    };

  testScript = ''
    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+    # The virtual U2F device should be recognized
+    machine.succeed("fido2-token -L | grep -q hidraw")
+
+    # Register a U2F credential for alice
+    machine.succeed("mkdir -p /home/alice/.config/Yubico")
    machine.succeed(
-        'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test.*userpresence=1" /etc/pam.d/ -R'
+        "pamu2fcfg -u alice -o pam://nixos-test"
+        " > /home/alice/.config/Yubico/u2f_keys"
    )
+    machine.succeed("chown -R alice:users /home/alice/.config")
+
+    # Log in as alice on tty2. With control=sufficient, pam_u2f runs
+    # before pam_unix. The emulated device auto-approves user presence,
+    # so alice is authenticated by her U2F key — no password needed.
+    machine.send_key("alt-f2")
+    machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+    machine.wait_for_unit("getty@tty2.service")
+    machine.wait_until_tty_matches("2", "login: ")
+    machine.send_chars("alice\n")
+
+    # alice should get a shell without being asked for a password
+    machine.wait_until_succeeds("pgrep -u alice bash")
+    machine.send_chars("touch /tmp/u2f-login-success\n")
+    machine.wait_for_file("/tmp/u2f-login-success")
  '';
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3828,8 +3828,8 @@ let
        mktplcRef = {
          name = "ansible";
          publisher = "redhat";
-          version = "26.3.0";
-          hash = "sha256-c6NcQsJe2sjJH/nBhStHYWKNSfJtU3CLHpv+2qPlyqM=";
+          version = "26.3.5";
+          hash = "sha256-IKSozGy4S04pSsbhpXVgsqQvJNzaxVkoSrLwhFb4Ag4=";
        };
        meta = {
          description = "Ansible language support";
--- a/pkgs/applications/emulators/libretro/cores/fbalpha2012.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbalpha2012.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore rec {
  core = "fbalpha2012";
-  version = "0-unstable-2025-12-12";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbalpha2012";
-    rev = "c547d8cf3f7748f4094cee658a5d31ec1b79ece4";
-    hash = "sha256-owy8IuJ/dAEbUH7hGCR3oLiI4tYuwsNfRYRl6LmyYfc=";
+    rev = "15af60bf24e3dc2267a38e3c8532450ebec86317";
+    hash = "sha256-7QfDk/j7akaORSekdx96mcDgsFp+kAq1/Cxtu3uPe4A=";
  };

  sourceRoot = "${src.name}/svn-current/trunk";
--- a/pkgs/applications/emulators/libretro/cores/fmsx.nix
+++ b/pkgs/applications/emulators/libretro/cores/fmsx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fmsx";
-  version = "0-unstable-2025-07-31";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fmsx-libretro";
-    rev = "fbe4dfc4c3e3f7eb27089def3d663a905b181845";
-    hash = "sha256-1hZQO16SDB8n1wdTP67Kpns3izg/nPGl5M7wjFDBjGc=";
+    rev = "6b807c588d63677770f7f2ed8b94ca0e9da256ce";
+    hash = "sha256-vA9ODUtmmrDPbZjmRJ9IIFELLTD8g8aHmQdo/B/d1fQ=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/graphics/apngasm/default.nix
+++ b/pkgs/applications/graphics/apngasm/default.nix
@@ -26,6 +26,11 @@ stdenv.mkDerivation {
      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/apngasm/files/apngasm-3.1.10-static.patch?id=45fd0cde71ca2ae0e7e38ab67400d84b86b593d7";
      sha256 = "sha256-eKthgInWxXEqN5PupvVf9wVQDElxsPYRFXT7pMc6vIU=";
    })
+    # Boost 1.89+ removed the boost_system CMake component
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/apngasm/files/apngasm-3.1.10-boost-1.89.patch?id=87e57d47db8c7c68acb2dec534e70015d8b1d61e";
+      sha256 = "sha256-92oie9owUYP8a1hrJsFCRk8QI4AjTzMXTe+frlmbIuE=";
+    })
  ];

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -823,7 +823,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "146.0.7680.164",
+    "version": "146.0.7680.177",
    "deps": {
      "depot_tools": {
        "rev": "42786f6e46c25c30dd58f69283ab6fcd0c959f58",
@@ -835,16 +835,16 @@
        "hash": "sha256-wFCuu4GR0N7QZCwT8UAhqH5moicYQjZ4ZLI58AM4pJ0="
      },
      "ungoogled-patches": {
-        "rev": "146.0.7680.164-1",
-        "hash": "sha256-mqgmG+1TefLshc3QUQrGN2XB99FXJyexE6QI7uD3IXQ="
+        "rev": "146.0.7680.177-1",
+        "hash": "sha256-OMGjomgLuwO0KkqwW3IxLmSbpHM7ZbVUVOiPkQs/N6s="
      },
      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "bbd8c5dd25fb2f569d98e626a9517cf2171abdff",
-        "hash": "sha256-hwZehtGUyuMdHisIaztsYlu0MEftbmmAqN/X+ias4nI=",
+        "rev": "ae03f7fb2cf1215853896d6a4c15fdceee2badb7",
+        "hash": "sha256-WVJ6dtDpXnp+Q8N/KEFJZWU9/4xEmpEYcu53MA94PZ8=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "e05753c6d05b17b23d514038957469c70b75475c",
-        "hash": "sha256-SMym7PN2acfw84Z95xWSbN/QV5UIDIOztWxFeTCfBsk="
+        "rev": "1c0f91aaa60a1f87725840495cbfd9717e7c77c8",
+        "hash": "sha256-9Me/9kdDgcDLGP/0lLWpj294IoUp0hDD5hfFjSZbTOc="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "a655251a59c4af3fbf8058bb2572d6a457f896d2",
-        "hash": "sha256-UKoDytne6QD2d6ojy4mYPjLbo9GB4xy1fUf9C1pLKaE="
+        "rev": "10fb89e3179bb7443e66911eb3c795c7aaf022e5",
+        "hash": "sha256-ATTNb61RG7hS1mapDw0o4ZyBeny4ONI8ZjJLpmbQaKU="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1474,8 +1474,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6a75afe9792764f6faa76ad50125781899ca05e8",
-        "hash": "sha256-S4AAmNw50ToTZIuHl41Pc+Z1MZfUVf0/ZGGIiEr5cXo="
+        "rev": "30d129c8800b5626c46fb83fa62db10b9b22b319",
+        "hash": "sha256-2/Deen9OwDgDRrm5j7Rw27Z2JUX1thX7mnKWRLJbEvM="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "b2a90ac0037ee7187102ce2c40e5007216ca9a58",
-        "hash": "sha256-rX6NEN0RbfHPRqJqkGhypwWt/NcREvPaanL+CDxwhA8="
+        "rev": "6733aa5ba16e1e1087f339d1151c80c924a6fbf8",
+        "hash": "sha256-g2GYFVTK8f296v7lUcYPqkI4qDoladsTpnKWb6SGRmw="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "0e999a528db40a3ef6fa917adf96370a18b87d70",
-        "hash": "sha256-rkSuZBdFUHJyYmqp2oN3mLjNtKjk569MocyvnICo+uw="
+        "rev": "0ad812d268a7820dba9bf848b416aeda4dd1b2e5",
+        "hash": "sha256-nG4goqqVAAWPMkq8296wCYhnwL93oAL+pF1oaMXyqZI="
      }
    }
  }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -191,13 +191,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "cloudamqp_cloudamqp": {
-    "hash": "sha256-PAH7Avc6WQFQ7fXs7A//SxIEP88uSrN9sWlEYe9Zr+I=",
+    "hash": "sha256-WVEGtD5Hfb8xu/GymHMknK8n2KgOMW2EzBMvRmbKJug=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.43.1",
+    "rev": "v1.44.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SrGNzwSdkMTyNuVgjUj0tID/Qu6BBusVn+NsgTk4RJI="
+    "vendorHash": "sha256-sagrygtfsZWQUuIuGTUldZYYR5OhQfpZDxDKZAaIR4Y="
  },
  "cloudflare_cloudflare": {
    "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=",
@@ -1310,11 +1310,11 @@
    "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-iUbbxwnRgYtNq8a8qMYB/6HQ7QS/hrvlzL5MMS08rn0=",
+    "hash": "sha256-xsYh5gDneL3nQDUIHe3fRjObFTGp3ssPq8wlqPWsq7Y=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.77",
+    "rev": "v1.82.82",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/droopy/default.nix
+++ b/pkgs/applications/networking/droopy/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
    description = "Mini Web server that let others upload files to your computer";
    homepage = "http://stackp.online.fr/droopy";
    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    mainProgram = "droopy";
  };

