Merge staging-next into staging

2026-06-05 21:03:40 +00:00 · 2026-05-07 12:39:44 +00:00
parent ec02e9d82e 7c5a818410
commit f2fcfe6487
80 changed files with 5721 additions and 443 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -290,6 +290,12 @@
    githubId = 92977828;
    name = "Mori Zen";
  };
+  _7591yj = {
+    email = "yeongjin.kim@proton.me";
+    github = "7591yj";
+    githubId = 77034308;
+    name = "Yeongjin Kim";
+  };
  _7karni = {
    email = "7karni@proton.me";
    name = "7karni";
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -2,51 +2,12 @@
  config,
  options,
  lib,
-  pkgs,
  ...
 }:
 let
  cfg = config.nixpkgs;
  opt = options.nixpkgs;

-  isConfig = x: builtins.isAttrs x || lib.isFunction x;
-
-  optCall = f: x: if lib.isFunction f then f x else f;
-
-  mergeConfig =
-    lhs_: rhs_:
-    let
-      lhs = optCall lhs_ { inherit lib pkgs; };
-      rhs = optCall rhs_ { inherit lib pkgs; };
-    in
-    lib.recursiveUpdate lhs rhs
-    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
-      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
-    }
-    // lib.optionalAttrs (lhs ? packageOverrides) {
-      packageOverrides =
-        pkgs:
-        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
-    }
-    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
-      perlPackageOverrides =
-        pkgs:
-        optCall lhs.perlPackageOverrides pkgs
-        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
-    };
-
-  configType = lib.mkOptionType {
-    name = "nixpkgs-config";
-    description = "nixpkgs config";
-    check =
-      x:
-      let
-        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
-      in
-      traceXIfNot isConfig;
-    merge = args: lib.foldr (def: mergeConfig def.value) { };
-  };
-
  overlayType = lib.mkOptionType {
    name = "nixpkgs-overlay";
    description = "nixpkgs overlay";
@@ -73,6 +34,8 @@ let
    ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem
    ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem;

+  _configDefinitions = opt.config.definitionsWithLocations;
+
  defaultPkgs =
    if opt.hostPlatform.isDefined then
      let
@@ -90,14 +53,15 @@ let
      in
      import ../../.. (
        {
-          inherit (cfg) config overlays;
+          inherit _configDefinitions;
+          inherit (cfg) overlays;
        }
        // systemArgs
      )
    else
      import ../../.. {
+        inherit _configDefinitions;
        inherit (cfg)
-          config
          overlays
          localSystem
          crossSystem
@@ -165,7 +129,15 @@ in
      example = lib.literalExpression ''
        { allowBroken = true; allowUnfree = true; }
      '';
-      type = configType;
+      type = lib.types.deferredModuleWith {
+        staticModules = [
+          { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; }
+          ../../../pkgs/top-level/config.nix
+        ];
+      };
+      # Returns pkgs.config instead of nixpkgs.config
+      # This shadows the deferredModule to make it look like a submodule
+      apply = _: finalPkgs.config;
      description = ''
        Global configuration for Nixpkgs.
        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
@@ -406,7 +378,7 @@ in
          '';
        }
        {
-          assertion = opt.pkgs.isDefined -> cfg.config == { };
+          assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority;
          message = ''
            Your system configures nixpkgs with an externally created instance.
            `nixpkgs.config` options should be passed when creating the instance instead.
--- a/nixos/modules/services/finance/odoo.nix
+++ b/nixos/modules/services/finance/odoo.nix
@@ -46,7 +46,24 @@ in
      };

      settings = lib.mkOption {
-        type = format.type;
+        type = lib.types.submodule {
+          options = {
+            options = {
+              workers = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 0;
+                description = "Values above 0 will enable the multi-processing HTTP server, this should be set for production setups. This needs to be set to >0 for real-time connections in the discuss app. For configuration recommendations see <https://www.odoo.com/documentation/19.0/administration/on_premise/deploy.html#builtin-server>";
+              };
+              proxy_mode = lib.mkOption {
+                type = lib.types.bool;
+                default = cfg.domain != null;
+                defaultText = "services.odoo.domain != null";
+                description = "Enables the use of X-Forwarded-* headers through Werkzeug’s proxy support. Must be enabled if reverse proxy is used.";
+              };
+            };
+          };
+          freeformType = format.type;
+        };
        default = { };
        description = ''
          Odoo configuration settings. For more details see <https://www.odoo.com/documentation/15.0/administration/install/deploy.html>
@@ -96,7 +113,7 @@ in
          '';

          locations = {
-            "/longpolling" = {
+            "/websocket" = {
              proxyPass = "http://odoochat";
            };

@@ -127,7 +144,6 @@ in
        );
        settings.options = {
          data_dir = "/var/lib/private/odoo/data";
-          proxy_mode = cfg.domain != null;
          # Disable the database manager by default
          # https://www.odoo.com/documentation/master/administration/on_premise/deploy.html#database-manager-security
          list_db = lib.mkDefault false;
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -131,6 +131,7 @@ let
        "v2ray"
        "varnish"
        "wireguard"
+        "zfs-siebenmann"
        "zfs"
      ]
      (
--- a/nixos/modules/services/monitoring/prometheus/exporters/zfs-siebenmann.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/zfs-siebenmann.nix
@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.zfs-siebenmann;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    optionalString
+    ;
+in
+{
+  port = 9700;
+
+  extraOpts = {
+    pools = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      description = ''
+        Name of the pool(s) to collect, repeat for multiple pools (default: all pools).
+      '';
+    };
+
+    depth = mkOption {
+      type = types.int;
+      default = 1;
+      description = ''
+        Depth of the vdev tree to report on.
+        0 is the pool, 1 is top level vdevs, 2 is devices too.
+      '';
+    };
+
+    fullPath = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Report the full path of disks.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    # needs zpool
+    path = [ config.boot.zfs.package ];
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-siebenmann-zfs-exporter}/bin/zfs_exporter \
+          --listen-addr ${cfg.listenAddress}:${toString cfg.port} \
+          --depth ${toString cfg.depth} \
+          ${optionalString cfg.fullPath "--fullpath"} \
+          ${concatStringsSep " " (map (p: "--pool=${p}") cfg.pools)} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+      ProtectClock = false;
+      PrivateDevices = false;
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1179,15 +1179,27 @@ in
  octoprint = runTest ./octoprint.nix;
  oddjobd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./oddjobd.nix { };
  odoo17 = runTest {
-    imports = [ ./odoo.nix ];
+    imports = [ ./odoo/single-process.nix ];
+    _module.args.package = pkgs.odoo17;
+  };
+  odoo17-multiprocess = runTest {
+    imports = [ ./odoo/multi-process.nix ];
    _module.args.package = pkgs.odoo17;
  };
  odoo18 = runTest {
-    imports = [ ./odoo.nix ];
+    imports = [ ./odoo/single-process.nix ];
+    _module.args.package = pkgs.odoo18;
+  };
+  odoo18-multiprocess = runTest {
+    imports = [ ./odoo/multi-process.nix ];
    _module.args.package = pkgs.odoo18;
  };
  odoo19 = runTest {
-    imports = [ ./odoo.nix ];
+    imports = [ ./odoo/single-process.nix ];
+    _module.args.package = pkgs.odoo19;
+  };
+  odoo19-multiprocess = runTest {
+    imports = [ ./odoo/multi-process.nix ];
    _module.args.package = pkgs.odoo19;
  };
  oh-my-zsh = runTest ./oh-my-zsh.nix;
--- a/nixos/tests/odoo/multi-process.nix
+++ b/nixos/tests/odoo/multi-process.nix
@@ -0,0 +1,39 @@
+{
+  package,
+  lib,
+  ...
+}:
+{
+  name = "odoo-multi-process";
+  meta.maintainers = with lib.maintainers; [
+    mkg20001
+    xanderio
+  ];
+
+  nodes.server = {
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+    };
+
+    services.odoo = {
+      enable = true;
+      package = package;
+      autoInit = true;
+      autoInitExtraFlags = [ "--without-demo=all" ];
+      domain = "localhost";
+      settings.options.workers = 2;
+    };
+  };
+
+  testScript = # python
+    ''
+      server.wait_for_unit("odoo.service")
+      server.wait_until_succeeds(
+        "test $(journalctl -u odoo | grep -o 'Worker WorkerHTTP ([[:digit:]]*) alive' | wc -l) = 2"
+      )
+      server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
+      server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
+      server.succeed("curl http://localhost/web/database/manager | grep 'database manager has been disabled'")
+    '';
+}
--- a/nixos/tests/odoo/single-process.nix
+++ b/nixos/tests/odoo/single-process.nix
@@ -4,8 +4,11 @@
  ...
 }:
 {
-  name = "odoo";
-  meta.maintainers = with lib.maintainers; [ mkg20001 ];
+  name = "odoo-single-process";
+  meta.maintainers = with lib.maintainers; [
+    mkg20001
+    xanderio
+  ];

  nodes.server = {
    services.nginx = {
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -59,7 +59,7 @@
  vulkanSupport ? false,
  sdlSupport ? false,
  usbSupport ? false,
-  mingwSupport ? stdenv.hostPlatform.isDarwin,
+  mingwSupport ? stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64,
  waylandSupport ? false,
  x11Support ? false,
  ffmpegSupport ? false,
@@ -268,6 +268,16 @@ stdenv.mkDerivation (
          }
        '';

+    # Fix dcomp test for aarch64
+    postPatch = lib.optionalString (useStaging && stdenv.hostPlatform.isAarch64) ''
+      if [ -f dlls/dcomp/tests/dcomp.c ]; then
+        substituteInPlace dlls/dcomp/tests/dcomp.c \
+          --replace-fail \
+            '#error "Unsupported architecture"' \
+            '__asm__ __volatile__("mov %0, sp" : "=r"(stack_pointer));'
+      fi
+    '';
+
    configureFlags =
      prevConfigFlags
      ++ lib.optionals waylandSupport [ "--with-wayland" ]
--- a/pkgs/applications/emulators/wine/default.nix
+++ b/pkgs/applications/emulators/wine/default.nix
@@ -12,7 +12,13 @@ args@{
  callPackage,
  darwin,
  wineRelease ? "stable",
-  wineBuild ? if stdenv.hostPlatform.system == "x86_64-linux" then "wineWow" else "wine32",
+  wineBuild ?
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      "wineWow"
+    else if stdenv.hostPlatform.isAarch64 then
+      "wine64"
+    else
+      "wine32",
  gettextSupport ? false,
  fontconfigSupport ? false,
  alsaSupport ? false,
@@ -39,7 +45,7 @@ args@{
  vulkanSupport ? false,
  sdlSupport ? false,
  usbSupport ? false,
-  mingwSupport ? stdenv.hostPlatform.isDarwin,
+  mingwSupport ? stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64,
  waylandSupport ? false,
  x11Support ? false,
  ffmpegSupport ? false,
--- a/pkgs/applications/emulators/wine/llvm-mingw.nix
+++ b/pkgs/applications/emulators/wine/llvm-mingw.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  zlib,
+  stdenv,
+}:
+
+# Used as a workaround for ucrtAarch64.
+# compiler-rt due to pthread.h not being found during cross-build.
+
+let
+  version = "20260421";
+
+  hostArch =
+    if stdenv.hostPlatform.isAarch64 then
+      "aarch64"
+    else if stdenv.hostPlatform.isx86_64 then
+      "x86_64"
+    else
+      throw "llvm-mingw: unsupported host platform ${stdenv.hostPlatform.system}";
+
+  hashes = {
+    aarch64 = "sha256-6c+lqTKQy4Utxaa5DM3iVUA6YzMmSL4XFHDKPBrTeCg=";
+    x86_64 = "sha256-+LjM53mv/qtHvK7Gzm6edosWYJSjZhI+9kstCzicwSE=";
+  };
+in
+stdenvNoCC.mkDerivation {
+  pname = "llvm-mingw-${hostArch}";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/mstorsjo/llvm-mingw/releases/download/${version}/llvm-mingw-${version}-ucrt-ubuntu-22.04-${hostArch}.tar.xz";
+    hash = hashes.${hostArch};
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [
+    (lib.getLib stdenv.cc.cc) # libstdc++
+    zlib
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r * $out/
+
+    runHook postInstall
+  '';
+
+  autoPatchelfIgnoreMissingDeps = [ "*.dll" ];
+  dontStrip = true;
+
+  meta = {
+    description = "LLVM/Clang/LLD-based mingw-w64 toolchain (prebuilt)";
+    homepage = "https://github.com/mstorsjo/llvm-mingw";
+    license = lib.licenses.zlib;
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/applications/emulators/wine/packages.nix
+++ b/pkgs/applications/emulators/wine/packages.nix
@@ -28,6 +28,8 @@ let
    mono
    ;

