[Backport release-26.05] dexter: 0.6.0 -> 0.7.0 (#528130)

Diff: https://github.com/remoteoss/dexter/compare/v0.6.0...v0.7.0

Changelog: https://github.com/remoteoss/dexter/blob/refs/tags/v0.7.0/CHANGELOG.md
(cherry picked from commit c5ebd4868c)

README.md

@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
+* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
+* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).

maintainers/github-teams.json

@@ -309,8 +309,7 @@
     "members": {
       "AndersonTorres": 5954806,
       "adisbladis": 63286,
-      "panchoh": 471059,
-      "ttuegel": 563054
+      "panchoh": 471059
     },
     "name": "emacs"
   },
@@ -407,12 +406,13 @@
   "gnome": {
     "description": "Maintain GNOME desktop environment and platform.",
     "id": 3806133,
-    "maintainers": {},
+    "maintainers": {
+      "jtojnar": 705123
+    },
     "members": {
       "bobby285271": 20080233,
       "dasj19": 7589338,
-      "hedning": 71978,
-      "jtojnar": 705123
+      "hedning": 71978
     },
     "name": "GNOME"
   },
@@ -702,6 +702,7 @@
       "Mic92": 96200,
       "Radvendii": 1239929,
       "edolstra": 1148549,
+      "lisanna-dettwyler": 72424138,
       "lovesegfault": 7243783,
       "xokdvium": 145775305
     },
@@ -819,14 +820,13 @@
     "description": "Maintain the Qt framework, KDE application suite, Plasma desktop environment and related projects",
     "id": 4341481,
     "maintainers": {
-      "ttuegel": 563054
+      "K900": 386765,
+      "NickCao": 15247171,
+      "SuperSandro2000": 7258858
     },
     "members": {
       "FRidh": 2129135,
-      "K900": 386765,
       "LunNova": 782440,
-      "NickCao": 15247171,
-      "SuperSandro2000": 7258858,
       "bkchr": 5718007,
       "ilya-fedin": 17829319,
       "mjm": 1181,
@@ -896,8 +896,7 @@
     "id": 7304571,
     "maintainers": {
       "Mic92": 96200,
-      "winterqt": 78392041,
-      "zowoq": 59103226
+      "winterqt": 78392041
     },
     "members": {},
     "name": "rust"
@@ -936,6 +935,7 @@
       "infinisil": 20525370
     },
     "members": {
+      "andir": 638836,
       "pyrox0": 35778371
     },
     "name": "Security review"

maintainers/maintainer-list.nix

@@ -21387,6 +21387,12 @@
     githubId = 7420227;
     name = "Peter Tri Ho";
   };
+  peterwaller-arm = {
+    email = "peter.waller@arm.com";
+    github = "peterwaller-arm";
+    githubId = 52030119;
+    name = "Peter Waller";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";

maintainers/scripts/luarocks-packages.csv

@@ -49,6 +49,7 @@ lpeglabel,,,,1.6.0,,
 lrexlib-gnu,,,,,,
 lrexlib-oniguruma,,,,,,junestepp
 lrexlib-pcre,,,,,,
+lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -13,6 +13,7 @@
   - If you use LUKS disk encryption, ensure that `fileSystems."/".device` is set to `"/dev/mapper/<name>"`, where `<name>` matches the name in your `boot.initrd.luks.devices.<name>` definition, to avoid systemd timing out while prompting for a passphrase. If you have a more complex setup, e.g. with LVM on top of LUKS, you may need to add `"x-systemd.device-timeout=infinity"` to `fileSystems."/".options` instead. If you need to disable the timeout before you can boot into the system, pass `systemd.default_device_timeout_sec=infinity` on the kernel command line.
   - The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
   - Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
+  - `/dev/root` is not available with the systemd stage 1. In the old scripted stage 1, `/dev/root` was a symlink created by the init script from the `root=` kernel command line. With systemd stage 1, this symlink is not provided. If your configuration uses `/dev/root` in `fileSystems`, replace it with a stable device path such as `/dev/disk/by-label/...`, `/dev/disk/by-uuid/...`, or the appropriate `/dev/mapper/...` path.
 
 - The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using `nix-channel`.
   This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - Create the first release note entry in this section!
 
+- [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/config/fonts/packages.nix

@@ -47,6 +47,8 @@ in
         gyre-fonts # TrueType substitutes for standard PostScript fonts
         liberation_ttf
         unifont
+        noto-fonts-cjk-sans
+        noto-fonts-cjk-serif
         noto-fonts-color-emoji
       ]
     );

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -787,9 +787,10 @@ in
       options = [ "mode=0755" ];
     };
 
-    # Note that /dev/root is a symlink to the actual root device
-    # specified on the kernel command line, created in the stage 1
-    # init script.
+    # With systemd stage 1, the ISO is identified by its volume label.
+    # With the scripted stage 1, /dev/root is a symlink to the actual
+    # root device specified on the kernel command line, created by the
+    # stage 1 init script.
     "/iso" = lib.mkImageMediaOverride {
       device =
         if config.boot.initrd.systemd.enable then

nixos/modules/module-list.nix

@@ -1017,6 +1017,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/flap-alerted.nix
   ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix

nixos/modules/services/display-managers/default.nix

@@ -101,16 +101,7 @@ in
       };
 
       defaultSession = lib.mkOption {
-        type = lib.types.nullOr lib.types.str // {
-          description = "session name";
-          check =
-            d:
-            lib.assertMsg (d != null -> (lib.types.str.check d && lib.elem d cfg.sessionData.sessionNames)) ''
-              Default graphical session, '${d}', not found.
-              Valid names for 'services.displayManager.defaultSession' are:
-                ${lib.concatStringsSep "\n  " cfg.sessionData.sessionNames}
-            '';
-        };
+        type = lib.types.nullOr (lib.types.str // { description = "session name"; });
         default = null;
         example = "gnome";
         description = ''
@@ -130,26 +121,12 @@ in
 
       sessionPackages = lib.mkOption {
         type = lib.types.listOf (
-          lib.types.package
+          lib.types.addCheck lib.types.package (
+            p: p ? providedSessions && p.providedSessions != [ ] && lib.all lib.isString p.providedSessions
+          )
           // {
             description = "package with provided sessions";
-            check =
-              p:
-              lib.assertMsg
-                (
-                  lib.types.package.check p
-                  && p ? providedSessions
-                  && p.providedSessions != [ ]
-                  && lib.all lib.isString p.providedSessions
-                )
-                ''
-                  Package, '${p.name}', did not specify any session names, as strings, in
-                  'passthru.providedSessions'. This is required when used as a session package.
-
-                  The session names can be looked up in:
-                    ${p}/share/xsessions
-                    ${p}/share/wayland-sessions
-                '';
+            descriptionClass = "composite";
           }
         );
         default = [ ];
@@ -211,6 +188,14 @@ in
           services.displayManager.autoLogin.enable requires services.displayManager.autoLogin.user to be set
         '';
       }
+      {
+        assertion = cfg.defaultSession == null || lib.elem cfg.defaultSession cfg.sessionData.sessionNames;
+        message = ''
+          Default graphical session, '${toString cfg.defaultSession}', not found.
+          Valid names for 'services.displayManager.defaultSession' are:
+            ${lib.concatStringsSep "\n    " cfg.sessionData.sessionNames}
+        '';
+      }
     ];
 
     # Make xsessions and wayland sessions available in XDG_DATA_DIRS

nixos/modules/services/display-managers/gdm.nix

@@ -455,6 +455,22 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
+            # make sure the spawned session has the same variables as `display-manager.service`
+            # https://github.com/NixOS/nixpkgs/issues/523332
+            {
+              name = "env-greeter";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.conffile =
+                let
+                  env = config.services.displayManager.generic.environment;
+                in
+                pkgs.writeText "gdm-launch-environment-env-conf" ''
+                  PATH          DEFAULT="''${PATH}:${pkgs.gnome-session}/bin"
+                  XDG_DATA_DIRS DEFAULT="''${XDG_DATA_DIRS}:${env.XDG_DATA_DIRS}"
+                '';
+              settings.readenv = 0;
+            }
             {
               name = "systemd";
               control = "optional";

nixos/modules/services/home-automation/home-assistant.nix

@@ -30,7 +30,6 @@ let
     mapAttrsToList
     mergeAttrsList
     mkEnableOption
-    mkDefault
     mkIf
     mkMerge
     mkOption
@@ -777,7 +776,25 @@ in
     openFirewall = mkOption {
       default = false;
       type = types.bool;
-      description = "Whether to open the firewall for the specified port.";
+      description = ''
+        Whether to open the firewall for the specified frontend port
+
+        :::{.note}
+        For components specific ports see {option}`services.home-assistant.openFirewallForComponents`.
+        :::
+      '';
+    };
+
+    openFirewallForComponents = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Whether to open required firewall ports for enabled components.
+
+        :::{.note}
+        For the frontend see {option}`services.home-assistant.openFirewall`.
+        :::
+      '';
     };
 
     blueprints = mergeAttrsList (
@@ -845,7 +862,13 @@ in
       }
     ];
 
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.config.http.server_port ];
+    networking.firewall.allowedTCPPorts = mkMerge [
+      (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
+      (mkIf cfg.openFirewallForComponents
+        # https://www.home-assistant.io/integrations/sonos/#network-requirements
+        (optionals (useComponent "sonos") [ 1400 ])
+      )
+    ];
 
