nixos/systemd-boot: refuse to wipe ESP when no generations found (#528461)

Diff: https://github.com/rerun-io/rerun/compare/0.32.2...0.33.0

Changelog: https://github.com/rerun-io/rerun/blob/0.33.0/CHANGELOG.md

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -47,7 +47,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -55,7 +55,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -171,7 +171,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -256,7 +256,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -471,7 +471,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

maintainers/maintainer-list.nix

@@ -11084,7 +11084,7 @@
     name = "Hugo Tavares Reis";
   };
   httprafa = {
-    email = "rafael.kienitz@gmail.com";
+    email = "rafa.kienitz@proton.me";
     github = "HttpRafa";
     githubId = 60099368;
     name = "Rafael Kienitz";

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -532,6 +532,17 @@ def install_bootloader(args: argparse.Namespace) -> None:
     for profile in get_profiles():
         gens += get_generations(profile)
 
+    if not gens:
+        # With zero generations we would garbage-collect every kernel,
+        # initrd and loader entry off the ESP, leaving the system
+        # unbootable.
+        print(
+            "error: no system generations found in /nix/var/nix/profiles, "
+            "refusing to remove all boot loader entries",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
     boot_files: BootFileList = []
     critical_paths: set[Path] = set()
 

nixos/tests/all-tests.nix

@@ -942,7 +942,7 @@ in
   lomiri-system-settings = runTest ./lomiri-system-settings.nix;
   lorri = handleTest ./lorri/default.nix { };
   luks = runTest ./luks.nix;
-  lvm2 = handleTest ./lvm2 { };
+  lvm2 = import ./lvm2 { inherit pkgs runTest; };
   lxc = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./lxc;
   lxd-image-server = runTest ./lxd-image-server.nix;
   lxqt = runTest ./lxqt.nix;
@@ -1849,7 +1849,7 @@ in
   zammad = runTest ./zammad.nix;
   zenohd = runTest ./zenohd.nix;
   zeronet-conservancy = runTest ./zeronet-conservancy.nix;
-  zfs = handleTest ./zfs.nix { };
+  zfs = import ./zfs.nix { inherit system pkgs runTest; };
   zigbee2mqtt = runTest ./zigbee2mqtt.nix;
   zipline = runTest ./zipline.nix;
   zoneminder = runTest ./zoneminder.nix;

nixos/tests/initrd-luks-empty-passphrase.nix

@@ -61,47 +61,63 @@ in
       };
     };
 
-  testScript = ''
-    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+  testScript =
+    { nodes, ... }:
+    let
+      toplevel = nodes.machine.system.build.toplevel;
+      boot-luks-missing-keyfile =
+        nodes.machine.specialisation.boot-luks-missing-keyfile.configuration.system.build.toplevel;
+      boot-luks-wrong-keyfile =
+        nodes.machine.specialisation.boot-luks-wrong-keyfile.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
 
 
-    def grub_select_boot_luks_wrong_key_file():
-        """
-        Selects "boot-luks" from the GRUB menu
-        to trigger a login request.
-        """
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey ret")
+      def grub_select_boot_luks_wrong_key_file():
+          """
+          Selects "boot-luks" from the GRUB menu
+          to trigger a login request.
+          """
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey ret")
 
-    def grub_select_boot_luks_missing_key_file():
-        """
-        Selects "boot-luks" from the GRUB menu
-        to trigger a login request.
-        """
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey ret")
+      def grub_select_boot_luks_missing_key_file():
+          """
+          Selects "boot-luks" from the GRUB menu
+          to trigger a login request.
+          """
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey ret")
 
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
-    machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
+      machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("${boot-luks-wrong-keyfile}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Check if rootfs is on /dev/mapper/cryptroot
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+      # Check if rootfs is on /dev/mapper/cryptroot
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
 
-    # Choose boot-luks-missing-keyfile specialisation
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Choose boot-luks-missing-keyfile specialisation
+      machine.succeed(
+          "mkdir -p /nix/var/nix/profiles",
+          "ln -sfn ${toplevel} /nix/var/nix/profiles/system-1-link",
+          "ln -sfn system-1-link /nix/var/nix/profiles/system",
+      )
 
-    # Check if rootfs is on /dev/mapper/cryptroot
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      machine.succeed("${boot-luks-missing-keyfile}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+
+      # Check if rootfs is on /dev/mapper/cryptroot
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/luks.nix

@@ -1,6 +1,6 @@
 # Tests LUKS specifically with scripted stage 1. Remove in 26.11.
 
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "luks";
 
@@ -47,41 +47,59 @@
 
   enableOCR = true;
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+  testScript =
+    { nodes, ... }:
+    let
+      toplevel = nodes.machine.system.build.toplevel;
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+      boot-luks-custom-keymap =
+        nodes.machine.specialisation.boot-luks-custom-keymap.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_text("Passphrase for")
-    machine.send_chars("supersecret\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_text("Passphrase for")
+      machine.send_chars("supersecret\n")
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
 
-    # Boot from the encrypted disk with custom keymap
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-custom-keymap.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # The new root is empty, so it has no /nix/var/nix/profiles. Without a
+      # system profile, systemd-boot-builder finds zero generations and
+      # bails. So we manually create the one profile link that we need.
+      machine.succeed(
+          "mkdir -p /nix/var/nix/profiles",
+          "ln -sfn ${toplevel} /nix/var/nix/profiles/system-1-link",
+          "ln -sfn system-1-link /nix/var/nix/profiles/system",
+      )
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_text("Passphrase for")
-    machine.send_chars("havfkhfrkfl\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the encrypted disk with custom keymap
+      machine.succeed("${boot-luks-custom-keymap}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_text("Passphrase for")
+      machine.send_chars("havfkhfrkfl\n")
+      machine.wait_for_unit("multi-user.target")
+
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/lvm2/default.nix

@@ -1,8 +1,6 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
-  lib ? pkgs.lib,
+  pkgs,
+  runTest,
   kernelVersionsToTest ? [
     "5.10"
     "5.15"
@@ -15,38 +13,36 @@
 
 # For quickly running a test, the nixosTests.lvm2.lvm-thinpool-linux-latest attribute is recommended
 let
-  tests =
-    let
-      callTest = p: lib.flip (import p) { inherit system pkgs; };
-    in
-    {
-      thinpool = {
-        test = callTest ./thinpool.nix;
-        kernelFilter = lib.id;
-      };
-      # we would like to test all versions, but the kernel module currently does not compile against the other versions
-      vdo = {
-        test = callTest ./vdo.nix;
-        kernelFilter = lib.filter (v: v == "latest");
-      };
+  inherit (pkgs) lib;
 
-      # systemd in stage 1
-      raid-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.filter (v: v != "5.15");
-        flavour = "raid";
-      };
-      thinpool-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.id;
-        flavour = "thinpool";
-      };
-      vdo-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.filter (v: v == "latest");
-        flavour = "vdo";
-      };
+  tests = {
+    thinpool = {
+      test = ./thinpool.nix;
+      kernelFilter = lib.id;
     };
+    # we would like to test all versions, but the kernel module currently does not compile against the other versions
+    vdo = {
+      test = ./vdo.nix;
+      kernelFilter = lib.filter (v: v == "latest");
+    };
+
+    # systemd in stage 1
+    raid-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.filter (v: v != "5.15");
+      flavour = "raid";
+    };
+    thinpool-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.id;
+      flavour = "thinpool";
+    };
+    vdo-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.filter (v: v == "latest");
+      flavour = "vdo";
+    };
+  };
 in
 lib.listToAttrs (
   lib.filter (x: x.value != { }) (
@@ -61,18 +57,17 @@ lib.listToAttrs (
       lib.flip lib.mapAttrsToList tests (
         name: t:
         lib.nameValuePair "lvm-${name}-linux-${v'}" (
-          lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (
-            t.test (
-              {
-                kernelPackages = pkgs."linuxPackages_${v'}";
-                inherit mkXfsFlags;
-              }
-              // removeAttrs t [
-                "test"
-                "kernelFilter"
-              ]
-            )
-          )
+          lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (runTest {
+            imports = [ t.test ];
+            _module.args = {
+              kernelPackages = pkgs."linuxPackages_${v'}";
+              inherit mkXfsFlags;
+            }
+            // removeAttrs t [
+              "test"
+              "kernelFilter"
+            ];
+          })
         )
       )
     )

nixos/tests/lvm2/systemd-stage-1.nix

@@ -1,7 +1,9 @@
 {
+  lib,
   kernelPackages ? null,
   flavour,
   mkXfsFlags ? "",
+  ...
 }:
 let
   preparationCode =
@@ -66,57 +68,61 @@ let
     .${flavour};
 
 in
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-${flavour}-systemd-stage-1";
-    meta.maintainers = with lib.maintainers; [
-      das_j
-      helsinki-Jo
-    ];
+{
+  name = "lvm2-${flavour}-systemd-stage-1";
+  meta.maintainers = with lib.maintainers; [
+    das_j
+    helsinki-Jo
+  ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        imports = [ extraConfig ];
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            8192
-            8192
-          ];
-          useBootLoader = true;
-          useEFIBoot = true;
-          # To boot off the LVM disk, we need to have a init script which comes from the Nix store.
-          mountHostNixStore = true;
-        };
-        boot.loader.systemd-boot.enable = true;
-        boot.loader.efi.canTouchEfiVariables = true;
-
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        boot = {
-          initrd.systemd = {
-            enable = true;
-            emergencyAccess = true;
-          };
-          initrd.services.lvm.enable = true;
-          kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
-        };
-
-        specialisation.boot-lvm.configuration.virtualisation = {
-          useDefaultFilesystems = false;
-          fileSystems = {
-            "/" = {
-              device = "/dev/test_vg/test_lv";
-              fsType = "xfs";
-            };
-          };
-
-          rootDevice = "/dev/test_vg/test_lv";
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      imports = [ extraConfig ];
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          8192
+          8192
+        ];
+        useBootLoader = true;
+        useEFIBoot = true;
+        # To boot off the LVM disk, we need to have a init script which comes from the Nix store.
+        mountHostNixStore = true;
+      };
+      boot.loader.systemd-boot.enable = true;
+      boot.loader.efi.canTouchEfiVariables = true;
+
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      boot = {
+        initrd.systemd = {
+          enable = true;
+          emergencyAccess = true;
         };
+        initrd.services.lvm.enable = true;
+        kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
       };
 
-    testScript = ''
+      specialisation.boot-lvm.configuration.virtualisation = {
+        useDefaultFilesystems = false;
+        fileSystems = {
+          "/" = {
+            device = "/dev/test_vg/test_lv";
+            fsType = "xfs";
+          };
+        };
+
+        rootDevice = "/dev/test_vg/test_lv";
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      boot-lvm = nodes.machine.specialisation.boot-lvm.configuration.system.build.toplevel;
+    in
+    # python
+    ''
       machine.wait_for_unit("multi-user.target")
       # Create a VG for the root
       ${preparationCode}
@@ -124,7 +130,7 @@ import ../make-test-python.nix (
       machine.succeed("mkdir -p /mnt && mount /dev/test_vg/test_lv /mnt && echo hello > /mnt/test && umount /mnt")
 
