Merge release-25.11 into staging-next-25.11

2026-06-05 21:03:40 +00:00 · 2026-05-30 00:46:31 +00:00
parent ce2d2d94bc 4ae4ff0d4b
commit a9f3d1316d
38 changed files with 726 additions and 228 deletions
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -35,10 +35,14 @@ jobs:
            into: staging-next-25.11
          - from: staging-next-25.11
            into: staging-25.11
+          - from: release-25.11
+            into: staging-nixos-25.11
          - from: release-26.05
            into: staging-next-26.05
          - from: staging-next-26.05
            into: staging-26.05
+          - from: release-26.05
+            into: staging-nixos-26.05
          - name: merge-base(master,staging) → haskell-updates
            from: master staging
            into: haskell-updates
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -443,6 +443,7 @@ The staging workflow is used for all stable branches with corresponding names:
 - `master`/`release-YY.MM`
 - `staging`/`staging-YY.MM`
 - `staging-next`/`staging-next-YY.MM`
+- `staging-nixos`/`staging-nixos-YY.MM`

 [^1]: Except changes that cause no more rebuilds than kernel updates

@@ -506,7 +507,7 @@ These PRs go to `staging-nixos`, see [the next section for more context](#change
 Changes causing a rebuild of all NixOS tests get a special [`10.rebuild-nixos-tests`](https://github.com/NixOS/nixpkgs/issues?q=state%3Aopen%20label%3A10.rebuild-nixos-tests) label.
 These changes pose a significant impact on the build infrastructure.

-Hence, these PRs should either target a `staging`-branch or `staging-nixos`, provided one of following conditions applies:
+Hence, these PRs should either target a `staging`-branch or `staging-nixos`-branch, provided one of following conditions applies:

 * The label `10.rebuild-nixos-tests` is set, or
 * The PR is a change affecting the Linux kernel.
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@@ -101,9 +101,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
  const rebuildsAllTests =
    changed.attrdiff.changed.includes('nixosTests.simple')

-  // https://github.com/NixOS/nixpkgs/pull/481205#issuecomment-3790123921
-  // These should go to staging-nixos instead of master,
-  // but release-xx.xx (not staging-xx.xx) when backported
+  // https://github.com/NixOS/nixpkgs/pull/521157
+  // These should go to master and release-xx.xx when backported
  let isExemptKernelUpdate = false
  if (prInfo.changed_files === 1) {
    const changedFiles = (
@@ -114,11 +113,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
    ).data
    isExemptKernelUpdate =
      changedFiles.length === 1 &&
-      (changedFiles[0].filename ===
-        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix' ||
-        (base.startsWith('release-') &&
-          changedFiles[0].filename ===
-            'pkgs/os-specific/linux/kernel/kernels-org.json'))
+      changedFiles[0].filename ===
+        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
  }

  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
@@ -163,8 +159,10 @@ async function checkTargetBranch({ github, context, core, dry }) {
      branchText = '(probably either `staging-nixos` or `staging`)'
    } else if (base === 'master') {
      branchText = '(probably `staging-nixos`)'
+    } else if (maxRebuildCount >= 500) {
+      branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
    } else {
-      branchText = `(probably \`staging-${split(base).version}\`)`
+      branchText = `(probably \`staging-nixos-${split(base).version}\`)`
    }
    const body = [
      `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -119,11 +119,10 @@ $ pkgs/os-specific/linux/kernel/update.sh
 The change gets submitted like this:

 * File a PR against `staging-nixos`.
-  * Add a `backport release-XX.XX` label for an automated backport.
-    We don't expect many other changes on that branch to require a backport, hence there's no such branch for stable.
+  * Add a `backport staging-nixos-XX.XX` label for an automated backport.
    By using an additional PR, we get the automatic backport against stable without manual cherry-picks.
-* Merge into `staging-nixos`.
-* File as PR from `staging-nixos` against `master`.
+* Merge into `staging-nixos` or `staging-nixos-XX.XX`.
+* File as PR from `staging-nixos` against `master` or `staging-nixos-XX.XX` against `release-xx.xx`.
 * When all status checks are green, merge.

 ### Add a new (major) version of the Linux kernel {#sec-linux-add-new-kernel-version}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -676,6 +676,7 @@
  ./services/hardware/nvidia-optimus.nix
  ./services/hardware/openrgb.nix
  ./services/hardware/pcscd.nix
+  ./services/hardware/pdudaemon.nix
  ./services/hardware/pid-fan-controller.nix
  ./services/hardware/pommed.nix
  ./services/hardware/power-profiles-daemon.nix
--- a/nixos/modules/services/hardware/pdudaemon.nix
+++ b/nixos/modules/services/hardware/pdudaemon.nix
@@ -0,0 +1,146 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.pdudaemon;
+  configFile = pkgs.writeText "pdudaemon.conf" (
+    lib.generators.toJSON { } {
+      daemon = {
+        hostname = cfg.bindAddress;
+        port = cfg.port;
+        logging_level = cfg.logLevel;
+        listener = cfg.listener;
+      };
+      pdus = cfg.pdus;
+    }
+  );
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.pdudaemon = {
+      enable = lib.mkEnableOption "PDUDaemon";
+
+      package = lib.mkPackageOption pkgs "pdudaemon" { };
+
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the PDUDaemon.";
+      };
+
+      port = lib.mkOption {
+        default = 16421;
+        type = lib.types.port;
+        description = "Port to bind to.";
+      };
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to automatically open the PDUDaemon listen port in the firewall.
+        '';
+      };
+
+      listener = lib.mkOption {
+        default = "http";
+        type = lib.types.enum [
+          "http"
+          "tcp"
+        ];
+        description = "Which kind of listener to provide.";
+      };
+
+      logLevel = lib.mkOption {
+        default = "error";
+        type = lib.types.enum [
+          "debug"
+          "info"
+          "warning"
+          "error"
+        ];
+        description = "PDUDaemon log level.";
+      };
+
+      pdus = lib.mkOption {
+        type = with lib.types; attrsOf anything;
+        default = { };
+        description = ''
+          Structural pdus section of PDUDaemon's pdudaemon.conf.
+          Refer to <https://github.com/pdudaemon/pdudaemon/blob/main/share/pdudaemon.conf>
+          for more examples.
+        '';
+        example = lib.literalExpression ''
+          {
+            cbs350-poe-switch = {
+              driver = "snmpv1";
+              community = "private";
+              oid = ".1.3.6.1.2.1.105.1.1.1.3.1.*;
+              onsetting = 1;
+              offsetting = 2;
+            };
+            energenie = {
+              driver = "EG-PMS";
+              device = "aa:bb:cc:xx:yy";
+            };
+            local = {
+              driver = "localcmdline";
+            };
+          };
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.pdudaemon = {
+      after = [ "network-online.target" ];
+      description = "Control and Queueing daemon for PDUs";
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --conf ${configFile}";
+        Type = "simple";
+        DynamicUser = "yes";
+        StateDirectory = "pdudaemon";
+        ProtectHome = true;
+        Restart = "on-failure";
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
+        RestrictNamespaces = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictRealtime = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
--- a/nixos/modules/services/networking/fastnetmon-advanced.nix
+++ b/nixos/modules/services/networking/fastnetmon-advanced.nix
@@ -207,6 +207,10 @@ in
          AmbientCapabilities = "cap_net_bind_service";
        };
      };
+
+      services.fastnetmon-advanced.hostgroups = {
+        global = { };
+      };
    })