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [

nixos/modules/services/logging/logrotate.nix

@@ -91,9 +91,9 @@ let
       # files required to exist also won't be present, so missingok is forced.
       user=$(${pkgs.buildPackages.coreutils}/bin/id -un)
       group=$(${pkgs.buildPackages.coreutils}/bin/id -gn)
-      sed -e "s/\bsu\s.*/su $user $group/" \
-          -e "s/\b\(create\s\+[0-9]*\s*\|createolddir\s\+[0-9]*\s\+\).*/\1$user $group/" \
-          -e "1imissingok" -e "s/\bnomissingok\b//" \
+      sed -E -e "s/\bsu\s.*/su $user $group/" \
+             -e "s/\b((create|createolddir)\b(\s+[0-9]+)?).*/\1 $user $group/" \
+             -e "1imissingok" -e "s/\bnomissingok\b//" \
           $out > logrotate.conf
       # Since this makes for very verbose builds only show real error.
       # There is no way to control log level, but logrotate hardcodes

nixos/modules/services/monitoring/flap-alerted.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.flap-alerted;
+
+  settingsArgs = lib.pipe cfg.settings [
+    (lib.mapAttrsToList (
+      name: value:
+      if value == null || value == false then
+        [ ]
+      else if value == true then
+        [ "-${name}" ]
+      else
+        [
+          "-${name}"
+          (toString value)
+        ]
+    ))
+    lib.concatLists
+  ];
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.flap-alerted = {
+    enable = lib.mkEnableOption "FlapAlerted";
+
+    package = lib.mkPackageOption pkgs "flap-alerted" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/flap-alerted.env" ];
+      description = ''
+        Files to load environment variables from.
+        This is useful to avoid putting secrets into the nix store.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra command line arguments to pass to FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = [ ];
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.int
+              lib.types.bool
+            ]
+          )
+        );
+
+        options = {
+          asn = lib.mkOption {
+            type = lib.types.ints.u32;
+            description = "Your ASN number";
+          };
+
+          bgpListenAddress = lib.mkOption {
+            type = lib.types.str;
+            description = "Address to listen on for incoming BGP connections";
+            default = ":1790";
+          };
+
+          debug = lib.mkOption {
+            type = lib.types.bool;
+            description = "Enable debug mode (produces a lot of output)";
+            default = false;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.flap-alerted = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "flap-alerted";
+        Group = "flap-alerted";
+        DynamicUser = true;
+
+        EnvironmentFile = cfg.environmentFiles;
+
+        ExecStart = lib.escapeShellArgs ([ (lib.getExe cfg.package) ] ++ settingsArgs ++ cfg.extraArgs);
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/modules/services/networking/wpa_supplicant.nix

@@ -123,7 +123,8 @@ let
             # set up imperative config file
             "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
             "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /etc/wpa_supplicant/imperative.conf"
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory

nixos/modules/services/security/jitterentropy-rngd.nix

@@ -26,6 +26,11 @@ in
       default = false;
       description = "Force SP800-90B mode for entropy reading";
     };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
     verbose = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -56,6 +61,12 @@ in
           # use service from package with our configured args
           "${cfg.package}/bin/jitterentropy-rngd ${args}"
         ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
       };
     };
 

nixos/modules/services/torrent/transmission.nix

@@ -238,10 +238,10 @@ in
         default = null;
         example = "770";
         description = ''
-          If not `null`, is used as the permissions
-          set by `system.activationScripts.transmission-daemon`
-          on the directories [](#opt-services.transmission.settings.download-dir),
-          [](#opt-services.transmission.settings.incomplete-dir).
+          If not `null`, is used as the permissions set by
+          `transmission-setup.service` on the directories
+          [](#opt-services.transmission.settings.download-dir),
+          [](#opt-services.transmission.settings.incomplete-dir)
           and [](#opt-services.transmission.settings.watch-dir).
           Note that you may also want to change
           [](#opt-services.transmission.settings.umask).

nixos/modules/services/web-apps/weblate.nix

@@ -9,6 +9,7 @@ let
   cfg = config.services.weblate;
 
   dataDir = "/var/lib/weblate";
+  cacheDir = "${dataDir}/cache";
   settingsDir = "${dataDir}/settings";
 
   finalPackage = cfg.package.overridePythonAttrs (old: {
@@ -362,6 +363,18 @@ in
       ];
       inherit environment;
       path = weblatePath;
+      # Weblate generates SSH wrappers with some preset options that use the
+      # absolute paths of the ssh and scp binaries internally.
+      # As the wrapper is only regenerated when the generator itself is changed,
+      # this absolute nix store path becomes unusable once ssh is updated and
+      # the path is garbage collected.
+      # As generating the wrappers is a quick operation, simply deleting the
+      # wrapper directory before service start ensures they are up to date.
+      preStart = ''
+        if [ -d "${cacheDir}/ssh" ]; then
+          rm -r "${cacheDir}/ssh"
+        fi
+      '';
       serviceConfig = {
         Type = "notify";
         NotifyAccess = "all";

nixos/modules/system/activation/activation-script.nix

@@ -322,6 +322,9 @@ in
         description = "Run user-specific NixOS activation";
         script = config.system.userActivationScripts.script;
         unitConfig.ConditionUser = "!@system";
+        # switch-to-configuration restarts this explicitly on every switch.
+        restartIfChanged = false;
+        serviceConfig.RemainAfterExit = true;
         serviceConfig.Type = "oneshot";
         wantedBy = [ "default.target" ];
       };

nixos/modules/system/activation/pre-switch-check.nix

@@ -8,9 +8,18 @@ let
   preSwitchCheckScript = lib.concatLines (
     lib.mapAttrsToList (name: text: ''
       # pre-switch check ${name}
-      if ! (
+      #
+      # Run with errexit in a subshell that is not part of an `if`/`||`
+      # condition, so that `set -e` is actually honoured inside the
+      # check body.
+      set +e
+      (
+        set -e
         ${text}
-      ) >&2 ; then
+      ) >&2
+      _rc=$?
+      set -e
+      if [ "$_rc" -ne 0 ]; then
         echo "Pre-switch check '${name}' failed" >&2
         exit 1
       fi

nixos/modules/system/boot/kernel_config.nix

@@ -29,9 +29,7 @@ let
       };
 
       freeform = mkOption {
-        type = types.nullOr types.str // {
-          merge = mergeEqualOption;
-        };
+        type = types.nullOr types.str;
         default = null;
         example = ''MMC_BLOCK_MINORS.freeform = "32";'';
         description = ''

nixos/modules/virtualisation/lxcfs.nix

@@ -41,7 +41,7 @@ in
       serviceConfig = {
         ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
         ExecStart = "${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
-        ExecStopPost = "-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
+        ExecStopPost = "-${pkgs.fuse3}/bin/fusermount3 -u /var/lib/lxcfs";
         KillMode = "process";
         Restart = "on-failure";
       };

nixos/tests/all-tests.nix

@@ -596,6 +596,7 @@ in
   firezone = runTest ./firezone/firezone.nix;
   fish = runTest ./fish.nix;
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
+  flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;

nixos/tests/caddy.nix

@@ -73,7 +73,7 @@
           services.caddy = {
             package = pkgs.caddy.withPlugins {
               plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-              hash = "sha256-kKWXpxEAn23yud8tcgw7FFOaxLjoodZ/cuM1239TRoY=";
+              hash = "sha256-0N/bQAM5yT6g9UAteWsfxofGcelmU/NDTroS2oL43Gs=";
             };
             configFile = pkgs.writeText "Caddyfile" ''
               {

nixos/tests/flap-alerted.nix

@@ -0,0 +1,128 @@
+{ config, lib, ... }:
+
+{
+  name = "flap-alerted";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.flap-alerted = {
+      enable = true;
+      settings = {
+        asn = 4213370001;
+        bgpListenAddress = ":1790";
+        routeChangeCounter = 5;
+        overThresholdTarget = 1;
+      };
+    };
+
+    services.bird = {
+      enable = true;
+      preCheckConfig = ''
+        mkdir -p /tmp/bird
+        touch /tmp/bird/routes.conf
+      '';
+      config = ''
+        router id 192.168.1.1;
+
+        protocol device { }
+
+        protocol bgp flapalerted {
+          local 2001:db8:1::1 as 4213370001;
+          neighbor ::1 as 4213370001 port 1790;
+
+          ipv4 {
+            add paths on;
+            export all;
+            import none;
+            extended next hop on;
+          };
+
+          ipv6 {
+            add paths on;
+            export all;
+            import none;
+          };
+        }
+
+        protocol static {
+          include "/tmp/bird/routes.conf";
+
+          ipv4 {
+            import all;
+            export none;
+          };
+        }
+      '';
+    };
+
+    systemd.services.bird.serviceConfig.BindReadOnlyPaths = [ "/tmp/bird" ];
+
+    systemd.tmpfiles.settings.bird-static-routes."/tmp/bird/routes.conf".f = { };
+  };
+
+  interactive.sshBackdoor.enable = true;
+  interactive.defaults.virtualisation.graphics = false;
+
+  interactive.nodes.machine = {
+    services.flap-alerted.settings.httpAPIListenAddress = ":8699";
+    networking.firewall.allowedTCPPorts = [ 8699 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8699;
+        guest.port = 8699;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+    import random
+    import time
+
+    machine.log(machine.succeed("systemd-analyze security flap-alerted.service --threshold=11 --no-pager"))
+
+    machine.wait_for_unit("bird.service")
+    machine.wait_for_unit("flap-alerted.service")
+    machine.wait_for_open_port(1790)
+    machine.wait_for_open_port(8699)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/capabilities"))
+    expected_version = "v${config.nodes.machine.services.flap-alerted.package.version}"
+    assert resp["Version"] == expected_version
+
+    for _ in range(10):
+      resp = json.loads(machine.succeed("curl localhost:8699/sessions"))
+      if len(resp) == 1: break
+      time.sleep(1)
+    else:
+      assert False, "failed to establish bgp session"
+    assert resp[0]["RouterID"] == "192.168.1.1"
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert resp == []
+
+    def flap():
+      route = lambda idx, gw: f"""
+        route 10.0.{idx}.0/24 via 10.254.254.{gw} dev \"eth0\" onlink {{
+          bgp_path.prepend(4213370002);
+          bgp_path.prepend({4213370002 + gw});
+        }};
+      """
+      with open("routes.conf", "w") as f:
+        for i in range(1, 4): # stable routes
+          f.write(route(i, i))
+        for i in range(4, 7): # flappy routes
+          f.write(route(i, random.randint(1, 254)))
+      machine.copy_from_host("routes.conf", "/tmp/bird/routes.conf")
+      machine.succeed("birdc configure")
+
+    t = time.time()
+    while time.time() - t < 70:
+      flap()
+      time.sleep(1)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert sorted(x["Prefix"] for x in resp) == ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+  '';
+}

nixos/tests/incus/incus-tests-module.nix

@@ -1,10 +1,12 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
 let
   jsonFormat = pkgs.formats.json { };
+  cfg = config.tests.incus;
 in
 {
   options.tests.incus = {
@@ -74,7 +76,11 @@ in
             config =
               let
                 releases = import ../../release.nix {
-                  configuration = config.nixosConfig;
+                  configuration = lib.recursiveUpdate config.nixosConfig {
+                    virtualisation.incus = {
+                      inherit (cfg) package;
+                    };
+                  };
                 };
 
                 images = {

nixos/tests/logrotate.nix

@@ -66,8 +66,10 @@ in
             checkConf = {
               su = "root utmp";
               createolddir = "0750 root utmp";
+              "createolddir " = "0750";
               create = "root utmp";
               "create " = "0750 root utmp";
+              "create  " = "0750";
             };
             # multiple paths should be aggregated
             multipath = {

nixos/tests/switch-test.nix

@@ -739,6 +739,22 @@ in
             '';
           };
 
