sox: fix version scheme (#541888)

Clean up

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -88,7 +88,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -98,7 +98,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -108,7 +108,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/build.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -96,7 +96,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -138,7 +138,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -174,7 +174,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -259,7 +259,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -476,7 +476,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

ci/OWNERS

@@ -211,7 +211,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/perl-modules      @stigtsp @marcusramberg
 
 # R
-/pkgs/applications/science/math/R   @jbedo
+/pkgs/by-name/r/R   @jbedo
 /pkgs/development/r-modules         @jbedo
 
 # Rust

ci/pinned.json

@@ -9,9 +9,22 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
-      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
-      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
+      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
+      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
+      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
+    },
+    "nixpkgs-26.05-darwin": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "NixOS",
+        "repo": "nixpkgs"
+      },
+      "branch": "nixpkgs-26.05-darwin",
+      "submodules": false,
+      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
+      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
+      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
     }
   },
   "version": 8

doc/build-helpers/images/appimagetools.section.md

@@ -28,7 +28,7 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 ```nix
 { appimageTools, fetchurl }:
-let
+appimageTools.wrapType2 {
   pname = "nuclear";
   version = "0.6.30";
 
@@ -36,8 +36,7 @@ let
     url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
-in
-appimageTools.wrapType2 { inherit pname version src; }
+}
 ```
 
 :::
@@ -56,7 +55,7 @@ There are a few ways to learn which dependencies an application needs:
 
 ```nix
 { appimageTools, fetchurl }:
-let
+appimageTools.wrapType2 {
   pname = "irccloud";
   version = "0.16.0";
 
@@ -64,9 +63,7 @@ let
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
+
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 }
 ```
@@ -88,12 +85,12 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 # Extracting an AppImage to install extra files
 
-This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
-Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+`wrapType2` automatically extracts the AppImage for you and makes it available via the `contents` attribute.
+Note how `finalAttrs.contents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
 
 ```nix
 { appimageTools, fetchurl }:
-let
+appimageTools.wrapType2 (finalAttrs: {
   pname = "irccloud";
   version = "0.16.0";
 
@@ -102,27 +99,24 @@ let
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
-  appimageContents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
     substituteInPlace $out/share/applications/irccloud.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=irccloud'
   '';
-}
+})
 ```
 
 :::
 
-The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+`appimageTools` also exposes the `extract` function should you need to do it manually, requiring `pname`, `version`, and `src` arguments (`src` being the AppImage file to extract).
+
+The arguments passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
 `postExtract` must be a string with commands to run.
 
 :::{.warning}
@@ -138,7 +132,7 @@ This is a rewrite of [](#ex-extracting-appimage) to use `postExtract` and `wrapA
 
 ```nix
 { appimageTools, fetchurl }:
-let
+appimageTools.wrapAppImage (finalAttrs: {
   pname = "irccloud";
   version = "0.16.0";
 