--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/cstring-includes.patch
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/cstring-includes.patch
@@ -0,0 +1,74 @@
+diff --git a/src/api/video/nv12_buffer.cc b/src/api/video/nv12_buffer.cc
+index ca9dcd867..89d28f23c 100644
+--- a/src/api/video/nv12_buffer.cc
+++ b/src/api/video/nv12_buffer.cc
+@@ -16,6 +16,8 @@
+ #include "third_party/libyuv/include/libyuv/convert.h"
+ #include "third_party/libyuv/include/libyuv/scale.h"
+
+#include <cstring>
+
+ namespace webrtc {
+
+ namespace {
+diff --git a/src/audio/utility/channel_mixer.cc b/src/audio/utility/channel_mixer.cc
+index 0f1e66387..33b771b0c 100644
+--- a/src/audio/utility/channel_mixer.cc
+++ b/src/audio/utility/channel_mixer.cc
+@@ -15,6 +15,8 @@
+ #include "rtc_base/logging.h"
+ #include "rtc_base/numerics/safe_conversions.h"
+
+#include <cstring>
+
+ namespace webrtc {
+
+ ChannelMixer::ChannelMixer(ChannelLayout input_layout,
+diff --git a/src/modules/audio_processing/aec3/alignment_mixer.cc b/src/modules/audio_processing/aec3/alignment_mixer.cc
+index 7f076dea8..ffd7242b5 100644
+--- a/src/modules/audio_processing/aec3/alignment_mixer.cc
+++ b/src/modules/audio_processing/aec3/alignment_mixer.cc
+@@ -10,6 +10,7 @@
+ #include "modules/audio_processing/aec3/alignment_mixer.h"
+
+ #include <algorithm>
+#include <cstring>
+
+ #include "rtc_base/checks.h"
+
+diff --git a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+index 7ef1a030e..5b9ab7137 100644
+--- a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+++ b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+@@ -18,6 +18,7 @@
+ #include <spa/param/video/format-utils.h>
+ #include <sys/mman.h>
+
+#include <cstring>
+ #include <vector>
+
+ #include "absl/memory/memory.h"
+diff --git a/src/modules/video_coding/utility/ivf_file_reader.cc b/src/modules/video_coding/utility/ivf_file_reader.cc
+index 4c08ca613..f82f2bfcb 100644
+--- a/src/modules/video_coding/utility/ivf_file_reader.cc
+++ b/src/modules/video_coding/utility/ivf_file_reader.cc
+@@ -10,6 +10,7 @@
+
+ #include "modules/video_coding/utility/ivf_file_reader.h"
+
+#include <cstring>
+ #include <string>
+ #include <vector>
+
+diff --git a/src/net/dcsctp/packet/bounded_byte_writer.h b/src/net/dcsctp/packet/bounded_byte_writer.h
+index d754549e4..bf5e3ed42 100644
+--- a/src/net/dcsctp/packet/bounded_byte_writer.h
+++ b/src/net/dcsctp/packet/bounded_byte_writer.h
+@@ -12,6 +12,7 @@
+ #define NET_DCSCTP_PACKET_BOUNDED_BYTE_WRITER_H_
+
+ #include <algorithm>
+#include <cstring>
+
+ #include "api/array_view.h"
+ 
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -31,6 +31,9 @@ let
    };

    patches = [
+      # fix build with latest glibc
+      # upstream PR: https://github.com/desktop-app/tg_owt/pull/172
+      ./cstring-includes.patch
      (fetchpatch {
        url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
        decode = "base64 -d";
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ab-av1";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "alexheretic";
    repo = "ab-av1";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UiBgtA6i5rpXAtiPwihg7sUbmD6lou6IOsb//DWNWwU=";
+    hash = "sha256-kT0BJr4xoYigKObD6vZNRieslaJj/MWuqQmhYLWNwvs=";
  };

-  cargoHash = "sha256-1/vxKOlbXZ8HXnVFM9dXB9crobBx8djGDKsjnzc/KwQ=";
+  cargoHash = "sha256-o64GrmHvwF2VUKw+nIRK0jesSuelxNo0TFnyKaP/YlQ=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/al/alpine-make-vm-image/package.nix
+++ b/pkgs/by-name/al/alpine-make-vm-image/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alpine-make-vm-image";
-  version = "0.13.3";
+  version = "0.13.4";

  src = fetchFromGitHub {
    owner = "alpinelinux";
    repo = "alpine-make-vm-image";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AIwT2JAGnMeMXUXZ0FRJthf22FvFfTTw/2LtZKPSj6g=";
+    hash = "sha256-U3eJ9wOxxbC9gEDBMXanBmEy0x6YBSsXXf6U5nzVoZ8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-03-21";
+  version = "0-unstable-2026-03-30";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "a0305dc2070306a1af52aad9b03096a51f4147e8";
-    hash = "sha256-WAbJATvx5dWfpB0PYVVlRCVEygDzUU+qeOmhzRKA8GY=";
+    rev = "7460ed8d375425f50517119b0df3a57b876b504e";
+    hash = "sha256-hFBQGmGKUw/LT1DiyfnTsYO5Lt2c7LBMLRVBMmjYakY=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/an/ansible-doctor/package.nix
+++ b/pkgs/by-name/an/ansible-doctor/package.nix
@@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ansible-doctor";
-  version = "8.2.2";
+  version = "8.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "thegeeklab";
    repo = "ansible-doctor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gezpY5iaFxNcngAyUnlVRPGo33zUgjdsm2zFlfWUWfA=";
+    hash = "sha256-lwN6pMKysycMOqVRNrK8+dgGfrsRF2B2EW1Kby0l/0I=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/an/antigravity/information.json
+++ b/pkgs/by-name/an/antigravity/information.json
@@ -1,22 +1,22 @@
 {
-  "version": "1.20.6",
+  "version": "1.21.9",
  "vscodeVersion": "1.107.0",
  "sources": {
    "x86_64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/linux-x64/Antigravity.tar.gz",
-      "sha256": "ad382bf321a6216d07f95af1f613e03f5a07fdf6fc6632b769ce83d81afdd567"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/linux-x64/Antigravity.tar.gz",
+      "sha256": "85ea4d55f52d32fbbf9d92fddc747f10e8d04c1bd00a07721b571fa7f2ef5226"
    },
    "aarch64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/linux-arm/Antigravity.tar.gz",
-      "sha256": "6e17f33d8ccb5622affb3590efccb87c3c4dd505f1d3b0f8506f1c20c39c026a"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/linux-arm/Antigravity.tar.gz",
+      "sha256": "76d56462e0fad95a98efaf25d06be9c4789e3b8551fe5b936a6858b14c723364"
    },
    "x86_64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/darwin-x64/Antigravity.zip",
-      "sha256": "4e56f3ac83bc0e1803b4d811585d567f3795b14ad57ccec1fcfe8cb02f7cb719"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/darwin-x64/Antigravity.zip",
+      "sha256": "a8ebdbf3b18c75d39b876541904c95576422e281fd92e45f7f7f4e7231ac769c"
    },
    "aarch64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/darwin-arm/Antigravity.zip",
-      "sha256": "c4392cc64a52b7b7066cb1c21c32918854b7cd7297b7efa3b14397fc7d05ad5a"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/darwin-arm/Antigravity.zip",
+      "sha256": "f9ec42d0a791cc13cbb57a1f7c36b2421e67f180cd0bdfb01fd8fa23ad87440b"
    }
  }
 }
--- a/pkgs/by-name/as/asn/package.nix
+++ b/pkgs/by-name/as/asn/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "asn";
-  version = "0.80.4";
+  version = "0.80.5";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o0gHHV0tQeKd/qIGAMhA/cwUuCF7VLVDzngoFU8fGhI=";
+    hash = "sha256-o+qyNxEV2lPRsCNkkcZbj07hKw4eV45qhB8G34OWmgg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bg/bgnet/package.nix
+++ b/pkgs/by-name/bg/bgnet/package.nix
@@ -39,6 +39,6 @@ stdenv.mkDerivation {
    homepage = "https://beej.us/guide/bgnet/";
    license = lib.licenses.unfree;

-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/bl/blobfuse/package.nix
+++ b/pkgs/by-name/bl/blobfuse/package.nix
@@ -9,19 +9,19 @@
 }:

 let
-  version = "2.5.2";
+  version = "2.5.3";
  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-fuse";
    rev = "blobfuse2-${version}";
-    sha256 = "sha256-iTzVKb8z7lQh40iMZiwjeufColiwU2YrihBLNLjS6JI=";
+    sha256 = "sha256-PgpXlyFo+rE32wZfjx7h11YmNka4q/6Jbr03CsW0pZc=";
  };
 in
 buildGoModule {
  pname = "blobfuse";
  inherit version src;

-  vendorHash = "sha256-9sT+8o+esVYdqYqAfkvyggqPiIIkG78krv+uID9+UBw=";
+  vendorHash = "sha256-I2/0BzT9KiMBpzReSll0dKY0uzULRx49fcVGD/z4BPQ=";

  buildInputs = [ fuse3 ];

--- a/pkgs/by-name/ci/ciel/package.nix
+++ b/pkgs/by-name/ci/ciel/package.nix
@@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ciel";
-  version = "3.10.2";
+  version = "3.10.3";

  src = fetchFromGitHub {
    owner = "AOSC-Dev";
    repo = "ciel-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lYw1Dzh3zQ9V5TqZGVJ5LTHuAsnEYsJsShkiJcXMGfc=";
+    hash = "sha256-y6AM3tLACJscGSVh3WhEONSkDmXC2KFL3VKt8a7CdGU=";
  };

