Merge staging-next into staging

2026-07-20 15:41:16 +00:00 · 2026-06-19 13:13:11 +00:00
parent cd10a2ad97 45a8d40fcd
commit e388eff357
47 changed files with 1057 additions and 190 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -67,6 +67,10 @@
  Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
  Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.

+- `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
+  They were missing before because Ceph omitted logs when this directory was missing.
+  Ceph logs can grow large, so you may want to configure rotation of these logs.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26291,6 +26291,12 @@
    githubId = 4061736;
    name = "Severen Redwood";
  };
+  ssnoer = {
+    email = "ssnoer@proton.me";
+    github = "Seba244c";
+    githubId = 23051740;
+    name = "Sebastian August Snoer";
+  };
  sstef = {
    email = "stephane@nix.frozenid.net";
    github = "haskelious";
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -481,6 +481,15 @@ in
        "/run/ceph".d = defaultConfig // {
          mode = "0770";
        };
+        # Ceph daemons log to files under `/var/log/ceph` by default
+        # (`log_to_file = true`, `log_file = /var/log/ceph/$cluster-$name.log`).
+        # The daemons run as the unprivileged `ceph` user under
+        # `ProtectSystem=full` and cannot create this directory themselves, and
+        # Ceph silently discards its logs if the directory is missing; it does
+        # not even warn; the `::open()` failure in `Log::reopen_log_file()` is
+        # ignored, see https://github.com/ceph/ceph/blob/v20.2.1/src/log/Log.cc#L165-L174.
+        # Create the directory so logging works out of the box.
+        "/var/log/ceph".d = defaultConfig;
        "/var/lib/ceph".d = defaultConfig;
        "/var/lib/ceph/mgr".d = lib.mkIf (cfg.mgr.enable) defaultConfig;
        "/var/lib/ceph/mon".d = lib.mkIf (cfg.mon.enable) defaultConfig;
--- a/nixos/modules/services/networking/gokapi.nix
+++ b/nixos/modules/services/networking/gokapi.nix
@@ -82,7 +82,7 @@ in