@@ -147,30 +141,22 @@ let
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
+  contents = appimageTools.extract {
+    inherit (finalAttrs) pname version src;
     postExtract = ''
       substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=irccloud'
     '';
   };
-in
-appimageTools.wrapAppImage {
-  inherit pname version;
-
-  src = appimageContents;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
   '';
-
-  # specify src archive for nix-update
-  passthru.src = src;
-}
+})
 ```
 
 :::

doc/release-notes/rl-2611.section.md

@@ -129,6 +129,8 @@
 
 - `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
 
+- `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
+
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.

flake.nix

@@ -199,7 +199,8 @@
         && system != "riscv64-linux"
         # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
         && system != "x86_64-freebsd"
-      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
+        # TODO: revert to importing fmt.pkg directly from ./ci when support for 26.05 ends
+      ) (forAllSystems (system: (import ./shell.nix { inherit system; }).formatter));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

lib/licenses/licenses.nix

@@ -1259,6 +1259,11 @@ lib.mapAttrs mkLicense (
       fullName = "SIL Open Font License 1.1";
     };
 
+    ogluk30 = {
+      spdxId = "OGL-UK-3.0";
+      fullName = "Open Government Licence v3.0";
+    };
+
     oml = {
       spdxId = "OML";
       fullName = "Open Market License";
@@ -1421,9 +1426,8 @@ lib.mapAttrs mkLicense (
     };
 
     stk = {
-      shortName = "stk";
-      fullName = "Synthesis Tool Kit 4.3";
-      url = "https://github.com/thestk/stk/blob/master/LICENSE";
+      spdxId = "MIT-STK";
+      fullName = "MIT-STK License";
     };
 
     sudo = {

maintainers/maintainer-list.nix

@@ -1173,6 +1173,12 @@
       }
     ];
   };
+  albfsg = {
+    name = "Alberto Francisco Solaz García";
+    github = "albfsg";
+    githubId = 227897008;
+    email = "albfsg@proton.me";
+  };
   alch-emi = {
     email = "emi@alchemi.dev";
     github = "Alch-Emi";
@@ -3423,13 +3429,6 @@
     githubId = 32903896;
     keys = [ { fingerprint = "CB5C 7B3C 3E6F 2A59 A583  A90A 8A60 0376 7BE9 5976"; } ];
   };
-  benesim = {
-    name = "Benjamin Isbarn";
-    email = "benjamin.isbarn@gmail.com";
-    github = "BeneSim";
-    githubId = 29384538;
-    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
-  };
   bengsparks = {
     email = "benjamin.sparks@protonmail.com";
     github = "bengsparks";
@@ -7340,6 +7339,13 @@
     githubId = 39825;
     name = "Dominik Honnef";
   };
+  donottellmetonottellyou = {
+    name = "Jade Masker";
+    email = "donottellmetonottellyou@gmail.com";
+    github = "donottellmetonottellyou";
+    githubId = 115233539;
+    keys = [ { fingerprint = "5C8B 7128 4AB3 000D 4AC6  6234 9B81 35A2 4A75 CB86"; } ];
+  };
   donovanglover = {
     github = "donovanglover";
     githubId = 2374245;
@@ -12960,11 +12966,6 @@
     name = "Jez Cope";
     keys = [ { fingerprint = "D9DA 3E47 E8BD 377D A317  B3D0 9E42 CE07 1C45 59D1"; } ];
   };
-  jf-uu = {
-    github = "jf-uu";
-    githubId = 181011550;
-    name = "jf-uu";
-  };
   jfchevrette = {
     email = "jfchevrette@gmail.com";
     github = "jfchevrette";
@@ -13581,6 +13582,12 @@
     name = "Jonas Wunderlich";
     matrix = "@matrix:03j.de";
   };
+  jonascarpay = {
+    name = "Jonas Carpay";
+    email = "jonascarpay@gmail.com";
+    github = "jonascarpay";
+    githubId = 3593851;
+  };
   jonasfranke = {
     name = "Jonas Franke";
     email = "info@jonasfranke.xyz";
@@ -18868,6 +18875,11 @@
     githubId = 45770;
     name = "Mitsuhiro Nakamura";
   };
+  MNThomson = {
+    github = "MNThomson";
+    githubId = 73045936;
+    name = "Max Thomson";
+  };
   moaxcp = {
     email = "moaxcp@gmail.com";
     github = "moaxcp";
@@ -20282,6 +20294,12 @@
     github = "niklaskorz";
     githubId = 590517;
   };
+  niklasravnsborg = {
+    name = "Niklas Ravnsborg";
+    github = "niklasravnsborg";
+    githubId = 6717303;
+    keys = [ { fingerprint = "0C90 DD8A 0EE9 93DF 8D58  7AF9 8360 E6C5 8AE8 F3ED"; } ];
+  };
   niklasthorild = {
     name = "Niklas Thorild";
     email = "niklas@thorild.se";
@@ -23315,6 +23333,13 @@
     github = "DaRacci";
     githubId = 90304606;
   };
+  rachalaraj = {
+    name = "Rachala Raj Kumar";
+    email = "rachaalaraj@gmail.com";
+    matrix = "@rachalaraj:matrix.org";
+    github = "rachalaraj";
+    githubId = 124191100;
+  };
   RadxaYuntian = {
     # This is the work account for @MakiseKurisu
     name = "ZHANG Yuntian";
@@ -29372,6 +29397,11 @@
     github = "UnsolvedCypher";
     githubId = 3170853;
   };
+  untio11 = {
+    name = "Robin Kneepkens";
+    github = "untio11";
+    githubId = 14060658;
+  };
   uralbash = {
     email = "root@uralbash.ru";
     github = "uralbash";
@@ -29699,6 +29729,13 @@
     githubId = 116078858;
     keys = [ { fingerprint = "CDEA 7E04 69E3 0885 A754  4B05 0104 BC05 F41B 77B8"; } ];
   };
+  vherrmann = {
+    name = "Valentin Herrmann";
+    email = "me@valentin-herrmann.de";
+    github = "vherrmann";
+    githubId = 50072577;
+    keys = [ { fingerprint = "309D A29B 4070 FDFD C01A  3AB4 9E60 CB44 5C4B BC4C"; } ];
+  };
   videl = {
     email = "thibaut.smith@mailbox.org";
     github = "videl";

nixos/README-modular-services.md

@@ -43,7 +43,7 @@ When reviewing a modular service, you should check the following. Details and ra
 ### NixOS VM test
 
 See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
-TBD: describe best practices here.
+Best practices: keep tests minimal and focused (boot a VM, enable the service, and assert a basic request succeeds). For general guidance, see the [NixOS Tests chapter](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
 
 ### `_class = "service"`
 

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -129,7 +129,7 @@
 
 - [nvme-rs](https://github.com/liberodark/nvme-rs), NVMe monitoring [services.nvme-rs](#opt-services.nvme-rs.enable).
 
-- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as {option}`opt-services.overseerr.enable`.
 
 - [PairDrop](https://github.com/schlagmichdoch/pairdrop), a peer-to-peer file transfer web app. Available as [services.pairdrop](#opt-services.pairdrop.enable).
 

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -84,7 +84,7 @@
 
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
-- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
+- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mango.enable).
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -89,9 +89,9 @@
 
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
-- `virtualisation.registries.block` / `insecure` / `search` were deprecated,
+- `virtualisation.containers.registries.block` / `insecure` / `search` were deprecated,
   because they mapped to the deprecated V1 `registries.conf` format.
-  See the new option {option}`virtualisation.registries.settings`
+  See the new option {option}`virtualisation.containers.registries.settings`
   and [containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)
   to migrate to the new configuration format.
 
@@ -113,6 +113,8 @@
 
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
+- Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -140,6 +142,8 @@
 
 - `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
 
+- [`virtualisation.qemu.firmware.enable`](#opt-virtualisation.qemu.firmware.enable) has been added to install QEMU firmware descriptors to {file}`/etc/qemu/firmware`, making the corresponding firmware images discoverable by tools such as `systemd-vmspawn`. By default this exposes the firmware bundled with QEMU. Further firmware can be added via [`virtualisation.qemu.firmware.packages`](#opt-virtualisation.qemu.firmware.packages), for example the new `OVMF-amdsev` and `OVMF-inteltdx` packages, which provide UEFI firmware for AMD SEV-SNP and Intel TDX confidential VMs.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -89,6 +89,11 @@ def main() -> None:
         type=Path,
         required=True,
     )
+    arg_parser.add_argument(
+        "--test-script",
+        help="path to a test script to run, taking precedence over the one defined in the config file",
+        type=Path,
+    )
     arg_parser.add_argument(
         "--keep-vm-state",
         help=argparse.SUPPRESS,
@@ -163,8 +168,12 @@ def main() -> None:
     if args.debug_hook_attach is not None:
         debugger = Debug(logger, args.debug_hook_attach)
 
+    config = load_driver_configuration(args.config)
+    if args.test_script is not None:
+        config.test_script = args.test_script
+
     with Driver(
-        config=load_driver_configuration(args.config),
+        config=config,
         out_dir=output_directory,
         logger=logger,
         keep_machine_state=args.keep_machine_state,

nixos/modules/module-list.nix

@@ -355,7 +355,7 @@
   ./programs/wayland/hyprland.nix
   ./programs/wayland/hyprlock.nix
   ./programs/wayland/labwc.nix
-  ./programs/wayland/mangowc.nix
+  ./programs/wayland/mango.nix
   ./programs/wayland/miracle-wm.nix
   ./programs/wayland/niri.nix
   ./programs/wayland/pinnacle.nix
@@ -938,7 +938,6 @@
   ./services/misc/open-webui.nix
   ./services/misc/orthanc.nix
   ./services/misc/osrm.nix
-  ./services/misc/overseerr.nix
   ./services/misc/owncast.nix
   ./services/misc/packagekit.nix
   ./services/misc/paisa.nix
@@ -2052,6 +2051,7 @@
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/podman/default.nix
+  ./virtualisation/qemu-firmware.nix
   ./virtualisation/qemu-guest-agent.nix
   ./virtualisation/rosetta.nix
   ./virtualisation/spice-usb-redirection.nix

nixos/modules/programs/miriway.nix

@@ -14,56 +14,93 @@ in
       Miriway, a Mir based Wayland compositor. You can manually launch Miriway by
       executing "exec miriway" on a TTY, or launch it from a display manager. Copy
       /etc/xdg/xdg-miriway/miriway-shell.config to ~/.config/miriway-shell.config
+      and /etc/xdg/xdg-miriway/miriway-shell.settings to ~/.config/miriway-shell.settings
       to modify the system-wide configuration on a per-user basis. See <https://github.com/Miriway/Miriway>,
       and "miriway --help" for more information'';
 
     config = lib.mkOption {
+      description = ''
+        Contents of system-wide miriway-shell.config. See Miriway's configuration documentation for details.
+      '';
       type = lib.types.lines;
       default = ''
         x11-window-title=Miriway (Mir-on-X)
         idle-timeout=600
-        ctrl-alt=t:miriway-terminal # Default "terminal emulator finder"
-
-        shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
-
-        meta=Left:@dock-left
-        meta=Right:@dock-right
-        meta=Space:@toggle-maximized
-        meta=Home:@workspace-begin
-        meta=End:@workspace-end
-        meta=Page_Up:@workspace-up
-        meta=Page_Down:@workspace-down
-        ctrl-alt=BackSpace:@exit
       '';
       example = ''
         idle-timeout=300
-        ctrl-alt=t:weston-terminal
         add-wayland-extensions=all
 
-        shell-components=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
-
         shell-component=waybar
         shell-component=wbg Pictures/wallpaper
-
-        shell-meta=a:synapse
-
-        meta=Left:@dock-left
-        meta=Right:@dock-right
-        meta=Space:@toggle-maximized
-        meta=Home:@workspace-begin
-        meta=End:@workspace-end
-        meta=Page_Up:@workspace-up
-        meta=Page_Down:@workspace-down
-        ctrl-alt=BackSpace:@exit
       '';
+    };
+
+    settings = lib.mkOption {
       description = ''
-        Miriway's config. This will be installed system-wide.
-        The default will install the miriway package's barebones example config.
+        Contents of system-wide miriway-shell.settings. See Miriway's configuration documentation for details.
+      '';
+      type = lib.types.lines;
+      default = ''
+        command_ctrl_alt=t:miriway-terminal # Default "terminal emulator finder"
+
+        command_meta=Left:@dock-left
+        command_meta=Right:@dock-right
+        command_meta=Space:@toggle-maximized
+        command_meta=Home:@workspace-begin
+        command_meta=End:@workspace-end
+        command_meta=Page_Up:@workspace-up
+        command_meta=Page_Down:@workspace-down
+        command_ctrl_alt=BackSpace:@exit
+      '';
+      example = ''
+        command_ctrl_alt=t:weston-terminal
+        command_shell_meta=a:synapse
+
+        command_meta=Left:@dock-left
+        command_meta=Right:@dock-right
+        command_meta=Space:@toggle-maximized
+        command_meta=Home:@workspace-begin
+        command_meta=End:@workspace-end
+        command_meta=Page_Up:@workspace-up
+        command_meta=Page_Down:@workspace-down
+        command_ctrl_alt=BackSpace:@exit
       '';
     };
   };
 
   config = lib.mkIf cfg.enable {
+    warnings =
+      let
+        optionsNoLongerInConfig = [
+          "ctrl-alt"
+          "meta"
+          "shell-ctrl-alt"
+          "shell-meta"
+          "shell-plain"
+
+          "command_ctrl_alt"
+          "command_meta"
+          "command_shell_ctrl_alt"
+          "command_shell_meta"
+          "command_plain"
+        ];
+      in
+      # Added 2026-07-17
+      lib.optional
+        (builtins.foldl' (
+          acc: option: acc || (lib.strings.hasInfix "${option}=" cfg.config)
+        ) false optionsNoLongerInConfig)
+        ''
+          Since Miriway 26.06, configuration options got partially renamed and split across different files.
+          A new option `programs.miriway.settings` got introduced for options that belong into miriway-shell.settings
+          instead of miriway-shell.config.
+
+          You appear to have one of the following options in `programs.miriway.config` that should now go into
+          `programs.miriway.settings`, and may need to be renamed:
+          ${lib.strings.concatStringsSep ", " optionsNoLongerInConfig}
+        '';
+
     environment = {
       systemPackages = with pkgs; [
         miriway
@@ -71,6 +108,7 @@ in
       ];
       etc = {
         "xdg/xdg-miriway/miriway-shell.config".text = cfg.config;
+        "xdg/xdg-miriway/miriway-shell.settings".text = cfg.settings;
       };
     };
 

nixos/modules/programs/regreet.nix

@@ -15,14 +15,13 @@ in
       description = ''
         Enable ReGreet, a clean and customizable greeter for greetd.
 
-        To use ReGreet, {option}`services.greetd` has to be enabled and
-        {option}`services.greetd.settings.default_session` should contain the
-        appropriate configuration to launch
-        {option}`config.programs.regreet.package`. For examples, see the
-        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session).
+        By default enables {option}`services.greetd` and configures a
+        {command}`default_session` to launch ReGreet using the
+        {command}`cage` compositor.
 
-        A minimal configuration that launches ReGreet in {command}`cage` is
-        enabled by this module by default.
+        See the
+        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session)
+        for other examples.
       '';
     };
 
@@ -48,8 +47,8 @@ in
         [ "-s" "-d" "-m" "last" ]
       '';
       description = ''
-        Additional arguments to be passed to
-        [cage](https://github.com/cage-kiosk/cage).
+        Arguments to be passed to [cage](https://github.com/cage-kiosk/cage)
+        when using it as the default compositor.
       '';
     };
 

nixos/modules/programs/wayland/mango.nix

@@ -6,18 +6,22 @@
 }:
 
 let
-  cfg = config.programs.mangowc;
+  cfg = config.programs.mango;
 in
 {
-  options.programs.mangowc = {
-    enable = lib.mkEnableOption "MangoWC, a Wayland compositor based on dwl and scenefx";