-  cargoHash = "sha256-RSdJFjFO0ah2WXazc2QDFQzvNwOKxe0IKiNIjRHO0EQ=";
+  cargoHash = "sha256-rgflNUoAOKzqXKMoSDbAgqV1tKbFgJUeH0K7RCVC1ME=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ci/ciftilib/package.nix
+++ b/pkgs/by-name/ci/ciftilib/package.nix
@@ -42,7 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace CMakeLists.txt \
      --replace-fail "CMAKE_MINIMUM_REQUIRED(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)" \
      --replace-fail "CMAKE_POLICY(VERSION 2.8.7)" "CMAKE_POLICY(VERSION 3.10)" \
-      --replace-fail "CMAKE_POLICY(SET CMP0045 OLD)" ""
+      --replace-fail "CMAKE_POLICY(SET CMP0045 OLD)" "" \
+      --replace-fail "FIND_PACKAGE(Boost REQUIRED COMPONENTS filesystem system)" \
+                     "FIND_PACKAGE(Boost REQUIRED COMPONENTS filesystem)"
  '';

  meta = {
--- a/pkgs/by-name/co/colobot/package.nix
+++ b/pkgs/by-name/co/colobot/package.nix
@@ -47,6 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_package(Boost COMPONENTS system filesystem regex REQUIRED)' \
+                     'find_package(Boost COMPONENTS filesystem regex REQUIRED)'
+  '';
+
  nativeBuildInputs = [
    cmake
    xmlstarlet
--- a/pkgs/by-name/co/compress-pptx/inject-dependency-paths.patch
+++ b/pkgs/by-name/co/compress-pptx/inject-dependency-paths.patch
@@ -0,0 +1,49 @@
+diff --git a/src/compress_pptx/__main__.py b/src/compress_pptx/__main__.py
+index 433b6d8..f86c2e2 100644
+--- a/src/compress_pptx/__main__.py
+++ b/src/compress_pptx/__main__.py
+@@ -101,7 +101,7 @@ def main():
+         "--ffmpeg-path",
+         type=str,
+         help="Path to ffmpeg executable",
+-        default="ffmpeg",
+        default="@ffmpeg@",
+     )
+     cli_args = parser.parse_args()
+ 
+diff --git a/src/compress_pptx/compress_pptx.py b/src/compress_pptx/compress_pptx.py
+index 0cb5b42..0845aef 100644
+--- a/src/compress_pptx/compress_pptx.py
+++ b/src/compress_pptx/compress_pptx.py
+@@ -131,7 +131,7 @@ class CompressPptx:
+         ffmpeg_video_codec: Optional[str] = None,
+         ffmpeg_audio_codec: Optional[str] = None,
+         ffmpeg_extra_options: Optional[str] = None,
+-        ffmpeg_path: str = "ffmpeg",
+        ffmpeg_path: str = "@ffmpeg@",
+     ) -> None:
+         """
+         Compress images in a PowerPoint file or extract media.
+@@ -187,19 +187,9 @@ class CompressPptx:
+ 
+         self.file_list: List[FileObj] = []
+ 
+-        # Check for ImageMagick - prefer 'magick' but fall back to 'convert'/'identify'
+-        if which("magick") is not None:
+-            self.magick_cmd = "magick"
+-            self.convert_cmd = ["magick", "convert"]
+-            self.identify_cmd = ["magick", "identify"]
+-        elif which("convert") is not None and which("identify") is not None:
+-            self.magick_cmd = "convert"
+-            self.convert_cmd = ["convert"]
+-            self.identify_cmd = ["identify"]
+-        else:
+-            raise CompressPptxError(
+-                "ImageMagick not found in PATH. Make sure you have installed ImageMagick and that either 'magick' or 'convert'/'identify' commands are available."
+-            )
+        self.magick_cmd = "@magick@"
+        self.convert_cmd = ["@magick@", "convert"]
+        self.identify_cmd = ["@magick@", "identify"]
+ 
+         required_executables = []
+         # add ffmpeg to required executables if user wants media files to be compressed
--- a/pkgs/by-name/co/compress-pptx/package.nix
+++ b/pkgs/by-name/co/compress-pptx/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+
+  # patches
+  replaceVars,
+  ffmpeg,
+  imagemagick,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "compress-pptx";
+  version = "1.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "slhck";
+    repo = "compress-pptx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+67EdAEWsRY11Pkie6AOz7Sl7MSTMGxZoQYS+M2x07Y=";
+  };
+
+  patches = [
+    (replaceVars ./inject-dependency-paths.patch {
+      ffmpeg = lib.getExe ffmpeg;
+      magick = lib.getExe imagemagick;
+    })
+  ];
+
+  build-system = with python3Packages; [ uv-build ];
+
+  dependencies = with python3Packages; [
+    ffmpeg-progress-yield
+    tqdm
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+  ];
+
+  meta = {
+    description = "Compress PPTX files";
+    longDescription = ''
+      Compress a PPTX or POTX file, converting all PNG/TIFF images to lossy
+      JPEGs.
+    '';
+    homepage = "https://github.com/slhck/compress-pptx";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/slhck/compress-pptx/releases/tag/${finalAttrs.src.tag}";
+    mainProgram = "compress-pptx";
+    maintainers = with lib.maintainers; [ artur-sannikov ];
+  };
+})
--- a/pkgs/by-name/ct/ctlptl/package.nix
+++ b/pkgs/by-name/ct/ctlptl/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "ctlptl";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "tilt-dev";
    repo = "ctlptl";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y957JaHg2SnDC6yvwI/0fBFjbEKOfKFsNqOOrqQe+TU=";
+    hash = "sha256-vbg3gaVCFkQ6jKguNq6ClstEKpTrk9ryUG572emEY4U=";
  };

-  vendorHash = "sha256-gJiarW1uYr5vl9nt+JN6/yRyYr9J0sfDVZcNLLcwPJY=";
+  vendorHash = "sha256-b9lzCNjO0rrK/kJlw5dssuQD/cyf/Wu/LJ2YNQ645LE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/cy/cyclonedx-python/package.nix
+++ b/pkgs/by-name/cy/cyclonedx-python/package.nix
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cyclonedx-python";
-  version = "7.2.2";
+  version = "7.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = "cyclonedx-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nTQ0y2zn4idg6x8qVjK8DeZVCMnlXLEJg89ISYabp68=";
+    hash = "sha256-mBOkSgHGKc77zhcMmdsrlZLXsK2t00VFiGW5eSN2lxc=";
  };

  build-system = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/de/deezer-desktop/package.nix
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -8,15 +8,15 @@
 }:

 let
-  version = "7.1.110";
+  version = "7.1.120";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-g8HAAp36l0GrAg/bJOjlvNT13Z9p/geDbA5XQCk3QvM=";
+      hash = "sha256-RrsM8Rx/uYJpH9+w/XX0RoPw+N/+nzJCC+KFdbYzSdc=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-W6br5bvRwgrfSiwwO5OMwfReev7t3mvI6L0zTIIDiwI=";
+      hash = "sha256-WgCfX7Av8YoCHmhACyyVtxut0FUfAdgTAXaIBydWTRI=";
    };
  };

--- a/pkgs/by-name/dj/djhtml/package.nix
+++ b/pkgs/by-name/dj/djhtml/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "djhtml";
-  version = "3.0.10";
+  version = "3.0.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rtts";
    repo = "djhtml";
    tag = finalAttrs.version;
-    hash = "sha256-7K7/Zm6ORfza9AD+Jyl+0Q5zlxgF+WpH3a1O18VpT5k=";
+    hash = "sha256-l3qxPwnEyJ0sZWquaol0bOX7QvImLc8IRTfyE2yqXCo=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "emmylua_doc_cli";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "EmmyLuaLs";
    repo = "emmylua-analyzer-rust";
    tag = finalAttrs.version;
-    hash = "sha256-2H/8ILVk5QnLe099a25pzMEqJLRFDxMG/fQ3f5UwgmI=";
+    hash = "sha256-Zj5nLeTH/4sVElYP+erg6bSTX8jFqF7sqiXfaMam8pE=";
  };

  buildAndTestSubdir = "crates/emmylua_doc_cli";