       # Boot from LVM
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-lvm.conf")
+      machine.succeed("${boot-lvm}/bin/switch-to-configuration boot")
       machine.succeed("sync")
       machine.crash()
       machine.wait_for_unit("multi-user.target")
@@ -135,5 +141,4 @@ import ../make-test-python.nix (
       assert "hello" in machine.succeed("cat /test")
       ${extraCheck}
     '';
-  }
-)
+}

nixos/tests/lvm2/thinpool.nix

@@ -1,49 +1,48 @@
 {
+  lib,
   kernelPackages ? null,
   mkXfsFlags ? "",
+  ...
 }:
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-thinpool";
-    meta.maintainers = with lib.maintainers; [
-      das_j
-      helsinki-Jo
-    ];
+{
+  name = "lvm2-thinpool";
+  meta.maintainers = with lib.maintainers; [
+    das_j
+    helsinki-Jo
+  ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 4096 ];
-        services.lvm = {
-          boot.thin.enable = true;
-          dmeventd.enable = true;
-        };
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        environment.etc."lvm/lvm.conf".text = ''
-          activation/thin_pool_autoextend_percent = 10
-          activation/thin_pool_autoextend_threshold = 80
-        '';
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 4096 ];
+      services.lvm = {
+        boot.thin.enable = true;
+        dmeventd.enable = true;
       };
-
-    testScript =
-      let
-        mkXfsFlags =
-          lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
-          + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
-      in
-      ''
-        machine.succeed("vgcreate test_vg /dev/vdb")
-        machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
-        machine.succeed("lvcreate -n test_lv -V 16G --thinpool test_thin_pool test_vg")
-        machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
-        machine.succeed("mkdir /mnt; mount /dev/test_vg/test_lv /mnt")
-        assert "/dev/mapper/test_vg-test_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
-        machine.succeed("dd if=/dev/zero of=/mnt/empty.file bs=1M count=1024")
-        machine.succeed("journalctl -u dm-event.service | grep \"successfully resized\"")
-        machine.succeed("umount /mnt")
-        machine.succeed("vgchange -a n")
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      environment.etc."lvm/lvm.conf".text = ''
+        activation/thin_pool_autoextend_percent = 10
+        activation/thin_pool_autoextend_threshold = 80
       '';
-  }
-)
+      boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    };
+
+  testScript =
+    let
+      mkXfsFlags =
+        lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
+        + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
+    in
+    ''
+      machine.succeed("vgcreate test_vg /dev/vdb")
+      machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
+      machine.succeed("lvcreate -n test_lv -V 16G --thinpool test_thin_pool test_vg")
+      machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
+      machine.succeed("mkdir /mnt; mount /dev/test_vg/test_lv /mnt")
+      assert "/dev/mapper/test_vg-test_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+      machine.succeed("dd if=/dev/zero of=/mnt/empty.file bs=1M count=1024")
+      machine.succeed("journalctl -u dm-event.service | grep \"successfully resized\"")
+      machine.succeed("umount /mnt")
+      machine.succeed("vgchange -a n")
+    '';
+}

nixos/tests/lvm2/vdo.nix

@@ -1,35 +1,34 @@
 {
+  lib,
   kernelPackages ? null,
   mkXfsFlags ? "",
+  ...
 }:
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-vdo";
-    meta.maintainers = [ ];
+{
+  name = "lvm2-vdo";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        # Minimum required size for VDO volume: 5063921664 bytes
-        virtualisation.emptyDiskImages = [ 8192 ];
-        services.lvm = {
-          boot.vdo.enable = true;
-          dmeventd.enable = true;
-        };
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      # Minimum required size for VDO volume: 5063921664 bytes
+      virtualisation.emptyDiskImages = [ 8192 ];
+      services.lvm = {
+        boot.vdo.enable = true;
+        dmeventd.enable = true;
       };
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    };
 
-    testScript = ''
-      machine.succeed("vgcreate test_vg /dev/vdb")
-      machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
-      machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
-      machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
-      assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
-      machine.succeed("umount /mnt")
-      machine.succeed("vdostats")
-      machine.succeed("vgchange -a n")
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("vgcreate test_vg /dev/vdb")
+    machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
+    machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
+    assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+    machine.succeed("umount /mnt")
+    machine.succeed("vdostats")
+    machine.succeed("vgchange -a n")
+  '';
+}

nixos/tests/systemd-initrd-btrfs-raid.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-btrfs-raid";
 
@@ -33,21 +33,27 @@
       };
     };
 
-  testScript = ''
-    # Create RAID
-    machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
-    machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-btrfs-raid = nodes.machine.specialisation.boot-btrfs-raid.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create RAID
+      machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
+      machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
 
-    # Boot from the RAID
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-btrfs-raid.conf")
-    machine.succeed("sync")
-    machine.crash()
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the RAID
+      machine.succeed("${boot-btrfs-raid}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+      machine.wait_for_unit("multi-user.target")
 
-    # Ensure we have successfully booted from the RAID
-    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-    assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
-    assert "hello" in machine.succeed("cat /test")
-    assert "Total devices 2" in machine.succeed("btrfs filesystem show")
-  '';
+      # Ensure we have successfully booted from the RAID
+      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+      assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
+      assert "hello" in machine.succeed("cat /test")
+      assert "Total devices 2" in machine.succeed("btrfs filesystem show")
+    '';
 }

nixos/tests/systemd-initrd-luks-fido2.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   hostPkgs,
   ...
 }:
@@ -43,19 +42,25 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-keyfile.nix

@@ -42,20 +42,26 @@ in
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
-    machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
+      machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-password.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-luks-password";
 
@@ -39,30 +39,36 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
-    machine.send_console("supersecret\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
+      machine.send_console("supersecret\n")
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-  '';
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-tpm2.nix

@@ -35,21 +35,27 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
-    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -82,33 +82,39 @@ in
       };
     };
 
-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      machine.wait_for_unit("multi-user.target")
 
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+        machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk. This part of the test is SLOW.
-    machine.start()
-    machine.wait_for_unit("unl0kr-agent.service")
-    machine.screenshot("prompt")
-    machine.send_chars("${passphrase}")
-    machine.screenshot("pw")
-    machine.send_chars("\n")
-    machine.switch_root()
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk. This part of the test is SLOW.
+      machine.start()
+      machine.wait_for_unit("unl0kr-agent.service")
+      machine.screenshot("prompt")
+      machine.send_chars("${passphrase}")
+      machine.screenshot("pw")
+      machine.send_chars("\n")
+      machine.switch_root()
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-  '';
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-swraid.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-swraid";
 
@@ -41,30 +41,36 @@
       specialisation.build-old-initrd.configuration.boot.initrd.systemd.enable = lib.mkForce false;
     };
 
-  testScript = ''
-    # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
-    machine.succeed("mkfs.ext4 -L testraid /dev/md0")
-    machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-swraid = nodes.machine.specialisation.boot-swraid.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create RAID
+      machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
+      machine.succeed("mkfs.ext4 -L testraid /dev/md0")
+      machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 
-    # Boot from the RAID
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-swraid.conf")
-    machine.succeed("sync")
-    machine.crash()
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the RAID
+      machine.succeed("${boot-swraid}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+      machine.wait_for_unit("multi-user.target")
 
-    # Ensure we have successfully booted from the RAID
-    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-    assert "/dev/md0 on / type ext4" in machine.succeed("mount")
-    assert "hello" in machine.succeed("cat /test")
-    assert "md0" in machine.succeed("cat /proc/mdstat")
+      # Ensure we have successfully booted from the RAID
+      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+      assert "/dev/md0 on / type ext4" in machine.succeed("mount")
+      assert "hello" in machine.succeed("cat /test")
+      assert "md0" in machine.succeed("cat /proc/mdstat")
 
-    # Verify the RAID array was properly auto-detected and assembled
-    detail = machine.succeed("mdadm --detail /dev/md0")
-    assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
-    assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
-    assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"
+      # Verify the RAID array was properly auto-detected and assembled
+      detail = machine.succeed("mdadm --detail /dev/md0")
+      assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
+      assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
+      assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"
 
-    machine.wait_for_unit("mdmonitor.service")
-  '';
+      machine.wait_for_unit("mdmonitor.service")
+    '';
 }

nixos/tests/web-apps/pdfding/basic.nix

@@ -34,6 +34,10 @@
 
         # enable mailpit
         services.mailpit.instances.default = { };
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/e2e.nix

@@ -42,6 +42,10 @@
             # it only cares about files in static/
           ))
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/postgres.nix

@@ -25,6 +25,10 @@
         environment.systemPackages = [
           config.services.postgresql.finalPackage
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/s3-backups.nix

@@ -92,6 +92,10 @@ in
           minio-client
           sqlite
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pixelfed/default.nix

@@ -4,6 +4,7 @@
 let
   supportedSystems = [
     "x86_64-linux"
+    "aarch64-linux"
     "i686-linux"
   ];
 in

nixos/tests/web-apps/pixelfed/standard.nix

@@ -4,7 +4,7 @@
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { pkgs, lib, ... }:
       {
         services.pixelfed = {
           enable = true;
@@ -19,16 +19,25 @@
           );
           settings."FORCE_HTTPS_URLS" = false;
         };
+
+        # to prevent getting killed by oom
+        virtualisation.memorySize = 2048;
+        virtualisation.emptyDiskImages = [ 4096 ];
+        swapDevices = [ { device = "/dev/vdb"; } ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 
   testScript = ''
     # Wait for Pixelfed PHP pool
-    server.wait_for_unit("phpfpm-pixelfed.service")
+    server.wait_for_unit("phpfpm-pixelfed.service", timeout=1800)
     # Wait for NGINX
-    server.wait_for_unit("nginx.service")
+    server.wait_for_unit("nginx.service", timeout=1800)
     # Wait for HTTP port
-    server.wait_for_open_port(80)
+    server.wait_for_open_port(80, timeout=1800)
     # Access the homepage.
     server.succeed("curl -H 'Host: pixelfed.local' http://localhost")
     # Create an account

nixos/tests/zfs.nix

@@ -1,12 +1,11 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  system,
+  pkgs,
+  runTest,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
+  inherit (pkgs) lib;
 
   makeZfsTest =
     {
@@ -15,11 +14,9 @@ let
       zfsPackage,
       extraTest ? "",
     }:
-    makeTest {
+    runTest {
       name = zfsPackage.kernelModuleAttribute;
-      meta = with pkgs.lib.maintainers; {
-        maintainers = [ elvishjerricco ];
-      };
+      meta.maintainers = with lib.maintainers; [ elvishjerricco ];
 
       nodes.machine =
         {
@@ -124,82 +121,90 @@ let
           };
         };
 