+  options.programs.mango = {
+    enable = lib.mkEnableOption "Mango, a Wayland compositor based on dwl and scenefx";
 
-    package = lib.mkPackageOption pkgs "mangowc" {
-      default = [ "mangowc" ];
-      example = "pkgs.mangowc.override { enableXWayland = false; }";
+    package = lib.mkPackageOption pkgs "mango" {
+      default = [ "mango" ];
+      example = "pkgs.mango.override { enableXWayland = false; }";
     };
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule [ "programs" "mangowc" ] [ "programs" "mango" ])
+  ];
+
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/rename.nix

@@ -403,6 +403,11 @@ in
       as the underlying package isn't being maintained. Working alternatives are
       libinput and synaptics.
     '')
+    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "afterstep" ] ''
+      The services.xserver.windowManager.afterstep module and the corresponding
+      package have been removed from Nixpkgs because they were unmaintained
+      upstream.
+    '')
     (mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
       The services.xserver.windowManager.ragnarwm module has been removed
       because the corresponding package was removed from nixpkgs.
@@ -534,6 +539,13 @@ in
     (mkRemovedOptionModule [ "services" "xserver" "cmt" ] ''
       services.xserver.cmt has been removed as it was broken and unmaintained upstream
     '')
+    (mkRemovedOptionModule
+      [
+        "services"
+        "overseerr"
+      ]
+      "`services.overseerr` has been replaced by `services.seerr` as the project has been merged with Jellyseerr under Seerr."
+    )
     # Do NOT add any option renames here, see top of the file
   ];
 }

nixos/modules/security/pam.nix

@@ -1422,7 +1422,6 @@ let
                 modulePath = config.security.pam.pam_unixModulePath;
                 settings = {
                   nullok = true;
-                  yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
                 };
               }
               {

nixos/modules/services/display-managers/gdm.nix

@@ -577,7 +577,6 @@ in
               control = "requisite";
               modulePath = config.security.pam.pam_unixModulePath;
               settings.nullok = true;
-              settings.yescrypt = true;
             }
           ];
 

nixos/modules/services/display-managers/greetd.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -76,9 +77,37 @@ in
     services.greetd.settings.default_session.user = lib.mkDefault "greeter";
 
     security.pam.services.greetd = {
-      allowNullPassword = true;
-      startSession = true;
-      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+      useDefaultRules = false;
+      rules = {
+        auth = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "substack";
+            modulePath = "login";
+          }
+        ];
+        account = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "include";
+            modulePath = "login";
+          }
+        ];
+        password = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "substack";
+            modulePath = "login";
+          }
+        ];
+        session = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "include";
+            modulePath = "login";
+          }
+        ];
+      };
     };
 
     # This prevents nixos-rebuild from killing greetd by activating getty again

nixos/modules/services/display-managers/ly.nix

@@ -100,9 +100,37 @@ in
 
     security.pam.services = {
       ly = {
-        startSession = true;
-        unixAuth = true;
-        enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+        useDefaultRules = false;
+        rules = {
+          auth = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "substack";
+              modulePath = "login";
+            }
+          ];
+          account = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+          password = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "substack";
+              modulePath = "login";
+            }
+          ];
+          session = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+        };
       };
     }
     // optionalAttrs dmcfg.autoLogin.enable {

nixos/modules/services/home-automation/home-assistant.nix

@@ -242,7 +242,9 @@ let
     "elkm1"
     "elv"
     "enocean"
+    "homeassistant_connect_zbt2"
     "homeassistant_hardware"
+    "homeassistant_sky_connect"
     "homeassistant_yellow"
     "firmata"
     "flexit"

nixos/modules/services/misc/overseerr.nix

@@ -1,89 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.services.overseerr;
-in
-{
-  meta.maintainers = [ lib.maintainers.jf-uu ];
-
-  options.services.overseerr = {
-    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";
-
-    package = lib.mkPackageOption pkgs "overseerr" { };
-
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Open a port in the firewall for the Overseerr web interface.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 5055;
-      description = "The port which the Overseerr web UI should listen on.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.overseerr = {
-      description = "Request management and media discovery tool for the Plex ecosystem";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      environment = {
-        CONFIG_DIRECTORY = "/var/lib/overseerr";
-        PORT = toString cfg.port;
-      };
-      serviceConfig = {
-        CapabilityBoundingSet = "";
-        DynamicUser = true;
-        ExecStart = lib.getExe cfg.package;
-        LockPersonality = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateIPC = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        Restart = "on-failure";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        StateDirectory = "overseerr";
-        StateDirectoryMode = "0700";
-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-          "~@resources"
-        ];
-        Type = "exec";
-      };
-    };
-
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
-    };
-  };
-}

nixos/modules/services/networking/nsd.nix

@@ -988,8 +988,9 @@ in
     systemd.services.nsd = {
       description = "NSD authoritative only domain name service";
 
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
 
       startLimitBurst = 4;
       startLimitIntervalSec = 5 * 60; # 5 mins

nixos/modules/services/networking/unbound.nix

@@ -115,7 +115,7 @@ in
         default = true;
         description = ''
           Whether unbound should resolve local queries (i.e. add 127.0.0.1 to
-          /etc/resolv.conf).
+          /etc/resolv.conf and set name servers to localhost respectively).
         '';
       };
 
@@ -276,6 +276,7 @@ in
       resolvconf = {
         useLocalResolver = mkDefault true;
       };
+      nameservers = lib.mkBefore ([ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1"));
     };
 
     environment.etc."unbound/unbound.conf".source = confFile;

nixos/modules/services/system/userborn.nix

@@ -36,8 +36,14 @@ let
 
   userbornConfigJson = pkgs.writeText "userborn.json" (builtins.toJSON userbornConfig);
   userbornStaticFiles =
-    pkgs.runCommand "static-userborn" { }
-      "mkdir -p $out; ${lib.getExe cfg.package} ${userbornConfigJson} $out";
+    pkgs.runCommand "static-userborn"
+      {
+        nativeBuildInputs = [ cfg.package ];
+      }
+      ''
+        mkdir -p $out
+        userborn ${userbornConfigJson} $out
+      '';
   previousConfigPath = "/var/lib/userborn/previous-userborn.json";
 
   immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -458,7 +458,6 @@ in
             control = "requisite";
             modulePath = config.security.pam.pam_unixModulePath;
             settings.nullok = true;
-            settings.yescrypt = true;
           }
         ];
 

nixos/modules/services/x11/window-managers/afterstep.nix

@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.services.xserver.windowManager.afterstep;
-in
-{
-  ###### interface
-  options = {
-    services.xserver.windowManager.afterstep.enable = mkEnableOption "afterstep";
-  };
-
-  ###### implementation
-  config = mkIf cfg.enable {
-    services.xserver.windowManager.session = singleton {
-      name = "afterstep";
-      start = ''
-        ${pkgs.afterstep}/bin/afterstep &
-        waitPID=$!
-      '';
-    };
-    environment.systemPackages = [ pkgs.afterstep ];
-  };
-}

nixos/modules/services/x11/window-managers/default.nix

@@ -8,7 +8,6 @@ in
 {
   imports = [
     ./2bwm.nix
-    ./afterstep.nix
     ./berry.nix
     ./bspwm.nix
     ./cwm.nix

nixos/modules/system/boot/resolved.nix

@@ -30,8 +30,9 @@ let
 
   dnsmasqResolve = config.services.dnsmasq.enable && config.services.dnsmasq.resolveLocalQueries;
 
-  transformSettings = settings: {
-    Resolve = lib.mapAttrs (
+  transformSettings =
+    settings:
+    lib.mapAttrs (
       key: value:
       # concat lists for options that should result in space-separated values
       if
@@ -45,10 +46,9 @@ let
         concatStringsSep " " value
       else
         value
-    ) settings.Resolve;
-  };
+    ) settings;
 
-  resolvedConf = settingsToSections (transformSettings cfg.settings);
+  resolvedConf = settingsToSections { Resolve = transformSettings cfg.settings.Resolve; };
 in
 {
   imports = [

nixos/modules/tasks/filesystems/envfs.nix

@@ -69,7 +69,7 @@ in
   config = lib.mkIf (cfg.enable) {
     environment.systemPackages = [ cfg.package ];
     # we also want these mounts in virtual machines.
-    fileSystems = if config.virtualisation ? qemu then lib.mkVMOverride mounts else mounts;
+    fileSystems = if config.virtualisation.qemu ? package then lib.mkVMOverride mounts else mounts;
 
     # We no longer need those when using envfs
     system.activationScripts.usrbinenv = lib.mkForce "";

nixos/modules/testing/test-instrumentation.nix

@@ -196,7 +196,7 @@ in
     # that do not specify any nodes, or an empty attr set as nodes) will not
     # have the QEMU module loaded and thuse these options can't and should not
     # be set.
-    virtualisation = lib.optionalAttrs (options ? virtualisation.qemu) {
+    virtualisation = lib.optionalAttrs (options ? virtualisation.qemu.package) {
       qemu = {
         # NOTE: optionalAttrs
         #       test-instrumentation.nix appears to be used without qemu-vm.nix, so

nixos/modules/virtualisation/qemu-firmware.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.virtualisation.qemu.firmware;
+in
+
+{
+  options.virtualisation.qemu.firmware = {
+    enable = lib.mkEnableOption "QEMU firmware descriptors in {file}`/etc/qemu/firmware`";
+
+    packages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ pkgs.qemu ];
+      defaultText = lib.literalExpression "[ pkgs.qemu ]";
+      example = lib.literalExpression "[ pkgs.qemu pkgs.OVMF-amdsev.fd ]";
+      description = ''
+        Packages providing QEMU firmware descriptors under
+        {file}`share/qemu/firmware`, following the QEMU firmware interop
+        convention (see {file}`docs/interop/firmware.json` in the QEMU
+        source tree). The descriptors are merged and linked to
+        {file}`/etc/qemu/firmware`, where tools like
+        {command}`systemd-vmspawn` discover the firmware available for
+        running virtual machines.
+
+        The default exposes the descriptors of the firmware images
+        bundled with QEMU. Note that setting this option replaces the
+        default, so include `pkgs.qemu` when adding further firmware.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc."qemu/firmware".source =
+      let
+        merged = pkgs.buildEnv {
+          name = "qemu-firmware-descriptors";
+          paths = cfg.packages;
+          pathsToLink = [ "/share/qemu/firmware" ];
+        };
+      in
+      "${merged}/share/qemu/firmware";
+  };
+
+  meta.maintainers = [ lib.maintainers.katexochen ];
+}

nixos/tests/all-tests.nix

@@ -153,6 +153,7 @@ in
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
     nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
+    multi-arch-test = runTest ./nixos-test-driver/multi-arch-test.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
@@ -1302,7 +1303,6 @@ in
   osrm-backend = runTest ./osrm-backend.nix;
   outline = runTest ./outline.nix;
   overlayfs = runTest ./overlayfs.nix;
-  overseerr = runTest ./overseerr.nix;
   owi = runTest ./owi.nix;
   owncast = runTest ./owncast.nix;
   oxidized = handleTest ./oxidized.nix { };
@@ -1448,6 +1448,7 @@ in
   pykms = runTest ./pykms.nix;
   qbittorrent = runTest ./qbittorrent.nix;
   qboot = runTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix;
+  qemu-firmware = runTestOn [ "x86_64-linux" ] ./qemu-firmware.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
   qemu-vm-store = runTest ./qemu-vm-store.nix;

nixos/tests/geoclue2.nix

@@ -31,6 +31,6 @@
       assert ("Latitude:    12.345000°" in whereAmI), f"Incorrect latitude in:\n{whereAmI}"
       assert ("Longitude:   -67.890000°" in whereAmI), f"Incorrect longitude in:\n{whereAmI}"
       assert ("Altitude:    123.450000 meters" in whereAmI), f"Incorrect altitude in:\n{whereAmI}"
-      assert ("Accuracy:    1000.000000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
+      assert ("Accuracy:    1000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
     '';
 }

nixos/tests/login-nosuid.nix

@@ -57,6 +57,7 @@
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("grep -F 'alice:$y$' /etc/shadow")
 
     with subtest("Check whether switching VTs works"):
         machine.fail("pgrep -f 'agetty.*tty2'")

nixos/tests/login.nix

@@ -28,6 +28,7 @@
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("grep -F 'alice:$y$' /etc/shadow")
 
     with subtest("Check whether switching VTs works"):
         machine.fail("pgrep -f 'agetty.*tty2'")

nixos/tests/miriway.nix

@@ -33,13 +33,12 @@
           add-wayland-extensions=all
           enable-x11=
 
-          ctrl-alt=t:foot --maximized
-          ctrl-alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"
-
-          shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
-
           shell-component=foot --maximized
         '';
+        settings = ''
+          command_ctrl_alt=t:foot --maximized
+          command_ctrl_alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"
+        '';
       };
 
       environment = {
@@ -59,8 +58,9 @@
         etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
           main = {
             font = "inconsolata:size=16";
+            initial-color-theme = "light";
           };
-          colors = rec {
+          colors-light = rec {
             foreground = "000000";
             background = "ffffff";
             regular2 = foreground;

nixos/tests/nixos-test-driver/multi-arch-test.nix

@@ -0,0 +1,55 @@
+{ pkgs, lib, ... }:
+{
+  name = "multi-arch-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ tfc ];
+
+  node.pkgsReadOnly = false;
+
+  nodes = {
+    # Setting build = host platform because such standard VM setups
+    # are well-cached by the multi-arch build infrastructure of the
+    # project.
+    vmIntel = {
+      nixpkgs.buildPlatform = "x86_64-linux";
+      nixpkgs.hostPlatform = "x86_64-linux";
+    };
+    vmArm = {
+      nixpkgs.buildPlatform = "aarch64-linux";
+      nixpkgs.hostPlatform = "aarch64-linux";
+    };
+  };
+
+  defaults = {
+    # not needed for this test and shrinks the closure
+    # because we dont' need qemu for all architectures
+    virtualisation.qemu.guestAgent.enable = false;
+
+    # the test is already very slow but we don't need DHCP anyway
+    networking.dhcpcd.enable = false;
+
+    # fix the network-online target, otherwise it doesn't work
+    # properly as a synchronization mechanism.
+    systemd.network.wait-online.enable = true;
+    systemd.network.wait-online.anyInterface = true;
+  };
+