+          # As above, but with reloadIfChanged: pass 2 must reload, not
+          # restart.
+          userServiceMigratedToNixosReloadOnly.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated = {
+              reloadIfChanged = true;
+              serviceConfig.ExecReload = "${pkgs.coreutils}/bin/true";
+            };
+          };
+
+          # As above, but with restartIfChanged = false: pass 2 must skip it.
+          userServiceMigratedToNixosNoRestart.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated.restartIfChanged = false;
+          };
+
           no_inhibitors.configuration.system.switch.inhibitors = lib.mkForce { };
 
           inhibitors.configuration.system.switch.inhibitors = lib.mkForce {
@@ -772,6 +788,11 @@ in
         echo this will fail
         false
       '';
+      specialisation.failingMidCheck.configuration.system.preSwitchChecks.failsInTheMiddle = ''
+        echo before
+        nonexistent-command
+        echo after
+      '';
     };
   };
 
@@ -810,6 +831,15 @@ in
         RemainAfterExit=true
         ExecStart=${pkgs.runtimeShell} -c 'echo home > %t/migrated-owner'
       '';
+
+      # Unit file placed in ~/.local/share/systemd/user (lower priority than
+      # /etc) to simulate a package-shipped unit.
+      dataMigratedUnit = pkgs.writeText "migrated.service" ''
+        [Service]
+        Type=oneshot
+        RemainAfterExit=true
+        ExecStart=${pkgs.runtimeShell} -c 'echo data > %t/migrated-owner'
+      '';
     in
     # python
     ''
@@ -863,6 +893,11 @@ in
           machine.succeed("${stderrRunner} ${otherSystem}/bin/switch-to-configuration check")
           out = switch_to_specialisation("${otherSystem}", "failingCheck", action="check", fail=True)
           assert_contains(out, "this will fail")
+          # errexit must be honoured inside the check body
+          out = switch_to_specialisation("${otherSystem}", "failingMidCheck", action="check", fail=True)
+          assert_contains(out, "before")
+          assert_contains(out, "Pre-switch check 'failsInTheMiddle' failed")
+          assert_lacks(out, "after")
 
       with subtest("switch inhibitors"):
           # Start without any inhibitors
@@ -1729,9 +1764,10 @@ in
           out = switch_to_specialisation("${machine}", "simpleUserService")
           user_systemctl("is-active usertest.service")
 
-          # No-op switch does nothing
+          # No-op switch leaves the test unit alone.
           out = switch_to_specialisation("${machine}", "simpleUserService")
-          assert_lacks(out, "user units:")
+          assert_lacks(out, "usertest.service")
+          assert_contains(out, "restarting the following user units: nixos-activation.service")
 
           # Modifying the unit stop-starts it (default stopIfChanged=true)
           out = switch_to_specialisation("${machine}", "simpleUserServiceModified")
@@ -1748,7 +1784,7 @@ in
           # reloadIfChanged=true reloads instead
           out = switch_to_specialisation("${machine}", "simpleUserServiceReload")
           assert_lacks(out, "stopping the following user units:")
-          assert_lacks(out, "restarting the following user units:")
+          assert_lacks(out, "restarting the following user units: usertest.service")
           assert_contains(out, "reloading the following user units: usertest.service")
           user_systemctl("is-active usertest.service")
 
@@ -1818,6 +1854,59 @@ in
           out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
           assert_contains(out, "nixos")
 
+          # Pass 2 must honour reloadIfChanged.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosReloadOnly")
+          assert_lacks(out, "restarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "reloading (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          # Reloaded only, so the home ExecStart never re-ran.
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Pass 2 must honour restartIfChanged = false.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosNoRestart")
+          assert_lacks(out, "\nrestarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "NOT restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Migration from a lower-priority search-path entry ($XDG_DATA_HOME
+          # here, standing in for ~/.nix-profile/share etc.). /etc outranks
+          # these, so pass 2 must restart onto the /etc definition.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          machine.succeed(
+              "sudo -u usertest mkdir -p ~usertest/.local/share/systemd/user",
+              "sudo -u usertest cp ${dataMigratedUnit} ~usertest/.local/share/systemd/user/migrated.service",
+          )
+          user_systemctl("daemon-reload")
+          user_systemctl("start migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "data")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/.local/share/systemd/user/migrated.service")
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_contains(out, "restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/etc/systemd/user/migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "nixos")
+          # Switching again must NOT touch it: /etc already had it, so it is
+          # not a candidate even though the lower-priority copy is still there.
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_lacks(out, "migrated.service")
+          machine.succeed("sudo -u usertest rm -rf ~usertest/.local/share/systemd")
+          user_systemctl("daemon-reload")
+
           # Units that remain shadowed by ~/.config must be left alone in both
           # passes even though /etc now also defines them.
           switch_to_specialisation("${machine}", "")

nixos/tests/user-activation-scripts.nix

@@ -13,12 +13,14 @@
       isNormalUser = true;
     };
     systemd.user.tmpfiles.users.alice.rules = [ "r %h/file-to-remove" ];
+    specialisation.changed.configuration.system.userActivationScripts.bar = "true";
   };
 
   testScript = ''
     def verify_user_activation_run_count(n):
-        machine.succeed(
-            '[[ "$(find /home/alice/ -name user-activation-ran.\\* | wc -l)" == %s ]]' % n
+        t.assertEqual(
+            n,
+            int(machine.succeed('find /home/alice/ -name user-activation-ran.\\* | wc -l').rstrip())
         )
 
 
@@ -36,5 +38,12 @@
     machine.succeed("/run/current-system/bin/switch-to-configuration test")
     verify_user_activation_run_count(2)
     machine.succeed("[[ ! -f /home/alice/file-to-remove ]] || false")
+    # Activation must not be killed while running.
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
+
+    # Changed activation script: still exactly one run.
+    machine.succeed("/run/current-system/specialisation/changed/bin/switch-to-configuration test")
+    verify_user_activation_run_count(3)
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
   '';
 }

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -13,18 +13,18 @@
   writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.8.0";
+  version = "0.8.4";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff.nvim";
     tag = "v${version}";
-    hash = "sha256-JbV2dTQhTyZgDZYvFoR1mz9CeM2IPv59Qmp2iiJC8a0=";
+    hash = "sha256-w88NovzYVTiUVZmgvvmRvRq1didlbxMJYtKj1A3VB/Y=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-L/Ens/wzw/jKaa1T3A2pLIBKs09saPEk/0bRhgRezPQ=";
+    cargoHash = "sha256-2LGrohseOYdroUFY3cHy57HzgfS34CBuIbN1AFuYTUg=";
 
     cargoBuildFlags = [
       "-p"
@@ -65,9 +65,12 @@ let
       openssl
     ];
 
-    # This test requires curl and GitHub access
     checkFlags = [
+      # This test requires curl and GitHub access
       "--skip=update_check::tests::test_update_check_end_to_end"
+
+      # This test depends on catching a race window and is not deterministic
+      "--skip=drop_during_post_scan_does_not_crash"
     ];
 
     env = {

pkgs/applications/editors/vscode/update-vscodium.sh

@@ -5,9 +5,11 @@ set -eou pipefail
 
 latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/VSCodium/vscodium/releases/latest | jq -r ".tag_name")
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; vscodium.version or (lib.getVersion vscodium)" | tr -d '"')
+latestUpstream=$(curl -sL "https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/$latestVersion/upstream/stable.json" | jq -r ".tag")
 
 echo "latest  version: $latestVersion"
 echo "current version: $currentVersion"
+echo "latest upstream version: $latestUpstream"
 
 if [[ "$latestVersion" == "$currentVersion" ]]; then
     echo "package is up-to-date"
@@ -25,3 +27,5 @@ for i in \
     hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
     update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
+
+update-source-version vscodium $latestUpstream --version-key=vscodeVersion --ignore-same-version --ignore-same-hash

pkgs/applications/editors/vscode/vscodium.nix

@@ -44,6 +44,7 @@ buildVscode rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
   version = "1.116.02821";
+  vscodeVersion = "1.116.0";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/emulators/cdemu/vhba.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vhba";
-  version = "20250329";
+  version = "20260313";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${finalAttrs.version}.tar.xz";
-    hash = "sha256-piog1yDd8M/lpTIo9FE9SY2JwurZ6a8LG2lZ/4EmB14=";
+    hash = "sha256-KTADv12dwrOG2w0F9ZXFVINVpTXW38Bv03n9mLsZAXQ=";
   };
 