-  cargoHash = "sha256-QdL4KtQ4sJUaviqMzxmC1KW4Qy5wO7c5koy0Pl8Eua0=";
+  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ew/eww/package.nix
+++ b/pkgs/by-name/ew/eww/package.nix
@@ -15,13 +15,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "eww";
-  version = "0.6.0-unstable-2025-06-30";
+  version = "0.6.0-unstable-2026-03-05";

  src = fetchFromGitHub {
    owner = "elkowar";
    repo = "eww";
-    rev = "fddb4a09b107237819e661151e007b99b5cab36d";
-    hash = "sha256-PJW4LvW9FmkG9HyUtgXOq7MDjYtBc/iJuOxyf29nD0Y=";
+    rev = "865cf631d5bbb5f9fccc99b3f4cc80b9eeada18c";
+    hash = "sha256-fL12XFMsf/efSlbzQc7cCI366CwETkM6sWpEfcF9s6A=";
  };

  cargoHash = "sha256-Kf99eojqXvdbZ3eRS8GBgyLYNpZKJGIJtsOsvhhSVDk=";
--- a/pkgs/by-name/fd/fdtools/package.nix
+++ b/pkgs/by-name/fd/fdtools/package.nix
@@ -96,6 +96,6 @@ stdenv.mkDerivation {
    description = "Set of utilities for working with file descriptors";
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/fl/flashlabel-yxwl/package.nix
+++ b/pkgs/by-name/fl/flashlabel-yxwl/package.nix
@@ -67,7 +67,10 @@ stdenv.mkDerivation rec {
        - A81
        - A81H
        - C80
+        - C801
        - C80H
+        - C80S1
+        - C80Y1
        - D80
        - D80 Pro
        - Y8
--- a/pkgs/by-name/ge/geteltorito/package.nix
+++ b/pkgs/by-name/ge/geteltorito/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Extract the initial/default boot image from a CD image if existent";
    homepage = "https://userpages.uni-koblenz.de/~krienke/ftp/noarch/geteltorito/";
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    license = lib.licenses.gpl2Only;
    mainProgram = "geteltorito";
  };
--- a/pkgs/by-name/gh/gh-token/package.nix
+++ b/pkgs/by-name/gh/gh-token/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gh-token";
-  version = "2.0.9";
+  version = "2.0.10";

  src = fetchFromGitHub {
    owner = "Link-";
    repo = "gh-token";
    rev = "v${version}";
-    hash = "sha256-ff3Dzajh/7p0yNSKCHJzJcqkTpf09zuZ6Hp0ygDv6o0=";
+    hash = "sha256-pjOGEd2c2yRua3qOTEKuTg89YbVBTAIvvZ/Rd8NFesI=";
  };

  vendorHash = "sha256-brAFqWdvaJwURdWb9m8x21nhuXeRxIJX6FsUfGiFIWQ=";
--- a/pkgs/by-name/gi/github-distributed-owners/package.nix
+++ b/pkgs/by-name/gi/github-distributed-owners/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "github-distributed-owners";
-  version = "0.1.11";
+  version = "0.1.12";

  src = fetchFromGitHub {
    owner = "andrewring";
    repo = "github-distributed-owners";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oLRcH1lgRxlYIlyk3bPWO5YmCIq462YUjBjMSPOF7Ic=";
+    hash = "sha256-Ry7l4hiVWtSm47DYG38N0L7V/z5wNfPm9tt+8Zs5tsI=";
  };

-  cargoHash = "sha256-pt/GoXF/uSU78pZqG8PgFe+tlbwZH2qpGQD7jgC52NM=";
+  cargoHash = "sha256-xLc9T2rS511/qWyZpqSNFVyfyf4+gzheOF95TpVlUfc=";
  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glaze";
-  version = "7.1.0";
+  version = "7.2.2";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-W48BDsxUrFjjqUFwBcBqHr5Y7h+BtGGWdioGukBqzbE=";
+    hash = "sha256-E92oxXOcmA4d3s2k0D+DppnHt0Ks900+3W0XoGbbcG4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -31,9 +31,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
+    homepage = "https://stephenberry.github.io/glaze/";
+    changelog = "https://github.com/stephenberry/glaze/releases/tag/v${finalAttrs.version}";
    description = "Extremely fast, in memory, JSON and interface library for modern C++";
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ moni ];
+    maintainers = with lib.maintainers; [
+      moni
+      miniharinn
+    ];
    license = lib.licenses.mit;
  };
 })
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "hugo";
-  version = "0.159.0";
+  version = "0.159.2";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-R+XUgATk6KHaQ+hTIbFSHEzC0VIzaVLna0mMGDRZILw=";
+    hash = "sha256-86qlh4did365g75j3fk5gkBp3T3YH3zEnNhaOrPFVcI=";
  };

-  vendorHash = "sha256-qAZ+EnU1Yaom8QHjaMoAJSaN7HslNpwifmBMlgnmmAE=";
+  vendorHash = "sha256-w6wjKB4jQejxW7IqpZaujxlZSUxWYqHiPI6aqOOD2+0=";

  checkFlags =
    let
--- a/pkgs/by-name/ir/irrd/package.nix
+++ b/pkgs/by-name/ir/irrd/package.nix
@@ -65,14 +65,14 @@ in

 py.pkgs.buildPythonPackage (finalAttrs: {
  pname = "irrd";
-  version = "4.5.1";
+  version = "4.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "irrdnet";
    repo = "irrd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-98DXooabwJtjI+m/HNMGBkZKT843bEbTaXJgflVdx/A=";
+    hash = "sha256-Lr2+3pG22l479mNrn1JFiea+zp+n9qWVX1yTp0Cj4Ds=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/kd/kdotool/package.nix
+++ b/pkgs/by-name/kd/kdotool/package.nix
@@ -8,29 +8,17 @@
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.2.2-pre";
+  version = "0.2.2";
  pname = "kdotool";

  src = fetchFromGitHub {
    owner = "jinliu";
    repo = "kdotool";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-qx4bWAFQcoLM/r4aNzmoZdjclw8ccAW8lKLda6ON1aQ=";
+    hash = "sha256-aJRqFcKyu4/aqI3WtH9NjzjNgiI6lq0VgCXNGaNdyvE=";
  };

-  patches = [
-    # Remove these two on next release.
-    (fetchpatch {
-      url = "https://github.com/jinliu/kdotool/commit/049e3f5620ad8c5484241d7d06d742bc17d423ed.patch";
-      hash = "sha256-VTpHlT6XMVRgJIeLjxZPHkzaYFZCYtS8IAD0mKZ8rzs=";
-    })
-    (fetchpatch {
-      url = "https://github.com/jinliu/kdotool/commit/e0a3bff3b5d9882033dd72836e5fcff572b64135.patch";
-      hash = "sha256-6IsV9O2h9N/FxGQRHS8qAbEqdr7282ziGza5K52vpPk=";
-    })
-  ];
-
-  cargoHash = "sha256-ASR2zMwVCKeEZPYQNoO54J00eZyTn1i6FE0NBCJWSCs=";
+  cargoHash = "sha256-QrJVN2O/pDCIpD1ioFPZyj7au3DQtU3l/I440WsyYWo=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
--- a/pkgs/by-name/la/lagrange/package.nix
+++ b/pkgs/by-name/la/lagrange/package.nix
@@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lagrange";
-  version = "1.20.2";
+  version = "1.20.3";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Rin9frCxY7vMJQbErtR7pXss2GciL4LbXg+BFHFNjn4=";
+    hash = "sha256-i6W4618/r3Xc9dNNxkc9eHlgHK2amZ0FQtq/qtr5sE8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libu2f-emu/package.nix
+++ b/pkgs/by-name/li/libu2f-emu/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  openssl,
+}:
+
+stdenv.mkDerivation {
+  pname = "libu2f-emu";
+  version = "0-unstable-2020-09-04";
+
+  src = fetchFromGitHub {
+    owner = "Agnoctopus";
+    repo = "libu2f-emu";
+    rev = "d1c4b9c2e1c42e8931033912c8b609521f2a7756";
+    hash = "sha256-kDAXA/v2nb/QAiJpGs0rTjm0t6CdbonTwHHoYhDQExE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  postPatch = ''
+    # Upstream meson.build uses error() instead of warning() for missing
+    # doxygen/dot, which fails the configure.
+    substituteInPlace meson.build \
+      --replace-fail "error('Skip doc:" "warning('Skip doc:" \
+      --replace-fail "error('Skip dot in doc:" "warning('Skip dot in doc:"
+
+    # Fix header guard typo: TRANSaCTION_H -> TRANSACTION_H
+    substituteInPlace src/usb/transaction.h \
+      --replace-fail "define TRANSaCTION_H" "define TRANSACTION_H"
+
+    # Install headers into a u2f-emu/ subdirectory so consumers can
+    # use #include <u2f-emu/u2f-emu.h> (expected by QEMU).
+    substituteInPlace src/meson.build \
+      --replace-fail "install_headers(u2f_emu_headers)" \
+                     "install_headers(u2f_emu_headers, subdir: 'u2f-emu')"
+  '';
+
+  # Disable -Werror: upstream uses OpenSSL EC_KEY APIs deprecated since 3.0.
+  mesonFlags = [ "--warnlevel=2" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  meta = {
+    description = "Universal 2nd Factor (U2F) Emulation C Library";
+    homepage = "https://github.com/Agnoctopus/libu2f-emu";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ philiptaron ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/mi/mihomo/package.nix
+++ b/pkgs/by-name/mi/mihomo/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "mihomo";
-  version = "1.19.21";
+  version = "1.19.22";

  src = fetchFromGitHub {
    owner = "MetaCubeX";
    repo = "mihomo";
    rev = "v${version}";
-    hash = "sha256-vNWnGLVbwsyD0DqOXe1dfUy/Mym+YhBzGlrZrgZ3RuE=";
+    hash = "sha256-HRFtKx9g7AsBPl3HlOf+2giDc6a7e4YmQZlg4hElfdI=";
  };

-  vendorHash = "sha256-yj+vCpwyyyw0++V1UHxzV8j1tZ+Jc65eilyef9UShZQ=";
+  vendorHash = "sha256-K5lC6bvetwaXvufa+FU+noXWXBem/IZ1pkl2eLo7vTc=";

  excludedPackages = [ "./test" ];