+  # slow due to SW emulation but shouldn't be slower than that
+  globalTimeout = 5 * 60;
+
+  testScript = { nodes, ... }: /* python */ ''
+    start_all()
+
+    vmIntel.systemctl("start network-online.target")
+    vmArm.systemctl("start network-online.target")
+    vmIntel.wait_for_unit("network-online.target")
+    vmArm.wait_for_unit("network-online.target")
+
+    vmIntel.succeed("ping -c 1 vmArm")
+    vmArm.succeed("ping -c 1 vmIntel")
+
+    archIntel = vmIntel.succeed("uname -m")
+    t.assertIn("${nodes.vmIntel.nixpkgs.hostPlatform.qemuArch}", archIntel, "machine1 is an intel VM")
+    archArm = vmArm.succeed("uname -m")
+    t.assertIn("${nodes.vmArm.nixpkgs.hostPlatform.qemuArch}", archArm, "machine1 is an ARM VM")
+  '';
+}

nixos/tests/overseerr.nix

@@ -1,20 +0,0 @@
-{ lib, pkgs, ... }:
-{
-  name = "overseerr";
-  meta.maintainers = with lib.maintainers; [ jf-uu ];
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.jq ];
-      services.overseerr.enable = true;
-    };
-
-  testScript = ''
-    machine.wait_for_unit("overseerr.service")
-    machine.wait_for_open_port(5055)
-
-    version = machine.succeed("curl --fail http://localhost:5055/api/v1/status | jq --raw-output .version").rstrip("\n")
-    assert version == "${pkgs.overseerr.version}", f"expected version to be ${pkgs.overseerr.version}, got {version}"
-  '';
-}

nixos/tests/qemu-firmware.nix

@@ -0,0 +1,41 @@
+{ lib, ... }:
+
+{
+  name = "qemu-firmware";
+  meta.maintainers = [ lib.maintainers.katexochen ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.qemu.firmware = {
+        enable = true;
+        packages = [
+          pkgs.qemu
+          pkgs.OVMF-amdsev.fd
+          pkgs.OVMF-inteltdx.fd
+        ];
+      };
+      environment.systemPackages = [ pkgs.jq ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("descriptors are merged into /etc/qemu/firmware"):
+        machine.succeed("test -e /etc/qemu/firmware/60-edk2-x86_64.json")
+        machine.succeed("test -e /etc/qemu/firmware/61-edk2-ovmf-x64-amdsev.json")
+        machine.succeed("test -e /etc/qemu/firmware/61-edk2-ovmf-x64-inteltdx.json")
+
+    with subtest("descriptors reference existing firmware images"):
+        machine.succeed(
+            "jq -er '.mapping | .filename // .executable.filename' "
+            + "/etc/qemu/firmware/*.json | xargs stat --"
+        )
+
+    with subtest("systemd-vmspawn discovers the descriptors"):
+        listed = machine.succeed("systemd-vmspawn --firmware=list")
+        assert "61-edk2-ovmf-x64-amdsev.json" in listed
+        assert "61-edk2-ovmf-x64-inteltdx.json" in listed
+        assert "60-edk2-x86_64.json" in listed
+  '';
+}

nixos/tests/systemd-boot.nix

@@ -460,19 +460,17 @@ in
       nodes.machine = common;
 
       testScript =
-        let
-          oldVersion = "222";
-        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
 
           def switch():
-              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+              # Replace version inside sd-boot with something older. See SD_MAGIC in systemd src/boot/boot.c
+              # Note: the sed replacement has to be length-preserving, because section length matters.
               machine.succeed(
-                """
+                r"""
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot [0-9]\(.*\) ####/#### LoaderInfo: systemd-boot 0\1 ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

nixos/tests/vaultwarden.nix

@@ -91,6 +91,9 @@ let
 
               click_when_unobstructed((By.XPATH, "//a[contains(., 'Skip to web app')]"))
 
+              # Skip the tour on first login
+              click_when_unobstructed((By.XPATH, "//button[contains(., 'Skip')]"))
+
               click_when_unobstructed((By.XPATH, "//button[contains(., 'New item')]"))
 
               driver.find_element(By.XPATH, '//input[@formcontrolname="name"]').send_keys(

pkgs/applications/editors/android-studio/default.nix

@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2026.1.2.10"; # "Android Studio Quail 2 | 2026.1.2"
-    sha256Hash = "sha256-ZERaVAkucFbG638aia0RbQ/uwu9flluOWU1iq9tYWQ8=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.10/android-studio-quail2-linux.tar.gz";
+    version = "2026.1.2.11"; # "Android Studio Quail 2 | 2026.1.2 Patch 1"
+    sha256Hash = "sha256-HMnNVPQA27DQeITw98DKtSTbXOCl73CyOu1v3TzURbk=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.11/android-studio-quail2-patch1-linux.tar.gz";
   };
   betaVersion = {
     version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/b4-review-mode/package.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  b4,
+  melpaBuild,
+}:
+melpaBuild {
+  pname = "b4-review-mode";
+  inherit (b4) version;
+
+  src = b4.src-misc;
+  sourceRoot = "${b4.src-misc.name}/misc/emacs";
+
+  meta = {
+    description = "Emacs major mode with highlighting for the b4 review reply editor";
+    homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fzakaria ];
+  };
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -12,6 +12,46 @@
 let
   zig = zig_0_15;
 
+  mkModule =
+    {
+      pname,
+      version,
+      src,
+      zigDeps,
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      inherit
+        pname
+        version
+        src
+        zigDeps
+        ;
+
+      nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+
+      env.EMACS_INCLUDE_DIR = "${emacs}/include";
+
+      dontSetZigDefaultFlags = true;
+
+      doCheck = true;
+
+      zigCheckFlags = [
+        "-Dcpu=baseline"
+        # See https://github.com/ghostty-org/ghostty/blob/main/PACKAGING.md#build-options
+        "-Doptimize=ReleaseFast"
+      ];
+
+      zigBuildFlags = finalAttrs.zigCheckFlags;
+
+      postConfigure = ''
+        cp -rLT ${finalAttrs.zigDeps} "$ZIG_GLOBAL_CACHE_DIR/p"
+        chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
+      '';
+    });
+
+  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
+in
+melpaBuild (finalAttrs: {
   pname = "ghostel";
 
   version = "0.44.0";
@@ -19,59 +59,37 @@ let
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-vRGZoQtjsL42ga07fOfEjccKRidAhqgwHBoKs++62Ls=";
   };
 
-  module = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version src;
-
-    deps = zig.fetchDeps {
-      inherit (finalAttrs) src pname version;
-      fetchAll = true;
-      hash = "sha256-yrVgiofdmVjTGJ+PGPGRCc8gb/JcEca1uAzIoPgHHqU=";
-    };
-
-    nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
-
-    env.EMACS_INCLUDE_DIR = "${emacs}/include";
-
-    dontSetZigDefaultFlags = true;
-
-    doCheck = true;
-
-    zigCheckFlags = [
-      "-Dcpu=baseline"
-      # See https://github.com/ghostty-org/ghostty/blob/main/PACKAGING.md#build-options
-      "-Doptimize=ReleaseFast"
-    ];
-
-    zigBuildFlags = finalAttrs.zigCheckFlags;
-
-    postConfigure = ''
-      cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
-      chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
-    '';
-  });
-
-  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
-in
-melpaBuild {
-  inherit pname version src;
+  # this can be put into mkModule, but we put it here to ease user overrideAttrs
+  zigDeps = zig.fetchDeps {
+    inherit (finalAttrs) src pname version;
+    fetchAll = true;
+    hash = "sha256-yrVgiofdmVjTGJ+PGPGRCc8gb/JcEca1uAzIoPgHHqU=";
+  };
 
   files = ''
     (:defaults "etc" "ghostel-module${libExt}" "ghostel-module.version")
   '';
 
   preBuild = ''
-    install ${module}/ghostel-module${libExt} ghostel-module${libExt}
-    install --mode=444 ${module}/ghostel-module.version ghostel-module.version
+    install ${finalAttrs.finalPackage.module}/ghostel-module${libExt} ghostel-module${libExt}
+    install --mode=444 ${finalAttrs.finalPackage.module}/ghostel-module.version ghostel-module.version
   '';
 
   passthru = {
     updateScript = nix-update-script { };
 
-    inherit module;
+    module = mkModule {
+      pname = "${finalAttrs.pname}-module";
+      inherit (finalAttrs)
+        version
+        src
+        zigDeps
+        ;
+    };
   };
 
   meta = {
@@ -83,4 +101,4 @@ melpaBuild {
     ];
     license = lib.licenses.gpl3Plus;
   };
-}
+})

pkgs/applications/editors/emacs/elisp-packages/manual-packages/majutsu/package.nix

@@ -6,22 +6,26 @@
   magit,
   transient,
   with-editor,
+  consult,
+  plz,
 }:
 melpaBuild {
   pname = "majutsu";
-  version = "0.6.0-unstable-2026-07-09";
+  version = "0.6.0-unstable-2026-07-23";
 
   src = fetchFromGitHub {
     owner = "0WD0";
     repo = "majutsu";
-    rev = "59aff9b93eac575fbccc1f4ab2d48d048e0ead9b";
-    hash = "sha256-GJ62hsHgLEFIY0ghij0VPFt1jMUGRKhI2eCroBjkxtc=";
+    rev = "8eaf8cb4db2f0737d0a131ef8b61ce6393660369";
+    hash = "sha256-QqvzRfqWa4Ql7bpuShqHmXzXJCu1VU8ObnImiK7ZyvE=";
   };
 
   packageRequires = [
     magit
     transient
     with-editor
+    consult
+    plz
   ];
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=main" ]; };

pkgs/applications/editors/emacs/sources.nix

@@ -107,10 +107,10 @@ in
 {
   emacs31 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "31.0.90";
+    version = "31.0.91";
     variant = "mainline";
-    rev = "emacs-31.0.90";
-    hash = "sha256-Rzlnn+NKQ+jICXLNop27RnVInq79myn4hueJieDO2Ck=";
+    rev = "emacs-31.0.91";
+    hash = "sha256-3nvCiLiEtII1C57CLfDIbVqhiwadYViF9Nv32yDtLIQ=";
   });
 
   emacs30 = import ./make-emacs.nix (mkArgs {

pkgs/applications/editors/vim/plugins/non-generated/b4-review-vim/default.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  vimUtils,
+  b4,
+}:
+vimUtils.buildVimPlugin {
+  pname = "b4-review-vim";
+  inherit (b4) version;
+
+  src = b4.src-misc;
+  sourceRoot = "${b4.src-misc.name}/misc/vim";
+
+  meta = {
+    description = "Vim syntax highlighting for the b4 review reply editor";
+    homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fzakaria ];
+  };
+}

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -74,6 +74,9 @@ let
     ];
 
     env = {
+      # Build zlob for a portable CPU baseline (https://github.com/dmtrKovalenko/fff/issues/705)
+      CI = "1";
+
       OPENSSL_NO_VENDOR = true;
 
       # Allow undefined symbols on Darwin - they will be provided by Neovim's LuaJIT runtime

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-Y6MXjJBmhMzuQMwhkPLHK/vtciTdjsGvkEblH3ofju0=";
+          hash = "sha256-Z/tQ+KV+3MdbknA/1kmiIpVfOsUM8NUu+0iHlPVbYV0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-8VvDtb+8SoLTRC7pXwH40amRurxTQgCmhdi0u7e5AfU=";
+          hash = "sha256-d2GjWr0FHOoORI5KRdwUQvcFfBB8xV6j9wj5OS9VL9o=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-bqjEgsjY+zyG1g/KtkRNxAlazIpc+HwGWvsMQNnPI2M=";
+          hash = "sha256-dlfGTxf2EoiNb0g9uqwjTNW8fi2d1tzubGdIDyp4xTw=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.218";
+      version = "2.1.219";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-eslint";
     publisher = "dbaeumer";
-    version = "3.0.24";
-    hash = "sha256-ZQVzpSSLf3tpO4QtLjbCOje3L5/EqzT9A9IOssl6e54=";
+    version = "3.0.34";
+    hash = "sha256-ynCPFzne4YS4WNjQSmGky+e2IaE3SLxj6FkjKyLPcAs=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "oxc";
     name = "oxc-vscode";
-    version = "1.58.0";
-    hash = "sha256-30dFeguNbY8WM3fLym6aUMkHYH5wA5scSNn04Ukbj9U=";
+    version = "1.59.0";
+    hash = "sha256-avfW91oF8PGCoDYocC744wpQ3zE8fv5582n55Ugb8k8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/emulators/libretro/cores/beetle-vb.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-vb";
-  version = "0-unstable-2026-06-14";
+  version = "0-unstable-2026-07-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-vb-libretro";
-    rev = "38e7a0ec9ac7079ca1c1e3dd9aaf5b56f527efca";
-    hash = "sha256-+57qsfH2wygKdD66yauzKD9XDf01q4LeiWdIeYbVUmc=";
+    rev = "7cc663e9044459b3dab1790bdce8f48dc7358ed6";
+    hash = "sha256-ntw8SXzyu0PTDQgaLmT5Wy172A8TI3JLN6A5WQ2T/OI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/dolphin.nix

@@ -20,13 +20,13 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2026-07-12";
+  version = "0-unstable-2026-07-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "0b766a68cc835775b3216500bb9af2f5d4602b12";
-    hash = "sha256-JaUiDc4/vEWjEXe6H9+i6pft2DTsl5my5wyFmtbjdR0=";
+    rev = "c6b869102f6b9f450f0a9878330d00484754879d";
+    hash = "sha256-7sImbA1uzpwGovo4+5bK9SJpIDIvdB5FhN2IuxVaiQ8=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/melonds.nix

@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "melonds";
-  version = "0-unstable-2026-06-25";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "melonds";
-    rev = "c9550d18923fe86a5ad9faa159399b55c12b47f1";
-    hash = "sha256-xvBdt/TMxZOrC//DLHRWRMqIibt7dNsfLM/FeMTRA60=";
+    rev = "66b5d2634cd0a79030562811e6e05f5532f800ba";
+    hash = "sha256-nQvnXoB8UeaSr6QfYwn18Y18KyLyWvcv/Q3L3SHvaNU=";
   };
 
   extraBuildInputs = [

pkgs/applications/emulators/libretro/cores/picodrive.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "picodrive";
-  version = "0-unstable-2026-04-02";
+  version = "0-unstable-2026-07-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "picodrive";
-    rev = "f0d4a0118a9733a1f10bce5a4ac772c474f9300d";
-    hash = "sha256-q584bnqIbKoXSCRHUAcqSJAIhholnXfbphvLVcbm57o=";
+    rev = "78a662e3135871a6c657d5e61900f6704152e594";
+    hash = "sha256-3+x1ILIUq+/nwfUGXweNIq3PFTAaP56/6G+dX4dEZ/Y=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/brave/default.nix

@@ -0,0 +1,37 @@
+{ callPackage }:
+
+let
+  flavorData = {
+    browser = {
+      optStem = "brave";
+      fileStem = "brave-browser";
+      appIdStem = "com.brave.Browser";
+      darwinStem = "Brave Browser";
+      changelogFile = "CHANGELOG_DESKTOP.md";
+      homepage = "https://brave.com/";
+      innerBinary = "brave";
+    };
+    origin = {
+      optStem = "brave-origin";
+      fileStem = "brave-origin";
+      appIdStem = "com.brave.Origin";
+      darwinStem = "Brave Origin";
+      changelogFile = "CHANGELOG_DESKTOP_ORIGIN.md";
+      homepage = "https://brave.com/origin/";
+      innerBinary = "brave";
+    };
+  };
+
+  mkBrave =
+    release:
+    let
+      pkg = import release;
+      fd = flavorData.${pkg.flavor or "browser"};
+    in
+    callPackage ./make-brave.nix { } (pkg // fd);
+
+in
+{
+  brave = mkBrave ./packages/brave.nix;
+  brave-origin = mkBrave ./packages/brave-origin.nix;
+}

pkgs/applications/networking/browsers/brave/make-brave.nix

@@ -49,26 +49,20 @@
   coreutils,
   libxcb,
   zlib,
-
   # Darwin dependencies
   unzip,
   makeWrapper,
-
   # command line arguments which are always set e.g "--disable-gpu"
   commandLineArgs ? "",
-
   # Necessary for USB audio devices.
   pulseSupport ? stdenv.hostPlatform.isLinux,
   libpulseaudio,
-
   # For GPU acceleration support on Wayland (without the lib it doesn't seem to work)
   libGL,
-
   # For video acceleration via VA-API (--enable-features=AcceleratedVideoDecodeLinuxGL,AcceleratedVideoEncoder)
   libvaSupport ? stdenv.hostPlatform.isLinux,
   libva,
   enableVideoAcceleration ? libvaSupport,
-
   # For Vulkan support (--enable-features=Vulkan); disabled by default as it seems to break VA-API
   vulkanSupport ? false,
   addDriverRunpath,
@@ -78,8 +72,22 @@
 {
   pname,
   version,
-  hash,
-  url,
+  # Map from Nix system strings ("x86_64-linux", "aarch64-darwin", ...) to
+  # the corresponding upstream `{ url, hash }` record. Encoding the per-system
+  # sources as data rather than positional arguments lets channel-specific
+  # package.nix files drop platforms that upstream hasn't published yet.
+  archives,
+  # Upstream product flavor: "browser" (the regular Brave) or "origin" (the
+  # stripped-down Brave Origin).
+  flavor ? "browser",
+  # Flavor-specific paths supplied by the caller (default.nix).
+  optStem,
+  fileStem,
+  appIdStem,
+  darwinStem,
+  changelogFile,
+  homepage,