+  llvm-mingw = callPackage ./llvm-mingw.nix { };
+
  # Args to pass through to base.nix (support flags, etc.)
  baseArgs = removeAttrs args [
    "stdenv_32bit"
@@ -71,13 +73,19 @@ in
      pname = "wine64";
      inherit version patches;
      pkgArches = [ pkgs ];
-      mingwGccs = with pkgsCross; [ mingwW64.buildPackages.gcc ];
+      mingwGccs =
+        if pkgs.stdenv.hostPlatform.isAarch64 then
+          [ llvm-mingw ]
+        else
+          with pkgsCross; [ mingwW64.buildPackages.gcc ];
      geckos = [ gecko64 ];
      monos = [ mono ];
-      configureFlags = [ "--enable-win64" ];
+      configureFlags =
+        if pkgs.stdenv.hostPlatform.isAarch64 then [ "--enable-archs=aarch64" ] else [ "--enable-win64" ];
      platforms = [
        "x86_64-linux"
        "x86_64-darwin"
+        "aarch64-linux"
      ];
      mainProgram = "wine";
    }
@@ -119,16 +127,26 @@ in
      inherit version patches;
      mingwSupport = true; # Required because we request "--enable-archs=x86_64"
      pkgArches = [ pkgs ];
-      mingwGccs = with pkgsCross; [
-        mingw32.buildPackages.gcc
-        mingwW64.buildPackages.gcc
-      ];
+      mingwGccs =
+        if pkgs.stdenv.hostPlatform.isAarch64 then
+          [ llvm-mingw ]
+        else
+          with pkgsCross;
+          [
+            mingw32.buildPackages.gcc
+            mingwW64.buildPackages.gcc
+          ];
      geckos = [ gecko64 ];
      monos = [ mono ];
-      configureFlags = [ "--enable-archs=x86_64,i386" ];
+      configureFlags =
+        if pkgs.stdenv.hostPlatform.isAarch64 then
+          [ "--enable-archs=aarch64,x86_64,i386" ]
+        else
+          [ "--enable-archs=x86_64,i386" ];
      platforms = [
        "x86_64-linux"
        "x86_64-darwin"
+        "aarch64-linux"
      ];
      mainProgram = "wine";
    }
--- a/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json
@@ -1,138 +1,138 @@
 {
  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "641e70087040bffb40e5d021f125ddfe3c3fd1cfa60a6c47abd1647bbc69a460"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "b91a3ffe046a2a3c6938352a0698da76bb88766df71c30e47ecf1ba41cd91da7"
  },
  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "02579703f9ec013132fb4f1a34d61bb067caa8a0eed987f09bab26bdf34c9d85"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "ba406b694207371dd59a08a4e22b6b8ad2506c5a617df1399d7084f52c04f383"
  },
  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "60ebbb953e2f86f5a8fdc3617298d2fa5b867913c7d1223e7b2a6058a4b55cf4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "60004be2877bc9e018c47b76f82779e754acd4931b19bfa4bb158c5013a44362"
  },
  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "0cf92d03e00550af2edbef01f248588dc0ec84346c9068c38dea01e5b33cca0b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "d7eb347708ea97b387e90eed671c64b4e0a1e11fb60af4f94995d21e0ba840d4"
  },
  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "825a67b5c88bcd4572b41d684d3a78bc860057331b446b906a43507f6313a40c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "45709e41c8b5d1ff3c9e780c8f22754cb1102d25e78932572033a716ebf7b0f7"
  },
  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "a7c22d3de484a2f9e9b6ca9d2a454d392160a1fada9a958917f2aa3bf3f38b81"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "d513d2d3887b6d6a9b91f24a177aaae736fe34af64d67b772b0e5c322c717437"
  },
  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "65354b633f282f77d1462430e05d1814676235c257895c759f4ab67e5d995458"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "75afdb00dc9bf90a0bf153909df0886ea41d28c39387a6440d4830e00dd05f95"
  },
  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "8b8af6dadeb165fed27993f0763c31f2fc55742e152c6432d712aa13841650b5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "be15ffd05156b50b27cdac28768005a27484c0b16946f9ef2531bb1d0a6185e2"
  },
  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "079198afe353632ede96795721c8c06d25095e94a37143d82aacffaa0858fad1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "fa2d53df0ec302f5a5f418cb0eb4dc7c19e653c2345b1f4f9ae9a46f267013ad"
  },
  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "094ec55290bd89bb058c979a80216ac4d49e3d081e45ee7e1ebb08fb12ea0f50"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "ce5325e6bd901a241bf0f06929da7ac35352c304f9180598b89502adbde603cf"
  },
  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "d439daf97b18bd91c1b716c22c51a3131ca30b8a8107a33cc98e2238d7fe2ff7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "cadcaa43d750d68ea137b63b1a4bf36eea64b4c05d3d7573420ea065b58c9803"
  },
  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "8d02d4ef7460929b8dcc8f6be838e8822443bee546e01f0852b158fa8ea1d18e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "7099afbc3ea21b9969cbb90a694093f91d862c6da671340753f01ddbdb7c6d25"
  },
  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "8a21224c48ddfa8d234045cfeb4f8610df3f4114d2e927310694ce563d5db6e4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "92e2f3d822fdd264a133680a909aa03104e75ab784e8b819c5ab3c6e7452ba79"
  },
  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "824fc4f4c13d04acec697355dd6c89fe334ec7a0034305fbbe55410d08584e10"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "3916099fd9c991ce5f837dad902f187aed47d7fce066cc5ffcc37ad43a909ece"
  },
  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "fcae3611339ad4f0437fb5cc8c4f246dd3d49b88d908533c9293eaef14544b4f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "24a3e2a68b8f4c16dea632ebe2b10876737c8fb5a457273cef83f0b935e3e793"
  },
  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "51ed4890c66fdaa75fa33dc2c01296b5231e678b5f0da674216f9f0e9ab04dc3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "1440c406f7c9def8170e8b279de5298cbc2a91f72fda2290581660fcd614e1a8"
  },
  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "8527c05d35be8b89343236c2e8c0d0159717750414afb554e14382e348a3984f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "de3abd803043588ae3c349a276dd52093528a3ae86115c9d4979982b6a1d59d3"
  },
  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "99e1aa2dcf3f39d736abaf8cddf229d9931ab4c80940881cd7c6b89ff357bd17"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "68b492ed357fcc513adc0baf0a5306a625d5eccfda4389ab303e4f03d1d54ca3"
  },
  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "0e14946966080e5a71852eb140489916271de41ef9c7a91c5c3bd1dc6c4c3ad8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "046f1884d788be8fcc343c73d7ff699d8be89fe6c607e0536b4a8732c5d27a13"
  },
  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "c94fecb19b6b1eaa347c49fc60def2e1251d866714e9ab05ea6ce29d5da41fb3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "0d1c03990ca8e243ba4a291312f1a1ce62b52e28170ee6f85b0a95f8032b3eef"
  },
  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "2580870d652d80dc9d2f6904cb247d42490a96760d020a4a054e5cdc6f68a873"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "b0f286a53c7da0f9275da9a4e648913b588ccfcf70c8289886e48008f256ea51"
  },
  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "9def3c6c9094030c258e6e02aa24195f33e4f2ce6abdb5d7a219100bf1d86e11"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "4d4340241b1e417cac9be28f60b6a4f48bb6e513fb01f261bb72e47b162b8917"
  },
  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "9f5777b154a7df4977cd12d162ab559edd8c1ec1a716aab4e2b33e5bb39ae69e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "a5a225e9b8d57bccbb04095ab86d77897ef39beda4c9db56fe43152f7922e213"
  },
  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "47f9647b674c412ceb915c71790ca1ce71424f733d0dbdb675699335fb33d2d8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "3786e9642a9ad14a55c87917ca8a3b2a03b9cb8cf7ee7320d0ea4e122c566a8f"
  },
  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "7e3ed1fa01a9f44dc957f2adc6e5e877b1e1d32b94a3ea5a1722ed1d12c9189b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "a6d84f504820e9199859f7943662e1232621ece3bd1559c1e630dfac2726f344"
  },
  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "8d3884444e465f8f41a8fc64d2af0a9ee010239ab5d7cc531fdad8e8e48952f9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "d2084cdb68c8a68d70854b68d15382baddc197980d48de0d45707391f252656e"
  },
  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "92fc511e73ffc08defc7b8e71fb6ef769531cb2a8fe3ed2053d4a7d337644cf4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "ceb393f3f89bd550de3ac4bfdbfa4d090fa6693d7f0b3428bd0db5dc4ebd7ac0"
  },
  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "ba77ac84eda9704594aa9eb6629430f7b60606fb532e245c21bf4ca0f7fbee9b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "fe7cda504690bcc90694b9c88c6bab70ea4e89d14c17ab0b726de6eaa3c3055d"
  },
  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "87ab074fda05e5d55dfeda6c1af492c8e87b2f37a1087183a8faa73ca07d7499"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "d24aeb2d60ee5009dcf663b6edea6a5a30ff4486a98b91f87661b02d83fc116c"
  },
  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2fbbcb3af0673dfd2f046150fb0775468f6139dd41537bd8bff77f3bdfb5ffbe"
  },
  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "beaee2bd0190ecaee7a61f74c20cc4586c1f6e80f74dfe4d2993ec5468f7d26a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "ae97992ad44e403271ce5b54ed5856c06ab8a2decade2768debc06d3ca6e0486"
  },
  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "c458b9de8dd82d2f39b071551ce3605fd602ece178e03bb81b756dabf69471e8"
  },
  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "0e62fd6dae520a9ef9d0ab252cba54d86d434c5de60eb4018f7577877a6b3ae5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "857457306f280f261deb1bea6663a8146ca3d0539311920a81252ad611b93a72"
  },
  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.9%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "b954552b6235421c910330e2c80a7bea34c93ea64ad15fdfcbced66b826203b2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "c78e808f09935dd0c633ed4b63c9fadbe6577b7992b2111a9c884bf042710a97"
  }
 }
--- a/pkgs/applications/networking/cluster/rke2/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_33/versions.nix
@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.33.9+rke2r1";
-  rke2Commit = "91477e5799063a35553b4d855e7a21bdd53c7009";
-  rke2TarballHash = "sha256-2QLG5FHmKQJWu/UjdwtXvXpoNu/to29ORDbo7SgjXSI=";
-  rke2VendorHash = "sha256-1hkGjui1RDE8UzK7h2SrhYwUX59lRsHLJ3g/OQZ9JTQ=";
-  k8sImageTag = "v1.33.9-rke2r1-build20260227";
-  etcdVersion = "v3.5.26-k3s1-build20260227";
+  rke2Version = "1.33.11+rke2r1";
+  rke2Commit = "9e559b0969f73df7242fd618386ffb475ae2d460";
+  rke2TarballHash = "sha256-+OnesNR5rnT/jwANvHGyM9ZLoBm/yvTyDD/idP7ncT0=";
+  rke2VendorHash = "sha256-9zXirLuvIR/su5irILDgOI6OqbatSeTrenBLgSZEAqY=";
+  k8sImageTag = "v1.33.11-rke2r1-build20260416";
+  etcdVersion = "v3.6.7-k3s1-build20260415";
  pauseVersion = "3.6";
-  ccmVersion = "v1.33.8-0.20260211145912-3552cfc26032-build20260211";
-  dockerizedVersion = "v1.33.9-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
+  ccmVersion = "v1.33.11-0.20260415182038-2566e39d309b-build20260416";
+  dockerizedVersion = "v1.33.11-rke2r1";
+  helmJobVersion = "v0.9.17-build20260422";
  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
--- a/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
@@ -1,138 +1,138 @@
 {
  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "3bb5170ba08641b4a285dde9fabb65348f186e1c507d84fa540fe6e966e8aad0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "a1dceccd822e24281f715a4a608539507968ffd97810484d3e370b96017f16ff"
  },
  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "279b3a0ce8d142c8c24a60e1af7a1be542355da75549cec27b3b1135da3da0bd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "a9de3a4aef52e0ead9a69156556f8432d9026a7fd1716770185863f14c7d7f07"
  },
  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "b144a24be9db33353d78c3c7147c0cbdc3ac66e80e914760d17851f5ecd69373"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "df74183ec867c9c607d8ab3286fa3bc19dd92088e1074a1f8a75be7a4a290e57"
  },
  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "2a2345c6daa2742119fc36118f6b08240465c65354efea0d67c1272fb0d905c7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "8c91f98adc2f4ee970d13e230525692b5622124627163e956e7a597e24fc5c80"
  },
  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "e500be563eca5c594af9b893abb8187a7f1d8a5dabff2f901d3b5f43c9e7ee31"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "51ba6ed5197c381f2303e8a09cf4a453026b910bf265b077c3fc7ab3428f6ced"
  },
  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "a7c22d3de484a2f9e9b6ca9d2a454d392160a1fada9a958917f2aa3bf3f38b81"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "924e92a89d33e1cd8ffbcf15787d4d5b02883a8b3714f3671d239670aef59ecc"
  },
  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "c6aa1b6be5e0795b9261ce53b98421272a03f3351844a70f2677fc36a24af96e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "2e2386f91dc12d6f50a69d04e90322d0075bc0881263b2566679e94a9da11873"
  },
  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "8b8af6dadeb165fed27993f0763c31f2fc55742e152c6432d712aa13841650b5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "be15ffd05156b50b27cdac28768005a27484c0b16946f9ef2531bb1d0a6185e2"
  },
  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "34c22f24882d990843880e297c3296406b76ed270423b6a512c7bba6a3d855cd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "e3773afb1951f0c21eb37e155fa7375bbf12c8fa884dca2cd5338dcc918d0151"
  },
  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "1ab41422cc16f5d030b8f62889133dff5d9dce985fbf13360c16049340ede6c1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "944c1785483bffb7f20559432fea2d1b7d3ce6a37ac344557c7a1c8293fa4e8c"
  },
  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "f5736ff7058e98562a6de4720207a7aa47e85633e6cd186c2d50b743934c44cc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "8426be3703efc7126d1a25b2fc2738d6b63ca202c32dc3b3d9c72d4b1e0f8757"
  },
  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "41dd1cefcaf487a8b3269c6a06ef114ee91d362855bb3c807d15795616bc346c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "7136a51e4c62479664010d19fb4acb05794cdbea9c0d7c9ab0f2cd1486ba96ae"
  },
  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "2622a22bb70fb4d5167bb116fde2206925d209429ff1ae62fd585f788aa2b885"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "11659fecf1ec1b98a2fabfdc4b9db4fac79513b383b0ae51c0bd4d359317548d"
  },
  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "0916003d2cb70501fffd58f278a8b24a1f2c991a9b5d9013b4ba7e8aef92e577"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "2fe0b9b21ad6db41b7d6d6d682353844efb9e44d520d69824b7e46c503a73a67"
  },
  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "e3f71f6ac15157c2f03ca9999580f112acdc11f440b1a2f084e08ab7dbafb0fd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "0bdcf82427f6fe49e211c28023ea0a4390f0abf4811f1c94b5b3442cdab9c2e0"
  },
  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "92b648b60561fec1252194c70949e5e9ea4bd3fa4157e05663f69493bae74138"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "44212de2ccbed50fccd9c9c5c2648a3883b3efcc1ee00fc4554defe61bb64ffa"
  },
  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "d0350e10ed7766927b4400eab8dda06029ebc72df4ef36f5708056110b74b2fc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "7ad8b7519b8b7faed7788eb362a0f667da81021466c6bd5a911be2095be47c87"
  },
  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "d843630e86003cf4b18a1ef070b44c3a73e1431770244e853eafcecdb714bfa3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "05d378074e3886f42858bd67dedcda0ad1f926faf69f2ce5bdc6e2a97a29a436"
  },
  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "8037cc34fc3de43395ef89025509c584ac98b9bf4a9e7cb7159b0f24540765bb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "618934aaa80d160f8b39466f260b7d47946eda18ed8c0f52e3a1545e087f01cf"