--- a/pkgs/by-name/mk/mktorrent/package.nix
+++ b/pkgs/by-name/mk/mktorrent/package.nix
@@ -33,7 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/pobrn/mktorrent/wiki";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
-      Profpatsch
      winter
    ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/mp/mpv/scripts/convert.nix
+++ b/pkgs/by-name/mp/mpv/scripts/convert.nix
@@ -38,7 +38,7 @@ buildLua {
  meta = {
    description = "Convert parts of a video while you are watching it in mpv";
    homepage = "https://gist.github.com/Zehkul/25ea7ae77b30af959be0";
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    longDescription = ''
      When this script is loaded into mpv, you can hit Alt+W to mark the beginning
      and Alt+W again to mark the end of the clip. Then a settings window opens.
--- a/pkgs/by-name/mu/mustache-spec/package.nix
+++ b/pkgs/by-name/mu/mustache-spec/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {

    homepage = "http://mustache.github.io/";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/mu/muvm/package.nix
+++ b/pkgs/by-name/mu/muvm/package.nix
@@ -52,16 +52,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "muvm";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "AsahiLinux";
    repo = "muvm";
    tag = "muvm-${finalAttrs.version}";
-    hash = "sha256-k3Jj/Tzu5ZfnADMiVG7pAPqosrkZvhmehi0NMbyudN0=";
+    hash = "sha256-eXsU2QRJ55gx5RhjT+m9F1KAFqGrd4WwnyR3eMpuIc4=";
  };

-  cargoHash = "sha256-jFNyQD2Hf1K5+wHDRD2WG70IJfZbL+hT/gtjeUnt5Mk=";
+  cargoHash = "sha256-OP44LRMN4Lp9LaXQ8Oa8B4LRTqlMyaTa0xKn4eoh1LQ=";

  postPatch = ''
    substituteInPlace crates/muvm/src/guest/bin/muvm-guest.rs \
--- a/pkgs/by-name/ne/nettee/package.nix
+++ b/pkgs/by-name/ne/nettee/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://sourceforge.net/projects/nettee";
    description = ''Network "tee" program'';
    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
    mainProgram = "nettee";
  };
--- a/pkgs/by-name/nf/nfpm/package.nix
+++ b/pkgs/by-name/nf/nfpm/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "nfpm";
-  version = "2.45.2";
+  version = "2.46.0";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = "nfpm";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-MzxN4oQFmhnuR8T5wa5AGKjL+LhlTSBd2tGVf9WsCBc=";
+    hash = "sha256-dzgC8SnGsKdW95xyq7pXacBvCTrte6QQCjYvo5R4D9I=";
  };

-  vendorHash = "sha256-cq0pcbC0T3klh3D9l0e0u5JPYv1kWYlpeNYyGczGX+A=";
+  vendorHash = "sha256-HfqPqGpwInTrGjTCA4qJjtngJTCmb+c/sJ1Uhi/CCZ0=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-ncffAF1gEsCMeUszgqZExTSYRPkZ6em85S9thM1U3Sc=";
+    hash = "sha256-IxPsm361gYdYWDy16vai5JsmJ5NWUSIRQ9k2Qnwi2K8=";
  };

  vendorHash = "sha256-snrOKwD4xbMTdjP13KLTVVB7ikXG+yHS8QT60/tHZ3I=";
--- a/pkgs/tools/networking/ebpf-verifier/default.nix
+++ b/pkgs/tools/networking/ebpf-verifier/default.nix
@@ -4,28 +4,30 @@
  fetchFromGitHub,
  boost,
  cmake,
-  catch2,
+  catch2_3,
+  microsoft-gsl,
  pkg-config,
  replaceVars,
  yaml-cpp,
 }:

-stdenv.mkDerivation {
-  pname = "ebpf-verifier";
-  version = "unstable-2023-07-15";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prevail";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "vbpf";
-    repo = "ebpf-verifier";
-    rev = "de14d3aa3cd2845b621faf32b599766a66e158cf";
+    repo = "prevail";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-gnxB8ZLbTyIYpd61T57LPKFm1MHufeVEq/qN9pu2Vpk=";
+    hash = "sha256-qlQSoz9GE2Z2rzmrPIj+HnIQmNxiBSgvR40FR9psuDc=";
  };

  patches = [
    (replaceVars ./remove-fetchcontent-usage.patch {
      # We will download them instead of cmake's fetchContent
-      catch2Src = catch2.src;
+      catch2Src = catch2_3.src;
+      gslSrc = microsoft-gsl.src;
    })
  ];

@@ -39,21 +41,35 @@ stdenv.mkDerivation {
    yaml-cpp
  ];

+  cmakeFlags = [
+    (lib.cmakeBool "prevail_ENABLE_TESTS" finalAttrs.doCheck)
+  ];
+
  installPhase = ''
    runHook preInstall

    mkdir -p $out/bin
-    cp ../check $out/bin/ebpf-verifier
+    cp ../bin/prevail $out/bin/prevail

    runHook postInstall
  '';

+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    pushd ..
+    bin/tests
+    popd
+    runHook postCheck
+  '';
+
  meta = {
    description = "eBPF verifier based on abstract interpretation";
-    homepage = "https://github.com/vbpf/ebpf-verifier";
+    homepage = "https://github.com/vbpf/prevail";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
    maintainers = [ ];
-    mainProgram = "ebpf-verifier";
+    mainProgram = "prevail";
  };
-}
+})
--- a/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch
+++ b/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch
@@ -0,0 +1,25 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -75,9 +75,7 @@
+ endif ()
+ 
+ FetchContent_Declare(GSL
+-  GIT_REPOSITORY "https://github.com/microsoft/GSL"
+-  GIT_TAG "v4.2.0"
+-  GIT_SHALLOW ON
+  SOURCE_DIR "@gslSrc@"
+ )
+ set(GSL_INSTALL ON CACHE BOOL "Force GSL install to vendor it with prevail" FORCE)
+ set(GSL_TEST OFF CACHE BOOL "Skip GSL tests when building as a dependency" FORCE)
+@@ -196,9 +194,7 @@
+ # Tests
+ if (prevail_ENABLE_TESTS)
+   FetchContent_Declare(Catch2
+-    GIT_REPOSITORY "https://github.com/catchorg/Catch2.git"
+-    GIT_TAG "v3.13.0"
+-    GIT_SHALLOW ON
+    SOURCE_DIR "@catch2Src@"
+   )
+   FetchContent_MakeAvailable(Catch2)
+ 
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -92,6 +92,8 @@
  fuse3,
  canokeySupport ? false,
  canokey-qemu,
+  u2fEmuSupport ? false,
+  libu2f-emu,
  capstoneSupport ? !minimal,
  capstone,
  valgrindSupport ? false,
@@ -245,6 +247,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals uringSupport [ liburing ]
  ++ lib.optionals fuseSupport [ fuse3 ]
  ++ lib.optionals canokeySupport [ canokey-qemu ]
+  ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
  ++ lib.optionals capstoneSupport [ capstone ]
  ++ lib.optionals valgrindSupport [ valgrind-light ];

@@ -329,6 +332,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional uringSupport "--enable-linux-io-uring"
  ++ lib.optional fuseSupport "--enable-fuse"
  ++ lib.optional canokeySupport "--enable-canokey"
+  ++ lib.optional u2fEmuSupport "--enable-u2f"
  ++ lib.optional capstoneSupport "--enable-capstone"
  ++ lib.optional (!pluginsSupport) "--disable-plugins"
  ++ lib.optional (!enableBlobs) "--disable-install-blobs"
--- a/pkgs/by-name/se/sealcurses/package.nix
+++ b/pkgs/by-name/se/sealcurses/package.nix
@@ -10,14 +10,14 @@

 stdenv.mkDerivation {
  pname = "sealcurses";
-  version = "0-unstable-2024-12-02"; # No release yet
+  version = "0-unstable-2026-03-22"; # No release yet

  src = fetchFromGitea {
    domain = "git.skyjake.fi";
    owner = "skyjake";
    repo = "sealcurses";
-    rev = "310348a6b88678a47d371c7edfcc1e8c76ca1677";
-    hash = "sha256-SEK3w6pVrYi+h2l5RuULpORYPnm8H78lEVR01cMkku0=";
+    rev = "35c2e0332301f7aa14d3a849b30a844d65fa81bd";
+    hash = "sha256-ILskZo5BNw4JK6n0ig2ULkUI7k9mdPjuk4VVEB7jx8c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/se/secrethound/package.nix
+++ b/pkgs/by-name/se/secrethound/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "secrethound";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "rafabd1";
    repo = "SecretHound";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-TyN7byX4rkRXrKzcx/u/LYNqVRBue2YNJRnkF+f34jQ=";
+    hash = "sha256-mZ2rZMjNKLJ+AQQlEGUwgSpIAhqbHG53wUNDIEtJXwI=";
  };

  vendorHash = "sha256-oTyI3/+evDTzyH+BjfSP0A1r2bYVAMxtWRsg0G1d2zQ=";
--- a/pkgs/by-name/se/sem/package.nix
+++ b/pkgs/by-name/se/sem/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "sem";
-  version = "0.33.0";
+  version = "0.33.1";

  src = fetchFromGitHub {
    owner = "semaphoreci";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-sWj0eenqZBanHO2E047Jd0MlphgzszvD+1ZsMFHiQ00=";
+    sha256 = "sha256-+MNl+JOpC3FgzWBVybTDqV6VE4cdBafQ77IYcXO4j48=";
  };

  vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
--- a/pkgs/by-name/sh/shelfmark-frontend/package.nix
+++ b/pkgs/by-name/sh/shelfmark-frontend/package.nix
@@ -9,7 +9,7 @@ buildNpmPackage (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/src/frontend";

