staging-next 2026-08-20 (#554614)

Some packages explitly use `dotnet-runtime = null` when outputting
self-contained executables.  This results in the hook script containing:

  dotnetRuntime=@dotnetRuntime@

CONTRIBUTING.md

@@ -957,7 +957,6 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
-If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.

doc/release-notes/rl-2611.section.md

@@ -142,6 +142,8 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
+
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.

lib/licenses/licenses.nix

@@ -715,6 +715,11 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
+    gccException20 = {
+      spdxId = "GCC-exception-2.0";
+      fullName = "GCC Runtime Library exception 2.0";
+    };
+
     gccException31 = {
       spdxId = "GCC-exception-3.1";
       fullName = "GCC Runtime Library exception 3.1";

maintainers/github-teams.json

@@ -262,6 +262,7 @@
       "stephenstubbs": 18033664,
       "t-monaghan": 62273348,
       "thefloweringash": 42933,
+      "thtrf": 82712122,
       "tricktron": 16036882,
       "uncenter": 47499684,
       "usertam": 22500027,
@@ -657,7 +658,6 @@
       "djacu": 7043297
     },
     "members": {
-      "Sigmanificient": 53050011,
       "flyfloh": 74379,
       "thilobillerbeck": 7442383
     },
@@ -856,6 +856,7 @@
       "lorenzleutgeb": 542154
     },
     "members": {
+      "Mic92": 96200,
       "ju1m": 21160136,
       "matthiasbeyer": 427866
     },

maintainers/maintainer-list.nix

@@ -3694,13 +3694,6 @@
     githubId = 185443;
     name = "Alexey Lebedeff";
   };
-  binary-eater = {
-    email = "sergeantsagara@protonmail.com";
-    github = "Binary-Eater";
-    githubId = 10691440;
-    name = "Rahul Rameshbabu";
-    keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110  BE53 FF24 7B3E 5411 387B"; } ];
-  };
   binarycat = {
     email = "binarycat@envs.net";
     github = "lolbinarycat";
@@ -20948,6 +20941,12 @@
     githubId = 41154684;
     name = "nokazn";
   };
+  nolight132 = {
+    email = "contact@nolight.dev";
+    github = "nolight132";
+    githubId = 71591964;
+    name = "Pavel Olizko";
+  };
   nolith = {
     github = "nolith";
     githubId = 78752;

nixos/doc/manual/development/running-nixos-tests.section.md

@@ -59,6 +59,6 @@ To make this path available, set the following option:
 
 ```nix
 {
-  nix.settings.sandbox-paths = [ "/dev/net" ];
+  nix.settings.extra-sandbox-paths = [ "/dev/net" ];
 }
 ```

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -106,6 +106,10 @@
 
 - [kvrocks_exporter](https://github.com/RocksLabs/kvrocks_exporter), a Prometheus exporter for Kvrocks metrics. Available as [services.prometheus.exporters.kvrocks](#opt-services.prometheus.exporters.kvrocks.enable).
 
+- [Umbriel](https://docs.noctalia.dev/umbriel/), a Wayland compositor built on wlroots and SceneFX. Available as [programs.umbriel](#opt-programs.umbriel.enable).
+
+- [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -195,14 +199,22 @@
 
 - `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
 
+- `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
+
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
+- The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
+
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
 
 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
 
 - `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
 
+- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1809,15 +1809,16 @@ class NspawnMachine(BaseMachine):
 
         # 1. Wait for the directory to actually be created by the container
         self.log(f"Waiting for journal at {journal_path}...")
-        max_attempts = 10
+        warn_after = 10
         attempts = 0
-        while not journal_path.exists() and attempts < max_attempts:
+        while not journal_path.exists():
+            if proc.poll() is not None:
+                self.log(f"Error: Journal directory {journal_path} never appeared.")
+                return
             time.sleep(1)
             attempts += 1
-
-        if not journal_path.exists():
-            self.log(f"Error: Journal directory {journal_path} never appeared.")
-            return
+            if attempts == warn_after:
+                self.log(f"Still waiting for journal at {journal_path}...")
 
         # 2. Start the journalctl process
         # Using a loop here handles cases where journalctl might exit unexpectedly

nixos/lib/testing/run.nix

@@ -35,8 +35,7 @@ let
     options = {
       devnet = mkOption {
         type = types.bool;
-        default =
-          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
+        default = containers != { } && nodes != { };
         defaultText = lib.literalMD "`true` if both VMs and containers are present.";
         description = ''
           This heuristic setting that assumes that the majority of tests requires VMs and containers
@@ -52,14 +51,14 @@ let
       };
       uid-range = mkOption {
         type = types.bool;
-        default = builtins.length (lib.attrNames containers) > 0;
+        default = containers != { };
         defaultText = lib.literalMD "`true` if containers are present.";
         description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
       };
       kvm = mkOption {
         type = types.bool;
-        default = isLinux;
-        defaultText = lib.literalMD "`true` if built to run on Linux.";
+        default = isLinux && nodes != { };
+        defaultText = lib.literalMD "`true` if built to run on Linux and any virtual machines are specified.";
         description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
       };
       apple-virt = mkOption {

nixos/lib/testing/testScript.nix

@@ -7,20 +7,15 @@ testModuleArgs@{
   ...
 }:
 let
-  inherit (lib) mkOption types;
-  inherit (types) either lines functionTo;
+  inherit (lib) mkOption types const;
+  inherit (types) coercedTo lines functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = either lines (functionTo lines);
-      apply =
-        v:
-        if lib.isFunction v then
-          # Only pass args the testScript function expects.
-          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
-        else
-          v;
+      type = coercedTo lines const (functionTo lines);
+      # Only pass args the testScript function expects.
+      apply = v: args: v (builtins.intersectAttrs (lib.functionArgs v) args);
       description = ''
         A series of python declarations and statements that you write to perform
         the test.
@@ -50,23 +45,19 @@ in
     withoutTestScriptReferences.includeTestScriptReferences = false;
     withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
 
-    testScriptString =
-      if lib.isFunction config.testScript then
-        config.testScript {
-          nodes = lib.mapAttrs (
-            k: v:
-            if v.virtualisation.useNixStoreImage then
-              # prevent infinite recursion when testScript would
-              # reference v's toplevel
-              config.withoutTestScriptReferences.nodesCompat.${k}
-            else
-              # reuse memoized config
-              v
-          ) config.nodesCompat;
-          containers = config.containers;
-        }
-      else
-        config.testScript;
+    testScriptString = config.testScript {
+      nodes = lib.mapAttrs (
+        k: v:
+        if v.virtualisation.useNixStoreImage then
+          # prevent infinite recursion when testScript would
+          # reference v's toplevel
+          config.withoutTestScriptReferences.nodesCompat.${k}
+        else
+          # reuse memoized config
+          v
+      ) config.nodesCompat;
+      containers = config.containers;
+    };
 
     nodeDefaults =
       { config, name, ... }:

nixos/modules/module-list.nix

@@ -372,6 +372,7 @@
   ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
+  ./programs/wayland/umbriel.nix
   ./programs/wayland/uwsm.nix
   ./programs/wayland/waybar.nix
   ./programs/wayland/wayfire.nix
@@ -1823,6 +1824,7 @@
   ./services/web-apps/romm.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rsshub.nix
+  ./services/web-apps/rundeck.nix
   ./services/web-apps/rustical.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix

nixos/modules/programs/wayland/umbriel.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.umbriel;
+in
+{
+  options.programs.umbriel = {
+    enable = lib.mkEnableOption "Umbriel, a Wayland compositor built on wlroots and SceneFX";
+    package = lib.mkPackageOption pkgs "umbriel" { };
+    portalPackage = lib.mkPackageOption pkgs "xdg-desktop-portal-umbriel" { };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [ cfg.package ];
+        services.displayManager.sessionPackages = [ cfg.package ];
+        systemd.packages = [ cfg.package ];
+
+        systemd.user.services.umbriel = {
+          restartIfChanged = false;
+          enableDefaultPath = false;
+        };
+
+        xdg.portal = {
+          enable = lib.mkDefault true;
+          extraPortals = [ cfg.portalPackage ];
+          configPackages = [ cfg.portalPackage ];
+        };
+      }
+
+      (import ./wayland-session.nix {
+        inherit lib pkgs;
+        enableXWayland = false;
+        enableWlrPortal = false;
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [
+    samiser
+    pyrox0
+  ];
+}

nixos/modules/services/audio/mympd.nix

@@ -108,7 +108,7 @@ in
         DynamicUser = true;
         ExecStart = lib.getExe cfg.package;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         PrivateDevices = true;
         ProtectClock = true;
         ProtectControlGroups = true;

nixos/modules/services/databases/mysql.nix

@@ -752,7 +752,7 @@ in
             "AF_INET6"
           ];
           LockPersonality = true;
-          MemoryDenyWriteExecute = true;
+          MemoryDenyWriteExecute = false; # pcre2 jit
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           PrivateMounts = true;

nixos/modules/services/games/quake3-server.nix

@@ -15,9 +15,16 @@ let
     ;
   cfg = config.services.quake3-server;
 
-  configFile = pkgs.writeText "q3ds-extra.cfg" ''
-    set net_port ${toString cfg.port}
+  toQuake3Value = value: if lib.isBool value then (if value then "1" else "0") else toString value;
 
+  toQuake3Config =
+    settings:
+    lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''seta ${name} "${toQuake3Value value}"'' + "\n") settings
+    );
+
+  configFile = pkgs.writeText "q3ds-extra.cfg" ''
+    ${toQuake3Config cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -50,19 +57,19 @@ let
   '';
 in
 {
+
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "quake3-server" "port" ]
+      [ "services" "quake3-server" "settings" "net_port" ]
+    )
+  ];
+
   options = {
     services.quake3-server = {
       enable = mkEnableOption "Quake 3 dedicated server";
       package = lib.mkPackageOption pkgs "ioquake3" { };
 
-      port = mkOption {
-        type = types.port;
-        default = 27960;
-        description = ''
-          UDP Port the server should listen on.
-        '';
-      };
-
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -71,16 +78,59 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.nullOr (
+              types.oneOf [
+                types.str
+                types.bool
+                types.int
+                types.float
+                types.port
+              ]
+            )
+          );
+          options = {
+            net_port = lib.mkOption {
+              type = lib.types.port;
+              default = 27960;
+              description = "UDP port for the dedicated server to bind to.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          sv_hostname = "My Quake 3 server";
+          g_gametype = 0;
+          sv_pure = true;
+        };
+        description = ''
+          Quake 3 cvars set via `seta` on server start (i.e. persisted,
+          archive-flagged cvars – the vast majority of server settings).
+          Note that options changed via RCON will not be persisted. To list
+          all possible options, use "cvarlist 1" via RCON.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         example = ''
-          seta rconPassword "superSecret"      // sets RCON password for remote console
-          seta sv_hostname "My Quake 3 server"      // name that appears in server list
+          // map rotation and other things that don't map onto plain cvars
+          set d1 "map q3dm1 ; set nextmap vstr d2"
+          set d2 "map q3dm7 ; set nextmap vstr d1"
+          vstr d1
+
+          // rarely needed: cvars with a non-seta flag
+          sets sv_privatePassword "hidden"
         '';
         description = ''
-          Extra configuration options. Note that options changed via RCON will not be persisted. To list all possible
-          options, use "cvarlist 1" via RCON.
+          Extra configuration lines appended after `settings`, for anything
+          that isn't a plain persisted cvar: map-rotation scripts, `exec`,
+          `vstr`, aliases, or cvars that need `set`/`sets`/`sett`/`setu`
+          instead of `seta`. Note that options changed via RCON will not be
+          persisted. To list all possible options, use "cvarlist 1" via RCON.
         '';
       };
 
