Merge staging-next into staging

doc/README.md

@@ -14,17 +14,12 @@ Use **examples** first to show how to get something done. Keep **Explanation** l
 
 Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-This directory contains **guides** and **reference** documentation for Nixpkgs.
+Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
 
-Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
+Write **guides** task-first: lead with a working example, then explain in prose.
+Write **reference** as the specification of functions and attributes.
 
-**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
-Explanations appear as prose after examples.
-
-**Reference** documentation is the specification of functions and attributes.
-
-We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
+We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
 
 See [Document structure](#document-structure) for a structural template.
 

doc/style.css

@@ -465,7 +465,8 @@ div.appendix .variablelist .term {
   font-display: swap;
 }
 
-.chapter {
+div.chapter,
+div.page {
   content-visibility: auto;
 }
 

nixos/doc/manual/redirects.json

@@ -214,6 +214,24 @@
   "module-services-tdarr-server-only": [
     "index.html#module-services-tdarr-server-only"
   ],
+  "module-services-zapret2": [
+    "index.html#module-services-zapret2"
+  ],
+  "module-services-zapret2-configuration": [
+    "index.html#module-services-zapret2-configuration"
+  ],
+  "module-services-zapret2-configuration-firewall": [
+    "index.html#module-services-zapret2-configuration-firewall"
+  ],
+  "module-services-zapret2-configuration-lua-files": [
+    "index.html#module-services-zapret2-configuration-lua-files"
+  ],
+  "module-services-zapret2-configuration-profiles": [
+    "index.html#module-services-zapret2-configuration-profiles"
+  ],
+  "module-services-zapret2-quick-start": [
+    "index.html#module-services-zapret2-quick-start"
+  ],
   "module-virtualisation-xen": [
     "index.html#module-virtualisation-xen"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -56,6 +56,8 @@
 
 - [Koito](https://koito.io/), a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as [services.koito](#opt-services.koito.enable).
 
+- [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).

nixos/modules/misc/nixpkgs.nix

@@ -2,12 +2,51 @@
   config,
   options,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.nixpkgs;
   opt = options.nixpkgs;
 
+  isConfig = x: builtins.isAttrs x || lib.isFunction x;
+
+  optCall = f: x: if lib.isFunction f then f x else f;
+
+  mergeConfig =
+    lhs_: rhs_:
+    let
+      lhs = optCall lhs_ { inherit lib pkgs; };
+      rhs = optCall rhs_ { inherit lib pkgs; };
+    in
+    lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
+    // lib.optionalAttrs (lhs ? packageOverrides) {
+      packageOverrides =
+        pkgs:
+        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
+    }
+    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
+      perlPackageOverrides =
+        pkgs:
+        optCall lhs.perlPackageOverrides pkgs
+        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
+    };
+
+  configType = lib.mkOptionType {
+    name = "nixpkgs-config";
+    description = "nixpkgs config";
+    check =
+      x:
+      let
+        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
+      in
+      traceXIfNot isConfig;
+    merge = args: lib.foldr (def: mergeConfig def.value) { };
+  };
+
   overlayType = lib.mkOptionType {
     name = "nixpkgs-overlay";
     description = "nixpkgs overlay";
@@ -34,8 +73,6 @@ let
     ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem
     ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem;
 
-  _configDefinitions = opt.config.definitionsWithLocations;
-
   defaultPkgs =
     if opt.hostPlatform.isDefined then
       let
@@ -53,21 +90,14 @@ let
       in
       import ../../.. (
         {
-          inherit _configDefinitions;
-          inherit (cfg) overlays;
-          # Explicitly set config to prevent impure.nix from filling it
-          # from the NIXPKGS_CONFIG environment variable.
-          config = { };
+          inherit (cfg) config overlays;
         }
         // systemArgs
       )
     else
       import ../../.. {
-        inherit _configDefinitions;
-        # Explicitly set config to prevent impure.nix from filling it
-        # from the NIXPKGS_CONFIG environment variable.
-        config = { };
         inherit (cfg)
+          config
           overlays
           localSystem
           crossSystem
@@ -135,15 +165,7 @@ in
       example = lib.literalExpression ''
         { allowBroken = true; allowUnfree = true; }
       '';
-      type = lib.types.deferredModuleWith {
-        staticModules = [
-          { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; }
-          ../../../pkgs/top-level/config.nix
-        ];
-      };
-      # Returns pkgs.config instead of nixpkgs.config
-      # This shadows the deferredModule to make it look like a submodule
-      apply = _: finalPkgs.config;
+      type = configType;
       description = ''
         Global configuration for Nixpkgs.
         The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
@@ -384,7 +406,7 @@ in
           '';
         }
         {
-          assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority;
+          assertion = opt.pkgs.isDefined -> cfg.config == { };
           message = ''
             Your system configures nixpkgs with an externally created instance.
             `nixpkgs.config` options should be passed when creating the instance instead.

nixos/modules/module-list.nix

@@ -1498,6 +1498,7 @@
   ./services/networking/xrdp.nix
   ./services/networking/yggdrasil-jumper.nix
   ./services/networking/yggdrasil.nix
+  ./services/networking/zapret2.nix
   ./services/networking/zapret.nix
   ./services/networking/zenohd.nix
   ./services/networking/zerobin.nix

nixos/modules/services/networking/zapret2.md

@@ -0,0 +1,246 @@
+# Zapret2 {#module-services-zapret2}
+
+[Zapret2](https://github.com/bol-van/zapret2) is a service that enables
+bypassing DPI systems using extensible Lua filters that process outgoing
+network traffic.
+
+For details on which parameters are available and their usage, consult the
+[upstream documentation][1].
+
+## Quick Start {#module-services-zapret2-quick-start}
+
+A simple, minimal setup that includes only a single profile that applies two
+Lua [instances][2] to TLS ClientHello packets can be defined as follows:
+
+```nix
+{
+  services.zapret2 = {
+    enable = true;
+    profiles.default.parameters = [
+      "--filter-tcp=443"
+      "--payload=tls_client_hello"
+      "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1"
+      "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000"
+    ];
+  };
+}
+```
+
+## Configuration {#module-services-zapret2-configuration}
+
+The NixOS module for Zapret2 adds a small structured interface on top of the
+typical plain argument list that is passed to `nfqws2`. This allows e.g.
+profiles to be defined across multiple modules and merged correctly.
+
+### Profiles {#module-services-zapret2-configuration-profiles}
+
+Each Zapret2 profile is defined under the {option}`services.zapret2.profiles`
+option. Multiple profiles can be defined at once, however it's important to
+ensure that each profile can only match one category of traffic by using
+`--filter-*` parameters, because otherwise a profile will match all traffic,
+and since first match wins, no other profile can match it, even if it has a
+more specific filter:
+
+```nix
+{
+  services.zapret2.profiles = {
+    http.parameters = [
+      "--filter-tcp=80"
+      "--payload=http_req"
+      "--lua-desync=http_methodeol"
+    ];
+    https.parameters = [
+      "--filter-tcp=443"
+      "--payload=tls_client_hello"
+      "--lua-desync=multisplit:pos=1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1"
+    ];
+    stun.parameters = [
+      "--filter-udp=*"
+      "--payload=stun,discord_ip_discovery"
+      "--lua-desync=fake:blob=0x00000000000000000000000000000000:repeats=2"
+    ];
+  };
+}
+```
+
+Since profiles are matched on their order and first match wins, each profile
+also has a {option}`services.zapret2.profiles.‹name›.priority` option. Lower
+values will cause the profile to be ordered *before* others, higher values will
+cause the profile to be ordered *after* others. The default priority is `1000`.
+In other words, if you want to define a "fallback" profile that matches traffic
+not matched by any other profile, you should set the priority to a higher value
+such as `1500`.
+
+Each profile's parameters can have the typical filters such as `--filter-tcp=*`
+or `--filter-udp=*`, however for matching hostnames and IP addresses, there are
+a few options to make this more convenient:
+
+```nix
+{
+  services.zapret2.profiles.default = {
+    hosts = {
+      # Automatically keep track of which hosts need the DPI bypass and which
+      # don't. This works by Zapret2 checking if the connection would otherwise
+      # be matched by the profile, and if it is, it first bypasses it, however
+      # it monitors the connection to see if it gets denied (for example, if a
+      # TCP RST packet is received right after the TLS ClientHello is sent). If
+      # this happens, it will then add it to the auto host list (that is
+      # persisted on disk), so subsequent connections will succeed.
+      autodetect.enable = true;
+
+      # If you wish to change where the automatic hostlist file is saved, from
+      # the default location of `/var/lib/zapret2/‹name›-hosts.txt`, for
+      # example to share between multiple profiles:
+      autodetect.file = "/var/lib/zapret2/hosts.txt";
+
+      # Hardcoded list of DNS domains to include/exclude. Note that domains are
+      # matched including all their subdomains, so `nixos.org` also includes
+      # `cache.nixos.org` for example, and `ru` includes `gosuslugi.ru`. If you
+      # don't want this behaviour, you should add `^` to the beginning of the
+      # entry, e.g. `^example.com` will match `example.com` but not
+      # `www.example.com`.
+      include = [
+        "cachix.org"
+        "nixos.org"
+      ];
+      exclude = [ "ru" ];
+    };
+
+    ips = {
+      # Like with hostnames, hardcoded list of IP addresses or subnets in CIDR
+      # notation to include/exclude. Note that by default, the firewall already
+      # excludes local networks (as defined by RFC 1918), so they are not
+      # passed to Zapret2.
+      include = [ "213.59.192.0/18" ];
+      exclude = [ "173.245.48.0/20" ];
+    };
+  };
+}
+```
+
+If either an IP/host include list is defined, or {option}`hosts.autodetect` is
+enabled, the profile will enter a whitelist mode, where traffic by default
+won't be matched (except the special connection tracking case of the auto
+mode). If an IP/host exclude list is defined, traffic not on the exclude list
+is still matched by default, unless an include list is also defined.
+
+In addition to the options above, you may of course define `--ipset-*` or
+`--hostlist-*` options in the profile's parameters. This can be useful to e.g.
+maintain an externally updated list that is not hardcoded into the NixOS
+configuration. If you use these options, make sure the file paths are
+accessible by the user that Zapret2 runs as (by default, it runs as a dynamic
+user).
+
+### Lua Files {#module-services-zapret2-configuration-lua-files}
+
+By default, the module loads the `zapret-lib` and `zapret-antidpi` files from
+the package defined by {option}`services.zapret2.package`. The list of files to
+load can be customised using the {option}`services.zapret2.files` option, as
+follows:
+
+```nix
+{
+  services.zapret2.files = [
+    "zapret-lib"
+    "zapret-antidpi"
+    "zapret-obfs"
+    ./my-lib.lua
+    "/path/to/read/at/runtime/my-lib.lua"
+  ];
+}
+```
+
+Each entry in the list of files can either be a path value, an absolute string
+path (with the `.lua` extension), or the name of a [Zapret2 Lua library][3]
+(without the `.lua` extension). For example, `zapret-lib` gets resolved to
+`zapret-lib.lua` from the defined {option}`services.zapret2.package`. By
+default, `zapret-lib` and `zapret-antidpi` are already included, so for the
+simple case of DPI bypass using the standard libraries, configuring this option
+isn't needed.
+
+However, note that if you *do* customise this option, it overrides the default
+list of files completely. So, for example, if you are writing custom Lua desync
+functions, you will need to not only include your library's full path, but also
+any libraries that it depends on (typically `zapret-lib`).
+
+### Firewall {#module-services-zapret2-configuration-firewall}
+
+Options for the generated nftables firewall configuration can be customised
+under the {option}`services.zapret2.firewall` option. Since Zapret2 is a
+userspace program and all network traffic originates in the kernel, all
+matching network traffic has to be passed from kernel space to userspace. This
+is an expensive process that can slow down network traffic if too much traffic
+is processed. So, it is important to process as little traffic as possible to
+maintain high network throughput. The predefined firewall already excludes
+local IP ranges (as defined by RFC 1918), and the module includes a number of
+options to further reduce how much traffic is passed to Zapret2:
+
+```nix
+{
+  services.zapret2.firewall = {
+    # The maximum number of packets *per each connection* that is passed to
+    # Zapret2, where connection is defined by conntrack. So for the default
+    # value of 16, it will pass the first 16 packets of the connection to
+    # Zapret2 for processing. After 16 packets the firewall won't pass any
+    # packets, and the connection will completely bypass Zapret2. This is
+    # sufficient for most anti-DPI mangling. However if you are doing more
+    # complex processing, you may have to increase this. If you are doing
+    # obfuscation, you will want to set this to `null` so that every packet is
+    # passed. Otherwise obfuscation will only apply to the first 16 packets.
+    maxPackets = 16;
+
+    # The interfaces on which traffic will be passed to Zapret2 for processing.
+    # By default this is `null`, which matches every interface including e.g.
+    # loopback and VPN tunnels, which don't need processing. You should almost
+    # always set this to your actual outbound network interface(s) to prevent
+    # VPN traffic on the inside of the tunnel from getting mangled.
+    interfaces = [ "eth0" ];
+
+    # TCP and UDP ports routed to Zapret2 at the firewall level. Any ports not
+    # in these lists will bypass processing completely. No profile can ever
+    # match ports not on these lists, since they are not even passed to
+    # Zapret2. By default these are both `null`, meaning connections to all
+    # ports are passed.
+    tcpPorts = [
+      80
+      443
+    ];
+    udpPorts = [ 443 ];
+
+    # Internal parameters used by the firewall that mustn't be used by any
+    # other application, or in your own firewall configuration, for example if
+    # you are doing some kind of advanced setup on a router.
+    queue = 200;
+    desyncFwmark = "0x40000000";
+  };
+}
+```
+
+Since Zapret2 works using nfqueue, it's important that the queue number is not
+used by any other application on the system. If the default queue number of
+`200` is already used by another application, you should set the option
+{option}`services.zapret2.firewall.queue` to a queue number that isn't used.
+
+Likewise, it's also important that the desync mark used to mark
+already-processed packets is also not used by any other application. Otherwise,
+it may cause issues such as packet loops or some packets being ignored by the
+conflicting applications. If the default desync mark of `0x40000000` is used by
+another application (or within your firewall configuration), you should set the
+option {option}`services.zapret2.firewall.desyncFwmark` to a desync mark that
+isn't used. Note that the desync mark is expected to be a bitmask, i.e. it
+should be a single bit. As such, the option uses a string instead of a number,
+and the module checks that it only has a single bit set in it.
+
+The firewall configuration in the module only supports nftables, it does not
+support iptables. If you wish to use iptables, or otherwise want to define your
+own firewall configuration (for example, if you are running Zapret2 server-side
+instead of client-side), you can disable the built-in firewall configuration by
+setting {option}`services.zapret2.firewall.configureAutomatically` to `false`.
+Note that, even if the option is disabled, the module still uses the queue
+number and desync mark defined in the module's options, as they are passed as
+command-line arguments to Zapret2. None of the other firewall options are used.
+
+[1]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md
+[2]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md#traffic-processing-scheme
+[3]: https://github.com/bol-van/zapret2/tree/master/lua
+