-      testScript = ''
-        machine.wait_for_unit("multi-user.target")
-        machine.succeed(
-            "zpool status",
-            "parted --script /dev/vdb mklabel msdos",
-            "parted --script /dev/vdb -- mkpart primary 1024M -1s",
-            "parted --script /dev/vdc mklabel msdos",
-            "parted --script /dev/vdc -- mkpart primary 1024M -1s",
-        )
+      testScript =
+        { nodes, ... }:
+        let
+          samba = nodes.machine.specialisation.samba.configuration.system.build.toplevel;
+          encryption = nodes.machine.specialisation.encryption.configuration.system.build.toplevel;
+          forcepool = nodes.machine.specialisation.forcepool.configuration.system.build.toplevel;
+        in
+        # python
+        ''
+          machine.wait_for_unit("multi-user.target")
+          machine.succeed(
+              "zpool status",
+              "parted --script /dev/vdb mklabel msdos",
+              "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+              "parted --script /dev/vdc mklabel msdos",
+              "parted --script /dev/vdc -- mkpart primary 1024M -1s",
+          )
 
-        with subtest("sharesmb works"):
-            machine.succeed(
-                "zpool create rpool /dev/vdb1",
-                "zfs create -o mountpoint=legacy rpool/root",
-                # shared datasets cannot have legacy mountpoint
-                "zfs create rpool/shared_smb",
-                "bootctl set-default nixos-generation-1-specialisation-samba.conf",
-                "sync",
-            )
-            machine.crash()
-            machine.wait_for_unit("multi-user.target")
-            machine.succeed("zfs set sharesmb=on rpool/shared_smb")
-            machine.succeed(
-                "smbclient -gNL localhost | grep rpool_shared_smb",
-                "umount /tmp/mnt",
-                "zpool destroy rpool",
-            )
+          with subtest("sharesmb works"):
+              machine.succeed(
+                  "zpool create rpool /dev/vdb1",
+                  "zfs create -o mountpoint=legacy rpool/root",
+                  # shared datasets cannot have legacy mountpoint
+                  "zfs create rpool/shared_smb",
+                  "${samba}/bin/switch-to-configuration boot",
+                  "sync",
+              )
+              machine.crash()
+              machine.wait_for_unit("multi-user.target")
+              machine.succeed("zfs set sharesmb=on rpool/shared_smb")
+              machine.succeed(
+                  "smbclient -gNL localhost | grep rpool_shared_smb",
+                  "umount /tmp/mnt",
+                  "zpool destroy rpool",
+              )
 
-        with subtest("encryption works"):
-            machine.succeed(
-                'echo password | zpool create -O mountpoint=legacy '
-                + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdb1",
-                "zpool create -O mountpoint=legacy manual /dev/vdc1",
-                "echo otherpass | zfs create "
-                + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted",
-                "zfs create -o encryption=aes-256-gcm -o keyformat=passphrase "
-                + "-o keylocation=http://localhost/zfskey manual/httpkey",
-                "bootctl set-default nixos-generation-1-specialisation-encryption.conf",
-                "sync",
-                "zpool export automatic",
-                "zpool export manual",
-            )
-            machine.crash()
-            machine.start()
-            machine.wait_for_console_text("Starting password query on")
-            machine.send_console("password\n")
-            machine.wait_for_unit("multi-user.target")
-            machine.succeed(
-                "zfs get -Ho value keystatus manual/encrypted | grep -Fx unavailable",
-                "echo otherpass | zfs load-key manual/encrypted",
-                "systemctl start manual-encrypted.mount",
-                "zfs load-key manual/httpkey",
-                "systemctl start manual-httpkey.mount",
-                "umount /automatic /manual/encrypted /manual/httpkey /manual",
-                "zpool destroy automatic",
-                "zpool destroy manual",
-            )
+          with subtest("encryption works"):
+              machine.succeed(
+                  'echo password | zpool create -O mountpoint=legacy '
+                  + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdb1",
+                  "zpool create -O mountpoint=legacy manual /dev/vdc1",
+                  "echo otherpass | zfs create "
+                  + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted",
+                  "zfs create -o encryption=aes-256-gcm -o keyformat=passphrase "
+                  + "-o keylocation=http://localhost/zfskey manual/httpkey",
+                  "${encryption}/bin/switch-to-configuration boot",
+                  "sync",
+                  "zpool export automatic",
+                  "zpool export manual",
+              )
+              machine.crash()
+              machine.start()
+              machine.wait_for_console_text("Starting password query on")
+              machine.send_console("password\n")
+              machine.wait_for_unit("multi-user.target")
+              machine.succeed(
+                  "zfs get -Ho value keystatus manual/encrypted | grep -Fx unavailable",
+                  "echo otherpass | zfs load-key manual/encrypted",
+                  "systemctl start manual-encrypted.mount",
+                  "zfs load-key manual/httpkey",
+                  "systemctl start manual-httpkey.mount",
+                  "umount /automatic /manual/encrypted /manual/httpkey /manual",
+                  "zpool destroy automatic",
+                  "zpool destroy manual",
+              )
 
-        with subtest("boot.zfs.forceImportAll works"):
-            machine.succeed(
-                "rm /etc/hostid",
-                "zgenhostid deadcafe",
-                "zpool create forcepool /dev/vdb1 -O mountpoint=legacy",
-                "bootctl set-default nixos-generation-1-specialisation-forcepool.conf",
-                "rm /etc/hostid",
-                "sync",
-            )
-            machine.crash()
-            machine.wait_for_unit("multi-user.target")
-            machine.fail("zpool import forcepool")
-            machine.succeed(
-                "systemctl start forcepool.mount",
-                "mount | grep forcepool",
-            )
-      ''
-      + extraTest;
+          with subtest("boot.zfs.forceImportAll works"):
+              machine.succeed(
+                  "rm /etc/hostid",
+                  "zgenhostid deadcafe",
+                  "zpool create forcepool /dev/vdb1 -O mountpoint=legacy",
+                  "${forcepool}/bin/switch-to-configuration boot",
+                  "rm /etc/hostid",
+                  "sync",
+              )
+              machine.crash()
+              machine.wait_for_unit("multi-user.target")
+              machine.fail("zpool import forcepool")
+              machine.succeed(
+                  "systemctl start forcepool.mount",
+                  "mount | grep forcepool",
+              )
+        ''
+        + extraTest;
 
     };
 
@@ -250,7 +255,7 @@ in
       systemdStage1 = true;
     }).zfsroot;
 
-  expand-partitions = makeTest {
+  expand-partitions = runTest {
     name = "multi-disk-zfs";
     nodes = {
       machine =

pkgs/applications/editors/vim/plugins/generated.nix

@@ -7309,6 +7309,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  heirline-components-nvim = buildVimPlugin {
+    pname = "heirline-components.nvim";
+    version = "2026-02-25";
+    src = fetchFromGitHub {
+      owner = "Zeioth";
+      repo = "heirline-components.nvim";
+      rev = "5ea9a16286c01b7c36d58c91903d1f8ff0b7ddeb";
+      sha256 = "0gij9c9qgmqc99fnqnvp6icxp32q0wkz536ric2x5vpbqlzsdkik";
+    };
+    meta.homepage = "https://github.com/Zeioth/heirline-components.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   heirline-nvim = buildVimPlugin {
     pname = "heirline.nvim";
     version = "1.0.8";

pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix

@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.45.0";
+  version = "2.45.1";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-Up4vH5yk13don0HrmHHpqrPIKtc1MTtDbZ6QcMHQYAU=";
+    hash = "sha256-1F6z/rhZxiuI6W1ReyHP6EQFxys4qm3fbINxoy1hQZA=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1753,6 +1753,10 @@ assertNoAdditions {
     checkInputs = [ self.telescope-nvim ];
   };
 
+  heirline-components-nvim = super.heirline-components-nvim.overrideAttrs {
+    nvimRequireCheck = "heirline-components.all";
+  };
+
   helm-ls-nvim = super.helm-ls-nvim.overrideAttrs {
     runtimeDeps = [
       helm-ls

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -521,6 +521,7 @@ https://github.com/travitch/hasksyn/,,
 https://github.com/StackInTheWild/headhunter.nvim/,,
 https://github.com/lukas-reineke/headlines.nvim/,,
 https://github.com/rebelot/heirline.nvim/,,
+https://github.com/Zeioth/heirline-components.nvim/,,
 https://github.com/qvalentin/helm-ls.nvim/,,
 https://github.com/OXY2DEV/helpview.nvim/,,
 https://github.com/RaafatTurki/hex.nvim/,,

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "2.1.0";
-    hash = "sha256-DTh8IoJfKuAoNx5XS41wZlafoJwi68g0oJn0vXbEGDo=";
+    version = "2.2.0";
+    hash = "sha256-HwgInQOaSKHSs8CU+Ng4jYA6aaP/g3l4CSb/0ewkmc4=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-fiPj/rkwNevJC2bTjRBkuhwdI3Sqgj3xsQB1yp6KxEM=";
+          hash = "sha256-q5j8Ip/ew3oHGIakJm/CTeKcW4O9FR062f4rILXbQrQ=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-NZy2I3cNZBM2oXUJ/mf56QW1edvcKu0HICAZq6VVF6U=";
+          hash = "sha256-viZxHDA8SfsIVB5R9I/8SB8EEWRvt1kpZPDA4w0sD54=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-admTed1OpngSd2BY368AkOQGWnVLX7KM4icgx2uNJYE=";
+          hash = "sha256-kL0bab7BT45EEh17jKFVHqaMQEYkxLlsDKtK1deoS4M=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-l39oH4LOgFrZ5598+YWvArIHrZHSz0NU9wOAMop7kNw=";
+          hash = "sha256-fJW6fTGRWLBWB1yZ1pGb3p4KkFLhrDXqw+0wjOv71Vo=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.158";
+      version = "2.1.161";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -618,8 +618,8 @@ let
         mktplcRef = {
           name = "github-markdown-preview";
           publisher = "bierner";
-          version = "0.3.0";
-          hash = "sha256-7pbl5OgvJ6S0mtZWsEyUzlg+lkUhdq3rkCCpLsvTm4g=";
+          version = "0.4.0";
+          hash = "sha256-bfj0rrZWVtgNfynap9+kdp8jAef0g9pTozEJwmkzhgU=";
         };
         meta = {
           description = "VSCode extension that changes the markdown preview to support GitHub markdown features";
@@ -3491,8 +3491,8 @@ let
         mktplcRef = {
           name = "veriloghdl";
           publisher = "mshr-h";
-          version = "1.23.2";
-          hash = "sha256-btwEFVhvNqCnMCftSt7CS6c4lAf29N3MxBAMriKDyjg=";
+          version = "1.25.0";
+          hash = "sha256-7DN0lYxwLL+Z0mIKApRHGHT7HiJZ0nfDMdojQm7XGAM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mshr-h.VerilogHDL/changelog";