@@ -103,7 +153,7 @@ in
       baseq3InStore = builtins.typeOf cfg.baseq3 == "set";
     in
     mkIf cfg.enable {
-      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.settings.net_port ];
 
       systemd.services.q3ds = {
         description = "Quake 3 dedicated server";
@@ -115,7 +165,7 @@ in
         serviceConfig = with lib; {
           Restart = "always";
           DynamicUser = true;
-          WorkingDirectory = home;
+          WorkingDirectory = if baseq3InStore then home else cfg.baseq3;
 
           # It is possible to alter configuration files via RCON. To ensure reproducibility we have to prevent this
           ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;

nixos/modules/services/mail/cyrus-imap.nix

@@ -355,7 +355,7 @@ in
         PrivateDevices = true;
         ProtectSystem = "full";
         CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectControlGroups = true;

nixos/modules/services/mail/dovecot.nix

@@ -1061,7 +1061,7 @@ in
           "CAP_SYS_RESOURCE"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = false; # e.g for sendmail
         OOMPolicy = "continue";
         PrivateTmp = true;

nixos/modules/services/mail/postfix.nix

@@ -1011,7 +1011,7 @@ in
             PrivateDevices = true;
             ProtectSystem = "full";
             CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-            MemoryDenyWriteExecute = true;
+            MemoryDenyWriteExecute = false; # pcre2 jit
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectControlGroups = true;

nixos/modules/services/misc/forgejo.nix

@@ -777,7 +777,7 @@ in
         ];
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;

nixos/modules/services/misc/gitea.nix

@@ -953,7 +953,7 @@ in
         ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;

nixos/modules/services/misc/portunus.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.services.portunus;
-
 in
 {
   options.services.portunus = {
@@ -79,9 +78,15 @@ in
         type = lib.types.listOf (
           lib.types.submodule {
             options = {
+              redirectURIs = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+                description = "URLs where the OIDC client should redirect";
+              };
               callbackURL = lib.mkOption {
-                type = lib.types.str;
-                description = "URL where the OIDC client should redirect";
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                description = "URL where the OIDC client should redirect (deprecated, use redirectURIs)";
               };
               id = lib.mkOption {
                 type = lib.types.str;
@@ -93,7 +98,7 @@ in
         default = [ ];
         example = [
           {
-            callbackURL = "https://example.com/client/oidc/callback";
+            redirectURIs = [ "https://example.com/client/oidc/callback" ];
             id = "service";
           }
         ];
@@ -227,7 +232,7 @@ in
 
           staticClients = lib.forEach cfg.dex.oidcClients (client: {
             inherit (client) id;
-            redirectURIs = [ client.callbackURL ];
+            redirectURIs = client.redirectURIs ++ lib.optional (client.callbackURL != null) client.callbackURL;
             name = "OIDC for ${client.id}";
             secretEnv = "DEX_CLIENT_${client.id}";
           });

nixos/modules/services/networking/adguardhome.nix

@@ -20,8 +20,7 @@ let
 
   settings =
     if (cfg.settings != null) then
-      cfg.settings
-      // (
+      lib.recursiveUpdate cfg.settings (
         if cfg.settings.schema_version < 23 then
           {
             bind_host = cfg.host;
@@ -192,8 +191,9 @@ in
                 # Note: --check-config has the side effect of modifying the file at rest!
                 ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
 
-                # Writing directly to AdGuardHome.yaml results in empty file
-                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
+                # sed operation needed to fix protection_disabled_until value changed by yaml-merge
+                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" \
+                | sed -E "s/(protection_disabled_until: [0-9]{4}-[0-9]{2}-[0-9]{2}) /\1T/" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
                 mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
               else
                 ${installFresh}

nixos/modules/services/networking/suricata/default.nix

@@ -273,7 +273,7 @@ in
               ProtectSystem = "strict";
               DevicePolicy = "closed";
               LockPersonality = true;
-              MemoryDenyWriteExecute = true;
+              MemoryDenyWriteExecute = false; # pcre2 jit
               ProtectHostname = true;
               ProtectProc = true;
               ProtectKernelLogs = true;

nixos/modules/services/networking/syncthing.nix

@@ -1049,7 +1049,7 @@ in
       };
       syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
-        requisite = [ "syncthing.service" ];
+        requires = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
         wantedBy = [ "multi-user.target" ];
 

nixos/modules/services/web-apps/netbox.nix

@@ -434,11 +434,12 @@ in
     package = lib.mkOption {
       type = types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "26.05" then pkgs.netbox_4_5 else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then pkgs.netbox_4_6 else pkgs.netbox_4_5;
       defaultText = lib.literalExpression ''
-        if lib.versionAtLeast config.system.stateVersion "26.05"
-        then pkgs.netbox_4_5
-        else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then
+          pkgs.netbox_4_6
+        else
+          pkgs.netbox_4_5;
       '';
       description = ''
         NetBox package to use.

nixos/modules/services/web-apps/papra.nix

@@ -8,14 +8,22 @@ let
   cfg = config.services.papra;
   defaultUser = "papra";
   defaultGroup = "papra";
-  defaultEnv = {
-    SERVER_SERVE_PUBLIC_DIR = true;
-    PORT = 1221;
-    DATABASE_URL = "file:/var/lib/papra/db.sqlite";
-    DOCUMENT_STORAGE_FILESYSTEM_ROOT = "/var/lib/papra/local-documents";
-  };
 in
 {
+  imports = [
+    (lib.mkChangedOptionModule
+      [ "services" "papra" "environmentFile" ]
+      [ "services" "papra" "environmentFiles" ]
+      (
+        config:
+        let
+          value = lib.getAttrFromPath [ "services" "papra" "environmentFile" ] config;
+        in
+        if value == null then [ ] else [ value ]
+      )
+    )
+  ];
+
   options = {
     services.papra = {
       enable = lib.mkEnableOption "Papra";
@@ -37,31 +45,103 @@ in
 
       package = lib.mkPackageOption pkgs "papra" { };
 
-      environment = lib.mkOption {
-        type =
-          with lib.types;
-          attrsOf (oneOf [
-            str
-            int
-            float
-            bool
-            path
-            package
-          ]);
-        default = defaultEnv;
-        example = {
-          PORT = 1221;
-        };
-        description = "Environment variables to set for the service.";
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for Papra.
+        '';
       };
 
-      environmentFile = lib.mkOption {
-        type = with lib.types; nullOr path;
-        default = null;
-        description = "Environment file, usefult to provide secrets to the service";
+      environment = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              str
+              int
+              float
+              bool
+              path
+              package
+            ]);
+
+          options = {
+            PORT = lib.mkOption {
+              type = lib.types.port;
+              default = 1221;
+              description = ''
+                The port on which Papra listens.
+                See <https://docs.papra.app/self-hosting/configuration/#port> for more information.
+              '';
+            };
+
+            DATABASE_URL = lib.mkOption {
+              type = lib.types.str;
+              default = "file:/var/lib/papra/db.sqlite";
+              description = ''
+                The URL of the database.
+                See <https://docs.papra.app/self-hosting/configuration/#database_url> for more information.
+
+                ::: {.note}
+                When specifying a `file:` URL with an absolute path through this option,
+                the database's parent directory is automatically added to the systemd
+                service's `ReadWritePaths`. Other local database paths, including paths
+                specified through `environmentFiles`, may need to be added to `ReadWritePaths` manually.
+                :::
+              '';
+            };
+
+            INGESTION_FOLDER_ROOT_PATH = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/papra/ingestion";
+              description = ''
+                The root directory in which ingestion folders for each organization are stored.
+                The parent directory must already exist if using a custom path.
+                See <https://docs.papra.app/self-hosting/configuration/#ingestion_folder_root_path> for more information.
+              '';
+            };
+
+            DOCUMENT_STORAGE_FILESYSTEM_ROOT = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/papra/local-documents";
+              description = ''
+                The root directory to store documents in.
+                The parent directory must already exist if using a custom path.
+                See <https://docs.papra.app/self-hosting/configuration/#document_storage_filesystem_root> for more information.
+              '';
+            };
+
+            SERVER_SERVE_PUBLIC_DIR = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to serve the public directory.
+                See <https://docs.papra.app/self-hosting/configuration/#server_serve_public_dir> for more information.
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Environment variables to pass to Papra.
+          See <https://docs.papra.app/self-hosting/configuration/#configuration-variables> for more information.
+        '';
+      };
+
+      environmentFiles = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [ ];
+        example = [ "/run/secrets/papra.env" ];
+        description = ''
+          Files to load environment variables from in addition to [](#opt-services.papra.environment).
+          This is useful to avoid putting secrets into the nix store.
+          See <https://docs.papra.app/self-hosting/configuration/#configuration-variables> for more information.
+        '';
       };
     };
   };
+
   config = lib.mkIf cfg.enable {
     users = {
       users = lib.optionalAttrs (cfg.user == defaultUser) {
@@ -76,6 +156,18 @@ in
       };
     };
 
