Merge a0fe7a7f2e into haskell-updates

.github/workflows/eval.yml

@@ -15,6 +15,9 @@ on:
       targetSha:
         required: true
         type: string
+      baseBranch:
+        required: true
+        type: string
       systems:
         required: true
         type: string
@@ -291,6 +294,7 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
+          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -299,6 +303,7 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
+            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

.github/workflows/merge-group.yml

@@ -97,6 +97,7 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/pull-request-target.yml

@@ -110,6 +110,7 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

ci/eval/compare/default.nix

@@ -49,6 +49,7 @@ in
 {
   combinedDir,
   touchedFilesJson,
+  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -242,7 +243,7 @@ runCommand "compare"
       echo
       echo "# Performance comparison"
       echo
-      echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
       echo
     } >> $out/step-summary.md
 

ci/eval/default.nix

@@ -288,6 +288,9 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
+      # The branch the local comparison is made against; matches the `master`
+      # used in the touched-files expression above.
+      baseBranch ? "master",
     }:
     let
       diffs = symlinkJoin {
@@ -305,7 +308,7 @@ let
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson;
+        inherit touchedFilesJson baseBranch;
       };
     in
     comparisonReport;

doc/release-notes/rl-2611.section.md

@@ -42,6 +42,8 @@
     Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
   - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
 
+- `buildFHSEnvChroot` has been removed after deprecation in 23.05.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.

lib/systems/default.nix

@@ -17,6 +17,10 @@ let
 
   inherit (lib.strings) toJSON;
 
+  inherit (lib.trivial)
+    oldestSupportedReleaseIsAtLeast
+    ;
+
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
@@ -701,9 +705,12 @@ let
         };
       };
     in
-    # TODO: Remove in 27.05.
+    # Platforms elaborated by pre-26.11 Nixpkgs will include the `linux-kernel` attr,
+    # so we can't assert its absence until 26.11 is the oldest supported release.
+    # Assertion will activate during the 27.05 cycle, when 26.05 support ends.
+    # TODO: Remove assertion in the 27.11 cycle.
     assert
-      args ? linux-kernel
+      oldestSupportedReleaseIsAtLeast 2611 && args ? linux-kernel
       -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
 
     assert final.useAndroidPrebuilt -> final.isAndroid;

maintainers/maintainer-list.nix

@@ -289,6 +289,14 @@
     githubId = 92977828;
     name = "Mori Zen";
   };
+  _74k1 = {
+    email = "git.t@betsumei.com";
+    github = "74k1";
+    githubId = 49000471;
+    keys = [ { fingerprint = "46F3 422F 63A3 1369 7EAB  83D5 1CF1 55F7 6F21 3503"; } ];
+    matrix = "@74k1:matrix.org";
+    name = "Tim";
+  };
   _7591yj = {
     email = "yeongjin.kim@proton.me";
     github = "7591yj";
@@ -10466,6 +10474,12 @@
     github = "hacker1024";
     githubId = 20849728;
   };
+  hadal84 = {
+    name = "hadal84";
+    email = "business.masses555@passinbox.com";
+    github = "hadal84";
+    githubId = 143954694;
+  };
   hadilq = {
     name = "Hadi Lashkari Ghouchani";
     email = "hadilq.dev@gmail.com";
@@ -19830,12 +19844,6 @@
     githubId = 70602908;
     github = "nikolaizombie1";
   };
-  niksingh710 = {
-    email = "nik.singh710@gmail.com";
-    name = "Nikhil Singh";
-    github = "niksingh710";
-    githubId = 60490474;
-  };
   nikstur = {
     email = "nikstur@outlook.com";
     name = "nikstur";
@@ -25008,6 +25016,12 @@
     githubId = 33031;
     name = "Greg Pfeil";
   };
+  semi710 = {
+    email = "nik.singh710@gmail.com";
+    name = "Nikhil Singh";
+    github = "semi710";
+    githubId = 60490474;
+  };
   sempiternal-aurora = {
     email = "myrialsarvay@gmail.com";
     github = "sempiternal-aurora";
@@ -26676,13 +26690,6 @@
     githubId = 36031171;
     name = "Supa";
   };
-  superherointj = {
-    email = "sergiomarcelo@yandex.com";
-    github = "superherointj";
-    githubId = 5861043;
-    matrix = "@superherointj:matrix.org";
-    name = "Sérgio Marcelo";
-  };
   supermarin = {
     email = "git+nixpkgs@mar.in";
     name = "marin";
@@ -27155,12 +27162,6 @@
     githubId = 101565936;
     name = "Tautvydas Cerniauskas";
   };
-  tcbravo = {
-    email = "tomas.bravo@protonmail.ch";
-    github = "tcbravo";
-    githubId = 66133083;
-    name = "Tomas Bravo";
-  };
   tchab = {
     email = "dev@chabs.name";
     github = "t-chab";

maintainers/team-list.nix

@@ -566,7 +566,6 @@ with lib.maintainers;
       ethancedwards8
       phanirithvij
       prince213
-      wegank
     ];
     scope = "Maintain NGI-supported software.";
     shortName = "NGI";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -57,6 +57,8 @@
   Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
   See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
 
+  - Coincidentally the driver now exposes machines to the testScript using their attr name used in the test module. E.g. a machine declared with `nodes.<name> = …` is now available as `<name>`. Before, the test driver used their `system.name` option value. They both default to the same value, but if you have set both independently, you might need to adapt your testScript.
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -14,6 +14,8 @@
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
+- [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
@@ -46,6 +48,8 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
+- `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/module-list.nix

@@ -1052,6 +1052,7 @@
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
   ./services/monitoring/nezha-agent.nix
+  ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
   ./services/monitoring/osquery.nix

nixos/modules/security/run0.nix

@@ -11,17 +11,11 @@ let
     mkIf
     mkMerge
     mkOption
+    mkPackageOption
+    mkAliasOptionModule
     ;
 
   cfg = config.security.run0;
-
-  sudoAlias = pkgs.writeShellScriptBin "sudo" ''
-    if [[ "$1" == -* ]]; then
-      echo "This script is a sudo-alias to systemd's run0 and does not support any sudo parameters."
-      exit 1
-    fi
-    exec run0 "$@"
-  '';
 in
 {
   options.security.run0 = {
@@ -36,9 +30,17 @@ in
       '';
     };
 
-    enableSudoAlias = mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+    sudo-shim.enable = mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+    sudo-shim.package = mkPackageOption pkgs "run0-sudo-shim" { };
   };
 
+  imports = [
+    (mkAliasOptionModule
+      [ "security" "run0" "enableSudoAlias" ]
+      [ "security" "run0" "sudo-shim" "enable" ]
+    )
+  ];
+
   config = mkMerge [
     {
       # Late introduction of the enable toggle, this should help during migration.
@@ -58,8 +60,8 @@ in
       assertions = [
         {
           assertion =
-            cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
-          message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
+            cfg.sudo-shim.enable -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
+          message = "`security.run0.sudo-shim.enable` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
         }
       ];
 
@@ -74,7 +76,15 @@ in
         '';
       };
 
-      environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
+      environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;
     })
   ];
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      zimward
+      grimmauld
+      kuflierl
+    ];
+  };
 }

nixos/modules/services/display-managers/gdm.nix

@@ -200,8 +200,6 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    warnings = lib.optional config.services.pulseaudio.enable "Support for Pulseaudio + gdm will be removed in NixOS 26.11";
-
     services.xserver.displayManager.lightdm.enable = false;
 
     users.users = lib.mkMerge [

nixos/modules/services/monitoring/nezha.nix

@@ -0,0 +1,179 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nezha;
+
+  # nezha uses yaml as the configuration file format.
+  # Since we need to use jq to update the content, so here we generate json
+  settingsFormat = pkgs.formats.json { };
+  configFile = settingsFormat.generate "config.json" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+  options = {
+    services.nezha = {
+      enable = lib.mkEnableOption "Nezha Monitoring";
+
+      package = lib.mkPackageOption pkgs "nezha" { };
+
+      debug = lib.mkEnableOption "verbose log";
+
+      settings = lib.mkOption {
+        description = ''
+          Generate to {file}`config.yaml` as a Nix attribute set.
+          Check the [guide](https://nezha.wiki/en_US/guide/dashboard.html)
+          for possible options.
+        '';
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+
+          options = {
+            listenhost = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              description = ''
+                Host on which the nezha web interface and grpc should listen.
+              '';
+            };
+            listenport = lib.mkOption {
+              type = lib.types.port;
+              default = 8008;
+              description = ''
+                Port on which the nezha web interface and grpc should listen.
+              '';
+            };
+
+          };
+        };
+      };
+
+      mutableConfig = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether the config.yaml is writable by Nezha.
+
+          If this option is disabled, changes on the web interface won't
+          be possible. If an config.yaml is present, it will be overwritten.
+        '';
+      };
+
+      jwtSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret to sign web requests using JSON Web Tokens.
+        '';
+      };
+
+      agentSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret used by agents to connect.
+        '';
+      };
+
+      extraThemes = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.nezha-theme-nazhua ]";
+        description = ''
+          A list of additional themes.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nezha.settings.debug = cfg.debug;
+
+    systemd.services.nezha = {
+      serviceConfig = {
+        Restart = "on-failure";
+        StateDirectory = "nezha";
+        RuntimeDirectory = "nezha";
+        ConfigurationDirectory = "nezha";
+        WorkingDirectory = "/var/lib/nezha";
+        ReadWritePaths = [
+          "/var/lib/nezha"
+          "/etc/nezha"
+        ];
+
+        LoadCredential = [
+          "jwt-secret:${cfg.jwtSecretFile}"
+          "agent-secret:${cfg.agentSecretFile}"
+        ];
+
+        # Hardening
+        ProcSubset = "pid";
+        DynamicUser = true;
+        RemoveIPC = true;
+        LockPersonality = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = cfg.settings.listenport >= 1024; # incompatible with CAP_NET_BIND_SERVICE
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        AmbientCapabilities = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0066";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ]
+        ++ lib.optional (cfg.settings ? tsdb) "mincore";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        PrivateDevices = "yes";
+
+        ExecStart =
+          let
+            package = cfg.package.override { withThemes = cfg.extraThemes; };
+          in
+          ''${lib.getExe package} -c "''${CONFIGURATION_DIRECTORY}"/config.yaml -db "''${STATE_DIRECTORY}"/sqlite.db'';
+      };
+      enableStrictShellChecks = true;
+      startLimitIntervalSec = 10;
+      startLimitBurst = 3;
+      preStart = ''
+        cp "${configFile}" "''${RUNTIME_DIRECTORY}"/new
+        ${lib.getExe pkgs.jq} \
+            --arg jwt_secret "$(<"''${CREDENTIALS_DIRECTORY}"/jwt-secret)" \
+            --arg agent_secret "$(<"''${CREDENTIALS_DIRECTORY}"/agent-secret)" \
+            '. + { jwtsecretkey: $jwt_secret, agentsecretkey: $agent_secret }' \
+            < "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+        mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+
+        ${lib.optionalString cfg.mutableConfig ''
+          [ -e "''${CONFIGURATION_DIRECTORY}"/config.yaml ] && \
+            ${lib.getExe pkgs.yj} < "''${CONFIGURATION_DIRECTORY}"/config.yaml > "''${RUNTIME_DIRECTORY}"/old && \
+            ${lib.getExe pkgs.jq} -s '.[0] * .[1]' \
+              "''${RUNTIME_DIRECTORY}"/old "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+          [ -e "''${RUNTIME_DIRECTORY}"/old ] && rm "''${RUNTIME_DIRECTORY}"/old
+          [ -e "''${RUNTIME_DIRECTORY}"/tmp ] && mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+        ''}
+        mv "''${RUNTIME_DIRECTORY}"/new  "''${CONFIGURATION_DIRECTORY}"/config.yaml
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}

nixos/modules/services/networking/ghostunnel.nix

@@ -192,7 +192,12 @@ let
               ++ optional (config.cacert != null) "cacert:${config.cacert}";
           };
           script = concatStringsSep " " (
-            [ "${mainCfg.package}/bin/ghostunnel" ]
+            [
+              "${mainCfg.package}/bin/ghostunnel"
+              # ghostunnel's landlock rules don't like reading the CA certs from /etc
+              # because they are links to /nix/store, which isn't part of its rules
+              "--disable-landlock"
+            ]
             ++ optional (config.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
             ++ optional (config.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"
             ++ optional (config.key != null) "--key=$CREDENTIALS_DIRECTORY/key"

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -559,7 +559,7 @@ def install_bootloader() -> None:
 
         if config('secureBoot', 'enable'):
             sbctl = os.path.join(str(config('secureBoot', 'sbctl')), 'bin', 'sbctl')
-            if not os.path.exists("/var/lib/sbctl") and config('secureBoot', 'autoGenerateKeys'):
+            if not os.path.exists("/var/lib/sbctl/keys") and config('secureBoot', 'autoGenerateKeys'):
                 print('auto generating keys')
                 try:
                     subprocess.run([sbctl, 'create-keys'])

nixos/tests/all-tests.nix

@@ -752,6 +752,7 @@ in
   hitch = handleTest ./hitch { };
   hledger-web = runTest ./hledger-web.nix;
   hockeypuck = runTest ./hockeypuck.nix;
+  holo-daemon-modular-service = runTest ./holo-daemon-modular.nix;
   home-assistant = runTest ./home-assistant.nix;
   homebox = runTest ./homebox.nix;
   homebridge = runTest ./homebridge.nix;
@@ -1099,6 +1100,7 @@ in
   nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = runTest ./nexus.nix;
+  nezha = runTest ./nezha.nix;
   # TODO: Test nfsv3 + Kerberos
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };

nixos/tests/holo-daemon-modular.nix

@@ -0,0 +1,66 @@
+{ ... }:
+{
+  _class = "nixosTest";
+  name = "holo-daemon-modular-service-test";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.holo-daemon
+          pkgs.holo-cli
+        ];
+        system.services.holo-daemon = {
+          imports = [ pkgs.holo-daemon.services.default ];
+        };
+        users.users.holo = {
+          isSystemUser = true;
+          group = "holo";
+          home = "/var/lib/holo";
+          createHome = true;
+        };
+        users.groups.holo = { };
+        services.getty.autologinUser = "root";
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import time
+
+      start_all()
+
+      # holo-cli connects to the daemon at startup
+      # features a bash-like editing functionality for interactive use
+      # uses -c option to execute arguments as commands
+
+      machine.wait_for_unit("multi-user.target")
+
+      machine.wait_for_unit("holo-daemon.service")
+
+      machine.succeed("holo-cli -V")
+
+      # wait for cli to connect to the daemon
+      machine.wait_for_open_port(50051)
+
+      # Test the running configuration is empty
+      machine.succeed("holo-cli -c 'show running format json'")
+
+      # Configure an OSPFv3 instance:
+      # as seen in https://asciinema.org/a/qYxmDu1QjGPBAt5gNyNKvXhHk
+
+      machine.send_chars("holo-cli\n", 1)
+      time.sleep(5)
+      machine.send_chars("configure\n", 1)
+      machine.send_chars("routing control-plane-protocols control-plane-protocol ietf-ospf:ospfv3 main\n", 1)
+      machine.send_chars("ospf preference inter-area 50\n", 1)
+      machine.send_chars("show changes\n", 1)
+      machine.send_chars("commit\n", 1)
+      machine.send_chars("exit\n", 1)
+
+      # Verify the configuration was applied (in interactive test)
+      machine.succeed("test \"$(holo-cli -c 'show running format json')\" != \"{}\"");
+    '';
+}