  },
  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "c94fecb19b6b1eaa347c49fc60def2e1251d866714e9ab05ea6ce29d5da41fb3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "26803301b9d26b82afeaa7aa94b66ec80825c3cb2b42f7468f60a3770926744f"
  },
  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "6f8bd02f7c9122238c667f97379ed59756c4dcd2c556ab222ba32970eb1889b9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "bd9f7cf98e625f62b10bbdfded475f3f05d04e80f07deb195f6778fb1b9c9df0"
  },
  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "236fb612c6cc5870fb075c0fe964544e3b1c66463c11f8fa84c9bcc6c5c1e93e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "532ee3aef895744d85899634cbd65023f6026b3b494c97ab9ac8b38188ce3bdf"
  },
  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "dd3649306bef4a412ca4125c7a71c00225dec711dbe218b2b402f1c7ded8b277"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "63c55631be709190646f5e70a17dd7ba54f5593420b83496e252e01543f02096"
  },
  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "66e2f545da94a72d29090d69cf9a225024095a4f1a644a5bacf1b2e1873665ee"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "cd12831ceb77a071fdbd9f0ec37fbcc60cb99d6dfd4f3901803b27ea318fa38d"
  },
  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "1e25054f03859407565f9598791212868bdffc007513e21a537a20ada1da8a22"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "00a39e85d561fac062c000bc8e663b10d44c9d14a425ee6cff343f2869bf2ed5"
  },
  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "035612c8628d1d18548082bfd72db0393949fbfd5f21a35d96e22dc7070a5d52"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "cfb4cea40d0ff547033bb75eb5ff3fb160633284bd433e0acee57e88c6b697cd"
  },
  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "1b6b6f55366e0e7014fb3241d7bb01b786eebf72a13ed1e7c7ea86850d31f28f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "753a1715fc153dfe940778bdc00fb86ff5b0de1c590261777e6e280d838aa02a"
  },
  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "d3eb6dab20944a417d0cbc6eed3a4838c008646a40c3e6b637729f7f9251ff8c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "d84f65ba2aae7706313d3009fc471335a1acb8ef091e1369ccd3054bf010f0c0"
  },
  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "3e0daa3ef4f04bf1739e76640fdec8956d81f07d2263b1a3d66555cc0944c17e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "dc97c8fc3016eae77ef15de114d7d26b850d5ad6d15555a1e827a7fb78c0573a"
  },
  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2fbbcb3af0673dfd2f046150fb0775468f6139dd41537bd8bff77f3bdfb5ffbe"
  },
  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "5313e18d388665b358dc8c4f11112d0798ae76b0d03c4bb101de44b334c11479"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "a067bc1b29dd65e7c96fee7e69659bb254abfccd77451d357f17c0c017849b1b"
  },
  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "c458b9de8dd82d2f39b071551ce3605fd602ece178e03bb81b756dabf69471e8"
  },
  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "4435f093077efbd3e635aab2adb30837d91e45cc28c062918ec0af275317334b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "5f1e96e34a1ba8d3e5aa703a259ac0726b994efab1a9f38a058ee6c7b056b41b"
  },
  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.5%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "861be8cbcc110ba986dc1443c83811c2c4ce92a534895f4cfc231d446ecf11d0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "3a7cb81f2635f5771c95e57029c0a6538b2b470857b92188a5180ecffc665624"
  }
 }
--- a/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.34.5+rke2r1";
-  rke2Commit = "105ddbd880270e1edcf8ea26a73e1f9be922ec83";
-  rke2TarballHash = "sha256-Wc0kZsPfxSi+HoNLo//CYDUROiOkdYreUkcnlYQc7uA=";
-  rke2VendorHash = "sha256-qYMOtIyRb3iZnEunssZOO/O8a9muhFZr62rLH9P7+WU=";
-  k8sImageTag = "v1.34.5-rke2r1-build20260227";
-  etcdVersion = "v3.6.7-k3s1-build20260227";
+  rke2Version = "1.34.7+rke2r1";
+  rke2Commit = "6fb975ad761d191a245a4c0215843e8c19423ac9";
+  rke2TarballHash = "sha256-2+EVvexT0oco6xI/nAfau4yz9wotynD4ejm6xC8JssQ=";
+  rke2VendorHash = "sha256-eX29l/K8UIWkSKIcJBn9Be2zPqxqoWlsmK0xs/bdxOo=";
+  k8sImageTag = "v1.34.7-rke2r1-build20260416";
+  etcdVersion = "v3.6.7-k3s1-build20260415";
  pauseVersion = "3.6";
-  ccmVersion = "v1.34.4-0.20260211145917-c6017918a65c-build20260211";
-  dockerizedVersion = "v1.34.5-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
+  ccmVersion = "v1.34.7-0.20260415182025-e7567db58dd7-build20260416";
+  dockerizedVersion = "v1.34.7-rke2r1";
+  helmJobVersion = "v0.9.17-build20260422";
  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
--- a/pkgs/applications/networking/cluster/rke2/1_35/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_35/images-versions.json
@@ -1,138 +1,138 @@
 {
  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "adc04088139474163dd7e2f0f80ec7cd9918c50c1f6e4a518d84b1e6f0a717b8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "1563bfb894ac077320a8ef535c3c3caa541b7ed19ca9181920702bfdd7e6e57d"
  },
  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "13b07010c7f9e002557786590b4e3a7e8ad043f6d90ec557eff59e2ffddda11b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "30a3c779a7b87884d6a2185345407842c42d4d5de16e1303f4a86cb07de316ac"
  },
  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "4e48981cdb0c47b0bc4d19ba7851203c9f862e175a0e791291c69ad5b7f10147"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "b4afde3c8932c286bbaa0835a50dc7854cc951a84dddfa1d376aaf49e97bc3d2"
  },
  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "1a7db48cd3667b5142eab1ebfd03c1e2c33dd4555aef9a928682c744ea8e568a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "3d7536615244d0f60d666c95fad1efa834b93e64b7b1117e2a0d33d7869136bd"
  },
  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "d5d7e0ec035ce8d8c206791a40e384376afad18f830412977c51a280ff2c8067"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "e031ac4cd1c2e5152b751370af1905404edd15e6bf662213dc22441c535c8985"
  },
  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "a7c22d3de484a2f9e9b6ca9d2a454d392160a1fada9a958917f2aa3bf3f38b81"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "d513d2d3887b6d6a9b91f24a177aaae736fe34af64d67b772b0e5c322c717437"
  },
  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "441b03258d68260f7ce0a6bda7acee9c2b2a4515182a5ecf55e33876586ea50a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "9ee8839e3060464ff0d3c8aabf9d992bcffc97df7e0ec04445b56d0a36fb341b"
  },
  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "50f4d1b1bb03523b922d7ce989d2d83f009d751d7fbf4aa8821fe52c9b9fd96d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "837a399259b8fd41e52d7e9f7f9d263c4678b76954fd280966b012a2516a00aa"
  },
  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "feaddac5752336c1a883d39848fc604ff2e0c92de3a027460f55303b2591c228"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "a86d13c29b8c7cc65d1bb4575352ea4106c7a893fa34071b00d8abf7c96fdb3f"
  },
  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "443a2c6052035d4953f27516d0dcab0f9a7f68ae93f0c48da74f9569096b87cc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "96757062b058c0a3617a4b20c3749ad9be738f884f70d2ace87f18b9a943d77e"
  },
  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "98dbee7b3e4a17e42dcf60d1d9bea593ad961893659504a7388ee4dbf1cab4a9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "af212d7b0925dedd7099b212a7d6ae3b315cf87cb744d0448bbc10a7b3754dfc"
  },
  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "827081118238089e882b2b14218fcb8bade4ea27fde7a460b626c111796cdc50"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "1b1faaa36f90cfe78e74008a68af69919fb661c34cc8a567e8a06bdb4a398f06"
  },
  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "e5447136a26f542f7bb0ef9045c1900472928952623e73737e1e6f1eb3900b8f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "4a01c3364f5891fbcb329e17e9f6662631d303be63b545373f483377f055257c"
  },
  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "8f802a9ca9822c0cae78b84e8a67c172294c9278ac76503b1f8b04c5701d9491"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "e8355a07f9fbb1e2d3442a07796d8a5e0f359ec0f1cbd10f372812970542fabb"
  },
  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "06f57e254ac74f4a7d7a1195592c0fee130470dd0fe23bd7f6fd54f25f3b749a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "3875876ee6d45d3bcb1fcbb97cf738c8afd64242d590f896100b1f71c531d8c0"
  },
  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "aeca03ab172bd667742262e942b1d799f5524a96757de3c0aab4b84f19b02ba0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "ddfc6020222b15fc0eed8a5e9f9aefdee8334a039a20d0000801f40c81dd22d1"
  },
  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "f50f5e118230b2b63f85a7a1c99f63a5331e1f7bccf0514b9800012e8a91339c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "7df86fe7e2481bb9c04ec775d48f832899bd456c19208271ec23fd05f4176d2d"
  },
  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "99e1aa2dcf3f39d736abaf8cddf229d9931ab4c80940881cd7c6b89ff357bd17"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "05d378074e3886f42858bd67dedcda0ad1f926faf69f2ce5bdc6e2a97a29a436"
  },
  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "0e3669bc9b0d5f265b361817949f00e5f8cb2fea647b22d69a6c3c8bbf7409ae"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "2db5385f6d06d08296eb936bec9cad3db3d37620cd48b2b6def2deca58b11e78"
  },
  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "fd01dba6b0b12d99e575f6c6f428be59d93d7bf89eba6721dab5f9727483facb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "26803301b9d26b82afeaa7aa94b66ec80825c3cb2b42f7468f60a3770926744f"
  },
  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "9d43e3d5cbebd9b060c645b101cc11025184309a33c448f91036f9b4c63fe7a1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "5c3f8ea51103b12549d64bb790ec511aebd7ce53bd34fcbdc8564e641ae029ed"
  },
  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "06b37736600989520644d34d2d5a4b797e40f298a9775c2a923e33a159d2c600"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "61804cf3ed8347bbea0dd47f7805bbbc550b3eb39844782beae442f8b7ef44dc"
  },
  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "cd1b237ef3fcdbc193aa324c42385c21e5fd6493824b79e69e360036383589af"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "b9aec99429066e3cea35ddd6aaa16b1eb84435a2feb156f8a0a5af541f87bb07"
  },
  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "7321e46d1822e3d3f5c9e751563e8cbd34eaeab77cbd85c7c93e42658ce82f17"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "d359809efb1030af287b2077e534e1ae0e2c1b777280ef65b614939026f9ae0f"
  },
  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "45468bf2b855ea9ac2d4b560b9a974796bbcb9a9681c758e78db41cea0f94229"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "725862931f0675fa8699ce8a1167914d222d1d2fc3e689a20e662b9319a48683"
  },
  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "988106315218556fd3ea366a6c27dde2a72c231e14d295c0f0f4cb26eddb88fa"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "c2015d80e510d2a9a3d8f0eebadaa65c8c4a4eed7f63948011ab8d0a3549a97f"
  },
  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "1c85da0b7a7946c88d5f4d489b7a76517909f68d436a0558fe89d01a94c0f9ef"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "69b950a05bc980405a0f7a7ae96233924b33685d812def46cfae11fb30891010"
  },
  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "27b8fbe74bcc4d7956b7a341e107b279372a295ae6a37855b20340defd8a6768"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "f5f6ffdfd37164d12624390c9292ee7436c4c6dfa5c8cc889852f356e6964167"
  },
  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "dd6d4f1272bcda3e23d8730359848b346b8baed70b5b18eab64fd0dee555b4fc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "6c98ce847abbd827e9c48ecba380084348dd6abca838de34d748c502bf3a7978"
  },
  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2fbbcb3af0673dfd2f046150fb0775468f6139dd41537bd8bff77f3bdfb5ffbe"
  },
  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "be4d81082cd9334ae1e196165f3a0a18f7d836560eb410b027f3d5ce1d5afb8e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "ff9491f09bb3c8e0444209c1070542d2381bc1ff450cda26ff9c000bb929a614"
  },
  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "c458b9de8dd82d2f39b071551ce3605fd602ece178e03bb81b756dabf69471e8"
  },
  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "4dc6c827aee2411205c2dd9310f761b1f34fd481bae2d2dade3beb9b2e44dea4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "311aa5805c5a6e947e65f1d48dac789428ee056679d142d8b96e791e78868b6b"
  },
  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "945d0d7cce48975f14e4b5c1230d6ce70cdc4a968df63f8e2d1f6921387b7513"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.4%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "4000891ee00df8441d49b8d1864208dfd4d1287efcfed59fbb6c44626144ceaa"
  }
 }
--- a/pkgs/applications/networking/cluster/rke2/1_35/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_35/versions.nix
@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.35.2+rke2r1";
-  rke2Commit = "b1cd9d8e735bcd84cad7407109423a8dd7b648d8";
-  rke2TarballHash = "sha256-s5lZK7S+WReRF+Io9+X4bSd6mAvBq9qUXbYEOH++cFA=";
-  rke2VendorHash = "sha256-3i//hVONK/QxIsiOth92fN0Rxw6Ex4cgBQe7NG//URc=";
-  k8sImageTag = "v1.35.2-rke2r1-build20260227";
-  etcdVersion = "v3.6.7-k3s1-build20260227";
+  rke2Version = "1.35.4+rke2r1";
+  rke2Commit = "5dc4f4390d27d77b17b6506d8b22aed72aa4fbe6";
+  rke2TarballHash = "sha256-VWhml35keKn9Fhj/SeySpusi8yzz9dwgPC2rfABXPrk=";
+  rke2VendorHash = "sha256-uaPjOFSwCxMWH/LD8tvE0VttPWJ9agMYm4E2mWiuYfw=";
+  k8sImageTag = "v1.35.4-rke2r1-build20260416";
+  etcdVersion = "v3.6.7-k3s1-build20260415";
  pauseVersion = "3.6";
-  ccmVersion = "v1.35.1-0.20260211145923-50fa2d70c239-build20260211";
-  dockerizedVersion = "v1.35.2-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
+  ccmVersion = "v1.35.4-0.20260415195656-e51c0636351d-build20260415";
+  dockerizedVersion = "v1.35.4-rke2r1";
+  helmJobVersion = "v0.9.17-build20260422";
  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1238,13 +1238,13 @@
    "vendorHash": "sha256-/4v25xY/fmfSAEALRbXu/a+x3nC1Ly/IJPOEKmYjgmw="
  },
  "splunk-terraform_signalfx": {
-    "hash": "sha256-m+qD71tTqQycD+9xju5T83IaYCgJhkfh+byn6yrdfO4=",
+    "hash": "sha256-pzro0Uyu12u1pKy22GrZAktoTKngjn4h5mZpABqARk0=",
    "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
    "owner": "splunk-terraform",
    "repo": "terraform-provider-signalfx",
-    "rev": "v9.27.1",
+    "rev": "v9.28.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-u3WK/pLsuwySJX6GMNho8ImB+F+XXUPC6h+IQtDrOp8="
+    "vendorHash": "sha256-L+J3vsxxmF3TjQaDL5Uo9IentkDJfGpjfzBYTQzzGvY="
  },
  "spotinst_spotinst": {
    "hash": "sha256-0Wc+QgEeizydsvtyBdnxgLhpYuBZLMB3JGjmTDXzJY0=",
@@ -1274,11 +1274,11 @@
    "vendorHash": "sha256-R/+PS4cUtr8/twUXOPRiVweb5I9NNiD6mGOcAFr9IDs="
  },
  "sysdiglabs_sysdig": {
-    "hash": "sha256-g1al4OJTbnnOIT6ZsjMhEzB+dXvMrBUzctw+Jh2uFYI=",
+    "hash": "sha256-yjuh6JVIt+FYVe9yILORklwt/KiBFcjmZnEHf5oeQQw=",
    "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
    "owner": "sysdiglabs",
    "repo": "terraform-provider-sysdig",
-    "rev": "v3.7.2",
+    "rev": "v3.8.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
  },
--- a/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix
+++ b/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
      based on the NetX project.
    '';
    homepage = "https://github.com/adoptopenjdk/icedtea-web";
+    license = lib.licenses.WITH lib.licenses.gpl2Only lib.licenses.classpathException20;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -27,6 +27,9 @@ buildGoModule (finalAttrs: {
    "-X=github.com/bloodhoundad/azurehound/v2/constants.Version=${finalAttrs.version}"
  ];