+    systemd.tmpfiles.settings."10-papra" = {
+      "${cfg.environment.DOCUMENT_STORAGE_FILESYSTEM_ROOT}".d = {
+        mode = "0700";
+        inherit (cfg) user group;
+      };
+
+      "${cfg.environment.INGESTION_FOLDER_ROOT_PATH}".d = {
+        mode = "0770";
+        inherit (cfg) user group;
+      };
+    };
+
     systemd.services.papra = {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
@@ -85,15 +177,58 @@ in
         User = cfg.user;
         Group = cfg.group;
         StateDirectory = "papra";
-        EnvironmentFile = cfg.environmentFile;
+        StateDirectoryMode = "0700";
+        EnvironmentFile = cfg.environmentFiles;
+        ReadWritePaths = lib.unique (
+          [
+            cfg.environment.DOCUMENT_STORAGE_FILESYSTEM_ROOT
+            cfg.environment.INGESTION_FOLDER_ROOT_PATH
+          ]
+          ++ lib.optional (lib.hasPrefix "file:/" cfg.environment.DATABASE_URL) (
+            dirOf (lib.removePrefix "file:" cfg.environment.DATABASE_URL)
+          )
+        );
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0007";
       };
-      environment =
-        let
-          environmentwithDefaults = defaultEnv // cfg.environment;
-        in
-        (lib.mapAttrs (
-          _: s: if lib.isBool s then lib.boolToString s else toString s
-        ) environmentwithDefaults);
+      environment = lib.mapAttrs (
+        _: s: if lib.isBool s then lib.boolToString s else toString s
+      ) cfg.environment;
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.environment.PORT ];
     };
   };
 

nixos/modules/services/web-apps/rundeck.nix

@@ -0,0 +1,651 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rundeck;
+  settingsFormat = pkgs.formats.javaProperties { };
+  effectivePort = if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort;
+  scheme = if cfg.ssl.enable then "https" else "http";
+
+  configFile = settingsFormat.generate "rundeck-config.properties" cfg.settings;
+  frameworkFile = settingsFormat.generate "framework.properties" cfg.frameworkSettings;
+
+  realmFile = pkgs.writeText "realm.properties" ''
+    ${cfg.adminUser}:@ADMIN_PASSWORD@,user,admin
+  '';
+
+  replaceSecret =
+    placeholder: file: target:
+    "replace-secret ${
+      lib.escapeShellArgs [
+        placeholder
+        file
+        target
+      ]
+    }";
+
+  rundeckStartScript = pkgs.writeShellScript "start-rundeck" ''
+    # Generate SSH
+    if [ ! -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ]; then
+      umask 0077
+      ${lib.getExe' pkgs.openssh "ssh-keygen"} -t ${cfg.sshKeyType} ${
+        lib.optionalString (cfg.sshKeyType == "rsa") "-b 4096"
+      } -N "" -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}
+      chmod 644 ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+      chown ${cfg.user}:${cfg.group} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+    fi
+
+    ${lib.getExe cfg.package} \
+      --skipinstall \
+      -b ${cfg.dataDir} \
+      -c ${cfg.configDir} \
+      -p ${cfg.dataDir}/projects
+  '';
+in
+{
+  options = {
+    services.rundeck = {
+      enable = lib.mkEnableOption "Rundeck service";
+
+      package = lib.mkPackageOption pkgs "rundeck" { };
+
+      adminUser = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+        description = "Username for the Rundeck admin user";
+        example = "rundeck-admin";
+      };
+
+      adminPasswordFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Path to a file containing the admin password";
+        example = "/run/secrets/rundeck-admin-password";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "User account under which Rundeck runs";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "Group account under which Rundeck runs";
+      };
+
+      serverHostname = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = "Hostname for the Rundeck server";
+      };
+
+      serverURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${scheme}://${cfg.serverHostname}:${toString effectivePort}";
+        defaultText = lib.literalMD ''
+          `<scheme>://<serverHostname>:<port>`, where scheme is `https` when
+          `ssl.enable` else `http`, and port is `ssl.port` when `ssl.enable`
+          else `serverPort`.
+        '';
+        description = "Complete Grails server URL";
+        example = "https://myhost:4443/rundeck";
+      };
+
+      serverPort = lib.mkOption {
+        type = lib.types.port;
+        default = 4440;
+        description = "Port on which Rundeck will listen";
+      };
+
+      serverUUID = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "UUID for the Rundeck server (automatically generated if not specified)";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/rundeck";
+        description = "Directory for Rundeck runtime data (RDECK_BASE)";
+      };
+
+      configDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/etc/rundeck";
+        description = "Directory for Rundeck configuration files";
+      };
+
+      javaOpts = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "-Xmx1024m"
+          "-Xms256m"
+          "-XX:MaxMetaspaceSize=256m"
+          "-server"
+        ];
+        description = "Additional Java options for Rundeck";
+      };
+
+      aclPolicies = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        description = "ACL policies for Rundeck, where the attribute name is the filename and the value is the policy content";
+        example = lib.literalExpression ''
+          {
+            "admin.aclpolicy" = '''
+              description: Admin access for administrators
+              context:
+                project: '.*'
+              for:
+                resource:
+                  - allow: '*'
+                job:
+                  - allow: '*'
+                node:
+                  - allow: '*'
+              by:
+                group: admin
+              ---
+              description: Admin access in application scope
+              context:
+                application: 'rundeck'
+              for:
+                resource:
+                  - allow: '*'
+                project:
+                  - allow: '*'
+              by:
+                group: admin
+            ''';
+          }
+        '';
+      };
+
+      sshKeyType = lib.mkOption {
+        type = lib.types.enum [
+          "rsa"
+          "ed25519"
+        ];
+        default = "rsa";
+        description = "Type of SSH key to generate (rsa for compatibility, ed25519 for better security)";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open the Rundeck port in the firewall";
+      };
+
+      startTimeout = lib.mkOption {
+        type = lib.types.int;
+        default = 180;
+        description = "Timeout in seconds before systemd considers the service startup as failed";
+        example = 120;
+      };
+
+      database = {
+        type = lib.mkOption {
+          type = lib.types.enum [
+            "h2"
+            "postgresql"
+            "mysql"
+          ];
+          default = "h2";
+          description = "Database type to use (h2, postgresql, or mysql)";
+        };
+
+        host = lib.mkOption {
+          type = lib.types.str;
+          default = "localhost";
+          description = "Database host";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.nullOr lib.types.port;
+          default =
+            if cfg.database.type == "postgresql" then
+              5432
+            else if cfg.database.type == "mysql" then
+              3306
+            else
+              null;
+          defaultText = lib.literalExpression ''
+            if config.services.rundeck.database.type == "postgresql" then
+              5432
+            else if config.services.rundeck.database.type == "mysql" then
+              3306
+            else
+              null
+          '';
+          description = "Database port (defaults: PostgreSQL: 5432, MySQL: 3306)";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database name";
+        };
+
+        username = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database username";
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = "Path to a file containing the database password";
+          example = "/run/secrets/rundeck-db-password";
+        };
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `rundeck-config.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+
+          Secrets must not be set here, as this ends up world-readable in the Nix
+          store. Use the dedicated `*File` options instead.
+        '';
+        example = lib.literalExpression ''
+          {
+            "rundeck.feature.repository.enabled" = "true";
+            "rundeck.projectsStorageType" = "db";
+            "rundeck.gui.title" = "My Rundeck Instance";
+            "rdeck.security.useHMacRequestTokens" = "true";
+            "rundeck.web.jetty.servlet.MaxFormKeys" = "2000";
+          }
+        '';
+      };
+
+      frameworkSettings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `framework.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+        '';
+        example = lib.literalExpression ''
+          {
+            "framework.ssh.timeout" = "120";
+            "framework.ssh.user" = "deploy";
+          }
+        '';
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "SSL support";
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 4443;
+          description = "Port on which Rundeck will listen for HTTPS when ssl.enable is true";
+        };
+
+        keyStore = lib.mkOption {
+          type = lib.types.path;
+          example = "/etc/rundeck/ssl/keystore";
+          description = "Path to the keystore containing the SSL certificate";
+        };
+
+        keyStorePasswordFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Path to a file containing the SSL keystore password";
+          example = "/run/secrets/rundeck-keystore-password";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion =
+          cfg.database.type == "h2"
+          || (cfg.database.host != "" && cfg.database.username != "" && cfg.database.passwordFile != null);
+        message = "When using external database (PostgreSQL/MySQL), host, username, and passwordFile must be provided";
+      }
+      {
+        assertion = cfg.database.type == "h2" || cfg.database.port != null;
+        message = "Database port must be set when using an external database";
+      }
+    ];
+
+    services.rundeck.settings = {
+      "server.address" = lib.mkDefault "0.0.0.0";
+      "server.port" = lib.mkDefault (toString cfg.serverPort);
+      "grails.serverURL" = lib.mkDefault cfg.serverURL;
+      "logging.config" = lib.mkDefault "${cfg.configDir}/log4j2.properties";
+      "dataSource.url" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "jdbc:h2:file:${cfg.dataDir}/data/rundeckdb;DB_CLOSE_ON_EXIT=FALSE;NON_KEYWORDS=MONTH,HOUR,MINUTE,YEAR,SECONDS"
+        else if cfg.database.type == "postgresql" then
+          "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}"
+        else
+          "jdbc:mysql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}?autoReconnect=true&useSSL=false"
+      );
+      "dataSource.driverClassName" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "org.h2.Driver"
+        else if cfg.database.type == "postgresql" then
+          "org.postgresql.Driver"
+        else
+          "org.mariadb.jdbc.Driver"
+      );
+      "dataSource.username" = lib.mkDefault cfg.database.username;
+    }
+    // lib.optionalAttrs (cfg.database.passwordFile != null) {
+      "dataSource.password" = lib.mkDefault "@DB_PASSWORD@";
+    }
+    // lib.optionalAttrs (cfg.database.type == "h2") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.H2Dialect";
+    }
+    // lib.optionalAttrs (cfg.database.type == "mysql") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.MariaDB103Dialect";
+    }
+    // lib.optionalAttrs cfg.ssl.enable {
+      "server.https.port" = lib.mkDefault (toString cfg.ssl.port);
+      "server.ssl.keyStore" = lib.mkDefault (toString cfg.ssl.keyStore);
+      "server.ssl.keyStorePassword" = lib.mkDefault "@KEYSTORE_PASSWORD@";
+    };
+
+    services.rundeck.frameworkSettings = {
+      "framework.server.name" = lib.mkDefault cfg.serverHostname;
+      "framework.server.hostname" = lib.mkDefault cfg.serverHostname;
+      "framework.server.port" = lib.mkDefault (toString effectivePort);
+      "framework.server.url" = lib.mkDefault cfg.serverURL;
+      "framework.ssh.keypath" = lib.mkDefault "${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}";
+      "framework.ssh.user" = lib.mkDefault cfg.user;
+      "framework.ssh.timeout" = lib.mkDefault "60";
+      "rdeck.base" = cfg.dataDir;
+      "framework.projects.dir" = "${cfg.dataDir}/projects";
+      "framework.etc.dir" = toString cfg.configDir;
+      "framework.var.dir" = "${cfg.dataDir}/var";
+      "framework.tmp.dir" = "${cfg.dataDir}/var/tmp";
+      "framework.logs.dir" = "${cfg.dataDir}/var/logs";
+      "framework.libext.dir" = "${cfg.dataDir}/libext";
+      "rundeck.server.uuid" = if cfg.serverUUID != "" then cfg.serverUUID else "@SERVER_UUID@";
+    };
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      home = cfg.dataDir;
+      createHome = true;
+    };
+
+    users.groups.${cfg.group} = { };
+
+    systemd.tmpfiles.settings."10-rundeck" = {
+      "${cfg.dataDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/etc" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/data" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/projects" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/libext" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/logs" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/tmp" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/.ssh" = {
+        d = {
+          mode = "0700";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}/ssl" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "/var/log/rundeck" = {
+        L = {
+          argument = "${cfg.dataDir}/var/logs";
+        };
+      };
+    };
+
+    environment.etc."rundeck/jaas-loginmodule.conf" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        RDpropertyfilelogin {
+          org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
+          debug="true"
+          file="/etc/rundeck/realm.properties";
+        };
+      '';
+    };
+
+    environment.etc."rundeck/log4j2.properties" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        status = info
+        name = RundeckPro
+
+        appender.console.type = Console
+        appender.console.name = STDOUT
+        appender.console.layout.type = PatternLayout
+        appender.console.layout.pattern = %d{DEFAULT} %-5p %c{1} - %m%n
+
+        appender.file.type = RollingFile
+        appender.file.name = FILE
+        appender.file.fileName = ${cfg.dataDir}/var/logs/rundeck.log
+        appender.file.filePattern = ${cfg.dataDir}/var/logs/rundeck.%d{yyyy-MM-dd}.log
+        appender.file.layout.type = PatternLayout
+        appender.file.layout.pattern = %d{DEFAULT} [%t] %-5p %c{1} - %m%n
+        appender.file.policies.type = Policies
+        appender.file.policies.time.type = TimeBasedTriggeringPolicy
+        appender.file.policies.time.interval = 1
+        appender.file.policies.time.modulate = true
+
+        rootLogger.level = info
+        rootLogger.appenderRef.stdout.ref = STDOUT
+        rootLogger.appenderRef.file.ref = FILE
+
+        logger.hibernate.name = org.hibernate
+        logger.hibernate.level = ERROR
+      '';
+    };
+
+    systemd.services.rundeck = {
+      description = "Rundeck Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional (cfg.database.type == "mysql") "mysql.service"
+      ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+      wants =
+        lib.optional (cfg.database.type == "mysql") "mysql.service"
+        ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+
+      environment = {
+        RDECK_BASE = cfg.dataDir;
+        RUNDECK_CONFIG_DIR = cfg.configDir;
+        JAVA_OPTS = lib.concatStringsSep " " cfg.javaOpts;
+      };
+
+      path = [ pkgs.replace-secret ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = rundeckStartScript;
+        WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = "rundeck";
+        RuntimeDirectoryMode = "0750";
+        UMask = "0027";
+
+        LimitNOFILE = 65536;
+        ReadWritePaths = [
+          cfg.dataDir
+          cfg.configDir
+        ];
+        RestartSec = "10s";
+        Restart = "always";
+        TimeoutStartSec = "${toString cfg.startTimeout}s";
+
+        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" ];
+        AmbientCapabilities = [ "CAP_SYS_ADMIN" ];
+
+        LimitCORE = 0;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+
+      preStart = ''
+        ${lib.optionalString (cfg.serverUUID == "") ''
+          # Generate UUID
+          UUID_FILE="${cfg.dataDir}/.uuid"
+          if [ ! -f "$UUID_FILE" ]; then
+            umask 0137
+            ${lib.getExe' pkgs.util-linux "uuidgen"} > "$UUID_FILE"
+          fi
+        ''}
+
+
+        install -m 0640 ${configFile} ${cfg.configDir}/rundeck-config.properties
+        install -m 0640 ${frameworkFile} ${cfg.configDir}/framework.properties
+        install -m 0600 ${realmFile} ${cfg.configDir}/realm.properties
+
+        ${replaceSecret "@ADMIN_PASSWORD@" cfg.adminPasswordFile "${cfg.configDir}/realm.properties"}
+
+        ${lib.optionalString (cfg.database.passwordFile != null) (
+          replaceSecret "@DB_PASSWORD@" cfg.database.passwordFile "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString cfg.ssl.enable (
+          replaceSecret "@KEYSTORE_PASSWORD@" cfg.ssl.keyStorePasswordFile
+            "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString (cfg.serverUUID == "") (
+          replaceSecret "@SERVER_UUID@" "${cfg.dataDir}/.uuid" "${cfg.configDir}/framework.properties"
+        )}
+
+        if [ -f ${cfg.dataDir}/etc/framework.properties ]; then
+          install -m 0640 ${cfg.configDir}/framework.properties ${cfg.dataDir}/etc/framework.properties
+        fi
+
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (
+            name: content:
+            "install -m 0640 ${pkgs.writeText "rundeck-${name}" content} ${cfg.dataDir}/etc/${name}"
+          ) cfg.aclPolicies
+        )}
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+      (if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort)
+    ];
+  };
+}