nixos/modules/services/networking/zapret2.nix

@@ -0,0 +1,563 @@
+{
+  utils,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.zapret2;
+
+  profileSubmodule =
+    { config, name, ... }:
+    {
+      options = {
+        name = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          default = name;
+          defaultText = "‹name›";
+          description = "A unique string that identifies this profile.";
+        };
+
+        priority = lib.mkOption {
+          type = lib.types.int;
+          default = 1000;
+          example = 0;
+          description = ''
+            The priority for the profile when constructing the command-line
+            parameters. Lower priority values will cause the profile to be
+            ordered before others, meaning it will be matched before others.
+            Higher priority values will cause the profile to be ordered after
+            others, meaning it will be matched after others.
+          '';
+        };
+
+        ips = {
+          include = lib.mkOption {
+            type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr));
+            default = null;
+            example = [
+              "213.59.192.0/18"
+            ];
+            description = ''
+              An explicit list of IP addresses to include in the DPI bypass.
+              Each member is an IPv4 or IPv6 address, or a subnet in CIDR
+              notation.
+
+              If set to null (the default), no include list is set, meaning all
+              IP addresses are included in the DPI bypass. If set to an empty
+              list, the include list will be empty, and no IP address will be
+              included in the DPI bypass.
+            '';
+          };
+
+          exclude = lib.mkOption {
+            type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr));
+            default = null;
+            example = [
+              "173.245.48.0/20"
+              "103.21.244.0/22"
+              "103.22.200.0/22"
+              "103.31.4.0/22"
+              "141.101.64.0/18"
+              "108.162.192.0/18"
+              "190.93.240.0/20"
+              "188.114.96.0/20"
+              "197.234.240.0/22"
+              "198.41.128.0/17"
+              "162.158.0.0/15"
+              "104.16.0.0/13"
+              "104.24.0.0/14"
+              "172.64.0.0/13"
+              "131.0.72.0/22"
+            ];
+            description = ''
+              An explicit list of IP addresses to exclude from the DPI bypass.
+              Each member is an IPv4 or IPv6 address, or a subnet in CIDR
+              notation.
+
+              If set to null (the default) or an empty list, no exclude list is
+              set, meaning no IP addresses are excluded from the DPI bypass.
+            '';
+          };
+        };
+
+        hosts = {
+          include = lib.mkOption {
+            type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr));
+            default = null;
+            example = [
+              "youtube.com"
+              "chess.com"
+            ];
+            description = ''
+              An explicit list of hostnames to include in the DPI bypass. Each
+              member is a hostname, optionally prefixed with ^ to be a strict
+              match (by default all subdomains are matched).
+
+              If set to null (the default), no include list is set, meaning all
+              hostnames are included in the DPI bypass. If set to an empty
+              list, the include list will be empty, and no hostname will be
+              included in the DPI bypass.
+            '';
+          };
+
+          exclude = lib.mkOption {
+            type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr));
+            default = null;
+            example = [
+              "ru"
+              "yandex.net"
+              "yastatic.net"
+            ];
+            description = ''
+              An explicit list of hostnames to exclude from the DPI bypass.
+              Each member is a hostname, optionally prefixed with ^ to be a
+              strict match (by default all subdomains are matched).
+
+              If set to null (the default) or an empty list, no exclude list is
+              set, meaning no hostnames are excluded from the DPI bypass.
+            '';
+          };
+
+          autodetect = {
+            enable = lib.mkEnableOption ''
+              automatic tracking of which hosts the DPI bypass is necessary for
+            '';
+
+            file = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/zapret2/${config.name}-hosts.txt";
+              defaultText = "/var/lib/zapret2/‹name›-hosts.txt";
+              description = ''
+                The file where the automatic host list is saved. This path must
+                be writable by the user Zapret2 runs as (by default, it uses a
+                dynamic user, so it should generally be in
+                {file}`/var/lib/zapret2`).
+              '';
+            };
+          };
+        };
+
+        parameters = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          example = [
+            "--filter-tcp=443"
+            "--payload=tls_client_hello"
+            "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1"
+            "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000"
+          ];
+          description = ''
+            The parameters to use for this profile. Note that, when using
+            multiple profiles, a {option}`--filter-*` parameter MUST be defined,
+            otherwise the first profile will match everything and no other
+            profile will even be executed.
+
+            To obtain a list of suitable parameters, consider running the
+            `blockcheck2` program (part of the zapret2 package), searching the
+            [Zapret forums][1] for community solutions, or consulting the
+            [Zapret manual][2].
+
+            [1]: https://ntc.party/c/community-software/zapret-antidpi/
+            [2]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md
+          '';
+        };
+      };
+
+      config.parameters = lib.mkMerge [
+        (lib.mkIf (config.ips.include != null) (
+          lib.mkBefore [
+            "--ipset=${pkgs.writeText "zapret2-ips-include.txt" (lib.concatLines config.ips.include)}"
+          ]
+        ))
+        (lib.mkIf (config.ips.exclude != null) (
+          lib.mkBefore [
+            "--ipset-exclude=${pkgs.writeText "zapret2-ips-exclude.txt" (lib.concatLines config.ips.exclude)}"
+          ]
+        ))
+        (lib.mkIf (config.hosts.include != null) (
+          lib.mkBefore [
+            "--hostlist=${pkgs.writeText "zapret2-hosts-include.txt" (lib.concatLines config.hosts.include)}"
+          ]
+        ))
+        (lib.mkIf (config.hosts.exclude != null) (
+          lib.mkBefore [
+            "--hostlist-exclude=${pkgs.writeText "zapret2-hosts-exclude.txt" (lib.concatLines config.hosts.exclude)}"
+          ]
+        ))
+        (lib.mkIf config.hosts.autodetect.enable (
+          lib.mkAfter [
+            "--hostlist-auto=${config.hosts.autodetect.file}"
+          ]
+        ))
+      ];
+    };
+
+  arguments =
+    let
+      fileOptions =
+        let
+          isAbsolute = x: builtins.isPath x || lib.hasPrefix "/" x;
+          toFile = x: if isAbsolute x then x else "${cfg.package}/share/zapret2/lua/${x}.lua";
+        in
+        map (x: "--lua-init=@${toFile x}") cfg.files;
+      profileOptions =
+        let
+          sorted = builtins.sort (a: b: a.priority < b.priority) (builtins.attrValues cfg.profiles);
+          toArgs = profile: [ "--name=${profile.name}" ] ++ profile.parameters;
+        in
+        builtins.foldl' (acc: p: acc ++ lib.optional (acc != [ ]) "--new" ++ toArgs p) [ ] sorted;
+    in
+    [
+      (lib.getExe cfg.package)
+      "--qnum=${toString cfg.firewall.queue}"
+      "--fwmark=${cfg.firewall.desyncFwmark}"
+    ]
+    ++ fileOptions
+    ++ profileOptions
+    ++ cfg.extraOptions;
+in
+
+{
+  options.services.zapret2 = {
+    enable = lib.mkEnableOption "zapret2, an extensible DPI bypass program";
+    package = lib.mkPackageOption pkgs "zapret2" { };
+
+    profiles = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule profileSubmodule);
+      default = { };
+      example = {
+        https.parameters = [
+          "--filter-tcp=443"
+          "--payload=tls_client_hello"
+          "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1"
+          "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000"
+        ];
+      };
+      description = ''
+        Defines DPI bypass profiles for Zapret2.
+
+        Note that each profile should have a unique {option}`--filter-*`
+        option. By default, a profile matches all traffic, and when a profile
+        matches some traffic, no other profile is evaluated. Since profiles are
+        matched in order they are passed on the command line, the ordering of
+        profiles is important, and if a "fallback"/catch-all profile is
+        defined, it should be defined with a high priority to make sure it is
+        last in the list of profiles.
+
+        Each profile will be prepended with the {option}`--name` option to set
+        the name, and then joined together with {option}`--new` between
+        profiles to form the final command-line parameters that will be passed
+        to Zapret2. Therefore, neither {option}`--name` nor {option}`--new`
+        should be used in the values.
+      '';
+    };
+
+    extraOptions = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "--debug" ];
+      description = ''
+        Extra command line parameters to pass to Zapret2.
+
+        Profiles and desync strategies should not be set here, instead the
+        {option}`services.zapret2.profiles` option should be used instead,
+        which allows profiles to be defined and merged correctly across
+        multiple NixOS modules.
+
+        The {option}`--lua-init` parameters should not be included here, the
+        files to load should instead be set via the
+        {option}`services.zapret2.files` option.
+
+        Likewise, the {option}`--qnum` and {option}`--fwmark` parameters should
+        also not be included, instead the queue number and firewall desync mark
+        can be set using the {option}`services.zapret2.firewall.queue` and
+        {option}`services.zapret2.firewall.desyncFwmark` options respectively.
+      '';
+    };
+
+    files = lib.mkOption {
+      type = lib.types.listOf (lib.types.either lib.types.nonEmptyStr lib.types.path);
+      default = [
+        "zapret-lib"
+        "zapret-antidpi"
+      ];
+      example = [
+        "zapret-lib"
+        "zapret-obfs"
+        "/path/to/custom.lua"
+      ];
+      description = ''
+        List of Lua files that will be loaded and executed once on startup.
+        Each entry in the list can be either an absolute path (including the
+        .lua extension) or the name of a standard library file bundled with
+        zapret2 (without the .lua extension). In case of the latter, they
+        will be automatically resolved to the files in the configured zapret2
+        package.
+      '';
+    };
+
+    firewall = {
+      configureAutomatically = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to automatically configure the firewall rules to apply the
+          DPI bypass to all outgoing non-local connections (using nftables).
+
+          If disabled, the only options that will be used are
+          {option}`firewall.queue` and {option}`firewall.desyncFwmark`, for the
+          {option}`--qnum` and {option}`--fwmark` parameters respectively.
+        '';
+      };
+
+      maxPackets = lib.mkOption {
+        type = lib.types.nullOr (lib.types.ints.between 2 65535);
+        default = 16;
+        example = 20;
+        description = ''
+          The number of packets in each connection to route via Zapret2. For
+          example, a value of 16 will only subject the first 16 packets in each
+          connection to anti-DPI measures. It's recommended to keep this value
+          low in order to avoid routing unnecessary traffic through userspace
+          if possible. However, if necessary, all traffic can be routed by
+          setting this option to null.
+        '';
+      };
+
+      interfaces = lib.mkOption {
+        type = lib.types.nullOr (lib.types.nonEmptyListOf lib.types.nonEmptyStr);
+        default = null;
+        example = [ "eth0" ];
+        description = ''
+          A filter for which interfaces to apply the DPI bypass to. Setting
+          this option to null (the default) means the DPI bypass applies to
+          all interfaces.
+        '';
+      };
+
+      tcpPorts = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.port);
+        default = null;
+        example = [
+          80
+          443
+        ];
+        description = ''
+          A list of destination TCP ports that are routed to Zapret2 at the
+          firewall level. Setting this option to null (the default) means all
+          TCP connections are routed to Zapret2. Setting this option to an
+          empty list disables routing to Zapret2 for any TCP connection.
+        '';
+      };
+
+      udpPorts = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.port);
+        default = null;
+        example = [ 443 ];
+        description = ''
+          A list of destination UDP ports that are routed to Zapret2 at the
+          firewall level. Setting this option to null (the default) means all
+          UDP connections are routed to Zapret2. Setting this option to an
+          empty list disables routing to Zapret2 for any UDP connection.
+        '';
+      };
+
+      queue = lib.mkOption {
+        type = lib.types.ints.between 0 65535;
+        default = 200;
+        example = 400;
+        description = ''
+          The nfqueue queue number to use. This number must be unique between
+          all other programs using nfqueue.
+        '';
+      };
+
+      desyncFwmark = lib.mkOption {
+        type = lib.types.strMatching "0x(1|2|4|8)(0){0,7}";
+        default = "0x40000000";
+        example = "0x10000000";
+        description = ''
+          The desync mark bitmask to use. This bitmask must contain only a
+          single bit, and must be unique among all other nftables rules.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.firewall.configureAutomatically -> config.networking.nftables.enable;
+        message = "When Zapret2 is set to configure the firewall automatically (services.zapret2.firewall.configureAutomatically), nftables must be enabled (networking.nftables.enable must be true).";
+      }
+    ];
+
+    # For the systemd nfqws@.service template unit
+    systemd.packages = [ cfg.package ];
+
+    systemd.services."nfqws2@default" = {
+      overrideStrategy = "asDropin";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = lib.mkMerge [
+        {
+          ExecStart = [
+            ""
+            (utils.escapeSystemdExecArgs arguments)
+          ];
+          CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
+          AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
+          NoNewPrivileges = true;
+          ProtectSystem = "full";
+          DynamicUser = true;
+          SystemCallFilter = "@system-service";
+          SystemCallArchitectures = "native";
+        }
+        (lib.mkIf (builtins.any (p: p.hosts.autodetect.enable) (builtins.attrValues cfg.profiles)) {
+          StateDirectory = "zapret2";
+        })
+      ];
+    };
+
+    networking.nftables = lib.mkIf cfg.firewall.configureAutomatically {
+      enable = lib.mkDefault true;
+      tables.zapret2 = {
+        family = "inet";
+        content = ''
+          define DESYNC_MARK = ${cfg.firewall.desyncFwmark}
+          define QNUM = ${toString cfg.firewall.queue}
+          ${lib.optionalString (cfg.firewall.interfaces != null) ''
+            define WAN = { ${lib.concatMapStringsSep ", " (x: ''"${x}"'') cfg.firewall.interfaces} }
+          ''}
+          ${lib.optionalString (cfg.firewall.maxPackets != null) ''
+            define PKT = 1-${toString cfg.firewall.maxPackets}
+          ''}
+          ${lib.optionalString (cfg.firewall.tcpPorts != null && cfg.firewall.tcpPorts != [ ]) ''
+            define TCP_PORT = { ${lib.concatMapStringsSep ", " toString cfg.firewall.tcpPorts} }
+          ''}
+          ${lib.optionalString (cfg.firewall.udpPorts != null && cfg.firewall.udpPorts != [ ]) ''
+            define UDP_PORT = { ${lib.concatMapStringsSep ", " toString cfg.firewall.udpPorts} }
+          ''}
+
+          set local4 {
+            type ipv4_addr
+            flags interval
+            elements = {
+              127.0.0.0/8,
+              10.0.0.0/8,
+              100.64.0.0/10,
+              172.16.0.0/12,
+              192.168.0.0/16,
+              169.254.0.0/16
+            }
+          }
+
+          set local6 {
+            type ipv6_addr
+            flags interval
+            elements = {
+              ::1/128,
+              fe80::/10,
+              fc00::/7,
+              ff00::/8
+            }
+          }
+
+          chain post {
+            type filter hook postrouting priority 101; policy accept;
+
+            ${lib.concatStringsSep " " [
+              (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN")
+              "ip daddr @local4 accept"
+            ]}
+            ${lib.concatStringsSep " " [
+              (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN")
+              "ip6 daddr @local6 accept"
+            ]}
+
+            ${lib.optionalString (cfg.firewall.tcpPorts != [ ]) ''
+              ${lib.concatStringsSep " " [
+                (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN")
+                "meta mark & $DESYNC_MARK == 0"
+                "meta l4proto tcp"
+                (lib.optionalString (cfg.firewall.tcpPorts != null) "tcp dport $TCP_PORT")
+                (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction original")
+                (lib.optionalString (cfg.firewall.maxPackets != null) "ct original packets $PKT")
+                "queue num $QNUM bypass"
+              ]}
+            ''}
+
+            ${lib.optionalString (cfg.firewall.udpPorts != [ ]) ''
+              ${lib.concatStringsSep " " [
+                (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN")
+                "meta mark & $DESYNC_MARK == 0"
+                "meta l4proto udp"
+                (lib.optionalString (cfg.firewall.udpPorts != null) "udp dport $UDP_PORT")
+                (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction original")
+                (lib.optionalString (cfg.firewall.maxPackets != null) "ct original packets $PKT")
+                "queue num $QNUM bypass"
+              ]}
+            ''}
+          }
+
+          chain pre {
+            type filter hook prerouting priority -101; policy accept;
+
+            ${lib.concatStringsSep " " [
+              (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN")
+              "ip saddr @local4 accept"
+            ]}
+            ${lib.concatStringsSep " " [
+              (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN")
+              "ip6 saddr @local6 accept"
+            ]}
+
+            ${lib.optionalString (cfg.firewall.tcpPorts != [ ]) ''
+              ${lib.concatStringsSep " " [
+                (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN")
+                "meta mark & $DESYNC_MARK == 0"
+                "meta l4proto tcp"
+                (lib.optionalString (cfg.firewall.tcpPorts != null) "tcp sport $TCP_PORT")
+                (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction reply")
+                (lib.optionalString (cfg.firewall.maxPackets != null) "ct reply packets $PKT")
+                "queue num $QNUM bypass"
+              ]}
+            ''}
+
+            ${lib.optionalString (cfg.firewall.udpPorts != [ ]) ''
+              ${lib.concatStringsSep " " [
+                (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN")
+                "meta mark & $DESYNC_MARK == 0"
+                "meta l4proto udp"
+                (lib.optionalString (cfg.firewall.udpPorts != null) "udp sport $UDP_PORT")
+                (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction reply")
+                (lib.optionalString (cfg.firewall.maxPackets != null) "ct reply packets $PKT")
+                "queue num $QNUM bypass"
+              ]}
+            ''}
+          }
+
+          chain predefrag {
+            type filter hook output priority -401; policy accept;
+            meta mark & $DESYNC_MARK != 0 notrack
+          }
+        '';
+      };
+    };
+
+    boot.kernel.sysctl = {
+      # From the zapret2 quickstart example commands, the RST packets that DPI
+      # systems inject can sometimes be dropped as invalid before they reach
+      # nfqueue. So relax the conntrack rules so that they aren't dropped.
+      "net.netfilter.nf_conntrack_tcp_be_liberal" = lib.mkDefault true;
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ andre4ik3 ];
+    doc = ./zapret2.md;
+  };
+}

nixos/modules/services/web-apps/gerrit.nix

@@ -246,7 +246,7 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProtectSystem = "full";
+        ProtectSystem = "strict";
         RestrictAddressFamilies = [
           "AF_UNIX"
           "AF_INET"

nixos/modules/services/web-apps/misskey.nix

@@ -231,7 +231,7 @@ in
         webserver = lib.mkOption {
           type = lib.types.attrTag {
             nginx = lib.mkOption {
-              type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix);
+              type = lib.types.submodule ../web-servers/nginx/vhost-options.nix;
               default = { };
               description = ''
                 Extra configuration for the nginx virtual host of Misskey.
@@ -240,7 +240,7 @@ in
             };
             caddy = lib.mkOption {
               type = lib.types.submodule (
-                import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+                lib.modules.importApply ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
               );
               default = { };
               description = ''

nixos/modules/services/web-apps/mobilizon.nix

@@ -241,6 +241,10 @@ in
           );
         message = "Setting the IP mobilizon listens on is only possible when the nginx config is not used, as it is hardcoded there.";
       }
+      {
+        assertion = lib.versionOlder config.services.postgresql.finalPackage.version "18";
+        message = "Mobilizon currently doesn't support PostgreSQL versions above 18. See https://framagit.org/kaihuri/mobilizon/-/work_items/2070 for the upstream issue.";
+      }
     ];
 
     services.mobilizon.settings = {

nixos/tests/all-tests.nix

@@ -1925,6 +1925,7 @@ in
   yggdrasil = runTest ./yggdrasil.nix;
   your_spotify = runTest ./your_spotify.nix;
   zammad = runTest ./zammad.nix;
+  zapret2 = runTest ./zapret2.nix;
   zenohd = runTest ./zenohd.nix;
   zeronet-conservancy = runTest ./zeronet-conservancy.nix;
   zfs = import ./zfs.nix { inherit system pkgs runTest; };

nixos/tests/installer.nix

@@ -748,6 +748,7 @@ let
                   kbd.dev
                   kmod.dev
                   libarchive.dev
+                  libcap-text-verifier
                   libxml2.bin
                   libxslt.bin
                   nixos-artwork.wallpapers.simple-dark-gray-bottom

nixos/tests/mobilizon.nix

@@ -12,7 +12,7 @@ in
   ];
 
   nodes.server =
-    { ... }:
+    { pkgs, ... }:
     {
       services.mobilizon = {
         enable = true;
@@ -36,6 +36,9 @@ in
       };
 
       networking.hosts."::1" = [ mobilizonDomain ];
+
+      # https://framagit.org/kaihuri/mobilizon/-/work_items/2070
+      services.postgresql.package = pkgs.postgresql_17;
     };
 
   testScript = ''

nixos/tests/networking/networkmanager.nix

@@ -245,8 +245,8 @@ let
           client.wait_for_unit("NetworkManager.service")
           router.wait_for_unit("freeradius.service")
           router.wait_for_unit("hostapd.service")
-          router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"")
-          router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"")
+          router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='Sent Access-Accept'")
+          router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='TLS-Client-Cert-Common-Name = \"client1.example.com\"'")
         '';
       };
     eapFiles = {
@@ -294,8 +294,8 @@ let
         client.wait_for_unit("NetworkManager.service")
         router.wait_for_unit("freeradius.service")
         router.wait_for_unit("hostapd.service")
-        router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"")
-        router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"")
+        router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='Sent Access-Accept'")
+        router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='TLS-Client-Cert-Common-Name = \"client1.example.com\"'")
       '';
     };
   };

nixos/tests/zapret2.nix

@@ -0,0 +1,153 @@
+{ pkgs, lib, ... }:
+
+let
+  serverIP = "203.0.113.1";
+  clientIP = "203.0.113.2";
+
+  mkInterface = address: {
+    ipv4.addresses = lib.singleton {
+      inherit address;
+      prefixLength = 24;
+    };
+  };
+
+  # naive DPI to block any TCP stream with "acme.test"
+  suricataRules = pkgs.writeText "suricata.rules" ''
+    drop tcp-pkt any any -> any any (msg:"Block acme.test"; flow:established,to_server; content:"acme.test"; nocase; sid:1000001; rev:1;)
+  '';
+in
+
+{
+  name = "zapret2";
+  meta.maintainers = with lib.maintainers; [ andre4ik3 ];
+
+  nodes = {
+    router = {
+      virtualisation.vlans = [
+        1
+        2
+      ];
+      networking = {
+        useDHCP = false;
+        interfaces = {
+          eth1.ipv4.addresses = lib.mkForce [ ];
+          eth2.ipv4.addresses = lib.mkForce [ ];
+        };
+      };
+
+      # disable suricata-update because this requires an Internet connection
+      systemd.services.suricata-update.enable = false;
+
+      services.suricata = {
+        enable = true;
+        settings = {
+          outputs = lib.singleton {
+            fast.enabled = true;
+          };
+
+          af-packet = [
+            {
+              interface = "eth1";
+              threads = 1;
+              defrag = false;
+              cluster-type = "cluster_flow";
+              cluster-id = 98;
+              copy-mode = "ips";
+              copy-iface = "eth2";
+              buffer-size = 64535;
+            }
+            {
+              interface = "eth2";
+              threads = 1;
+              cluster-id = 97;
+              defrag = false;
+              cluster-type = "cluster_flow";
+              copy-mode = "ips";
+              copy-iface = "eth1";
+              buffer-size = 64535;
+            }
+          ];
+
+          classification-file = "${pkgs.suricata}/etc/suricata/classification.config";
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "C /var/lib/suricata/rules/suricata.rules - - - - ${suricataRules}"
+        "z /var/lib/suricata/rules/suricata.rules 644 suricata suricata -"
+      ];
+    };
+
+    server = {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = mkInterface serverIP;
+        firewall.allowedTCPPorts = [ 443 ];
+      };
+
+      security.pki.certificates = lib.singleton (builtins.readFile ./common/acme/server/ca.cert.pem);
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."acme.test" = {
+          onlySSL = true;
+          reuseport = true;
+          sslCertificate = ./common/acme/server/acme.test.cert.pem;
+          sslCertificateKey = ./common/acme/server/acme.test.key.pem;
+          root = lib.mkForce (
+            pkgs.runCommandLocal "testdir" { } ''
+              mkdir "$out"
+              cat > "$out/index.html" <<EOF
+              <html><body>Hello World!</body></html>
+              EOF
+            ''
+          );
+        };
+      };
+    };
+
+    client = {
+      virtualisation.vlans = [ 2 ];
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = mkInterface clientIP;
+      };
+
+      security.pki.certificates = lib.singleton (builtins.readFile ./common/acme/server/ca.cert.pem);
+
+      services.zapret2 = {
+        enable = true;
+        firewall.interfaces = [ "eth1" ];
+        profiles.default.parameters = [
+          "--filter-tcp=443"
+          "--payload=tls_client_hello"
+          "--lua-desync=multisplit:pos=host+1,midsld,endhost-1"
+        ];
+      };
+
+      networking.extraHosts = ''
+        ${serverIP} acme.test
+      '';
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    for machine in [client, router, server]:
+      machine.wait_for_unit("multi-user.target")
+
+    server.wait_for_unit("nginx.service")
+    router.wait_for_unit("suricata.service")
+
+    # with nfqws2 running, the request should succeed
+    client.wait_for_unit("nfqws2@default.service")
+    client.sleep(5)
+    client.succeed("curl -s --max-time 5 https://acme.test | grep -F 'Hello World!'")
+
+    # with nfqws2 stopped, the DPI should block it
+    client.stop_job("nfqws2@default.service")
+    client.fail("curl -s --max-time 5 https://acme.test")
+  '';
+}

pkgs/applications/editors/vscode/extensions/default.nix

@@ -361,6 +361,22 @@ let
         };
       };
 
+      arktypeio.arkdark = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "arktypeio";
+          name = "arkdark";
+          version = "6.6.0";
+          hash = "sha256-9QsHaH8mXM7D7QE5+xTFrGyxh6MShPF9Wk0hFHpxk8A=";
+        };
+        meta = {
+          description = "Syntax highlighting and inline errors for ArkType";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=arktypeio.arkdark";
+          homepage = "https://github.com/arktypeio/arktype";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ logn ];
+        };
+      };
+
       arrterian.nix-env-selector = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "nix-env-selector";

pkgs/applications/office/libreoffice/default.nix

@@ -811,6 +811,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit srcs;
+    inherit withJava;
     jdk = if withJava then jre' else null;
     python = python3; # for unoconv
     updateScript = [

pkgs/applications/office/libreoffice/wrapper.nix

@@ -118,6 +118,11 @@ let
         fi
       '')
     ]
+    ++ lib.optionals unwrapped.withJava [
+      "--set"
+      "JAVA_HOME"
+      "${unwrapped.jdk.home}"
+    ]
     ++ [
       "--inherit-argv0"
     ]

pkgs/build-support/fetchurl/builder.sh

@@ -62,7 +62,7 @@ tryDownload() {
     # if we get error code 18, resume partial download
     while [ $curlexit -eq 18 ]; do
        # keep this inside an if statement, since on failure it doesn't abort the script
-       if "${curl[@]}" -C - --fail "$url" --output "$target"; then
+       if "${curl[@]}" -C - --fail "$url" --output "$target" 2> >(tr '\r' '\n'); then
           success=1
           break
        else

pkgs/by-name/ad/adapta-gtk-theme/disable-gtk2.patch

@@ -0,0 +1,89 @@
+diff --git a/configure.ac b/configure.ac
+index e59085f6..908a38bc 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -24,6 +24,7 @@ AC_PREFIX_DEFAULT(/usr/local)
+ AM_SILENT_RULES([yes])
+ 
+ ADAPTA_OPTION([PARALLEL],     [parallel],     [parallel-build],      [disable])
++ADAPTA_OPTION([GTK_2],        [gtk_2],        [Gtk-2.0],             [disable])
+ ADAPTA_OPTION([GTK_NEXT],     [gtk_next],     [Gtk-4.0],             [disable])
+ ADAPTA_OPTION([GNOME],        [gnome],        [Gnome-Shell],         [enable])
+ ADAPTA_OPTION([CINNAMON],     [cinnamon],     [Cinnamon],            [enable])
+@@ -106,7 +107,7 @@ AC_MSG_RESULT([
+         | Supported Gtk+ Version
+         -----------------------------------------------------------------
+ 
+-         Gtk+ 2.0:               always
++         Gtk+ 2.0:               $ENABLE_GTK_2 (default: no)
+          Gtk+ 3.20:              always
+          Gtk+ 3.22:              always
+          Gtk+ 3.24:              always
+diff --git a/gtk/Makefile.am b/gtk/Makefile.am
+index d3291a40..349d18ed 100644
+--- a/gtk/Makefile.am
++++ b/gtk/Makefile.am
+@@ -528,7 +528,10 @@ all:
+ 	$(MKDIR_P) $(srcdir)/asset/assets-gtk2/Toolbar && \
+ 	$(MKDIR_P) $(srcdir)/asset/assets-gtk3
+ 
++if ENABLE_GTK_2
+ 	cd $(srcdir)/gtk-2.0 && ./recolor-gtk2.sh
++endif
++
+ if ENABLE_PARALLEL
+ 	cd $(srcdir)/sass && $(PARALLEL) $(parallel_option) ::: \
+ 		"$(SASSC) $(sassc_option) 3.20/gtk.scss ../gtk-3.20/gtk-contained.css" \
+@@ -593,12 +596,11 @@ if ENABLE_XFCE
+ endif
+ 
+ if ENABLE_PARALLEL
++if ENABLE_GTK_2
+ 	cd $(srcdir)/asset/assets-gtk2-scripts && \
+ 		./recolor-assets-gtk2.sh
+ 	cd $(srcdir)/asset/assets-gtk2-scripts && \
+ 		./clone-assets-gtk2.sh
+-	cd $(srcdir)/asset/assets-gtk3-scripts && \
+-		./recolor-assets-gtk3.sh
+ 	cd $(srcdir)/asset/assets-gtk2-scripts && \
+ 	$(PARALLEL) $(parallel_option) ./render-assets-gtk2.sh ::: \
+ 		arrow \
+@@ -611,6 +613,9 @@ if ENABLE_PARALLEL
+ 		range \
+ 		scrollbar \
+ 		spin
++endif
++	cd $(srcdir)/asset/assets-gtk3-scripts && \
++		./recolor-assets-gtk3.sh
+ 	cd $(srcdir)/asset/assets-gtk3-scripts && \
+ 	$(PARALLEL) $(parallel_option) ./render-assets-gtk3.sh ::: \
+ 		checkbox \
+@@ -623,10 +628,12 @@ if ENABLE_PARALLEL
+ 		window-maximize \
+ 		window-unmaximize
+ else
++if ENABLE_GTK_2
+ 	cd $(srcdir)/asset/assets-gtk2-scripts && \
+ 		./recolor-assets-gtk2.sh && \
+ 		./clone-assets-gtk2.sh && \
+ 		./render-assets-gtk2.sh all
++endif
+ 	cd $(srcdir)/asset/assets-gtk3-scripts && \
+ 		./recolor-assets-gtk3.sh && \
+ 		./render-assets-gtk3.sh all
+@@ -686,6 +693,7 @@ install-data-local:
+ 	$(MKDIR_P) $(noktoetadir)/gtk-3.24
+ 	cp -Rv $(gtk324noktoeta_file) $(noktoetadir)/gtk-3.24
+ 
++if ENABLE_GTK_2
+ 	$(MKDIR_P) $(adaptadir)/gtk-2.0
+ 	$(MKDIR_P) $(adaptadir)/gtk-2.0/Arrows
+ 	$(MKDIR_P) $(adaptadir)/gtk-2.0/Buttons
+@@ -813,6 +821,7 @@ install-data-local:
+ 	cp -Rv $(gtk2_nokto_shadow_file) $(noktoetadir)/gtk-2.0/Shadows
+ 	cp -Rv $(gtk2_nokto_spin_file) $(noktoetadir)/gtk-2.0/Spin
+ 	cp -Rv $(gtk2_nokto_toolbar_file) $(noktoetadir)/gtk-2.0/Toolbar
++endif
+ 
+ if ENABLE_GTK_NEXT
+ 	$(MKDIR_P) $(adaptadir)/gtk-4.0

pkgs/by-name/ad/adapta-gtk-theme/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  parallel,
+  sassc,
+  inkscape,
+  libxml2,
+  glib,
+  gdk-pixbuf,
+  librsvg,
+  gnome-shell,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adapta-gtk-theme";
+  version = "3.95.0.11";
+
+  src = fetchFromGitHub {
+    owner = "adapta-project";
+    repo = "adapta-gtk-theme";
+    tag = finalAttrs.version;
+    sha256 = "19skrhp10xx07hbd0lr3d619vj2im35d8p9rmb4v4zacci804q04";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [
+    ./disable-gtk2.patch
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    parallel
+    sassc
+    inkscape
+    libxml2
+    glib.dev
+    gnome-shell
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    librsvg
+  ];
+
+  postPatch = ''
+    substituteInPlace gtk/Makefile.am \
+      --replace-fail "--jobs 100%" '--jobs ''${NIX_BUILD_CORES}'
+
+    patchShebangs .
+  '';
+
+  configureFlags = [
+    "--disable-gtk_next"
+    "--enable-parallel"
+  ];
+
+  meta = {
+    description = "Adaptive GTK theme based on Material Design Guidelines";
+    homepage = "https://github.com/adapta-project/adapta-gtk-theme";
+    license =
+      with lib.licenses;
+      # cc-by-sa-40 (svg files) is technically incompatible with gpl2 (everything else),
+      # but cc-by-sa-40 is compatible with gpl3, which this project used to be licensed
+      # under at some point. The intent behind this exact license combination is effectively
+      # lost to time, as more than 700 issues have been made inaccessible even prior to the
+      # repository's archival. At the very least we know it's not `OR [ gpl2 cc-by-sa-40 ]`
+      # based on the README.md and the svg sources (which say cc-by-sa-40 in their xml).
+      AND [
+        gpl2
+        cc-by-sa-40
+      ];
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      romildo
+      emilylange
+    ];
+  };
+})

pkgs/by-name/al/alsa-plugins/package.nix

@@ -1,11 +1,11 @@
 {
   stdenv,
   fetchurl,
+  fetchpatch,
   lib,
   pkg-config,
   alsa-lib,
-  # FIXME: unpin when upstream supports ffmpeg 9
-  ffmpeg_8,
+  ffmpeg,
   libjack2,
   libogg,
   libpulseaudio,
@@ -22,11 +22,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "ffmpeg-9-compatibility.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/alsa-plugins/-/raw/7f250af93b76e9b3d552af509beb8ea1356114d1/ffmpeg9.patch";
+      hash = "sha256-heAl6Ym3iYI8mhuuQpwBpc0FeFYsQZRHx4UUvqiVtBo=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     alsa-lib
-    ffmpeg_8
+    ffmpeg
     libjack2
     libogg
     libpulseaudio

pkgs/by-name/at/atmos/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.224.1";
+  version = "1.225.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ew07sucTTLLUU2bdN3HKyJJ6i5z6jqgfYR3fHLnzcHA=";
+    hash = "sha256-PP2yOYwNnvk08QJtNSvpF/ZEQIrh1dQlMH9CUf6Ozr8=";
   };
 
-  vendorHash = "sha256-MP30jhbhcf6+TWB0q/VLPY6DYd0TLUWZmg3D+d8IpXg=";
+  vendorHash = "sha256-1lyBg1slFnCCdmP749Ub7Hjx1zFvNaZaMVwOnSuqG/M=";
 
   env.CGO_ENABLED = 0; # Compiles a pure statically linked Go binary.
 

pkgs/by-name/au/autobrr/package.nix

@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.82.1";
+  version = "1.83.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-dB/lk05v9L8GAF//N1We3byhsK+156rzRT+r9Q+EVD4=";
+    hash = "sha256-zVhrQrsv7+qLAGGYCSIcalzZPbmKuUVbgBpubzFuz04=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
@@ -46,7 +46,7 @@ let
         ;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = "sha256-wlikd38tAfgaSSD9L7DiSXRQFYcfVq5YA1eWs5NE4n8=";
+      hash = "sha256-sb4nRsQQnf/j7BTKb5h1joDnV5OSTuY6Omjzaz8f+k4=";
     };
 
     postBuild = ''
@@ -65,7 +65,7 @@ buildGoModule (finalAttrs: {
     src
     ;
 
-  vendorHash = "sha256-tsGl0uiQV25aemEQvedZUISrlO4IPE+V87nl31m8hZI=";
+  vendorHash = "sha256-WOf3MCqRCGqR2BJ8CV3o/zl/AYVgaTYVDPC9cFw+8rs=";
 
   preBuild = ''
     cp -r ${finalAttrs.passthru.autobrr-web}/* web/dist

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -345,9 +345,9 @@
 
   vm-repair = mkAzExtension rec {
     pname = "vm-repair";
-    version = "2.2.1";
+    version = "2.2.3";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl";
-    hash = "sha256-k/6ATtYT2YXaHm5nbb0Tf7xE98Oz9svRlbjodCOOuo8=";
+    hash = "sha256-u5Pjksq2NiN4P4awFKiq2h/P2qGDgEQoMm/w10wAkX4=";
     description = "Support for repairing Azure Virtual Machines";
     propagatedBuildInputs = with python3Packages; [ opencensus ];
     meta.maintainers = [ ];

pkgs/by-name/bd/bdf2psf/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bdf2psf";
-  version = "1.248";
+  version = "1.249";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${finalAttrs.version}_all.deb";
-    sha256 = "sha256-51PE9o1kmISd/kYHLm8NUBDKi2eyXJkL0MkWlp1f8co=";
+    sha256 = "sha256-7qfp9gq+7klgcTuETw2XFT3AWV5bSNMnrnziqL8k2PE=";
   };
 
   nativeBuildInputs = [ dpkg ];

pkgs/by-name/bl/blackfire/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2026.7.0";
+  version = "2026.8.0";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -60,19 +60,19 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        hash = "sha256-GzhcK+7NrQEP48XFmOQ9PVrvvsUzrCy/VRcshTSic9E=";
+        hash = "sha256-9hBHQvR4w7AnJGL5FdzfYyxoAOnoFtsOC8Fd+7A+Y0M=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        hash = "sha256-F6U7YHSBE5Ogie2yBSGGUKt0XsE8jogKi2GP28H1Eeo=";
+        hash = "sha256-HnNgdGVhzX+WIXzgfukPZAKB7jr9PwxOUJ8iMOaMOI8=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        hash = "sha256-eDJAjd/5omgUJ6sw5kCqxu7Ok2AYei/WGlXV96Ynd/U=";
+        hash = "sha256-Q89i59KSA2oN8PEVScmnf56i6MJZgDbpTNW8Eojd8To=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        hash = "sha256-xzWw6us+9/r8lMMHZTgE++rX7ZZShAL7L7fOneALA4Q=";
+        hash = "sha256-h3vTwK8/wZLoAsAnFSSiDe6CvZNtPG0TAAt4Vts4GBE=";
       };
     };
 

pkgs/by-name/bo/boundary/package.nix

@@ -71,7 +71,11 @@ stdenv.mkDerivation rec {
       jk
       techknowlogick
     ];
-    platforms = lib.platforms.unix;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     mainProgram = "boundary";
   };
 }

pkgs/by-name/bu/burpsuite/package.nix

@@ -15,7 +15,7 @@ assert lib.assertMsg (
 
 let
   pname = "burpsuite";
-  version = "2026.7.2";
+  version = "2026.7.3";
 
   src = fetchurl {
     name = "burpsuite.jar";
@@ -24,7 +24,7 @@ let
       "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
       "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
     ];
-    hash = "sha256-WLmuv09RKq4B4/L1iWFEPck45Fix/5DTFs/MPYJmC8M=";
+    hash = "sha256-yCYtxUJvOL7cSQ1mxdIbb/d9bcbYXO/mpmyIJpATQGk=";
   };
 
   description = "Integrated platform for performing security testing of web applications";

pkgs/by-name/ca/camunda-modeler/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.50.0";
+  version = "5.50.1";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-khLBro0jYICQhZpRLNNlX++vEmSiQ5RCnyEz1+D95b4=";
+    hash = "sha256-bDwPJTyKmtbkZYFNzxL6Ow3B5FFP00j+e3btXqHhRME=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 

pkgs/by-name/ce/censor/package.nix

@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "censor";
-  version = "0.9.1";
+  version = "0.10.0";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "censor";
     repo = "Censor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4eRJetI/BZPBiG7M3TYQ/QOd2+x1MrCLTOcL9RJYYuo=";
+    hash = "sha256-F6ODQyI1hELVpHENmOfEDg0uenniqaICQVPvdDKKLzE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clj-kondo/package.nix

@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2026.07.24";
+  version = "2026.08.03";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-QUZkiURBeuv0qxELNRhFw8MudP0m026IpZ8axG922Qg=";
+    sha256 = "sha256-EXZJtX1855Tz8m7a9gxI1+DGw9zbPF0oVgX0ZoMuKmg=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/by-name/co/coder/package.nix

@@ -96,6 +96,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Provision remote development environments via Terraform";
     homepage = "https://coder.com";
     license = lib.licenses.agpl3Only;
+    platforms = lib.attrNames channels.${channel}.hash;
     mainProgram = "coder";
     maintainers = with lib.maintainers; [
       bpmct

pkgs/by-name/co/consul/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.22.7";
+  version = "2.0.2";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = "consul";
     tag = "v${version}";
-    hash = "sha256-lcb2Dbr5rpNbtstEk7kQxEYHdN3/FQEHFH+NIa6czDU=";
+    hash = "sha256-Xt9Rch4pSSUb1/KI+W3fn++Jlm7ZtYNxSo9hOjXXEhw=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-tFa8UKeaAQR4q+WpRl/u5P+TpjdBh9Gf6bVQcwzP5QQ=";
+  vendorHash = "sha256-C532h7n/2E2vYQO02EcznnF8s/eI5r7qGoB5NEiiHEg=";
 
   doCheck = false;
 

pkgs/by-name/co/coredns/package.nix

@@ -123,10 +123,6 @@ buildGoModule (finalAttrs: {
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # loopback interface is lo0 on macos
     sed -E -i 's/\blo\b/lo0/' plugin/bind/setup_test.go
-
-    # test is apparently outdated but only exhibits this on darwin
-    substituteInPlace test/corefile_test.go \
-      --replace-fail "TestCorefile1" "SkipCorefile1"
   '';
 
   __darwinAllowLocalNetworking = true;

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -142,7 +142,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.asl20;
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     maintainers = with lib.maintainers; [
       gepbird
       mkg20001

pkgs/by-name/de/dealii/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dealii";
-  version = "9.7.1";
+  version = "9.8.0";
 
   src = fetchFromGitHub {
     owner = "dealii";
     repo = "dealii";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hy7Z9DUcSv/k5UU5TOfYzCIEiKXBZZEUrRnJ7jN1gus=";
+    hash = "sha256-TivjhIy2IVcyQqS42d7Tnp2pFnrD0UWa9RLgRHUnIFc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/de/deno/package.nix

@@ -101,6 +101,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
   env.RUSTY_V8_ARCHIVE = librusty_v8;
+  # Workaround for riscv64 because it has no pre-generated bindings.
+  env.RUSTY_V8_SRC_BINDING_PATH = librusty_v8.binding;
 
   # de-vendor SQLite
   env.LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
@@ -134,6 +136,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
           "aarch64"
         else if stdenv.hostPlatform.isx86_64 then
           "x64"
+        else if stdenv.hostPlatform.isRiscV64 then
+          "riscv64"
         else
           throw "Unsupported architecture";
     in
@@ -305,6 +309,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "riscv64-linux"
       "aarch64-darwin"
     ];
   };

pkgs/by-name/de/deno/rusty-v8/default.nix

@@ -164,10 +164,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=scope"
   ];
 
+  outputs = [
+    "out"
+    "binding"
+  ];
+
   installPhase = ''
     runHook preInstall
 
     cp target/*/release/gn_out/obj/librusty_v8${stdenv.hostPlatform.extensions.staticLibrary} $out
+    # workaround for riscv64 because has no pre-generated bindings.
+    cp target/*/release/gn_out/src_binding.rs $binding
 
     runHook postInstall
   '';

pkgs/by-name/fi/fishnet/package.nix

@@ -12,40 +12,32 @@
 }:
 
 let
-  # These files can be found in Stockfish/src/evaluate.h
-  nnueBigFile = "nn-9a0cc2a62c52.nnue";
-  nnueBigHash = "sha256-mgzCpixSClN6rTrG6QiowJiqkAidyny8h0zCGXYYvyM=";
-  nnueBig = fetchurl {
-    url = "https://tests.stockfishchess.org/api/nn/${nnueBigFile}";
-    hash = nnueBigHash;
-  };
-  nnueSmallFile = "nn-47fc8b7fff06.nnue";
-  nnueSmallHash = "sha256-R/yLf/8GfSQEdJO4TkKrhVwPzrUFjAFsafjuXE7kvWk=";
-  nnueSmall = fetchurl {
-    url = "https://tests.stockfishchess.org/api/nn/${nnueSmallFile}";
-    hash = nnueSmallHash;
+  # This file can be found in Stockfish/src/evaluate.h
+  nnueFile = "nn-89cb98a217f7.nnue";
+  nnueHash = "sha256-icuYohf3IBR8coYXYQl76koEKJl90iDsioGlYkMbu+Y=";
+  nnue = fetchurl {
+    url = "https://tests.stockfishchess.org/api/nn/${nnueFile}";
+    hash = nnueHash;
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fishnet";
-  version = "2.13.2";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "lichess-org";
     repo = "fishnet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0ArTovfr9znjudo53W5hnnSZlzfEnAd7E+7DXTqtN6w=";
+    hash = "sha256-p6gZEQfC/XX0qp7nJZps5FNDea5iOVXN4hQ6f5nGKCc=";
     fetchSubmodules = true;
   };
 
   postPatch = ''
-    cp -v '${nnueBig}' 'Stockfish/src/${nnueBigFile}'
-    cp -v '${nnueBig}' 'Fairy-Stockfish/src/${nnueBigFile}'
-    cp -v '${nnueSmall}' 'Stockfish/src/${nnueSmallFile}'
-    cp -v '${nnueSmall}' 'Fairy-Stockfish/src/${nnueSmallFile}'
+    cp -v '${nnue}' 'Stockfish/src/${nnueFile}'
+    cp -v '${nnue}' 'Fairy-Stockfish/src/${nnueFile}'
   '';
 
-  cargoHash = "sha256-mkioBmawYR5GvR0WSlaicGyXV4EVVVQuai5UF5+Thk8=";
+  cargoHash = "sha256-S3mgeYujRLvEoJYLG8Np1f1JYuftF3lZlptG33QqbNM=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -68,10 +60,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
         PNAME = finalAttrs.pname;
         PKG_FILE = toString ./package.nix;
         GITHUB_REPOSITORY = "${finalAttrs.src.owner}/${finalAttrs.src.repo}";
-        NNUE_BIG_FILE = nnueBigFile;
-        NNUE_BIG_HASH = nnueBigHash;
-        NNUE_SMALL_FILE = nnueSmallFile;
-        NNUE_SMALL_HASH = nnueSmallHash;
+        NNUE_FILE = nnueFile;
+        NNUE_HASH = nnueHash;
       };
 
       text = builtins.readFile ./update.bash;

pkgs/by-name/fi/fishnet/update.bash

@@ -9,31 +9,20 @@ stockfish_revision="$(
 stockfish_header="$(
     curl --fail --silent "https://raw.githubusercontent.com/official-stockfish/Stockfish/$stockfish_revision/src/evaluate.h"
 )"
-new_nnue_big_file="$(
+new_nnue_file="$(
     echo "$stockfish_header" |
-        grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue'
+        grep --perl-regexp --only-matching 'EvalFileDefaultName "\Knn-(\w+).nnue'
 )"
-new_nnue_big_hash="$(
+new_nnue_hash="$(
     nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
-        nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_big_file}"
-    )"
-)"
-new_nnue_small_file="$(
-    echo "$stockfish_header" |
-        grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue'
-)"
-new_nnue_small_hash="$(
-    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
-        nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_small_file}"
+        nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_file}"
     )"
 )"
 
 # Update NNUE
 pkg_body="$(<"$PKG_FILE")"
-pkg_body="${pkg_body//"$NNUE_BIG_FILE"/"$new_nnue_big_file"}"
-pkg_body="${pkg_body//"$NNUE_BIG_HASH"/"$new_nnue_big_hash"}"
-pkg_body="${pkg_body//"$NNUE_SMALL_FILE"/"$new_nnue_small_file"}"
-pkg_body="${pkg_body//"$NNUE_SMALL_HASH"/"$new_nnue_small_hash"}"
+pkg_body="${pkg_body//"$NNUE_FILE"/"$new_nnue_file"}"
+pkg_body="${pkg_body//"$NNUE_HASH"/"$new_nnue_hash"}"
 echo "$pkg_body" >"$PKG_FILE"
 
 # Update version, src

pkgs/by-name/fl/flying-carpet/package.nix

@@ -19,13 +19,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "flying-carpet";
-  version = "10.0.2";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "spieglt";
     repo = "FlyingCarpet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-38gPXTP+WAZ43oVhgYEFy0lD41uV4JxlNktiD+tJOu0=";
+    hash = "sha256-PmUi4nN2PDgHgYl3Wx2LiGwDaz7hjQT2ccCFRciJqIo=";
   };
 
   cargoHash = "sha256-WZ93Gk2n8GJox7I4o/McC0AgrBh6CZAJFcXWvALk9TM=";

pkgs/by-name/fr/freeradius/package.nix

@@ -32,6 +32,7 @@
   sqlite,
   withYubikey ? false,
   libyubikey,
+  nixosTests,
 }:
 
 assert withRest -> withJson;
@@ -101,6 +102,13 @@ stdenv.mkDerivation rec {
     "doc"
   ];
 
+  passthru.tests = {
+    inherit (nixosTests.networking.networkmanager)
+      eap
+      eapFiles
+      ;
+  };
+
   meta = {
     homepage = "https://freeradius.org/";
     description = "Modular, high performance free RADIUS suite";

pkgs/by-name/ge/gelly/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "1.9.5";
+  version = "1.9.7";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k6LgXEK5xoVrjiXCkYnFgC7Hs7oz+v3Kz47CELPqN9Q=";
+    hash = "sha256-KPU16kQUmM+TOOzw8JXFjlchhFHQy9Zt7brky9YW/fE=";
   };
 
-  cargoHash = "sha256-RbOs5CEj3KRe6F1RJSGx97wBoQKSynx+iza929ipfjA=";
+  cargoHash = "sha256-CUbQp1E+snaIuduXmEXErOoOELFXmEm3Td1y5Mou+UA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/gi/git-recent/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "git-recent";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "paulirish";
     repo = "git-recent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qE6UNNuFfB2n3MuR+9gCRQCJKe0jOgW8ZwzlBZwvkrs=";
+    hash = "sha256-ScgzMG40uR9+4cjTIHwmefSoAxVNELNx8fDVXGFl8rU=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/gi/github-runner/package.nix

@@ -366,6 +366,7 @@ buildDotnetModule (finalAttrs: {
       kfollesdal
       aanderse
       zimbatm
+      schmittlauch
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/gl/gloox/package.nix

@@ -19,27 +19,42 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-WRvRLCSe3gtQoe9rmawN6O+cG6T9Lhhvl6dAIVzFlmw=";
   };
 
+  patches = [
+    # Clang rejects `{ 0 }` as SSL_export_keying_material's context pointer
+    # argument. Use a plain `0` rather than `nullptr`: gloox's ./configure
+    # unconditionally adds `-ansi` (C++98) on all non-Windows platforms, and
+    # while Clang tolerates `nullptr` there as an extension, GCC hard-errors
+    # on it as an undeclared identifier.
+    ./tls-openssl-clang.patch
+  ];
+
   # needed since gcc12
   postPatch = ''
-    sed '1i#include <ctime>' -i \
-      src/tests/{tag/tag_perf.cpp,zlib/zlib_perf.cpp} \
-      src/examples/*.cpp
+    substituteInPlace \
+      src/tests/tag/tag_perf.cpp \
+      src/tests/zlib/zlib_perf.cpp \
+      --replace-fail \
+        "#include <sys/time.h>" \
+        $'#include <ctime>\n#include <sys/time.h>'
+
+    substituteInPlace src/examples/*.cpp \
+      --replace-fail \
+        "#include <stdio.h>" \
+        $'#include <ctime>\n#include <stdio.h>'
   '';
 
-  buildInputs =
-    [ ]
-    ++ lib.optional zlibSupport zlib
-    ++ lib.optional sslSupport openssl
-    ++ lib.optional idnSupport libidn;
+  buildInputs = lib.flatten [
+    (lib.optional zlibSupport zlib)
+    (lib.optional sslSupport openssl)
+    (lib.optional idnSupport libidn)
+  ];
 
   meta = {
     description = "Portable high-level Jabber/XMPP library for C++";
     mainProgram = "gloox-config";
     homepage = "http://camaya.net/gloox";
     license = lib.licenses.gpl3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.philocalyst ];
     platforms = lib.platforms.unix;
-    # The last successful Darwin Hydra build was in 2023
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/by-name/gl/gloox/tls-openssl-clang.patch

@@ -0,0 +1,12 @@
+diff --git a/src/tlsopensslclient.cpp b/src/tlsopensslclient.cpp
+--- a/src/tlsopensslclient.cpp
++++ b/src/tlsopensslclient.cpp
+@@ -51,7 +51,7 @@
+     {
+       unsigned char buf[32];
+       const char* const label = "EXPORTER-Channel-Binding";
+-      SSL_export_keying_material( m_ssl, buf, 32, label, strlen( label ), { 0 }, 1, 0 );
++      SSL_export_keying_material( m_ssl, buf, 32, label, strlen( label ), 0, 0, 0 );
+       return std::string( reinterpret_cast<char* const>( buf ), 32 );
+     }
+     else

pkgs/by-name/go/goose-cli/package.nix

@@ -191,6 +191,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       miniharinn
       caniko
     ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
   };
 })

pkgs/by-name/ha/hayabusa-sec/package.nix

@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     makeWrapper $out/share/hayabusa-sec/hayabusa $out/bin/hayabusa
   '';
 
-  passthru.updateScript = nix-update-script { rev-prefix = "v"; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Sigma-based threat hunting and fast forensics timeline generator for Windows event logs";

pkgs/by-name/ii/iio-oscilloscope/package.nix

@@ -2,10 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
   wrapGAppsHook3,
+  desktopToDarwinBundle,
   libiio,
   glib,
   gtk3,
@@ -23,32 +23,33 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "iio-oscilloscope";
-  version = "0.17";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner = "analogdevicesinc";
     repo = "iio-oscilloscope";
-    rev = "v${finalAttrs.version}-master";
-    hash = "sha256-wCeOLAkrytrBaXzUbNu8z2Ayz44M+b+mbyaRoWHpZYU=";
+    rev = "v${finalAttrs.version}-main";
+    hash = "sha256-lAP8rI1YnBMmwWBDxfQOV5W8NYscQbb7lh/ZhG893p0=";
   };
 
-  patches = [
-    # make sure the sizeof argument to calloc is the second argument.
-    (fetchpatch {
-      url = "https://github.com/analogdevicesinc/iio-oscilloscope/commit/565cade20566d50adec7be191a6dd7b21217f878.patch";
-      hash = "sha256-JeRve3xtWi+EcZR+qZlek+YwAbPB56OYxkFVd8MmIb0=";
-    })
-  ];
-
   postPatch = ''
     # error: 'idx' may be used uninitialized
     substituteInPlace plugins/lidar.c --replace-fail "int i, j, idx;" "int i, j, idx = 0;"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace oscmain.c --replace-fail '#include "osc.h"${"\n"}#include "backtrace.h"' '#include "backtrace.h"${"\n"}#include "osc.h"'
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '-D_GNU_SOURCE' '-D_DARWIN_C_SOURCE' \
+      --replace-fail '${"\${CMAKE_SYSTEM_NAME} MATCHES \"Linux\""}' 'TRUE'
   '';
 
   nativeBuildInputs = [
     cmake
     pkg-config
     wrapGAppsHook3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    desktopToDarwinBundle
   ];
 
   buildInputs = [
@@ -68,6 +69,20 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_POLKIT_PREFIX=${placeholder "out"}"
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=unused-variable"
+  ];
+
+  preInstall = ''
+    sed -e 's/Exec=.*/Exec=osc/' \
+        -e 's/Icon=.*/Icon=osc/' \
+        -i adi-osc.desktop
+  '';
+
+  postInstall = ''
+    ln -s $out/share/osc/icons/osc.svg $out/share/icons/hicolor/scalable/apps/
+  '';
+
   meta = {
     description = "GTK+ based oscilloscope application for interfacing with various IIO devices";
     homepage = "https://wiki.analog.com/resources/tools-software/linux-software/iio_oscilloscope";
@@ -75,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     changelog = "https://github.com/analogdevicesinc/iio-oscilloscope/releases/tag/v${finalAttrs.version}-master";
     maintainers = with lib.maintainers; [ chuangzhu ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ko/koffan/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "koffan";
-  version = "2.12.3";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "PanSalut";
     repo = "Koffan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mApQftAsoXh6CTFRPu28O9iK5Ow2/QwkAx4V8XPWTvg=";
+    hash = "sha256-kaObQYEgyMBRVqcKP8dzMKAdOMN8K7xa7X55XvneoXg=";
   };
 
   vendorHash = "sha256-BYehi5LQQ0MIsKG/fN3DHaQwKVmxUFrvWGrKZeKj+ow=";

pkgs/by-name/ku/ku/package.nix

@@ -8,14 +8,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ku";
-  version = "0.10.0";
+  version = "0.11.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "ku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MXtZdogaUhaMQcZdave5rz3afq+6T/tvQkZVzk0WCfg=";
+    hash = "sha256-UO390xbjUVhlDN8NzvRl2BXMQCYngfU5cXu+tNiVvoA=";
   };
 
   vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44=";

pkgs/by-name/li/libgphoto2/package.nix

@@ -9,7 +9,6 @@
   libusb1,
   libtool,
   libexif,
-  libgphoto2,
   libjpeg,
   curl,
   libxml2,
@@ -31,21 +30,18 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
-    gettext
     libtool
     pkg-config
   ];
 
   buildInputs = [
+    gettext
     libjpeg
     libtool # for libltdl
     libusb1
     curl
     libxml2
     gd
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    gettext
   ];
 
   doInstallCheck = true;

pkgs/by-name/li/libkcapi/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libkcapi";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "libkcapi";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xOI29cjhUGUeHLaYIrPA5ZwwCE9lBdZG6kaW0lo1uL8=";
+    hash = "sha256-xNhN6MWSNU8eufI5J/NOxhvw21nS0s7+V/Feg4N65jg=";
   };
 
   outputs = [

pkgs/by-name/li/libkrun/package.nix

@@ -71,6 +71,13 @@ stdenv.mkDerivation (finalAttrs: {
     rustc
   ];
 
+  patches = lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # https://github.com/libkrun/libkrun/commit/d4bb6e0
+    # Fix riscv64 non-TEE memory region setup
+    # Remove in next release (Not included in 1.19.4)
+    ./riscv64-non-tee-memory.patch
+  ];
+
   buildInputs = [
     libcap_ng
     libkrunfw'

pkgs/by-name/li/libkrun/riscv64-non-tee-memory.patch

@@ -0,0 +1,357 @@
+From d4bb6e040ad7b6e6a6cf68ffced3b895c2753a18 Mon Sep 17 00:00:00 2001
+From: Zewei Yang <yangzewei@loongson.cn>
+Date: Thu, 19 Mar 2026 09:40:43 +0800
+Subject: [PATCH] vmm: fix riscv64 non-TEE memory region setup
+
+In non-x86 builds that don't use TEE features, vstate.rs used cfg!() to
+distinguish between TEE and non-TEE memory setup paths.
+
+cfg!() only evaluates to a compile-time constant; code in both branches
+still participates in compilation and type checking. As a result, normal
+riscv64 builds still type-check guest_memfd and memory attribute code,
+which leads to build failures.
+
+Refactor the memory-region setup into cfg-gated helpers so non-TEE builds
+do not compile TEE-only memory setup code, and reject unsupported
+TEE+architecture combinations during VM setup instead of during memory
+initialization.
+
+Upstream: https://github.com/libkrun/libkrun/commit/d4bb6e040ad7b6e6a6cf68ffced3b895c2753a18
+Backported to v1.19.0: the upstream diff does not apply as-is because of
+the intervening Rust 2024 edition migration / cargo fmt reordering of the
+`use kvm_bindings::{...}` blocks. Only those import hunks were adjusted;
+no functional change.
+
+Signed-off-by: Zewei Yang <yangzewei@loongson.cn>
+---
+diff --git a/src/vmm/src/builder.rs b/src/vmm/src/builder.rs
+index 6d50e7f..c0521b1 100644
+--- a/src/vmm/src/builder.rs
++++ b/src/vmm/src/builder.rs
+@@ -1562,6 +1562,23 @@ pub(crate) fn setup_vm(
+         .map_err(StartMicrovmError::Internal)?;
+     Ok(vm)
+ }
++
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
++fn validate_tee_config(tee: Tee) -> std::result::Result<(), StartMicrovmError> {
++    match tee {
++        #[cfg(feature = "amd-sev")]
++        Tee::Snp => Ok(()),
++        #[cfg(feature = "tdx")]
++        Tee::Tdx => Ok(()),
++        _ => Err(StartMicrovmError::InvalidTee),
++    }
++}
++
++#[cfg(all(feature = "tee", not(target_arch = "x86_64")))]
++fn validate_tee_config(_tee: Tee) -> std::result::Result<(), StartMicrovmError> {
++    Err(StartMicrovmError::InvalidTee)
++}
++
+ #[cfg(all(target_os = "linux", feature = "tee"))]
+ pub(crate) fn setup_vm(
+     kvm: &KvmContext,
+@@ -1569,6 +1586,8 @@ pub(crate) fn setup_vm(
+     resources: &super::resources::VmResources,
+     #[cfg(feature = "tdx")] _sender: Sender<WorkerMessage>,
+ ) -> std::result::Result<Vm, StartMicrovmError> {
++    validate_tee_config(resources.tee_config().tee)?;
++
+     let mut vm = Vm::new(
+         kvm.fd(),
+         resources.tee_config(),
+diff --git a/src/vmm/src/linux/vstate.rs b/src/vmm/src/linux/vstate.rs
+index 05e58fb..d87b743 100644
+--- a/src/vmm/src/linux/vstate.rs
++++ b/src/vmm/src/linux/vstate.rs
+@@ -41,7 +41,9 @@ use kbs_types::Tee;
+ use crate::resources::TeeConfig;
+ use crate::vmm_config::machine_config::CpuFeaturesTemplate;
+ #[cfg(target_arch = "x86_64")]
+-use cpuid::{c3, filter_cpuid, t2, VmSpec};
++use cpuid::{VmSpec, c3, filter_cpuid, t2};
++#[cfg(not(feature = "tee"))]
++use kvm_bindings::kvm_userspace_memory_region;
+ #[cfg(target_arch = "x86_64")]
+ use kvm_bindings::{
+     kvm_clock_data, kvm_debugregs, kvm_irqchip, kvm_lapic_state, kvm_mp_state, kvm_pit_state2,
+@@ -49,14 +51,14 @@ use kvm_bindings::{
+     KVM_CLOCK_TSC_STABLE, KVM_IRQCHIP_IOAPIC, KVM_IRQCHIP_PIC_MASTER, KVM_IRQCHIP_PIC_SLAVE,
+     KVM_MAX_CPUID_ENTRIES,
+ };
++use kvm_bindings::{KVM_API_VERSION, KVM_SYSTEM_EVENT_RESET, KVM_SYSTEM_EVENT_SHUTDOWN};
++#[cfg(feature = "tee")]
++use kvm_bindings::{KVM_CAP_EXIT_HYPERCALL, KVM_MEMORY_EXIT_FLAG_PRIVATE, kvm_enable_cap};
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
+ use kvm_bindings::{
+-    kvm_create_guest_memfd, kvm_userspace_memory_region, kvm_userspace_memory_region2,
+-    KVM_API_VERSION, KVM_MEM_GUEST_MEMFD, KVM_SYSTEM_EVENT_RESET, KVM_SYSTEM_EVENT_SHUTDOWN,
++    KVM_MEM_GUEST_MEMFD, KVM_MEMORY_ATTRIBUTE_PRIVATE, kvm_create_guest_memfd,
++    kvm_memory_attributes, kvm_userspace_memory_region2,
+ };
+-#[cfg(feature = "tee")]
+-use kvm_bindings::{kvm_enable_cap, KVM_CAP_EXIT_HYPERCALL, KVM_MEMORY_EXIT_FLAG_PRIVATE};
+-#[cfg(not(target_arch = "riscv64"))]
+-use kvm_bindings::{kvm_memory_attributes, KVM_MEMORY_ATTRIBUTE_PRIVATE};
+ use kvm_ioctls::{Cap::*, *};
+ use utils::eventfd::EventFd;
+ use utils::signal::{register_signal_handler, sigrtmin, Killable};
+@@ -661,90 +663,121 @@ impl Vm {
+         None
+     }
+ 
+-    #[allow(unused_mut)]
+-    fn memory_region_set(
++    // GuestMemfd is generally intended for either of two purposes:
++    // * sharing the memory with out-of-process components, and conversely,
++    // * hiding the memory completely from the VMM process (Confidential Computing).
++    //
++    // We only use it for the second use case currently, so don't even try to use it
++    // outside of TEE builds. Software-protected VMs are only available on x86_64 and
++    // are marked with strongly-worded warnings about them being for development only,
++    // as of late 2025. Also, on other architectures like aarch64, guest_memfd in
++    // general is unstable for now, so don't try to use it without a reason.
++
++    #[cfg(not(feature = "tee"))]
++    fn create_guest_physical_memory_slot(
+         &mut self,
+-        guest_mem: &GuestMemoryMmap,
++        host_addr: u64,
++        start: u64,
+         region: &GuestRegionMmap,
+     ) -> Result<()> {
+-        let host_addr = guest_mem.get_host_address(region.start_addr()).unwrap();
+-        let start = region.start_addr().raw_value();
+-        let end = start + region.len();
++        let memory_region = kvm_userspace_memory_region {
++            slot: self.next_mem_slot,
++            guest_phys_addr: start,
++            memory_size: region.len(),
++            userspace_addr: host_addr,
++            flags: 0,
++        };
+ 
+-        // GuestMemfd is generally intended for either of two purposes:
+-        // * sharing the memory with out-of-process components, and conversely,
+-        // * hiding the memory completely from the VMM process (Confidential Computing).
+-        //
+-        // We only use it for the second use case currently, so don't even try to use it
+-        // outside of TEE builds. Software-protected VMs are only available on x86_64 and
+-        // are marked with strongly-worded warnings about them being for development only,
+-        // as of late 2025. Also, on other architectures like aarch64, guest_memfd in
+-        // general is unstable for now, so don't try to use it without a reason.
+-
+-        if cfg!(not(feature = "tee")) {
+-            let memory_region = kvm_userspace_memory_region {
+-                slot: self.next_mem_slot,
+-                guest_phys_addr: start,
+-                memory_size: region.len(),
+-                userspace_addr: host_addr as u64,
+-                flags: 0,
+-            };
++        // Safe because we mapped the memory region and ensured regions do not overlap.
++        unsafe {
++            self.fd
++                .set_user_memory_region(memory_region)
++                .map_err(Error::SetUserMemoryRegion)?;
++        };
+ 
+-            // Safe because we mapped the memory region, we made sure that the regions
+-            // are not overlapping.
+-            unsafe {
+-                self.fd
+-                    .set_user_memory_region(memory_region)
+-                    .map_err(Error::SetUserMemoryRegion)?;
+-            };
+-        } else {
+-            if !self.fd.check_extension(GuestMemfd) {
+-                return Err(Error::KvmCap(GuestMemfd));
+-            }
++        Ok(())
++    }
+ 
+-            // Create a guest_memfd and set the region.
+-            let guest_memfd = self
+-                .fd
+-                .create_guest_memfd(kvm_create_guest_memfd {
+-                    size: region.size() as u64,
+-                    flags: 0,
+-                    reserved: [0; 6],
+-                })
+-                .map_err(Error::CreateGuestMemfd)?;
+-
+-            let memory_region = kvm_userspace_memory_region2 {
+-                slot: self.next_mem_slot,
+-                flags: KVM_MEM_GUEST_MEMFD,
+-                guest_phys_addr: start,
+-                memory_size: region.len(),
+-                userspace_addr: host_addr as u64,
+-                guest_memfd_offset: 0,
+-                guest_memfd: guest_memfd as u32,
+-                pad1: 0,
+-                pad2: [0; 14],
+-            };
+-
+-            // Safe because we mapped the memory region, we made sure that the regions
+-            // are not overlapping.
+-            unsafe {
+-                self.fd
+-                    .set_user_memory_region2(memory_region)
+-                    .map_err(Error::SetUserMemoryRegion)?;
+-            };
+-
+-            let attr = kvm_memory_attributes {
+-                address: start,
+-                size: region.len(),
+-                attributes: KVM_MEMORY_ATTRIBUTE_PRIVATE as u64,
++    #[cfg(all(feature = "tee", target_arch = "x86_64"))]
++    fn create_guest_physical_memory_slot(
++        &mut self,
++        host_addr: u64,
++        start: u64,
++        region: &GuestRegionMmap,
++    ) -> Result<()> {
++        let end = start + region.len();
++
++        if !self.fd.check_extension(GuestMemfd) {
++            return Err(Error::KvmCap(GuestMemfd));
++        }
++
++        // GuestMemfd is only used for confidential-memory setups in TEE builds.
++        let guest_memfd = self
++            .fd
++            .create_guest_memfd(kvm_create_guest_memfd {
++                size: region.size() as u64,
+                 flags: 0,
+-            };
++                reserved: [0; 6],
++            })
++            .map_err(Error::CreateGuestMemfd)?;
++
++        let memory_region = kvm_userspace_memory_region2 {
++            slot: self.next_mem_slot,
++            flags: KVM_MEM_GUEST_MEMFD,
++            guest_phys_addr: start,
++            memory_size: region.len(),
++            userspace_addr: host_addr,
++            guest_memfd_offset: 0,
++            guest_memfd: guest_memfd as u32,
++            pad1: 0,
++            pad2: [0; 14],
++        };
+ 
++        // Safe because we mapped the memory region and ensured regions do not overlap.
++        unsafe {
+             self.fd
+-                .set_memory_attributes(attr)
+-                .map_err(Error::SetMemoryAttributes)?;
++                .set_user_memory_region2(memory_region)
++                .map_err(Error::SetUserMemoryRegion)?;
++        };
+ 
+-            self.guest_memfds.push((Range { start, end }, guest_memfd));
+-        }
++        let attr = kvm_memory_attributes {
++            address: start,
++            size: region.len(),
++            attributes: KVM_MEMORY_ATTRIBUTE_PRIVATE as u64,
++            flags: 0,
++        };
++
++        self.fd
++            .set_memory_attributes(attr)
++            .map_err(Error::SetMemoryAttributes)?;
++
++        self.guest_memfds.push((Range { start, end }, guest_memfd));
++
++        Ok(())
++    }
++
++    #[cfg(all(feature = "tee", not(target_arch = "x86_64")))]
++    fn create_guest_physical_memory_slot(
++        &mut self,
++        _host_addr: u64,
++        _start: u64,
++        _region: &GuestRegionMmap,
++    ) -> Result<()> {
++        // TEE support should be rejected during VM setup on non-x86_64 targets.
++        // Do not silently fall back to the non-TEE path here, because that would
++        // ignore an invalid TEE configuration and create a normal VM instead.
++        Err(Error::InvalidTee)
++    }
++
++    fn memory_region_set(
++        &mut self,
++        guest_mem: &GuestMemoryMmap,
++        region: &GuestRegionMmap,
++    ) -> Result<()> {
++        let host_addr = guest_mem.get_host_address(region.start_addr()).unwrap() as u64;
++        let start = region.start_addr().raw_value();
++
++        self.create_guest_physical_memory_slot(host_addr, start, region)?;
+ 
+         self.next_mem_slot += 1;
+ 
+diff --git a/src/vmm/src/worker.rs b/src/vmm/src/worker.rs
+index d0131b9..a28ed55 100644
+--- a/src/vmm/src/worker.rs
++++ b/src/vmm/src/worker.rs
+@@ -1,20 +1,20 @@
+ use std::io;
+ use std::sync::{Arc, Mutex};
+ 
+-#[cfg(feature = "tee")]
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
+ use utils::worker_message::MemoryProperties;
+ use utils::worker_message::WorkerMessage;
+ 
+ use crossbeam_channel::Receiver;
+-#[cfg(feature = "tee")]
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
+ use crossbeam_channel::Sender;
+-#[cfg(feature = "tee")]
+-use kvm_bindings::{kvm_memory_attributes, KVM_MEMORY_ATTRIBUTE_PRIVATE};
+-#[cfg(feature = "tee")]
+-use libc::{fallocate, madvise, FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, MADV_DONTNEED};
+-#[cfg(feature = "tee")]
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
++use kvm_bindings::{KVM_MEMORY_ATTRIBUTE_PRIVATE, kvm_memory_attributes};
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
++use libc::{FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, MADV_DONTNEED, fallocate, madvise};
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
+ use std::ffi::c_void;
+-#[cfg(feature = "tee")]
++#[cfg(all(feature = "tee", target_arch = "x86_64"))]
+ use vm_memory::{
+     guest_memory::GuestMemory, Address, GuestAddress, GuestMemoryRegion, MemoryRegionAddress,
+ };
+@@ -59,15 +59,21 @@ impl super::Vmm {
+                     .send(self.vm.fd().set_irq_line(irq, active).is_ok())
+                     .unwrap();
+             }
+-            WorkerMessage::ConvertMemory(_sender, _properties) =>
+-            {
+-                #[cfg(feature = "tee")]
+-                self.convert_memory(_sender, _properties)
++            WorkerMessage::ConvertMemory(_sender, _properties) => {
++                #[cfg(all(feature = "tee", target_arch = "x86_64"))]
++                {
++                    self.convert_memory(_sender, _properties);
++                }
++
++                #[cfg(not(all(feature = "tee", target_arch = "x86_64")))]
++                {
++                    let _ = _sender.send(false);
++                }
+             }
+         }
+     }
+ 
+-    #[cfg(feature = "tee")]
++    #[cfg(all(feature = "tee", target_arch = "x86_64"))]
+     fn convert_memory(&self, sender: Sender<bool>, properties: MemoryProperties) {
+         let Some((guest_memfd, region_start)) = self.kvm_vm().guest_memfd_get(properties.gpa)
+         else {
+-- 
+2.51.0

pkgs/by-name/li/livekit-libwebrtc/package.nix

@@ -49,7 +49,7 @@ let
     "aarch64" = "arm64";
   };
   cpuName = stdenv.hostPlatform.parsed.cpu.name;
-  gnArch = platformMap."${cpuName}" or (throw "unsupported arch ${cpuName}");
+  gnArch = platformMap."${cpuName}" or "unsupported";
   gnOs =
     if stdenv.hostPlatform.isLinux then
       "linux"
@@ -352,6 +352,8 @@ stdenv.mkDerivation {
       WeetHet
       niklaskorz
     ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = lib.intersectLists (lib.platforms.linux ++ lib.platforms.darwin) (
+      lib.platforms.x86 ++ lib.platforms.aarch64 ++ lib.platforms.arm
+    );
   };
 }

pkgs/by-name/ma/matrix-tuwunel/package.nix

@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mfdX5HmuXf6s7zyT9AJUoz4v5v9Km+VX8z6KvRGq8F8=";
+    hash = "sha256-Csq8eHV2r28POX+Ce1lZ0ybIw5Wt3ABUbWg2W8p2lOw=";
   };
 
-  cargoHash = "sha256-jIgL/4i17H216goZ8DiFvIJTCKyjEHGiky3MTO5sQoY=";
+  cargoHash = "sha256-mShVBCwd8cwF7K1ILf1gn7ImaxwF73KP2YiDiAJV0f0=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/mo/mobilizon/alias.patch

@@ -1,13 +0,0 @@
-diff --git a/lib/federation/activity_pub/types/resources.ex b/lib/federation/activity_pub/types/resources.ex
-index fd1831e68..0fa00129a 100644
---- a/lib/federation/activity_pub/types/resources.ex
-+++ b/lib/federation/activity_pub/types/resources.ex
-@@ -4,7 +4,7 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Resources do
-   alias Mobilizon.Actors.Actor
-   alias Mobilizon.Federation.ActivityPub.Permission
-   alias Mobilizon.Federation.ActivityPub.Types.Entity
--  alias alias Mobilizon.Federation.ActivityStream
-+  alias Mobilizon.Federation.ActivityStream
-   alias Mobilizon.Federation.ActivityStream.Convertible
-   alias Mobilizon.Resources.Resource
-   alias Mobilizon.Service.Activity.Resource, as: ResourceActivity

pkgs/by-name/mo/mobilizon/common.nix

@@ -2,13 +2,20 @@
 rec {
 
   pname = "mobilizon";
-  version = "5.2.3";
+  version = "5.2.4";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "kaihuri";
     repo = pname;
     tag = version;
-    hash = "sha256-uMMmRP3T9KlF+S0xDk2rY2bqEjjM8zWJVRbegth4pdw=";
+    hash = "sha256-qsyuk3RnJXXG7ZYgtZlGvY3Wtq9aLKCrFiG/9nONUPw=";
   };
+
+  patches = [
+    # Portion of
+    # https://framagit.org/kaihuri/mobilizon/-/commit/df7f9ce8081aedf94856b6c58067b3db6ce0eb39,
+    # but framagit put Anubis in front of everything, so we can't download the patch anymore…
+    ./json_polyfill.patch
+  ];
 }

pkgs/by-name/mo/mobilizon/frontend.nix

@@ -9,9 +9,14 @@ let
   common = callPackage ./common.nix { };
 in
 buildNpmPackage {
-  inherit (common) pname version src;
+  inherit (common)
+    pname
+    version
+    src
+    patches
+    ;
 
-  npmDepsHash = "sha256-nqjqRdIF583cmUd/mg9+PogA8Tpo5mfh0R9IylDpWZg=";
+  npmDepsHash = "sha256-gvAHUgfS21UrZYUL/QUsAMymqh4g/Moo/+vTl6RH/7I=";
 
   nativeBuildInputs = [ imagemagick ];
 

pkgs/by-name/mo/mobilizon/json_polyfill.patch

@@ -0,0 +1,25 @@
+diff --git a/mix.exs b/mix.exs
+index 82fd7bf11..31d40fd26 100644
+--- a/mix.exs
++++ b/mix.exs
+@@ -246,8 +246,7 @@ defmodule Mobilizon.Mixfile do
+       {:haversine, "~> 0.1.0"},
+       {:ecto_dev_logger, "~> 0.7"},
+       {:castore, "~> 1.0"},
+-      {:credo_code_climate, "~> 0.1.0", only: [:dev, :test]},
+-      {:json_polyfill, "~> 0.2"}
++      {:credo_code_climate, "~> 0.1.0", only: [:dev, :test]}
+     ] ++ oauth_deps()
+   end
+
+--- a/mix.lock
++++ b/mix.lock
+@@ -82,7 +82,6 @@
+   "ip_reserved": {:hex, :ip_reserved, "0.1.1", "e5112d71f1abf05207f82fd9597d369a5fde1e0b6d1bbe77c02a99bb26ecdc33", [:mix], [{:inet_cidr, "~> 1.0.0", [hex: :inet_cidr, repo: "hexpm", optional: false]}], "hexpm", "55fcd2b6e211caef09ea3f54ef37d43030bec486325d12fe865ab5ed8140a4fe"},
+   "jason": {:hex, :jason, "1.4.5", "2e3a008590b0b8d7388c20293e9dcc9cf3e5d642fd2a114e4cbbb52e595d940a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"},
+   "jose": {:hex, :jose, "1.11.12", "06e62b467b61d3726cbc19e9b5489f7549c37993de846dfb3ee8259f9ed208b3", [:mix, :rebar3], [], "hexpm", "31e92b653e9210b696765cdd885437457de1add2a9011d92f8cf63e4641bab7b"},
+-  "json_polyfill": {:hex, :json_polyfill, "0.2.2", "789016c5b87a043f12196c840480264e630b1955e2e28f124cd38df7b0a95b25", [:rebar3], [], "hexpm", "33cb73ade53df5967375817e64e8af3c6ba35524b2f8b31eb94c265291e724d9"},
+   "jumper": {:hex, :jumper, "1.0.2", "68cdcd84472a00ac596b4e6459a41b3062d4427cbd4f1e8c8793c5b54f1406a7", [:mix], [], "hexpm", "9b7782409021e01ab3c08270e26f36eb62976a38c1aa64b2eaf6348422f165e1"},
+   "junit_formatter": {:hex, :junit_formatter, "3.4.0", "d0e8db6c34dab6d3c4154c3b46b21540db1109ae709d6cf99ba7e7a2ce4b1ac2", [:mix], [], "hexpm", "bb36e2ae83f1ced6ab931c4ce51dd3dbef1ef61bb4932412e173b0cfa259dacd"},
+   "linkify": {:hex, :linkify, "0.5.3", "5f8143d8f61f5ff08d3aeeff47ef6509492b4948d8f08007fbf66e4d2246a7f2", [:mix], [], "hexpm", "3ef35a1377d47c25506e07c1c005ea9d38d700699d92ee92825f024434258177"},
+

pkgs/by-name/mo/mobilizon/mix.nix

@@ -17,12 +17,12 @@ let
     {
       absinthe = buildMix rec {
         name = "absinthe";
-        version = "1.9.1";
+        version = "1.11.0";
 
         src = fetchHex {
           pkg = "absinthe";
           version = "${version}";
-          sha256 = "d93e1aa61d68b974f48d5660104cb911ae045ee3a5d69954d251f91f3dbe2077";
+          sha256 = "39b3b4b6e3eb405fa98b449feef0dacff81d89bf01c2866cfa513616c5530ba6";
         };
 
         beamDeps = [
@@ -35,12 +35,12 @@ let
 
       absinthe_phoenix = buildMix rec {
         name = "absinthe_phoenix";
-        version = "2.0.4";
+        version = "2.0.5";
 
         src = fetchHex {
           pkg = "absinthe_phoenix";
           version = "${version}";
-          sha256 = "66617ee63b725256ca16264364148b10b19e2ecb177488cd6353584f2e6c1cf3";
+          sha256 = "086c6d4a1c32f7444713130d204c87b1b006169f5159026b73f02f7d38ccd05c";
         };
 
         beamDeps = [
@@ -55,12 +55,12 @@ let
 
       absinthe_plug = buildMix rec {
         name = "absinthe_plug";
-        version = "1.5.9";
+        version = "1.5.10";
 
         src = fetchHex {
           pkg = "absinthe_plug";
           version = "${version}";
-          sha256 = "dcdc84334b0e9e2cd439bd2653678a822623f212c71088edf0a4a7d03f1fa225";
+          sha256 = "489ac1951c8e4128571141c60a0669a720619bc161f801a8c6be8cfaf7ab0979";
         };
 
         beamDeps = [
@@ -100,12 +100,12 @@ let
 
       bandit = buildMix rec {
         name = "bandit";
-        version = "1.10.3";
+        version = "1.12.0";
 
         src = fetchHex {
           pkg = "bandit";
           version = "${version}";
-          sha256 = "99a52d909c48db65ca598e1962797659e3c0f1d06e825a50c3d75b74a5e2db18";
+          sha256 = "45dac82dc86f45cf4a196dee9cc5a8b791d9c9469d996055f055e6ee36c66e20";
         };
 
         beamDeps = [
@@ -150,12 +150,12 @@ let
 
       castore = buildMix rec {
         name = "castore";
-        version = "1.0.18";
+        version = "1.0.19";
 
         src = fetchHex {
           pkg = "castore";
           version = "${version}";
-          sha256 = "f393e4fe6317829b158fb74d86eb681f737d2fe326aa61ccf6293c4104957e34";
+          sha256 = "3669e6cab13f54c2df26b3e6833745d647f35b6e30d8ddd5975df0d5c842ca98";
         };
 
         beamDeps = [ ];
@@ -176,12 +176,12 @@ let
 
       cldr_utils = buildMix rec {
         name = "cldr_utils";
-        version = "2.29.5";
+        version = "2.29.7";
 
         src = fetchHex {
           pkg = "cldr_utils";
           version = "${version}";
-          sha256 = "962d3a2028b232ee0a5373941dc411028a9442f53444a4d5d2c354f687db1835";
+          sha256 = "4bddcd597fee34e2d2829ae9ef62bcfef8d97ae5f6b75f0c6ee37a3db31aa73a";
         };
 
         beamDeps = [
@@ -245,12 +245,12 @@ let
 
       credo = buildMix rec {
         name = "credo";
-        version = "1.7.17";
+        version = "1.7.19";
 
         src = fetchHex {
           pkg = "credo";
           version = "${version}";
-          sha256 = "1eb5645c835f0b6c9b5410f94b5a185057bcf6d62a9c2b476da971cde8749645";
+          sha256 = "2d8bc95d5a7bb99dd2613621d4f08c6a3575c3fd4b62e6a2b48a100352a557b8";
         };
 
         beamDeps = [
@@ -294,12 +294,12 @@ let
 
       db_connection = buildMix rec {
         name = "db_connection";
-        version = "2.9.0";
+        version = "2.10.1";
 
         src = fetchHex {
           pkg = "db_connection";
           version = "${version}";
-          sha256 = "17d502eacaf61829db98facf6f20808ed33da6ccf495354a41e64fe42f9c509c";
+          sha256 = "18ed94c6e627b4bf452dbd4df61b69a35a1e768525140bc1917b7a685026a6a3";
         };
 
         beamDeps = [ telemetry ];
@@ -307,12 +307,12 @@ let
 
       decimal = buildMix rec {
         name = "decimal";
-        version = "2.3.0";
+        version = "2.4.1";
 
         src = fetchHex {
           pkg = "decimal";
           version = "${version}";
-          sha256 = "a4d66355cb29cb47c3cf30e71329e58361cfcb37c34235ef3bf1d7bf3773aeac";
+          sha256 = "7e618897933a8455f19a727d7c5e50a2c071a544b700e5e724298ecb4340187f";
         };
 
         beamDeps = [ ];
@@ -333,18 +333,15 @@ let
 
       digital_token = buildMix rec {
         name = "digital_token";
-        version = "1.0.0";
+        version = "2.0.0";
 
         src = fetchHex {
           pkg = "digital_token";
           version = "${version}";
-          sha256 = "8ed6f5a8c2fa7b07147b9963db506a1b4c7475d9afca6492136535b064c9e9e6";
+          sha256 = "cbd2fff52770284a8251540a4b4e529e9738c6fe052d7f3c3428eb5c817385cd";
         };
 
-        beamDeps = [
-          cldr_utils
-          jason
-        ];
+        beamDeps = [ ];
       };
 
       doctor = buildMix rec {
@@ -362,12 +359,12 @@ let
 
       earmark_parser = buildMix rec {
         name = "earmark_parser";
-        version = "1.4.44";
+        version = "1.4.45";
 
         src = fetchHex {
           pkg = "earmark_parser";
           version = "${version}";
-          sha256 = "4778ac752b4701a5599215f7030989c989ffdc4f6df457c5f36938cc2d2a2750";
+          sha256 = "d3ec045bf122965db20c0bdb420e19ee1415843135327124918473feb4b328e8";
         };
 
         beamDeps = [ ];
@@ -388,12 +385,12 @@ let
 
       ecto = buildMix rec {
         name = "ecto";
-        version = "3.13.5";
+        version = "3.13.6";
 
         src = fetchHex {
           pkg = "ecto";
           version = "${version}";
-          sha256 = "df9efebf70cf94142739ba357499661ef5dbb559ef902b68ea1f3c1fabce36de";
+          sha256 = "8afa059bc16cd2c94739ec0a11e3e5df69d828125119109bef35f20a21a76af2";
         };
 
         beamDeps = [
@@ -503,12 +500,12 @@ let
 
       elixir_make = buildMix rec {
         name = "elixir_make";
-        version = "0.9.0";
+        version = "0.10.0";
 
         src = fetchHex {
           pkg = "elixir_make";
           version = "${version}";
-          sha256 = "db23d4fd8b757462ad02f8aa73431a426fe6671c80b200d9710caf3d1dd0ffdb";
+          sha256 = "dc1f09fb7fa68866b886abd5f0f3c83553b1a19a52359a899e92af1bb3b31982";
         };
 
         beamDeps = [ ];
@@ -516,12 +513,12 @@ let
 
       erlex = buildMix rec {
         name = "erlex";
-        version = "0.2.8";
+        version = "0.2.9";
 
         src = fetchHex {
           pkg = "erlex";
           version = "${version}";
-          sha256 = "9d66ff9fedf69e49dc3fd12831e12a8a37b76f8651dd21cd45fcf5561a8a7590";
+          sha256 = "8cfffc0ec7159e6d73de2ab28a588064de80f88b2798d5cbe4482cbbc200178b";
         };
 
         beamDeps = [ ];
@@ -555,12 +552,12 @@ let
 
       ex_cldr = buildMix rec {
         name = "ex_cldr";
-        version = "2.47.2";
+        version = "2.47.4";
 
         src = fetchHex {
           pkg = "ex_cldr";
           version = "${version}";
-          sha256 = "4a7cef380a1c2546166b45d6ee5e8e2f707ea695b12ae6dadd250201588b4f16";
+          sha256 = "918aabc032955f3eac70abbdf2c5469433132edfaaaccee55451f074ee1ccdba";
         };
 
         beamDeps = [
@@ -574,12 +571,12 @@ let
 
       ex_cldr_calendars = buildMix rec {
         name = "ex_cldr_calendars";
-        version = "2.4.2";
+        version = "2.4.3";
 
         src = fetchHex {
           pkg = "ex_cldr_calendars";
           version = "${version}";
-          sha256 = "ab69fd04bc1ae18baf9d2e57335d4754c5ac263076ea397eb112621702251fe5";
+          sha256 = "b46ef6bd74f7e2dc3de27366f79372b1e630563bcf09b7803fec162e28d4a85e";
         };
 
         beamDeps = [
@@ -591,12 +588,12 @@ let
 
       ex_cldr_currencies = buildMix rec {
         name = "ex_cldr_currencies";
-        version = "2.17.1";
+        version = "2.17.2";
 
         src = fetchHex {
           pkg = "ex_cldr_currencies";
           version = "${version}";
-          sha256 = "e266a0a61f4c7d83608154d49b59e4d7485b2aaa7ba1d0e17b3c55910595de51";
+          sha256 = "797095c106a2fe6632981531e29cfb1d2f8ee7de626f4d6243f974d6f74a0112";
         };
 
         beamDeps = [
@@ -639,12 +636,12 @@ let
 
       ex_cldr_numbers = buildMix rec {
         name = "ex_cldr_numbers";
-        version = "2.38.1";
+        version = "2.38.3";
 
         src = fetchHex {
           pkg = "ex_cldr_numbers";
           version = "${version}";
-          sha256 = "4f95738f1dc4e821485e52226666f7691c9276bf6eba49cba8d23c8a2db05e84";
+          sha256 = "3a0d87ef2747c66d78ae8967023d415d3d76aa310981047ad601e3287e8fe73c";
         };
 
         beamDeps = [
@@ -658,12 +655,12 @@ let
 
       ex_cldr_plugs = buildMix rec {
         name = "ex_cldr_plugs";
-        version = "1.3.4";
+        version = "1.4.0";
 
         src = fetchHex {
           pkg = "ex_cldr_plugs";
           version = "${version}";
-          sha256 = "30829e097eac403013101dc087e6cabf5e01a1c5e3a6b23ea4562e85521ff52a";
+          sha256 = "0859ccd533bddd00a36008ea970ba2d6440c8f01b1d73b115f445015046277bc";
         };
 
         beamDeps = [
@@ -676,12 +673,12 @@ let
 
       ex_doc = buildMix rec {
         name = "ex_doc";
-        version = "0.40.1";
+        version = "0.40.3";
 
         src = fetchHex {
           pkg = "ex_doc";
           version = "${version}";
-          sha256 = "bcef0e2d360d93ac19f01a85d58f91752d930c0a30e2681145feea6bd3516e00";
+          sha256 = "2756e357742fecd9749b489b85d67c9ce99c465f2e75728d9e6dc8d704b973de";
         };
 
         beamDeps = [
@@ -874,12 +871,12 @@ let
 
       floki = buildMix rec {
         name = "floki";
-        version = "0.38.1";
+        version = "0.38.4";
 
         src = fetchHex {
           pkg = "floki";
           version = "${version}";
-          sha256 = "e744bf0db7ee34b2c8b62767f04071107af0516a81144b9a2f73fe0494200e5b";
+          sha256 = "bdb34645eee8e79845c7edaca2d4099a52804ee4d4a3ecc683a69451f0244973";
         };
 
         beamDeps = [ ];
@@ -944,12 +941,12 @@ let
 
       geolix = buildMix rec {
         name = "geolix";
-        version = "2.0.0";
+        version = "2.1.0";
 
         src = fetchHex {
           pkg = "geolix";
           version = "${version}";
-          sha256 = "8742bf588ed0bb7def2c443204d09d355990846c6efdff96ded66aac24c301df";
+          sha256 = "0b871bc2db8efd0114d1fd7087c83180056a1fff20d90946c89d32200e368651";
         };
 
         beamDeps = [ ];
@@ -1109,15 +1106,15 @@ let
 
       http_signatures = buildMix rec {
         name = "http_signatures";
-        version = "0.1.2";
+        version = "0.1.3";
 
         src = fetchHex {
           pkg = "http_signatures";
           version = "${version}";
-          sha256 = "f08aa9ac121829dae109d608d83c84b940ef2f183ae50f2dd1e9a8bc619d8be7";
+          sha256 = "20313a65516db88006f85b090f6f76cc5b04e9609b45943657e6781eb91174f4";
         };
 
-        beamDeps = [ ];
+        beamDeps = [ plug ];
       };
 
       httpoison = buildMix rec {
@@ -1174,12 +1171,12 @@ let
 
       jason = buildMix rec {
         name = "jason";
-        version = "1.4.4";
+        version = "1.4.5";
 
         src = fetchHex {
           pkg = "jason";
           version = "${version}";
-          sha256 = "c5eb0cab91f094599f94d55bc63409236a8ec69a21a67814529e8d5f6cc90b3b";
+          sha256 = "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684";
         };
 
         beamDeps = [ decimal ];
@@ -1268,12 +1265,12 @@ let
 
       makeup_erlang = buildMix rec {
         name = "makeup_erlang";
-        version = "1.0.3";
+        version = "1.1.0";
 
         src = fetchHex {
           pkg = "makeup_erlang";
           version = "${version}";
-          sha256 = "953297c02582a33411ac6208f2c6e55f0e870df7f80da724ed613f10e6706afd";
+          sha256 = "1cd6780fb1dd1a03979abaed0fe82712b0625118fd5257d3ebbf73f960c73c3c";
         };
 
         beamDeps = [ makeup ];
@@ -1320,12 +1317,12 @@ let
 
       mimerl = buildRebar3 rec {
         name = "mimerl";
-        version = "1.4.0";
+        version = "1.5.0";
 
         src = fetchHex {
           pkg = "mimerl";
           version = "${version}";
-          sha256 = "13af15f9f68c65884ecca3a3891d50a7b57d82152792f3e19d88650aa126b144";
+          sha256 = "db648ce065bae14ea84ca8b5dd123f42f49417cef693541110bf6f9e9be9ecc4";
         };
 
         beamDeps = [ ];
@@ -1476,12 +1473,12 @@ let
 
       oauth2 = buildMix rec {
         name = "oauth2";
-        version = "2.1.0";
+        version = "2.1.1";
 
         src = fetchHex {
           pkg = "oauth2";
           version = "${version}";
-          sha256 = "8ac07f85b3307dd1acfeb0ec852f64161b22f57d0ce0c15e616a1dfc8ebe2b41";
+          sha256 = "1d5997cb1ff1643dac17076b6c00c91e4381d8389f3c49a8c390984606dad439";
         };
 
         beamDeps = [ tesla ];
@@ -1502,12 +1499,12 @@ let
 
       oban = buildMix rec {
         name = "oban";
-        version = "2.20.3";
+        version = "2.23.0";
 
         src = fetchHex {
           pkg = "oban";
           version = "${version}";
-          sha256 = "075ffbf1279a96bec495bc63d647b08929837d70bcc0427249ffe4d1dddaec33";
+          sha256 = "8e5f0cec5abecce78dd08cb14dc5438db90ec3884987b44773ce76fe60dd3f81";
         };
 
         beamDeps = [
@@ -1518,6 +1515,23 @@ let
         ];
       };
 
+      oidcc = buildMix rec {
+        name = "oidcc";
+        version = "3.7.2";
+
+        src = fetchHex {
+          pkg = "oidcc";
+          version = "${version}";
+          sha256 = "e3f1ed91509fdeb31ec8b9de4ecda0e80cb68b463a9f5b7a9ee1ee40e521e445";
+        };
+
+        beamDeps = [
+          jose
+          telemetry
+          telemetry_registry
+        ];
+      };
+
       paasaa = buildMix rec {
         name = "paasaa";
         version = "1.0.0";
@@ -1546,12 +1560,12 @@ let
 
       phoenix = buildMix rec {
         name = "phoenix";
-        version = "1.8.5";
+        version = "1.8.8";
 
         src = fetchHex {
           pkg = "phoenix";
           version = "${version}";
-          sha256 = "83b2bb125127e02e9f475c8e3e92736325b5b01b0b9b05407bcb4083b7a32485";
+          sha256 = "f0c843037bd2e7012fc1d1ec9574dfa6972b7e3d09e9b77fd23aa283af0aa994";
         };
 
         beamDeps = [
@@ -1632,12 +1646,12 @@ let
 
       phoenix_live_view = buildMix rec {
         name = "phoenix_live_view";
-        version = "1.1.27";
+        version = "1.2.3";
 
         src = fetchHex {
           pkg = "phoenix_live_view";
           version = "${version}";
-          sha256 = "415735d0b2c612c9104108b35654e977626a0cb346711e1e4f1ed16e3c827ede";
+          sha256 = "449affd6aea24daaa2f6b43748fc1e2c6a87610df996cc1f54e7b19a7a18e638";
         };
 
         beamDeps = [
@@ -1714,12 +1728,12 @@ let
 
       plug = buildMix rec {
         name = "plug";
-        version = "1.19.1";
+        version = "1.20.1";
 
         src = fetchHex {
           pkg = "plug";
           version = "${version}";
-          sha256 = "560a0017a8f6d5d30146916862aaf9300b7280063651dd7e532b8be168511e62";
+          sha256 = "892d2a1a7a3f5368c5a3b9067bba1050c031495f48c430ec00b09691dbf211b7";
         };
 
         beamDeps = [
@@ -1757,12 +1771,12 @@ let
 
       postgrex = buildMix rec {
         name = "postgrex";
-        version = "0.22.0";
+        version = "0.22.2";
 
         src = fetchHex {
           pkg = "postgrex";
           version = "${version}";
-          sha256 = "a68c4261e299597909e03e6f8ff5a13876f5caadaddd0d23af0d0a61afcc5d84";
+          sha256 = "8946382ddb06294f56026ac4278b3cc212bac8a2c82ed68b4087819ed1abc53b";
         };
 
         beamDeps = [
@@ -1877,12 +1891,12 @@ let
 
       sleeplocks = buildRebar3 rec {
         name = "sleeplocks";
-        version = "1.1.3";
+        version = "1.1.4";
 
         src = fetchHex {
           pkg = "sleeplocks";
           version = "${version}";
-          sha256 = "d3b3958552e6eb16f463921e70ae7c767519ef8f5be46d7696cc1ed649421321";
+          sha256 = "bc12752ab0693ea4e4a3bcf4e063cef408d71197a3c0fad75497fabd475f5481";
         };
 
         beamDeps = [ ];
@@ -1968,12 +1982,12 @@ let
 
       swoosh = buildMix rec {
         name = "swoosh";
-        version = "1.23.1";
+        version = "1.26.2";
 
         src = fetchHex {
           pkg = "swoosh";
           version = "${version}";
-          sha256 = "3193813b462d6dd519e907c680df04988c47bae372b4159e0c4c9f1c42dffea3";
+          sha256 = "08c6a1636b82721d0f64259053a733526526d077011ff6a7776f80e21dc60757";
         };
 
         beamDeps = [
@@ -1990,25 +2004,38 @@ let
 
       telemetry = buildRebar3 rec {
         name = "telemetry";
-        version = "1.4.1";
+        version = "1.4.2";
 
         src = fetchHex {
           pkg = "telemetry";
           version = "${version}";
-          sha256 = "2172e05a27531d3d31dd9782841065c50dd5c3c7699d95266b2edd54c2dafa1c";
+          sha256 = "928f6495066506077862c0d1646609eed891a4326bee3126ba54b60af61febb1";
         };
 
         beamDeps = [ ];
       };
 
+      telemetry_registry = buildMix rec {
+        name = "telemetry_registry";
+        version = "0.3.2";
+
+        src = fetchHex {
+          pkg = "telemetry_registry";
+          version = "${version}";
+          sha256 = "e7ed191eb1d115a3034af8e1e35e4e63d5348851d556646d46ca3d1b4e16bab9";
+        };
+
+        beamDeps = [ telemetry ];
+      };
+
       tesla = buildMix rec {
         name = "tesla";
-        version = "1.16.0";
+        version = "1.20.0";
 
         src = fetchHex {
           pkg = "tesla";
           version = "${version}";
-          sha256 = "eb3bdfc0c6c8a23b4e3d86558e812e3577acff1cb4acb6cfe2da1985a1035b89";
+          sha256 = "3ecb41cb458772332752c3acdfe983e23abb991f5a43cfd69a64e9ea3f4b0061";
         };
 
         beamDeps = [
@@ -2023,12 +2050,12 @@ let
 
       thousand_island = buildMix rec {
         name = "thousand_island";
-        version = "1.4.3";
+        version = "1.5.0";
 
         src = fetchHex {
           pkg = "thousand_island";
           version = "${version}";
-          sha256 = "6e4ce09b0fd761a58594d02814d40f77daff460c48a7354a15ab353bb998ea0b";
+          sha256 = "708923d40523e43cf99041ab37a0d4b0ec426ac6438fa3716ab23d919eaeb412";
         };
 
         beamDeps = [ telemetry ];
@@ -2053,12 +2080,12 @@ let
 
       tls_certificate_check = buildRebar3 rec {
         name = "tls_certificate_check";
-        version = "1.32.0";
+        version = "1.33.0";
 
         src = fetchHex {
           pkg = "tls_certificate_check";
           version = "${version}";
-          sha256 = "38e38db768244d808e11ed27f812e7d927ea5f999007b07d0473db44d7f7cc51";
+          sha256 = "cab9a7439e2dbfe91b38104f2d8a4b6d61dbc4d3a5ad59ac364713a88c6cfd9b";
         };
 
         beamDeps = [ ssl_verify_fun ];
@@ -2084,12 +2111,12 @@ let
 
       tzdata = buildMix rec {
         name = "tzdata";
-        version = "1.1.3";
+        version = "1.1.4";
 
         src = fetchHex {
           pkg = "tzdata";
           version = "${version}";
-          sha256 = "d4ca85575a064d29d4e94253ee95912edfb165938743dbf002acdf0dcecb0c28";
+          sha256 = "ab48888699de8ff4a255522fd858abe81bac2e64690a375e6cb590112cf4a24e";
         };
 
         beamDeps = [ hackney ];
@@ -2221,6 +2248,23 @@ let
         ];
       };
 
+      ueberauth_oidcc = buildMix rec {
+        name = "ueberauth_oidcc";
+        version = "0.4.2";
+
+        src = fetchHex {
+          pkg = "ueberauth_oidcc";
+          version = "${version}";
+          sha256 = "b9ea3c981464a5052e4f4fbf0a3c716e124da056aca30b9754654c5c6f90f8c2";
+        };
+
+        beamDeps = [
+          oidcc
+          plug
+          ueberauth
+        ];
+      };
+
       ueberauth_twitter = buildMix rec {
         name = "ueberauth_twitter";
         version = "0.4.1";

pkgs/by-name/mo/mobilizon/package.nix

@@ -1,10 +1,11 @@
 {
   lib,
   callPackage,
-  writeScript,
+  writeShellScriptBin,
   beam,
   mix2nix,
   fetchFromGitHub,
+  applyPatches,
   git,
   cmake,
   nixosTests,
@@ -18,10 +19,12 @@ let
   common = callPackage ./common.nix { };
 in
 beamPackages.mixRelease rec {
-  inherit (common) pname version src;
-
-  # A typo that is a build failure on elixir 1.18
-  patches = [ ./alias.patch ];
+  inherit (common)
+    pname
+    version
+    src
+    patches
+    ;
 
   nativeBuildInputs = [
     git
@@ -51,8 +54,8 @@ beamPackages.mixRelease rec {
             repo = "cldr";
             rev = "v${old.version}";
             hash =
-              assert old.version == "2.47.2";
-              "sha256-XiShurm4i/Qxop1nE4Z/8tMj5953kUqn+4kBrILxO+Y=";
+              assert old.version == "2.47.4";
+              "sha256-LIQK6pZRAW1T3Ej2XAjnuPo82hPJ2KiMPWYmHWgx008=";
           };
           postInstall = ''
             cp $src/priv/cldr/locales/* $out/lib/erlang/lib/ex_cldr-${old.version}/priv/cldr/locales/
@@ -141,12 +144,18 @@ beamPackages.mixRelease rec {
 
   passthru = {
     tests = { inherit (nixosTests) mobilizon; };
-    updateScript = writeScript "update-mobilizon" ''
-      set -euo pipefail
+    updateScript =
+      let
+        patchedSource = applyPatches {
+          inherit src patches;
+        };
+      in
+      writeShellScriptBin "update-mobilizon" ''
+        set -euo pipefail
 
-      ${lib.getExe mix2nix} '${src}/mix.lock' > pkgs/by-name/mo/mobilizon/mix.nix
-      ${lib.getExe nixfmt} pkgs/by-name/mo/mobilizon/mix.nix
-    '';
+        ${lib.getExe mix2nix} '${patchedSource}/mix.lock' > pkgs/by-name/mo/mobilizon/mix.nix
+        ${lib.getExe nixfmt} pkgs/by-name/mo/mobilizon/mix.nix
+      '';
     elixirPackage = beamPackages.elixir;
     inherit mixNixDeps;
   };

pkgs/by-name/ne/networkmanager/fix-paths.patch

@@ -10,29 +10,8 @@ index 148acade5c..6395fbfbe5 100644
 +PROGRAM="@runtimeShell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
  
  LABEL="nm_drivers_end"
-diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
-index e310a9c680..ed8d838e43 100644
---- a/src/core/devices/nm-device.c
-+++ b/src/core/devices/nm-device.c
-@@ -15239,14 +15239,14 @@ nm_device_start_ip_check(NMDevice *self)
-             gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET);
-             if (gw) {
-                 nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
--                ping_binary = nm_utils_find_helper("ping", "/usr/bin/ping", NULL);
-+                ping_binary = "@iputils@/bin/ping";
-                 log_domain  = LOGD_IP4;
-             }
-         } else if (priv->ip_data_6.state == NM_DEVICE_IP_STATE_READY) {
-             gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET6);
-             if (gw) {
-                 nm_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf);
--                ping_binary = nm_utils_find_helper("ping6", "/usr/bin/ping6", NULL);
-+                ping_binary = "@iputils@/bin/ping";
-                 log_domain  = LOGD_IP6;
-             }
-         }
 diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
-index cbe76f5f1c..6ec684f9fe 100644
+index cbe76f5f1c..0fc28b83e7 100644
 --- a/src/libnmc-base/nm-vpn-helpers.c
 +++ b/src/libnmc-base/nm-vpn-helpers.c
 @@ -284,15 +284,6 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
@@ -51,7 +30,7 @@ index cbe76f5f1c..6ec684f9fe 100644
      const char *oc_argv[(12 + 2 * G_N_ELEMENTS(oc_property_args))];
      const char *gw;
      int         port;
-@@ -311,13 +302,8 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
+@@ -311,13 +302,7 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
  
      port = extract_url_port(gw);
  
@@ -63,7 +42,6 @@ index cbe76f5f1c..6ec684f9fe 100644
 -                                         NULL,
 -                                         error);
 +    path = g_find_program_in_path("openconnect");
-+
      if (!path)
          return FALSE;
  

pkgs/by-name/ne/networkmanager/package.nix

@@ -1,74 +1,93 @@
 {
-  lib,
-  stdenv,
   fetchurl,
-  replaceVars,
-  gettext,
-  pkg-config,
-  dbus,
   gitUpdater,
-  libuuid,
-  polkit,
-  gnutls,
-  ppp,
-  dhcpcd,
-  iptables,
-  nftables,
-  python3,
-  vala,
-  libgcrypt,
-  dnsmasq,
-  bluez5,
-  readline,
-  libselinux,
-  audit,
-  gobject-introspection,
-  perl,
-  modemmanager,
-  openresolv,
-  libndp,
-  newt,
-  ethtool,
-  gnused,
-  iputils,
-  kmod,
-  jansson,
+  lib,
+  nixosTests,
+  replaceVars,
+  stdenv,
+
+  # build
+  bpftools,
+  clang,
   elfutils,
-  gtk-doc,
-  libxslt,
-  docbook_xsl,
-  docbook_xml_dtd_412,
-  docbook_xml_dtd_42,
-  docbook_xml_dtd_43,
-  curl,
+  gettext,
+  gnused,
   meson,
   mesonEmulatorHook,
   ninja,
-  libnvme,
-  libpsl,
-  mobile-broadband-provider-info,
+  perl,
+  pkg-config,
+  vala,
   runtimeShell,
   buildPackages,
-  nixosTests,
+
+  # libs
+  audit,
+  curl,
+  dbus,
+  gnutls,
+  gobject-introspection,
+  jansson,
+  libbpf,
+  libnvme,
+  libpsl,
+  libselinux,
+  libuuid,
+  polkit,
+  readline,
+  slang,
   systemd,
   udev,
-  udevCheckHook,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+
+  # external deps
+  bluez5,
+  dhcpcd,
+  dnsmasq,
+  ethtool,
+  iptables,
+  kmod,
+  libgcrypt,
+  libndp,
+  modemmanager,
+  mobile-broadband-provider-info,
+  newt,
+  nftables,
+  openresolv,
+  ppp,
+
+  # docs
+  docbook_xml_dtd_412,
+  docbook_xml_dtd_42,
+  docbook_xml_dtd_43,
+  docbook_xsl,
+  gtk-doc,
+  libxslt,
+  python3,
+
+  # install tests
+  udevCheckHook,
+
   # NBFT (NVMe Boot Firmware Table) support, opt-in due to closure size
   # https://github.com/NixOS/nixpkgs/pull/446121#discussion_r2380598419
   withNbft ? false,
 }:
 
 let
+  inherit (lib)
+    mesonBool
+    mesonOption
+    ;
+
   pythonForDocs = python3.pythonOnBuildForHost.withPackages (pkgs: with pkgs; [ pygobject3 ]);
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.56.0";
+  version = "1.58.0";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-WaMtOFzB564m5DeYxvEtB/9hmKvQQewGILOgjPwCHMw=";
+    hash = "sha256-DG8nA6LJsBfNaPv+HS6KGl1/8FE3x1HsQhy6NulFRro=";
   };
 
   outputs = [
@@ -79,6 +98,10 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
+  # TODO: only disable for clang used for bpf builds
+  # this breaks clang target bpf, which does not support -fzero-call-used-regs=used-gpr
+  hardeningDisable = [ "zerocallusedregs" ];
+
   # Right now we hardcode quite a few paths at build time. Probably we should
   # patch networkmanager to allow passing these path in config file. This will
   # remove unneeded build-time dependencies.
@@ -86,53 +109,52 @@ stdenv.mkDerivation (finalAttrs: {
     # System paths
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    (lib.mesonOption "systemdsystemunitdir" (
+    (mesonOption "systemdsystemunitdir" (
       if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no"
     ))
     # to enable link-local connections
-    "-Dudev_dir=${placeholder "out"}/lib/udev"
-    "-Ddbus_conf_dir=${placeholder "out"}/share/dbus-1/system.d"
-    "-Dkernel_firmware_dir=/run/current-system/firmware"
+    (mesonOption "udev_dir" "${placeholder "out"}/lib/udev")
+    (mesonOption "dbus_conf_dir" "${placeholder "out"}/share/dbus-1/system.d")
+    (mesonOption "kernel_firmware_dir" "/run/current-system/firmware")
 
     # Platform
-    "-Dmodprobe=${kmod}/bin/modprobe"
-    (lib.mesonOption "session_tracking" (if withSystemd then "systemd" else "no"))
-    (lib.mesonBool "systemd_journal" withSystemd)
-    "-Dlibaudit=yes-disabled-by-default"
-    "-Dpolkit_agent_helper_1=/run/wrappers/bin/polkit-agent-helper-1"
+    (mesonOption "modprobe" (lib.getExe' kmod "modprobe"))
+    (mesonOption "session_tracking" (if withSystemd then "systemd" else "no"))
+    (mesonBool "systemd_journal" withSystemd)
+    (mesonOption "libaudit" "yes-disabled-by-default")
+    (mesonOption "polkit_agent_helper_1" "/run/wrappers/bin/polkit-agent-helper-1")
 
     # Features
-    # Allow using iwd when configured to do so
-    "-Diwd=true"
-    "-Dpppd=${ppp}/bin/pppd"
-    "-Diptables=${iptables}/bin/iptables"
-    "-Dnft=${nftables}/bin/nft"
-    "-Dmodem_manager=true"
-    "-Dnmtui=true"
-    "-Ddnsmasq=${dnsmasq}/bin/dnsmasq"
-    "-Dqt=false"
-    (lib.mesonBool "nbft" withNbft)
+    (mesonBool "clat" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) # fails to find UAPI headers
+    (mesonBool "iwd" true)
+    (mesonOption "pppd" (lib.getExe' ppp "pppd"))
+    (mesonOption "iptables" (lib.getExe iptables))
+    (mesonOption "nft" (lib.getExe nftables))
+    (mesonBool "modem_manager" true)
+    (mesonBool "nmtui" true)
+    (mesonOption "dnsmasq" (lib.getExe dnsmasq))
+    (mesonBool "qt" false)
+    (mesonBool "nbft" withNbft)
 
     # Handlers
-    "-Dresolvconf=${openresolv}/bin/resolvconf"
+    (mesonOption "resolvconf" (lib.getExe openresolv))
 
     # DHCP clients
-    "-Ddhcpcd=${dhcpcd}/bin/dhcpcd"
+    (mesonOption "dhcpcd" (lib.getExe dhcpcd))
 
     # Miscellaneous
     # almost cross-compiles, however fails with
     # ** (process:9234): WARNING **: Failed to load shared library '/nix/store/...-networkmanager-aarch64-unknown-linux-gnu-1.38.2/lib/libnm.so.0' referenced by the typelib: /nix/store/...-networkmanager-aarch64-unknown-linux-gnu-1.38.2/lib/libnm.so.0: cannot open shared object file: No such file or directory
-    "-Ddocs=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Dman=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Dtests=no"
-    "-Dcrypto=gnutls"
-    "-Dmobile_broadband_provider_info_database=${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml"
+    (mesonBool "docs" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform))
+    (mesonBool "man" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform))
+    (mesonOption "tests" "no")
+    (mesonOption "crypto" "gnutls")
+    (mesonOption "mobile_broadband_provider_info_database" "${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml")
   ];
 
   patches = [
     (replaceVars ./fix-paths.patch {
       inherit
-        iputils
         ethtool
         gnused
         ;
@@ -144,24 +166,52 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-install-paths.patch
   ];
 
+  nativeBuildInputs = [
+    bpftools
+    clang
+    elfutils # used to find jansson soname
+    gettext
+    gobject-introspection
+    meson
+    ninja
+    perl
+    pkg-config
+    vala
+    udevCheckHook
+
+    # Docs
+    gtk-doc
+    libxslt
+    docbook_xsl
+    docbook_xml_dtd_412
+    docbook_xml_dtd_42
+    docbook_xml_dtd_43
+    pythonForDocs
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
+  ];
+
   buildInputs = [
-    (if withSystemd then systemd else udev)
-    libselinux
     audit
+    bluez5
+    curl
+    dbus # used to get directory paths with pkg-config during configuration
+    dnsmasq
+    jansson
+    libbpf
+    libndp
     libpsl
+    libselinux
     libuuid
+    mobile-broadband-provider-info
+    modemmanager
+    newt
     polkit
     ppp
-    libndp
-    curl
-    mobile-broadband-provider-info
-    bluez5
-    dnsmasq
-    modemmanager
     readline
-    newt
-    jansson
-    dbus # used to get directory paths with pkg-config during configuration
+    slang
+    (if withSystemd then systemd else udev)
   ]
   ++ lib.optionals withNbft [
     libnvme
@@ -172,28 +222,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgcrypt
   ];
 
-  nativeBuildInputs = [
-    meson
-    ninja
-    gettext
-    pkg-config
-    vala
-    gobject-introspection
-    perl
-    elfutils # used to find jansson soname
-    # Docs
-    gtk-doc
-    libxslt
-    docbook_xsl
-    docbook_xml_dtd_412
-    docbook_xml_dtd_42
-    docbook_xml_dtd_43
-    pythonForDocs
-    udevCheckHook
-  ]
-  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    mesonEmulatorHook
-  ];
+  nativeInstallCheckInputs = [ udevCheckHook ];
 
   doCheck = false; # requires /sys, the net
 
@@ -207,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   + lib.optionalString withSystemd ''
     substituteInPlace data/NetworkManager.service.in \
-      --replace-fail /usr/bin/busctl ${systemd}/bin/busctl
+      --replace-fail /usr/bin/busctl ${lib.getExe' systemd "busctl"}
   '';
 
   preBuild = ''
@@ -219,7 +248,7 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $PWD/src/libnm-client-impl/libnm.so.0 ${placeholder "out"}/lib/libnm.so.0
   '';
 
-  postFixup = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+  postFixup = lib.optionalString (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
     cp -r ${buildPackages.networkmanager.devdoc} $devdoc
     cp -r ${buildPackages.networkmanager.man} $man
   '';
@@ -231,9 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
       odd-unstable = true;
       url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git";
     };
-    tests = {
-      inherit (nixosTests.networking) networkmanager;
-    };
+    tests = nixosTests.networking.networkmanager;
   };
 
   meta = {

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py

@@ -236,7 +236,7 @@ class RendererMixin(Renderer):
             'included_preface': lambda *args: self._included_thing("preface", *args),
             'included_parts': lambda *args: self._included_thing("part", *args),
             'included_appendix': lambda *args: self._included_thing("appendix", *args),
-            'included_content': lambda *args: self._included_thing("content", *args),
+            'included_page': lambda *args: self._included_thing("page", *args),
             'included_options': self.included_options,
         }
 
@@ -396,7 +396,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
         intersection_observer_js = """
 //<![CDATA[
 function createObserver() {
-  const content = document.querySelector(".content");
+  const content = document.querySelector("main.content");
   const headings = content.querySelectorAll("h1, h2, h3, h4, h5, h6");
 
   const links = new Map();
@@ -739,7 +739,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
 
     def _build_config_include(self, nodes: list[ConfigNode], config_file: Path) -> Token:
         included = [self._build_config_item(node, config_file) for node in nodes]
-        token = Token('included_content', '', 0, map=[0, 1])
+        token = Token('included_page', '', 0, map=[0, 1])
         token.meta['included'] = included
         token.meta['include-args'] = {}
         return token
@@ -749,7 +749,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
             path = (config_file.parent / node.file).resolve()
             leaf_src = path.read_text()
             self._base_paths.append(path)
-            self._current_type.append('content')
+            self._current_type.append('page')
             try:
                 fragment = self._parse(leaf_src)
             finally:
@@ -884,7 +884,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
             title_html = (
                 f"<em>{title_html}</em>"
                 if typ == 'chapter'
-                else title_html if typ in [ 'book', 'part', 'content' ]
+                else title_html if typ in [ 'book', 'part', 'page' ]
                 else f'the section called “{title_html}”'
             )
         return XrefTarget(id, title_html, toc_html, re.sub('<.*?>', '', title), path, drop_fragment)

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual_structure.py

@@ -15,8 +15,8 @@ FragmentType = Literal['preface', 'part', 'chapter', 'section', 'appendix']
 
 # the TOC allows every fragment type. it also allows the enclosing book.
 # it allows 'example' and 'figure'.
-# --experimental-config adds a generic 'content' kind.
-TocEntryType = Literal['book', 'preface', 'part', 'chapter', 'section', 'appendix', 'example', 'figure', 'content']
+# --experimental-config adds a generic 'page' kind.
+TocEntryType = Literal['book', 'preface', 'part', 'chapter', 'section', 'appendix', 'example', 'figure', 'page']
 
 def is_include(token: Token) -> bool:
     return token.type == "fence" and token.info.startswith("{=include=} ")

pkgs/by-name/or/oracle-instantclient/package.nix

@@ -17,7 +17,7 @@ assert odbcSupport -> unixodbc != null;
 let
   inherit (lib) optional optionalString;
 
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+  throwSystem = "unsupported";
 
   # assemble list of components
   components = [

pkgs/by-name/ov/overused-grotesk/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  installFonts,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "overused-grotesk";
+  version = "0.5-alpha.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchzip {
+    url = "https://github.com/RandomMaerks/Overused-Grotesk/releases/download/v${finalAttrs.version}/OverusedGrotesk-v${finalAttrs.version}.zip";
+    stripRoot = false;
+    hash = "sha256-XNylWbD9ZjEAcIUNCQECEy4ATlTlrzXrKP4Fb5YSCUw=";
+  };
+
+  nativeBuildInputs = [ installFonts ];
+
+  sourceRoot = "${finalAttrs.src.name}/ttf";
+
+  meta = {
+    homepage = "https://randommaerks.github.io/overused-grotesk";
+    changelog = "https://github.com/RandomMaerks/Overused-Grotesk/releases";
+    description = "A variable sans serif typeface inspired by the classic neo-grotesk Swiss design";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ yarn ];
+  };
+})

pkgs/by-name/po/polyglot/package.nix

@@ -79,7 +79,10 @@ maven.buildMavenPackage rec {
     changelog = "https://github.com/DraqueT/PolyGlot/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ noodlez1232 ];
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "PolyGlot";
   };
 }

pkgs/by-name/pt/ptouch-print/package.nix

@@ -1,4 +1,5 @@
 {
+  argp-standalone,
   cmake,
   fetchgit,
   gd,
@@ -36,6 +37,9 @@ stdenv.mkDerivation {
     libpng
     zlib
     libusb1
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isMusl) [
+    argp-standalone
   ];
 
   installPhase = ''

pkgs/by-name/re/retroarch-assets/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "retroarch-assets";
-  version = "1.22.0-unstable-2026-06-27";
+  version = "1.22.0-unstable-2026-08-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "retroarch-assets";
-    rev = "a12a7be0898de32ab3eefb891e6778ff5130e5fb";
-    hash = "sha256-Mhp9+Mr/M79ZqIt9H6RrciOH+bE1cI5TLTjGzz4zKrw=";
+    rev = "6a1bbdeff5bca537a5712e2226a2aeeaee211fd0";
+    hash = "sha256-BZyGCveK4h/T2toveGeeKwM6PnZurZLq9URzzf6mfmw=";
   };
 
   makeFlags = [

pkgs/by-name/rm/rmux/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rmux";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "Helvesec";
     repo = "rmux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dp0faMC2v8mArWE9EEeGggnm/vM3zXn7INXMcwaQZ5M=";
+    hash = "sha256-YHWCUP5NvzWCDLIYDLSV0a7VWc6B2sFZ0EwzRwAYX3g=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-YMA42V2Wk4GeCDQsWZkWbOL1a74AzB+radfCkUZCuZ8=";
+  cargoHash = "sha256-vgd9oduIFSCezuqWcGazcyqjluhFmNnm0jWJwPgYux0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ro/router/package.nix