+  # flaky: races a 5ms sleep against a 5ms batch timeout
+  checkFlags = [ "-skip=^TestBatch$" ];
+
  doInstallCheck = true;

  meta = {
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
  pname = "balena-cli";
-  version = "24.1.4";
+  version = "25.1.3";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-NFZoJVhixD67dqLq0tVB2GtMHl0n6qngw1uj/Qqxz8w=";
+    hash = "sha256-zDjSzjR5y4fQPMRVuddf3zTddFoaR4p1D6v/+BHQzZo=";
  };

-  npmDepsHash = "sha256-yGPn9sJ5dsNIvrofqL1/F9E3T/vhI04RmZEQwjsHQa0=";
+  npmDepsHash = "sha256-VE4HY8gRlB6r+qS/56Tj0UackFxO35/MFSY2l4EH0kY=";

  makeCacheWritable = true;

--- a/pkgs/by-name/bl/blink1-tool/package.nix
+++ b/pkgs/by-name/bl/blink1-tool/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [ libusb1 ];

  makeFlags = [
+    "GIT_TAG_RAW=v${finalAttrs.version}"
    "GIT_TAG=v${finalAttrs.version}"
    "USBLIB_TYPE=HIDAPI"
    "HIDAPI_TYPE=LIBUSB"
--- a/pkgs/by-name/ca/cargo-deb/package.nix
+++ b/pkgs/by-name/ca/cargo-deb/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-deb";
-  version = "3.6.4";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "kornelski";
    repo = "cargo-deb";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-De4ouk+tub/sDSoIuEaoWYd9qjpLDA05xvuuQlaHF6M=";
+    hash = "sha256-x/SUGHMW+MUpK+pFp3MfWc+2hgn5HDE0s12kp9Up1fY=";
  };

-  cargoHash = "sha256-jac3VFOCeYKuedFHt4lEfBHlErHdfczRF6Mrs8Se88o=";
+  cargoHash = "sha256-Wd6Uj6fi4OtZJGz6QIzBNIdB5HnJzJWFMV53ucvr6Fw=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/de/deployer/composer.lock
+++ b/pkgs/by-name/de/deployer/composer.lock
--- a/pkgs/by-name/de/deployer/package.nix
+++ b/pkgs/by-name/de/deployer/package.nix
@@ -6,16 +6,18 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "deployer";
-  version = "7.5.12";
+  version = "8.0.3";

  src = fetchFromGitHub {
    owner = "deployphp";
    repo = "deployer";
-    rev = "7b108897baa94b8ac438c821ec1fb815d95eba77";
-    hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-mbqwAYfEiJB1ELkxQwuMVmgXZZLi9jLjg33o0ZfgT4Y=";
  };