-  npmDepsHash = "sha256-RAzotFGj0FGpfF7iyB5f2fdKFvMLcpJx142yplRwboU=";
+  npmDepsHash = "sha256-VCnxEcaqWo31oIpF6X8Lid4I/aaQCQZ9l9rV6TTqXPI=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/by-name/sh/shelfmark/package.nix
+++ b/pkgs/by-name/sh/shelfmark/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "shelfmark";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "calibrain";
    repo = "shelfmark";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-t4t7je7Y/aezx/EX7paJIcsCq5qyZeU/+mPLeZ8oTPg=";
+    hash = "sha256-Fe7zu51gFG2QgcBWcGkFi64CdZW4ohZg+7jdmeMFVLI=";
  };

  nativeBuildInputs = [
@@ -90,7 +90,10 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/calibrain/shelfmark";
    changelog = "https://github.com/calibrain/shelfmark/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
+    maintainers = with lib.maintainers; [
+      jamiemagee
+      pyrox0
+    ];
    mainProgram = "shelfmark";
  };
 })
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "signalbackup-tools";
-  version = "20260306";
+  version = "20260325";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    tag = finalAttrs.version;
-    hash = "sha256-mGJkkE+sT+FKd2tSAXcmDAmKbsE9H9k5IyQbzxJcvjY=";
+    hash = "sha256-5Tb9bY0sZvCUlYkGpmu6hVi7EOEMaygEH9x3tbyo2T4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "siyuan";
-  version = "3.6.1";
+  version = "3.6.2";

  src = fetchFromGitHub {
    owner = "siyuan-note";
    repo = "siyuan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Qsqg6WKfpPOZwvH6aFcDVjIAJcBckClqE/1g92JvR2M=";
+    hash = "sha256-2OBTX4Lh3dx7NbuWsvyB4FzXk6ywDcp6LswhlRlBjCI=";
  };

  kernel = buildGoModule {
    name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
    inherit (finalAttrs) src;
    sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-R+/njKBraRPgWLnhBXy969ILA/fn0wyq6OkYgJnS1WM=";
+    vendorHash = "sha256-EfGCeVsD4yYUBEkSCbRdmMitZfJmQffcbScKaAOX+0o=";

    patches = [
      (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm_9;
    fetcherVersion = 3;
-    hash = "sha256-N/LKkE0I6sIiO0+wGvPZMgaWKUPcq7Gjpsw5Oj9cvqI=";
+    hash = "sha256-HKAK0XwudDuMk/1l6FH1h/FS0xUhzE0s37tpXDdtMU4=";
  };

  sourceRoot = "${finalAttrs.src.name}/app";
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stevenblack-blocklist";
-  version = "3.16.69";
+  version = "3.16.72";

  src = fetchFromGitHub {
    owner = "StevenBlack";
    repo = "hosts";
    tag = finalAttrs.version;
-    hash = "sha256-OSN3K2lSag5aA58UmfI1JMvmksuEVwlT7TOeBOsEmX8=";
+    hash = "sha256-4jL8uNtLxjFObsp34uYAdPinNHZEcLk+wQ9Dg2wGxgk=";
  };

  outputs = [
--- a/pkgs/by-name/ta/tagtime/package.nix
+++ b/pkgs/by-name/ta/tagtime/package.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation {
    '';
    homepage = "https://messymatters.com/tagtime/";
    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    mainProgram = "tagtimed";
  };
 }
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "tanka";
-  version = "0.36.3";
+  version = "0.36.4";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "tanka";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ukWPmOEFOMnjwqTy9GkA8+WF3ItXUUvuh8EdKngLlT8=";
+    sha256 = "sha256-t40sGSXKb7Q0WvMl4D7J59FurbkGRX8PHA34WM2Hnwk=";
  };

-  vendorHash = "sha256-nO0nv7tpUovtooeCr6zFA2mgCvuaLszrjU0EpcMMRmE=";
+  vendorHash = "sha256-4Ojuu4Jv++yh/wbJATdd/uozFb9gDVv3nD64Iy5EjQQ=";

  doCheck = false;
  # Required for versions >= 0.28 as they introduce a gowork.sum file. This is only used for tests so we can safely disable GOWORK
--- a/pkgs/by-name/ta/tar2ext4/package.nix
+++ b/pkgs/by-name/ta/tar2ext4/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "tar2ext4";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "hcsshim";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-/ImyicXRBGclnUEpqygNYhknFYJmRqBqKkz/gNxVLWQ=";
+    sha256 = "sha256-8FPEGQ6DBYYnT6mIjYmSTRfHMloS42oB8xPU5wmFLwI=";
  };

  sourceRoot = "${finalAttrs.src.name}/cmd/tar2ext4";
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -82,7 +82,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
      diogotcorreia
-      Profpatsch
    ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/we/webeep-sync/package.nix
+++ b/pkgs/by-name/we/webeep-sync/package.nix
@@ -0,0 +1,125 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  writableTmpDirAsHomeHook,
+  makeWrapper,
+  electron,
+  nodejs,
+  zip,
+  makeDesktopItem,
+  copyDesktopItems,
+  lib,
+  nix-update-script,
+  withDebug ? false,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "webeep-sync";
+  version = "1.0.3-unstable-2026-03-24";
+
+  src = fetchFromGitHub {
+    owner = "toto04";
+    repo = "webeep-sync";
+    rev = "eabae4471b32660358c8bf95a985473f145d160a";
+    hash = "sha256-wQUNhuhuARLJG0ZYRVpIAgUIbYDFTLC3sRH762HOmBY=";
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpm_10
+    writableTmpDirAsHomeHook
+    makeWrapper
+    nodejs
+    zip
+    electron
+    copyDesktopItems
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-IuI1asHqq2n1/hqf1NlRUG5/GU7HTLKCjalNooyPcO4=";
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+  };
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  patches = [ ./workspace.patch ]; # TODO: waiting for PR https://github.com/toto04/webeep-sync/pull/138
+
+  preBuild = ''
+    # create the electron archive to be used by electron-packager
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
+    zip -0Xqr ../electron.zip .
+    popd
+
+    rm -r electron-dist
+
+    # force @electron/packager to use our electron instead of downloading it
+    substituteInPlace node_modules/.pnpm/@electron+packager@*/node_modules/@electron/packager/dist/packager.js \
+      --replace-fail "await this.getElectronZipPath(downloadOpts)" "'$(pwd)/electron.zip'"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    pnpm config set node-linker hoisted
+    pnpm run package | cat
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    ${lib.optionalString (!withDebug) ''
+      find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
+    ''}
+
+    rm -rf node_modules/.pnpm/{*electron*,*typescript*,prettier*,eslint*,@babel*,react-icons*}
+    # remove symlinks to the previously deleted packages
+    find node_modules packages/**/node_modules -xtype l -delete
+
+    mkdir -p $out/lib/node_modules/${finalAttrs.pname}
+    cp -r .webpack node_modules $out/lib/node_modules/${finalAttrs.pname}/
+
+    makeWrapper ${electron}/bin/electron $out/bin/${finalAttrs.pname} \
+      ${lib.optionalString withDebug ''--set NODE_OPTIONS "--enable-source-maps"''} \
+      --add-flags "$out/lib/node_modules/${finalAttrs.pname}/.webpack/x64/main/index.js" \
+      --add-flags "--user-data-dir=\$HOME/.config/${finalAttrs.pname}"
+
+    for size in 32 48 64 72 96 128 256; do
+      install -Dm644 static/icons/icon-$size"x"$size.png \
+        $out/share/icons/hicolor/$size"x"$size/apps/${finalAttrs.pname}.png
+    done
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = finalAttrs.pname;
+      exec = finalAttrs.pname;
+      icon = finalAttrs.pname; # Matches the PNG name we installed earlier
+      desktopName = "WeBeep Sync";
+      comment = finalAttrs.meta.description;
+      categories = [ "Education" ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Keep all your WeBeep files synced on your computer";
+    homepage = "https://github.com/toto04/webeep-sync";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.lnk3 ];
+    mainProgram = "webeep-sync";
+  };
+})
--- a/pkgs/by-name/we/webeep-sync/workspace.patch
+++ b/pkgs/by-name/we/webeep-sync/workspace.patch
@@ -0,0 +1,8 @@
+--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
+@@ -1,3 +1,5 @@
+packages:
+  - '.'
+ allowBuilds:
+   '@parcel/watcher': true
+   electron: true
--- a/pkgs/by-name/yj/yj/package.nix
+++ b/pkgs/by-name/yj/yj/package.nix
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    description = "Convert YAML <=> TOML <=> JSON <=> HCL";
    license = lib.licenses.asl20;
    mainProgram = "yj";
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
    homepage = "https://github.com/sclevine/yj";
  };
 })
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "zigbee2mqtt";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "Koenkk";
    repo = "zigbee2mqtt";
    tag = finalAttrs.version;
-    hash = "sha256-PsgQ1/h9YCQNV58PB7o3CQyfuOXzU878I9qIfozX02w=";
+    hash = "sha256-LdrsHOeRXeNccpf1UNg20y82M75PGt070zVbmQYYsVg=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_9;
    fetcherVersion = 1;
-    hash = "sha256-MM184JsFVGqOALyQjCyR3QnHqHoQr39lnodq5v4cXAQ=";
+    hash = "sha256-8ioe9/gSI9u9ehrnj3L1j+vPS9p+nJGs2d8TdZTEsk4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -27,13 +27,13 @@ let
  nodejs = nodejs_22;