@@ -53,6 +53,11 @@ rustPlatform.buildRustPackage rec {
     description = "Configurable, high-performance routing runtime for Apollo Federation";
     homepage = "https://www.apollographql.com/docs/router/";
     license = lib.licenses.elastic20;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     maintainers = [ lib.maintainers.bbigras ];
   };
 }

pkgs/by-name/sl/slack/package.nix

@@ -34,5 +34,5 @@ let
 in
 callPackage (if stdenvNoCC.hostPlatform.isDarwin then ./darwin.nix else ./linux.nix) {
   inherit pname passthru meta;
-  inherit (sources.${system} or (throw "Unsupported system: ${system}")) version src;
+  inherit (sources.${system} or sources.x86_64-linux) version src;
 }

pkgs/by-name/sp/spacetimedb/package.nix

@@ -87,6 +87,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     description = "Full-featured relational database system that lets you run your application logic inside the database";
     homepage = "https://github.com/clockworklabs/SpacetimeDB";
     license = lib.licenses.bsl11;

pkgs/by-name/sp/spruce/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spruce";
-  version = "1.35.14";
+  version = "1.35.15";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = "spruce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EKhspLsuovnzJVFyp8+0cUSA+kRzPwJ0YHN5iUe5NRM=";
+    hash = "sha256-JzHLdKafvqcmolDO6To4R3xtvyctxVTe1h65GUEsO/o=";
   };
 
   vendorHash = null;

pkgs/by-name/sv/sv-lang/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   boost,
   catch2_3,
   cmake,
@@ -23,6 +24,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-popHzwX0qwv2POAl7/qX3e//OwJRXGtSl9xogpSn2LI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fmt-12.2.patch";
+      url = "https://github.com/MikePopoloski/slang/commit/5a898b4b9225d281902fcd59fe4732b1561677d2.patch";
+      excludes = [ "tests/unittests/diagnostics/WaiverTests.cpp" ];
+      hash = "sha256-Y+GG8UINWXh7eTXEweM42oPY8ByP4DQYgTjSLukz4I4=";
+    })
+  ];
+
+  patchFlags = [
+    "-p1"
+    "-F3"
+  ];
+
   cmakeFlags = [
     # fix for https://github.com/NixOS/nixpkgs/issues/144170
     "-DCMAKE_INSTALL_INCLUDEDIR=include"

pkgs/by-name/ta/tabularis/package.nix

@@ -19,14 +19,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tabularis";
-  version = "0.17.0";
+  version = "0.18.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "TabularisDB";
     repo = "tabularis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LMQonEjgOdeedy8SJvxEJW6fvqCs5jB247VXIBtLGqs=";
+    hash = "sha256-Z+cvIKa5Ly81PmE8A4X6umKObe+ConLRIumNOk1iNrE=";
   };
 
   strictDeps = true;
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-vXw76T+CA7m0s2b8uVof20Hww3YrQJL1/bKzUzmxKXo=";
+  cargoHash = "sha256-kVhKEnqNNEF1IaXFATE2XiSPebb7v6PDd2x9evktOJI=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;

pkgs/by-name/ta/talhelper/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.1.15";
+  version = "3.1.16";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1jvUf/YsCdj/zJ+BoIv+52CobScWMlc+hIHUN9VPN04=";
+    hash = "sha256-E2cJFl0jZuR6dtxMWUxwpmtxN/3Qyzh9nEgLCLXxfJk=";
   };
 
-  vendorHash = "sha256-mXM7c6T5qcAHez5QrmxFmGE0DLyL2RADIFTdrQaH2GQ=";
+  vendorHash = "sha256-bBjeLyqX3t2msjiAXWnkII8yyg2x8oQ5zdWNlpV4NXc=";
 
   ldflags = [
     "-s"

pkgs/by-name/te/temporal-ui-server/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal-ui-server";
-  version = "2.52.1";
+  version = "2.53.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "ui-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z6lDqzDDzyHh2ZLf1paqUT9f6+ioR0qnVhX4/QFa9D0=";
+    hash = "sha256-qeSIrU+Jh1PINlF9RPEXYVzeI6mn3mJgeVTbtPDwJg8=";
   };
 
-  vendorHash = "sha256-E9pg16YJRDahBmiHwQY3r8kA+vBfza7KdFYqdw+qBSY=";
+  vendorHash = "sha256-a4b4Z0/1KZyQdpvnwhGAXLVYUdUBXNdRoWSLfOmL6h4=";
 
   postInstall = ''
     mv $out/bin/server $out/bin/temporal-ui-server

pkgs/by-name/uc/ucx/deprecated-openmp-pragma.patch

@@ -0,0 +1,17 @@
+diff --git a/src/tools/perf/perftest.c b/src/tools/perf/perftest.c
+index 52a1682f85..87e0511807 100644
+--- a/src/tools/perf/perftest.c
++++ b/src/tools/perf/perftest.c
+@@ -243,7 +243,11 @@
+ {
+ #if _OPENMP
+ #  pragma omp barrier
+-#  pragma omp master
++#  if _OPENMP >= 202011
++#    pragma omp masked
++#  else
++#    pragma omp master
++#  endif
+ #endif
+   {
+     sock_rte_group_t *group = rte_group;

pkgs/by-name/uc/ucx/package.nix

@@ -54,6 +54,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-R/uUjkYLPtY9c3vZWrkzKaSgK9Z/cppJCwQ1V1cuwPc=";
   };
 
+  # UCX uses the `#pragma omp master` declaration which is deprecated since
+  # OpenMP 5.1. Since UCX builds with -Werror by default, this causes build
+  # failures in GCC 16 which introduced the `deprecated-openmp` warning.
+  # Accordingly, we replace it with the new `#pragma omp masked` version in
+  # compilers which support OpenMP 5.1.
+  # https://github.com/openucx/ucx/pull/11697
+  patches = [ ./deprecated-openmp-pragma.patch ];
+
   postPatch = ''
     patchShebangs config/nvcc_wrap.sh
   '';

pkgs/by-name/up/upower/package.nix

@@ -38,7 +38,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.91.2";
+  version = "1.91.3";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lr7Va7jmC7Hy+kY8YIbAEE5mK3TxU9LtgTKxEyM1QY8=";
+    hash = "sha256-QdAJxaua43iGovQeRg+n1MypS5CS0Ro3gqF9Tv8eMBg=";
   };
 
   patches =

pkgs/by-name/vi/vicinae/package.nix

@@ -1,4 +1,5 @@
 {
+  apple-sdk,
   cmake,
   cmark-gfm,
   coreutils,
@@ -15,10 +16,12 @@
   pkg-config,
   qt6,
   stdenv,
+  swift,
   wayland,
   libxml2,
   udevCheckHook,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
   version = "0.23.2";
@@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     "VICINAE_PROVENANCE" = "nix";
     "INSTALL_NODE_MODULES" = "OFF";
     "INSTALL_BROWSER_NATIVE_HOST" = "OFF";
+    "USE_SYSTEM_CMARK_GFM" = "ON";
     "USE_SYSTEM_GLAZE" = "ON";
+    "USE_SYSTEM_KF6" = "ON";
+    "USE_SYSTEM_QT_KEYCHAIN" = "ON";
+    "BUNDLE_SOULVER_CORE" = "OFF";
     "CMAKE_INSTALL_PREFIX" = placeholder "out";
     "CMAKE_INSTALL_DATAROOTDIR" = "share";
     "CMAKE_INSTALL_BINDIR" = "bin";
@@ -60,22 +67,34 @@ stdenv.mkDerivation (finalAttrs: {
     nodejs
     pkg-config
     qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    qt6.qttools
+    swift
   ];
 
   buildInputs = [
     cmark-gfm
     glaze
-    kdePackages.layer-shell-qt
     kdePackages.qtkeychain
     kdePackages.syntax-highlighting
     libqalculate
     minizip
     nodejs
     qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtimageformats
     qt6.qtsvg
+    qt6.qtshadertools
+    libxml2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    kdePackages.layer-shell-qt
     qt6.qtwayland
     wayland
-    libxml2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk
   ];
 
   postPatch = ''
@@ -98,14 +117,28 @@ stdenv.mkDerivation (finalAttrs: {
     }"
   ];
 
-  postFixup = ''
-    substituteInPlace $out/share/systemd/user/vicinae.service \
-      --replace-fail "/bin/kill" "${lib.getExe' coreutils "kill"}"\
-      --replace-fail "ExecStart=vicinae" "ExecStart=$out/bin/vicinae"
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    app=$out/Applications/Vicinae.app
+    install -Dm755 bin/vicinae-server "$app/Contents/MacOS/Vicinae"
+    install -Dm755 bin/vicinae "$app/Contents/MacOS/vicinae-cli"
+    install -Dm644 Info.plist "$app/Contents/Info.plist"
+    install -Dm644 ../extra/vicinae.icns "$app/Contents/Resources/vicinae.icns"
+    cp -r ../extra/themes "$app/Contents/Resources/themes"
+    rm -f "$out/bin/vicinae"
   '';
 
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ udevCheckHook ];
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace $out/share/systemd/user/vicinae.service \
+        --replace-fail "/bin/kill" "${lib.getExe' coreutils "kill"}"\
+        --replace-fail "ExecStart=vicinae" "ExecStart=$out/bin/vicinae"
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      ln -s ../Applications/Vicinae.app/Contents/MacOS/vicinae-cli "$out/bin/vicinae"
+    '';
+
+  doInstallCheck = stdenv.hostPlatform.isLinux;
+  nativeInstallCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ udevCheckHook ];
 
   passthru.updateScript = ./update.sh;
 
@@ -114,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/vicinaehq/vicinae";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ zstg ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "vicinae";
   };
 })

pkgs/by-name/xe/xevd/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   stdenv,
   gitUpdater,
   testers,
@@ -10,45 +9,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xevd";
-  version = "0.5.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mpeg5";
     repo = "xevd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Dc2V77t+DrZo9252FAL0eczrmikrseU02ob2RLBdVvU=";
+    hash = "sha256-MMqtgXEcIYLr5gyIpGj1p0aPiEW0zb6ZAQ+75kHhyxU=";
   };
 
-  patches = lib.optionals (!lib.versionOlder "0.5.0" finalAttrs.version) (
-    map fetchpatch2 [
-      # Upstream accepted patches, should be dropped on next version bump.
-      {
-        url = "https://github.com/mpeg5/xevd/commit/7eda92a6ebb622189450f7b63cfd4dcd32fd6dff.patch?full_index=1";
-        hash = "sha256-Ru7jGk1b+Id5x1zaiGb7YKZGTNaTcArZGYyHbJURfgs=";
-      }
-      {
-        url = "https://github.com/mpeg5/xevd/commit/499bc0153a99f8c8fd00143dd81fc0d858a5b509.patch?full_index=1";
-        hash = "sha256-3ExBNTeBhj/IBweYkgWZ2ZgUypFua4oSC24XXFmjxXA=";
-      }
-      {
-        url = "https://github.com/mpeg5/xevd/commit/b099623a09c09cddfe7f732fb795b2af8a020620.patch?full_index=1";
-        hash = "sha256-Ee/PQmsGpUCU7KUMbdGEXEEKOc8BHYcGF4mq+mmWb/w=";
-      }
-      {
-        url = "https://github.com/mpeg5/xevd/commit/2e6b24bf1f946c30d789b114dfd56e91b99039fe.patch?full_index=1";
-        hash = "sha256-thT0kVSKwWruyhIjDFBulyUNeyG9zQ8rQtpZVmRvYxI=";
-      }
-      {
-        url = "https://github.com/mpeg5/xevd/commit/c1f23a41b8def84ab006a8ce4e9221b2fff84a1a.patch?full_index=1";
-        hash = "sha256-MOJ9mU5txk6ISzJsQdK+TTb2dlWD8ofGZI0nfq9rsPo=";
-      }
-      {
-        url = "https://github.com/mpeg5/xevd/commit/adf1c45d6edb0d235997a40261689d7454b711c5.patch?full_index=1";
-        hash = "sha256-tGIPaswx9S1Oy8QF928RzV/AHr710kYxXfMRYg6SLR4=";
-      }
-    ]
-  );
-
   postPatch = ''
     echo v$version > version.txt
   '';
@@ -63,21 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     optional isAarch64 (cmakeBool "ARM" true)
     ++ optional isDarwin (cmakeFeature "CMAKE_SYSTEM_NAME" "Darwin");
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    map (w: "-Wno-" + w) (
-      [
-        # Evaluate on version bump whether still necessary.
-        "sometimes-uninitialized"
-        "unknown-warning-option"
-      ]
-      ++ (
-        # Fixed upstream in 325fd9f94f3fdf0231fa931a31ebb72e63dc3498 but might
-        # change behavior, therefore opted to leave it out for now.
-        lib.optional (!lib.versionOlder "0.5.0" finalAttrs.version) "for-loop-analysis"
-      )
-    )
-  );
-
   postInstall = ''
     ln $dev/include/xevd/* $dev/include/
   '';

pkgs/by-name/xe/xeve/0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch

@@ -1,27 +0,0 @@
-From f3927c3cb05ffc77f62026bafd7cea1d25de1e72 Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Tue, 2 Jul 2024 19:23:11 +0200
-Subject: [PATCH 1/2] CMakeLists.txt: Disable static linking on Darwin
-
----
- CMakeLists.txt | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e0873d5..1d639c4 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -64,7 +64,9 @@ if(NOT ARM)
- else()
-   add_definitions(-DARM=1)
-   set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -flax-vector-conversions")
--  set(CMAKE_EXE_LINKER_FLAGS "-static")
-+  if(NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "Darwin")
-+    set(CMAKE_EXE_LINKER_FLAGS "-static")
-+  endif()
- endif()
- message("ARM=${ARM}")
- 
--- 
-2.44.1
-

pkgs/by-name/xe/xeve/0002-sse2neon-Cast-to-variable-type.patch

@@ -1,27 +0,0 @@
-From d1a480867c0778ee46ff0213e2b1e494afcb67fc Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Mon, 1 Jul 2024 15:19:37 +0200
-Subject: [PATCH 2/2] sse2neon: Cast to variable type
-
-The `__m128d` type corresponds to `float32x4_t` or `float64x2_t`
-depending on the platform. The cast cannot explicitly use either type.
----
- src_base/neon/sse2neon.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src_base/neon/sse2neon.h b/src_base/neon/sse2neon.h
-index 490c0a4..3290fa3 100644
---- a/src_base/neon/sse2neon.h
-+++ b/src_base/neon/sse2neon.h
-@@ -6003,7 +6003,7 @@ FORCE_INLINE void _mm_storeu_si32(void *p, __m128i a)
- FORCE_INLINE void _mm_stream_pd(double *p, __m128d a)
- {
- #if __has_builtin(__builtin_nontemporal_store)
--    __builtin_nontemporal_store(a, (float32x4_t *) p);
-+    __builtin_nontemporal_store(a, (__m128d *) p);
- #elif defined(__aarch64__)
-     vst1q_f64(p, vreinterpretq_f64_m128d(a));
- #else
--- 
-2.44.1
-

pkgs/by-name/xe/xeve/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   gitUpdater,
   stdenv,
   cmake,
@@ -9,43 +8,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xeve";
-  version = "0.5.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mpeg5";
     repo = "xeve";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/DcYv2fInr8MN1wpOgJHcFWEvW//7SIXccheRfeaTHM=";
+    hash = "sha256-QA9+0PsPyg3gQYR2TpIO1nwL5H/BFpOtCX8xBQ4Qjmg=";
   };
 
-  patches =
-    map fetchpatch2 [
-      {
-        url = "https://github.com/mpeg5/xeve/commit/954ed6e0494cd2438fd15c717c0146e88e582b33.patch?full_index=1";
-        hash = "sha256-//NtOUm1fqPFvOM955N6gF+QgmOdmuVunwx/3s/G/J8=";
-      }
-      {
-        url = "https://github.com/mpeg5/xeve/commit/07a6f2a6d13dfaa0f73c3752f8cd802c251d8252.patch?full_index=1";
-        hash = "sha256-P9J7Y9O/lb/MSa5oCfft7z764AbLBLZnMmrmPEZPcws=";
-      }
-      {
-        url = "https://github.com/mpeg5/xeve/commit/0a0f3bd397161253b606bdbeaa518fbe019d24e1.patch?full_index=1";
-        hash = "sha256-PoZpE64gWkTUS4Q+SK+DH1I1Ac0UEzwwnlvpYN16hsI=";
-      }
-      {
-        url = "https://github.com/mpeg5/xeve/commit/e029f1619ecedbda152b8680641fa10eea9eeace.patch?full_index=1";
-        hash = "sha256-ooIBzNtGSjDgYvTzA8T0KB+QzsUiy14mPpoRqrHF3Pg=";
-      }
-    ]
-    ++ [
-      # Backport to 0.5.0 of upstream patch c564ac77c103dbba472df3e13f4733691fd499ed
-      ./0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch
-
-      # Rejected upstream, can be dropped when a fix for
-      # https://github.com/mpeg5/xeve/pull/123 is in a version bump.
-      ./0002-sse2neon-Cast-to-variable-type.patch
-    ];
-
   postPatch = ''
     echo v$version > version.txt
   '';
@@ -60,23 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
     optional isAarch64 (cmakeBool "ARM" true)
     ++ optional isDarwin (cmakeFeature "CMAKE_SYSTEM_NAME" "Darwin");
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    map (w: "-Wno-" + w) [
-      # Patch addressing an if without a body was rejected upstream, third
-      # line-based comment in this thread, https://github.com/mpeg5/xeve/pull/122#pullrequestreview-2187744305
-      # Evaluate on version bump whether still necessary.
-      "empty-body"
-
-      # Evaluate on version bump whether still necessary.
-      "parentheses-equality"
-      "unknown-warning-option"
-
-      # Fixed upstream in 325fd9f94f3fdf0231fa931a31ebb72e63dc3498 but might
-      # change behavior, therefore opted to leave it out for now.
-      "for-loop-analysis"
-    ]
-  );
-
   postInstall = ''
     ln $dev/include/xeve/* $dev/include/
   '';

pkgs/by-name/za/zapret2/package.nix

@@ -16,6 +16,7 @@
   libnetfilter_queue,
   systemdLibs,
   zlib,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -131,6 +132,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) zapret2; };
+
   meta = {
     description = "Anti-DPI software for bypassing DPI systems";
     homepage = "https://github.com/bol-van/zapret2";

pkgs/by-name/zi/zigfetch/package.nix

@@ -11,13 +11,13 @@
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "zigfetch";
-  version = "0.27.2";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "utox39";
     repo = "zigfetch";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PFZqtKgZYRRVXf0bNUKYFsahmJ9g2qcm58LFTR4ZzCU=";
+    hash = "sha256-FDIZnmMzhHH1MmvwyuHnV6KiNSH1E5ZEg5G6C5BBJWE=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/development/compilers/elm/packages/elm-wrap/default.nix

@@ -9,7 +9,7 @@
   lib,
 }:
 stdenv.mkDerivation rec {
-  name = "elm-wrap";
+  pname = "elm-wrap";
   version = "1.0.1";
 
   src = fetchFromGitHub {

pkgs/development/compilers/zulu/common.nix

@@ -32,16 +32,14 @@
   ffmpeg,
 }:
 let
-  dist =
-    dists.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  dist = dists.${stdenv.hostPlatform.system} or (builtins.head (builtins.attrValues dists));
 
   arch =
     {
       "aarch64" = "aarch64";
       "x86_64" = "x64";
     }
-    .${stdenv.hostPlatform.parsed.cpu.name}
-      or (throw "Unsupported architecture: ${stdenv.hostPlatform.parsed.cpu.name}");
+    .${stdenv.hostPlatform.parsed.cpu.name} or "unsupported";
 
   platform =
     {

pkgs/development/ocaml-modules/camlimages/default.nix

@@ -6,7 +6,6 @@
   dune-configurator,
   cppo,
   graphics,
-  lablgtk,
   stdio,
 }:
 
@@ -14,8 +13,6 @@ buildDunePackage (finalAttrs: {
   pname = "camlimages";
   version = "5.0.5";
 
-  minimalOCamlVersion = "4.07";
-
   src = fetchFromGitLab {
     owner = "camlspotter";
     repo = "camlimages";
@@ -31,17 +28,15 @@ buildDunePackage (finalAttrs: {
     dune-configurator
     findlib
     graphics
-    lablgtk
     stdio
   ];
 
   meta = {
     branch = "5.0";
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://gitlab.com/camlspotter/camlimages";
     description = "OCaml image processing library";
     license = lib.licenses.lgpl2;
     maintainers = [
-      lib.maintainers.vbgl
       lib.maintainers.mt-caret
     ];
   };

pkgs/development/ocaml-modules/cohttp/async.nix

@@ -51,6 +51,8 @@ buildDunePackage {
     ipaddr
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   doCheck = true;
   checkInputs = [
     ounit

pkgs/development/ocaml-modules/cohttp/eio.nix

@@ -33,6 +33,8 @@ buildDunePackage {
     uri
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   doCheck = true;
   checkInputs = [
     alcotest

pkgs/development/ocaml-modules/ctypes/foreign.nix

@@ -1,4 +1,7 @@
 {
+  lib,
+  stdenv,
+  ocaml,
   buildDunePackage,
   ctypes,
   dune-configurator,
@@ -10,7 +13,7 @@
 buildDunePackage {
   pname = "ctypes-foreign";
 
-  inherit (ctypes) version src doCheck;
+  inherit (ctypes) version src;
 
   buildInputs = [ dune-configurator ];
 
@@ -27,6 +30,9 @@ buildDunePackage {
   # Fix build with gcc 14
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
+  # closure lifetime tests crash on darwin ocaml 5.5
+  doCheck = !(stdenv.hostPlatform.isDarwin && lib.versionAtLeast ocaml.version "5.5");
+
   meta = ctypes.meta // {
     description = "Dynamic access to foreign C libraries using Ctypes";
   };