   makeFlags = kernelModuleMakeFlags ++ [

pkgs/applications/networking/browsers/chromium/common.nix

@@ -621,7 +621,7 @@ let
       # clang++: error: unknown argument: '-fno-lifetime-dse'
       ./patches/chromium-147-llvm-22.patch
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "148" && lib.versionOlder llvmVersion "23") [
+    ++ lib.optionals (versionRange "148" "149" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
       (fetchpatch {
         name = "chromium-148-revert-build-Add--fsanitizer=return-config.patch";
@@ -651,7 +651,22 @@ let
         hash = "sha256-jR0G9z2R8VGl2tkB3u0368RyWM1J6qYXqNWwKkYd5zU=";
       })
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "148") [
+    ++ lib.optionals (chromiumVersionAtLeast "149" && lib.versionOlder llvmVersion "23") [
+      # clang++: error: unknown argument: '-fdiagnostics-show-inlining-chain'
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
+      ./patches/chromium-149-llvm-22.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "149" && stdenv.hostPlatform.isAarch64) [
+      # [43731/56364] CXX obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o
+      # FAILED: [code=1] obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o
+      # clang++ -MD -MF obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o.d [...]
+      # ../../media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc:123:9: error: use of undeclared identifier 'ERROR'
+      #   123 |     LOG(ERROR) << "dlopen(radeonsi_dri.so) failed with error: " << dlerror();
+      #       |         ^~~~~
+      ./patches/chromium-149-use-of-undeclared-identifier-ERROR.patch
+    ]
+    ++ lib.optionals (versionRange "148" "149") [
       # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
       (fetchpatch {
         name = "chromium-148-revert-Reland-build-use-tool-inputs-instead-of-siso-config-for-rust-actions.patch";
@@ -792,6 +807,12 @@ let
         mkdir -p third_party/gperf/cipd/bin
         ln -s "${pkgsBuildHost.gperf}/bin/gperf" third_party/gperf/cipd/bin/gperf
       ''
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7719879
+      # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
+      + lib.optionalString (chromiumVersionAtLeast "149") ''
+        mkdir -p third_party/rust-toolchain/bin
+        ln -s "${buildPackages.rustc}/bin/rustc" third_party/rust-toolchain/bin/rustc
+      ''
       +
         lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform && stdenv.hostPlatform.isAarch64)
           ''
@@ -973,7 +994,11 @@ let
     # Mute some warnings that are enabled by default. This is useful because
     # our Clang is always older than Chromium's and the build logs have a size
     # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    env.NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow";
+    env.NIX_CFLAGS_COMPILE =
+      "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
+      # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
+      # because of hardeningDisable = [ "strictflexarrays1" ];
+      + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
     env.BUILD_CC = "$CC_FOR_BUILD";
     env.BUILD_CXX = "$CXX_FOR_BUILD";
     env.BUILD_AR = "$AR_FOR_BUILD";

pkgs/applications/networking/browsers/chromium/patches/chromium-149-llvm-22.patch

@@ -0,0 +1,30 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index f977c9fed76e6f50c50351ca22128e8c8c8897b1..81460f3591b734f3354a6f9ac7bb0990e5b28889 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -589,7 +589,7 @@ config("compiler") {
+     # Flags for diagnostics.
+     cflags += [ "-fcolor-diagnostics" ]
+     if (!is_win) {
+-      cflags += [ "-fdiagnostics-show-inlining-chain" ]
++      cflags += [ ]
+     } else {
+       # Combine after https://github.com/llvm/llvm-project/pull/192241
+       cflags += [ "/clang:-fdiagnostics-show-inlining-chain" ]
+@@ -1911,7 +1911,7 @@ config("clang_warning_suppression") {
+ # See also: https://crbug.com/40891132#comment10
+ ubsan_hardening("c_array_bounds") {
+   sanitizer = "array-bounds"
+-  condition = !(is_asan && target_cpu == "x86")
++  condition = false
+ 
+   # Because we've enabled array-bounds sanitizing we also want to suppress
+   # the related warning about "unsafe-buffer-usage-in-static-sized-array",
+@@ -1925,6 +1925,7 @@ ubsan_hardening("c_array_bounds") {
+ # `NOTREACHED()` at the end of such functions.
+ ubsan_hardening("return") {
+   sanitizer = "return"
++  condition = false
+ }
+ 
+ config("rustc_revision") {

pkgs/applications/networking/browsers/chromium/patches/chromium-149-use-of-undeclared-identifier-ERROR.patch

@@ -0,0 +1,12 @@
+diff --git a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
+index 58ab0db508f73dbac36a84cb71ffdad972b3fc3c..b5b97f6c6b22a79fd5e4e53393859a107cc0f399 100644
+--- a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
++++ b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
+@@ -7,6 +7,7 @@
+ #include <dlfcn.h>
+ #include <sys/stat.h>
+ 
++#include "base/logging.h"
+ #include "base/process/process_metrics.h"
+ #include "base/strings/stringprintf.h"
+ #include "build/build_config.h"

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "151.0.2";
+  version = "151.0.3";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "87308953ed354a2799a9a45be40033bf9ff8d80fa220f034aacfbd6e754716901d4164c37fa56032c659b259116603e0ba2b566c1f3651ab9cc0835d502cd739";
+    sha512 = "511723e5cf042abb66cbeda89b78d42de8d1b53544565670173f3e69c2a7ceefc76468c90576221418bfc9b122151ec117978caa4823cfb9b80797f3064bd895";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -228,7 +228,7 @@ let
           terminal = false;
         }
         // (
-          if libName == "thunderbird" then
+          if lib.strings.hasPrefix "thunderbird" libName then
             {
               genericName = "Email Client";
               comment = "Read and write e-mails or RSS feeds, or manage tasks on calendars.";
@@ -413,7 +413,7 @@ let
           done
 
           # Disable update checks
-          touch $out/${libDir}/is-packaged-app
+          touch "$out/${libDir}/is-packaged-app"
 
           cd "$out"
 

pkgs/applications/networking/cluster/k3s/1_33/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "234a24f45c7d767cd850a7265257d4d2d7c2cc5ac3ca8e67a94f359766ec547d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "6a29f795a718e0b7a11b81b4f8a342764a90b78a83a57ad6e1b90d81c3718290"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "71cd029a49fae4893970132b0136b217b133de4dbb4ba0107f3b82ec4867734d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "1ec9755fbe791b710b176c12f66160e19b31605345c92f3b5916176976f813a8"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "41ceeb0249f8d53cbf3ead7ff70374c292c121f991af0e3a491ff66d48a99d41"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "893e395bbee35745e32aaa4e421aaf0c88e685739edc5658f9bf573a95a86782"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "4d826c3f62a3d58f6da34e4369c4a64f0997b2c963423e1890e5bda70e55dc6b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1613727aaa8ae55a1a597a2914faf9ab909a710e175a26b4652754b25ab01337"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "5c5f6d62105b620cda23099b63146d3cb8698e437a2c0c8e770a17578b174eeb"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "5fa48235a216c9dfcaefcd344597d221adf16aa583a0ca9d9b4094e4c9c1ef5f"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "e4ca9bf05aab34f10fa792f894ab214aeaac30be31b6d91918b036216d753efa"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "ec56b324e405a3990b9ee16b5aa39bfb636ce88a127869685c042944caf38835"
   }
 }

pkgs/applications/networking/cluster/k3s/1_33/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.33.11+k3s1";
-  k3sCommit = "c532325bce6b1fa03be983cca3a8b4b84eea72a6";
-  k3sRepoSha256 = "1gzpazgi0bhqp4bqlp1s7gxqlh2wq2s8n31khy83kdhz22i6dipb";
-  k3sVendorHash = "sha256-rFH0Z66J6NHP+iscHDsr5rDkVLLkXeVuXTlT9hEhubw=";
+  k3sVersion = "1.33.12+k3s1";
+  k3sCommit = "35e4874312bcfd643320c7f7cb225f7063cb9e4e";
+  k3sRepoSha256 = "1md7w6n9iz3nk63rnf4ahs66d2vg3gfc5frksar2iw3kcv99bhmc";
+  k3sVendorHash = "sha256-O0HIcCzrKGR8NkMoDfaD1wPbAttHt0kEpVjr/kOLMu8=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -17,5 +17,5 @@
   flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s2";
-  helmJobVersion = "v0.9.17-build20260422";
+  helmJobVersion = "v0.10.0-build20260513";
 }

pkgs/applications/networking/cluster/k3s/1_34/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "4c81d96db507206816c341e79c113692d9f6c1515d0f2cd82f3c95376f09e7f3"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "2a5f910bb31b8674dff61f55a242b8dacb553894a50d66ea3c2dbf4ec8931345"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1d98b5f32c85ae41371851e6c14b81bdb8960177b28ccd1deda55c1a05586704"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "c1a261f664a58664aab975ba5c861d872c825d4f8ccc391c649283bf2c1663cf"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "da9fb4db5e14d8ebaf173718f1df8ed68c80f56ea725e5c7b19c0c2b216f538a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "a14b0421af4e4afe70010886cf66eb99b2cb48e1f810269bae47dad5c8bbc2c7"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "9880d9f56c5ec9b61714aa27caab365b237f51ec272e27cfc3bfead5ae60eeee"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "b6dba85a8470f95ab2a57658bb5ac2adfcf3e3c0634501e7b87d6904f32308d6"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "7702e62ebf167bdc9d8f4b3eda18544339c839f456746389d8fceea8be379d3e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "dbb6f771024fbf07a85d57fb77d43a59a4cd712684e819dd31f9633088c3f99e"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "4c9514a2874c592813285fac36ff6a9f7e65febc426af73a7ac3ececa1804d6d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "984dc4a2050e1bde1b57ac8a07ce6639a56151a3b57cee0616220bc680c65041"
   }
 }

pkgs/applications/networking/cluster/k3s/1_34/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.34.7+k3s1";
-  k3sCommit = "757f14939dd335fb5d7a839a9980382da9cdedf7";
-  k3sRepoSha256 = "0f4mp23hnn5w5km0ymj66vpjjdh6m0xkrs87lfpm0gf2j9ba1vn5";
-  k3sVendorHash = "sha256-MrWZp43SVKWboUs3RasZXBmZD3dDYWWZewKbXkJvsiA=";
+  k3sVersion = "1.34.8+k3s1";
+  k3sCommit = "fb21251ee14ffbec9a2ba5d8ff25a7aa1221fbe3";
+  k3sRepoSha256 = "18f2mhhn7nz8lri1qbjja5nfjncsadra9wrqxxgprfg5lx7fi3a2";
+  k3sVendorHash = "sha256-jikPQgyQ4ApWPF+iHYjL7H6ccWcC1x/JEABluJyzmfs=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -17,5 +17,5 @@
   flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s3";
-  helmJobVersion = "v0.9.17-build20260422";
+  helmJobVersion = "v0.10.0-build20260513";
 }

pkgs/applications/networking/cluster/k3s/1_35/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "cb7609c41885b65452fd8e4b5ad4621e39ef31a1894c9b416e2ca369aea673bd"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "b25863ba596e81ee773b462edc1b7ee26e80ff8e675c983115464372713237ac"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "2740585f773e1461b2a5b9976a1291a7a554b85f4538228e34cc67b03f690ca5"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "c1a261f664a58664aab975ba5c861d872c825d4f8ccc391c649283bf2c1663cf"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "ef1366c55b9ee109a8452d9fdeb3d5cfc00927e0f24f227ff57ec0e54b34f7ae"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "5b9fc436d67f0ca941084c512715f2ea21e6c66732144145788f1403ffd6c082"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b09ebf9407e9c2901f13d4921304d83abf9bbd4e1222fb5a2a6d91ac9622a2e3"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1613727aaa8ae55a1a597a2914faf9ab909a710e175a26b4652754b25ab01337"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "6bba0489d0b1ac542a9fcca64a6cf367ae6423f6e17478cca40f0ea4cfd01d31"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "bc085e02004382b15413e98457079e2a0a3d8f18b3c9a4a58917f1bc6064ea29"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "3ddac18185a554b42d53e79d80954ca7841ce48f511afe75fdf8485e0d88efe7"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "0bf33db3b0595166f1c36a6780ebd789343f50f23a4d61157519ada4d002919d"
   }
 }