    (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -405,6 +405,7 @@ in
  containers-tmpfs = runTest ./containers-tmpfs.nix;
  containers-unified-hierarchy = runTest ./containers-unified-hierarchy.nix;
  convos = runTest ./convos.nix;
+  coredns = runTest ./coredns.nix;
  corerad = runTest ./corerad.nix;
  corteza = runTest ./corteza.nix;
  cosmic = runTest {
@@ -1207,6 +1208,7 @@ in
  password-option-override-ordering = runTest ./password-option-override-ordering.nix;
  patroni = handleTestOn [ "x86_64-linux" ] ./patroni.nix { };
  pdns-recursor = runTest ./pdns-recursor.nix;
+  pdudaemon = runTest ./pdudaemon.nix;
  peerflix = runTest ./peerflix.nix;
  peering-manager = runTest ./web-apps/peering-manager.nix;
  peertube = handleTestOn [ "x86_64-linux" ] ./web-apps/peertube.nix { };
--- a/nixos/tests/coredns.nix
+++ b/nixos/tests/coredns.nix
@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+{
+  name = "coredns";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ johanot ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.dnsutils ];
+      services.coredns = {
+        enable = true;
+        config = ''
+          .:10053 {
+                ipecho {
+                  domain test.nixos.org
+                  ttl 2629800
+                }
+              }
+        '';
+        package = pkgs.coredns.override {
+          externalPlugins = [
+            {
+              name = "ipecho";
+              repo = "github.com/Eun/coredns-ipecho";
+              version = "224170ebca45cc59c6b071d280a18f42d1ff130c";
+              position = "start-of-file";
+            }
+          ];
+          vendorHash = "sha256-66WNU+t/frHfbxexYdiXzgXKLxPyLnN6JuKnlG/kSQY=";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("coredns.service")
+    machine.wait_for_open_port(10053)
+    machine.succeed("dig @127.0.0.1 -p 10053 127.0.0.2.test.nixos.org A +short | grep 127.0.0.2")
+  '';
+}
--- a/nixos/tests/docker.nix
+++ b/nixos/tests/docker.nix
@@ -15,7 +15,7 @@
      {
        virtualisation.docker.enable = true;
        virtualisation.docker.autoPrune.enable = true;
-        virtualisation.docker.package = pkgs.docker;
+        virtualisation.docker.package = pkgs.docker_29;

        users.users = {
          noprivs = {
@@ -48,7 +48,7 @@
    docker.succeed("docker stop sleeping")

    # Must match version 4 times to ensure client and server git commits and versions are correct
-    docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
+    docker.succeed('[ $(docker version | grep ${pkgs.docker_29.version} | wc -l) = "4" ]')
    docker.succeed("systemctl restart systemd-sysctl")
    docker.succeed("grep 1 /proc/sys/net/ipv4/conf/all/forwarding")
    docker.succeed("grep 1 /proc/sys/net/ipv4/conf/default/forwarding")
--- a/nixos/tests/fastnetmon-advanced.nix
+++ b/nixos/tests/fastnetmon-advanced.nix
@@ -62,7 +62,7 @@
      bird.wait_for_unit("bird.service")

      fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
-      fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+      fnm.wait_until_succeeds('journalctl -eu gobgp.service | grep "Peer Up"')
      bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
      fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
      fnm.succeed("fcli set blackhole 172.23.42.123")
--- a/nixos/tests/pdudaemon.nix
+++ b/nixos/tests/pdudaemon.nix
@@ -0,0 +1,50 @@
+{ pkgs, ... }:
+{
+  name = "PDUDaemon";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    aiyion
+    emantor
+  ];
+
+  nodes.pdudaemonhost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.pdudaemon.enable = true;
+      services.pdudaemon.openFirewall = true;
+      services.pdudaemon.pdus = {
+        testpduhost = {
+          driver = "localcmdline";
+          cmd_on = "echo '%s on' >> /tmp/pdu";
+          cmd_off = "echo '%s off' >> /tmp/pdu";
+        };
+      };
+    };
+
+  nodes.clienthost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    #python
+    ''
+      with subtest("Wait for pdudaemon startup"):
+          pdudaemonhost.start()
+          pdudaemonhost.wait_for_unit("pdudaemon.service")
+          pdudaemonhost.wait_for_open_port(16421)
+          print(pdudaemonhost.succeed("curl 'http://localhost:16421/power/control/on?hostname=testpduhost&port=1'"))
+
+      with subtest("Connect from client"):
+          clienthost.start()
+          clienthost.wait_until_succeeds("curl 'http://pdudaemonhost:16421/power/control/off?hostname=testpduhost&port=1'")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 15
+          service_name = "pdudaemon"
+          pdudaemonhost.fail(f"systemd-analyze security {service_name}.service --threshold={exact_threshold-1}")
+          pdudaemonhost.succeed(f"systemd-analyze security {service_name}.service --threshold={exact_threshold}")
+    '';
+}
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -12,7 +12,7 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.83";
+  version = "0.84";
  pname = "putty";

  src = fetchurl {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
      "https://the.earth.li/~sgtatham/putty/${version}/${pname}-${version}.tar.gz"
      "ftp://ftp.wayne.edu/putty/putty-website-mirror/${version}/${pname}-${version}.tar.gz"
    ];
-    hash = "sha256-cYd3wT1j0N/5H+AxYrwqBbTfyLCCdjTNYLUc79/2McY=";
+    hash = "sha256-BgV4Yq4Zjx29IZ0MdJMIDVn2BhlLtQVsVJ40KqAbaf4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -430,6 +430,9 @@ in
      containerdHash = "sha256-vz7RFJkFkMk2gp7bIMx1kbkDFUMS9s0iH0VoyD9A21s=";
      tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
      tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
+      knownVulnerabilities = [
+        "docker_28 has been unmaintained since November 2025, use docker_29 or newer instead"
+      ];
    };

  docker_29 =
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -640,7 +640,7 @@ buildStdenv.mkDerivation {

  profilingPhase = lib.optionalString pgoSupport ''
    # Avoid compressing the instrumented build with high levels of compression
-    export MOZ_PKG_FORMAT=tar
+    export MOZ_PKG_FORMAT=TAR

    # Package up Firefox for profiling
    ./mach package
--- a/pkgs/by-name/al/alire/package.nix
+++ b/pkgs/by-name/al/alire/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alire";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "alire-project";
    repo = "alire";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
+    hash = "sha256-YOUFTKbqbFfdYNWcGCvtFCDCW2tH8E3YuRQrV522Px4=";

    fetchSubmodules = true;
  };
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
  installShellFiles,
  nixosTests,
  externalPlugins ? [ ],
-  vendorHash ? "sha256-bnNpJgy54wvTST1Jtfbd1ldLJrIzTW62TL7wyHeqz28=",
+  vendorHash ? "sha256-9LLTgIjOOMvYx4nhy+6X9bEBvqlKeTx//39q+YWXeHw=",
 }:

 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "coredns";
-  version = "1.13.2";
+  version = "1.14.3";

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9ggyFixdNy0t4UA8ZxU5oMUzA/8EB/k1jors4f8Q6YE=";
+    hash = "sha256-Uk4oWsUxaGdLQzX5JywYzi7pmQHGo06uQdLeOkP4U/s";
  };

  inherit vendorHash;
@@ -32,59 +32,61 @@ buildGoModule (finalAttrs: {
    "man"
  ];