nixos/modules/services/web-servers/nginx/default.nix

@@ -1626,11 +1626,7 @@ in
           ];
           RestrictNamespaces = true;
           LockPersonality = true;
-          MemoryDenyWriteExecute =
-            !(
-              (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || (lib.getName cfg.package == "openresty")
-            );
+          MemoryDenyWriteExecute = false; # for pcre2 & several plugins
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           RemoveIPC = true;

nixos/modules/services/web-servers/unit/default.nix

@@ -139,7 +139,7 @@ in
           "AF_INET6"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;

nixos/tests/actual.nix

@@ -3,13 +3,13 @@
   name = "actual";
   meta.maintainers = [ lib.maintainers.oddlama ];
 
-  nodes.machine =
+  containers.machine =
     { ... }:
     {
       services.actual.enable = true;
     };
 
-  nodes.machine2 =
+  containers.machine2 =
     { ... }:
     {
       services.actual = {

nixos/tests/all-tests.nix

@@ -802,7 +802,7 @@ in
     systemdStage1 = true;
   };
   hister = runTest ./hister.nix;
-  hitch = handleTest ./hitch { };
+  hitch = runTest ./hitch;
   hledger-web = runTest ./hledger-web.nix;
   hockeypuck = runTest ./hockeypuck.nix;
   holo-daemon-modular-service = runTest ./holo-daemon-modular.nix;
@@ -912,8 +912,14 @@ in
   keter = runTest ./keter.nix;
   kexec = runTest ./kexec.nix;
   keycloak = discoverTests (import ./keycloak.nix);
-  keyd = handleTest ./keyd.nix { };
-  keymap = handleTest ./keymap.nix { };
+  keyd = import ./keyd.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
+  keymap = import ./keymap.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   kimai = runTest ./kimai.nix;
   kismet = runTest ./kismet.nix;
   kiwix-serve = runTest ./kiwix-serve;
@@ -1007,7 +1013,7 @@ in
   lomiri-mediaplayer-app = runTest ./lomiri-mediaplayer-app.nix;
   lomiri-music-app = runTest ./lomiri-music-app.nix;
   lomiri-system-settings = runTest ./lomiri-system-settings.nix;
-  lorri = handleTest ./lorri/default.nix { };
+  lorri = runTest ./lorri/default.nix;
   luks = runTest ./luks.nix;
   luks-suspend = runTest ./luks-suspend.nix;
   lvm2 = import ./lvm2 { inherit pkgs runTest; };
@@ -1156,6 +1162,7 @@ in
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
   netbox_4_5 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_5; };
+  netbox_4_6 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_6; };
   netdata = runTest ./netdata.nix;
   netfoil = runTest ./netfoil.nix;
   netplan = runTest ./netplan.nix;
@@ -1553,6 +1560,7 @@ in
   rsyslogd = handleTest ./rsyslogd.nix { };
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
+  rundeck = runTest ./rundeck.nix;
   rush = runTest ./rush.nix;
   rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
@@ -1787,7 +1795,7 @@ in
   terminal-emulators = handleTest ./terminal-emulators.nix { };
   test-containers-bittorrent = runTest ./test-containers-bittorrent.nix;
   thanos = runTest ./thanos.nix;
-  thelounge = handleTest ./thelounge.nix { };
+  thelounge = runTest ./thelounge.nix;
   tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
@@ -1918,7 +1926,10 @@ in
     inherit pkgs runTest;
     inherit (pkgs) lib;
   };
-  wine = handleTest ./wine.nix { };
+  wine = import ./wine.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   wireguard = import ./wireguard {
     inherit pkgs runTest;
     inherit (pkgs) lib;

nixos/tests/blocky.nix

@@ -1,7 +1,7 @@
 {
   name = "blocky";
 
-  nodes = {
+  containers = {
     server =
       { pkgs, ... }:
       {

nixos/tests/cloudlog.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 {
   name = "cloudlog";
-  nodes = {
+  containers = {
     machine = {
       services.mysql.package = pkgs.mariadb;
       services.cloudlog.enable = true;

nixos/tests/hitch/default.nix

@@ -1,36 +1,34 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "hitch";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jflanglois ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.curl ];
-        services.hitch = {
-          enable = true;
-          backend = "[127.0.0.1]:80";
-          pem-files = [
-            ./example.pem
-          ];
-        };
-
-        services.httpd = {
-          enable = true;
-          virtualHosts.localhost.documentRoot = ./example;
-          adminAddr = "noone@testing.nowhere";
-        };
+{ pkgs, ... }:
+{
+  name = "hitch";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jflanglois ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.hitch = {
+        enable = true;
+        backend = "[127.0.0.1]:80";
+        pem-files = [
+          ./example.pem
+        ];
       };
 
-    testScript = ''
-      start_all()
+      services.httpd = {
+        enable = true;
+        virtualHosts.localhost.documentRoot = ./example;
+        adminAddr = "noone@testing.nowhere";
+      };
+    };
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("hitch.service")
-      machine.wait_for_open_port(443)
-      assert "We are all good!" in machine.succeed("curl -fk https://localhost:443/index.txt")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("hitch.service")
+    machine.wait_for_open_port(443)
+    assert "We are all good!" in machine.succeed("curl -fk https://localhost:443/index.txt")
+  '';
+}

nixos/tests/keyd.nix

@@ -1,12 +1,10 @@
 # The test template is taken from the `./keymap.nix`
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
   readyFile = "/tmp/readerReady";
   resultFile = "/tmp/readerResult";
@@ -29,8 +27,8 @@ let
   mkKeyboardTest =
     name:
     { default, test }:
-    with pkgs.lib;
-    makeTest {
+
+    runTest {
       inherit name;
 
       nodes.machine = {
@@ -72,7 +70,7 @@ let
     };
 
 in
-pkgs.lib.mapAttrs mkKeyboardTest {
+lib.mapAttrs mkKeyboardTest {
   swap-ab_and_ctrl-as-shift = {
     test.press = [
       "a"

nixos/tests/keymap.nix

@@ -1,11 +1,9 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
   readyFile = "/tmp/readerReady";
   resultFile = "/tmp/readerResult";
@@ -32,8 +30,8 @@ let
       extraConfig ? { },
       tests,
     }:
-    with pkgs.lib;
-    makeTest {
+    with lib;
+    runTest {
       name = "keymap-${layout}";
 
       nodes.machine.console.keyMap = mkOverride 900 layout;
@@ -105,7 +103,7 @@ let
     };
 
 in
-pkgs.lib.mapAttrs mkKeyboardTest {
+lib.mapAttrs mkKeyboardTest {
   azerty = {
     tests = {
       azqw.qwerty = [

nixos/tests/lorri/default.nix

@@ -1,4 +1,4 @@
-import ../make-test-python.nix {
+{
   name = "lorri";
 