pkgs/applications/editors/vscode/extensions/jjk.jjk/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "jjk";
     publisher = "jjk";
-    version = "0.10.0";
-    hash = "sha256-mzsujU3fil3z3yDxpecaOpbXX1K8oh+6dfx/rbOwFYs=";
+    version = "0.11.0";
+    hash = "sha256-hEgr8u6p2aI5TwjgC+iNF7M5oU+DLLZcw7M88Ech87w=";
   };
   meta = {
     changelog = "https://github.com/keanemind/jjk/releases";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-05-23";
+  version = "0-unstable-2026-06-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ccd8ae3d8d8e43100e9f596a66214a5b2acb2da1";
-    hash = "sha256-zznSKLjpc0ovgqzkpxBqVOMV7UZyuTx1R/x4SCbSPdo=";
+    rev = "ee042b73f8fe2aa9c8c73408b5bf200a3ce1a67b";
+    hash = "sha256-k1DvQHGQH/d6W7jTIAW9jIk0qVHUji3PeYAa8MuUP9w=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/puae.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "puae";
-  version = "0-unstable-2026-05-21";
+  version = "0-unstable-2026-06-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-uae";
-    rev = "9fda5f344470d6837e17b939b0f53e5afe938878";
-    hash = "sha256-gGuYxGRRGyBbHiyG7Gpoi2/frEI5d+ySo8JdZStznN8=";
+    rev = "2b0ed42fe565fb997a0627aaa8f44e0948b527f8";
+    hash = "sha256-gkCzHvoSqh9CluahSSe3+dhZG1HtiNH0orU404pwjgo=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-AFQV9frUBb8OutvJ0UM5bhMh9IownwQ37iGE1fPmps4=",
+    "hash": "sha256-uIggPhDgTMQei6LpXPzAbfbsoNjVN35P60QcqqHyCIA=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.15.0",
+    "rev": "v8.17.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1292,13 +1292,13 @@
     "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
   },
   "tailscale_tailscale": {
-    "hash": "sha256-h+VKIhmx3wa+kImQaHeqXYM8oxeH3Ic75bG7FHBKJ1g=",
+    "hash": "sha256-1cQq2nM4EJFFRtsnE7mXKJv4ILfJDtZSTX4hG/jNdwM=",
     "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
     "owner": "tailscale",
     "repo": "terraform-provider-tailscale",
-    "rev": "v0.29.1",
+    "rev": "v0.29.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-hl9govsnEXMd4VbOPqoSGLgSnImDA55enYTaDz2wKH0="
+    "vendorHash": "sha256-rD4W2PkRrIQfACm8UWdF0yfZ+Qc5hTjH1lA6U7GJxpE="
   },
   "telmate_proxmox": {
     "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",

pkgs/by-name/_1/_1password-gui/sources.json

@@ -29,28 +29,28 @@
   },
   "beta": {
     "linux": {
-      "version": "8.12.22-16.BETA",
+      "version": "8.12.24-24.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.22-16.BETA.x64.tar.gz",
-          "hash": "sha256-Kpmexrq6WpGpanTIYKaMIpM4rJiy8NV2TR8TILmuhr0="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.24-24.BETA.x64.tar.gz",
+          "hash": "sha256-2pdVY7X2qfSkxhSEIKod9+8zGsJ91r9rY3ODTjA4Bw8="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.22-16.BETA.arm64.tar.gz",
-          "hash": "sha256-7ZxrPLPdGizexCRMHkufi9WapFMApxwDw0VgBTpQ7bM="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.24-24.BETA.arm64.tar.gz",
+          "hash": "sha256-HIFlrclzIHZftUtYKyMRX9s1UjS//sibTFyhi0NU4pE="
         }
       }
     },
     "darwin": {
-      "version": "8.12.22-16.BETA",
+      "version": "8.12.24-24.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.22-16.BETA-x86_64.zip",
-          "hash": "sha256-Ce9A3UKGxJvABDlMhlw9gElGc2iKS+j+CvBnohij4mg="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.24-24.BETA-x86_64.zip",
+          "hash": "sha256-KXgqH7bFCIMdmruqnCel7tCWa8YdwKtajFv/HGxb7AE="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.22-16.BETA-aarch64.zip",
-          "hash": "sha256-sfBVX171OQfxh+v8367nmeVNATMRAJdIk+bS2KXF+BA="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.24-24.BETA-aarch64.zip",
+          "hash": "sha256-u8uRcR7z65Hs0jq3dXz4HNgI4UH4+AJjtPBH2keUXZI="
         }
       }
     }

pkgs/by-name/_9/_9pfs/package.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  fuse,
-  gitUpdater,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "9pfs";
-  version = "0.6";
-
-  src = fetchFromGitHub {
-    owner = "ftrvxmtrx";
-    repo = "9pfs";
-    tag = finalAttrs.version;
-    sha256 = "sha256-zJ1H5UfnTqGWCPt24Pi+Fr3K04wUiPVUmx1AH2sjXmM=";
-  };
-
-  postPatch = ''
-    substituteInPlace Makefile --replace-fail "pkg-config" "$PKG_CONFIG"
-  '';
-
-  makeFlags = [
-    "BIN=$(out)/bin"
-    "MAN=$(out)/share/man/man1"
-  ];
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fuse ];
-  enableParallelBuilding = true;
-
-  passthru.updateScript = gitUpdater { };
-
-  meta = {
-    homepage = "https://github.com/ftrvxmtrx/9pfs";
-    description = "FUSE-based client of the 9P network filesystem protocol";
-    mainProgram = "9pfs";
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-    license = with lib.licenses; [
-      lpl-102
-      bsd2
-    ];
-  };
-})

pkgs/by-name/ac/act/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "act";
-  version = "0.2.88";
+  version = "0.2.89";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = "act";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/nkaJlB2opuScXb8+Jo9rXdYN1Pwc+nq+T05Y4yxcCI=";
+    hash = "sha256-K3+JJHadA/+aayI5XtGBLgFRbCuu6Uilm45kumnlZUw=";
   };
 
-  vendorHash = "sha256-z7FX2hrF4DkmHu0K9Atc76pa+PPLylimpoWhQCeF5uA=";
+  vendorHash = "sha256-Gp4Bxq0n1gmqHwrggSonMsFbWMVeCIgeVKY1U1Oe6lU=";
 
   doCheck = false;
 

pkgs/by-name/af/afuse/001-darwin-fdatasync.patch

@@ -1,15 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index ef07d70..2da26aa 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -27,9 +27,9 @@ if test "$have_fuse_opt_parse" = no; then
- fi
- AM_CONDITIONAL(FUSE_OPT_COMPAT, test "$have_fuse_opt_parse" = no)
-
-
--AC_CHECK_FUNCS([setxattr fdatasync getline fgetln])
-+AC_CHECK_FUNCS([setxattr getline fgetln])
-
- AC_CONFIG_FILES([Makefile
-                  src/Makefile
-                  compat/Makefile])

pkgs/by-name/af/afuse/package.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  autoreconfHook,
-  fuse,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "afuse";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "pcarrier";
-    repo = "afuse";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-KpysJRvDx+12BSl9pIGRqbJAM4W1NbzxMgDycGCr2RM=";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-
-  buildInputs = [ fuse ];
-
-  patches = [ ./001-darwin-fdatasync.patch ];
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Fix the build on macOS with macFUSE installed
-    substituteInPlace configure.ac --replace-fail \
-      'export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH' \
-      ""
-  '';
-
-  meta = {
-    description = "Automounter in userspace";
-    homepage = "https://github.com/pcarrier/afuse";
-    license = lib.licenses.gpl2Only;
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-  };
-})

pkgs/by-name/al/algol68g/package.nix

@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "algol68g";
-  version = "3.12.1";
+  version = "3.12.2";
 
   src = fetchurl {
     # Uses archive.org because the original site removes older versions.
-    url = "https://web.archive.org/web/20260515052918/https://algol68genie.nl/algol68g-3.12.1.tar.gz";
-    hash = "sha256-Mdoca6W1Wyyv7WrmzaAW/fn0uLkXy6MwSDImVwB+mBk";
+    url = "https://web.archive.org/web/20260515052918/https://algol68genie.nl/algol68g-3.12.2.tar.gz";
+    hash = "sha256-4fiubqpgoH3YOlCg1bJHQ3kOayKNulW3CYbOK1awE7k";
   };
 
   outputs = [

pkgs/by-name/al/alpine-make-rootfs/package.nix

@@ -14,14 +14,14 @@
   util-linux,
   wget,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alpine-make-rootfs";
   version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "alpinelinux";
     repo = "alpine-make-rootfs";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ktGJXPJK94RbdqcgsA3fA8+MO0inaRcwaDLx18KFo1w=";
   };
 
@@ -55,4 +55,4 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/am/amnezia-vpn-bin/package.nix

@@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn-bin";
-  version = "4.8.15.4";
+  version = "4.8.16.0";
 
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/amnezia-vpn/amnezia-client/releases/download/${finalAttrs.version}/AmneziaVPN_${finalAttrs.version}_linux_x64.tar";
-    hash = "sha256-Dr8zuzgwMAPXOTh69URFvA7EzGMnfBFO6kPhjhtjr6A=";
+    hash = "sha256-0gffxBD0pNsyTvqAFdYdjI8rzCkyaXHOApSCu4waP7s=";
   };
 
   strictDeps = true;

pkgs/by-name/an/android-cli/package.nix

@@ -8,18 +8,19 @@
 }:
 
 let
+  version = "1.0.15498356";
   platformData = {
     x86_64-linux = {
-      url = "https://dl.google.com/android/cli/latest/linux_x86_64/android-cli";
-      hash = "sha256-1F9RVDPqiy60zs2CfWytKSPKeRC9KDTogw4Ml59HaeY=";
+      url = "https://dl.google.com/android/cli/${version}/linux_x86_64/android-cli";
+      hash = "sha256-TmwLwLKqnMCxWwtX8m50KflmisfeG3PjZsBs7z9vccU=";
     };
     x86_64-darwin = {
-      url = "https://dl.google.com/android/cli/latest/darwin_x86_64/android-cli";
-      hash = "sha256-bXP9rRMSqQa3+kfUJnIeDb1LZXh2P2A6ytwunzjyfGs=";
+      url = "https://dl.google.com/android/cli/${version}/darwin_x86_64/android-cli";
+      hash = "sha256-ThBobULyevoKlp/22tdUqnBBccX6FbPDNrSwwuK4wnw=";
     };
     aarch64-darwin = {
-      url = "https://dl.google.com/android/cli/latest/darwin_arm64/android-cli";
-      hash = "sha256-r47LXmilevW0td4N+SRTR7EFnCrPBdG7G/oTUAea90Q=";
+      url = "https://dl.google.com/android/cli/${version}/darwin_arm64/android-cli";
+      hash = "sha256-E3PC0Ivf6MoYRQu56dSD/49LI8DJZhXL27/o6daH0Sg=";
     };
   };
 