+  innerBinary,
 }:
 
 let
@@ -94,6 +102,19 @@ let
     escapeShellArg
     ;
 
+  # /opt/brave.com/<optName>/
+  optName = optStem;
+  # Basename used for .desktop, gnome-control-center xml and icon files.
+  fileBase = fileStem;
+  # Secondary .desktop app-id.
+  appId = appIdStem;
+  # Upstream shell wrapper inside /opt.
+  innerWrapper = fileStem;
+  # macOS .app bundle name (inside the zip).
+  darwinApp = darwinStem;
+  # Upstream Exec= target in .desktop files (replaced with our wrapper).
+  upstreamBin = "brave-${flavor}-stable";
+
   deps = [
     alsa-lib
     at-spi2-atk
@@ -156,13 +177,19 @@ let
   ] # disable automatic updates
   # The feature disable is needed for VAAPI to work correctly: https://github.com/brave/brave-browser/issues/20935
   ++ optionals enableVideoAcceleration [ "UseChromeOSDirectVideoDecoder" ];
+
+  archive =
+    assert lib.assertMsg (builtins.hasAttr stdenv.hostPlatform.system archives)
+      "${pname} is not available for ${stdenv.hostPlatform.system}";
+    archives.${stdenv.hostPlatform.system};
 in
 stdenv.mkDerivation {
   inherit pname version;
 
-  src = fetchurl {
-    inherit url hash;
-  };
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl { inherit (archive) url hash; };
 
   dontConfigure = true;
   dontBuild = true;
@@ -201,27 +228,27 @@ stdenv.mkDerivation {
       cp -R usr/share $out
       cp -R opt/ $out/opt
 
-      export BINARYWRAPPER=$out/opt/brave.com/brave/brave-browser
+      export BINARYWRAPPER=$out/opt/brave.com/${optName}/${innerWrapper}
 
       # Fix path to bash in $BINARYWRAPPER
       substituteInPlace $BINARYWRAPPER \
           --replace-fail /bin/bash ${stdenv.shell} \
           --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
 
-      ln -sf $BINARYWRAPPER $out/bin/brave
+      ln -sf $BINARYWRAPPER $out/bin/${pname}
 
-      for exe in $out/opt/brave.com/brave/{brave,chrome_crashpad_handler}; do
+      for exe in $out/opt/brave.com/${optName}/{${innerBinary},chrome_crashpad_handler}; do
           patchelf \
               --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath "${rpath}" $exe
       done
 
       # Fix paths
-      substituteInPlace $out/share/applications/{brave-browser,com.brave.Browser}.desktop \
-          --replace-fail /usr/bin/brave-browser-stable $out/bin/brave
-      substituteInPlace $out/share/gnome-control-center/default-apps/brave-browser.xml \
+      substituteInPlace $out/share/applications/{${fileBase},${appId}}.desktop \
+          --replace-fail /usr/bin/${upstreamBin} $out/bin/${pname}
+      substituteInPlace $out/share/gnome-control-center/default-apps/${fileBase}.xml \
           --replace-fail /opt/brave.com $out/opt/brave.com
-      substituteInPlace $out/opt/brave.com/brave/default-app-block \
+      substituteInPlace $out/opt/brave.com/${optName}/default-app-block \
           --replace-fail /opt/brave.com $out/opt/brave.com
 
       # Correct icons location
@@ -229,13 +256,13 @@ stdenv.mkDerivation {
 
       for icon in ''${icon_sizes[*]}
       do
-          mkdir -p $out/share/icons/hicolor/$icon\x$icon/apps
-          ln -s $out/opt/brave.com/brave/product_logo_$icon.png $out/share/icons/hicolor/$icon\x$icon/apps/brave-browser.png
+          mkdir -p $out/share/icons/hicolor/''${icon}x''${icon}/apps
+          ln -s $out/opt/brave.com/${optName}/product_logo_''${icon}.png $out/share/icons/hicolor/''${icon}x''${icon}/apps/${fileBase}.png
       done
 
       # Replace xdg-settings and xdg-mime
-      ln -sf ${xdg-utils}/bin/xdg-settings $out/opt/brave.com/brave/xdg-settings
-      ln -sf ${xdg-utils}/bin/xdg-mime $out/opt/brave.com/brave/xdg-mime
+      ln -sf ${xdg-utils}/bin/xdg-settings $out/opt/brave.com/${optName}/xdg-settings
+      ln -sf ${xdg-utils}/bin/xdg-mime $out/opt/brave.com/${optName}/xdg-mime
 
       runHook postInstall
     ''
@@ -244,9 +271,9 @@ stdenv.mkDerivation {
 
       mkdir -p $out/{Applications,bin}
 
-      cp -r . "$out/Applications/Brave Browser.app"
+      cp -r . "$out/Applications/${darwinApp}.app"
 
-      makeWrapper "$out/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" $out/bin/brave
+      makeWrapper "$out/Applications/${darwinApp}.app/Contents/MacOS/${darwinApp}" $out/bin/${pname}
 
       runHook postInstall
     '';
@@ -279,22 +306,33 @@ stdenv.mkDerivation {
 
   installCheckPhase = ''
     # Bypass upstream wrapper which suppresses errors
-    $out/opt/brave.com/brave/brave --version
+    $out/opt/brave.com/${optName}/brave --version
   '';
 
   passthru.updateScript = ./update.sh;
 
   meta = {
-    homepage = "https://brave.com/";
-    description = "Privacy-oriented browser for Desktop and Laptop computers";
+    homepage = homepage;
+    description =
+      "Privacy-oriented browser for Desktop and Laptop computers"
+      + lib.optionalString (flavor == "origin") " (Origin variant)";
     changelog =
-      "https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md#"
+      "https://github.com/brave/brave-browser/blob/master/${changelogFile}#"
       + lib.replaceStrings [ "." ] [ "" ] version;
-    longDescription = ''
-      Brave browser blocks the ads and trackers that slow you down,
-      chew up your bandwidth, and invade your privacy. Brave lets you
-      contribute to your favorite creators automatically.
-    '';
+    longDescription =
+      if flavor == "origin" then
+        ''
+          Brave Origin is a stripped-down variant of the Brave browser that
+          removes most non-privacy features (rewards, wallet, AI, etc.) while
+          keeping the core privacy, adblock and Chromium-based browsing
+          experience.
+        ''
+      else
+        ''
+          Brave browser blocks the ads and trackers that slow you down,
+          chew up your bandwidth, and invade your privacy. Brave lets you
+          contribute to your favorite creators automatically.
+        '';
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
@@ -302,12 +340,9 @@ stdenv.mkDerivation {
       jefflabonte
       nasirhm
       buckley310
+      rachalaraj
     ];
-    platforms = [
-      "aarch64-linux"
-      "x86_64-linux"
-      "aarch64-darwin"
-    ];
-    mainProgram = "brave";
+    platforms = builtins.attrNames archives;
+    mainProgram = if flavor == "origin" then "brave-origin" else "brave";
   };
 }

pkgs/applications/networking/browsers/brave/packages/brave-origin.nix

@@ -0,0 +1,21 @@
+# Expression generated by update.sh; do not edit it by hand!
+rec {
+  pname = "brave-origin";
+  version = "1.92.144";
+  flavor = "origin";
+
+  archives = {
+    aarch64-linux = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
+      hash = "sha256-zqjpiBMogYhtuEhIlPlK8J2j9hzfd1M8RYlT/c74Na8=";
+    };
+    x86_64-linux = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
+      hash = "sha256-KF5WXF7GJPLCcEQyASEVfNrYyFJRXBSyWVPPAZPCa/E=";
+    };
+    aarch64-darwin = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin-v${version}-darwin-arm64.zip";
+      hash = "sha256-kkP8cBRnC34+SjC9EvkpKcDYP3cxW7sdJgni0+zXwbk=";
+    };
+  };
+}

pkgs/applications/networking/browsers/brave/packages/brave.nix

@@ -0,0 +1,20 @@
+# Expression generated by update.sh; do not edit it by hand!
+rec {
+  pname = "brave";
+  version = "1.92.144";
+
+  archives = {
+    aarch64-linux = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
+      hash = "sha256-Z9uUJRaMx+P35oXtvAnjHyOQOXt8mW5oyyEtnD754x8=";
+    };
+    x86_64-linux = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
+      hash = "sha256-no/KD+3EB6CqvVWEmDB/8k2rv1wau469FBXMNWN7z6k=";
+    };
+    aarch64-darwin = {
+      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
+      hash = "sha256-YidWCVGP36wn1goAulSbVrKFoHI1NA/pLtfPjIXBO48=";
+    };
+  };
+}

pkgs/applications/networking/browsers/brave/update.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl nix jq
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+VERSIONS_URL="https://versions.brave.com/latest/brave-versions.json"
+
+sri_hash() {
+  nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$1")"
+}
+
+find_release_with_asset() {
+  local versionsJson="$1" channel="$2" template="$3"
+  local match
+  match="$(
+    jq -c --arg channel "$channel" --arg tmpl "$template" '
+      [.[]
+      | select(.channel == $channel)
+      | . as $r
+      | select(
+          $r.github.assets
+          | map(.name)
+          | any(. == ($tmpl | gsub("\\$\\{version\\}"; $r.name)))
+        )
+      ]
+      | sort_by(.published)
+      | last
+    ' <<<"$versionsJson"
+  )"
+  if [[ "$match" != "null" ]]; then
+    printf '%s' "$match"
+    return 0
+  fi
+  echo "update.sh: no ${channel} release with asset matching '${template}' found" >&2
+  return 1
+}
+
+emit_archive_entry() {
+  local releaseJson="$1" version="$2" template="$3" platform="$4"
+  local name="${template//\$\{version\}/$version}"
+  local url
+  url="$(
+    jq -r --arg n "$name" '
+      .github.assets[]
+      | select(.name == $n)
+      | .download_url
+    ' <<<"$releaseJson"
+  )"
+  if [[ -z "$url" ]]; then
+    return 0
+  fi
+  local hash
+  hash="$(sri_hash "$url")"
+  local nixUrl="${url//${version}/\$\{version\}}"
+  cat <<EOF
+    ${platform} = {
+      url = "${nixUrl}";
+      hash = "${hash}";
+    };
+EOF
+}
+
+write_package_nix() {
+  local pname="$1" releaseJson="$2" debStem="$3" darwinStem="$4"
+  local version
+  version="$(jq -r '.name' <<<"$releaseJson")"
+  echo "=> ${pname}: ${version}" >&2
+  local flavorLine=""
+  if [[ "$pname" == brave-origin || "$pname" == brave-origin-* ]]; then
+    flavorLine='  flavor = "origin";'
+  fi
+  local outFile="${SCRIPT_DIR}/packages/${pname}.nix"
+  {
+    echo '# Expression generated by update.sh; do not edit it by hand!'
+    echo 'rec {'
+    echo "  pname = \"${pname}\";"
+    echo "  version = \"${version}\";"
+    [[ -n "$flavorLine" ]] && echo "$flavorLine"
+    echo ''
+    echo '  archives = {'
+    emit_archive_entry "$releaseJson" "$version" "${debStem}_\${version}_arm64.deb"      "aarch64-linux"
+    emit_archive_entry "$releaseJson" "$version" "${debStem}_\${version}_amd64.deb"      "x86_64-linux"
+    emit_archive_entry "$releaseJson" "$version" "${darwinStem}-v\${version}-darwin-arm64.zip" "aarch64-darwin"
+    echo '  };'
+    echo '}'
+  } > "$outFile"
+}
+
+versionsJson="$(curl --fail -s "$VERSIONS_URL")"
+
+entries=(
+  "brave                brave-browser         brave"
+  "brave-origin         brave-origin          brave-origin"
+)
+
+for entry in "${entries[@]}"; do
+  read -r pname debStem darwinStem <<<"$entry"
+  releaseJson="$(find_release_with_asset "$versionsJson" "release" "${debStem}_\${version}_amd64.deb")"
+  write_package_nix "$pname" "$releaseJson" "$debStem" "$darwinStem"
+done

pkgs/applications/networking/browsers/chromium/common.nix

@@ -91,7 +91,6 @@
   cupsSupport ? true,
   cups ? null,
   proprietaryCodecs ? true,
-  pulseSupport ? false,
   libpulseaudio ? null,
   ungoogled ? false,
   ungoogled-chromium,
@@ -394,7 +393,9 @@ let
       libgcrypt
       cups
     ]
-    ++ lib.optional pulseSupport libpulseaudio;
+    ++ [
+      libpulseaudio
+    ];
 
     buildInputs = [
     ]
@@ -455,7 +456,9 @@ let
       libgcrypt
       cups
     ]
-    ++ lib.optional pulseSupport libpulseaudio;
+    ++ [
+      libpulseaudio
+    ];
 
     patches = [
       ./patches/cross-compile.patch
@@ -968,7 +971,7 @@ let
         use_vaapi = false;
         use_v4l2_codec = true;
       }
-      // lib.optionalAttrs pulseSupport {
+      // {
         use_pulseaudio = true;
         link_pulseaudio = true;
       }

pkgs/applications/networking/browsers/chromium/default.nix

@@ -32,7 +32,6 @@
   enableWideVine ? false,
   ungoogled ? false, # Whether to build chromium or ungoogled-chromium
   cupsSupport ? true,
-  pulseSupport ? config.pulseaudio or stdenv.hostPlatform.isLinux,
   commandLineArgs ? "",
   pkgsBuildBuild,
   pkgs,
@@ -76,7 +75,6 @@ let
       inherit
         proprietaryCodecs
         cupsSupport
-        pulseSupport
         ungoogled
         ;
       gnChromium = buildPackages.gn.override upstream-info.deps.gn;

pkgs/applications/networking/browsers/chromium/info.json

@@ -837,7 +837,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "150.0.7871.181",
+    "version": "150.0.7871.186",
     "deps": {
       "depot_tools": {
         "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -849,16 +849,16 @@
         "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
       },
       "ungoogled-patches": {
-        "rev": "150.0.7871.181-1",
-        "hash": "sha256-ifqEnOcvi49cFOYan8ShiwteXYnFrLPclrIBZiE1rGY="
+        "rev": "150.0.7871.186-1",
+        "hash": "sha256-kL9xE/w0W4Wf+z9qX5EFLGMYWQ3Hvyzhy7PtF59a/Sk="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "24b04c927b23c39cf9c5227cc8dc6f64a744c8e9",
-        "hash": "sha256-F52wmxyNPEV26v8YgAz+MRhyEGyV7YUX+/wj95H4Lf0=",
+        "rev": "0fcdce5f4fdec8d442d7df760cb541f1ca6e446d",
+        "hash": "sha256-6coAYewN8RC5kx0PmmiV6mXQhLqWF3BZP320PmOcPvw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,11 +45,11 @@
     "vendorHash": "sha256-031RZo1EqWrt79NvdrrZ9FW/E+mfwkGmr7wyMYX4SHg="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-G52l+5WlcxSNflx0ioD0jEKI1GBWe5D4qW8VH8k6uTA=",
+    "hash": "sha256-es2ti8tSgShwUWYtZ7OEff88LLiAnK4B/Hq9PaNEEOc=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.285.0",
+    "rev": "v1.286.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-sZeXHTrMUUPllPzvpbFjwA5FjFJXnO1k5h9B5i8U+vs="
   },
@@ -445,13 +445,13 @@
     "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
   },
   "gitlabhq_gitlab": {
-    "hash": "sha256-BMOFi/g0W6xo/Kfqw8oqsMeeU3aXyWAKSgF9lIS4AbA=",
+    "hash": "sha256-eTtmEW3sdCkpojxshhdQq+8qNTYjzin5TmCGil/3F5E=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v19.1.0",
+    "rev": "v19.2.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9aoJGVTC9t76auYy8K3QSWGzSAq9aTxemKNc3aCLjRY="
+    "vendorHash": "sha256-uEXZEYlQZ24h4IffJQEmqqrmHbiRSKVGJ1OCv4k1zVQ="
   },
   "go-gandi_gandi": {
     "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -535,11 +535,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-XJmSVCX6rigPD4oi0S4qUyvgvR5SkCHZV2rMAqsmIIo=",
+    "hash": "sha256-M8Kq0lVbPtob2g8j8k4OJenAz8f5jjSobf192TrpSEg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.79.0",
+    "rev": "v4.81.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -905,13 +905,13 @@
     "vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
   },
   "metio_migadu": {
-    "hash": "sha256-Aef1H/L2EFeU9mhecOnlPAbJbt3XfBL0Wz67IqxCI10=",
+    "hash": "sha256-qeN2Zlx4qSrjb7qxjDf4v3uG1GR/faTiCNKD/HZkoyw=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.7.2",
+    "rev": "2026.7.23",
     "spdx": "0BSD",
-    "vendorHash": "sha256-wUX2smEhKUftBCRi7ANq8NpHXpB+EmlVshrhI2ltY2I="
+    "vendorHash": "sha256-rwIHdtVVWygfxadoJigGBIUV0xoQ6vqDsHJgjYQ2RBM="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",

pkgs/applications/networking/instant-messengers/pidgin/default.nix

@@ -13,7 +13,6 @@
   gst_all_1,
   gtk2,
   gtk2-x11,
-  gtkspell2,
   intltool,
   lib,
   libice,
@@ -94,7 +93,6 @@ let
       ]
       ++ lib.optionals stdenv.hostPlatform.isLinux [
         gtk2
-        gtkspell2
         farstream
       ]
       ++ lib.optional stdenv.hostPlatform.isDarwin gtk2-x11;
@@ -126,16 +124,14 @@ let
       "--disable-nm"
       "--disable-tcl"
       "--disable-gevolution"
+      "--disable-gtkspell"
     ]
     ++ lib.optionals withCyrus_sasl [ "--enable-cyrus-sasl=yes" ]
     ++ lib.optionals withGnutls [
       "--enable-gnutls=yes"
       "--enable-nss=no"
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "--disable-gtkspell"
-      "--disable-vv"
-    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ "--disable-vv" ]