   nodes.machine =

nixos/tests/rundeck.nix

@@ -0,0 +1,111 @@
+{
+  name = "rundeck";
+
+  nodes = {
+    rundeck =
+      { pkgs, ... }:
+      {
+        environment.etc."rundeck-admin-password" = {
+          text = "testpassword";
+          mode = "0400";
+          user = "rundeck";
+          group = "rundeck";
+        };
+
+        services.rundeck = {
+          enable = true;
+          serverHostname = "rundeck";
+          adminUser = "testadmin";
+          adminPasswordFile = "/etc/rundeck-admin-password";
+          serverPort = 4441;
+          database.type = "h2";
+          openFirewall = true;
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          jq
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    def login_and_verify_api(machine, host, port, user, password, timeout=300):
+        """Authenticate via Rundeck form login and verify API access."""
+        machine.wait_until_succeeds(
+            f"curl -s -c /tmp/cookies -L"
+            f" -d 'j_username={user}&j_password={password}'"
+            f" http://{host}:{port}/j_security_check -o /dev/null"
+            f" && curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            f" http://{host}:{port}/api/26/system/info"
+            f" | jq -e '.system.rundeck.version'",
+            timeout=timeout,
+        )
+
+    def properties(machine, path):
+        return machine.succeed(f"cat {path}").replace("\\", "").replace(" = ", "=")
+
+    with subtest("Rundeck starts and serves homepage"):
+        rundeck.wait_for_unit("rundeck.service")
+        rundeck.wait_for_open_port(4441)
+        rundeck.wait_until_succeeds(
+            "curl -sL http://rundeck:4441 | grep -qi Rundeck"
+        )
+
+    with subtest("Regression - port is included in generated URLs"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "grails.serverURL=http://rundeck:4441" in config, config
+        assert "server.port=4441" in config, config
+        assert "framework.server.url=http://rundeck:4441" in framework, framework
+
+    with subtest("Structural settings end up in the generated config"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+
+        assert "dataSource.driverClassName=org.h2.Driver" in config, config
+        assert "dataSource.dialect=org.hibernate.dialect.H2Dialect" in config, config
+
+    with subtest("Server UUID is generated and substituted"):
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "@SERVER_UUID@" not in framework, framework
+        rundeck.succeed(
+            "grep -qE '^rundeck\\.server\\.uuid = [0-9a-f-]{36}$'"
+            " /etc/rundeck/framework.properties"
+        )
+
+    with subtest("Secrets are substituted and not world-readable"):
+        rundeck.succeed(
+            "grep -qxF 'testadmin:testpassword,user,admin'"
+            " /etc/rundeck/realm.properties"
+        )
+        rundeck.fail("grep -q '@ADMIN_PASSWORD@' /etc/rundeck/realm.properties")
+        rundeck.succeed(
+            "[ \"$(stat -c %a /etc/rundeck/realm.properties)\" = 600 ]"
+        )
+        rundeck.succeed(
+            "[ \"$(stat -c %U /etc/rundeck/realm.properties)\" = rundeck ]"
+        )
+
+    with subtest("API authentication via form login"):
+        login_and_verify_api(rundeck, "rundeck", 4441, "testadmin", "testpassword")
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -X POST"
+            " -H 'Accept: application/json'"
+            " -H 'Content-Type: application/json'"
+            " -d '{\"name\":\"test-project\",\"config\":{}}'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e '.name == \"test-project\"'"
+        )
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e 'any(.[]; .name == \"test-project\")'"
+        )
+  '';
+}

nixos/tests/scion/freestanding-deployment/default.nix

@@ -122,7 +122,7 @@ in
           ret=0
           for as in "$@"
           do
-            scion ping "$as,127.0.0.1" -c 3
+            scion ping --sciond default "$as,127.0.0.1" -c 3
             ret=$?
             if [ "$ret" -ne "0" ]; then
               break

nixos/tests/scion/freestanding-deployment/topology1.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.1:50014",
+            "local": "192.168.1.1:50014",
             "remote": "192.168.1.4:50014"
           },
           "isd_as": "42-ffaa:1:4",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.1:50012",
+            "local": "192.168.1.1:50012",
             "remote": "192.168.1.2:50012"
           },
           "isd_as": "42-ffaa:1:2",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.1:50013",
+            "local": "192.168.1.1:50013",
             "remote": "192.168.1.3:50013"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/scion/freestanding-deployment/topology2.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.2:50012",
+            "local": "192.168.1.2:50012",
             "remote": "192.168.1.1:50012"
           },
           "isd_as": "42-ffaa:1:1",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.2:50023",
+            "local": "192.168.1.2:50023",
             "remote": "192.168.1.3:50023"
           },
           "isd_as": "42-ffaa:1:3",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.2:50025",
+            "local": "192.168.1.2:50025",
             "remote": "192.168.1.5:50025"
           },
           "isd_as": "42-ffaa:1:5",

nixos/tests/scion/freestanding-deployment/topology3.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.3:50013",
+            "local": "192.168.1.3:50013",
             "remote": "192.168.1.1:50013"
           },
           "isd_as": "42-ffaa:1:1",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.3:50023",
+            "local": "192.168.1.3:50023",
             "remote": "192.168.1.2:50023"
           },
           "isd_as": "42-ffaa:1:2",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.3:50034",
+            "local": "192.168.1.3:50034",
             "remote": "192.168.1.4:50034"
           },
           "isd_as": "42-ffaa:1:4",
@@ -48,7 +48,7 @@
         },
         "4": {
           "underlay": {
-            "public": "192.168.1.3:50035",
+            "local": "192.168.1.3:50035",
             "remote": "192.168.1.5:50035"
           },
           "isd_as": "42-ffaa:1:5",

nixos/tests/scion/freestanding-deployment/topology4.json

@@ -19,7 +19,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.4:50014",
+            "local": "192.168.1.4:50014",
             "remote": "192.168.1.1:50014"
           },
           "isd_as": "42-ffaa:1:1",
@@ -28,7 +28,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.4:50034",
+            "local": "192.168.1.4:50034",
             "remote": "192.168.1.3:50034"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/scion/freestanding-deployment/topology5.json

@@ -19,7 +19,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.5:50025",
+            "local": "192.168.1.5:50025",
             "remote": "192.168.1.2:50025"
           },
           "isd_as": "42-ffaa:1:2",
@@ -28,7 +28,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.5:50035",
+            "local": "192.168.1.5:50035",
             "remote": "192.168.1.3:50035"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/scx/default.nix

@@ -20,7 +20,6 @@
       flow.configuration.services.scx.scheduler = "scx_flow";
       forge.configuration.services.scx.scheduler = "scx_forge";
       lavd.configuration.services.scx.scheduler = "scx_lavd";
-      mlfq.configuration.services.scx.scheduler = "scx_mlfq";
       p2dq.configuration.services.scx.scheduler = "scx_p2dq";
       pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
       rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
@@ -41,7 +40,6 @@
       "flow",
       "forge",
       "lavd",
-      "mlfq",
       "p2dq",
       "pandemonium",
       "rlfifo",

nixos/tests/systemd-coredump.nix

@@ -4,15 +4,6 @@ let
 
   crasher = pkgs.writeCBin "crasher" "int main;";
 
-  commonConfig = {
-    systemd.services.crasher.serviceConfig = {
-      ExecStart = "${crasher}/bin/crasher";
-      StateDirectory = "crasher";
-      WorkingDirectory = "%S/crasher";
-      Restart = "no";
-    };
-  };
-
 in
 
 {
@@ -21,40 +12,33 @@ in
     maintainers = [ ];
   };
 
-  nodes.machine1 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.settings.Coredump = {
+  nodes.machine = {
+    systemd = {
+      services.crasher.serviceConfig = {
+        ExecStart = "${crasher}/bin/crasher";
+        StateDirectory = "crasher";
+        WorkingDirectory = "%S/crasher";
+        Restart = "no";
+      };
+
+      coredump.settings.Coredump = {
         Storage = "journal";
         ProcessSizeMax = "0";
       };
     };
-  nodes.machine2 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.enable = false;
-      systemd.package = pkgs.systemd.override {
-        withCoredump = false;
-      };
-    };
+  };
 
   testScript = ''
     with subtest("systemd-coredump enabled"):
-      machine1.wait_for_unit("multi-user.target")
-      machine1.wait_for_unit("systemd-coredump.socket")
-      machine1.systemctl("start crasher");
-      machine1.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
-      machine1.fail("stat /var/lib/crasher/core*")
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("systemd-coredump.socket")
+      machine.systemctl("start crasher");
+      machine.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
+      machine.fail("stat /var/lib/crasher/core*")
 
     with subtest("settings.Coredump renders coredump.conf"):
-      machine1.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
-
-    with subtest("systemd-coredump disabled"):
-      machine2.systemctl("start crasher");
-      machine2.wait_until_succeeds("stat /var/lib/crasher/core*", timeout=10)
+      machine.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
   '';
 }

nixos/tests/thelounge.nix

@@ -1,4 +1,4 @@
-import ./make-test-python.nix {
+{
   name = "thelounge";
 
   nodes = {

nixos/tests/web-apps/netbox-upgrade.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_4";
-  newNetbox = "netbox_4_5";
+  oldNetbox = "netbox_4_5";
+  newNetbox = "netbox_4_6";
 
   apiVersion =
     version:

nixos/tests/wine.nix

@@ -1,28 +1,25 @@
 {
-  system ? builtins.currentSystem,
-  pkgs ? import ../.. {
-    inherit system;
-    config = { };
-  },
+  pkgs,
+  lib,
+  runTest,
 }:
 
 let
-  inherit (pkgs.lib)
+  inherit (lib)
     concatMapStrings
     listToAttrs
     optionals
     optionalString
     ;
-  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
 
   hello32 = "${pkgs.pkgsCross.mingw32.hello}/bin/hello.exe";
   hello64 = "${pkgs.pkgsCross.mingwW64.hello}/bin/hello.exe";
 
   makeWineTest = packageSet: exes: variant: rec {
     name = "${packageSet}-${variant}";
-    value = makeTest {
+    value = runTest {
       inherit name;
-      meta = with pkgs.lib.maintainers; {
+      meta = with lib.maintainers; {
         maintainers = [ chkno ];
       };
 