-  # Override the go-modules fetcher derivation to fetch plugins
-  modBuildPhase = ''
-    cp plugin.cfg plugin.cfg.orig
-    ${
-      (lib.concatMapStringsSep "\n" (
-        plugin:
-        let
-          position = plugin.position or "end-of-file";
-          formatPlugin = { name, repo, ... }: "${name}:${repo}";
-        in
-        if position == "end-of-file" then
-          "echo '${formatPlugin plugin}' >> plugin.cfg"
-        else if position == "start-of-file" then
-          "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
-        else if lib.hasAttrByPath [ "before" ] position then
-          ''
-            if ! grep -q '^${position.before}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
-          ''
-        else if lib.hasAttrByPath [ "after" ] position then
-          ''
-            if ! grep -q '^${position.after}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
-          ''
-        else
-          throw ''
-            Unsupported position value in externalPlugin:
-              ${builtins.toJSON plugin}.
-            Valid values for position attr are:
-              - position = "end-of-file" (the default)
-              - position = "start-of-file"
-              - position.before = "{other plugin}"
-              - position.after = "{other plugin}"
-          ''
-      ) externalPlugins)
-    }
-    diff -u plugin.cfg.orig plugin.cfg || true
-    for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
-    CC= GOOS= GOARCH= go generate
-    go mod tidy
-    go mod vendor
-  '';
+  overrideModAttrs = {
+    # Add plugins before vendoring the modules.
+    preBuild = ''
+      cp plugin.cfg plugin.cfg.orig
+      ${
+        (lib.concatMapStringsSep "\n" (
+          plugin:
+          let
+            position = plugin.position or "end-of-file";
+            formatPlugin = { name, repo, ... }: "${name}:${repo}";
+          in
+          if position == "end-of-file" then
+            "echo '${formatPlugin plugin}' >> plugin.cfg"
+          else if position == "start-of-file" then
+            "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
+          else if lib.hasAttrByPath [ "before" ] position then
+            ''
+              if ! grep -q '^${position.before}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
+            ''
+          else if lib.hasAttrByPath [ "after" ] position then
+            ''
+              if ! grep -q '^${position.after}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
+            ''
+          else
+            throw ''
+              Unsupported position value in externalPlugin:
+                ${builtins.toJSON plugin}.
+              Valid values for position attr are:
+                - position = "end-of-file" (the default)
+                - position = "start-of-file"
+                - position.before = "{other plugin}"
+                - position.after = "{other plugin}"
+            ''
+        ) externalPlugins)
+      }
+      diff -u plugin.cfg.orig plugin.cfg || true
+      for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+      GOFLAGS=''${GOFLAGS//-mod=vendor/} CC= GOOS= GOARCH= go generate
+      go mod tidy
+    '';

-  modInstallPhase = ''
-    mv -t vendor go.mod go.sum plugin.cfg
-    cp -r --reflink=auto vendor "$out"
-  '';
+    # Move the modified `go.mod`, `go.sum`, and `plugin.cfg` files into the
+    # vendor directory so we can retrieve them later in the `preBuild` hook.
+    postBuild = ''
+      mv -t vendor go.mod go.sum plugin.cfg
+    '';
+  };

  preBuild = ''
    chmod -R u+w vendor
@@ -102,10 +104,21 @@ buildGoModule (finalAttrs: {
    substituteInPlace test/readme_test.go \
      --replace-fail "TestReadme" "SkipReadme"

+    substituteInPlace test/metrics_test.go \
+      --replace-fail "TestMetricsRewriteRequestSize" "SkipMetricsRewriteRequestSize"
+
+    substituteInPlace test/quic_test.go \
+      --replace-fail "TestQUICReloadDoesNotPanic" "SkipQUICReloadDoesNotPanic"
+
    # this test fails if any external plugins were imported.
    # it's a lint rather than a test of functionality, so it's safe to disable.
    substituteInPlace test/presubmit_test.go \
      --replace-fail "TestImportOrdering" "SkipImportOrdering"
+
+    substituteInPlace plugin/pkg/parse/transport_test.go \
+      --replace-fail \
+        "TestTransport" \
+        "SkipTransport"
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    # loopback interface is lo0 on macos
@@ -123,6 +136,7 @@ buildGoModule (finalAttrs: {
  '';

  passthru.tests = {
+    coredns-external-plugins = nixosTests.coredns;
    kubernetes-single-node = nixosTests.kubernetes.dns-single-node;
    kubernetes-multi-node = nixosTests.kubernetes.dns-multi-node;
  };
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "distribution";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "distribution";
    repo = "distribution";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-r0J1zsj4Qioe8+dByqzOgJypW+A06P2uIjetPu7w+24=";
+    hash = "sha256-KsN3QW71VwGrgrhOmwzzmTm/54+ZaTFj5kNgbta1FmI=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fa/fastnetmon-advanced/package.nix
+++ b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
@@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "fastnetmon-advanced";
-  version = "2.0.372";
+  version = "2.0.380";

  src = fetchurl {
-    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-FwYAbTBkk+AciDVxTIimswsB0M3gbzKX+03PD0fLMsY=";
+    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_noble/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
+    hash = "sha256-4hCrDaFat0kEbyzKg6nHdV+LlqCBYYJEojyvXyPYKD0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "forgejo-runner";
-  version = "12.10.1";
+  version = "12.10.2";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OBMduRaGSVPojSAr6DKPbAdUyuw1MSCpipRv+EA5OGw=";
+    hash = "sha256-Uo+x02HgpfOY+KXug7cmnW4d85AlX6wqz+nYGF/JrHk=";
  };

-  vendorHash = "sha256-V9dEHNp80oS7NfsGIlKgFyHD1PmMm2bCqydVADpphuA=";
+  vendorHash = "sha256-0gOftkxkBPziU0Tm8lIiD72rXcMMY5M57G9/Bt/mneI=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "haproxy";
-  version = "3.2.9";
+  version = "3.2.19";

  src = fetchurl {
    url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5mDRQbKQGfTRmHhbCDTMPpyW787rgHwv/y/JNb0zVMI=";
+    hash = "sha256-sI671X9XUBLkpetbdychUx+6z2kT/9M08CgXNqGteLY=";
  };

  buildInputs = [
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let

  pname = "librewolf-bin-unwrapped";