     ++ lib.optionals stdenv.cc.isClang [ "CFLAGS=-Wno-error=int-conversion" ];
 
     enableParallelBuilding = true;

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -78,8 +78,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "152.0.1";
-    sha512 = "f66c87de4dd73c3c45e420a55d76c3cb6ac091a61794ccf58ba59d1a40cf8001dee19a6a7f4c6bef7d36ea94ed4e4f677449d3006b2004abbd3fab42ad1c9228";
+    version = "153.0";
+    sha512 = "f77bde3dd0933dd35870a889386c41d55ff0cbe276ec3373b27e9885f7db7e35529e7ecc2fc149ae4f8c5ae53eddb3ad444e7499a850a59a82b8940c7a4c7747";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -89,6 +89,19 @@ rec {
   # Eventually, switch to an updateScript without versionPrefix hardcoded...
   thunderbird-esr = thunderbird-140;
 
+  thunderbird-153 = common {
+    applicationName = "Thunderbird ESR";
+
+    version = "153.0.1esr";
+    sha512 = "3773b49b69341aea108a627faa0dd5b7cfb52cdb4c37e625fbb8cbaef7f9166f925ecbc199173302d5bef7994e6bff3b56cd56a3a4c38a9d702cc3e5aeafcf7c";
+
+    updateScript = callPackage ./update.nix {
+      attrPath = "thunderbirdPackages.thunderbird-153";
+      versionPrefix = "153";
+      versionSuffix = "esr";
+    };
+  };
+
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 

pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "droidcam-obs";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "dev47apps";
     repo = "droidcam-obs-plugin";
     tag = finalAttrs.version;
-    hash = "sha256-JPAQoGZFzTIdBQ7GpCPaYUVPkkcBdCRFkVPU+nyRa7Q=";
+    hash = "sha256-T7CQrjQK5OV1bgqa2il9snsK7nScuVhV06NuX2SoIeI=";
   };
 
   preBuild = ''

pkgs/applications/virtualization/OVMF/default.nix

@@ -97,6 +97,82 @@ let
 
   buildPrefix = "Build/*/*";
 
+  isQemuPlatform = builtins.elem projectDscPath [
+    "OvmfPkg/OvmfPkgX64.dsc"
+    "ArmVirtPkg/ArmVirtQemu.dsc"
+    "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc"
+    "OvmfPkg/LoongArchVirt/LoongArchVirtQemu.dsc"
+  ];
+
+  # QEMU firmware interop descriptors to install, keyed by file name.
+  # Add an attribute to ship an additional descriptor.
+  qemuDescriptors =
+    let
+      description = "${fwPrefix} UEFI firmware for ${cpuName}${lib.optionalString secureBoot " with Secure Boot"}";
+
+      flashMapping = varsFile: {
+        device = "flash";
+        mode = "split";
+        executable = {
+          filename = "${placeholder "fd"}/FV/${fwPrefix}_CODE.fd";
+          format = "raw";
+        };
+        nvram-template = {
+          filename = "${placeholder "fd"}/FV/${varsFile}";
+          format = "raw";
+        };
+      };
+
+      common = {
+        interface-types = [ "uefi" ];
+        targets = [
+          {
+            architecture = cpuName;
+            machines =
+              {
+                x86_64 =
+                  if systemManagementModeRequired then
+                    [ "pc-q35-*" ]
+                  else
+                    [
+                      "pc-i440fx-*"
+                      "pc-q35-*"
+                    ];
+                aarch64 = [ "virt-*" ];
+                riscv64 = [ "virt*" ];
+                loongarch64 = [ "virt*" ];
+              }
+              .${cpuName} or [ ];
+          }
+        ];
+        features =
+          lib.optionals stdenv.hostPlatform.isx86 [
+            "acpi-s3"
+            "amd-sev"
+          ]
+          ++ lib.optionals (stdenv.hostPlatform.isx86 && !systemManagementModeRequired) [ "amd-sev-es" ]
+          ++ lib.optionals secureBoot [ "secure-boot" ]
+          ++ lib.optionals systemManagementModeRequired [ "requires-smm" ]
+          ++ lib.optionals (stdenv.hostPlatform.isx86 && !debug) [ "verbose-dynamic" ];
+        tags = [ ];
+      };
+    in
+    lib.optionalAttrs isQemuPlatform (
+      {
+        "50-edk2-${cpuName}${lib.optionalString secureBoot "-sb"}.json" = common // {
+          inherit description;
+          mapping = flashMapping "${fwPrefix}_VARS.fd";
+        };
+      }
+      // lib.optionalAttrs msVarsTemplate {
+        "40-edk2-${cpuName}${lib.optionalString secureBoot "-sb"}-enrolled.json" = common // {
+          description = "${description}, Microsoft keys enrolled";
+          mapping = flashMapping "${fwPrefix}_VARS.ms.fd";
+          features = common.features ++ [ "enrolled-keys" ];
+        };
+      }
+    );
+
 in
 
 assert msVarsTemplate -> fdSize4MB;
@@ -242,7 +318,17 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     mkdir -vp $fd/AAVMF
     ln -s $fd/FV/AAVMF_CODE.fd $fd/AAVMF/QEMU_EFI-pflash.raw
     ln -s $fd/FV/AAVMF_VARS.fd $fd/AAVMF/vars-template-pflash.raw
-  '';
+  ''
+  + lib.optionalString (qemuDescriptors != { }) ''
+    mkdir -vp $fd/share/qemu/firmware
+  ''
+  + lib.concatStrings (
+    lib.mapAttrsToList (name: descriptor: ''
+      python3 -m json.tool > $fd/share/qemu/firmware/${name} <<'EOF'
+      ${builtins.toJSON descriptor}
+      EOF
+    '') qemuDescriptors
+  );
 
   dontPatchELF = true;
 

pkgs/applications/virtualization/docker/default.nix

@@ -143,6 +143,27 @@ let
         hash = mobyHash;
       };
 
+      extraMobyPath = lib.optionals stdenv.hostPlatform.isLinux (
+        lib.makeBinPath [
+          iproute2
+          iptables
+          e2fsprogs
+          xz
+          xfsprogs
+          procps
+          util-linuxMinimal
+          gitMinimal
+        ]
+      );
+
+      extraMobyUserPath = lib.optionals (stdenv.hostPlatform.isLinux && !clientOnly) (
+        lib.makeBinPath [
+          rootlesskit
+          slirp4netns
+          fuse-overlayfs
+        ]
+      );
+
       moby = buildGoModule (
         lib.optionalAttrs stdenv.hostPlatform.isLinux {
           pname = "moby";
@@ -170,27 +191,6 @@ let
           ++ lib.optionals withSystemd [ systemd ]
           ++ lib.optionals withSeccomp [ libseccomp ];
 
-          extraPath = lib.optionals stdenv.hostPlatform.isLinux (
-            lib.makeBinPath [
-              iproute2
-              iptables
-              e2fsprogs
-              xz
-              xfsprogs
-              procps
-              util-linuxMinimal
-              gitMinimal
-            ]
-          );
-
-          extraUserPath = lib.optionals (stdenv.hostPlatform.isLinux && !clientOnly) (
-            lib.makeBinPath [
-              rootlesskit
-              slirp4netns
-              fuse-overlayfs
-            ]
-          );
-
           postPatch = ''
             patchShebangs hack/make.sh hack/make/
           ''
@@ -218,7 +218,9 @@ let
             install -Dm755 ./bundles/dynbinary-daemon/docker-proxy $out/libexec/docker/docker-proxy
 
             makeWrapper $out/libexec/docker/dockerd $out/bin/dockerd \
-              --prefix PATH : "$out/libexec/docker:$extraPath"
+              --prefix PATH : "$out/libexec/docker${
+                lib.optionalString (extraMobyPath != "") ":${extraMobyPath}"
+              }"
 
             ln -s ${docker-containerd}/bin/containerd $out/libexec/docker/containerd
             ln -s ${docker-containerd}/bin/containerd-shim${lib.optionalString (lib.versionAtLeast version "29.0.0") "-runc-v2"} $out/libexec/docker/containerd-shim${lib.optionalString (lib.versionAtLeast version "29.0.0") "-runc-v2"}
@@ -233,7 +235,9 @@ let
             # rootless Docker
             install -Dm755 ./contrib/dockerd-rootless.sh $out/libexec/docker/dockerd-rootless.sh
             makeWrapper $out/libexec/docker/dockerd-rootless.sh $out/bin/dockerd-rootless \
-              --prefix PATH : "$out/libexec/docker:$extraPath:$extraUserPath"
+              --prefix PATH : "$out/libexec/docker${
+                lib.optionalString (extraMobyPath != "") ":${extraMobyPath}"
+              }${lib.optionalString (extraMobyUserPath != "") ":${extraMobyUserPath}"}"
 
             runHook postInstall
           '';
@@ -335,7 +339,7 @@ let
           install -Dm755 ./build/docker $out/libexec/docker/docker
 
           makeWrapper $out/libexec/docker/docker $out/bin/docker \
-            --prefix PATH : "$out/libexec/docker:$extraPath" \
+            --prefix PATH : "$out/libexec/docker" \
             --prefix DOCKER_CLI_PLUGIN_DIRS : "${dockerCliPluginsDirs}"
         ''
         + lib.optionalString (!clientOnly) ''

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix

@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hy3";
-  version = "0.55.0";
+  version = "0.56.0.1";
 
   src = fetchFromGitHub {
     owner = "outfoxxed";
     repo = "hy3";
     tag = "hl${finalAttrs.version}";
-    hash = "sha256-P3wwiIfqo89evW7xzI+wOI/qM1WPZBiiSmGNtBmYeVk=";
+    hash = "sha256-iK0vERuy5aXisDXm/bzcJP0dgaIot5MLPoVG62DjqO4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix

@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hypr-darkwindow";
-  version = "0.55.4";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "micha4w";
     repo = "Hypr-DarkWindow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-91l5TD46OMfvmhd1WqWxm42cEnjR1yAj2Qk/73mr3ks=";
+    hash = "sha256-2upGTy7IRhrhxf+5VPjzrua8ebOtED6i8kSN8ka+ffg=";
   };
 
   installPhase = ''

pkgs/build-support/appimage/default.nix

@@ -8,16 +8,18 @@
   pv,
   squashfsTools,
   buildFHSEnv,
-  pkgs,
+  replaceVarsWith,
+  runtimeShell,
+  runCommand,
 }:
 
 rec {
-  appimage-exec = pkgs.replaceVarsWith {
+  appimage-exec = replaceVarsWith {
     src = ./appimage-exec.sh;
     isExecutable = true;
     dir = "bin";
     replacements = {
-      inherit (pkgs) runtimeShell;
+      inherit runtimeShell;
       path = lib.makeBinPath [
         bash
         binutils-unwrapped
@@ -42,7 +44,7 @@ rec {
     assert
       name == null
       || throw "The `name` argument is deprecated. Use `pname` and `version` instead to construct the name.";
-    pkgs.runCommand "${pname}-${version}-extracted"
+    runCommand "${pname}-${version}-extracted"
       {
         nativeBuildInputs = [ appimage-exec ];
         strictDeps = true;
@@ -57,60 +59,55 @@ rec {
   extractType2 = extract;
   wrapType1 = wrapType2;
 
-  wrapAppImage =
-    args@{
-      src,
-      extraPkgs ? pkgs: [ ],
-      meta ? { },
-      ...
-    }:
-    buildFHSEnv (
+  wrapAppImage = lib.extendMkDerivation {
+    constructDrv = buildFHSEnv;
+    excludeDrvArgNames = [ "extraPkgs" ];
+    extendDrvArgs =
+      finalAttrs:
+      prev@{
+        contents ? prev.src,
+        extraPkgs ? pkgs: [ ],
+        meta ? { },
+        ...
+      }:
       defaultFhsEnvArgs
       // {
         targetPkgs = pkgs: [ appimage-exec ] ++ defaultFhsEnvArgs.targetPkgs pkgs ++ extraPkgs pkgs;
 
-        runScript = "appimage-exec.sh -w ${src} --";
+        runScript = "appimage-exec.sh -w ${finalAttrs.contents or prev.src} --";
 
         meta = {
           sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
         }
         // meta;
-      }
-      // (removeAttrs args (builtins.attrNames (builtins.functionArgs wrapAppImage)))
-    );
+      };
+  };
 
-  wrapType2 =
-    args@{
-      src,
-      extraPkgs ? pkgs: [ ],
-      ...
-    }:
-    wrapAppImage (
-      args
-      // {
-        inherit extraPkgs;
-        src = extract (
-          lib.filterAttrs (
-            key: value:
-            builtins.elem key [
-              "pname"
-              "version"
-              "src"
-            ]
-          ) args
-        );
-
-        # passthru src to make nix-update work
-        # hack to keep the origin position (unsafeGetAttrPos)
-        passthru =
-          lib.pipe args [
-            lib.attrNames
-            (lib.remove "src")
-            (removeAttrs args)
+  wrapType2 = lib.extendMkDerivation {
+    constructDrv = wrapAppImage;
+    extendDrvArgs = finalAttrs: args: {
+      contents = extract (
+        lib.filterAttrs (
+          key: value:
+          builtins.elem key [
+            "pname"
+            "version"
+            "src"
           ]
-          // args.passthru or { };
-      }
-    );
+        ) finalAttrs
+      );
+
+      # passthru src to make nix-update work
+      # hack to keep the origin position (unsafeGetAttrPos)
+      passthru =
+        lib.pipe finalAttrs [
+          lib.attrNames
+          (lib.remove "src")
+          (removeAttrs finalAttrs)
+        ]
+        // args.passthru or { };
+    };
+  };
 
   defaultFhsEnvArgs = {
     # Most of the packages were taken from the Steam chroot

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  stdenvNoCC,
   callPackage,
   runCommandLocal,
   writeShellScript,
@@ -11,30 +12,6 @@
   bubblewrap,
 }:
 
-{
-  pname ? throw "You must provide either `name` or `pname`",
-  version ? throw "You must provide either `name` or `version`",
-  name ? "${pname}-${version}",
-  runScript ? "bash",
-  nativeBuildInputs ? [ ],
-  extraInstallCommands ? "",
-  executableName ? args.pname or name,
-  meta ? { },
-  passthru ? { },
-  extraPreBwrapCmds ? "",
-  extraBwrapArgs ? [ ],
-  unshareUser ? false,
-  unshareIpc ? false,
-  unsharePid ? false,
-  unshareNet ? false,
-  unshareUts ? false,
-  unshareCgroup ? false,
-  privateTmp ? false,
-  chdirToPwd ? true,
-  dieWithParent ? true,
-  ...
-}@args:
-
 # NOTE:
 # `pname` and `version` will throw if they were not provided.
 # Use `name` instead of directly evaluating `pname` or `version`.
@@ -42,338 +19,358 @@
 # If you need `pname` or `version` specifically, use `args` instead:
 # e.g. `args.pname or ...`.
 
-let
-  inherit (lib)
-    concatLines
-    concatStringsSep
-    escapeShellArgs
-    filter
-    optionalString
-    splitString
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-
-  # The splicing code does not handle `pkgsi686Linux` well, so we have to be
-  # explicit about which package set it's coming from.
-  inherit (pkgsHostTarget) pkgsi686Linux;
-
-  # we don't know which have been supplied, and want to avoid defaulting missing attrs to null. Passed into runCommandLocal
-  nameAttrs = lib.filterAttrs (
-    key: value:
-    builtins.elem key [
-      "name"
-      "pname"
-      "version"
-    ]
-  ) args;
-
-  buildFHSEnv = callPackage ./buildFHSEnv.nix { };
-
-  fhsenv = buildFHSEnv (
-    removeAttrs args [
+lib.makeOverridable (
+  lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
+    excludeDrvArgNames = [
+      "multiPkgs"
+      "targetPkgs"
       "runScript"
-      "extraInstallCommands"
-      "meta"
-      "passthru"
-      "extraPreBwrapCmds"
-      "extraBwrapArgs"
-      "dieWithParent"
-      "unshareUser"
-      "unshareCgroup"
-      "unshareUts"
-      "unshareNet"
-      "unsharePid"
-      "unshareIpc"
-      "privateTmp"
-    ]
-  );
-
-  etcBindEntries =
-    let
-      files = [
-        # NixOS Compatibility
-        "static"
-        "nix" # mainly for nixVersions.git users, but also for access to nix/netrc
-        # Shells
-        "shells"
-        "bashrc"
-        "zshenv"
-        "zshrc"
-        "zinputrc"
-        "zprofile"
-        # Users, Groups, NSS
-        "passwd"
-        "group"
-        "shadow"
-        "hosts"
-        "resolv.conf"
-        "nsswitch.conf"
-        # User profiles
-        "profiles"
-        # Sudo & Su
-        "login.defs"
-        "sudoers"
-        "sudoers.d"
-        # Time
-        "localtime"
-        "zoneinfo"
-        # Other Core Stuff
-        "machine-id"
-        "os-release"
-        # PAM
-        "pam.d"
-        # Fonts
-        "fonts"
-        # ALSA
-        "alsa"
-        "asound.conf"
-        # SSL
-        "ssl/certs"
-        "ca-certificates"
-        "pki"
-        # Custom dconf profiles
-        "dconf"
-      ];
-    in
-    map (path: "/etc/${path}") files;
-
-  # Here's the problem case:
-  # - we need to run bash to run the init script
-  # - LD_PRELOAD may be set to another dynamic library, requiring us to discover its dependencies
-  # - oops! ldconfig is part of the init script, and it hasn't run yet
-  # - everything explodes
-  #
-  # In particular, this happens with fhsenvs in fhsenvs, e.g. when running