@@ -74,6 +71,6 @@ listToAttrs (
       ])
       # This wayland combination times out after spending many hours.
       # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
-      (pkgs.lib.remove "wayland" variants)
+      (lib.remove "wayland" variants)
   )
 )

pkgs/applications/editors/emacs/sources.nix

@@ -107,10 +107,10 @@ in
 {
   emacs31 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "31.1-rc1";
+    version = "31.1";
     variant = "mainline";
-    rev = "emacs-31.1-rc1";
-    hash = "sha256-ZNCYFfMA2f14p57g/LdG6YK7nwUio8fdXmllkChMOSc=";
+    rev = "emacs-31.1";
+    hash = "sha256-lFT5Vt49G17t/fRm5yppO5p9ui10I9JNJVaGO1GPZFI=";
   });
 
   emacs30 = import ./make-emacs.nix (mkArgs {

pkgs/applications/editors/vim/plugins/generated.nix

@@ -262,20 +262,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  link-vim = buildVimPlugin {
-    pname = "link.vim";
-    version = "2.0.3";
-    src = fetchFromGitHub {
-      owner = "qadzek";
-      repo = "link.vim";
-      tag = "v2.0.3";
-      hash = "sha256-YjKFDv9QyuWDfWiKP6EvjSRbkz/K6e/Neq76ckghKh0=";
-    };
-    meta.homepage = "https://github.com/qadzek/link.vim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   LuaSnip-snippets-nvim = buildVimPlugin {
     pname = "LuaSnip-snippets.nvim";
     version = "0-unstable-2022-03-17";
@@ -475,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-20";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "cef8d093b63c9be7e8b49f7dc341e8447fc4c300";
-      hash = "sha256-yNlPcjlfjt+RxK/XVuVLbuKgZF++X/mKSfuV03dXT8c=";
+      rev = "73e89eb3e536a4dd8f991c963bd37189520c9919";
+      hash = "sha256-64QPVE298/XHx+UZeuvh5GndxiLgzWn1WfLJLBeZJKQ=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -897,12 +883,12 @@ final: prev: {
 
   ale = buildVimPlugin {
     pname = "ale";
-    version = "4.0.0-unstable-2026-08-19";
+    version = "4.0.0-unstable-2026-08-21";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "1c6e71732f3811197ec21cd6d3130791955ca80a";
-      hash = "sha256-Zqd7QD/rGV2GZNjyK05Zj2nVBYdHvAXo7ooE4yA/FnI=";
+      rev = "e1789bc54483d76ac9ddb40b633d1645c8281914";
+      hash = "sha256-aW0Gs10xe0sKptS7tPee/n9RoZRfrnZQKYd5X+MfEEk=";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
     meta.license = getLicenseFromSpdxId "BSD-2-Clause";
@@ -1093,12 +1079,12 @@ final: prev: {
 
   astrocore = buildVimPlugin {
     pname = "astrocore";
-    version = "3.0.8";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "AstroNvim";
       repo = "astrocore";
-      tag = "v3.0.8";
-      hash = "sha256-xpO2fcUuzZneBMLfykQpyknWU3pE7mrEZBZtGX+/QTw=";
+      tag = "v3.1.0";
+      hash = "sha256-ALLA4JVCfn1VS24uZEVkSN3wTW3df3RlmSQLbpn+pPk=";
     };
     meta.homepage = "https://github.com/AstroNvim/astrocore/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -2129,12 +2115,12 @@ final: prev: {
 
   bluloco-nvim = buildVimPlugin {
     pname = "bluloco.nvim";
-    version = "1.4.0-unstable-2026-08-19";
+    version = "1.4.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "uloco";
       repo = "bluloco.nvim";
-      rev = "424f5ea3c5f92423cbb8e32941e86919005fb4ab";
-      hash = "sha256-HHqLxD+aKIaCh5fFRfT4SlCrO48jhe1YVnXwQfoizqs=";
+      rev = "8973f4b595a96ceb45b3885d533f287182a73c20";
+      hash = "sha256-nBZCvS9LU/09cs8u92a+FBhMaMuG2LGldGxO+IfFMHo=";
     };
     meta.homepage = "https://github.com/uloco/bluloco.nvim/";
     meta.license = getLicenseFromSpdxId "LGPL-3.0-only";
@@ -3513,15 +3499,15 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-08-19";
+    version = "0.0.82-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "d7cf12d0dc873fcd276e89dff4e7c4949e3e5793";
-      hash = "sha256-X3baNWAjKwHusfDwRHbQSs7PUspVDVnA/DC0SsNr6KQ=";
+      rev = "95073dab304d4c35fd468c0eb57f4bfe25bf8eda";
+      hash = "sha256-9Z55Npuz64nUJoPXLH+FAD3litfXq8+Oahvd7GT9hus=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
-    meta.license = unfree;
+    meta.license = getLicenseFromSpdxId "MIT";
     meta.hydraPlatforms = [ ];
   };
 
@@ -4228,12 +4214,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-08-10";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "46c9880110511bcfe8598d368de07b8c488d1d19";
-      hash = "sha256-WW+oWMaXiY85GBOOnQV2rhikGNOa1NsqPjIkx3pqpRQ=";
+      rev = "f8ca1cde7fd7027a3ad5609295fc61931e987ea5";
+      hash = "sha256-CfBmu8Q8x6iW1kliLId45kps/RjxNnCeNigGIMW60Z4=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -5490,12 +5476,12 @@ final: prev: {
 
   easy-dotnet-nvim = buildVimPlugin {
     pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-08-18";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "GustavEikaas";
       repo = "easy-dotnet.nvim";
-      rev = "0a8cfb96e40b985921e6613f31f75811e31b8edf";
-      hash = "sha256-8KjAdKYAXQHrJ2ISBv0Eu4hl696fiz09c8yCtNPr2OY=";
+      rev = "7765221c078267bad975fdca307776ecc01c69cc";
+      hash = "sha256-x/NXqklLsCZraLzj6gUCTMPx54VWmEgPYIr5XfntAcE=";
     };
     meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6052,12 +6038,12 @@ final: prev: {
 
   flash-nvim = buildVimPlugin {
     pname = "flash.nvim";
-    version = "2.1.0-unstable-2026-07-10";
+    version = "2.1.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "flash.nvim";
-      rev = "b6346946d10d07998efee029fb0f7a593806d0cd";
-      hash = "sha256-1v2+iq4/TnJq37iiGedIKFf6PxlTHQac8RXECZ2HYdM=";
+      rev = "5f0f270fdc7c5b0c21d903ee85b9cb06f2ac636a";
+      hash = "sha256-88DoXkz8M6ehkzS9VNu2/T0FENpduTbgiUZd+GeVVX4=";
     };
     meta.homepage = "https://github.com/folke/flash.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -6347,12 +6333,12 @@ final: prev: {
 
   fugitive-gitlab-vim = buildVimPlugin {
     pname = "fugitive-gitlab.vim";
-    version = "0-unstable-2024-11-13";
+    version = "0-unstable-2026-08-20";
     src = fetchFromGitHub {
       owner = "shumphrey";
       repo = "fugitive-gitlab.vim";
-      rev = "3584cf7e607ba7822f991d407a8d780e05aae287";
-      hash = "sha256-bjKPh7EwA6wtp0lilaUA7f5b1VarR9QWFBuJm1j8Qfo=";
+      rev = "effc1fcb81803aa9c1322b089c7f7a2b53cf3dcc";
+      hash = "sha256-S+9xAHtlOlye/RgiLOPL5yNtyNJvwtkY2ihvdfVTmF4=";
     };
     meta.homepage = "https://github.com/shumphrey/fugitive-gitlab.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8643,12 +8629,12 @@ final: prev: {
 
   lazy-lsp-nvim = buildVimPlugin {
     pname = "lazy-lsp.nvim";
-    version = "2025.12.19-unstable-2026-03-12";
+    version = "2026.08.22";
     src = fetchFromGitHub {
       owner = "dundalek";
       repo = "lazy-lsp.nvim";
-      rev = "e2599ac3d2ee3b0c38d11edf1c01ce7e846f0079";
-      hash = "sha256-70roDFHMY2MB2d7wPrPbWdLqhr8r8TMkYTpaGI/GRRU=";
+      tag = "2026.08.22";
+      hash = "sha256-ZycJy86HJNLSAax2hSKvddbLvsOLL40a0NVZ+s2pQUM=";
     };
     meta.homepage = "https://github.com/dundalek/lazy-lsp.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8769,11 +8755,11 @@ final: prev: {
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-21";
     src = fetchgit {
       url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "e51ba2a70169bb6fd58342312ccde591242ac739";
-      hash = "sha256-0gF993CXulPD5LQhgV6VeDI8ToNkTl/SlXucFkUE6Vk=";
+      rev = "7884f9455e5bf07bd11a3dcd9f961095a966a5d7";
+      hash = "sha256-SwzjzwlGmFyV+iHprqrpbnLWVxgA8w5a8uJvbSu00d0=";
     };
     meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
     meta.license = unfree;
@@ -9060,6 +9046,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  link-vim = buildVimPlugin {
+    pname = "link.vim";
+    version = "2.0.3";
+    src = fetchFromGitHub {
+      owner = "qadzek";
+      repo = "link.vim";
+      tag = "v2.0.3";
+      hash = "sha256-YjKFDv9QyuWDfWiKP6EvjSRbkz/K6e/Neq76ckghKh0=";
+    };
+    meta.homepage = "https://github.com/qadzek/link.vim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   lir-nvim = buildVimPlugin {
     pname = "lir.nvim";
     version = "0-unstable-2026-03-29";
@@ -9202,12 +9202,12 @@ final: prev: {
 
   llama-vim = buildVimPlugin {
     pname = "llama.vim";
-    version = "0-unstable-2026-08-18";
+    version = "0.1.0";
     src = fetchFromGitHub {
       owner = "ggml-org";
       repo = "llama.vim";
-      rev = "93f8106ed7657859d7eefebdb210edad515e9463";
-      hash = "sha256-qv8E4Y8UkyQxdGFciLuPE0JQB3G42dI80n7P/ATY2lU=";
+      tag = "v0.1.0";
+      hash = "sha256-3g0Q4GZU1w5mHR6jQyx8kZyZ7aGclkB8giHZcIwIaY8=";
     };
     meta.homepage = "https://github.com/ggml-org/llama.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11190,12 +11190,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-08-14";
+    version = "1.4.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "8560c245f6a5bc7bb229c00d9d0627d02ef9b4e8";
-      hash = "sha256-ZYBigA6XdpPg3P9JhVgwsn9LaA05sGC7fJebrQDQv8k=";
+      rev = "93dc1293afc97c03ff7fecef654ba6d13e7e9f7e";
+      hash = "sha256-ixpdG8kxUOELP00mBTsXmpz6P6vXBpBXBDUNgW3+Qj0=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11274,12 +11274,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-27";
+    version = "3.0.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "37e0f22a2345bad1bffe01b31970885882f46275";
-      hash = "sha256-oyGGEbBCGr9mYeaG7siHl/Zz2HOBEKEkhQuwmJ2eA3o=";
+      rev = "5adc81b26232954cd7a90f158aa7844c18fc3165";
+      hash = "sha256-s0yrtTweFrrUsxVjLjr+1uNHTlhcxGI7JUvOkrpt13g=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12494,12 +12494,12 @@ final: prev: {
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "0.10.0-unstable-2026-05-08";
+    version = "0.10.0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "7b9923abad60b903ece7c52940e1321d39eccc79";
-      hash = "sha256-klOJgBPw8oGDnF9wKIpGDzuBY+tH1acRyvZSPR4wrjw=";
+      rev = "430522f95fe4fb7c511ec64f8c1a90cc6a66c05c";
+      hash = "sha256-WSSuk2lmBefKTseLDa/AwBUPEsjYsG41SYepPZw/rpM=";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13273,11 +13273,11 @@ final: prev: {
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "05-unstable-2026-08-17";
+    version = "05-unstable-2026-08-20";
     src = fetchgit {
       url = "https://codeberg.org/mfussenegger/nvim-lint/";
-      rev = "5b5b794458b5ff0b17d26c9d7400faaebd00b32d";
-      hash = "sha256-r143wOn0EK28H2uH6rCFnPVy0h8okUbhsNv0o/xsqZ8=";
+      rev = "0370fe965697aa8f04252a1562441bdc13723cd1";
+      hash = "sha256-MhQOZe4/FxcZUudadSRl7tfyxE8lazUq7RekhJT28rE=";
     };
     meta.homepage = "https://codeberg.org/mfussenegger/nvim-lint/";
     meta.license = unfree;
@@ -13916,12 +13916,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-08-15";
+    version = "0.10.0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "074aa4422bf029908338e855d0c0f71470a971bb";
-      hash = "sha256-gfysRZAwKXSLZpO8AhO1o3O93OwnzJTTbXhhdbbOJ7M=";
+      rev = "8b98b4470eb326f1c7b50dae79f8c963568e5720";
+      hash = "sha256-u+ESawp6hRUPYmgY+VVW3KpxhymC0Cy9ehgamRGXWSo=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14378,12 +14378,12 @@ final: prev: {
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "0-unstable-2026-07-30";
+    version = "0-unstable-2026-08-24";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "205f024d3ea4a3d81aac751b6bf8e2d01e0c204f";
-      hash = "sha256-p5s9JhujDEZezYYsNygi9ejI4qlxluRO3jYWFdJkSrw=";
+      rev = "37a416818c61bd2d150498e2f601744e5329e2eb";
+      hash = "sha256-gkb8jaSkxR7GumWtkD78zx9vtHPSgieoIUhDQgqTb1o=";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14630,12 +14630,12 @@ final: prev: {
 