-  vendorHash = "sha256-sgWPZw5HiXd7c45I0f5qnw4l2HwgLaTJwzmXw8140kk=";
+  composerLock = ./composer.lock;
+
+  vendorHash = "sha256-X30D05d0PCmw2tHN7PC9PiAXVlnI6SkQg2l7G+tZ4Mo=";

  meta = {
    changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "fabric-ai";
-  version = "1.4.451";
+  version = "1.4.452";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5eKARPLPD24MQLMlSIa76R7YoR1axCmn5vL9V7Zly5o=";
+    hash = "sha256-2O/g0DC0ptxzEzXA1NYZWfdnUeIVFuLWNyw1uct2XyM=";
  };

  vendorHash = "sha256-oSHrn2Oad6XuIFjrqeC4NGC/rasCu+49xADY15YNSbc=";
--- a/pkgs/by-name/fr/freerdp/package.nix
+++ b/pkgs/by-name/fr/freerdp/package.nix
@@ -70,13 +70,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "freerdp";
-  version = "3.24.2";
+  version = "3.26.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
-    rev = finalAttrs.version;
-    hash = "sha256-gIe5MoPaKCTHlNGBt+Gc4QZFQ24avas9EBARtiRfLQE=";
+    tag = finalAttrs.version;
+    hash = "sha256-7yUqZXuUn3OFhlWrZyXmmh/aGOp0uRJ7XxaLl1fVnVQ=";
  };

  postPatch = ''
@@ -227,6 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
      FreeRDP is a client-side implementation of the Remote Desktop Protocol (RDP)
      following the Microsoft Open Specifications.
    '';
+    changelog = "https://github.com/FreeRDP/FreeRDP/releases/tag/${finalAttrs.src.tag}";
    homepage = "https://www.freerdp.com/";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ deimelias ];
--- a/pkgs/by-name/ge/gerrit/package.nix
+++ b/pkgs/by-name/ge/gerrit/package.nix
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "gerrit";
-  version = "3.13.5";
+  version = "3.13.6";

  src = fetchurl {
    url = "https://gerrit-releases.storage.googleapis.com/gerrit-${finalAttrs.version}.war";
-    hash = "sha256-Imhi9mZsLmjbwpUipQEdQLBbyBvMJw2THXkfxaikNkA=";
+    hash = "sha256-nGKl5KNundR+FkiQ5CO/qBezOSNAHDHcPsssm1lZAhk=";
  };

  buildCommand = ''
--- a/pkgs/by-name/ge/gexiv2_0_16/package.nix
+++ b/pkgs/by-name/ge/gexiv2_0_16/package.nix
@@ -0,0 +1,90 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  meson,
+  mesonEmulatorHook,
+  ninja,
+  pkg-config,
+  exiv2,
+  glib,
+  gobject-introspection,
+  vala,
+  gi-docgen,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gexiv2";
+  __structuredAttrs = true;
+  strictDeps = true;
+  version = "0.16.0";
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/gexiv2/${lib.versions.majorMinor finalAttrs.version}/gexiv2-${finalAttrs.version}.tar.xz";
+    sha256 = "2W+JXyRTn5ZvV3srskia6E+CMpcKjQwGTkoAdHSne7s=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    vala
+    gi-docgen
+    (python3.pythonOnBuildForHost.withPackages (ps: [ ps.pygobject3 ]))
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
+  ];
+
+  buildInputs = [
+    glib
+    gi-docgen
+  ];
+
+  propagatedBuildInputs = [
+    exiv2
+  ];
+
+  mesonFlags = [
+    "-Dgtk_doc=true"
+    "-Dtests=true"
+  ];
+
+  doCheck = true;
+
+  preCheck =
+    let
+      libName = if stdenv.hostPlatform.isDarwin then "libgexiv2-0.16.4.dylib" else "libgexiv2-0.16.so.4";
+    in
+    ''
+      # Our gobject-introspection patches make the shared library paths absolute
+      # in the GIR files. When running unit tests, the library is not yet installed,
+      # though, so we need to replace the absolute path with a local one during build.
+      # We are using a symlink that will be overridden during installation.
+      mkdir -p $out/lib
+      ln -s $PWD/gexiv2/${libName} $out/lib/${libName}
+      export GI_TYPELIB_PATH=$PWD/gexiv2
+    '';
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  meta = {
+    homepage = "https://gitlab.gnome.org/GNOME/gexiv2";
+    description = "GObject wrapper around the Exiv2 photo metadata library";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    teams = [ lib.teams.gnome ];
+    maintainers = [ lib.maintainers._7591yj ];
+  };
+})
--- a/pkgs/by-name/gp/gputils/package.nix
+++ b/pkgs/by-name/gp/gputils/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchDebianPatch,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -13,6 +14,16 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-j7iCCzHXwffHdhQcyzxPBvQK+RXaY3QSjXUtHu463fI=";
  };

+  patches = [
+    (fetchDebianPatch {
+      pname = "gputils";
+      version = "1.5.2";
+      debianRevision = "2";
+      patch = "01-use-stdbool.diff";
+      hash = "sha256-YuQqWWKC5cntaok1J7hZUv6NX/Xv1mI6+K3if3Owkzc=";
+    })
+  ];
+
  meta = {
    homepage = "https://gputils.sourceforge.io";
    description = "Collection of tools for the Microchip (TM) PIC microcontrollers. It includes gpasm, gplink, and gplib";
--- a/pkgs/by-name/gu/gummi/package.nix
+++ b/pkgs/by-name/gu/gummi/package.nix
@@ -1,7 +1,8 @@
 {
  lib,
  stdenv,
-  pkgs,
+  fetchFromGitHub,
+  fetchDebianPatch,
  glib,
  gtk3,
  gtksourceview3,
@@ -18,13 +19,23 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.8.3";
  pname = "gummi";

-  src = pkgs.fetchFromGitHub {
+  src = fetchFromGitHub {
    owner = "alexandervdm";
    repo = "gummi";
    rev = finalAttrs.version;
    sha256 = "sha256-71n71KjLmICp4gznd27NlbyA3kayje3hYk/cwkOXEO0=";
  };

+  patches = [
+    (fetchDebianPatch {
+      pname = "gummi";
+      version = "0.8.3+really0.8.3";
+      debianRevision = "6";
+      patch = "0002-build-with-gcc-15.patch";
+      hash = "sha256-YNOVgZHJIVy7y60FOZRI8N8qxoOkUsResLo0PNZ0dkY=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
    intltool
--- a/pkgs/by-name/jw/jwx/package.nix
+++ b/pkgs/by-name/jw/jwx/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "jwx";
-  version = "4.0.1";
+  version = "4.0.2";

  src = fetchFromGitHub {
    owner = "lestrrat-go";
    repo = "jwx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tVvesVrsbFONhmpFo59c/kC3vxAjWpQwnbaUmrx8O5E=";
+    hash = "sha256-CGBQF//smVUt1/SQkxvZJ+7zlAhAuxVtO3WWWHCSvII=";
  };

-  vendorHash = "sha256-jCAHyCfTEcbtGEkxPLJvXJ90mVDyijWOoHJ5dbJouCs=";
+  vendorHash = "sha256-g+kawcxLJdR77kkR6pJoRKe48kV+/kS33gYjOY30pAc=";

  sourceRoot = "${finalAttrs.src.name}/cmd/jwx";

--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libphonenumber";
-  version = "9.0.29";
+  version = "9.0.30";

  src = fetchFromGitHub {
    owner = "google";
    repo = "libphonenumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VhVPLDD7KHRxD7adOyYGxVxfI3n77QCk5pLPtN8YfPQ=";
+    hash = "sha256-+VGANm6L2TZkOW97PDYCH+rELyppyJ/GIiabnZXWNTc=";
  };

  patches = [
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-04-26";
+  version = "0-unstable-2026-05-05";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "cc71b5eff24a962bd055a92d2032f806635fdf97";
-    hash = "sha256-PeG6H5XArKdptbSicMgXPFtnrkglmkwZieGKSr0aPaQ=";
+    rev = "2ba50bfaeae630741216a9b60b5147485657316f";
+    hash = "sha256-3hJ/rpTDI8oqd4t/dTAHztmWkXW769cAqbmt5jVdIHE=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "lint-staged";
-  version = "16.4.0";
+  version = "17.0.2";

  src = fetchFromGitHub {
    owner = "okonet";
    repo = "lint-staged";
    rev = "v${version}";
-    hash = "sha256-JwULZ5rwlQfoFIhzhd/etVajTD1A4NJvqRADfzv1PZo=";
+    hash = "sha256-6WlTa1QFQU3lzAv3y9GgJi4FtfFvpnSvDgzyy38TbeQ=";
  };

-  npmDepsHash = "sha256-140Sjkwb+NpNj+MEnUb2zQFyjP6Uel25ZZXnNMEU5NY=";
+  npmDepsHash = "sha256-Ew4nR9G/YqIY5LpEajGyE+wmn+8gHiNPFV4woVkffr8=";

  dontNpmBuild = true;

--- a/pkgs/by-name/li/linyaps/package.nix
+++ b/pkgs/by-name/li/linyaps/package.nix
@@ -39,13 +39,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "linyaps";
-  version = "1.12.2";
+  version = "1.12.3";

  src = fetchFromGitHub {
    owner = "OpenAtom-Linyaps";
    repo = finalAttrs.pname;
    tag = finalAttrs.version;
-    hash = "sha256-Pm0ijMAwDiQpotxuAgrCXiA3Z0FCejsqYIJ89/GKR9o=";
+    hash = "sha256-AbiUHoNRaz2yL6pV5D1R0kmDGcV8+nmEa+EDDK6soe0=";
  };

  patches = [
--- a/pkgs/by-name/ma/magic-wormhole-rs/package.nix
+++ b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "magic-wormhole-rs";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "magic-wormhole";
    repo = "magic-wormhole.rs";
    rev = finalAttrs.version;
-    sha256 = "sha256-j+SweUDOp38QMz2yPEOV9ZEXE8R2zL2hq7OkGX32zpc=";
+    sha256 = "sha256-23NXmXkuFGMocicw2UxsXroCZ4N0PYkrOropuQYe0d8=";
  };

-  cargoHash = "sha256-6ydO9vrlOwTrnn624GQ59nWoClnGaO0UxHhW+01APGw=";
+  cargoHash = "sha256-LqsYyyJyMxJ97c4JOsjyL28idKLyV6GOQMccuyDRlYs=";

  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];

--- a/pkgs/by-name/ma/maven/build-maven-package.nix
+++ b/pkgs/by-name/ma/maven/build-maven-package.nix
@@ -155,10 +155,14 @@ let
    );
 in
 fnOrAttrs:
-if !lib.isFunction fnOrAttrs then
-  buildMavenPackage fnOrAttrs
-else
-  let
-    finalAttrs = fnOrAttrs finalAttrs;
-  in
-  buildMavenPackage finalAttrs
+let
+  finalPackage =
+    if !lib.isFunction fnOrAttrs then
+      buildMavenPackage fnOrAttrs
+    else
+      let
+        finalAttrs = fnOrAttrs (finalAttrs // { inherit finalPackage; });
+      in
+      buildMavenPackage finalAttrs;
+in
+finalPackage
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -197,13 +197,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mpd";
-  version = "0.24.9";
+  version = "0.24.10";

  src = fetchFromGitHub {
    owner = "MusicPlayerDaemon";
    repo = "MPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WBIPGdn8Hg/YH236epiNuenp8XwHoBcmgJa+CApIjBE=";
+    sha256 = "sha256-qwBX5NG1h55HoNtHMyLfjDQhua1xCyONqd386+QB6IU=";
  };

  buildInputs = [
--- a/pkgs/by-name/ne/newflasher/package.nix
+++ b/pkgs/by-name/ne/newflasher/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "newflasher";
-  version = "59";
+  version = "60";

  src = fetchFromGitHub {
    owner = "munjeni";
    repo = "newflasher";
    tag = "${finalAttrs.version}";
-    hash = "sha256-ulcHbSoMXnu0pauYUaZiTVvl5VtEYnYy3ljtZ0oEvGM=";
+    hash = "sha256-YmFY0WPT92f5zN10TEfuRv2mzhEweqeZEpzWCK4otYg=";
  };

  buildInputs = [
--- a/pkgs/by-name/ni/nixfmt-rs/package.nix
+++ b/pkgs/by-name/ni/nixfmt-rs/package.nix
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nixfmt-rs";
-  version = "0.3.0";
+  version = "0.4.1";