-  # a wrapped game from Steam.
-  #
-  # So, instead of doing that, we build a tiny static (important!) shim
-  # that executes ldconfig in a completely clean environment to generate
-  # the initial cache, and then execs into the "real" init, which is the
-  # first time we see anything dynamically linked at all.
-  #
-  # Also, the real init is placed strategically at /init, so we don't
-  # have to recompile this every time.
-  containerInit =
-    runCommandCC "container-init"
+    ];
+    extendDrvArgs =
+      finalAttrs:
       {
-        buildInputs = [ stdenv.cc.libc.static or null ];
-      }
-      ''
-        $CXX -static -s -o $out ${./container-init.cc}
-      '';
+        pname ? throw "You must provide either `name` or `pname`",
+        version ? throw "You must provide either `name` or `version`",
+        name ? "${pname}-${version}",
+        runScript ? "bash",
+        executableName ? args.pname or name,
+        meta ? { },
+        passthru ? { },
+        unshareUser ? false,
+        unshareIpc ? false,
+        unsharePid ? false,
+        unshareNet ? false,
+        unshareUts ? false,
+        unshareCgroup ? false,
+        privateTmp ? false,
+        chdirToPwd ? true,
+        dieWithParent ? true,
+        ...
+      }@args:
+      let
+        inherit (lib)
+          concatLines
+          concatStringsSep
+          escapeShellArgs
+          filter
+          optionalString
+          splitString
+          removeAttrs
+          ;
 
-  realInit =
-    run:
-    writeShellScript "${name}-init" ''
-      source /etc/profile
-      exec ${run} "$@"
-    '';
+        # The splicing code does not handle `pkgsi686Linux` well, so we have to be
+        # explicit about which package set it's coming from.
+        inherit (pkgsHostTarget) pkgsi686Linux;
 
-  indentLines = str: concatLines (map (s: "  " + s) (filter (s: s != "") (splitString "\n" str)));
-  bwrapCmd =
-    {
-      initArgs ? "",
-    }:
-    ''
-      ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
-      ro_mounts=()
-      symlinks=()
-      etc_ignored=()
+        buildFHSEnv = callPackage ./buildFHSEnv.nix { };
 
-      ${extraPreBwrapCmds}
+        fhsenv = buildFHSEnv (
+          removeAttrs args [
+            "runScript"
+            "extraInstallCommands"
+            "meta"
+            "passthru"
+            "extraPreBwrapCmds"
+            "extraBwrapArgs"
+            "dieWithParent"
+            "unshareUser"
+            "unshareCgroup"
+            "unshareUts"
+            "unshareNet"
+            "unsharePid"
+            "unshareIpc"
+            "privateTmp"
+          ]
+        );
 
-      # loop through all entries of root in the fhs environment, except its /etc.
-      for i in ${fhsenv}/*; do
-        path="/''${i##*/}"
-        if [[ $path == '/etc' ]]; then
-          :
-        elif [[ -L $i ]]; then
-          symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
-          ignored+=("$path")
-        else
-          ro_mounts+=(--ro-bind "$i" "$path")
-          ignored+=("$path")
-        fi
-      done
+        etcBindEntries =
+          let
+            files = [
+              # NixOS Compatibility
+              "static"
+              "nix" # mainly for nixVersions.git users, but also for access to nix/netrc
+              # Shells
+              "shells"
+              "bashrc"
+              "zshenv"
+              "zshrc"
+              "zinputrc"
+              "zprofile"
+              # Users, Groups, NSS
+              "passwd"
+              "group"
+              "shadow"
+              "hosts"
+              "resolv.conf"
+              "nsswitch.conf"
+              # User profiles
+              "profiles"
+              # Sudo & Su
+              "login.defs"
+              "sudoers"
+              "sudoers.d"
+              # Time
+              "localtime"
+              "zoneinfo"
+              # Other Core Stuff
+              "machine-id"
+              "os-release"
+              # PAM
+              "pam.d"
+              # Fonts
+              "fonts"
+              # ALSA
+              "alsa"
+              "asound.conf"
+              # SSL
+              "ssl/certs"
+              "ca-certificates"
+              "pki"
+              # Custom dconf profiles
+              "dconf"
+            ];
+          in
+          map (path: "/etc/${path}") files;
 
-      # loop through the entries of /etc in the fhs environment.
-      if [[ -d ${fhsenv}/etc ]]; then
-        for i in ${fhsenv}/etc/*; do
-          path="/''${i##*/}"
-          # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
-          # don't want to override it with a path from the FHS environment.
-          if [[ $path == '/fonts' || $path == '/ssl' ]]; then
-            continue
-          fi
-          if [[ -L $i ]]; then
-            symlinks+=(--symlink "$i" "/etc$path")
-          else
-            ro_mounts+=(--ro-bind "$i" "/etc$path")
-          fi
-          etc_ignored+=("/etc$path")
-        done
-      fi
-
-      # propagate /etc from the actual host if nested
-      if [[ -e /.host-etc ]]; then
-        ro_mounts+=(--ro-bind /.host-etc /.host-etc)
-      else
-        ro_mounts+=(--ro-bind /etc /.host-etc)
-      fi
-
-      declare -A etc_ignored_set
-      for ign in "''${etc_ignored[@]}"; do
-        etc_ignored_set[$ign]=1
-      done
-
-      # link selected etc entries from the actual root
-      for i in ${escapeShellArgs etcBindEntries}; do
-        if [[ -n "''${etc_ignored_set[$i]:-}" ]]; then
-          continue
-        fi
-        if [[ -e $i ]]; then
-          symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
-        fi
-      done
-
-      declare -A ignored_set
-      for ign in "''${ignored[@]}"; do
-        ignored_set[$ign]=1
-      done
-
-      declare -a auto_mounts
-      # loop through all directories in the root
-      for dir in /*; do
-        # if it is a directory and not already provided by the FHS env or
-        # explicitly ignored, bind-mount it into the chroot. Use exact match
-        # via associative array because regex substring matching incorrectly
-        # skips prefixes (e.g. /sb would match /sbin and never get mounted,
-        # breaking --chdir when CWD is on a custom mount like /sb/project).
-        # https://github.com/NixOS/nixpkgs/issues/241151
-        if [[ -d "$dir" ]] && [[ -z "''${ignored_set[$dir]:-}" ]]; then
-          # add it to the mount list
-          auto_mounts+=(--bind "$dir" "$dir")
-        fi
-      done
-
-      declare -a x11_args
-      # Always mount a tmpfs on /tmp/.X11-unix
-      # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
-      x11_args+=(--tmpfs /tmp/.X11-unix)
-
-      # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
-      if [[ "$DISPLAY" == *:* ]]; then
-        # recover display number from $DISPLAY formatted [host]:num[.screen]
-        display_nr=''${DISPLAY/#*:} # strip host
-        display_nr=''${display_nr/%.*} # strip screen
-        local_socket=/tmp/.X11-unix/X$display_nr
-        x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
-      fi
-
-      ${optionalString privateTmp ''
-        # sddm places XAUTHORITY in /tmp
-        if [[ "$XAUTHORITY" == /tmp/* ]]; then
-          x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
-        fi
-
-        # dbus-run-session puts the socket in /tmp
-        IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
-        for addr in "''${addrs[@]}"; do
-          [[ "$addr" == unix:* ]] || continue
-          IFS="," read -ra parts <<<"''${addr#unix:}"
-          for part in "''${parts[@]}"; do
-            printf -v part '%s' "''${part//\\/\\\\}"
-            printf -v part '%b' "''${part//%/\\x}"
-            [[ "$part" == path=/tmp/* ]] || continue
-            x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
-          done
-        done
-      ''}
-
-      cmd=(
-        ${bubblewrap}/bin/bwrap
-        --dev-bind /dev /dev
-        --proc /proc
-        ${optionalString chdirToPwd ''--chdir "$(pwd)"''}
-        ${optionalString unshareUser "--unshare-user"}
-        ${optionalString unshareIpc "--unshare-ipc"}
-        ${optionalString unsharePid "--unshare-pid"}
-        ${optionalString unshareNet "--unshare-net"}
-        ${optionalString unshareUts "--unshare-uts"}
-        ${optionalString unshareCgroup "--unshare-cgroup"}
-        ${optionalString dieWithParent "--die-with-parent"}
-        --bind /nix /nix
-        ${optionalString privateTmp "--tmpfs /tmp"}
-        # Our glibc will look for the cache in its own path in `/nix/store`.
-        # As such, we need a cache to exist there, because pressure-vessel
-        # depends on the existence of an ld cache. However, adding one
-        # globally proved to be a bad idea (see #100655), the solution we
-        # settled on being mounting one via bwrap.
-        # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
-        # of both architectures to work.
-        --tmpfs ${glibc}/etc \
-        --tmpfs /etc \
-        --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
-        --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
-        --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
-        --remount-ro ${glibc}/etc \
-        --symlink ${realInit runScript} /init \
-    ''
-    + optionalString fhsenv.isMultiBuild (indentLines ''
-      --tmpfs ${pkgsi686Linux.glibc}/etc \
-      --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \
-      --symlink /etc/ld.so.cache ${pkgsi686Linux.glibc}/etc/ld.so.cache \
-      --ro-bind ${pkgsi686Linux.glibc}/etc/rpc ${pkgsi686Linux.glibc}/etc/rpc \
-      --remount-ro ${pkgsi686Linux.glibc}/etc \
-    '')
-    + ''
-        "''${ro_mounts[@]}"
-        "''${symlinks[@]}"
-        "''${auto_mounts[@]}"
-        "''${x11_args[@]}"
-        ${concatStringsSep "\n  " extraBwrapArgs}
-        ${containerInit} ${initArgs}
-      )
-      exec "''${cmd[@]}"
-    '';
-
-  bin = writeShellScript "${name}-bwrap" (bwrapCmd {
-    initArgs = ''"$@"'';
-  });
-in
-runCommandLocal name
-  (
-    nameAttrs
-    // {
-      inherit nativeBuildInputs;
-
-      __structuredAttrs = true;
-
-      passthru = passthru // {
-        env =
-          runCommandLocal "${name}-shell-env"
+        # Here's the problem case:
+        # - we need to run bash to run the init script
+        # - LD_PRELOAD may be set to another dynamic library, requiring us to discover its dependencies
+        # - oops! ldconfig is part of the init script, and it hasn't run yet
+        # - everything explodes
+        #
+        # In particular, this happens with fhsenvs in fhsenvs, e.g. when running
+        # a wrapped game from Steam.
+        #
+        # So, instead of doing that, we build a tiny static (important!) shim
+        # that executes ldconfig in a completely clean environment to generate
+        # the initial cache, and then execs into the "real" init, which is the
+        # first time we see anything dynamically linked at all.
+        #
+        # Also, the real init is placed strategically at /init, so we don't
+        # have to recompile this every time.
+        containerInit =
+          runCommandCC "container-init"
             {
-              shellHook = bwrapCmd { };
+              buildInputs = [ stdenv.cc.libc.static or null ];
             }
             ''
-              echo >&2 ""
-              echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
-              echo >&2 ""
-              exit 1
+              $CXX -static -s -o $out ${./container-init.cc}
             '';
-        inherit args fhsenv;
+
+        realInit =
+          run:
+          writeShellScript "${name}-init" ''
+            source /etc/profile
+            exec ${run} "$@"
+          '';
+
+        indentLines = str: concatLines (map (s: "  " + s) (filter (s: s != "") (splitString "\n" str)));
+        bwrapCmd =
+          {
+            initArgs ? "",
+          }:
+          ''
+            ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
+            ro_mounts=()
+            symlinks=()
+            etc_ignored=()
+
+            ${finalAttrs.extraPreBwrapCmds or ""}
+
+            # loop through all entries of root in the fhs environment, except its /etc.
+            for i in ${fhsenv}/*; do
+              path="/''${i##*/}"
+              if [[ $path == '/etc' ]]; then
+                :
+              elif [[ -L $i ]]; then
+                symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
+                ignored+=("$path")
+              else
+                ro_mounts+=(--ro-bind "$i" "$path")
+                ignored+=("$path")
+              fi
+            done
+
+            # loop through the entries of /etc in the fhs environment.
+            if [[ -d ${fhsenv}/etc ]]; then
+              for i in ${fhsenv}/etc/*; do
+                path="/''${i##*/}"
+                # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
+                # don't want to override it with a path from the FHS environment.
+                if [[ $path == '/fonts' || $path == '/ssl' ]]; then
+                  continue
+                fi
+                if [[ -L $i ]]; then
+                  symlinks+=(--symlink "$i" "/etc$path")
+                else
+                  ro_mounts+=(--ro-bind "$i" "/etc$path")
+                fi
+                etc_ignored+=("/etc$path")
+              done
+            fi
+
+            # propagate /etc from the actual host if nested
+            if [[ -e /.host-etc ]]; then
+              ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+            else
+              ro_mounts+=(--ro-bind /etc /.host-etc)
+            fi
+
+            declare -A etc_ignored_set
+            for ign in "''${etc_ignored[@]}"; do
+              etc_ignored_set[$ign]=1
+            done
+
+            # link selected etc entries from the actual root
+            for i in ${escapeShellArgs etcBindEntries}; do
+              if [[ -n "''${etc_ignored_set[$i]:-}" ]]; then
+                continue
+              fi
+              if [[ -e $i ]]; then
+                symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
+              fi
+            done
+
+            declare -A ignored_set
+            for ign in "''${ignored[@]}"; do
+              ignored_set[$ign]=1
+            done
+
+            declare -a auto_mounts
+            # loop through all directories in the root
+            for dir in /*; do
+              # if it is a directory and not already provided by the FHS env or
+              # explicitly ignored, bind-mount it into the chroot. Use exact match
+              # via associative array because regex substring matching incorrectly
+              # skips prefixes (e.g. /sb would match /sbin and never get mounted,
+              # breaking --chdir when CWD is on a custom mount like /sb/project).
+              # https://github.com/NixOS/nixpkgs/issues/241151
+              if [[ -d "$dir" ]] && [[ -z "''${ignored_set[$dir]:-}" ]]; then
+                # add it to the mount list
+                auto_mounts+=(--bind "$dir" "$dir")
+              fi
+            done
+
+            declare -a x11_args
+            # Always mount a tmpfs on /tmp/.X11-unix
+            # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
+            x11_args+=(--tmpfs /tmp/.X11-unix)
+
+            # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
+            if [[ "$DISPLAY" == *:* ]]; then
+              # recover display number from $DISPLAY formatted [host]:num[.screen]
+              display_nr=''${DISPLAY/#*:} # strip host
+              display_nr=''${display_nr/%.*} # strip screen
+              local_socket=/tmp/.X11-unix/X$display_nr