  config = lib.mkIf cfg.enable {
    systemd.services.gokapi = {
-      wantedBy = [ "default.target" ];
+      wantedBy = [ "multi-user.target" ];
      wants = [ "network-online.target" ];
      after = [ "network-online.target" ];
      environment = lib.mapAttrs (_: value: toString value) cfg.environment;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -332,8 +332,16 @@ in
  };
  castopod = runTest ./castopod.nix;
  centrifugo = runTest ./centrifugo.nix;
-  ceph-multi-node = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix;
-  ceph-single-node = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix;
+  ceph-multi-node-bluestore = runTestOn [ "aarch64-linux" "x86_64-linux" ] (
+    import ./ceph-multi-node-bluestore.nix { }
+  );
+  ceph-multi-node-bluestore-cephfs = runTestOn [ "aarch64-linux" "x86_64-linux" ] (
+    import ./ceph-multi-node-bluestore.nix { withCephfs = true; }
+  );
+  ceph-multi-node-deprecated-filestore = runTestOn [
+    "aarch64-linux"
+    "x86_64-linux"
+  ] ./ceph-multi-node-deprecated-filestore.nix;
  ceph-single-node-bluestore = runTestOn [
    "aarch64-linux"
    "x86_64-linux"
@@ -342,6 +350,10 @@ in
    "aarch64-linux"
    "x86_64-linux"
  ] ./ceph-single-node-bluestore-dmcrypt.nix;
+  ceph-single-node-deprecated-filestore = runTestOn [
+    "aarch64-linux"
+    "x86_64-linux"
+  ] ./ceph-single-node-deprecated-filestore.nix;
  certmgr = import ./certmgr.nix { inherit pkgs runTest; };
  cfssl = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix;
  cgit = runTest ./cgit.nix;
--- a/nixos/tests/ceph-multi-node-bluestore.nix
+++ b/nixos/tests/ceph-multi-node-bluestore.nix
@@ -0,0 +1,602 @@
+# Multi-node Ceph cluster test using BlueStore OSDs.
+{
+  withCephfs ? false,
+}:
+{ lib, ... }:
+let
+  # Development knobs:
+  # * `defaultTimeout` caps how long every `waitUntilSucceeds` waits before it
+  #   gives up. Lower it for faster feedback while iterating on the test.
+  # * When `investigateFailures` is true, a `waitUntilSucceeds` that times out
+  #   does NOT fail the test; instead it dumps each machine's full (multi-boot)
+  #   journal and `/var/log/ceph` into a `test-failure-investigation/` directory
+  #   inside the test's working/output directory and then lets the test succeed,
+  #   so the collected logs end up in the build's store path for convenient
+  #   reading. Keep this `false` for real CI runs.
+  defaultTimeout = 60;
+  investigateFailures = false;
+
+  cfg = {
+    clusterId = "066ae264-2a5d-4729-8001-6ad265f50b03";
+    monA = {
+      name = "a";
+      ip = "192.168.1.1";
+    };
+    osd0 = {
+      name = "0";
+      ip = "192.168.1.2";
+      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
+      uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
+    };
+    osd1 = {
+      name = "1";
+      ip = "192.168.1.3";
+      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
+      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
+    };
+    osd2 = {
+      name = "2";
+      ip = "192.168.1.4";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
+    # Client that mounts CephFS using the in-kernel client.
+    kclient = {
+      ip = "192.168.1.5";
+    };
+    # Client that mounts CephFS using the `ceph-fuse` client.
+    fuseclient = {
+      ip = "192.168.1.6";
+    };
+  };
+  generateCephConfig =
+    { daemonConfig }:
+    {
+      enable = true;
+      global = {
+        fsid = cfg.clusterId;
+        monHost = cfg.monA.ip;
+        monInitialMembers = cfg.monA.name;
+      };
+    }
+    // daemonConfig;
+
+  generateHost =
+    { cephConfig, networkConfig }:
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        # A single raw block device per machine, consumed directly by BlueStore
+        # as `/dev/vdb`. Because BlueStore owns the raw device (there is no
+        # filesystem to mount), the OSD's on-disk state survives a hard
+        # crash/reboot and the OSD comes back automatically.
+        emptyDiskImages = [ 20480 ];
+        vlans = [ 1 ];
+      };
+
+      networking = networkConfig;
+
+      # TODO: Why do we need any of these? Shouldn't Ceph work independent of `systemPackages`? Only `sudo` and `ceph` are used in our own test code.
+      environment.systemPackages = with pkgs; [
+        bash
+        sudo
+        ceph
+        netcat
+      ];
+
+      services.ceph = cephConfig;
+
+      # Restart limits are unsuitable for daemons that must recover from
+      # arbitrary crash/network downtimes.
+      # Ensure all daemons have infinite restart limits.
+      # Otherwise the tests are flaky based on timing.
+      systemd.services =
+        let
+          daemonUnits =
+            lib.concatMap
+              (
+                daemonType:
+                lib.optionals (cephConfig.${daemonType}.enable or false) (
+                  map (daemon: "ceph-${daemonType}-${daemon}") cephConfig.${daemonType}.daemons
+                )
+              )
+              [
+                "mon"
+                "mgr"
+                "osd"
+                "mds"
+              ];
+        in
+        lib.genAttrs daemonUnits (_: {
+          serviceConfig.Restart = lib.mkForce "always";
+          serviceConfig.RestartSec = lib.mkForce "1";
+          unitConfig.StartLimitIntervalSec = lib.mkForce 0; # Ensure Restart=always is always honoured (no start limit)
+        });
+    };
+
+  networkMonA = {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = cfg.monA.ip;
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      allowedTCPPorts = [
+        6789
+        3300
+      ];
+      allowedTCPPortRanges = [
+        {
+          from = 6800;
+          to = 7300;
+        }
+      ];
+    };
+  };
+  cephConfigMonA = generateCephConfig {
+    daemonConfig = {
+      mon = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+      mgr = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+    }
+    # The MDS daemon (which provides CephFS) is only configured in the CephFS
+    # variant of this test.
+    // lib.optionalAttrs withCephfs {
+      mds = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+    };
+  };
+
+  networkOsd = osd: {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = osd.ip;
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      allowedTCPPortRanges = [
+        {
+          from = 6800;
+          to = 7300;
+        }
+      ];
+    };
+  };
+
+  cephConfigOsd =
+    osd:
+    generateCephConfig {
+      daemonConfig = {
+        osd = {
+          enable = true;
+          daemons = [ osd.name ];
+        };
+      };
+    };
+
+  # The CephFS clients only need the ceph client tooling. They do not run any
+  # ceph daemon, so they only get a minimal ceph config pointing at the mon.
+  # The in-kernel ceph filesystem module is part of the default kernel and is
+  # autoloaded by `mount -t ceph`, so no extra modules are needed.
+  networkClient = client: {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = client.ip;
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  cephConfigClient = generateCephConfig { daemonConfig = { }; };
+
+  generateClientHost =
+    { networkConfig }:
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        vlans = [ 1 ];
+      };
+
+      networking = networkConfig;
+
+      environment.systemPackages = with pkgs; [
+        ceph
+      ];
+
+      services.ceph = cephConfigClient;
+    };
+
+  # Python prelude that must run before any test code.
+  # It replaces every machine's `wait_until_succeeds()` with a wrapper that
+  # implements the "development knobs" above.
+  helperScript = ''
+    import os
+    import shutil
+
+    DEFAULT_TIMEOUT = ${toString defaultTimeout}
+    INVESTIGATE_FAILURES = ${if investigateFailures then "True" else "False"}
+
+    def collect_failure_investigation(failed_machine, command):
+        out_dir = os.path.join(driver.out_dir, "test-failure-investigation")
+        os.makedirs(out_dir, exist_ok=True)
+        with open(os.path.join(out_dir, "README.txt"), "w") as f:
+            f.write(
+                "wait_until_succeeds timed out on machine "
+                f"'{failed_machine.name}' running command:\n{command}\n"
+            )
+        for m in machines:
+            try:
+                m.execute("journalctl --no-pager --boot=all > /tmp/journal.txt 2>&1; true")
+                m.copy_from_machine("/tmp/journal.txt", out_dir)
+                shutil.move(
+                    os.path.join(out_dir, "journal.txt"),
+                    os.path.join(out_dir, f"{m.name}-journal.txt"),
+                )
+            except Exception as e:
+                m.log(f"could not collect journal: {e}")
+            try:
+                m.copy_from_machine("/var/log/ceph", out_dir)
+                shutil.move(
+                    os.path.join(out_dir, "ceph"),
+                    os.path.join(out_dir, f"{m.name}-ceph-logs"),
+                )
+            except Exception as e:
+                m.log(f"could not collect /var/log/ceph: {e}")
+
+    # Replace the test driver's `wait_until_succeeds` with our wrapper.
+    machine_class = machines[0].__class__
+    orig_wait_until_succeeds = machine_class.wait_until_succeeds
+
+    def patched_wait_until_succeeds(self, command: str, timeout: int = DEFAULT_TIMEOUT) -> str:
+        try:
+            return orig_wait_until_succeeds(self, command, timeout=timeout)
+        except Exception:
+            if not INVESTIGATE_FAILURES:
+                raise
+            self.log(
+                "wait_until_succeeds timed out; collecting logs into "
+                "test-failure-investigation/ and ending the test as 'passed' "
+                "(investigateFailures = true)"
+            )
+            collect_failure_investigation(self, command)
+            os._exit(0)
+
+    # Use `setattr` (rather than a plain attribute assignment) so the type
+    # checker does not treat this as implicitly shadowing the driver's
+    # `wait_until_succeeds`; the replacement is intentional.
+    setattr(machine_class, "wait_until_succeeds", patched_wait_until_succeeds)
+  '';
+
+  # Set up the cluster (mon, mgr, BlueStore OSDs) and perform a
+  # hard whole-cluster crash/recovery (failover) test.
+  #
+  # Based on the "manual deployment" approach from:
+  # https://docs.ceph.com/en/tentacle/install/manual-deployment/
+  baseScript = ''
+    start_all()
+
+    monA.wait_for_unit("network.target")
+    osd0.wait_for_unit("network.target")
+    osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")
+
+    # Bootstrap ceph-mon daemon
+    monA.succeed(
+        "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
+        "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
+        "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
+        "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
+        "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
+        "sudo -u ceph mkdir -p /var/lib/ceph/mgr/ceph-${cfg.monA.name}/",
+        "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
+        "systemctl start ceph-mon-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
+    monA.succeed("ceph mon enable-msgr2")
+    monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
+
+    # Can't check ceph status until a mon is up
+    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
+
+    # Start the ceph-mgr daemon, it has no deps and hardly any setup
+    monA.succeed(
+        "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
+        "sync",  # to ensure shell redirection above is durable
+        "systemctl start ceph-mgr-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mgr-a")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+
+    # Send the admin keyring to the OSD machines.
+    monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
+    osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+
+    # Bootstrap the BlueStore OSDs.
+    osd0.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd0.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
+        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
+    )
+    osd1.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd1.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd1.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
+        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
+    )
+    osd2.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd2.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
+    )
+
+    # We `sync` so that the config survives the forced crashes below.
+    osd0.succeed(
+        "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd0.name}",
+    )
+    osd1.succeed(
+        "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd1.name}",
+    )
+    osd2.succeed(
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
+    )
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    monA.succeed(
+        "ceph osd pool create multi-node-test 32 32",
+        "ceph osd pool ls | grep 'multi-node-test'",
+
+        # A pool that has no application associated with it stays unhealthy in
+        # state POOL_APP_NOT_ENABLED. Ceph only auto-associates an application
+        # for pools it manages itself, such as CephFS data/metadata pools
+        # (application "cephfs") and the pools RGW creates (application "rgw"); see
+        # https://docs.ceph.com/en/tentacle/rados/operations/pools/#associating-a-pool-with-an-application
+        # This is a plain RADOS pool, so we have to associate an application
+        # with it ourselves. We use the custom application name "nixos-test".
+        "ceph osd pool application enable multi-node-test nixos-test",
+
+        "ceph osd pool rename multi-node-test multi-node-other-test",
+        "ceph osd pool ls | grep 'multi-node-other-test'",
+    )
+    monA.succeed("ceph osd pool set multi-node-other-test size 2")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+    monA.wait_until_succeeds("! ceph -s | grep -e 'unknown' -e 'pgs inactive'")
+    monA.fail(
+        "ceph osd pool ls | grep 'multi-node-test'",
+        "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
+    )
+
+    # Shut down ceph on all machines in a very unpolite way
+    monA.crash()
+    osd0.crash()
+    osd1.crash()
+    osd2.crash()
+
+    # Start it up
+    osd0.start()
+    osd1.start()
+    osd2.start()
+    monA.start()
+
+    # Ensure the cluster comes back up again.
+    monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    # Verify the recovery.
+    monA.wait_until_succeeds("! ceph -s | grep -e 'unknown' -e 'pgs inactive'", timeout=60)
+  '';
+
+  # For `withCephfs = true`, after the regular failover, test CephFS and mounts:
+  # * bring up an MDS
+  # * create a CephFS
+  # * mount it via in-kernel ("kclient") and a `ceph-fuse` ("fuseclient")
+  #   from 2 different nodes
+  # * verify bidirectional visibility of file changes
+  # * performs another crash/recovery test (without crashing the clients)
+  # * verifiy the mounts survive and keep working.
+  cephfsScript = ''
+    kclient.wait_for_unit("network.target")
+    fuseclient.wait_for_unit("network.target")
+
+    # Start the ceph-mds daemon (which provides CephFS), after creating
+    # its keyring and data dir.
+    monA.succeed(
+        "sudo -u ceph mkdir -p /var/lib/ceph/mds/ceph-${cfg.monA.name}/",
+        "ceph auth get-or-create mds.${cfg.monA.name} mon 'allow profile mds' mgr 'allow profile mds' osd 'allow rwx' mds 'allow' > /var/lib/ceph/mds/ceph-${cfg.monA.name}/keyring",
+        "chown ceph:ceph /var/lib/ceph/mds/ceph-${cfg.monA.name}/keyring",
+        "sync",  # to ensure config survives the forced crashes below
+        "systemctl start ceph-mds-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mds-${cfg.monA.name}")
+
+    # Create a CephFS.
+    monA.succeed(
+        "ceph osd pool create cephfs-data 32 32",
+        "ceph osd pool create cephfs-metadata 32 32",
+        "ceph fs new cephfs cephfs-metadata cephfs-data",
+    )
+    # Wait for the MDS to claim the filesystem and become active.
+    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+
+    # Distribute the admin keyring (and a plain secret file for the kernel
+    # client) to both client machines, so that they can authenticate.
+    monA.succeed(
+        "cp /etc/ceph/ceph.client.admin.keyring /tmp/shared",
+        "ceph-authtool -p /etc/ceph/ceph.client.admin.keyring > /tmp/shared/admin.secret",
+    )
+    kclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    fuseclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    kclient.succeed("cp /tmp/shared/admin.secret /etc/ceph/admin.secret")
+
+    # Mount CephFS on the kernel client.
+    # We force the messenger v2 protocol via "ms_mode=secure"; the cluster
+    # has msgr2 enabled (see "ceph mon enable-msgr2" above) and the legacy v1
+    # protocol apparently does not reconnect reliably after the servers are restarted.
+    # The msgr2 monitor listens on port 3300 (instead of legacy v1 port 6789),
+    # so we have to point the device string at that port explicitly.
+    # `recover_session=clean` makes the kernel client automatically reconnect
+    # (discarding its stale session) after the whole cluster has been down,
+    # which would otherwise leave the mount blocklisted and hanging forever.
+    # Real CephFS use may not prefer hanging `recover_session=clean`, and
+    # prefer manual de-blocklisting to avoid any failed OS syscalls,
+    # but for this test, discarding stale sessions is good enough.
+    kclient.succeed("mkdir -p /mnt/cephfs")
+    kclient.wait_until_succeeds(
+        "mount -t ceph ${cfg.monA.ip}:3300:/ /mnt/cephfs -o name=admin,secretfile=/etc/ceph/admin.secret,ms_mode=secure,recover_session=clean"
+    )
+    kclient.succeed("mountpoint /mnt/cephfs")
+
+    # Mount CephFS on the FUSE client using ceph-fuse.
+    fuseclient.succeed("mkdir -p /mnt/cephfs")
+    fuseclient.wait_until_succeeds(
+        "ceph-fuse --id admin -m ${cfg.monA.ip}:6789 /mnt/cephfs"
+    )
+    fuseclient.succeed("mountpoint /mnt/cephfs")
+
+    # Both clients mount the same CephFS, so files written by one must be
+    # visible to the other. Verify this in both directions.
+
+    # Kernel client writes, FUSE client reads.
+    kclient.succeed("echo 'written by kclient' > /mnt/cephfs/from-kclient")
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient)\" = 'written by kclient'"
+    )
+
+    # FUSE client writes, kernel client reads.
+    fuseclient.succeed("echo 'written by fuseclient' > /mnt/cephfs/from-fuseclient")
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient)\" = 'written by fuseclient'"
+    )
+
+    # Crash test with CephFS.
+    # We deliberately do not crash the CephFS clients here: Their mounts must
+    # survive the (temporary) outage of the ceph servers and resume working
+    # once the cluster is healthy again.
+    monA.crash()
+    osd0.crash()
+    osd1.crash()
+    osd2.crash()
+
+    # Start it up
+    osd0.start()
+    osd1.start()
+    osd2.start()
+    monA.start()
+
+    # Ensure the cluster comes back up again.
+    # See the note above on why this uses `wait_until_succeeds`.
+    monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'", timeout=60)
+
+    # Ensure the MDS/CephFS comes back up again, too.
+    monA.wait_for_unit("ceph-mds-${cfg.monA.name}")
+    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    # The clients kept running across the outage, so their CephFS mounts
+    # should still be present and should reconnect automatically.
+    kclient.succeed("mountpoint /mnt/cephfs")
+    fuseclient.succeed("mountpoint /mnt/cephfs")
+
+    # The files written before the crash must still have the correct content.
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient)\" = 'written by fuseclient'"
+    )
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient)\" = 'written by kclient'"
+    )
+
+    # Ensure the mounts are still writable after recovery, in both directions.
+    kclient.succeed("echo 'written by kclient after recovery' > /mnt/cephfs/from-kclient-2")
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient-2)\" = 'written by kclient after recovery'"
+    )
+    fuseclient.succeed("echo 'written by fuseclient after recovery' > /mnt/cephfs/from-fuseclient-2")
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient-2)\" = 'written by fuseclient after recovery'"
+    )
+  '';
+
+in
+{
+  name = "basic-multi-node-ceph-cluster-bluestore" + lib.optionalString withCephfs "-cephfs";
+  meta = {
+    maintainers = with lib.maintainers; [
+      nh2
+      benaryorg
+    ];
+  };
+
+  nodes = {
+    monA = generateHost {
+      cephConfig = cephConfigMonA;
+      networkConfig = networkMonA;
+    };
+    osd0 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd0;
+      networkConfig = networkOsd cfg.osd0;
+    };
+    osd1 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd1;
+      networkConfig = networkOsd cfg.osd1;
+    };
+    osd2 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd2;
+      networkConfig = networkOsd cfg.osd2;
+    };
+  }
+  # CephFS client machines are only needed when testing CephFS.
+  // lib.optionalAttrs withCephfs {
+    kclient = generateClientHost {
+      networkConfig = networkClient cfg.kclient;
+    };
+    fuseclient = generateClientHost {
+      networkConfig = networkClient cfg.fuseclient;
+    };
+  };
+
+  testScript =
+    { ... }:
+    ''
+      ${helperScript}
+      ${baseScript}
+      ${lib.optionalString withCephfs cephfsScript}
+    '';
+}
--- a/nixos/tests/ceph-multi-node-deprecated-filestore.nix
+++ b/nixos/tests/ceph-multi-node-deprecated-filestore.nix
@@ -1,3 +1,4 @@
+# Tests the legacy FileStore OSD backend.
 { lib, ... }:
 let
  cfg = {
@@ -159,6 +160,7 @@ let
      # Start the ceph-mgr daemon, it has no deps and hardly any setup
      monA.succeed(
          "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
+          "sync",  # to ensure shell redirection above is durable
          "systemctl start ceph-mgr-${cfg.monA.name}",
      )
      monA.wait_for_unit("ceph-mgr-a")
@@ -194,20 +196,23 @@ let
          'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
      )

-      # Initialize the OSDs with regular filestore
+      # We `sync` so that the config survives the forced crashes below.
      osd0.succeed(
          "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
          "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
          "systemctl start ceph-osd-${cfg.osd0.name}",
      )
      osd1.succeed(
          "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
          "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
          "systemctl start ceph-osd-${cfg.osd1.name}",
      )
      osd2.succeed(
          "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
          "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
          "systemctl start ceph-osd-${cfg.osd2.name}",
      )
      monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
@@ -258,7 +263,7 @@ let
    '';
 in
 {
-  name = "basic-multi-node-ceph-cluster";
+  name = "basic-multi-node-ceph-cluster-deprecated-filestore";
  meta = with lib.maintainers; {
    maintainers = [ lejonet ];
  };
--- a/nixos/tests/ceph-single-node-deprecated-filestore.nix
+++ b/nixos/tests/ceph-single-node-deprecated-filestore.nix
@@ -269,7 +269,7 @@ let
  '';
 in
 {
-  name = "basic-single-node-ceph-cluster";
+  name = "basic-single-node-ceph-cluster-deprecated-filestore";
  meta = with lib.maintainers; {
    maintainers = [
      lejonet
--- a/pkgs/applications/emulators/libretro/cores/prboom.nix
+++ b/pkgs/applications/emulators/libretro/cores/prboom.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "prboom";
-  version = "0-unstable-2026-05-20";
+  version = "0-unstable-2026-06-15";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-prboom";
-    rev = "648223372e24773821a2041e0c39728f723badf4";
-    hash = "sha256-LyITrBmL5me5zWOfMRZAeCM9rDS19aV2TAFuU8QU/Kw=";
+    rev = "b760de6a1eb1bfcd7833c5b677ff9170d104302f";
+    hash = "sha256-JZrQbhntCGV4WIktUbtVXCSGAEmh9gTPn+tLiMyt6ZY=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -445,13 +445,13 @@
    "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
  },
  "gitlabhq_gitlab": {
-    "hash": "sha256-pMwgByUQPPKM6ZQP/DkbJERXPqfw6pU/zMnJH2YXhCE=",
+    "hash": "sha256-BMOFi/g0W6xo/Kfqw8oqsMeeU3aXyWAKSgF9lIS4AbA=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v19.0.0",
+    "rev": "v19.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YdNHXnJXUIYrq9BJ+58+0LEtgKNCF481pAsggBRjISA="
+    "vendorHash": "sha256-9aoJGVTC9t76auYy8K3QSWGzSAq9aTxemKNc3aCLjRY="
  },
  "go-gandi_gandi": {
    "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -787,13 +787,13 @@
    "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
  },
  "jianyuan_sentry": {
-    "hash": "sha256-/FOpuCdMkUHpJN3z18guNqzG4Ujv8B+gZ67R2TgqKBk=",
+    "hash": "sha256-p1vaKwWrkNaaicQWFfnjgQ8O2P/194PvslzWdVwn6IE=",
    "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
    "owner": "jianyuan",
    "repo": "terraform-provider-sentry",
-    "rev": "v0.15.1",
+    "rev": "v0.15.2",
    "spdx": "MIT",
-    "vendorHash": "sha256-6XGS1T1bMUQKPOTqS3i92ZMfyD00ZovTuCViYyM/OEU="
+    "vendorHash": "sha256-7O7/m4N7MDb+AU7w6dqQqzsqDO3jWGwOHnRX2OkJirM="
  },
  "joneshf_openwrt": {
    "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "adscan";
-  version = "9.1.0";
+  version = "9.1.1";
  pyproject = true;

  __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "ADScanPro";
    repo = "adscan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YsJFOJtf2rubfAXHWlu6c7ZLX8QE1KZFcFof56MsPVo=";
+    hash = "sha256-lVoDPRw2NQBQJo37uKT807HXN28cDFxiWwedTiYhojc=";
  };

  pythonRelaxDeps = [ "credsweeper" ];
--- a/pkgs/by-name/bt/btcd/package.nix
+++ b/pkgs/by-name/bt/btcd/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "btcd";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "btcsuite";
    repo = "btcd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-redoqqbiVdwgNLxDzBccqRBZGwhRTIY5nE9Gx6+4POc=";
+    hash = "sha256-08Ce66iSVCVzhSQ4fouWiXmld7e7jFU+Y1o8HdtsaDE=";
  };

-  vendorHash = "sha256-qXfZKVoTvq7gNm0G4KKSL8anB8FUt/TxoxbOtH240cc=";
+  vendorHash = "sha256-vXQSFh9lD7iNjgUwhA4AMZ2miq/1pV8Y8QT7rcvgdCE=";

  subPackages = [
    "."
--- a/pkgs/by-name/cd/cdktn-cli/package.nix
+++ b/pkgs/by-name/cd/cdktn-cli/package.nix
@@ -19,18 +19,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cdktn-cli";
-  version = "0.23.0";
+  version = "0.23.3";

  src = fetchFromGitHub {
    owner = "open-constructs";
    repo = "cdk-terrain";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qBpdeIa4V5hfVbkwa+5gHszSwqXJej0k0BdVImTdwt8=";
+    hash = "sha256-k3xAaJiqldRZubAFrRuNM1e+3kH/5vv0maEeT/gdqK0=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-H8UnrCZx9yjKn7YxRqv+uJ73fw/ngPFI6zdayUizo1k=";
+    hash = "sha256-9nhv31ljJ8DphOot3TAsYhbV6cx7Ovfe+ll+V2vJWx8=";
  };

  hcl2json-go-modules =
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preCheck

    # Skip tests that require terraform (unfree)
-    yarn --offline workspace cdktn-cli test -- \
+    yarn --offline workspace cdktn-cli jest \
      --testPathIgnorePatterns \
       "src/test/cmds/(convert|init).test.ts"

--- a/pkgs/by-name/ce/ceph/ceph.nix
+++ b/pkgs/by-name/ce/ceph/ceph.nix
@@ -393,10 +393,12 @@ stdenv.mkDerivation {
    pythonEnv = ceph-python-env;
    tests = {
      inherit (nixosTests)
-        ceph-multi-node
-        ceph-single-node
+        ceph-multi-node-bluestore
+        ceph-multi-node-bluestore-cephfs
+        ceph-multi-node-deprecated-filestore
        ceph-single-node-bluestore
        ceph-single-node-bluestore-dmcrypt
+        ceph-single-node-deprecated-filestore
        ;
    };
  };
--- a/pkgs/by-name/ce/ceph/src.nix
+++ b/pkgs/by-name/ce/ceph/src.nix
@@ -6,11 +6,11 @@

 applyPatches (final: {
  pname = "ceph-src";
-  version = "20.2.1";
+  version = "20.2.2";

  src = fetchurl {
    url = "https://download.ceph.com/tarballs/ceph-${final.version}.tar.gz";
-    hash = "sha256-3neaoBQYOTiLsgHgqdYiuEM5guHE17/DrGEXt2OXJUI=";
+    hash = "sha256-G76ZcCdadt4KP7Ry0yzqPrbi1ydZlrcZb2IhGd2Fd1M=";
  };

  patches = [
--- a/pkgs/by-name/cl/cloudflare-cli/package.nix
+++ b/pkgs/by-name/cl/cloudflare-cli/package.nix
@@ -12,18 +12,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cloudflare-cli";
-  version = "5.1.6";
+  version = "5.1.7";

  src = fetchFromGitHub {
    owner = "danielpigott";
    repo = "cloudflare-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lNwpXNKrhRAdcDnaapsAyANnsgUtah3/T99iBitgAdY=";
+    hash = "sha256-3I8KvP9nlkiyYi4h7LpP5LE9xR+uvQyfkLLdSmDaG7E=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-8dQkdCRJ7hJGC3zuUX0hmd5tWCoPSTdRNbtg2vapEXE=";
+    hash = "sha256-XCqKC/uATKsWaqF9FnEd/p+CRl2OFP7zdmz7LAkm5HQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/deja/package.nix
+++ b/pkgs/by-name/de/deja/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "deja";
-  version = "0.3.1";
+  version = "0.3.2";
  __structuredAttrs = true;
  src = fetchFromGitHub {
    owner = "Giammarco-Ferranti";
    repo = "deja";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3fwjPvxCoFBb4a7vKFfGk+sIaLzTSiLxpGp2UIB0llk=";
+    hash = "sha256-ngjnrEq7x6OQ9uFGKmEvbAG7rPtjYX0xLK8110WSZUQ=";
  };

  vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";
--- a/pkgs/by-name/do/dotnet-outdated/package.nix
+++ b/pkgs/by-name/do/dotnet-outdated/package.nix
@@ -6,11 +6,11 @@
 buildDotnetGlobalTool rec {
  pname = "dotnet-outdated";
  nugetName = "dotnet-outdated-tool";
-  version = "4.7.1";
+  version = "4.8.1";

  dotnet-sdk = dotnetCorePackages.sdk_10_0;

-  nugetHash = "sha256-EoH9TFAtnex+9uYaKUZMqQDSofQaZJDe0Va37PiO4OU=";
+  nugetHash = "sha256-f5su1er+1wP35rrU3S+qvwfPp/C55tR7xZ4bv4z7zL0=";

  meta = {
    description = ".NET Core global tool to display and update outdated NuGet packages in a project";
--- a/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix
+++ b/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  libime,
+  fcitx5,
+  qt6Packages,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fcitx5-sitelen-pona";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Toastberries";
+    repo = "fcitx5-sitelen-pona";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZLp/p5umewp1seXFPtMevVBXfoNwHXAojYl5jWHHsTU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ libime ];
+
+  buildInputs = [
+    fcitx5
+    qt6Packages.fcitx5-chinese-addons
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p fcitx5/table
+    for file in table_sources/*; do
+      libime_tabledict "$file" "fcitx5/table/$(basename "$file" .txt).dict"
+    done
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fcitx5
+    cp -r fcitx5/{inputmethod,punctuation,table} "$out/share/fcitx5/"
+
+    mkdir -p $out/share/icons/hicolor/scalable/status
+    for icon in icons/*; do
+      install -Dm644 "$icon" "$out/share/icons/hicolor/scalable/status/fcitx5-$(basename "$icon")"
+    done
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+
+  meta = {
+    inherit (fcitx5.meta) platforms;
+    description = "IME using Fcitx5 for writing toki pona's sitelen pona glyphs";
+    longDescription = ''
+      This tool is an IME using Fcitx5
+      With it, you can easily write toki pona's sitelen pona glyphs
+      Simply type your words in latin characters, and they'll be changed into sitelen pona
+    '';
+    homepage = "https://github.com/Toastberries/fcitx5-sitelen-pona";
+    changelog = "https://github.com/Toastberries/fcitx5-sitelen-pona/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ssnoer ];
+  };
+})
--- a/pkgs/by-name/ge/geobug/package.nix
+++ b/pkgs/by-name/ge/geobug/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  python3Packages,
+  fetchFromCodeberg,
+  gobject-introspection,
+  wrapGAppsHook4,
+  geoclue2,
+  libadwaita,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "geobug";
+  version = "0.9.1";
+  pyproject = true;
+
+  src = fetchFromCodeberg {
+    owner = "tpikonen";
+    repo = "geobug";
+    tag = finalAttrs.version;
+    hash = "sha256-u9+tCKE5zhX6PGl1IsYcqCT0Q1p/eP+V68N6ggAgDoQ=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies =
+    (with python3Packages; [
+      gpxpy
+      pygobject3
+    ])
+    ++ [
+      geoclue2
+      libadwaita
+    ];
+
+  pythonImportsCheck = [
+    "geobug"
+  ];
+
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Adaptive GeoClue client";
+    longDescription = ''
+      Geobug is an adaptive client for GeoClue, the geolocation D-bus server from freedesktop.org. It can display your location information (coordinates, speed etc.) and save a track of your movements to a GPX-file.
+    '';
+    homepage = "https://codeberg.org/tpikonen/geobug";
+    changelog = "https://codeberg.org/tpikonen/geobug/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      Luflosi
+    ];
+    mainProgram = "geobug";
+  };
+})
--- a/pkgs/by-name/gi/github-runner/deps.json
+++ b/pkgs/by-name/gi/github-runner/deps.json
@@ -36,8 +36,8 @@
  },
  {
    "pname": "Microsoft.Bcl.Cryptography",
-    "version": "10.0.6",
-    "hash": "sha256-6VaDedxTljDNE+a4ao4xSG3rzZ6lbmCShtgMgHe9aH4="
+    "version": "10.0.7",
+    "hash": "sha256-5hOu8j2jLhCj9m7MlBoCjq3Qo0ST+b8n6oG2lLHL24s="
  },
  {
    "pname": "Microsoft.CodeCoverage",
@@ -46,18 +46,18 @@
  },
  {
    "pname": "Microsoft.DevTunnels.Connections",
-    "version": "1.3.39",
-    "hash": "sha256-aJBUNv1n7b64EBrAa04+Gw1MLYC315xANCRdK3RnWlA="
+    "version": "1.3.48",
+    "hash": "sha256-/E7ik2riVOMUyPt/1pxU7laDHG1pG5JpLIf5cQ7x7K4="
  },
  {
    "pname": "Microsoft.DevTunnels.Contracts",
-    "version": "1.3.39",
-    "hash": "sha256-lREgEhQhgQJyLoMYS/N5w+i6iX0s3Ppnl0T71KhG2u8="
+    "version": "1.3.48",
+    "hash": "sha256-YYmyZWmKv03BnOKAwbAeLrKqYDbBQ4ZS26jn92QkLSc="
  },
  {
    "pname": "Microsoft.DevTunnels.Management",
-    "version": "1.3.39",
-    "hash": "sha256-twyduZ89fY69k5onUihezBwdiu3BxdOMBLIXq4aQvY0="
+    "version": "1.3.48",
+    "hash": "sha256-DyDPqIwQkKJESx5K9Y4nKtw05cHrTlTp56rg/JXuVag="
  },
  {
    "pname": "Microsoft.DevTunnels.Ssh",
@@ -536,8 +536,8 @@
  },
  {
    "pname": "System.Diagnostics.EventLog",
-    "version": "10.0.6",
-    "hash": "sha256-MpXUz1TiiFkD1ngApC7HKqW+i37zi5V2ApOmqZwDqiI="
+    "version": "10.0.7",
+    "hash": "sha256-fV+2RcEzBV/JUnPDOLce3VBQKqvo32zcTWMZeJcAAJg="
  },
  {
    "pname": "System.Diagnostics.EventLog",
@@ -561,8 +561,8 @@
  },
  {
    "pname": "System.Formats.Asn1",
-    "version": "10.0.6",
-    "hash": "sha256-h5f9iYBUHgG9kOV7jlVQ8HqBQ0DQJt+wy3R/FbB1kaQ="
+    "version": "10.0.7",
+    "hash": "sha256-s48DCef2td3qUMdsRRGFfzkZ/wl/kUaVseQBDDfWUzM="
  },
  {
    "pname": "System.Globalization",
@@ -856,8 +856,8 @@
  },
  {
    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "10.0.6",
-    "hash": "sha256-7T34t/DoxxMWUGRPSnLV1l5ScAxcDnK9iYKstRvLJuA="
+    "version": "10.0.7",
+    "hash": "sha256-+3RdvoSme0k3FoutPdJLkbWPWsmqPVo80hMgpuH3FP0="
  },
  {
    "pname": "System.Security.Cryptography.Primitives",
@@ -896,8 +896,8 @@
  },
  {
    "pname": "System.ServiceProcess.ServiceController",
-    "version": "10.0.6",
-    "hash": "sha256-Lvkb2mzQT/tcJ2yxkQDmKKFpEyaUbQ75qU51FwD1dzY="
+    "version": "10.0.7",
+    "hash": "sha256-koSlZI43JaCrG3ultJ6Sj7Ic9D9N878L+6HtRRGyJSA="
  },
  {
    "pname": "System.Text.Encoding",
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@@ -35,13 +35,13 @@ assert builtins.all (

 buildDotnetModule (finalAttrs: {
  pname = "github-runner";
-  version = "2.334.0";
+  version = "2.335.1";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KSfzWwIf8Vpc8H0XM1tIqdZhdY/noZCeYLBvdWjqmLA=";
+    hash = "sha256-mFwWhpFzp0pT7WaMpF/N6PGw0IJt3I6/e7GDgw9wA2U=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -211,6 +211,10 @@ buildDotnetModule (finalAttrs: {
    "RepositoryActionWithInvalidWrapperActionfile_Node"
    "RepositoryActionWithWrapperActionfile_PreSteps"
  ]
+  ++ [
+    "GitHub.Runner.Common.Tests.Worker.ActionManagerL0.GetDownloadInfoAsync_OmitsDependencies_WhenEmpty"
+    "GitHub.Runner.Common.Tests.Worker.ActionManagerL0.GetDownloadInfoAsync_PropagatesDependencies_WhenPresent"
+  ]
  ++ map (x: "GitHub.Runner.Common.Tests.DotnetsdkDownloadScriptL0.${x}") [
    "EnsureDotnetsdkBashDownloadScriptUpToDate"
    "EnsureDotnetsdkPowershellDownloadScriptUpToDate"
--- a/pkgs/by-name/ho/hostapd/package.nix
+++ b/pkgs/by-name/ho/hostapd/package.nix
@@ -128,6 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://w1.fi/hostapd/";
    description = "User space daemon for access point and authentication servers";
    license = lib.licenses.bsd3;
+    mainProgram = "hostapd";
    maintainers = with lib.maintainers; [ oddlama ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/hy/hyprshell/package.nix
+++ b/pkgs/by-name/hy/hyprshell/package.nix
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hyprshell";
-  version = "4.10.7";
+  version = "4.10.8";

  src = fetchFromGitHub {
    owner = "H3rmt";
    repo = "hyprshell";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1Hr9X7MdYkcibCxRl4zlQOxGu/HDyjBeDTUMJi4B23E=";
+    hash = "sha256-GXegc0W2xiRuSCjMpVc5mmKP5YFCYn87M/POTalISCA=";
  };

-  cargoHash = "sha256-p2oo2rUOILRv5Ifapacz+CvJQhCjxnKTe3X2kTvLr9g=";
+  cargoHash = "sha256-idvY6AOLyx22Gy01kQyA4V8j0VupP5JNswsY4K5Oq9M=";

  nativeBuildInputs = [
    wrapGAppsHook4
--- a/pkgs/by-name/ka/kazumi/git-hashes.json
+++ b/pkgs/by-name/ka/kazumi/git-hashes.json
@@ -2,14 +2,14 @@
  "audio_service_mpris": "sha256-IVv1ioBpiK0VbnOFqnc9NbNn3Z+l9VN2clpCQjckBRo=",
  "audio_service_win": "sha256-OZq2waTr0WLJ6uki/VLdUBdDdui25PvXnMNFohs7gjs=",
  "desktop_webview_window": "sha256-KWON5aTPlVVrLidmnfpV+syWPYEngChOvkN7miIFjvE=",
-  "media_kit": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_android_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_ios_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_linux": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_macos_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_ohos": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_libs_windows_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
-  "media_kit_video": "sha256-jbpGouOPjbZjF9gsNdNs6HMNqsNxIgb/UMG3NF7O+fw=",
+  "media_kit": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_android_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_ios_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_linux": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_macos_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_ohos": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_libs_windows_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
+  "media_kit_video": "sha256-JnMA/Q3DcuD/if7vAu8ZztKVBtfXAQb3SmXmT+dxVmQ=",
  "webview_windows": "sha256-afBTwbam9YA0xvIYMtiJe+CKi8GWit1HqDR3J72r2o0="
 }
--- a/pkgs/by-name/ka/kazumi/package.nix
+++ b/pkgs/by-name/ka/kazumi/package.nix
@@ -18,13 +18,13 @@
 }:

 let
-  version = "2.1.4";
+  version = "2.1.6";

  src = fetchFromGitHub {
    owner = "Predidit";
    repo = "Kazumi";
    tag = version;
-    hash = "sha256-rGziris2/4UiedviO+2L4cguC4DLGGCuGc1GK/Lyr3c=";
+    hash = "sha256-J3lpzCVbw5syvErfVTntgY6dvMj6ITT+3CMPZRaAUk8=";
  };
 in
 flutter.buildFlutterApplication {
--- a/pkgs/by-name/ka/kazumi/pubspec.lock.json
+++ b/pkgs/by-name/ka/kazumi/pubspec.lock.json
@@ -1151,8 +1151,8 @@
      "dependency": "direct main",
      "description": {
        "path": "media_kit",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1162,8 +1162,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/android/media_kit_libs_android_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1173,8 +1173,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/ios/media_kit_libs_ios_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1184,8 +1184,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/linux/media_kit_libs_linux",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1195,8 +1195,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/macos/media_kit_libs_macos_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1206,8 +1206,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/ohos/media_kit_libs_ohos",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1217,8 +1217,8 @@
      "dependency": "direct main",
      "description": {
        "path": "libs/universal/media_kit_libs_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1228,8 +1228,8 @@
      "dependency": "direct overridden",
      "description": {
        "path": "libs/windows/media_kit_libs_windows_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -1239,8 +1239,8 @@
      "dependency": "direct main",
      "description": {
        "path": "media_kit_video",
-        "ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
-        "resolved-ref": "a7d4a070fb4b66cf794893a88a1686156daf20be",
+        "ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
+        "resolved-ref": "87cdfef7dc4c14653068a1174d5eeaa7627e5a88",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@@ -2396,6 +2396,6 @@
  },
  "sdks": {
    "dart": ">=3.11.0 <4.0.0",
-    "flutter": ">=3.44.1"
+    "flutter": ">=3.44.2"
  }
 }
--- a/pkgs/by-name/li/libxxf86dga/package.nix
+++ b/pkgs/by-name/li/libxxf86dga/package.nix
@@ -11,11 +11,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libxxf86dga";
-  version = "1.1.6";
+  version = "1.1.7";

  src = fetchurl {
    url = "mirror://xorg/individual/lib/libXxf86dga-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vkRCdXmAj+OiF9WfUcrnVqJpE+tuTIc4zKtl/1bXmA8=";
+    hash = "sha256-s75bRE0yTLbg9LUBmklyyZ6jNsy4q3lo7M7+zZF//eY=";
  };

  strictDeps = true;
--- a/pkgs/by-name/mu/mustang-cli/package.nix
+++ b/pkgs/by-name/mu/mustang-cli/package.nix
@@ -19,14 +19,14 @@ let
  };
 in
 maven.buildMavenPackage (finalAttrs: {
-  version = "2.23.1";
+  version = "2.24.0";
  pname = "mustang-cli";

  src = fetchFromGitHub {
    owner = "ZUGFeRD";
    repo = "mustangproject";
    tag = "core-${finalAttrs.version}";
-    hash = "sha256-HhNcmXXwnR2u1hjSeNYfU+j9EdJ+tbXhgWHj1k4eSuw=";
+    hash = "sha256-hNsVVG0OJlshv0J8l6TYtoFCaPKVQrv6U8HO/I6whBo=";
  };

  strictDeps = true;
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -1,40 +1,62 @@
 {
-  buildGoModule,
  lib,
+  buildGoModule,
  fetchFromGitHub,
-  udev,
  nix-update-script,
-  versionCheckHook,
+  pkg-config,
+  pipewire,
+  udev,
+  usbutils,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "openlinkhub";
-  version = "0.7.5";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "jurkovic-nikola";
    repo = "OpenLinkHub";
-    tag = version;
-    hash = "sha256-Jq31ZcJtl0ZmjNsMOiTTt2eZIIYn2DRVPE4Q5FTx6OM=";
+    tag = finalAttrs.version;
+    hash = "sha256-yxLRwYsBvwpPVeQWx8R9bfbtdkGu2qUsDiyoijcTD2g=";
  };

  proxyVendor = true;
+  vendorHash = "sha256-/itomxsbTDT7ML52bpUfDZIBZ/Rh/zx4Blg+PP7m7gE=";

-  vendorHash = "sha256-xpIaQzl2jrWRIUe/1woODKLlwxQrdlCLkIk0qmWs7m0=";
+  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
+    pipewire
    udev
+    usbutils
  ];

+  env.CGO_CFLAGS_ALLOW = "-fno-strict-overflow";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 644 -t $out/etc/udev/rules.d 99-openlinkhub.rules
+    install -Dm 755 -t $out/bin $GOPATH/bin/OpenLinkHub
+
+    mkdir -p $out/opt/OpenLinkHub
+    cp -r {database,static,web} $out/opt/OpenLinkHub
+
+    runHook postInstall
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
    homepage = "https://github.com/jurkovic-nikola/OpenLinkHub";
-    platforms = lib.platforms.linux;
    description = "Open source interface for iCUE LINK Hub and other Corsair AIOs, Hubs for Linux";
-    maintainers = with lib.maintainers; [ bot-wxt1221 ];
-    license = lib.licenses.gpl3Only;
+    changelog = "https://github.com/jurkovic-nikola/OpenLinkHub/releases/tag/${finalAttrs.version}";
    mainProgram = "OpenLinkHub";
-    changelog = "https://github.com/jurkovic-nikola/OpenLinkHub/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      bot-wxt1221
+      mikaeladev
+    ];
  };
-}
+})
--- a/pkgs/by-name/ri/ripplerx/package.nix
+++ b/pkgs/by-name/ri/ripplerx/package.nix
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ripplerx";
-  version = "1.5.18";
+  version = "1.5.19";

  src = fetchFromGitHub {
    owner = "tiagolr";
    repo = "ripplerx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lHLAJ8eCmn/WFYxGl/zIq8a2xPKqzpB7tilffJcXhM4=";
+    hash = "sha256-YcrBJu7vLh8KZkds6OA48nhOHtZjRymxGrNmh7yTIxc=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/sh/shader-slang/package.nix
+++ b/pkgs/by-name/sh/shader-slang/package.nix
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "shader-slang";
-  version = "2026.5.2";
+  version = "2026.11";

  src = fetchFromGitHub {
    owner = "shader-slang";
    repo = "slang";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kx1g7GrUX8ZPg/HGS6SpRYat/YLTJejxCM2UgcUkDgo=";
+    hash = "sha256-PnqnTd6ccOK6WWCEdan0l6NFy/0Iv0nIbfk3oywTQZU=";
    fetchSubmodules = true;
  };

@@ -101,6 +101,9 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "SLANG_RHI_ENABLE_VULKAN" false)
    (lib.cmakeBool "SLANG_RHI_ENABLE_METAL" false)
    (lib.cmakeBool "SLANG_RHI_ENABLE_WGPU" false)
+    # Disable DXC (DirectX Compiler) for now; wiring up directx-shader-compiler
+    # as a proper dependency is left for a future PR
+    (lib.cmakeBool "SLANG_ENABLE_DXIL" false)
  ]
  ++ lib.optionals withGlslang [
    (lib.cmakeBool "SLANG_USE_SYSTEM_SPIRV_TOOLS" true)
--- a/pkgs/by-name/sl/slimserver/package.nix
+++ b/pkgs/by-name/sl/slimserver/package.nix
@@ -6,6 +6,7 @@
  lib,
  makeWrapper,
  monkeys-audio,
+  nix-update-script,
  nixosTests,
  perlPackages,
  sox,
@@ -34,13 +35,13 @@ let
 in
 perlPackages.buildPerlPackage rec {
  pname = "slimserver";
-  version = "9.1.0";
+  version = "9.1.1";

  src = fetchFromGitHub {
    owner = "LMS-Community";
    repo = "slimserver";
    tag = version;
-    hash = "sha256-Df7v1oxc1NYiVApU5p1CzB0UxlLqia1RtytgttKdSJo=";
+    hash = "sha256-+GvP4+DdJs7NLB/V2uLq28Pa3K3M9u1Ni86k+PYECOo=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -128,7 +129,12 @@ perlPackages.buildPerlPackage rec {
      inherit (nixosTests) slimserver;
    };

-    updateScript = ./update.nu;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "(9\\.[0-9.]+)"
+      ];
+    };
  };

  meta = {
@@ -143,7 +149,6 @@ perlPackages.buildPerlPackage rec {
      adamcstephens
      jecaro
    ];
-    platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/sl/slimserver/update.nu
+++ b/pkgs/by-name/sl/slimserver/update.nu
@@ -1,14 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts
-
-# get latest tag, but drop versions 10.0 tags since they are 10+ years old
-let latest_tag = list-git-tags --url=https://github.com/LMS-Community/slimserver | lines | find --invert 10.0 | sort --natural | last
-
-let current_version = nix eval --raw -f default.nix slimserver | str trim
-
-if $latest_tag != $current_version {
-  update-source-version slimserver $latest_tag $"--file=(pwd)/pkgs/by-name/sl/slimserver/package.nix"
-  {before: $current_version, after: $latest_tag}
-} else {
-  "No new version"
-}
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "vcpkg";
-  version = "2026.05.25";
+  version = "2026.06.01";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "vcpkg";
    tag = finalAttrs.version;
-    hash = "sha256-UoskFd2Pmdr7U0y9x5AgNNTIWlJuk1lTY3Q/kxb+c7I=";
+    hash = "sha256-hb3kFRe/14pO0IUyQNpmV2tEgP0hCcRx5KcbY49MPio=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
--- a/pkgs/by-name/zw/zwave-js-server/package.nix
+++ b/pkgs/by-name/zw/zwave-js-server/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "zwave-js-server";
-  version = "3.4.0";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "zwave-js";
    repo = "zwave-js-server";
    rev = version;
-    hash = "sha256-JmPO1faJgpJ+RjocvauP0EQGken61G59CLqQAZiRSUU=";
+    hash = "sha256-PZmIpGcNxjZ5q7rnYj2SdtxCO7SyjWd5QFl+JT89KDU=";
  };

-  npmDepsHash = "sha256-lCJ4dcLIv+PQkoNdaP9FsXbWIzy2sdooQw08ZVbESCM=";
+  npmDepsHash = "sha256-CIVGcz8K0kTfcJXaTO7SClt72AhRx1rZUXQgTm+aFdk=";

  # For some reason the zwave-js dependency is in devDependencies
  npmFlags = [ "--include=dev" ];
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-arcmenu";
-  version = "67.2";
+  version = "69.2";

  src = fetchFromGitLab {
    owner = "arcmenu";
    repo = "ArcMenu";
    rev = "v${version}";
-    hash = "sha256-MqzxHETxfifsIhoWv0xgUM1DvmrYn3ICoggZhjhqaRo=";
+    hash = "sha256-BdvFeoXwGxFlBH1JqcSDAKMzN+wBEmZdsz+gXWxQF6Y=";
  };

  patches = [
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-code";
-  version = "8.3.0";
+  version = "8.3.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "code";
    tag = version;
-    hash = "sha256-5ijVYfpr2SU0loPQ9L2vvxOVrNA67IhEMqIqoaf36iY=";
+    hash = "sha256-K4b7qbEUNFy6BV0fifqW929MBUDepbrSDV2CHI9Ucv0=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@@ -2,21 +2,27 @@
  stdenv,
  lib,
  fetchFromGitLab,
+  testers,
  gitUpdater,
+  dbus-test-runner,
  doxygen,
  glib,
+  graphviz,
  libaccounts-glib,
  pkg-config,
  qmake,
  qtbase,
-  wrapQtAppsHook,
+  qttools,
+  writableTmpDirAsHomeHook,
 }:

+let
+  withQt6 = lib.strings.versionAtLeast qtbase.version "6";
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "accounts-qt";
  version = "1.17";

-  # pinned to fork with Qt6 support
  src = fetchFromGitLab {
    owner = "accounts-sso";
    repo = "libaccounts-qt";
@@ -24,32 +30,91 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-mPZgD4r7vlUP6wklvZVknGqTXZBckSOtNzK7p6e2qSA=";
  };

+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  postPatch =
+    # Don't install test binary. Not useful, and it has ref to /build.
+    ''
+      substituteInPlace tests/tst_libaccounts.pro \
+        --replace-fail 'include( ../common-installs-config.pri )' '# include( ../common-installs-config.pri )'
+    ''
+    # Let Nix do the timeout.
+    + ''
+      substituteInPlace tests/accountstest.sh \
+        --replace-fail 'dbus-test-runner -m 180' 'dbus-test-runner -m 0'
+    ''
+    # We're installing headers to dev output
+    + ''
+      substituteInPlace Accounts/AccountsQt*Config.cmake.in \
+        --replace-fail 'set(ACCOUNTSQT_INCLUDE_DIRS $${INSTALL_PREFIX}' 'set(ACCOUNTSQT_INCLUDE_DIRS $${NIX_OUTPUT_DEV}'
+    ''
+    # qhelpgenerator isn't on PATH w/ Qt6
+    + ''
+      substituteInPlace doc/doxy.conf \
+        --replace-fail \
+          '= qhelpgenerator' \
+          '= ${if withQt6 then "${qttools}/libexec" else "${lib.getDev qttools}/bin"}/qhelpgenerator'
+    '';
+
+  # QMake
+  strictDeps = false;
+
+  nativeBuildInputs = [
+    doxygen
+    graphviz
+    pkg-config
+    qmake
+    writableTmpDirAsHomeHook # to stop doxygen from complaining
+  ];
+
  propagatedBuildInputs = [
    glib
    libaccounts-glib
  ];
-  buildInputs = [ qtbase ];
-  nativeBuildInputs = [
-    doxygen
-    pkg-config
-    qmake
-    wrapQtAppsHook
+
+  nativeCheckInputs = [
+    dbus-test-runner
  ];

-  # remove forbidden references to /build
-  preFixup = ''
-    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$out"/bin/*
+  # Library
+  dontWrapQtApps = true;
+
+  # Configure *now*
+  postConfigure = ''
+    make qmake_all
  '';

-  passthru.updateScript = gitUpdater {
-    rev-prefix = "VERSION_";
+  postBuild = ''
+    make docs
+  '';
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  # For qhelpgenerator to find minimal plugin
+  env.QT_PLUGIN_PATH = "${lib.getBin qtbase}/${qtbase.qtPluginPrefix}";
+
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "VERSION_";
+    };
  };

  meta = {
-    description = "Qt library for accessing the online accounts database";
-    mainProgram = "accountstest";
-    homepage = "https://gitlab.com/accounts-sso/libaccounts-qt";
-    license = lib.licenses.lgpl21;
+    description = "Qt-based client library for the accounts database";
+    homepage = "https://accounts-sso.gitlab.io/";
+    license = lib.licenses.lgpl21Only;
+    maintainers = [ lib.maintainers.OPNA2608 ];
    platforms = lib.platforms.linux;
+    pkgConfigModules = [
+      "accounts-qt${lib.versions.major qtbase.version}"
+    ];
  };
 })
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -78,6 +78,14 @@ stdenv.mkDerivation rec {
    "OpenEXR.testSampleImages"
    "OpenEXR.testSharedFrameBuffer"
    "OpenEXR.testTiledRgba"
+
+    # Lack of proper endianness handling in OpenJPH
+    # https://github.com/aous72/OpenJPH/issues/266
+    # "ojph error 0x00050041 at ojph_params.cpp:687: error reading SIZ marker", and similar errors
+    "OpenEXR.testConversion"
+    "OpenEXR.testExistingStreams"
+    "OpenEXR.testLargeDataWindowOffsets"
+    "OpenEXR.testTiledCompression"
  ];

  passthru.tests = {
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.32";
+  version = "1.43.33";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-1jpnmxnBJCJpiLHbomnLWCgBdax0NWcyEsEJBPz/rug=";
+    hash = "sha256-fcaKNxemictMYAM11XGeBjXg0HEPICs678A+WQpMmAI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "claude-agent-sdk";
-  version = "0.2.102";
+  version = "0.2.105";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anthropics";
    repo = "claude-agent-sdk-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Vh+NS/NGzZICfWiw3MSRSeU/PlusyJTFHwPHTaRwO4M=";
+    hash = "sha256-CkY3mJp8vUgB1SR+vg9S/r3pIGvgppmgll3wre4bd00=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202606181";
+  version = "0.1.202606191";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-m0GxNjaPA4XTjpysgAv5FQ+zw4hjyEdgt/NSJoRDMj0=";
+    hash = "sha256-E3//Jc1VSjoymAcqe+uSKTZ3Dw45sNXP3NYI00EN6N8=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -107,8 +107,8 @@ in
      "sha256-ddcr8HAgFnhGDYPGx8WrNi16Rg++W1A7ccpBXn86hbc=";

  mypy-boto3-application-autoscaling =
-    buildMypyBoto3Package "application-autoscaling" "1.43.0"
-      "sha256-f9Xs8j/KPZjmNJaifdX1Pi+oxliZHAeX80q/qXUURv0=";
+    buildMypyBoto3Package "application-autoscaling" "1.43.33"
+      "sha256-2XP/4KieF/WxpTNef7md499zt0eMOaQ6WiwEIObZEIo=";

  mypy-boto3-application-insights =
    buildMypyBoto3Package "application-insights" "1.43.0"
@@ -163,8 +163,8 @@ in
      "sha256-FZuhcgbPBohluThfTy99inR5nyG0r3q/AsxNEvtgJU4=";

  mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.15"
-      "sha256-q0lBBSuu3eAed8d5XaminRn8h9tZTLXaLlKMjZ+20SM=";
+    buildMypyBoto3Package "batch" "1.43.33"
+      "sha256-JOYTa+nkiVal5gvKf2yF+eMdbKbPK45oyLKGNq6DYrc=";

  mypy-boto3-billingconductor =
    buildMypyBoto3Package "billingconductor" "1.43.7"
@@ -311,8 +311,8 @@ in
      "sha256-CavBKgp+dEMR2poR+bG2PgZb+wX1zlNmuOyJsV3LfVM=";

  mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.43.19"
-      "sha256-Aihq5V9TmK5erGX06KeGzHftyu68BYhkifn2HnMXBG0=";
+    buildMypyBoto3Package "cognito-idp" "1.43.33"
+      "sha256-tNZluhU3Ano5b9ZYs4Zyut3WJrKyJgkCFc0ceM/NtmQ=";

  mypy-boto3-cognito-sync =
    buildMypyBoto3Package "cognito-sync" "1.43.0"
@@ -327,8 +327,8 @@ in
      "sha256-sXIPfVu+Ss+UHCZ7W1qof+rbEb266dqrSU3V6/j5PzY=";

  mypy-boto3-compute-optimizer =
-    buildMypyBoto3Package "compute-optimizer" "1.43.25"
-      "sha256-OetbBzcvQZ3d7bW5fd6Uljqn61+AusqZgh4hH0eV8nE=";
+    buildMypyBoto3Package "compute-optimizer" "1.43.33"
+      "sha256-Y+cDD5dq7C8tiGW37YheNcHTMxFyYCX6P6JPSjN7ttA=";

  mypy-boto3-config =
    buildMypyBoto3Package "config" "1.43.23"
@@ -443,8 +443,8 @@ in
      "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";

  mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.27"
-      "sha256-Cz3DhKTxDSluH14aqeY+lPuCGTEOoC0DJp7A3RCP7Gg=";
+    buildMypyBoto3Package "ec2" "1.43.33"
+      "sha256-35GbcIr6yNm8rfPoQ4v1a+R0AXrNKd/CiT/S0iJL1Ok=";

  mypy-boto3-ec2-instance-connect =
    buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -459,16 +459,16 @@ in
      "sha256-02BUkAFhr9sT8ohkJJFPYNni0O9/UI/G0GUee/Kx5Dw=";

  mypy-boto3-ecs =
-    buildMypyBoto3Package "ecs" "1.43.32"
-      "sha256-pMGBaM4f26LMyu+uU4/TA7B9Mfh2PDSrH0RmKturmf8=";
+    buildMypyBoto3Package "ecs" "1.43.33"
+      "sha256-ihoW11IbKb9lmWCnn5cKvHV77wfmcPqYYCivvSV4m7I=";

  mypy-boto3-efs =
    buildMypyBoto3Package "efs" "1.43.23"
      "sha256-11KpPRxGId76g/I4jXwMQ55kwGEQVsasgvMUXsiLbM4=";

  mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.43.29"
-      "sha256-gQdBnUEwhso0BNY2UW2sU45cz75K1bS9gSX5vrIET2A=";
+    buildMypyBoto3Package "eks" "1.43.33"
+      "sha256-ryLZyMekjwdF6LGgNkQ5m6ocEm1DFys/U7QJl/sst3k=";

  mypy-boto3-elastic-inference =
    buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -559,8 +559,8 @@ in
      "sha256-4roB3AEdN4zXGceUNkrmarmTThmPbS9SltvHG6kF+84=";

  mypy-boto3-gamelift =
-    buildMypyBoto3Package "gamelift" "1.43.0"
-      "sha256-WGFXXyxUTvKbPbJnkAxcn5LbCzN4hTJ/5LhyTQZI3+s=";
+    buildMypyBoto3Package "gamelift" "1.43.33"
+      "sha256-OVgUWPp91lYeOXZpFDYRiRxxLWt6xbI6Ib2aozMu2eU=";

  mypy-boto3-glacier =
    buildMypyBoto3Package "glacier" "1.43.0"
@@ -598,8 +598,8 @@ in
      "sha256-UHDodWN6MLV54LA31Pc7vlMr7a0tVrmCfVjXl96cjsE=";

  mypy-boto3-healthlake =
-    buildMypyBoto3Package "healthlake" "1.43.28"
-      "sha256-qRmvgKIela1k38muCLMKrGbFWiOjapQPS0oXQ2mPU+s=";
+    buildMypyBoto3Package "healthlake" "1.43.33"
+      "sha256-KBy7YsMMoTw7A+HPAA4hFKJ/cesmuBuiucPuCGkTlgI=";

  mypy-boto3-iam =
    buildMypyBoto3Package "iam" "1.43.29"
@@ -766,8 +766,8 @@ in
      "sha256-gYTCgaRwH3zKi6gg4MC8DUwXQT+jZO6lqc/vi+JUahU=";

  mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.43.20"
-      "sha256-wdYorfSAmlDVEFRlQxiujWu/OFbq6nKA2aZt1mv/isk=";
+    buildMypyBoto3Package "lambda" "1.43.33"
+      "sha256-WrEHRzWcOLIolJk0tXpiqCbaYBRHED/fsyi8BSo9kpQ=";

  mypy-boto3-lex-models =
    buildMypyBoto3Package "lex-models" "1.43.3"
@@ -806,8 +806,8 @@ in
      "sha256-EunrKwNaYp0CDiwp8frI7zASilMF4wYHjDSuCsJ6aJM=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.43.30"
-      "sha256-9orJ4i+E+GKPxvvpJzAbKrrVIOBQqahx6gsUv1KCbV4=";
+    buildMypyBoto3Package "logs" "1.43.33"
+      "sha256-Acp5vySW/YPY11wzHKE1/s/K3fP+aIAed6GeQpd0Ru0=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.43.0"
@@ -1170,8 +1170,8 @@ in
      "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";

  mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.31"
-      "sha256-S2uL8thh/cyWkxeyZMBBL/BFlky0MFsuYKdNkT3JROw=";
+    buildMypyBoto3Package "sagemaker" "1.43.33"
+      "sha256-dTc7cVfvrRoCxP9rUBRYTw8UhQdges7IERfXSRXHxd0=";

  mypy-boto3-sagemaker-a2i-runtime =
    buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@@ -1342,8 +1342,8 @@ in
      "sha256-EGelGYE1b7seBg7WHOnY1Vumlw8iMqBAMIuUpPmIUIA=";

  mypy-boto3-synthetics =
-    buildMypyBoto3Package "synthetics" "1.43.0"
-      "sha256-UmRSnFX0xy8YlB/RVAxSeRLwNSUE4rqkkXI1lf6MqvQ=";
+    buildMypyBoto3Package "synthetics" "1.43.33"
+      "sha256-vfHbGu/CUJKHLc7G5FVwvedPdsQ6d0ft5vlU25khVdQ=";

  mypy-boto3-textract =
    buildMypyBoto3Package "textract" "1.43.0"
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.117";
+  version = "3.1.119";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-u0vTpcRkgnHeO6lj5eU359p3E8RcyHMM+ukAVlcdfuU=";
+    hash = "sha256-6uPKhXonPxWIwyXYlURSukwDg0WJnUkA4wCcNxWimlY=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -30,7 +30,7 @@

 buildPythonPackage rec {
  pname = "weaviate-client";
-  version = "4.21.3";
+  version = "4.22.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
    owner = "weaviate";
    repo = "weaviate-python-client";
    tag = "v${version}";
-    hash = "sha256-1c1jjikWLD1o1bqUosEZFUi8/r7y+VBuafjXv5PXaic=";
+    hash = "sha256-dAN4R71BQsYJkxdwnDvLEkw1rfJvxRX6IUVsh3+WWEE=";
  };

  pythonRelaxDeps = [
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  openssl,
  zlib,
-  pcre,
+  pcre2,
  libxcrypt,
  libxml2,
  libxslt,
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    openssl
    zlib
-    pcre
+    pcre2
    libxcrypt
    libxml2
    libxslt