-  version = "150.0.2-1";
+  version = "151.0.1-2";
 in

 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
    url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
    hash =
      {
-        x86_64-linux = "sha256-KMpSMcLJ/wkySo2gbiECJfH2/hcxdTSLXwKcZLMkvhk=";
-        aarch64-linux = "sha256-Dxs7eRN6nj3e/6pQ3z0d27tnTtD6CefhUxPZGwTVL+Y=";
+        x86_64-linux = "sha256-YqFUKUK4GoP2JAIa3aJqz/iAAmD8hh5UqVzbm4jjvm8=";
+        aarch64-linux = "sha256-TIJEiffEa7X51RGmntCAR7NLP51qcJ08aTvKxVAYNsY=";
      }
      .${stdenv.hostPlatform.system} or throwSystem;
  };
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "151.0.1-2",
+  "packageVersion": "151.0.2-1",
  "source": {
-    "rev": "151.0.1-2",
-    "hash": "sha256-6C048VV6NECGTcdGla4qIa88z677ZTjORf5FM0a4xMM="
+    "rev": "151.0.2-1",
+    "hash": "sha256-Iq6Jf8Cw2AgkI5zehV5TJQBFHCGANtj4e13cy+ANoTo="
  },
  "firefox": {
-    "version": "151.0.1",
-    "hash": "sha512-hJKhu5VrODcxU5OL0YsOGOOkrQ0qvCAXtF4CvCdoyPRo1cBjKaMkhaA6Z7ucIhAuar/x5zCAx3dkc11DDcdydw=="
+    "version": "151.0.2",
+    "hash": "sha512-hzCJU+01SieZqaRb5AAzv5/42A+iIPA0qs+9bnVHFpAdQWTDf6VgMsZZslkRZgPguitWbB82UaucwINdUCzXOQ=="
  }
 }
--- a/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch
+++ b/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch
@@ -1,15 +1,17 @@
-diff --git a/BUILD.gn b/BUILD.gn
-index d5289b8..598bbbc 100644
 --- a/BUILD.gn
 +++ b/BUILD.gn
-@@ -138,8 +138,8 @@ config("library_impl_config") {
+@@ -143,8 +143,12 @@
 # target_defaults and direct_dependent_settings.
 config("common_inherited_config") {
-   defines = []
+   defines = [ "PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII=0" ]
 -  cflags = []
 -  ldflags = []
 +  cflags = [ "-fvisibility=default" ]
 +  ldflags = [ "-lavutil", "-lavformat", "-lavcodec" ]
- 
-   if (rtc_dlog_always_on) {
-     defines += [ "DLOG_ALWAYS_ON" ]
+
+  if (is_linux) {
+    ldflags += [ "-Wl,--version-script=" + rebase_path("//libwebrtc.version", root_build_dir) ]
+  }
+
+   if (rtc_objc_prefix != "") {
+     defines += [ "RTC_OBJC_TYPE_PREFIX=${rtc_objc_prefix}" ]
--- a/pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch
+++ b/pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch
@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 45086d6838cac..81132ad8ecb31 100644
+--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
+@@ -1727,16 +1727,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
+-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
+-  # library. The Rust symbols are marked as weak, so that they can be replaced by
+-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
+-  # order to cause that replacement to occur by explicitly linking in clang's
+-  # compiler-rt library.
+-  if (is_clang && !is_nacl && !is_cronet_build) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {
--- a/pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version
+++ b/pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version
@@ -0,0 +1,22 @@
+/* Linker version script for libwebrtc.so (Linux only).
+ *
+ * When libwebrtc.so is built with rtc_use_pipewire=true and
+ * -fvisibility=default, PipeWire lazy-load trampoline stubs (pw_*, spa_*)
+ * are exported as weak symbols. If the PipeWire ALSA plugin
+ * (libasound_module_pcm_pipewire.so) is later dlopen'd by libasound,
+ * the dynamic linker may resolve the plugin's pw_* references through
+ * libwebrtc.so's broken trampolines instead of the real libpipewire.so,
+ * causing a SIGSEGV (NULL function pointer dereference).
+ *
+ * This script hides only those third-party symbol namespaces while
+ * keeping every WebRTC / BoringSSL / internal symbol exported (which
+ * the Rust webrtc-sys bindings require).
+ */
+{
+  global:
+    *;
+
+  local:
+    pw_*;
+    spa_*;
+};
--- a/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix
@@ -10,7 +10,7 @@
  libxml2,
  libxslt,
  minizip,
-  ffmpeg_6,
+  ffmpeg_8,
 }:
 {
  "brotli" = {
@@ -58,7 +58,7 @@
    path = "third_party/zlib/BUILD.gn";
  };
  "ffmpeg" = {
-    package = ffmpeg_6;
+    package = ffmpeg_8;
    path = "third_party/ffmpeg/BUILD.gn";
  };
 }
--- a/pkgs/by-name/li/livekit-libwebrtc/package.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/package.nix
@@ -9,7 +9,6 @@
  xcbuild,
  python3,
  ninja,
-  darwinMinVersionHook,
  git,
  cpio,
  pkg-config,
@@ -28,7 +27,19 @@
  libxml2,
  libxslt,
  minizip,
-  ffmpeg_6,
+  ffmpeg_8,
+  libepoxy,
+  libgbm,
+  libGL,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libxtst,
+  pipewire,
+  libx11,
+  libxi,
 }:
 let
  platformMap = {
@@ -63,13 +74,13 @@ let
      libxml2
      libxslt
      minizip
-      ffmpeg_6
+      ffmpeg_8
      ;
  };
 in
 stdenv.mkDerivation {
  pname = "livekit-libwebrtc";
-  version = "125-unstable-2025-07-25";
+  version = "137-unstable-2026-03-12";

  gclientDeps = gclient2nix.importGclientDeps ./sources.json;
  sourceRoot = "src";
@@ -77,30 +88,45 @@ stdenv.mkDerivation {
  patches = [
    # Adds missing dependencies to generated LICENSE
    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_licenses.patch";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_licenses.patch";
      hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
    })
    # Fixes the certificate chain, required for Let's Encrypt certs
    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
-      hash = "sha256-/gneuCac4VGJCWCjJZlgLKFOTV+x7Lc5KVFnNIKenwM=";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
+      hash = "sha256-RBvRcJzoKItpEbqpe07YZe1D1ZVGS12EnDSISldGy+0=";
    })
    # Adds dependencies and features required by livekit
    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_deps.patch";
-      hash = "sha256-EMNYcTcBYh51Tt96+HP43ND11qGKClfx3xIPQmIBSo0=";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_deps.patch";
+      hash = "sha256-DwRtGdU5sppmiFsVuyhJoVCQrRl5JFmZJfxgUPhYXBg=";
    })
-    # Fixes "error: no matching member function for call to 'emplace'"
+    # Fix gcc-related errors
    (fetchpatch {
-      url = "https://raw.githubusercontent.com/zed-industries/livekit-rust-sdks/5f04705ac3f356350ae31534ffbc476abc9ea83d/webrtc-sys/libwebrtc/patches/abseil_use_optional.patch";
-      hash = "sha256-FOwlwOqgv5IEBCMogPACbXXxdNhGzpYcVfsolcwA7qU=";
-
-      extraPrefix = "third_party/";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/force_gcc.patch";
+      hash = "sha256-1d73Pi1HkbunjYvp1NskUNE4xXbCmnh++rC6NrCJHbY=";
      stripLen = 1;
+      extraPrefix = "build/";
    })
-    # Required for dynamically linking to ffmpeg libraries and exposing symbols
+    # fix a gcc-related dav1d compile option
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/david_disable_gun_source_macro.patch";
+      hash = "sha256-RCZpeeSQHaxkL3dY2oFFXDjYeU0KHw7idQFONGge8+0=";
+      stripLen = 1;
+      extraPrefix = "third_party/";
+    })
+    # Required for dynamically linking to ffmpeg libraries, exposing symbols,
+    # and hiding PipeWire symbols via version script (Linux only) to prevent
+    # SIGSEGV when ALSA's PipeWire plugin is loaded.
    ./0001-shared-libraries.patch
-  ];
+    # Borrow a patch from chromium to prevent a build failure due to missing libclang libraries
+    ./chromium-129-rust.patch
+  ]
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    # Fix a broken build with pipewire 1.5+
+    # From https://github.com/Thaodan/tg_owt/commit/960b6b30a9c7e9e4451031c30f362fd01d2ce7c1
+    ./pipewire-1.5.patch
+  ]);

