Merge remote-tracking branch 'origin/staging-next' into staging

doc/release-notes/rl-2611.section.md

@@ -29,6 +29,15 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `roadrunner` has been updated from 2025.1.15 to 3.0.0, which contains several breaking changes:
+  - Middleware in `http.middleware` now run left to right; reverse the list to keep the previous order.
+  - The Zipkin tracing exporter has been removed; use OTLP.
+  - Goridge v4 removes the MessagePack codec; use JSON, protobuf, Gob, or raw payloads for RPC.
+  - The AMQP driver requires named connections with `config.connection`, and `config.version` has been removed.
+  - The TCP plugin is not supported; applications using `tcp:` must stay on RoadRunner v2025.
+
+  See the [upstream migration guide](https://github.com/roadrunner-server/docs/blob/release/v3/intro/v3-migration.md) for details.
+
 - The `dxvk` Wine setup wrapper now uses DXVK 3.x on Linux. DXVK 3.x requires Wine 10.0 or newer and a Vulkan 1.4-capable driver, and removes the `DXVK_FRAME_RATE` environment variable; use `dxvk.maxFrameRate` instead.
   The native library is available as `dxvk_3`. The `dxvk_1` and `dxvk_2` packages remain available for older hardware and applications.
   See the [upstream release notes](https://github.com/doitsujin/dxvk/releases/tag/v3.0) for details.
@@ -130,6 +139,8 @@
 
 - `landrun` was updated to `0.1.17`, which included breaking changes, reference the [breaking changes](https://github.com/Zouuup/landrun/releases/tag/v0.1.17) section in the `landrun` release notes.
 
+- `services.gitea-actions-runner` is no longer compatible with the `pkgs.forgejo-runner` executable, migrate to `services.forgejo-runner`.
+
 - `gimp2` has been removed due to being unmaintained upstream, and depending on the deprecated GTK2 library. Along with that, all GIMP plugins in the `gimpPlugins` set that only worked with gimp 2.0 have been removed as well.
 
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

maintainers/maintainer-list.nix

@@ -24269,6 +24269,11 @@
     githubId = 52847440;
     name = "Ryan Burns";
   };
+  r-xyz = {
+    github = "r-xyz";
+    githubId = 100710244;
+    name = "r-xyz";
+  };
   r0chd = {
     github = "r0chd";
     githubId = 100892812;

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -162,6 +162,8 @@
 
 - [ollaya](https://ollaya.dev), a server for local decision models, with an Ollama-style CLI and a TypeSafe-compatible API. Available as [services.ollaya](#opt-services.ollaya.enable).
 
+- [Spotify Soloist](https://developer.spotify.com/documentation/soloist), a headless Spotify Connect client. Available as [services.soloist](#opt-services.soloist.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -348,9 +350,9 @@
 
 - `services.pdfding` has been updated to support pdfding version 1.14.0. The automated backup functionality `services.pdfding.backup` option has been removed.
 
-- `sing-box` has been updated to 1.14.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/migration/) for details and migration options.
+- `sing-box` has been updated to 1.14.0, which has removed some deprecated options. See [upstream documentation](https://sing-box.sagernet.org/migration/) for details and migration options.
 
-- `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
+- `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2. `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
 
 - `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
 

nixos/modules/module-list.nix

@@ -472,6 +472,7 @@
   ./services/audio/roon-server.nix
   ./services/audio/slimserver.nix
   ./services/audio/snapserver.nix
+  ./services/audio/soloist.nix
   ./services/audio/spotifyd.nix
   ./services/audio/squeezelite.nix
   ./services/audio/tts.nix

nixos/modules/programs/thunderbird.nix

@@ -65,6 +65,84 @@ in
         - `"clear"`: Value has no effect. Resets to factory defaults on each startup.
       '';
     };
+
+    languagePacks = lib.mkOption {
+      # Available languages can be found in https://releases.mozilla.org/pub/thunderbird/releases/${cfg.package.version}/linux-x86_64/xpi/
+      type = lib.types.listOf (
+        lib.types.enum [
+          "af"
+          "ar"
+          "ast"
+          "be"
+          "bg"
+          "br"
+          "ca"
+          "cak"
+          "cs"
+          "cy"
+          "da"
+          "de"
+          "dsb"
+          "el"
+          "en-CA"
+          "en-GB"
+          "en-US"
+          "es-AR"
+          "es-ES"
+          "es-MX"
+          "et"
+          "eu"
+          "fi"
+          "fr"
+          "fy-NL"
+          "ga-IE"
+          "gd"
+          "gl"
+          "he"
+          "hr"
+          "hsb"
+          "hu"
+          "hy-AM"
+          "id"
+          "is"
+          "it"
+          "ja"
+          "ka"
+          "kab"
+          "kk"
+          "ko"
+          "lt"
+          "lv"
+          "ms"
+          "nb-NO"
+          "nl"
+          "nn-NO"
+          "pa-IN"
+          "pl"
+          "pt-BR"
+          "pt-PT"
+          "rm"
+          "ro"
+          "ru"
+          "sk"
+          "sl"
+          "sq"
+          "sr"
+          "sv-SE"
+          "th"
+          "tr"
+          "uk"
+          "uz"
+          "vi"
+          "zh-CN"
+          "zh-TW"
+        ]
+      );
+      default = [ ];
+      description = ''
+        The language packs to install.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -82,6 +160,15 @@ in
         Value = value;
         Status = cfg.preferencesStatus;
       }) cfg.preferences;
+      ExtensionSettings = builtins.listToAttrs (
+        builtins.map (
+          lang:
+          lib.attrsets.nameValuePair "langpack-${lang}@thunderbird.mozilla.org" {
+            installation_mode = "normal_installed";
+            install_url = "https://releases.mozilla.org/pub/thunderbird/releases/${cfg.package.version}/linux-x86_64/xpi/${lang}.xpi";
+          }
+        ) cfg.languagePacks
+      );
     };
   };
 

nixos/modules/services/audio/music-assistant.nix

@@ -57,7 +57,11 @@ in
       default = false;
       description = ''
         Whether to open required ports for the configured providers.
-        Currently airplay and sendspin need port to be opened to function.
+        Currently AirPlay, Sendspin, Snapcast, Squeezelite and Spotify Connect need port(s) to be opened to properly function.
+
+        ::: {.note}
+        AirPlay and Spotify Connect must open all random high UDP or TCP ports respectively to function.
+        :::
       '';
     };
 
@@ -104,8 +108,14 @@ in
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts =
         lib.optional cfg.enable 8097 # Music Assistant stream port
-        ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
+        # https://github.com/music-assistant/server/blob/dev/music_assistant/providers/airplay/pairing.py#L191
+        ++ lib.optionals (lib.elem "airplay" cfg.providers) [
+          5000 # AirPlay 1/RAOP
+          7000 # AirPlay 2
+        ]
+        # https://www.music-assistant.io/player-support/sendspin/#connecting-external-sendspin-clients
         ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927
+        # https://www.music-assistant.io/player-support/snapcast/#known-issues--notes
         ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780
         ++ lib.optionals (lib.elem "squeezelite" cfg.providers) [
           # https://lyrion.org/reference/slimproto-protocol/
@@ -114,6 +124,15 @@ in
           9000 # Slimproto JSON-RPC
           9090 # Slimproto CLI
         ];
+      allowedTCPPortRanges =
+        # Music Assistant does not configure the zeroconf_port, so all ephemeral ports are used
+        # https://github.com/devgianlu/go-librespot#example-minimal-zeroconf-configuration
+        lib.optionals (lib.elem "spotify_connect" cfg.providers) [
+          {
+            from = 32768;
+            to = 65535;
+          }
+        ];
       allowedUDPPorts = lib.optionals (lib.elem "squeezelite" cfg.providers) [
         # https://lyrion.org/reference/slimproto-protocol/
         3483 # Slimproto discovery

nixos/modules/services/audio/soloist.nix

@@ -0,0 +1,220 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.soloist;
+
+  args = [
+    "--device-name"
+    cfg.deviceName
+  ]
+  ++ lib.optionals (cfg.cacheSize != null) [
+    "--cache-size"
+    (toString cfg.cacheSize)
+  ]
+  ++ lib.optionals (cfg.initialVolume != null) [
+    "--initial-volume"
+    (toString cfg.initialVolume)
+  ]
+  ++ lib.optionals (cfg.pipewireDevice != null) [
+    "--pipewire-device"
+    cfg.pipewireDevice
+  ]
+  ++ lib.optionals (cfg.websocketAddress != null) [
+    "--ws"
+    cfg.websocketAddress
+  ]
+  ++ lib.optional cfg.verbose "--verbose"
+  ++ cfg.extraArgs;
+in
+{
+  options.services.soloist = {
+    enable = lib.mkEnableOption "Spotify Soloist, a headless Spotify Connect client";
+
+    package = lib.mkPackageOption pkgs "soloist" { };
+
+    deviceName = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.hostName";
+      description = ''
+        Name advertised to Spotify Connect controllers on the local network.
+        Select this name in the Spotify app to start playback on this device.
+      '';
+    };
+
+    apiKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/soloist-api-key";
+      description = ''
+        File containing the Spotify Soloist API key.
+
+        Generate one from the [Spotify for Developers dashboard](https://developer.spotify.com/dashboard/soloist).
+      '';
+    };
+
+    initialVolume = lib.mkOption {
+      type = lib.types.nullOr (lib.types.ints.between 0 100);
+      default = null;
+      example = 40;
+      description = ''
+        Initial volume from 0 to 100.
+      '';
+    };
+
+    pipewireDevice = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "alsa_output.usb-foobar-00.analog-stereo";
+      description = ''
+        Route audio to a specific PipeWire node name or ID instead of the
+        system's default audio output.
+      '';
+    };
+
+    cacheSize = lib.mkOption {
+      type = lib.types.nullOr lib.types.ints.unsigned;
+      default = null;
+      example = 500;
+      description = ''
+        Maximum playback cache size in MB. Use 0 for no limit (the default
+        when unset). Values must be 0 or at least 100.
+      '';
+    };
+
+    websocketAddress = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "127.0.0.1:0";
+      description = ''
+        Address and port (`ADDR:PORT`) to enable the local WebSocket API on.
+        Use port 0 to let the operating system choose a free port.
+        If unset, the WebSocket API stays disabled.
+      '';
+    };
+
+    verbose = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable verbose logging.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "--verbose" ];
+      description = ''
+        Extra command-line arguments to pass to `soloist`.
+        See <https://developer.spotify.com/documentation/soloist/reference/command-line>.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.apiKeyFile != null;
+        message = "services.soloist.apiKeyFile must be set to a file containing your Spotify Soloist API key (generate one at https://developer.spotify.com/dashboard/soloist).";
+      }
+      {
+        assertion = cfg.cacheSize == null || cfg.cacheSize == 0 || cfg.cacheSize >= 100;
+        message = "services.soloist.cacheSize must be 0 (no limit) or at least 100 (MB).";
+      }
+      {
+        assertion = config.services.pipewire.enable && config.services.pipewire.systemWide;
+        message = ''
+          services.soloist needs system-wide PipeWire: set
+          `services.pipewire.enable = true` and
+          `services.pipewire.systemWide = true`. Soloist has no ALSA backend.
+        '';
+      }
+    ];
+
+    systemd.services.soloist = {
+      description = "Spotify Soloist headless Spotify Connect client";
+      documentation = [ "https://developer.spotify.com/documentation/soloist" ];
+
+      after = [
+        "network-online.target"
+        "sound.target"
+        "pipewire.service"
+      ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        apiKey="$(cat "$CREDENTIALS_DIRECTORY/soloist-api-key")"
+        exec ${lib.getExe cfg.package} \
+          --api-key "$apiKey" \
+          --data-dir "$STATE_DIRECTORY" \
+          --cache-dir "$CACHE_DIRECTORY" \
+          ${lib.escapeShellArgs args}
+      '';
+
+      serviceConfig = {
+        DynamicUser = true;
+        User = "soloist";
+        Group = "soloist";
+        SupplementaryGroups = [
+          "audio"
+          "pipewire"
+        ];
+
+        StateDirectory = "soloist";
+        StateDirectoryMode = "0700";
+        CacheDirectory = "soloist";
+        CacheDirectoryMode = "0700";
+
+        LoadCredential = lib.optional (cfg.apiKeyFile != null) "soloist-api-key:${cfg.apiKeyFile}";
+
+        Restart = "always";
+        RestartSec = "5s";
+
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "ptrace"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = pkgs.soloist.meta.maintainers;
+}