@@ -30,7 +31,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "android-cli";
-  version = "1.0.15433482";
+  inherit version;
 
   strictDeps = true;
   __structuredAttrs = true;

pkgs/by-name/an/antigravity-cli/package.nix

@@ -8,24 +8,24 @@
 
 let
   # Version and platform-specific data retrieved from Google's manifests
-  version = "1.0.3";
+  version = "1.0.6";
 
   sourceData = {
     "x86_64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-UM/b3TuXROHHx0dKMU0KtENNREmY+VAYKmxRWewu/ic=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.6-5359777384103936/linux-x64/cli_linux_x64.tar.gz";
+      hash = "sha256-rxDLuuium+yQl3SiRcFhLzC5+ZCZU/tG2LQfFZMOYx4=";
     };
     "aarch64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-Cp44KTj1wP85y6Z6oCOd1ylL2nTg1mDx7aJuv/Q7nBE=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.6-5359777384103936/linux-arm/cli_linux_arm64.tar.gz";
+      hash = "sha256-Mol5V3Lt2A89yrGdwWiOdv4y5dCZkMaT8onXG6IsQtc=";
     };
     "aarch64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-lbf6dCJ7QhDNomfpi10Dhk9VShxAxTC0zsFIFpGlbtA=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.6-5359777384103936/darwin-arm/cli_mac_arm64.tar.gz";
+      hash = "sha256-GmAxVP6KW0Zii2kSDvwwzsa88r/4ko2BVVpS8BeING4=";
     };
     "x86_64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-B1zPkt4h3JN7ZWhin0iTQMCe+NhVvBGKWCLfKnBrZnw=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.6-5359777384103936/darwin-x64/cli_mac_x64.tar.gz";
+      hash = "sha256-RqjKhRqiW6Fg61eYzem+uXb5LXBYi5Cyv0hwtCaqomo=";
     };
   };
 

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.14";
+  version = "1.2.15";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+yvQK6mrDT9MOeJsEJp4maycz6jpyAnGkc4QddaCbDo=";
+    hash = "sha256-/Y5JqCCqbP+5Of4K6+Bdag9lLKiY/SJiz6x3W6gQnDE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-ITxeRtPJmLEqD8BundfWdQO10XGHaElL2vpYFSM24pQ=";
+  vendorHash = "sha256-cp29oB3YcqQljeLq4ySOMhV+CXYnQ+ZnDljHn0UzmWs=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

pkgs/by-name/ar/arc-icon-theme/package.nix

@@ -10,14 +10,14 @@
   hicolor-icon-theme,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-icon-theme";
   version = "20161122";
 
   src = fetchFromGitHub {
     owner = "horst3180";
     repo = "arc-icon-theme";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-TfYtzwo69AC5hHbzEqB4r5Muqvn/eghCGSlmjMCFA7I=";
   };
 
@@ -45,4 +45,4 @@ stdenvNoCC.mkDerivation rec {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ romildo ];
   };
-}
+})

pkgs/by-name/ar/arc-theme/package.nix

@@ -15,15 +15,15 @@
   python3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "arc-theme";
   version = "20221218";
 
   src = fetchFromGitHub {
     owner = "jnsh";
     repo = "arc-theme";
-    tag = version;
-    sha256 = "sha256-7VmqsUCeG5GwmrVdt9BJj0eZ/1v+no/05KwGFb7E9ns=";
+    tag = finalAttrs.version;
+    hash = "sha256-7VmqsUCeG5GwmrVdt9BJj0eZ/1v+no/05KwGFb7E9ns=";
   };
 
   nativeBuildInputs = [
@@ -71,4 +71,4 @@ stdenv.mkDerivation rec {
       romildo
     ];
   };
-}
+})

pkgs/by-name/aw/aws-vault/package.nix

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.10.8";
+  version = "7.11.1";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h7/OGylN2FOC5ESsOV4JHVFZjG7Qv7JHOVlfqqpSWbE=";
+    hash = "sha256-GsE8UtER5KDIlVA36uFVoKPsX2pJNwotKtaizZH33t0=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-FzA58f2aBNs3OG+o0XpKiAbwe7w3GsBTo7h83gkfRSE=";
+  vendorHash = "sha256-spGYYxSeAfbOy+ze854IBBxxv07jnmE9rNGGqenkkCw=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/be/betterleaks/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "betterleaks";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "betterleaks";
     repo = "betterleaks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bPrOp5PP5BxkSOA7wUmq/bbVPg+bwymGQ0rl8PvPSAE=";
+    hash = "sha256-bDyWTye+OEzgqzJukWCEjl4NsD1udHr+tSP3e1ahj/4=";
   };
 
   vendorHash = "sha256-RStdC7M0+bPNXwaATxkMOBGf1OrT0pqlNPTJ7TCelfk=";

pkgs/by-name/bl/blender/package.nix

@@ -1,5 +1,4 @@
 {
-  SDL,
   addDriverRunpath,
   alembic,
   apple-sdk_15,
@@ -14,8 +13,8 @@
   cudaSupport ? config.cudaSupport,
   dbus,
   embree,
-  fetchzip,
   fetchFromGitHub,
+  fetchzip,
   ffmpeg_7,
   fftw,
   fftwFloat,
@@ -26,16 +25,11 @@
   jackaudioSupport ? false,
   jemalloc,
   lib,
-  libGL,
-  libGLU,
-  libx11,
-  libxext,
-  libxi,
-  libxrender,
-  libxxf86vm,
   libdecor,
   libepoxy,
   libffi,
+  libGL,
+  libGLU,
   libharu,
   libjack2,
   libjpeg,
@@ -45,13 +39,18 @@
   libspnav,
   libtiff,
   libwebp,
+  libx11,
+  libxext,
+  libxi,
   libxkbcommon,
+  libxrender,
+  libxxf86vm,
   llvmPackages,
   makeWrapper,
   manifold,
   mesa,
   nix-update-script,
-  openUsdSupport ? !stdenv.hostPlatform.isDarwin,
+  onetbb,
   openal,
   opencolorio,
   openexr,
@@ -60,6 +59,7 @@
   openjpeg,
   openpgl,
   opensubdiv,
+  openUsdSupport ? !stdenv.hostPlatform.isDarwin,
   openvdb,
   openxr-loader,
   pkg-config,
@@ -70,11 +70,11 @@
   rocmSupport ? config.rocmSupport,
   rubberband,
   runCommand,
+  SDL,
   shaderc,
   spaceNavSupport ? stdenv.hostPlatform.isLinux,
   sse2neon,
   stdenv,
-  onetbb,
   vulkan-headers,
   vulkan-loader,
   wayland,
@@ -181,7 +181,7 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_CYCLES_DEVICE_OPTIX" cudaSupport)
     (lib.cmakeBool "WITH_CYCLES_EMBREE" embreeSupport)
     (lib.cmakeBool "WITH_CYCLES_OSL" true)
-    (lib.cmakeBool "WITH_SYSTEM_GLOG" true)
+    (lib.cmakeBool "WITH_CYCLES_PARALLEL_DEVICE_KERNEL_BUILD" true)
     (lib.cmakeBool "WITH_HYDRA" openUsdSupport)
     (lib.cmakeBool "WITH_INSTALL_PORTABLE" false)
     (lib.cmakeBool "WITH_JACK" jackaudioSupport)
@@ -193,6 +193,7 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_PYTHON_INSTALL_NUMPY" false)
     (lib.cmakeBool "WITH_PYTHON_INSTALL_REQUESTS" false)
     (lib.cmakeBool "WITH_STRICT_BUILD_OPTIONS" true)
+    (lib.cmakeBool "WITH_SYSTEM_GLOG" true)
     (lib.cmakeBool "WITH_USD" openUsdSupport)
 
     # Blender supplies its own FindAlembic.cmake (incompatible with the Alembic-supplied config file)
@@ -210,9 +211,7 @@ stdenv'.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals waylandSupport [
     (lib.cmakeBool "WITH_GHOST_WAYLAND" true)
-    (lib.cmakeBool "WITH_GHOST_WAYLAND_DBUS" true)
     (lib.cmakeBool "WITH_GHOST_WAYLAND_DYNLOAD" false)
-    (lib.cmakeBool "WITH_GHOST_WAYLAND_LIBDECOR" true)
   ]
   ++ lib.optionals stdenv.cc.isClang [
     (lib.cmakeFeature "PYTHON_LINKFLAGS" "") # Clang doesn't support "-export-dynamic"
@@ -277,8 +276,9 @@ stdenv'.mkDerivation (finalAttrs: {
     openjpeg
     openpgl
     (opensubdiv.override { inherit cudaSupport; })
-    openvdb
     onetbb
+    openvdb
+    openxr-loader
     potrace
     pugixml
     python3
@@ -302,7 +302,6 @@ stdenv'.mkDerivation (finalAttrs: {
         libxrender
         libxxf86vm
         openal
-        openxr-loader
       ]
     else
       [
@@ -312,7 +311,6 @@ stdenv'.mkDerivation (finalAttrs: {
         apple-sdk_15
         brotli
         llvmPackages.openmp
-        openxr-loader
       ]
   )
   ++ lib.optionals stdenv.hostPlatform.isAarch64 [ sse2neon ]
@@ -448,17 +446,15 @@ stdenv'.mkDerivation (finalAttrs: {
   meta = {
     description = "3D Creation/Animation/Publishing System";
     homepage = "https://www.blender.org";
-    # They comment two licenses: GPLv2 and Blender License, but they
-    # say: "We've decided to cancel the BL offering for an indefinite period."
     # OptiX, enabled with cudaSupport, is non-free.
     license = with lib.licenses; [ gpl2Plus ] ++ lib.optional cudaSupport nvidiaCudaRedist;
     donationPage = "https://fund.blender.org/";
 
     platforms = [
+      "aarch64-darwin"
       "aarch64-linux"
       "x86_64-darwin"
       "x86_64-linux"
-      "aarch64-darwin"
     ];
     maintainers = with lib.maintainers; [
       amarshall

pkgs/by-name/bl/blender/wrapper.nix

@@ -15,15 +15,12 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
   ];
   installPhase = ''
-    mkdir $out/{share/applications,bin} -p
-    sed 's/Exec=blender/Exec=${finalAttrs.finalPackage.pname}/g' $src/share/applications/blender.desktop > $out/share/applications/${finalAttrs.finalPackage.pname}.desktop
-    cp -r $src/share/blender $out/share
-    cp -r $src/share/doc $out/share
-    cp -r $src/share/icons $out/share
+    mkdir $out/bin -p
+    cp -r $src/share $out/share
 
     buildPythonPath "''${pythonPath[*]}"
 