  postPatch = ''
    substituteInPlace .gn \
@@ -131,13 +157,24 @@ stdenv.mkDerivation {
          -delete
      fi
    done
+
+    # Trick the update_rust.py script into thinking we have *this specific* rust available.
+    # It isn't actually needed for the libwebrtc build, but GN will fail if it isn't there.
+    mkdir -p third_party/rust-toolchain
+    (python3 tools/rust/update_rust.py --print-package-version || true) \
+      | head -n 1 \
+      | sed 's/.* expected Rust version is \([^ ]*\) .*/rustc 1.0 1234 (\1 chromium)/' \
+      > third_party/rust-toolchain/VERSION
  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p buildtools/linux64
    ln -sf ${lib.getExe gn} buildtools/linux64/gn
+    cp ${./libwebrtc.version} libwebrtc.version
    substituteInPlace build/toolchain/linux/BUILD.gn \
      --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p buildtools/mac
    ln -sf ${lib.getExe gn} buildtools/mac/gn
    chmod +x build/toolchain/apple/linker_driver.py
    patchShebangs build/toolchain/apple/linker_driver.py
@@ -174,6 +211,18 @@ stdenv.mkDerivation {
    glib
    alsa-lib
    pulseaudio
+    libepoxy
+    libgbm
+    libGL
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrandr
+    libxtst
+    pipewire
+    libx11
+    libxi
  ]);

  preConfigure = ''
@@ -200,16 +249,19 @@ stdenv.mkDerivation {
    "is_component_build=true"
    "enable_stripping=true"
    "rtc_use_h264=true"
+    "rtc_use_h265=true"
    "use_custom_libcxx=false"
    "use_rtti=true"
  ]
  ++ (lib.optionals stdenv.hostPlatform.isLinux [
-    "use_goma=false"
-    "rtc_use_pipewire=false"
+    "rtc_use_pipewire=true"
    "symbol_level=0"
    "enable_iterator_debugging=false"
-    "rtc_use_x11=false"
+    "rtc_use_x11=true"
    "use_sysroot=false"
+    "use_custom_libcxx_for_host=false"
+    "use_libcxx_modules=false"
+    "use_llvm_libatomic=false"
    "is_clang=false"
  ])
  ++ (lib.optionals stdenv.hostPlatform.isDarwin [
@@ -233,6 +285,7 @@ stdenv.mkDerivation {
    "pc:peer_connection"
    "sdk:videocapture_objc"
    "sdk:mac_framework_objc"
+    "desktop_capture_objc"
  ];

  postBuild =
@@ -251,10 +304,11 @@ stdenv.mkDerivation {
    mkdir -p $out/lib
    mkdir -p $dev/include

-    install -m0644 obj/webrtc.ninja args.gn LICENSE.md $dev
+    install -m0644 obj/webrtc.ninja obj/modules/desktop_capture/desktop_capture.ninja args.gn LICENSE.md $dev