+              x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
+            fi
+
+            ${optionalString privateTmp ''
+              # sddm places XAUTHORITY in /tmp
+              if [[ "$XAUTHORITY" == /tmp/* ]]; then
+                x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
+              fi
+
+              # dbus-run-session puts the socket in /tmp
+              IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
+              for addr in "''${addrs[@]}"; do
+                [[ "$addr" == unix:* ]] || continue
+                IFS="," read -ra parts <<<"''${addr#unix:}"
+                for part in "''${parts[@]}"; do
+                  printf -v part '%s' "''${part//\\/\\\\}"
+                  printf -v part '%b' "''${part//%/\\x}"
+                  [[ "$part" == path=/tmp/* ]] || continue
+                  x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
+                done
+              done
+            ''}
+
+            cmd=(
+              ${bubblewrap}/bin/bwrap
+              --dev-bind /dev /dev
+              --proc /proc
+              ${optionalString chdirToPwd ''--chdir "$(pwd)"''}
+              ${optionalString unshareUser "--unshare-user"}
+              ${optionalString unshareIpc "--unshare-ipc"}
+              ${optionalString unsharePid "--unshare-pid"}
+              ${optionalString unshareNet "--unshare-net"}
+              ${optionalString unshareUts "--unshare-uts"}
+              ${optionalString unshareCgroup "--unshare-cgroup"}
+              ${optionalString dieWithParent "--die-with-parent"}
+              --bind /nix /nix
+              ${optionalString privateTmp "--tmpfs /tmp"}
+              # Our glibc will look for the cache in its own path in `/nix/store`.
+              # As such, we need a cache to exist there, because pressure-vessel
+              # depends on the existence of an ld cache. However, adding one
+              # globally proved to be a bad idea (see #100655), the solution we
+              # settled on being mounting one via bwrap.
+              # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
+              # of both architectures to work.
+              --tmpfs ${glibc}/etc \
+              --tmpfs /etc \
+              --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
+              --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
+              --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
+              --remount-ro ${glibc}/etc \
+              --symlink ${realInit runScript} /init \
+          ''
+          + optionalString fhsenv.isMultiBuild (indentLines ''
+            --tmpfs ${pkgsi686Linux.glibc}/etc \
+            --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \
+            --symlink /etc/ld.so.cache ${pkgsi686Linux.glibc}/etc/ld.so.cache \
+            --ro-bind ${pkgsi686Linux.glibc}/etc/rpc ${pkgsi686Linux.glibc}/etc/rpc \
+            --remount-ro ${pkgsi686Linux.glibc}/etc \
+          '')
+          + ''
+              "''${ro_mounts[@]}"
+              "''${symlinks[@]}"
+              "''${auto_mounts[@]}"
+              "''${x11_args[@]}"
+              ${concatStringsSep "\n  " (finalAttrs.extraBwrapArgs or [ ])}
+              ${containerInit} ${initArgs}
+            )
+            exec "''${cmd[@]}"
+          '';
+
+        bin = writeShellScript "${name}-bwrap" (bwrapCmd {
+          initArgs = ''"$@"'';
+        });
+      in
+      {
+        buildCommand = ''
+          mkdir -p $out/bin
+          ln -s ${bin} $out/bin/${executableName}
+
+          ${finalAttrs.extraInstallCommands or ""}
+        '';
+
+        __structuredAttrs = true;
+        strictDeps = true;
+
+        enableParallelBuilding = true;
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+
+        passthru = passthru // {
+          env =
+            runCommandLocal "${name}-shell-env"
+              {
+                shellHook = bwrapCmd { };
+              }
+              ''
+                echo >&2 ""
+                echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
+                echo >&2 ""
+                exit 1
+              '';
+          inherit args fhsenv;
+        };
+
+        meta = {
+          mainProgram = executableName;
+        }
+        // meta;
       };
-
-      meta = {
-        mainProgram = executableName;
-      }
-      // meta;
-    }
-  )
-  ''
-    mkdir -p $out/bin
-    ln -s ${bin} $out/bin/${executableName}
-
-    ${extraInstallCommands}
-  ''
+  }
+)

pkgs/build-support/replace-vars/replace-vars-with.nix

@@ -122,7 +122,8 @@ in
 
 stdenvNoCC.mkDerivation (
   {
-    name = baseNameOf src;
+    name =
+      if (attrs ? pname && attrs ? version) then "${attrs.pname}-${attrs.version}" else baseNameOf src;
   }
   // optionalAttrs
   // forcedAttrs

pkgs/by-name/af/afterstep/fix-build-with-c23.patch

@@ -1,81 +0,0 @@
-From 081d9c3284075c65b70837079bd67621c3b64da7 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Sun, 28 Dec 2025 00:39:49 +0800
-Subject: [PATCH] fix build with c23
-
----
- libAfterBase/fs.c       | 2 +-
- src/ASDocGen/ASDocGen.c | 2 +-
- src/Ident/Ident.c       | 2 +-
- src/afterstep/dirtree.c | 2 +-
- src/afterstep/menus.h   | 2 +-
- 5 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/libAfterBase/fs.c b/libAfterBase/fs.c
-index 731bfd3..954bfd6 100644
---- a/libAfterBase/fs.c
-+++ b/libAfterBase/fs.c
-@@ -818,7 +818,7 @@ my_scandir (char *dirname, struct direntry *(*namelist[]),
- 	}
- 	/* Optionally sort the list */
- 	if (dcomp)
--		qsort (*namelist, n, sizeof (struct direntry *), (int (*)())dcomp);
-+		qsort (*namelist, n, sizeof (struct direntry *), (int (*)(const void *, const void *))dcomp);
- 
- 	/* Return the count of the entries */
- 	return n;
-diff --git a/src/ASDocGen/ASDocGen.c b/src/ASDocGen/ASDocGen.c
-index 31d7a70..9a86219 100644
---- a/src/ASDocGen/ASDocGen.c
-+++ b/src/ASDocGen/ASDocGen.c
-@@ -667,7 +667,7 @@ write_options_keywords(const char *source_dir, const char *syntax_dir, SyntaxDef
- 	sorted_list = safecalloc( max_i, sizeof(TermDef*));
- 	for (i = 0; i < max_i; i++)
- 		sorted_list[i] = &(syntax->terms[i]) ; 
--	qsort(sorted_list, max_i, sizeof(TermDef*), (int (*)())sort_terms_by_alpha );
-+	qsort(sorted_list, max_i, sizeof(TermDef*), (int (*)(const void *, const void *))sort_terms_by_alpha );
- 	for (i = 0; i < max_i; i++)
- 	{	
- 		SyntaxDef *sub_syntax = sorted_list[i]->sub_syntax ; 
-diff --git a/src/Ident/Ident.c b/src/Ident/Ident.c
-index 1497d06..d6ddad6 100644
---- a/src/Ident/Ident.c
-+++ b/src/Ident/Ident.c
-@@ -89,7 +89,7 @@ void HandleEvents();
- void DispatchEvent (ASEvent * event);
- void process_message (send_data_type type, send_data_type *body);
- 
--Window make_ident_window();
-+Window make_ident_window(int width, int height);
- void fill_window_data();
- void display_window_data();
- void add_property( const char *name, const char *value, unsigned long value_encoding, Bool span_cols );
-diff --git a/src/afterstep/dirtree.c b/src/afterstep/dirtree.c
-index 46ce782..48f7e30 100644
---- a/src/afterstep/dirtree.c
-+++ b/src/afterstep/dirtree.c
-@@ -675,7 +675,7 @@ void dirtree_sort (dirtree_t * tree)
- 	list = (dirtree_t **) safemalloc (n * sizeof (dirtree_t *));
- 	for (n = 0, t = tree->child; t != NULL; t = t->next, n++)
- 		list[n] = t;
--	qsort (list, n, sizeof (dirtree_t *), (int (*)())dirtree_compar);
-+	qsort (list, n, sizeof (dirtree_t *), (int (*)(const void *, const void *))dirtree_compar);
- 	tree->child = list[0];
- 	for (i = 1; i < n; i++)
- 		list[i - 1]->next = list[i];
-diff --git a/src/afterstep/menus.h b/src/afterstep/menus.h
-index 98b2ad3..bb2a5b1 100644
---- a/src/afterstep/menus.h
-+++ b/src/afterstep/menus.h
-@@ -95,7 +95,7 @@ MenuData* FindPopup( const char* name, int quiet );
- 
- void DeleteMenuItem( MenuDataItem* item );
- 
--MenuData *CreateMenuData();
-+MenuData *CreateMenuData(char *name);
- MenuData *NewMenuData (char *name);
- void DeleteMenuData (MenuData * menu);
- 
--- 
-2.51.2
-

pkgs/by-name/af/afterstep/package.nix

@@ -1,101 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  dbus,
-  fltk_1_3,
-  gtk2,
-  libice,
-  libsm,
-  libtiff,
-  pkg-config,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "afterstep";
-  version = "2.2.12";
-
-  src = fetchFromGitHub {
-    owner = "afterstep";
-    repo = "afterstep";
-    rev = finalAttrs.version;
-    hash = "sha256-j1ADTRZ3Mxv9VNZWhWCFMnM/CJfkphdrgbw9Ca3bBw0=";
-  };
-
-  patches = [
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/afterstep/raw/master/debian/patches/44-Fix-build-with-gcc-5.patch";
-      hash = "sha256-RNLB6PuFVA1PsYt2VwLyLyvY2OO3oIl1xk+0/6nwN+4=";
-    })
-
-    # Fix pending upstream inclusion for binutils-2.36 support:
-    #  https://github.com/afterstep/afterstep/pull/7
-    (fetchpatch {
-      name = "binutils-2.36.patch";
-      url = "https://github.com/afterstep/afterstep/commit/5e9e897cf8c455390dd6f5b27fec49707f6b9088.patch";
-      hash = "sha256-aGMTyojzXEHGjO9lMT6dwLl01Fd333BUuCIX0FU9ac4=";
-    })
-
-    # fix build with c23
-    #   fs.c:821:66: error: passing argument 4 of 'qsort' from incompatible pointer type [-Wincompatible-pointer-types]
-    #   Ident.c:326:1: error: conflicting types for 'make_ident_window'; have 'Window(int,  int)' {aka 'long unsigned int(int,  int)'}
-    #   menuitem.c:85:11: error: conflicting types for 'CreateMenuData'; have 'MenuData *(char *)'
-    ./fix-build-with-c23.patch
-  ];
-
-  postPatch = ''
-    # Causes fatal ldconfig cache generation attempt on non-NixOS Linux
-    for mkfile in autoconf/Makefile.common.lib.in libAfter{Base,Image}/Makefile.in; do
-      substituteInPlace $mkfile \
-        --replace-fail 'test -w /etc' 'false'
-    done
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    dbus
-    fltk_1_3
-    gtk2
-    libice
-    libsm
-    libtiff
-  ];
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  strictDeps = true;
-
-  preConfigure = ''
-    # A strange type of bug: dbus is not immediately found by pkg-config
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
-  '';
-
-  # Parallel build fails due to missing dependencies between private libraries:
-  #   ld: cannot find ../libAfterConf/libAfterConf.a: No such file or directory
-  # Let's disable parallel builds until it's fixed upstream:
-  #   https://github.com/afterstep/afterstep/issues/8
-  enableParallelBuilding = false;
-
-  meta = {
-    homepage = "http://www.afterstep.org/";
-    description = "NEXTStep-inspired window manager";
-    longDescription = ''
-      AfterStep is a window manager for the Unix X Window System. Originally
-      based on the look and feel of the NeXTStep interface, it provides end
-      users with a consistent, clean, and elegant desktop. The goal of AfterStep
-      development is to provide for flexibility of desktop configuration,
-      improving aestetics, and efficient use of system resources.
-    '';
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
-    mainProgram = "afterstep";
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/ai/airspyhf/package.nix

@@ -9,12 +9,14 @@
 
 stdenv.mkDerivation {
   pname = "airspyhf";
-  version = "1.6.8-unstable-2025-07-12";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "airspy";
     repo = "airspyhf";
-    rev = "87cf12a30f3a0f10f313aab8e54999ca69b753af";
+    # Not clear why upstream won't tag releases. See:
+    # https://github.com/airspy/airspyhf/commit/c0bb66dd8976651c53884ccec3d70a108f1e50e1#r193607536
+    rev = "c0bb66dd8976651c53884ccec3d70a108f1e50e1";
     hash = "sha256-7bXBv4YTOaWRFI6Svb9/lSBEAssUgJMqxKM5zHk1swM=";
   };
 

pkgs/by-name/al/algol68g/package.nix

@@ -15,12 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "algol68g";
-  version = "3.12.2";
+  version = "3.12.3";
 
   src = fetchurl {
-    # Uses archive.org because the original site removes older versions.
-    url = "https://web.archive.org/web/20260515052918/https://algol68genie.nl/algol68g-3.12.2.tar.gz";
-    hash = "sha256-4fiubqpgoH3YOlCg1bJHQ3kOayKNulW3CYbOK1awE7k";
+    url = "https://algol68genie.nl/algol68g-${finalAttrs.version}.tar.gz";
+    hash = "sha256-TS5m+Byi+5j4jiOuQbR159QERfNJsQiGNngtoyC9IrE=";
   };
 
   outputs = [
@@ -48,8 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall =
     let
       pdfdoc = fetchurl {
-        url = "https://web.archive.org/web/20260503174213/https://algol68genie.nl/learning-algol-68-genie.pdf";
-        hash = "sha256-eLMRf3XcAkr/Dmk7ieRe62x76VcCj+2QltHH7YtL15s=";
+        url = "https://algol68genie.nl/learning-algol-68-genie.pdf";
+        hash = "sha256-BrVjYXd5sknV0+UCRgQMf0H3QMzMQcLhytEEuiTGkLE=";
       };
     in
     lib.optionalString withPDFDoc ''

pkgs/by-name/al/alistral/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XsN4UyIXkd0YVtO/q9EcFP/sBYkH9leISmbJZ93ef6E=";
+    hash = "sha256-NDWQl2Gq4Q0OMMCrHQhybInaJRjY3Fxe3GXrGb32MMY=";
   };
 
-  cargoHash = "sha256-KFNFioZ/5moC5FNXw+hA+NrPjsqu+3V8A5mtZ4FZUHw=";
+  cargoHash = "sha256-QxTmjtntp5zy7UijRn0hF3DyOOl3dIpZjPSASCuHaEk=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2503";
+  version = "2.0.2511";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-UtwbQXhX8dmmA6dVuVFcMQkM98kOt/U//OAVMGBImDU=";
+    hash = "sha256-KnEvFnPXQZ+XhNyweWIE0mjM4vqcqXcJKuus/dFq5f0=";
   };
 
-  npmDepsHash = "sha256-V7MWSEJT2RtYE1iYJHj2ltrfzke+GO1PfT/wo+MqlZk=";
+  npmDepsHash = "sha256-Xw/SXRpQkPd+EcemeHO89tC9amDiVV/RD/1H0H8rax0=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/an/anubis/package.nix

@@ -15,21 +15,21 @@
 
 buildGoModule (finalAttrs: {
   pname = "anubis";
-  version = "1.25.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "TecharoHQ";
     repo = "anubis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/XIwSMEmnS3L/Wzg6ABso7R6W3TYkJomC8aFMycxZo=";
+    hash = "sha256-0ceF4Te0H5edBhvGJgGc/NLJxEAcDVGnnKlqHKnpW60=";
   };
 
-  vendorHash = "sha256-9CMD8Rn4q8b+hyrph+BqqS32ijZyJRNsop6ML7z5Zuk=";
+  vendorHash = "sha256-+NPwL4p0p/s74m1Ld0z2GEcsWk5FqhcLbHrTNP3yEzk=";
 
   npmDeps = fetchNpmDeps {
     name = "anubis-npm-deps";
     inherit (finalAttrs) src;
-    hash = "sha256-2U91Dt+ymspjYgTtgCjahCNr6fIs85TT/k+I8M2aC9s=";
+    hash = "sha256-6sj9C8GHm+RzFl/X5HIPhIDl5l8muBzDSXSRCHumGBs=";
   };
 
   nativeBuildInputs = [
@@ -75,6 +75,8 @@ buildGoModule (finalAttrs: {
     export DONT_USE_NETWORK=1
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     tests = { inherit (nixosTests) anubis; };
     updateScript = nix-update-script { extraArgs = [ "--version-regex=^v(\\d+\\.\\d+\\.\\d+)$" ]; };

pkgs/by-name/ap/apriltag/package.nix

@@ -9,7 +9,6 @@
 
 let
   opencv4WithGtk = python3Packages.opencv4.override {
-    enableGtk2 = true; # For GTK2 support
     enableGtk3 = true; # For GTK3 support
   };
 in

pkgs/by-name/as/as-tree/package.nix

@@ -6,7 +6,7 @@
 
 rustPlatform.buildRustPackage {
   pname = "as-tree";
-  version = "unstable-2021-03-09";
+  version = "0.12.0-unstable-2021-03-09";
 
   src = fetchFromGitHub {
     owner = "jez";

pkgs/by-name/as/assh/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "assh";
-  version = "2.17.2";
+  version = "2.17.3";
 
   src = fetchFromGitHub {
     repo = "assh";
     owner = "moul";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/w4RluA7py6d75S04czNsgHpmR5rmAUZx8OnZfu9oNg=";
+    hash = "sha256-CH6QM/dy5fKo7Tq2ekrc06iqjJDZl8JHMG7jalho7BI=";
   };
 
-  vendorHash = "sha256-EA39KqAN9SHPU362j6/j6okvT+eZb2R4unMA0bB+bVg=";
+  vendorHash = "sha256-ENCJNgMLTZDlKL0DIt48F1G8TYo2blPdsFH6v8dNC8w=";
 
   ldflags = [
     "-s"

pkgs/by-name/as/assimp/package.nix

@@ -42,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "ASSIMP_BUILD_ASSIMP_TOOLS" true)
     (lib.cmakeBool "ASSIMP_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "ASSIMP_WARNINGS_AS_ERRORS" false)
   ];
 
   # Some matrix tests fail on non-86_64-linux: