Merge master into staging-nixos

2026-06-05 21:03:40 +00:00 · 2026-04-26 12:17:21 +00:00
parent 5ca45da0d6 1c8355b14e
commit bc33d9febb
60 changed files with 1791 additions and 1485 deletions
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -93,7 +93,7 @@ there are 3 steps: frontend dependencies (javascript), backend dependencies (eli

 ##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}

-For phoenix projects, inside of Nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+For phoenix projects, inside of Nixpkgs you can either use `fetchYarnDeps` or `buildNpmPackage`. An example with `fetchYarnDeps` can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix). An example with `fetchYarnDeps` will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)

 ##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}

--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -89,6 +89,7 @@ Exceptions to this rule are:
 Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
 The node_modules abstraction can be also used to build some web framework frontends.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
 Then when building the frontend you can just symlink the node_modules directory.

 ## Tool-specific instructions {#javascript-tool-specific}
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -278,6 +278,21 @@ rec {
      attr ? ${name} && !(hasPrefix "@" attr.${name})
    ) "Systemd ${group} field `${name}' is not a systemd credential";

+  assertRouteMetricOrTriple =
+    name: group: attr:
+    let
+      isMetric = n: 0 <= n && 4294967295 >= n;
+
+      parts = splitString ":" attr.${name};
+      partsValid =
+        length parts == 3 && all (p: (match "[0-9]+" p) != null && isMetric (toIntBase10 p)) parts;
+      valid = (isInt attr.${name} && isMetric attr.${name}) || partsValid;
+    in
+    optional (attr ? ${name} && !valid) (
+      "Systemd ${group} field `${name}' must either be an integer in the range [0,4294967295]"
+      + " or a string containing three integers separated with `:`"
+    );
+
  checkUnitConfig =
    group: checks: attrs:
    let
--- a/nixos/modules/installer/cd-dvd/channel.nix
+++ b/nixos/modules/installer/cd-dvd/channel.nix
@@ -92,7 +92,7 @@ in
            -i ${channelSources} --quiet --option build-use-substitutes false \
            ${lib.optionalString config.boot.initrd.systemd.enable "--option sandbox false"} # There's an issue with pivot_root
          mkdir -m 0700 -p /root/.nix-defexpr
-          ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
+          ln -sfvT /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
          mkdir -m 0755 -p /var/lib/nixos
          touch /var/lib/nixos/did-channel-init
        fi
--- a/nixos/modules/system/boot/loader/limine/limine.nix
+++ b/nixos/modules/system/boot/loader/limine/limine.nix
@@ -455,6 +455,10 @@ in
          assertion = cfg.efiSupport;
          message = "Secure boot is only supported on EFI systems.";
        }
+        {
+          assertion = !cfg.enableEditor;
+          message = "Editor is unconditionally disabled by Limine.";
+        }
      ];

      boot.loader.limine.enrollConfig = true;
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -610,6 +610,17 @@ let
    )
  );

+  systemdStage1HardwareKeyAssertionMessage = opt: ''
+    ${opt} is deprecated, and it is unsupported with systemd stage 1. Support will be removed in 26.11 along with scripted stage 1. Hardware keys in systemd stage 1 are supported with systemd-cryptsetup(8). To migrate, enroll a key in a LUKS slot with systemd-cryptenroll(1). Usually, systemd will automatically detect the configuration at runtime, but if necessary, configure the corresponding crypttab(5) options with boot.initrd.luks.devices.<name>.crypttabExtraOpts.
+
+    Note: After migrating to a new LUKS slot, the old LUKS slot used for the scripted stage 1 implementation should be removed, otherwise it could interfere with falling back to a passphrase prompt in the event the hardware key fails.
+
+    See:
+    - https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup.html
+    - https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html
+    - https://www.freedesktop.org/software/systemd/man/crypttab.html
+  '';
+
 in
 {
  imports = [
@@ -1106,21 +1117,16 @@ in
      # TODO
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.gpgSupport;
-        message = "systemd stage 1 does not support GPG smartcards yet.";
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.gpgSupport";
      }
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.fido2Support;
-        message = ''
-          systemd stage 1 does not support configuring FIDO2 unlocking through `boot.initrd.luks.fido2Support`.
-          Use systemd-cryptenroll(1) to configure FIDO2 support, and set
-          `boot.initrd.luks.devices.''${DEVICE}.crypttabExtraOpts` as appropriate per crypttab(5)
-          (e.g. `fido2-device=auto`).
-        '';
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.fido2Support";
      }
      # TODO
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.yubikeySupport;
-        message = "systemd stage 1 does not support Yubikeys yet.";
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.yubikeySupport";
      }
    ];

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -1744,8 +1744,7 @@ let
        (assertValueOneOf "UseDNR" boolValues)
        (assertValueOneOf "UseDomains" (boolValues ++ [ "route" ]))
        (assertRange "RouteTable" 0 4294967295)
-        (assertInt "RouteMetric")
-        (assertRange "RouteMetric" 0 4294967295)
+        (assertRouteMetricOrTriple "RouteMetric")
        (assertValueOneOf "QuickAck" boolValues)
        (assertValueOneOf "UseMTU" boolValues)
        (assertValueOneOf "UseHopLimit" boolValues)
--- a/nixos/tests/incus/default.nix
+++ b/nixos/tests/incus/default.nix
@@ -45,6 +45,15 @@ in
    };
  };

+  channel = incusRunTest {
+    name = "channel";
+
+    instances.c1 = {
+      type = "container";
+      copyChannel = true;
+    };
+  };
+
  # used in lxc tests to verify container functionality
  container = incusRunTest {
    name = "container";
--- a/nixos/tests/incus/incus-tests-module.nix
+++ b/nixos/tests/incus/incus-tests-module.nix
@@ -60,6 +60,11 @@ in
                default = { };
              };

+              copyChannel = lib.mkEnableOption ''
+                copy channel in test image. disabled by default as it forces image
+                rebuilds excessively. enable to validate channel things.
+              '';
+
              testScript = lib.mkOption {
                type = lib.types.str;
                description = "final script provided to test runner";
@@ -104,7 +109,7 @@ in
                  documentation.enable = lib.mkForce false;
                  documentation.nixos.enable = lib.mkForce false;
                  # including a channel forces images to be rebuilt on any changes
-                  system.installer.channel.enable = lib.mkForce false;
+                  system.installer.channel.enable = lib.mkForce config.copyChannel;

                  environment.etc."nix/registry.json".text = lib.mkForce "{}";

@@ -170,64 +175,67 @@ in
                #
                # container specific
                #
-                +
-                  lib.optionalString (config.type == "container")
-                    # python
-                    ''
-                      with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
-                          # Remove /sbin/init so we can verify installBootLoader recreates it
-                          server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
-                          server.fail(f"incus exec {instance_name} -- test -e /sbin/init")
+                + lib.optionalString (config.type == "container") (
+                  # python
+                  ''
+                    with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
+                        # Remove /sbin/init so we can verify installBootLoader recreates it
+                        server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
+                        server.fail(f"incus exec {instance_name} -- test -e /sbin/init")

-                          server.succeed(
-                              f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
-                          )
+                        server.succeed(
+                            f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
+                        )

-                          # Verify installBootLoader recreated /sbin/init pointing to the system's init
-                          server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
-                          target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
-                          current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
-                          assert target == current, f"/sbin/init -> {target}, expected {current}"
+                        # Verify installBootLoader recreated /sbin/init pointing to the system's init
+                        server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
+                        target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
+                        current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
+                        assert target == current, f"/sbin/init -> {target}, expected {current}"

-                      # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
-                      with subtest("[${image_id}] memory limits can be hotplug changed"):
-                          server.set_instance_config(instance_name, "limits.memory 512MB")
-                          # can't use lsmem since it sees the host's memory size
-                          server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)
+                    # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
+                    with subtest("[${image_id}] memory limits can be hotplug changed"):
+                        server.set_instance_config(instance_name, "limits.memory 512MB")
+                        # can't use lsmem since it sees the host's memory size
+                        server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)

-                      # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
-                      with subtest("[${image_id}] lxc-generator compatibility"):
-                          with subtest("[${image_id}] lxc-container generator configures plain container"):
-                              # default container is plain
-                              server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                    # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
+                    with subtest("[${image_id}] lxc-generator compatibility"):
+                        with subtest("[${image_id}] lxc-container generator configures plain container"):
+                            # default container is plain
+                            server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")

-                              server.check_instance_sysctl(instance_name)
+                            server.check_instance_sysctl(instance_name)