    pushd ../..
    find . -name "*.h" -print | cpio -pd $dev/include
+    find . -name "*.inc" -print | cpio -pd $dev/include
    popd
  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
--- a/pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch
+++ b/pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch
@@ -0,0 +1,35 @@
+From 960b6b30a9c7e9e4451031c30f362fd01d2ce7c1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B6rn=20Kettunen?= <bjorn.kettunen@thaodan.de>
+Date: Fri, 28 Nov 2025 19:41:02 +0200
+Subject: [PATCH] Fix building with Pipewire 1.5.81 and later. Resolves #167
+
+---
+ .../desktop_capture/linux/wayland/shared_screencast_stream.cc   | 2 ++
+ modules/video_capture/linux/pipewire_session.cc             | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc b/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+index 71ea4d9f5..7ef1a030e 100644
+--- a/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+++ b/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+@@ -13,6 +13,8 @@
+ #include <fcntl.h>
+ #include <libdrm/drm_fourcc.h>
+ #include <pipewire/pipewire.h>
+#include <spa/pod/parser.h>
+#include <spa/pod/iter.h>
+ #include <spa/param/video/format-utils.h>
+ #include <sys/mman.h>
+ 
+diff --git a/modules/video_capture/linux/pipewire_session.cc b/modules/video_capture/linux/pipewire_session.cc
+index d2d8eeaf8..c16d511ba 100644
+--- a/modules/video_capture/linux/pipewire_session.cc
+++ b/modules/video_capture/linux/pipewire_session.cc
+@@ -15,6 +15,7 @@
+ #include <spa/param/format.h>
+ #include <spa/param/video/raw.h>
+ #include <spa/pod/parser.h>
+#include <spa/pod/iter.h>
+ 
+ #include "common_video/libyuv/include/webrtc_libyuv.h"
+ #include "modules/video_capture/device_info_impl.h"
--- a/pkgs/by-name/li/livekit-libwebrtc/sources.json
+++ b/pkgs/by-name/li/livekit-libwebrtc/sources.json
@@ -1,74 +1,74 @@
 {
    "src": {
        "args": {
-            "hash": "sha256-zSWjPxcrvLpi+zaJ+GReG3YsjPKqxBdkKfe8Gj/O0dA=",
+            "hash": "sha256-KVbw0ikSo1fkLT63zo5/GIBwUDB8QRcxubhP7pYD5vA=",
            "owner": "webrtc-sdk",
            "repo": "webrtc",
-            "rev": "db3ba7af86dd6d48174ed35387d11c0794f1a21b"
+            "rev": "a4bd28d99eb9ed3bc8e41ce7b9ce7254ee7308bd"
        },
        "fetcher": "fetchFromGitHub"
    },
    "src/base": {
        "args": {
-            "hash": "sha256-Hw0cXws+0M2UcvcnJZGkUtH28ZEDfxNl0e8ngWlAZnA=",
-            "rev": "738cf0c976fd3d07c5f1853f050594c5295300d8",
+            "hash": "sha256-MTG+pjMPY6/dqeEUy+xJVxPuICETtV98S+h/lFwGItg=",
+            "rev": "86c814633cf284bc8057a539bc722e2a672afe2f",
            "url": "https://chromium.googlesource.com/chromium/src/base"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/build": {
        "args": {
-            "hash": "sha256-mPjb7/TTJ7/oatBdIRGhSsacjbyu5ZilUgyplAtji1s=",
+            "hash": "sha256-qFZ12YFX4qxFEHU+VWOG+HDYYPXodgGz+iJ7WEc7cD8=",
            "owner": "webrtc-sdk",
            "repo": "build",
-            "rev": "6978bac6466311e4bee4c7a9fd395faa939e0fcd"
+            "rev": "01021e6c12636951a6b4e5342e16b2101b352367"
        },
        "fetcher": "fetchFromGitHub"
    },
    "src/buildtools": {
        "args": {
-            "hash": "sha256-OS9k7sDzAVH+NU9P4ilKJavkiov/1qq1fG5AWq9kH/Y=",
-            "rev": "5eb927f0a922dfacf10cfa84ee76f39dcf2a7311",
+            "hash": "sha256-YWtmMKL1ydueNJ4XM/Pq+8OpqIFe5A6/vYyfZTv7/EI=",
+            "rev": "0f32cb9025766951122d4ed19aba87a94ded3f43",
            "url": "https://chromium.googlesource.com/chromium/src/buildtools"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/testing": {
        "args": {
-            "hash": "sha256-VisK7NDR/xDC3OM7LD9Gyo58rs1GE37i7QRYC/Kk12k=",
-            "rev": "d6e731571c33f30e5dc46f54c69e6d432566e55c",
+            "hash": "sha256-s65cABkyMo+FkAmilS67qM3VnrT7iYZg9scycrXzxyE=",
+            "rev": "a89c37d36bf80c05963727e28b9916835ae88d3a",
            "url": "https://chromium.googlesource.com/chromium/src/testing"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party": {
        "args": {
-            "hash": "sha256-TdB8qMcmXO3xgYyJkHHwn/8tVg1pFMlrNABpQQ80bOY=",
-            "rev": "f36c4b6e56aaa94606c87fa0c3f7cbdbb5c70546",
+            "hash": "sha256-q+xVOFlpC0vnLMSF9Z6ZRL7mb/cu8jBpsWjDNFFgiKM=",
+            "rev": "8062e0e102496ff14a8c58b586f014527424953d",
            "url": "https://chromium.googlesource.com/chromium/src/third_party"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/boringssl/src": {
        "args": {
-            "hash": "sha256-Ln6rnbn2hwszst24E/6EpP2C3Scoppe7wvVKFtxuPjQ=",
-            "rev": "12391e648d3c6f04a718721568cc89208b780654",
+            "hash": "sha256-5Efqc8pLs4ZskXQGpFdTb5cw//v3+DR285m/DsrWSWA=",
+            "rev": "34492c89a8e381e0e856a686cc71b1eb5bd728db",
            "url": "https://boringssl.googlesource.com/boringssl.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/breakpad/breakpad": {
        "args": {
-            "hash": "sha256-qAIXZ1jZous0Un0jVkOQ66nA2525NziV3Lbso2/+Z1Y=",
-            "rev": "76788faa4ef163081f82273bfca7fae8a734b971",
+            "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c=",
+            "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
            "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/catapult": {
        "args": {
-            "hash": "sha256-uqtyxO7Ge3egBsYmwcRGiV1lqm4iYVHrqYfDz7r6Byo=",
-            "rev": "88367fd8c736a2601fc183920c9ffe9ac2ec32ac",
+            "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw=",
+            "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
            "url": "https://chromium.googlesource.com/catapult.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -83,8 +83,8 @@
    },
    "src/third_party/clang-format/script": {
        "args": {
-            "hash": "sha256-whD8isX2ZhLrFzdxHhFP1S/sZDRgyrzLFaVd7OEFqYo=",
-            "rev": "3c0acd2d4e73dd911309d9e970ba09d58bf23a62",
+            "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
+            "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -97,42 +97,50 @@
        },
        "fetcher": "fetchFromGitiles"
    },
+    "src/third_party/compiler-rt/src": {
+        "args": {
+            "hash": "sha256-yo7BFGgwJNScsXwnCAu8gFBdZVS8/HJplzUk2e73mVg=",
+            "rev": "57213f125d03209892fed26189feb3b736e96735",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
    "src/third_party/crc32c/src": {
        "args": {
-            "hash": "sha256-urg0bmnfMfHagLPELp4WrNCz1gBZ6DFOWpDue1KsMtc=",
-            "rev": "fa5ade41ee480003d9c5af6f43567ba22e4e17e6",
+            "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
+            "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
            "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/dav1d/libdav1d": {
        "args": {
-            "hash": "sha256-AA2bcrsW1xFspyl5TqYUJeAwKM06rWTNtXr/uMVIJmw=",
-            "rev": "006ca01d387ac6652825d6cce1a57b2de67dbf8d",
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
            "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/depot_tools": {
        "args": {
-            "hash": "sha256-RguGUaIpxtxrY+LksFmeNbZuitZpB6O9HJc1c4TMXeQ=",
-            "rev": "495b23b39aaba2ca3b55dd27cadc523f1cb17ee6",
+            "hash": "sha256-DWQyYtpAAGiryeGJzIWlUwY5yn4cNwXY957vlPDUNak=",
+            "rev": "fa8fc854e1766b86f10c9a15902cf3cc23adaac2",
            "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/ffmpeg": {
        "args": {
-            "hash": "sha256-6+Sc5DsPaKW68PSUS4jlpzRXjPhEN7LFQATVVL9Xhfo=",
-            "rev": "901248a373cbbe7af68fb92faf3be7d4f679150d",
+            "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI=",
+            "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
            "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/flatbuffers/src": {
        "args": {
-            "hash": "sha256-LecJwLDG6szZZ/UOCFD+MDqH3NKawn0sdEwgnMt8wMM=",
-            "rev": "bcb9ef187628fe07514e57756d05e6a6296f7dc5",
+            "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
+            "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
            "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -147,40 +155,40 @@
    },
    "src/third_party/freetype/src": {
        "args": {
-            "hash": "sha256-XBHWUw28bsCpwUXb+faE36DRdujuKiWoJ+dEmUk07s4=",
-            "rev": "b3a6a20a805366e0bc7044d1402d04c53f9c1660",
+            "hash": "sha256-Vlin6Z+QisUyj6R+TclVOm8x6673YhUIWob9Ih6gzC8=",
+            "rev": "1da283b8ae6d6b94f34a5c4b8c1227adc9dbb1d8",
            "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/fuzztest/src": {
        "args": {
-            "hash": "sha256-8w4yIW15VamdjevMO27NYuf+GFu5AvHSooDZH0PbS6s=",
-            "rev": "65354bf09a2479945b4683c42948695d4f2f7c07",
+            "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw=",
+            "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
            "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/google_benchmark/src": {
        "args": {
-            "hash": "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=",
-            "rev": "344117638c8ff7e239044fd0fa7085839fc03021",
+            "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
+            "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
            "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/googletest/src": {
        "args": {
-            "hash": "sha256-JCIJrjN/hH6oAgvJRuv3aJA+z6Qe7yefyRbAhP5bZDc=",
-            "rev": "5197b1a8e6a1ef9f214f4aa537b0be17cbf91946",
+            "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg=",
+            "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
            "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/grpc/src": {
        "args": {