nixos/modules/services/continuous-integration/gitea-actions-runner.nix

@@ -191,6 +191,13 @@ in
         assertion = wantsContainerRuntime -> hasDocker || hasPodman;
         message = "Label configuration on gitea-actions-runner instance requires either docker or podman.";
       }
+      {
+        assertion = lib.getName cfg.package != "forgejo-runner";
+        message = ''
+          Running forgejo-runner via `services.gitea-actions-runner' is no longer supported.
+          Please use `services.forgejo-runner' instead.
+        '';
+      }
     ];
 
     systemd.services =

nixos/modules/services/wayland/vellum.nix

@@ -64,7 +64,9 @@ in
       after = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
       wantedBy = [ "graphical-session.target" ];
-      restartTriggers = [ config.environment.etc."xdg/vellum/config.toml".source ];
+      restartTriggers = lib.optionals (cfg.settings != { }) [
+        config.environment.etc."xdg/vellum/config.toml".source
+      ];
       serviceConfig = {
         ExecStart = getExe cfg.package;
         Type = "exec";

nixos/tests/forgejo.nix

@@ -60,22 +60,6 @@ let
             ];
             services.openssh.enable = true;
 
-            specialisation.gitea-actions-runner = {
-              inheritParentConfig = true;
-              configuration.services.gitea-actions-runner = {
-                package = pkgs.forgejo-runner;
-                instances."test" = {
-                  enable = true;
-                  name = "ci";
-                  url = "http://localhost:3000";
-                  labels = [
-                    # type ":host" does not depend on docker/podman/lxc
-                    "native:host"
-                  ];
-                  tokenFile = "/var/lib/forgejo/runner_token";
-                };
-              };
-            };
             specialisation.forgejo-runner = {
               inheritParentConfig = true;
               configuration = (
@@ -271,7 +255,7 @@ let
 
               return status == "success"
 
-          with subtest("Testing deprecated gitea-actions-runner registration and action workflow"):
+          with subtest("Testing forgejo-runner registration and action workflow"):
               # mirror "actions/checkout" action
               client.succeed("cp -R ${checkoutActionSource}/ /tmp/checkout")
               client.succeed("git -C /tmp/checkout init")
@@ -294,17 +278,7 @@ let
                   + f"-H 'Authorization: token {api_token}'"
                   + ' -d \'{"has_actions":true}\'''
               )
-              server.succeed(
-                  "su -l forgejo -c 'GITEA_WORK_DIR=/var/lib/forgejo forgejo actions generate-runner-token' | sed 's/^/TOKEN=/' | tee /var/lib/forgejo/runner_token"
-              )
-              server.succeed("${serverSystem}/specialisation/gitea-actions-runner/bin/switch-to-configuration test")
-              server.wait_for_unit("gitea-runner-test.service")
-              server.succeed("journalctl -o cat -u gitea-runner-test.service | grep -q 'Runner registered successfully'")
 
-              with server.nested("Waiting for the workflow run to be successful"):
-                  retry(lambda _: poll_workflow_action_status(0), 180)
-
-          with subtest("Testing forgejo-runner registration and action workflow"):
               runner_registration_response = server.succeed(
                   "curl --fail http://localhost:3000/api/v1/admin/actions/runners "
                   + f"-H 'Authorization: token {api_token}' "

nixos/tests/web-apps/bookorbit.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 {
   name = "bookorbit";
 
@@ -12,10 +12,94 @@
     };
   };
 
-  testScript = ''
-    machine.wait_for_unit('bookorbit.service')
+  testScript =
+    let
+      baseUrl = "http://localhost:3000";
+      username = "admin";
+      password = "Sup3rSecret";
+      jsonArg = value: "'${lib.escape [ "\"" "'" ] (builtins.toJSON value)}'";
 
-    machine.wait_for_open_port(3000)
-    machine.succeed('curl --fail http://localhost:3000 | grep BookOrbit')
-  '';
+      # Minimal valid EPUB (zip container), generated once and embedded so the test
+      # needs no extra tooling inside the VM.
+      sampleEpub = "UEsDBBQAAAAIAAdMT11vYassFgAAABQAAAAIAAAAbWltZXR5cGVLLCjIyUxOLMnMz9NPLShN0q7KLAAAUEsDBBQAAAAIAAdMT10dMgM2nwAAAOIAAAAWAAAATUVUQS1JTkYvY29udGFpbmVyLnhtbFWOQQ7CIBRE9z0FYWtadEuAJiauNfEEX/qrROAToEZvL7qocTfJzLwZNT6DZw/MxVHUfDds+Wg6ZSlWcBHzv8VaOBbNlxwlQXFFRghYZLWSEsaJ7BIwVvmNyRXCTceYykR1dh6LWSWbF+/7BPWm+fGwP53Fp9MIA6WZs4CTg76+EmoOKXlnobYvgvCSSqvZO1xx08a4MEr8+J0S67Z5A1BLAwQUAAAACAAHTE9d2LtPxh4BAADnAQAAEQAAAE9FQlBTL2NvbnRlbnQub3BmRdHBbsMgDADQe78CcZ0S2u2wKUqo1MOO22HdB9DgJFYJsMS02d+PkiW5gWw/Y1Mep96wGwwjOlvxQ77nDGztNNq24t/n9+yNH+Wu9Kq+qhZYzLZjxTsiXwhxv99z1L7J3dCK5/3+VTjf8I17eXDB4k+ADDVYwgZhqPjFuStqLneMlT2Q0orUTBe6XnUfBpNkXQsw0Mf6URzyg0iFsVTXBSEZkB84fX6xM4zETpEuxRpZE7f2DPX2gjDYIgTUhcXJjRlFIrssxFazOUbZNsRNSLApZ70/ZhHLMPNkymITQVkiQZ/aWnXjrBugScd86qg3nPWgUWX066HiynuDtaK4P5HCT3EvXMhoL9zDHj1amOGoRXsxU+oc3ZXi/9vkH1BLAwQUAAAACAAHTE9dP4NNsIAAAACdAAAADwAAAE9FQlBTL25hdi54aHRtbCXMwQ7CIBAE0F8he5e18SIGaOLBox6sH6BCWmJlTdkI/r803CYzL6P78p7F1y8pUDTQyS0IH5/kQhwN3IbTZg+91RNXVWVMBibmzwEx5yzzTtIyYqeUwrIaqNTfndUcePb2SPTS2LLGtjzI/arq7DmUy1UMPrFornYa24zrmf0DUEsBAhQDFAAAAAgAB0xPXW9hqywWAAAAFAAAAAgAAAAAAAAAAAAAAIABAAAAAG1pbWV0eXBlUEsBAhQDFAAAAAgAB0xPXR0yAzafAAAA4gAAABYAAAAAAAAAAAAAAIABPAAAAE1FVEEtSU5GL2NvbnRhaW5lci54bWxQSwECFAMUAAAACAAHTE9d2LtPxh4BAADnAQAAEQAAAAAAAAAAAAAAgAEPAQAAT0VCUFMvY29udGVudC5vcGZQSwECFAMUAAAACAAHTE9dP4NNsIAAAACdAAAADwAAAAAAAAAAAAAAgAFcAgAAT0VCUFMvbmF2LnhodG1sUEsFBgAAAAAEAAQA9gAAAAkDAAAAAA==";
+    in
+    ''
+      import json
+
+      machine.wait_for_unit("bookorbit.service")
+      machine.wait_for_open_port(3000)
+
+      with subtest("Homepage is served"):
+          machine.succeed("curl --fail --silent ${baseUrl}/ | grep BookOrbit")
+
+      with subtest("Complete first-run setup"):
+          setup = json.loads(machine.succeed(
+              "curl --fail --silent"
+              + " --header 'x-setup-token: abcdefgh'"
+              + " --json ${
+                jsonArg {
+                  username = "${username}";
+                  name = "Admin";
+                  email = "admin@example.com";
+                  password = "${password}";
+                }
+              }"
+              + " ${baseUrl}/api/v1/auth/setup"
+          ))
+          assert setup["accessToken"], f"Expected an access token, got: {json.dumps(setup)}"
+
+      with subtest("Sign in"):
+          login = json.loads(machine.succeed(
+              "curl --fail --silent"
+              + " --json ${
+                jsonArg {
+                  username = "${username}";
+                  password = "${password}";
+                }
+              }"
+              + " ${baseUrl}/api/v1/auth/login"
+          ))
+          token = login["accessToken"]
+          assert login["user"]["isSuperuser"], f"Expected the first user to be a superuser, got: {json.dumps(login)}"
+
+      with subtest("Identify the signed-in user"):
+          me = json.loads(machine.succeed(
+              "curl --fail --silent --header 'Authorization: Bearer " + token + "'"
+              + " ${baseUrl}/api/v1/auth/me"
+          ))
+          assert me["username"] == "${username}", f"Expected username '${username}', got: {json.dumps(me)}"
+
+      with subtest("Create a library"):
+          library = json.loads(machine.succeed(
+              "curl --fail --silent --header 'Authorization: Bearer " + token + "'"
+              + " --json ${
+                jsonArg {
+                  name = "Test Library";
+                  icon = "folder";
+                  folders = [ "/var/lib/bookorbit/library" ];
+                }
+              }"
+              + " ${baseUrl}/api/v1/libraries"
+          ))
+          library_id = library["id"]
+          assert library_id, f"Expected a library id, got: {json.dumps(library)}"
+
+      with subtest("Upload a book"):
+          machine.succeed("echo '${sampleEpub}' | base64 -d > /tmp/test-book.epub")
+          upload = json.loads(machine.succeed(
+              "curl --fail --silent --header 'Authorization: Bearer " + token + "'"
+              + " --form file=@/tmp/test-book.epub"
+              + f" ${baseUrl}/api/v1/libraries/{library_id}/upload"
+          ))
+          book_id = upload["bookId"]
+          assert book_id, f"Expected a book id, got: {json.dumps(upload)}"
+
+      with subtest("Uploaded book is retrievable"):
+          book = json.loads(machine.succeed(
+              "curl --fail --silent --header 'Authorization: Bearer " + token + "'"
+              + f" ${baseUrl}/api/v1/books/{book_id}"
+          ))
+          assert book["id"] == book_id, f"Expected book {book_id}, got: {json.dumps(book)}"
+          assert book["libraryId"] == library_id, f"Expected book in library {library_id}, got: {json.dumps(book)}"
+    '';
 }