   opencode-nvim = buildVimPlugin {
     pname = "opencode.nvim";
-    version = "0.14.0";
+    version = "1.0.0";
     src = fetchFromGitHub {
       owner = "nickjvandyke";
       repo = "opencode.nvim";
-      tag = "v0.14.0";
-      hash = "sha256-bAF3ssHly41AxqKEHFrsK9S1mTbrIZfEI3kzZ6alKXc=";
+      tag = "v1.0.0";
+      hash = "sha256-Au8vW7ISTH0jMxzgkRN3pFmLm4fMd9l27tBs1QH3v5c=";
     };
     meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15316,14 +15316,28 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  profile-nvim = buildVimPlugin {
+    pname = "profile.nvim";
+    version = "0-unstable-2025-03-05";
+    src = fetchFromGitHub {
+      owner = "stevearc";
+      repo = "profile.nvim";
+      rev = "30433d7513f0d14665c1cfcea501c90f8a63e003";
+      hash = "sha256-2Mk6VbC+K/WhTWF+yHyDhQKJhTi2rpo8VJsnO7ofHXs=";
+    };
+    meta.homepage = "https://github.com/stevearc/profile.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.0.1-1";
+    version = "6.0.2-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.0.1-1";
-      hash = "sha256-j6N2M6YUjnqrhQt8F/AoGb/cDUa5TQc/EV5xX5hGyic=";
+      tag = "v6.0.2-1";
+      hash = "sha256-LE66wEabvJuvCSy0FlWg0LE/5YDq2TaJpNIRVrU4NKE=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15977,11 +15991,11 @@ final: prev: {
 
   run-nvim = buildVimPlugin {
     pname = "run.nvim";
-    version = "2.0.0";
+    version = "2.01";
     src = fetchgit {
       url = "https://codeberg.org/ssnoer/run.nvim";
-      tag = "v2.0.0";
-      hash = "sha256-MTxhhcD6lHLJCfwaivKF9reeUrMog/8I2kJarNWz5Kk=";
+      tag = "v2.01";
+      hash = "sha256-/3ouvPsPoGhsotAP+l0r0AacA1KmC11Z3Ch4C3XdQNg=";
     };
     meta.homepage = "https://codeberg.org/ssnoer/run.nvim";
     meta.license = unfree;
@@ -16158,12 +16172,12 @@ final: prev: {
 
   scretch-nvim = buildVimPlugin {
     pname = "scretch.nvim";
-    version = "1.2.4";
+    version = "1.2.5";
     src = fetchFromGitHub {
       owner = "0xJohnnyboy";
       repo = "scretch.nvim";
-      tag = "v1.2.4";
-      hash = "sha256-FCv6EI/aYV/RDSeLGPSCkrAbNMfbTWVCIrmX+7tV+AE=";
+      tag = "v1.2.5";
+      hash = "sha256-Gz5jW8K3Ysjm3yzadyKkFusyRvGVMIMXxWsiXDCGMs8=";
     };
     meta.homepage = "https://github.com/0xJohnnyboy/scretch.nvim/";
     meta.license = getLicenseFromSpdxId "AGPL-3.0-only";
@@ -16439,12 +16453,12 @@ final: prev: {
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2.1.0-unstable-2026-08-14";
+    version = "2.1.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "289971cfdbc7f7b1c91670a228b239d870130af7";
-      hash = "sha256-o7CFObuVo1O39v66wRRc7Kn8E1Hu51d59nkQBGAbmks=";
+      rev = "5e92431aa7f5e618c2f6825f682df6d94f6e0a02";
+      hash = "sha256-BoFfH4a5I8XnC8OIrXP+y6cp9+N+iPY9PbpcUk4VzQg=";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16579,12 +16593,12 @@ final: prev: {
 
   solarized-osaka-nvim = buildVimPlugin {
     pname = "solarized-osaka.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-24";
     src = fetchFromGitHub {
       owner = "craftzdog";
       repo = "solarized-osaka.nvim";
-      rev = "7be007658c1ba2ce303c004613e09af16efb5157";
-      hash = "sha256-+q15fTk3B5bVkHCc6uTvnAVzoM+Zo27OrFQ7QVuqzn4=";
+      rev = "476f0e7725598b752a673d7d6a6e9776bde4f6fe";
+      hash = "sha256-bdxQqayM8uhr9v1jJmjAEnC6NW8wrjNfwl71gLU4CCg=";
     };
     meta.homepage = "https://github.com/craftzdog/solarized-osaka.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -21012,12 +21026,12 @@ final: prev: {
 
   vim-floaterm = buildVimPlugin {
     pname = "vim-floaterm";
-    version = "0-unstable-2026-05-07";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "bb4ba7952e906408e1f83b215f55ffe57efcade6";
-      hash = "sha256-JEd8XR1LsY7Xb32dx+TSa961sxSfF+OHewBxiCSFRYs=";
+      rev = "0e8e95f7be74b900bc7d3bc54d9b65211b264ace";
+      hash = "sha256-1aITnfEL8Ea8E5/QNqrGrQJbMJD3kGyiIsI+/zbgbo8=";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21320,12 +21334,12 @@ final: prev: {
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "1.29-unstable-2026-07-24";
+    version = "1.29-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "bd1fcfeb79908001ff2a6f4b382a5a55da5ce11e";
-      hash = "sha256-teM/RaFh80SX9SVvefIeIr+SQ33qJe718xAfnmQWjbg=";
+      rev = "47694979496d4bf2e90ce75d95f1dec3f41cbefb";
+      hash = "sha256-AYeQpADkdGbTNGhzmxquttD+s15yHENVUKfNKgzX1vM=";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
     meta.license = unfree;
@@ -21362,11 +21376,11 @@ final: prev: {
 
   vim-graphql = buildVimPlugin {
     pname = "vim-graphql";
-    version = "1.6-unstable-2026-07-25";
+    version = "1.6-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "jparise";
       repo = "vim-graphql";
-      rev = "642c9931d6a4634f9cf9a1a91f450dc1a52a9d68";
+      rev = "ebea1e6bc93e85aa71848112b8a42f95468ac566";
       hash = "sha256-hN+YE6PQnApdK5dKERJBVpKepicYIgsfY5mpZiiOcfE=";
     };
     meta.homepage = "https://github.com/jparise/vim-graphql/";
@@ -22876,12 +22890,12 @@ final: prev: {
 
   vim-nixhash = buildVimPlugin {
     pname = "vim-nixhash";
-    version = "0-unstable-2026-08-16";
+    version = "0-unstable-2026-08-21";
     src = fetchFromGitHub {
       owner = "symphorien";
       repo = "vim-nixhash";
-      rev = "dd7b80f326b3a6b48d591dafdcf2648a6e279ad4";
-      hash = "sha256-9dJJ/zVIDtWdWOaRvx2wYm/nDnPpxyFtnAVSEteBMgs=";
+      rev = "16838857bb236051f02642e7cd999cbeebb9113d";
+      hash = "sha256-5gSHIvJ9mWs28HAmd6jSvpusonFaJ/Rb3PRBz/T0Ja4=";
     };
     meta.homepage = "https://github.com/symphorien/vim-nixhash/";
     meta.license = unfree;
@@ -26223,12 +26237,12 @@ final: prev: {
 
   zen-nvim = buildVimPlugin {
     pname = "zen.nvim";
-    version = "0-unstable-2026-07-18";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "sand4rt";
       repo = "zen.nvim";
-      rev = "cc7306e9ea479b19e8ef4c5fba35b4efd4b66692";
-      hash = "sha256-ZFuhNDVmUU7A02w/rzDn8uze7ivHVu2GI3+6PyIxAgE=";
+      rev = "9ae3ce3cac4cf88b4369a8ec789aa755882f5cc9";
+      hash = "sha256-jJCtzZ4J4SsVMUK7wuVdh8fLbCKTzJQgEN2K/gGHqkY=";
     };
     meta.homepage = "https://github.com/sand4rt/zen.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26320,12 +26334,12 @@ final: prev: {
 
   zotcite = buildVimPlugin {
     pname = "zotcite";
-    version = "0.7-unstable-2026-08-19";
+    version = "0.7-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "jalvesaq";
       repo = "zotcite";
-      rev = "b8b96a33dac53b8e9ed3a0a645ca14555fa1404d";
-      hash = "sha256-0jpgvZTU5hPd1wwyNiwAf17hV0XtnPMfNP1IvYk+A1k=";
+      rev = "04942208ff371972ddcd9089b6c50b6941b956e4";
+      hash = "sha256-UIdLbcchrf9dfRn6Xoo+VhLnSGBQiGWfEylCVRzMNNA=";
     };
     meta.homepage = "https://github.com/jalvesaq/zotcite/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -1,5 +1,5 @@
 # generated by pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
-# Using parser data from https://github.com/nvim-neorocks/nurr/blob/main/tree-sitter-parsers.json
+# Using parser data from ${vimPlugins.nvim-treesitter}/lua/nvim-treesitter/parsers.lua
 