  __structuredAttrs = true;
  strictDeps = true;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Mic92";
    repo = "nixfmt-rs";
    tag = finalAttrs.version;
-    hash = "sha256-H4APJn0NGaD2LrkjcJ7io+fu3aKoO0Cn2BJk731YlqQ=";
+    hash = "sha256-MsSefbTC6u9GAEB9PhDSz9GvWTCASgTxysIHRrqGINc=";
  };

-  cargoHash = "sha256-gJq6PxA6WaWObHnIL7jsKQBOSHQj31kzlrM95OY27ro=";
+  cargoHash = "sha256-QSckmh8hBpQjpg0/4rwlpJZ2uxEZ1sPQvZfjmi4NFEc=";

  nativeBuildInputs = [
    installShellFiles
@@ -44,7 +44,6 @@ rustPlatform.buildRustPackage (finalAttrs: {

  nativeCheckInputs = [
    gitMinimal
-    nixfmt
  ];

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/od/odoo17/package.nix
+++ b/pkgs/by-name/od/odoo17/package.nix
@@ -55,6 +55,13 @@ python.pkgs.buildPythonApplication rec {
    }"
  ];

+  postPatch = ''
+    # hardcode the location of the unwrapped python scrip, otherwise the websocket
+    # server (called longpoll in codebase) will fail to start.
+    substituteInPlace odoo/service/server.py \
+      --replace-fail 'sys.argv[0]' "'${placeholder "out"}/bin/.odoo-wrapped'"
+  '';
+
  build-system = with python.pkgs; [
    setuptools
  ];
@@ -111,7 +118,7 @@ python.pkgs.buildPythonApplication rec {
  passthru = {
    updateScript = ./update.sh;
    tests = {
-      inherit (nixosTests) odoo17;
+      inherit (nixosTests) odoo17 odoo17-multiprocess;
    };
  };

--- a/pkgs/by-name/od/odoo18/package.nix
+++ b/pkgs/by-name/od/odoo18/package.nix
@@ -9,7 +9,7 @@

 let
  odoo_version = "18.0";
-  odoo_release = "20250506";
+  odoo_release = "20260420";
  python = python312.override {
    self = python;
  };
@@ -21,11 +21,18 @@ python.pkgs.buildPythonApplication rec {

  src = fetchzip {
    # find latest version on https://nightly.odoo.com/${odoo_version}/nightly/src
-    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
    name = "odoo-${version}";
-    hash = "sha256-rNG0He+51DnRT5g1SovGZ9uiE1HWXtcmAybcadBMjY4="; # odoo
+    hash = "sha256-+ilM07s33pdwZc3XoAXbID7MRz/m6PHnzjHzi183eyM="; # odoo
  };

+  postPatch = ''
+    # hardcode the location of the unwrapped python scrip, otherwise the websocket
+    # server (called longpoll in codebase) will fail to start.
+    substituteInPlace odoo/service/server.py \
+      --replace-fail 'sys.argv[0]' "'${placeholder "out"}/bin/.odoo-wrapped'"
+  '';
+
  makeWrapperArgs = [
    "--prefix PATH : ${
      lib.makeBinPath [
@@ -97,7 +104,7 @@ python.pkgs.buildPythonApplication rec {
  passthru = {
    updateScript = ./update.sh;
    tests = {
-      inherit (nixosTests) odoo18;
+      inherit (nixosTests) odoo18 odoo18-multiprocess;
    };
  };

--- a/pkgs/by-name/od/odoo18/update.sh
+++ b/pkgs/by-name/od/odoo18/update.sh
@@ -27,6 +27,6 @@ fi

 cd "$SCRIPT_DIR"

-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.tar.gz")\"; # odoo|g" package.nix
 sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
 sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
--- a/pkgs/by-name/od/odoo19/package.nix
+++ b/pkgs/by-name/od/odoo19/package.nix
@@ -26,6 +26,13 @@ python.pkgs.buildPythonApplication rec {
    hash = "sha256-JsbJ39zPZm4eyRTXkvdCMHwYaA08yUxZXcLglRn3kWs="; # odoo
  };

+  postPatch = ''
+    # hardcode the location of the unwrapped python scrip, otherwise the websocket
+    # server (called longpoll in codebase) will fail to start.
+    substituteInPlace odoo/service/server.py \
+      --replace-fail 'sys.argv[0]' "'${placeholder "out"}/bin/.odoo-wrapped'"
+  '';
+
  makeWrapperArgs = [
    "--prefix PATH : ${
      lib.makeBinPath [
@@ -92,7 +99,7 @@ python.pkgs.buildPythonApplication rec {
  passthru = {
    updateScript = ./update.sh;
    tests = {
-      inherit (nixosTests) odoo19;
+      inherit (nixosTests) odoo19 odoo19-multiprocess;
    };
  };

--- a/pkgs/by-name/on/onlykey/package.nix
+++ b/pkgs/by-name/on/onlykey/package.nix
@@ -46,11 +46,43 @@ buildNpmPackage (finalAttrs: {
  # should not break other things.
  npmFlags = [ "--ignore-scripts" ];

+  postPatch = ''
+    # NW.js 0.102 in Chrome-packaged-app mode never advances
+    # document.readyState past "loading", so DOMContentLoaded and load
+    # events never fire and the wizard UI never initializes (the window
+    # only shows the page background and the "Last message received"
+    # footer text). Dispatch the events manually after the bottom-of-body
+    # scripts have registered their listeners.
+    substituteInPlace app/app.html \
+      --replace-fail \
+        '<script src="/scripts/dialog-links.js"></script>' \
+        '<script src="/scripts/dialog-links.js"></script>
+    <script>setTimeout(() => { document.dispatchEvent(new Event("DOMContentLoaded")); window.dispatchEvent(new Event("load")); }, 0);</script>'
+
+    # The app should not create autostart entries on first launch.
+    substituteInPlace app/app.js \
+      --replace-fail \
+        "} else if (!localStorage.hasOwnProperty('autoLaunch')) {" \
+        "} else if (false && !localStorage.hasOwnProperty('autoLaunch')) {"
+  '';
+
+  postBuild = ''
+    substituteInPlace build/package.json \
+      --replace-fail '"name": "OnlyKey-dev"' '"name": "OnlyKey"' \
+      --replace-fail '"toolbar": true' '"toolbar": false'
+  '';
+
  installPhase = ''
    runHook preInstall

+    rm -rf node_modules
+    npm ci --omit=dev --omit=optional --ignore-scripts
+    rm -rf node_modules/nw
+    rm -f node_modules/.bin/nw
+
    mkdir -p "$out/share"
    cp -r build "$out/share/onlykey"
+    cp -r node_modules "$out/share/onlykey/node_modules"

    ln -s "${finalAttrs.desktopItem}/share/applications" "$out/share/applications"

--- a/pkgs/by-name/op/openimageio/package.nix
+++ b/pkgs/by-name/op/openimageio/package.nix
@@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openimageio";
-  version = "3.1.12.0";
+  version = "3.1.13.1";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "OpenImageIO";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+5X2gR2WE6rO1OkhlTe0ptfCEKRxJVjw8v73lMTzURc=";
+    hash = "sha256-GlQ4e0YGHqQxlwcyC8SVf4y0mKZiEyaT4jtxw0Pva4U=";
  };

  outputs = [
--- a/pkgs/by-name/pk/pkg/package.nix
+++ b/pkgs/by-name/pk/pkg/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pkg";
-  version = "2.5.0";
+  version = "2.7.5";

  src = fetchFromGitHub {
    owner = "freebsd";
    repo = "pkg";
    rev = finalAttrs.version;
-    hash = "sha256-bx/BPldUZHX7KYM8bYRT/p/RcLKqAXqlnCihP8Ec7NY=";
+    hash = "sha256-t1Mvnw6dRbKgUjxSnm4OSbq8HN6e/0q2MqUlgNB+amw=";
  };

  setOutputFlags = false;
--- a/pkgs/by-name/pr/prometheus-siebenmann-zfs-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-siebenmann-zfs-exporter/package.nix
@@ -0,0 +1,28 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+}:
+
+buildGoModule {
+  __structuredAttrs = true;
+  pname = "prometheus-siebenmann-zfs-exporter";
+  version = "unstable-2022-08-17";
+
+  src = fetchFromGitHub {
+    owner = "siebenmann";
+    repo = "zfs_exporter";
+    rev = "c5f18cb0d470c24dbd2c12553a87d0aca3ddc50b";
+    hash = "sha256-FBFjzsoRiU48616CsxkP2lVSGO3qgLYBjOrtROzhgSY=";
+  };
+
+  vendorHash = "sha256-YjEK/nKqoMch0UygoCkk8mAclRFhsjodFVHhN49zeW4=";
+
+  meta = {
+    description = "ZFS Exporter for the Prometheus monitoring system (Siebenmann/cks-upstream variant)";
+    mainProgram = "zfs_exporter";
+    homepage = "https://github.com/siebenmann/zfs_exporter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ podocarp ];
+  };
+}
--- a/pkgs/by-name/py/py-spy/package.nix
+++ b/pkgs/by-name/py/py-spy/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-velwX7lcNQvwg3VAUTbgsOPLlA5fAcPiPvczrBBsMvs=";

-  buildFeatures = [ "unwind" ];
+  buildFeatures = lib.optional stdenv.hostPlatform.isLinux "unwind";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    python3
  ];

-  env.NIX_CFLAGS_COMPILE = "-L${libunwind}/lib";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux "-L${libunwind}/lib";

  checkFlags = [
    # assertion `left == right` failed
@@ -44,8 +44,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    changelog = "https://github.com/benfred/py-spy/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ lnl7 ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    # https://github.com/benfred/py-spy/pull/330
-    broken = stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux;
  };
 })
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "pyprland";
-  version = "3.3.1";
+  version = "3.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hyprland-community";
    repo = "pyprland";
    tag = finalAttrs.version;
-    hash = "sha256-a4DT/lb9ZQo/4Rqb7tteuJ6ngdM7lav8BABvdhevri8=";
+    hash = "sha256-e2BTHGmZrxRXC+Eu2TpNcEJB1txZDOi0gs/CsjZu9eY=";
  };

  build-system = [ python3Packages.hatchling ];
--- a/pkgs/by-name/rt/rt/package.nix
+++ b/pkgs/by-name/rt/rt/package.nix
@@ -4,6 +4,7 @@
  autoreconfHook,
  buildEnv,
  fetchFromGitHub,
+  fetchpatch,
  perl,
  perlPackages,
  makeWrapper,
@@ -25,6 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    ./dont-check-users_groups.patch # needed for "make testdeps" to work in the build
    ./override-generated.patch
+    # Fix "Wide character in subroutine entry" crash on every request
+    # merged upstream
+    (fetchpatch {
+      url = "https://github.com/bestpractical/rt/commit/f8f03dd6e69dfbf4eb71e3ded0f793af4721a06d.patch";
+      hash = "sha256-Mk8ve8n5tgyyHT7RAt2o+QnUlcYNOu95lNjku6VgXS0=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/sw/switchfin/package.nix
+++ b/pkgs/by-name/sw/switchfin/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "switchfin";
-  version = "0.8.3";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "dragonflylee";
    repo = "switchfin";
    rev = finalAttrs.version;
-    hash = "sha256-EXYsx8y9tMOkuARe/ffon1IXicmwvZxByuze0wKeMh0=";
+    hash = "sha256-W1qdU9x9GTdLkGNaGE9BopQAO6QIanzPbOvD2wEhfUw=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/tf/tfenv/package.nix
+++ b/pkgs/by-name/tf/tfenv/package.nix
@@ -16,13 +16,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  __structuredAttrs = true;