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-3L+WKtc4TXpSa/RpJ1AaokNe2jquS6P4/jH6b5l97Wo=";
+          hash = "sha256-CxcRJM0kr9GWqHDqklgwnfv7l+a42NUl19uzIl/sxQA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-CvLZYrStZUJPIHF+RIFRZ8QwNFsYklACHmqgsI9x+jE=";
+          hash = "sha256-g26KjS0tAj5aN+8WLwnEMTE6aiyNPJLRPvtD6rQklos=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-dlcov3B/P9I9lSIDXcqz+OSR9OR2Teprtk0jtRRlutM=";
+          hash = "sha256-a9rAHqk4oYcM3FG/ghMci72SxHMuS3EzNVpsC56OP3g=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.300";
+      version = "2.1.301";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/networking/cluster/helm/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-E1xhKV3ahZ8ahCDalga2XSOiLea0UyC8b1t3Gd4P6xA=";
+    hash = "sha256-XbRqZWsr012zT6dXumg4YShsjXeVNt6Qk52ttEFm/Oo=";
   };
 
-  vendorHash = "sha256-WxQMzzWcMJJATibiXXSBmCQz8YAlRu/MPGBkQaiHht8=";
+  vendorHash = "sha256-yjiKKAB+IoY3mn0Ae4ITKU4yPNuZhX7Y9Ct1LEZj5zQ=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -373,11 +373,11 @@
     "vendorHash": null
   },
   "dopplerhq_doppler": {
-    "hash": "sha256-3k7leyu/7FCtCzZN7pn6eIhxuYUbi8h3DBSGhrt2XXQ=",
+    "hash": "sha256-8E/myRJTAmomaKqsMc4vE3dLUYOrC8djlPWlDH3zF8U=",
     "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
     "owner": "DopplerHQ",
     "repo": "terraform-provider-doppler",
-    "rev": "v1.21.5",
+    "rev": "v1.22.0",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
@@ -1004,13 +1004,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-VIz4dKuXPYUeLWtTyabwT+87HjIzj+cqb2THbQEtYVw=",
+    "hash": "sha256-OMdR+GcFngtxjwhJvMOtXqF7kWT9Jtzy6RHMrJGjV2E=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.100.1",
+    "rev": "v3.101.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Eo76Quv+L9i9n8bTd0LudAYeKd1sILdoY+ODbGmRj3s="
+    "vendorHash": "sha256-OKs20KouIKiBEoWy2MbkObLBq5SYoB35ktzPXyT6lP0="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-6w0r6QXm16h4I4PFj80dJhTDbF4FPMjJalO0TfXGBEA=",
@@ -1076,13 +1076,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-ZPXlPDKBmGvVmG+0HNyRhLWTHFrsCTF32n2m8OSbXuo=",
+    "hash": "sha256-Xv4YGiaqRDhvgOfiVpU8HJzlSmNqlFEFzbp+2zfOKfw=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.37.9",
+    "rev": "v1.37.10",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6H/i/BLNegYvTwy5IejLD9QUB0QreFwyJpJ9ENhALo8="
+    "vendorHash": "sha256-zMhzhXtVJBMKIGWndBOaDRTsJNSagXEDjDUOcRrRnU0="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",

pkgs/applications/video/kodi/addons/a4ksubtitles/default.nix

@@ -15,7 +15,7 @@ buildKodiAddon rec {
     owner = "a4k-openproject";
     repo = "a4kSubtitles";
     rev = "${namespace}/${namespace}-${version}";
-    sha256 = "sha256-t6oclFAOsUC+hFtw6wjRh1zl2vQfc7RKblVJpBPfE9w=";
+    hash = "sha256-t6oclFAOsUC+hFtw6wjRh1zl2vQfc7RKblVJpBPfE9w=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/archive_tool/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
     owner = "zach-morris";
     repo = "script.module.archive_tool";
     rev = version;
-    sha256 = "0hbkyk59xxfjv6vzfjplahmqxi5564qjlwyq6k8ijy6jjcwnd3p7";
+    hash = "sha256-545mOZPSeBnRNNhzKjExpcSOK1T0Sve32dL1nsr0c0E=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/arrow/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/script.module.arrow/script.module.arrow-${version}.zip";
-    sha256 = "sha256-Et+9FJT1dRE1dFOrAQ70HJJcfylyLsiyay9wPJcSOXs=";
+    hash = "sha256-Et+9FJT1dRE1dFOrAQ70HJJcfylyLsiyay9wPJcSOXs=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/certifi/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-NQbjx+k9fnQMYLLMR5+N5NSuDcXEzZjlhGPA3qSmjfI=";
+    hash = "sha256-NQbjx+k9fnQMYLLMR5+N5NSuDcXEzZjlhGPA3qSmjfI=";
   };
 
   patches = [

pkgs/applications/video/kodi/addons/chardet/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-cIQIX6LVAoGf1sBRKWonXJd3XYqGOa5WIUttabV0HeU=";
+    hash = "sha256-cIQIX6LVAoGf1sBRKWonXJd3XYqGOa5WIUttabV0HeU=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/controller-topology-project/default.nix

@@ -14,7 +14,7 @@ let
       owner = "kodi-game";
       repo = "controller-topology-project";
       rev = "v${version}";
-      sha256 = "sha256-GfEnCx1DewxHipzblMBtnl2dsLewr87qLEi6R3CYh6Q=";
+      hash = "sha256-GfEnCx1DewxHipzblMBtnl2dsLewr87qLEi6R3CYh6Q=";
     };
 
     postPatch = ''

pkgs/applications/video/kodi/addons/dateutil/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-iQnyS0GjYcPbnBDUxmMrmDxHOA3K8RbTVke/HF4d5u4=";
+    hash = "sha256-iQnyS0GjYcPbnBDUxmMrmDxHOA3K8RbTVke/HF4d5u4=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/defusedxml/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-jSl7lbFqR6hjZhHzxY69hDbs84LY3B5RYKzXnHou0Qg=";
+    hash = "sha256-jSl7lbFqR6hjZhHzxY69hDbs84LY3B5RYKzXnHou0Qg=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/formula1/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-yz9SB0hiw5JKURGNvAazxazL+bMtfziNXlOLLoGUPOU=";
+    hash = "sha256-yz9SB0hiw5JKURGNvAazxazL+bMtfziNXlOLLoGUPOU=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/future/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-BsDgCAZuJBRBpe6EmfSynhrXS3ktQRZsEwf9CdF0VCg=";
+    hash = "sha256-BsDgCAZuJBRBpe6EmfSynhrXS3ktQRZsEwf9CdF0VCg=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/iagl/default.nix

@@ -20,7 +20,7 @@ buildKodiAddon rec {
     owner = "zach-morris";
     repo = "plugin.program.iagl";
     rev = version;
-    sha256 = "sha256-b8nO3D/xTnj/5UDshGlIJdiHd75VhIlkrGUi0vkZqG4=";
+    hash = "sha256-b8nO3D/xTnj/5UDshGlIJdiHd75VhIlkrGUi0vkZqG4=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/idna/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-wFS7rETO+VGeg1MxMEdb/cwVw5/TEoZF2CS3BjkxDlk=";
+    hash = "sha256-wFS7rETO+VGeg1MxMEdb/cwVw5/TEoZF2CS3BjkxDlk=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/inputstream-ffmpegdirect/default.nix

@@ -17,7 +17,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = "inputstream.ffmpegdirect";
     rev = "${version}-${rel}";
-    sha256 = "sha256-IgCSEJzu3a2un7FdiZCEVs/boxvIhSNleTPpOCljCZo=";
+    hash = "sha256-IgCSEJzu3a2un7FdiZCEVs/boxvIhSNleTPpOCljCZo=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix

@@ -17,7 +17,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = "inputstream.rtmp";
     rev = "${version}-${rel}";
-    sha256 = "sha256-AkpRbYOe30dWDcflCGXxJz8Y+9bQw9ZmZF88ra2c+fc=";
+    hash = "sha256-AkpRbYOe30dWDcflCGXxJz8Y+9bQw9ZmZF88ra2c+fc=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/inputstreamhelper/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-v5fRikswmP+KVbxYibD0NbCK8leUnFbya5EtF1FmS0I=";
+    hash = "sha256-v5fRikswmP+KVbxYibD0NbCK8leUnFbya5EtF1FmS0I=";
   };
 
   patches = [

pkgs/applications/video/kodi/addons/invidious/default.nix

@@ -17,7 +17,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/plugin.video.invidious/plugin.video.invidious-${version}+nexus.0.zip";
-    sha256 = "sha256-XnlnhvtHMh4uQTupW/SSOmaEV8xZrL61/6GoRpyKR0o=";
+    hash = "sha256-XnlnhvtHMh4uQTupW/SSOmaEV8xZrL61/6GoRpyKR0o=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/jellycon/default.nix

@@ -23,7 +23,7 @@ buildKodiAddon rec {
     owner = "jellyfin";
     repo = "jellycon";
     rev = "v${version}";
-    sha256 = "sha256-dpH611GZ+BG63bSFypcZ9VUtNCA/tL8zgKuaU7cCRII=";
+    hash = "sha256-dpH611GZ+BG63bSFypcZ9VUtNCA/tL8zgKuaU7cCRII=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/kodi/addons/jellyfin/default.nix

@@ -21,7 +21,7 @@ buildKodiAddon rec {
     owner = "jellyfin";
     repo = "jellyfin-kodi";
     rev = "v${version}";
-    sha256 = "sha256-TWDhCOe4EO2HJ/Px+en2++YWniiw4Y+vU3sQtxOvT8U=";
+    hash = "sha256-TWDhCOe4EO2HJ/Px+en2++YWniiw4Y+vU3sQtxOvT8U=";
   };
 
   nativeBuildInputs = [ python ];

pkgs/applications/video/kodi/addons/joystick/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = namespace;
     rev = "${version}-${rel}";
-    sha256 = "sha256-ADkXvbTsx4xMUiu90hvHIMvpAF0FQ2HNkKDX/E/tRok=";
+    hash = "sha256-ADkXvbTsx4xMUiu90hvHIMvpAF0FQ2HNkKDX/E/tRok=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/keymap/default.nix