nixos/tests/nezha.nix

@@ -0,0 +1,114 @@
+{ lib, pkgs, ... }:
+let
+  agent_host = "agent.test";
+  dashboard_host = "dashboard.test";
+
+  agentSecret = pkgs.writeText "fakeagentsecret" "fakeagentsecret";
+
+  hosts = {
+    "${agent_host}" = "192.168.0.2";
+    "${dashboard_host}" = "192.168.0.1";
+  };
+  hostsEntries = lib.mapAttrs' (k: v: {
+    name = v;
+    value = lib.singleton k;
+  }) hosts;
+in
+{
+  name = "nezha";
+
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+
+  containers = {
+    agent = _: {
+      networking = {
+        hostName = builtins.elemAt (lib.splitString "." agent_host) 0;
+        domain = builtins.elemAt (lib.splitString "." agent_host) 1;
+        firewall.enable = false;
+        hosts = hostsEntries;
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = lib.singleton {
+          address = hosts."${agent_host}";
+          prefixLength = 24;
+        };
+      };
+      services.nezha-agent = {
+        enable = true;
+        debug = true;
+        genUuid = true;
+        settings = {
+          server = hosts."${dashboard_host}" + ":80";
+        };
+        clientSecretFile = agentSecret;
+      };
+    };
+
+    dashboard =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1.ipv4.addresses = lib.singleton {
+            address = hosts."${dashboard_host}";
+            prefixLength = 24;
+          };
+        };
+        services.nezha = {
+          enable = true;
+          debug = true;
+          settings = {
+            listenhost = "0.0.0.0";
+            # Test CAP_NET_BIND_SERVICE
+            listenport = 80;
+          };
+          mutableConfig = true;
+          jwtSecretFile = pkgs.writeText "fakejwt" "fakejwt";
+          agentSecretFile = agentSecret;
+        };
+      };
+  };
+
+  testScript = ''
+    import json
+
+    with subtest("Wait for services and network"):
+        dashboard.wait_for_unit("nezha.service")
+        agent.wait_for_unit("nezha-agent.service")
+        dashboard.wait_for_open_port(80)
+        dashboard.wait_for_unit("network.target")
+        agent.wait_for_unit("network.target")
+        agent.succeed("curl --fail --max-time 10 http://dashboard.test/")
+
+    with subtest("Test mutableConfig"):
+        dashboard.succeed("systemctl stop nezha")
+        dashboard.succeed("""
+          echo '{"sitename": "Nezha on NixOS"}' > /etc/nezha/config.yaml
+        """)
+        dashboard.succeed("systemctl start nezha")
+        dashboard.wait_for_unit("nezha.service")
+        dashboard.wait_for_open_port(80)
+        result = json.loads(agent.succeed("""
+            curl --fail -X POST --json '{ "username": "admin", "password": "admin"}' \
+              'http://dashboard.test/api/v1/login'
+        """))
+        token = result['data']['token']
+        result = json.loads(agent.succeed(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/setting'
+        """))
+        assert "Nezha on NixOS" == result['data']['config']['site_name']
+
+    with subtest("Verify connection and uuid"):
+        uuid = agent.succeed(
+            "${lib.getExe' pkgs.util-linux "uuidgen"} --md5 -n @dns -N ${agent_host}"
+        )
+        # remove unprintable characters
+        uuid = "".join([char for char in uuid if char.isprintable()])
+        agent.wait_until_succeeds(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/server' | grep {uuid}
+        """)
+  '';
+}

pkgs/applications/editors/kakoune/plugins/overrides.nix

@@ -47,13 +47,13 @@ self: super: {
 
   kak-ansi = stdenv.mkDerivation (finalAttrs: {
     pname = "kak-ansi";
-    version = "0.2.4";
+    version = "0.3.0";
 
     src = fetchFromGitHub {
       owner = "eraserhd";
       repo = "kak-ansi";
       rev = "v${finalAttrs.version}";
-      sha256 = "kFjTYFy0KF5WWEHU4hHFAnD/03/d3ptjqMMbTSaGImE=";
+      sha256 = "sha256-Tp+cKZxDESlpks6l+6J0H/1BvHyfQSqCxeutUcsZrEc=";
     };
 
     installPhase = ''

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-XA4xSd/sg9vhOGqcCNliHzloBxPZsgXW/dSkKp/RzM0=";
+          hash = "sha256-hjj2PRcpRsC6kWqwhGlBt071rHVq9ZN+OcNsT78IuWc=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-l2NjDHBOMBzJT9Pis7sqSuFuG07eZPALximND+hVqDU=";
+          hash = "sha256-7lhfn95LI8vg2MvzTuQw57bmhJOXInl+T/e3ZSLNMKA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-hE/1N28f9uAzg2fG3Hrc4z1kW21rdhtCRmF9SphqiFc=";
+          hash = "sha256-/aSCQP6yQ30qmgz1ZcgZ91MiLwpxkr77m3NIlidfgnw=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-68CmDax385o0juoQWNX/NLx+tjIt9YytTHjRZkqAR98=";
+          hash = "sha256-uDVR6Y1GoY8G8OLBoAGY6YMLL2Qj7eHpZ6p0Z0OCN/4=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.175";
+      version = "2.1.179";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1204,8 +1204,8 @@ let
         mktplcRef = {
           name = "dart-code";
           publisher = "dart-code";
-          version = "3.136.0";
-          hash = "sha256-XPajPR0MX6TiUfaCw/+WYyc453cZOMaK1Uen6ND+RKY=";
+          version = "3.136.1";
+          hash = "sha256-z9DPxEtQwjx9xk5ucHKfX2BYRij5UA253oPuHpD0jdU=";
         };
 
         meta.license = lib.licenses.mit;

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.39.7";
-    hash = "sha256-hm5jDcBVaRfmzhDTXFOpReN227lFyYT/i+HGPcpdkX0=";
+    version = "1.39.8";
+    hash = "sha256-MiCa1OuLvXYC5HmXNzM7LCL72weG40tDTgLWWl9Kxug=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-06-06";
+  version = "0-unstable-2026-06-16";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "b2825c2f0a705f93d3c4d1b4369c8728d76f2e07";
-    hash = "sha256-S470+U7rP7EXapPSwliUh8MwIKvKm+mgc7BuQkN572k=";
+    rev = "5ec3ccfb4313d452c3b3faccea97443ba3d9db4d";
+    hash = "sha256-GFPh2z31vnACo8EEe83YRd7SVcPsSIe/vnPivaE2JYg=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/mame2010.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "mame2010";
-  version = "0-unstable-2026-06-08";
+  version = "0-unstable-2026-06-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2010-libretro";
-    rev = "64d2bee2e03d5eb1db77bcb4595099553a1b9a97";
-    hash = "sha256-XU2g7bxt2y8gqIMACUXGDbZCWNrg9BWcqBudK699Uhw=";
+    rev = "36c36bb0a59902aa75af3e80853f7f893d7ffe91";
+    hash = "sha256-tudxNTySzhoN4SzlzqhzuDE9Qmyr9Ud87fCiW+0MITc=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2026-06-05";
+  version = "0-unstable-2026-06-06";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "3a904f67694ce6ce8f88fd97ebaf30240bd87dce";
-    hash = "sha256-vxedP/J6LhTqhoRw1bn6uCNedRJUpKHZnD8OQ5z1rxY=";
+    rev = "ee1334610cb2181bd9a84e837ba3ea667ebdb16a";
+    hash = "sha256-oriF08elBRg8jTlPz1Qoc6SmKQPknkegJlOtcOV4RX8=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "149.0.7827.114",
+    "version": "149.0.7827.155",
     "chromedriver": {
-      "version": "149.0.7827.115",
-      "hash_darwin": "sha256-DOhM1knKphvLNyrkf0uvb9NZ3kBwSuVN5hkQLqAZR1Y=",
-      "hash_darwin_aarch64": "sha256-HXWvAjMdMMbeF8DsgFKNM+S0ZEYr2M8Wj0uUZC7tmxY="
+      "version": "149.0.7827.156",
+      "hash_darwin": "sha256-V7ZBijHsPzyphJPipWlIcU5Mb9l1OWzLc6PzxFKFuR8=",
+      "hash_darwin_aarch64": "sha256-sUG2Qg+nPIrYQC0iKNK78O1l92qTSDbRnJFfrqJMpts="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
-        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
+        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
+        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
-        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
+        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
+        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
-        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
+        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
+        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -192,8 +192,8 @@
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "afa2870e449ef33ad41545e7670c574cf70926a4",
-        "hash": "sha256-+N6FPtSiLQmNqf5+x5XDSksrRq/YDVSMVx5Rv1PGjfI="
+        "rev": "8ef5673404a3bbc192b0997e1c2df559cc5bd79d",
+        "hash": "sha256-NplvLz9oET6mhTuBkHH6pZc8qdfhqI7g69eZRCyae0A="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -537,8 +537,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "640d4ce27ba918783e28a0da46a8a37abe4a65b6",
-        "hash": "sha256-uCa/MEfw2s05kK91uubi/TqztHulwattzt1vfr0LR4E="
+        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
+        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -602,8 +602,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "74d747ce1d383caca3ec0e604d77bac35ccd1e58",
-        "hash": "sha256-qMY6L93hlnMgGZ5Blk5ldDnI/LUXYyuk+b7FXCiVV6s="
+        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
+        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -652,8 +652,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
-        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
+        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
+        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -787,8 +787,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
-        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
+        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
+        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -817,13 +817,13 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
-        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
+        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
+        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
       }
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.114",
+    "version": "149.0.7827.155",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.114-1",
-        "hash": "sha256-F0pIlZM/EBPLIZxD8jyLX7HWe0vFn2HXs2vkM5+Xplg="
+        "rev": "149.0.7827.155-1",
+        "hash": "sha256-+DviTrU7mdY3YQIIUzFh0DbFKUokQI8+lmQslUZdNSU="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
-        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
+        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
+        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
-        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
+        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
+        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
-        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
+        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
+        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1014,8 +1014,8 @@
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "afa2870e449ef33ad41545e7670c574cf70926a4",
-        "hash": "sha256-+N6FPtSiLQmNqf5+x5XDSksrRq/YDVSMVx5Rv1PGjfI="
+        "rev": "8ef5673404a3bbc192b0997e1c2df559cc5bd79d",
+        "hash": "sha256-NplvLz9oET6mhTuBkHH6pZc8qdfhqI7g69eZRCyae0A="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -1359,8 +1359,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "640d4ce27ba918783e28a0da46a8a37abe4a65b6",
-        "hash": "sha256-uCa/MEfw2s05kK91uubi/TqztHulwattzt1vfr0LR4E="
+        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
+        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1424,8 +1424,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "74d747ce1d383caca3ec0e604d77bac35ccd1e58",
-        "hash": "sha256-qMY6L93hlnMgGZ5Blk5ldDnI/LUXYyuk+b7FXCiVV6s="
+        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
+        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1474,8 +1474,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
-        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
+        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
+        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
-        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
+        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
+        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
-        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
+        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
+        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
       }
     }
   }

pkgs/applications/networking/cluster/helm/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Wyihzf7KpnVuIdp5lmjhB7uLAGgtmI0TXYl29uaVC5Y=";
+    hash = "sha256-k2lZXdWYnewNiZdLNQrC5j9A3JkvYCwMY486QxjCpaw=";
   };
 
-  vendorHash = "sha256-QTDC0v0BPE3FoK9AAq1n2jWxOE9gB9OsoY2wnpcCDUQ=";
+  vendorHash = "sha256-XIKQF9PWgxKJUt66wQ/mPhWVfJnra0vV9ZuyclgQ21U=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -283,13 +283,13 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-HGRv2leNSZleAmlsoTgbEng1W02XUAOaw5nFz6AeckI=",
+    "hash": "sha256-pTtEKgxh17Oi41oqgBrtUCsriRMfRew30kLjbOdM9jo=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v4.12.1",
+    "rev": "v4.13.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-VBLDf6wkRT2k5ExmpQ1aDKf/BGqossVEQpGmeHsgrcQ="
+    "vendorHash": "sha256-GRxcI8+3uarErfVhzoz+Iku3mCmY9XfriDZZX0wSI5s="
   },
   "datadrivers_nexus": {
     "hash": "sha256-gwExaFhOoJFrAhH91oZEp1AFvI7kgWekp655zd4tyd8=",
@@ -373,13 +373,13 @@
     "vendorHash": "sha256-RtS88NqkO1nG/8znM0sQqsAIfDc+sOMy8N4T4hmvaVA="
   },
   "e-breuninger_netbox": {
-    "hash": "sha256-04k9lKwoczptgoMW5C8EitP/u/Joi4/OCd3+I+nr5pc=",
+    "hash": "sha256-e9244MaxEcmtYHT9zN4Nct2xpgBv8JOMe1VOW5y/2OQ=",
     "homepage": "https://registry.terraform.io/providers/e-breuninger/netbox",
     "owner": "e-breuninger",
     "repo": "terraform-provider-netbox",
-    "rev": "v5.4.0",
+    "rev": "v5.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-RWoe4QQE55lW+B20uDJt0qX3Om/oc3em3LXhN+cBoUY="
+    "vendorHash": "sha256-WaeRXTqXakFTYMHio+VLIKS4kS5wHQdY5zdJYwrlVjE="
   },
   "equinix_equinix": {
     "hash": "sha256-Tn8CnLx2ibkj7qlzpYCX7Cm+yoTcZujVELMJSbG+/ec=",
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
   },
   "hashicorp_aws": {
-    "hash": "sha256-073kfB/vwTtlbjO3I4s+QLPQT127Hvab8jc7/NFvcmk=",
+    "hash": "sha256-kWA/cpYQ8MynW/vxnj7Yys6lsFdRAmfC8N6bmEIOW70=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.49.0",
+    "rev": "v6.50.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DyYT8SK5/IbkXWvzRTF6TjTi4aIpokLPOz5H/O05YU8="
+    "vendorHash": "sha256-Msl/Mn0GK3D+QyLnSFU3m9ux/ThkwDCDh85b0Yzpnjo="
   },
   "hashicorp_awscc": {
     "hash": "sha256-/4NhHZs/8LwrL+TXoOGyszvHZcKps5tDu7uewKeNmb4=",
@@ -1319,11 +1319,11 @@
     "vendorHash": "sha256-7ZoJg1HEVj5Nygr46lmBZeJDfZuU4F90yntrgkBVgGg="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-9TTN1DmIXxqIWWiPdFQLRZbJ1mXkibXAOKfF4rJTPBE=",
+    "hash": "sha256-nv+X3mptE51m7WwYzRqyvvrVR5tUikOYM06axtZIznk=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.101",
+    "rev": "v1.83.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1391,13 +1391,13 @@
     "vendorHash": "sha256-da0+/aLNEuMZWD7+zMUGpc1Ch5VKyN+EyO0Mp4mZWv8="
   },
   "trozz_pocketid": {
-    "hash": "sha256-/rEdOnAbVM69mA/eP6SlZhk1FZfzrYpej2aO0NUP6E4=",
+    "hash": "sha256-QjK8AOnil1UQ3/vjtXxm2p62xVPrGuKDwl9wTUxnpSI=",
     "homepage": "https://registry.terraform.io/providers/Trozz/pocketid",
     "owner": "Trozz",
     "repo": "terraform-provider-pocketid",
-    "rev": "v0.1.7",
+    "rev": "v2.1.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-ozAYLFkilSK0Nygdglhz3VNtRVKoLDGRnrVvg4nWyH4="
+    "vendorHash": "sha256-Y1vNBojo+8UYTfuR7NeOKdOPDDH9tIVjjpPAxLDa5iA="
   },
   "turbot_turbot": {
     "hash": "sha256-sJODPeFzU3vaiHbKlGe1dR5Pi7aS56JcmZUe8Yg1BcQ=",
@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-8p6dJwGyTK+qtgplSLtIRKxnNAQAgHfs4z/EsBcg/iY="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-JSF1Q0wNRg2oavZ1+67QfCxNz+JOHrG+rfKn/1T9cgc=",
+    "hash": "sha256-/t4HHlZ/E4QM4vvJAUzn+uJIox3Duqxl0/3Hu4AGGak=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.206.0",
+    "rev": "v0.209.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SpJ6wuzBzfI46C7MbNxs0gQpG62ODmB0WIZ8UpJjuPU="
+    "vendorHash": "sha256-UKWLZp64nvohXqYHMhRB+nWfUKSYyGJBMpo1nk792XY="
   }
 }