  pname = "tfenv";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "tfutils";
    repo = "tfenv";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-bwY5QEXugogNrStT859lNOkPoQ+n3BQZGexErxl5nco=";
+    hash = "sha256-okFPGBZgKgkwxdou9RiERHphzBr5vQQsidoNzEWT7IM=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/th/thunderbird-cli-bridge/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli-bridge/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "thunderbird-cli-bridge";
+  version = "1.0.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vitalio-sh";
+    repo = "thunderbird-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+  };
+
+  forceEmptyCache = true;
+  dontNpmBuild = true;
+
+  npmWorkspace = "bridge";
+  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+
+  # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
+  postInstall = ''
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-mcp
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-mcp
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.";
+    homepage = "https://github.com/vitalio-sh/thunderbird-cli";
+    changelog = "https://github.com/vitalio-sh/thunderbird-cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "tb-bridge";
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/th/thunderbird-cli-mcp/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli-mcp/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "thunderbird-cli-mcp";
+  version = "1.0.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vitalio-sh";
+    repo = "thunderbird-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+  };
+
+  forceEmptyCache = true;
+  dontNpmBuild = true;
+
+  npmWorkspace = "mcp";
+  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+
+  # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
+  postInstall = ''
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-mcp
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-mcp
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "MCP server that gives full access to your email through Mozilla Thunderbird";
+    homepage = "https://github.com/vitalio-sh/thunderbird-cli";
+    changelog = "https://github.com/vitalio-sh/thunderbird-cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "tb-mcp";
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/th/thunderbird-cli/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "thunderbird-cli";
+  version = "1.0.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vitalio-sh";
+    repo = "thunderbird-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+  };
+
+  forceEmptyCache = true;
+  dontNpmBuild = true;
+
+  npmWorkspace = "cli";
+  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+
+  # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
+  postInstall = ''
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-bridge
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/.bin/tb-mcp
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli
+    rm -rf $out/lib/node_modules/thunderbird-cli/node_modules/thunderbird-cli-mcp
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Low-level CLI to manage Mozilla Thunderbird email from the shell";
+    homepage = "https://github.com/vitalio-sh/thunderbird-cli";
+    changelog = "https://github.com/vitalio-sh/thunderbird-cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "tb";
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wastebin";
-  version = "3.6.1";
+  version = "3.6.2";

  src = fetchFromGitHub {
    owner = "matze";
    repo = "wastebin";
    rev = finalAttrs.version;
-    hash = "sha256-yRiODf3lmr3uStU1PlDtRvkD/wewnJt0aOUrQrVzcl0=";
+    hash = "sha256-pORShre3lLgI8UE9iZ7gicQbGbZM06IgYnKLLwOYm/s=";
  };

-  cargoHash = "sha256-hanuUZgwDhkwtu/K7ZunZcw5K7AtBglkdb2c2UnROHc=";
+  cargoHash = "sha256-fpEG0J+l/kRq5s6G0rzDsshbKM44fZfVeURFPhFeV7s=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "1.1.5";
+  version = "1.1.6";

  outputs = [
    "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jY73pkncs351ssZOho7fXcr0bKvQ9UynGEjfKTFFnik=";
+    hash = "sha256-2yuwjJhrK5tQkMmQnOaOYyQETB5mTKAIGMedw7kmXzg=";
  };

  postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm -r $out/git/*/candle-book/
  '';

-  cargoHash = "sha256-uQMjh7JdpjcXYBO8GE6ZI24G13qS43AjM4mgmXEn4V4=";
+  cargoHash = "sha256-xTK+u0IQ/QlGQuROehudjDJ4ch9/pM3Z9DahrJ+c9mk=";

  __structuredAttrs = true;

--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -7,6 +7,7 @@
  meson,
  ninja,
  libevdev,
+  lua5_4,
  mtdev,
  udev,
  wacomSupport ? stdenv.hostPlatform.isLinux,
@@ -53,7 +54,7 @@ in

 stdenv.mkDerivation rec {
  pname = "libinput";
-  version = "1.29.2";
+  version = "1.31.1";

  outputs = [
    "bin"
@@ -66,13 +67,9 @@ stdenv.mkDerivation rec {
    owner = "libinput";
    repo = "libinput";
    rev = version;
-    hash = "sha256-oxDGUbZebxAmBd2j51qV9Jn8SXBjUX2NPRgkxbDz7Dk=";
+    hash = "sha256-9Ko97vJyo4a9NUF7omqHTwzVV02sJ2EqpDIh+nPeLwk=";
  };

-  patches = [
-    ./udev-absolute-path.patch
-  ];
-
  nativeBuildInputs = [
    pkg-config
    meson
@@ -87,6 +84,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    libevdev
+    lua5_4
    mtdev
    (python3.withPackages (
      pp: with pp; [
--- a/pkgs/development/libraries/libinput/udev-absolute-path.patch
+++ b/pkgs/development/libraries/libinput/udev-absolute-path.patch
@@ -1,11 +0,0 @@
--- a/meson.build
-+++ b/meson.build
-@@ -100,7 +100,7 @@
-      args : model_quirks)
- 
- udev_rules_config = configuration_data()
-udev_rules_config.set('UDEV_TEST_PATH', '')
-+udev_rules_config.set('UDEV_TEST_PATH', dir_udev + '/')
- configure_file(input : 'udev/80-libinput-device-groups.rules.in',
- 	       output : '80-libinput-device-groups.rules',
- 	       install : true,
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
  pname = "mesa";
-  version = "26.0.6";
+  version = "26.1.0";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "mesa";
    repo = "mesa";
    rev = "mesa-${version}";
-    hash = "sha256-rSX+dVcquTIdITfTy+heipeq6xktOaA3psn6vXm1S34=";
+    hash = "sha256-Ymgtqecx1DinLzygpamX+I15ucL1wenh7p/40IGepIA=";
  };

  meta = {
--- a/pkgs/development/python-modules/affinegap/default.nix
+++ b/pkgs/development/python-modules/affinegap/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "affinegap";
-  version = "2";
+  version = "1.12";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dedupeio";
    repo = "affinegap";
-    tag = "pypideploy${version}";
-    hash = "sha256-TuydLF3YfeVIP2y2uDQH+oZ9Y2b325ZFEM0Fiu0Xhus=";
+    tag = "v${version}";
+    hash = "sha256-9eX41eoME5Vdtq+c04eQbMYnViy6QKOhKkafrkeMylI=";
  };

  build-system = [
@@ -41,6 +41,8 @@ buildPythonPackage rec {
    "affinegap"
  ];

+  passthru.skipBulkUpdate = true;
+
  meta = {
    description = "Cython implementation of the affine gap string distance";
    homepage = "https://github.com/dedupeio/affinegap";
--- a/pkgs/development/python-modules/flatten-dict/default.nix
+++ b/pkgs/development/python-modules/flatten-dict/default.nix
@@ -4,24 +4,21 @@
  fetchFromGitHub,
  poetry-core,
  pytestCheckHook,
-  six,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "flatten-dict";
-  version = "0.4.2";
+  version = "0.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ianlini";
    repo = "flatten-dict";
-    rev = version;
-    hash = "sha256-uHenKoD4eLm9sMREVuV0BB/oUgh4NMiuj+IWd0hlxNQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-wzCuTnLOOeybhBPcyyPNPKWoJBHwaKkmARTzlg87wtU=";
  };

-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [ six ];
+  build-system = [ poetry-core ];

  nativeCheckInputs = [ pytestCheckHook ];

@@ -30,7 +27,8 @@ buildPythonPackage rec {
  meta = {
    description = "Module for flattening and unflattening dict-like objects";
    homepage = "https://github.com/ianlini/flatten-dict";
+    changelog = "https://github.com/ianlini/flatten-dict/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/modelscope/default.nix
+++ b/pkgs/development/python-modules/modelscope/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "modelscope";
-  version = "1.36.2";
+  version = "1.36.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "modelscope";
    repo = "modelscope";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Cf6s5AujXL5kP7OPVbYSvfkvtAYH/XQJy1BKA8f3sGs=";
+    hash = "sha256-4AmilIVmsfi+mS+iUhd4MX8n/U8gowkL0dnFpJ90iGQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pycdlib/default.nix
+++ b/pkgs/development/python-modules/pycdlib/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pycdlib";
-  version = "1.15.0";
+  version = "1.16.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "clalancette";
    repo = "pycdlib";
    tag = "v${version}";
-    hash = "sha256-BD33nA60x6YvwkYGXPA0E6s8N/XhWaY/+tTRbFN9ai4=";
+    hash = "sha256-uJ9rMriRCLXpKekG8vGsIw+s0e6wlfX0soAYs6HGe0Y=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pythonqwt/default.nix
+++ b/pkgs/development/python-modules/pythonqwt/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "pythonqwt";
-  version = "0.15.0";
+  version = "0.16.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PythonQwt";
    tag = "v${version}";
-    hash = "sha256-S67k5kfGqB6Ezr2XMlW3x/ya6MW6df2cFrGEqlsLOhk=";
+    hash = "sha256-LBn88lEOruLLdXcJ7dHfgMS1EahHQErIlZjFVNosvAU=";
  };

  build-system = [
--- a/pkgs/development/python-modules/starsessions/default.nix
+++ b/pkgs/development/python-modules/starsessions/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "starsessions";
-  version = "2.2.1";
+  version = ".2.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "alex-oleshkevich";
    repo = "starsessions";
    tag = "v${version}";
-    hash = "sha256-JI044sn6LQI37PvSLdz2dooa3v5qdHmp6DZD0p7VzJU=";
+    hash = "sha256-CR8eMyYyr+iFf2l1QE0N762LdkxemOayn/s++mBZRqA=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -93,7 +93,7 @@
  pytestCheckHook,
 }:
 let
-  version = "9.7.0";
+  version = "9.8.0";
  agent = [
    mcpadapt
    smolagents
@@ -241,7 +241,7 @@ let
    owner = "neuml";
    repo = "txtai";
    tag = "v${version}";
-    hash = "sha256-24q75SqOV/twvMhbi3Exl9eHcfoyeTIbUEwvIYVtceM=";
+    hash = "sha256-AcNx6pdaZpfCMwjTMu2OTod3ISii4Qq28ZV0yIqNXbA=";
  };
 in
 buildPythonPackage {
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -308,7 +308,11 @@ stdenv.mkDerivation (finalAttrs: {
        jinja2
      ]
      ++ lib.optional withEfi ps.pyelftools
-      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
+      # pefile is only required to trigger a check in meson to actually build
+      # ukify. This module should never appear in the runtime closure of ukify.
+      # Instead the pefile from buildInputs should be used.
+      # Remove this when it's fixed upstream: https://github.com/systemd/systemd/pull/41959
+      ++ lib.optional withUkify ps.pefile
    ))
  ]
  ++ lib.optionals withLibBPF [
--- a/pkgs/servers/home-assistant/custom-components/hass_web_proxy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/hass_web_proxy/package.nix
@@ -38,6 +38,10 @@ buildHomeAssistantComponent rec {
    urlmatch
  ];

+  ignoreVersionRequirement = [
+    "hass-web-proxy-lib"
+  ];
+
  nativeCheckInputs = [
    pytestCheckHook
    pytest-aiohttp
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "sankey-chart";
-  version = "4.1.0";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "MindFreeze";
    repo = "ha-sankey-chart";
    rev = "v${version}";
-    hash = "sha256-wIYStC0sE+1HKWU4PI1KDEx2n4h/stCW64N9HeHcgCQ=";
+    hash = "sha256-E7tljTa/DTo5+V6ahc94B+26QfazcItCxYvF3OOvGL0=";
  };