pkgs/applications/networking/cluster/k3s/1_35/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.35.4+k3s1";
-  k3sCommit = "5dc8fe6894219e2156c2ba82b1bee84cad674694";
-  k3sRepoSha256 = "0ilsxhfnn30h0lfajn6awz396g7ygm9n2syzsf09k0g1mv741gib";
-  k3sVendorHash = "sha256-PzRBM5cSCF3cGIEdvUrQ4x4PyV7rBpMZVP+tYJDH6oo=";
+  k3sVersion = "1.35.5+k3s1";
+  k3sCommit = "6a4781ad53ee5cad273bedcd9462ae36ac97d798";
+  k3sRepoSha256 = "1m6sy7p5v3kkg66mzsna9c4d1f7ly843ii42zmb2a26vxa0dicx3";
+  k3sVendorHash = "sha256-czE0ZJ9yWc3VSuPqjy4V+ViBGPriluMPmUK5aTk4DmY=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -17,5 +17,5 @@
   flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s3";
-  helmJobVersion = "v0.9.17-build20260422";
+  helmJobVersion = "v0.10.0-build20260513";
 }

pkgs/applications/networking/cluster/k3s/1_36/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "1b6dbb5cebc30c3218a5910a6c0503d2cd9a92a8c494d323c12c181d8d90e525"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "8aad05e71764f08eae8d4db9e5d42d892dce39c9eb79206514c4ee03f4293db1"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1d98b5f32c85ae41371851e6c14b81bdb8960177b28ccd1deda55c1a05586704"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "72cf836bfcf8f9af2de88102b69129d297b77a60243895a7ac4bc47d77a65079"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "d7ad1e1cb378e4638a92cee9358390b047adfc4c2d5f8fcb1247903c900255e2"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "639f155016f956764b212a1671a6e090100016505b34d3f45e76513fdd93cb5f"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "9880d9f56c5ec9b61714aa27caab365b237f51ec272e27cfc3bfead5ae60eeee"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "4b16cc7a17bac0957db9df4ad937ce52792a696b0eb60944b52eb65447a0d1fa"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "2807168a82c3f9657540ac272afa186e6cf360cb068c35e5cad2e9447a8947a1"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "bc84f7965ef5f3a7e45e9f79f1090ef066fdd9bdb96d476c5d37cb13d0c2935b"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "65959cea20b4448096f6cd36e84b567dace2bf14f54c577de90c0b93ca559d2a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "174e1e7cf8493ea8fb2550231de3e93fc2f3cec27f977236fd7ab90a18680eed"
   }
 }

pkgs/applications/networking/cluster/k3s/1_36/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.36.0+k3s1";
-  k3sCommit = "09347304fd829ba8e9378bb16fe20bacba939e27";
-  k3sRepoSha256 = "1qdwqbfngxxzfjcq263lfhrp8khv6mi2a9yw06v0jswh41r42m3c";
-  k3sVendorHash = "sha256-Qli3CgKlUBhc8fwIJVB/89QH/jYXHn2K7y491BEj0Sk=";
+  k3sVersion = "1.36.1+k3s1";
+  k3sCommit = "a9663261a7ff40522542485a6b2f81916b6d72f9";
+  k3sRepoSha256 = "0788034bw5pl8ikfb16fvdhl8a3dhhfasrbafir6s9fb8q9h3z4z";
+  k3sVendorHash = "sha256-jX/qoRhVLZy/25fdhp5NOiRSGEatV/acBbSpjhutAzU=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
@@ -17,5 +17,5 @@
   flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s5";
-  helmJobVersion = "v0.9.17-build20260422";
+  helmJobVersion = "v0.10.0-build20260513";
 }

pkgs/applications/networking/irc/weechat/default.nix

@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.0";
+  version = "4.9.1";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-fLubJ/JafS8djEJqCPjmJe77wdPlm793WSVET3I5S28=";
+    hash = "sha256-BJYLVuHdhhJ/Y8+P0Bu/93yBQvQK6KlBrD22QtMQzek=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031
@@ -199,7 +199,7 @@ stdenv.mkDerivation rec {
       on https://nixos.org/nixpkgs/manual/#sec-weechat .
     '';
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ ncfavier ];
+    maintainers = with lib.maintainers; [ abbe ];
     mainProgram = "weechat";
     platforms = lib.platforms.unix;
   };

pkgs/applications/networking/syncthing/default.nix

@@ -1,151 +0,0 @@
-{
-  pkgsBuildBuild,
-  go,
-  buildGoModule,
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  nixosTests,
-  autoSignDarwinBinariesHook,
-  nix-update-script,
-}:
-
-let
-  common =
-    {
-      stname,
-      target,
-      postInstall ? "",
-    }:
-    buildGoModule rec {
-      pname = stname;
-      version = "2.0.15";
-
-      src = fetchFromGitHub {
-        owner = "syncthing";
-        repo = "syncthing";
-        tag = "v${version}";
-        hash = "sha256-v77ovjV+UoCRA1GteP+HDqC8dsRvtOhFX/IkSgSIf8Y=";
-      };
-
-      vendorHash = "sha256-boYTLgvH+iWlh3y3Z0LPvSVGEget3X94AthtJKphhCw=";
-
-      nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-        # Recent versions of macOS seem to require binaries to be signed when
-        # run from Launch Agents/Daemons, even on x86 devices where it has a
-        # more lax code signing policy compared to Apple Silicon. So just sign
-        # the binaries on both architectures to make it possible for launchd to
-        # auto-start Syncthing at login.
-        autoSignDarwinBinariesHook
-      ];
-
-      doCheck = false;
-
-      env = {
-        BUILD_USER = "nix";
-        BUILD_HOST = "nix";
-      };
-
-      buildPhase = ''
-        runHook preBuild
-        (
-          export GOOS="${pkgsBuildBuild.go.GOOS}" GOARCH="${pkgsBuildBuild.go.GOARCH}" CC=$CC_FOR_BUILD
-          go build build.go
-          go generate github.com/syncthing/syncthing/lib/api/auto github.com/syncthing/syncthing/cmd/infra/strelaypoolsrv/auto
-        )
-        ./build -goos ${go.GOOS} -goarch ${go.GOARCH} -no-upgrade -version v${version} build ${target}
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preInstall
-        install -Dm755 ${target} $out/bin/${target}
-        runHook postInstall
-      '';
-
-      inherit postInstall;
-
-      passthru = {
-        tests = {
-          inherit (nixosTests)
-            syncthing
-            syncthing-folders
-            syncthing-guiPassword
-            syncthing-guiPasswordFile
-            syncthing-init
-            syncthing-no-settings
-            syncthing-relay
-            ;
-        };
-        updateScript = nix-update-script { };
-      };
-
-      meta = {
-        homepage = "https://syncthing.net/";
-        description = "Open Source Continuous File Synchronization";
-        changelog = "https://github.com/syncthing/syncthing/releases/tag/v${version}";
-        license = lib.licenses.mpl20;
-        maintainers = with lib.maintainers; [
-          joko
-          peterhoeg
-        ];
-        mainProgram = target;
-        platforms = lib.platforms.unix;
-      };
-    };
-
-in
-{
-  syncthing = common {
-    stname = "syncthing";
-    target = "syncthing";
-
-    postInstall = ''
-      # This installs man pages in the correct directory according to the suffix
-      # on the filename
-      for mf in man/*.[1-9]; do
-        mantype="$(echo "$mf" | awk -F"." '{print $NF}')"
-        mandir="$out/share/man/man$mantype"
-        install -Dm644 "$mf" "$mandir/$(basename "$mf")"
-      done
-
-      install -Dm644 etc/linux-desktop/syncthing-ui.desktop $out/share/applications/syncthing-ui.desktop
-      install -Dm644 assets/logo-32.png   $out/share/icons/hicolor/32x32/apps/syncthing.png
-      install -Dm644 assets/logo-64.png   $out/share/icons/hicolor/64x64/apps/syncthing.png
-      install -Dm644 assets/logo-128.png  $out/share/icons/hicolor/128x128/apps/syncthing.png
-      install -Dm644 assets/logo-256.png  $out/share/icons/hicolor/256x256/apps/syncthing.png
-      install -Dm644 assets/logo-512.png  $out/share/icons/hicolor/512x512/apps/syncthing.png
-      install -Dm644 assets/logo-only.svg $out/share/icons/hicolor/scalable/apps/syncthing.svg
-
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isLinux) ''
-      mkdir -p $out/lib/systemd/{system,user}
-
-      substitute etc/linux-systemd/system/syncthing@.service \
-                 $out/lib/systemd/system/syncthing@.service \
-                 --replace-fail /usr/bin/syncthing $out/bin/syncthing
-
-      substitute etc/linux-systemd/user/syncthing.service \
-                 $out/lib/systemd/user/syncthing.service \
-                 --replace-fail /usr/bin/syncthing $out/bin/syncthing
-    '';
-  };
-
-  syncthing-discovery = common {
-    stname = "syncthing-discovery";
-    target = "stdiscosrv";
-  };
-
-  syncthing-relay = common {
-    stname = "syncthing-relay";
-    target = "strelaysrv";
-
-    postInstall = lib.optionalString (stdenv.hostPlatform.isLinux) ''
-      mkdir -p $out/lib/systemd/system
-
-      substitute cmd/strelaysrv/etc/linux-systemd/strelaysrv.service \
-                 $out/lib/systemd/system/strelaysrv.service \
-                 --replace-fail /usr/bin/strelaysrv $out/bin/strelaysrv
-    '';
-  };
-}

pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch

@@ -0,0 +1,22 @@
+From: "Matthias J. Kannwischer" <matthias@zerorisc.com>
+Date: Sat, 30 May 2026 16:37:44 +0800
+Subject: pa_j: accept camlp5 8.05 for OCaml 5.4
+
+Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
+---
+ pa_j/chooser.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pa_j/chooser.sh b/pa_j/chooser.sh
+index 5ec8d00..de5c8c8 100755
+--- a/pa_j/chooser.sh
++++ b/pa_j/chooser.sh
+@@ -20,7 +20,7 @@ CAMLP5_FULL_VERSION=`camlp5 -v 2>&1 | cut -f3 -d' ' | cut -f1-3 -d'.' | cut -f1
+ 
+ if test ${OCAML_BINARY_VERSION} = "3.0"
+ then echo "pa_j_${OCAML_VERSION}.ml"
+-elif test ${CAMLP5_FULL_VERSION} = "8.04.00"
++elif test ${CAMLP5_BINARY_VERSION} = "8.04" -o ${CAMLP5_BINARY_VERSION} = "8.05"
+ then
+   if test ${OCAML_BINARY_VERSION} = "5.4"
+   then echo "pa_j_5.4_8.04.00.ml"

pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch

@@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
++++ b/Makefile
+@@ -128,7 +128,7 @@
+ hol.sh: pa_j.cmo ${HOLSRC} bignum.cmo hol_loader.cmo update_database.ml
+ 	if [ `uname` = "Linux" ] || [ `uname` = "Darwin" ] ; then \
+ 		if [ ${OCAML_UNARY_VERSION} = "5" ] || [ ${OCAML_VERSION} = "4.14" ] ; then \
+-			ocamlfind ocamlmktop -package zarith -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
++			ocamlfind ocamlmktop -package zarith,findlib -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+ 			sed "s^__DIR__^`pwd`^g; s^__USE_MODULE__^$(HOLLIGHT_USE_MODULE)^g" hol_4.14.sh > hol.sh ; \
+ 		else \
+ 			ocamlmktop -o ocaml-hol nums.cma bignum.cmo hol_loader.cmo ; \

pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch

@@ -1,66 +0,0 @@
-From: Stephane Glondu <steph@glondu.net>
-Date: Wed, 12 Feb 2020 05:42:32 +0100
-Subject: Fix compilation with camlp5 7.11
-
----
- pa_j_4.xx_7.xx.ml | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/pa_j_4.xx_7.xx.ml b/pa_j_4.xx_7.xx.ml
-index 4f7ed60..e834058 100755
---- a/pa_j/pa_j_4.xx_7.xx.ml
-+++ b/pa_j/pa_j_4.xx_7.xx.ml
-@@ -410,9 +410,10 @@ and reloc_module_type floc sh =
-     | MtApp loc x1 x2 →
-         let loc = floc loc in
-         MtApp loc (self x1) (self x2)
--    | MtFun loc x1 x2 x3 →
-+    | MtFun loc x x3 →
-         let loc = floc loc in
--        MtFun loc x1 (self x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, self x2))) x in
-+        MtFun loc x (self x3)
-     | MtLid loc x1 →
-         let loc = floc loc in
-         MtLid loc x1
-@@ -507,9 +508,10 @@ and reloc_module_expr floc sh =
-     | MeApp loc x1 x2 →
-         let loc = floc loc in
-         MeApp loc (self x1) (self x2)
--    | MeFun loc x1 x2 x3 →
-+    | MeFun loc x x3 →
-         let loc = floc loc in
--        MeFun loc x1 (reloc_module_type floc sh x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, reloc_module_type floc sh x2))) x in
-+        MeFun loc x (self x3)
-     | MeStr loc x1 →
-         let loc = floc loc in
-         MeStr loc (vala_map (List.map (reloc_str_item floc sh)) x1)
-@@ -2007,7 +2009,7 @@ EXTEND
-       | -> <:vala< [] >> ] ]
-   ;
-   mod_binding:
--    [ [ i = V UIDENT; me = mod_fun_binding -> (i, me) ] ]
-+    [ [ i = V uidopt "uidopt"; me = mod_fun_binding -> (i, me) ] ]
-   ;
-   mod_fun_binding:
-     [ RIGHTA
-@@ -2070,7 +2072,7 @@ EXTEND
-           <:sig_item< value $lid:i$ : $t$ >> ] ]
-   ;
-   mod_decl_binding:
--    [ [ i = V UIDENT; mt = module_declaration -> (i, mt) ] ]
-+    [ [ i = V uidopt "uidopt"; mt = module_declaration -> (i, mt) ] ]
-   ;
-   module_declaration:
-     [ RIGHTA
-@@ -2092,6 +2094,9 @@ EXTEND
-       | "module"; i = V mod_ident ""; ":="; me = module_expr ->
-           <:with_constr< module $_:i$ := $me$ >> ] ]
-   ;
-+  uidopt:
-+    [ [ m = V UIDENT -> Some m ] ]
-+  ;
-   (* Core expressions *)
-   expr:
-     [ "top" RIGHTA

pkgs/applications/science/logic/hol_light/default.nix

@@ -1,61 +1,51 @@
 {
   lib,
   stdenv,
-  runtimeShell,
   fetchFromGitHub,
+  makeBinaryWrapper,
+  writeText,
   ocaml,
   findlib,
-  num,
   zarith,
   camlp5,
   camlp-streams,
+  fmt,
   pcre2,
+  ledit,
   bash,
 }:
 
 let
-  use_zarith = lib.versionAtLeast ocaml.version "4.14";
-  load_num =
-    if use_zarith then
-      ''
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-        -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-      ''
-    else
-      lib.optionalString (num != null) ''
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/top-num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs
-      '';
-
-  start_script = ''
-    #!${runtimeShell}
-    cd $out/lib/hol_light
-    export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}${camlp5}/lib/ocaml/${ocaml.version}/site-lib/"
-    exec ${ocaml}/bin/ocaml \
-      -I \`${camlp5}/bin/camlp5 -where\` \
-      ${load_num} \
-      -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ \
-      -I ${camlp-streams}/lib/ocaml/${ocaml.version}/site-lib/camlp-streams camlp_streams.cma \
-      -init make.ml
-  '';
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib" [
+    camlp5
+    camlp-streams
+    fmt
+    pcre2
+    zarith
+  ];
+  stublibsPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib/stublibs" [
+    zarith
+    pcre2
+  ];
 in
 
 stdenv.mkDerivation {
   pname = "hol_light";
-  version = "unstable-2024-07-07";
+  version = "0-unstable-2026-05-19";
 
   src = fetchFromGitHub {
     owner = "jrh13";
     repo = "hol-light";
-    rev = "16b184e30e7e3fe9add7d1ee93242323ed2e1726";
-    hash = "sha256-V0OtsmX5pa+CH3ZXmNG3juXwXZ5+A0k13eMCAfaRziQ=";
+    rev = "9b510bc76da4cecf6e509be44d327c9236ec273f";
+    hash = "sha256-QaTDrGHpHvEde2AK/SD7eM+bAC9vN5o+dQqW1oau1Yo=";
   };
 
-  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
-
-  buildInputs = [ bash ];
+  patches = [
+    # Accept camlp5 8.05 in the pa_j chooser; submitted upstream.
+    ./0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+    # Link findlib into ocaml-hol so `#use "topfind"` works in the sandbox.
+    ./0002-link-findlib-into-ocaml-hol.patch
+  ];
 
   strictDeps = true;
 
@@ -63,28 +53,77 @@ stdenv.mkDerivation {
     ocaml
     findlib
     camlp5
+    makeBinaryWrapper
+  ];
+  buildInputs = [
+    bash
+    ocaml
+    findlib
+    camlp5
+    ledit
   ];
   propagatedBuildInputs = [
     camlp-streams
+    fmt
     pcre2
-    (if use_zarith then zarith else num)
+    zarith
   ];
 
+  setupHook = writeText "hol-light-setup-hook.sh" ''
+    addHolLight () {
+      if test -d "''$1/lib/hol_light"; then
+        export HOLLIGHT_DIR="''$1/lib/hol_light"
+      fi
+    }
+    addEnvHooks "$targetOffset" addHolLight
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs .
+    HOLLIGHT_USE_MODULE=1 make hol.sh
+    HOLLIGHT_USE_MODULE=1 make
+    runHook postBuild
+  '';
+
   installPhase = ''
-    mkdir -p "$out/lib/hol_light" "$out/bin"
-    cp -a  . $out/lib/hol_light
-    echo "${start_script}" > "$out/bin/hol_light"
-    chmod a+x "$out/bin/hol_light"
+    runHook preInstall
+    mkdir -p "$out/lib/hol_light"
+    cp -a . "$out/lib/hol_light"
+    # The Makefile bakes the build directory into hol.sh; regenerate it
+    # pointing at the install location.
+    sed "s^__DIR__^$out/lib/hol_light^g; s^__USE_MODULE__^1^g" hol_4.14.sh \
+      > "$out/lib/hol_light/hol.sh"
+    chmod +x "$out/lib/hol_light/hol.sh"
+    # Add the findlib site-lib so the toplevel can `#use "topfind"`.
+    substituteInPlace "$out/lib/hol_light/hol.sh" \
+      --replace-fail '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR}' \
+        '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib'
+    makeWrapper "$out/lib/hol_light/hol.sh" "$out/bin/hol_light" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          ocaml
+          findlib
+          camlp5
+          ledit
+        ]
+      } \
+      --set OCAMLPATH "${ocamlPath}" \
+      --prefix CAML_LD_LIBRARY_PATH : "${stublibsPath}"
+    ln -s hol_light "$out/bin/hol.sh"
+    runHook postInstall
   '';
 
   meta = {
     description = "Interactive theorem prover based on Higher-Order Logic";
     homepage = "http://www.cl.cam.ac.uk/~jrh13/hol-light/";
+    mainProgram = "hol_light";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
       thoughtpolice
       vbgl
+      mkannwischer
     ];
   };
 }

