Merge commit '8d0a7d4c0437cc1e5349d3dabde379c5e2a66305' into haskell-updates

lib/customisation.nix

@@ -30,7 +30,6 @@ let
     flatten
     deepSeq
     extends
-    toFunction
     id
     ;
   inherit (lib.strings) levenshtein levenshteinAtMost;
@@ -842,14 +841,6 @@ rec {
     :::
   */
   extendMkDerivation =
-    let
-      extendsWithExclusion =
-        excludedNames: g: f: final:
-        let
-          previous = f final;
-        in
-        removeAttrs previous excludedNames // g final previous;
-    in
     {
       constructDrv,
       excludeDrvArgNames ? [ ],
@@ -858,24 +849,27 @@ rec {
       inheritFunctionArgs ? true,
       transformDrv ? id,
     }:
-    setFunctionArgs
+    {
       # Adds the fixed-point style support
-      (
-        fpargs:
+      __functor =
+        self: fpargs:
         transformDrv (
-          constructDrv (extendsWithExclusion excludeDrvArgNames extendDrvArgs (toFunction fpargs))
-        )
-      )
-      # Add __functionArgs
-      (
-        removeAttrs (
-          # Inherit the __functionArgs from the base build helper
-          optionalAttrs inheritFunctionArgs (removeAttrs (functionArgs constructDrv) excludeDrvArgNames)
-          # Recover the __functionArgs from the derived build helper
-          // functionArgs (extendDrvArgs { })
-        ) excludeFunctionArgNames
-      )
-    // {
+          constructDrv (
+            final:
+            let
+              previous = if isFunction fpargs then fpargs final else fpargs;
+            in
+            removeAttrs previous excludeDrvArgNames // extendDrvArgs final previous
+          )
+        );
+
+      __functionArgs = removeAttrs (
+        # Inherit the __functionArgs from the base build helper
+        optionalAttrs inheritFunctionArgs (removeAttrs (functionArgs constructDrv) excludeDrvArgNames)
+        # Recover the __functionArgs from the derived build helper
+        // functionArgs (extendDrvArgs { })
+      ) excludeFunctionArgNames;
+
       inherit
         # Expose to the result build helper.
         constructDrv

lib/fetchers.nix

@@ -1,16 +1,38 @@
 # snippets that can be shared by multiple fetchers (pkgs/build-support)
 { lib }:
 let
-  commonH = hashTypes: rec {
-    hashNames = [ "hash" ] ++ hashTypes;
-    hashSet = lib.genAttrs hashNames (lib.const { });
-  };
+  commonH =
+    let
+      defaultHashNames = [ "hash" ];
+    in
+    hashTypes: rec {
+      hashNames = defaultHashNames ++ hashTypes;
+      hashSet = genAttrs hashNames (const { });
+    };
 
   fakeH = {
     hash = lib.fakeHash;
     sha256 = lib.fakeSha256;
     sha512 = lib.fakeSha512;
   };
+
+  defaultHashTypes = [ "sha256" ];
+
+  inherit (lib)
+    concatMapStringsSep
+    head
+    length
+    throwIf
+    ;
+  inherit (lib.attrsets)
+    attrsToList
+    intersectAttrs
+    genAttrs
+    removeAttrs
+    optionalAttrs
+    ;
+
+  inherit (lib.trivial) const functionArgs setFunctionArgs;
 in
 rec {
 
@@ -90,27 +112,14 @@ rec {
   */
   normalizeHash =
     {
-      hashTypes ? [ "sha256" ],
+      hashTypes ? defaultHashTypes,
       required ? true,
     }:
     let
-      inherit (lib)
-        concatMapStringsSep
-        head
-        tail
-        throwIf
-        ;
-      inherit (lib.attrsets)
-        attrsToList
-        intersectAttrs
-        removeAttrs
-        optionalAttrs
-        ;
-
       inherit (commonH hashTypes) hashNames hashSet;
     in
     args:
-    if args ? "outputHash" then
+    if args ? outputHash then
       args
     else
       let
@@ -122,7 +131,7 @@ rec {
           in
           if hashesAsNVPairs == [ ] then
             throwIf required "fetcher called without `hash`" null
-          else if tail hashesAsNVPairs != [ ] then
+          else if length hashesAsNVPairs != 1 then
             throw "fetcher called with mutually-incompatible arguments: ${
               concatMapStringsSep ", " (a: a.name) hashesAsNVPairs
             }"
@@ -190,15 +199,20 @@ rec {
     and is implemented somewhat more efficiently.
   */
   withNormalizedHash =
+    let
+      removedAttributes = [
+        "outputHash"
+        "outputHashAlgo"
+      ];
+    in
     {
-      hashTypes ? [ "sha256" ],
+      hashTypes ? defaultHashTypes,
     }:
+    let
+      inherit (commonH hashTypes) hashSet;
+    in
     fetcher:
     let
-      inherit (lib.attrsets) intersectAttrs removeAttrs;
-      inherit (lib.trivial) functionArgs setFunctionArgs;
-
-      inherit (commonH hashTypes) hashSet;
       fArgs = functionArgs fetcher;
 
       normalize = normalizeHash {
@@ -211,10 +225,7 @@ rec {
     assert intersectAttrs fArgs hashSet == { };
 
     setFunctionArgs (args: fetcher (normalize args)) (
-      removeAttrs fArgs [
-        "outputHash"
-        "outputHashAlgo"
-      ]
+      removeAttrs fArgs removedAttributes
       // {
         hash = fArgs.outputHash;
       }

lib/licenses/helpers.nix

@@ -1,4 +1,23 @@
 { lib }:
+
+let
+  inherit (lib) all any elem;
+  handleComplexProperty =
+    evaluateSubProperty: AND: OR: license:
+    if license.licenseType == "compound" then
+      if license.operator == "OR" then
+        OR evaluateSubProperty license.licenses
+      else if license.operator == "AND" then
+        AND evaluateSubProperty license.licenses
+      else
+        throw "Unknown license operator"
+    else if license.licenseType == "exception" then
+      evaluateSubProperty license.license && evaluateSubProperty license.exception
+    else if license.licenseType == "plus" then
+      evaluateSubProperty license.license
+    else
+      throw "Unknown license type or legacy license";
+in
 rec {
   /**
     Evaluate a license expression for a given predicate.
@@ -21,29 +40,45 @@ rec {
     - [license] license expression to check
   */
   evaluateProperty =
-    predicate: permissive: license:
+    predicate: permissive:
     let
-      OR = if permissive then lib.any else lib.all;
-      AND = if permissive then lib.all else lib.any;
+      OR = if permissive then any else all;
+      AND = if permissive then all else any;
+      evaluateComplexProperty = handleComplexProperty (evaluateProperty predicate permissive) AND OR;
     in
-    if license.licenseType == "simple" then
-      predicate license
-    else if license.licenseType == "compound" then
-      if license.operator == "OR" then
-        OR (x: evaluateProperty predicate permissive x) license.licenses
-      else if license.operator == "AND" then
-        AND (x: evaluateProperty predicate permissive x) license.licenses
-      else
-        throw "Unknown license operator"
-    else if license.licenseType == "exception" then
-      AND (x: evaluateProperty predicate permissive x) [
-        license.license
-        license.exception
-      ]
-    else if license.licenseType == "plus" then
-      evaluateProperty predicate permissive license.license
-    else
-      throw "Unknown license type or legacy license";
+    license:
+    if license.licenseType == "simple" then predicate license else evaluateComplexProperty license;
+
+  /**
+    Evaluate a license expression for a given property name. The property must
+    be defined as a boolean attribute of all licenses passed.
+
+    # Example
+
+    ```nix
+    evaluateNamedProperty "deprecated" true (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
+    ```
+    # Type
+
+    ```
+    evaluateProperty :: String -> Bool -> AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [name] name of the attribute to check
+    - [permissive] whether to apply checks permissive or reciprocal
+    - [license] license expression to check
+  */
+  evaluateNamedProperty =
+    name: permissive:
+    let
+      OR = if permissive then any else all;
+      AND = if permissive then all else any;
+      evaluateComplexProperty = handleComplexProperty (evaluateNamedProperty name permissive) AND OR;
+    in
+    license:
+    if license.licenseType == "simple" then license.${name} else evaluateComplexProperty license;
 
   /**
     Check whether a license expression is free.
@@ -65,7 +100,7 @@ rec {
 
     - [license] License expression to check if free
   */
-  isFree = evaluateProperty (x: x.free) true;
+  isFree = evaluateNamedProperty "free" true;
 
   /**
     Check whether a license expression is redistributable.
@@ -87,7 +122,7 @@ rec {
 
     - [license] License expression to check if redistributable
   */
-  isRedistributable = evaluateProperty (x: x.redistributable) true;
+  isRedistributable = evaluateNamedProperty "redistributable" true;
 
   /**
     Check whether any of the given licenses is required in the license expression.
@@ -110,7 +145,7 @@ rec {
     - [licenses] List of licenses to look
     - [license] License expression to check
   */
-  containsLicenses = licenses: evaluateProperty (x: lib.lists.elem x licenses) false;
+  containsLicenses = licenses: evaluateProperty (x: elem x licenses) false;
 
   /**
     Convert a license expression to an SPDX license expression string.

maintainers/maintainer-list.nix

@@ -4852,11 +4852,6 @@
     githubId = 18648043;
     name = "Daniel Cartwright";
   };
-  chewblacka = {
-    github = "chewblacka";
-    githubId = 18430320;
-    name = "John Garcia";
-  };
   Chili-Man = {
     email = "dr.elhombrechile@gmail.com";
     name = "Diego Rodriguez";
@@ -16082,6 +16077,12 @@
     githubId = 83420438;
     name = "Lewis";
   };
+  luc65r = {
+    email = "lucas@ransan.fr";
+    github = "luc65r";
+    githubId = 59375051;
+    name = "Lucas Ransan";
+  };
   LucaGuerra = {
     email = "luca@guerra.sh";
     github = "LucaGuerra";
@@ -19556,6 +19557,11 @@
     githubId = 10180857;
     name = "Anmol Sethi";
   };
+  nhshah15 = {
+    github = "nhshah15";
+    githubId = 31825306;
+    name = "Neil Shah";
+  };
   ni5arga = {
     email = "hello@ni5arga.com";
     github = "ni5arga";
@@ -29383,6 +29389,14 @@
     github = "wamserma";
     githubId = 60148;
   };
+  wanderer = {
+    name = "Martin Becze";
+    email = "martin@becze.org";
+    matrix = "@null_radix:matrix.org";
+    github = "wanderer";
+    githubId = 158211;
+    keys = [ { fingerprint = "82CB 91F4 F3E4 04A5 DAB2  78E8 8B99 1293 8FF2 1020"; } ];
+  };
   wariuccio = {
     name = "Wariuccio";
     github = "wariuccio";
@@ -30489,6 +30503,12 @@
     githubId = 7040031;
     name = "Yannik Sander";
   };
+  ysnt-yes = {
+    name = "Yes";
+    github = "ysnt-yes";
+    githubId = 85800291;
+    email = "yes@ysnt.live";
+  };
   yuannan = {
     email = "brandon@emergence.ltd";
     github = "yuannan";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -23,11 +23,11 @@
     # Pinned Nixpkgs archive
     #
     # Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
-    # latest commit of the stable channel and `nix-prefetch-url --unpack`
-    # to compute its sha256 hash.
+    # latest commit of the stable channel and `nix --extra-experimental-features nix-command store prefetch-file --unpack`
+    # to compute its hash.
     nixpkgs = builtins.fetchTarball {
       url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
-      sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
+      hash = "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=";
     };
   in
   import "${nixpkgs}/nixos" {

nixos/modules/config/system-environment.nix

@@ -11,6 +11,23 @@ let
 
   cfg = config.environment;
 
+  suffixedVariables = lib.flip lib.mapAttrs cfg.profileRelativeSessionVariables (
+    envVar: suffixes:
+    lib.flip lib.concatMap cfg.profiles (profile: map (suffix: "${profile}${suffix}") suffixes)
+  );
+
+  combinedSessionVars = lib.zipAttrsWith (n: lib.concatLists) [
+    # Make sure security wrappers are prioritized without polluting
+    # shell environments with an extra entry. Sessions which depend on
+    # pam for its environment will otherwise have eg. broken sudo. In
+    # particular Gnome Shell sometimes fails to source a proper
+    # environment from a shell.
+    { PATH = [ config.security.wrapperDir ]; }
+
+    (lib.mapAttrs (n: lib.toList) cfg.sessionVariables)
+    suffixedVariables
+  ];
+
 in
 
 {
@@ -73,13 +90,11 @@ in
   };
 
   config = {
+    environment.etc."environment.d/50-systemd-path.conf".text = ''
+      PATH="${lib.concatStringsSep ":" combinedSessionVars.PATH}"
+    '';
     environment.etc."pam/environment".text =
       let
-        suffixedVariables = lib.flip lib.mapAttrs cfg.profileRelativeSessionVariables (
-          envVar: suffixes:
-          lib.flip lib.concatMap cfg.profiles (profile: map (suffix: "${profile}${suffix}") suffixes)
-        );
-
         # We're trying to use the same syntax for PAM variables and env variables.
         # That means we need to map the env variables that people might use to their
         # equivalent PAM variable.
@@ -88,21 +103,7 @@ in
         pamVariable =
           n: v: ''${n}   DEFAULT="${lib.concatStringsSep ":" (map replaceEnvVars (lib.toList v))}"'';
 
-        pamVariables = lib.concatStringsSep "\n" (
-          lib.mapAttrsToList pamVariable (
-            lib.zipAttrsWith (n: lib.concatLists) [
-              # Make sure security wrappers are prioritized without polluting
-              # shell environments with an extra entry. Sessions which depend on
-              # pam for its environment will otherwise have eg. broken sudo. In
-              # particular Gnome Shell sometimes fails to source a proper
-              # environment from a shell.
-              { PATH = [ config.security.wrapperDir ]; }
-
-              (lib.mapAttrs (n: lib.toList) cfg.sessionVariables)
-              suffixedVariables
-            ]
-          )
-        );
+        pamVariables = lib.concatStringsSep "\n" (lib.mapAttrsToList pamVariable combinedSessionVars);
       in
       ''
         ${pamVariables}

nixos/modules/security/wrappers/default.nix

@@ -245,134 +245,156 @@ in
   };
 
   ###### implementation
-  config = lib.mkIf config.security.enableWrappers {
-
-    assertions = lib.mapAttrsToList (name: opts: {
-      assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
-      message = ''
-        The security.wrappers.${name} wrapper is not valid:
-            setuid/setgid and capabilities are mutually exclusive.
+  config = lib.mkMerge [
+    {
+      warnings = lib.optional (wrappers != { } && !config.security.enableWrappers) ''
+        security.enableWrappers is set to false, but the following wrappers are still enabled and will be silently ignored: ${lib.concatStringsSep ", " (lib.attrNames wrappers)}. This might prevent fundamental functionalities, like PAM authentication. To avoid this warning, either set security.enableWrappers = true, or explicitly disable each wrapper with `enable = false`.