-                          with subtest("[${image_id}] lxc-container generator configures nested container"):
-                              server.set_instance_config(instance_name, "security.nesting=true", restart=True)
+                        with subtest("[${image_id}] lxc-container generator configures nested container"):
+                            server.set_instance_config(instance_name, "security.nesting=true", restart=True)

-                              server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
-                              target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
-                              assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
+                            server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                            target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
+                            assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"

-                              server.check_instance_sysctl(instance_name)
+                            server.check_instance_sysctl(instance_name)

-                      with subtest("[${image_id}] lxcfs"):
-                          with subtest("[${image_id}] mounts lxcfs overlays"):
-                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
-                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
+                    with subtest("[${image_id}] lxcfs"):
+                        with subtest("[${image_id}] mounts lxcfs overlays"):
+                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
+                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")

-                          with subtest("[${image_id}] supports per-instance lxcfs"):
-                              server.succeed(f"incus stop {instance_name}")
-                              server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                        with subtest("[${image_id}] supports per-instance lxcfs"):
+                            server.succeed(f"incus stop {instance_name}")
+                            server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")

-                              server.succeed("incus config set instances.lxcfs.per_instance=true")
-
-                              server.succeed(f"incus start {instance_name}")
-                              server.wait_for_instance(instance_name)
-                              server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
-                    ''
+                            server.succeed("incus config set instances.lxcfs.per_instance=true")

+                            server.succeed(f"incus start {instance_name}")
+                            server.wait_for_instance(instance_name)
+                            server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                  ''
+                  + lib.optionalString (config.copyChannel) ''
+                    with subtest("[${image_id}] channel copied correctly"):
+                        server.succeed(f"incus exec {instance_name} -- systemctl status nix-channel-init.service")
+                  ''
+                )
                #
                # virtual-machine specific
                #
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7306,6 +7306,32 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  isabelle-lsp-nvim = buildVimPlugin {
+    pname = "isabelle-lsp.nvim";
+    version = "0-unstable-2025-12-02";
+    src = fetchFromGitHub {
+      owner = "Treeniks";
+      repo = "isabelle-lsp.nvim";
+      rev = "3601b59d77cc4998de29f966ded7d4d959318be2";
+      hash = "sha256-2SijIavooMFft9S/fMcH/YE77wctAP0Oneg/YAR9+LM=";
+    };
+    meta.homepage = "https://github.com/Treeniks/isabelle-lsp.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
+  isabelle-syn-nvim = buildVimPlugin {
+    pname = "isabelle-syn.nvim";
+    version = "0-unstable-2024-05-15";
+    src = fetchFromGitHub {
+      owner = "Treeniks";
+      repo = "isabelle-syn.nvim";
+      rev = "114b06dc34edf1707be7249b5a3815733e68d4c9";
+      hash = "sha256-f04jyExUwos9w89IeKbRdRMtWIsQYe0McAUoijq7mCA=";
+    };
+    meta.homepage = "https://github.com/Treeniks/isabelle-syn.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  iswap-nvim = buildVimPlugin {
    pname = "iswap.nvim";
    version = "0-unstable-2026-03-25";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -560,6 +560,8 @@ https://github.com/ajbucci/ipynb.nvim/,,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,,
 https://github.com/haya14busa/is.vim/,,
+https://github.com/Treeniks/isabelle-lsp.nvim/,,
+https://github.com/Treeniks/isabelle-syn.nvim/,,
 https://github.com/mizlan/iswap.nvim/,,
 https://github.com/vim-scripts/jdaddy.vim/,,
 https://github.com/mahyarmirrashed/jdd.nvim/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3861,8 +3861,8 @@ let
        mktplcRef = {
          name = "ansible";
          publisher = "redhat";
-          version = "26.4.2";
-          hash = "sha256-mSsCeUMEmLkEuxQIBQZaVzOpOwZ7b4SaiPwOJdVuIJk=";
+          version = "26.4.4";
+          hash = "sha256-fBwehxNmePQuM+kJ4cigVQCZ9UqBlBcT6+xD/gDCv64=";
        };
        meta = {
          description = "Ansible language support";
--- a/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "windows-ai-studio";
    publisher = "ms-windows-ai-studio";
-    version = "0.34.0";
-    hash = "sha256-yOBUkFNE/6Gy675J3/PbrfkvKgJdgQVRcSEnd7rCtlU=";
+    version = "1.0.0";
+    hash = "sha256-bpq4q/ZEk75NBiwP1VUtTCV2xHed38+CiSKNkT/ClWk=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/fbalpha2012.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbalpha2012.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore rec {
  core = "fbalpha2012";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbalpha2012";
-    rev = "15af60bf24e3dc2267a38e3c8532450ebec86317";
-    hash = "sha256-7QfDk/j7akaORSekdx96mcDgsFp+kAq1/Cxtu3uPe4A=";
+    rev = "95fa35582b1ca7ce68de3313615794c8c9d8d7c0";
+    hash = "sha256-9F970HETDJsttoQOlqg2dFMzff/drR7G8MxXaSlWTHI=";
  };

  sourceRoot = "${src.name}/svn-current/trunk";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1310,11 +1310,11 @@
    "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-tbXhMSoZ9e3md+M8Vtt/m0oPyCjFpGcJXZw49A/UFwI=",
+    "hash": "sha256-vngfpLrxer7DQN6Gtapfaw1GMUF2/uGC+xcLvhN5pWI=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.88",
+    "rev": "v1.82.89",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1499,12 +1499,12 @@
    "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
  },
  "yandex-cloud_yandex": {
-    "hash": "sha256-xRpxl65jB4pqMM7pf7SWF7XRvqhgTV3kYWx7sxAQj/A=",
+    "hash": "sha256-EtY2Z/dBtyNvOk8T+iEXduEPiB5IqW/eYA4u7llTYAc=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "repo": "terraform-provider-yandex",
-    "rev": "v0.199.0",
+    "rev": "v0.201.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-76prUN1Qv5sP0tDj5bwnyt6KFl+aeY36wsWhLF4sWE8="
+    "vendorHash": "sha256-Mdyu8GSENgU1+8Lc2iAizZ1tJq2t9Zdh7qRPtwV94XY="
  }
 }
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
--- a/pkgs/build-support/node/fetch-yarn-deps/common.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/common.js
@@ -1,7 +1,5 @@
 const path = require('path')

-// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
-// so that fixup_yarn_lock produces the same paths
 const urlToName = url => {
  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')

--- a/pkgs/by-name/am/amiberry/package.nix
+++ b/pkgs/by-name/am/amiberry/package.nix
@@ -2,112 +2,57 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  cmake,
-  copyDesktopItems,
-  makeWrapper,
+  curl,
+  enet,
  flac,
+  libGL,
  libmpeg2,
  libmpg123,
+  libpcap,
  libpng,
  libserialport,
+  nlohmann_json,
  portmidi,
-  SDL2,
-  SDL2_image,
-  SDL2_ttf,
-  makeDesktopItem,
+  sdl3,
+  sdl3-image,
+  zstd,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "amiberry";
-  version = "5.7.4";
+  version = "8.1.5";

  src = fetchFromGitHub {
    owner = "BlitterStudio";
    repo = "amiberry";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EOoVJYefX2pQ2Zz9bLD1RS47u/+7ZWTMwZYha0juF64=";
+    hash = "sha256-udSMQxpELpk3Shu3+weHA9S0i/WMdVnrOuLGZ0whEEI=";
  };

-  patches = [
-    # cmake-4 support
-    (fetchpatch {
-      name = "cmake-4.patch";
-      url = "https://github.com/BlitterStudio/amiberry/commit/dbd85a37147603875b9ca51a9409c65a26c0d60a.patch?full_index=1";
-      hash = "sha256-w8Z9yhNafbXWv3nV8GDNpks2R1+M12uG1mWWrwVaEUk=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
-    copyDesktopItems
-    makeWrapper
  ];

  buildInputs = [
+    curl
+    enet
    flac
+    libGL
    libmpeg2
    libmpg123
+    libpcap
    libpng
    libserialport
+    nlohmann_json
    portmidi
-    SDL2
-    SDL2_image
-    SDL2_ttf
+    sdl3
+    sdl3-image
+    zstd
  ];

  enableParallelBuilding = true;