  pname = "zotero";
-  version = "8.0.3";
+  version = "8.0.5";

  src = fetchFromGitHub {
    owner = "zotero";
    repo = "zotero";
    tag = version;
-    hash = "sha256-I6s6m8CG1b1BXQK2qIdOqmsNyxzwj3fAfFFuHK7t6ec=";
+    hash = "sha256-Amk2ehdzrQjFhx1eEHcnq+Z+un+2bT/u4kpbWqD5Sbc=";
    fetchSubmodules = true;
  };

@@ -326,6 +326,7 @@ buildNpmPackage (finalAttrs: {
  meta = {
    homepage = "https://www.zotero.org";
    description = "Collect, organize, cite, and share your research sources";
+    changelog = "https://www.zotero.org/support/changelog";
    mainProgram = "zotero";
    license = lib.licenses.agpl3Only;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -393,8 +393,6 @@ package-maintainers:
    - cornelis
  poscat:
    - hinit
-  Profpatsch:
-    - gitit
  psibi:
    - path-pieces
    - persistent
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -276513,7 +276513,6 @@ self: {
      description = "Wiki using happstack, git or darcs, and pandoc";
      license = "GPL";
      maintainers = [
-        lib.maintainers.Profpatsch
        lib.maintainers.sternenseemann
      ];
    }
--- a/pkgs/development/interpreters/elixir/1.20.nix
+++ b/pkgs/development/interpreters/elixir/1.20.nix
@@ -1,7 +1,7 @@
 import ./generic-builder.nix {
-  version = "1.20.0-rc.3";
-  hash = "sha256-n0Y9HHb3sppliLMADUiNZKsNStghH8WwsOsjYzIzNoU=";
-  # https://hexdocs.pm/elixir/1.20.0-rc.2/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
-  minimumOTPVersion = "26";
-  maximumOTPVersion = "28";
+  version = "1.20.0-rc.4";
+  hash = "sha256-sboB+GW3T+t9gEcOGtd6NllmIlyWio1+cgWyyxE+484=";
+  # https://hexdocs.pm/elixir/1.20.0-rc.4/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
+  minimumOTPVersion = "27";
+  maximumOTPVersion = "29";
 }
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
  pname = "mesa";
-  version = "26.0.3";
+  version = "26.0.4";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "mesa";
    repo = "mesa";
    rev = "mesa-${version}";
-    hash = "sha256-CTOnJKsx9hDtLhDnuJSGc/lBQ2ZcDm3/Iie7awusGho=";
+    hash = "sha256-gsrqhFCxZRrTbA5MMWARrN6lFVp4Q3D5Jz7MDYbXznY=";
  };

  meta = {
--- a/pkgs/development/python-modules/azure-kusto-ingest/default.nix
+++ b/pkgs/development/python-modules/azure-kusto-ingest/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "azure-kusto-ingest";
-  version = "6.0.2";
+  version = "6.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-kusto-python";
    tag = "v${version}";
-    hash = "sha256-jg8VueMohp7z45va5Z+cF0Hz+RMW4Vd5AchJX/wngLc=";
+    hash = "sha256-n69KpWZpAVMjr7d1QRQ/J/SgeTLkadJUhCgD62F6O7w=";
  };

  sourceRoot = "${src.name}/${pname}";
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -12,13 +12,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "google-cloud-org-policy";
-  version = "1.16.1";
+  version = "1.17.0";
  pyproject = true;

  src = fetchPypi {
    pname = "google_cloud_org_policy";
    inherit (finalAttrs) version;
-    hash = "sha256-KleKj6JhG4pi/XAM82C/VndJED2nvK1+NzvT1lm7zpE=";
+    hash = "sha256-93GJ7n9loo83VfhV9xC4tnuYYuKmtqk7B15vnak7/yA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -13,13 +13,13 @@

 buildPythonPackage rec {
  pname = "google-cloud-securitycenter";
-  version = "1.42.0";
+  version = "1.44.0";
  pyproject = true;

  src = fetchPypi {
    pname = "google_cloud_securitycenter";
    inherit version;
-    hash = "sha256-zwCV0I0vBIgvVRXG31JX8M00u8mzXGMCw/5QpEMKa+Q=";
+    hash = "sha256-ir0rdSUREsfGTyR8YbSWbpDd1GxYOZ2hj8f7jwTmVsc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "google-cloud-videointelligence";
-  version = "2.18.0";
+  version = "2.19.0";
  pyproject = true;

  src = fetchPypi {
    pname = "google_cloud_videointelligence";
    inherit version;
-    hash = "sha256-sq45vSLRhiGGhKKXwvovpjblh05p059xlQTXKfRGOf0=";
+    hash = "sha256-ezIMGKBHWwjd6bYKD7/fiRUyDCCWYVn62AtVlAidVh4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/iapws/default.nix
+++ b/pkgs/development/python-modules/iapws/default.nix
@@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "iapws";
-  version = "1.5.4";
+  version = "1.5.5";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-nw+qOaln12/F5flfYdki4TVFMZLgK/h10HJC8T1uqlU=";
+    hash = "sha256-yG4eFxVRh3/pzrA+5BXkpJBtLlJpj/nVZWeEYJc5300=";
  };

  propagatedBuildInputs = [ scipy ];
--- a/pkgs/development/python-modules/json-stream/default.nix
+++ b/pkgs/development/python-modules/json-stream/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "json-stream";
-  version = "2.4.1";
+  version = "2.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "daggaz";
    repo = "json-stream";
    tag = "v${version}";
-    hash = "sha256-oZYVRgDSl15/UJmhTAoLk3UoVimQeLGNOjNXLH6GTtY=";
+    hash = "sha256-iSJY53VImv9GSIC2IB969zzYYNg7gFKJH8QQFpjzrQU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/karton-dashboard/default.nix
+++ b/pkgs/development/python-modules/karton-dashboard/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "karton-dashboard";
-  version = "1.6.0";
+  version = "1.7.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = "karton-dashboard";
    tag = "v${version}";
-    hash = "sha256-VzBC7IATF8QBtTXMv4vmorAzBlImEsayjenQ2Uz5jIo=";
+    hash = "sha256-DYfL//i1gJ0ci7jVPtrMKC8j+i5/L8rvmbs8zz6Eq2M=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "llama-index-llms-ollama";
-  version = "0.10.0";
+  version = "0.10.1";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_llms_ollama";
    inherit version;
-    hash = "sha256-dYJnOyDpAoiJg3LcqxfrT4E9WWSGW5DQdFs/CrOMbtQ=";
+    hash = "sha256-Rw7YNt7kO8AXHcBcaMLao2GKfDgWa4BE1/g2DNjNj6Y=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/llm/default.nix
+++ b/pkgs/development/python-modules/llm/default.nix
@@ -167,7 +167,7 @@ let

  llm = buildPythonPackage rec {
    pname = "llm";
-    version = "0.29";
+    version = "0.30";
    pyproject = true;

    build-system = [ setuptools ];
@@ -176,7 +176,7 @@ let
      owner = "simonw";
      repo = "llm";
      tag = version;
-      hash = "sha256-51WHV8ZvyUJgr+a3jFUoZ2hPlv2oiA4rrgalqZEFIfM=";
+      hash = "sha256-+8fwx7sS1vFSTqb+p2uDLqWW/UIx8WoW3kYJihznRRg=";
    };

    patches = [
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@@ -16,13 +16,13 @@

 buildPythonPackage rec {
  pname = "mkdocs-jupyter";
-  version = "0.25.1";
+  version = "0.26.1";
  pyproject = true;

  src = fetchPypi {
    pname = "mkdocs_jupyter";
    inherit version;
-    hash = "sha256-DpJy/0lH4OxoPJJCOkv7QqJkd8EDqxpquCd+LcyPev4=";
+    hash = "sha256-fIDA05U96R5bQKDTIJIzeVyPgAJDqymOTsOOBQTtpjA=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/mlx-lm/default.nix
+++ b/pkgs/development/python-modules/mlx-lm/default.nix
@@ -79,6 +79,12 @@ buildPythonPackage (finalAttrs: {
    "tests/test_models.py::TestModels::test_gated_delta_masked"
  ];