@@ -15,7 +15,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-sbyI6ZK8HvXgMxNDtm2Tb/ub93IcdXB5PSdxoL+QIqU=";
+    hash = "sha256-sbyI6ZK8HvXgMxNDtm2Tb/ub93IcdXB5PSdxoL+QIqU=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/kodi-platform/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     owner = "xbmc";
     repo = "kodi-platform";
     rev = "kodiplatform-${version}";
-    sha256 = "sha256-W9V6O+YmH2U7xyEvWgS30sHBlIqGaaIt9jKgJ4ePNbY=";
+    hash = "sha256-W9V6O+YmH2U7xyEvWgS30sHBlIqGaaIt9jKgJ4ePNbY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/video/kodi/addons/kodi-six/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-nWz5CPoE0uVsZvWjI4q6y4ZKUnraTjTXLSJ1mK4YopI=";
+    hash = "sha256-nWz5CPoE0uVsZvWjI4q6y4ZKUnraTjTXLSJ1mK4YopI=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/libretro-genplus/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = "game.libretro.genplus";
     rev = "${version}-Matrix";
-    sha256 = "sha256-F3bt129lBZKlDtp7X0S0q10T9k9C2zNeHG+yIP3818Q=";
+    hash = "sha256-F3bt129lBZKlDtp7X0S0q10T9k9C2zNeHG+yIP3818Q=";
   };
 
   extraCMakeFlags = [

pkgs/applications/video/kodi/addons/libretro-mgba/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = "game.libretro.mgba";
     rev = "${version}-Matrix";
-    sha256 = "sha256-lxpj6Y34apYcE22q4W3Anhigp79r4RgiJ36DbES1kzU=";
+    hash = "sha256-lxpj6Y34apYcE22q4W3Anhigp79r4RgiJ36DbES1kzU=";
   };
 
   extraCMakeFlags = [

pkgs/applications/video/kodi/addons/libretro-nestopia/default.nix

@@ -16,7 +16,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = "game.libretro.nestopia";
     rev = "${version}-${rel}";
-    sha256 = "sha256-DmBO+HcfIBcz7p16dND09iwXWeObtU/doo/mJ0IZGGg=";
+    hash = "sha256-DmBO+HcfIBcz7p16dND09iwXWeObtU/doo/mJ0IZGGg=";
   };
 
   extraCMakeFlags = [

pkgs/applications/video/kodi/addons/libretro-snes9x/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = "game.libretro.snes9x";
     rev = "${version}-Matrix";
-    sha256 = "sha256-LniZf8Gae4+4Rgc9OGhMCkOI3IA7CPjVrN/gbz9te38=";
+    hash = "sha256-LniZf8Gae4+4Rgc9OGhMCkOI3IA7CPjVrN/gbz9te38=";
   };
 
   extraCMakeFlags = [

pkgs/applications/video/kodi/addons/libretro/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = "game.libretro";
     rev = "${version}-${rel}";
-    sha256 = "sha256-RwaLGAJt13PLKy45HU64TvQFyY532WWq2YX34Eyu+6o=";
+    hash = "sha256-RwaLGAJt13PLKy45HU64TvQFyY532WWq2YX34Eyu+6o=";
   };
 
   extraBuildInputs = [ tinyxml ];

pkgs/applications/video/kodi/addons/myconnpy/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-NlLMq9RAdWu8rVsMc0FDe1HmQiVp5T7iBXbIH7HB5bI=";
+    hash = "sha256-NlLMq9RAdWu8rVsMc0FDe1HmQiVp5T7iBXbIH7HB5bI=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/orftvthek/default.nix

@@ -16,7 +16,7 @@ buildKodiAddon rec {
     owner = "s0faking";
     repo = namespace;
     rev = version;
-    sha256 = "sha256-HWx1Uj/yOJ5Tggyd8EJHyBfpUAbtfk89XpWTKzl6Ie0=";
+    hash = "sha256-HWx1Uj/yOJ5Tggyd8EJHyBfpUAbtfk89XpWTKzl6Ie0=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/pdfreader/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
     owner = "i96751414";
     repo = "plugin.image.pdfreader";
     rev = "v${version}";
-    sha256 = "sha256-J93poR5VO9fAgNCEGftJVYnpXOsJSxnhHI6TAJZ2LeI=";
+    hash = "sha256-J93poR5VO9fAgNCEGftJVYnpXOsJSxnhHI6TAJZ2LeI=";
   };
 
   passthru.pythonPath = "lib/api";

pkgs/applications/video/kodi/addons/plex-for-kodi/default.nix

@@ -18,7 +18,7 @@ buildKodiAddon rec {
     owner = "pannal";
     repo = "plex-for-kodi";
     rev = "v${version}";
-    sha256 = "sha256-rNxTz3SKHHBm0WDCoZ/foJN2pBBiyI3a/tOdQdOCuXA=";
+    hash = "sha256-rNxTz3SKHHBm0WDCoZ/foJN2pBBiyI3a/tOdQdOCuXA=";
   };
 
   # Plex for Kodi writes to its own directory by default, needs to be patched to a non-store path.

pkgs/applications/video/kodi/addons/plugin-cache/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-5QcMNmWOEw2C26OXlvAvxqDxTpjIMBhwmaIFwVgHuIU=";
+    hash = "sha256-5QcMNmWOEw2C26OXlvAvxqDxTpjIMBhwmaIFwVgHuIU=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/pvr-hdhomerun/default.nix

@@ -15,7 +15,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-pvr";
     repo = "pvr.hdhomerun";
     rev = "${version}-${rel}";
-    sha256 = "sha256-wgKMt3ufvOh08nwZTGvDGoJ0U+aUzSWJptCNRiRW4B0=";
+    hash = "sha256-wgKMt3ufvOh08nwZTGvDGoJ0U+aUzSWJptCNRiRW4B0=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/pvr-hts/default.nix

@@ -14,7 +14,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-pvr";
     repo = "pvr.hts";
     rev = "${version}-${rel}";
-    sha256 = "sha256-opxNgin+Sz/Nb9IGZ+OFrCzbDc4FXl2LaNKUu5LAgFM=";
+    hash = "sha256-opxNgin+Sz/Nb9IGZ+OFrCzbDc4FXl2LaNKUu5LAgFM=";
   };
 
   patches = [

pkgs/applications/video/kodi/addons/pvr-iptvsimple/default.nix

@@ -20,7 +20,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-pvr";
     repo = "pvr.iptvsimple";
     rev = "${version}-${rel}";
-    sha256 = "sha256-bw0rAEn8R44n5Nzc9ni6IGaG/Bxry6GSyWcT6BdgLz8=";
+    hash = "sha256-bw0rAEn8R44n5Nzc9ni6IGaG/Bxry6GSyWcT6BdgLz8=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/pvr-vdr-vnsi/default.nix

@@ -14,7 +14,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-pvr";
     repo = "pvr.vdr.vnsi";
     rev = "${version}-${rel}";
-    sha256 = "sha256-V/ICEK006Zs4mipywAbRl8ZdezsprCgdC2WYtc/cAAY=";
+    hash = "sha256-V/ICEK006Zs4mipywAbRl8ZdezsprCgdC2WYtc/cAAY=";
   };
 
   extraBuildInputs = [ libGL ];

pkgs/applications/video/kodi/addons/radioparadise/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/script.radioparadise/script.radioparadise-${version}.zip";
-    sha256 = "sha256-7mBKWgyjXcGPbUknE7F7czxicMDoYmv06Am1RgbOjgE=";
+    hash = "sha256-7mBKWgyjXcGPbUknE7F7czxicMDoYmv06Am1RgbOjgE=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/raiplay/default.nix

@@ -20,7 +20,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-WJDk2Ck5+AvbxuJ3odu1Gsbe0ByGapHYOpCxek/trFk=";
+    hash = "sha256-WJDk2Ck5+AvbxuJ3odu1Gsbe0ByGapHYOpCxek/trFk=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/requests-cache/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-6M/v/ghS2TnSZhG8bREjxfEfcfLOmvA6hgsa7JUk9Dk=";
+    hash = "sha256-6M/v/ghS2TnSZhG8bREjxfEfcfLOmvA6hgsa7JUk9Dk=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/requests/default.nix

@@ -16,7 +16,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-05BSD5aoN2CTnjqaSKYMb93j5nIfLvpJHyeQsK++sTw=";
+    hash = "sha256-05BSD5aoN2CTnjqaSKYMb93j5nIfLvpJHyeQsK++sTw=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/routing/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-piPmY8Q3NyIeImmkYhDwmQhBiwwcV0X532xV1DogF+I=";
+    hash = "sha256-piPmY8Q3NyIeImmkYhDwmQhBiwwcV0X532xV1DogF+I=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/signals/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-WsLR7iUh5F+LXMISBpWx71dLAtg/AMYF6BsiyKZakuE=";
+    hash = "sha256-WsLR7iUh5F+LXMISBpWx71dLAtg/AMYF6BsiyKZakuE=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/simplecache/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-xdOBIi99nspcDIKkjxcW1r/BqL8O9NxdDViTuvMtUmo=";
+    hash = "sha256-xdOBIi99nspcDIKkjxcW1r/BqL8O9NxdDViTuvMtUmo=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/simplejson/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-RJy75WAr0XmXnSrPjqKhFjWJnWo3c5IEtUGumcE/mRo=";
+    hash = "sha256-RJy75WAr0XmXnSrPjqKhFjWJnWo3c5IEtUGumcE/mRo=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/six/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-d6BNpnTg6K7NPX3uWp5X0rog33C+B7YoAtLH/CrUYno=";
+    hash = "sha256-d6BNpnTg6K7NPX3uWp5X0rog33C+B7YoAtLH/CrUYno=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/skyvideoitalia/default.nix

@@ -16,7 +16,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-ciLtqT++6bn7la4xRVvlRwzbbUUUPN5WU35rJpR4l+w=";
+    hash = "sha256-ciLtqT++6bn7la4xRVvlRwzbbUUUPN5WU35rJpR4l+w=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/somafm/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/plugin.audio.somafm/plugin.audio.somafm-${version}.zip";
-    sha256 = "sha256-auPLm7QFabU4tXJPjTl17KpE+lqWM2Edbd2HrXPRx40=";
+    hash = "sha256-auPLm7QFabU4tXJPjTl17KpE+lqWM2Edbd2HrXPRx40=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/steam-controller/default.nix

@@ -13,7 +13,7 @@ buildKodiBinaryAddon rec {
     owner = "kodi-game";
     repo = namespace;
     rev = "b3174673c6feb34325975b6c007581c39bf3e4a5";
-    sha256 = "sha256-Q+eJfbD4NpAPANm9Mx9/pD29L5tdS4gxhQqNufufYdw=";
+    hash = "sha256-Q+eJfbD4NpAPANm9Mx9/pD29L5tdS4gxhQqNufufYdw=";
   };
 
   extraBuildInputs = [ libusb1 ];

pkgs/applications/video/kodi/addons/steam-launcher/default.nix

@@ -17,7 +17,7 @@ buildKodiAddon {
     owner = "teeedubb";
     repo = owner + "-xbmc-repo";
     rev = "76d728bb51ad265a28d4945af99c7fa2626df624";
-    sha256 = "sha256-i8plXt+Fu+O42JPo/FJI365IAUCNvWhREy2eZuG44lQ=";
+    hash = "sha256-i8plXt+Fu+O42JPo/FJI365IAUCNvWhREy2eZuG44lQ=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/steam-library/default.nix