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix

@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin {
   pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2026-03-09";
+  version = "0-unstable-2026-05-29";
 
   src = fetchFromGitHub {
     owner = "VirtCode";
     repo = "hypr-dynamic-cursors";
-    rev = "57e14edd0ae265b01828e466e287e96eb1e84dd3";
-    hash = "sha256-hHMMP4h9VvacDLb8lkI6gZcUnhDbEt+GP2RLLL2s2C4=";
+    rev = "1de08deb7d495124ce88b342fecc7e7542d0672f";
+    hash = "sha256-Ck9dFUfj/zDSab16CzsGWEMNeSNDhhDOB0JWeHzVvjk=";
   };
 
   dontUseCmakeConfigure = true;

pkgs/by-name/_1/_1password-gui/sources.json

@@ -18,11 +18,11 @@
       "sources": {
         "x86_64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-x86_64.zip",
-          "hash": "sha256-tAWgIe7mcaGANCn8Kr0h6+zmvqufDJMjzAI3FrAGNk0="
+          "hash": "sha256-1dAmyaBMo4re1aQTk16AMEol7GjeSVhx9F4SuYBGoso="
         },
         "aarch64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-aarch64.zip",
-          "hash": "sha256-1c6YbzFYNyHKzY13OZ7z1Ad5hzgTIMs3aT0nluK9l0w="
+          "hash": "sha256-WrWbGzBK65tVNl9Dc3OnJURiPpfbNLOYUJcVT0ETaAs="
         }
       }
     }

pkgs/by-name/ac/actool/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "actool";
-  version = "2.0.0";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "viraptor";
     repo = "actool";
     tag = finalAttrs.version;
-    hash = "sha256-TRxA9c6q66Gso/ziqvly8IJR2AEHMc197gC9cUSuwAw=";
+    hash = "sha256-dDTa6J2by6uvg4gecwCcBIRGesZ1F0gAXSLr+6DYjGc=";
   };
 
-  cargoHash = "sha256-BhR5gwIrFE0OuSAxVTY5kMfmMlPfIABfOgmX/rOvpug=";
+  cargoHash = "sha256-Q0fSZNXw/71kMemYzwVsBRFcAMNl4ItKu56YdB0AAdM=";
 
   meta = {
     description = "Apple's actool reimplementation";

pkgs/by-name/an/andcli/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.6.2";
+  version = "2.7.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -17,10 +17,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EtfsSLyZs5hADJRE5xvn2mu6A04Sz9e21Y4+VkopCY0=";
+    hash = "sha256-l+ZpAm+yHCKPalGib4OlIaGFsDHc3IFFlOvB1kXWZG0=";
   };
 
-  vendorHash = "sha256-CHWypAA2BpHop5LGkjZVTBL4dGzWfrwDJcFrtGTBAb4=";
+  vendorHash = "sha256-S2JRkVy1iLGBqoOWukTQm80fVJ2YMNHTLfUUA2530GE=";
 
   ldflags = [
     "-s"

pkgs/by-name/an/antimicrox/package.nix

@@ -12,14 +12,14 @@
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "antimicrox";
   version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "AntiMicroX";
-    repo = pname;
-    rev = version;
+    repo = "antimicrox";
+    rev = finalAttrs.version;
     sha256 = "sha256-ZIHhgyOpabWkdFZoha/Hj/1d8/b6qVolE6dn0xAFZVw=";
   };
 
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     udevCheckHook
     libsForQt5.wrapQtAppsHook
   ];
+
   buildInputs = [
     SDL2
     libsForQt5.qttools
@@ -46,10 +47,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "GUI for mapping keyboard and mouse controls to a gamepad";
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     maintainers = [ ];
     license = lib.licenses.gpl3Plus;
     platforms = with lib.platforms; linux;
     mainProgram = "antimicrox";
   };
-}
+})

pkgs/by-name/an/anytype-cli/package.nix

@@ -9,16 +9,16 @@ buildGoModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "anytype-cli";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9jJ4FV4ASUrhUvW/lI4qs7AmK06OkPfnD0+okl5blrs=";
+    hash = "sha256-t1EdNrXmG1kTMx17Ni5jM81V1bfZTGA2jMDm+wdqKAE=";
   };
 
-  vendorHash = "sha256-7J/nW4Jn2vdAs8sN+rV3wg6nV3JhtQrnLwlxNI0uja0=";
+  vendorHash = "sha256-/yF5niHBEPKvIGoWUVvZ00vrEaxG5s3kK5uFNdGCYcA=";
   proxyVendor = true;
 
   env.CGO_ENABLED = 1;

pkgs/by-name/ap/apache-airflow/providers.nix

@@ -473,6 +473,7 @@
       "kerberos"
       "marshmallow"
       "msgpack"
+      "pyjwt"
       "werkzeug"
       "wtforms"
     ];
@@ -644,7 +645,10 @@
   };
 
   jdbc = {
-    deps = [ "jaydebeapi" ];
+    deps = [
+      "jaydebeapi"
+      "jpype1"
+    ];
     imports = [
       "airflow.providers.jdbc"
       "airflow.providers.jdbc.get_provider_info"
@@ -754,6 +758,7 @@
     deps = [
       "aiomysql"
       "mysqlclient"
+      "pymysql"
     ];
     imports = [
       "airflow.providers.mysql"

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -19,6 +19,7 @@
   attrs,
   babel,
   buildPythonPackage,
+  cachetools,
   cadwyn,
   colorlog,
   cron-descriptor,
@@ -88,13 +89,13 @@
   enabledProviders,
 }:
 let
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "airflow";
     tag = version;
-    hash = "sha256-jwWxH9fTTCFdLAaAN18/FUAbN0cTCPkkk9+0ZMYNXek=";
+    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
   };
 
   pnpm = pnpm_10;
@@ -104,6 +105,10 @@ let
     inherit src version;
     sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
 
+    # vite build resolves "localhost" during the build, which the darwin
+    # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
+    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
     nativeBuildInputs = [
       nodejs
       pnpm
@@ -119,7 +124,7 @@ let
         pnpm
         ;
       fetcherVersion = 3;
-      hash = "sha256-OkSDQoWsHQ6w1vIoX5W9zXHghV0obvL6Wji0HYN6CSs=";
+      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
     };
 
     buildPhase = ''
@@ -138,6 +143,8 @@ let
     inherit src version;
     sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
 
+    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
     nativeBuildInputs = [
       nodejs
       pnpm
@@ -146,9 +153,14 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       pname = "simple-auth-manager-ui";
-      inherit sourceRoot src version;
+      inherit
+        sourceRoot
+        src
+        version
+        pnpm
+        ;
       fetcherVersion = 3;
-      hash = "sha256-uQIVHzX0BcJuxgbPp6wqKhALbsfACSJjiMOdmrpuzOk=";
+      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
     };
 
     buildPhase = ''
@@ -212,6 +224,7 @@ let
       sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
       sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
       # Copy built UI assets
       cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
@@ -235,6 +248,7 @@ let
       argcomplete
       asgiref
       attrs
+      cachetools
       cadwyn
       colorlog
       cron-descriptor
@@ -291,6 +305,8 @@ let
       uvicorn
     ]
     ++ (map buildProvider requiredProviders);
+
+    pythonRelaxDeps = [ "starlette" ];
   };
 
   taskSdk = buildPythonPackage {
@@ -308,6 +324,7 @@ let
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
       # task-sdk needs config.yml from core subpackage
       mkdir -p src/airflow/config_templates
@@ -354,6 +371,7 @@ buildPythonPackage rec {
     sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
     sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
     sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
   '';
 
   nativeBuildInputs = [ writableTmpDirAsHomeHook ];

pkgs/by-name/ap/appflowy/package.nix

@@ -126,7 +126,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Open-source alternative to Notion";
     homepage = "https://www.appflowy.io/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.agpl3Only;
+    license = with lib.licenses; [
+      # The LICENSE file clearly claims the project is using AGPL-3.0
+      #
+      # c.f. https://github.com/AppFlowy-IO/AppFlowy/blob/main/LICENSE
+      agpl3Only
+      # But, the source code has not been synced with any major release since
+      # the end of 2025. One of the core team member said that they will "merge
+      # Flutter code back into this public repository at a later stage". However,
+      # 2 months later, nothing has changed.
+      #
+      # c.f. https://github.com/AppFlowy-IO/AppFlowy/issues/8479#issuecomment-4053301446
+      unfreeRedistributable
+    ];
     changelog = "https://github.com/AppFlowy-IO/appflowy/releases/tag/${finalAttrs.version}";
     maintainers = with lib.maintainers; [ darkonion0 ];
     platforms = [ "x86_64-linux" ] ++ lib.platforms.darwin;

pkgs/by-name/aw/awww/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromGitea,
+  fetchFromCodeberg,
   rustPlatform,
   pkg-config,
   lz4,
@@ -17,8 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "awww";
   version = "0.12.1";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
+  src = fetchFromCodeberg {
     owner = "LGFae";
     repo = "awww";
     tag = "v${finalAttrs.version}";

pkgs/by-name/ba/badkeys/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "badkeys";
-  version = "0.0.17";
+  version = "0.0.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "badkeys";
     repo = "badkeys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sQ2HOgffVklHKpOTmIHMR0QSfsB9lxrEcaT2jzicVlM=";
+    hash = "sha256-sQPMil8MdGR9vauBgX+fAX/wdmSdqkchoxD4drGXR3I=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/be/betterleaks/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "betterleaks";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "betterleaks";
     repo = "betterleaks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-65ITYF3PFYuMXsAEEVOXVBlaZnM01w/BpOdCD0LW5Y4=";
+    hash = "sha256-bPrOp5PP5BxkSOA7wUmq/bbVPg+bwymGQ0rl8PvPSAE=";
   };
 
   vendorHash = "sha256-RStdC7M0+bPNXwaATxkMOBGf1OrT0pqlNPTJ7TCelfk=";