pkgs/applications/networking/remote/citrix-workspace/default.nix

@@ -1,13 +0,0 @@
-{ lib, callPackage }:
-
-# For detailed information about the Citrix source-tarball, please refer to the OEM
-# reference guide: https://developer-docs.citrix.com/en-us/citrix-workspace-app-for-linux/citrix-workspace-app-for-linux-oem-reference-guide
-
-let
-  supportedVersions = callPackage ./sources.nix { };
-
-  toAttrName = x: "citrix_workspace_${builtins.replaceStrings [ "." ] [ "_" ] x}";
-in
-lib.mapAttrs' (
-  attr: versionInfo: lib.nameValuePair (toAttrName attr) (callPackage ./generic.nix versionInfo)
-) supportedVersions

pkgs/applications/networking/remote/citrix-workspace/sources.nix

@@ -1,43 +0,0 @@
-{ stdenv, lib }:
-
-let
-  mkVersionInfo =
-    _:
-    {
-      major,
-      minor,
-      patch,
-      hash,
-      suffix,
-      homepage,
-    }:
-    {
-      inherit hash homepage;
-      version = "${major}.${minor}.${patch}.${suffix}";
-    };
-
-  # Attribute-set with all actively supported versions of the Citrix workspace app
-  # for Linux.
-  #
-  # The latest versions can be found at https://www.citrix.com/downloads/workspace-app/linux/
-  supportedVersions = lib.mapAttrs mkVersionInfo {
-    "26.01.0" = {
-      major = "26";
-      minor = "01";
-      patch = "0";
-      hash = "0avrf9jpqhijvp6w4jgs7xgp4gg1q2mdzak9h9klkqrbsgrvjr3p";
-      suffix = "150";
-      homepage = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
-    };
-
-    "25.08.10" = {
-      major = "25";
-      minor = "08";
-      patch = "10";
-      hash = "06hdwi5rd8z43nlpvym6yrw3snfz8jh6ic3g4pihn9ji22bw5pbd";
-      suffix = "111";
-      homepage = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
-    };
-  };
-in
-supportedVersions

pkgs/build-support/build-fhsenv-chroot/chrootenv/default.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  stdenv,
-  meson,
-  ninja,
-  pkg-config,
-  glib,
-}:
-
-stdenv.mkDerivation {
-  name = "chrootenv";
-  src = ./src;
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-  buildInputs = [ glib ];
-
-  meta = {
-    description = "Setup mount/user namespace for FHS emulation";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/build-support/build-fhsenv-chroot/chrootenv/src/chrootenv.c

@@ -1,169 +0,0 @@
-#define _GNU_SOURCE
-
-#include <glib.h>
-#include <glib/gstdio.h>
-
-#include <errno.h>
-#include <sched.h>
-#include <unistd.h>
-
-#include <sys/mount.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/syscall.h>
-
-#define fail(s, err) g_error("%s: %s: %s", __func__, s, g_strerror(err))
-#define fail_if(expr)                                                          \
-  if (expr)                                                                    \
-    fail(#expr, errno);
-
-const gchar *bind_blacklist[] = {"bin", "etc", "host", "real-host", "usr", "lib", "lib64", "lib32", "sbin", "opt", NULL};
-
-int pivot_root(const char *new_root, const char *put_old) {
-  return syscall(SYS_pivot_root, new_root, put_old);
-}
-
-void mount_tmpfs(const gchar *target) {
-  fail_if(mount("none", target, "tmpfs", 0, NULL));
-}
-
-void bind_mount(const gchar *source, const gchar *target) {
-  fail_if(g_mkdir(target, 0755));
-  fail_if(mount(source, target, NULL, MS_BIND | MS_REC, NULL));
-}
-
-const gchar *create_tmpdir() {
-  gchar *prefix =
-      g_build_filename(g_get_tmp_dir(), "chrootenvXXXXXX", NULL);
-  fail_if(!g_mkdtemp_full(prefix, 0755));
-  return prefix;
-}
-
-void pivot_host(const gchar *guest) {
-  g_autofree gchar *point = g_build_filename(guest, "host", NULL);
-  fail_if(g_mkdir(point, 0755));
-  fail_if(pivot_root(guest, point));
-}
-
-void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) {
-  g_autofree gchar *source = g_build_filename(host, name, NULL);
-  g_autofree gchar *target = g_build_filename(guest, name, NULL);
-
-  if (G_LIKELY(g_file_test(source, G_FILE_TEST_IS_DIR)))
-    bind_mount(source, target);
-}
-
-void bind(const gchar *host, const gchar *guest) {
-  mount_tmpfs(guest);
-
-  pivot_host(guest);
-
-  g_autofree gchar *host_dir = g_build_filename("/host", host, NULL);
-
-  g_autoptr(GError) err = NULL;
-  g_autoptr(GDir) dir = g_dir_open(host_dir, 0, &err);
-
-  if (err != NULL)
-    fail("g_dir_open", errno);
-
-  const gchar *item;
-
-  while ((item = g_dir_read_name(dir)))
-    if (!g_strv_contains(bind_blacklist, item))
-      bind_mount_item(host_dir, "/", item);
-}
-
-void spit(const char *path, char *fmt, ...) {
-  va_list args;
-  va_start(args, fmt);
-
-  FILE *f = g_fopen(path, "w");
-
-  if (f == NULL)
-    fail("g_fopen", errno);
-
-  g_vfprintf(f, fmt, args);
-  fclose(f);
-}
-
-int main(gint argc, gchar **argv) {
-  const gchar *self = *argv++;
-
-  if (argc < 2) {
-    g_message("%s command [arguments...]", self);
-    return 1;
-  }
-
-  g_autofree const gchar *prefix = create_tmpdir();
-
-  pid_t cpid = fork();
-
-  if (cpid < 0)
-    fail("fork", errno);
-
-  else if (cpid == 0) {
-    uid_t uid = getuid();
-    gid_t gid = getgid();
-
-    int namespaces = CLONE_NEWNS;
-    if (uid != 0) {
-      namespaces |= CLONE_NEWUSER;
-    }
-    if (unshare(namespaces) < 0) {
-      int unshare_errno = errno;
-
-      g_message("Requires Linux version >= 3.19 built with CONFIG_USER_NS");
-      if (g_file_test("/proc/sys/kernel/unprivileged_userns_clone",
-                      G_FILE_TEST_EXISTS))
-        g_message("Run: sudo sysctl -w kernel.unprivileged_userns_clone=1");
-
-      fail("unshare", unshare_errno);
-    }
-
-    // hide all mounts we do from the parent
-    fail_if(mount(0, "/", 0, MS_SLAVE | MS_REC, 0));
-
-    if (uid != 0) {
-      spit("/proc/self/setgroups", "deny");
-      spit("/proc/self/uid_map", "%d %d 1", uid, uid);
-      spit("/proc/self/gid_map", "%d %d 1", gid, gid);
-    }
-
-    // If there is a /host directory, assume this is nested chrootenv and use it as host instead.
-    gboolean nested_host = g_file_test("/host", G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR);
-    g_autofree const gchar *host = nested_host ? "/host" : "/";
-
-    bind(host, prefix);
-
-    // Replace /host by an actual (inner) /host.
-    if (nested_host) {
-      fail_if(g_mkdir("/real-host", 0755));
-      fail_if(mount("/host/host", "/real-host", NULL, MS_BIND | MS_REC, NULL));
-      // For some reason umount("/host") returns EBUSY even immediately after
-      // pivot_root. We detach it at least to keep `/proc/mounts` from blowing
-      // up in nested cases.
-      fail_if(umount2("/host", MNT_DETACH));
-      fail_if(mount("/real-host", "/host", NULL, MS_MOVE, NULL));
-      fail_if(rmdir("/real-host"));
-    }
-
-    fail_if(chdir("/"));
-    fail_if(execvp(*argv, argv));
-  }
-
-  else {
-    int status;
-
-    fail_if(waitpid(cpid, &status, 0) != cpid);
-    fail_if(rmdir(prefix));
-
-    if (WIFEXITED(status))
-      return WEXITSTATUS(status);
-
-    else if (WIFSIGNALED(status))
-      kill(getpid(), WTERMSIG(status));
-
-    return 1;
-  }
-}

pkgs/build-support/build-fhsenv-chroot/chrootenv/src/meson.build

@@ -1,5 +0,0 @@
-project('chrootenv', 'c')
-
-glib = dependency('glib-2.0')
-
-executable('chrootenv', 'chrootenv.c', dependencies: [glib], install: true)

pkgs/build-support/build-fhsenv-chroot/default.nix

@@ -1,87 +0,0 @@
-{
-  lib,
-  callPackage,
-  runCommandLocal,
-  writeScript,
-  stdenv,
-  coreutils,
-}:
-
-let
-  buildFHSEnv = callPackage ./env.nix { };
-in
-
-args@{
-  name,
-  version ? null,
-  runScript ? "bash",
-  nativeBuildInputs ? [ ],
-  extraInstallCommands ? "",
-  meta ? { },
-  passthru ? { },
-  ...
-}:
-
-let
-  env = buildFHSEnv (
-    removeAttrs args [
-      "version"
-      "runScript"
-      "extraInstallCommands"
-      "meta"
-      "passthru"
-    ]
-  );
-
-  chrootenv = callPackage ./chrootenv { };
-
-  init =
-    run:
-    writeScript "${name}-init" ''
-      #! ${stdenv.shell}
-      for i in ${env}/* /host/*; do
-        path="/''${i##*/}"
-        [ -e "$path" ] || ${coreutils}/bin/ln -s "$i" "$path"
-      done
-
-      [ -d "$1" ] && [ -r "$1" ] && cd "$1"
-      shift
-
-      source /etc/profile
-      exec ${run} "$@"
-    '';
-
-  versionStr = lib.optionalString (version != null) ("-" + version);
-
-  nameAndVersion = name + versionStr;
-
-in
-runCommandLocal nameAndVersion
-  {
-    inherit nativeBuildInputs meta;
-
-    passthru = passthru // {
-      env =
-        runCommandLocal "${name}-shell-env"
-          {
-            shellHook = ''
-              exec ${chrootenv}/bin/chrootenv ${init runScript} "$(pwd)"
-            '';
-          }
-          ''
-            echo >&2 ""
-            echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
-            echo >&2 ""
-            exit 1
-          '';
-    };
-  }
-  ''
-    mkdir -p $out/bin
-    cat <<EOF >$out/bin/${name}
-    #! ${stdenv.shell}
-    exec ${chrootenv}/bin/chrootenv ${init runScript} "\$(pwd)" "\$@"
-    EOF
-    chmod +x $out/bin/${name}
-    ${extraInstallCommands}
-  ''