+  disabledTests = [
+    # ValueError: [rope] dims must be positive but got 0
+    # Reported upstream: https://github.com/ml-explore/mlx-lm/issues/1089
+    "test_all_models"
+  ];
+
  meta = {
    description = "Run LLMs with MLX";
    homepage = "https://github.com/ml-explore/mlx-lm";
--- a/pkgs/development/python-modules/mlx-vlm/default.nix
+++ b/pkgs/development/python-modules/mlx-vlm/default.nix
@@ -9,13 +9,13 @@
  # dependencies
  datasets,
  fastapi,
+  miniaudio,
  mlx,
  mlx-lm,
  numpy,
  opencv-python,
  pillow,
  requests,
-  soundfile,
  tqdm,
  transformers,
  uvicorn,
@@ -26,35 +26,32 @@
  rich,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "mlx-vlm";
-  version = "0.3.9";
+  version = "0.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Blaizzy";
    repo = "mlx-vlm";
-    tag = "v${version}";
-    hash = "sha256-L+llrfFo4C++JZ3GjpZi16wMZNXtKrYh3pxhZ5N1n/4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GmeMcANmztICfYR9Ca5wQfLOugOlK1mt5j3q616n6TQ=";
  };

  build-system = [
    setuptools
  ];

-  pythonRelaxDeps = [
-    "opencv-python"
-  ];
  dependencies = [
    datasets
    fastapi
+    miniaudio
    mlx
    mlx-lm
    numpy
    opencv-python
    pillow
    requests
-    soundfile
    tqdm
    transformers
    uvicorn
@@ -91,11 +88,11 @@ buildPythonPackage rec {
  meta = {
    description = "Inference and fine-tuning of Vision Language Models (VLMs) on your Mac using MLX";
    homepage = "https://github.com/Blaizzy/mlx-vlm";
-    changelog = "https://github.com/Blaizzy/mlx-vlm/releases/tag/${src.tag}";
+    changelog = "https://github.com/Blaizzy/mlx-vlm/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ GaetanLepage ];
    platforms = [
      "aarch64-darwin"
    ];
  };
-}
+})
--- a/pkgs/development/python-modules/mlx/default.nix
+++ b/pkgs/development/python-modules/mlx/default.nix
@@ -33,6 +33,7 @@ let
  gguf-tools = fetchFromGitHub {
    owner = "antirez";
    repo = "gguf-tools";
+    # Tag from https://github.com/ml-explore/mlx/blob/v0.31.1/mlx/io/CMakeLists.txt#L14
    rev = "8fa6eb65236618e28fd7710a0fba565f7faa1848";
    hash = "sha256-15FvyPOFqTOr5vdWQoPnZz+mYH919++EtghjozDlnSA=";
  };
@@ -40,14 +41,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "mlx";
-  version = "0.30.5";
+  version = "0.31.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ml-explore";
    repo = "mlx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SV/3MXt+SuJ69XfLfXycold6KgtXSM7OE0KwMSNw+eE=";
+    hash = "sha256-PiNk/MdMw9Vpat2KuslBTyaFuK+mJ4UvwJqBnysvvUU=";
  };

  patches = [
--- a/pkgs/development/python-modules/modal/default.nix
+++ b/pkgs/development/python-modules/modal/default.nix
@@ -38,14 +38,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "modal";
-  version = "1.3.5";
+  version = "1.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "modal-labs";
    repo = "modal-client";
    tag = "py/v${finalAttrs.version}";
-    hash = "sha256-DjCEnQ+H03Ga0My2qHGEEF4Ae5HnmlWNvwL+jLdo0pg=";
+    hash = "sha256-Ol6KYncP1F9EHbcyJmScuBwev79/vxrKWlO/ZkoxOhQ=";
  };
  sourceRoot = "${finalAttrs.src.name}/py";

--- a/pkgs/development/python-modules/napari-console/default.nix
+++ b/pkgs/development/python-modules/napari-console/default.nix
@@ -14,7 +14,7 @@
  qtpy,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "napari-console";
  version = "0.1.4";
  pyproject = true;
@@ -22,7 +22,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "napari";
    repo = "napari-console";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-z1pyG31g+fvTNLbWc2W56zDf33HCx8PvPKwIIc/x2VA=";
  };

@@ -31,6 +31,9 @@ buildPythonPackage rec {
    setuptools-scm
  ];

+  pythonRelaxDeps = [
+    "ipykernel"
+  ];
  dependencies = [
    ipykernel
    ipython
@@ -47,4 +50,4 @@ buildPythonPackage rec {
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ SomeoneSerge ];
  };
-}
+})
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@@ -15,6 +15,7 @@
  pydantic-extra-types,
  pyyaml,
  rich,
+  tomli,
  tomli-w,
  typer,

@@ -33,14 +34,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "napari-npe2";
-  version = "0.8.0";
+  version = "0.8.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "napari";
    repo = "npe2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aZOs9wTYcblt9EZftYHKFWI/GvpZcC2KqVTAis15+Iw=";
+    hash = "sha256-cR7hf5v+RgcENY3rSHnOB4E/TONVYvHKS5i3Kv1Sbuc=";
  };

  build-system = [
@@ -56,6 +57,7 @@ buildPythonPackage (finalAttrs: {
    pydantic-extra-types
    pyyaml
    rich
+    tomli
    tomli-w
    typer
  ];
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -1,7 +1,6 @@
 {
  lib,
  buildPythonPackage,
-  pythonAtLeast,
  fetchFromGitHub,

  # build-system
@@ -24,12 +23,13 @@
  napari-console,
  napari-npe2,
  napari-svg,
-  numpydoc,
  pandas,
  pillow,
  pint,
  psutil,
  pydantic,
+  pydantic-extra-types,
+  pydantic-settings,
  pyopengl,
  pyyaml,
  scikit-image,
@@ -44,6 +44,7 @@

  # tests
  hypothesis,
+  pooch,
  pretend,
  pyautogui,
  pytest-pretty,
@@ -56,18 +57,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "napari";
-  version = "0.6.6";
+  version = "0.7.0";
  pyproject = true;

-  # napari uses pydantic v1 which is not compatible with python 3.14
-  # ValueError: '__slots__' in __slots__ conflicts with class variable
-  disabled = pythonAtLeast "3.14";
-
  src = fetchFromGitHub {
    owner = "napari";
    repo = "napari";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-F0l6GWyZ6n4HNZW7XyUk4ZBPQfrAW4DWixCaRHViDPI=";
+    hash = "sha256-fDt9n4+yQcA03IO7sMhcpiP3TfOWfyvbCjY7ImEj+Qg=";
  };

  postPatch = ''
@@ -86,11 +83,6 @@ buildPythonPackage (finalAttrs: {
    qt6.qtbase
  ];

-  pythonRelaxDeps = [
-    "app-model"
-    "psygnal"
-    "vispy"
-  ];
  dependencies = [
    app-model
    appdirs
@@ -104,12 +96,13 @@ buildPythonPackage (finalAttrs: {
    napari-console
    napari-npe2
    napari-svg
-    numpydoc
    pandas
    pillow
    pint
    psutil
    pydantic
+    pydantic-extra-types
+    pydantic-settings
    pyopengl
    pyyaml
    scikit-image
@@ -134,6 +127,7 @@ buildPythonPackage (finalAttrs: {

  nativeCheckInputs = [
    hypothesis
+    pooch
    pretend
    pyautogui
    pytest-pretty
@@ -189,6 +183,7 @@ buildPythonPackage (finalAttrs: {
    # Fatal Python error: Aborted
    "test_add_layer_data_to_viewer_optional"
    "test_from_layer_data_tuple_accept_deprecating_dict"
+    "test_layer_rename_updates_combobox"
    "test_layers_populate_immediately"
    "test_magicgui_add_data"
    "test_magicgui_add_future_data"
--- a/pkgs/development/python-modules/ncclient/default.nix
+++ b/pkgs/development/python-modules/ncclient/default.nix
@@ -2,15 +2,16 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
  lxml,
  paramiko,
-  setuptools,
  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "ncclient";
-  version = "0.7.0";
+  version = "0.7.1";
  pyproject = true;

  src = fetchFromGitHub {
@@ -25,11 +26,12 @@ buildPythonPackage rec {
    postFetch = ''
      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/ncclient/_version.py
    '';
-    hash = "sha256-vSX+9nTl4r6vnP/vmavdmdChzOC8P2G093/DQNMQwS4=";
+    hash = "sha256-A1e1YE+RW6mkuhF9eEUPiMiKw3YuHqA+4pNqJpYtAJU=";
  };

  build-system = [
-    setuptools
+    hatchling
+    hatch-vcs
  ];

  dependencies = [
--- a/pkgs/development/python-modules/openfga-sdk/default.nix
+++ b/pkgs/development/python-modules/openfga-sdk/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "openfga-sdk";
-  version = "0.9.9";
+  version = "0.10.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openfga";
    repo = "python-sdk";
    tag = "v${version}";
-    hash = "sha256-bkDeIQJ+5VDMkBDorEMczsN7Ex04SaxhxulXLtUW/CM=";
+    hash = "sha256-yopZJMGv2cVJZsTXqU7vaQN31QOwCW/kg0gghqt6rus=";
  };

  build-system = [ hatchling ];
--- a/Show More
+++ b/Show More