-  # Amiberry has traditionally behaved as a "Portable" app, meaning that it was designed to expect everything
-  # under the same directory. This is not compatible with Nix package conventions.
-  # The Amiberry behavior has changed since versions 5.7.4 and 6.3.4 (see
-  # https://github.com/BlitterStudio/amiberry/wiki/FAQ#q-where-does-amiberry-look-for-its-files-can-i-change-that
-  # for more information), however this is still not compatible with Nix packaging. The AMIBERRY_DATA_DIR can go
-  # in the nix store but the Amiberry configuration files must be stored in a user writable location.
-  # Fortunately Amiberry provides environment variables for specifying these locations which we can supply with the
-  # wrapper script below.
-  # One more caveat: Amiberry expects the configuration files path (AMIBERRY_HOME_DIR) to exist, otherwise it will
-  # fall back to behaving like a "Portable" app. The wrapper below ensures that the AMIBERRY_HOME_DIR path exists,
-  # preventing that fallback.
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    cp amiberry $out/bin/
-    cp -r abr data $out/
-    install -Dm444 data/amiberry.png $out/share/icons/hicolor/256x256/apps/amiberry.png
-    wrapProgram $out/bin/amiberry \
-      --set-default AMIBERRY_DATA_DIR $out \
-      --run 'AMIBERRY_HOME_DIR="$HOME/.amiberry"' \
-      --run 'mkdir -p \
-        $AMIBERRY_HOME_DIR/kickstarts \
-        $AMIBERRY_HOME_DIR/conf \
-        $AMIBERRY_HOME_DIR/nvram \
-        $AMIBERRY_HOME_DIR/plugins \
-        $AMIBERRY_HOME_DIR/screenshots \
-        $AMIBERRY_HOME_DIR/savestates \
-        $AMIBERRY_HOME_DIR/controllers \
-        $AMIBERRY_HOME_DIR/whdboot \
-        $AMIBERRY_HOME_DIR/lha \
-        $AMIBERRY_HOME_DIR/floppies \
-        $AMIBERRY_HOME_DIR/cdroms \
-        $AMIBERRY_HOME_DIR/harddrives'
-    runHook postInstall
-  '';
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "amiberry";
-      desktopName = "Amiberry";
-      exec = "amiberry";
-      comment = "Amiga emulator";
-      icon = "amiberry";
-      categories = [
-        "System"
-        "Emulator"
-      ];
-    })
-  ];
-
  meta = {
    homepage = "https://github.com/BlitterStudio/amiberry";
    description = "Optimized Amiga emulator for Linux/macOS";
--- a/pkgs/by-name/bu/buku/package.nix
+++ b/pkgs/by-name/bu/buku/package.nix
@@ -8,9 +8,11 @@
 let
  serverRequire = with python3.pkgs; [
    requests
+    flasgger
    flask
    flask-admin
    flask-api
+    flask-babel
    flask-bootstrap
    flask-paginate
    flask-wtf
@@ -49,6 +51,10 @@ buildPythonApplication (finalAttrs: {
    flake8
    pytest-cov-stub
    pyyaml
+  ]
+  ++ lib.optionals withServer [
+    lxml
+    pytest-timeout
  ];

  propagatedBuildInputs = [
--- a/pkgs/by-name/ca/cargo-edit/package.nix
+++ b/pkgs/by-name/ca/cargo-edit/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-edit";
-  version = "0.13.9";
+  version = "0.13.10";

  src = fetchFromGitHub {
    owner = "killercup";
    repo = "cargo-edit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8cl7Ev4G3w8UZltP4GnoZs2SWChVipePtUezavmftso=";
+    hash = "sha256-9CmbOIRHgYlc/bAN8BS5NyzfgRIzyneh/LC/sZFZUuo=";
  };

-  cargoHash = "sha256-CDrTVl7XQIpuEQc8WdVkzVMk1vHw0H0YOpQQsvQcczU=";
+  cargoHash = "sha256-O1tY0RVH4FHr7kWJ8+BUyD7LzzqlaObO0dHwrsX2biQ=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/co/cog/package.nix
+++ b/pkgs/by-name/co/cog/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "cog";
-  version = "0.1.8";
+  version = "0.1.9";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "cog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eIvesUCvIluSFZuiU6NI1JUrpuRGi0t2cz5uNkvE6/c=";
+    hash = "sha256-AFR9D776MRXmSR/hvXJd7xorHEl1VAio/crEvUU8kuY=";
  };

-  vendorHash = "sha256-OrFRYCWb//ga1R+QIkg4aMhQYAFOAxRPi5IvGjUL6I4=";
+  vendorHash = "sha256-UVcsstCSY3OZkvaujrlnGHKI3BTMcb3UN3lwOMPKLdw=";

  subPackages = [ "cmd/cli" ];

--- a/pkgs/by-name/dm/dms-shell/package.nix
+++ b/pkgs/by-name/dm/dms-shell/package.nix
@@ -28,13 +28,13 @@ buildGoModule (
  in
  {
    pname = "dms-shell";
-    version = "1.4.4.1";
+    version = "1.4.5";

    src = fetchFromGitHub {
      owner = "AvengeMedia";
      repo = "DankMaterialShell";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-iYBdSBvcW7bJtc84G6k5TFJEbPHQrif9KzZyE9Lbq8M=";
+      hash = "sha256-K/DtFratLxaZ4+YS9G+HZA37banWacXYznmul3XPKKM=";
    };

    sourceRoot = "${finalAttrs.src.name}/core";
--- a/pkgs/by-name/du/duplicati/deps.json
+++ b/pkgs/by-name/du/duplicati/deps.json
@@ -21,8 +21,13 @@
  },
  {
    "pname": "Avalonia",
-    "version": "11.3.3",
-    "hash": "sha256-UvENUQgoTUikjIMTL+oI93FNwr1gZfoGVtZdYzBzdts="
+    "version": "11.3.13",
+    "hash": "sha256-9khLyFw6dk82UhmQoGf0R2HA5AmRyGA0pydM+unZ+ww="
+  },
+  {
+    "pname": "Avalonia",
+    "version": "12.0.0",
+    "hash": "sha256-pBn3o40TTYAPtjcfvaVK6wMFNSY7AHEE5wU4zDUj4FA="
  },
  {
    "pname": "Avalonia.Angle.Windows.Natives",
@@ -31,63 +36,78 @@
  },
  {
    "pname": "Avalonia.BuildServices",
-    "version": "0.0.31",
-    "hash": "sha256-wgtodGf644CsUZEBIpFKcUjYHTbnu7mZmlr8uHIxeKA="
+    "version": "11.3.2",
+    "hash": "sha256-6wx06tjSKWQOlX2czdp6Wh0nuwVapx5qf/s8Qj5we40="
  },
  {
    "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.3.3",
-    "hash": "sha256-zg35D8NygrU8mCAsLLoPmrzXZcV31NuHNtTaiZZhOxc="
+    "version": "11.3.13",
+    "hash": "sha256-hzGLVkFxGDxqYE0+1J6Ze/akUUmhnGiNaeHeNx9JYlg="
  },
  {
    "pname": "Avalonia.Desktop",
-    "version": "11.3.3",
-    "hash": "sha256-/jYjxA5vJqU5IpJkgnlathprzdHB/ihdL35ZZBRESeU="
+    "version": "12.0.0",
+    "hash": "sha256-M18vFA8cxZDR6RBF32O82n5pQAj70Jr6CpVXUEjtEso="
  },
  {
    "pname": "Avalonia.Diagnostics",
-    "version": "11.3.3",
-    "hash": "sha256-rHBFnhZ+gAqPqqDfZxBxUr3wXIpgOc9hInwzDOgdk5E="
+    "version": "11.3.13",
+    "hash": "sha256-hGiZB8zq56ByjzSf1o3XEJ0rHTnVNrGrVm3xgwVwleg="
  },
  {
    "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.3",
-    "hash": "sha256-kUSE90HoJz9NsYCphLUQgNkxb3xHhFIlqXa6lzuGi4c="
+    "version": "12.0.0",
+    "hash": "sha256-jOAw9i1K093cfGrNOVZQgXm8nNxaFcRMhbLM3NFrGE8="
+  },
+  {
+    "pname": "Avalonia.FreeDesktop.AtSpi",
+    "version": "12.0.0",
+    "hash": "sha256-/sXI18zP+SB8kRBZLl1WddrNxsgQRceoB3AiZwQYfWs="
+  },
+  {
+    "pname": "Avalonia.HarfBuzz",
+    "version": "12.0.0",
+    "hash": "sha256-3S0L0YqiULMBgXbwlJl7qTwhBZl8I/ahM8GF1kcK/hE="
  },
  {
    "pname": "Avalonia.Native",
-    "version": "11.3.3",
-    "hash": "sha256-QmvN5gUsgjk7ViacdXOwHULHid0TfAKJGW3cf9A8bwQ="
+    "version": "12.0.0",
+    "hash": "sha256-QqPWE4I2TxCPHufuNkfx1r35lGN1W+c992gxzrB+RRc="
  },
  {
    "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.3",
-    "hash": "sha256-gHZA53IyRAdeIg7yRIN6Pzh0AbOGd5B9mckEWsPuK7A="
+    "version": "11.3.13",
+    "hash": "sha256-HrT+dI3NLTVv5NpmhEb1ZVrXF4hgC0IkQ23VZVmw/qc="
+  },
+  {
+    "pname": "Avalonia.Remote.Protocol",
+    "version": "12.0.0",
+    "hash": "sha256-l/NCO/I3Zavlta14Q198MpYn7jtwMclUWk6cqEgqmTU="
  },
  {
    "pname": "Avalonia.Skia",
-    "version": "11.3.3",
-    "hash": "sha256-pUMqXnupxztsAP/n4U2pSgTga89gy7CBLg39y2j0EjA="
+    "version": "12.0.0",
+    "hash": "sha256-w8i8lTkf3yp78rPxg7LlcsrKF/K3J7ATOTy3D/Bt6CA="
  },
  {
    "pname": "Avalonia.Themes.Fluent",
-    "version": "11.3.3",
-    "hash": "sha256-tWNl3jvESx96lTd6i0lxo6Y8/Y6cS5ZQrPovIolNfAE="
+    "version": "12.0.0",
+    "hash": "sha256-wpBWj5EsRPDhsoE+RFGy8Z7wS8lN2s0mW7qFgRaVOOA="
  },
  {
    "pname": "Avalonia.Themes.Simple",
-    "version": "11.3.3",
-    "hash": "sha256-nUfIEeJZgiLuy681S16Qncri6fvCGF7tYk4dSf3JY4s="
+    "version": "11.3.13",
+    "hash": "sha256-PzCYsrELqrINWcTzIHpnKQ757xsiYMEBa6fTUQGg3zE="
  },
  {
    "pname": "Avalonia.Win32",
-    "version": "11.3.3",
-    "hash": "sha256-jlQXEdbZjfRsu2MjYzHGUAyn+uvdACXCvm63HjUKqfQ="
+    "version": "12.0.0",
+    "hash": "sha256-QDS1fxNQMw3EHfrqihk05emNENjUmxLQyYgNCQp9vwM="
  },
  {
    "pname": "Avalonia.X11",
-    "version": "11.3.3",
-    "hash": "sha256-7A+uzB7g21P+RnKO4bKOJVY35qPz5Xna8n8VGG7RoMw="
+    "version": "12.0.0",
+    "hash": "sha256-WJjJKB2q1s18BVlLDUdPIpLQC2Bhgkl7fkO42Kjv2zU="
  },
  {
    "pname": "AWSSDK.Core",
@@ -391,28 +411,28 @@
  },
  {
    "pname": "HarfBuzzSharp",
-    "version": "8.3.1.1",
-    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
+    "version": "8.3.1.3",
+    "hash": "sha256-/+ZEhjpOs8B4tMPw3vDyuQqGGZHJEWvy3WaKMaDwmrU="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.Linux",
-    "version": "8.3.1.1",
-    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
+    "version": "8.3.1.3",
+    "hash": "sha256-feWOna/8ncvmrq7CxnDczv1facV2poZV5R+OyCtocpU="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.macOS",
-    "version": "8.3.1.1",
-    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
+    "version": "8.3.1.3",
+    "hash": "sha256-6WKsJ/jF9pHnaWcQvaezc5AV6flu3XsOxQs7i4BGYJs="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
-    "version": "8.3.1.1",
-    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
+    "version": "8.3.1.3",
+    "hash": "sha256-arBiI82fXPjAqftqnG7Wc3BRzZ6+vKd7b58vQSWJVk0="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.Win32",
-    "version": "8.3.1.1",
-    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
+    "version": "8.3.1.3",
+    "hash": "sha256-WNUQmLWVFSwBKT9x7UdhSz9T2FA7wibvwjuPew/3yUM="
  },
  {
    "pname": "jose-jwt",
@@ -426,8 +446,8 @@
  },
  {
    "pname": "MailKit",
-    "version": "4.12.1",
-    "hash": "sha256-fwI0YTbwfzrvdkbATWGbv4D8ugOXgaPO/WFvGxQ9WS8="
+    "version": "4.16.0",
+    "hash": "sha256-4yyFxq8pJVTIgAJkyAYcuV2+/ZirENgUSk1OSD/gKIo="
  },
  {
    "pname": "MegaApiClient",
@@ -441,8 +461,8 @@
  },
  {
    "pname": "MicroCom.Runtime",
-    "version": "0.11.0",
-    "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
+    "version": "0.11.4",
+    "hash": "sha256-hd13T4Z9DsF1Sb56bS+SDpWjksJVzb4m/Kp37jaUhkU="
  },
  {
    "pname": "Microsoft.ApplicationInsights",
@@ -774,11 +794,6 @@
    "version": "17.14.1",
    "hash": "sha256-mZUzDFvFp7x1nKrcnRd0hhbNu5g8EQYt8SKnRgdhT/A="
  },
-  {
-    "pname": "Microsoft.NETCore.App.Host.win-x64",
-    "version": "10.0.5",
-    "hash": "sha256-Rstfo3XefLjeoW5qfVcHsCviFxWvZS+F8McWRUW7WdQ="
-  },
  {
    "pname": "Microsoft.OpenApi",
    "version": "2.3.0",
@@ -841,13 +856,8 @@
  },
  {
    "pname": "MimeKit",
-    "version": "4.12.0",
-    "hash": "sha256-4i/RvXyXQsb6LlEs7tZWz5d5ab8mw3R8Wwp7FXSbMaA="
-  },
-  {
-    "pname": "MimeKit",
-    "version": "4.15.1",
-    "hash": "sha256-MI4Wr+JWoxR9wsYhKmW8j1EdJ59W/O4jv5D9Zb8mEUw="
+    "version": "4.16.0",
+    "hash": "sha256-yWGXVm+EHvBSsZlVHdWdD+rVwdf/5hHxsUfJMSd2Afo="
  },
  {
    "pname": "Minio",
@@ -926,28 +936,28 @@
  },
  {
    "pname": "SkiaSharp",
-    "version": "2.88.9",
-    "hash": "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24="
+    "version": "3.119.3-preview.1.1",
+    "hash": "sha256-fIrOUgx8K/qnJaQCPa06BPlkIy3PHRgrhHGkKn5d3qY="
  },
  {
    "pname": "SkiaSharp.NativeAssets.Linux",
-    "version": "2.88.9",
-    "hash": "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A="
+    "version": "3.119.3-preview.1.1",
+    "hash": "sha256-JsQ9xmreA1zNaLwEHNPMaFsRygEDhemJCrbkhs8WHvQ="
  },
  {
    "pname": "SkiaSharp.NativeAssets.macOS",
-    "version": "2.88.9",
-    "hash": "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g="
+    "version": "3.119.3-preview.1.1",
+    "hash": "sha256-9l1xrgVl6kH2kjW5ffluKv4ec/kqUfVnqlz9OVwP2cQ="
  },
  {
    "pname": "SkiaSharp.NativeAssets.WebAssembly",
-    "version": "2.88.9",
-    "hash": "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY="
+    "version": "3.119.3-preview.1.1",
+    "hash": "sha256-5UsssFayYOMcvWNBGJeChLRc9EahpIuuexNhGHnnrhU="
  },
  {
    "pname": "SkiaSharp.NativeAssets.Win32",
-    "version": "2.88.9",
-    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
+    "version": "3.119.3-preview.1.1",
+    "hash": "sha256-MWsHe/NBlbHGtEhUICVuuhpRYSjtU06msLCoglqmVhQ="
  },
  {
    "pname": "SMBLibrary",
@@ -1196,8 +1206,13 @@
  },
  {
    "pname": "Tmds.DBus.Protocol",
-    "version": "0.21.2",
-    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+    "version": "0.90.3",
+    "hash": "sha256-jK/98C0WrkVqPPNMx+xkdGK7vhcFmDsMqX7hUmALAWM="
+  },
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.92.0",
+    "hash": "sha256-WZSB9eqSOIzsBfnpOJDIIopIhNxAH+UcZuD6W94PIN4="
  },
  {
    "pname": "uplink.NET",
--- a/pkgs/by-name/du/duplicati/package.nix
+++ b/pkgs/by-name/du/duplicati/package.nix
@@ -14,9 +14,9 @@

 let
  # for update.sh easy to handle
-  ngclientVersion = "0.0.207";
-  ngclientRev = "42d711a541ca1ee2ff43f95cce89e8eeb224afc8";
-  ngclientHash = "sha256-VS6kb/2YGn/TBDXt62UifD7BHCWE2xiUkLcGBXzV+ww=";
+  ngclientVersion = "0.0.218";
+  ngclientRev = "67e437adee2fefa9dc2a9464d3748a8512525f71";
+  ngclientHash = "sha256-1DT/WIaQ+di8vsnsAaA5qYinhvaKImEfGn2pyljXxjw=";