-    makeWrapper ${blender}/bin/blender $out/bin/${finalAttrs.finalPackage.pname} \
+    makeWrapper ${blender}/bin/blender $out/bin/blender \
       --prefix PATH : $program_PATH \
       --prefix PYTHONPATH : $program_PYTHONPATH
   '';

pkgs/by-name/bo/boinc/package.nix

@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "boinc";
-  version = "8.2.11";
+  version = "8.2.13";
 
   src = fetchFromGitHub {
     name = "${pname}-${version}-src";
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-xWEAjTWEUCTTtxfCFFMcrJD0DRVmUAgi2vE0GifTX2Q=";
+    hash = "sha256-BzP3yDGAhJ1DtrxLEc3s27EwJilMVi6A1NoTv0NwH9c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ch/checkov/package.nix

@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.2.530";
+  version = "3.2.533";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-Vb9dtlw/fiDRVZ7Mc8RaXvzu6aKQaCiCJHMdIyo4AHY=";
+    hash = "sha256-WuHmMqtDcivwsZpvZB5wQuKWm5BoDSX4LGJEW7oKJrA=";
   };
 
   pythonRelaxDeps = [
@@ -96,6 +96,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     docker
     dockerfile-parse
     dpath
+    ecdsa
     flake8
     gitpython
     igraph

pkgs/by-name/ch/checkstyle/package.nix

@@ -8,17 +8,17 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.4.2";
+  version = "13.5.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-0ENLO/hP/MXVU358Ys83cH1Adl8CTbT/zcG9/tOBIC8=";
+    hash = "sha256-2v6ccNG4t8cXObMdztX+Y+PVuiqt4Fd5IR7j5bk5IaA=";
   };
 
-  mvnHash = "sha256-eRNJOrSP9GcuF226kZi5ef3shm1PdTEsGvjpi46cfSw=";
+  mvnHash = "sha256-M830+mpd7fAbzZGUQiTJZUKPe64zYUKp6QRqTrSOy7w=";
 
   nativeBuildInputs = [
     maven

pkgs/by-name/ch/chow-phaser/package.nix

@@ -26,7 +26,6 @@
   libsysprof-capture,
   libthai,
   libxkbcommon,
-  pcre,
   pkg-config,
   python3,
   sqlite,
@@ -74,7 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
     libsysprof-capture
     libthai
     libxkbcommon
-    pcre
     python3
     sqlite
     gcc-unwrapped

pkgs/by-name/ch/chow-tape-model/package.nix

@@ -27,8 +27,6 @@
   libuuid,
   libxkbcommon,
   lv2,
-  pcre,
-  pcre2,
   pkg-config,
   python3,
   sqlite,
@@ -82,8 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     libuuid
     libxkbcommon
     lv2
-    pcre
-    pcre2
     python3
     sqlite
   ];

pkgs/by-name/ci/ciopfs/package.nix

@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  fuse,
-  glib,
-  attr,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ciopfs";
-  version = "0.4";
-
-  src = fetchurl {
-    url = "https://www.brain-dump.org/projects/ciopfs/ciopfs-${finalAttrs.version}.tar.gz";
-    sha256 = "0sr9i9b3qfwbfvzvk00yrrg3x2xqk1njadbldkvn7hwwa4z5bm9l";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    fuse
-    glib
-    attr
-  ];
-
-  makeFlags = [
-    "DESTDIR=$(out)"
-    "PREFIX="
-  ];
-
-  meta = {
-    homepage = "https://www.brain-dump.org/projects/ciopfs/";
-    description = "Case-insensitive filesystem layered on top of any other filesystem";
-    license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.158",
-  "commit": "96d5f49347b9949c6a3e6287cbb62b8939b7e1c2",
-  "buildDate": "2026-05-29T23:34:41Z",
+  "version": "2.1.161",
+  "commit": "6a550aea7c747b1b0ddd8bb61dbe199c4ad41320",
+  "buildDate": "2026-06-02T01:55:49Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "536a0517fa64d48ddcbc8eb511a3d08027d47e06d148872332a8041d72c22768",
-      "size": 215233824
+      "checksum": "5b4dc79eab05f9756c252c71deb339efa4429dffc1967dd8392cf87fcde4867f",
+      "size": 218040864
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "b7b33293702fb8e0a119b795d5af5178bd346fb46d4d7f161336d521f62d1451",
-      "size": 217747984
+      "checksum": "6f874fecac8a951f5f1991dc1470bc85a5e24f2588859b89cca0f1b6b5592310",
+      "size": 220555024
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "98807675a3ed5b7b775f7eaa81eda32cba2810b97e9db9f6f98d7bd658cec00e",
-      "size": 240563848
+      "checksum": "7dfa0a79a2fc9f332057cdc0302f808cba63df7b75e2ccb5a7c1ab62639804e3",
+      "size": 243316360
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "dd27008acd42700bac5762652ec83ff604bf9ae0786d4dde55d57a6866017fbe",
-      "size": 240666320
+      "checksum": "1f6a22f387a3bce496b6d869389a35dffb5a69c97d9831833f3bd6dc0e6c6c28",
+      "size": 243439312
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "742329f43930cbb1122eb1fe7aca339cb3dfb67be83cd256867859fba1e79ce2",
-      "size": 233418584
+      "checksum": "8318d4039c60fbb21a53e81f93e46a3b1dcdb9b07462f6fee72d99c9d2b93f83",
+      "size": 236171096
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "56d66c89bf8d3e8efdab965e1dcc840d993212b40a2e89c751567c4bc605beba",
-      "size": 235060272
+      "checksum": "f8e09e0b16502c277ca8a296245eb59f421e424763a99fd132551b701a713bcf",
+      "size": 237833264
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "10fa305545b20baf6e074a086762bd252b89dfe7035848a5d41385503b1a6c74",
-      "size": 236306080
+      "checksum": "3b0b64caf3428fac3751bd1903c350870b34f9e7a4390ac7c2fdb3a711656a04",
+      "size": 239007904
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "9e0e303015eb3c9aba782b366b35194073ab8130ac6c091c2c46870798a20bdc",
-      "size": 232271008
+      "checksum": "f4a7d910fc5a8b46afc14c36108c46c8b0deeb8f316c6b7e4ede77868ce70acf",
+      "size": 234972832
     }
   }
 }

pkgs/by-name/co/codeql/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.25.5";
+  version = "2.25.6";
 
   dontConfigure = true;
   dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-pD8F2VoWQELKYP/fT2jKr0k4+mq0ZF7/fxyDdlG9JYA=";
+    hash = "sha256-1VLmiheNtN6EkPZfgP35hnAiIKhpnuFhigQd6W5DbxU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/coroot/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TF1Z4IXXTGWkx6oH3MAE+I1AJ+jO7X8Py9lMQwritMc=";
+    hash = "sha256-FntRLdYazY/FeZrOp+DEV3eaaVhn5hxlE4dkUGbemTc=";
   };
 
   vendorHash = "sha256-npMQah59pJqF6wgD2dlEleneIZbP/atDGEpjjb+KCpI=";

pkgs/by-name/cr/cromfs/package.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  fuse,
-  perl,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "cromfs";
-  version = "1.5.10.2";
-
-  src = fetchurl {
-    url = "https://bisqwit.iki.fi/src/arch/cromfs-${finalAttrs.version}.tar.bz2";
-    sha256 = "0xy2x1ws1qqfp7hfj6yzm80zhrxzmhn0w2yns77im1lmd2h18817";
-  };
-
-  postPatch = "patchShebangs configure";
-
-  installPhase = ''
-    install -d $out/bin
-    install cromfs-driver $out/bin
-    install util/cvcromfs $out/bin
-    install util/mkcromfs $out/bin
-    install util/unmkcromfs $out/bin
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    fuse
-    perl
-  ];
-
-  makeFlags = [ "CXXFLAGS=-std=c++03" ];
-
-  meta = {
-    description = "FUSE Compressed ROM filesystem with lzma";
-    homepage = "https://bisqwit.iki.fi/source/cromfs.html";
-    license = lib.licenses.gpl3;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/ct/ctlptl/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ctlptl";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = "ctlptl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4c/sEWzKhs0PjHmZzVs8jXdWe2GWHYNFGsA9cQF5tOI=";
+    hash = "sha256-/E1E3agKPYIgBjhUDGr2eKmoWH3tAbx+eSQRnDja2k0=";
   };
 
-  vendorHash = "sha256-nlLx2+NdhqkhpwM7E5PwKcFW+MsJLeSoXWRdtQjFV4Q=";
+  vendorHash = "sha256-uARktb9Umo/SkJ8UvbOZhNSYb2ooXFybHhtY4xIVSFs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/cu/curlftpfs/fix-rpl_malloc.patch

@@ -1,13 +0,0 @@
-diff -Naur a/configure.ac b/configure.ac
---- a/configure.ac	2008-04-23 20:37:42.000000000 +0900
-+++ b/configure.ac	2021-05-16 01:28:24.000000000 +0900
-@@ -46,9 +46,7 @@
- 
- # Checks for library functions.
- AC_FUNC_CHOWN
--AC_FUNC_MALLOC
- AC_FUNC_MKTIME
--AC_FUNC_REALLOC
- AC_FUNC_SELECT_ARGTYPES
- AC_FUNC_STRFTIME
- AC_FUNC_UTIME_NULL

pkgs/by-name/cu/curlftpfs/package.nix

@@ -1,63 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  autoreconfHook,
-  fuse,
-  curl,
-  pkg-config,
-  glib,
-  zlib,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "curlftpfs";
-  version = "0.9.2";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/curlftpfs/curlftpfs-${finalAttrs.version}.tar.gz";
-    sha256 = "0n397hmv21jsr1j7zx3m21i7ryscdhkdsyqpvvns12q7qwwlgd2f";
-  };
-
-  patches = [
-    # This removes AC_FUNC_MALLOC and AC_FUNC_REALLOC from configure.ac because
-    # it is known to cause problems. Search online for "rpl_malloc" and
-    # "rpl_realloc" to find out more.
-    ./fix-rpl_malloc.patch
-    ./suse-bug-580609.patch
-    ./suse-bug-955687.patch
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-  buildInputs = [
-    fuse
-    curl
-    glib
-    zlib
-  ];
-
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    CFLAGS = "-D__off_t=off_t";
-  };
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Fix the build on macOS with macFUSE installed. Needs autoreconfHook for
-    # this change to effect
-    substituteInPlace configure.ac --replace \
-      'export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH' \
-      ""
-  '';
-
-  doCheck = false; # fails, doesn't work well too, btw
-
-  meta = {
-    description = "Filesystem for accessing FTP hosts based on FUSE and libcurl";
-    mainProgram = "curlftpfs";
-    homepage = "https://curlftpfs.sourceforge.net";
-    license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.unix;
-  };
-})