       '';
-    }) wrappers;
+      assertions = [
+        {
+          assertion =
+            !(
+              !config.security.enableWrappers && lib.any (u: u.isNormalUser) (lib.attrValues config.users.users)
+            );
+          message = ''
+            security.enableWrappers is disabled but normal users are defined
+            (${
+              lib.concatStringsSep ", " (
+                lib.mapAttrsToList (n: _: n) (lib.filterAttrs (_: u: u.isNormalUser) config.users.users)
+              )
+            }). Without SUID wrappers, users cannot login. Either enable wrappers or remove all normal user accounts.
+          '';
+        }
+      ];
+    }
+    (lib.mkIf config.security.enableWrappers {
+      assertions = lib.mapAttrsToList (name: opts: {
+        assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
+        message = ''
+          The security.wrappers.${name} wrapper is not valid:
+              setuid/setgid and capabilities are mutually exclusive.
+        '';
+      }) wrappers;
 
-    security.wrappers =
-      let
-        mkSetuidRoot = source: {
-          setuid = true;
-          owner = "root";
-          group = "root";
-          inherit source;
+      security.wrappers =
+        let
+          mkSetuidRoot = source: {
+            setuid = true;
+            owner = "root";
+            group = "root";
+            inherit source;
+          };
+        in
+        {
+          # These are mount related wrappers that require the +s permission.
+          mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
+          umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
         };
-      in
-      {
-        # These are mount related wrappers that require the +s permission.
-        mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
-        umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
+
+      # Make sure our wrapperDir exports to the PATH env variable when
+      # initializing the shell
+      environment.extraInit = ''
+        # Wrappers override other bin directories.
+        export PATH="${wrapperDir}:$PATH"
+      '';
+
+      security.apparmor.includes = lib.mapAttrs' (
+        wrapName: wrap:
+        lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
+          include "${
+            pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
+              (securityWrapper wrap.source)
+            ]
+          }"
+          mrpx ${wrap.source},
+        ''
+      ) wrappers;
+
+      systemd.mounts = [
+        {
+          where = parentWrapperDir;
+          what = "tmpfs";
+          type = "tmpfs";
+          options = lib.concatStringsSep "," [
+            "nodev"
+            "mode=755"
+            "size=${config.security.wrapperDirSize}"
+          ];
+        }
+      ];
+
+      systemd.services.suid-sgid-wrappers = {
+        description = "Create SUID/SGID Wrappers";
+        wantedBy = [ "sysinit.target" ];
+        before = [
+          "sysinit.target"
+          "shutdown.target"
+        ];
+        conflicts = [ "shutdown.target" ];
+        after = [ "systemd-sysusers.service" ];
+        unitConfig.DefaultDependencies = false;
+        unitConfig.RequiresMountsFor = [
+          "/nix/store"
+          "/run/wrappers"
+        ];
+        serviceConfig.RestrictSUIDSGID = false;
+        serviceConfig.Type = "oneshot";
+        script = ''
+          chmod 755 "${parentWrapperDir}"
+
+          # We want to place the tmpdirs for the wrappers to the parent dir.
+          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
+          chmod a+rx "$wrapperDir"
+
+          ${lib.concatStringsSep "\n" mkWrappedPrograms}
+
+          if [ -L ${wrapperDir} ]; then
+            # Atomically replace the symlink
+            # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
+            old=$(readlink -f ${wrapperDir})
+            if [ -e "${wrapperDir}-tmp" ]; then
+              rm --force --recursive "${wrapperDir}-tmp"
+            fi
+            ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
+            mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
+            rm --force --recursive "$old"
+          else
+            # For initial setup
+            ln --symbolic "$wrapperDir" "${wrapperDir}"
+          fi
+        '';
       };
 
-    # Make sure our wrapperDir exports to the PATH env variable when
-    # initializing the shell
-    environment.extraInit = ''
-      # Wrappers override other bin directories.
-      export PATH="${wrapperDir}:$PATH"
-    '';
+      ###### wrappers consistency checks
+      system.checks = lib.singleton (
+        pkgs.runCommand "ensure-all-wrappers-paths-exist"
+          {
+            preferLocalBuild = true;
+          }
+          ''
+            # make sure we produce output
+            mkdir -p $out
 
-    security.apparmor.includes = lib.mapAttrs' (
-      wrapName: wrap:
-      lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
-        include "${
-          pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
-            (securityWrapper wrap.source)
-          ]
-        }"
-        mrpx ${wrap.source},
-      ''
-    ) wrappers;
+            echo -n "Checking that Nix store paths of all wrapped programs exist... "
 
-    systemd.mounts = [
-      {
-        where = parentWrapperDir;
-        what = "tmpfs";
-        type = "tmpfs";
-        options = lib.concatStringsSep "," [
-          "nodev"
-          "mode=755"
-          "size=${config.security.wrapperDirSize}"
-        ];
-      }
-    ];
+            declare -A wrappers
+            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
 
-    systemd.services.suid-sgid-wrappers = {
-      description = "Create SUID/SGID Wrappers";
-      wantedBy = [ "sysinit.target" ];
-      before = [
-        "sysinit.target"
-        "shutdown.target"
-      ];
-      conflicts = [ "shutdown.target" ];
-      after = [ "systemd-sysusers.service" ];
-      unitConfig.DefaultDependencies = false;
-      unitConfig.RequiresMountsFor = [
-        "/nix/store"
-        "/run/wrappers"
-      ];
-      serviceConfig.RestrictSUIDSGID = false;
-      serviceConfig.Type = "oneshot";
-      script = ''
-        chmod 755 "${parentWrapperDir}"
+            for name in "''${!wrappers[@]}"; do
+              path="''${wrappers[$name]}"
+              if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
+                test -t 1 && echo -ne '\033[1;31m'
+                echo "FAIL"
+                echo "The path $path does not exist!"
+                echo 'Please, check the value of `security.wrappers."'$name'".source`.'
+                test -t 1 && echo -ne '\033[0m'
+                exit 1
+              fi
+            done
 
-        # We want to place the tmpdirs for the wrappers to the parent dir.
-        wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
-        chmod a+rx "$wrapperDir"
-
-        ${lib.concatStringsSep "\n" mkWrappedPrograms}
-
-        if [ -L ${wrapperDir} ]; then
-          # Atomically replace the symlink
-          # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
-          old=$(readlink -f ${wrapperDir})
-          if [ -e "${wrapperDir}-tmp" ]; then
-            rm --force --recursive "${wrapperDir}-tmp"
-          fi
-          ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
-          mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
-          rm --force --recursive "$old"
-        else
-          # For initial setup
-          ln --symbolic "$wrapperDir" "${wrapperDir}"
-        fi
-      '';
-    };
-
-    ###### wrappers consistency checks
-    system.checks = lib.singleton (
-      pkgs.runCommand "ensure-all-wrappers-paths-exist"
-        {
-          preferLocalBuild = true;
-        }
-        ''
-          # make sure we produce output
-          mkdir -p $out
-
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
-
-          declare -A wrappers
-          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
-
-          for name in "''${!wrappers[@]}"; do
-            path="''${wrappers[$name]}"
-            if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
-              test -t 1 && echo -ne '\033[1;31m'
-              echo "FAIL"
-              echo "The path $path does not exist!"
-              echo 'Please, check the value of `security.wrappers."'$name'".source`.'
-              test -t 1 && echo -ne '\033[0m'
-              exit 1
-            fi
-          done
-
-          echo "OK"
-        ''
-    );
-  };
+            echo "OK"
+          ''
+      );
+    })
+  ];
 }

nixos/modules/services/continuous-integration/radicle/ci-broker.nix

@@ -208,7 +208,7 @@ in
           LoadCredential = config.systemd.services.radicle-node.serviceConfig.LoadCredential or [ ];
 
           BindReadOnlyPaths = config.systemd.services.radicle-node.serviceConfig.BindReadOnlyPaths ++ [
-            "/run/credentials/radicle-ci-broker.service/xyz.radicle.node.secret:/var/lib/radicle/keys/radicle"
+            "/run/credentials/radicle-ci-broker.service/dev.radicle.node.secret:/var/lib/radicle/keys/radicle"
           ];
           ReadWritePaths = [ RAD_HOME ];
 

nixos/modules/services/display-managers/ly.nix

@@ -113,12 +113,12 @@ in
             {
               name = "nologin";
               control = "requisite";
-              modulePath = "pam_nologin.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
             }
             {
               name = "ly-normal-user";
               control = "required";
-              modulePath = "pam_succeed_if.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_succeed_if.so";
               settings.quiet = true;
               args = lib.mkBefore [
                 "uid"
@@ -129,7 +129,7 @@ in
             {
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 

nixos/modules/services/display-managers/plasma-login-manager.nix

@@ -125,12 +125,12 @@ in
             {
               name = "nologin";
               control = "requisite";
-              modulePath = "pam_nologin.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
             }
             {
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -166,7 +166,7 @@ in
               # Load environment from /etc/environment and ~/.pam_environment
               name = "env";
               control = "required";
-              modulePath = "pam_env.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
@@ -174,7 +174,7 @@ in
               # Always let the greeter start without authentication
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -183,7 +183,7 @@ in
               # No action required for account management
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -192,7 +192,7 @@ in
               # Can't change password
               name = "deny";
               control = "required";
-              modulePath = "pam_deny.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
             }
           ];
 
@@ -201,7 +201,7 @@ in
               # Setup session
               name = "unix";
               control = "required";
-              modulePath = "pam_unix.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
             {
               name = "systemd";

nixos/modules/services/misc/radicle.nix

@@ -17,8 +17,8 @@ let
   };
 
   credentials = {
-    privateKey = "xyz.radicle.node.secret";
-    privateKeyPassphrase = "xyz.radicle.node.passphrase";
+    privateKey = "dev.radicle.node.secret";
+    privateKeyPassphrase = "dev.radicle.node.passphrase";
   };
 
   # Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`

nixos/modules/services/networking/wpa_supplicant.nix

@@ -158,6 +158,7 @@ let
           builtins.storeDir
           "/etc/"
         ]
+        ++ cfg.extraConfigFiles
         ++ lib.optional (cfg.secretsFile != null) cfg.secretsFile;
         DeviceAllow = "/dev/rfkill rw";
         LockPersonality = true;

nixos/modules/services/web-apps/mastodon.nix

@@ -145,9 +145,11 @@ let
     pkgs.writeShellScriptBin "mastodon-tootctl" ''
       set -a
       export RAILS_ROOT="${cfg.package}"
+      export HOME="/var/lib/mastodon"
       source "${envFile}"
       source /var/lib/mastodon/.secrets_env
       ${sourceExtraEnv}
+      cd /var/lib/mastodon
 
       sudo=exec
       if [[ "$USER" != ${cfg.user} ]]; then

nixos/modules/services/web-servers/nginx/tailscale-auth.nix

@@ -72,6 +72,7 @@ in
 
           proxy_pass http://unix:${cfgAuth.socketPath};
           proxy_pass_request_body off;
+          proxy_set_header Content-Length "";
 
           # Upstream uses $http_host here, but we are using gixy to check nginx configurations
           # gixy wants us to use $host: https://github.com/yandex/gixy/blob/master/docs/en/plugins/hostspoofing.md

nixos/modules/services/web-servers/vinyl-cache/default.nix

@@ -18,12 +18,9 @@ let
   cfg = config.services.vinyl-cache;
 
   # Vinyl Cache has very strong opinions and very complicated code around handling
-  # the stateDir. After a lot of back and forth, we decided that we a)
-  # do not want a configurable option here, as most of the handling depends
-  # on the version and the compile time options. Putting everything into
-  # /var/run (RAM backed) is absolutely recommended by Vinyl Cache anyways.
-  # We do need to pay attention to the version-dependend variations, though!
-  stateDir = "/var/run/vinyld";
+  # the stateDir. After a lot of back and forth, we decided to set the stateDir
+  # at compile time and let the package expose the particular path as passthru.
+  stateDir = cfg.package.stateDir;
 
   # from --help:
   #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
@@ -183,13 +180,13 @@ in
         after = [ "network.target" ];
         serviceConfig = {
           Type = "simple";
-          ExecStart = "${cfg.package}/bin/vinyld ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+          ExecStart = "${cfg.package}/bin/vinyld ${commandLineAddresses} -F ${cfg.extraCommandLine} ${commandLine}";
           Restart = "always";
           RestartSec = "5s";
           User = "vinyl-cache";
           Group = "vinyl-cache";
           DynamicUser = true;
-          RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
+          RuntimeDirectory = lib.removePrefix "/run/" stateDir;
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           NoNewPrivileges = true;
           LimitNOFILE = 131072;
@@ -221,6 +218,10 @@ in
             assertion = cfg.package.pname == "vinyl-cache";
             message = "services.vinyl-cache only supports Vinyl Cache. Please use services.varnish.";
           }
+          {
+            assertion = lib.strings.hasPrefix "/run/" stateDir;
+            message = "The vinyl-cache NixOS mosule only supports statedirs in /run/, but vinyl-cache package was compiled with ${stateDir}.";
+          }
         ];
     })
     (lib.mkIf (cfg.enable && cfg.enableFileLogging) {

nixos/modules/system/activation/top-level.nix

@@ -42,7 +42,7 @@ let
 
     ${config.system.systemBuilderCommands}
 
-    printf "%s" "$extraDependencies" > "$out/extra-dependencies"
+    printf "%s " "''${extraDependencies[@]}" > "$out/extra-dependencies"
 
     ${optionalString (!config.boot.isContainer && config.boot.bootspec.enable) ''
       ${config.boot.bootspec.writer}

nixos/modules/system/boot/kernel.nix

@@ -410,7 +410,7 @@ in
             ln -s ${config.hardware.deviceTree.package} $out/dtbs
           ''}
 
-          echo -n "$kernelParams" > $out/kernel-params
+          echo -n "''${kernelParams[@]}" > $out/kernel-params
 
           ${optionalString config.boot.initrd.enable ''
             ln -s ${initrdPath} $out/initrd

nixos/tests/radicle-ci-broker.nix

@@ -20,7 +20,7 @@ in
 
   nodes.seed = {
     virtualisation.credentials = {
-      "xyz.radicle.node.secret".source = "${seed-ssh-keys.snakeOilEd25519PrivateKey}";
+      "dev.radicle.node.secret".source = "${seed-ssh-keys.snakeOilEd25519PrivateKey}";
     };
 
     services.radicle = {

nixos/tests/radicle.nix

@@ -72,7 +72,7 @@ in
         imports = [ commonHostConfig ];
 
         virtualisation.credentials = {
-          "xyz.radicle.node.secret".source = "${seed-ssh-keys.snakeOilEd25519PrivateKey}";
+          "dev.radicle.node.secret".source = "${seed-ssh-keys.snakeOilEd25519PrivateKey}";
         };
 
         services.radicle = {

nixos/tests/rancher/multi-node.nix

@@ -222,6 +222,11 @@ in
       # Also wait for our service account to show up; it takes a sec
       server.wait_until_succeeds("kubectl get serviceaccount default")
 
+      # Wait for all nodes to be ready
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/server")
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/server2")
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/agent")