-  npmDepsHash = "sha256-H2MX7KvCwThODH3b9yaaQQMYbdppuYiTjCSskzRYJL4=";
+  npmDepsHash = "sha256-cOOq+dYO87LxuerXhLehlpwngj/Ok2+tAqkv8YPVuis=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/servers/kanidm/1_10.nix
+++ b/pkgs/servers/kanidm/1_10.nix
@@ -1,5 +1,5 @@
 import ./generic.nix {
-  version = "1.10.0";
-  hash = "sha256-VKzeyhps9NC+tU7NaGZf2kTCCK6J5LU1ewJBhS/Noek=";
-  cargoHash = "sha256-hvWZLGJBsMbpZQixafdYzqT+zMbk2vAtPYpJ4OBVhoU=";
+  version = "1.10.1";
+  hash = "sha256-nIuxaYuVVNzQpnFRisyLkWFz7GWaJOUrj8mRRcGs2KI=";
+  cargoHash = "sha256-zti+7dlaU9k2EQfLQmdCL7Am9Xib1YKdUFVrLx15cCc=";
 }
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -125,7 +125,11 @@ let
  # Logical inversion of meta.availableOn for hostPlatform
  hasUnsupportedPlatform =
    let
-      anyHostPlatform = any (platformMatch hostPlatform);
+      inherit (hostPlatform) system;
+      # in almost all cases, meta.platforms is a simple list of strings, and we
+      # can just check if it contains the current system. we only run the more
+      # intensive platformMatch if necessary
+      anyHostPlatform = list: elem system list || any (platformMatch hostPlatform) list;
    in
    pkg:
    pkg ? meta.platforms && !(anyHostPlatform pkg.meta.platforms)
--- a/pkgs/test/config-nix-unit.nix
+++ b/pkgs/test/config-nix-unit.nix
@@ -0,0 +1,117 @@
+# Tests for nixpkgs config forwarding from NixOS modules.
+#
+# Run with:
+#   nix-unit pkgs/test/config-nix-unit.nix
+# or
+#   nix-build -A tests.config-nix-unit
+#
+{
+  nixpkgsPath ? ../..,
+  pkgs ? import nixpkgsPath { },
+}:
+let
+  lib = pkgs.lib;
+
+  # Test helper
+  evalNixos =
+    modules:
+    import (nixpkgsPath + "/nixos/lib/eval-config.nix") {
+      modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ] ++ modules;
+    };
+in
+{
+  # Basic: a single config option is forwarded correctly.
+  testSingleConfigOption = {
+    expr = (evalNixos [ { nixpkgs.config.allowUnfree = true; } ]).config.nixpkgs.config.allowUnfree;
+    expected = true;
+  };
+
+  # Multiple config definitions from separate modules are merged.
+  testMultipleModulesMerge = {
+    expr =
+      let
+        eval = evalNixos [
+          { nixpkgs.config.allowUnfree = true; }
+          { nixpkgs.config.allowBroken = true; }
+        ];
+      in
+      {
+        inherit (eval.config.nixpkgs.config) allowUnfree allowBroken;
+      };
+    expected = {
+      allowUnfree = true;
+      allowBroken = true;
+    };
+  };
+
+  # mkForce works. Also covers other properties
+  testMkForce = {
+    expr =
+      (evalNixos [
+        { nixpkgs.config.allowUnfree = true; }
+        { nixpkgs.config.allowUnfree = lib.mkForce false; }
+      ]).config.nixpkgs.config.allowUnfree;
+    expected = false;
+  };
+
+  testDefaults = {
+    expr = (evalNixos [ ]).config.nixpkgs.config.allowUnfree;
+    expected = false;
+  };
+
+  # Standalone nixpkgs (i.e. import <nixpkgs> { ... })
+  testStandaloneConfig = {
+    expr = (import nixpkgsPath { config.allowUnfree = true; }).config.allowUnfree;
+    expected = true;
+  };
+
+  # Standalone nixpkgs with a function (i.e. import <nixpkgs> ({pkgs, lib, ...}: { ... })
+  testStandaloneConfigFunctionPkgs = {
+    expr =
+      (import nixpkgsPath {
+        config =
+          { pkgs, lib, ... }:
+          {
+            allowUnfree = lib.isAttrs pkgs;
+          };
+      }).config.allowUnfree;
+    expected = true;
+  };
+
+  # NixOS module sets nixpkgs.config as a function
+  testNixosConfigFunction = {
+    expr =
+      (evalNixos [
+        {
+          nixpkgs.config =
+            { lib, ... }:
+            {
+              allowUnfree = lib.isFunction lib.id;
+            };
+        }
+      ]).config.nixpkgs.config.allowUnfree;
+    expected = true;
+  };
+
+  # Passing both config and _configDefinitions is not allowed
+  testConfigAndDefinitionsMutuallyExclusive = {
+    expr =
+      (import nixpkgsPath {
+        config = {
+          allowUnfree = true;
+        };
+        _configDefinitions = [
+          {
+            file = "test";
+            value = {
+              allowBroken = true;
+            };
+          }
+        ];
+      }).config.allowUnfree;
+    expectedError = {
+      type = "ThrownError";
+      msg = ".*_configDefinitions.*internal.*must not be combined.*";
+    };
+  };
+}
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -128,6 +128,21 @@ in

  config = callPackage ./config.nix { };

+  # Technically nix-unit binds to a fixed nix version
+  # We have tests in lib to test the module system itself against different nix-versions
+  # Based on this assumption (transitivity of correctness) this test should therefore also cover all tested nix-versions
+  config-nix-unit =
+    pkgs.runCommand "config-nix-unit"
+      {
+        nativeBuildInputs = [ pkgs.nix-unit ];
+      }
+      ''
+        export HOME=$TMPDIR
+        nix-unit --eval-store "$HOME" ${./config-nix-unit.nix} \
+          --arg nixpkgsPath "${../..}"
+        mkdir $out
+      '';
+
  top-level = callPackage ./top-level { };

  haskell = callPackage ./haskell { };
--- a/pkgs/tools/misc/fltrdr/default.nix
+++ b/pkgs/tools/misc/fltrdr/default.nix
@@ -25,6 +25,10 @@ stdenv.mkDerivation rec {
    openssl
  ];

+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i '/stdc++fs/d' CMakeLists.txt
+  '';
+
  meta = {
    homepage = "https://octobanana.com/software/fltrdr";
    description = "TUI text reader for the terminal";
@@ -39,7 +43,7 @@ stdenv.mkDerivation rec {
      setting.
    '';

-    platforms = lib.platforms.linux; # can only test linux
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.matthiasbeyer ];
    mainProgram = "fltrdr";
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -6,7 +6,12 @@
 #     nix-build -A tests.config
 #

-{ config, lib, ... }:
+{
+  config,
+  lib,
+  docPrefix,
+  ...
+}:

 let
  inherit (lib)
@@ -115,13 +120,13 @@ let
    gitConfig = mkOption {
      type = types.attrsOf (types.attrsOf types.anything);
      description = ''
-        The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](#fetchgit) calls.
+        The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls.

        Among many other potential uses, this can be used to override URLs to point to local mirrors.

        Changing this will not cause any rebuilds because `pkgs.fetchgit` produces a [fixed-output derivation](https://nix.dev/manual/nix/stable/glossary.html?highlight=fixed-output%20derivation#gloss-fixed-output-derivation).

-        To set the configuration file directly, use the [`gitConfigFile`](#opt-gitConfigFile) option instead.
+        To set the configuration file directly, use the [`gitConfigFile`](${docPrefix}#opt-gitConfigFile) option instead.

        To set the configuration file for individual calls, use `fetchgit { gitConfigFile = "..."; }`.
      '';
@@ -135,9 +140,9 @@ let
    gitConfigFile = mkOption {
      type = types.nullOr types.path;
      description = ''
-        A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](#fetchgit) calls.
+        A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls.

-        This overrides the [`gitConfig`](#opt-gitConfig) option, see its documentation for more details.
+        This overrides the [`gitConfig`](${docPrefix}#opt-gitConfig) option, see its documentation for more details.
      '';
      default =
        if config.gitConfig != { } then
@@ -155,7 +160,7 @@ let

        For example, an override like `"registry.npmjs.org" = "my-mirror.local/registry.npmjs.org"` will replace a URL like `https://registry.npmjs.org/foo.tar.gz` with `https://my-mirror.local/registry.npmjs.org/foo.tar.gz`.

-        To set the string directly, see [`npmRegistryOverridesString`](#opt-npmRegistryOverridesString).
+        To set the string directly, see [`npmRegistryOverridesString`](${docPrefix}#opt-npmRegistryOverridesString).
      '';
      default = { };
      example = {
@@ -174,7 +179,7 @@ let
      description = ''
        A string containing a string with a JSON representation of npm registry overrides for `fetchNpmDeps`.

-        This overrides the [`npmRegistryOverrides`](#opt-npmRegistryOverrides) option, see its documentation for more details.
+        This overrides the [`npmRegistryOverrides`](${docPrefix}#opt-npmRegistryOverrides) option, see its documentation for more details.
      '';
      default = builtins.toJSON config.npmRegistryOverrides;
    };
@@ -412,7 +417,7 @@ let
      type = types.listOf types.str;
      default = [ "https://tarballs.nixos.org" ];
      description = ''
-        The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](#sec-pkgs-fetchers-fetchurl).
+        The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](${docPrefix}#sec-pkgs-fetchers-fetchurl).
        In case `pkgs.fetchurl` can't download from the given URLs,
        it will try the hashed mirrors based on the expected output hash.

@@ -466,11 +471,27 @@ let
        Silence the warning for the upcoming deprecation of the
        `x86_64-darwin` platform in Nixpkgs 26.11.

-        See the [release notes](#x86_64-darwin-26.05) for more
+        See the [release notes](${docPrefix}#x86_64-darwin-26.05) for more
        information.
      '';
    };

+    packageOverrides = mkOption {
+      type = types.functionTo types.attrs;
+      default = pkgs: { };
+      description = ''
+        A function to replace or add packages in `pkgs` expects an attrset to be returned when called.
+      '';
+    };
+
+    perlPackageOverrides = mkOption {
+      type = types.functionTo types.attrs;
+      default = pkgs: { };
+      description = ''
+        The same as `packageOverrides` but for packages in the perl package set.
+      '';
+    };
+
    problems = (import ../stdenv/generic/problems.nix { inherit lib; }).configOptions;
  };

@@ -494,6 +515,7 @@ in
  inherit options;

  config = {
+    _module.args.docPrefix = lib.mkDefault "";
    warnings =
      optionals config.warnUndeclaredOptions (
        mapAttrsToList (k: v: "undeclared Nixpkgs option set: config.${k}") config._undeclared or { }
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -64,6 +64,11 @@ in
  # list it returns.
  stdenvStages ? import ../stdenv,

+  # Temporary parameter to unify nixpkgs/pkgs evaluation
+  # Internal, do not use this manually!
+  # Will be removed again within the next releases
+  _configDefinitions ? null,
+
  # Ignore unexpected args.
  ...
 }@args:
@@ -109,7 +114,13 @@ let
        then
          x86_64DarwinDeprecationWarning
        else
-          x: x
+          x:
+          x throwIfNot (lib.all lib.isFunction crossOverlays)
+            "All crossOverlays passed to nixpkgs must be functions."
+      )
+      (
+        throwIfNot (_configDefinitions == null || config0 == { })
+          "The `_configDefinitions` argument is an internal interface and must not be combined with `config`."
      );

  localSystem = lib.systems.elaborate args.localSystem;
@@ -134,20 +145,24 @@ let

  # Allow both:
  # { /* the config */ } and
-  # { pkgs, ... } : { /* the config */ }
+  # { lib, pkgs, ... } : { /* the config */ }
  config1 = if lib.isFunction config0 then config0 { inherit lib pkgs; } else config0;

  configEval = lib.evalModules {
    modules = [
      ./config.nix
-      (
-        { options, ... }:
-        {
-          _file = "nixpkgs.config";
-          config = config1;
-        }
-      )
-    ];
+    ]
+    ++ (
+      if _configDefinitions != null then
+        map (def: lib.modules.setDefaultModuleLocation def.file def.value) _configDefinitions
+      else
+        [
+          {
+            _file = "nixpkgs.config";
+            config = config1;
+          }
+        ]
+    );
    class = "nixpkgsConfig";
  };