vaultwarden: 1.37.4 -> 1.37.5 (#581979)

Diff: https://github.com/vaultwarden/vw_web_builds/compare/v2026.7.0+0...v2026.10.1+0

doc/languages-frameworks/cuda.section.md

@@ -165,6 +165,75 @@ To illustrate: support for Blackwell (e.g., `sm_100`) was added in CUDA 12.8. As
 
 The `pkgsForCudaArch` attribute set makes it possible to access packages built for a specific architecture without needing to manually call `pkgs.extend` and supply a new `config`. As an example, `pkgsForCudaArch.sm_89.python3Packages.torch` provides PyTorch built for Ada Lovelace GPUs.
 
+### Unlocking GeForce tensor core throughput {#cuda-gpu-unlock}
+
+[gpu-unlock](https://github.com/Zagitta/gpu-unlock) removes the tensor core
+throughput cap for FP16, BF16 and TF32 operations with FP32 accumulation on
+supported GeForce GPUs. Upstream considers Ampere (RTX 30) support stable and
+Turing (RTX 20) and Ada (RTX 40) support experimental; Blackwell (RTX 50) is
+unsupported. Check the upstream supported GPU list for your exact model.
+This does not improve gaming or ordinary FP32 CUDA performance.
+
+The kernel module is available as `config.boot.kernelPackages.gpu-unlock`, with
+its firmware in the package's `firmware` attribute. The firmware is unfree; allow
+`gpu-unlock-firmware` in your `nixpkgs.config.allowUnfreePredicate`, or enable
+`nixpkgs.config.allowUnfree`. The pinned firmware version is independent of your
+installed NVIDIA driver version.
+
+Add the following to a NixOS configuration that already enables the NVIDIA driver:
+
+```nix
+{ config, ... }:
+{
+  boot.extraModulePackages = [ config.boot.kernelPackages.gpu-unlock ];
+  hardware.firmware = [ config.boot.kernelPackages.gpu-unlock.firmware ];
+  boot.initrd.availableKernelModules = [ "gpu_unlock" ];
+  boot.kernelParams = [ "gpu_unlock.targets=all" ];
+
+  boot.initrd.systemd.services.gpu-unlock = {
+    description = "Unlock NVIDIA GPU tensor core throughput";
+    wantedBy = [ "sysinit.target" ];
+    before = [
+      "sysinit.target"
+      "systemd-modules-load.service"
+      "systemd-udevd.service"
+      "systemd-udev-trigger.service"
+    ];
+    unitConfig.DefaultDependencies = false;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "/bin/modprobe gpu_unlock";
+    };
+  };
+}
+```
+
+The initrd service must finish before udev or the normal module loader can load
+NVIDIA or another GPU driver. Merely adding `gpu_unlock` to
+`boot.initrd.kernelModules` does not ensure this ordering. The module's firmware
+declarations cause NixOS to include the required assets in the initrd.
+
+To select individual GPUs, replace `all` with full PCI addresses from `lspci -D`,
+for example `gpu_unlock.targets=0000:01:00.0,0000:02:00.0`. Already bound or
+powered-down cards are skipped. Loading the module after the NVIDIA driver has
+bound the card is too late.
+
+Apply the configuration with `sudo nixos-rebuild boot`, then reboot. Check
+`journalctl -k -b --grep=gpu_unlock` for an `unlocked` message for each selected
+GPU. `journalctl -b -u gpu-unlock.service` shows initrd service failures; a
+successful service exit alone does not mean a GPU was unlocked.
+
+The unlock is lost when a GPU loses power. Upstream attempts to reapply it after
+suspend to RAM before NVIDIA resumes the GPU; hibernation is not covered.
+Laptop runtime power management can also reset the unlock. See upstream's
+power-management guidance and check the kernel log after resume.
+
+To disable unlocking, remove `gpu_unlock.targets=...` from `boot.kernelParams`,
+rebuild the boot configuration, and reboot. For a single boot, remove the
+parameter in the bootloader editor. To uninstall, also remove the module,
+firmware, and initrd service settings above, rebuild, and reboot.
+
 ### Running Docker or Podman containers with CUDA support {#cuda-docker-podman}
 
 It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).

doc/packages/darwin-builder.section.md

@@ -124,6 +124,14 @@ When switching an existing QEMU builder over, delete its data disk first (e.g.
 `sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
 but writes a raw image, and refuses to misread a genuine qcow2 left behind.
 
+The guest runs on demand: it boots on the first connection and keeps it on hold
+until the guest is ready (usually around 12s). If there are no connections for
+10 minutes, the guest is stopped. The data disk is kept across these reboots,
+even with nix-darwin's `nix.linux-builder.ephemeral`.
+The `ephemeral` setting wipes the disk only during the launchd service start.
+Set `virtualisation.vz.idleTimeout` to a number of seconds, or to `null` to keep
+the guest running forever.
+
 The guest console goes to the macOS unified log by default; read it with:
 
 ```ShellSession

doc/redirects.json

@@ -47,6 +47,9 @@
   "cuda-extending-cuda-package-sets": [
     "index.html#cuda-extending-cuda-package-sets"
   ],
+  "cuda-gpu-unlock": [
+    "index.html#cuda-gpu-unlock"
+  ],
   "cuda-modifying-cuda-package-sets": [
     "index.html#cuda-modifying-cuda-package-sets",
     "index.html#cuda-configuring-cuda-package-sets"

maintainers/maintainer-list.nix

@@ -31828,12 +31828,6 @@
       }
     ];
   };
-  wizeman = {
-    email = "rcorreia@wizy.org";
-    github = "wizeman";
-    githubId = 168610;
-    name = "Ricardo M. Correia";
-  };
   wjohnsto = {
     name = "Will Johnston";
     github = "wjohnsto";

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils haskellPackages.cabal2nix-unstable.bin git (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils haskellPackages.cabal2nix-unstable.bin git "(import <nixpkgs/ci> {}).fmt.pkg"
 
 set -euo pipefail
 

maintainers/scripts/haskell/transitive-broken-packages.nix

@@ -14,7 +14,15 @@ let
       ) x
     );
   brokenDeps = lib.subtractLists (getEvaluating pkgs.haskellPackages) (
-    getEvaluating (nixpkgs { config.allowBroken = true; }).haskellPackages
+    getEvaluating
+      (nixpkgs {
+        config.problems.matchers = lib.mkForce [
+          {
+            kind = "broken";
+            handler = "ignore";
+          }
+        ];
+      }).haskellPackages
   );
 in
 ''

maintainers/scripts/haskell/update-cabal2nix-unstable.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts "(import <nixpkgs/ci> {}).fmt.pkg"
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.

maintainers/team-list.nix

@@ -433,6 +433,7 @@ with lib.maintainers;
   libretro = {
     members = [
       aanderse
+      iedame
       igorcafe
       thiagokokada
     ];

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -79,6 +79,8 @@
 
 - [devenv](https://devenv.sh/), fast, declarative, reproducible and composable developer environments. Available as [programs.devenv](#opt-programs.devenv.enable).
 
+- [Yopass](https://yopass.se/), a secure way to share secrets, passwords and files. Available as [services.yopass](#opt-services.yopass.enable).
+
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
 - [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).
@@ -129,6 +131,8 @@
 
 - [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI), a proxy that provides OpenAI/Gemini/Claude/Codex/Grok compatible API interfaces from OAuth-based AI CLI subscriptions. Available as [services.cliproxyapi](#opt-services.cliproxyapi.enable).
 
+- [VLC media player](https://www.videolan.org/), a free and open source cross-platform multimedia player. Available as [programs.vlc](#opt-programs.vlc.enable).
+
 - [Lix TOML remote builders](https://docs.lix.systems/manual/lix/stable/advanced-topics/distributed-builds.html#using-a-toml-configuration), remote builder configuration using lix's TOML format. Available as [lix.buildMachines](#opt-lix.buildMachines). Note: incompatible with `nix.buildMachines`.
 
 - [Forgejo Runner](https://forgejo.org/docs/latest/admin/actions/), a daemon for Forgejo Actions. Available as [services.forgejo-runner](#opt-services.forgejo-runner.instances).
@@ -591,13 +595,15 @@ The above example can be migrated via the following structured code block:
 
 - The new {option}`programs.ssh.hosts` option can be used to add `Host` blocks to the client {file}`ssh_config`, keyed by `Host` pattern, instead of writing them by hand via {option}`programs.ssh.extraConfig`. Each block declares an {option}`programs.ssh.hosts.<name>.order`, since `ssh_config` applies the first obtained value for each keyword.
 
+- `services.openssh` now generates a hybrid post-quantum ML-DSA 44/Ed25519 host key at {file}`/etc/ssh/ssh_host_mldsa44_ed25519_key` by default.
+
 - `services.esphome` has been rewritten to use the new [ESPHome Device Builder](https://github.com/esphome/device-builder) which replaces the previous ESPHome dashboard. Most settings have been converted to equivalent or comparable Device Builder settings. The option `services.esphome.usePing` has been removed since the Device Builder does not have such an option.
 
 - `services.hostapd` gained [`interfaceName`](#opt-services.hostapd.radios._name_.networks._name_.interfaceName) per network, separating the interface name emitted in the hostapd configuration from the network attribute name. Secondary BSSs on different radios can now share an interface name (for example `mld0`) when configured as links of the same Wi-Fi 7 multi-link device with `settings.mld_ap = true`, which is required for MLO support. It defaults to the attribute name, so existing configurations are unchanged.
 
 - NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
 
-- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
+- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. The guest boots on demand and powers off after 10 idle minutes, see `virtualisation.vz.idleTimeout`. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
 
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
   - Default settings can now be introspected at [](#opt-services.netbox.settings).

nixos/modules/module-list.nix

@@ -361,6 +361,7 @@
   ./programs/vim.nix
   ./programs/virt-manager.nix
   ./programs/vivid.nix
+  ./programs/vlc.nix
   ./programs/vscode.nix
   ./programs/wavemon.nix
   ./programs/wayland/dux-shell.nix
@@ -1897,6 +1898,7 @@
   ./services/web-apps/windmill.nix
   ./services/web-apps/wordpress.nix
   ./services/web-apps/writefreely.nix
+  ./services/web-apps/yopass.nix
   ./services/web-apps/your_spotify.nix
   ./services/web-apps/youtrack.nix
   ./services/web-apps/zabbix.nix

nixos/modules/profiles/nix-builder-vz-vm.nix

@@ -40,6 +40,8 @@ in
       }
     ];
 
+    virtualisation.vz.idleTimeout = lib.mkDefault (10 * 60);
+
     # The guest console belongs where a Mac user looks for service logs. Switch to `file`
     # for a complete record: the unified log drops messages under bursts.
     virtualisation.vz.console = lib.mkDefault "log";

nixos/modules/programs/vlc.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.programs.vlc;
+in
+{
+  options = {
+    programs.vlc = {
+      enable = lib.mkEnableOption "VideoLAN's VLC media player";
+      package = lib.mkPackageOption pkgs "vlc" { };
+
+      chromecast.openFirewall = lib.mkEnableOption "" // {
+        description = ''
+          Open the default port (8010) in the firewall for Chromecast to work.
+
+          Make sure to use the `vlc` package with
+          `chromecastSupport = true`, which is the default.