@@ -16,7 +16,7 @@ buildKodiAddon rec {
     owner = "aanderse";
     repo = namespace;
     rev = "v${version}";
-    sha256 = "sha256-HwPNBqD+zS5sDNXtiGEmoc1RJ1SFCRzVOzUCjunMCnU=";
+    hash = "sha256-HwPNBqD+zS5sDNXtiGEmoc1RJ1SFCRzVOzUCjunMCnU=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/trakt-module/default.nix

@@ -15,7 +15,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-6JIAQwot5VZ36gvQym88BD/e/mSyS8WO8VqkPn2GcqY=";
+    hash = "sha256-6JIAQwot5VZ36gvQym88BD/e/mSyS8WO8VqkPn2GcqY=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/trakt/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-kjA3kk1Ii3PylfwgiKpLCRe6TGMNDgOppFJM38rgVWU=";
+    hash = "sha256-kjA3kk1Ii3PylfwgiKpLCRe6TGMNDgOppFJM38rgVWU=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/typing_extensions/default.nix

@@ -12,7 +12,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-bCGPl5fGVyptCenpNXP/Msi7hu+UdtZd2ms7MfzbsbM=";
+    hash = "sha256-bCGPl5fGVyptCenpNXP/Msi7hu+UdtZd2ms7MfzbsbM=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/upnext/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-oNUk80MEzK6Qssn1KjT6psPTazISRoUif1IMo+BKJxo=";
+    hash = "sha256-oNUk80MEzK6Qssn1KjT6psPTazISRoUif1IMo+BKJxo=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/urllib3/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-xapFA51ENjkB3IldUey5WqXAjMij66dNqILQjKD/VkA=";
+    hash = "sha256-xapFA51ENjkB3IldUey5WqXAjMij66dNqILQjKD/VkA=";
   };
 
   passthru = {

pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix

@@ -20,7 +20,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = namespace;
     rev = "${version}-${rel}";
-    sha256 = "sha256-D0eLH+G+qF5xLBBX/FdJC+gKNQpqSb7LjRmi/99rPNg=";
+    hash = "sha256-D0eLH+G+qF5xLBBX/FdJC+gKNQpqSb7LjRmi/99rPNg=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/vfs-rar/default.nix

@@ -14,7 +14,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = namespace;
     rev = "${version}-${rel}";
-    sha256 = "sha256-8IEYA2gNchCa7O9kzrCbO5DxYWJqPzQN3SJIr9zCWc8=";
+    hash = "sha256-8IEYA2gNchCa7O9kzrCbO5DxYWJqPzQN3SJIr9zCWc8=";
   };
 
   extraBuildInputs = [ tinyxml ];

pkgs/applications/video/kodi/addons/vfs-sftp/default.nix

@@ -16,7 +16,7 @@ buildKodiBinaryAddon rec {
     owner = "xbmc";
     repo = namespace;
     rev = "${version}-${rel}";
-    sha256 = "sha256-aD0AEr406urgnGVfB6C9JGaNmZAFL7WghnTZhbMfzA8=";
+    hash = "sha256-aD0AEr406urgnGVfB6C9JGaNmZAFL7WghnTZhbMfzA8=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/websocket/default.nix

@@ -14,7 +14,7 @@ buildKodiAddon rec {
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-1Wy+hxB059UoZnQlncytVT3sQ07dYAhNRnW3/QVD4ZE=";
+    hash = "sha256-1Wy+hxB059UoZnQlncytVT3sQ07dYAhNRnW3/QVD4ZE=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/xbmcswift2/default.nix

@@ -13,7 +13,7 @@ buildKodiAddon rec {
     owner = "XBMC-Addons";
     repo = namespace;
     rev = version;
-    sha256 = "sha256-Z+rHz3wncoNvV1pwhRzJFB/X0H6wdfwg88otVh27wg8=";
+    hash = "sha256-Z+rHz3wncoNvV1pwhRzJFB/X0H6wdfwg88otVh27wg8=";
   };
 
   passthru = {

pkgs/applications/video/kodi/unwrapped.nix

@@ -147,26 +147,26 @@ let
     owner = "xbmc";
     repo = "libdvdcss";
     rev = "1.4.3-Next-Nexus-Alpha2-2";
-    sha256 = "sha256-CJMGH50mNAkovccNcol5ArF3zUnZKfbVB9EXyQgu5k4=";
+    hash = "sha256-CJMGH50mNAkovccNcol5ArF3zUnZKfbVB9EXyQgu5k4=";
   };
 
   libdvdnav = fetchFromGitHub {
     owner = "xbmc";
     repo = "libdvdnav";
     rev = "6.1.1-Next-Nexus-Alpha2-2";
-    sha256 = "sha256-m8SCjOokVbwJ7eVfYKHap1pQjVbI+BXaoxhGZQIg0+k=";
+    hash = "sha256-m8SCjOokVbwJ7eVfYKHap1pQjVbI+BXaoxhGZQIg0+k=";
   };
 
   libdvdread = fetchFromGitHub {
     owner = "xbmc";
     repo = "libdvdread";
     rev = "6.1.3-Next-Nexus-Alpha2-2";
-    sha256 = "sha256-AphBQhXud+a6wm52zjzC5biz53NnqWdgpL2QDt2ZuXc=";
+    hash = "sha256-AphBQhXud+a6wm52zjzC5biz53NnqWdgpL2QDt2ZuXc=";
   };
 
   groovy = fetchzip {
     url = "mirror://apache/groovy/4.0.16/distribution/apache-groovy-binary-4.0.16.zip";
-    sha256 = "sha256-OfZBiMVrhw6VqHRHCSC7ZV3FiZ26n4+F8hsskk+L6yU=";
+    hash = "sha256-OfZBiMVrhw6VqHRHCSC7ZV3FiZ26n4+F8hsskk+L6yU=";
   };
 
   apache_commons_lang = fetchzip {

pkgs/by-name/av/avml/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "avml";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "avml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ziK2s4Wwy+WB45O7OU3TKyTujrLsQV6hRUSm5Jr4NO4=";
+    hash = "sha256-iBlY5dkc5uKgp+hf2j56J5aqqQ9sF/ob4qnQy1vzPfQ=";
   };
 
-  cargoHash = "sha256-72c2914higGji0vDUwjtQoil/LdEaECv+HqANTcSRdE=";
+  cargoHash = "sha256-CnFIC5nMffXcZ6cQL7G93tSXJwczMFOty3dcqCy5DTc=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/bb/bb-launcher/package.nix

@@ -0,0 +1,132 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  qt6,
+  cryptopp,
+  fmt,
+  libarchive,
+  nlohmann_json,
+  pugixml,
+  sdl3,
+  toml11,
+  vulkan-headers,
+  vulkan-loader,
+  vulkan-volk,
+  zarchive,
+  zstd,
+  nix-update-script,
+  shadps4,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bb-launcher";
+  version = "16.12";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "rainmakerv3";
+    repo = "BB_Launcher";
+    tag = "Release${finalAttrs.version}";
+    hash = "sha256-W6La/VGcssN1vLKSGYGydaUXkYJjzqj+CKqWituO4GU=";
+
+    # qmicroz is the only external left after unbundle-externals.patch, and
+    # qtstatic is a big prebuilt Qt for Windows only, so free some disk space.
+    postCheckout = ''
+      git -C "$out/externals" submodule update --init microz
+      rm -r "$out/qtstatic" "$out/WebView2SDK"
+    '';
+  };
+
+  patches = [
+    # Devendor various vendored dependencies in favor of linking against nixpkgs' versions.
+    # Only qmicroz and the miniz it carries stay vendored, being unpackaged.
+    # Of the forked pins there (fmt, sdl3, cryptopp) only cryptopp diverges, in
+    # clang-cl branches inactive here.
+    # Recheck if any divergence was added when updating.
+    ./unbundle-externals.patch
+  ]
+  # BB_Launcher otherwise only runs builds the user picks in its file dialog or
+  # downloads through it, and those downloads are dynamically linked binaries.
+  # Selecting a /nix/store path by hand would go stale quickly.
+  # This patch injects ${shadps4} if the set one either doesn't exist, or is a
+  # /nix/store path (which may be stale by now).
+  # If a user doesn't want that, they can simply do `bb-launcher.override { shadps4 = null; }`
+  ++ lib.optional (shadps4 != null) ./use-nix-shadps4.patch;
+
+  postPatch = lib.optionalString (shadps4 != null) ''
+    substituteInPlace settings/config.cpp \
+      --subst-var-by shadps4 ${lib.getExe shadps4} \
+      --subst-var-by storeDir ${builtins.storeDir}
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+    qt6.qttools
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwebsockets
+    qt6.qtwebview
+    qt6.qtwebengine
+    qt6.qtwebchannel
+    cryptopp
+    fmt
+    libarchive
+    nlohmann_json
+    pugixml
+    sdl3
+    toml11
+    vulkan-headers
+    vulkan-volk
+    zarchive
+    zstd
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "USE_WEBENGINE" true)
+  ];
+
+  # volk dlopens the loader at runtime
+  qtWrapperArgs = [
+    "--prefix"
+    "LD_LIBRARY_PATH"
+    ":"
+    (lib.makeLibraryPath [ vulkan-loader ])
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "Release(.*)"
+    ];
+  };
+
+  meta = {
+    description = "Dedicated shadPS4 launcher focused entirely on Bloodborne";
+    longDescription = ''
+      BB_Launcher is a dedicated shadPS4 launcher focused entirely on
+      Bloodborne, with mod management, save/trophy management and a shadPS4
+      settings editor.
+
+      It runs the packaged shadPS4 by default. Override `shadps4` to run a
+      different build, or set `shadps4 = null` to manage builds entirely from
+      within the app.
+    '';
+    homepage = "https://github.com/rainmakerv3/BB_Launcher";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ kilyanni ];
+    mainProgram = "BB_Launcher";
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/bb/bb-launcher/unbundle-externals.patch