pkgs/by-name/cu/curlftpfs/suse-bug-580609.patch

@@ -1,10 +0,0 @@
---- a/ftpfs.c	2008-04-30 01:05:47.000000000 +0200
-+++ b/ftpfs.c	2010-05-21 13:01:42.569006163 +0200
-@@ -503,7 +503,6 @@ static void *ftpfs_write_thread(void *da
-   
-   curl_easy_setopt_or_die(fh->write_conn, CURLOPT_URL, fh->full_path);
-   curl_easy_setopt_or_die(fh->write_conn, CURLOPT_UPLOAD, 1);
--  curl_easy_setopt_or_die(fh->write_conn, CURLOPT_INFILESIZE, -1);
-   curl_easy_setopt_or_die(fh->write_conn, CURLOPT_READFUNCTION, write_data_bg);
-   curl_easy_setopt_or_die(fh->write_conn, CURLOPT_READDATA, fh);
-   curl_easy_setopt_or_die(fh->write_conn, CURLOPT_LOW_SPEED_LIMIT, 1);

pkgs/by-name/cu/curlftpfs/suse-bug-955687.patch

@@ -1,11 +0,0 @@
---- a/ftpfs.c
-+++ b/ftpfs.c
-@@ -614,6 +614,8 @@ static void free_ftpfs_file(struct ftpfs
-   sem_destroy(&fh->data_need);
-   sem_destroy(&fh->data_written);
-   sem_destroy(&fh->ready);
-+  if (fh->buf.size) { buf_free(&fh->buf); }
-+  if (fh->stream_buf.size) { buf_free(&fh->stream_buf); }
-   free(fh);
- }
- 

pkgs/by-name/da/dashy-ui/package.nix

@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "4.0.7";
+  version = "4.2.2";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-PWuynBFOp4A/0AC5Lc5zAkb5Y5DWJgdZHtDc/douYQc=";
+    hash = "sha256-8oShyf4TfHjPG/yxK1sbZA5gHyqOQYqfoUEDQlaJgU0=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-jU/XnX6i6P1CWWWyUeVXt2q2PXMExDvmPTiLBOEuHcE=";
+    hash = "sha256-5a2ypu6A4WOGdcm6HlvuzuCEgq3szd64zqTp/rmnjh4=";
   };
 
   passthru = {

pkgs/by-name/de/deadlock-mod-manager/package.nix

@@ -4,7 +4,7 @@
   rustPlatform,
   cargo-tauri,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   pkg-config,
@@ -27,26 +27,26 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deadlock-mod-manager";
-  version = "0.18.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "deadlock-mod-manager";
     repo = "deadlock-mod-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+64Y6BFwgQIQhmFzZXOeJ/IGFn+OXV58I/ZdARVFt4w=";
+    hash = "sha256-tSOSjapAlAd63Xkc+MNFVKn1k4+AtW3w3GhicRTV9Pg=";
   };
 
   cargoRoot = "apps/desktop";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-6ljyPdobcoBaYyarc7Iin5N24y1YXPafrYAk2xvBtvY=";
+  cargoHash = "sha256-x0lhn8nAV9xTgWbRAabJscATSCNpkKpzWvdnuZ4BEvw=";
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     cargo-tauri.hook
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
     pkg-config
     wrapGAppsHook3
   ];
@@ -76,10 +76,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       version
       src
       ;
-    pnpm = pnpm_9;
+    pnpm = pnpm_11;
     fetcherVersion = 3;
     sourceRoot = "source";
-    hash = "sha256-6lMTvlkIeM9kkbFhHzS9jJsHk2bVZWZs6GPgn+X3Rss=";
+    hash = "sha256-zl+ZrI21EnMBeMInKvEkUObiZ0OA5SJLJjnHwu/Dagc=";
   };
 
   patches = [
@@ -88,9 +88,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.VITE_API_URL = "https://api.deadlockmods.app";
 
-  # Skip tests that require network access
   checkFlags = [
+    # Requires network access
     "--skip=download_manager::downloader::tests::test_download_file"
+    # Asserts that set_steam_dir rejects a non-Steam directory, but steamlocate
+    # 2.1.0's SteamDir::from_dir only checks that the path is a directory
+    # (further validation is an upstream TODO), so this fails in any environment.
+    "--skip=mod_manager::steam_manager::tests::set_steam_dir_rejects_invalid_directory"
   ];
 
   preFixup = ''

pkgs/by-name/de/deja/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "deja";
-  version = "0.2.7";
+  version = "0.3.0";
   __structuredAttrs = true;
   src = fetchFromGitHub {
     owner = "Giammarco-Ferranti";
     repo = "deja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HHD9x7oM9b0Bt9QhtMhirwobW/o/zjiCVPCFKTn838g=";
+    hash = "sha256-xxbClKhhSwo+jUjAZ2gS4yOS5sSI76dfPpDzA3qdV18";
   };
 
   vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";

pkgs/by-name/de/deltachat-desktop/package.nix

@@ -21,37 +21,37 @@
 
 let
   deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.49.0";
+    version = "2.51.0";
     src = fetchFromGitHub {
       owner = "chatmail";
       repo = "core";
       tag = "v${version}";
-      hash = "sha256-iMgWXlffbGG25iM/SMCQzer1J6clDWwP0hURloL3n2k=";
+      hash = "sha256-OXazjp3w4NxbcTUNsyeU46erbdj27n1I7dvt+Io/AZ0=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "chatmail-core";
       inherit version src;
-      hash = "sha256-0QhMJis1Hbl/Tn3Rwiz+UjCSieodfYhgL060DWjEOIM=";
+      hash = "sha256-gt//65v9PF2nnX/zkZGU9hm73lfzOTmw36rbkWu9VX0=";
     };
   };
   electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "2.49.1";
+  version = "2.51.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JTbhKOTtPNlromdOsdekw6hhuE4gRwm1QB+5qaKy53o=";
+    hash = "sha256-ORp8lZcHzswrSCe30cGKpZdyqZCcvqLgu2hwvadMHN0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-UZ6/OTUtIiOA1D5PanY4aS+VCBNj/AIbIGYe1eibGMQ=";
+    hash = "sha256-OP+FbBxSnyFdeKvhqhmdEr1htFSX+WoPj6Ti8Q+ab/Y=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/de/deltachat-tauri/package.nix

@@ -27,24 +27,24 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deltachat-tauri";
-  version = "2.49.1";
+  version = "2.51.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JTbhKOTtPNlromdOsdekw6hhuE4gRwm1QB+5qaKy53o=";
+    hash = "sha256-ORp8lZcHzswrSCe30cGKpZdyqZCcvqLgu2hwvadMHN0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-UZ6/OTUtIiOA1D5PanY4aS+VCBNj/AIbIGYe1eibGMQ=";
+    hash = "sha256-OP+FbBxSnyFdeKvhqhmdEr1htFSX+WoPj6Ti8Q+ab/Y=";
   };
 
-  cargoHash = "sha256-xxO17cpZ86Pg/zlfoEYLdBkY9MstsgNqoJbPWxTaXrw=";
+  cargoHash = "sha256-JhsoIQZrU4GVcs/TCIug6y/84gODyEWl0Bl2jRNxL5Y=";
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $cargoDepsCopy/source-registry-0/libappindicator-sys-*/src/lib.rs \

pkgs/by-name/di/distrho-ports/package.nix

@@ -10,6 +10,7 @@
   libxcursor,
   libxext,
   libxrender,
+  lv2,
   meson,
   ninja,
   pkg-config,
@@ -31,13 +32,14 @@ let
 in
 stdenv.mkDerivation {
   pname = "distrho-ports";
-  version = "2021-03-15-unstable-2024-05-01";
+  version = "2021-03-15-unstable-2025-08-15";
 
   src = fetchFromGitHub {
     owner = "DISTRHO";
     repo = "DISTRHO-Ports";
-    rev = "b3596e6a690eb0556e69e8b6d943fee2dfbb04fb";
-    sha256 = "00fgqwayd20akww3n2imyqscmyrjyc9jj0ar13k9dhpaxqk2jxbf";
+    rev = "d3b62da2e83c69b0866af5bb2e29ac78dc8014cf";
+    sha256 = "sha256-wlppmRTdgA/9wWqFp75UyDLYJOqzg1aY+w97wTgJ8lk=";
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
@@ -54,14 +56,20 @@ stdenv.mkDerivation {
     libxcursor
     libxext
     libxrender
+    lv2
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
+  postPatch = ''
+    chmod +x scripts/*.sh
+    patchShebangs scripts
+  '';
+
   postFixup =
     let
       files = [
-        (lib.optionalString buildLV2 "$out/lib/lv2/vitalium.lv2/vitalium.so")
+        (lib.optionalString buildLV2 "$out/lib/lv2/vitalium.lv2/vitalium-lv2.so")
         (lib.optionalString buildVST2 "$out/lib/vst/vitalium.so")
         (lib.optionalString buildVST3 "$out/lib/vst3/vitalium.vst3/Contents/x86_64-linux/vitalium.so")
       ];

pkgs/by-name/di/dix/package.nix

@@ -7,18 +7,26 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "1.4.2";
+  version = "2.0.0";
 
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
-    owner = "faukah";
+    owner = "manic-systems";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5mn79jtV9gct4LdU5tdz7Q7GHTM2v0Cb2cso0A0dZX0=";
+    hash = "sha256-5aH8zX/Wm+KHzd1fjmjlxjDB+psDG42JAY5U8lrjGDU=";
   };
 
-  cargoHash = "sha256-1DtxGaahPFGZcQMX8GHZ0jSpMqSRIGKE3pZSdCVoKnU=";
+  cargoHash = "sha256-llStz2BaHBH9iHhfbptAE+Td5HPsvzAlPtXohrCxY4w=";
+
+  env.TMPDIR = "/tmp/";
+  checkFlags = [
+    "--skip=store::nix_command::tests::test_query_closure_path_info"
+    "--skip=store::nix_command::tests::test_query_closure_size"
+    "--skip=store::nix_command::tests::test_query_dependents"
+    "--skip=store::nix_command::tests::test_query_system_derivations"
+  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
@@ -26,9 +34,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://github.com/faukah/dix";
+    homepage = "https://github.com/manic-systems/dix";
     description = "Blazingly fast tool to diff Nix related things";
+    changelog = "https://github.com/manic-systems/dix/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     maintainers = with lib.maintainers; [
       faukah
       NotAShelf

pkgs/by-name/do/doctl/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.160.0";
+  version = "1.160.1";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LXALzs5oubT1uL+sgA0LsaoFbir3e8JYVlIiJv6U5J4=";
+    hash = "sha256-M+DBJfUXymlzY9DJeyHl3SPaCIKCT2iN/I4rd3uyQbQ=";
   };
 
   meta = {

pkgs/by-name/do/dosbox-x/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosbox-x";
-  version = "2026.05.02";
+  version = "2026.06.02";
 
   src = fetchFromGitHub {
     owner = "joncampbell123";
     repo = "dosbox-x";
     rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-4P6NH3LZgnV3CpakdKQhW+29hQl2Q30N5fScZgdk84E=";
+    hash = "sha256-60ZMaevTqYjHq6WrhKVQ8T8kfrQV7Auy59y3JFMHi5w=";
   };
 
   # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants
@@ -88,12 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
   # Tests for SDL_net.h for modem & IPX support, not automatically picked up due to being in SDL2 subdirectory
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2_net}/include/SDL2";
 
-  configureFlags = [ "--enable-sdl2" ];
+  configureFlags = [ (lib.strings.enableFeature true "sdl2") ];
 
   enableParallelBuilding = true;
 
-  hardeningDisable = [ "format" ]; # https://github.com/joncampbell123/dosbox-x/issues/4436
-
   # Build optional App Bundle target, which needs at least one arch-suffixed binary
   postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
     cp src/dosbox-x src/dosbox-x-$(uname -m)

pkgs/by-name/ec/ecsk/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ecsk";
-  version = "0.9.3";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "yukiarrr";
     repo = "ecsk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1nrV7NslOIXQDHsc7c5YfaWhoJ8kfkEQseoVVeENrHM=";
+    hash = "sha256-wCv3wyD2KM4Jzawd6Z4JFLCafsDp0W40ygbB05h7r0I=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ed/eden/package.nix

@@ -57,27 +57,16 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eden";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitea {
     domain = "git.eden-emu.dev";
     owner = "eden-emu";
     repo = "eden";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q/tJP6AHAtW9AXn9G+8dF4oTlKDfNHN4cuTKXtYq0T8=";
+    hash = "sha256-79/JmIRWysoc3psJqMFyiNc2gjTY4VhJfdNaiTvisMk=";
   };
 
-  patches = [
-    (fetchpatch {
-      # httplib uses `SameMinorVersion` compatibility for its CMake files which
-      # makes it reject the nixpkgs version which is newer
-      name = "revert-httplib-version-specification.patch";
-      url = "https://git.eden-emu.dev/eden-emu/eden/commit/9c13c71da8dcc37d03fc53bc3bc16978a65fd8f2.patch";
-      hash = "sha256-g7q40BDb9TKE8eudBS7Smajq5EYCzxSemZgsl2ialJo=";
-      revert = true;
-    })
-  ];
-
   strictDeps = true;
   __structuredAttrs = true;
 

pkgs/by-name/ei/eid-mw/package.nix

@@ -23,13 +23,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "eid-mw";
   # NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
-  version = "5.1.28";
+  version = "5.1.31";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "eid-mw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xXzrJWQEZ5mxnv6lG+rkG1P6TSzUDELccSwUizzhEek=";
+    hash = "sha256-pKSe+G1OcdcCf5IvTC7hbk3FRosarf09wyXXNJU4a8o=";
   };
 
   postPatch = ''

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.263";
+  version = "0.0.264";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-+Br2PS5IsHaAAJM5IJR7gXMx90pduixbdbSVNxL+kLo=";
+    hash = "sha256-iv9BCN5b6Qn2N85vpyyuqHR3HlCSxPRYGgaf04D8bBk=";
   };
 
   postPatch = ''

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.5.2";
+  version = "2026.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-DLM4hzbEWaJURtCIpKdL9Igy53puEGW+qRiBpDdFZ4o=";
+    hash = "sha256-laz+XNszkayfmEyrtFr3BHUWVV9eFhj130o4l99XElY=";
   };
 
   patches = [

pkgs/by-name/fa/faugus-launcher/package.nix

@@ -6,26 +6,27 @@
   lib,
   libayatana-appindicator,
   libcanberra-gtk3,
+  lsfg-vk,
   meson,
   ninja,
   nix-update-script,
   python3Packages,
   umu-launcher,
-  lsfg-vk,
+  vulkan-tools,
   wrapGAppsHook3,
   xdg-utils,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "faugus-launcher";
-  version = "1.16.6";
+  version = "1.20.4";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Faugus";
     repo = "faugus-launcher";
     tag = finalAttrs.version;
-    hash = "sha256-VVLq11jq7fGKgQske/FnQEkwcneuKWOvXFr4eUGHYTw=";
+    hash = "sha256-Kt6ZZ5yivbRzlgV+ovWiZVolxjmquAifJ/0lk1oL4fA=";
   };
 
   nativeBuildInputs = [
@@ -42,24 +43,25 @@ python3Packages.buildPythonApplication (finalAttrs: {
   dependencies = with python3Packages; [
     pillow
     psutil
+    pygame
     pygobject3
     requests
     vdf
   ];
 
   postPatch = ''
-    substituteInPlace faugus_launcher.py \
-      --replace-fail "PathManager.find_binary('faugus-run')" "'$out/bin/.faugus-run-wrapped'" \
-      --replace-fail "PathManager.find_binary('faugus-proton-manager')" "'$out/bin/.faugus-proton-manager-wrapped'" \
+    substituteInPlace faugus-launcher \
+      --replace-fail "/usr/bin/python3" "${python3Packages.python.interpreter}"
+
+    substituteInPlace faugus/launcher.py \
       --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'" \
       --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
-      --replace-fail "/usr/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
-      --replace-fail 'Exec={faugus_run}' 'Exec=faugus-run'
+      --replace-fail "/usr/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so"
 
-    substituteInPlace faugus_run.py \
+    substituteInPlace faugus/runner.py \
       --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'"
 
-    substituteInPlace faugus_shortcut.py \
+    substituteInPlace faugus/shortcut.py \
       --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
       --replace-fail "/usr/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so"
   '';
@@ -69,16 +71,19 @@ python3Packages.buildPythonApplication (finalAttrs: {
   preFixup = ''
     makeWrapperArgs+=(
       "''${gappsWrapperArgs[@]}"
+      --suffix PYTHONPATH : "$out/${python3Packages.python.sitePackages}:$PYTHONPATH"
       --suffix PATH : "${
         lib.makeBinPath [
           icoextract
           imagemagick
           libcanberra-gtk3
           umu-launcher
+          vulkan-tools
           xdg-utils
         ]
       }"
     )
+    wrapProgram $out/bin/faugus-launcher ''${makeWrapperArgs[@]}
   '';
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/fi/filebot/package.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "filebot";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20230917142929/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
-    hash = "sha256-OcXXKaZcBuP584SJWeQB+aaxO0kih6Oiud0Vm8e9kPo=";
+    hash = "sha256-1LYFc76wQOnmlkdGjE7ZuRh4FeM2o8ZM4sfDwx8hyBc=";
   };
 
   unpackPhase = "tar xvf $src";

pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix

@@ -83,6 +83,11 @@ rustPlatform.buildRustPackage rec {
 
     wrapProgram $out/bin/firefoxpwa-connector \
       --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa"
+
+    # Create empty `lib/firefoxpwa` directory so the Firefox wrapper won't fail
+    # trying to disable the update checks. It will try to write to
+    # `$out/lib/firefoxpwa/is-packaged-app`, which doesn't exist by default.
+    mkdir $out/lib/firefoxpwa
   '';
 
   passthru = {

pkgs/by-name/fo/fosrl-gerbil/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gerbil";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "gerbil";
     tag = finalAttrs.version;
-    hash = "sha256-SKpXWlpMkmo5Qwdi/MylqNIBvP4jEHSZfP5BjQD1nVs=";
+    hash = "sha256-wKqJfiCzmMbKZXJGB7BWoXRNDukc4t+PX60XyynJNAU=";
   };
 
-  vendorHash = "sha256-k5G8mkqrezRYY2lH1kbMMcW8GsUkyDaPglLEAzJIxYo=";
+  vendorHash = "sha256-S5olgsmX0uZR9P/u/8Rf3lzRCSIwPDcmlvSzJhhJM3w=";
 
   # patch out the /usr/sbin/iptables
   postPatch = ''

pkgs/by-name/fu/fulcio/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fulcio";
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "fulcio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R0fqBbK3dpbjnLlB0IB5IsaJO/+PxjEphqzjXV/nmsA=";
+    hash = "sha256-9TvucbTD2uPFxJqUG2EwMLRV6PxGf5UbxoEIUAqUE84=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-NLBorBTXNVxvvGKgekTOQuarMcoxZv8sVzKzPStGT74=";
+  vendorHash = "sha256-Mb4MBqEbWAo58TLd15JUh53I7CUHu+nyyIAfZxx3DMw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/fu/fuse-7z-ng/no-pthread.patch

@@ -1,11 +0,0 @@
-pthread_yield() is not used by fuse-7z-ng, fails configure.
---- a/configure.ac
-+++ b/configure.ac
-@@ -25,7 +25,6 @@ AC_CHECK_HEADERS([fcntl.h stddef.h string.h unistd.h dlfcn.h dirent.h])
- AC_CHECK_FUNCS([memset memmove])
- AC_CHECK_FUNCS([sqrt])
- 
--AC_CHECK_LIB([pthread], [pthread_yield],,AC_MSG_ERROR([pthread library not found.]))
- AC_CHECK_LIB([dl], [dlclose])
- 
- PKG_CHECK_MODULES([fuse], [fuse >= 2.8])

pkgs/by-name/fu/fuse-7z-ng/package.nix

@@ -1,64 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fuse,
-  p7zip,
-  autoconf,
-  automake,
-  pkg-config,
-  makeWrapper,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "fuse-7z-ng";
-  version = "0-unstable-2014-06-08";
-
-  src = fetchFromGitHub {
-    owner = "kedazo";
-    repo = "fuse-7z-ng";
-    rev = "eb5efb1f304c2b7bc2e0389ba06c9bf2ac4b932c";
-    sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
-  };
-  patches = [
-    # Drop unused pthread library. pthread_yield()
-    # fails the configure.
-    ./no-pthread.patch
-    # Zero-initialize unset fields of `struct fuse_operations` so that
-    # garbage values don't cause segfault.
-    # <https://github.com/kedazo/fuse-7z-ng/pull/8>
-    ./zero-init-fuse-operations.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
-    autoconf
-    automake
-  ];
-  buildInputs = [ fuse ];
-
-  preConfigure = "./autogen.sh";
-
-  libs = lib.makeLibraryPath [ p7zip ]; # 'cause 7z.so is loaded manually
-  postInstall = ''
-    wrapProgram $out/bin/fuse-7z-ng --suffix LD_LIBRARY_PATH : "${libs}/p7zip"
-
-    mkdir -p $out/share/doc/fuse-7z-ng
-    cp TODO README NEWS COPYING ChangeLog AUTHORS $out/share/doc/fuse-7z-ng/
-  '';
-
-  meta = {
-    inherit (src.meta) homepage;
-    description = "FUSE-based filesystem that uses the p7zip library";
-    longDescription = ''
-      fuse-7z-ng is a FUSE file system that uses the p7zip
-      library to access all archive formats supported by 7-zip.
-
-      This project is a fork of fuse-7z ( https://gitorious.org/fuse-7z/fuse-7z ).
-    '';
-    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3Plus;
-    mainProgram = "fuse-7z-ng";
-  };
-}