  # from Duplicati/Server/webroot/ngclient/package.json
  ngclient = buildNpmPackage {
@@ -30,7 +30,7 @@ let
      hash = ngclientHash;
    };

-    npmDepsHash = "sha256-wkzSUEqoB013yNbC1sX4qRz8DuGWRB20/M+ue/thbOQ=";
+    npmDepsHash = "sha256-yytz5qMhgd/yXr11szuVslTLTjV5XpfNPyLW3mmRM1E=";

    nativeBuildInputs = [ bun ];

@@ -58,15 +58,15 @@ let
 in
 buildDotnetModule rec {
  pname = "duplicati";
-  version = "2.3.0.0";
+  version = "2.3.0.1";
  channel = "stable";
-  buildDate = "2026-04-14";
+  buildDate = "2026-04-24";

  src = fetchFromGitHub {
    owner = "duplicati";
    repo = "duplicati";
    tag = "v${version}_${channel}_${buildDate}";
-    hash = "sha256-X9SaH83p2RJWeJK8MfNwPgI2c3AfBHhbxOaFz4c26qU=";
+    hash = "sha256-r3Oumo2vrViTNvZDUaVoJyGMBf1/uHS6oAhn9Aegb3s=";
    stripRoot = true;
  };

--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -61,13 +61,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.62.0";
+  version = "2.62.1";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-26rKLrlRKn8pVbqP727H5JAXCN5NaRCbf8si0Jgo4fc=";
+    hash = "sha256-lI3p0LPDg5EXQ60NIYkpv0sNeckUdZjJSsmc2XP1l0E=";
  };

  outputs = [
--- a/pkgs/by-name/gh/gh-cherry-pick/package.nix
+++ b/pkgs/by-name/gh/gh-cherry-pick/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "gh-cherry-pick";
-  version = "1.3.1";
+  version = "1.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PerchunPak";
    repo = "gh-cherry-pick";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-plNxOYLfKWLjN5RR1g2VOJWgyrzXdgI0MDJYe05XcCk=";
+    hash = "sha256-ec9q+3nd1zJ2K3dyWqLsdTH5GBJ4B1b8D/4Wd6d8PcA=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/go/google-cloud-sdk/components.json
+++ b/pkgs/by-name/go/google-cloud-sdk/components.json
--- a/pkgs/by-name/go/google-cloud-sdk/data.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/data.nix
@@ -1,27 +1,27 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "552.0.0";
+  version = "565.0.0";
  googleCloudSdkPkgs = {
    x86_64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-552.0.0-linux-x86_64.tar.gz";
-      sha256 = "10ihffqxn2dxl6lagp4616k9cp4d73p68lcy4dzy2n5hzmfklj9s";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-565.0.0-linux-x86_64.tar.gz";
+      sha256 = "0pra5cr46bf5k729m30xbs3s1vw8vkix7p33j9h8gvmqhr66fwh9";
    };
    x86_64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-552.0.0-darwin-x86_64.tar.gz";
-      sha256 = "0s8s717dy301nbc2a2pa5zcnpg258r3hvq8lmsz19gwa7y8k8bws";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-565.0.0-darwin-x86_64.tar.gz";
+      sha256 = "1hyrr6kkbaqz6nhn029l1rwyn416jcvvyd41187vgpyr5b2ldd0h";
    };
    aarch64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-552.0.0-linux-arm.tar.gz";
-      sha256 = "197kj3m999pigk6503h3y8psld0m9xlp6sviv5mz9zriaf1rxgqs";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-565.0.0-linux-arm.tar.gz";
+      sha256 = "0jx0h0skicy16g2572rblj59a4f5q3fxbaxhfs03ldqr15fjg647";
    };
    aarch64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-552.0.0-darwin-arm.tar.gz";
-      sha256 = "1m1jdsgl8dm73wgvs982rkjx4j3fqxgs2xrkqxqadpcx3nb82ysv";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-565.0.0-darwin-arm.tar.gz";
+      sha256 = "1b7h0gzp58fkkln5v0dnki2j73akankhjm67205qah9hskaq06cd";
    };
    i686-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-552.0.0-linux-x86.tar.gz";
-      sha256 = "1dp48vvkg1vfv2cc4g0g1cb06pdshhvxvs48r78943cbbsjql32k";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-565.0.0-linux-x86.tar.gz";
+      sha256 = "19nba1qp87yf1wr94rabvkgf584i8pkvsp01qqd5la6hhmcpg0zn";
    };
  };
 }
--- a/pkgs/by-name/jw/jwx/package.nix
+++ b/pkgs/by-name/jw/jwx/package.nix
@@ -6,19 +6,21 @@

 buildGoModule (finalAttrs: {
  pname = "jwx";
-  version = "3.0.13";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "lestrrat-go";
    repo = "jwx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f2L78kS0H3FxS/qS0hP+GUXjkH3teJ1L5rrzy1oq+Wk=";
+    hash = "sha256-b/Bc+pZeFbdqB/Sp0bGvDU/MHE0r1rPPcj96SHdfcAg=";
  };

-  vendorHash = "sha256-BGxLwALZ6PZiErbIngaJCUjBhkg3UbfZig/MMOgAZTQ=";
+  vendorHash = "sha256-RBv86IfoCQDeQQfTU74oLpMOwU0JRJc0dcr3VMKX8CA=";

  sourceRoot = "${finalAttrs.src.name}/cmd/jwx";

+  env.GOEXPERIMENT = "jsonv2";
+
  meta = {
    description = "Implementation of various JWx (Javascript Object Signing and Encryption/JOSE) technologies";
    mainProgram = "jwx";
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -14,7 +14,7 @@ in
  inherit useVSCodeRipgrep;
  commandLineArgs = extraCommandLineArgs;

-  version = "0.11.131";
+  version = "0.11.133";
  pname = "kiro";

  # You can find the current VSCode version in the About dialog:
--- a/pkgs/by-name/ki/kiro/sources.json
+++ b/pkgs/by-name/ki/kiro/sources.json
@@ -1,14 +1,14 @@
 {
  "x86_64-linux": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.11.131/tar/kiro-ide-0.11.131-stable-linux-x64.tar.gz",
-    "hash": "sha256-/fihQRY+srbtAa6V+SXWPkgSTLO6cBXMTFoVsMqoNxA="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.11.133/tar/kiro-ide-0.11.133-stable-linux-x64.tar.gz",
+    "hash": "sha256-D8Y1w3YmbgKvNpN3sLv+GZLcT7HAQaGjCL9YSdrHbbA="
  },
  "x86_64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.11.131/kiro-ide-0.11.131-stable-darwin-x64.dmg",
-    "hash": "sha256-uHcD1BnOuhHyzUauxohSnR7kTfHiZ6zSfeJ4Du0ELto="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.11.133/kiro-ide-0.11.133-stable-darwin-x64.dmg",
+    "hash": "sha256-kCPDrcwIx7VLW0sEEvilIO+vobWlrRqS97pbztGkAl4="
  },
  "aarch64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.11.131/kiro-ide-0.11.131-stable-darwin-arm64.dmg",
-    "hash": "sha256-fnWG55snBwD1X3UYQM9pyfnjv5Ce5lb1ZDRmaAgzaWo="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.11.133/kiro-ide-0.11.133-stable-darwin-arm64.dmg",
+    "hash": "sha256-P0BxS2xQqZSVpYQw6I496B/asN9ov9n18bEKfYjSVU4="
  }
 }
--- a/pkgs/by-name/li/libcdio-paranoia/package.nix
+++ b/pkgs/by-name/li/libcdio-paranoia/package.nix
@@ -30,7 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
    libiconv
  ];