@@ -0,0 +1,103 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 11aba11..be7d500 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -106,6 +106,9 @@ find_package(pugixml 1.14 CONFIG)
+ find_package(fmt 10.2.0 CONFIG)
+ find_package(SDL3 3.1.2 CONFIG)
+ find_package(VulkanHeaders 1.4.324 CONFIG)
++find_package(nlohmann_json 3.11.0 CONFIG)
++find_package(volk 1.3.270 CONFIG)
++find_package(LibArchive 3.6.0)
+ if (APPLE)
+     find_package(date 3.0.1 CONFIG)
+ endif()
+@@ -284,8 +287,8 @@ target_include_directories(BB_Launcher PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+ target_include_directories(BB_Launcher PRIVATE externals/microz/miniz)
+ 
+ target_link_libraries(BB_Launcher PRIVATE Qt6::Widgets Qt6::Network Qt6::Quick Qt6::QuickWidgets Qt6::WebView Qt6::WebSockets Qt6::Concurrent)
+-target_link_libraries(BB_Launcher PRIVATE fmt::fmt toml11::toml11 nlohmann_json::nlohmann_json pugixml::pugixml SDL3::SDL3 Vulkan::Headers volk_headers ZArchive::zarchive)
+-target_link_libraries(BB_Launcher PRIVATE qmicroz cryptopp::cryptopp liblzma archive_static)
++target_link_libraries(BB_Launcher PRIVATE fmt::fmt toml11::toml11 nlohmann_json::nlohmann_json pugixml::pugixml SDL3::SDL3 Vulkan::Headers volk::volk_headers ZArchive::zarchive)
++target_link_libraries(BB_Launcher PRIVATE qmicroz cryptopp::cryptopp LibArchive::LibArchive)
+ 
+ if (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND USE_WEBENGINE)
+     target_link_libraries(BB_Launcher PRIVATE Qt6::WebEngineCore Qt6::WebEngineWidgets Qt6::WebChannel)
+diff --git a/externals/CMakeLists.txt b/externals/CMakeLists.txt
+index 2b2a8d0..0581b5a 100644
+--- a/externals/CMakeLists.txt
++++ b/externals/CMakeLists.txt
+@@ -41,17 +41,17 @@ endif()
+ # microz
+ add_subdirectory(microz)
+ 
+-# zlib from qmicroz
+-add_library(miniz_zlib STATIC microz/miniz/miniz.c)
+-target_compile_definitions(miniz_zlib PUBLIC MINIZ_NO_ZLIB_NAMESPACES)
+-add_library(ZLIB::ZLIB ALIAS miniz_zlib)
+-
+ #nlohmann json 
+-set(JSON_BuildTests OFF CACHE INTERNAL "")
+-add_subdirectory(json)
++if (NOT TARGET nlohmann_json::nlohmann_json)
++    set(JSON_BuildTests OFF CACHE INTERNAL "")
++    add_subdirectory(json)
++endif()
+ 
+ #volk
+-add_subdirectory(volk)
++if (NOT TARGET volk::volk_headers)
++    add_subdirectory(volk)
++    add_library(volk::volk_headers ALIAS volk_headers)
++endif()
+ 
+ # vulkan-headers
+ if (NOT TARGET Vulkan::Headers)
+@@ -77,6 +77,13 @@ if (NOT TARGET cryptopp::cryptopp)
+     endif()
+ endif()
+ 
++if (NOT TARGET LibArchive::LibArchive)
++
++# zlib from qmicroz
++add_library(miniz_zlib STATIC microz/miniz/miniz.c)
++target_compile_definitions(miniz_zlib PUBLIC MINIZ_NO_ZLIB_NAMESPACES)
++add_library(ZLIB::ZLIB ALIAS miniz_zlib)
++
+ # liblzma
+ set(ENABLE_NLS OFF CACHE BOOL "Disable NLS" FORCE)
+ add_subdirectory(xz)
+@@ -109,6 +116,24 @@ if (WIN32 AND CMAKE_BUILD_TYPE STREQUAL "Debug")
+     set(HAVE_WCSCPY 1 CACHE INTERNAL "Define to 1 if you have the wcscpy function" FORCE)
+ endif()
+ add_subdirectory(libarchive)
++add_library(LibArchive::LibArchive ALIAS archive_static)
++
++endif()
++
++# ZArchive ships no CMake config, only a pkg-config file.
++if (NOT TARGET zarchive)
++    find_package(PkgConfig QUIET)
++    if (PkgConfig_FOUND)
++        pkg_check_modules(zarchive IMPORTED_TARGET GLOBAL zarchive)
++        pkg_check_modules(libzstd IMPORTED_TARGET GLOBAL libzstd)
++    endif()
++endif()
++
++if (TARGET PkgConfig::zarchive)
++    set_property(TARGET PkgConfig::zarchive APPEND PROPERTY
++        INTERFACE_LINK_LIBRARIES PkgConfig::libzstd)
++    add_library(ZArchive::zarchive ALIAS PkgConfig::zarchive)
++else()
+ 
+ # zstd (dependency of ZArchive)
+ if (NOT TARGET libzstd_static)
+@@ -135,6 +160,8 @@ if (NOT TARGET zarchive)
+     add_library(ZArchive::zarchive ALIAS zarchive)
+ endif()
+ 
++endif()
++
+ if (APPLE)
+      # date
+     if (NOT TARGET date::date-tz)

pkgs/by-name/bb/bb-launcher/use-nix-shadps4.patch

@@ -0,0 +1,16 @@
+diff --git a/settings/config.cpp b/settings/config.cpp
+index 3079300..8cdb50f 100644
+--- a/settings/config.cpp
++++ b/settings/config.cpp
+@@ -103,6 +103,11 @@ void LoadSettings() {
+         CustomUserFolder = toml::find_fs_path_or(launcher, "CustomUserFolder", {});
+     }
+ 
++    if (Common::shadPs4Executable.string().starts_with("@storeDir@/") ||
++        !std::filesystem::exists(Common::shadPs4Executable)) {
++        Common::shadPs4Executable = "@shadps4@";
++    }
++
+     if (std::filesystem::exists(Common::installPath)) {
+         Common::game_serial = Common::GetGameSerial(Common::installPath);
+     } else {

pkgs/by-name/bo/bookorbit/package.nix

@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bookorbit";
-  version = "3.2.0";
+  version = "3.4.0";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bookorbit";
     repo = "bookorbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+0e/gZ5foYeb6jYghL/f66H5dbAyrsuj37fRChx2H3Y=";
+    hash = "sha256-5zwnQGsWLgs5aSIScpo0bYUXmLzJAR4KORYYAqmM/dA=";
   };
 
   pnpmWorkspaces = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-zRmENCmKw2gHDYjVmPCXjKWEmDbDKCJEf03ZAmh1tYw=";
+    hash = "sha256-xn3IgXnCUPl0ZBp6d5f5HTW+6ABweePuyTrpgBx4DnM=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,35 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
+    # @swc/core >= 1.16 ships its native addon as a self-loading ELF carrier
+    # with a zstd "SWCNZSTD" payload embedded in a read-only section. On load
+    # the addon self-extracts into a per-user cache and refuses to load unless
+    # that cache root *and every one of its ancestors* is owned by the
+    # effective uid or root and is not group/other-writable
+    # (crates/swc_native_addon/src/platform/unix.rs, secure_cache_root). The
+    # nix sandbox root "/" is owned by an unmapped uid, so no
+    # SWC_NATIVE_BINDING_CACHE location can satisfy the check, and the
+    # SWC_NATIVE_BINDING_CACHE_SKIP_SECURITY_CHECK opt-out only exists in
+    # @swc/core >= 1.16.17. Overwrite each carrier with its decoded raw addon:
+    # the raw N-API addon loads directly, exactly as pre-1.16 swc shipped it.
+    # The payload lives in a read-only section as a v1 header (magic, version
+    # 1, 96-byte header size) followed by the raw addon as a zstd frame.
+    find node_modules -name 'swc.*.node' -exec node -e '
+      const fs = require("node:fs"), z = require("node:zlib");
+      const signature = Buffer.from("SWCNZSTD\x01\x00\x60\x00", "latin1");
+      for (const p of process.argv.slice(1)) {
+        const b = fs.readFileSync(p);
+        const i = b.indexOf(signature);
+        if (i < 0) continue;
+        const frameLen = Number(b.readBigUInt64LE(i + 16));
+        const raw = z.zstdDecompressSync(b.subarray(i + 96, i + 96 + frameLen));
+        fs.chmodSync(p, 0o644);
+        fs.writeFileSync(p, raw);
+      }
+    ' {} +
+
+    # ora's spinner hangs in the non-TTY sandbox without CI set.
+    export CI=1
     pnpm --filter client run build-only
     pnpm --filter server run build
 

pkgs/by-name/bo/borgbackup/package.nix

@@ -55,8 +55,11 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   sphinxBuilders = [
-    "singlehtml"
-    "man"
+    # HACK: sphinxBuilders is currently broken with __structuredAttrs = true,
+    # and ignores all but the first array item. for now, pass them as a single
+    # space-separated entry. fixed on staging, but requires a mass-rebuild.
+    # TODO: revert to [ "singlehtml" "man" ] on staging.
+    "singlehtml man"
   ];
 
   buildInputs = [
@@ -81,7 +84,10 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     ];
 
   makeWrapperArgs = [
-    ''--prefix PATH ':' "${openssh}/bin"''
+    "--prefix"
+    "PATH"
+    ":"
+    "${openssh}/bin"
   ];
 
   preInstallSphinx = ''

pkgs/by-name/bt/btrfs-assistant/package.nix

@@ -12,29 +12,19 @@
   util-linux,
   enableSnapper ? true,
   nix-update-script,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "btrfs-assistant";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitLab {
     owner = "btrfs-assistant";
     repo = "btrfs-assistant";
     rev = finalAttrs.version;
-    hash = "sha256-sjqLmpiLdoV9wUxNqeBTzw4gkj5o0/guXzqp1uYhYnA=";
+    hash = "sha256-dug56EbUp2Bn84MFSDN3+EWPm+e9CZm//BFNqLA65xE=";
   };
 
-  patches = [
-    # Avoid unprivileged crashes before command-line arguments are processed.
-    # https://gitlab.com/btrfs-assistant/btrfs-assistant/-/merge_requests/98
-    (fetchpatch {
-      url = "https://gitlab.com/btrfs-assistant/btrfs-assistant/-/commit/5fb306c7871e5be63a8adf6fbce31c50fce7512b.diff";
-      hash = "sha256-JU9l611OoSOqKMI1cGRoFY9rnf1MC58DeMnI5vmAhKo=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     git

pkgs/by-name/bu/butler/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "butler";
-  version = "15.31.0";
+  version = "15.32.0";
 
   src = fetchFromGitHub {
     owner = "itchio";
     repo = "butler";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gH0aSS5VvKdBr9zD7CGHo3Qhs/MFkJWVMaG9m9yDPXw=";
+    hash = "sha256-XODUoDjntEjc/sy92BirIDAJ4GmxzdDvD+laRDDd4CA=";
   };
 
   buildInputs = [ brotli ];
 
   doCheck = false; # disabled because the tests don't work in a non-FHS compliant environment.
 
