Merge 73259bfa6e into haskell-updates

doc/release-notes/rl-2605.section.md

@@ -120,6 +120,11 @@
 
 - Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.
 
+- Keycloak has been updated to 26.6.X, bringing a lot new features like federated client authentication, JWT authorization grants, workflows and the ability to do
+  zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)
+  and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out wether this is a breaking
+  change for your keycloak instance.
+
 - `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.
 
 - `forgejo` has been updated to major version 14. For more information, see the [release blog post](https://forgejo.org/2026-01-release-v14-0/) and [full release notes](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/14.0.0.md)

lib/strings.nix

@@ -337,7 +337,6 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
-    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -361,7 +360,7 @@ rec {
 
     :::
   */
-  concatLines = concatMapStrings (s: s + "\n");
+  concatLines = str: concatStringsSep "\n" str + "\n";
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.

maintainers/maintainer-list.nix

@@ -11408,6 +11408,11 @@
     githubId = 39416660;
     name = "Mladen Branković";
   };
+  imcvampire = {
+    github = "imcvampire";
+    githubId = 9426721;
+    name = "Quoc-Anh Nguyen";
+  };
   imgabe = {
     email = "gabrielpmonte@hotmail.com";
     github = "ImGabe";
@@ -14971,6 +14976,12 @@
     githubId = 61395246;
     name = "Lampros Pitsillos";
   };
+  landreussi = {
+    email = "lucasandreussi@gmail.com";
+    github = "landreussi";
+    githubId = 5938518;
+    name = "Lucas Andreussi";
+  };
   langsjo = {
     name = "langsjo";
     github = "langsjo";
@@ -24538,6 +24549,12 @@
     githubId = 77039267;
     name = "Vito Secona";
   };
+  sectore = {
+    email = "sectore@gmail.com";
+    github = "sectore";
+    githubId = 47693;
+    name = "Jens Krause";
+  };
   sedlund = {
     email = "scott+nixpkgs@teraton.com";
     github = "sedlund";
@@ -29660,6 +29677,13 @@
     githubId = 117323435;
     name = "Andrés Pico";
   };
+  xeni = {
+    name = "xeni";
+    github = "Gernomaly";
+    githubId = 71495036;
+    email = "xeni@koeln.ccc.de";
+    matrix = "@xeni:koeln.ccc.de";
+  };
   xfnw = {
     email = "xfnw+nixos@riseup.net";
     github = "xfnw";

maintainers/team-list.nix

@@ -299,6 +299,7 @@ with lib.maintainers;
     ];
     scope = "Maintain GCC (GNU Compiler Collection) compilers";
     shortName = "GCC";
+    enableFeatureFreezePing = true;
   };
 
   geospatial = {

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -102,6 +102,8 @@
 
 - [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
 
+- [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).
+
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
 
 - [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
@@ -313,6 +315,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).
 
+- The `services.prometheus.exporters` module interface now accepts an optional `socketOpts` attribute, allowing individual exporter modules to describe an accompanying `systemd.sockets.prometheus-${name}-exporter` unit alongside their service, enabling socket activation support.
+
 - Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
 
 - `security.acme` now defaults to a dynamic renewal duration, if

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -66,7 +66,7 @@ in
         "qcow2"
         "vpc"
       ];
-      default = "vpc";
+      default = "raw";
       description = "The image format to output";
     };
   };

nixos/modules/image/repart-verity-store.nix

@@ -89,6 +89,12 @@ in
       };
     };
 
+    fileSystems."/nix/store" = lib.mkDefault {
+      device = "/usr/nix/store";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
     image.repart.partitions = {
       # dm-verity hash partition
       ${cfg.partitionIds.store-verity}.repartConfig = {
@@ -96,6 +102,7 @@ in
         Verity = "hash";
         VerityMatchKey = lib.mkDefault verityMatchKey;
         Label = lib.mkDefault "store-verity";
+        Minimize = lib.mkDefault "best";
       };
       # dm-verity data partition that contains the nix store
       ${cfg.partitionIds.store} = {
@@ -106,23 +113,29 @@ in
           Format = lib.mkDefault "erofs";
           VerityMatchKey = lib.mkDefault verityMatchKey;
           Label = lib.mkDefault "store";
+          Minimize = lib.mkDefault "best";
         };
       };
 
     };
 
     system.build = {
+      finalImage = lib.warn "system.build.finalImage has been renamed to system.build.image" config.system.build.image;
 
       # intermediate system image without ESP
       intermediateImage =
-        (config.system.build.image.override {
+        (config.image.repart.image.override {
           # always disable compression for the intermediate image
           compression.enable = false;
         }).overrideAttrs
           (
             _: previousAttrs: {
               # make it easier to identify the intermediate image in build logs
-              pname = "${previousAttrs.pname}-intermediate";
+              name =
+                if previousAttrs ? pname then
+                  "${previousAttrs.pname}-${previousAttrs.version}-intermediate"
+                else
+                  "${previousAttrs.name}-intermediate";
 
               # do not prepare the ESP, this is done in the final image
               systemdRepartFlags = previousAttrs.systemdRepartFlags ++ [ "--defer-partitions=esp" ];
@@ -162,8 +175,8 @@ in
         );
 
       # final system image that is created from the intermediate image by injecting the UKI from above
-      finalImage =
-        (config.system.build.image.override {
+      image = lib.mkOverride 99 (
+        (config.image.repart.image.override {
           # continue building with existing intermediate image
           createEmpty = false;
         }).overrideAttrs
@@ -216,7 +229,8 @@ in
                 rm -v repart-output_orig.json
               '';
             }
-          );
+          )
+      );
     };
   };
 

nixos/modules/image/repart.nix

@@ -282,6 +282,15 @@ in
       '';
     };
 
+    image = lib.mkOption {
+      type = lib.types.package;
+      internal = true;
+      readOnly = true;
+      description = ''
+        The image built by this module. Used as the default for `system.build.image`.
+      '';
+    };
+
     assertions = lib.mkOption {
       type = options.assertions.type;
       default = [ ];
@@ -356,6 +365,37 @@ in
 
         finalPartitions = lib.mapAttrs addClosure cfg.partitions;
 
+        image =
+          let
+            fileSystems = lib.filter (f: f != null) (
+              lib.mapAttrsToList (_n: v: v.repartConfig.Format or null) cfg.partitions
+            );
+
+            format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
+
+            definitionsDirectory = utils.systemdUtils.lib.definitions "repart.d" format (
+              lib.mapAttrs (_n: v: { Partition = v.repartConfig; }) cfg.finalPartitions
+            );
+
+            mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
+            val = pkgs.callPackage ./repart-image.nix {
+              systemd = cfg.package;
+              inherit (config.image) baseName;
+              inherit (cfg)
+                name
+                version
+                compression
+                split
+                seed
+                imageSize
+                sectorSize
+                finalPartitions
+                ;
+              inherit fileSystems definitionsDirectory mkfsEnv;
+            };
+          in
+          lib.asserts.checkAssertWarn cfg.assertions cfg.warnings val;
+
         assertions = lib.mapAttrsToList (
           fileName: partitionConfig:
           let
@@ -401,36 +441,7 @@ in
         );
       };
 
-    system.build.image =
-      let
-        fileSystems = lib.filter (f: f != null) (
-          lib.mapAttrsToList (_n: v: v.repartConfig.Format or null) cfg.partitions
-        );
-
-        format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
-
-        definitionsDirectory = utils.systemdUtils.lib.definitions "repart.d" format (
-          lib.mapAttrs (_n: v: { Partition = v.repartConfig; }) cfg.finalPartitions
-        );
-
-        mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
-        val = pkgs.callPackage ./repart-image.nix {
-          systemd = cfg.package;
-          inherit (config.image) baseName;
-          inherit (cfg)
-            name
-            version
-            compression
-            split
-            seed
-            imageSize
-            sectorSize
-            finalPartitions
-            ;
-          inherit fileSystems definitionsDirectory mkfsEnv;
-        };
-      in
-      lib.asserts.checkAssertWarn cfg.assertions cfg.warnings val;
+    system.build.image = cfg.image;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/module-list.nix

@@ -1779,6 +1779,7 @@
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
+  ./services/web-apps/strichliste.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix

nixos/modules/services/databases/mysql.nix

@@ -9,9 +9,6 @@ let
   cfg = config.services.mysql;
 
   isMariaDB = lib.getName cfg.package == lib.getName pkgs.mariadb;
-  isOracle = lib.getName cfg.package == lib.getName pkgs.mysql84;
-  # Oracle MySQL has supported "notify" service type since 8.0
-  hasNotify = isMariaDB || (isOracle && lib.versionAtLeast cfg.package.version "8.0");
 
   mysqldOptions = "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
 
@@ -576,15 +573,6 @@ in
           superUser = if isMariaDB then cfg.user else "root";
         in
         ''
-          ${lib.optionalString (!hasNotify) ''
-            # Wait until the MySQL server is available for use
-            while [ ! -e /run/mysqld/mysqld.sock ]
-            do
-                echo "MySQL daemon not yet started. Waiting for 1 second..."
-                sleep 1
-            done
-          ''}
-
           ${lib.optionalString isMariaDB ''
             # If MariaDB is used in an Galera cluster, we have to check if the sync is done,
             # or it will fail to init the database while joining, so we get in an broken non recoverable state
@@ -689,7 +677,7 @@ in
 
       serviceConfig = lib.mkMerge [
         {
-          Type = if hasNotify then "notify" else "simple";
+          Type = "notify";
           Restart = "on-abnormal";
           RestartSec = "5s";
 

nixos/modules/services/hardware/rasdaemon.nix

@@ -10,6 +10,10 @@ let
 
 in
 {
+  meta = {
+    inherit (pkgs.rasdaemon.meta) maintainers;
+  };
+
   options.hardware.rasdaemon = {
 
     enable = lib.mkEnableOption "RAS logging daemon";

nixos/modules/services/monitoring/prometheus/exporters.md

@@ -138,12 +138,23 @@ example:
           DynamicUser = false;
           ExecStart = ''
             ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
-              --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+              --web.systemd-socket \
               --web.telemetry-path ${cfg.telemetryPath} \
               ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
           '';
         };
       };
+
+      # `socketOpts` is an optional attribute set describing a
+      # `systemd.sockets.prometheus-${name}-exporter` unit that
+      # accompanies the exporter's service. When set, it is merged
+      # with a default definition that includes
+      # `wantedBy = [ "sockets.target" ]`, enabling socket activation
+      # for exporters that support it.
+      # Note that this attribute is optional.
+      socketOpts = {
+        socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+      };
     }
     ```
   - This should already be enough for the postfix exporter. Additionally one

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -36,10 +36,15 @@ let
   #   - extraOpts   (types.attrs): extra configuration options to
   #                                configure the exporter with, which
   #                                are appended to the default options
+  #   - socketOpts  (types.attrs): optional config that is merged with
+  #                                the default definition of the
+  #                                exporter's systemd socket unit. When
+  #                                set, a `prometheus-${name}-exporter.socket`
+  #                                unit is created, enabling socket activation.
   #
-  #  Note that `extraOpts` is optional, but a script for the exporter's
-  #  systemd service must be provided by specifying either
-  #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
+  #  Note that `extraOpts` and `socketOpts` are optional, but a script
+  #  for the exporter's systemd service must be provided by specifying
+  #  either `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
 
   exporterOpts =
     (genAttrs
@@ -311,6 +316,7 @@ let
       name,
       conf,
       serviceOpts,
+      socketOpts,
     }:
     let
       enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
@@ -368,6 +374,12 @@ let
         "-m comment --comment ${name}-exporter -j nixos-fw-accept"
       ]);
       networking.firewall.extraInputRules = mkIf (conf.openFirewall && nftables) conf.firewallRules;
+      systemd.sockets."prometheus-${name}-exporter" = mkIf (socketOpts != null) (mkMerge [
+        {
+          wantedBy = [ "sockets.target" ];
+        }
+        socketOpts
+      ]);
       systemd.services."prometheus-${name}-exporter" = mkMerge [
         {
           wantedBy = [ "multi-user.target" ];
@@ -603,6 +615,7 @@ in
       mkExporterConf {
         inherit name;
         inherit (conf) serviceOpts;
+        socketOpts = conf.socketOpts or null;
         conf = cfg.${name};
       }
     ) exporterOpts)

nixos/modules/services/monitoring/prometheus/exporters/node.nix

@@ -39,6 +39,7 @@ in
       '';
     };
   };
+
   serviceOpts = {
     serviceConfig = {
       DynamicUser = false;
@@ -47,7 +48,7 @@ in
         ${pkgs.prometheus-node-exporter}/bin/node_exporter \
           ${concatMapStringsSep " " (x: "--collector." + x) cfg.enabledCollectors} \
           ${concatMapStringsSep " " (x: "--no-collector." + x) cfg.disabledCollectors} \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " " cfg.extraFlags}
+          --web.systemd-socket ${concatStringsSep " " cfg.extraFlags}
       '';
       RestrictAddressFamilies =
         optionals (collectorIsEnabled "logind" || collectorIsEnabled "systemd") [
@@ -67,4 +68,8 @@ in
       ProtectHome = true;
     };
   };
+
+  socketOpts = {
+    socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+  };
 }

nixos/modules/services/monitoring/prometheus/exporters/postfix.nix

@@ -85,6 +85,7 @@ in
       };
     };
   };
+
   serviceOpts = {
     after = mkIf cfg.systemd.enable [ cfg.systemd.unit ];
     serviceConfig = {
@@ -95,7 +96,7 @@ in
       SupplementaryGroups = mkIf cfg.systemd.enable [ "systemd-journal" ];
       ExecStart = ''
         ${lib.getExe cfg.package} \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          --web.systemd-socket \
           --web.telemetry-path ${cfg.telemetryPath} \
           --postfix.showq_path ${escapeShellArg cfg.showqPath} \
           ${concatStringsSep " \\\n  " (
@@ -115,4 +116,8 @@ in
       '';
     };
   };
+
+  socketOpts = {
+    socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+  };
 }