pkgs/build-support/build-fhsenv-chroot/env.nix

@@ -1,290 +0,0 @@
-{
-  stdenv,
-  lib,
-  buildEnv,
-  writeText,
-  pkgs,
-  pkgsi686Linux,
-}:
-
-{
-  name,
-  profile ? "",
-  targetPkgs ? pkgs: [ ],
-  multiPkgs ? pkgs: [ ],
-  nativeBuildInputs ? [ ],
-  extraBuildCommands ? "",
-  extraBuildCommandsMulti ? "",
-  extraOutputsToInstall ? [ ],
-}:
-
-# HOWTO:
-# All packages (most likely programs) returned from targetPkgs will only be
-# installed once--matching the host's architecture (64bit on x86_64 and 32bit on
-# x86).
-#
-# Packages (most likely libraries) returned from multiPkgs are installed
-# once on x86 systems and twice on x86_64 systems.
-# On x86 they are merged with packages from targetPkgs.
-# On x86_64 they are added to targetPkgs and in addition their 32bit
-# versions are also installed. The final directory structure looks as
-# follows:
-# /lib32 will include 32bit libraries from multiPkgs
-# /lib64 will include 64bit libraries from multiPkgs and targetPkgs
-# /lib will link to /lib32
-
-let
-  is64Bit = stdenv.hostPlatform.parsed.cpu.bits == 64;
-  # multi-lib glibc is only supported on x86_64
-  isMultiBuild = multiPkgs != null && stdenv.hostPlatform.system == "x86_64-linux";
-  isTargetBuild = !isMultiBuild;
-
-  # list of packages (usually programs) which are only be installed for the
-  # host's architecture
-  targetPaths = targetPkgs pkgs ++ (if multiPkgs == null then [ ] else multiPkgs pkgs);
-
-  # list of packages which are installed for both x86 and x86_64 on x86_64
-  # systems
-  multiPaths = multiPkgs pkgsi686Linux;
-
-  # base packages of the chroot
-  # these match the host's architecture, glibc_multi is used for multilib
-  # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
-  # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
-  basePkgs = with pkgs; [
-    glibcLocales
-    (if isMultiBuild then glibc_multi else glibc)
-    (toString gcc.cc.lib)
-    bashInteractiveFHS
-    coreutils
-    less
-    shadow
-    su
-    gawk
-    diffutils
-    findutils
-    gnused
-    gnugrep
-    gnutar
-    gzip
-    bzip2
-    xz
-  ];
-  baseMultiPkgs = with pkgsi686Linux; [
-    (toString gcc.cc.lib)
-  ];
-
-  etcProfile = writeText "profile" ''
-    export PS1='${name}-chrootenv:\u@\h:\w\$ '
-    export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
-    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
-    export TZDIR='/etc/zoneinfo'
-
-    # XDG_DATA_DIRS is used by pressure-vessel (steam proton) and vulkan loaders to find the corresponding icd
-    export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share
-
-    # Following XDG spec [1], XDG_DATA_DIRS should default to "/usr/local/share:/usr/share".
-    # In nix, it is commonly set without containing these values, so we add them as fallback.
-    #
-    # [1] <https://specifications.freedesktop.org/basedir-spec/latest>
-    case ":$XDG_DATA_DIRS:" in
-      *:/usr/local/share:*) ;;
-      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/local/share" ;;
-    esac
-    case ":$XDG_DATA_DIRS:" in
-      *:/usr/share:*) ;;
-      *) export XDG_DATA_DIRS="$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/usr/share" ;;
-    esac
-
-    # Force compilers and other tools to look in default search paths
-    unset NIX_ENFORCE_PURITY
-    export NIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
-    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
-    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
-    export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
-    export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
-    export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-    export ACLOCAL_PATH=/usr/share/aclocal
-
-    ${profile}
-  '';
-
-  # Compose /etc for the chroot environment
-  etcPkg = stdenv.mkDerivation {
-    name = "${name}-chrootenv-etc";
-    buildCommand = ''
-      mkdir -p $out/etc
-      cd $out/etc
-
-      # environment variables
-      ln -s ${etcProfile} profile
-
-      # compatibility with NixOS
-      ln -s /host/etc/static static
-
-      # symlink nix config
-      ln -s /host/etc/nix nix
-
-      # symlink some NSS stuff
-      ln -s /host/etc/passwd passwd
-      ln -s /host/etc/group group
-      ln -s /host/etc/shadow shadow
-      ln -s /host/etc/hosts hosts
-      ln -s /host/etc/resolv.conf resolv.conf
-      ln -s /host/etc/nsswitch.conf nsswitch.conf
-
-      # symlink user profiles
-      ln -s /host/etc/profiles profiles
-
-      # symlink sudo and su stuff
-      ln -s /host/etc/login.defs login.defs
-      ln -s /host/etc/sudoers sudoers
-      ln -s /host/etc/sudoers.d sudoers.d
-
-      # symlink other core stuff
-      ln -s /host/etc/localtime localtime
-      ln -s /host/etc/zoneinfo zoneinfo
-      ln -s /host/etc/machine-id machine-id
-      ln -s /host/etc/os-release os-release
-
-      # symlink PAM stuff
-      ln -s /host/etc/pam.d pam.d
-
-      # symlink fonts stuff
-      ln -s /host/etc/fonts fonts
-
-      # symlink ALSA stuff
-      ln -s /host/etc/asound.conf asound.conf
-      ln -s /host/etc/alsa alsa
-
-      # symlink SSL certs
-      mkdir -p ssl
-      ln -s /host/etc/ssl/certs ssl/certs
-
-      # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
-      ln -s /proc/mounts mtab
-    '';
-  };
-
-  # Composes a /usr-like directory structure
-  staticUsrProfileTarget = buildEnv {
-    name = "${name}-usr-target";
-    paths = [ etcPkg ] ++ basePkgs ++ targetPaths;
-    extraOutputsToInstall = [
-      "out"
-      "lib"
-      "bin"
-    ]
-    ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-    postBuild = ''
-      if [[ -d  $out/share/gsettings-schemas/ ]]; then
-          # Recreate the standard schemas directory if its a symlink to make it writable
-          if [[ -L $out/share/glib-2.0 ]]; then
-              target=$(readlink $out/share/glib-2.0)
-              rm $out/share/glib-2.0
-              mkdir $out/share/glib-2.0
-              ln -fs $target/* $out/share/glib-2.0
-          fi
-
-          if [[ -L $out/share/glib-2.0/schemas ]]; then
-              target=$(readlink $out/share/glib-2.0/schemas)
-              rm $out/share/glib-2.0/schemas
-              mkdir $out/share/glib-2.0/schemas
-              ln -fs $target/* $out/share/glib-2.0/schemas
-          fi
-
-          mkdir -p $out/share/glib-2.0/schemas
-
-          for d in $out/share/gsettings-schemas/*; do
-              # Force symlink, in case there are duplicates
-              ln -fs $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
-              ln -fs $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
-          done
-
-          # and compile them
-          ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
-      fi
-    '';
-  };
-
-  staticUsrProfileMulti = buildEnv {
-    name = "${name}-usr-multi";
-    paths = baseMultiPkgs ++ multiPaths;
-    extraOutputsToInstall = [
-      "out"
-      "lib"
-    ]
-    ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-  };
-
-  # setup library paths only for the targeted architecture
-  setupLibDirs_target = ''
-    # link content of targetPaths
-    cp -rsHf ${staticUsrProfileTarget}/lib lib
-    ln -s lib lib${if is64Bit then "64" else "32"}
-  '';
-
-  # setup /lib, /lib32 and /lib64
-  setupLibDirs_multi = ''
-    mkdir -m0755 lib32
-    mkdir -m0755 lib64
-    ln -s lib64 lib
-
-    # copy glibc stuff
-    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/ && chmod u+w -R lib32/
-
-    # copy content of multiPaths (32bit libs)
-    [ -d ${staticUsrProfileMulti}/lib ] && cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/ && chmod u+w -R lib32/
-
-    # copy content of targetPaths (64bit libs)
-    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/ && chmod u+w -R lib64/
-
-    # symlink 32-bit ld-linux.so
-    ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
-  '';
-
-  setupLibDirs = if isTargetBuild then setupLibDirs_target else setupLibDirs_multi;
-
-  # the target profile is the actual profile that will be used for the chroot
-  setupTargetProfile = ''
-    mkdir -m0755 usr
-    cd usr
-    ${setupLibDirs}
-    for i in bin sbin share include; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    cd ..
-
-    for i in var etc opt; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    for i in usr/{bin,sbin,lib,lib32,lib64}; do
-      if [ -d "$i" ]; then
-        ln -s "$i"
-      fi
-    done
-  '';
-
-in
-stdenv.mkDerivation {
-  name = "${name}-fhs";
-  inherit nativeBuildInputs;
-  buildCommand = ''
-    mkdir -p $out
-    cd $out
-    ${setupTargetProfile}
-    cd $out
-    ${extraBuildCommands}
-    cd $out
-    ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
-  '';
-  preferLocalBuild = true;
-  allowSubstitutes = false;
-}

pkgs/build-support/fetchurl/mirrors.nix

@@ -332,6 +332,17 @@
     "https://test.pypi.io/packages/source/"
   ];
 
+  # TeX historic archive (see https://tug.org/historic/)
+  texhistoric = [
+    "https://ftp.math.utah.edu/pub/tex/historic/"
+    "https://texlive.info/historic/"
+    "https://ftp.tu-chemnitz.de/pub/tug/historic/"
+    "https://pi.kwarc.info/historic/"
+    "https://mirrors.tuna.tsinghua.edu.cn/tex-historic-archive/"
+    "https://mirror.nju.edu.cn/tex-historic/"
+    "ftp://tug.org/texlive/historic/"
+  ];
+
   ### Linux distros
 
   # CentOS

pkgs/by-name/an/andagii/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -14,14 +15,7 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-U7wC55G8jIvMMyPcEiJQ700A7nkWdgWK1LM0F/wgDCg=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp -v ANDAGII_.TTF $out/share/fonts/truetype/andagii.ttf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     homepage = "http://www.i18nguy.com/unicode/unicode-font.html";

pkgs/by-name/an/ansible-doctor/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-doctor";
-  version = "8.3.1";
+  version = "8.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wv5iSY5p/PZUwgxwknoZgB4f5ERvsvA3hrUbdSAYwxQ=";
+    hash = "sha256-Asp26tGyzFPOCLESXe2Je4i+0u8OGX2GSaGy/cQC3AI=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/an/anytype/package.nix

@@ -93,6 +93,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    # used upstream for builds: https://github.com/anyproto/anytype-ts/blob/5d66657f764c0649410e37c9e9c06e3ff18487ee/.github/workflows/build.yml#L192.
+    NODE_OPTIONS = "--max-old-space-size=8192";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.16";
+  version = "1.2.17";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RsUoolJ2WOs3wpQilAs6RfpR3YzOhzTvDaxuweErIKs=";
+    hash = "sha256-6Z+1LpgvdRpcy2PmgSFeKHuMLh3jeA03KhfS2j2AhKQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-cp29oB3YcqQljeLq4ySOMhV+CXYnQ+ZnDljHn0UzmWs=";
+  vendorHash = "sha256-K2fqDAzex0EgrGPK5I4Bp5oqmIOnnuI1sztlySrX1Pc=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

pkgs/by-name/as/ashuffle/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/joshkunz/ashuffle";
     description = "Automatic library-wide shuffle for mpd";
-    maintainers = [ lib.maintainers.tcbravo ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
     license = lib.licenses.mit;
     mainProgram = "ashuffle";

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -313,9 +313,9 @@
 
   ssh = mkAzExtension rec {
     pname = "ssh";
-    version = "2.0.8";
+    version = "2.0.9";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/ssh-${version}-py3-none-any.whl";
-    hash = "sha256-eX42Pr1rTPWqUna4nvNMv7sWtIGcXyc/CbmhwRjQxoM=";
+    hash = "sha256-OdE4FZckAeM0eFI5/QPBtLJnCIs7fQF/M47B7ULqxFY=";
     description = "SSH into Azure VMs using RBAC and AAD OpenSSH Certificates";
     propagatedBuildInputs = with python3Packages; [
       oras

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.8.0";
+  version = "4.9.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QAlpOikf6T/YfAtvrOJy0lJX3vRGLCBa+g2sYBcGmt0=";
+    hash = "sha256-eEDiv/yBKWVvKTAeelqVSAQp2xHhXRJVkK2x0FZ9tOE=";
   };
 
   patches = [

pkgs/by-name/be/betterleaks/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "betterleaks";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "betterleaks";
     repo = "betterleaks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eq0U4KiL91NW2lxizQ0tZuXxkNnTuSb/pvNSY/+3DZQ=";
+    hash = "sha256-7Oa6mtFhkHqgd4/FH85W7Bc/KSMwPCeHRhIFk2KVkik=";
   };
 
-  vendorHash = "sha256-zlZNay6srObMfm4iweCezsr/EImCN9rl03DH8qJU/rc=";
+  vendorHash = "sha256-KAZfl2t8LUsgQBKsrgXsh/1ziX0FZvDhnSUAv7D/hSA=";
 
   ldflags = [
     "-s"

pkgs/by-name/by/byedpi/package.nix

@@ -30,8 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/hufrea/byedpi";
     changelog = "https://github.com/hufrea/byedpi/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ averyanalex ];
-    platforms = with lib.platforms; linux ++ windows;
+    maintainers = with lib.maintainers; [
+      averyanalex
+      hadal84
+    ];
+    platforms = with lib.platforms; linux ++ windows ++ darwin;
     mainProgram = "ciadpi";
   };
 })

pkgs/by-name/ca/caddyfile-language-server/package.nix

@@ -1,73 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  pnpm_8,
-  nodejs,
-  pnpmConfigHook,
-  makeBinaryWrapper,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "caddyfile-language-server";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "vscode-caddyfile";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-IusP9Z3e8mQ0mEhI1o1zIqPDB/i0pqlMfnt6M8bzb2w=";
-  };
-
-  pnpmWorkspaces = [ "@caddyserver/caddyfile-language-server" ];
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs)
-      pname
-      version
-      src
-      pnpmWorkspaces
-      ;
-    pnpm = pnpm_8;
-    fetcherVersion = 3;
-    hash = "sha256-D9kYFkmFlvg4r6vR9PHHAwF0qglHsTuRae0Z7CzDq1M=";
-  };
-
-  nativeBuildInputs = [
-    pnpm_8
-    pnpmConfigHook
-    nodejs
-    makeBinaryWrapper
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    pnpm --filter=@caddyserver/caddyfile-language-server run build
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    rm -rf node_modules packages/server/node_modules
-    pnpm install --production --offline --force --filter=@caddyserver/caddyfile-language-server
-    mkdir -p $out/lib/node_modules/caddyfile-language-server/
-    mv packages/server/dist/* $out/lib/node_modules/caddyfile-language-server/
-
-    makeWrapper ${lib.getExe nodejs} $out/bin/caddyfile-language-server \
-      --add-flags "$out/lib/node_modules/caddyfile-language-server/index.js"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    changelog = "https://github.com/caddyserver/vscode-caddyfile/releases/tag/v${finalAttrs.version}";
-    description = "Basic language server for caddyfile";
-    homepage = "https://github.com/caddyserver/vscode-caddyfile";
-    mainProgram = "caddyfile-language-server";
-    maintainers = with lib.maintainers; [ pyrox0 ];
-    platforms = lib.platforms.all;
-  };
-})

pkgs/by-name/ca/cardinal/package.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  carla,
   cmake,
   dbus,
   fftwFloat,
@@ -37,6 +38,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   prePatch = ''
     patchShebangs ./dpf/utils/generate-ttl.sh
+
+    substituteInPlace plugins/Cardinal/src/Carla.cpp \
+      --replace-fail "/usr/lib/carla" "${carla}/bin" \
+      --replace-fail "/usr/share/carla/resources" "${carla}/share"
+
+    substituteInPlace plugins/Cardinal/src/Ildaeil.cpp \
+      --replace-fail "/usr/lib/carla" "${carla}/bin" \
+      --replace-fail "/usr/share/carla/resources" "${carla}/share"
   '';
 
   dontUseCmakeConfigure = true;

pkgs/by-name/ca/cargo-sort-derives/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sort-derives";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "cargo-sort-derives";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-91sfRTMcI2/MyTrv+uJmhqfL4KUAc6//yzRR9FxvPHo=";
+    hash = "sha256-o92jmQ+AYZIadVUMqsZdAq7x1Y4HneWx3RYEVKTVJyM=";
   };
 
-  cargoHash = "sha256-kQTAYBb/xhrfO3PSJvnZrZKr6B3fgtlElf1mNCSf7eg=";
+  cargoHash = "sha256-DPjwCzP7nsqJjsERHO3YMUEXbU7TjUTZc8Jo1R9XThg=";
 
   meta = {
     description = "Cargo subcommand to sort derive attributes";

pkgs/by-name/ca/catppuccin/package.nix

@@ -4,6 +4,7 @@ let
     "bat"
     "bottom"
     "btop"
+    "delta"
     "element"
     "grub"
     "hyprland"
@@ -90,6 +91,14 @@ let
       hash = "sha256-mEGZwScVPWGu+Vbtddc/sJ+mNdD2kKienGZVUcTSl+c=";
     };
 
+    delta = fetchFromGitHub {
+      name = "delta";
+      owner = "catppuccin";
+      repo = "delta";
+      rev = "011516f5d14f66b771b3e716f29c77231e008c74";
+      hash = "sha256-lztkxX9O41YossvRzpR7tqxMhDNT1Efy2JvkCwtsiXQ=";
+    };
+
     element = fetchFromGitHub {
       name = "element";
       owner = "catppuccin";
@@ -268,6 +277,11 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
       mkdir -p "$out/bottom"
       cp "${sources.bottom}/themes/${variant}.toml" "$out/bottom"
 
+    ''
+    + lib.optionalString (lib.elem "delta" themeList) ''
+      mkdir -p "$out/delta"
+      cp "${sources.delta}/catppuccin.gitconfig" "$out/delta"
+
     ''
     + lib.optionalString (lib.elem "element" themeList) ''
       mkdir -p "$out/element"

pkgs/by-name/ch/charasay/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "charasay";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "latipun7";
     repo = "charasay";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NB2GDDFH9IW/c0acMojYHuzPrx0J3tjlDqjQa6ZRbN4=";
+    hash = "sha256-VkDOdZt0Z/kuBwFm5utXYsxT59a1uapU9ouzB1ymmXs=";
   };
 
-  cargoHash = "sha256-i2CvwQXKKfYLdK0tKf/w4TepPyMo99v1I+kIr00PWcY=";
+  cargoHash = "sha256-6AczT5VvOryOlcOMNFxcHqy8K1sm4tbhb6+LsCNHW14=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ch/choose-gui/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/chipsenkbeil/choose/blob/${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [
       heywoodlh
-      niksingh710
+      semi710
     ];
     mainProgram = "choose";
   };

pkgs/by-name/ch/chroma/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chroma";
-  version = "2.26.1";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
     repo = "chroma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kOhPaiqtFU3H43jz+GjfOOIVEy5acpP9SwQ1/2xsMQc=";
+    hash = "sha256-iIu0FFAavXbma/LiKEDltvrGMYYd4uxSfHpNTrmN6aI=";
   };
 