-  vendorHash = "sha256-4Uleff7XO9hs72/G+s8Ak1yaDLNpdHZa2GKx1aCtLZI=";
+  vendorHash = "sha256-IJ/ODqn7dMwW/PZ7dmad/BdlhsR0FslSuGr6qJLQCSA=";
 
   meta = {
     description = "Command-line itch.io helper";

pkgs/by-name/ch/chafa/package.nix

@@ -11,6 +11,7 @@
   libavif,
   libjxl,
   librsvg,
+  libwebp,
   libxslt,
   libxml2,
   docbook_xml_dtd_412,
@@ -57,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     libavif
     libjxl
     librsvg
+    libwebp
   ];
 
   patches = [ ./xmlcatalog_patch.patch ];

pkgs/by-name/cl/claude-code/manifest.zst.json

@@ -1,56 +1,56 @@
 {
-  "version": "2.1.300",
+  "version": "2.1.301",
   "manifestSignatureEnforcement": "flag",
-  "commit": "c6733ae1276880507ca0c5b053ae18fb0df090d6",
-  "buildDate": "2026-10-14T13:31:05Z",
+  "commit": "12a1baed117fbcc7e0695ab8aa6d2a4c6bd00cbb",
+  "buildDate": "2026-10-15T14:02:29Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "5f19cc8fef7b1387f4b71691213b5aadc62d9157a78014287f3002ce8642cc23",
-      "size": 83582341,
+      "checksum": "499703a087a5395ed31e96e5cb19a6d3257cfeffbf812e5dba97347a33c84c5a",
+      "size": 83877124,
       "bundle": {
-        "checksum": "f53c2f9a3934eeebf8b7c86990e2c08b9ec046623941daea91d80a1f58a5d197",
-        "size": 83578473
+        "checksum": "491300b6499480e9240856191ad45b750f2cd90d1c9d00e1d4d37ba15c7d2f41",
+        "size": 83879655
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "0bf82ce30e45f97b271db94af3a6877b72f658f570cea4dfac66741708a7737d",
-      "size": 88318346,
+      "checksum": "157e1ad1310d96edcbadc7308debdec4cd5a40ea92b7e6e487ba88d056c3e934",
+      "size": 88633774,
       "bundle": {
-        "checksum": "5e4397e2736e9b9e40de94251d9c621e4fe8bcfc460dec98312090002db750f3",
-        "size": 88323146
+        "checksum": "5a9d4ca1a59dadb842467cd863ceb8cfe453f28dea02557e7a909d4edf0b8dea",
+        "size": 88642019
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "1f87b1a7838056aaf69c2b819c0b6b118ac713e0e2ba6c0a768aa531c7c5e8d0",
-      "size": 92840828
+      "checksum": "b94d6bca4549db066a3ffdbdb3d0f64083aa11d4557f672fd1eb77173b665d0f",
+      "size": 93160808
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "ca1608ae4e85017c5408c85a3778410add7dd796324acfd0eef3ad707268d5d6",
-      "size": 93676652
+      "checksum": "7121db492db6a44a756ae9581890613d914f78abba35cd57fa3bb4ed5e873e39",
+      "size": 93994767
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "f006bb2458db1d50c5c956b47864bc708823c132345d94dd8a10e8d5e0b2ffd8",
-      "size": 91194411
+      "checksum": "d60d859afeb94325c2603934b8e9514227d87c1802eb6021c1d572db7456a908",
+      "size": 91515582
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "0f5c6b4abe1d772642f85d52a4a05c79bbe7fd83bd0a551d1d0cfabbcc30ef53",
-      "size": 92091262
+      "checksum": "8b131b3cb1d9dbf753edb003e66d49c91b2e58e0411906803694d8f4b1b9ede2",
+      "size": 92405915
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "78ed93dd777f073ef3a5961457775091d152d17c65823c40a86fc9bf55cb113a",
-      "size": 96203531
+      "checksum": "825816dcf3b81a989bfb8c931ed02485f3e2014fe954326710607f7af0f10c4d",
+      "size": 96514855
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "ca0cb24c68d402e8b3caa7a0daa38992cec05ac1076a4ebf709983aa608bb665",
-      "size": 92145199
+      "checksum": "e85bee152b8e0e2216a97e3494708b66935e0279f05cc00ff32fea04a19cfe4a",
+      "size": 92454500
     }
   },
   "sdkCompat": {

pkgs/by-name/co/codechecker-unwrapped/package.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  fetchPypi,
+  python313Packages,
+}:
+
+# Starting the codechecker server currently breaks with Python 3.14
+# https://github.com/Ericsson/codechecker/issues/4773
+python313Packages.buildPythonApplication (finalAttrs: {
+  pname = "codechecker-unwrapped";
+  version = "6.29.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) version;
+    pname = "codechecker";
+    hash = "sha256-0D8eO+UumjZXh/t00IUcBLtUUwXJINbFaUG+svkOScQ=";
+  };
+
+  build-system = with python313Packages; [
+    setuptools
+    types-setuptools
+  ];
+
+  dependencies = with python313Packages; [
+    alembic
+    argcomplete
+    authlib
+    distutils # required in python312 to call subcommands (see https://github.com/Ericsson/codechecker/issues/4350)
+    lxml
+    multiprocess
+    portalocker
+    psutil
+    semver
+    sqlalchemy
+    thrift
+    gitpython
+    pyyaml
+    requests
+    types-pyyaml
+    sarif-tools
+    types-psutil
+    types-lxml
+    prettytable
+  ];
+
+  pythonRelaxDeps = true;
+  nativeBuildInputs = with python313Packages; [
+    pythonRelaxDepsHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/Ericsson/codechecker";
+    changelog = "https://github.com/Ericsson/codechecker/releases/tag/v${finalAttrs.version}";
+    description = "Analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [
+      zebreus
+      felixsinger
+      kacper-uminski
+    ];
+    mainProgram = "CodeChecker";
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+  };
+})

pkgs/by-name/co/codechecker/package.nix

@@ -1,91 +1,46 @@
 {
-  lib,
-  fetchpatch,
-  fetchPypi,
-  makeWrapper,
-  python313Packages,
-  libclang,
   clang-tools,
+  codechecker-unwrapped,
   cppcheck,
   gcc,
   infer,
+  lib,
+  libclang,
+  makeWrapper,
+  symlinkJoin,
   withClang ? false,
   withClangTools ? false,
   withCppcheck ? false,
   withGcc ? false,
   withInfer ? false,
 }:
-# Starting the codechecker server currently breaks with Python 3.14
-# https://github.com/Ericsson/codechecker/issues/4773
-python313Packages.buildPythonApplication (finalAttrs: {
+
+symlinkJoin {
   pname = "codechecker";
-  version = "6.29.1";
-  pyproject = true;
 
-  src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-0D8eO+UumjZXh/t00IUcBLtUUwXJINbFaUG+svkOScQ=";
-  };
+  inherit (codechecker-unwrapped) version meta;
 
-  build-system = with python313Packages; [
-    setuptools
-    types-setuptools
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  paths = [
+    codechecker-unwrapped
   ];
 
-  dependencies = with python313Packages; [
-    alembic
-    argcomplete
-    authlib
-    distutils # required in python312 to call subcommands (see https://github.com/Ericsson/codechecker/issues/4350)
-    lxml
-    multiprocess
-    portalocker
-    psutil
-    semver
-    sqlalchemy
-    thrift
-    gitpython
-    pyyaml
-    requests
-    types-pyyaml
-    sarif-tools
-    types-psutil
-    types-lxml
-    prettytable
-  ];
-
-  pythonRelaxDeps = true;
-  nativeBuildInputs = with python313Packages; [
+  nativeBuildInputs = [
     makeWrapper
-    pythonRelaxDepsHook
   ];
 
-  postInstall = ''
-    wrapProgram "$out/bin/CodeChecker" --prefix PATH : ${
-      lib.makeBinPath (
-        lib.optional withClang libclang
-        ++ lib.optional withClangTools clang-tools
-        ++ lib.optional withCppcheck cppcheck
-        ++ lib.optional withGcc gcc
-        ++ lib.optional withInfer infer
-      )
-    }
+  postBuild = ''
+    wrapProgram "$out/bin/CodeChecker" \
+      --prefix PATH : ${
+        lib.makeBinPath (
+          lib.optional withClang libclang
+          ++ lib.optional withClangTools clang-tools
+          ++ lib.optional withCppcheck cppcheck
+          ++ lib.optional withGcc gcc
+          ++ lib.optional withInfer infer
+        )
+      }
   '';
-
-  meta = {
-    homepage = "https://github.com/Ericsson/codechecker";
-    changelog = "https://github.com/Ericsson/codechecker/releases/tag/v${finalAttrs.version}";
-    description = "Analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy";
-    license = with lib.licenses; [
-      asl20
-      llvm-exception
-    ];
-    maintainers = with lib.maintainers; [
-      zebreus
-      felixsinger
-      kacper-uminski
-    ];
-    mainProgram = "CodeChecker";
-    platforms = lib.platforms.darwin ++ lib.platforms.linux;
-  };
-})
+}

pkgs/by-name/co/codex/package.nix

@@ -218,6 +218,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # the future once this software stabilizes.
   doCheck = false;
 
+  # codex-voice-host is moved out of bin/ before fixup; strip it too, or its
+  # debug info keeps gcc and glibc.dev in the runtime closure.
+  stripDebugList = [
+    "bin"
+    "codex-resources"
+  ];
+
   # Metadata enables voice package discovery even without a daemon.
   # Patch ps and package rg/bwrap directly: a wrapper fails the daemon's
   # staged-vs-running executable content check.

pkgs/by-name/co/complete-alias/package.nix

@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "Automagical shell alias completion";
     homepage = "https://github.com/cykerway/complete-alias";
-    license = lib.licenses.lgpl3Only;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ tuxinaut ];
     mainProgram = "complete_alias";
   };

pkgs/by-name/co/copybara/package.nix

@@ -14,11 +14,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20260928";
+  version = "20261012";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-JYB2Re4Xt7hj9PiFASsGGSuZUmMrVAvfiiEIgxP+SSU=";
+    hash = "sha256-r5LX29Vp+L2afD9sudr9aM2xticfhgdKc3BMUWtqick=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cp/cpc/package.nix

@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cpc";
     description = "Text calculator with support for units and conversion";
     homepage = "https://github.com/kasper9n/cpc";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [
       s0me1newithhand7s
     ];

pkgs/by-name/cr/critiq/package.nix

@@ -0,0 +1,107 @@
+{
+  alsa-lib,
+  autoPatchelfHook,
+  cups,
+  dpkg,
+  fetchurl,
+  gtk3,
+  lib,
+  libgbm,
+  libsecret,
+  makeBinaryWrapper,
+  musl,
+  nss,
+  stdenvNoCC,
+  undmg,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "critiq";
+  version = "1.12.6";
+
+  src = fetchurl (
+    finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}")
+  );
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ]
+  ++ (
+    if stdenvNoCC.hostPlatform.isLinux then
+      [
+        autoPatchelfHook
+        dpkg
+      ]
+    else
+      [ undmg ]
+  );
+
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    alsa-lib
+    cups
+    gtk3
+    libgbm
+    libsecret
+    musl
+    nss
+  ];
+
+  sourceRoot = lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Critiq.app";
+
+  unpackPhase = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+    runHook preUnpack
+
+    dpkg-deb --extract $src $out
+
+    runHook postUnpack
+  '';
+
+  postInstall = ''
+    mkdir --parents $out/bin
+  ''
+  + lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+    mv $out/usr/share $out
+    rmdir $out/usr
+    makeWrapper $out/opt/Critiq/critiq $out/bin/critiq \
+      --prefix PATH : $PATH
+  ''
+  + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+    mkdir -p "$out"/Applications
+    cp -r . "$out"/Applications/Critiq.app
+    makeWrapper "$out"/Applications/Critiq.app/Contents/MacOS/Critiq "$out"/bin/critiq
+  '';
+
+  passthru.sources =
+    let
+      baseUrl = "https://downloads.getcritiq.dev/releases/v${finalAttrs.version}";
+    in
+    {
+      aarch64-darwin = {
+        url = "${baseUrl}/Critiq_${finalAttrs.version}_arm64.dmg";
+        hash = "sha256-CGAWKui/Rq09suX+ykHdawJJD9/106FF4JThuwiLRnk=";
+      };
+      x86_64-linux = {
+        url = "${baseUrl}/Critiq.deb";
+        hash = "sha256-5WC1EikwXAg9G2+pDJsq7JzEUWFPc+kaht0fBSjmhq0=";
+      };
+    };
+
+  meta = {
+    description = "Native Git client for code review";
+    longDescription = ''
+      Compare branches, review PRs with inline comments, trace history
+      with blame, full language support and symbol indexing all in one
+      native workspace.
+    '';
+    homepage = "https://getcritiq.dev";
+    license = lib.licenses.unfree;
+    mainProgram = "critiq";
+    maintainers = with lib.maintainers; [ yiyu ];
+    platforms = lib.attrNames finalAttrs.passthru.sources;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/di/direnv/package.nix