nixos/modules/services/web-apps/strichliste.nix

@@ -0,0 +1,521 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkForce
+    mkIf
+    mkMerge
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.strichliste;
+
+  format = pkgs.formats.yaml { };
+  settingsFile = format.generate "strichliste.yaml" {
+    parameters.strichliste = cfg.settings;
+  };
+
+  unitDependencies =
+    lib.optionals (
+      lib.hasInfix "pgpsql" cfg.environment.DATABASE_URL
+      || lib.hasInfix "postgres" cfg.environment.DATABASE_URL
+    ) [ "postgresql.service" ]
+    ++ lib.optionals (lib.hasInfix "mysql" cfg.environment.DATABASE_URL) [ "mysql.service" ];
+in
+{
+  meta.buildDocsInSandbox = false;
+
+  options.services.strichliste = {
+    enable = mkEnableOption "strichliste, a web based tally sheet.";
+
+    packages = {
+      backend = mkPackageOption pkgs "strichliste" { };
+      frontend = mkOption {
+        type = types.package;
+        default = pkgs.strichliste.frontend;
+        description = ''
+          The strichliste-frontend package to use.
+        '';
+      };
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          common = {
+            idleTimeout = mkOption {
+              type = types.int;
+              default = 30000;
+              description = ''
+                Time until the app returns to the start page.
+              '';
+            };
+          };
+
+          user = {
+            stalePeriod = mkOption {
+              type = types.str;
+              default = "10 day";
+              example = "1 week";
+              description = ''
+                Duration after which users are listed as inactive.
+
+                The format used is documented in <https://www.php.net/manual/en/dateinterval.createfromdatestring.php>.
+
+                ::: {.tip}
+                This helps unclutter the user listing by prioritizing active users.
+                :::
+              '';
+            };
+          };
+
+          i18n = {
+            timezone = mkOption {
+              type = types.str;
+              default = config.time.timeZone;
+              defaultText = lib.literalExpression "config.time.timeZone";
+              example = "Europe/Berlin";
+              description = ''
+                Timezone used throughout the app, e.g. in the transaction log.
+              '';
+            };
+
+            language = mkOption {
+              type = types.str;
+              default = "en";
+              example = "de";
+              description = ''
+                Language used throughout the app.
+              '';
+            };
+
+            currency = {
+              name = mkOption {
+                type = types.str;
+                example = "Euro";
+                description = ''
+                  Name of the currency.
+                '';
+              };
+
+              symbol = mkOption {
+                type = types.str;
+                example = "€";
+                description = ''
+                  Symbol for the currency.
+                '';
+              };
+
+              alpha3 = mkOption {
+                type = types.str;
+                example = "EUR";
+                description = ''
+                  [ISO 4217] alpha code representing the currency.
+
+                  [ISO 4217]: https://en.wikipedia.org/wiki/ISO_4217#List_of_ISO_4217_currency_codes
+                '';
+              };
+            };
+          };
+
+          account = {
+            lower = mkOption {
+              type = types.int;
+              default = -200000;
+              example = 0;
+              description = ''
+                The credit limit for user accounts.
+              '';
+            };
+
+            upper = mkOption {
+              type = types.ints.positive;
+              default = 200000;
+              description = ''
+                The maximum balance on a user account.
+              '';
+            };
+          };
+
+          payment = {
+            boundary = {
+              lower = mkOption {
+                type = types.int;
+                default = -2000;
+                example = 0;
+                description = ''
+                  The lowest amount that can be used for payments.
+                '';
+              };
+
+              upper = mkOption {
+                type = types.ints.positive;
+                default = 15000;
+                description = ''
+                  The highest amount that can be used for payment.
+                '';
+              };
+            };
+
+            deposit = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow money deposits.
+                '';
+              };
+
+              custom = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow custom amounts for deposits.
+                '';
+              };
+
+              steps = mkOption {
+                type = types.listOf (
+                  types.oneOf [
+                    types.int
+                    types.float
+                  ]
+                );
+                example = [
+                  0.5
+                  1
+                  2
+                  5
+                  10
+                  20
+                ];
+                description = ''
+                  List of selectable deposit amounts.
+
+                  This should match your most common coins and banknotes.
+                '';
+              };
+            };
+
+            dispense = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow spending money.
+                '';
+              };
+
+              custom = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow custom spending amounts.
+                '';
+              };
+
+              steps = mkOption {
+                type = types.listOf (
+                  types.oneOf [
+                    types.int
+                    types.float
+                  ]
+                );
+                example = [
+                  0.5
+                  1
+                  2
+                  5
+                  10
+                  20
+                ];
+                description = ''
+                  List of selectable spending amounts.
+
+                  This should match your most common products.
+                '';
+              };
+            };
+
+            transaction = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow transactions between user accounts.
+                '';
+              };
+            };
+
+            undo = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow undoing transactions withing the {option}`services.strichliste.settings.payment.undo.timeout` period.
+                '';
+              };
+
+              delete = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow deleting within the {option}`services.strichliste.settings.payment.undo.timeout` period.
+                '';
+              };
+
+              timeout = mkOption {
+                type = types.str;
+                default = "5 minute";
+                description = ''
+                  The time period after creating a transaction in which undoing/deleting remains possible.
+
+                  The format used is documented in <https://www.php.net/manual/en/dateinterval.createfromdatestring.php>.
+                '';
+              };
+            };
+          };
+        };
+      };
+      description = ''
+        The {file}`strichliste.yaml` configuration as a Nix attribute set.
+
+        See the [configuration reference](https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/docs/Config.md)
+        for possible options.
+      '';
+    };
+
+    domain = mkOption {
+      type = types.str;
+      example = "strichliste.example.com";
+      description = ''
+        Domain name used to configure the webserver virtual host.
+      '';
+    };
+
+    environment = mkOption {
+      type = types.submodule {
+        freeformType = types.attrs;
+        options = {
+          APP_ENV = mkOption {
+            type = types.str;
+            default = "prod";
+            description = ''
+              The active environment.
+            '';
+          };
+          APP_LOG_DIR = mkOption {
+            type = types.path;
+            default = "/var/log/strichliste";
+            description = ''
+              Directory to write logs.
+            '';
+          };
+          APP_CACHE_DIR = mkOption {
+            type = types.path;
+            default = "/var/cache/strichliste";
+            description = ''
+              Directory used for caching.
+            '';
+          };
+          CORS_ALLOW_ORIGIN = mkOption {
+            type = types.str;
+            default = "^https?://${config.services.strichliste.domain}(:[0-9]+)?$";
+            defaultText = lib.literalExpression "^https?://$${config.services.strichliste.domain}(:[0-9]+)?$";
+            description = ''
+              Regular expression defining the allowed CORS origins.
+            '';
+          };
+          DATABASE_URL = mkOption {
+            type = types.str;
+            default = "sqlite:////var/lib/strichliste/db.sqlite";
+            example = "postgresql://strichliste@localhost/strichliste?host=/run/postgresql";
+            description = ''
+              See <https://www.doctrine-project.org/projects/doctrine-dbal/en/3.9/reference/configuration.html#connecting-using-a-url>
+              for more URL examples.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Environment variables consumed by Symfony.
+
+        See <https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/.env.dist> for possible options.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          "/run/keys/strichliste.env"
+        ]
+      '';
+      description = ''
+        Environment files to configure Symfony.
+
+        See <https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/.env.dist> for possible options.
+
+        ::: {.important}
+        You should configure `APP_SECRET` here.
+        :::
+      '';
+    };
+
+    nginx = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to enable and configure an nginx vhost to serve strichliste.
+        '';
+      };
+
+      virtualHost = mkOption {
+        type = types.submodule (
+          import ../web-servers/nginx/vhost-options.nix {
+            inherit config lib;
+          }
+        );
+        example = lib.literalExpression ''
+          {
+            enableACME = true;
+            forceSSL = true;
+          }
+        '';
+        description = ''
+          Nginx virtual settings to allow direct customization of its settings.
+        '';
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.enable && cfg.nginx.enable) {
+      services.phpfpm.pools.strichliste.settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+      };
+
+      services.nginx.enable = true;
+      services.nginx.virtualHosts.${cfg.domain} = mkMerge [
+        cfg.nginx.virtualHost
+        {
+          root = mkForce "${cfg.packages.frontend}";
+          locations = {
+            "/" = {
+              tryFiles = toString [
+                "$uri"
+                "$uri/"
+                "index.html"
+              ];
+            };
+
+            "/api/" = {
+              fastcgiParams = {
+                SCRIPT_FILENAME = "${cfg.packages.backend}/share/php/strichliste-backend/public/index.php";
+                SCRIPT_NAME = "/index.php";
+                REQUEST_URI = "$request_uri";
+
+                modHeadersAvailable = "true";
+                front_controller_active = "true";
+              };
+              extraConfig = ''
+                fastcgi_intercept_errors on;
+                fastcgi_pass unix:${config.services.phpfpm.pools.strichliste.socket};
+                fastcgi_request_buffering off;
+              '';
+            };
+          };
+        }
+      ];
+    })
+
+    (mkIf cfg.enable {
+      environment.etc."strichliste.yaml".source = settingsFile;
+
+      systemd.tmpfiles.settings."strichliste" = {
+        ${cfg.environment.APP_CACHE_DIR}.d = {
+          user = "strichliste";
+          group = "strichliste";
+          mode = "0700";
+        };
+        ${cfg.environment.APP_LOG_DIR}.d = {
+          user = "strichliste";
+          group = "strichliste";
+          mode = "0700";
+        };
+      };
+
+      systemd.services.strichliste-migrate = {
+        wantedBy = [ "phpfpm-strichliste.service" ];
+        before = [ "phpfpm-strichliste.service" ];
+        wants = unitDependencies;
+        after = unitDependencies;
+        inherit (cfg) environment;
+        preStart = ''
+          set -ex
+          if [ ! -e "/var/lib/strichliste/.db-init" ]; then
+            ${lib.optionalString (lib.hasInfix "sqlite" cfg.environment.DATABASE_URL) ''
+              ${lib.getExe cfg.packages.backend} doctrine:database:create
+            ''}
+            ${lib.getExe cfg.packages.backend} doctrine:schema:create
+            touch "/var/lib/strichliste/.db-init"
+          fi
+        '';
+        serviceConfig = {
+          Type = "exec";
+          User = "strichliste";
+          Group = "strichliste";
+          EnvironmentFile = cfg.environmentFiles;
+          ExecStart = toString [
+            (lib.getExe cfg.packages.backend)
+            "doctrine:migrations:migrate"
+            "--allow-no-migration"
+            "--no-interaction"
+          ];
+        };
+      };
+
+      systemd.services.phpfpm-strichliste = {
+        inherit (cfg) environment;
+        serviceConfig.EnvironmentFile = cfg.environmentFiles;
+      };
+
+      services.phpfpm.pools.strichliste = {
+        user = "strichliste";
+        group = "strichliste";
+        settings = {
+          # support environment variables
+          "clear_env" = false;
+          "pm" = "dynamic";
+          "pm.max_children" = 8;
+          "pm.start_servers" = 1;
+          "pm.min_spare_servers" = 1;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 256;
+        };
+        inherit (cfg.packages.backend) phpPackage;
+      };
+
+      users.groups.strichliste = { };
+      users.users.strichliste = {
+        group = "strichliste";
+        home = "/var/lib/strichliste";
+        createHome = true;
+        isSystemUser = true;
+      };
+    })
+  ];
+}

nixos/modules/system/boot/luksroot.nix

@@ -214,7 +214,7 @@ let
 
                       # and try reading it from /dev/console with a timeout
                       IFS= read -t 1 -r passphrase
-                      if [ -n "$passphrase" ]; then
+                      if [ $? = 0 ]; then
                          ${
                            if luks.reusePassphrases then
                              ''
@@ -232,7 +232,7 @@ let
                   fi
               done
               echo -n "Verifying passphrase for ${dev.device}..."
-              echo -n "$passphrase" | ${csopen} --key-file=-
+              echo "$passphrase" | ${csopen}
               if [ $? == 0 ]; then
                   echo " - success"
                   ${

nixos/tests/all-tests.nix

@@ -1519,6 +1519,7 @@ in
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
   stirling-pdf-desktop = runTest ./stirling-pdf-desktop.nix;
   stratis = handleTest ./stratis { };
+  strichliste = runTest ./web-apps/strichliste.nix;
   strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
   stunnel = import ./stunnel.nix { inherit runTest; };

nixos/tests/alps.nix

@@ -10,40 +10,49 @@ in
   };
 
   nodes = {
-    server = {
-      imports = [ ./common/user-account.nix ];
-      security.pki.certificateFiles = [
-        certs.ca.cert
-      ];
-      networking.extraHosts = ''
-        127.0.0.1 ${domain}
-      '';
-      networking.firewall.allowedTCPPorts = [
-        25
-        465
-        993
-      ];
-      services.postfix = {
-        enable = true;
-        enableSubmission = true;
-        enableSubmissions = true;
+    server =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+        security.pki.certificateFiles = [
+          certs.ca.cert
+        ];
+        networking.extraHosts = ''
+          127.0.0.1 ${domain}
+        '';
+        networking.firewall.allowedTCPPorts = [
+          25
+          465
+          993
+        ];
+        services.postfix = {
+          enable = true;
+          enableSubmission = true;
+          enableSubmissions = true;
 
-        settings.main = {
-          smtp_tls_CAfile = "${certs.ca.cert}";
-          smtpd_tls_chain_files = [
-            "${certs.${domain}.key}"
-            "${certs.${domain}.cert}"
-          ];
+          settings.main = {
+            smtp_tls_CAfile = "${certs.ca.cert}";
+            smtpd_tls_chain_files = [
+              "${certs.${domain}.key}"
+              "${certs.${domain}.cert}"
+            ];
+          };
+        };
+        services.dovecot2 = {
+          enable = true;
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+            protocols.imap = true;
+            ssl_server_ca_file = "${certs.ca.cert}";
+            ssl_server_cert_file = "${certs.${domain}.cert}";
+            ssl_server_key_file = "${certs.${domain}.key}";
+          };
         };
       };
-      services.dovecot2 = {
-        enable = true;
-        enableImap = true;
-        sslCACert = "${certs.ca.cert}";
-        sslServerCert = "${certs.${domain}.cert}";
-        sslServerKey = "${certs.${domain}.key}";
-      };
-    };
 
     client =
       { nodes, config, ... }:
@@ -110,7 +119,7 @@ in
     ''
       server.start()
       server.wait_for_unit("postfix.service")
-      server.wait_for_unit("dovecot2.service")
+      server.wait_for_unit("dovecot.service")
       server.wait_for_open_port(465)
       server.wait_for_open_port(993)
 

nixos/tests/appliance-repart-image-verity-store.nix

@@ -10,31 +10,20 @@
     willibutz
   ];
 
-  nodes.machine =
-    {
-      config,
-      lib,
-      pkgs,
-      ...
-    }:
+  defaults =
+    { config, lib, ... }:
     let
       inherit (config.image.repart.verityStore) partitionIds;
     in
     {
       imports = [ ../modules/image/repart.nix ];
 
-      virtualisation.fileSystems = lib.mkVMOverride {
+      virtualisation.fileSystems = lib.mkVMOverride { };
+      fileSystems = {
         "/" = {
           fsType = "tmpfs";
           options = [ "mode=0755" ];
         };
-
-        # bind-mount the store
-        "/nix/store" = {
-          device = "/usr/nix/store";
-          fsType = "none";
-          options = [ "bind" ];
-        };
       };
 
       image.repart = {
@@ -55,12 +44,6 @@
               SizeMinBytes = if config.nixpkgs.hostPlatform.isx86_64 then "64M" else "96M";
             };
           };
-          ${partitionIds.store-verity}.repartConfig = {
-            Minimize = "best";
-          };
-          ${partitionIds.store}.repartConfig = {
-            Minimize = "best";
-          };
         };
       };
 
@@ -75,10 +58,7 @@
         initrd.systemd.enable = true;
       };
 
-      system.image = {
-        id = "nixos-appliance";
-        version = "1";
-      };
+      system.image.id = "nixos-appliance";
 
       # don't create /usr/bin/env
       # this would require some extra work on read-only /usr
@@ -86,6 +66,12 @@
       system.activationScripts.usrbinenv = lib.mkForce "";
     };
 
+  nodes.machine = {
+    system.image.version = "1";
+  };
+
+  nodes.without-version = { };
+
   testScript =
     { nodes, ... }: # python
     ''
@@ -93,32 +79,50 @@
       import subprocess
       import tempfile
 
-      tmp_disk_image = tempfile.NamedTemporaryFile()
+      def create_disk_image(qemu_img, backing_file):
+        tmp = tempfile.NamedTemporaryFile()
+        subprocess.run([
+          qemu_img,
+          "create",
+          "-f",
+          "qcow2",
+          "-b",
+          backing_file,
+          "-F",
+          "raw",
+          tmp.name,
+        ], check=True)
+        return tmp
 
-      subprocess.run([
+      def run_verity_tests(machine):
+        with subtest("Running with volatile root"):
+          machine.succeed("findmnt --kernel --type tmpfs /")
+
+        with subtest("/nix/store is backed by dm-verity protected fs"):
+          verity_info = machine.succeed("dmsetup info --target verity usr")
+          assert "ACTIVE" in verity_info, f"unexpected verity info: {verity_info}"
+
+          backing_device = machine.succeed("df --output=source /nix/store | tail -n1").strip()
+          assert "/dev/mapper/usr" == backing_device, f"unexpected backing device: {backing_device}"
+
+      tmp_disk_machine = create_disk_image(
         "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
-        "create",
-        "-f",
-        "qcow2",
-        "-b",
-        "${nodes.machine.system.build.finalImage}/${nodes.machine.image.repart.imageFile}",
-        "-F",
-        "raw",
-        tmp_disk_image.name,
-      ])
-
-      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
-
+        "${nodes.machine.system.build.image}/${nodes.machine.image.filePath}",
+      )
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_machine.name
       machine.wait_for_unit("default.target")
+      run_verity_tests(machine)
+      with subtest("Image version is set"):
+        machine.succeed("grep IMAGE_VERSION=1 /etc/os-release")
 
-      with subtest("Running with volatile root"):
-        machine.succeed("findmnt --kernel --type tmpfs /")
-
-      with subtest("/nix/store is backed by dm-verity protected fs"):
-        verity_info = machine.succeed("dmsetup info --target verity usr")
-        assert "ACTIVE" in verity_info,f"unexpected verity info: {verity_info}"
-
-        backing_device = machine.succeed("df --output=source /nix/store | tail -n1").strip()
-        assert "/dev/mapper/usr" == backing_device,"unexpected backing device: {backing_device}"
+      tmp_disk_without_version = create_disk_image(
+        "${nodes."without-version".virtualisation.qemu.package}/bin/qemu-img",
+        "${nodes."without-version".system.build.image}/${nodes."without-version".image.filePath}",
+      )
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_without_version.name
+      without_version.wait_for_unit("default.target")
+      run_verity_tests(without_version)
+      with subtest("Image version is not set"):
+        without_version.succeed('grep IMAGE_VERSION="" /etc/os-release')
     '';
 }

nixos/tests/appliance-repart-image.nix

@@ -109,7 +109,7 @@ in
         "-f",
         "qcow2",
         "-b",
-        "${nodes.machine.system.build.image}/${nodes.machine.image.repart.imageFile}",
+        "${nodes.machine.system.build.image}/${nodes.machine.image.filePath}",
         "-F",
         "raw",
         tmp_disk_image.name,

nixos/tests/discourse.nix

@@ -85,7 +85,7 @@ in
     };
 
   nodes.client =
-    { nodes, ... }:
+    { config, nodes, ... }:
     {
       imports = [ common/user-account.nix ];
 
@@ -100,7 +100,14 @@ in
 
       services.dovecot2 = {
         enable = true;
-        protocols = [ "imap" ];
+        enablePAM = true;
+        settings = {
+          dovecot_config_version = "2.4.3";
+          dovecot_storage_version = config.services.dovecot2.package.version;
+          protocols.imap = true;
+          mail_driver = "maildir";
+          mail_path = "${config.services.postfix.settings.main.mail_spool_directory}/%{user}";
+        };
       };
 
       services.postfix = {

nixos/tests/opensmtpd-rspamd.nix

@@ -3,7 +3,7 @@ import ./make-test-python.nix {
 
   nodes = {
     smtp1 =
-      { pkgs, ... }:
+      { config, pkgs, ... }:
       {
         imports = [ common/user-account.nix ];
         networking = {
@@ -26,7 +26,7 @@ import ./make-test-python.nix {
           serverConfiguration = ''
             listen on 0.0.0.0
             action dovecot_deliver mda \
-              "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+              "${config.services.dovecot2.package}/libexec/dovecot/deliver -d %{user.username}"
             match from any for local action dovecot_deliver
 
             action relay_smtp2 relay host "smtp://192.168.1.2"
@@ -35,14 +35,20 @@ import ./make-test-python.nix {
         };
         services.dovecot2 = {
           enable = true;
-          enableImap = true;
-          mailLocation = "maildir:~/mail";
-          protocols = [ "imap" ];
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+            protocols.imap = true;
+            auth_allow_cleartext = true;
+          };
         };
       };
 
     smtp2 =
-      { pkgs, ... }:
+      { config, pkgs, ... }:
       {
         imports = [ common/user-account.nix ];
         networking = {
@@ -72,15 +78,21 @@ import ./make-test-python.nix {
             filter rspamd proc-exec "${pkgs.opensmtpd-filter-rspamd}/bin/filter-rspamd"
             listen on 0.0.0.0 filter rspamd
             action dovecot_deliver mda \
-              "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+              "${config.services.dovecot2.package}/libexec/dovecot/deliver -d %{user.username}"
             match from any for local action dovecot_deliver
           '';
         };
         services.dovecot2 = {
           enable = true;
-          enableImap = true;
-          mailLocation = "maildir:~/mail";
-          protocols = [ "imap" ];
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+            protocols.imap = true;
+            auth_allow_cleartext = true;
+          };
         };
       };
 
@@ -146,7 +158,7 @@ import ./make-test-python.nix {
     smtp1.wait_for_unit("opensmtpd")
     smtp2.wait_for_unit("opensmtpd")
     smtp2.wait_for_unit("rspamd")
-    smtp2.wait_for_unit("dovecot2")
+    smtp2.wait_for_unit("dovecot")
 
     # To prevent sporadic failures during daemon startup, make sure
     # services are listening on their ports before sending requests

nixos/tests/opensmtpd.nix

@@ -48,7 +48,7 @@ import ./make-test-python.nix {
       };
 
     smtp2 =
-      { pkgs, ... }:
+      { config, pkgs, ... }:
       {
         imports = [ common/user-account.nix ];
         networking = {
@@ -71,15 +71,21 @@ import ./make-test-python.nix {
           serverConfiguration = ''
             listen on 0.0.0.0
             action dovecot_deliver mda \
-              "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+              "${config.services.dovecot2.package}/libexec/dovecot/deliver -d %{user.username}"
             match from any for local action dovecot_deliver
           '';
         };
         services.dovecot2 = {
           enable = true;
-          enableImap = true;
-          mailLocation = "maildir:~/mail";
-          protocols = [ "imap" ];
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+            protocols.imap = true;
+            auth_allow_cleartext = true;
+          };
         };
       };
 

nixos/tests/qownnotes.nix

@@ -50,7 +50,7 @@
           machine.wait_for_text("Note folder")
           machine.send_key("ret")
           machine.wait_for_console_text("Note path '/home/alice/Notes' was now created.")
-          machine.wait_for_text("Panel layout")
+          machine.wait_for_text("Layout preset")
           machine.send_key("ret")
           machine.wait_for_text("Nextcloud")
           machine.send_key("ret")

nixos/tests/rasdaemon.nix

@@ -1,9 +1,8 @@
-{ ... }:
+{ pkgs, ... }:
 {
   name = "rasdaemon";
   meta = {
-    maintainers = [ ];
-    broken = true; # test timed out
+    inherit (pkgs.rasdaemon.meta) maintainers;
   };
 
   nodes.machine =

nixos/tests/repath-studio.nix

@@ -25,8 +25,13 @@
           repath-studio
         ];
 
-        # electron application, give more memory
+        # electron application, give more memory and cpu
         virtualisation.memorySize = 4096;
+        virtualisation.cores = 4;
+        virtualisation.qemu.options = [
+          # Force qemu at 1020x768 resolution for the Save button click
+          "-vga none -device virtio-gpu-pci,xres=1020,yres=768"
+        ];
       };
   };
 
@@ -52,7 +57,9 @@
     machine.sleep(2)
     machine.send_key("ctrl-shift-s")
     machine.sleep(2)
-    machine.send_chars("/tmp/saved.rps\n")
+    machine.send_chars("/tmp/saved.rps")
+    machine.sleep(2)
+    machine.succeed("su - alice -c 'DISPLAY=:0 xdotool mousemove --sync 975 745 click 1'") # Save file dialog
     machine.sleep(2)
     print(machine.succeed("cat /tmp/saved.rps"))
     assert "${pkgs.repath-studio.version}" in machine.succeed("cat /tmp/saved.rps")

nixos/tests/rss2email.nix

@@ -3,7 +3,7 @@ import ./make-test-python.nix {
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { config, pkgs, ... }:
       {
         imports = [ common/user-account.nix ];
         services.nginx = {
@@ -33,9 +33,14 @@ import ./make-test-python.nix {
         };
         services.dovecot2 = {
           enable = true;
-          enableImap = true;
-          mailLocation = "maildir:~/mail";
-          protocols = [ "imap" ];
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+            protocols.imap = true;
+          };
         };
         environment.systemPackages =
           let
@@ -67,7 +72,7 @@ import ./make-test-python.nix {
     server.systemctl("start network-online.target")
     server.wait_for_unit("network-online.target")
     server.wait_for_unit("opensmtpd")
-    server.wait_for_unit("dovecot2")
+    server.wait_for_unit("dovecot")
     server.wait_for_unit("nginx")
     server.wait_for_unit("rss2email")
 

nixos/tests/web-apps/strichliste.nix

@@ -0,0 +1,105 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  name = "strichliste";
+  meta.maintainers = pkgs.strichliste.meta.maintainers;
+
+  nodes = {
+    server =
+      { config, ... }:
+      {
+        networking.extraHosts = ''
+          127.0.0.1 strichliste.local
+        '';
+
+        environment.systemPackages = with pkgs; [ httpie ];
+
+        time.timeZone = "Europe/Berlin";
+
+        services.strichliste = {
+          enable = true;
+          domain = "strichliste.local";
+          environmentFiles = [
+            (pkgs.writeText "strichliste-secret.env" ''
+              APP_SECRET=changemechangemechangeme
+            '')
+          ];
+          settings = {
+            i18n = {
+              currency = {
+                alpha3 = "EUR";
+                name = "Euro";
+                symbol = "€";
+              };
+            };
+          };
+        };
+      };
+  };
+
+  testScript =
+    {
+      nodes,
+      ...
+    }:
+    # python
+    ''
+      import json
+
+      start_all()
+
+      def get_users():
+        response = machine.succeed("http --check-status http://strichliste.local/api/user")
+        users = json.loads(response)["users"]
+        return users
+
+      def get_user(uid: int):
+        response = machine.succeed(f"http --check-status http://strichliste.local/api/user/{uid}")
+        user = json.loads(response)["user"]
+        return user
+
+      def test():
+        with subtest("Check empty user list"):
+          users = get_users()
+          t.assertEqual(len(users), 0, "Strichliste must not have users.")
+
+        with subtest("Create user"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user name=Alice")
+          users = get_users()
+          t.assertEqual(len(users), 1, "Strichliste must have exactly one user.")
+
+        with subtest("Retrieve user details"):
+          user = get_user(1)
+          t.assertEqual(user["name"], "Alice", "Created user must be named Alice")
+          t.assertEqual(user["balance"], 0, "New users should have a balance of 0")
+
+        with subtest("Deposit money"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=500")
+          user = get_user(1)
+          t.assertEqual(user["balance"], 500, "Balance must be 500 after depositing 500")
+
+        with subtest("Dispense money"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=-1000")
+          user = get_user(1)
+          t.assertEqual(user["balance"], -500, "Balance must be -500 after dispensing 1000")
+
+        with subtest("Undo transaction"):
+          response = machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=7500")
+          transaction = json.loads(response)["transaction"]
+          machine.succeed(f"http --check-status delete http://strichliste.local/api/user/1/transaction/{transaction['id']}")
+
+      server.wait_for_unit("phpfpm-strichliste.service")
+
+      # frontend
+      server.wait_until_succeeds("http --check-status http://strichliste.local/ | grep -q '<title>Strichliste</title>'")
+
+      # backend
+      server.wait_until_succeeds("http --check-status http://strichliste.local/api/settings")
+
+      # sqlite
+      test()
+    '';
+}

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0106";
+  version = "9.2.0340";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-byOf2Gr1vA7xQw3YHV454te1QrVxRy3sXrLdFUp2XRg=";
+    hash = "sha256-jCnOVIafx+0o1nlHv7QJQrmxs1IAxh9BBshDOFdZdCM=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/macvim.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  callPackage,
   fetchFromGitHub,
   apple-sdk_14,
   ncurses,
@@ -24,6 +25,9 @@ let
   ruby = ruby_3_4;
 in
 
+let
+  common = callPackage ./common.nix { inherit stdenv; };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "macvim";
 
@@ -182,7 +186,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
-  hardeningDisable = [ "format" ];
+  hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
   env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
 

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -193,10 +193,8 @@ assertNoAdditions {
   };
 
   aider-nvim = super.aider-nvim.overrideAttrs {
-    patches = [
-      (replaceVars ./patches/aider-nvim/bin.patch {
-        aider = lib.getExe aider-chat;
-      })
+    runtimeDeps = [
+      aider-chat
     ];
   };
 
@@ -243,10 +241,8 @@ assertNoAdditions {
   };
 
   aw-watcher-vim = super.aw-watcher-vim.overrideAttrs {
-    patches = [
-      (replaceVars ./patches/aw-watcher-vim/program_paths.patch {
-        curl = lib.getExe curl;
-      })
+    runtimeDeps = [
+      curl
     ];
   };
 
@@ -328,6 +324,10 @@ assertNoAdditions {
     dependencies = [ self.plenary-nvim ];
   };
 
+  blink-cmp-latex = super.blink-cmp-latex.overrideAttrs {
+    dependencies = [ self.blink-cmp ];
+  };
+
   blink-cmp-nixpkgs-maintainers = super.blink-cmp-nixpkgs-maintainers.overrideAttrs {
     dependencies = [ self.blink-cmp ];
   };
@@ -1388,10 +1388,8 @@ assertNoAdditions {
   };
 
   gx-nvim = super.gx-nvim.overrideAttrs {
-    patches = lib.optionals stdenv.hostPlatform.isLinux [
-      (replaceVars ./patches/gx-nvim/fix-paths.patch {
-        inherit xdg-utils;
-      })
+    runtimeDeps = [
+      xdg-utils
     ];
 
     nvimRequireCheck = "gx";
@@ -1928,10 +1926,8 @@ assertNoAdditions {
       };
     in
     super.markdown-preview-nvim.overrideAttrs {
-      patches = [
-        (replaceVars ./patches/markdown-preview-nvim/fix-node-paths.patch {
-          node = "${nodejs}/bin/node";
-        })
+      runtimeDeps = [
+        nodejs
       ];
       postInstall = ''
         cp -r ${nodeDep} $out/app/node_modules
@@ -2802,10 +2798,14 @@ assertNoAdditions {
     nvimSkipModules = [ "install_parsers" ];
   };
 
-  # TODO: raise warning at 26.04; drop at 26.11
-  nvim-treesitter-legacy = super.nvim-treesitter-legacy.overrideAttrs (
-    callPackage ./nvim-treesitter-legacy/overrides.nix { } self super
-  );
+  # TODO: raise warning at 26.05; drop at 26.11
+  nvim-treesitter-legacy =
+    let
+      drv = super.nvim-treesitter-legacy.overrideAttrs (
+        callPackage ./nvim-treesitter-legacy/overrides.nix { } self super
+      );
+    in
+    lib.warnOnInstantiate "nvim-treesitter-legacy is deprecated, please migrate to the new version. This will become an error in 26.11" drv;
 
   nvim-treesitter-pairs = super.nvim-treesitter-pairs.overrideAttrs {
     dependencies = [ self.nvim-treesitter-legacy ];
@@ -2971,9 +2971,12 @@ assertNoAdditions {
   # The plugin depends on either skim-vim or fzf-vim, but we don't want to force the user so we
   # avoid choosing one of them and leave it to the user
   openscad-nvim = super.openscad-nvim.overrideAttrs {
+    runtimeDeps = [
+      openscad
+    ];
+
     buildInputs = [
       zathura
-      htop
       openscad
     ];
 
@@ -2983,12 +2986,6 @@ assertNoAdditions {
       "openscad.snippets.openscad"
       "openscad.utilities"
     ];
-    patches = [
-      (replaceVars ./patches/openscad.nvim/program_paths.patch {
-        htop = lib.getExe htop;
-        openscad = lib.getExe openscad;
-      })
-    ];
   };
 
   org-notebook-nvim = super.org-notebook-nvim.overrideAttrs {
@@ -3073,12 +3070,14 @@ assertNoAdditions {
   };
 
   peek-nvim = super.peek-nvim.overrideAttrs (old: {
+    runtimeDeps = [
+      deno
+    ];
+
     patches = [
       # Patch peek-nvim to run using nixpkgs deno
       # This means end-users have to build peek-nvim the first time they use it...
-      (replaceVars ./patches/peek-nvim/cmd.patch {
-        deno = lib.getExe deno;
-      })
+      ./patches/peek-nvim/cmd.patch
     ];
   });
 
@@ -3123,10 +3122,8 @@ assertNoAdditions {
   };
 
   Preview-nvim = super.Preview-nvim.overrideAttrs {
-    patches = [
-      (replaceVars ./patches/preview-nvim/hardcode-mdt-binary-path.patch {
-        mdt = lib.getExe md-tui;
-      })
+    runtimeDeps = [
+      md-tui
     ];
   };
 
@@ -3193,11 +3190,9 @@ assertNoAdditions {
   };
 
   ranger-nvim = super.ranger-nvim.overrideAttrs {
-    patches = [ ./patches/ranger.nvim/fix-paths.patch ];
-
-    postPatch = ''
-      substituteInPlace lua/ranger-nvim.lua --replace-fail '@ranger@' ${ranger}/bin/ranger
-    '';
+    runtimeDeps = [
+      ranger
+    ];
   };
 
   refactoring-nvim = super.refactoring-nvim.overrideAttrs {

pkgs/applications/editors/vim/plugins/patches/aider-nvim/bin.patch

@@ -1,15 +0,0 @@
-diff --git a/lua/aider.lua b/lua/aider.lua
-index 98b5071..589b06d 100644
---- a/lua/aider.lua
-+++ b/lua/aider.lua
-@@ -61,9 +61,9 @@ function M.AiderOpen(args, window_type)
-     log("Existing aider buffer found, opening in new window")
-     helpers.open_buffer_in_new_window(window_type, M.aider_buf)
-   else
-     log("No existing aider buffer, creating new one")
--    local command = "aider " .. (args or "")
-+    local command = "@aider@ " .. (args or "")
-     log("Opening window with type: " .. window_type)
-     helpers.open_window(window_type)
-     log("Adding buffers to command")
-     command = helpers.add_buffers_to_command(command, is_valid_buffer)

pkgs/applications/editors/vim/plugins/patches/aw-watcher-vim/program_paths.patch

@@ -1,13 +0,0 @@
-diff --git a/plugin/activitywatch.vim b/plugin/activitywatch.vim
-index 6986553..7462b02 100644
---- a/plugin/activitywatch.vim
-+++ b/plugin/activitywatch.vim
-@@ -29,7 +29,7 @@ let s:heartbeat_apiurl = printf('%s/heartbeat?pulsetime=30', s:bucket_apiurl)
- let s:http_response_code = {}
- 
- function! HTTPPostJson(url, data)
--    let l:req = ['curl', '-s', a:url,
-+    let l:req = ['@curl@', '-s', a:url,
-         \ '-H', 'Content-Type: application/json',
-         \ '-X', 'POST',
-         \ '-d', json_encode(a:data),

pkgs/applications/editors/vim/plugins/patches/gx-nvim/fix-paths.patch

@@ -1,13 +0,0 @@
-diff --git a/lua/gx/init.lua b/lua/gx/init.lua
-index 12272d4..c51771a 100644
---- a/lua/gx/init.lua
-+++ b/lua/gx/init.lua
-@@ -73,7 +73,7 @@ local function get_open_browser_app()
-   if sysname == "Darwin" then
-     app = "open"
-   elseif sysname == "Linux" then
--    app = "xdg-open"
-+    app = "@xdg-utils@/bin/xdg-open"
-   elseif sysname == "Windows_NT" then
-     app = "powershell.exe"
-   end

pkgs/applications/editors/vim/plugins/patches/markdown-preview-nvim/fix-node-paths.patch

@@ -1,31 +0,0 @@
-diff --git a/autoload/health/mkdp.vim b/autoload/health/mkdp.vim
-index 323b57b..8053ea8 100644
---- a/autoload/health/mkdp.vim
-+++ b/autoload/health/mkdp.vim
-@@ -8,8 +8,8 @@ function! health#mkdp#check() abort
-     lua vim.health.info('Pre build: ' .. vim.api.nvim_eval('l:mkdp_server_script'))
-     lua vim.health.info('Pre build version: ' .. vim.fn['mkdp#util#pre_build_version']())
-     lua vim.health.ok('Using pre build')
--  elseif executable('node')
--    lua vim.health.info('Node version: ' .. string.gsub(vim.fn.system('node --version'), '^%s*(.-)%s*$', '%1'))
-+  else
-+    lua vim.health.info('Node version: ' .. string.gsub(vim.fn.system('@node@ --version'), '^%s*(.-)%s*$', '%1'))
-     let l:mkdp_server_script = s:mkdp_root_dir .. '/app/server.js'
-     lua vim.health.info('Script: ' .. vim.api.nvim_eval('l:mkdp_server_script'))
-     lua vim.health.info('Script exists: ' .. vim.fn.filereadable(vim.api.nvim_eval('l:mkdp_server_script')))
-diff --git a/autoload/mkdp/rpc.vim b/autoload/mkdp/rpc.vim
-index b257571..57f04e7 100644
---- a/autoload/mkdp/rpc.vim
-+++ b/autoload/mkdp/rpc.vim
-@@ -41,9 +41,9 @@ function! mkdp#rpc#start_server() abort
-   let l:mkdp_server_script = s:mkdp_root_dir . '/app/bin/markdown-preview-' . mkdp#util#get_platform()
-   if executable(l:mkdp_server_script)
-     let l:cmd = [l:mkdp_server_script, '--path', s:mkdp_root_dir . '/app/server.js']
--  elseif executable('node')
-+  else
-     let l:mkdp_server_script = s:mkdp_root_dir . '/app/index.js'
--    let l:cmd = ['node', l:mkdp_server_script, '--path', s:mkdp_root_dir . '/app/server.js']
-+    let l:cmd = ['@node@', l:mkdp_server_script, '--path', s:mkdp_root_dir . '/app/server.js']
-   endif
-   if exists('l:cmd')
-     if s:is_vim

pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch

@@ -1,26 +0,0 @@
-diff --git a/autoload/health/openscad_nvim.vim b/autoload/health/openscad_nvim.vim
-index d6d4b4c..9853877 100644
---- a/autoload/health/openscad_nvim.vim
-+++ b/autoload/health/openscad_nvim.vim
-@@ -15,7 +15,7 @@ function! s:check_zathura_installed() abort
- endfunction
-
- function! s:check_htop_installed() abort
--	if !executable('htop')
-+	if !executable('@htop@')
- 		call v:lua.vim.health.error('has(htop)','install htop')
- 	else
- 		call v:lua.vim.health.ok("htop is installed")
-diff --git a/lua/openscad.lua b/lua/openscad.lua
-index 0a26d08..1264989 100644
---- a/lua/openscad.lua
-+++ b/lua/openscad.lua
-@@ -126,7 +126,7 @@ function M.exec_openscad()
- 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. filename
- 	else
- 		-- TODO: What about Windows?
--		jobCommand = 'openscad ' .. filename
-+		jobCommand = '@openscad@ ' .. filename
- 	end
-
- 	vim.fn.jobstart(jobCommand)

pkgs/applications/editors/vim/plugins/patches/peek-nvim/cmd.patch

@@ -1,16 +1,3 @@
-diff --git a/app/src/main.ts b/app/src/main.ts
-index c82d914..e8542f3 100644
---- a/app/src/main.ts
-+++ b/app/src/main.ts
-@@ -73,7 +73,7 @@ async function init(socket: WebSocket) {
-     const onListen: Deno.ServeOptions['onListen'] = ({ hostname, port }) => {
-       const serverUrl = `${hostname.replace('0.0.0.0', 'localhost')}:${port}`;
-       logger.info(`listening on ${serverUrl}`);
--      const webview = new Deno.Command('deno', {
-+      const webview = new Deno.Command('@deno@', {
-         cwd: dirname(fromFileUrl(Deno.mainModule)),
-         args: [
-           'run',
 diff --git a/lua/peek/app.lua b/lua/peek/app.lua
 index af5148e..5e67563 100644
 --- a/lua/peek/app.lua
@@ -22,7 +9,7 @@ index af5148e..5e67563 100644
 -    'deno',
 -    'task',
 -    '--quiet',
-+    '@deno@',
++    'deno',
      'run',
 +    '--allow-read',
 +    '--allow-write',

pkgs/applications/editors/vim/plugins/patches/preview-nvim/hardcode-mdt-binary-path.patch

@@ -1,22 +0,0 @@
-diff --git a/lua/preview.lua b/lua/preview.lua
-index 6d9875d..729cc70 100644
---- a/lua/preview.lua
-+++ b/lua/preview.lua
-@@ -28,7 +28,7 @@ local function open_window(file)
- 	vim.env.MDT_WIDTH = width
- 
- 	vim.cmd.vnew()
--	vim.fn.termopen("mdt " .. file)
-+	vim.fn.termopen("@mdt@ " .. file)
- 
- 	vim.cmd("setlocal nonumber norelativenumber")
- 	vim.api.nvim_feedkeys("a", "t", false)
-@@ -49,7 +49,7 @@ end
- function M.setup()
- 	-- Check if "mdt" is installed
- 	if vim.fn.executable("mdt") == 0 then
--		install()
-+		-- install()
- 	end
- 
- 	set_cmd()

pkgs/applications/editors/vim/plugins/patches/ranger.nvim/fix-paths.patch

@@ -1,31 +0,0 @@
-diff --git a/lua/ranger-nvim.lua b/lua/ranger-nvim.lua
-index be95e36..3bd1587 100644
---- a/lua/ranger-nvim.lua
-+++ b/lua/ranger-nvim.lua
-@@ -127,7 +127,7 @@ local function build_ranger_cmd(select_current_file)
- 	local selectfile_flag = select_current_file and " --selectfile=" .. selected_file or ""
- 	if select_current_file then
- 		return string.format(
--			"ranger --choosefiles=%s %s %s",
-+			"@ranger@ --choosefiles=%s %s %s",
- 			SELECTED_FILEPATH,
- 			selectfile_flag,
- 			create_ranger_cmd_flags(create_cmd_values(opts.keybinds))
-@@ -135,7 +135,7 @@ local function build_ranger_cmd(select_current_file)
- 	else
- 		vim.api.nvim_buf_delete(1, { force = true })
- 		return string.format(
--			"ranger  --choosefiles=%s %s %s",
-+			"@ranger@  --choosefiles=%s %s %s",
- 			SELECTED_FILEPATH,
- 			create_ranger_cmd_flags(create_cmd_values(opts.keybinds)),
- 			get_absolute_argument()
-@@ -209,7 +209,7 @@ end
- ---Opens ranger and open selected files on exit.
- ---@param select_current_file boolean|nil open ranger and select the current file. Defaults to true.
- function M.open(select_current_file)
--	if vim.fn.executable("ranger") ~= 1 then
-+	if vim.fn.executable("@ranger@") ~= 1 then
- 		vim.api.nvim_err_write(
- 			"ranger executable not found, please check that ranger is installed and is in your path\n"
- 		)

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1254,6 +1254,7 @@ https://github.com/vim-scripts/timestamp.vim/,,
 https://github.com/levouh/tint.nvim/,HEAD,
 https://github.com/tinted-theming/tinted-nvim/,HEAD,
 https://github.com/tinted-theming/tinted-vim/,HEAD,
+https://github.com/rachartier/tiny-cmdline.nvim/,HEAD,
 https://github.com/rachartier/tiny-devicons-auto-colors.nvim/,HEAD,
 https://github.com/rachartier/tiny-glimmer.nvim/,HEAD,
 https://github.com/rachartier/tiny-inline-diagnostic.nvim/,HEAD,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.107";
-    hash = "sha256-3RhHJzkY2Lkp5zI8NWXueUfiqd+RuKLfSqcLF4fxvSA=";
+    version = "2.1.111";
+    hash = "sha256-NfmPJl/+PyJTImKsN+cES6XxJryEQW0+dUoOyZsYq4k=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1330,8 +1330,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.28.4";
-          hash = "sha256-9m3Oi6w1GoVQatiMShmQAlsXDOauW3JBmNi3o78LFys=";
+          version = "2.28.5";
+          hash = "sha256-G5WgFSrmQOOtsDFfmJaJxvgbKfnpQSmMf+xAJeuhvhU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1970,8 +1970,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "vscode-pull-request-github";
-          version = "0.134.0";
-          hash = "sha256-gzzFCGSuV4Qofs7BI9ihd6lBGN8zOCvFntgKfS0bIIA=";
+          version = "0.136.0";
+          hash = "sha256-WUdA5aD3EC45gHBo4ctxVUog8QTEIq6IXlCOPZBBXmo=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -3090,8 +3090,8 @@ let
         mktplcRef = {
           name = "compare-folders";
           publisher = "moshfeu";
-          version = "0.29.0";
-          hash = "sha256-oX4182qaoHbvZC9MdzzARBlW4MbtE7H0Fg687K5h2XQ=";
+          version = "0.30.0";
+          hash = "sha256-XBMHEk5iRW6n9fjDUbD8c/FFGNRttrnV0tH1qUphXYo=";
         };
 
         meta = {
@@ -3306,8 +3306,8 @@ let
         mktplcRef = {
           publisher = "ms-vscode";
           name = "cmake-tools";
-          version = "1.22.28";
-          hash = "sha256-ZVtVZ53wvFBchXd9wRCxm1NQkkoTn9Yn4vcbY46GQmY=";
+          version = "1.23.51";
+          hash = "sha256-5AcmkJmk5ccZjHPx/4gZ/WW6c6RlHcosaPXHjey2a0M=";
         };
         meta.license = lib.licenses.mit;
       };
@@ -5076,8 +5076,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-debug";
-          version = "0.58.2025022807";
-          hash = "sha256-8bzDbCF03U5P15tkVkieOGuuLetUFXjZNrQKZTcKNFA=";
+          version = "0.59.0";
+          hash = "sha256-5Zc/zXY6mE6k1uV2RMz49f5sqoDA5YnylAPwDJrOOSA=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -5088,8 +5088,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-dependency";
-          version = "0.27.1";
-          hash = "sha256-QMZ26Es+TMVBa3a7VwkbOkAQUbSZ3ragVJBUVJov5yY=";
+          version = "0.27.2";
+          hash = "sha256-1ix/MtZ801uX0Q1/t+S6AG3sSkILDugouecOq9BO1IQ=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -5100,8 +5100,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-test";
-          version = "0.44.0";
-          hash = "sha256-Qr4Ms15Nq+/yygWYBDvN5dHIKpQ0yYQjI1p/RNFMWjw=";
+          version = "0.45.0";
+          hash = "sha256-6GEuijuVilhJ73isdrZPzD+xhZjRDXYQNCgcSBoyIdo=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -5128,8 +5128,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-maven";
-          version = "0.45.1";
-          hash = "sha256-ZMfw04RhSz6VlNlgxZuJWHprpI9PyjsfyzOihjrhuo8=";
+          version = "0.45.2";
+          hash = "sha256-iXmOePF+i/gaYSMpEa0YPfKzmYRy1sRg64iHfqlc3AY=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.42.3";
-    hash = "sha256-bkVfwPFQSuTMcIEoEa/M91foSZC+0H4ESFXFwDDDhbc=";
+    version = "0.44.1";
+    hash = "sha256-xm3BG6d853ztavvTmADyTbc13xD0x9eZ4TudNpNH7+0=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/leanprover.lean4/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "lean4";
     publisher = "leanprover";
-    version = "0.0.229";
-    hash = "sha256-gwyBpoUXlTVbxljU+/bxeIvMhS7/t5QYlop6z474nWg=";
+    version = "0.0.234";
+    hash = "sha256-pChzzyJ49LAlSHWl83G6GaH3mTJB2ZZTjMygxWpubtE=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   };
 
   meta = {
-    description = "VSCode extension providing an autonomous coding agent right in your IDE, capable of creating/editing files, executing commands, using the browser, and more with your permission every step of the way";
+    description = "Cline - autonomous coding agent VSCode extension, capable of creating/editing files, executing commands, using the browser, and more with your permission every step of the way";
     downloadPage = "https://github.com/cline/cline";
     homepage = "https://github.com/cline/cline";
     license = lib.licenses.asl20;

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-04-07";
+  version = "0-unstable-2026-04-12";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "ad03e10c16a70b289f29bb10112857961125b4e6";
-    hash = "sha256-XSCI+94PXJXnU6/6lqA+1p05A3p2r8W0XPwbaDPSsaM=";
+    rev = "321bdaf08b4b007a720f196ea072c1813b1b7efe";
+    hash = "sha256-9Ry5+krdhz2RCmZZh2l6DdcKTgMpcgHwOBG4c7fc/og=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/nxengine.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nxengine";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nxengine-libretro";
-    rev = "990bdaacd6ed9db735ea625c948252d0b8a2100a";
-    hash = "sha256-41f2iHQi3gwla1gM2/rFvzTKhSIrJqYLZN+5f9Ylu7A=";
+    rev = "a1c45fd4d045333f4ea523e556469b545be82b0a";
+    hash = "sha256-v7mUr4GeNc/bOe4gQvtPns4/uLA+r7UFGavDdtBNj6E=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/vecx.nix

@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "vecx";
-  version = "0-unstable-2026-01-12";
+  version = "0-unstable-2026-04-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-vecx";
-    rev = "eacee1f6f029688b043ed802cece29dd3c320e21";
-    hash = "sha256-2OlacvnJWcfTA8l91IBvuoUgd1HAs5ZHCbBGfaTGCyg=";
+    rev = "8f671cc9d737f2890c3ce19e177e2984dcae121f";
+    hash = "sha256-gNHPmoCiqWg7vWapWBPwHPPogiXCvXfkyqsHuudKHDg=";
   };
 
   extraBuildInputs = [

pkgs/applications/misc/qtbitcointrader/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     qmake $qmakeFlags \
       PREFIX=$out \
       DESKTOPDIR=$out/share/applications \
-      ICONDIR=$out/share/icons/hicolor/1024x1024/apps \
+      ICONDIR=$out/share/icons \
       QtBitcoinTrader_Desktop.pro
 
     runHook postConfigure

pkgs/applications/networking/browsers/chromium/info.json

@@ -828,11 +828,11 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "147.0.7727.55",
+    "version": "147.0.7727.101",
     "deps": {
       "depot_tools": {
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "442cbd6d584d2c992ca9bcc19ecbd2235bea772e",
+        "hash": "sha256-CgEu3y/MNRcCN2EmtcVgmGW/bEPKypeyLaANtiplDJU="
       },
       "gn": {
         "version": "0-unstable-2026-03-05",
@@ -840,16 +840,16 @@
         "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
       },
       "ungoogled-patches": {
-        "rev": "147.0.7727.55-1",
-        "hash": "sha256-7Fs/dfAn+N7zpkUSzACf9SDRhgMJUsnVi8cAExwn21A="
+        "rev": "147.0.7727.101-1",
+        "hash": "sha256-w/9bzbYHZM3Ot26ZcYWB51z7T+I4OBOxflo1dWxghyQ="
       },
       "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "7dc2b8f6f651b42c0a8f3634c9feb5e0b6b25c91",
-        "hash": "sha256-mAauWiP5AlyzoRFOSGA71ljtZ9MtYLKtRlSolCA/spE=",
+        "rev": "56536d2a8034c51b0e68e1a0483ab9f1a0165ae3",
+        "hash": "sha256-94TMvPkcWm+IEVYwTh+m1ys5du75bvJcc1RpkSKpAwc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "401e94882e22cf2aa7af649b92ab123eaa329321",
-        "hash": "sha256-WD8GaB8LYhICdHZ+meCXSmLylAcISzEaZj06g+z1sfw="
+        "rev": "cbc4f074126e6f1acf72ad620a28cd4a8dd86f2a",
+        "hash": "sha256-MUgLUj2L0vmpAoxt/TJy1clsJfvYkQqe3Xm2+e4Y6tw="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -959,8 +959,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "3ab1df504f1af37a64f8d3949e77b0868e154894",
-        "hash": "sha256-wWoXEvgROx5FLx4nnvaiEW7N9q5VibulffWwCkkEXOs="
+        "rev": "2c681aed02b0add6bcf6724175660c4b35ece843",
+        "hash": "sha256-io3X9zu6tHgqJGXjygUXMa98rXELRNl6Y330U2nRc/M="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1254,8 +1254,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9dd1b8af51cfd431cbcdeebc95256c0ec6b249eb",
-        "hash": "sha256-IX9mgT9f8fyAd0e1HzBNDE6tNAK4JC+OVqQLJIsvMY0="
+        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
+        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1369,8 +1369,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "9a2d3d1f46afbdfa9b9820a9fd3aacb084e65e2f",
-        "hash": "sha256-9OkXFvBDfh/NFA96IQzaJcXSKSKW6tBN/HJSAwAr3S8="
+        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
+        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1434,8 +1434,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "f99c212599bb85ce2e60936099f829cbcc3d4f5c",
-        "hash": "sha256-jq5qVIRWmC1xTvV/YwaosJMQH3XpS2N6Xn601uUPFkc="
+        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
+        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "abbe599fb3c0ef2fa82bfadbb0ddcd321f22faf0",
-        "hash": "sha256-QR0R8gwDh6m4RCCCj0EJ/oQQd/mHdUkOVSO8mg74WkE="
+        "rev": "f8cd2da0256752afb0059bf17e4bf2bec422967e",
+        "hash": "sha256-dtSWBpCaewkKMW3Jc1PNDQh0jSQHIPduaXsIU9rcTa0="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "0cd69a9ba82925f5eb2c91376c4e7ba0da9dd445",
-        "hash": "sha256-PKaDXkDkdUVBlcXRmlfWjd5tqvLTCywhC7KdP/xp5NM="
+        "rev": "c207e34c08865143dc6774c1c624f3cea07f7420",
+        "hash": "sha256-5rc28tPK9mOJDO3HA3F1ZgsRQmWXhoLZGeKTzxWSISw="
       }
     }
   }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-/Vrz9KuImtTDhuOMM6Ql8N2KTDQKZyzU5bgWPlN7HdI=",
+    "hash": "sha256-nh8ZxBPWeH4J8+/E0LppTmzx7WInkJVmt2NluC91OcY=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.53.0",
+    "rev": "v4.54.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-aKD+3Y80B3BUmsBsbeAiSpCx7Qh3U/LlTtB2fk/tlTI="
+    "vendorHash": "sha256-Ai51lUT782wnua4DIcFkxXCbnSBIhTduUO91zL7LBJY="
   },
   "akamai_akamai": {
     "hash": "sha256-/+IE06obx4Rxzz3uh5QbeS/FhGlK2qTJJFWGAlDWJaw=",
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-39r9+dFJYJrzL0EOK3vXLcftOSqyw/pR5q+zm2lipYY="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-ySzZTmsiPEvgPsqxTi2FMclfp9zR97aaGfmZba2lScM=",
+    "hash": "sha256-iEAe+eRMRSnsxS8CtmF/vr1PwGcMvhnba/eedx+hS6w=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.27.0",
+    "rev": "v7.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Wf2Lh2bLUA+Jco2LukHFq1PtbytnObBUPC6+nWDUFE0="
+    "vendorHash": "sha256-6AUZpHNEqruuOcnkmEiLe53D+cUf8TmbvEHS0kuHyzU="
   },
   "hashicorp_helm": {
     "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -652,11 +652,11 @@
     "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-TDDnW6786MGOBuptsIBqPe4/PUHQ3pKeLFqLHex3ObI=",
+    "hash": "sha256-/vEbhPKNhKUIlChGYuMNR5Ulbk9gG4171vZ6pvoTdcM=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.76.1",
+    "rev": "v0.76.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-JNTe1RI2aDw86jNzYJqmiBr5BBnr824/DhkJeaMpbKI="
   },
@@ -932,11 +932,11 @@
     "vendorHash": "sha256-cvnxSUCiu6S5lkT9VAyn9K6lmridRb0WZyrrvMv+B48="
   },
   "namecheap_namecheap": {
-    "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
+    "hash": "sha256-eV2K3KHTEXEEt1WXwfYfNMK+gLUY0EoHFQg9kLdAI3s=",
     "homepage": "https://registry.terraform.io/providers/namecheap/namecheap",
     "owner": "namecheap",
     "repo": "terraform-provider-namecheap",
-    "rev": "v2.2.0",
+    "rev": "v2.3.2",
     "spdx": "Apache-2.0",
     "vendorHash": null
   },
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-u3WK/pLsuwySJX6GMNho8ImB+F+XXUPC6h+IQtDrOp8="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-ow/8K8MXUKG0D5U2ILHImPBzRZwAp5oxybCf5wqbclA=",
+    "hash": "sha256-DWMa48u6D9lT6xtcYOQxWyHfMwFvI+iYufKoXgQJmC0=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.233.1",
+    "rev": "v1.234.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wcuB0GpsrVajguxa6FQ7jELVdgpZ0chazUKeH0ElVMo="
+    "vendorHash": "sha256-iUu/SG4VprmEuYo6e8az5GARJhJWHyvyyJNSapnpWME="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",

pkgs/applications/science/physics/crystfel/default.nix

@@ -86,19 +86,18 @@ let
       src =
         if stdenv.hostPlatform.isDarwin then
           fetchurl {
-            url = "https://www.mrc-lmb.cam.ac.uk/mosflm/mosflm/ver${
+            url = "https://www.mrc-lmb.cam.ac.uk/harry/imosflm/ver${
               builtins.replaceStrings [ "." ] [ "" ] version
-            }/pre-built/mosflm-osx-64-noX11.zip";
-            sha256 = "1da5wimv3kl8bccp49j69vh8gi28cn7axg59lrmb38s68c618h7j";
+            }/downloads/mosflm-${version}-osx-64.zip";
+            hash = "sha256-0sXgA3zSIjhy9+zTiv+K/51yZsIgGorMtKVjdRjW+AM=";
           }
         else
           fetchurl {
-            url = "https://www.mrc-lmb.cam.ac.uk/mosflm/mosflm/ver${
+            url = "https://www.mrc-lmb.cam.ac.uk/harry/imosflm/ver${
               builtins.replaceStrings [ "." ] [ "" ] version
-            }/pre-built/mosflm-linux-64-noX11.zip";
-            hash = "sha256:1f2qins5kaz5v6mkaclncqpirx3mlz177ywm13py9p6s9mk99g32";
+            }/downloads/imosflm-${version}-linux-64.zip";
+            hash = "sha256-2we0K09W31LKgn9SHLGti50EA/zhbX+CWWuQGCSKW18=";
           };
-      mosflmBinary = if stdenv.hostPlatform.isDarwin then "bin/mosflm" else "mosflm-linux-64-noX11";
     in
     stdenv.mkDerivation {
       pname = "mosflm";
@@ -112,13 +111,11 @@ let
         makeWrapper
       ];
 
-      sourceRoot = ".";
-
       # mosflm statically links against its own libccp4, which as the syminfo.lib environment variable problem.
       # Here, we circumvent it by creating a little wrapper script that calls mosflm after setting the SYMINFO variable.
       installPhase = ''
         mkdir -p $out/bin
-        cp ${mosflmBinary} $out/bin/mosflm-raw
+        cp bin/mosflm $out/bin/mosflm-raw
         makeWrapper $out/bin/mosflm-raw $out/bin/mosflm --set SYMINFO ${libccp4}/share/syminfo.lib --add-flags -n
       '';
     };

pkgs/build-support/trivial-builders/default.nix

@@ -109,6 +109,7 @@ rec {
       allowSubstitutes ? false,
       preferLocalBuild ? true,
       derivationArgs ? { },
+      pos ? builtins.unsafeGetAttrPos "name" args,
     }@args:
     assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
       destination must be an absolute path, relative to the derivation's out path,
@@ -123,8 +124,8 @@ rec {
     runCommand name
       (
         {
-          pos = builtins.unsafeGetAttrPos "name" args;
           inherit
+            pos
             text
             executable
             checkPhase
@@ -261,6 +262,7 @@ rec {
       inheritPath ? true,
     }@args:
     writeTextFile {
+      pos = builtins.unsafeGetAttrPos "name" args;
       inherit
         name
         meta

pkgs/by-name/ac/actual-server/package.nix

@@ -130,7 +130,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit (finalAttrs) offlineCache;
+    inherit translations;
     tests = nixosTests.actual;
+    updateScript = ./update.sh;
   };
 
   meta = {

pkgs/by-name/ac/actual-server/update.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts coreutils git jq nix-prefetch-github yarn-berry.yarn-berry-fetcher
+
+set -o errexit -o nounset -o pipefail
+
+package="actual-server"
+owner="actualbudget"
+repo="actual"
+translations_repo="translations"
+package_dir="pkgs/by-name/${package::2}/${package}"
+
+#
+# package
+#
+
+current_version=$(nix-instantiate --eval --expr "with import ./. {}; ${package}.version" --raw)
+echo "Current version: ${current_version}"
+
+latest_version=$(list-git-tags --url="https://github.com/${owner}/${repo}" | grep -oP '^v\K[0-9.]+$' | sort --version-sort | tail --lines=1)
+echo "Latest version: ${latest_version}"
+
+if [[ "${current_version}" == "${latest_version}" ]]; then
+  echo "${package} is up to date: ${current_version}"
+  exit 0
+fi
+
+echo "Updating ${package} from ${current_version} to ${latest_version}…"
+
+update-source-version "${package}" "${latest_version}"
+
+#
+# translations
+#
+
+echo "Updating translations repo"
+old_translations_rev=$(nix-instantiate --eval --expr "with import ./. {}; ${package}.translations.rev" --raw)
+old_translations_hash=$(nix-instantiate --eval --expr "with import ./. {}; ${package}.translations.outputHash" --raw)
+
+translations_rev=$(git ls-remote "https://github.com/${owner}/${translations_repo}" HEAD | cut -f1)
+echo "Latest translations rev: ${translations_rev}"
+
+translations_hash=$(nix-prefetch-github --json --rev "${translations_rev}" "${owner}" "${translations_repo}" | jq --raw-output .hash)
+echo "Translations hash: ${translations_hash}"
+
+sed -i "s|${old_translations_rev}|${translations_rev}|" "${package_dir}/package.nix"
+sed -i "s|${old_translations_hash}|${translations_hash}|" "${package_dir}/package.nix"
+
+#
+# yarn deps
+#
+
+echo "Regenerating missing-hashes.json…"
+src_path=$(nix-build --attr "${package}.src" --no-link)
+yarn-berry-fetcher missing-hashes "${src_path}/yarn.lock" >"${package_dir}/missing-hashes.json"
+
+echo "Updating offline cache hash…"
+update-source-version "${package}" --ignore-same-version --source-key=offlineCache
+
+echo "Done."

pkgs/by-name/ai/airgorah/package.nix

@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   postInstall = ''
-    install -Dm644 icons/app_icon.png $out/share/icons/hicolor/1024x1024/apps/airgorah.png
+    install -Dm644 icons/app_icon.png $out/share/icons/airgorah.png
   '';
 
   desktopItems = [

pkgs/by-name/al/alisthelper/package.nix

@@ -7,7 +7,6 @@
   makeDesktopItem,
   runCommand,
   yq-go,
-  imagemagick,
   _experimental-update-script-combinators,
   nix-update-script,
 }:
@@ -26,7 +25,6 @@ flutter341.buildFlutterApplication (finalAttrs: {
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
   nativeBuildInputs = [
-    imagemagick
     copyDesktopItems
   ];
 
@@ -47,8 +45,7 @@ flutter341.buildFlutterApplication (finalAttrs: {
   ];
 
   postInstall = ''
-    mkdir -p $out/share/icons/hicolor/1024x1024/apps
-    magick assets/alisthelper.png -resize 1024x1024 $out/share/icons/hicolor/1024x1024/apps/alisthelper.png
+    install -D assets/alisthelper.png $out/share/icons/alisthelper.png
   '';
 
   passthru = {

pkgs/by-name/am/amp-cli/package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1775463997-ga80857"
+        "@sourcegraph/amp": "^0.0.1776125492-g5cb0c2"
       }
     },
     "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1775463997-ga80857",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1775463997-ga80857.tgz",
-      "integrity": "sha512-tQuoo8sh6z6JHyySL9/z/WJbWIZ2PdOxvhB4XMbAVbxs2W32arrDRLY/5iAHbtqsNqz7SXRVrHoQ/yMGre/Trw==",
+      "version": "0.0.1776125492-g5cb0c2",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1776125492-g5cb0c2.tgz",
+      "integrity": "sha512-LdicFMcgJLNrKAF5diTbOLykdb7znsFohcyGiZInpHl6xGyRyJdyqdeh7VdRSfP4vR5EQGIsi7+i1nQOs6ViDQ==",
       "license": "Amp Commercial License",
       "dependencies": {
         "@napi-rs/keyring": "1.1.10"

pkgs/by-name/am/amp-cli/package.nix

@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1775463997-ga80857";
+  version = "0.0.1776125492-g5cb0c2";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-H74L/t0gGjn6m3UeZo8Ln1CEgRYZcKXO+I7O8VO7bL4=";
+    hash = "sha256-EXS32qGU+/SD5MqjXO10GRH0w8EvvP9OqCCfEQfV8Kg=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-tC28yduzwyJrzJbttMW0XLNxiv5dfS5dMiVyfY8J85Q=";
+  npmDepsHash = "sha256-YT92XzPl1fnJ2a7XdjAe1+01gTeWWJ20Ca5uiLVL+Q4=";
 
   propagatedBuildInputs = [
     ripgrep

pkgs/by-name/au/audion/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "audion";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "audiusGmbH";
     repo = "audion";
     tag = finalAttrs.version;
-    hash = "sha256-NtAzh7n5bJXMt73L+FJU3vuNoNgga3wYXdZ2TY8AjIA=";
+    hash = "sha256-r/ZJ9c2PEl8/AhMlsQaHkVQ9uv5R/qEW66rLSJRGxQk=";
   };
 
-  cargoHash = "sha256-kIrbHt6aAUgdF4Jx/aUOYpiBj1+pyFLCVak6R+JN2Ug=";
+  cargoHash = "sha256-f+O/McbMnufNERpZgb8K2CiTeTPXqnX+kJd57zQu474=";
 
   meta = {
     description = "Ping the host continuously and write results to a file";

pkgs/by-name/au/auth0-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "auth0-cli";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FqMfnousaJg0u8W3o2lR8REIGFThq3vhsQFN1Je65Q8=";
+    hash = "sha256-RAfDCYDTlinx4mxmpTqOtAMmNG7G9E8XqYYVfkhwCpY=";
   };
 
-  vendorHash = "sha256-PrcGZ1UJb9fsp7ZsAAxH5VzumDwn/mkyoKVvniuPQrg=";
+  vendorHash = "sha256-OICMv7yAkY2OQu++HKfowcuvmISeLk3HzrYygW8EPbI=";
 
   ldflags = [
     "-s"

pkgs/by-name/au/autodiff/package.nix

@@ -19,6 +19,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-hKIufS5o5tfsbVchwTJxms1n5Im1iTfY3KGWD1s5g9M=";
   };
 
+  # BUILD file exists and darwin can't deal with case insensitive collisions
+  preConfigure = ''
+    cmakeBuildDir=alt_build
+  '';
+
   nativeBuildInputs = [
     cmake
     eigen

pkgs/by-name/aw/aws-vault/package.nix

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.9.14";
+  version = "7.9.15";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-L3WJtS94EYgNqgwM2Gzayx89l2aKHkjaGNwOtfJMk3o=";
+    hash = "sha256-kDzFiuzSyxNyJnj3nechenhvm4bg+fSif+D+/stdTyo=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-axxV3XCxZVY3UM0yzC2ziTO0cbwJiNnDkOKAQADKUKA=";
+  vendorHash = "sha256-92k0E4zCKgWyCAvXWU49dFaYuiTByYNAWxdTYDeTzoE=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/az/azuredatastudio/package.nix

@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -D ${targetPath}/resources/app/resources/linux/code.png $out/share/icons/hicolor/1024x1024/apps/azuredatastudio.png
+    install -D ${targetPath}/resources/app/resources/linux/code.png $out/share/icons/azuredatastudio.png
 
     runHook postInstall
   '';

pkgs/by-name/ba/badlion-client/package.nix

@@ -23,7 +23,7 @@ appimageTools.wrapAppImage rec {
 
   extraInstallCommands = ''
     install -Dm444 ${src}/BadlionClient.desktop $out/share/applications/BadlionClient.desktop
-    install -Dm444 ${src}/BadlionClient.png -t $out/share/icons/hicolor/1024x1024/apps
+    install -Dm444 ${src}/BadlionClient.png -t $out/share/icons
     substituteInPlace $out/share/applications/BadlionClient.desktop \
       --replace-fail "Exec=AppRun --no-sandbox %U" "Exec=badlion-client"
     wrapProgram $out/bin/badlion-client \

pkgs/by-name/bd/bdf2psf/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bdf2psf";
-  version = "1.246";
+  version = "1.247";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${finalAttrs.version}_all.deb";
-    sha256 = "sha256-mfg5Ml3jnzCgyzWER592nH9F2lD7PToFWlIAsEFQ++o=";
+    sha256 = "sha256-56JC3wJZz80nGXn/YywWZ4wXiR1h+X//Y72qfLyPtyE=";
   };
 
   nativeBuildInputs = [ dpkg ];

pkgs/by-name/be/beads/package.nix

@@ -2,25 +2,28 @@
   lib,
   stdenv,
   buildGoModule,
+  dolt,
   fetchFromGitHub,
   gitMinimal,
+  icu,
   installShellFiles,
+  makeBinaryWrapper,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "beads";
-  version = "0.42.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    owner = "steveyegge";
+    owner = "gastownhall";
     repo = "beads";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3t+pm7vuFj3PH1oCJ/AnwbGupqleimNQnP2bRSBHrSg=";
+    hash = "sha256-D2jShGpkOWKx9aRmRvV5bmV8t0/Y2eAE8q0m54QrRN0=";
   };
 
-  vendorHash = "sha256-ovG0EWQFtifHF5leEQTFvTjGvc+yiAjpAaqaV0OklgE=";
+  vendorHash = "sha256-7DJgqJX2HDa9gcGD8fLNHLIXvGAEivYeDYx3snCUyCE=";
 
   subPackages = [ "cmd/bd" ];
 
@@ -29,23 +32,46 @@ buildGoModule (finalAttrs: {
     "-w"
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  buildInputs = [
+    icu
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
 
   nativeCheckInputs = [
     gitMinimal
     writableTmpDirAsHomeHook
   ];
 
-  # Skip security tests on Darwin - they check for /etc/passwd which isn't available in sandbox
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-skip=TestCleanupMergeArtifacts_CommandInjectionPrevention"
-  ];
+  # Workaround for: panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
+  # ref: https://github.com/NixOS/nix/pull/1646
+  __darwinAllowLocalNetworking = true;
+
+  checkFlags =
+    let
+      skippedTests = [
+        # Upstream test bug: version gap 0.55.0->1.0.0 triggers "very old" warning instead of expected "ok"
+        "TestCheckMetadataVersionTracking"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        # Checks for /etc/passwd which isn't available in sandbox
+        "TestCleanupMergeArtifacts_CommandInjectionPrevention"
+      ];
+    in
+    [ "-skip=^(${lib.concatStringsSep "|" skippedTests})$" ];
 
   preCheck = ''
     export PATH="$out/bin:$PATH"
   '';
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  postInstall = ''
+    wrapProgram $out/bin/bd \
+      --prefix PATH : ${lib.makeBinPath [ dolt ]}
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd bd \
       --bash <($out/bin/bd completion bash) \
       --fish <($out/bin/bd completion fish) \
@@ -61,9 +87,12 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Lightweight memory system for AI coding agents with graph-based issue tracking";
-    homepage = "https://github.com/steveyegge/beads";
+    homepage = "https://github.com/gastownhall/beads";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kedry ];
+    maintainers = with lib.maintainers; [
+      kedry
+      imcvampire
+    ];
     mainProgram = "bd";
   };
 })

pkgs/by-name/bl/blackvoxel/package.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postInstall = ''
-    install -Dm644 blackvoxel.png $out/share/icons/hicolor/1024x1024/apps/blackvoxel.png
+    install -Dm644 blackvoxel.png $out/share/icons/blackvoxel.png
   '';
 
   desktopItems = [

pkgs/by-name/bl/bluemail/package.nix

@@ -92,8 +92,8 @@ stdenv.mkDerivation rec {
     mv * $out/opt/bluemail
     ln -s $out/opt/bluemail/bluemail $out/bin/bluemail
 
-    mkdir -p $out/share/icons/hicolor/1024x1024/apps
-    ln -s $out/opt/bluemail/resources/assets/icons/bluemailx-icon.png $out/share/icons/hicolor/1024x1024/apps/bluemail.png
+    mkdir -p $out/share/icons
+    ln -s $out/opt/bluemail/resources/assets/icons/bluemailx-icon.png $out/share/icons/bluemail.png
 
     runHook postInstall
   '';

pkgs/by-name/bo/bombsquad/package.nix

@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
       --add-flags ${lib.escapeShellArg commandLineArgs} \
       --add-flags "-d $out/share/bombsquad"
 
-    install -Dm755 ${bombsquadIcon} $out/share/icons/hicolor/1024x1024/apps/bombsquad.png
+    install -Dm755 ${bombsquadIcon} $out/share/icons/bombsquad.png
 
     runHook postInstall
   '';

pkgs/by-name/bu/build2-bootstrap/package.nix

@@ -4,6 +4,7 @@
   fetchurl,
   buildPackages,
   fixDarwinDylibNames,
+  fetchpatch,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "build2-bootstrap";
@@ -15,6 +16,12 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Pick up sysdirs from NIX_LDFLAGS
     ./nix-ldflags-sysdirs.patch
+    # Fix build on newer clang/libcpp
+    (fetchpatch {
+      name = "new-libcpp-fix.patch";
+      url = "https://github.com/build2/build2/commit/7cf9cece1d88cd1be283ab309f9a851bd02b43d0.patch";
+      hash = "sha256-PTo1C6Aa1L9fvjiJ08KtGgVqHMw2ZlW5LSKoripL22g=";
+    })
   ];
 
   sourceRoot = "build2-toolchain-${finalAttrs.version}/build2";

pkgs/by-name/ca/cardpeek/package.nix

@@ -25,7 +25,14 @@ stdenv.mkDerivation {
     sha256 = "1ighpl7nvcvwnsd6r5h5n9p95kclwrq99hq7bry7s53yr57l6588";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = ''
+    # gcc15
+    substituteInPlace lua_nodes.c \
+      --replace-fail "ui_update(1)" "ui_update()"
+    substituteInPlace ui/gtk/gui_cardview.c \
+      --replace-fail "ui_update(0)" "ui_update()"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # replace xcode check and hard-coded PCSC framework path
     substituteInPlace configure.ac \
       --replace-fail 'if test ! -e "/Applications/Xcode.app/"; then' 'if test yes != yes; then' \

pkgs/by-name/ca/cargo-machete/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-machete";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "bnjbvr";
     repo = "cargo-machete";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4tzffZeHdhAq6/K1BGkThqT+CBa3rUw+kR7aLwnqZjc=";
+    hash = "sha256-vC7Oj42GU7YlNtP+TUp+4LH2gxGk55RZ5cOLRaiEQ3w=";
   };
 
-  cargoHash = "sha256-ahTvfxYYo3prPKDTalw2f2FPJLsPzGkE/2LCcyuniFY=";
+  cargoHash = "sha256-cmOMWJOSJxhjXVdwVdDnTORJRSZcQ8kdDUTJaIy8dbk=";
 
   # tests require internet access
   doCheck = false;

pkgs/by-name/cg/cgtcalc/package.nix

@@ -45,7 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/NixOS/nixpkgs/issues/379859
   doCheck = false;
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "UK capital gains tax calculator written in Swift";

pkgs/by-name/ch/cherry-studio/package.nix

@@ -139,7 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
       else
         "cp -r dist/linux-unpacked/{resources,LICENSE*} $out/opt/cherry-studio"
     }
-    install -Dm644 build/icon.png $out/share/icons/hicolor/1024x1024/apps/cherry-studio.png
+    install -Dm644 build/icon.png $out/share/icons/cherry-studio.png
     makeWrapper ${lib.getExe electron} $out/bin/cherry-studio \
       --inherit-argv0 \
       --add-flags $out/opt/cherry-studio/resources/app.asar \

pkgs/by-name/cl/claude-code-bin/manifest.json

@@ -1,46 +1,46 @@
 {
-  "version": "2.1.107",
-  "buildDate": "2026-04-14T04:25:18Z",
+  "version": "2.1.111",
+  "buildDate": "2026-04-16T14:30:47Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "af95a2929cea1ac50feb32ac76bcaa9bf4791fdd25c3186ad7b514da0788deaf",
-      "size": 202518512
+      "checksum": "2620cc83dbee72c24858b3519ce5de050fef91f0d3d17b309176d61e679f95ee",
+      "size": 203956832
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "cdfae1d314063e17f7a6fbc153bd9f4f6727e565517b5b9453635acf87f028bb",
-      "size": 204016640
+      "checksum": "16d897d570c93b83d100a16a7a33ca3adbd43b1b0f818ab66bef1a364b2460a6",
+      "size": 205442640
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "b3f1d3acde0a247c67a93638208911dd2f676743d16cb3f9bd3987ffb3498a00",
-      "size": 234883648
+      "checksum": "99376866bf7ec367142d3be548c17184a79f30a97318441ee9a00f78e51246e7",
+      "size": 236128832
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "8abe3909c55b3afafa8939d28c2cc2fcf73ba9424a46b4f435bbadda7e0eb00d",
-      "size": 234576512
+      "checksum": "5d4df970040b0f83aac434ae540b409126a4778a379e8c9b4c793560e3bfa060",
+      "size": 235842176
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "2827a84aa631859be0d3a100f97b9549879bb5098bf311caff4f8ed72c282035",
-      "size": 227936704
+      "checksum": "39f1d4b9c328ced97dae1de8ca000769e935e15aaa89f54f4c6663016c834ff5",
+      "size": 228854208
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "2a47436fae6444bedbbf2f34ba3cae11244761bd61c10bcf568078bec4c2caa0",
-      "size": 228891072
+      "checksum": "cb789bbf32c90aa7b658f0cf1cedd7116b45afc5e0438f6fda4af0bac5996c9f",
+      "size": 230107584
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "d8cddb8c37da11a5a68e1cbde922b472974e93b459d1e4270be6d5856592685f",
-      "size": 244154016
+      "checksum": "51024dbcd60382b6fb881b5cda6754a0fe445a90d3ad02eb5f13a2733ac3262e",
+      "size": 245423264
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "ffa590ddd68e10803c6ea708a1a28ecd24dbe2e24c6a245d286f2d266589ae79",
-      "size": 240854688
+      "checksum": "8381c9964a39cb231e4243d5ec7bf0158719fc292de1130f7c0f07e8b3137327",
+      "size": 242154656
     }
   }
 }

pkgs/by-name/cl/claude-code-bin/package.nix

@@ -95,8 +95,9 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
     ];
     maintainers = with lib.maintainers; [
-      xiaoxiangmoe
       mirkolenz
+      oskarwires
+      xiaoxiangmoe
     ];
     mainProgram = "claude";
   };

pkgs/by-name/cl/claude-code/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.1.107",
+  "version": "2.1.111",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.1.107",
+      "version": "2.1.111",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.1.107";
+  version = "2.1.111";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-FpJ7grsXbBJxzbqSZTN6uICd1sGxizMEpHbs1n9yW3s=";
+    hash = "sha256-K3qhZXVJ2DIKv7YL9f/CHkuUYnK0lkIR1wjEa+xeSCk=";
   };
 
-  npmDepsHash = "sha256-OVmbHfANAqNe6QLzQaSH1oZP50InstIW6RmN2crvQJw=";
+  npmDepsHash = "sha256-6f68qUMnDk6tn+qypVi8bPtNrxbtcf15tHrgtlhEaK4=";
 
   strictDeps = true;
 
@@ -81,6 +81,7 @@ buildNpmPackage (finalAttrs: {
       malo
       markus1189
       omarjatoi
+      oskarwires
       xiaoxiangmoe
     ];
     mainProgram = "claude";

pkgs/by-name/cl/clockify/package.nix

@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
     in
     ''
       install -Dm 444 ${appimageContents}/clockify.desktop -t $out/share/applications
-      install -Dm 444 ${appimageContents}/clockify.png -t $out/share/icons/hicolor/1024x1024/apps
+      install -Dm 444 ${appimageContents}/clockify.png -t $out/share/icons
 
       substituteInPlace $out/share/applications/clockify.desktop \
         --replace-fail 'Exec=AppRun' 'Exec=${pname}'

pkgs/by-name/cl/cloud-custodian/package.nix

@@ -20,6 +20,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "docutils"
     "importlib-metadata"
     "referencing"
+    "tabulate"
     "urllib3"
   ];
 

pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-dynamic-dns";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchFromGitHub {
     owner = "zebradil";
     repo = "cloudflare-dynamic-dns";
     tag = finalAttrs.version;
-    hash = "sha256-7KGNLz/VwvICUNJuoeWMEFV+gpbqPATF5xILzcHIk+g=";
+    hash = "sha256-VBBuBZ5J5ioLDzlslNahSwVGJ7RFJLmWs4WWs11SQaI=";
   };
 
-  vendorHash = "sha256-rqp+K5pnslgfwpVxK/Ul3g1MGRKsWl8lpeMsS5Qqk10=";
+  vendorHash = "sha256-UPzv8W18vdeTL/Rx32z5rJVcWHjFlImUKlUb9gt3TTM=";
 
   subPackages = ".";
 

pkgs/by-name/co/colmap/disambiguate-gradientchecker.patch

@@ -1,19 +0,0 @@
-commit a1f0a46b4932ed1c98ceb872e6b346b370f1b638
-Author: Patrick Chilton <chpatrick@gmail.com>
-Date:   Wed Mar 18 15:59:05 2026 +0100
-
-    Disambiguate ceres::GradientChecker constructor
-
-diff --git a/src/colmap/estimators/cost_functions/reprojection_error_test.cc b/src/colmap/estimators/cost_functions/reprojection_error_test.cc
-index 25e6ffdc..7a1e4777 100644
---- a/src/colmap/estimators/cost_functions/reprojection_error_test.cc
-+++ b/src/colmap/estimators/cost_functions/reprojection_error_test.cc
-@@ -106,7 +106,7 @@ TEST(ReprojErrorCostFunctor, AnalyticalVersusAutoDiff) {
- 
-         ceres::NumericDiffOptions numeric_diff_options;
-         ceres::GradientChecker gradient_checker(
--            analytical_cost_function.get(), nullptr, numeric_diff_options);
-+            analytical_cost_function.get(), static_cast<const std::vector<const ceres::Manifold*>*>(nullptr), numeric_diff_options);
-         ceres::GradientChecker::ProbeResults results;
-         EXPECT_TRUE(
-             gradient_checker.Probe(parameter_blocks.data(), kEps, &results));

pkgs/by-name/co/colmap/package.nix

@@ -2,7 +2,8 @@
   lib,
   fetchFromGitHub,
   fetchpatch,
-  gitUpdater,
+  fetchurl,
+  nix-update-script,
   cmake,
   boost,
   ceres-solver,
@@ -31,6 +32,9 @@
   sqlite,
   llvmPackages,
   gtest,
+  curl,
+
+  enableTests ? true,
 }:
 
 assert cudaSupport -> cudaPackages != { };
@@ -65,30 +69,54 @@ let
 
   # TODO: migrate to redist packages
   inherit (cudaPackages) cudatoolkit;
+
+  # COLMAP needs these model files to run the ONNX tests
+  # Based on: https://github.com/colmap/colmap/blob/79efc74b2b614935a3c69b1f983f2bad23a836a1/src/colmap/feature/resources.h#L36
+  modelsForTesting = [
+    {
+      name = "aliked-n16rot.onnx";
+      url = "https://github.com/colmap/colmap/releases/download/3.13.0/aliked-n16rot.onnx";
+      sha256 = "39c423d0a6f03d39ec89d3d1d61853765c2fb6a8b8381376c703e5758778a547";
+    }
+    {
+      name = "aliked-n32.onnx";
+      url = "https://github.com/colmap/colmap/releases/download/3.13.0/aliked-n32.onnx";
+      sha256 = "a077728a02d2de1a775c66df6de8cfeb7c6b51ca57572c64c680131c988c8b3c";
+    }
+    {
+      name = "aliked-lightglue.onnx";
+      url = "https://github.com/colmap/colmap/releases/download/3.13.0/aliked-lightglue.onnx";
+      sha256 = "b9a5de7204648b18a8cf5dcac819f9d30de1a5961ef03756803c8b86c2dceb8d";
+    }
+    {
+      name = "bruteforce-matcher.onnx";
+      url = "https://github.com/colmap/colmap/releases/download/3.13.0/bruteforce-matcher.onnx";
+      sha256 = "3c1282f96d83f5ffc861a873298d08bbe5219f59af59223f5ceab5c41a182a47";
+    }
+    {
+      name = "sift-lightglue.onnx";
+      url = "https://github.com/colmap/colmap/releases/download/3.13.0/sift-lightglue.onnx";
+      sha256 = "e0500228472b43f92b3d36881a09b3310d3b058b56187b246cc7b9ab6429096e";
+    }
+  ];
 in
 stdenv'.mkDerivation {
-  version = "4.0.2";
+  version = "4.0.3";
   pname = "colmap";
   src = fetchFromGitHub {
     owner = "colmap";
     repo = "colmap";
-    rev = "d927f7e518fc20afa33390712c4cc20d85b730b8";
-    hash = "sha256-+cPkksfCLyEo7A70nuRWnOBEkhx8BFevQ9XWTipEkpM=";
+    rev = "e5b4a3e2276fe0cb81c3643d8ffdf124020c372e";
+    hash = "sha256-VV+ROjhrg7bEMV3QU6r4zCcMzC7tAPwTu6gV6/cmiH0=";
   };
 
-  patches = [
-    ./suitesparse-no-include-subdir.patch
-    # Remove when https://github.com/colmap/colmap/pull/4265 is merged
-    ./disambiguate-gradientchecker.patch
-  ];
-
   cmakeFlags = [
-    (lib.cmakeBool "DOWNLOAD_ENABLED" false)
+    (lib.cmakeBool "DOWNLOAD_ENABLED" true) # We want COLMAP to be able to fetch models like LightGlue.
     (lib.cmakeBool "UNINSTALL_ENABLED" false)
     (lib.cmakeBool "FETCH_POSELIB" false)
     (lib.cmakeBool "FETCH_FAISS" false)
     (lib.cmakeBool "FETCH_ONNX" false)
-    (lib.cmakeBool "TESTS_ENABLED" true)
+    (lib.cmakeBool "TESTS_ENABLED" enableTests)
     (lib.cmakeFeature "CHOLMOD_INCLUDE_DIR_HINTS" "${suitesparse.dev}/include")
     (lib.cmakeFeature "CHOLMOD_LIBRARY_DIR_HINTS" "${suitesparse}/lib")
   ]
@@ -114,6 +142,7 @@ stdenv'.mkDerivation {
     gmp
     mpfr
     libsm
+    curl
   ]
   ++ depsAlsoForPycolmap;
 
@@ -126,7 +155,19 @@ stdenv'.mkDerivation {
     autoAddDriverRunpath
   ];
 
+  doCheck = enableTests;
+  preCheck = lib.optionalString enableTests ''
+    export GTEST_FILTER='-*Gpu*:*GPU*:*OpenGL*' # Disable any test involving OpenGL or GPU, these won't work in the sandbox.
+    export HOME=$PWD
+    # Pre-fetch the ONNX models into COLMAP's cache dir so we can run their tests.
+    mkdir -p .cache/colmap
+    ${lib.concatMapStringsSep "\n" (model: ''
+      ln -s ${fetchurl model} .cache/colmap/${model.sha256}-${model.name}
+    '') modelsForTesting}
+  '';
+
   passthru.depsAlsoForPycolmap = depsAlsoForPycolmap;
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Structure-From-Motion and Multi-View Stereo pipeline";

pkgs/by-name/co/colmap/suitesparse-no-include-subdir.patch

@@ -1,22 +0,0 @@
-diff --git a/cmake/FindCHOLMOD.cmake b/cmake/FindCHOLMOD.cmake
-index a5daf0e3..b0f13e3e 100644
---- a/cmake/FindCHOLMOD.cmake
-+++ b/cmake/FindCHOLMOD.cmake
-@@ -57,7 +57,7 @@ if(TARGET CHOLMOD::CHOLMOD)
- else()
-     find_path(CHOLMOD_INCLUDE_DIRS
-         NAMES
--        suitesparse/cholmod.h
-+        cholmod.h
-         PATHS
-         ${CHOLMOD_INCLUDE_DIR_HINTS}
-         /usr/include
-@@ -89,7 +89,7 @@ else()
- 
-     add_library(CHOLMOD::CHOLMOD INTERFACE IMPORTED)
-     target_include_directories(
--        CHOLMOD::CHOLMOD INTERFACE ${CHOLMOD_INCLUDE_DIRS}/suitesparse)
-+        CHOLMOD::CHOLMOD INTERFACE ${CHOLMOD_INCLUDE_DIRS})
-     target_link_libraries(
-         CHOLMOD::CHOLMOD INTERFACE ${CHOLMOD_LIBRARIES})
- endif()

pkgs/by-name/co/corrscope/package.nix

@@ -61,6 +61,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ]
   );
 
+  pythonRelaxDeps = [
+    "ruamel-yaml"
+  ];
+
   dontWrapQtApps = true;
 
   preFixup = ''

pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings.patch

@@ -1,58 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 7c10e63a..052a5852 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1658,7 +1658,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-a11y-manager-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "cosmic-protocols",
-  "iced_futures",
-@@ -1672,7 +1672,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-accessibility-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "cosmic-dbus-a11y",
-  "futures",
-@@ -1685,7 +1685,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-airplane-mode-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1718,7 +1718,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-daemon-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1731,7 +1731,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-network-manager-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "bitflags 2.10.0",
-  "cosmic-dbus-networkmanager",
-@@ -1765,7 +1765,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-upower-subscription"
- version = "1.0.2"
--source = "git+https://github.com/pop-os/cosmic-settings#55b502dff39bf4be056c23888aaad185f9227eb2"
-+source = "git+https://github.com/pop-os/cosmic-settings#b46a55d4237f1fd6e1bacc852ceb053e6a26c2fe"
- dependencies = [
-  "futures",
-  "iced_futures",

pkgs/by-name/co/cosmic-applets/package.nix

@@ -20,25 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-x2FHzgbxxHJEYlCK0bi5j7WdAqAlcocLYW20y2ionBc=";
+    hash = "sha256-+E7d8I9xKaTzJzVlJhPb23ak8M9wgjnB6rwYFdpnjcs=";
   };
 
-  cargoPatches = [
-    # The lockfile references two different revisions of the same internal repository cosmic-settings,
-    # which likely is unintentional and currently causing issues with fetchCargoVendor.
-    # Upstream already resolved this because of a general dependency update, so this can be removed on the
-    # next update.
-    ./dedup-cosmic-settings.patch
-  ];
-
-  cargoHash = "sha256-R9d7slLid3x7NYXkMfcRRa4zY8/RxW+QLMZGsvHdfCw=";
+  cargoHash = "sha256-uxz6kMuxhDTehHxDcA43iO+zVHBofbtO6HZoWEf3E30=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-applibrary/package.nix

@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-sHF5jNY6sAZtWPeIgYjrLlhpSzhfoU21kA0ejWRkf98=";
+    hash = "sha256-+ewcDeRskge8mgGo7b9rf0i0vg+mdR3iwK/LF38UTvM=";
   };
 
-  cargoHash = "sha256-h/LjcSKnmZof4/OFyLDUFWcjn6TiTt8eRAJkj8lUC0Y=";
+  cargoHash = "sha256-Cd4tNG+qXYwCUKIXnE5+LzaCBmRJnDWrI1uGwFiFhWA=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-bg/package.nix

@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-epwCl68NWKgGMUrwIA7ALlOLMTLxyShqfV0ARXsZxrs=";
+    hash = "sha256-f8XVAxxP+RdsVaVKqicZBkZiGXPCMfpP6Z4sBDeoYyo=";
   };
 
   postPatch = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
   '';
 
-  cargoHash = "sha256-BEQQy79s9B0GLr0w2+8N5s24Ko8ikWjRxf8DmLve8kc=";
+  cargoHash = "sha256-ahz/isgQpt48lWQM4V7Y4NwUlyX8+tW9LHNxZJe3SD4=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-comp/package.nix

@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-TGTKUF7rYZ/Koem4rPBFYHatzhhqpWe/1WmAqlY3odg=";
+    hash = "sha256-eFUvLBk+EkemDWJk7A0bd3R0fip31u2zqjmKKVim8Y0=";
   };
 
-  cargoHash = "sha256-MI8cJzjZd2UeWBESu8xEDYQv0Oa4PRhc4pOCN0zDNO4=";
+  cargoHash = "sha256-80xojIrLd8Foxu9Qbf/cCImP4T4I7otA1iJbr7/lEb8=";
 
   separateDebugInfo = true;
 

pkgs/by-name/co/cosmic-edit/package.nix

@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-qmzVc09VFZBS5S/C5JL0OzPnCX5jERXPE8iFycDUj/A=";
+    hash = "sha256-L4OtNqcvXMjQZtt26H+NIh6bzgDoFlyZuViXoG9RdaI=";
   };
 
-  cargoHash = "sha256-VEPahTeBPMx+xoZWRFgmbLLEw8l2QXqr/Sk06gW2Mds=";
+  cargoHash = "sha256-Qs+THwbp6TNcSzO33Y0j/o8WP9E5ti0HCxknOo7h1H0=";
 
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"

pkgs/by-name/co/cosmic-files/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   just,
   libcosmicAppHook,
@@ -13,25 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-KXXNYNGun1stXXzY4OWzOVLrLXAs5g7NNaSYajavDvU=";
+    hash = "sha256-cPnsnn9VLyTFA9htsovboDygt7NEAr9XdrJsP45bE08=";
   };
 
-  cargoHash = "sha256-HMHS6HrOUVnrWbyGi9wadl9++onBNNCRw4r4nohvQzI=";
-
-  patches = [
-    (fetchpatch {
-      # patch for fixing build error introduced in `epoch-1.0.7`
-      url = "https://github.com/pop-os/cosmic-files/commit/49e3d95e7a5e02c279f2be1f1f4dfdba2fb532dc.patch";
-      hash = "sha256-Ohf3K+ehFvIurPOReFDML+wfBvdxCi7Ef3eCoSLnXFM=";
-    })
-  ];
+  cargoHash = "sha256-DB5u0MSdrxYIGcndbyUUeNPuXXN0OScd519XBxB1lLg=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-greeter/package.nix

@@ -15,31 +15,21 @@
   nix-update-script,
   nixosTests,
   orca,
-  fetchpatch2,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-U0JrxvMWzISSA0tP8moasN7iN7TfZreEwbvWZGHRn8E=";
+    hash = "sha256-59t0jKXspmhwnTYPa96tNkYrOuCFZ80g/VJsyrZ0s10=";
   };
 
-  cargoHash = "sha256-J5ycaeKZsEBPcI9JH8bHsOAcXXwcx/D21GlVhJZbGwM=";
-
-  cargoPatches = [
-    (fetchpatch2 {
-      # https://github.com/pop-os/cosmic-greeter/pull/426
-      name = "security-hardening.patch";
-      url = "https://github.com/pop-os/cosmic-greeter/commit/6049b50f8984f98c2c61117d86b9f6f9befc9300.patch?full_index=1";
-      hash = "sha256-T9tc4Krmp5jieKhbaTgI1CByWqSWy97HWcKMIXzr7MU=";
-    })
-  ];
+  cargoHash = "sha256-MZmbwmc1DPCZ9g4OM9gy0IuXgy/zxreujEYY3Ji5Ad8=";
 
   env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 

pkgs/by-name/co/cosmic-icons/package.nix

@@ -9,14 +9,14 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-dLiBao8jvtxxSlENceVkPJNChwEK1Wtf3k5hY97WZoI=";
+    hash = "sha256-h6vnOL3T4o2VDoQ5vLGg3s6nMYcPKysI5RxbjnbnCFI=";
   };
 
   nativeBuildInputs = [ just ];

pkgs/by-name/co/cosmic-idle/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

pkgs/by-name/co/cosmic-initial-setup/package.nix

@@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+yl3MIBNO3G0O4o4Iu1vMkcLW4UMj8mPv9IWCCcqG6s=";
+    hash = "sha256-wq0uqS0gNM4w6E+1pTPU6C8Mx4j8/MNp+0Oiw1kbwck=";
   };
 
   cargoHash = "sha256-Kj+eaTMHMQQHN0X3prIuZm1wvfnaV7BUlUKem6JLtc8=";

pkgs/by-name/co/cosmic-launcher/package.nix

@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.8";
+  version = "1.0.10";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-zrU5wn/DaIJiIri5u40t4etqkyn8ZO9ITTyJQGyqziw=";
+    hash = "sha256-g2j0rh/gNe30DXSjPaGE8HH2aQ0tOW0wimSUt5D08yo=";
   };
 
-  cargoHash = "sha256-o2CyAjUp0E4m5G4SG8vm4RhQzvFsmbgfJDQRRxoyGEg=";
+  cargoHash = "sha256-KsiW+/WYKCfoUJB++ov0FGcmZhew2NjvzkBlcH/Vubw=";
 
   nativeBuildInputs = [
     just