-  configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "--disable-ld-version-script" ];
+  configureFlags = [
+    "CFLAGS=-std=gnu17"
+  ];

  meta = {
    description = "CD paranoia on top of libcdio";
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "11.4.1";
+  version = "12.0.2";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sTmjVVhOb2EOhohW/SMJgrM8HT5t6afq1ekv+6eZNuY=";
+    hash = "sha256-bHHBqQrQLY0J+8RkfS9qsyRGk4fw21xsb0nB2HVkKwg=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -20,9 +20,9 @@
    #
    # Ensure you also check ../mattermostLatest/package.nix.
    regex = "^v(10\\.11\\.[0-9]+)$";
-    version = "10.11.14";
-    srcHash = "sha256-rcKsfCJSot9mz8ds4LoIurF0NsgGQuuqhb9PRPjyxqU=";
-    vendorHash = "sha256-hKAKM2qFn5Zvr/Sc33XmFl7l59agMaEvlvVD5aOyaxI=";
+    version = "10.11.15";
+    srcHash = "sha256-b/hXZHYULl9nNJZT4GtKsaOfX8BEzz/v3Uy3EEbzN8U=";
+    vendorHash = "sha256-Z94d1eCIkuMG72Mlvk5su/99+4kJoaeHxaeZuk96Hlc=";
    npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
    lockfileOverlay = ''
      unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -13,7 +13,7 @@
  copyDesktopItems,
 }:
 # NOTE mqtt-explorer has 3 yarn subpackages and uses relative links
-# between them, which makes it hard to package them via 3 `mkYarnPackage`
+# between them, which makes it hard to package them via 3 `fetchYarnDeps`
 # since the resulting `node_modules` directories don't have the same structure
 # as if they were installed directly. Hence why we opted to use a
 # `stdenv.mkDerivation` instead.
--- a/pkgs/by-name/mu/muffet/package.nix
+++ b/pkgs/by-name/mu/muffet/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "muffet";
-  version = "2.11.2";
+  version = "2.11.3";

  src = fetchFromGitHub {
    owner = "raviqqe";
    repo = "muffet";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0ehNG9zTzr9csykimuI/VZezjBgvNnSPHgStWNiXji8=";
+    hash = "sha256-c/ionFvWOPZ/MFNos/Q0KdlFH9qlOeAXldQZljaEF8k=";
  };

-  vendorHash = "sha256-3Tz3pGwhNchZk/cHgXWREzu/yajBC84jY3sMGYYydKo=";
+  vendorHash = "sha256-ZTPaNeozhbl6FReJowzVHDcSGLCXdt8e3UEW69lFx88=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/ni/nix-unit/package.nix
+++ b/pkgs/by-name/ni/nix-unit/package.nix
@@ -17,17 +17,17 @@ let
  # We pin the nix version to a known working one here as upgrades can likely break the build.
  # Since the nix language is rather stable we don't always need to have the latest and greatest for unit tests
  # On each update of nix unit we should re-evaluate what version we need.
-  nixComponents = nixVersions.nixComponents_2_30;
+  nixComponents = nixVersions.nixComponents_2_34;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nix-unit";
-  version = "2.30.0";
+  version = "2.34.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-unit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-yQ7HqzfrG7B6Sq1iGBI7QJsbkI/07Ccz42bqWJW4NJA=";
+    hash = "sha256-vZfRXBDC9FTO2Vpz8TroVMqOYqp+hcVk6Nwx6+kRN1Q=";
  };

  buildInputs = [
--- a/pkgs/by-name/op/optnix/package.nix
+++ b/pkgs/by-name/op/optnix/package.nix
@@ -9,12 +9,12 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "optnix";
-  version = "0.3.1";
+  version = "0.3.2";
  src = fetchFromSourcehut {
    owner = "~watersucks";
    repo = "optnix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fjEtC0GlTsxS6cMNJgaXkI5ik8fZPoPFy43XLIEUUPI=";
+    hash = "sha256-FLp+/X0r6NANPYzlj2si8JNmwd5iJPcOdQIJ9f5LLUg=";
  };

  vendorHash = "sha256-g/H91PiHWSRRQOkaobw2wAYX/07DFxWTCTlKzf7BT1Y=";
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@@ -10,23 +10,23 @@

 let
  pname = "osu-lazer-bin";
-  version = "2026.418.0";
+  version = "2026.425.0";

  src =
    {
      aarch64-darwin = fetchzip {
        url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.app.Apple.Silicon.zip";
-        hash = "sha256-zJRKgFbaXdXD8INiaDDemlNfVilTAyUEjkPNVF5H85Q=";
+        hash = "sha256-ZXivLSEpC6A6LOclb2PF12YbTwDNcL9E3fW+oHTAoVQ=";
        stripRoot = false;
      };
      x86_64-darwin = fetchzip {
        url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.app.Intel.zip";
-        hash = "sha256-vUXvmfZd/dh4rzwcNgrVDnlrZxoJsBrjYt35hNz/WYw=";
+        hash = "sha256-FAxkNOmRu32z0cx1AMrLl00npGIRK9+jUwE3Efi8ENI=";
        stripRoot = false;
      };
      x86_64-linux = fetchurl {
        url = "https://github.com/ppy/osu/releases/download/${version}-lazer/osu.AppImage";
-        hash = "sha256-51zjZ7OxftIKl21d2xCjUhaQMtwyQK6vEGRPTXnqjXU=";
+        hash = "sha256-JpuHeZdXHx5n93y87cUiuBFFXexIMx0gO2HMezXWy0A=";
      };
    }
    .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");
--- a/pkgs/by-name/os/osu-lazer/deps.json
+++ b/pkgs/by-name/os/osu-lazer/deps.json
@@ -631,8 +631,8 @@
  },
  {
    "pname": "ppy.osu.Game.Resources",
-    "version": "2026.411.0",
-    "hash": "sha256-cc4GkPDnw22X2fPKSyULCflgvxS4cLqzx45j+KrZuiI="
+    "version": "2026.423.0",
+    "hash": "sha256-fzw3TLXkLkBpy2JKJ1cz2yyc6ncJQGAjFEXlw4n/jH0="
  },
  {
    "pname": "ppy.osuTK.NS20",
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@@ -22,13 +22,13 @@

 buildDotnetModule rec {
  pname = "osu-lazer";
-  version = "2026.418.0";
+  version = "2026.425.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    tag = "${version}-lazer";
-    hash = "sha256-0l0MlfCyO81X/Rpjhjc9WyxdhEhTLZcqRSOgYSaK6wk=";
+    hash = "sha256-gYxsoMrdHQzy8Ny2pLUbJ/UMEHIZfvLnFjX4cKHa3ck=";
  };

  projectFile = "osu.Desktop/osu.Desktop.csproj";
@@ -70,9 +70,14 @@ buildDotnetModule rec {
  fixupPhase = ''
    runHook preFixup

+    # Disabling error reporting.
+    # https://github.com/ppy/osu/commit/48434dd683d095c42c01def8ff7cb95ce0a85ce4
+    # Unhandled exception. System.ArgumentException: Invalid DSN: No public key provided.
+
    wrapProgram $out/bin/osu! \
      ${lib.optionalString nativeWayland "--set SDL_VIDEODRIVER wayland"} \
-      --set OSU_EXTERNAL_UPDATE_PROVIDER 1
+      --set OSU_EXTERNAL_UPDATE_PROVIDER 1 \
+      --set OSU_DISABLE_ERROR_REPORTING 1

    for i in 16 32 48 64 96 128 256 512 1024; do
      install -D ./assets/lazer.png $out/share/icons/hicolor/''${i}x$i/apps/osu.png
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
  pname = "pgdog";
-  version = "0.1.37";
+  version = "0.1.38";

  src = fetchFromGitHub {
    owner = "pgdogdev";
    repo = "pgdog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wJUJI5ogK8JLMqyEqU2dyySy5o0mA/xy4pYRntszdB0=";
+    hash = "sha256-dSZzzgGyegr5NPRrCIe8ZS2StR4PXsTLbZ//Y3TpMrM=";
  };

-  cargoHash = "sha256-wE8YFekvNPmwaoPm2DSa0gAGh5TqkDn3CSvLHdPwXW0=";
+  cargoHash = "sha256-td/zsfK77Wd/8FhJenJE3SEK55vZPIsW/nztR/XbCKs=";

  # Hardcoded paths for C compiler and linker
  postPatch = ''
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "phpunit";
-  version = "13.1.5";
+  version = "13.1.7";

  src = fetchFromGitHub {
    owner = "sebastianbergmann";
    repo = "phpunit";
    tag = finalAttrs.version;
-    hash = "sha256-ulOpOQUU6uSqQr1F8BHpb0ad+4c4JrN0cK8H9n4y0Lw=";
+    hash = "sha256-MIHBxs4mRZp74fxEB0pMN/c/wIM3hFD6s1X2Tg2OalY=";
  };

-  vendorHash = "sha256-5Va/2Px2jwieeY44BlsscOWmGozcj/jGqAhIm81BCCY=";
+  vendorHash = "sha256-nHO+wjK+AXvxHLp0CNHzpa3By8J5pn+HoZQ5UUHGwYk=";

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/pi/pik/package.nix
+++ b/pkgs/by-name/pi/pik/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pik";
-  version = "0.30.2";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "jacek-kurlit";
    repo = "pik";
    rev = finalAttrs.version;
-    hash = "sha256-OFlt1JMuIX1oe6KE/prQJie+DaB+QFjnfYHJEdbIqcI=";
+    hash = "sha256-YachIoJeMDJPBvmucALRvyhIwFpMqatesKn3mdrGguE=";
  };

-  cargoHash = "sha256-Vg5pXpRSuO4PnN6uJbTrNBvKrmNz4Z8u9AgWtWb9ZYo=";
+  cargoHash = "sha256-gHx6G3MUbv/JCbFGdAUm2ep11d0ksVLlEbSBCtXm7ls=";

  passthru.tests.version = testers.testVersion { package = pik; };

--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
  pname = "pocket-id";
-  version = "2.5.0";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "pocket-id";
    repo = "pocket-id";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5y4XIwBnag+vWoNH3RBYn5QbmpM2S08mkY7GiLFchag=";
+    hash = "sha256-xuAG1vpeUEvh0VPOPYNAIWWzmX2AMurLLiQ26Qn1VmM=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";

-  vendorHash = "sha256-ZrwnM3X8PbR89xQrM2VeYUTRR2/HupoAb5k9sH26vb8=";
+  vendorHash = "sha256-4AJA34zj+i412b0N0btb9LZ32ip9KaQtPIBEvLjmvHs=";

  env.CGO_ENABLED = 0;
  ldflags = [
@@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
      inherit (finalAttrs) pname version src;
      pnpm = pnpm_10;
      fetcherVersion = 3;
-      hash = "sha256-4rMVdZnPMAIX/F3CGNJQJtH9OcJ663UlF+arvuwgS80=";
+      hash = "sha256-aciRc302PGUmiLptVlnuLnPc9h+IB0GlPSN7YWTNCEQ=";
    };

    env.BUILD_OUTPUT_PATH = "dist";
--- a/pkgs/by-name/po/powershell/package.nix
+++ b/pkgs/by-name/po/powershell/package.nix
@@ -74,11 +74,11 @@ stdenv.mkDerivation rec {
    mkdir -p $out/{bin,share/powershell}
    cp -R * $out/share/powershell
    chmod +x $out/share/powershell/pwsh
-    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh \
+    wrapProgram $out/share/powershell/pwsh \
      --prefix ${platformLdLibraryPath} : "${lib.makeLibraryPath buildInputs}" \
-      --set TERM xterm \
      --set POWERSHELL_TELEMETRY_OPTOUT 1 \
      --set DOTNET_CLI_TELEMETRY_OPTOUT 1
+    cp $out/share/powershell/pwsh $out/bin/pwsh

  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
--- a/pkgs/by-name/se/sequoia-git/package.nix
+++ b/pkgs/by-name/se/sequoia-git/package.nix
@@ -12,14 +12,14 @@
  libfaketime,
  ...
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (final: {
  pname = "sequoia-git";
  version = "0.6.0";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
    repo = "sequoia-git";
-    rev = "v${version}";
+    rev = "v${final.version}";
    hash = "sha256-1nSFzpz0Rl9uoE59teP3o7PduSmA20QEhe+fvTM6JGA=";
  };

@@ -46,10 +46,10 @@ rustPlatform.buildRustPackage rec {
  env.ASSET_OUT_DIR = "target";

  postInstall = ''
-    installManPage ${env.ASSET_OUT_DIR}/man-pages/*.1
-    installShellCompletion --bash ${env.ASSET_OUT_DIR}/shell-completions/${meta.mainProgram}.bash
-    installShellCompletion --zsh ${env.ASSET_OUT_DIR}/shell-completions/_${meta.mainProgram}
-    installShellCompletion --fish ${env.ASSET_OUT_DIR}/shell-completions/${meta.mainProgram}.fish
+    installManPage ${final.env.ASSET_OUT_DIR}/man-pages/*.1
+    installShellCompletion --bash ${final.env.ASSET_OUT_DIR}/shell-completions/${final.meta.mainProgram}.bash
+    installShellCompletion --zsh ${final.env.ASSET_OUT_DIR}/shell-completions/_${final.meta.mainProgram}
+    installShellCompletion --fish ${final.env.ASSET_OUT_DIR}/shell-completions/${final.meta.mainProgram}.fish
  '';

  meta = {
@@ -58,4 +58,4 @@ rustPlatform.buildRustPackage rec {
    maintainers = [ lib.maintainers.matthiasbeyer ];
    mainProgram = "sq-git";
  };
-}
+})
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -91,7 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
    # of better-sqlite3. It has a native part that it wants to build using a
    # script which is disallowed.
    # What's more, we need to use headers from electron to avoid ABI mismatches.
-    # Adapted from mkYarnModules.
    for f in $(find . -path '*/node_modules/better-sqlite3' -type d); do
      (cd "$f" && (
      npm run build-release --offline --nodedir="${electron.headers}"
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -89,7 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
  # After the pnpm configure, we need to build the binaries of all instances
  # of better-sqlite3. It has a native part that it wants to build using a
  # script which is disallowed.
-  # Adapted from mkYarnModules.
  preBuild = ''
    for f in $(find -path '*/node_modules/better-sqlite3' -type d); do
      (cd "$f" && (
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -8,13 +8,13 @@

 buildGo126Module (finalAttrs: {
  pname = "tsgolint";
-  version = "0.21.1";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "oxc-project";
    repo = "tsgolint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tNLmJnV6ztk6IJpJERow4kf4Xx+cbFadLptbt4JpiRs=";
+    hash = "sha256-tB+39Z6KpNj6/mejB/+Zxe4evdlGAnQW1LJtH3pQlVw=";
    fetchSubmodules = true;
  };

@@ -41,7 +41,7 @@ buildGo126Module (finalAttrs: {
    '';

  proxyVendor = true;
-  vendorHash = "sha256-iu2yQ4ZTSae49VgO/BYG3cEHhTtE4Q0g8L8KCAYARSw=";
+  vendorHash = "sha256-sdGpBrDie+VSOX4jhobipEN9BY6JjdM7fdmdYKXkb44=";

  subPackages = [ "cmd/tsgolint" ];

--- a/pkgs/by-name/xm/xmedcon/package.nix
+++ b/pkgs/by-name/xm/xmedcon/package.nix
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xmedcon";
-  version = "0.26.1";
+  version = "0.26.2";

  src = fetchurl {
    url = "mirror://sourceforge/xmedcon/xmedcon-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-mf424qgt1FqqnwDQU7b8XLQNJsesLQi07T0LdP1cdPg=";
+    sha256 = "sha256-r0oDA5wMS2bkKCgM7C+WxUahGvJm7NUA/iUNu2uZJPE=";
  };

  buildInputs = [
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -418,7 +418,12 @@ lib.extendMkDerivation {
          optional-dependencies
          ;
        updateScript = nix-update-script { };
+        # __stdenvPythonCompat[Pos] attributes are here for overrideStdenvCompat in `python-packages-base.nix` to work.
+        # They are internal and subject to changes.
+        # TODO(@ShamrockLee): Remove when overrideStdenvCompat gets removed.
        ${if attrs ? stdenv then "__stdenvPythonCompat" else null} = attrs.stdenv;
+        ${if attrs ? stdenv then "__stdenvPythonCompatPos" else null} =
+          builtins.unsafeGetAttrPos "stdenv" attrs;
      }
      // attrs.passthru or { };