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -33,13 +33,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2026.3.1";
+  version = "2026.5.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-ecaCHk04N9h0RP8gK0o+MLgYS6Linsqi7AaC86hwQ3U=";
+    hash = "sha256-R00wt5W4kKmFIODEaGoUqDwfGyHH/2PpiRaC8Gq3d88=";
   };
 
   patches = [
@@ -85,7 +85,7 @@ buildNpmPackage' rec {
 
   npmWorkspace = "apps/desktop";
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-1t4CSd1NDC1medTTFHSzX9ZkgHqPG2L//yjaloH47z0=";
+  npmDepsHash = "sha256-xmb3zwE8/nWpRlUOgTz2UhNRaUA8KW9sHQHA97pjjfg=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -95,7 +95,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-d9Iv7OekHOteH1lyAuyj/EzfU/KSCW6ATx83foOW3IE=";
+    hash = "sha256-phvk4t1JKfSYGzm/vm1rT8A0fACHJF/C0WiZ2Lk3cV0=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 

pkgs/by-name/bo/bodyclose/package.nix

@@ -1,35 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  unstableGitUpdater,
-}:
-
-buildGoModule {
-  pname = "bodyclose";
-  version = "0-unstable-2024-12-22";
-
-  src = fetchFromGitHub {
-    owner = "timakin";
-    repo = "bodyclose";
-    rev = "1db5c5ca4d6719fe28430df1ae8d337ee2ac09c7";
-    hash = "sha256-s5bWvpV6gHGEsuiNXJl2ZuyDaffD82/rCbusov3zsyw=";
-  };
-
-  vendorHash = "sha256-8grdJuV8aSETsJr2VazC/3ctfnGh3UgjOWD4/xf3uC8=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = {
-    description = "Golang linter to check whether HTTP response body is closed and a re-use of TCP connection is not blocked";
-    mainProgram = "bodyclose";
-    homepage = "https://github.com/timakin/bodyclose";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ meain ];
-  };
-}

pkgs/by-name/br/brlcad/package.nix

@@ -46,8 +46,68 @@ let
     owner = "BRL-CAD";
     repo = "bext";
     rev = "f9074f84c87605f89d912069cee1b1e710ead635"; # must match brlcad_bext_init() in CMakeLists.txt
-    hash = "sha256-jCBw4aDk/bmz2Woe9qIA88mgLRRZSu7zDYM5pi3MbP8=";
+    hash = "sha256-wOzrHiEA+IVUnchSRRUAzIwKkGWtyvnrInnADi3KgiI=";
     fetchSubmodules = true;
+    # remove unneeded subprojects to reduce NAR size
+    postFetch =
+      let
+        subprojectsToRemove = toString [
+          "appleseed"
+          "astyle"
+          "boost"
+          "clipper2"
+          "deflate"
+          "eigen"
+          "embree"
+          "expat"
+          "flexbison"
+          "fmt"
+          "gdal"
+          "geogram"
+          "gte"
+          "icu"
+          "ispc"
+          "jpeg"
+          "lief"
+          "llvm"
+          "lmdb"
+          "lz4"
+          "minizip-ng"
+          "mmesh"
+          "ncurses"
+          "netpbm"
+          "onetbb"
+          "opencolorio"
+          "opencv"
+          "openexr"
+          "openimageio"
+          "openmesh"
+          "osl"
+          "ospray"
+          "patchelf"
+          "plief"
+          "png"
+          "poissonrecon"
+          "proj"
+          "pugixml"
+          "pystring"
+          "qt"
+          "rkcommon"
+          "sqlite3"
+          "stepcode"
+          "tiff"
+          "tinygltf"
+          "xerces-c"
+          "xmltools"
+          "yaml-cpp"
+          "zstd"
+        ];
+      in
+      ''
+        for name in ${subprojectsToRemove}; do
+          rm -r $out/$name
+        done
+      '';
   };
 in
 

pkgs/by-name/ca/caddy/package.nix

@@ -11,12 +11,12 @@
   versionCheckHook,
 }:
 let
-  version = "2.11.3";
+  version = "2.11.4";
   dist = fetchFromGitHub {
     owner = "caddyserver";
     repo = "dist";
     tag = "v${version}";
-    hash = "sha256-D1qI7TDJpSvtgpo1FsPZk6mpqRvRharFZ8soI7Mn3RE=";
+    hash = "sha256-oRQfQH1GKjAjVMj+dZo1f1+HOaOdJIyEfod0iGLYcc8=";
   };
 in
 buildGoModule (finalAttrs: {
@@ -27,10 +27,10 @@ buildGoModule (finalAttrs: {
     owner = "caddyserver";
     repo = "caddy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Hgmo7ldDtbwl/acEY/4RNhSGnK/NNcXn+eIm1I8HKg=";
+    hash = "sha256-wzk8KRZfDCbbjRlBwkoKAoMjOhV4xF3yuXUueqtl1xM=";
   };
 
-  vendorHash = "sha256-QiZZxYsYFUneZ52TfFKQWJ42lmBofvUTZrHmDBuN2O4=";
+  vendorHash = "sha256-2GwSM7EKN9GwN6kte7CekpXIJ0vzHhhsnrs3TC6vTW4=";
 
   ldflags = [
     "-s"

pkgs/by-name/co/collabora-desktop/package.nix

@@ -13,7 +13,6 @@
   pam,
   pango,
   pixman,
-  pkgs,
   pkg-config,
   poco,
   python3,
@@ -47,6 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
 
     patchShebangs browser/util/*.py coolwsd-systemplate-setup scripts/*
     substituteInPlace configure.ac --replace-fail '/usr/bin/env python3' python3
+
+    # workaround for QtWebEngine crash when loading 'cell' cursor
+    substituteInPlace browser/css/spreadsheet.css \
+      --replace-warn "cursor: cell" "cursor: crosshair"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/cr/cropgui/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   python3Packages,
-  fetchFromGitea,
+  fetchFromCodeberg,
   makeWrapper,
   libjpeg,
   exiftool,
@@ -11,8 +11,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cropgui";
   version = "0.9";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
+  src = fetchFromCodeberg {
     owner = "jepler";
     repo = "cropgui";
     tag = "v${finalAttrs.version}";

pkgs/by-name/cr/cross-seed/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "cross-seed";
-  version = "6.13.6";
+  version = "6.13.7";
 
   src = fetchFromGitHub {
     owner = "cross-seed";
     repo = "cross-seed";
     tag = "v${version}";
-    hash = "sha256-E2tnlDU2/msNcSsoDXvwGWFhWpXEByloUmlVp2tckwo=";
+    hash = "sha256-+7A4UGIY75hvF0JvtIr6nGNdXkUE0XV9TFpEQz9OW+Y=";
   };
 
-  npmDepsHash = "sha256-tR7zPoIX6yjlRx8QbRSxskvueQ1BsP3gGAlonKHH0RY=";
+  npmDepsHash = "sha256-HoIiO7cj4JNY+sJEuH1v0AgagDuBTySJaoVo/4SsfIc=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/dd/ddhx/package.nix

@@ -31,5 +31,6 @@ buildDubPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ryand56 ];
     platforms = lib.platforms.unix;
+    mainProgram = "ddhx";
   };
 })

pkgs/by-name/de/deezer-desktop/package.nix

@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.200";
+  version = "7.1.220";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-FrAFUkxv4/GGhDO/2g+0Kym1LCV+YoIee7rmOAw17/Q=";
+      hash = "sha256-q4j4S88c7xsC+Ax7XY1EVbqRRJXH+JzLrZRRB6rfQOE=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-FcP4jAVvIA71GCtVoWEIA4AynsHOAn0/zt3rNB6Q25Y=";
+      hash = "sha256-g94qn+EHr8Dwn21L7z3W7Z5+LJoVSQcAEXHpJiAdbJg=";
     };
   };
 

pkgs/by-name/de/dexter/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dexter";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "remoteoss";
     repo = "dexter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BmWzrbC9ka8L1/mrPOXJqnoi1YVXxRcg6tSkb8tI88Q=";
+    hash = "sha256-MQ8LxSI2amecFUiNK6vED/nJKHgs5sRT7rJVi6cLdkc=";
   };
 
   vendorHash = "sha256-1mJ4HdDCsZl/g8F+L+NrW2ACuiHe2aSheJO/1XfKAb4=";

pkgs/by-name/ds/dssd/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  dbus,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "dssd";
+  version = "0.3.3";
+
+  src = fetchFromGitHub {
+    owner = "ylxdzsw";
+    repo = "dssd";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gAV4gwrfvYfc2f1tDY/cNOFMrQzrzHSmEFsKg7ke/6c=";
+  };
+
+  cargoHash = "sha256-yX2/2TW3FNbqwzR6+5yP26E2Eps0bTJgJJrDIQG2KQU=";
+
+  postPatch = ''
+    substituteInPlace dssd.service org.freedesktop.secrets.service \
+      --replace-fail /usr/bin/dssd $out/bin/dssd
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ dbus ];
+
+  postInstall = ''
+    install dssd.service -Dt $out/lib/systemd/user/
+    install org.freedesktop.secrets.service -Dt $out/share/dbus-1/system-services/
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Dead Simple Secret Daemon";
+    homepage = "https://github.com/ylxdzsw/dssd";
+    license = lib.licenses.mit;
+    mainProgram = "dssd";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ex/exiftags/package.nix

@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     sed -i -e s@/usr/local@$out@ Makefile
+
+    substituteInPlace makers.h \
+      --replace-fail "void (*propfun)();" "void (*propfun)(struct exifprop *, struct exiftags *);" \
+      --replace-fail "struct ifd *(*ifdfun)();" "struct ifd *(*ifdfun)(u_int32_t, struct tiffmeta *);"
+    substituteInPlace canon.c \
+      --replace-fail "int (*valfun)()" "int (*valfun)(struct exifprop *, struct exifprop *, unsigned char *, struct exiftags *)"
   '';
 
   preInstall = ''

pkgs/by-name/fa/fastcdr/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastcdr";
-  version = "2.3.5";
+  version = "2.3.6";
 
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-CDR";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gWENB3zqnFll047Jv+GL4k497wrzNaIaVTbXY7feRNQ=";
+    hash = "sha256-s0cIb/83dD5W8vN/2bEBxRD35NpfCSHEpsJQjtr94aE=";
   };
 
   patches = [

pkgs/by-name/ff/fflogs/package.nix

@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "9.3.17";
+  version = "9.3.61";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-EYo65CerGE14kQadNIaVyANvyBig/yW1PfulAAE6dxo=";
+    hash = "sha256-QBiZR8wjhMsLguzBaM21mADlR1hKHdBuK66DcSzyVtQ=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in

pkgs/by-name/fi/filebeat8/package.nix

@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.15";
+  version = "8.19.16";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PHLdHY0XdcbZpE9yOjmb+9Eesb7M13+Je+/8cQ5Klls=";
+    hash = "sha256-OBPaSbPAp7SvhEi2yycgT70yRfCtIEdkL4/GSR2YrO4=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-y4f5gJSb/XI0PVZol8cXgurquwtMaOk6mrWNLfNxRFo=";
+  vendorHash = "sha256-aCoXzWnNsctxJmsfeUyVSLkUY59adtIn2JxxGKPBob8=";
 
   subPackages = [ "filebeat" ];