+        '';
+      };
+
+      plugins = lib.mkOption {
+        default = [ ];
+        # TODO: List 2 plugins in the example once there are enough in nixpkgs
+        example = lib.literalExpression "[ pkgs.vlc-bittorrent ]";
+        type = with lib.types; listOf package;
+        description = ''
+          List of VLC plugins to use.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.variables = lib.mkIf (cfg.plugins != [ ]) {
+      # VLC_PLUGIN_PATH expects a single folder containing the user-supplied
+      # plugins, not a list of directories separated by a color (:). So we
+      # symlink the plugins together.
+      VLC_PLUGIN_PATH = pkgs.symlinkJoin {
+        name = "custom-vlc-plugins";
+        paths = cfg.plugins;
+      };
+    };
+
+    # vlc's chromecastSupport requires TCP port 8010 to be open for it to work
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.chromecast.openFirewall [
+      8010
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ kintrix ];
+}

nixos/modules/services/monitoring/kener.nix

@@ -115,6 +115,7 @@ in
         StateDirectoryMode = "750";
         DynamicUser = true;
         ExecStart = "${cfg.package}/bin/kener-server";
+        EnvironmentFile = cfg.environmentFile;
         Restart = "on-failure";
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";

nixos/modules/services/network-filesystems/litestream/default.nix

@@ -7,6 +7,7 @@
 let
   cfg = config.services.litestream;
   settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "litestream-config.yaml" cfg.settings;
 in
 {
   options.services.litestream = {
@@ -65,16 +66,13 @@ in
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    environment.etc = {
-      "litestream.yml" = {
-        source = settingsFormat.generate "litestream-config.yaml" cfg.settings;
-      };
-    };
+    environment.etc."litestream.yml".source = settingsFile;
 
     systemd.services.litestream = {
       description = "Litestream";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      restartTriggers = [ settingsFile ];
       serviceConfig = {
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${cfg.package}/bin/litestream replicate";

nixos/modules/services/networking/ssh/sshd.nix

@@ -380,6 +380,10 @@ in
             type = "ed25519";
             path = "/etc/ssh/ssh_host_ed25519_key";
           }
+          {
+            type = "mldsa44-ed25519";
+            path = "/etc/ssh/ssh_host_mldsa44_ed25519_key";
+          }
         ];
         example = [
           {

nixos/modules/services/web-apps/immich.nix

@@ -455,8 +455,7 @@ in
 
     systemd.services.immich-machine-learning = mkIf cfg.machine-learning.enable {
       description = "immich machine learning";
-      requires = lib.mkIf cfg.database.enable [ "postgresql.target" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.enable [ "postgresql.target" ];
+      after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       inherit (cfg.machine-learning) environment;
       serviceConfig = commonServiceConfig // {

nixos/modules/services/web-apps/yopass.nix

@@ -0,0 +1,159 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.yopass;
+
+  stateDirectory = "/var/lib/yopass";
+
+  # yopass-server has no config file: every flag is read from an
+  # environment variable of the same name (upstream
+  # docs/server-options.md). List-valued flags such as TRUSTED_PROXIES
+  # are parsed as comma-separated strings.
+  toEnvValue =
+    v:
+    if lib.isBool v then
+      lib.boolToString v
+    else if lib.isList v then
+      lib.concatMapStringsSep "," toString v
+    else
+      toString v;
+in
+{
+  options.services.yopass = {
+    enable = lib.mkEnableOption "Yopass, a secure way to share secrets and files";
+
+    package = lib.mkPackageOption pkgs "yopass" { };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/yopass";
+      description = ''
+        Path to a file in systemd `EnvironmentFile` format, for
+        settings that shouldn't land in the Nix store: `API_TOKEN`,
+        `WEBHOOK_SECRET`, `LICENSE_KEY`, `OIDC_CLIENT_SECRET`,
+        `OIDC_SESSION_KEY`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (oneOf [
+          bool
+          int
+          str
+          (listOf str)
+        ]);
+      default = { };
+      example = {
+        PORT = 8080;
+        DATABASE = "redis";
+        REDIS = "redis://127.0.0.1:6379/0";
+        MAX_FILE_SIZE = "10MB";
+        TRUSTED_PROXIES = [
+          "192.168.1.0/24"
+          "10.0.0.0/8"
+        ];
+      };
+      description = ''
+        yopass-server settings, passed as environment variables. Every
+        flag in [the upstream documentation](https://github.com/jhaals/yopass/blob/master/docs/server-options.md)
+        has an environment variable form (`--oidc-issuer` is
+        `OIDC_ISSUER`); use that name as the attribute. Booleans become
+        `true`/`false`, numbers are stringified and lists are joined
+        with commas. Anything left unset keeps yopass-server's own
+        default, except that the module binds `ADDRESS` to `127.0.0.1`
+        (expecting a reverse proxy in front) and points
+        `FILE_STORE_PATH` at `/var/lib/yopass/files` so uploads survive
+        restarts; both can be overridden here.
+
+        A `FILE_STORE_PATH` outside `/var/lib/yopass` is allow-listed
+        for writing automatically, but it must already exist and be
+        writable by the service, which runs as a dynamic user.
+
+        The module doesn't own the storage backend. With `DATABASE =
+        "redis"` pointing at a local `services.redis.servers.<name>`,
+        add `systemd.services.yopass.after = [ "redis-<name>.service" ];`
+        yourself to avoid a startup race; the memcached unit name is
+        fixed, so that ordering is handled for you.
+
+        Secrets belong in {option}`services.yopass.environmentFile`
+        rather than here, since this ends up in the Nix store.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.yopass.settings = {
+      ADDRESS = lib.mkDefault "127.0.0.1";
+      # Upstream defaults to /tmp/yopass-files, which lands on the unit's
+      # PrivateTmp and is wiped on every restart.
+      FILE_STORE_PATH = lib.mkDefault "${stateDirectory}/files";
+    };
+
+    systemd.services.yopass = {
+      description = "Yopass - Share secrets securely";
+      documentation = [ "https://github.com/jhaals/yopass" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional ((cfg.settings.DATABASE or "memcached") == "memcached") "memcached.service";
+
+      environment = lib.mapAttrs (_: toEnvValue) cfg.settings;
+
+      serviceConfig = {
+        ExecStart = lib.getExe' cfg.package "yopass-server";
+        DynamicUser = true;
+        Restart = "on-failure";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = baseNameOf stateDirectory;
+        # StateDirectory is writable already; anything else needs
+        # allow-listing under ProtectSystem=strict.
+        ReadWritePaths = lib.optional (
+          !lib.hasPrefix "${stateDirectory}/" cfg.settings.FILE_STORE_PATH
+        ) cfg.settings.FILE_STORE_PATH;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @setuid @keyring"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ fraggerfox ];
+}

nixos/modules/virtualisation/vz-vm.nix

@@ -74,6 +74,7 @@ let
       else
         { mode = vzCfg.console; };
   }
+  // lib.optionalAttrs (vzCfg.idleTimeout != null) { idleTimeoutSeconds = vzCfg.idleTimeout; }
   // vzCfg.extraConfig;
 
   staticConfigFile = hostPkgs.writeText "vzvm-config.json" (builtins.toJSON staticConfig);
@@ -186,6 +187,25 @@ in
       '';
     };
 
+    virtualisation.vz.idleTimeout = lib.mkOption {
+      type = lib.types.nullOr (lib.types.ints.between 1 (7 * 24 * 60 * 60));
+      default = null;
+      example = 30 * 60;
+      description = ''
+        Run guest on demand: `vzvm` keeps listening on
+        {option}`virtualisation.vz.forwardPorts` and boots guest on first
+        connection. Vzvm powers it off once no forwarded connection has been
+        open for this many seconds. Next connection boots it again and keeps
+        connections on hold until it is ready (~12s).
+
+        Reboots are managed by the `vzvm` process and keep the data disk:
+        nix-darwin's `nix.linux-builder.ephemeral` wipes it when the launchd
+        service starts, not between on-demand boots.
+
+        `null` runs the guest without timeout for as long as `vzvm` runs.
+      '';
+    };
+
     virtualisation.vz.extraConfig = lib.mkOption {
       type = lib.types.attrs;
       default = { };
@@ -220,6 +240,14 @@ in
             writable store. Enable virtualisation.writableStoreUseTmpfs.
           '';
         }
+        {
+          assertion = vzCfg.idleTimeout != null -> vzCfg.forwardPorts != [ ];
+          message = ''
+            {option}`virtualisation.vz.idleTimeout` boots guest on first forwarded
+            connection but virtualisation.vz.forwardPorts is empty:
+            guest would never start.
+          '';
+        }
       ];
 
       boot.loader.grub.enable = false;

nixos/tests/all-tests.nix

@@ -774,6 +774,7 @@ in
   gocd-server = runTest ./gocd-server.nix;
   gocron = runTest ./gocron.nix;
   gocryptfs = runTest ./gocryptfs.nix;
+  goeland = runTest ./goeland.nix;
   gokapi = runTest ./gokapi.nix;
   gollum = runTest ./gollum.nix;
   gonic = runTest ./gonic.nix;
@@ -2055,6 +2056,7 @@ in
     inherit lib runTest;
   };
   yggdrasil = runTest ./yggdrasil.nix;
+  yopass = import ./web-apps/yopass.nix { inherit pkgs runTest; };
   your_spotify = runTest ./your_spotify.nix;
   zammad = runTest ./zammad.nix;
   zapret2 = runTest ./zapret2.nix;

nixos/tests/e57inspector.nix

@@ -44,9 +44,9 @@ in
     name = "e57inspector-screenshot-analysis";
     screenshot = "${vmTest}/screen.png";
     question = ''
-      Look at this screenshot of a desktop application.
+      Look at this screenshot of the e57inspector application.
       Answer: Does the application show that a file was loaded into it successfully?
-      For this, only scans matter, as there are no images in the file.
+      For this, only scans matter, as there are no images in the file, so an image count of 0 is fine.
       The inspector on the left should show child elements below 'Data 3D'.
     '';
   };

nixos/tests/goeland.nix

@@ -0,0 +1,106 @@
+{ pkgs, ... }:
+let
+  articleTitle = "Hello from the test feed";
+
+  # goeland refuses to fetch local and private IPs:
+  # https://github.com/slurdge/goeland/blob/3eb263bcb2c6617c74326f629efa9075f1f40783/internal/goeland/httpget/httpget.go#L75-L77
+  feedAddress = "203.0.113.1";
+  machineAddress = "203.0.113.2";
+in
+{
+  name = "goeland";
+  meta.maintainers = with pkgs.lib.maintainers; [ h7x4 ];
+
+  containers = {
+    feed = {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        useHostResolvConf = false;
+        firewall.allowedTCPPorts = [ 80 ];
+      };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "${feedAddress}/24";
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."feed.local".root = pkgs.writeTextDir "rss.xml" ''
+          <?xml version="1.0" encoding="UTF-8"?>
+          <rss version="2.0">
+            <channel>
+              <title>Dummy feed</title>
+              <link>http://feed.local/</link>
+              <description>Dummy feed for testing</description>
+              <item>
+                <title>${articleTitle}</title>
+                <link>http://feed.local/article.html</link>
+                <guid>http://feed.local/article.html</guid>
+                <description>The lazy fox jumps over the quick brown dog</description>
+              </item>
+            </channel>
+          </rss>
+        '';
+      };
+    };
+
+    machine =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          useHostResolvConf = false;
+          domain = "example.com";
+          hosts.${feedAddress} = [ "feed.local" ];
+        };
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "${machineAddress}/24";
+        };
+
+        services.postfix = {
+          enable = true;
+          settings.main.mydestination = [ config.networking.domain ];
+        };
+
+        services.goeland = {
+          enable = true;
+          settings = {
+            loglevel = "trace";
+            email = {
+              host = "127.0.0.1";
+              port = 25;
+              authentication = "none";
+              encryption = "none";
+            };
+            sources.feed = {
+              type = "feed";
+              url = "http://feed.local/rss.xml";
+              allow-insecure = true;
+              filters = [ "all" ];
+            };
+            pipes.feed = {
+              source = "feed";
+              destination = "email";
+              email_from = "goeland@example.com";
+              email_to = [ "alice@${config.networking.domain}" ];
+            };
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    feed.wait_for_open_port(80)
+    machine.wait_for_unit("postfix.service")
+    machine.systemctl("start goeland.service")
+
+    machine.wait_until_succeeds("grep -qr '${articleTitle}' /var/spool/mail/alice/")
+  '';
+}

nixos/tests/kanidm-provisioning.nix

@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_12;
 
   nodes.provision =
     { pkgs, lib, ... }:

nixos/tests/kanidm.nix

@@ -22,7 +22,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_12;
 
   nodes.server =
     { pkgs, ... }:

nixos/tests/openssh.nix

@@ -501,6 +501,8 @@ in
         )
         server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_ed25519_key")
         server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_ed25519_key.pub")
+        server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_mldsa44_ed25519_key")
+        server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_mldsa44_ed25519_key.pub")
         server_no_sshd_with_key.fail("pgrep sshd")
 
         # Validate the above check for sshd using pgrep does pass on a server

nixos/tests/vaultwarden.nix

@@ -94,7 +94,7 @@ let
               # Skip the tour on first login
               click_when_unobstructed((By.XPATH, "//button[contains(., 'Skip')]"))
 
-              click_when_unobstructed((By.XPATH, "//button[contains(., 'New item')]"))
+              click_when_unobstructed((By.XPATH, "//button[contains(., 'Add item')]"))
 
               driver.find_element(By.XPATH, '//input[@formcontrolname="name"]').send_keys(
                   'secrets'

nixos/tests/vlm-screenshot-question.nix

@@ -3,7 +3,7 @@
 # Similar to `wait_for_text()` in NixOS VM tests.
 #
 # Runs a VLM (Vision Language Model) on a screenshot and asserts that the
-# model's answer to a yes/no question ends with "YES".
+# model's answer to a yes/no question contains a bool response in a JSON field.
 #
 # This is useful to automatically test software that is otherwise
 # hard to test, e.g. "does this 3D program render the bunny correctly?".
@@ -23,6 +23,7 @@
       hash = "sha256-nEwdSKRi9/iDsomErE9C02bJxXNDTqtoVT4POL9+tQw=";
     }
   ),
+  # mmproj = "multimodal projector"
   mmproj ? (
     fetchurl {
       url = "https://huggingface.co/unsloth/gemma-4-E2B-it-GGUF/resolve/90f9618340396838ee7ff5b0ba2da27da62953d3/mmproj-F16.gguf";
@@ -35,28 +36,30 @@
   question,
 }:
 let
-
   analysisScript =
     writers.writePython3 "${name}-script" { flakeIgnore = [ "E501" ]; } # allow long lines
       ''
+        import json
         import os
-        import re
         import subprocess
+        import sys
         import time
 
+        SYSTEM_PROMPT = (
+            'Answer the user question, outputting valid JSON only.'
+            ' Schema: { "bool_answer": true | false, "explanation": "..." }'
+        )
+
         out = os.environ["out"]
-        screenshot = "${screenshot}"
-        # Using JSON here even permits preserving multi-line ASCII art questions and so on.
+        # Using JSON here safely escapes arbitrary strings into Python literals
+        # (and even permits preserving multi-line ASCII art questions and so on).
+        screenshot = ${builtins.toJSON "${screenshot}"}
         question = ${builtins.toJSON question}
 
-        # Build the full prompt with output markers for reliable extraction.
-        prompt = (
-            "Start your output with [output-start]."
-            f" {question}"
-            " Explain what you see, and your judgment."
-            " On the final line, output exactly YES or NO."
-            " Then immediately output [output-end] with nothing else after it."
-        )
+
+        def fail(message):
+            sys.exit(message)
+
 
         vlm_start = time.time()
         result = subprocess.run(
@@ -66,52 +69,87 @@ let
                 "--simple-io",  # disables the spinner whose backspace chars would corrupt captured output
                 "--reasoning", "off", "--temp", "0",
                 "--threads", "1",  # for determinism
-                "--n-gpu-layers", "0",  # force CPU-only (results on GPUs might be different and nondeterministic, see https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238)
+
+                # Force CPU-only, for both the text model and the multimodal projector
+                # (results on GPUs might be different and nondeterministic, see
+                # https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238).
+                "--device", "none",
+                "--n-gpu-layers", "0",
+                "--no-mmproj-offload",
+
                 "--model", "${model}",
                 "--mmproj", "${mmproj}",
                 "--image", screenshot,
-                "-p", prompt,
+                "-sys", SYSTEM_PROMPT,
+                "-p", question,
             ],
             capture_output=True,
             text=True,
-            # `OMP_NUM_THREADS=1` prevents OpenMP from spawning extra threads in the BLAS backend
-            # (OpenBLAS), which causes nondeterminism with `--image`; without `--image`, `--threads 1`
-            # alone is already deterministic (BLAS is not used for short text prompts).
+            # Limiting the BLAS backend (OpenBLAS) to one thread prevents nondeterminism with `--image`;
+            # without `--image`, `--threads 1` alone is already deterministic (BLAS is not used for short text prompts).
+            # Depending on how OpenBLAS is built, it spawns threads via OpenMP (`OMP_NUM_THREADS`)
+            # or its own pthreads pool (`OPENBLAS_NUM_THREADS`, legacy `GOTO_NUM_THREADS`),
+            # so set all of them.
             # Relevant code: https://github.com/ggml-org/llama.cpp/blob/80afa33aadcc4f71212b17e5e52904491c76b63e/ggml/src/ggml-blas/ggml-blas.cpp#L30-L148
             # PR to fix it in OpenBLAS: https://github.com/OpenMathLib/OpenBLAS/pull/5808
-            env={**os.environ, "OMP_NUM_THREADS": "1"},
+            env={
+                **os.environ,
+                "OMP_NUM_THREADS": "1",
+                "OPENBLAS_NUM_THREADS": "1",
+                "GOTO_NUM_THREADS": "1",
+            },
         )
         vlm_elapsed = time.time() - vlm_start
         output = result.stdout
         print(f"VLM inference took {vlm_elapsed:.1f}s")
-        print(f"VLM raw output: {repr(output)}")
+        print(f"VLM raw output: {output!r}")
         if result.returncode != 0:
             print(f"VLM stderr: {result.stderr}")
-        assert result.returncode == 0, f"llama-cli failed with exit code {result.returncode}"
+            fail(f"llama-cli failed with exit code {result.returncode}")
 
         print()
 
-        # Post-process: extract the answer between `[output-start]` and `[output-end]` markers.
-        # This is needed because llama-cli prints UI noise (banner,
-        # spinner, stats) to stdout alongside the model's response.
-        # TODO: Replace with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged;
-        #       then also remove the markers from the prompt and the extraction below.
-        matches = re.findall(r"\[output-start\](.*?)\[output-end\]", output, re.DOTALL)
-        assert matches, (
-            f"VLM output did not contain [output-start]...[output-end] markers."
-            f" Raw output: {repr(output)}"
-        )
-        answer = matches[-1].strip()  # use last match (first may be prompt echo)
-        print("VLM answer:")
-        print(answer)
-        assert answer.upper().endswith("YES"), (
-            f"VLM did not confirm expected answer. Answer: {answer}"
-        )
+        # Post-process: extract the first JSON object that has a `bool_answer` key.
+        # This is needed because llama-cli prints UI noise (banner, stats) to stdout
+        # around the model's response, and the model may output its own decorations
+        # such as putting JSON in a Markdown code fence.
+        # `raw_decode()` ignores any trailing text after the JSON object.
+        # TODO: Simplify with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged.
+        decoder = json.JSONDecoder()
+        j = None
+        index = output.find("{")
+        while index != -1:
+            try:
+                candidate, _ = decoder.raw_decode(output, index)
+            except json.JSONDecodeError:
+                candidate = None
+            if isinstance(candidate, dict) and "bool_answer" in candidate:
+                j = candidate
+                break
+            index = output.find("{", index + 1)
+
+        # On unexpected outputs, include the raw output in the error message on stderr
+        # (it's already included on stdout above in all cases).
+        if j is None:
+            fail(f"VLM output did not contain a valid JSON object with key 'bool_answer'. Raw output: {output!r}")
+
+        bool_answer = j.get("bool_answer")
+        explanation = j.get("explanation")
+        if not (isinstance(bool_answer, bool) and isinstance(explanation, str)):
+            fail(f'VLM output JSON was not of schema {{ "bool_answer": true | false, "explanation": "..." }}. Raw output: {output!r}')
+
+        print(f"Answer: {bool_answer}")
+        print(f"Explanation: {explanation}")
+        if not bool_answer:
+            fail(f"VLM did not confirm expected answer. Answer: {bool_answer}\nExplanation: {explanation}")
 
         os.makedirs(out, exist_ok=True)
-        with open(os.path.join(out, "vlm-answer.txt"), "w") as f:
-            f.write(answer + "\n")
-        os.symlink(screenshot, os.path.join(out, "screen.png"))
+        with open(os.path.join(out, "vlm-answer.json"), "w") as f:
+            json.dump(j, f, indent=2)
+            f.write("\n")
+        # Keep the original file extension, as the screenshot is not necessarily a PNG.
+        _, screenshot_ext = os.path.splitext(screenshot)
+        os.symlink(screenshot, os.path.join(out, f"screen{screenshot_ext}"))
       '';
 in
 runCommand name { } ''

nixos/tests/web-apps/yopass.nix

@@ -0,0 +1,74 @@
+{
+  runTest,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (pkgs) lib;
+  yopassCli = lib.getExe pkgs.yopass;
+
+  yopassTest =
+    { name, backend }:
+    runTest {
+      name = "yopass-${name}";
+      meta.maintainers = with lib.maintainers; [ fraggerfox ];
+
+      nodes.machine =
+        { ... }:
+        {
+          services.memcached.enable = backend == "memcached";
+          services.redis.servers.yopass = lib.mkIf (backend == "redis") {
+            enable = true;
+            # Named instances default to port 0 (Unix socket only); yopass
+            # connects over TCP via a redis:// URL, so this needs enabling.
+            port = 6379;
+          };
+
+          services.yopass = {
+            enable = true;
+            settings.DATABASE = backend;
+            # "localhost" resolves to the IPv6 loopback first in this VM,
+            # but services.redis.servers binds 127.0.0.1 (IPv4) only by
+            # default; point at it explicitly rather than fight DNS order.
+            settings.REDIS = lib.mkIf (backend == "redis") "redis://127.0.0.1:6379/0";
+          };
+
+          # The module can't infer this itself (see the settings
+          # description) since it doesn't own the backend -- wire it here,
+          # where the actual unit name (for this *named* redis instance)
+          # is known, to avoid a startup race.
+          systemd.services.yopass.after = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+          systemd.services.yopass.requires = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+        };
+
+      testScript = ''
+        start_all()
+        machine.wait_for_unit("yopass.service")
+        machine.wait_for_open_port(1337)
+        machine.succeed("curl --fail http://localhost:1337 | grep -qi yopass")
+
+        # Round-trip a secret through the real yopass CLI (ships in the
+        # same package as yopass-server), exercising create + retrieve
+        # against the running server rather than guessing the HTTP API.
+        link = machine.succeed(
+            "printf 'hello from the nixos test' |"
+            " ${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+        ).strip()
+        machine.succeed(
+            "${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+            f" --decrypt '{link}' | grep -q 'hello from the nixos test'"
+        )
+      '';
+    };
+in
+{
+  memcached = yopassTest {
+    name = "memcached";
+    backend = "memcached";
+  };
+  redis = yopassTest {
+    name = "redis";
+    backend = "redis";
+  };
+}

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15120,6 +15120,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  pentatonic-nvim = buildVimPlugin {
+    pname = "pentatonic.nvim";
+    version = "0-unstable-2026-10-31";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "pentatonic.nvim";
+      rev = "fe3c350795baa9a7cabd1a9fa37198c6a4c30f05";
+      hash = "sha256-aahik42orj0OfyaSY43Ln14MaDosT92j8cWjUv6gyfI=";
+    };
+    meta.homepage = "https://github.com/farbzen/pentatonic.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   perfanno-nvim = buildVimPlugin {
     pname = "perfanno.nvim";
     version = "0-unstable-2026-01-20";
@@ -17433,6 +17447,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tacho-nvim = buildVimPlugin {
+    pname = "tacho.nvim";
+    version = "0.1.0";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "tacho.nvim";
+      tag = "v0.1.0";
+      hash = "sha256-lJbf9T6EsVYSadYn1aRprFgVWtwe7CEqdnCmUUE9K1M=";
+    };
+    meta.homepage = "https://github.com/farbzen/tacho.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   tagalong-vim = buildVimPlugin {
     pname = "tagalong.vim";
     version = "0.2.2-unstable-2026-09-30";

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,18 +12,18 @@
   perl,
 }:
 let
-  version = "0.4.2";
+  version = "0.4.8";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
     tag = "v${version}";
-    hash = "sha256-Xh/Y9dDur5oXJRavAxQIwRNg9/3ofAREkAxmM/0Tyks=";
+    hash = "sha256-Ss+l+ZHWPbYRkBEqJMUj3qb6eZFzb3HJsk3e2+ogvXQ=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-Mtku+MLkDdBYN5xj2x4XbyFXFZ+qTfl1eX2g9VcfpFU=";
+    cargoHash = "sha256-D+5CFU1gejqNTXG8F1Y7Dx8sTyfeLYmHAZYgAoDo+G0=";
 
     nativeBuildInputs = [
       pkg-config

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1078,6 +1078,7 @@ https://github.com/lewis6991/pckr.nvim/,,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/toppair/peek.nvim/,,
+https://github.com/farbzen/pentatonic.nvim/,,
 https://github.com/t-troebst/perfanno.nvim/,,
 https://github.com/olimorris/persisted.nvim/,,
 https://github.com/folke/persistence.nvim/,,
@@ -1243,6 +1244,7 @@ https://github.com/gcmt/taboo.vim/,,
 https://github.com/abecodes/tabout.nvim/,,
 https://github.com/Shougo/tabpagebuffer.vim/,,
 https://github.com/godlygeek/tabular/,,
+https://github.com/farbzen/tacho.nvim/,,
 https://github.com/AndrewRadev/tagalong.vim/,,
 https://github.com/preservim/tagbar/,,
 https://github.com/vim-scripts/taglist.vim/,,

pkgs/applications/emulators/kega-fusion/default.nix

@@ -1,111 +0,0 @@
-{
-  stdenv,
-  lib,
-  writeText,
-  fetchurl,
-  upx,
-  libGL,
-  libGLU,
-  glib,
-  gtk2,
-  alsa-lib,
-  libsm,
-  libx11,
-  gdk-pixbuf,
-  pango,
-  libxinerama,
-  mpg123,
-  runtimeShell,
-}:
-
-let
-  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    libGL
-    libGLU
-    glib
-    gtk2
-    alsa-lib
-    libsm
-    libx11
-    gdk-pixbuf
-    pango
-    libxinerama
-  ];
-
-in
-stdenv.mkDerivation {
-  pname = "kega-fusion";
-  version = "3.63x";
-
-  src = fetchurl {
-    url = "https://www.carpeludum.com/download/Fusion363x.tar.gz";
-    sha256 = "14s6czy20h5khyy7q95hd7k77v17ssafv9l6lafkiysvj2nmw94g";
-  };
-
-  plugins = fetchurl {
-    url = "https://www.carpeludum.com/download/PluginsLinux.tar.gz";
-    sha256 = "0d623cvh6n5ijj3wb64g93mxx2xbichsn7hj7brbb0ndw5cs70qj";
-  };
-
-  runner = writeText "kega-fusion" ''
-    #!${runtimeShell} -ex
-
-    kega_libdir="@out@/lib/kega-fusion"
-    kega_localdir="$HOME/.Kega Fusion"
-
-    # create local plugins directory if not present
-    mkdir -p "$kega_localdir/Plugins"
-
-    # create links for every included plugin
-    if [ $(ls -1A $kega_libdir/plugins | wc -l) -gt 0 ]; then
-      for i in $kega_libdir/plugins/*; do
-        if [ ! -e "$kega_localdir/Plugins/$(basename "$i")" ]; then
-          ln -sf "$i" "$kega_localdir/Plugins/"
-        fi
-      done
-    fi
-
-    # copy configuration file if not present
-    if ! [ -f "$kega_localdir/Fusion.ini" ]; then
-      cat > "$kega_localdir/Fusion.ini" <<EOF
-    ALSADeviceName=default
-    libmpg123path=${lib.getLib mpg123}/lib/libmpg123.so.0
-    EOF
-    else
-      sed -i 's,^\(libmpg123path=\).*,\1${lib.getLib mpg123}/lib/libmpg123.so.0,' "$kega_localdir/Fusion.ini"
-    fi
-
-    # here we go!
-    exec "$kega_libdir/Fusion" "$@"
-  '';
-
-  dontStrip = true;
-  dontPatchELF = true;
-
-  nativeBuildInputs = [ upx ];
-
-  installPhase = ''
-    upx -d Fusion
-    install -Dm755 Fusion "$out/lib/kega-fusion/Fusion"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${libPath}" "$out/lib/kega-fusion/Fusion"
-
-    tar -xaf $plugins
-    mkdir -p "$out/lib/kega-fusion/plugins"
-    cp -r Plugins/*.rpi "$out/lib/kega-fusion/plugins"
-
-    mkdir -p "$out/bin"
-    substitute "$runner" "$out/bin/kega-fusion" --subst-var out
-    chmod +x "$out/bin/kega-fusion"
-  '';
-
-  meta = {
-    description = "Sega SG1000, SC3000, SF7000, Master System, Game Gear, Genesis/Megadrive, SVP, Pico, SegaCD/MegaCD and 32X emulator";
-    homepage = "https://www.carpeludum.com/kega-fusion/";
-    maintainers = [ ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfreeRedistributable;
-    platforms = [ "i686-linux" ];
-    mainProgram = "kega-fusion";
-  };
-}

pkgs/applications/misc/zathura/cb/default.nix

@@ -1,18 +1,16 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
-  zathura_core,
-  girara,
-  gtk4,
-  gettext,
-  libarchive,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  libarchive,
+  girara,
+  gtk4,
   gitUpdater,
 }:
 
@@ -20,6 +18,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-cb";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-cb";
@@ -31,17 +32,15 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    gettext
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    gtk4
-    libarchive
     zathura_core
+    libarchive
     girara
+    gtk4
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/core/default.nix

@@ -4,34 +4,31 @@
   fetchFromGitHub,
   meson,
   ninja,
-  wrapGAppsHook4,
-  pkg-config,
-  gitUpdater,
-  appstream-glib,
-  json-glib,
-  desktop-file-utils,
-  python3,
-  gtk4,
-  girara,
   gettext,
+  pkg-config,
+  librsvg,
+  sphinx,
+  desktop-file-utils,
+  appstream,
+  gtk4,
+  glib,
+  girara,
+  file, # libmagic
+  json-glib,
+  sqlite,
+  xxhash,
+  texlive, # synctex
+  libseccomp,
+  xvfb-run,
+  weston,
+  wrapGAppsHook4,
+  versionCheckHook,
+  gitUpdater,
+  zathura,
   gnome,
   libheif,
   libjxl,
-  libxml2,
-  xxhash,
-  check,
-  sqlite,
-  glib,
-  texlive,
-  libintl,
-  libseccomp,
-  file,
-  librsvg,
-  gtk-mac-integration,
   webp-pixbuf-loader,
-  xvfb-run,
-  weston,
-  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -65,35 +62,33 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsysconfdir=/etc"
     (lib.mesonEnable "seccomp" stdenv.hostPlatform.isLinux)
     (lib.mesonEnable "landlock" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "tests-x11" finalAttrs.doCheck)
+    (lib.mesonEnable "tests-wayland" finalAttrs.doCheck)
   ];
 
   nativeBuildInputs = [
     meson
     ninja
-    pkg-config
-    desktop-file-utils
-    python3.pythonOnBuildForHost.pkgs.sphinx
     gettext
+    pkg-config
+    librsvg
+    sphinx
+    desktop-file-utils
+    appstream
     wrapGAppsHook4
-    libxml2
-    appstream-glib
   ];
 
   buildInputs = [
     gtk4
-    girara
-    libintl
-    sqlite
     glib
-    file
-    librsvg
-    check
+    girara
+    file # libmagic
     json-glib
-    texlive.bin.core
+    sqlite
     xxhash
+    texlive.bin.core # synctex
   ]
-  ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
-  ++ lib.optional stdenv.hostPlatform.isDarwin gtk-mac-integration;
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libseccomp ];
 
   # add support for more image formats
   env.GDK_PIXBUF_MODULE_FILE = gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
@@ -115,11 +110,22 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    updateScript = gitUpdater { };
+    tests = {
+      inherit zathura;
+    };
+  };
 
   meta = {
     homepage = "https://pwmt.org/projects/zathura";
     description = "Core component for zathura PDF viewer";
+    longDescription = ''
+      Zathura is a highly customizable and functional PDF viewer based on the
+      poppler rendering library and the GTK toolkit. The idea behind zathura
+      is an application that provides a minimalistic and space saving interface
+      as well as an easy usage that mainly focuses on keyboard interaction.
+    '';
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ mithicspirit ];

pkgs/applications/misc/zathura/djvu/default.nix

@@ -5,14 +5,12 @@
   meson,
   ninja,
   pkg-config,
-  gtk3,
-  zathura_core,
-  girara,
-  djvulibre,
-  gettext,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  cairo,
+  djvulibre, # ddjvuapi
   gitUpdater,
 }:
 
@@ -20,6 +18,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-djvu";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-djvu";
@@ -33,15 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    djvulibre
-    gettext
     zathura_core
-    gtk3
     girara
+    cairo
+    djvulibre
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/pdf-mupdf/default.nix

@@ -1,25 +1,17 @@
 {
-  stdenv,
   lib,
+  stdenv,
+  fetchFromGitHub,
   meson,
   ninja,
-  fetchFromGitHub,
-  cairo,
-  girara,
-  gtk-mac-integration,
-  gumbo,
-  jbig2dec,
-  libjpeg,
-  mupdf,
-  openjpeg,
   pkg-config,
-  zathura_core,
-  tesseract,
-  leptonica,
-  mujs,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  mupdf,
+  glib,
+  cairo,
   gitUpdater,
 }:
 
@@ -27,6 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2026.07.18";
   pname = "zathura-pdf-mupdf";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-mupdf";
@@ -40,30 +35,18 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    cairo
-    girara
-    gumbo
-    jbig2dec
-    libjpeg
-    mupdf
-    openjpeg
     zathura_core
-    tesseract
-    leptonica
-    mujs
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin gtk-mac-integration;
+    girara
+    mupdf
+    glib
+    cairo
+  ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
-  postPatch = ''
-    sed -i -e '/^mupdfthird =/d' -e 's/, mupdfthird//g' meson.build
-  '';
-
   passthru.updateScript = gitUpdater { };
 
   meta = {

pkgs/applications/misc/zathura/pdf-poppler/default.nix

@@ -1,16 +1,15 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
+  desktop-file-utils,
+  appstream,
   zathura_core,
   girara,
   poppler,
-  desktop-file-utils,
-  appstream,
-  appstream-glib,
   gitUpdater,
 }:
 
@@ -18,6 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-pdf-poppler";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-poppler";
@@ -31,13 +33,12 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
-    zathura_core
   ];
 
   buildInputs = [
-    poppler
+    zathura_core
     girara
+    poppler
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/ps/default.nix

@@ -1,17 +1,17 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
-  zathura_core,
-  girara,
-  libspectre,
-  gettext,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  glib,
+  cairo,
+  libspectre,
   gitUpdater,
 }:
 
@@ -19,6 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-ps";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-ps";
@@ -30,16 +33,16 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    gettext
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    libspectre
     zathura_core
     girara
+    glib
+    cairo
+    libspectre
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/wrapper.nix

@@ -22,6 +22,9 @@ symlinkJoin {
   inherit (zathura_core) version;
   pname = "zathura-with-plugins";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   paths =
     with zathura_core;
     [
@@ -56,20 +59,17 @@ symlinkJoin {
     '';
 
   meta = {
-    homepage = "https://pwmt.org/projects/zathura";
-    description = "Highly customizable and functional PDF viewer";
-    longDescription = ''
-      Zathura is a highly customizable and functional PDF viewer based on the
-      poppler rendering library and the GTK toolkit. The idea behind zathura
-      is an application that provides a minimalistic and space saving interface
-      as well as an easy usage that mainly focuses on keyboard interaction.
-    '';
-    license = lib.licenses.zlib;
-    platforms = lib.platforms.unix;
+    inherit (zathura_core.meta)
+      homepage
+      description
+      longDescription
+      license
+      platforms
+      mainProgram
+      ;
     maintainers = with lib.maintainers; [
       TethysSvensson
       mithicspirit
     ];
-    mainProgram = "zathura";
   };
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -54,13 +54,13 @@
     "vendorHash": "sha256-/9AxZkWEXGtlEQ+p1utMhkC5z81XOkS1SCfp4ZgPT3g="
   },
   "aminueza_minio": {
-    "hash": "sha256-57IhDRu6YrJgXl2bkCeIeRIs4702wb0z/52eJoTAp70=",
+    "hash": "sha256-f8li8rvdRd6UDDqemerI0+nH+OtDCW3stT1H/fLDnDk=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.45.0",
+    "rev": "v3.45.1",
     "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-hKSqgc+Gf0vzQuXKlErWVC/EbHatu/9oTW25PnRMyxQ="
+    "vendorHash": "sha256-ov+YA8Y9bl8oaeobh5m4ISba624h2lzlb7BtzcALIyI="
   },
   "archessmn_powerdns": {
     "hash": "sha256-gQRB8tnFHhXNId9J8947ffizIWTKEetOnc+QMnjaB48=",
@@ -227,13 +227,13 @@
     "vendorHash": "sha256-KS76AlIyquah/b/uwM4qotBgEbpGwF54gx2u6mQpJ4E="
   },
   "cloudamqp_cloudamqp": {
-    "hash": "sha256-adpGr2j0jBFW+0QxtSgTiEyxlKoBp/fw6oINxefhCl4=",
+    "hash": "sha256-Ih26RaGdJKt9jeeCegcMZWnoxUv4vrzr1Pdx84BEcFA=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.51.0",
+    "rev": "v1.52.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
+    "vendorHash": "sha256-oXzgbhm+343BuItU9J/QvsMegncG3sjNXPZbdkt9SxQ="
   },
   "cloudflare_cloudflare": {
     "hash": "sha256-9uq4ebmGmwxOj5tTLgxapEbTvWjjByUNAIHLfcZfREA=",
@@ -310,11 +310,11 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-Sv/mzOMSerwMFiBFFcj+4bVaJvpAbHVj/MXXclhYpHA=",
+    "hash": "sha256-mWHyJtKODTnBcWCA0PKt6Dd7AJdyxONoVdA/ET63yrk=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v4.26.0",
+    "rev": "v4.27.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-dTbDKR03Inol1G4okCNDso5tZ45BEiUmkXOAmIrRcX0="
   },
@@ -391,13 +391,13 @@
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
   "drfaust92_bitbucket": {
-    "hash": "sha256-m5Ya99ulMesUwl54sbHuvOYumbPcAhWMESVGbXIOJpE=",
+    "hash": "sha256-5clib4KME7L/wk5ptrKLXiY1/NZ9/+cajrHwNMkD00I=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.52.0",
+    "rev": "v2.54.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uokHd4hDvWl6mrBa062F/uZmYPnW3TIZZKZwKBVq+Lo="
+    "vendorHash": "sha256-gUKREx3NORuYAFqR/hUCuU1OXQw5NYn2LzcpeunEagE="
   },
   "e-breuninger_netbox": {
     "hash": "sha256-tbBCGOcbDhiOjdgyS9lSw6IbMgzZwnbM40/InvhUKCA=",
@@ -706,13 +706,13 @@
     "vendorHash": "sha256-t20uPPaKr43Al7ExOPD+cw1hVwaVwxljHHR0tVPmrYw="
   },
   "hashicorp_tls": {
-    "hash": "sha256-4XHSPKszjMjt62fYDsgB+/43AY6Ixk8nTGUQBShcNgA=",
+    "hash": "sha256-PhRtfxTJ9pKfGilXlWkYi2rr9T5jTQySCT1l0ySAGhI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tls",
     "owner": "hashicorp",
     "repo": "terraform-provider-tls",
-    "rev": "v4.4.1",
+    "rev": "v4.4.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QuRWNrwfBOk9V5IrvSaT5Qtl98HjBJvSX/0BmZiYTh4="
+    "vendorHash": "sha256-4iv5WwD1qX7Hq/JLNkFrouAVC3dQ75glJhvVz74CN7E="
   },
   "hashicorp_vault": {
     "hash": "sha256-Bd9ZALCqHcM4cn1knLXLyD3fpnBlw992xFeZCCREqk8=",
@@ -733,22 +733,22 @@
     "vendorHash": "sha256-47xWjlzpQ/EYzjbuuMKQiu5cfYAXdYkXRl+AOEP+sA4="
   },
   "heroku_heroku": {
-    "hash": "sha256-FnJn/kFnTOOcnJtVdlSFpZh9S+BZodhk6IcvG0DFaLg=",
+    "hash": "sha256-KipVqV1OT5tINSuNbbGzt6JaKVsc9pSkQhUCo3KspCs=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.4.1",
+    "rev": "v5.4.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "hetznercloud_hcloud": {
-    "hash": "sha256-bK6oSiNa6W04IqsWYfgntpyTn1C/k1TpD+vmPWlsDFA=",
+    "hash": "sha256-aniX/TEZyZLE3F5hHWnlp2S+gbvVaNbf2QTcYgkutg8=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.70.0",
+    "rev": "v1.70.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PVoHdzP8gtGobxDyB9g5Zi7pNoATgeQFrPEWki2y8TE="
+    "vendorHash": "sha256-BpcXnBC8Li53taP3dt9AlwivQ5nMSaUSgzVj365Lzz8="
   },
   "huaweicloud_huaweicloud": {
     "hash": "sha256-e9osIGnur2QtVByW4X93X4pqPxhbqNUPn8CSIZAo6Vk=",
@@ -1445,11 +1445,11 @@
     "vendorHash": "sha256-6ivj3olSo9t75jVnow2GvzVGE5JeVtTjWxYDirvSyFc="
   },
   "trozz_pocketid": {
-    "hash": "sha256-jRjM8uMpa5FBRqAJY8eM+Sjo72E1et/HyIGEIoK/rXg=",
+    "hash": "sha256-JZAUncvrj42sArGYQP2CSGxU48IBIsrgbzTl8BbrqB4=",
     "homepage": "https://registry.terraform.io/providers/Trozz/pocketid",
     "owner": "Trozz",
     "repo": "terraform-provider-pocketid",
-    "rev": "v2.4.2",
+    "rev": "v2.5.0",
     "spdx": "MIT",
     "vendorHash": "sha256-Xro8lh5wNsAyYQrM8zIbzcPPTIGE1x99jA3ZMXZXwyk="
   },

pkgs/applications/virtualization/singularity/generic.nix

@@ -306,6 +306,10 @@ in
               hello
               cowsay
             ];
+            # mksquashfs scales its memory requirement with the number of
+            # processors (all host CPUs by default). Give the build VM enough
+            # memory to cope with high core-count builders.
+            memSize = 4096;
             singularity = finalAttrs.finalPackage;
           };
         };

pkgs/applications/virtualization/singularity/packages.nix

@@ -9,14 +9,14 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.5.4";
+        version = "1.5.5";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           tag = "v${version}";
-          hash = "sha256-ru0dAuR6Q6NoYnLtEGm9/SiXPk6u1Lw3dcckkuqB7Cs=";
+          hash = "sha256-oV1LzCBYbMFbKGhli6eCbpMoyB1KeccnaEi+xHJ431g=";
         };
 
         # Override vendorHash with overrideAttrs.

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix

@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hy3";
-  version = "0.56.0.1";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "outfoxxed";
     repo = "hy3";
     tag = "hl${finalAttrs.version}";
-    hash = "sha256-iK0vERuy5aXisDXm/bzcJP0dgaIot5MLPoVG62DjqO4=";
+    hash = "sha256-9qAw3Xsa0xN9b5ERiWEGL1fBq37GLskcrBj/6ax8PU4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ag/agent-browser/package.nix

@@ -18,18 +18,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "agent-browser";
-  version = "0.39.1";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "agent-browser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WIg6WAnk3728NrZVh8JYtu2iRoHi8lYT2e5CDgOg2Sc=";
+    hash = "sha256-siJ37qavluO6psfgaNTFkOSmL5f+PATFlPNWS7PXF6U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cli";
 
-  cargoHash = "sha256-f+7fTDs/irnf/6jCmSlSKaIaVAuqmTvjhW/vBT5gBKM=";
+  cargoHash = "sha256-YMLJ6ykf4IQNDjCNP3E6E5Rj+gLYe9INysbnVFaeqQA=";
 
   # Place the pre-built dashboard where RustEmbed expects it
   postUnpack = ''

pkgs/by-name/an/android-file-transfer/darwin-dont-vendor-dependencies.patch

@@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 574b354..1a62874 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -254,16 +254,6 @@ endif()
+ 
+ if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+ 	set(MACOSX_BUNDLE_LIBS)
+-	if (OPENSSL_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/opt/openssl@1.1/lib/libcrypto.1.1.dylib)
+-	endif()
+-	if (TAGLIB_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/opt/taglib/lib/libtag.2.dylib)
+-	endif()
+-	if (FUSE_FOUND)
+-		list(APPEND MACOSX_BUNDLE_LIBS /usr/local/lib/libosxfuse.2.dylib)
+-	endif()
+-
+ 	set(MACOSX_BUNDLE_LIBS_INSTALL)
+ 	set(MACOSX_BUNDLE_ROOT_DIR "${CMAKE_INSTALL_PREFIX}/${CMAKE_PROJECT_NAME}.app")
+ 	message(STATUS "bundle root dir: ${MACOSX_BUNDLE_ROOT_DIR}")

pkgs/by-name/an/android-file-transfer/package.nix

@@ -20,12 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Ogq8aTOZvZTfceJuQ1vSjl5Lm5Ww/8jTUZwcXkDDaxI=";
   };
 
+  patches = [ ./darwin-dont-vendor-dependencies.patch ];
+
   nativeBuildInputs = [
     cmake
     readline
     pkg-config
     qt6.wrapQtAppsHook
   ];
+
   buildInputs = [
     fuse3
     qt6.qtbase
@@ -41,7 +44,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Reliable MTP client with minimalistic UI";
     homepage = "https://whoozle.github.io/android-file-transfer-linux/";
     license = lib.licenses.lgpl21Plus;
-    maintainers = [ lib.maintainers.xaverdh ];
+    maintainers = with lib.maintainers; [
+      azuwis
+      xaverdh
+    ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/an/antares/package.nix

@@ -3,7 +3,7 @@
   lib,
   buildNpmPackage,
   electron,
-  nodejs_22,
+  nodejs_26,
   makeDesktopItem,
   copyDesktopItems,
   icoutils,
@@ -21,22 +21,22 @@ buildNpmPackage rec {
     hash = "sha256-A/ievIKXfFGu90aijxhmEWvfg2RqDtd7AtU+iyma3lU=";
   };
 
-  npmDepsHash = "sha256-X2dG75fpeXeU40wb22KAI7tDBybFwWUpKVj0Mlo3xhc=";
+  npmDepsHash = "sha256-fx/qwz3znXkLi81VLW2tB7TAZGO4M1dkzjzKcj3M4NA=";
 
   patches = [
     # Since version 0.7.28, package-lock is not updated properly so this patch update it to be able to build the package
     # This patch will probably be removed in the next version
     # If it does not build without it, you just need to do a npm update in the antares project and copy the patch
-    # https://github.com/antares-sql/antares/pull/1005
+    # https://github.com/antares-sql/antares/pull/1050
     (fetchpatch2 {
-      url = "https://github.com/antares-sql/antares/commit/6b2a45d93cf7fefdc92e0d87f390cd21a069b9a4.patch?full_index=1";
-      hash = "sha256-2dOGY0K6jMxSLNLDhwy/+ysTRB24XRXSoDu1AVxi4w4=";
+      url = "https://github.com/antares-sql/antares/commit/8fda56b28892dbaab2cbab0fee2db096bc4930c4.patch?full_index=1";
+      hash = "sha256-uDOEcakBuhbznb7eonJW2NC8QQX4HYR+6+Xa3TO6kFU=";
     })
   ];
 
-  nodejs = nodejs_22;
+  nodejs = nodejs_26;
 
-  buildInputs = [ nodejs_22 ];
+  buildInputs = [ nodejs_26 ];
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -44,6 +44,7 @@ buildNpmPackage rec {
   ];
 
   npmBuildScript = "compile";
+  npmRebuildFlags = [ "--ignore-scripts" ];
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ap/apngopt/package.nix

@@ -32,9 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
     zopfli
   ];
 
-  preBuild = ''
-    buildFlagsArray+=("LIBS=-lzopfli -lstdc++ -lpng -lz")
-  '';
+  strictDeps = true;
+
+  buildFlags = [
+    "LIBS=-lzopfli -lstdc++ -lpng -lz"
+  ];
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}c++" ];
 
@@ -44,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://sourceforge.net/projects/apng/";
     description = "Optimizes APNG animations";

pkgs/by-name/bc/bcftools/package.nix

@@ -10,18 +10,18 @@
   curl,
   perl,
   python3,
-  bash,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcftools";
-  version = "1.22";
+  version = "1.24";
 
   src = fetchFromGitHub {
     owner = "samtools";
     repo = "bcftools";
     tag = finalAttrs.version;
-    hash = "sha256-S+FuqjiOf38sAQKWYOixv/MlXGnuDmkx9z4Co/pk/eM=";
+    hash = "sha256-ZwlrnfCUwrBpS1CfwPtw1To94ygbK4qoGeiuhkDPm2Q=";
   };
 
   nativeBuildInputs = [
@@ -53,17 +53,19 @@ stdenv.mkDerivation (finalAttrs: {
   preCheck = ''
     patchShebangs misc/
     patchShebangs test/
-    sed -i -e 's|/bin/bash|${bash}/bin/bash|' test/test.pl
   '';
 
   enableParallelBuilding = true;
 
   doCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tools for manipulating BCF2/VCF/gVCF format, SNP and short indel sequence variants";
     license = lib.licenses.mit;
-    homepage = "http://www.htslib.org/";
+    homepage = "https://www.htslib.org/";
+    changelog = "https://github.com/samtools/bcftools/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.mimame ];
   };

pkgs/by-name/be/beads/package.nix

@@ -15,16 +15,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "beads";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "gastownhall";
     repo = "beads";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k3WUy0FWPoO7Ymu+FFgS2yYZ4u10Fb7mPBYqs17IP2U=";
+    hash = "sha256-f36v59+mSjI0SkwmUditpZwob0tqNosKUrRywEXxUQw=";
   };
 
-  vendorHash = "sha256-mnQo3S7JLrx0nY5EIP3qQVqWLTlisYhjJFzqgPD/xu8=";
+  vendorHash = "sha256-akJBtvchASCHKCmzuD77n6WKD/jLN1n01WyyCXXR2xY=";
 
   subPackages = [ "cmd/bd" ];
 

pkgs/by-name/bl/bloop/sources.json

@@ -1,6 +1,6 @@
 {
   "repo": "scalacenter/bloop",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "completions": {
     "bash": {
       "asset": "bash-completions",
@@ -18,11 +18,11 @@
   "assets": {
     "aarch64-darwin": {
       "asset": "bloop-aarch64-apple-darwin",
-      "hash": "sha256-Y3jY50vaJufHNUm4msSbJRrtLT2eB9fSlrwfm8qjem0="
+      "hash": "sha256-WtTWaErgffqT3aDI8YFRyLpZufflvUSPN0+Z6LNZ5AI="
     },
     "x86_64-linux": {
       "asset": "bloop-x86_64-pc-linux",
-      "hash": "sha256-p9bUqeCMxH1A9JAyObTgPagcJAE4HMDhZFtQQLEjWXE="
+      "hash": "sha256-Dchau/s2v0x/W4qO8HscsGe7ipwWatZaLzJFCyakteI="
     }
   }
 }

pkgs/by-name/bs/bs-manager/package.nix

@@ -8,7 +8,6 @@
   fetchNpmDeps,
   fetchFromGitHub,
   makeDesktopItem,
-  nodejs_22,
 
   autoPatchelfHook,
   copyDesktopItems,

pkgs/by-name/bt/btcpayserver/deps.json

@@ -61,13 +61,13 @@
   },
   {
     "pname": "BTCPayServer.Lightning.All",
-    "version": "1.7.13",
-    "hash": "sha256-038ETMvX3jSa6wea9tRuh6VNN2jGSx/JCWC1TXLWnk0="
+    "version": "1.7.14",
+    "hash": "sha256-dC4hz5tWCY1ilCxZBIZ8Lc3+JnD9fsV9/PJ9vxGONn4="
   },
   {
     "pname": "BTCPayServer.Lightning.CLightning",
-    "version": "1.7.9",
-    "hash": "sha256-QQjiWnNADGwsojtxFtgDUUJk71dSE6YzdS3z1d6qKZU="
+    "version": "1.7.10",
+    "hash": "sha256-KgQvei3S/xtLCQyEhLD3lQcg3d7gTrDcbutWT4oaTK0="
   },
   {
     "pname": "BTCPayServer.Lightning.Common",
@@ -76,28 +76,28 @@
   },
   {
     "pname": "BTCPayServer.Lightning.Common",
-    "version": "1.7.4",
-    "hash": "sha256-UMl/vAz6fYqZvXtwBdvkNPNZW0OrsU2XA1EXEaY/EFk="
+    "version": "1.7.5",
+    "hash": "sha256-qifQW9sAjNJNm44UBqNZydNLdZjUB5+dq/Eax75QVj8="
   },
   {
     "pname": "BTCPayServer.Lightning.Eclair",
-    "version": "1.7.4",
-    "hash": "sha256-D9ATUxibK+4YCw50+Pg+llkmddXAFuMhqGHNa7UvLI8="
+    "version": "1.7.5",
+    "hash": "sha256-XXXIElZQE25cx/R3Ah0HRidht+Xv2cXoXe1a0SUK79A="
   },
   {
     "pname": "BTCPayServer.Lightning.LND",
-    "version": "1.7.5",
-    "hash": "sha256-jTO2hjmUg6cBnCf6C9ESHyHXOMv7cHART9DtMpZ9oEw="
+    "version": "1.7.6",
+    "hash": "sha256-bD7IisjjoKp5SWlL34YxIIra0Oz/+7nBQxbjJ4ASW6w="
   },
   {
     "pname": "BTCPayServer.Lightning.LNDhub",
-    "version": "1.7.6",
-    "hash": "sha256-+am0ud+oezteBCAMHZq4slBpGze3OKbyO49a5t++IDk="
+    "version": "1.7.7",
+    "hash": "sha256-uh96Og/8kAhy1+PzIDLEnAUNuQjEK18aToF3U+cWbSE="
   },
   {
     "pname": "BTCPayServer.Lightning.Phoenixd",
-    "version": "1.7.5",
-    "hash": "sha256-Cy7H/CdatCnmN6HrOHR7cUy9zm2Jlunnn7TJewHaJxk="
+    "version": "1.7.6",
+    "hash": "sha256-xvCose2jPfb48Bw3JpUQY13sRNj+VFo7kFQb0pg+bzo="
   },
   {
     "pname": "BTCPayServer.NTag424",
@@ -516,13 +516,13 @@
   },
   {
     "pname": "NBitcoin",
-    "version": "10.0.11",
-    "hash": "sha256-LvZLfW3MMr/eq5uN4SSWHDVdSysVH3N8XAutZeDeeoo="
+    "version": "10.0.17",
+    "hash": "sha256-aUmn6R+diAhVFAA/cmuBIxI++tYPrsX7q4lEei6ikoI="
   },
   {
     "pname": "NBitcoin",
-    "version": "10.0.17",
-    "hash": "sha256-aUmn6R+diAhVFAA/cmuBIxI++tYPrsX7q4lEei6ikoI="
+    "version": "10.0.19",
+    "hash": "sha256-OlwtlVGwzmB5eU/VXfPBeYkg+a2KEvbd3ATTE3UUOls="
   },
   {
     "pname": "NBitcoin.Altcoins",

pkgs/by-name/bt/btcpayserver/package.nix

@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "btcpayserver";
     repo = "btcpayserver";
     tag = "v${version}";
-    hash = "sha256-bH6VPue4P+XUGFaaBBChdc8lSHFjsGBIfNw4fznE72A=";
+    hash = "sha256-8yVWNpxwXE4yDBX0aN2OgJkrJGBfKgj75pFletRtL7E=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/by-name/cl/cli11/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cli11";
-  version = "2.6.2";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "CLIUtils";
     repo = "CLI11";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TcOmx/qUK/w3mO0bDHX+TRxxMwJpaDFQBcpkQj3hz8A=";
+    hash = "sha256-lFMv7WH/Gv+lRjs9tH6QYk+E/QC39ndzvtYKwpGNkmg=";
   };
 
   buildInputs = [ catch2 ];

pkgs/by-name/co/cocoon/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cocoon";
-  version = "0.13.2";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "haileyok";
     repo = "cocoon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lvRqf2BeP/ul6axI6oQ19ucQ+Hn2YUN1swB1o3t909U=";
+    hash = "sha256-pvbEXY/ps+XB/Peq3+R76D2zd06Y33W1xzrnDiXiqxI=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-Dxbilj8A67jjOWqqkv4B1iekQ2oUg+5oVjP1ta4YOk0=";
+  vendorHash = "sha256-2MF2rB+7DSjaF1bmyC2TcNaHFLaBOk6BIBFVDevPnDA=";
 
   passthru = {
     tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux { inherit (nixosTests) cocoon; };

pkgs/by-name/dr/drone-scp/package.nix

@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "drone-scp";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "appleboy";
     repo = "drone-scp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Wh2DCy0JIPjKahJpAXKGdhvNEtk24BNRTdza9etA888=";
+    hash = "sha256-wfpJXGF+bSXdQzRY13idWO8mU6SYYubtH7GtUKZzfME=";
   };
 
-  vendorHash = "sha256-GJwNG2vN/Vw0d3ecR8dMUdMp4P9Sh/WZ9C78AmJWezU=";
+  vendorHash = "sha256-BVY6USDRSrfvozW4qmbcVW/MZuUp7Xf0sI3K90v2bRw=";
 
   # Needs a specific user...
   doCheck = false;

pkgs/by-name/dw/dwarf-fortress/package.nix

@@ -0,0 +1,8 @@
+{
+  dwarf-fortress-packages,
+  ...
+}@args:
+
+# The latest Dwarf Fortress with the default wrapper; see default.nix.
+# Override arguments are passed on to the wrapper.
+dwarf-fortress-packages.dwarf-fortress.override (removeAttrs args [ "dwarf-fortress-packages" ])

pkgs/by-name/dw/dwarf-fortress/unfuck.nix

@@ -82,7 +82,8 @@ stdenv.mkDerivation {
     sed -i "1i #include <cstdint>" g_src/files.h
   '';
 
-  cmakeFlags = [
+  # Only needed to find GTK 2, see below.
+  cmakeFlags = lib.optionals (versionOlder release.unfuckRelease "0.47.05") [
     "-DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include"
     "-DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include"
   ];

pkgs/by-name/ei/eigenwallet/package.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eigenwallet";
-  version = "4.13.3";
+  version = "4.16.1";
 
   src = fetchurl {
     url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-nVrl3XY6fN8lA/RUL2P/NzMaOdPUIFxsEYbROk7keTA=";
+    hash = "sha256-Hw7hlu+4S6V/3KD+c9yeV3u4SsEX4haLaBXk7u3uiws=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/et/etcd_3_6/package.nix

@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "3.6.15";
-  etcdSrcHash = "sha256-rnipUdLe5cZNouEuk86Wl8GDav3pk3stuGYj1ZTjy90=";
-  etcdCtlVendorHash = "sha256-2rWlwRaZ00iZqE2IHQtICmVVN6DvRNPYtnmqSS8fU0E=";
-  etcdUtlVendorHash = "sha256-bhnYxDB8xB7As938IVlvHAViqxlLKIDjye17VD5tPiQ=";
-  etcdServerVendorHash = "sha256-p0ka3KRlfaQmK3UPwjNICdtqjixgvs1oTQWxY0pOrq8=";
+  version = "3.6.16";
+  etcdSrcHash = "sha256-lqVsJOGYqqb+wlogNV2T7c/RHA7G90ubM1TR2mVRlx4=";
+  etcdCtlVendorHash = "sha256-ZRXJmyPVgEMa3xSZsJhRR7Hoz26bR9zO3bQeoGE4e4o=";
+  etcdUtlVendorHash = "sha256-JhzFZ60y8cxydrx0Y9EnTDDBjlgq49Y+WL2WhAvJqvU=";
+  etcdServerVendorHash = "sha256-2a+c3MusUy9kdFNcj3LXWwK9yVwumjeAabLeRDAqsBc=";
 
   src = fetchFromGitHub {
     owner = "etcd-io";

pkgs/by-name/fa/factorio/versions.json

@@ -15,15 +15,15 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux-arm64_2.1.23.tar.xz",
-          "factorio_linux-arm64_2.1.23.tar.xz"
+          "factorio_linux-arm64_2.1.24.tar.xz",
+          "factorio_linux-arm64_2.1.24.tar.xz"
         ],
-        "name": "factorio_alpha_arm64-2.1.23.tar.xz",
+        "name": "factorio_alpha_arm64-2.1.24.tar.xz",
         "needsAuth": true,
-        "sha256": "c49989f77e2cf5bd53c5b501f3024440e0a8d507ee88aa03feb2365502b58112",
+        "sha256": "36b9d9dc985c49d9216b365559dc83074558473573f98b6d57f0dee7096f2609",
         "tarDirectory": "arm64",
-        "url": "https://factorio.com/get-download/2.1.23/alpha/linux-arm64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/alpha/linux-arm64",
+        "version": "2.1.24"
       }
     },
     "demo": {
@@ -67,15 +67,15 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux-arm64_2.1.23.tar.xz",
-          "factorio-space-age_linux-arm64_2.1.23.tar.xz"
+          "factorio-space-age_linux-arm64_2.1.24.tar.xz",
+          "factorio-space-age_linux-arm64_2.1.24.tar.xz"
         ],
-        "name": "factorio_expansion_arm64-2.1.23.tar.xz",
+        "name": "factorio_expansion_arm64-2.1.24.tar.xz",
         "needsAuth": true,
-        "sha256": "1bcf981cd4db5fbc45858e11d50c9303648c1319f56ababd2ceee47bbd4a9ba8",
+        "sha256": "ea7f491d8616548bb71f6b58d4d254f7cd3582c6dee7c8eb67509e0c69ff6163",
         "tarDirectory": "arm64",
-        "url": "https://factorio.com/get-download/2.1.23/expansion/linux-arm64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/expansion/linux-arm64",
+        "version": "2.1.24"
       }
     },
     "headless": {
@@ -94,16 +94,16 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux-arm64_2.1.23.tar.xz",
-          "factorio-headless_linux-arm64_2.1.23.tar.xz",
-          "factorio_headless_arm64_2.1.23.tar.xz"
+          "factorio-headless_linux-arm64_2.1.24.tar.xz",
+          "factorio-headless_linux-arm64_2.1.24.tar.xz",
+          "factorio_headless_arm64_2.1.24.tar.xz"
         ],
-        "name": "factorio_headless_arm64-2.1.23.tar.xz",
+        "name": "factorio_headless_arm64-2.1.24.tar.xz",
         "needsAuth": false,
-        "sha256": "bf130c30eedbacc0d52ff7c4ef3c9a40c25159736cf5f934d2ef3857ed0c251a",
+        "sha256": "141bd7aaa199fcf7e223dcaca8877aec1d6deaa9c4ac03b7a8c60ef37b6afb98",
         "tarDirectory": "arm64",
-        "url": "https://factorio.com/get-download/2.1.23/headless/linux-arm64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/headless/linux-arm64",
+        "version": "2.1.24"
       }
     }
   },
@@ -123,15 +123,15 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux64_2.1.23.tar.xz",
-          "factorio_linux_2.1.23.tar.xz"
+          "factorio_linux64_2.1.24.tar.xz",
+          "factorio_linux_2.1.24.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.1.23.tar.xz",
+        "name": "factorio_alpha_x64-2.1.24.tar.xz",
         "needsAuth": true,
-        "sha256": "d49505f6c5ac7ea3a1bac80a9bce2d6926bbd580db42733596413451192a5e18",
+        "sha256": "8a2ed610d1fb6c0f424edce727621dd00598f65cc6d2008ee7b7513deb025611",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.23/alpha/linux64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/alpha/linux64",
+        "version": "2.1.24"
       }
     },
     "demo": {
@@ -175,15 +175,15 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux64_2.1.23.tar.xz",
-          "factorio-space-age_linux_2.1.23.tar.xz"
+          "factorio-space-age_linux64_2.1.24.tar.xz",
+          "factorio-space-age_linux_2.1.24.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.1.23.tar.xz",
+        "name": "factorio_expansion_x64-2.1.24.tar.xz",
         "needsAuth": true,
-        "sha256": "158cc3888e00d833a8ff402b045067fa3adbbd0b7b2b46a195f3ff901b79279b",
+        "sha256": "ea48adef5fc9367c8c48cedb5d4e19b1e077d596193d5758e47145c6d4b4b7f7",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.23/expansion/linux64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/expansion/linux64",
+        "version": "2.1.24"
       }
     },
     "headless": {
@@ -202,17 +202,17 @@
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux64_2.1.23.tar.xz",
-          "factorio-headless_linux_2.1.23.tar.xz",
-          "factorio_headless_x64_2.1.23.tar.xz"
+          "factorio-headless_linux64_2.1.24.tar.xz",
+          "factorio-headless_linux_2.1.24.tar.xz",
+          "factorio_headless_x64_2.1.24.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.1.23.tar.xz",
+        "name": "factorio_headless_x64-2.1.24.tar.xz",
         "needsAuth": false,
-        "sha256": "4633250f7747676279fb210a1717ba34caed6b9890c951fb3e469eefe43c46b9",
+        "sha256": "c49b66cff90aceff87b30f2973af0df7f51712cb2ee3153e0169d9bed46a964f",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.23/headless/linux64",
-        "version": "2.1.23"
+        "url": "https://factorio.com/get-download/2.1.24/headless/linux64",
+        "version": "2.1.24"
       }
     }
   }
-}
+}

pkgs/by-name/fb/fbc/package.nix

@@ -13,13 +13,13 @@
   ncurses,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fbc";
   version = "1.10.1";
 
   src = fetchzip {
     # Bootstrap tarball has sources pretranslated from FreeBASIC to C
-    url = "https://github.com/freebasic/fbc/releases/download/${version}/FreeBASIC-${version}-source-bootstrap.tar.xz";
+    url = "https://github.com/freebasic/fbc/releases/download/${finalAttrs.version}/FreeBASIC-${finalAttrs.version}-source-bootstrap.tar.xz";
     hash = "sha256-LBROv3m1DrEfSStMbNuLC+fldYNfSS+D09bJyNMNPP0=";
   };
 
@@ -48,6 +48,8 @@ stdenv.mkDerivation rec {
     libxrandr
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   hardeningDisable = [
@@ -91,7 +93,7 @@ stdenv.mkDerivation rec {
     make clean
 
     echo Compile patched host everything with previous patched stage
-    buildFlagsArray+=("FBC=$PWD/patched-fbc/bin/fbc${stdenv.buildPlatform.extensions.executable} -i $PWD/inc")
+    buildFlags+=("FBC=$PWD/patched-fbc/bin/fbc${stdenv.buildPlatform.extensions.executable} -i $PWD/inc")
   '';
 
   installFlags = [
@@ -121,12 +123,14 @@ stdenv.mkDerivation rec {
 
     # Run check targets in series, else the logs are a mess
     for target in $checkTarget; do
-      make $target -j$checkJobs $makeFlags $checkFlags
+      make $target -j$checkJobs "''${makeFlags[@]}" "''${checkFlags[@]}"
     done
 
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.freebasic.net/";
     description = "Multi-platform BASIC Compiler";
@@ -141,4 +145,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ OPNA2608 ];
     platforms = with lib.platforms; windows ++ linux;
   };
-}
+})

pkgs/by-name/fi/fiddler-everywhere/package.nix

@@ -8,10 +8,10 @@
 
 appimageTools.wrapType2 (finalAttrs: {
   pname = "fiddler-everywhere";
-  version = "8.2.0";
+  version = "8.3.0";
   src = fetchurl {
     url = "https://downloads.getfiddler.com/linux/fiddler-everywhere-${finalAttrs.version}.AppImage";
-    hash = "sha256-cP9DEnDUj0m3DJ71ASe3b3AH7ljUHOdw4bkQrHkey6I=";
+    hash = "sha256-XDErnmHKpJjZCKffLRUhlJPg/4y+8b+BfmYySRFf6M8=";
   };
 
   extraPkgs = pkgs: [ pkgs.icu ];

pkgs/by-name/fi/findent/package.nix

@@ -20,8 +20,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  checkTargets = [ "installcheck" ];
-
   meta = {
     description = "Fortran source code formatter";
     homepage = "https://sourceforge.net/projects/findent/";

pkgs/by-name/fl/flatpak-builder-tools/package.nix

@@ -7,12 +7,12 @@
   enableDeno ? false,
 }:
 let
-  version = "0-unstable-2026-09-30";
+  version = "0-unstable-2026-10-25";
   src = fetchFromGitHub {
     owner = "flatpak";
     repo = "flatpak-builder-tools";
-    rev = "74697c75b630d7330e77250fc13cb5ea688d9479";
-    hash = "sha256-yr6RTFN/ypqLPzagrjljnY9dhrin+bfbgzhsz3RY9ps=";
+    rev = "9d86d336a39b9af38b86f114b6ce5820fe260f91";
+    hash = "sha256-gKxnXQGICrWMkf3ZtiW694tMTichvdYx9x53P/wkZvE=";
   };
 in
 buildEnv {

pkgs/by-name/fl/flexget/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.22.6";
+  version = "3.22.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N5v65twL83JEPY3BocgPpjSiREjyTq77PohSB8OFC/U=";
+    hash = "sha256-xNNkwqocpg1NrQR3BSbYU3KWUejSYDSTpxFUlx7xh08=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/fl/floorp-bin-unwrapped/sources.json

@@ -1,17 +1,17 @@
 {
-  "version": "12.20.2",
+  "version": "12.21.0",
   "sources": {
     "aarch64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.20.2/floorp-linux-aarch64.tar.xz",
-      "sha256": "3521183a928c7e2a43577e1cccb9fc70c71c90ed7538221e1f4435e051d00d22"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.21.0/floorp-linux-aarch64.tar.xz",
+      "sha256": "3caa49bff3f1d3dc3ad724d6c69c0ee7b6060de5b5b26904a8e02b41c0d9df3b"
     },
     "x86_64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.20.2/floorp-linux-x86_64.tar.xz",
-      "sha256": "059a85f0e40c9f3649ae61fe716ecbdde85f06971a600aeec5c3e8f3a0af6004"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.21.0/floorp-linux-x86_64.tar.xz",
+      "sha256": "e3ff309b319ec50556c1d9cd4638fc443524160ac95c36febad4a359d3ffbcd4"
     },
     "aarch64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.20.2/floorp-macOS-universal.dmg",
-      "sha256": "f45684a19cd787cc78e151fc6d60fbc9605b3526a7f272fa1d2c896905824674"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.21.0/floorp-macOS-universal.dmg",
+      "sha256": "3bad837dbec78b2a247754f6f65b65ad49ced17774e93447908670ad8767be36"
     }
   }
 }

pkgs/by-name/fl/flyspray/package.nix

@@ -56,7 +56,10 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p "$DIR"
     cp -Tr "$src" "$DIR"
 
-    chmod u+w "$DIR/vendor/guzzle/guzzle/src/Guzzle/Http/Resources"
+    chmod -R u+w "$DIR"
+    # rm directories where content is generated at runtime
+    rm -rf "$DIR/cache" "$DIR/attachments" "$DIR/avatars"
+    # replace bundled cacerts
     rm "$DIR/vendor/guzzle/guzzle/src/Guzzle/Http/Resources/cacert.pem"
     ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt \
       "$DIR/vendor/guzzle/guzzle/src/Guzzle/Http/Resources/cacert.pem"

pkgs/by-name/fr/frigate/package.nix

@@ -34,6 +34,13 @@ let
 
           # Account for divergences with the main `tokenizers` derivation:
           postPatch = "";
+          # datasets>=5 is incompatible with huggingface-hub_0
+          nativeCheckInputs = builtins.filter (p: (p.pname or "") != "datasets") oldAttrs.nativeCheckInputs;
+          disabledTestPaths = [
+            # ModuleNotFoundError: No module named 'datasets'
+            "benches/test_tiktoken.py"
+            "tests/documentation/test_tutorial_train_from_iterators.py"
+          ];
           disabledTests = [
             # PermissionError: [Errno 13] Permission denied: 'tests/data/small.txt'
             "TestUnigram"

pkgs/by-name/gi/gif2apng/package.nix

@@ -46,9 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
     zopfli
   ];
 
-  preBuild = ''
-    buildFlagsArray+=("LIBS=-lzopfli -lstdc++ -lz")
-  '';
+  strictDeps = true;
+
+  buildFlags = [ "LIBS=-lzopfli -lstdc++ -lz" ];
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}c++" ];
 
@@ -60,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://gif2apng.sourceforge.net/";
     description = "Simple program that converts animations from GIF to APNG format";

pkgs/by-name/gi/girara/package.nix

@@ -5,23 +5,18 @@
   meson,
   ninja,
   pkg-config,
-  check,
-  dbus,
-  xvfb-run,
   glib,
-  gtk3,
-  gettext,
-  libiconv,
-  json-glib,
-  libintl,
-  zathura,
   gitUpdater,
+  zathura,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "girara";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   outputs = [
     "out"
     "dev"
@@ -38,25 +33,10 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    gettext
-    check
-    dbus
-    glib # for glib-compile-resources
   ];
 
   buildInputs = [
-    libintl
-    libiconv
-    json-glib
-  ];
-
-  propagatedBuildInputs = [
     glib
-    gtk3
-  ];
-
-  nativeCheckInputs = [
-    xvfb-run
   ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;
@@ -65,13 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Ddocs=disabled" # docs do not seem to be installed
   ];
 
-  checkPhase = ''
-    export NO_AT_BRIDGE=1
-    xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
-      --config-file=${dbus}/share/dbus-1/session.conf \
-      meson test --print-errorlogs
-  '';
-
   passthru = {
     updateScript = gitUpdater { };
     tests = {
@@ -87,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
       that focuses on simplicity and minimalism.
     '';
     license = lib.licenses.zlib;
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = [ ];
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ mithicspirit ];
   };
 })

pkgs/by-name/gi/gitea/package.nix

@@ -53,7 +53,7 @@ let
 in
 buildGo127Module (finalAttrs: {
   pname = "gitea";
-  version = "28.2.0";
+  version = "28.3.0";
 
   outputs = [
     "out"
@@ -64,12 +64,12 @@ buildGo127Module (finalAttrs: {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gCS27gw/zNYVlcbwBiAtqM5JGVOTzbk3LoTd+p+EzKM=";
+    hash = "sha256-y+sawjuhvZn9HBnrfzXtdBwH3i3oXQBYNoRhpsmdURY=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-AXEzpW4nPXu0D5exmUwBYoe5Fb1PHFWSSvnwz7VSQos=";
+  vendorHash = "sha256-H57+G/LeZobc6yzkeCdX4aPTc0mKdYUCTxOQFxzCeL4=";
 
   postPatch = ''
     substituteInPlace modules/setting/server.go \

pkgs/by-name/go/goeland/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 buildGoModule (finalAttrs: {
@@ -23,6 +24,8 @@ buildGoModule (finalAttrs: {
     "-X github.com/slurdge/goeland/version.GitCommit=${finalAttrs.version}"
   ];
 
+  passthru.tests.nixos = nixosTests.goeland;
+
   meta = {
     description = "Alternative to rss2email written in golang with many filters";
     mainProgram = "goeland";

pkgs/by-name/gp/gpu-screen-recorder/package.nix

@@ -30,12 +30,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder";
-  version = "6.1.4";
+  version = "6.1.6";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder";
     tag = finalAttrs.version;
-    hash = "sha256-Xs+H/jb6ngeXwDD5eNkZLTmXqdo6R3ZAPz8Tliba8pA=";
+    hash = "sha256-Y2u+C0ioSORKkEiKRLAABGzTSAnoFU3J7OIlNOC4MAQ=";
   };
 
   postPatch = ''

pkgs/by-name/gp/gpu-viewer/package.nix

@@ -29,7 +29,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gpu-viewer";
-  version = "4.02";
+  version = "4.04";
   pyproject = false;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "arunsivaramanneo";
     repo = "gpu-viewer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B9pOpop47KQdTcsHvUIlAIwAthHs4toL/hL0uoKM/Xg=";
+    hash = "sha256-704G6vCYer+039R9+6vsHLjhsZo+JSKjiM3D66Vk74I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/graff/manifest.json

@@ -1,21 +1,21 @@
 {
-  "version": "0.302.46",
+  "version": "0.302.66",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.46/graff-x86_64-linux.tar.gz",
-      "hash": "sha256-lSKHrf34hrrRefEHZGH2qhA/5/MqsqHPXe4DyXL3HHs="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.66/graff-x86_64-linux.tar.gz",
+      "hash": "sha256-ogMupabeenlA9p/0zfrvZwGqVraGXYSGXTdQwDNKLvY="
     },
     "aarch64-linux": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.46/graff-aarch64-linux.tar.gz",
-      "hash": "sha256-aMunRNomOVp3lJEcVJBz+volgeA4cTwz5ia5rDbAVg8="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.66/graff-aarch64-linux.tar.gz",
+      "hash": "sha256-7tJKFxiez7JwnwJP6QzplimJyKK97PX+C8gtm2jNH18="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.46/graff-aarch64-macos.tar.gz",
-      "hash": "sha256-ymYwMBRWdXjnOnMJFJ5jX6o53n+FzXLgZe3hEkNFrIw="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.66/graff-aarch64-macos.tar.gz",
+      "hash": "sha256-v9z2L7lN4WjEiAN0Lf/Cqq/txwpeocsQ/Db6bI6gxk0="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.46/graff-x86_64-macos.tar.gz",
-      "hash": "sha256-eMQKtxvt6GJMrU+SLiZCt4zlPsRSeKbH8/IE8cQUqbQ="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.302.66/graff-x86_64-macos.tar.gz",
+      "hash": "sha256-rB2+ruws407j4aXguVgcaC7RQy5jvCleVtfQ42sKouM="
     }
   }
 }

pkgs/by-name/gr/grimblast/package.nix

@@ -20,13 +20,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "grimblast";
-  version = "0.1-unstable-2026-08-21";
+  version = "0.1-unstable-2026-10-22";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "57baf317e5196a8286b80976771ef55febad8660";
-    hash = "sha256-qSzrIIqQUtEVeVZxQLj/L4p7+xKBEtPhgMTzFW2c6P8=";
+    rev = "a54daf843dcdf6f5ff86996ab011de6e86a1bd7c";
+    hash = "sha256-eiWcuJH3ft0epDVue6pkxsY6ekBa/s7Rwx+yI1g0VVQ=";
   };
 
   strictDeps = true;