-  vendorHash = "sha256-mPB7qPPMIQLjmyN2T7qX/X1Ip0E4X0jNv5h+UfVEHrY=";
+  vendorHash = "sha256-B2TvCIBqgdTpQApmQkO2COIarqmgF9mhZ0HG5aFgVhY=";
 
   modRoot = "./cmd/chroma";
 

pkgs/by-name/ci/citrix-workspace/package.nix

@@ -46,7 +46,7 @@
   libredirect,
   libseccomp,
   libsecret,
-  # libsoup_2_4,
+  libsoup_3,
   libvorbis,
   libxml2_13,
   libxslt,
@@ -55,10 +55,8 @@
   nspr,
   nss,
   opencv4,
-  openssl,
   pango,
   pcsclite,
-  perl,
   sane-backends,
   speex,
   symlinkJoin,
@@ -66,6 +64,7 @@
   tzdata,
   which,
   woff2,
+  webkitgtk_4_1,
   libxtst,
   libxscrnsaver,
   libxrender,
@@ -81,10 +80,6 @@
   x264,
   zlib,
 
-  homepage,
-  version,
-  hash,
-
   extraCerts ? [ ],
 }:
 
@@ -105,27 +100,15 @@ let
     name = "fuse3-backwards-compat";
     paths = [ (lib.getLib fuse3) ];
     postBuild = ''
-      ln -sf $out/lib/libfuse3.so.3.17.4 $out/lib/libfuse3.so.3
-    '';
-  };
-
-  openssl' = symlinkJoin {
-    name = "openssl-backwards-compat";
-    nativeBuildInputs = [ makeWrapper ];
-    paths = [ (lib.getLib openssl) ];
-    postBuild = ''
-      ln -sf $out/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
-      ln -sf $out/lib/libssl.so $out/lib/libssl.so.1.0.0
+      ln -sf $out/lib/libfuse3.so.3.* $out/lib/libfuse3.so.3
     '';
   };
 
   opencv4' = symlinkJoin {
     name = "opencv4-compat";
-    nativeBuildInputs = [ makeWrapper ];
     paths = [ opencv4 ];
     postBuild = ''
       for so in ${opencv4}/lib/*.so; do
-        ln -s "$so" $out/lib/$(basename "$so").407 || true
         ln -s "$so" $out/lib/$(basename "$so").410 || true
       done
     '';
@@ -135,17 +118,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "citrix-workspace";
-  inherit version;
+  version = "26.04.0.73";
 
   src = requireFile rec {
     name = "linuxx64-${version}.tar.gz";
-    sha256 = hash;
+    sha256 = "1hp6ax0ix3id94njd43a35af3ydlb6sqwvbbabd5xp8d511m695f";
 
     message = ''
       In order to use Citrix Workspace, you need to comply with the Citrix EULA and download
       the 64-bit binaries, .tar.gz from:
 
-      ${homepage}
+      https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-gcc11-for-linux.html
 
       (if you do not find version ${version} there, try at
       https://www.citrix.com/downloads/workspace-app/)
@@ -210,7 +193,7 @@ stdenv.mkDerivation rec {
     libpulseaudio
     libseccomp
     libsecret
-    # libsoup_2_4
+    libsoup_3
     libvorbis
     libxml2_13
     libxslt
@@ -218,7 +201,6 @@ stdenv.mkDerivation rec {
     nspr
     nss
     opencv4'
-    openssl'
     pango
     pcsclite
     sane-backends
@@ -226,6 +208,7 @@ stdenv.mkDerivation rec {
     stdenv.cc.cc
     (lib.getLib systemd)
     woff2
+    webkitgtk_4_1
     libxscrnsaver
     libxaw
     libxmu
@@ -275,8 +258,7 @@ stdenv.mkDerivation rec {
           lib.optional (isWfica program) "$ICAInstDir"
           ++ [
             "$ICAInstDir/lib"
-            "$ICAInstDir/usr/lib/x86_64-linux-gnu"
-            "$ICAInstDir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
+            "${lib.getLib webkitgtk_4_1}/lib/webkit2gtk-4.1/injected-bundle"
             # HdxRtcEngine loads libpulse.so.0 with dlopen, so autoPatchelf
             # cannot discover it from ELF dependencies.
             "${lib.getLib libpulseaudio}/lib"
@@ -297,7 +279,7 @@ stdenv.mkDerivation rec {
             ''--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "${gstPluginPath}"''
             ''--prefix LD_LIBRARY_PATH : "${ldLibraryPath program}"''
             ''--set LD_PRELOAD "${libredirect}/lib/libredirect.so ${lib.getLib pcsclite}/lib/libpcsclite.so"''
-            ''--set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone:/usr/lib/x86_64-linux-gnu=$ICAInstDir/usr/lib/x86_64-linux-gnu"''
+            ''--set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone"''
           ]
         );
 
@@ -328,6 +310,7 @@ stdenv.mkDerivation rec {
         "util/configmgr"
         "util/conncenter"
         "util/ctx_rehash"
+        "util/ctxwebhelper"
       ];
     in
     ''
@@ -349,11 +332,9 @@ stdenv.mkDerivation rec {
       source_date=$(date --utc --date=@$SOURCE_DATE_EPOCH "+%F %T")
       faketime -f "$source_date" ${stdenv.shell} linuxx64/hinst CDROM "$(pwd)"
 
-      mkdir -p "$ICAInstDir/usr"
-      tar -xzf ./linuxx64/linuxx64.cor/Webkit2gtk4.0/webkit2gtk-4.0.tar.gz \
-        --strip-components=2 \
-        -C "$ICAInstDir/usr" \
-        webkit2gtk-4.0-package/usr/lib
+      # The GCC 11 package line links against libsoup 3 and WebKitGTK 4.1, but
+      # the tarball still contains the legacy WebKitGTK 4.0 bundle.
+      rm -rf "$ICAInstDir/Webkit2gtk4.0"
 
       if [ -f "$ICAInstDir/util/setlog" ]; then
         chmod +x "$ICAInstDir/util/setlog"
@@ -365,7 +346,6 @@ stdenv.mkDerivation rec {
         "PrimaryAuthManager"
         "ServiceRecord"
         "AuthManagerDaemon"
-        "util/ctxwebhelper"
       ]}
 
       ln -sf $ICAInstDir/util/storebrowse $out/bin/storebrowse
@@ -390,38 +370,42 @@ stdenv.mkDerivation rec {
       echo "We arbitrarily set the timezone to UTC. No known consequences at this point."
       echo UTC > "$ICAInstDir/timezone"
 
-      echo "Copy .desktop files."
-      cp $out/opt/citrix-icaclient/desktop/* $out/share/applications/
-      for desktop in $out/share/applications/*.desktop; do
+      echo "Patch .desktop files."
+      for desktop in "$ICAInstDir"/desktop/*.desktop; do
         sed -i \
           -e "s#/opt/Citrix/ICAClient#$ICAInstDir#g" \
-          -e "s#$ICAInstDir/util/ctxwebhelper#ctxwebhelper#g" \
           "$desktop"
 
         case "$(basename "$desktop")" in
           citrixapp.desktop)
             sed -i \
-              -e 's#^TryExec=.*#TryExec=selfservice#' \
-              -e 's#^Exec=.*#Exec=selfservice %u#' \
+              -e "s#^TryExec=.*#TryExec=$out/bin/selfservice#" \
+              -e "s#^Exec=.*#Exec=$out/bin/selfservice %u#" \
+              "$desktop"
+            ;;
+          citrixweb.desktop | ctxaadsso.desktop | fido2_llt.desktop | receiver.desktop | receiver_fido2.desktop)
+            sed -i \
+              -e "s#^TryExec=.*#TryExec=$out/bin/ctxwebhelper#" \
+              -e "s#^Exec=.*#Exec=$out/bin/ctxwebhelper %u#" \
               "$desktop"
             ;;
           selfservice.desktop)
             sed -i \
-              -e 's#^TryExec=.*#TryExec=selfservice#' \
-              -e 's#^Exec=.*#Exec=selfservice#' \
+              -e "s#^TryExec=.*#TryExec=$out/bin/selfservice#" \
+              -e "s#^Exec=.*#Exec=$out/bin/selfservice#" \
               "$desktop"
             ;;
           wfica.desktop)
             sed -i \
-              -e 's#^TryExec=.*#TryExec=adapter#' \
-              -e 's#^Exec=.*#Exec=adapter %f#' \
+              -e "s#^TryExec=.*#TryExec=$out/bin/adapter#" \
+              -e "s#^Exec=.*#Exec=$out/bin/adapter %f#" \
               "$desktop"
             ;;
         esac
       done
 
-      # We introduce a dependency on the source file so that it need not be redownloaded everytime
-      echo $src >> "$out/share/workspace_dependencies.pin"
+      echo "Copy .desktop files."
+      cp $out/opt/citrix-icaclient/desktop/* $out/share/applications/
 
       runHook postInstall
     '';
@@ -429,13 +413,7 @@ stdenv.mkDerivation rec {
   # Make sure that `autoPatchelfHook` is executed before
   # running `ctx_rehash`.
   dontAutoPatchelf = true;
-  # Null out hardcoded webkit bundle path so it falls back to LD_LIBRARY_PATH
   postFixup = ''
-    ${lib.getExe perl} -0777 -pi -e 's{/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/}{"\0" x length($&)}e' \
-      $out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4
-
-    addAutoPatchelfSearchPath --no-recurse "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu"
-    addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
     addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/lib"
     autoPatchelf -- "$out"
 
@@ -443,16 +421,14 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    # citrix_workspace has a hard dependency on libsoup 2.4 (autoPatchelf
-    # fails if it is not present), which was removed for being insecure.
-    #
-    # Versions older than 25.08 also required webkitgtk_4_0, which was removed.
-    broken = true;
     license = lib.licenses.unfree;
     description = "Citrix Workspace";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [ flacks ];
-    inherit homepage;
+    maintainers = with lib.maintainers; [
+      khaneliman
+      flacks
+    ];
+    homepage = "https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-gcc11-for-linux.html";
   };
 }

pkgs/by-name/cl/clamav/package.nix

@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clamav";
-  version = "1.4.3";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/clamav-${finalAttrs.version}.tar.gz";
-    hash = "sha256-2HTKvz1HZbNbUY71NWWKHm7HSAIAah1hP58SSqE0MhA=";
+    hash = "sha256-80AYzyLwW92dGhV0ygcZPj4DDKUgUMPlwiDiOjIxSWU=";
   };
 
   patches = [
@@ -67,11 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DSYSTEMD_UNIT_DIR=${placeholder "out"}/lib/systemd"
     "-DAPP_CONFIG_DIRECTORY=/etc/clamav"
+    "-DCVD_CERTS_DIRECTORY=${placeholder "out"}/share/clamav/certs"
   ];
 
-  # Seems to only fail on x86_64-darwin with sandboxing
-  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64);
-  __darwinAllowLocalNetworking = true;
+  # Fails on darwin with sandboxing
+  doCheck = !(stdenv.hostPlatform.isDarwin);
 
   checkInputs = [
     python3.pkgs.pytest

pkgs/by-name/cl/claude-agent-acp/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.42.0";
+  version = "0.45.1";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yvljKMNVCQAFcobHzgPwXSTYGU1IWdOGdX6nsxBfWyw=";
+    hash = "sha256-NiDsm0tcK80CQyG8zn974ErwDP0hXXOHbCLX9BpErKY=";
   };
 
-  npmDepsHash = "sha256-ecMy4cgsM+PKdsiqAG4Deoiz8DQeJRDgZ8aWzjS/EjA=";
+  npmDepsHash = "sha256-WB+ZMtDmqZrEg8/k9peCm+EbKvZc8qfOV33STT1vj8k=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.177",
-  "commit": "6fae7a072b111776fc95ca221caac31b7439eb25",
-  "buildDate": "2026-06-13T00:29:44Z",
+  "version": "2.1.179",
+  "commit": "8c865e06ae1320b1c9b005bdeb6f6589ada9d0b3",
+  "buildDate": "2026-06-16T02:06:40Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "eb0730351be2f02b482b1855870f5877489085aac86b0c4c1db4e458d9e40ed9",
-      "size": 225124512
+      "checksum": "af2a2d0cb99b0e8b094bc5dbe114ed2d5b2d27ba440987ef6f2f209da9954253",
+      "size": 226082208
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "fcdc6c6679d4e1e3a0a3812f24e8b08ab73156732072c2ca5ee6248bee8313bd",
-      "size": 227642800
+      "checksum": "a0ad60761294bd208eda6cb0fd8e896c64397c8d317546a696c5e627782ec8cb",
+      "size": 228600496
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "baf3926dc166215772f959e367da9784ff4c75157aaafe4524fdc79ebff984b1",
-      "size": 250394248
+      "checksum": "25d2eba2351df153f872a8e19289f5042a26b430cd446564bd92a0dec5d681cd",
+      "size": 251311752
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "ff41753634b20c869ef6a32a20863521b33d4186ac0d6a49379ab48a48395ee7",
-      "size": 250480336
+      "checksum": "6d8422de5ac8ac2077b20e2a6307083f85609aaf45f8c783ec2f7d71e8781e70",
+      "size": 251418320
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "bc756f27912d993d632a5f86be9a0364fc3c1373d146a367e46c8d01d3ca1620",
-      "size": 243248984
+      "checksum": "8273ab58b79a6324fa8d56361cd394a4ffa5d30f28be3abecaafb2596d7ae2ee",
+      "size": 244166488
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "4884b1512bf2863a85f1717eee58840b05d558568f817be71b1a116a430f4a96",
-      "size": 244890672
+      "checksum": "891b13f5aa5a798c209b13ce9c556c9a9162b6ad574eea97b223c80e4ee1d9dd",
+      "size": 245828656
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "408ddf27d45fc6b6516843c0513072bc0f474d7bface60ae8bbbc633bef9feb2",
-      "size": 245856928
+      "checksum": "1025f57fb260a3adac9517eb643c78c67e756c1ef5514d9ad8c57d5d784f8be3",
+      "size": 246756512
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "89652ac1f73ccc3fe039a1d388af81af82608af1cac7a32b5ebc2189b8ae2d62",
-      "size": 241821856
+      "checksum": "0320d4b49e3d434fcf94cf1a73e4d7e95df831a22c2c94d2a0cd471a59a27eac",
+      "size": 242721440
     }
   }
 }

pkgs/by-name/cl/clive/package.nix

@@ -43,7 +43,7 @@ buildGoModule (finalAttrs: {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  doinstallCheck = true;
+  doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/co/containerlab/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.76.0";
+  version = "0.76.1";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ULO0I9ixhRKCHI6LT2lWn2wXEIMl87q3PXwus+b3VmM=";
+    hash = "sha256-1BE3PZvXUYSMvs65MS5kT3xp0P7pPjTXJKq6dEcmKqw=";
   };
 
-  vendorHash = "sha256-US8y4AlO9fMD7bogIPT6bsrSsUx7c6X1Y0ooHiQ6WUc=";
+  vendorHash = "sha256-x9G80vupcewg0FtIAnWSTQiPPWDIvfjqSpmmjAradwA=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/co/context7-mcp/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "3.0.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-3Hk3YEXIR6SAEtCeDeaU1fU/CyvxuObZSNbgqrzeJ/o=";
+    hash = "sha256-Gf3GnVOceAMzsc1SYGQVriDzDD/dQYSoBSrCuQ5M4UI=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-ugUN1U0OR8dPTq4PADJaq6ElngSlw6PlmYDUFoW+2F4=";
+    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
   };
 
   buildPhase = ''

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YXEEiWbbP6G7x/rQiihAq20OEMxJNSgky+JTEaKlNDU=";
+    hash = "sha256-FZP+RTV4pcj9pzDq3G2+sWeJnkh9WnW3Atd0CC9zDCk=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor

pkgs/by-name/ct/ctranslate2/package.nix

@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.7.2";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-jtOfMrC5kFKQN4eFEZeawo0blWHbpMu+peM3XtTSf5w=";
+    hash = "sha256-Z7Gq+kXIfMdZs48WeptRGXhXnLfehegAwTtQpTbPM4U=";
   };
 
   # Fix CMake 4 compatibility

pkgs/by-name/de/deadbeef/package.nix

@@ -65,14 +65,14 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "deadbeef";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "DeaDBeeF-Player";
     repo = "deadbeef";
     fetchSubmodules = true;
     tag = finalAttrs.version;
-    hash = "sha256-9naokzS2PxnyeO8AnqwLOsrYf/8I6Ah3oesUy2f22vs=";
+    hash = "sha256-SAp6XAE3fKTR27xYrdkNHneYDGJW1+XJdX6eBI9+EY0=";
   };
 
   buildInputs = [

pkgs/by-name/de/dep-scan/package.nix

@@ -79,6 +79,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     teams = [ lib.teams.ngi ];
-    mainProgram = "dep-scan";
+    mainProgram = "depscan";
   };
 })

pkgs/by-name/de/devin-cli/package.nix

@@ -7,29 +7,29 @@
 }:
 
 let
-  version = "2026.5.26-8";
+  version = "2026.7.16";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-unknown-linux.tar.gz";
-      hash = "sha256-TqSABBxigiYTafi0vxFYnssLjHbiXYaNxI8prkkp8CE=";
+      hash = "sha256-nbp5I6Ta6OFpz5P+TwKVxTdtoq3QcChii1QzYHizzzY=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-unknown-linux.tar.gz";
-      hash = "sha256-1hoTd6JR43nR+heLqU7igP+debI1bhWcIlG6BGyaj3I=";
+      hash = "sha256-8BiJnLlUk4BxTNo4tbZg6QHZjfMLRDEx/X9tcAenB9k=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-apple-darwin.tar.gz";
-      hash = "sha256-/8vd26V0z1qyt8EOJ2Z/JdWNGjb+iN+YkgaJQRoBHUk=";
+      hash = "sha256-iRt56RmT7U3lgFpw/e9KFkAoBg6UuJNdf79/zHiRwc0=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-apple-darwin.tar.gz";
-      hash = "sha256-uF6ORbWwC0hgIURFoXFQh/5oPvfS4cgRBaCui4S0E0E=";
+      hash = "sha256-luSuvOyXHPs4NDzF9Iql9cFUN1ac9key/bNr1saLZBE=";
     };
   };
 in

pkgs/by-name/du/duplicati/deps.json

@@ -26,8 +26,8 @@
   },
   {
     "pname": "Avalonia",
-    "version": "12.0.0",
-    "hash": "sha256-pBn3o40TTYAPtjcfvaVK6wMFNSY7AHEE5wU4zDUj4FA="
+    "version": "12.0.2",
+    "hash": "sha256-Ht2h4cBtnVhrk9VWsHDOEvU1wd/y80CxMDWn8W0lHKk="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
@@ -46,8 +46,8 @@
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "12.0.0",
-    "hash": "sha256-M18vFA8cxZDR6RBF32O82n5pQAj70Jr6CpVXUEjtEso="
+    "version": "12.0.2",
+    "hash": "sha256-ydFDRX0zTEtJJzjn+TTpcSYL49xBJ3vFi9v3NSOyPww="
   },
   {
     "pname": "Avalonia.Diagnostics",
@@ -56,23 +56,23 @@
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "12.0.0",
-    "hash": "sha256-jOAw9i1K093cfGrNOVZQgXm8nNxaFcRMhbLM3NFrGE8="
+    "version": "12.0.2",
+    "hash": "sha256-raEQGX8Vwr+c7W5SzkEZ/phEEs/a5N0xeUfAWKEpl6A="
   },
   {
     "pname": "Avalonia.FreeDesktop.AtSpi",
-    "version": "12.0.0",
-    "hash": "sha256-/sXI18zP+SB8kRBZLl1WddrNxsgQRceoB3AiZwQYfWs="
+    "version": "12.0.2",
+    "hash": "sha256-5AQPlWW6g7G6pm7qI8RHR/MQ45VGd7iAFWseXUitIVI="
   },
   {
     "pname": "Avalonia.HarfBuzz",
-    "version": "12.0.0",
-    "hash": "sha256-3S0L0YqiULMBgXbwlJl7qTwhBZl8I/ahM8GF1kcK/hE="
+    "version": "12.0.2",
+    "hash": "sha256-FUYKVfweWiFix+LJZt9scI7HYiIl3C+8j9K0/yKsOIE="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "12.0.0",
-    "hash": "sha256-QqPWE4I2TxCPHufuNkfx1r35lGN1W+c992gxzrB+RRc="
+    "version": "12.0.2",
+    "hash": "sha256-E1uQvsvnVBIyzAyV3803LXMpitPvaoJezCedz6ZeV1A="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
@@ -81,18 +81,18 @@
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "12.0.0",
-    "hash": "sha256-l/NCO/I3Zavlta14Q198MpYn7jtwMclUWk6cqEgqmTU="
+    "version": "12.0.2",
+    "hash": "sha256-19hc0GSsa9JujiZlHxLKn7x6fUjAeJSH3lO43hL0bD0="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "12.0.0",
-    "hash": "sha256-w8i8lTkf3yp78rPxg7LlcsrKF/K3J7ATOTy3D/Bt6CA="
+    "version": "12.0.2",
+    "hash": "sha256-ZzNoO/8/SYG4xN0RmPz9AC6N1RtPTnSaTVrQ0+NNvGU="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "12.0.0",
-    "hash": "sha256-wpBWj5EsRPDhsoE+RFGy8Z7wS8lN2s0mW7qFgRaVOOA="
+    "version": "12.0.2",
+    "hash": "sha256-H8AXau1gV8m33lKYrSzxp0GDmoCuyx7+B93gTfcpXXU="
   },
   {
     "pname": "Avalonia.Themes.Simple",
@@ -101,13 +101,13 @@
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "12.0.0",
-    "hash": "sha256-QDS1fxNQMw3EHfrqihk05emNENjUmxLQyYgNCQp9vwM="
+    "version": "12.0.2",
+    "hash": "sha256-yHcePPF2tKc9oussntmAr/4LX3FEkGRRFuzdmlE+NHQ="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "12.0.0",
-    "hash": "sha256-WJjJKB2q1s18BVlLDUdPIpLQC2Bhgkl7fkO42Kjv2zU="
+    "version": "12.0.2",
+    "hash": "sha256-not3Qv87nbN6Bi8sE49WKDSNzUTISBdcNR3rcFqgwHE="
   },
   {
     "pname": "AWSSDK.Core",
@@ -936,28 +936,28 @@
   },
   {
     "pname": "SkiaSharp",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-fIrOUgx8K/qnJaQCPa06BPlkIy3PHRgrhHGkKn5d3qY="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-yUHsoau6WVQkzYV5UVnKcgpABiapa9aoTDd1pw/J5r8="
   },
   {
     "pname": "SkiaSharp.NativeAssets.Linux",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-JsQ9xmreA1zNaLwEHNPMaFsRygEDhemJCrbkhs8WHvQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-jcf0FhUgOzxpJ4ENn1q5uPe8dT+kXl0/yUWJs+hDYNA="
   },
   {
     "pname": "SkiaSharp.NativeAssets.macOS",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-9l1xrgVl6kH2kjW5ffluKv4ec/kqUfVnqlz9OVwP2cQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-olbqFOHmkiCdlnXHU4l1lTb04yAPn21CvLNMP4AGncs="
   },
   {
     "pname": "SkiaSharp.NativeAssets.WebAssembly",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-5UsssFayYOMcvWNBGJeChLRc9EahpIuuexNhGHnnrhU="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-R+67ADA6luDa9b7xvsE4PSL6GWwQTaNYzw2WYou/ofQ="
   },
   {
     "pname": "SkiaSharp.NativeAssets.Win32",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-MWsHe/NBlbHGtEhUICVuuhpRYSjtU06msLCoglqmVhQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-Sd+KnMezIKbc4OLklHsfeM7EVZERtmawWuSCoaySteM="
   },
   {
     "pname": "SMBLibrary",
@@ -1204,11 +1204,6 @@
     "version": "1.5.4",
     "hash": "sha256-5rYv675c14DNMne6FUkebyBI+7fWwLCqGs+KQCjbCcI="
   },
-  {
-    "pname": "Tmds.DBus.Protocol",
-    "version": "0.90.3",
-    "hash": "sha256-jK/98C0WrkVqPPNMx+xkdGK7vhcFmDsMqX7hUmALAWM="
-  },
   {
     "pname": "Tmds.DBus.Protocol",
     "version": "0.92.0",

pkgs/by-name/du/duplicati/package.nix

@@ -14,9 +14,9 @@
 
 let
   # for update.sh easy to handle
-  ngclientVersion = "0.0.218";
-  ngclientRev = "67e437adee2fefa9dc2a9464d3748a8512525f71";
-  ngclientHash = "sha256-1DT/WIaQ+di8vsnsAaA5qYinhvaKImEfGn2pyljXxjw=";
+  ngclientVersion = "0.0.225";
+  ngclientRev = "b740ef00435af2066936f90d4cf284b5662c4bf9";
+  ngclientHash = "sha256-X8ZhCmwfroIZWj3DjFq/InN+2zCOtHjEE1TyCXHNaIw=";
 
   # from Duplicati/Server/webroot/ngclient/package.json
   ngclient = buildNpmPackage {
@@ -30,7 +30,7 @@ let
       hash = ngclientHash;
     };
 
-    npmDepsHash = "sha256-yytz5qMhgd/yXr11szuVslTLTjV5XpfNPyLW3mmRM1E=";
+    npmDepsHash = "sha256-DhP1gY965xNOj98s95LqSTCaqJt4YdFfbZ4bGp3o4cA=";
 
     nativeBuildInputs = [ bun ];
 
@@ -58,15 +58,15 @@ let
 in
 buildDotnetModule rec {
   pname = "duplicati";
-  version = "2.3.0.1";
+  version = "2.3.0.3";
   channel = "stable";
-  buildDate = "2026-04-24";
+  buildDate = "2026-06-10";
 
   src = fetchFromGitHub {
     owner = "duplicati";
     repo = "duplicati";
     tag = "v${version}_${channel}_${buildDate}";
-    hash = "sha256-r3Oumo2vrViTNvZDUaVoJyGMBf1/uHS6oAhn9Aegb3s=";
+    hash = "sha256-vRD3pehsGznGesynrftns6F5md9Ej509A99Ug0IOPGk=";
     stripRoot = true;
   };
 

pkgs/by-name/en/envoy-bin/package.nix

@@ -7,7 +7,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.38.0";
+  version = "1.38.2";
   inherit (stdenvNoCC.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -20,8 +20,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-nwBnjAzEM9ejQsQiQV6z/dFj53QUruXFtXwEvX1XlFQ=";
-      x86_64-linux = "sha256-zKMSp8P5GFLyhJmVyJUTDFmELiG6eH3JC6+kAm1sXsw=";
+      aarch64-linux = "sha256-nHFdDu2KrzqZgw7glwvDtevH1CIbvB4vP/chBWHanX0=";
+      x86_64-linux = "sha256-h3RKH8mY1ncHjJcDEToZLQgwutxoiGYkQWMoR/yziJk=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/et/etcd_3_4/package.nix

@@ -44,6 +44,6 @@ buildGoModule (finalAttrs: {
     downloadPage = "https://github.com/etcd-io/etcd/";
     license = lib.licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with lib.maintainers; [ superherointj ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/et/etcd_3_5/package.nix

@@ -28,10 +28,7 @@ let
     description = "Distributed reliable key-value store for the most critical data of a distributed system";
     license = lib.licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with lib.maintainers; [
-      dtomvan
-      superherointj
-    ];
+    maintainers = with lib.maintainers; [ dtomvan ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
   };
 

pkgs/by-name/et/etcd_3_6/package.nix

@@ -31,10 +31,7 @@ let
     downloadPage = "https://github.com/etcd-io/etcd";
     license = lib.licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with lib.maintainers; [
-      dtomvan
-      superherointj
-    ];
+    maintainers = with lib.maintainers; [ dtomvan ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
   };
 

pkgs/by-name/fa/falcon/bump-minimum-cmake-required-version.patch

@@ -1,250 +0,0 @@
-From a1f4fa1607249b0356c2cd2c54134cb3dc2dc231 Mon Sep 17 00:00:00 2001
-From: Stanislas Marquis <stan@astrorigin.com>
-Date: Fri, 3 Mar 2023 12:44:09 +0100
-Subject: [PATCH] Update cmake minimum version >= 3.16.3 (ubuntu FF)
-
----
- CMakeLists.txt                         | 2 +-
- apps/faldoc/CMakeLists.txt             | 2 +-
- clt/falcon/editline/CMakeLists.txt     | 4 ++--
- dist/nsis/CMakeLists.txt               | 2 +-
- modules/native/MP/CMakeLists.txt       | 2 +-
- modules/native/conio/CMakeLists.txt    | 2 +-
- modules/native/curl/CMakeLists.txt     | 2 +-
- modules/native/dbi/CMakeLists.txt      | 2 +-
- modules/native/dbus/CMakeLists.txt     | 2 +-
- modules/native/dynlib/CMakeLists.txt   | 2 +-
- modules/native/feathers/CMakeLists.txt | 2 +-
- modules/native/gd2/CMakeLists.txt      | 2 +-
- modules/native/gtk/CMakeLists.txt      | 2 +-
- modules/native/hpdf/CMakeLists.txt     | 2 +-
- modules/native/sdl/CMakeLists.txt      | 2 +-
- modules/native/wopi/CMakeLists.txt     | 2 +-
- tests/native/dynlib/CMakeLists.txt     | 2 +-
- 17 files changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 81c404677..de2125e3d 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -34,7 +34,7 @@
- # List of available modules: CURL DBI DBUS DYNLIB GD2 GTK PDF SDL
- #
- 
--cmake_minimum_required(VERSION 2.6.2)
-+cmake_minimum_required(VERSION 3.16.3)
- project(Falcon)
- 
- 
-diff --git a/apps/faldoc/CMakeLists.txt b/apps/faldoc/CMakeLists.txt
-index 3e0867f63..7ef40d7b3 100644
---- a/apps/faldoc/CMakeLists.txt
-+++ b/apps/faldoc/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # CMake configuration file for Feather modules
- ####################################################################
- 
--cmake_minimum_required(VERSION 2.6.2)
-+cmake_minimum_required(VERSION 3.16.3)
- project(falcon-app-faldoc)
- 
- set(FALDOC_DIR "${FALCON_APP_DIR}/faldoc" )
-diff --git a/clt/falcon/editline/CMakeLists.txt b/clt/falcon/editline/CMakeLists.txt
-index 8b51862ad..933ef0a13 100644
---- a/clt/falcon/editline/CMakeLists.txt
-+++ b/clt/falcon/editline/CMakeLists.txt
-@@ -1,4 +1,4 @@
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- project(Editline)
- 
- find_package(Curses REQUIRED)
-@@ -23,4 +23,4 @@ configure_file(
-   ${CMAKE_CURRENT_SOURCE_DIR}/config.h.cmake
-   ${CMAKE_CURRENT_BINARY_DIR}/config.h
- )
--              
-\ No newline at end of file
-+              
-diff --git a/dist/nsis/CMakeLists.txt b/dist/nsis/CMakeLists.txt
-index c6e0110bb..996ce5436 100644
---- a/dist/nsis/CMakeLists.txt
-+++ b/dist/nsis/CMakeLists.txt
-@@ -1,7 +1,7 @@
- #
- # Configurator for NSIS installer
- #
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- 
- #
- # Files to be configured
-diff --git a/modules/native/MP/CMakeLists.txt b/modules/native/MP/CMakeLists.txt
-index 2b86107e0..f8eba5c40 100644
---- a/modules/native/MP/CMakeLists.txt
-+++ b/modules/native/MP/CMakeLists.txt
-@@ -5,7 +5,7 @@
- ####################################################################
- 
- PROJECT(MP)
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules)
- # Set here project-wide options
- # OPTION( WITH_OPT  "An poption" OFF)
-diff --git a/modules/native/conio/CMakeLists.txt b/modules/native/conio/CMakeLists.txt
-index 104c9bcec..d828d7e09 100644
---- a/modules/native/conio/CMakeLists.txt
-+++ b/modules/native/conio/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # CMake configuration file for @PROJECT_NAME@
- ####################################################################
- 
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- project(conio)
- 
- # find the falcon installation.  Set CMAKE_INSTALL_PREFIX to the falcon root 
-diff --git a/modules/native/curl/CMakeLists.txt b/modules/native/curl/CMakeLists.txt
-index 2f1e908e7..7d7a2377c 100644
---- a/modules/native/curl/CMakeLists.txt
-+++ b/modules/native/curl/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # CMake configuration file for curl
- ####################################################################
- 
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- project(Falcon_curl)
- list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
- 
-diff --git a/modules/native/dbi/CMakeLists.txt b/modules/native/dbi/CMakeLists.txt
-index 3a3f72c5f..20dbee902 100644
---- a/modules/native/dbi/CMakeLists.txt
-+++ b/modules/native/dbi/CMakeLists.txt
-@@ -3,7 +3,7 @@
- #
- # CMake configuration file for DBI
- ####################################################################
--cmake_minimum_required(VERSION 2.6.2)
-+cmake_minimum_required(VERSION 3.16.3)
- project(Falcon_DBI)
- 
- list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
-diff --git a/modules/native/dbus/CMakeLists.txt b/modules/native/dbus/CMakeLists.txt
-index 4bd76ce38..09f575fa7 100644
---- a/modules/native/dbus/CMakeLists.txt
-+++ b/modules/native/dbus/CMakeLists.txt
-@@ -5,7 +5,7 @@
- ####################################################################
- 
- PROJECT(dbus)
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- 
- INCLUDE( ${CMAKE_ROOT}/Modules/FindPkgConfig.cmake)
- 
-diff --git a/modules/native/dynlib/CMakeLists.txt b/modules/native/dynlib/CMakeLists.txt
-index 92bc09e59..6e1f31ec9 100644
---- a/modules/native/dynlib/CMakeLists.txt
-+++ b/modules/native/dynlib/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # CMake configuration file for dynlib
- ####################################################################
- 
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- project(Falcon_dynlib)
- 
- find_package(Falcon REQUIRED)
-diff --git a/modules/native/feathers/CMakeLists.txt b/modules/native/feathers/CMakeLists.txt
-index 7be6dca12..3591a4b9a 100644
---- a/modules/native/feathers/CMakeLists.txt
-+++ b/modules/native/feathers/CMakeLists.txt
-@@ -3,7 +3,7 @@
- #
- # CMake configuration file for Feather modules
- ####################################################################
--cmake_minimum_required(VERSION 2.6.2)
-+cmake_minimum_required(VERSION 3.16.3)
- PROJECT(Falcon_Feathers)
- 
- # Find our Find*.cmake files 
-diff --git a/modules/native/gd2/CMakeLists.txt b/modules/native/gd2/CMakeLists.txt
-index 7d775d1e7..73692d4fd 100644
---- a/modules/native/gd2/CMakeLists.txt
-+++ b/modules/native/gd2/CMakeLists.txt
-@@ -5,7 +5,7 @@
- ####################################################################
- 
- PROJECT(gd2)
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- MESSAGE(STATUS "Building GD2 module" )
- 
- 
-diff --git a/modules/native/gtk/CMakeLists.txt b/modules/native/gtk/CMakeLists.txt
-index 0f08e4bb3..f1bc647e9 100644
---- a/modules/native/gtk/CMakeLists.txt
-+++ b/modules/native/gtk/CMakeLists.txt
-@@ -3,7 +3,7 @@
- #
- project( gtk )
- 
--cmake_minimum_required( VERSION 2.6.3 )
-+cmake_minimum_required( VERSION 3.16.3 )
- 
- list( APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake )
- 
-diff --git a/modules/native/hpdf/CMakeLists.txt b/modules/native/hpdf/CMakeLists.txt
-index 679444146..cf86e9392 100644
---- a/modules/native/hpdf/CMakeLists.txt
-+++ b/modules/native/hpdf/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # CMake configuration file for Feather modules
- ####################################################################
- 
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- project(falcon-module-hpdf)
- 
- list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
-diff --git a/modules/native/sdl/CMakeLists.txt b/modules/native/sdl/CMakeLists.txt
-index 32a07dfd5..7d46ae513 100644
---- a/modules/native/sdl/CMakeLists.txt
-+++ b/modules/native/sdl/CMakeLists.txt
-@@ -6,7 +6,7 @@
- if(COMMAND cmake_policy)
-    cmake_policy(SET CMP0003 OLD)
- endif(COMMAND cmake_policy)
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- PROJECT(Falcon_SDL)
- 
- 
-diff --git a/modules/native/wopi/CMakeLists.txt b/modules/native/wopi/CMakeLists.txt
-index 3f711cd6d..56e6c539b 100644
---- a/modules/native/wopi/CMakeLists.txt
-+++ b/modules/native/wopi/CMakeLists.txt
-@@ -3,7 +3,7 @@
- # Falcon Web Oriented Programming Interface
- #
- 
--cmake_minimum_required(VERSION 2.6.2)
-+cmake_minimum_required(VERSION 3.16.3)
- project( falcon_wopi ) 
- 
- ######################################################################
-diff --git a/tests/native/dynlib/CMakeLists.txt b/tests/native/dynlib/CMakeLists.txt
-index 1781380d9..ed3f1e99f 100644
---- a/tests/native/dynlib/CMakeLists.txt
-+++ b/tests/native/dynlib/CMakeLists.txt
-@@ -3,7 +3,7 @@
- #
- # CMake configuration file for dynlib - TESTS
- ####################################################################
--cmake_minimum_required(VERSION 2.6)
-+cmake_minimum_required(VERSION 3.16.3)
- 
- include_directories(
-   ${CMAKE_CURRENT_SOURCE_DIR}

pkgs/by-name/fa/falcon/package.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  pcre,
-  zlib,
-  sqlite,
-}:
-
-stdenv.mkDerivation {
-  pname = "falcon";
-  version = "0-unstable-2023-11-19";
-
-  src = fetchFromGitHub {
-    owner = "falconpl";
-    repo = "falcon";
-    rev = "fc403c6e8c1f3d8c2a5a6ebce5db6f1b3e355808";
-    hash = "sha256-0yLhwDVFNbfiW23hNxrvItCCkyaOvEbFSg1ZQuJvhIs=";
-  };
-
-  patches = [
-    # https://github.com/falconpl/falcon/pull/11
-    ./bump-minimum-cmake-required-version.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-  buildInputs = [
-    pcre
-    zlib
-    sqlite
-  ];
-
-  meta = {
-    description = "Programming language with macros and syntax at once";
-    homepage = "https://github.com/falconpl/falcon";
-    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ pSub ];
-    platforms = with lib.platforms; unix;
-    broken = stdenv.cc.isClang;
-  };
-}

pkgs/by-name/fi/filebrowser-quantum/package.nix

@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.2.2-stable";
+  version = "1.3.3-stable";
 
   src = fetchFromGitHub {
     owner = "gtsteffaniak";
     repo = "filebrowser";
     tag = "v${version}";
-    hash = "sha256-MWFBoVr5WRfLhDUGEGS6ntb3v23HcOcm91x3fGriM2A=";
+    hash = "sha256-Q4TtC5x/nAbeZzICH9R9LBqe/8tbQOFR8vAImhQ5sYM=";
   };
 
   frontend = buildNpmPackage {
@@ -20,7 +20,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/frontend";
-    npmDepsHash = "sha256-brW5YR/DNBOCPBDMEjSzyk+YTbrP5ppdQ0US/DLbyIs=";
+    npmDepsHash = "sha256-+2CHRhu+cEmA0OvvU8ZKZ7Q5rTUX2KCSXFeVdievoYQ=";
 
     buildPhase = ''
       runHook preBuild
@@ -47,7 +47,7 @@ buildGoModule {
 
   sourceRoot = "${src.name}/backend";
 
-  vendorHash = "sha256-pU5qtWvhLbMdxzXK6uKxEkvbZdb2oa4ZHKaCPm0bIwU=";
+  vendorHash = "sha256-Fq5FqsZ4m5j+UIn1RsElhNUb4guwI9wo48SjQdvESRU=";
 
   preBuild = ''
     mkdir -p http/embed

pkgs/by-name/fl/flow/package.nix

@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "flow";
-  version = "0.317.0";
+  version = "0.318.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3r330N+bmtMhUszOoaRqVqbrno7tZatXMO6szvPKqAc=";
+    hash = "sha256-FlrQzfFYGDydlYR7AgC+sXBGQtMhDzazV1C5OxVbuuY=";
   };
 
   patches = [

pkgs/by-name/fl/fluent-bit/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VXf1F0TZFi8d7gil8yc3WWA/0X3QyYPnbA3luE1DE98=";
+    hash = "sha256-5X6qiwoRc7FTJSGjWYhhef9N8gaxrc9dwD8Z/8woIUo=";
   };
 
   # The source build documentation covers some dependencies and CMake options.

pkgs/by-name/fl/fluxcd-operator-mcp/package.nix

@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.50.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4FIsad3/57KtyTVQE0T4jhQGEvuEw9/ZFWsriLyc6Ok=";
+    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };
 
-  vendorHash = "sha256-DxXTepwTjgc+Xy3MAIFcYZ/XZZ3zGgyStmXN2/BqM74=";
+  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
 
   ldflags = [
     "-s"

pkgs/by-name/fl/fluxcd-operator/package.nix

@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.50.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4FIsad3/57KtyTVQE0T4jhQGEvuEw9/ZFWsriLyc6Ok=";
+    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };
 
-  vendorHash = "sha256-DxXTepwTjgc+Xy3MAIFcYZ/XZZ3zGgyStmXN2/BqM74=";
+  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
 
   ldflags = [
     "-s"

pkgs/by-name/fl/fluxcd/package.nix

@@ -85,7 +85,6 @@ buildGoModule rec {
       ryan4yin
       SchahinRohani
       stealthybox
-      superherointj
     ];
     mainProgram = "flux";
   };

pkgs/by-name/fl/fly/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fly";
-  version = "8.2.3";
+  version = "8.2.4";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mg95mi2pose/vqLPeekv2lfS7rLtuyn+k9yeqbzlwm0=";
+    hash = "sha256-iY0oPeP3D6/nsPDdGE3lvjFlhH/z9QQ5gHpjpamdl5M=";
   };
 
   vendorHash = "sha256-ZNhGt+nyl7zmQIHT+5f/c2hixyZ8kLmCWO5qa7CAGuY=";

pkgs/by-name/fr/freerdp/package.nix

@@ -39,6 +39,8 @@
   orc,
   cairo,
   cjson,
+  libcbor,
+  libfido2,
   libusb1,
   libpulseaudio,
   cups,
@@ -70,13 +72,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.26.0";
+  version = "3.27.1";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     tag = finalAttrs.version;
-    hash = "sha256-7yUqZXuUn3OFhlWrZyXmmh/aGOp0uRJ7XxaLl1fVnVQ=";
+    hash = "sha256-4U3QC1hka+qTQ0F7GqKPiMVwkkFeJvbjNtom5A7V/Sg=";
   };
 
   postPatch = ''
@@ -117,6 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
     ffmpeg
     glib
     icu
+    libcbor
+    libfido2
     libx11
     libxcursor
     libxdamage
@@ -173,6 +177,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.mapAttrsToList lib.cmakeBool (
     {
       BUILD_TESTING = false; # false is recommended by upstream
+      CHANNEL_RDPEWA = true;
+      CHANNEL_RDPEWA_CLIENT = true;
       WITH_CAIRO = cairo != null;
       WITH_CUPS = cups != null;
       WITH_FAAC = withUnfree && faac != null;
@@ -230,7 +236,10 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/FreeRDP/FreeRDP/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://www.freerdp.com/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ deimelias ];
+    maintainers = with lib.maintainers; [
+      cizra
+      deimelias
+    ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/fz/fzf-preview/package.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   version = "0-unstable-2026-02-22";
 
   src = fetchFromGitHub {
-    owner = "niksingh710";
+    owner = "semi710";
     repo = "fzf-preview";
     rev = "5e5a5a5c4258fa86300cb56224e31416ff7401b5";
     hash = "sha256-ZjBoTsZ2ymfhmUbMpMWT1MB20kLf0BILnCDu75F6WEQ=";
@@ -79,10 +79,10 @@ stdenv.mkDerivation {
       be simple, fast, and highly compatible, making it a useful tool for anyone
       leveraging fzf for file navigation or search.
     '';
-    homepage = "https://github.com/niksingh710/fzf-preview";
+    homepage = "https://github.com/semi710/fzf-preview";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
-      niksingh710
+      semi710
     ];
     mainProgram = "fzf-preview";
     platforms = lib.platforms.unix;

pkgs/by-name/gf/gf/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation {
   pname = "gf";
-  version = "0-unstable-2026-05-03";
+  version = "0-unstable-2026-06-16";
 
   src = fetchFromGitHub {
     repo = "gf";
     owner = "nakst";
-    rev = "46174e9b25850c9898ca0c2de90af31ad83122d7";
-    hash = "sha256-UnMpV9RCDsJEDBj4/gypzYFhR4IqEVKYKLpvrLlTGaA=";
+    rev = "1c04ed95d45d49fb4b06cbc620c61acd58818977";
+    hash = "sha256-42uB2HVJaEXgjA+/iUrML6biUOqj9b7mCQfSrj/nKvw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gh/ghostunnel/package.nix

@@ -1,5 +1,4 @@
 {
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   lib,
@@ -9,16 +8,21 @@
 
 buildGoModule rec {
   pname = "ghostunnel";
-  version = "1.8.4";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
     rev = "v${version}";
-    hash = "sha256-NnRm1HEdfK6WI5ntilLSwdR2B5czG5CIcMFzl2TzEds=";
+    hash = "sha256-BntQCauAgnaiNn31nrVEsHFvQv7zK6D0z/rInbCVTr0=";
   };
 
-  vendorHash = "sha256-vP8OtjpYNMm1KkNfD3pmNrHh3HRy1GkzUbfLKWKhHbo=";
+  patches = [
+    # upstream left an untidied go.mod/go.sum in v1.10.0
+    ./pkg-errors.patch
+  ];
+
+  vendorHash = "sha256-pd7fTP0BAgpd4mD8ZG8Ak9fFF2sC0JGCDbPG8tAnWvw=";
 
   deleteVendor = true;
 

pkgs/by-name/gh/ghostunnel/pkg-errors.patch

@@ -0,0 +1,26 @@
+diff --git a/go.mod b/go.mod
+index d06c2e9117..f560c1cc69 100644
+--- a/go.mod
++++ b/go.mod
+@@ -192,6 +192,7 @@
+ 	github.com/nwaples/rardecode v1.1.3 // indirect
+ 	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
+ 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
++	github.com/pkg/errors v0.9.1 // indirect
+ 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+ 	github.com/prometheus/client_model v0.6.2 // indirect
+ 	github.com/prometheus/common v0.67.5 // indirect
+diff --git a/go.sum b/go.sum
+index 4dea0025f3..1edce71302 100644
+--- a/go.sum
++++ b/go.sum
+@@ -460,6 +460,9 @@
+ github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+ github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
+ github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
++github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
++github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
++github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

pkgs/by-name/gi/gitea-actions-runner/package.nix

@@ -44,9 +44,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://gitea.com/gitea/runner";
     license = lib.licenses.mit;
     mainProgram = "gitea-runner";
-    maintainers = with lib.maintainers; [
-      superherointj
-      techknowlogick
-    ];
+    maintainers = with lib.maintainers; [ techknowlogick ];
   };
 })

pkgs/by-name/gi/gitte/package.nix

@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitte";
-  version = "0.7.0";
+  version = "0.7.1";
 
   __structuredAttrs = true;
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ckruse";
     repo = "Gitte";
     tag = finalAttrs.version;
-    hash = "sha256-oZJmjpPAiMNlHJBdTLXmT7FOf9dCITPuazEU7GtWmM8=";
+    hash = "sha256-R2Y/nmj509yo0ueh0nMxUsoqdJBaGUdSHj69QHZBVTQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PZ1Q1GREBiZHQyEe/NrKFJ16ynuuPA/hXUhsP3r6WMg=";
+    hash = "sha256-QTnstnFJYlasY9JSXT+OMjxWYawQbNpQzI0FDpLWknM=";
   };
 
   strictDeps = true;

pkgs/by-name/go/godot-mcp/package.nix

@@ -38,7 +38,7 @@ buildNpmPackage {
     mainProgram = "godot-mcp";
     homepage = "https://github.com/Coding-Solo/godot-mcp";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ superherointj ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }

pkgs/by-name/go/goldendict-ng/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "26.5.7";
+  version = "26.6.0";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oTx0gEnyKg23E8fl+t1Cbi6jRoOYQGevaHGrJHSBA7s=";
+    hash = "sha256-gV1nDKKRCN8p+B9dZ28uzzvYEbKDB58h+fMyQ44nOXU=";
   };
 
   strictDeps = true;

pkgs/by-name/go/goshs/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pS/Dx3C2c8Rpr2ugcxrElFice6Eildt28zdIfrL/5yk=";
+    hash = "sha256-BbkAt+pL3M/LBugaUgIV26ziUsMnWe+fOHKpmddE2Ng=";
   };
 
-  vendorHash = "sha256-nVg+ALvvZYG+9JFiNGaT/EQO8IdZK3EO8UQoAp29KNQ=";
+  vendorHash = "sha256-CAl4yYAM/GQaLbUUNjgMN6A3Vqw4D+kpG9G2WXw6mRU=";
 
   ldflags = [ "-s" ];
 

pkgs/by-name/gr/gradle-completion/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gradle-completion";
-  version = "9.4.1";
+  version = "9.5.0";
 
   src = fetchFromGitHub {
     owner = "gradle";
     repo = "gradle-completion";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bqbi0Mg+MahS4ICmfC6kuEWVJ6t6GUdHB6Y5ATtbJ8c=";
+    hash = "sha256-8UwIrMfomyyIgw5MCfrpqtX0KHrn5ELU8eG0mWCX28o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/graphite/package.nix

@@ -30,12 +30,12 @@
 }:
 
 let
-  version = "0-unstable-2026-06-06";
-  rev = "2c29d2c40614a0ea51b8be113daba2f7f54c4209";
+  version = "0-unstable-2026-06-15";
+  rev = "34e0fd77574c30749d00d775df87a7e9362e7ce8";
 
-  srcHash = "sha256-0arLP1xUAZRUezNkTvxuVLn470Zl7EKlGecdBb5xw0Q=";
+  srcHash = "sha256-SyxteWavvyeRtKcGuJkOxojstJk1C2ndbNERuSM3Cng=";
   shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
-  cargoHash = "sha256-LAb279Acwl57aY5ijJ70c9rRMrBLGpGJ7Q5gVnEcRT0=";
+  cargoHash = "sha256-KktJj1c/OrJazNk40NND8irmNd30nzpZOxdwaTAqjIs=";
   npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig=";
 
   brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";

pkgs/by-name/gr/gridtracker2/package.nix

@@ -11,16 +11,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "gridtracker2";
-  version = "2.260323.0";
+  version = "2.260609.0";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3DUbKG7bMR2VpJPPsLNRLzYaStv5iTanECAT6DHMExo=";
+    hash = "sha256-QlL8q5TaUizACr4uRbFZtl8hy/Eyq7d4v56ca3ckj4o=";
   };
 
-  npmDepsHash = "sha256-dJmrNP2AwIaQaCq0guG+OTogfcL8f97MAp6N7HAw5z8=";
+  npmDepsHash = "sha256-5h3bswjVf/8JHhwHRFTUfydN7XXtWbxNHTZ0mLL7RT8=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/hm/hmcl/package.nix

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.14.1";
+  version = "3.15.1";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-j8+PIbNySlwELKKdsYQe53++w9zunKaN9TRqZq+LpYI=";
+    hash = "sha256-Uv6w3XEySoqsKCmZVmiDkGfmeretHfvpwFmYMJz0mv4=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for

pkgs/by-name/ho/holo-cli/libyang4-sys.patch

@@ -0,0 +1,12 @@
+--- a/build.rs
++++ b/build.rs
+@@ -62,6 +62,9 @@
+         cmake_config.define("ENABLE_BUILD_TESTS", "OFF");
+         cmake_config.define("CMAKE_BUILD_TYPE", "Release");
+         cmake_config.define("CMAKE_POSITION_INDEPENDENT_CODE", "ON");
++        // https://github.com/CESNET/libyang/blob/3d07c3a71534a580c3960907da17568eff7e5c64/CMakeModules/FindPCRE2.cmake#L9
++        cmake_config.define("PCRE2_INCLUDE_DIRS", "@PCRE2_INCLUDE_DIRS@");
++        cmake_config.define("PCRE2_LIBRARIES", "@PCRE2_LIBRARIES@");
+         let cmake_dst = cmake_config.build();
+         println!("cargo:root={}", env::var("OUT_DIR").unwrap());
+         println!("cargo:rustc-link-search=native={}/lib", cmake_dst.display());

pkgs/by-name/ho/holo-cli/package.nix

@@ -2,26 +2,48 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+
+  stdenv,
+  replaceVars,
+
   cmake,
   pkg-config,
   protobuf,
+
   pcre2,
+
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-cli";
-  version = "0.5.0-unstable-2025-09-22";
+  version = "0.5.0-unstable-2026-03-15";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo-cli";
-    rev = "7d99e7de5eb5226728ee57153c03362c90eb65b2";
-    hash = "sha256-O509LNSpak+MJPQheYLPtJQcNGPyZLMHMasKScoVnls=";
+    rev = "36fdc13323e384c086da8663f0d510b238fb6e4f";
+    hash = "sha256-5Nvyh9gznMsutu3wHR6gwgKkIm115hbx4R6D/Gm1Rug=";
   };
 
-  cargoHash = "sha256-bsoxWjOMzRRtFGEaaqK0/adhGpDcejCIY0Pzw1HjQ5U=";
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  cargoPatches = [
+    # cargo lock is outdated
+    # https://github.com/holo-routing/holo-cli/pull/31
+    ./update-cargo-lock.patch
+  ];
+
+  cargoHash = "sha256-77aUfXcnVQLVEKQuUdBZ4k5/3rOoe9PvGC0AlJS0UJc=";
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    pushd $cargoDepsCopy/*/libyang4-sys-*
+    patch -p1 < ${
+      replaceVars ./libyang4-sys.patch {
+        PCRE2_INCLUDE_DIRS = "${lib.getInclude pcre2}/include";
+        PCRE2_LIBRARIES = "${lib.getLib pcre2}/lib/libpcre2-8${stdenv.hostPlatform.extensions.sharedLibrary}";
+      }
+    }
+    popd
+  '';
 
   # Use rust nightly features
   env.RUSTC_BOOTSTRAP = 1;
@@ -31,17 +53,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pkg-config
     protobuf
   ];
+
   buildInputs = [
     pcre2
   ];
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     description = "Holo` Command Line Interface";
     homepage = "https://github.com/holo-routing/holo-cli";
-    teams = with lib.teams; [ ngi ];
-    maintainers = with lib.maintainers; [ themadbit ];
     license = lib.licenses.mit;
     mainProgram = "holo-cli";
+    maintainers = with lib.maintainers; [ themadbit ];
     platforms = lib.platforms.all;
+    teams = with lib.teams; [ ngi ];
   };
 })

pkgs/by-name/ho/holo-cli/update-cargo-lock.patch

@@ -0,0 +1,96 @@
+From 8e282c056f7d3cc00c1f1b544659f94c150e72e9 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sat, 28 Mar 2026 22:01:41 +0530
+Subject: [PATCH] update cargo lock file
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ Cargo.lock | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index a7279b9b9a339056b625a217a642c50e2fb97780..b1f8b251d1e0d9c3cdfa4f769b690a75c7404624 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,12 +26,6 @@ dependencies = [
+  "memchr",
+ ]
+ 
+-[[package]]
+-name = "android-tzdata"
+-version = "0.1.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+-
+ [[package]]
+ name = "android_system_properties"
+ version = "0.1.5"
+@@ -224,15 +218,16 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+ 
+ [[package]]
+ name = "chrono"
+-version = "0.4.40"
++version = "0.4.44"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
++checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+ dependencies = [
+- "android-tzdata",
+  "iana-time-zone",
++ "js-sys",
+  "num-traits",
+  "serde",
+- "windows-link",
++ "wasm-bindgen",
++ "windows-link 0.2.1",
+ ]
+ 
+ [[package]]
+@@ -537,6 +532,7 @@ checksum = "fbd780fe5cc30f81464441920d82ac8740e2e46b29a6fad543ddd075229ce37e"
+ name = "holo-cli"
+ version = "0.5.0"
+ dependencies = [
++ "chrono",
+  "clap",
+  "derive-new",
+  "enum-as-inner",
+@@ -1877,7 +1873,7 @@ checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+ dependencies = [
+  "windows-implement",
+  "windows-interface",
+- "windows-link",
++ "windows-link 0.1.1",
+  "windows-result",
+  "windows-strings",
+ ]
+@@ -1910,13 +1906,19 @@ version = "0.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+ 
++[[package]]
++name = "windows-link"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
++
+ [[package]]
+ name = "windows-result"
+ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
+ dependencies = [
+- "windows-link",
++ "windows-link 0.1.1",
+ ]
+ 
+ [[package]]
+@@ -1925,7 +1927,7 @@ version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+ dependencies = [
+- "windows-link",
++ "windows-link 0.1.1",
+ ]
+ 
+ [[package]]
+

pkgs/by-name/ho/holo-daemon/package.nix

@@ -6,6 +6,7 @@
   pkg-config,
   protobuf,
   pcre2,
+  pkgs,
   nix-update-script,
 }:
 
@@ -20,8 +21,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-zZrse46NJb8gD4BtM20FfdtRdxVNLZ+/51dy2nuiOd8=";
   };
 
-  passthru.updateScript = nix-update-script { };
-
   cargoHash = "sha256-cHJzwI7FDVA1iwqg+x9sMlao22SGQoOuq+MB0XtYsEc=";
 
   # Use rust nightly features
@@ -36,6 +35,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pcre2
   ];
 
+  passthru = {
+    updateScript = nix-update-script { };
+    services.default = {
+      imports = [
+        (lib.modules.importApply ./service.nix {
+          inherit pkgs;
+        })
+      ];
+      holo-daemon.package = lib.mkDefault finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "`holo` daemon that provides the routing protocols, tools and policies";
     homepage = "https://github.com/holo-routing/holo";

pkgs/by-name/ho/holo-daemon/service.nix

@@ -0,0 +1,133 @@
+# Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkPackageOption
+    mkOption
+    types
+    ;
+  cfg = config.holo-daemon;
+  format = pkgs.formats.toml { };
+  configFile = format.generate "holod.toml" cfg.settings;
+in
+{
+  _class = "service";
+
+  options.holo-daemon = {
+    package = mkPackageOption pkgs "holo-daemon" { };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          user = mkOption {
+            type = types.str;
+            description = "User for the holo daemon";
+            default = "holo";
+          };
+          group = mkOption {
+            type = types.str;
+            description = "Group for the holo daemon";
+            default = "holo";
+          };
+          # Needs to be writable by @user or @group
+          database_path = mkOption {
+            type = types.str;
+            description = "Path to the holo database";
+            default = "/var/run/holod/holod.db";
+          };
+          logging = mkOption {
+            type = types.submodule {
+              freeformType = format.type;
+              options = {
+                journald = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable journald logging";
+                        default = true;
+                      };
+                    };
+                  };
+                  description = "Journald logging configuration";
+                  default = { };
+                };
+                file = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable file logging";
+                        default = true;
+                      };
+                      dir = mkOption {
+                        type = types.str;
+                        description = "Directory for log files";
+                        default = "/var/log/";
+                      };
+                      name = mkOption {
+                        type = types.str;
+                        description = "Name of the log file";
+                        default = "holod.log";
+                      };
+                    };
+                  };
+                  description = "File logging configuration";
+                  default = { };
+                };
+              };
+            };
+            description = "Logging configuration for the holo daemon";
+            default = { };
+          };
+          plugins = mkOption {
+            type = types.submodule {
+              freeformType = format.type;
+              options = {
+                grpc = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable gRPC plugin";
+                        default = true;
+                      };
+                      address = mkOption {
+                        type = types.str;
+                        description = "gRPC server listening address";
+                        default = "[::]:50051";
+                      };
+                    };
+                  };
+                  description = "gRPC plugin configuration";
+                  default = { };
+                };
+              };
+            };
+            description = "Plugin configuration for the holo daemon";
+            default = { };
+          };
+        };
+      };
+      description = "Configuration for the holo daemon";
+      default = { };
+    };
+  };
+
+  config = {
+    process.argv = [
+      "${cfg.package}/bin/holod"
+      "-c"
+      configFile
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ themadbit ];
+}