--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -55,24 +55,29 @@ let
        args:
        let
          result = f args;
-          getName = x: x.pname or (lib.getName (x.name or "<unnamed>"));
-          applyMsgStdenvArg =
-            name:
-            lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511) ''
-              ${name}: Passing `stdenv` directly to `buildPythonPackage` or `buildPythonApplication` is deprecated. You should use their `.override` function instead, e.g:
-                buildPythonPackage.override { stdenv = customStdenv; } { }
-            '';
+          handleStdenvArg =
+            attrs: attrName:
+            let
+              name = attrs.pname or (lib.getName (attrs.name or "<unnamed>"));
+              pos = attrs.__stdenvPythonCompatPos or (builtins.unsafeGetAttrPos attrName attrs);
+              msg = [
+                "${name}: Passing `stdenv` directly to `buildPythonPackage` or `buildPythonApplication` is deprecated. You should use their `.override` function instead, e.g:"
+                "  buildPythonPackage.override { stdenv = customStdenv; } { }"
+              ]
+              ++ lib.optionals (pos != null) [
+                "`stdenv` argument found at ${pos.file}:${toString pos.line}"
+              ];
+            in
+            lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511) (lib.concatLines msg) attrs.${attrName};
        in
        if lib.isFunction args && result ? __stdenvPythonCompat then
          # Less reliable, as constructing with the wrong `stdenv` might lead to evaluation errors in the package definition.
-          f'.override { stdenv = applyMsgStdenvArg (getName result) result.__stdenvPythonCompat; } (
+          f'.override { stdenv = handleStdenvArg result "__stdenvPythonCompat"; } (
            finalAttrs: removeAttrs (args finalAttrs) [ "stdenv" ]
          )
        else if (!lib.isFunction args) && (args ? stdenv) then
          # More reliable, but only works when args is not `(finalAttrs: { })`
-          f'.override { stdenv = applyMsgStdenvArg (getName args) args.stdenv; } (
-            removeAttrs args [ "stdenv" ]
-          )
+          f'.override { stdenv = handleStdenvArg args "stdenv"; } (removeAttrs args [ "stdenv" ])
        else
          result
      )
--- a/pkgs/development/lua-modules/lua-https/default.nix
+++ b/pkgs/development/lua-modules/lua-https/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildLuaPackage,
+  writeScript,
+  fetchFromGitHub,
+  cmake,
+  lua,
+  curl,
+}:
+
+buildLuaPackage rec {
+  pname = "lua-https";
+  version = "0-unstable-2025-02-28";
+
+  src = fetchFromGitHub {
+    owner = "love2d";
+    repo = "lua-https";
+    rev = "e1b77046dd3cf1a9f61ddeb63cb39d47c844c089";
+    hash = "sha256-NQVB5ncw2bYJEHPQtBXqCdwp6FdQ4SJ/x97fasE5z0A=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    lua
+    curl
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/lib/lua/${lua.luaversion}")
+    (lib.cmakeFeature "LIBRARY_LOADER" "linktime")
+    (lib.cmakeBool "USE_CURL_BACKEND" true) # off by default on darwin
+    (lib.cmakeBool "USE_OPENSSL_BACKEND" false) # on by default on linux, but incompatible with linktime library loader
+    (lib.cmakeBool "USE_NSURL_BACKEND" false) # on by default on darwin
+  ];
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+
+    set -euo pipefail
+
+    response=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL "https://api.github.com/repos/${src.owner}/${src.repo}/commits?per_page=1")
+    rev=$(echo "$response" | jq -r '.[0].sha')
+    date=$(echo "$response" | jq -r '.[0].commit.committer.date' | cut -c1-10)
+    update-source-version luaPackages.lua-https 0-unstable-$date --rev=$rev
+  '';
+
+  meta = {
+    homepage = "https://love2d.org/wiki/lua-https";
+    description = "Simple Lua HTTPS module using native platform backends specifically written for LÖVE 12.0";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+  };
+}
--- a/pkgs/development/python-modules/plotpy/default.nix
+++ b/pkgs/development/python-modules/plotpy/default.nix
@@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "plotpy";
-  version = "2.8.4";
+  version = "2.9.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PlotPy";
    tag = "v${version}";
-    hash = "sha256-h2cB0sFZ5o4VPqQZ8rXio0iNsKTVLHsOJddACYlPyLs=";
+    hash = "sha256-6nLkpzwQEvaX9dlrpK6IKaDSOX6hAks9p4FjpXFTJjI=";
  };

  build-system = [
--- a/pkgs/development/python-modules/skops/default.nix
+++ b/pkgs/development/python-modules/skops/default.nix
@@ -26,14 +26,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "skops";
-  version = "0.13.0";
+  version = "0.14";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "skops-dev";
    repo = "skops";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1550LIVyChqP5q4VZmflCXPyXXg4eHJU5AlVQJD2M8c=";
+    hash = "sha256-AyrsXomc3vpfdqsBL51UmGXsjPsAJ+dx3uf3T8nPk/Y=";
  };

  build-system = [ hatchling ];
@@ -62,35 +63,24 @@ buildPythonPackage (finalAttrs: {
  enabledTestPaths = [ "skops" ];

  disabledTests = [
-    # flaky
-    "test_base_case_works_as_expected"
-
    # fairlearn is not available in nixpkgs
    "TestAddFairlearnMetricFrame"
-
-    # numpy.linalg.LinAlgError: The covariance matrix of class 0 is not full rank.
-    # Increase the value of `reg_param` to reduce the collinearity.
-    "test_can_persist_fitted"
-
-  ];
-
-  disabledTestPaths = [
-    # minor output formatting issue
-    "skops/card/_model_card.py"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # Segfaults on darwin
-    "skops/io/tests/test_persist.py"
-  ];
-
-  pytestFlags = [
-    # Warning from scipy.optimize in skops/io/tests/test_persist.py::test_dump_and_load_with_file_wrapper
-    # https://github.com/skops-dev/skops/issues/479
-    "-Wignore::DeprecationWarning"
-
-    # FutureWarning: Class PassiveAggressiveClassifier is deprecated; this is deprecated in version
-    # 1.8 and will be removed in 1.10. Use `SGDClassifier(...)` instead.
-    "-Wignore::FutureWarning"
+    # Fail in the sandbox with:
+    #   UNEXPECTED EXCEPTION: RuntimeError('*** -[__NSPlaceholderArray initWithObjects:count:]:
+    #   attempt to insert nil object from objects[1]')
+    "skops.card._model_card.Card"
+    "test_add_plot"
+    "test_add_plot_to_existing_section"
+    "test_add_plot_with_alt_text"
+    "test_add_plot_with_description"
+    "test_copy_plots"
+    "test_duplicate_permutation_importances"
+    "test_duplicate_permutation_importances_overwrite"
+    "test_multiple_permutation_importances"
+    "test_permutation_importances"
+    "test_permutation_importances_with_description"
  ];

  pythonImportsCheck = [ "skops" ];
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -22,8 +22,8 @@ let
      hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
    };
    "10" = {
-      version = "10.33.0";
-      hash = "sha256-v8wby60nmxOlFsRGp1s8WLaQS0XVehlRQRAV5Qt1GoA=";
+      version = "10.33.2";
+      hash = "sha256-envPE9f2zrOUbAOXg3PZm+n94cr8MAC9/tTE95EWdhA=";
    };
  };

--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "sankey-chart";
-  version = "4.0.2";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "MindFreeze";
    repo = "ha-sankey-chart";
    rev = "v${version}";
-    hash = "sha256-JZ2FtJkkF80ic7Dd9MTwOQKJ2hCfxN3IOQFcaJcXapE=";
+    hash = "sha256-wIYStC0sE+1HKWU4PI1KDEx2n4h/stCW64N9HeHcgCQ=";
  };

-  npmDepsHash = "sha256-AN/u8VHDY8FXzqS8bSK//DJnqSj1ML//5q7b5hhNVjw=";
+  npmDepsHash = "sha256-H2MX7KvCwThODH3b9yaaQQMYbdppuYiTjCSskzRYJL4=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -113,6 +113,8 @@ rec {

  image-nvim = callPackage ../development/lua-modules/image-nvim { };

+  lua-https = callPackage ../development/lua-modules/lua-https { };
+
  lua-pam = callPackage (
    {
      fetchFromGitHub,
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1337,10 +1337,10 @@ with self;

  Apppapersway = buildPerlPackage rec {
    pname = "App-papersway";
-    version = "2.001";
+    version = "3.000";
    src = fetchurl {
      url = "mirror://cpan/authors/id/S/SP/SPWHITTON/App-papersway-${version}.tar.gz";
-      hash = "sha256-Jx8MJdyr/tfumMhuCofQX0r3vWcVuDzfJGpCjq2+Odw=";
+      hash = "sha256-60H7zCtVbBfYOqVKw9X1EjOM7mzjSuPj5IwcDWhC+dE=";
    };
    buildInputs = [
      AnyEvent