@@ -7,20 +7,21 @@
   fish,
   zsh,
   writableTmpDirAsHomeHook,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "direnv";
-  version = "2.37.1";
+  version = "2.38.2";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-92xjoCjH5O7wx8U7OFG8Lw9eDOAdeVKNvxBHW+TiniM=";
+    hash = "sha256-0TVuQ0TEqkkCo36zrdFbfZ+FJSVrvNA7egAcsS9YFtA=";
   };
 
-  vendorHash = "sha256-SAIGFQGACTB3Q0KnIdiKKNYY6fVjf/09wGqNr0Hkg+M=";
+  vendorHash = "sha256-3ojb8iLIzhjUZa7Gt+gJjOFy9qm4LOrFBLZ6fk5x1HM=";
 
   # we have no bash at the moment for windows
   env.BASH_PATH = lib.optionalString (!stdenv.hostPlatform.isWindows) "${bash}/bin/bash";
@@ -62,6 +63,8 @@ buildGoModule (finalAttrs: {
     rm -rf "$out/share/fish"
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Shell extension that manages your environment";
     longDescription = ''

pkgs/by-name/es/espanso/package.nix

@@ -20,7 +20,7 @@
   setxkbmap,
   wl-clipboard,
   wxwidgets_3_2,
-  makeWrapper,
+  makeBinaryWrapper,
   securityWrapperPath ? null,
   nix-update-script,
   stdenv,
@@ -50,7 +50,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeBuildInputs = [
     kdePackages.extra-cmake-modules
     pkg-config
-    makeWrapper
+    makeBinaryWrapper
     wxwidgets_3_2
   ];
 

pkgs/by-name/eu/euro-office-desktopeditors/package.nix

@@ -3,7 +3,6 @@
   lib,
   fetchurl,
   buildFHSEnv,
-  unzip,
   patchelfUnstable,
   # Alphabetic ordering below
   alsa-lib,
@@ -84,21 +83,16 @@ let
 
   derivation = stdenv.mkDerivation (finalAttrs: {
     pname = "euro-office-desktopeditors";
-    # No release yet, pinning to latest version where Linux artifacts
-    # where provided.
-    version = "9.3.1-dev.1";
-    # Manual uploaded Github CI artifact (actions run 28295624289,
-    # artifact 7926798036) of linux-packages-amd64 tarball.
+    version = "9.3.5-2";
     src = fetchurl {
-      url = "https://archive.org/download/euro-office-desktopeditors-9.3.1-dev.1-linux-amd64/linux-packages-amd64.zip";
-      hash = "sha256-OV3abn9nYq/FeBkpft+27iGt34Rqi2VkJkAZwBHu1lM=";
+      url = "https://github.com/Euro-Office/DesktopEditors/releases/download/v${finalAttrs.version}/euro-office-euro-office_${finalAttrs.version}_amd64.deb";
+      hash = "sha256-0ekoe/uSePacpynl3z0d0mD1iiZy9Qai76ZKS7Al5aQ=";
     };
 
     unpackPhase = ''
       mkdir -p source
       cd source
-      unzip $src
-      dpkg-deb -x euro-office-desktopeditors_*.deb .
+      dpkg-deb -x ${finalAttrs.src} .
     '';
 
     nativeBuildInputs = [
@@ -106,7 +100,6 @@ let
       dpkg
       makeWrapper
       patchelfUnstable
-      unzip
       wrapGAppsHook3
     ];
 
@@ -174,12 +167,13 @@ let
 
       mv usr/bin/* $out/bin
       mv usr/share/* $out/share/
-      mv opt/euro-office/desktopeditors $out/share
+      mv opt/euro-office/* $out/share/euro-office/
 
-      substituteInPlace $out/bin/euro-office-desktopeditors \
+      substituteInPlace $out/bin/euro-office-euro-office \
         --replace-fail "/opt/euro-office/" "$out/share/"
 
-      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+      ln -s $out/share/euro-office/DesktopEditors $out/bin/DesktopEditors
+      ln -s $out/bin/euro-office-euro-office $out/bin/euro-office-desktopeditors
 
       runHook postInstall
     '';
@@ -200,7 +194,7 @@ in
 # In order to download plugins, Euro-Office uses /usr/bin/curl so we have to wrap it.
 # Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
 # Fonts are also discovered by looking in /usr/share/fonts, so adding fonts to targetPkgs will include them
-buildFHSEnv {
+buildFHSEnv (finalAttrs: {
   inherit (derivation) pname version;
 
   targetPkgs = pkgs': [
@@ -216,19 +210,19 @@ buildFHSEnv {
     mkdir -p $out/share
     ln -s ${derivation}/share/icons $out/share
     cp -r ${derivation}/share/applications $out/share
-    substituteInPlace $out/share/applications/euro-office-desktopeditors.desktop \
-        --replace-fail "/usr/bin/euro-office-desktopeditors" "$out/bin/euro-office-desktopeditors"
+    substituteInPlace $out/share/applications/euro-office-euro-office.desktop \
+        --replace-fail "/usr/bin/euro-office-euro-office" "$out/bin/euro-office-desktopeditors"
   '';
 
   meta = {
     description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
     homepage = "https://github.com/Euro-Office/DesktopEditors";
     downloadPage = "https://github.com/Euro-Office/DesktopEditors/releases";
-    changelog = "https://github.com/Euro-Office/DesktopEditors/blob/v9.3.1/CHANGELOG.md";
+    changelog = "https://github.com/Euro-Office/DesktopEditors/blob/v${finalAttrs.version}/CHANGELOG.md";
     platforms = [ "x86_64-linux" ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     license = lib.licenses.agpl3Plus;
     maintainers = [ lib.maintainers.onny ];
     mainProgram = "euro-office-desktopeditors";
   };
-}
+})

pkgs/by-name/fa/fastly/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "16.1.0";
+  version = "16.2.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xGp5Fa4ruHpc2YAAbrva0zurt4wxC6XRdSpMMQGEB7c=";
+    hash = "sha256-UCk12PYpY/dnP8HvO5UB4RH3zmaYu+gc/bz62+9fJ7o=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/fastly" ];
 
-  vendorHash = "sha256-JUYBaiAz91jv8QFrfjpHnY442+qK7T0VZJcC/rCGhD4=";
+  vendorHash = "sha256-LaWk1RIoVoOOaZ6QG2Zw4corUffi91bMOSfsRt0L/ZM=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/fi/fityk/package.nix

@@ -2,10 +2,11 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   autoreconfHook,
   wxwidgets_3_2,
   boost186,
-  lua5_2_compat,
+  lua5_5,
   zlib,
   bzip2,
   xylib,
@@ -14,7 +15,7 @@
   swig,
 }:
 let
-  lua = lua5_2_compat;
+  lua = lua5_5;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,6 +29,16 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-m2RaZMYT6JGwa3sOUVsBIzCdZetTbiygaInQWoJ4m1o=";
   };
 
+  patches = [
+    # Accept Lua 5.5 in configure (https://github.com/wojdyr/fityk/pull/64).
+    # Can be dropped at the next release.
+    (fetchpatch2 {
+      name = "fityk-detect-lua-5.5.patch";
+      url = "https://github.com/wojdyr/fityk/commit/48456231ca58211d7bcde0d2d8ac0c29cae2ab16.patch?full_index=1";
+      hash = "sha256-QkhNnGRuSP0bGqK7GtHfx2OpkEZoz8YI7M2m4f5N1Pw=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     lua

pkgs/by-name/gh/ghostfolio/package.nix

@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.79.0";
+  version = "3.86.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-ZWipbs14CiEJKSUUc4rUc/hRtC2bgsAPCEIPyZIpIak=";
+    hash = "sha256-HZ5nGH4iOPZWqGmOqioEaV4hcd+K4Aexc4IWoIr1IDs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-UzYEVKWfPpVp7HvI0b+hjEB6J0VOzjn4b/ijoQ/3BTo=";
+  npmDepsHash = "sha256-ohpGshxAfAFcDCV8mCrvFOwwY5ozSjf0u/Lab0BQ6rU=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \

pkgs/by-name/go/go-licence-detector/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-licence-detector";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "go-licence-detector";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/94rUYWS8r8rRTmMyNs93voLdK3WlzJlIQWxgGE6eaQ=";
+    hash = "sha256-EF1DN83kushDvuJFkTHawQ7DEmdhZ9BBO3XT6eZ18VA=";
   };
 
-  vendorHash = "sha256-wJ6jB8MxyYOlOpABRv5GmULofWuPQR8yClj63qsr/tg=";
+  vendorHash = "sha256-mEi/aMPdygwiQHuGU1tz82IOanOD15VYpdEePDzCwOU=";
 
   meta = {
     description = "Detect licences in Go projects and generate documentation";

pkgs/by-name/gr/gram/package.nix

@@ -129,10 +129,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mv $release_target/gram target/release/gram
 
     pushd crates/gram
-    # Note that this is GNU sed, while Gram's bundle-mac uses BSD sed
-    sed -i "s/package.metadata.bundle-stable/package.metadata.bundle/" Cargo.toml
+    # Select the stable bundle and migrate its macOS keys to cargo-bundle 0.12's schema.
+    substituteInPlace Cargo.toml \
+          --replace-fail '[package.metadata.bundle-stable]' '[package.metadata.bundle]' \
+          --replace-fail 'osx_minimum_system_version' 'osx.minimum_system_version' \
+          --replace-fail 'osx_info_plist_exts' 'osx.info_plist_exts' \
+          --replace-fail 'osx_url_schemes' 'osx.url_schemes'
     export CARGO_BUNDLE_SKIP_BUILD=true
-    app_path=$(cargo bundle --release | xargs)
+    app_path=$(cargo bundle --release --format osx | xargs)
     popd
 
     mkdir -p $out/Applications $out/bin