-            "hash": "sha256-64JEVCx/PCM0dvv7kAQvSjLc0QbRAZVBDzwD/FAV6T8=",
-            "rev": "822dab21d9995c5cf942476b35ca12a1aa9d2737",
+            "hash": "sha256-xivmP36VCSbiMAV3PDUjzCrF+AJzFXJdMe5e2q9yW/k=",
+            "rev": "957c9f95224b1e1318c0ecb98d0e7584ea5ccff2",
            "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -195,24 +203,24 @@
    },
    "src/third_party/harfbuzz-ng/src": {
        "args": {
-            "hash": "sha256-VAan6P8PHSq8RsGE4YbI/wCfFAhzl3nJMt0cQBYi5Ls=",
-            "rev": "155015f4bec434ecc2f94621665844218f05ce51",
+            "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4=",
+            "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
            "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/icu": {
        "args": {
-            "hash": "sha256-frsmwYMiFixEULsE91x5+p98DvkyC0s0fNupqjoRnvg=",
-            "rev": "364118a1d9da24bb5b770ac3d762ac144d6da5a4",
+            "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k=",
+            "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
            "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/instrumented_libs": {
        "args": {
-            "hash": "sha256-SGEB74fK9e0WWT77ZNISE9fVlXGGPvZMBUsQ3XD+DsA=",
-            "rev": "0172d67d98df2d30bd2241959d0e9569ada25abe",
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
            "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -227,128 +235,136 @@
    },
    "src/third_party/libFuzzer/src": {
        "args": {
-            "hash": "sha256-T0dO+1A0r6kLFoleMkY8heu80biPntCpvA6YfqA7b+E=",
-            "rev": "758bd21f103a501b362b1ca46fa8fcb692eaa303",
+            "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
+            "rev": "e31b99917861f891308269c36a32363b120126bb",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libaom/source/libaom": {
        "args": {
-            "hash": "sha256-0tLfbfYyCnG89DHNIoYoiitN9pFFcuX/Nymp3Q5xhBg=",
-            "rev": "eefd5585a0c4c204fcf7d30065f8c2ca35c38a82",
+            "hash": "sha256-ngVZ+xK0b+jKUmawteQ7VFAQzoebX4jqZ3hP9pW+Q0Q=",
+            "rev": "a23a4799ec2d7dd6e436c7b64a34553773014ed7",
            "url": "https://aomedia.googlesource.com/aom.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libc++/src": {
        "args": {
-            "hash": "sha256-ocJqlENHw19VpkFxKwHneGw3aNh56nt+/JeopxLj2M8=",
-            "rev": "e3b94d0e5b86883fd77696bf10dc33ba250ba99b",
+            "hash": "sha256-lqeuVUgeAKm1pxo+w1vyUbBkBXBzLCQ+Lfu44neKLPo=",
+            "rev": "917609c669e43edc850eeb192a342434a54e1dfd",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libc++abi/src": {
        "args": {
-            "hash": "sha256-qBupfCAnSNpvqcwFycQEi5v6TBAH5LdQI5YcLeQD2y8=",
-            "rev": "932d253fedb390a08b17ec3a92469a4553934a6a",
+            "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk=",
+            "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libjpeg_turbo": {
        "args": {
-            "hash": "sha256-+t75ZAdOXc7Nd1/8zEQLX+enZb8upqIQuR6qzb9z7Cg=",
-            "rev": "9b894306ec3b28cea46e84c32b56773a98c483da",
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
            "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libsrtp": {
        "args": {
-            "hash": "sha256-XOPiDAOHpWyCiXI+fi1CAie0Zaj4v14m9Kc8+jbzpUY=",
-            "rev": "7a7e64c8b5a632f55929cb3bb7d3e6fb48c3205a",
+            "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
+            "rev": "a52756acb1c5e133089c798736dd171567df11f5",
            "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libunwind/src": {
        "args": {
-            "hash": "sha256-/4/Trextb4F9UMDVrg4uG9QZl6S0H9FiwnL+2S5+ZpE=",
-            "rev": "419b03c0b8f20d6da9ddcb0d661a94a97cdd7dad",
+            "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o=",
+            "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libvpx/source/libvpx": {
        "args": {
-            "hash": "sha256-JbeUgX8Dx8GkQ79ElZHK8gYI3/4o6NrTV+HpblwLvIE=",
-            "rev": "8762f5efb2917765316a198e6713f0bc93b07c9b",
+            "hash": "sha256-NIGpzP6elcPScHJlZmnPHJdmXsuHcbuELT0C4Ha5PcA=",
+            "rev": "ff1d193f4b9dfa9b2ced51efbb6ec7a69e58e88c",
            "url": "https://chromium.googlesource.com/webm/libvpx.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libyuv": {
        "args": {
-            "hash": "sha256-hD5B9fPNwf8M98iS/PYeUJgJxtBvvf2BrrlnBNYXSg0=",
-            "rev": "a6a2ec654b1be1166b376476a7555c89eca0c275",
+            "hash": "sha256-b/EYCWBQvsNoGhea31DPBKpG8eouf0OBi5TgdHDHs9A=",
+            "rev": "1e40e34573c3861480d107cd4a4ce290df79951f",
            "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
        },
        "fetcher": "fetchFromGitiles"
    },
+    "src/third_party/llvm-libc/src": {
+        "args": {
+            "hash": "sha256-yNNx3gOGafMNvZ+aebDKHVj6QM8g0zt0d69PWlWLkyk=",
+            "rev": "912274164f0877ca917c06e8484ad3be1784833a",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
    "src/third_party/lss": {
        "args": {
-            "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-            "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
            "url": "https://chromium.googlesource.com/linux-syscall-support.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/nasm": {
        "args": {
-            "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-            "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
+            "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs=",
+            "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
            "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/openh264/src": {
        "args": {
-            "hash": "sha256-J7Eqe2QevZh1xfap19W8AVCcwfRu7ztknnbKFJUAH1c=",
-            "rev": "09a4f3ec842a8932341b195c5b01e141c8a16eb7",
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
            "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/perfetto": {
        "args": {
-            "hash": "sha256-fS0P/0Bqn9EreCPRC65Lw7/zcpMquo7RDf6dmbMDa74=",
-            "rev": "0e424063dbfd4e7400aa3b77b5c00b84893aee7b",
-            "url": "https://android.googlesource.com/platform/external/perfetto.git"
+            "hash": "sha256-I0qiAh3VliVop+3S2/tP6VwCAJOk0Vu7xy8vHJZ1w2A=",
+            "rev": "a54dd38d60593129ae56d400f1a72860670abea4",
+            "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/protobuf-javascript/src": {
        "args": {
-            "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-            "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
            "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/re2/src": {
        "args": {
-            "hash": "sha256-FA9wAZwqLx7oCPf+qeqZ7hhpJ9J2DSMXZAWllHIX/qY=",
-            "rev": "b84e3ff189980a33d4a0c6fa1201aa0b3b8bab4a",
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
            "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/tools": {
        "args": {
-            "hash": "sha256-19oGSveaPv8X+/hsevUe4fFtLASC3HfPtbnw3TWpYQk=",
-            "rev": "0d6482e40fe26f738a0acf6ebb0f797358538b48",
+            "hash": "sha256-kZFZl8SC9nZIIOVtNl/5H4huw6BCBsBkJVJ4gaUmly4=",
+            "rev": "ffcbc837bbb14d80d09147c2af5302ff6bd4bd69",
            "url": "https://chromium.googlesource.com/chromium/src/tools"
        },
        "fetcher": "fetchFromGitiles"
--- a/pkgs/by-name/no/nomachine-client/package.nix
+++ b/pkgs/by-name/no/nomachine-client/package.nix
@@ -9,10 +9,10 @@
  libpulseaudio,
 }:
 let
-  versionMajor = "9.4";
-  versionMinor = "14";
-  versionBuild_x86_64 = "1";
-  versionBuild_i686 = "1";
+  versionMajor = "9.5";
+  versionMinor = "7";
+  versionBuild_x86_64 = "2";
+  versionBuild_i686 = "2";
 in
 stdenv.mkDerivation rec {
  pname = "nomachine-client";
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz";
-        sha256 = "sha256-tLL8l/UgTiVzGs+mwJeRUlVA8lH72JVogBOEpaSr2AY=";
+        sha256 = "sha256-8f4ZL3Ko5VunojXLvTS9P3oB+ZVCSYIA0GIjM8VpUO4=";
      }
    else if stdenv.hostPlatform.system == "i686-linux" then
      fetchurl {
        url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz";
-        sha256 = "sha256-pPvg8MCrpCsQiiglRxHHl9wVyndI9JTluX/mwah3wwQ=";
+        sha256 = "sha256-Yr0bw7PW34Nga8vj3TxdFFyDiVVnHJ6lBdNskOyQ8m8=";
      }
    else
      throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/by-name/pd/pdudaemon/package.nix
+++ b/pkgs/by-name/pd/pdudaemon/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  nixosTests,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pdudaemon";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pdudaemon";
+    repo = "pdudaemon";
+    tag = version;
+    hash = "sha256-YjM1RmsdRfNyxCzK+PmSH8n7ZJ3qeIskTPxu2+EaupQ=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = with python3Packages; [
+    aiohttp
+    requests
+    pexpect
+    systemd-python
+    paramiko
+    pyserial
+    hidapi
+    pysnmp
+    pyasn1
+    pyusb
+    pymodbus
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  __structuredAttrs = true;
+
+  passthru.tests = {
+    inherit (nixosTests) pdudaemon;
+  };
+
+  meta = {
+    changelog = "https://github.com/pdudaemon/pdudaemon/releases/tag/${src.tag}";
+    description = "Python Daemon for controlling/sequentially executing commands to PDUs (Power Distribution Units)";
+    homepage = "https://github.com/pdudaemon/pdudaemon";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+    mainProgram = "pdudaemon";
+  };
+}
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
-  beamPackages,
+  beam27Packages,
+  elixir_1_18,
  stdenv,
  fetchurl,
  python3,
@@ -39,16 +40,18 @@ let
      systemd # for systemd unit activation check
    ]
  );
+
+  beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
 in