+
       # Now create a pod on each node via a daemonset and verify they can talk to each other.
       server.succeed("kubectl apply -f ${networkTestDaemonset}")
       server.wait_until_succeeds("kubectl rollout status daemonset test")

pkgs/README.md

@@ -874,7 +874,7 @@ $ nix-build -A phoronix-test-suite.tests
 Here are examples of package tests:
 
 - [Jasmin compile test](by-name/ja/jasmin/test-assemble-hello-world/default.nix)
-- [Lobster compile test](development/compilers/lobster/test-can-run-hello-world.nix)
+- [Lobster compile test](by-name/lo/lobster/test-can-run-hello-world.nix)
 - [Spacy annotation test](development/python-modules/spacy/annotation-test/default.nix)
 - [Libtorch test](development/libraries/science/math/libtorch/test/default.nix)
 - [Multiple tests for nanopb](./by-name/na/nanopb/package.nix)

pkgs/applications/audio/midas/m32edit.nix

@@ -6,8 +6,8 @@ callPackage ./generic.nix (
     brand = "Midas";
     type = "M32";
     version = "4.4.1";
-    url = "https://cdn.mediavalet.com/aunsw/musictribe/Yd1JkAyxqUeqIxoRM0lWWw/uwBe453FiEKSpqZzdjvYpQ/Original/${type}-Edit_LINUX_${version}.tar.gz";
+    url = "https://cdn-media.empowertribe.com/9ba5bed1bc7a427cb96cef8aeb49f097/${type}-Edit_LINUX_${version}.tar.gz";
     hash = "sha256-cEva2Brxo7zm3qppO+BtYIlUqV9t69j+8f6g94C4i3c=";
-    homepage = "https://www.midasconsoles.com/series.html?category=R-MIDAS-M32SERIES";
+    homepage = "https://www.midasconsoles.com/en/products/0603-AEO";
   }
 )

pkgs/applications/audio/midas/x32edit.nix

@@ -6,8 +6,8 @@ callPackage ./generic.nix (
     brand = "Behringer";
     type = "X32";
     version = "4.4.1";
-    url = "https://cdn.mediavalet.com/aunsw/musictribe/6-vOpP2lRkyNSDXgZEUbQA/FyIw4jc3bk60nseai05MBQ/Original/${type}-Edit_LINUX_${version}.tar.gz";
+    url = "https://cdn-media.empowertribe.com/23b991ede2e6473d916c7ac56f53d71d/${type}-Edit_LINUX_${version}.tar.gz";
     hash = "sha256-HrSPDWnWF2s1U8Khj6VnLptPdcMVyTivewWAIIdArMc=";
-    homepage = "https://www.behringer.com/product.html?modelCode=0603-ACE";
+    homepage = "https://www.behringer.com/en/products/0603-ACE";
   }
 )

pkgs/applications/editors/vim/plugins/generated.nix

@@ -1314,6 +1314,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  auto-dark-mode-nvim = buildVimPlugin {
+    pname = "auto-dark-mode.nvim";
+    version = "0-unstable-2026-03-29";
+    src = fetchFromGitHub {
+      owner = "f-person";
+      repo = "auto-dark-mode.nvim";
+      rev = "54058b4fe414bd64bd2904a6f8a63f1f14e3d8df";
+      hash = "sha256-xTgRyct3L6Gcz/vdYSc+h2IUgi/+Lh1Q4mxJwHISeis=";
+    };
+    meta.homepage = "https://github.com/f-person/auto-dark-mode.nvim/";
+    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
+    meta.hydraPlatforms = [ ];
+  };
+
   auto-fix-return-nvim = buildVimPlugin {
     pname = "auto-fix-return.nvim";
     version = "0.4.0";
@@ -3902,6 +3916,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  conflict-nvim = buildVimPlugin {
+    pname = "conflict.nvim";
+    version = "0-unstable-2026-04-25";
+    src = fetchFromGitHub {
+      owner = "niekdomi";
+      repo = "conflict.nvim";
+      rev = "fdc879c34c528aab90e1b90c5d408d141f31fef8";
+      hash = "sha256-hXww2PNTU5LX5egngKwMxOjvQl5CMgzBbDesRswPD2g=";
+    };
+    meta.homepage = "https://github.com/niekdomi/conflict.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   conform-nvim = buildVimPlugin {
     pname = "conform.nvim";
     version = "9.1.0-unstable-2026-05-15";
@@ -12337,6 +12365,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-dap-disasm = buildVimPlugin {
+    pname = "nvim-dap-disasm";
+    version = "0-unstable-2026-02-25";
+    src = fetchgit {
+      url = "https://codeberg.org/Jorenar/nvim-dap-disasm";
+      rev = "1119f3f2b22e411adcd123cdcf6d0425b61a31a7";
+      hash = "sha256-lq0tbMksVXccf6GGD7OxWAuoD9w8tlt30dpJSMtN4g8=";
+    };
+    meta.homepage = "https://codeberg.org/Jorenar/nvim-dap-disasm";
+    meta.license = unfree;
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-dap-docker = buildVimPlugin {
     pname = "nvim-dap-docker";
     version = "0.2.0";

pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix

@@ -10,12 +10,12 @@
   nix-update-script,
 }:
 let
-  version = "2.0.1";
+  version = "2.0.3";
   src = fetchFromGitHub {
     owner = "mistricky";
     repo = "codesnap.nvim";
     tag = "v${version}";
-    hash = "sha256-pYBB647UX3okpfUlZ3MhrlEwILXv/V0r42j7xp4aDO0=";
+    hash = "sha256-mpH+sewIXgl4vYLDToMYx3IX19HFPDjBWmMRdYGVsIw=";
   };
   codesnap-lib = rustPlatform.buildRustPackage {
     pname = "codesnap-lib";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3044,6 +3044,13 @@ assertNoAdditions {
     dependencies = [ self.nvim-dap ];
   };
 
+  nvim-dap-disasm = super.nvim-dap-disasm.overrideAttrs (old: {
+    dependencies = [ self.nvim-dap ];
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   nvim-dap-lldb = super.nvim-dap-lldb.overrideAttrs {
     dependencies = [ self.nvim-dap ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -92,6 +92,7 @@ https://github.com/skywind3000/asynctasks.vim/,,
 https://github.com/vmchale/ats-vim/,,
 https://github.com/augmentcode/augment.vim/,prerelease,
 https://github.com/ray-x/aurora/,,
+https://github.com/f-person/auto-dark-mode.nvim/,,
 https://github.com/Jay-Madden/auto-fix-return.nvim/,,
 https://github.com/hotwatermorning/auto-git-diff/,,
 https://github.com/asiryk/auto-hlsearch.nvim/,,
@@ -277,6 +278,7 @@ https://github.com/nvim-lua/completion-nvim/,,
 https://github.com/aca/completion-tabnine/,,
 https://github.com/chikatoike/concealedyank.vim/,,
 https://github.com/rhysd/conflict-marker.vim/,,
+https://github.com/niekdomi/conflict.nvim/,,
 https://github.com/stevearc/conform.nvim/,,
 https://github.com/Olical/conjure/,,
 https://github.com/niklasdewally/conjure.nvim/,,
@@ -879,6 +881,7 @@ https://github.com/andythigpen/nvim-coverage/,,
 https://github.com/ya2s/nvim-cursorline/,,
 https://codeberg.org/mfussenegger/nvim-dap/,,
 https://github.com/jedrzejboczar/nvim-dap-cortex-debug/,,
+https://codeberg.org/Jorenar/nvim-dap-disasm,,
 https://github.com/docker/nvim-dap-docker/,,
 https://github.com/leoluz/nvim-dap-go/,,
 https://github.com/julianolf/nvim-dap-lldb/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-VTbeOLAGmaVy9PL5/Y+ebbCNa6ki4cx0VGXhzLuz1ow=";
+          hash = "sha256-bAD+NqqkEe5RfMQdMSAokPzb+SqoVc6DKnTPrW0+MA0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-j8cDVoxT38/dmorTlPQjrd2GQS+BkoatIbQQzB1c7GA=";
+          hash = "sha256-AzF2ZK4mOHoQnZz1W8IhLzGQzdysr6skbICxvfY+iHA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-Kl23fdHFlh9cvfMtXNr6GI+AWknPFMM1lGFCuJY5kXw=";
+          hash = "sha256-vky+lZyLDeA3o04FXGPTnKQCRsV3L7Ry0RJ9w2XCmUo=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-M1dfKzjfHeH4xmvnuRmBsnhaQryL6c84nPrl2NGQT5k=";
+          hash = "sha256-MU0ZptlmHlpSvJu+j/QY7p+xXiKG6+iF65DMAuE98v0=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.143";
+      version = "2.1.145";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-21";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "3a5222c97456e8df90983eb546f4d866b0feb848";
-    hash = "sha256-FeT1VPOJsZaC9SZbJwbiC0fkVV/WOJ+rOcwf8g+wdeM=";
+    rev = "9c5c68f446204b09b12f3f1936072e56d91476c0";
+    hash = "sha256-p2vv9EExJYgR59ycjxc79+itVDf3/4pWKVn671lNjVo=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/gambatte.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "4c1b4c26c8db94663196bad187b58fe8e9162b4f";
-    hash = "sha256-uJoHwHJ2KtNk83eEDdWPPxAViMCp8bVq06wsBxQZEPw=";
+    rev = "3262c2aa4adae8dba4f6d51cdd931c15cb11569f";
+    hash = "sha256-JPnpY/43XbT9QnvzrYPkZLCcM3hN+SoQTFZ8J/Dj+Oc=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-05-08";
+  version = "0-unstable-2026-05-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "fa993f040d7150bda672b3e3ebe36c9bd2ea8904";
-    hash = "sha256-4igo4uwpDwbP6oTtlF6pwDF7+WZ0FgeFCtmPVNpULBo=";
+    rev = "162c3439a697ffdfa00a5d3f44af103bf671f5dc";
+    hash = "sha256-ExPuJjMYMKgGWqLdM1AdxHHZejBmFQ/BCfSDzoy8A7o=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2026-05-11";
+  version = "0-unstable-2026-05-16";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "7a2b8d6058c7b89548283be5d380accc85e310a0";
-    hash = "sha256-AA6l4t+TDz2g/qQM4bVbSnJXsamEXzUqTL7VnvQ1mgc=";
+    rev = "e62ea293ba347dc1fd9d387458d8262bc122053f";
+    hash = "sha256-V0ItXRD1YO7jq/SNoXOh7ZhpWwx9oFs3muIUkzj8FHE=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/swanstation.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "swanstation";
-  version = "0-unstable-2026-05-11";
+  version = "0-unstable-2026-05-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "swanstation";
-    rev = "0f7757b3196ab472c3a8b279206b3ea19a3e5f2d";
-    hash = "sha256-5R+K0NpLdjajT6LV0os569vrgqRCtfXDqMnhM8z7dmk=";
+    rev = "62697276b95848bd35b9c7b81daab899a98e0789";
+    hash = "sha256-jisW5Mk5PF3rxj9mF5FJXtktAKEAq2a6DUvCXBgri3E=";
   };
 
   extraNativeBuildInputs = [ cmake ];

pkgs/applications/emulators/libretro/cores/vba-next.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vba-next";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vba-next";
-    rev = "f56ea99799b51fb107a4d3afe2a97a1364e8d806";
-    hash = "sha256-gbBurV2N6evLnZqvcxAZ2xfKMsybVeu+Nml0p0APTRE=";
+    rev = "f04b19879d929730d199649c5c40b75b1f15b549";
+    hash = "sha256-Mv+vg0NyX1F7u8cRDpwduD+UZfCHKlcSUmB3bQGjCn8=";
   };
 
   meta = {

pkgs/applications/networking/browsers/chromium/common.nix

@@ -611,17 +611,11 @@ let
         hash = "sha256-WZsN2qm6lX121bDf7SoN75flXtCTmPPpwtHK0ayjkPc=";
       })
     ]
-    ++ lib.optionals (versionRange "146" "147") [
-      # Backport CL 7594600 from M147 to fix the following error:
-      #  error[E0277]: the trait bound `LaneCount<N>: SupportedLaneCount` is not satisfied
-      #  --> ../../third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/pod.rs:152:40
-      (fetchpatch {
-        name = "chromium-146-backport-Remove-now-obsolete-invalid-patch-on-bytemuck-v1.patch";
-        # https://chromium-review.googlesource.com/c/chromium/src/+/7594600
-        url = "https://chromium.googlesource.com/chromium/src/+/90b77efcecb262823fadb67b0ce218846cd9e756^!?format=TEXT";
-        decode = "base64 -d";
-        hash = "sha256-iDhDdVscy0tinQCRKXOghrn4ZRwlc8YjPZ0xPv0UMEU=";
-      })
+    ++ lib.optionals (!versionRange "146" "147") [
+      # Fix building with stable Rust 1.95 (https://issues.chromium.org/issues/480176523):
+      #  error[E0425]: cannot find type `LaneCount` in module `core::simd`
+      #  --> ../../third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/zeroable.rs:234:15
+      ./patches/chromium-142-bytemuck-rust-1.95.patch
     ]
     ++ lib.optionals (chromiumVersionAtLeast "147" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fno-lifetime-dse'

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "148.0.7778.167",
+    "version": "148.0.7778.178",
     "chromedriver": {
-      "version": "148.0.7778.168",
-      "hash_darwin": "sha256-F24gaQI0JZkStM71KJDEn8EKBTw1UifMxYXDdUIVup4=",
-      "hash_darwin_aarch64": "sha256-WpAiIz3nXxJLkxAP5JSn6rSxDW0vvl7EHeJA5MD+nss="
+      "version": "148.0.7778.179",
+      "hash_darwin": "sha256-jDw+ON0X8rePW1HLBZ5FVKMibImBuW/Tp0EDZ/UjJlw=",
+      "hash_darwin_aarch64": "sha256-hNaaKMVy8sKNU444Uf78YI3ayUATrTBAr6/7Z3jewv0="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
-        "hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
+        "rev": "d096af1c9e98c45c3596e59620622b1a049bfecb",
+        "hash": "sha256-XRalekzeALnDh9KiGqhYdhXvkGkjO3TOIZeqwpPLO+U=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
-        "hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
+        "rev": "50fd896fb21cca91f325812d01d1e971593efc73",
+        "hash": "sha256-HcfKm7UQmg3wMDOytmaYzm7Z7gRdOrRoqAKaE0ZdI4E="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -392,8 +392,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
-        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
+        "rev": "3859e64eed5d34544b27fbcab0ac1685ce83df3c",
+        "hash": "sha256-rNErsn11FZUh8GXAl7jK+NyLHIKrQR3LuoM1qFFGtmM="
       },
       "src/third_party/nlohmann_json/src": {
         "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@@ -822,13 +822,13 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
-        "hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
+        "rev": "ad6e4525c418a92147c8247ef9d144ce4c242a38",
+        "hash": "sha256-+cQdsWTgIohd3yOCsNCprSr4Ctes77fWGdmPxN2tQlM="
       }
     }
   },
   "ungoogled-chromium": {
-    "version": "148.0.7778.167",
+    "version": "148.0.7778.178",
     "deps": {
       "depot_tools": {
         "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
@@ -840,16 +840,16 @@
         "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
       "ungoogled-patches": {
-        "rev": "148.0.7778.167-1",
-        "hash": "sha256-07mzJHDgWiEQm/8pPDDzT8r+6/bh95yBrZMm2jDqCus="
+        "rev": "148.0.7778.178-1",
+        "hash": "sha256-s4zTU4rQUcrfpg7CWFdvEn3JYNqhHGsAFcYmQGS64fc="
       },
       "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
-        "hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
+        "rev": "d096af1c9e98c45c3596e59620622b1a049bfecb",
+        "hash": "sha256-XRalekzeALnDh9KiGqhYdhXvkGkjO3TOIZeqwpPLO+U=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
-        "hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
+        "rev": "50fd896fb21cca91f325812d01d1e971593efc73",
+        "hash": "sha256-HcfKm7UQmg3wMDOytmaYzm7Z7gRdOrRoqAKaE0ZdI4E="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1219,8 +1219,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
-        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
+        "rev": "3859e64eed5d34544b27fbcab0ac1685ce83df3c",
+        "hash": "sha256-rNErsn11FZUh8GXAl7jK+NyLHIKrQR3LuoM1qFFGtmM="
       },
       "src/third_party/nlohmann_json/src": {
         "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
-        "hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
+        "rev": "ad6e4525c418a92147c8247ef9d144ce4c242a38",
+        "hash": "sha256-+cQdsWTgIohd3yOCsNCprSr4Ctes77fWGdmPxN2tQlM="
       }
     }
   }

pkgs/applications/networking/browsers/chromium/patches/chromium-142-bytemuck-rust-1.95.patch

@@ -0,0 +1,24 @@
+diff --git a/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/pod.rs b/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/pod.rs
+index 330f722b3419b29e0dbb636459508167a61438f4..b0397923c7191e500e8c1590456b574fc3d37f8f 100644
+--- a/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/pod.rs
++++ b/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/pod.rs
+@@ -152,7 +152,6 @@ impl_unsafe_marker_for_simd!(
+ unsafe impl<T, const N: usize> Pod for core::simd::Simd<T, N>
+ where
+   T: core::simd::SimdElement + Pod,
+-  core::simd::LaneCount<N>: core::simd::SupportedLaneCount,
+ {
+ }
+ 
+diff --git a/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/zeroable.rs b/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/zeroable.rs
+index 186c567fffddb14bc3c3834a1fd13091f37f5d5a..397dddec99ef0be3474315837ab328c2b0c270ca 100644
+--- a/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/zeroable.rs
++++ b/third_party/rust/chromium_crates_io/vendor/bytemuck-v1/src/zeroable.rs
+@@ -231,7 +231,6 @@ impl_unsafe_marker_for_simd!(
+ unsafe impl<T, const N: usize> Zeroable for core::simd::Simd<T, N>
+ where
+   T: core::simd::SimdElement + Zeroable,
+-  core::simd::LaneCount<N>: core::simd::SupportedLaneCount,
+ {
+ }
+ 

pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml

@@ -15,3 +15,5 @@ safe_browsing_mode=0
 treat_warnings_as_errors=false
 use_official_google_api_keys=false
 use_unofficial_version_number=false
+v8_drumbrake_bounds_checks=true
+v8_enable_drumbrake=true

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "150.0b7";
+  version = "152.0b1";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e4240a9c13bbe188763eb03d65935576c03ba4ead80411ff2ca528a06788bbe4b61be3fa221c01f70e4601428bf8c7895506df28a782078e8171d34d017299a0";
+    sha512 = "1fcbb8bd7b80415639dec2e1f28e6e893b43592115e1a445f447868f114f04b9b20307af030017fd19fa9f3d7b8ae13e7083229aaa1af9d092f44f6eaa0ae798";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

pkgs/applications/networking/cluster/helm/default.nix

@@ -52,13 +52,27 @@ buildGoModule (finalAttrs: {
 
     # skipping version tests because they require dot git directory
     substituteInPlace cmd/helm/version_test.go \
-      --replace "TestVersion" "SkipVersion"
+      --replace-fail "TestVersion" "SkipVersion"
     # skipping plugin tests
     substituteInPlace cmd/helm/plugin_test.go \
-      --replace "TestPluginDynamicCompletion" "SkipPluginDynamicCompletion" \
-      --replace "TestLoadPlugins" "SkipLoadPlugins"
+      --replace-fail "TestPluginDynamicCompletion" "SkipPluginDynamicCompletion" \
+      --replace-fail "TestLoadPlugins" "SkipLoadPlugins"
     substituteInPlace cmd/helm/helm_test.go \
-      --replace "TestPluginExitCode" "SkipPluginExitCode"
+      --replace-fail "TestPluginExitCode" "SkipPluginExitCode"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # skipping as test fails in sandbox
+    substituteInPlace cmd/helm/dependency_build_test.go \
+      --replace-fail "TestDependencyBuildCmd" "SkipDependencyBuildCmd"
+    substituteInPlace cmd/helm/dependency_update_test.go \
+      --replace-fail "TestDependencyUpdateCmd" "SkipDependencyUpdateCmd"
+    # skipping as test fails in sandbox
+    substituteInPlace cmd/helm/install_test.go \
+      --replace-fail "TestInstall" "SkipInstall"
+    # skipping as test fails in sandbox
+    substituteInPlace cmd/helm/pull_test.go \
+      --replace-fail "TestPullCmd" "SkipPullCmd" \
+      --replace-fail "TestPullWithCredentialsCmd" "SkipPullWithCredentialsCmd"
   '';
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-ni4Y5MRnu6AL491wRD8UoQ4MJmnopumYoq59wGujSUQ=",
+    "hash": "sha256-Yevs7mUu5Mr9JBbPE8CIKufYCLKealbBXrNL+mRH2Yw=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.56.0",
+    "rev": "v4.57.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-vSSgABGm1aHGVPIsNXylpan8E07eOQ/Nc8Lf1N3+P5c="
+    "vendorHash": "sha256-ndIxcO14+NAKmRs9wVEE/HhBx9Wj4AwiMv+nus6BDK4="
   },
   "akamai_akamai": {
     "hash": "sha256-M6Btq8wX1lsEs1HUaaTwGspnvS2IyE0L2ITe+ogDTlc=",
@@ -283,13 +283,13 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-acDEAqygINpmFb45Ah5yiiD/kRhGhI6jVRlSN+/1s1Y=",
+    "hash": "sha256-yyUlJshH6leJbxDcm5lNGhR9pxbBEaEEDXasWeFI6Uw=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v4.8.0",
+    "rev": "v4.10.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1e5Jdn6fSSdoAef4EobC41MhyBtdkYq50F8dbvtx+hk="
+    "vendorHash": "sha256-tgo9FxqMZOZw4ZKULOz6CbZ8oJfEFfjdFffiWjjkc0Y="
   },
   "datadrivers_nexus": {
     "hash": "sha256-yfxlDln4brI8QTFnhVsNOO3vRiqft3YWytvy2GMNBdY=",
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
   },
   "hashicorp_aws": {
-    "hash": "sha256-+MvxcQn0pnsNDR6ERXFW85fLwQ+AG+UcBo5F25WN4mQ=",
+    "hash": "sha256-dC3oeVzd8H7Ni9NvApkjmDpVWdx/XgirhI7Rf5ECGBE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.44.0",
+    "rev": "v6.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fsGCKGgH2XM3Eq3rluKs3bODhmXUYEHLWskn+P58emA="
+    "vendorHash": "sha256-ieYDog2HS8OwfKvzPIsXZcSAsT7D9qzXPXuHhtfthV0="
   },
   "hashicorp_awscc": {
     "hash": "sha256-OC57nzpz8l+26/oBXVCFUMNK+gMlgpEK35uIyG1sFOo=",
@@ -589,13 +589,13 @@
     "vendorHash": "sha256-xCWhCYD+YKyEB55uMm2p+eCtSlg65nSfGFMlX0qIiMQ="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-/HxUOhDATteiUDIeA8zvGI9xQ5rOWJAhLN9PLHiBFfI=",
+    "hash": "sha256-EpXR8MOvW6S8XhaKvRQ3BOgdvLmv2WrVLaOvu60eE60=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.31.0",
+    "rev": "v7.33.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-5PnJ87cGMCwEl7zEwjbzgU5kZO9IC4Ls47HX2SZ2h2w="
+    "vendorHash": "sha256-5KnOUVvMNhWhOGsbcZWN2cCOKL2jrZeiDnLZ53Dd9zM="
   },
   "hashicorp_helm": {
     "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-/vEbhPKNhKUIlChGYuMNR5Ulbk9gG4171vZ6pvoTdcM=",
+    "hash": "sha256-GRrtwrShJj+d2h6CpxjP+QmRKQLTWoNt5889ek9rfyE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.76.2",
+    "rev": "v0.77.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JNTe1RI2aDw86jNzYJqmiBr5BBnr824/DhkJeaMpbKI="
+    "vendorHash": "sha256-DutNev1ABazfV6QOWMFsFc0QSkffARhaJ7RXTWG2Jyo="
   },
   "hashicorp_time": {
     "hash": "sha256-5+iPq2It3oFHPBHWshfIuNo1xkOPcuSYyljt6j+j7lg=",
@@ -679,13 +679,13 @@
     "vendorHash": "sha256-boeh/lZHlBD/bQqLnrY9oul4GcRZUHT97FyhKb4nE/c="
   },
   "hashicorp_tls": {
-    "hash": "sha256-r7nthgw7MycME+edQ4jHQQ33mmpNv3t/LDbD5IkXDYA=",
+    "hash": "sha256-mTfWFYkot4iMFosHZUyj1265PpJafavG68sWG9k/wp4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tls",
     "owner": "hashicorp",
     "repo": "terraform-provider-tls",
-    "rev": "v4.2.1",
+    "rev": "v4.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OvotUEh+P2b3ngaD/8lVbemnM3lrtwqduPXPjF/bqVA="
+    "vendorHash": "sha256-aM9bDzYM4RW3cIeJCMnIB9VqEaPV4D0r3zMOU3d0QDs="
   },
   "hashicorp_vault": {
     "hash": "sha256-k/S1ez6q70vvnHMfU2aweTFzRnLlYbxUEh4xZumT1mo=",
@@ -1256,13 +1256,13 @@
     "vendorHash": "sha256-L+J3vsxxmF3TjQaDL5Uo9IentkDJfGpjfzBYTQzzGvY="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-0Wc+QgEeizydsvtyBdnxgLhpYuBZLMB3JGjmTDXzJY0=",
+    "hash": "sha256-b+Bk3W3/xNF863+kflRVZ0gyk5YyziVS4Ok+H5A3VEg=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.235.0",
+    "rev": "v1.236.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-odyKlnrYufT5pQsYuGN0hKQeQx7LzTLVNTwde97wyPc="
+    "vendorHash": "sha256-Gb07NAvZowWIUokmjLq2IOvg4El2hGwJ6J2J9hBj+eg="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch2,
   cmake,
   hwloc,
   fftw,
@@ -69,7 +70,17 @@ stdenv.mkDerivation rec {
     inherit (source) hash;
   };
 
-  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
+  patches = [
+    # Fix pkg-config paths for the version-specific gromacs variant.
+    (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch)
+  ]
+  ++ lib.optional enablePlumed (
+    # Backport gcc 15 cstdint include fix.
+    fetchpatch2 {
+      url = "https://gitlab.com/gromacs/gromacs/-/commit/e0180bc37f3111d7dcaffca3854c088ed910c3b4.diff";
+      hash = "sha256-TvTzfb/RETAzFpYfFFr6/L5GV1Pile16gVJhNigwAB4=";
+    }
+  );
 
   postPatch = lib.optionalString enablePlumed ''
     plumed patch -p -e gromacs-${source.version}

pkgs/applications/version-management/subversion/default.nix

@@ -40,7 +40,7 @@ let
   common =
     {
       version,
-      sha256,
+      hash,
       extraPatches ? [ ],
     }:
     stdenv.mkDerivation (finalAttrs: {
@@ -49,7 +49,7 @@ let
 
       src = fetchurl {
         url = "mirror://apache/subversion/subversion-${finalAttrs.version}.tar.bz2";
-        inherit sha256;
+        inherit hash;
       };
 
       # Can't do separate $lib and $bin, as libs reference bins
@@ -98,10 +98,15 @@ let
       ]
       ++ extraPatches;
 
-      # remove vendored swig-3 files as these will shadow the swig provided
-      # ones and result in compile errors
+      # Remove vendored swig-3 files as these will shadow the swig provided
+      # ones and result in compile errors.
+      # Also remove the generated Perl wrappers from the release tarball
+      # so they are rebuilt with the same SWIG runtime as libsvn_swig_perl.
       postPatch = ''
         rm subversion/bindings/swig/proxy/{perlrun.swg,pyrun.swg,python.swg,rubydef.swg,rubyhead.swg,rubytracking.swg,runtime.swg,swigrun.swg}
+      ''
+      + lib.optionalString perlBindings ''
+        rm subversion/bindings/swig/perl/native/{core.c,svn_*.c}
       '';
 
       env = {
@@ -141,32 +146,26 @@ let
         makeFlagsArray=(APACHE_LIBEXECDIR=$out/modules)
       '';
 
-      postInstall = ''
-        if test -n "$pythonBindings"; then
-            make swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
-            make install-swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
-        fi
+      postInstall =
+        lib.optionalString pythonBindings ''
+          make swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
+          make install-swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
+        ''
+        + lib.optionalString perlBindings ''
+          make install-swig-pl
+        ''
+        + ''
+          mkdir -p $out/share/bash-completion/completions
+          cp tools/client-side/bash_completion $out/share/bash-completion/completions/subversion
 
-        if test -n "$perlBindings"; then
-            make swig-pl-lib
-            make install-swig-pl-lib
-            cd subversion/bindings/swig/perl/native
-            perl Makefile.PL PREFIX=$out
-            make install
-            cd -
-        fi
-
-        mkdir -p $out/share/bash-completion/completions
-        cp tools/client-side/bash_completion $out/share/bash-completion/completions/subversion
-
-        for f in $out/lib/*.la $out/lib/python*/site-packages/*/*.la; do
-          substituteInPlace $f \
-            --replace "${expat.dev}/lib" "${expat.out}/lib" \
-            --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
-            --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
-            --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
-        done
-      '';
+          for f in $out/lib/*.la $out/lib/python*/site-packages/*/*.la; do
+            substituteInPlace $f \
+              --replace "${expat.dev}/lib" "${expat.out}/lib" \
+              --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
+              --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
+              --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
+          done
+        '';
 
       inherit perlBindings pythonBindings;
 
@@ -195,6 +194,6 @@ in
 {
   subversion = common {
     version = "1.14.5";
-    sha256 = "sha256-54op53Zri3s1RJfQj3GlVkGrxTZ1zhh1WEeBquNWRKE=";
+    hash = "sha256-54op53Zri3s1RJfQj3GlVkGrxTZ1zhh1WEeBquNWRKE=";
   };
 }

pkgs/build-support/build-mozilla-mach/default.nix

@@ -332,46 +332,6 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
-    # Revert apple sdk bump to 26.1, 26.2 and 26.4
-    ++
-      lib.optionals (lib.versionAtLeast version "151" && lib.versionOlder apple-sdk_26.version "26.4")
-        [
-          (fetchpatch {
-            url = "https://github.com/mozilla-firefox/firefox/commit/d06b47c9e398ceb04193f904e090f23a5a1f4906.patch";
-            hash = "sha256-N458KSOOiotmji5VjgdbhueZ3yTVx47UtsWnmOe8XFQ=";
-            revert = true;
-            includes = [
-              "build/moz.configure/toolchain.configure"
-              "python/mozbuild/mozbuild/test/configure/macos_fake_sdk/SDKSettings.plist"
-            ];
-          })
-        ]
-    ++
-      lib.optionals (lib.versionAtLeast version "148" && lib.versionOlder apple-sdk_26.version "26.2")
-        [
-          (fetchpatch {
-            url = "https://github.com/mozilla-firefox/firefox/commit/73cbb9ff0fdbf8b13f38d078ce01ef6ec0794f9c.patch";
-            hash = "sha256-3eBhCuiT61pbeCrvK13vg0OFV4gn/JTvsGXmLN4MBTQ=";
-            revert = true;
-            includes = [
-              "build/moz.configure/toolchain.configure"
-              "python/mozbuild/mozbuild/test/configure/macos_fake_sdk/SDKSettings.plist"
-            ];
-          })
-        ]
-    ++
-      lib.optionals (lib.versionAtLeast version "146" && lib.versionOlder apple-sdk_26.version "26.1")
-        [
-          (fetchpatch {
-            url = "https://github.com/mozilla-firefox/firefox/commit/c1cd0d56e047a40afb2a59a56e1fd8043e448e05.patch";
-            hash = "sha256-NPaA5tYz3BUxB2ads5HZyYWJ+aS9pTzQp+AKFkfmdXA=";
-            revert = true;
-            includes = [
-              "build/moz.configure/toolchain.configure"
-              "python/mozbuild/mozbuild/test/configure/macos_fake_sdk/SDKSettings.plist"
-            ];
-          })
-        ]
     ++ extraPatches;
 
   postPatch = ''

pkgs/build-support/rust/lib/default.nix

@@ -77,7 +77,7 @@
       + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
         "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
         "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
-        "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}"
+        "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
       '';
     };
 }

pkgs/build-support/vm/default.nix

@@ -731,7 +731,7 @@ let
             ;
 
           debsFlat = lib.flatten debs;
-          debsGrouped = debs;
+          debsGrouped = map toString debs;
 
           preVM = createEmptyImage { inherit size fullName; };
 

pkgs/build-support/vm/test.nix

@@ -2,12 +2,12 @@
   hello,
   patchelf,
   pcmanfm,
+  runCommand,
   stdenv,
   vmTools,
 }:
 let
   inherit (vmTools)
-    buildRPM
     diskImages
     makeImageTestScript
     runInLinuxImage
@@ -46,6 +46,23 @@ in
     })
   );
 
+  # Sanity check to ensure the dpkg --install commands have run
+  checkPerlInstalledInDebian = runInLinuxImage (
+    runCommand "check-perl"
+      {
+        diskImage = diskImages.debian13x86_64;
+        diskImageFormat = "qcow2";
+        memSize = 512;
+      }
+      ''
+        echo Check if perl is present
+        perl -v
+        echo Check if perl is installed
+        dpkg -l | grep 'ii *perl'
+        mkdir $out
+      ''
+  );
+
   # RPM-based distros
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;

pkgs/by-name/_1/_1password-gui/sources.json

@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.12.12",
+      "version": "8.12.21",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.12.x64.tar.gz",
-          "hash": "sha256-tdhuBJeCXbepDN6Z9Yqs6gE5lMUh72sOJuQSv4Qoj1M="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.21.x64.tar.gz",
+          "hash": "sha256-+TNkHD+CEODImJqxsvYO008UYqOAyrFpfXiaI5zYuDs="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.12.arm64.tar.gz",
-          "hash": "sha256-RNwZOqr29aLgNJYH/66TFEKCK3AVBhk+qnSax+Y7Dl4="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.21.arm64.tar.gz",
+          "hash": "sha256-zY2hwSANgpGLGh/qOXUbY2JlZnNpXByysAgZvnuS+Qc="
         }
       }
     },
     "darwin": {
-      "version": "8.12.12",
+      "version": "8.12.21",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.12-x86_64.zip",
-          "hash": "sha256-6vVMkra7T4kVRrVn8QexBMRkHDrUoZXP/eALyBPYPow="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.21-x86_64.zip",
+          "hash": "sha256-3CX1Qv2lYTy23XXRaAblOE+mp5YoX4qtV0SXV4hP8xI="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.12-aarch64.zip",
-          "hash": "sha256-IqMw4dgMhHkzjMVbmZy/h3li74JZxbY8D4COeMEg+1o="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.21-aarch64.zip",
+          "hash": "sha256-dwE97R0ZXn5kH9GGlyE+Zizb2T5GasgpGW+5zUFog8U="
         }
       }
     }

pkgs/by-name/_7/_7zz/package.nix

@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "7zz";
-  version = "26.00";
+  version = "26.01";
 
   src = fetchzip {
     url = "https://7-zip.org/a/7z${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}-src.tar.xz";
     hash =
       {
-        free = "sha256-p914FrQPb+h1a+7YIL8ms2YoIfoS1hTCeLLeBF4DjwY=";
-        unfree = "sha256-CIgPhjRSE9A0ABQQx1YTZgO+DNb3BDxRo5xOQmuzBuI=";
+        free = "sha256-52+Gg66MOFmwYUVB0OO4PAtZJtQOkoVpxV7F9xBGy58=";
+        unfree = "sha256-w0fk8EDusUYiOfrmIiUq+xevlwfQxMhjdPzfkHkOkR8=";
       }
       .${if enableUnfree then "unfree" else "free"};
     stripRoot = false;

pkgs/by-name/ab/abracadabra/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.0.1";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jkbeu5KW4fB1d3RRCBO79ZeujrbzHuVu9kQ3EuwVHoE=";
+    hash = "sha256-6MraWIon5bqLmqwLodZXys4Lz+kamFhIa03+eVsApqk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ac/accountsservice/package.nix

@@ -8,7 +8,7 @@
   shadow,
   gobject-introspection,
   polkit,
-  systemd,
+  systemdLibs,
   coreutils,
   meson,
   mesonEmulatorHook,
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     glib
     polkit
-    systemd
+    systemdLibs
     libxcrypt
   ];
 

pkgs/by-name/ad/adaptagrams/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  cairomm,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adaptagrams";
+  version = "0-unstable-2025-10-28";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mjwybrow";
+    repo = "adaptagrams";
+    rev = "840ebcff20dbba36ad03a2160edf7cbaf9859984";
+    hash = "sha256-7tzDOass0ea+6vnfyA/jl2k6VWHCMtkE2I/eTeCFiYQ=";
+  };
+
+  sourceRoot = "source/cola";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairomm
+  ];
+
+  meta = {
+    description = "Libraries for constraint-based layout and connector routing for diagrams.";
+    homepage = "https://github.com/mjwybrow/adaptagrams";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [
+      wishstudio
+    ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-19";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "96d10aba6ead2862c4cc34bd6c9f1fabfeb4bee6";
-    hash = "sha256-YCt0XL+t7kMPQjWaLZrQGXDu5LjPqHye4T0t906tOXA=";
+    rev = "74b314e1c54115623fcb0eea868d1e08a10f84fe";
+    hash = "sha256-UGSv3ilCRfFmUpY3Gn/sEGs8nrA8zd+g/qihuNkIWLI=";
   };
 
   dontConfigure = true;

pkgs/by-name/an/antimicrox/package.nix

@@ -6,9 +6,8 @@
   pkg-config,
   itstool,
   udevCheckHook,
-  wrapQtAppsHook,
   SDL2,
-  qttools,
+  libsForQt5,
   libxtst,
   fetchFromGitHub,
 }:
@@ -30,11 +29,11 @@ stdenv.mkDerivation rec {
     pkg-config
     itstool
     udevCheckHook
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
   buildInputs = [
     SDL2
-    qttools
+    libsForQt5.qttools
     libxtst
   ];
 

pkgs/by-name/an/anytype-cli/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  tantivy-go,
+}:
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "anytype-cli";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "anyproto";
+    repo = "anytype-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9jJ4FV4ASUrhUvW/lI4qs7AmK06OkPfnD0+okl5blrs=";
+  };
+
+  vendorHash = "sha256-7J/nW4Jn2vdAs8sN+rV3wg6nV3JhtQrnLwlxNI0uja0=";
+  proxyVendor = true;
+
+  env.CGO_ENABLED = 1;
+  env.CGO_LDFLAGS = "-L${tantivy-go}/lib";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/anyproto/anytype-cli/core.Version=v${finalAttrs.version}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-line interface for interacting with Anytype";
+    homepage = "https://github.com/anyproto/anytype-cli";
+    changelog = "https://github.com/anyproto/anytype-cli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    mainProgram = "anytype-cli";
+    maintainers = with lib.maintainers; [
+      adda
+      wanderer
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})

pkgs/by-name/ap/apkeditor/arsclib/default.nix

@@ -9,7 +9,7 @@ let
   self = REAndroidLibrary {
     pname = "arsclib";
     # 1.3.8 is not new enough for APKEditor because of API changes
-    version = "1.3.8-unstable-2026-03-21";
+    version = "1.3.8-unstable-2026-05-16";
     projectName = "ARSCLib";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # This is the latest commit at the time of packaging.
       # It can be changed to a stable release ("V${version}")
       # if it is compatible with APKEditor.
-      rev = "f6c2dc2f6db9063445e84f7ede316d4f1f029351";
-      hash = "sha256-IZ2Us7tcuE+L4bfA4JAcF6Idz1Y2S2IfqW4NSbsxr5o=";
+      rev = "a28c6fb2a77de392f2758c4dfe1a4d7d1aa86c5a";
+      hash = "sha256-0SwowTDkgF9Rdenx/nlSPuGf3kvk7ucxtr7D6r9fU/c=";
     };
 
     mitmCache = gradle.fetchDeps {

pkgs/by-name/ap/apkeditor/package.nix

@@ -55,7 +55,7 @@ let
   apkeditor =
     let
       pname = "apkeditor";
-      version = "1.4.8";
+      version = "1.4.9";
       projectName = "APKEditor";
     in
     REAndroidLibrary {
@@ -71,7 +71,7 @@ let
         owner = "REAndroid";
         repo = "APKEditor";
         tag = "V${version}";
-        hash = "sha256-1XNefeEPs8SEBw+hY2CzZ+rPojNcAbg1AqvzhVcNyy4=";
+        hash = "sha256-NVUv09mMAJDJA/jCIB/EtjQbry0Ej43a7KGR1+5cknY=";
       };
 
       patches = [

pkgs/by-name/ap/apx-gui/package.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/Vanilla-OS/apx-gui";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ chewblacka ];
+    maintainers = [ ];
     mainProgram = "apx-gui";
   };
 })

pkgs/by-name/ap/apx/package.nix

@@ -115,10 +115,7 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/Vanilla-OS/apx";
     changelog = "https://github.com/Vanilla-OS/apx/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      chewblacka
-      masrlinu
-    ];
+    maintainers = with lib.maintainers; [ masrlinu ];
     mainProgram = "apx";
   };
 })

pkgs/by-name/ar/arnis/package.nix

@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Fh/jhKVNeAlJn2PATEMkPROhsyUYTtUp+Dv0FXoIfs=";
+    hash = "sha256-hNVECK6+I3ML/knsBdvEx2Uz1w4jXHynanlQfgrM9oM=";
   };
 
-  cargoHash = "sha256-ZKr+BBcn6vKq3JuLkHqaVHM6Ug7BfUUTEmnePs7RKyc=";
+  cargoHash = "sha256-Kff+76lZ6hsSbssYhrupmE2xAt1gwia8sMZR15ReqgU=";
 
   nativeBuildInputs = [
     cargo-tauri.hook

pkgs/by-name/ar/arwen/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "arwen";
+  version = "0.0.5-unstable-2026-04-07";
+
+  src = fetchFromGitHub {
+    owner = "nichmor";
+    repo = "arwen";
+    rev = "696351a8c208315b0dfd4a1e5c37288a689ccd2e";
+    hash = "sha256-6RW8BeKjoxeO8SBz/VdZGnrRW+EIKq5NtrFdM0lx0+o=";
+  };
+
+  cargoHash = "sha256-bj7YB7xNlfdrYYZv3CDuqkm+/pg+C1KwizPTlNqQWt8=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Cross-platform patching of shared libraries in Rust";
+    longDescription = ''
+      Arwen is a command-line utility and Rust library designed to modify
+      executable files and shared libraries.
+
+      Specifically, it targets the ELF format (commonly used on Linux, BSD, and
+      other Unix-like systems) and the Mach-O format (used on macOS and iOS).
+
+      It allows you to inspect and rewrite various properties within these
+      files that influence how they load and link with other libraries at
+      runtime.
+
+      Think of arwen as a modern, unified, Rust-based alternative to the
+      widely-used patchelf (for ELF files) and install_name_tool (for Mach-O
+      files). It combines the core functionalities of both into a single tool.
+    '';
+    homepage = "https://github.com/nichmor/arwen";
+    mainProgram = "arwen";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})

pkgs/by-name/aw/await/package.nix

@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Small binary that runs a list of commands in parallel and awaits termination";
     homepage = "https://github.com/slavaGanzin/await";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ chewblacka ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
     mainProgram = "await";
   };

pkgs/by-name/aw/awesomebump/package.nix

@@ -2,13 +2,9 @@
   lib,
   stdenv,
   fetchgit,
-  qtbase,
-  qmake,
-  qtscript,
   flex,
   bison,
-  qtdeclarative,
-  wrapQtAppsHook,
+  libsForQt5,
 }:
 
 let
@@ -27,15 +23,15 @@ let
     sourceRoot = "${src.name}/Sources/utils/QtnProperty";
     patches = [ ./qtnproperty-parallel-building.patch ];
     buildInputs = [
-      qtscript
-      qtbase
-      qtdeclarative
+      libsForQt5.qtscript
+      libsForQt5.qtbase
+      libsForQt5.qtdeclarative
     ];
     nativeBuildInputs = [
-      qmake
+      libsForQt5.qmake
       flex
       bison
-      wrapQtAppsHook
+      libsForQt5.wrapQtAppsHook
     ];
     postInstall = ''
       install -D bin-linux/QtnPEG $out/bin/QtnPEG
@@ -49,14 +45,14 @@ stdenv.mkDerivation {
   inherit src;
 
   buildInputs = [
-    qtbase
-    qtscript
-    qtdeclarative
+    libsForQt5.qtbase
+    libsForQt5.qtscript
+    libsForQt5.qtdeclarative
   ];
 
   nativeBuildInputs = [
-    qmake
-    wrapQtAppsHook
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
   ];
 
   preBuild = ''

pkgs/by-name/aw/awsebcli/package.nix

@@ -27,7 +27,7 @@ in
 
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "awsebcli";
-  version = "3.27.1";
+  version = "3.27.2";
   pyproject = true;
   doInstallCheck = true;
 
@@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     owner = "aws";
     repo = "aws-elastic-beanstalk-cli";
     tag = finalAttrs.version;
-    hash = "sha256-5SmV+V+B3GYDnuOH8abh+NzGTZpMId41ZrJ7Fr6cXZo=";
+    hash = "sha256-hTRgNqccwbXxpS4F+JD2h19N/U671NjCBEMiDp6Jbio=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/ba/bacon/package.nix

@@ -27,16 +27,17 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bacon";
-  version = "3.22.0";
+  version = "3.23.0";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eHMpzFKweKGI0REPudyy4veFTXDZc+AX626ylSN2yvU=";
+    hash = "sha256-HMHZQP9GY9iMm+vDeIhavv4akmM0IUbpDtWHyzHG7KE=";
   };
 
-  cargoHash = "sha256-nUO9xVQ51dNWB5fxDZBLlzOWNE5HDAh6xYa5OdBPr4M=";
+  cargoHash = "sha256-zlxhlgcTtSYvvGqSpQIg6f10cQZhF6s4UNrCZr8RIdY=";
 
   buildFeatures = lib.optionals withSound [
     "sound"

pkgs/by-name/be/beszel/package.nix

@@ -1,7 +1,9 @@
 {
+  stdenv,
   buildGo126Module,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   buildNpmPackage,
   nixosTests,
@@ -53,7 +55,14 @@ buildGo126Module (finalAttrs: {
 
   vendorHash = "sha256-TVpZbK9V9/GqpVFcjF7QGD5XJJHzRgjVXZOImHQTR1k=";
 
-  tags = [ "testing" ];
+  patches = [
+    # https://github.com/NixOS/nixpkgs/pull/513197
+    (fetchpatch {
+      name = "fix-updater-after-system-manager-shutdown.patch";
+      url = "https://github.com/henrygd/beszel/commit/c538d1de1cf3f4664a2d98086341884a217846e7.patch";
+      hash = "sha256-voIT9b14pgfhnbJrqgoIbQtwZPU1JF0fblybjG9mzvM=";
+    })
+  ];
 
   preBuild = ''
     mkdir -p internal/site/dist
@@ -66,15 +75,33 @@ buildGo126Module (finalAttrs: {
         "TestCollectorStartHelpers/nvtop_collector"
         "TestApiRoutesAuthentication/GET_/update_-_shouldn't_exist_without_CHECK_UPDATES_env_var"
         "TestConfigSyncWithTokens"
+        # This subtest assumes enough host CPUs for an 8s CPU delta over 1s to stay below 100%.
+        "TestServiceUpdateCPUPercent/subsequent_call_calculates_CPU_percentage"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        "TestCollectorStartHelpers/nvidia-smi_collector"
+        "TestCollectorStartHelpers/rocm-smi_collector"
+        "TestCollectorStartHelpers/tegrastats_collector"
+        "TestNewGPUManagerPriorityNvtopFallback"
+        "TestNewGPUManagerPriorityMixedCollectors"
+        "TestNewGPUManagerPriorityNvmlFallbackToNvidiaSmi"
+        "TestNewGPUManagerConfiguredCollectorsMustStart"
+        "TestNewGPUManagerConfiguredNvmlBypassesCapabilityGate"
+        "TestNewGPUManagerJetsonIgnoresCollectorConfig"
       ];
     in
-    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+    [
+      "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
+      "-tags=testing"
+    ];
 
   postInstall = ''
     mv $out/bin/agent $out/bin/beszel-agent
     mv $out/bin/hub $out/bin/beszel-hub
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     updateScript = nix-update-script {
       extraArgs = [

pkgs/by-name/be/betterleaks/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "betterleaks";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "betterleaks";
     repo = "betterleaks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1cP+mOboazalNuGe8LXBVKCSPvrAFBM2HR3keZdY4Bw=";
+    hash = "sha256-65ITYF3PFYuMXsAEEVOXVBlaZnM01w/BpOdCD0LW5Y4=";
   };
 
-  vendorHash = "sha256-bDe3SjKW3zIbDtkkUfk8RGooW9Nir/f5EVOwXCyPiAs=";
+  vendorHash = "sha256-RStdC7M0+bPNXwaATxkMOBGf1OrT0pqlNPTJ7TCelfk=";
 
   ldflags = [
     "-s"

pkgs/by-name/bf/bfcal/package.nix

@@ -5,8 +5,7 @@
   meson,
   ninja,
   pkg-config,
-  wrapQtAppsHook,
-  qtbase,
+  libsForQt5,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -24,11 +23,11 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtbase
+    libsForQt5.qtbase
   ];
 
   meta = {
@@ -36,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "bfcal";
     homepage = "https://git.sr.ht/~bitfehler/bfcal";
     license = lib.licenses.gpl3Plus;
-    platforms = qtbase.meta.platforms;
+    platforms = libsForQt5.qtbase.meta.platforms;
     maintainers = with lib.maintainers; [ laalsaas ];
   };
 })

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bootdev-cli";
-  version = "1.29.3";
+  version = "1.29.4";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6fdzSwCtJG8SFqInVsOc5EO4g9esMU/z9MYtou1ylFI=";
+    hash = "sha256-BU43XyK+5/YTI+61UGZSUPHmeWUIlal7sW6vgR5KCPg=";
   };
 
   vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";

pkgs/by-name/br/brlcad/disable-rpath-manipulation.patch

@@ -0,0 +1,75 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7526f05b70..18871afb75 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -356,20 +356,6 @@ set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
+ # directories outside the build tree to the install RPATH
+ set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+ 
+-# The following logic is what allows binaries to run successfully in the build
+-# directory AND install directory.
+-# This will need to be overridden for some targets that have a different
+-# relative position to LIB_DIR using the INSTALL_RPATH target property.
+-# However, we can cover the most common case for RPATH setting using the
+-# global default.
+-if(NOT APPLE)
+-  set(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/${LIB_DIR}:$ORIGIN/../${LIB_DIR}")
+-else(NOT APPLE)
+-  # For OSX, use the INSTALL_NAME_DIR target property
+-  set(CMAKE_INSTALL_RPATH "@executable_path/../${LIB_DIR}")
+-  set(CMAKE_INSTALL_NAME_DIR "@executable_path/../${LIB_DIR}")
+-endif(NOT APPLE)
+-
+ #---------------------------------------------------------------------
+ # For certain platforms (in particular Visual C++) we want to keep some pre-defined
+ # flags that are commonly used in the build logic.
+diff --git a/misc/CMake/BRLCAD_ExternalDeps.cmake b/misc/CMake/BRLCAD_ExternalDeps.cmake
+index fdce1dc0c0..1375de50d1 100644
+--- a/misc/CMake/BRLCAD_ExternalDeps.cmake
++++ b/misc/CMake/BRLCAD_ExternalDeps.cmake
+@@ -752,15 +752,6 @@ function(brlcad_bext_process)
+   string(REPLACE ";" "\n" TP_B "${ALL_BINARY_FILES}")
+   file(WRITE "${TP_INVENTORY_BINARIES}" "${TP_B}")
+ 
+-  if(NBINARY_FILES)
+-    message("Setting rpath on new 3rd party lib and exe files...")
+-    # Set local RPATH so the files will work during build
+-    foreach(lf ${NBINARY_FILES})
+-      rpath_build_dir_process("${CMAKE_BINARY_DIR}" "${lf}")
+-    endforeach(lf ${NBINARY_FILES})
+-    message("Setting rpath on new 3rd party lib and exe files... done.")
+-  endif(NBINARY_FILES)
+-
+   if(NNOEXEC_FILES)
+     message("Scrubbing paths from new 3rd party data files...")
+     foreach(tf ${NNOEXEC_FILES})
+@@ -864,6 +855,7 @@ function(brlcad_bext_process)
+   # to define an RPATH that will allow the binary files to work when
+   # the install directory is relocated.
+   foreach(bf ${ALL_BINARY_FILES})
++    continue()
+     if(IS_SYMLINK ${bf})
+       continue()
+     endif(IS_SYMLINK ${bf})
+diff --git a/misc/CMake/BRLCAD_Util.cmake b/misc/CMake/BRLCAD_Util.cmake
+index 631909f499..43a536d21d 100644
+--- a/misc/CMake/BRLCAD_Util.cmake
++++ b/misc/CMake/BRLCAD_Util.cmake
+@@ -154,17 +154,6 @@ function(PLUGIN_SETUP plugin_targets subdir)
+       LIBRARY DESTINATION ${LIBEXEC_DIR}/${subdir}
+       ARCHIVE DESTINATION ${LIBEXEC_DIR}/${subdir}
+     )
+-    # Set the RPATH target property
+-    if(NOT APPLE)
+-      set_property(
+-        TARGET ${target_name}
+-        PROPERTY INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/${LIB_DIR}:$ORIGIN/../../${LIB_DIR}"
+-      )
+-    else(NOT APPLE)
+-      # For OSX, set the INSTALL_NAME_DIR target property
+-      set_property(TARGET ${target_name} PROPERTY INSTALL_RPATH "@executable_path/../../${LIB_DIR}")
+-      set_property(TARGET ${target_name} PROPERTY INSTALL_NAME_DIR "@executable_path/../../${LIB_DIR}")
+-    endif(NOT APPLE)
+   endforeach(target_name${plugins})
+ endfunction(PLUGIN_SETUP)
+ 

pkgs/by-name/br/brlcad/fix-export.patch

@@ -0,0 +1,13 @@
+diff --git a/src/tclscripts/lib/GeometryIO.tcl b/src/tclscripts/lib/GeometryIO.tcl
+index 1ca6898ec1..b8fd8bf9a7 100644
+--- a/src/tclscripts/lib/GeometryIO.tcl
++++ b/src/tclscripts/lib/GeometryIO.tcl
+@@ -176,7 +176,7 @@ proc geom_load {input_file gui_feedback} {
+ # and may only want a subset.
+ proc geom_save {input_file output_file db_component} {
+ 
+-    set binpath [bu_dir bin] ]
++    set binpath [bu_dir bin]
+ 
+     set output_filename [file tail $output_file]
+     set output_dir [file dirname $output_file]

pkgs/by-name/br/brlcad/fix-findpackage-root.patch

@@ -0,0 +1,38 @@
+diff --git a/misc/CMake/BRLCAD_ExternalDeps.cmake b/misc/CMake/BRLCAD_ExternalDeps.cmake
+index 1375de50d1..da7f8b2677 100644
+--- a/misc/CMake/BRLCAD_ExternalDeps.cmake
++++ b/misc/CMake/BRLCAD_ExternalDeps.cmake
+@@ -1037,7 +1037,8 @@ macro(find_package_opencv)
+   unset(OpenCV_ROOT)
+ 
+   # If no bundled copy, see what the system has
+-  if(NOT OpenCV_FOUND)
++  #if(NOT OpenCV_FOUND)
++  if(TRUE)
+     set(OpenCV_DIR "${OpenCV_DIR_TMP}")
+     if(F_REQUIRED)
+       find_package(OpenCV REQUIRED)
+@@ -1072,7 +1073,7 @@ macro(find_package_tcl)
+     unset(TTK_STUB_LIBRARY CACHE)
+   endif(RESET_TP)
+ 
+-  set(TCL_ROOT "${CMAKE_BINARY_DIR}")
++  set(TCL_ROOT "${TCL_ROOT};${CMAKE_BINARY_DIR}")
+   if(F_REQUIRED)
+     find_package(TCL REQUIRED)
+   else()
+diff --git a/misc/CMake/BRLCAD_Find_Package.cmake b/misc/CMake/BRLCAD_Find_Package.cmake
+index 930b444bc4..41717d503d 100644
+--- a/misc/CMake/BRLCAD_Find_Package.cmake
++++ b/misc/CMake/BRLCAD_Find_Package.cmake
+@@ -62,8 +62,8 @@ macro(BRLCAD_Find_Package pkg_name)
+     set(${pkg_name}_ROOT "${BRLCAD_EXT_NOINSTALL_DIR}")
+     set(${pkg_upper}_ROOT "${BRLCAD_EXT_NOINSTALL_DIR}")
+   else(F_NOINSTALL)
+-    set(${pkg_name}_ROOT "${CMAKE_BINARY_DIR}")
+-    set(${pkg_upper}_ROOT "${CMAKE_BINARY_DIR}")
++    set(${pkg_name}_ROOT "${${pkg_name}_ROOT};${CMAKE_BINARY_DIR}")
++    set(${pkg_upper}_ROOT "${${pkg_upper}_ROOT};${CMAKE_BINARY_DIR}")
+   endif(F_NOINSTALL)
+ 
+   # Clear the old status value, if any

pkgs/by-name/br/brlcad/fix-gdal-strcasecmp.patch

@@ -0,0 +1,13 @@
+diff --git a/src/libgcv/plugins/gdal/gdal.cpp b/src/libgcv/plugins/gdal/gdal.cpp
+index c5ae693cb0..56e9ba15eb 100644
+--- a/src/libgcv/plugins/gdal/gdal.cpp
++++ b/src/libgcv/plugins/gdal/gdal.cpp
+@@ -42,6 +42,8 @@
+ #include <stdexcept>
+ 
+ /* GDAL headers */
++// Split the name to evade regress repocheck
++#define STRCASECMP(a, b) (str ## casecmp(a, b))
+ #include "gdal.h"
+ #include "gdalwarper.h"
+ #include "gdal_utils.h"

pkgs/by-name/br/brlcad/fix-perm-test-cmake.patch

@@ -0,0 +1,15 @@
+diff --git a/src/tclscripts/CMakeLists.txt b/src/tclscripts/CMakeLists.txt
+index 364d529ff0..7626e26e68 100644
+--- a/src/tclscripts/CMakeLists.txt
++++ b/src/tclscripts/CMakeLists.txt
+@@ -139,7 +139,9 @@ if(TARGET btclsh)
+   )
+   add_custom_target(TclIndexBld ALL DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/tclindexbld.sentinel)
+   distclean(${CMAKE_CURRENT_BINARY_DIR}/tclindexbld.sentinel)
+-  set_target_properties(perm_test PROPERTIES FOLDER "Compilation Utilities")
++  if(BUILD_TESTING)
++    set_target_properties(perm_test PROPERTIES FOLDER "Compilation Utilities")
++  endif()
+ 
+   foreach(ifile ${index_install_files})
+     # Install logic for index file.

pkgs/by-name/br/brlcad/package.nix

@@ -3,67 +3,227 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  cmake,
-  fontconfig,
-  libx11,
-  libxi,
-  freetype,
-  libgbm,
-}:
 
-stdenv.mkDerivation rec {
+  # nativeBuildInputs
+  cmake,
+  doxygen,
+  lemon,
+  libxslt,
+  re2c,
+
+  # buildInputs
+  adaptagrams,
+  assimp,
+  clipper2,
+  eigen,
+  gdal,
+  geogram,
+  gtmathematics,
+  libGL,
+  libjpeg_turbo,
+  libpng,
+  lmdb,
+  netpbm,
+  opencv,
+  openmesh,
+  pugixml,
+  qt6,
+  stepcode,
+  tcl,
+  tinygltf,
+  tk,
+  zlib,
+
+  # nativeCheckInputs
+  gzip,
+  which,
+
+  # build options
+  enableQt ? false,
+}:
+let
+  bext = fetchFromGitHub {
+    owner = "BRL-CAD";
+    repo = "bext";
+    rev = "f9074f84c87605f89d912069cee1b1e710ead635"; # must match brlcad_bext_init() in CMakeLists.txt
+    hash = "sha256-jCBw4aDk/bmz2Woe9qIA88mgLRRZSu7zDYM5pi3MbP8=";
+    fetchSubmodules = true;
+  };
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "brlcad";
-  version = "7.38.2";
+  version = "7.42.2";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "BRL-CAD";
     repo = "brlcad";
-    tag = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-23UTeH4gY2x/QGYZ64glAkf6LmsXBAppIOHgoUdxgpo=";
+    tag = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
+    hash = "sha256-smsCbUWlAfO9xyT8Bz/vLRkTJuehF9xANrP8bT//t18=";
   };
 
+  prePatch = ''
+    # clone bext src so we can patch it
+    mkdir -p build/bext
+    cp -r --no-preserve=mode ${bext}/* build/bext/
+  '';
+
   patches = [
-    # This commit was bringing an impurity in the rpath resulting in:
-    # RPATH of binary /nix/store/rq2hjvfgq2nvh5zxch51ij34rqqdpark-brlcad-7.38.0/bin/tclsh contains a forbidden reference to /build/
+    # make libgcv work with modern lemon
     (fetchpatch {
-      url = "https://github.com/BRL-CAD/brlcad/commit/fbdbf042b2db4c7d46839a17bbf4985cdb81f0ae.patch";
-      revert = true;
-      hash = "sha256-Wfihd7TLkE8aOpLdDtYmhhd7nZijiVGh1nbUjWr/BjQ=";
+      url = "https://github.com/BRL-CAD/brlcad/commit/0dbd82a10040edc45754242ab36ed130a0259fb8.patch";
+      hash = "sha256-N54FnF69PgeRUDZk/i9hoLHoBzb1neYN20KhDyMqvi4=";
+      excludes = [ "CMakeLists.txt" ];
     })
+    # disable internal RPATH manipulation which gets in our way
+    ./disable-rpath-manipulation.patch
+    # make <PACKAGE>_ROOT respect our cmakeFlags settings instead of being hardwired to CMAKE_BINARY_DIR
+    ./fix-findpackage-root.patch
+    # libgcv defines EQUAL macro, which causes gdal to not define STRCASECMP macro
+    ./fix-gdal-strcasecmp.patch
+    # only call set_target_properties on perm-test when testing is enabled
+    # https://github.com/BRL-CAD/brlcad/pull/235
+    ./fix-perm-test-cmake.patch
+    # fix typo in GeometryIO.tcl which causes model exports to fail
+    # https://github.com/BRL-CAD/brlcad/pull/234
+    ./fix-export.patch
   ];
 
+  postPatch = ''
+    # disable all bext projects by default
+    substituteInPlace build/bext/CMakeLists.txt \
+      --replace-fail "add_project" "#add_project"
+
+    # enable bext projects we actually need:
+    # * itcl: needs v3
+    # * itk: needs v3
+    # * iwidgets, tkhtml, tktable: missing in nixpkgs
+    # * manifold: needs v2
+    # * opennurbs: many vendored patches
+    # * osmesa, perplex, regex, utahrle: specialized vendored libraries
+    # * patch, strclear: required internally
+    # * assetimport, lemon, re2c, tcl, tk, zlib: transitive dependency, not actually built
+    substituteInPlace build/bext/CMakeLists.txt \
+      --replace-fail "#add_project(patch)" "add_project(patch)"
+    for name in itcl itk iwidgets tkhtml tktable manifold opennurbs osmesa perplex regex utahrle strclear zlib assetimport lemon re2c tcl tk; do
+      substituteInPlace build/bext/CMakeLists.txt \
+        --replace-fail "#add_project($name " "add_project($name "
+    done
+
+    # inject TCL_ROOT into bext projects
+    sed -i '1i set(TCL_ROOT "${tcl};${tk}")' \
+      build/bext/CMake/FindTCL.cmake \
+      build/bext/itcl/addfiles/FindTCL.cmake \
+      build/bext/itk/addfiles/FindTCL.cmake \
+      build/bext/tktable/tktable/CMake/FindTCL.cmake \
+      build/bext/tkhtml/tkhtml/CMake/FindTCL.cmake
+  ''
+  + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+    # remove a failing test
+    substituteInPlace src/libbu/tests/CMakeLists.txt \
+      --replace-fail "brlcad_add_test(NAME bu_color_to_rgb_floats_1 COMMAND bu_test color 4 192,78,214)" ""
+  '';
+
   nativeBuildInputs = [
     cmake
+    doxygen
+    lemon
+    libxslt
+    re2c
+  ]
+  ++ lib.optionals enableQt [
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    fontconfig
-    libx11
-    libxi
-    freetype
-    libgbm
+    adaptagrams
+    assimp
+    clipper2
+    eigen
+    gdal
+    geogram
+    gtmathematics
+    libGL
+    libjpeg_turbo
+    libpng
+    lmdb
+    netpbm
+    opencv
+    openmesh
+    pugixml
+    stepcode
+    tcl
+    tinygltf
+    tk
+    zlib
+  ]
+  ++ lib.optionals enableQt [
+    qt6.qtbase
+    qt6.qtsvg
   ];
 
   cmakeFlags = [
-    "-DBRLCAD_ENABLE_STRICT=OFF"
+    (lib.cmakeBool "BRLCAD_ENABLE_STRICT" false)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "BRLCAD_ENABLE_QT" enableQt)
+    (lib.cmakeFeature "GTE_INCLUDE_DIR" "${gtmathematics}/include/gtmathematics")
+    (lib.cmakeFeature "LMDB_LIBRARY" "${lmdb.out}/lib/liblmdb${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "LMDB_INCLUDE_DIR" "${lmdb.dev}/include")
+    (lib.cmakeFeature "OpenCV_DIR" "${opencv}/lib/cmake/opencv4")
+    (lib.cmakeFeature "STEPCODE_ROOT" "${stepcode}")
+    (lib.cmakeFeature "TCL_ROOT" "${tcl};${tk}")
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    # Needed with GCC 12
-    "-Wno-error=array-bounds"
+  preConfigure = ''
+    cmakeFlagsArray+=("-DBRLCAD_EXT_SOURCE_DIR=$(pwd)/build/bext")
+  '';
+
+  env = {
+    CXXFLAGS = toString [
+      # src/libbg/spsr/Octree.inl
+      "-Wno-template-body"
+      # manifold: clipper.core.h:181:22: error: template-id not allowed for constructor in C++20
+      "-Wno-error=template-id-cdtor"
+    ];
+    CFLAGS = toString [
+      # itk, tkhtml, tktable, utahrle
+      "-Wno-incompatible-pointer-types"
+      "-std=gnu17"
+    ];
+  };
+
+  nativeCheckInputs = [
+    gzip
+    which
   ];
 
+  doCheck = true;
+
+  # Only wrap Qt apps as other executables stop working when wrapped
+  dontWrapQtApps = true;
+  preFixup = lib.optionalString enableQt ''
+    wrapQtApp $out/bin/brlman
+    wrapQtApp $out/bin/qged
+    wrapQtApp $out/bin/qgmodel
+    wrapQtApp $out/bin/qgview
+    wrapQtApp $out/bin/qisst
+  '';
+
   meta = {
     homepage = "https://brlcad.org";
     description = "BRL-CAD is a powerful cross-platform open source combinatorial solid modeling system";
-    changelog = "https://github.com/BRL-CAD/brlcad/releases/tag/${lib.removePrefix "refs/tags/" src.rev}";
+    changelog = "https://github.com/BRL-CAD/brlcad/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [
       lgpl21
       bsd2
     ];
-    maintainers = with lib.maintainers; [ GaetanLepage ];
-    platforms = lib.platforms.linux;
-    # error Exactly one of ON_LITTLE_ENDIAN or ON_BIG_ENDIAN should be defined.
-    broken = stdenv.system == "aarch64-linux";
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      wishstudio
+    ];
+    platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/bt/btest/package.nix

@@ -10,22 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "btest";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "manawenuz";
     repo = "btest-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ltePF8HX46FDbdyq30u19FNVpIwPxhOo8AgNvKRzKHE=";
+    hash = "sha256-bS70knj5xUMj0zCoKUJLJDXMPOErH+yoyISlhbyhFIU=";
   };
 
-  cargoHash = "sha256-8AO7eTzZMzvNWcls3VXP0kPun/D5gsA1ih0FOqZ57R0=";
-
-  postPatch = ''
-    # https://github.com/manawenuz/btest-rs/pull/1
-    substituteInPlace Cargo.toml \
-      --replace-fail "0.6.0" "${finalAttrs.version}"
-  '';
+  cargoHash = "sha256-ydHr+4yKCzWbznwF6oWjn8S0dTkJqbV01j4p3ksT+60=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/bu/buildkite-agent/package.nix

@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.126.0";
+  version = "3.127.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JkXWd8I66iQVx/L+qHH0MGcJ/1AtPRZ7bL7+/pqCky0=";
+    hash = "sha256-pFB36R3WESjljn1oeDvq+G6X26sFn6rbHR2Q0iLDzAc=";
   };
 
-  vendorHash = "sha256-p8Xfm+jql2tFihiETlCjZBsx6o5S8DwpHkkjKk6yCV8=";
+  vendorHash = "sha256-lS12eJhIIc0Vi8k4W+NmQFxXBbHSkO+gzcFA6yoYc3U=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash

pkgs/by-name/bu/burpsuite/package.nix

@@ -4,44 +4,36 @@
   fetchurl,
   jdk,
   makeDesktopItem,
-  proEdition ? false,
   unzip,
+
+  # Either "community" or "pro"
+  iconName ? "community",
 }:
+assert lib.assertMsg (
+  iconName == "pro" || iconName == "community"
+) "iconName has to be either pro or community";
 
 let
-  version = "2026.3.2";
-
-  product =
-    if proEdition then
-      {
-        productName = "pro";
-        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-oZGSP19ejP9amfXV89kNDQwxLekZCs7oGKaX/DDHSZM=";
-      }
-    else
-      {
-        productName = "community";
-        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-PuV5XmgdBBkfPS0pc3xENtTUPMpemyHDDOTLVux24Xs=";
-      };
+  pname = "burpsuite";
+  version = "2026.4.3";
 
   src = fetchurl {
     name = "burpsuite.jar";
     urls = [
-      "https://portswigger-cdn.net/burp/releases/download?product=${product.productName}&version=${version}&type=Jar"
-      "https://portswigger.net/burp/releases/download?product=${product.productName}&version=${version}&type=Jar"
-      "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=${product.productName}&version=${version}&type=Jar"
+      "https://portswigger-cdn.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
+      "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
+      "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
     ];
-    hash = product.hash;
+    hash = "sha256-mewbN1uZAFCsxAiXsrNKJ/AexCccVcza40DjxMDbrlM=";
   };
 
-  pname = "burpsuite";
   description = "Integrated platform for performing security testing of web applications";
+
   desktopItem = makeDesktopItem {
-    name = "burpsuite";
+    name = pname;
     exec = pname;
     icon = pname;
-    desktopName = product.productDesktop;
+    desktopName = "Burp Suite Desktop";
     comment = description;
     categories = [
       "Development"
@@ -49,12 +41,11 @@ let
       "System"
     ];
   };
-
 in
 buildFHSEnv {
   inherit pname version;
 
-  runScript = "${jdk}/bin/java -jar ${src}";
+  runScript = "${lib.getExe jdk} -jar ${src}";
 
   targetPkgs =
     pkgs: with pkgs; [
@@ -88,7 +79,7 @@ buildFHSEnv {
 
   extraInstallCommands = ''
     mkdir -p "$out/share/icons/hicolor/64x64/apps"
-    ${lib.getBin unzip}/bin/unzip -p ${src} resources/Media/icon64${product.productName}.png > "$out/share/icons/hicolor/64x64/apps/burpsuite.png"
+    ${lib.getBin unzip}/bin/unzip -p ${src} resources/Media/icon64${iconName}.png > "$out/share/icons/hicolor/64x64/apps/burpsuite.png"
     cp -r ${desktopItem}/share/applications $out/share
   '';
 
@@ -103,9 +94,9 @@ buildFHSEnv {
       exploiting security vulnerabilities.
     '';
     homepage = "https://portswigger.net/burp/";
-    changelog =
-      "https://portswigger.net/burp/releases/professional-community-"
-      + lib.replaceStrings [ "." ] [ "-" ] version;
+    changelog = "https://portswigger.net/burp/releases/professional-community-${
+      lib.replaceStrings [ "." ] [ "-" ] version
+    }";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.unfree;
     platforms = jdk.meta.platforms;

pkgs/by-name/bu/burpsuite/update.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl jq xxd gnused diffutils
 set -eu -o pipefail
+trap 'rm -f latest.json' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
 curl -s 'https://portswigger.net/burp/releases/data' | jq -r '
       def verarr: (.Version // "") | split(".") | map(tonumber? // 0);
       [ .ResultSet.Results[]
-        | select((.categories|sort) == (["Professional","Community"]|sort))
+        | select(.categories == ["Desktop"])
         | .builds[]
         | select(.BuildCategoryPlatform == "Jar")
       ] as $all
@@ -16,23 +17,13 @@ curl -s 'https://portswigger.net/burp/releases/data' | jq -r '
       ' > latest.json
 
 version=$(jq -r '.[0].Version' latest.json)
-
-comm_hex=$(jq -r '.[] | select(.BuildCategoryId=="community") .Sha256Checksum' latest.json)
-pro_hex=$(jq -r '.[] | select(.BuildCategoryId=="pro") .Sha256Checksum' latest.json)
-
-comm_sri="sha256-$(printf %s "$comm_hex" | xxd -r -p | base64 -w0)"
-pro_sri="sha256-$(printf %s "$pro_hex" | xxd -r -p | base64 -w0)"
+hex=$(jq -r '.[0].Sha256Checksum' latest.json)
+sri="sha256-$(printf %s "$hex" | xxd -r -p | base64 -w0)"
 
 sed -i \
-  -e "s|^\(\s*version = \)\"[^\"]*\";|\1\"$version\";|" \
-  -e "/productName = \"community\"/,/hash =/ {
-        s|sha256-[^\"]*|$comm_sri|
-     }" \
-  -e "/productName = \"pro\"/,/hash =/ {
-        s|sha256-[^\"]*|$pro_sri|
-     }" \
-  $SCRIPT_DIR/package.nix
+    -e "s|^\(\s*version = \)\"[^\"]*\";|\1\"$version\";|" \
+    -e "s|^\(\s*hash = \)\"[^\]*\";|\1\"$sri\";|" \
+    $SCRIPT_DIR/package.nix
 
 echo "burpsuite → $version"
-echo "  community: $comm_sri"
-echo "  pro      : $pro_sri"
+echo "     hash: $sri"

pkgs/by-name/bu/butane/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "butane";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "butane";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RNK6G9/mNUTeRA0oWZoOdOUmc1F85Q3xmXUhtpgPymc=";
+    hash = "sha256-Cej00ugyOtjPys0E67z0oapwABdQxRuN4lOGu1qrtf8=";
   };
 
   vendorHash = null;

pkgs/by-name/c2/c2patool/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.56";
+  version = "0.26.59";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-Yn4+yyykhOWA79N1B6SBv2T9TvKeZWuTqvSgiFdKBHE=";
+    hash = "sha256-5QnclPyDfkO/NkIXeMAtyk9DVY3gEFuzbPwKqounsd0=";
   };
 
-  cargoHash = "sha256-qYY0UaMsIEh/8w/UJtO/fdnxjB6y2tlL/qROTJjJZBQ=";
+  cargoHash = "sha256-5hqSdLJXTJ4vZZMxEzJk2k+NmdGgPQCsvoGDzOzL9ok=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/ca/caesura/package.nix

@@ -5,13 +5,13 @@
   flac,
   lame,
   makeBinaryWrapper,
-  sox,
+  sox_ng,
 }:
 let
   runtimeDeps = [
     flac
     lame
-    sox
+    sox_ng
   ];
 in
 rustPlatform.buildRustPackage (finalAttrs: {

pkgs/by-name/ca/calibre/package.nix

@@ -248,6 +248,9 @@ stdenv.mkDerivation (finalAttrs: {
         # eglInitialize: Failed to get system egl display
         # Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
         "test_recipe_browser_webengine"
+        # Flaky test, occasionally errors with python exception:
+        # urllib.error.URLError: <urlopen error NetworkError.RemoteHostClosedError: Connection closed>
+        "test_recipe_browser_qt"
       ]
       ++ lib.optionals stdenv.hostPlatform.isAarch64 [
         # https://github.com/microsoft/onnxruntime/issues/10038

pkgs/by-name/ca/cargo-dist/package.nix

@@ -9,20 +9,21 @@
   zstd,
   git,
   rustup,
+  cacert,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-dist";
-  version = "0.30.4";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "axodotdev";
     repo = "cargo-dist";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Woaa+KNRLqTRgglGM50L8w6UXlnDTcUHQZ20AYbZPnE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BSE3pXo7Kk104v7VEh5WUk+Km1/n/kNf8NJGVGjUKoc=";
   };
 
-  cargoHash = "sha256-DVIckYfIf7EqqRXQbNI3msvDopSY7RxR11942w3XBjg=";
+  cargoHash = "sha256-bfX2Yt0wrPg1pbvYdr2O9VUqYlCFVRh4PIABWxZTgjg=";
 
   nativeBuildInputs = [
     pkg-config
@@ -37,10 +38,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeCheckInputs = [
     git
     rustup
+    cacert
   ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   };
 
   # remove tests that require internet access
@@ -54,7 +57,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Tool for building final distributable artifacts and uploading them to an archive";
     mainProgram = "dist";
     homepage = "https://github.com/axodotdev/cargo-dist";
-    changelog = "https://github.com/axodotdev/cargo-dist/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/axodotdev/cargo-dist/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit

pkgs/by-name/ca/cargo-generate/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-generate";
-  version = "0.23.8";
+  version = "0.23.9";
 
   src = fetchFromGitHub {
     owner = "cargo-generate";
     repo = "cargo-generate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Me3hgG6Z+JSsCjLVxbFDY3/6dUi4KtV6ArugFPgnda0=";
+    hash = "sha256-myakseKwLEjQa9GgcxdWZJWdjMFXh7Wi64CwrN2ZwSU=";
   };
 
-  cargoHash = "sha256-QhXHPnlU77ikaeTQLxBFYIc4j+tEZb0un3kVJanq7ZI=";
+  cargoHash = "sha256-IAUgpk3HD9znLORCQKNw+AO6NG9GEVWMU/cez3B+CKc=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.133";
+  version = "0.9.136";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-D8n7wvO9/MCSmvTkT6rht5+Zx9mOA/g8pajAVDVKGg8=";
+    hash = "sha256-SXpRSmCduZqF9HHvAd3NkgUtokZpxxu3f6IZEnLwA0g=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-oftwiuKIGaxr44RnkMUAu/uSs47Sh5DqqDKZWRXhAN4=";
+  cargoHash = "sha256-RWg1NcqlajN3GTOuMQ3WWWx5pa59YBZO3yKEm58qSu8=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/ca/cask-server/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   cmake,
   kdePackages,
-  wrapQtAppsHook,
+  libsForQt5,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     kdePackages.extra-cmake-modules
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   meta = {

pkgs/by-name/ch/chewing-editor/package.nix

@@ -7,8 +7,6 @@
   pkg-config,
   libchewing,
   qt5,
-  qtbase,
-  qttools,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,8 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gtest
     libchewing
-    qtbase
-    qttools
+    qt5.qtbase
+    qt5.qttools
   ];
 
   meta = {

pkgs/by-name/cl/claude-agent-acp/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.33.1";
+  version = "0.36.1";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FwcIJf/tfH6prDFKtOo7X1mTocibf4Ne6JHOS9ITG8U=";
+    hash = "sha256-mtdmzKuZF1eEt8FKm+VYp9h9igfRzQPQ2HCbq+IRVDw=";
   };
 
-  npmDepsHash = "sha256-y795LyNjSJjTpIqtA5bC/AgeFLghM0yU5xQRD3m+Ajs=";
+  npmDepsHash = "sha256-3lX2fAjVYWeFl9FAsSou30WOJ8st9lUdyt54hC4jN1E=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.143",
-  "commit": "cfb8132e4c3551e2773f41a1900efd1cc93637db",
-  "buildDate": "2026-05-15T17:47:13Z",
+  "version": "2.1.145",
+  "commit": "daa4c3755d45ab0cf97bb41db8c03bd2dfd2ff5f",
+  "buildDate": "2026-05-19T01:56:17Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "2701c6cfd68483f8faf0316a1ba6481a1455a90645ada179f0c48d8c36d722ef",
-      "size": 207605280
+      "checksum": "368dcd9709c85534f673071e7cc8eb5422bcff367fb9bdf5ce25d9619aab7ef5",
+      "size": 208546464
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "bc8ff4ce02b765a033808fb596f9522306cbe5c50d21344ed8752c08966f362c",
-      "size": 210119440
+      "checksum": "c23dc566214279d0708f4212261f023d8e63d5af5aef91638ebfdc090b3e33de",
+      "size": 211044112
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "32e8edc4a5c3c41d18607c75d1b8e7bec643330c03e266be46ac3b41a446c4eb",
-      "size": 232961672
+      "checksum": "75ad61d690d79440c82b5841444e1b42caae55736af37c97dd0e068ef20ce390",
+      "size": 233944712
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "f75fdc3ff9d9cd494b86192f9e349b5c5c6d3970ed4d5cd5c7b330c5a2b1dcc4",
-      "size": 233088720
+      "checksum": "b3ffbc12689bfe81389d6577787fcea4cab81bd3b6bba9b719e73770b62d720e",
+      "size": 234022608
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e68903ec56ddd5560bb0820c96c8f7a4193e7eab6236ede56cb2e05f450ce44f",
-      "size": 225816408
+      "checksum": "3a73f058b2225a4210931362bc9c98e486e3362ca28b339281755737fb375c7c",
+      "size": 226799448
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "e4cb8588ed6e38f9920bdaa2611263d4a0b0d11300f1d23945df234fdf5e278a",
-      "size": 227482672
+      "checksum": "cfc95961a41329204405c4b0e257cb467821133eb7bdb1ca0866dfe789d5d442",
+      "size": 228416560
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "e480244f2a4660fe76ed32442c1e3e2edda8fb5433417e73faba39f0e7f69eb6",
-      "size": 228902560
+      "checksum": "1da511cee5d3a4968634174498e9148635a5908d7f6ea5ec91b04d531c20c3bc",
+      "size": 229910176
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "5cbad78d2f316fedd0d621289aae558aaf259b404d0a46e0e49662ef3b397986",
-      "size": 224866976
+      "checksum": "b6b920c757e08ff3e4f0dc211360ad7815db539d4915bb691e57ee4d34db31e5",
+      "size": 225875616
     }
   }
 }

pkgs/by-name/cl/clipcat/package.nix

@@ -55,6 +55,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       xrelkd
       bot-wxt1221
     ];
+    broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "clipcatd";
   };
 })

pkgs/by-name/cl/clipit/package.nix

@@ -1,78 +0,0 @@
-{
-  fetchFromGitHub,
-  fetchpatch,
-  lib,
-  stdenv,
-  autoreconfHook,
-  intltool,
-  pkg-config,
-  gtk3,
-  libayatana-appindicator,
-  xdotool,
-  which,
-  wrapGAppsHook3,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "clipit";
-  version = "1.4.5";
-
-  src = fetchFromGitHub {
-    owner = "CristianHenzel";
-    repo = "ClipIt";
-    rev = "45e2ea386d04dbfc411ea370299502450d589d0c";
-    sha256 = "0byqz9hanwmdc7i55xszdby2iqrk93lws7hmjda2kv17g34apwl7";
-  };
-
-  preConfigure = ''
-    intltoolize --copy --force --automake
-  '';
-
-  patches = [
-    # Fixes for GCC14
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/clipit/-/raw/d4bafc28fcb445d1940cdfede6c70142cf3162f5/debian/patches/incompatible-pointer-types.patch";
-      hash = "sha256-STI1fpnoPdEqu1embQcUlTG712HPbJ+LPm930P13Ixo=";
-    })
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/clipit/-/raw/656d0814030c13437b10d40ee75615d0e8cd873e/debian/patches/missing-prototypes.patch";
-      hash = "sha256-UD183IjV5BprPHQK9bhmUBKfUYgqEZ9M1cRE+AmhAPA=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    wrapGAppsHook3
-    autoreconfHook
-    intltool
-  ];
-
-  configureFlags = [
-    "--with-gtk3"
-    "--enable-appindicator=yes"
-  ];
-
-  buildInputs = [
-    gtk3
-    libayatana-appindicator
-  ];
-
-  gappsWrapperArgs = [
-    "--prefix"
-    "PATH"
-    ":"
-    "${lib.makeBinPath [
-      xdotool
-      which
-    ]}"
-  ];
-
-  meta = {
-    description = "Lightweight GTK Clipboard Manager";
-    inherit (finalAttrs.src.meta) homepage;
-    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
-    mainProgram = "clipit";
-    maintainers = with lib.maintainers; [ kamilchm ];
-  };
-})

pkgs/by-name/cl/clojure/package.nix

@@ -13,12 +13,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.12.5.1638";
+  version = "1.12.5.1645";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-eAfhA0RByuQ8IdigJsHYotIPY/kDmLgDRHCw4uHzF5E=";
+    hash = "sha256-SoYS5/1yXsjkU/hwsi1bwaaO7/d0w9eTKamF81HAuDs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-dynamic-dns";
-  version = "4.4.4";
+  version = "4.4.5";
 
   src = fetchFromGitHub {
     owner = "zebradil";
     repo = "cloudflare-dynamic-dns";
     tag = finalAttrs.version;
-    hash = "sha256-VBBuBZ5J5ioLDzlslNahSwVGJ7RFJLmWs4WWs11SQaI=";
+    hash = "sha256-TIun4EZuk4lgtNiNRA8P0x3+hkh3UFMVMUa75YecUk0=";
   };
 
-  vendorHash = "sha256-UPzv8W18vdeTL/Rx32z5rJVcWHjFlImUKlUb9gt3TTM=";
+  vendorHash = "sha256-Pu73TKBgEgLhUktnY4o/fR4KBLT2s2CUGFSf2Jo3SbQ=";
 
   subPackages = ".";
 

pkgs/by-name/cl/cloudflared/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudflared";
-  version = "2026.3.0";
+  version = "2026.5.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = finalAttrs.version;
-    hash = "sha256-oGe6ZZeIcFC+ST78m54upFJmbPL2udwtFHaC8vrH4cg=";
+    hash = "sha256-3Znww+QsG7voek6XfwXVUmHCG+dIrMif2rMZXpZyNn0=";
   };
 
   vendorHash = null;
@@ -68,6 +68,11 @@ buildGoModule (finalAttrs: {
     #   Should be false
     substituteInPlace "datagramsession/manager_test.go" \
       --replace-warn "TestManagerCtxDoneCloseSessions" "SkipManagerCtxDoneCloseSessions"
+
+    # Workaround for: curves_test.go:121:
+    #   Should be true
+    substituteInPlace "crypto/curves_test.go" \
+      --replace-warn "TestSupportedCurvesNegotiation" "SkipSupportedCurvesNegotiation"
   '';
 
   doCheck = !stdenv.hostPlatform.isDarwin;

pkgs/by-name/co/cobang/package.nix

@@ -18,14 +18,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cobang";
-  version = "2.3.1";
+  version = "2.5.2";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "hongquan";
     repo = "CoBang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8qnF1w4zNYdH3QrzBnNjsPnOSMMD48H2tcTxPkemGEM=";
+    hash = "sha256-q28pSvEqWy56qNh7aE05PB6l3Hpu7eazz52REmQDYhY=";
   };
 
   nativeBuildInputs = [
@@ -59,6 +59,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pygobject3
     python-zbar
     qrcode
+    typing-extensions
   ];
 
   # Wrapping this manually for SVG recognition