 stdenv.mkDerivation (finalAttrs: {
  pname = "rabbitmq-server";
-  version = "4.2.1";
+  version = "4.2.4";

  # when updating, consider bumping elixir version in all-packages.nix
  src = fetchurl {
    url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-loZsktSiUexsQQsMxDL4WVdtVsoXp3mEllNzkwglPgM=";
+    hash = "sha256-XIBsD1xmRF4me4byAtiDqInmQ4y5dxKSezc2tZuapLU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -6,6 +6,7 @@
  fetchFromGitLab,
  applyPatches,
  autoAddDriverRunpath,
+  android-tools,
  avahi,
  boost,
  cli11,
@@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    android-tools
    eigen
    freetype
    glm
@@ -187,7 +189,8 @@ stdenv.mkDerivation (finalAttrs: {
        ]
      }
    wrapQtApp "$out/bin/wivrn-dashboard" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]} \
+      --prefix PATH : ${lib.makeBinPath [ android-tools ]}
  '';

  desktopItems = lib.optionals (!clientLibOnly) [
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -1,6 +1,6 @@
 {
  lib,
-  rustPlatform,
+  rustPackages_1_94,
  fetchFromGitHub,
  cmake,
  copyDesktopItems,
@@ -15,6 +15,7 @@
  sqlite,
  zlib,
  zstd,
+  glib,
  alsa-lib,
  libxkbcommon,
  wayland,
@@ -49,6 +50,8 @@
 assert withGLES -> stdenv.hostPlatform.isLinux;

 let
+  inherit (rustPackages_1_94) rustPlatform;
+  channel = "stable";
  executableName = "zeditor";
  # Based on vscode.fhs
  # Zed allows for users to download and use extensions
@@ -106,7 +109,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "0.218.6";
+  version = "0.229.0";

  outputs = [
    "out"
@@ -119,7 +122,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fNwJWC48DqUECadQ12p+iCHR7pIueFFdu6QRdomJ6/o=";
+    hash = "sha256-ZO4HzzzTb5rlBbzVCpE14DEzLkE3a7v2IKdyzlCTpaA=";
  };

  postPatch = ''
@@ -131,6 +134,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # newer versions work just as well.
    substituteInPlace script/generate-licenses \
      --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    # webrtc-sys expects glib headers to be in the sysroot, so we have to point it in the right direction
+    substituteInPlace $cargoDepsCopy/webrtc-sys-*/build.rs \
+      --replace-fail 'builder.include(&glib_path);' 'builder.include("${lib.getInclude glib}/include/glib-2.0");' \
+      --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
  '';

  # remove package that has a broken Cargo.toml
@@ -139,7 +148,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm -r $out/git/*/candle-book/
  '';

-  cargoHash = "sha256-+8L4BaR7J+j7ytQ7JM8XbuAYDKzq8Hv3oKQFnN0TdK0=";
+  cargoHash = "sha256-Q7sjd5u1jPIK6WogCByaXAVU7D6jcev1oRmfQ7y39i4=";

  nativeBuildInputs = [
    cmake
@@ -167,6 +176,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    zstd
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    glib
    alsa-lib
    libxkbcommon
    wayland
@@ -191,7 +201,16 @@ rustPlatform.buildRustPackage (finalAttrs: {

  # Required on darwin because we don't have access to the
  # proprietary Metal shader compiler.
-  buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui/runtime_shaders" ];
+  buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui_platform/runtime_shaders" ];
+
+  # Some crates define extra types or enum values in test configuration which then lead
+  # to type checking errors in other crates unless this feature is enabled.
+  # gpui_platform/runtime_shaders is required on darwin for the same reason as buildFeatures above:
+  # without it, build.rs invokes the proprietary Metal shader compiler.
+  checkFeatures = [
+    "visual-tests"
+  ]
+  ++ finalAttrs.buildFeatures;

  env = {
    ALLOW_MISSING_LICENSES = true;
@@ -228,6 +247,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  useNextest = true;

+  remoteServerExecutableName = "zed-remote-server-${channel}-${finalAttrs.version}+${channel}";
  installPhase = ''
    runHook preInstall

@@ -285,7 +305,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    )
  ''
  + lib.optionalString buildRemoteServer ''
-    install -Dm755 $release_target/remote_server $remote_server/bin/zed-remote-server-stable-$version
+    install -Dm755 $release_target/remote_server $remote_server/bin/${finalAttrs.remoteServerExecutableName}
  ''
  + ''
    runHook postInstall
@@ -320,7 +340,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    tests = {
      remoteServerVersion = testers.testVersion {
        package = finalAttrs.finalPackage.remote_server;
-        command = "zed-remote-server-stable-${finalAttrs.version} version";
+        command = "${finalAttrs.remoteServerExecutableName} version";
      };
    }
    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "authlib";
-  version = "1.6.11";
+  version = "1.6.12";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "lepture";
    repo = "authlib";
    tag = "v${version}";
-    hash = "sha256-GZemNZavmGSFoCocpIHM0RMiR+phCxyQsV8I91azvR0=";
+    hash = "sha256-HLUv9HdVS5RM2TVIN7Vg6hP/X3iYy9LH7Uj1G+ueAW4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -30,11 +30,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mysql";
-  version = "8.0.45";
+  version = "8.0.46";

  src = fetchurl {
    url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-tDXyLmWMj8k7gWmPo0uaVjJaMEs/Pf+H8n+2dMkKu8s=";
+    hash = "sha256-4NGpiuUYjGpO/tdMdP8oEV1LeRvJ1ZGnjhTSCt7Wc0Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9669,10 +9669,6 @@ with pkgs;

  qremotecontrol-server = libsForQt5.callPackage ../servers/misc/qremotecontrol-server { };

-  rabbitmq-server = callPackage ../by-name/ra/rabbitmq-server/package.nix {
-    beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
-  };
-
  rethinkdb = callPackage ../servers/nosql/rethinkdb {
    stdenv = clangStdenv;
    libtool = cctools;