 {
   buildGrammar,
@@ -63,12 +63,12 @@
     };
     apex = buildGrammar {
       language = "apex";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "apex";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@@ -1559,12 +1559,12 @@
     };
     json = buildGrammar {
       language = "json";
-      version = "0.0.0+rev=001c28d";
+      version = "0.0.0+rev=254c42a";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-json";
-        rev = "001c28d7a29832b06b0e831ec77845553c89b56d";
-        hash = "sha256-cUjbN+e8UtoLRm8ZnxG7iRGD5YIc032RbHBIlmV8aLc=";
+        rev = "254c42a6476413b776221e03982ac8ae159eeb72";
+        hash = "sha256-gK4suNfS1Olq3pONPSH+Uyn820ru5TQqgl5q3wN/ADU=";
       };
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=0169d92";
+      version = "0.0.0+rev=fa565a3";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "0169d92b0a93e9f32289533ef23abdafca579e56";
-        hash = "sha256-eFdZxTIHijT6IuOjyIlElfr2HBU+BdOKJsIA1COmW9g=";
+        rev = "fa565a337b673050ba4f1131d21a1d259153140b";
+        hash = "sha256-UjFgw3AUDvsFLBdAh/zbQDjpZL1qBlCFMyxx3VVmXfM=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -1931,12 +1931,12 @@
     };
     mlir = buildGrammar {
       language = "mlir";
-      version = "0.0.0+rev=5085767";
+      version = "0.0.0+rev=e9f60f9";
       src = fetchFromGitHub {
         owner = "artagnon";
         repo = "tree-sitter-mlir";
-        rev = "50857672166f6ba1efceb05c4ec82877d72b4043";
-        hash = "sha256-50APhoj6Q7wGxPO1r3EuuapRcFXg6FnUve6aOaArKy4=";
+        rev = "e9f60f952a8807f5769c51de14e44625c24a00f8";
+        hash = "sha256-sjTGATP+hddYi1Hg6dF30P0RNlCSXIWXx+aUHEtk7wg=";
       };
       generate = true;
       meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2214,12 +2214,12 @@
     };
     pkl = buildGrammar {
       language = "pkl";
-      version = "0.0.0+rev=3486521";
+      version = "0.0.0+rev=65f4483";
       src = fetchFromGitHub {
         owner = "apple";
         repo = "tree-sitter-pkl";
-        rev = "3486521eb1c2fcb3c9a5e88300215930ee515693";
-        hash = "sha256-bQNSSDVVi0kmsIlpmI+7LWf8/SrXylAyEju/DAahqzg=";
+        rev = "65f4483b9e8a5960a4d8948421ef3a8992013517";
+        hash = "sha256-+SjtOZBSaVrH2FdWmc+ciG8c/TNT6G3XEalYy3F+SQ8=";
       };
       meta.homepage = "https://github.com/apple/tree-sitter-pkl";
     };
@@ -2472,12 +2472,12 @@
     };
     racket = buildGrammar {
       language = "racket";
-      version = "0.0.0+rev=e2b8064";
+      version = "0.0.0+rev=b3cbbde";
       src = fetchFromGitHub {
         owner = "6cdh";
         repo = "tree-sitter-racket";
-        rev = "e2b8064b32ab1dfa30532aeac1577ae4c1cc3df5";
-        hash = "sha256-NuEFNKoP2JaodFfX/8wizLC3xjKPvLwHIgefzI5oXMg=";
+        rev = "b3cbbde75ce2de3079e33c7fe90bd41b1d45be48";
+        hash = "sha256-QSlMxijWwYOtZPjZF1KpqLXbmu15e2g7JXp6ABaP6AY=";
       };
       meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
     };
@@ -2560,12 +2560,12 @@
     };
     rego = buildGrammar {
       language = "rego";
-      version = "0.0.0+rev=7f8a431";
+      version = "0.0.0+rev=da2a1f6";
       src = fetchFromGitHub {
         owner = "FallenAngel97";
         repo = "tree-sitter-rego";
-        rev = "7f8a43138951a13832919312290147bd175180cd";
-        hash = "sha256-kBTK6IjEnMnSPIF964GmTv6m+RukfP2TLcPHqHnxyIc=";
+        rev = "da2a1f63cd877efb05d56de61fe516e90012b9a7";
+        hash = "sha256-FIZsxmP66BNAzYRba5ExOeEtQBU5fm/uKH+P4TvxL/s=";
       };
       meta.homepage = "https://github.com/FallenAngel97/tree-sitter-rego";
     };
@@ -2703,12 +2703,12 @@
     };
     scala = buildGrammar {
       language = "scala";
-      version = "0.0.0+rev=4799cfc";
+      version = "0.0.0+rev=d699806";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-scala";
-        rev = "4799cfc8543145b5ad79fdb81a6e6996cca97af2";
-        hash = "sha256-NJKAcvLDHwiejybDBgFOJOzTtCXgoVUbgIWmBX0eehk=";
+        rev = "d69980656ee2be375596d9d013d64e1d29aa7d8f";
+        hash = "sha256-eENBlIE3lXGCBNuYWqRQaHzdUXlHbqWeq6aBO/OD+Is=";
       };
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
     };
@@ -2750,12 +2750,12 @@
     };
     sflog = buildGrammar {
       language = "sflog";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "sflog";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@@ -2850,36 +2850,36 @@
     };
     soql = buildGrammar {
       language = "soql";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "soql";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
     };
     sosl = buildGrammar {
       language = "sosl";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "sosl";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
     };
     sourcepawn = buildGrammar {
       language = "sourcepawn";
-      version = "0.0.0+rev=fdf3113";
+      version = "0.0.0+rev=d6c8a08";
       src = fetchFromGitHub {
         owner = "nilshelmig";
         repo = "tree-sitter-sourcepawn";
-        rev = "fdf31136774c5d182344305e7f3605d77fa4084f";
-        hash = "sha256-3+NcSLxz16g80CY4PosyekiQk21p+Fj/+o8Xr3fIuqk=";
+        rev = "d6c8a0801f3becf95cc232003b53c82f9267e8b7";
+        hash = "sha256-FmVOiJDOGDgw/Uju1PZZkG7hsy/6u3XTRUCycpbZ7M8=";
       };
       meta.homepage = "https://github.com/nilshelmig/tree-sitter-sourcepawn";
     };
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=85d1773";
+      version = "0.0.0+rev=172ada1";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "85d1773baf6e53de3722f2035fd3a9e7b03bf8d9";
-        hash = "sha256-l7bIJ2YgRcQigv7RWCTe37LxbGpdro/+q0ScjrzL3iY=";
+        rev = "172ada1cc4117d0260d9340680b4134adba2bc2c";
+        hash = "sha256-6N4w0fMpc2e/D3/2rxNbO9e/MJzrgbZwTbVQrUlgkpw=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3417,12 +3417,12 @@
     };
     vhdl = buildGrammar {
       language = "vhdl";
-      version = "0.0.0+rev=68dc07f";
+      version = "0.0.0+rev=f87f5e4";
       src = fetchFromGitHub {
         owner = "jpt13653903";
         repo = "tree-sitter-vhdl";
-        rev = "68dc07f69d9571c2ebea6b32f995925905d09741";
-        hash = "sha256-TWn6KXkn+FTIATpATrMTCWk8HknZCUEK0dllkljP/z4=";
+        rev = "f87f5e4874dd05efb7a8ccf0a337b14c48d20903";
+        hash = "sha256-/pJC3AYOF3rwMFfDmmkt7HMFdNxkA9iDENCovw46vcY=";
       };
       meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
     };
@@ -3527,12 +3527,12 @@
     };
     wxml = buildGrammar {
       language = "wxml";
-      version = "0.0.0+rev=7b821c7";
+      version = "0.0.0+rev=1cc1761";
       src = fetchFromGitHub {
         owner = "BlockLune";
         repo = "tree-sitter-wxml";
-        rev = "7b821c748dc410332f59496c0dea2632168c4e5a";
-        hash = "sha256-ZJeBKccEreak/Fs/Zi5E3m2S//s2R54KwFK3atoCvf0=";
+        rev = "1cc1761c8c11cacab5516dbe64e20ee689aa4428";
+        hash = "sha256-RoeEY/Xc8bP+0/l9cQgCejyB5nPLdK6CYlOoVEjIiik=";
       };
       meta.homepage = "https://github.com/BlockLune/tree-sitter-wxml";
     };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -17,7 +17,6 @@ https://github.com/vigoux/LanguageTool.nvim/,,
 https://github.com/LazyVim/LazyVim/,,
 https://github.com/Yggdroot/LeaderF/,,
 https://github.com/goropikari/LibDeflate.nvim/,,
-https://github.com/qadzek/link.vim/,,
 https://github.com/molleweide/LuaSnip-snippets.nvim/,,
 https://github.com/Valloric/MatchTagAlways/,,
 https://github.com/numToStr/Navigator.nvim/,,
@@ -645,6 +644,7 @@ https://github.com/markgandolfo/lightswitch.nvim/,,
 https://github.com/junegunn/limelight.vim/,,
 https://github.com/AndrewRadev/linediff.vim/,,
 https://github.com/lf-lang/lingua-franca.vim/,,
+https://github.com/qadzek/link.vim/,,
 https://github.com/tamago324/lir.nvim/,,
 https://github.com/kkharji/lispdocs.nvim/,,
 https://github.com/ldelossa/litee-calltree.nvim/,,
@@ -1092,6 +1092,7 @@ https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,
 https://github.com/vim-scripts/prev_indent/,,
+https://github.com/stevearc/profile.nvim/,,
 https://github.com/DrKJeff16/project.nvim/,,
 https://github.com/GnikDroy/projections.nvim/,,
 https://github.com/kevinhwang91/promise-async/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oOytttotGI7f4RlnNBRM6TvXaXUht6v99Kzxc9GP404=";
+          hash = "sha256-Yabd8DFEh1wq0K4IQPFUBNFDkyHhXl695wSfKa5RX7k=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-9Ne1PGz0k1E1wY/HhoR5mqB3SFQiFkHt236+L5jXE60=";
+          hash = "sha256-gzMUtolNlNxFUofsL9JgOnaxfUGeSxFQY7C4smJ8fr8=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-2nwDsS4tVRikMZWZW4TKshQE7HVeQ/yY7CxpGg0os7w=";
+          hash = "sha256-U8S7U5sYj9LukYfmC2yyUjeenAYYHsMrx8snhXqATck=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.238";
+      version = "2.1.245";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1742,8 +1742,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.26";
-          hash = "sha256-Bt3ELE5jlR0CEn4UIGzx/8P6OTzN3Ckm6W13yD04fC4=";
+          version = "0.7.28";
+          hash = "sha256-aUmVt5zlDFt+c9BmfDkKHtdBMEumlG+Wupz8iW681Uw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
@@ -4591,8 +4591,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "110.3.0";
-          hash = "sha256-vVLnjFOpOmfmkwP0Yz7zONrBgpNDFfFZ0TAAicxdZ64=";
+          version = "110.3.1";
+          hash = "sha256-C3lJ7MO6GTJIotBa71vQN/L6A8iWZ9viYNniT6I2DMQ=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -5273,8 +5273,8 @@ let
         mktplcRef = {
           name = "volar";
           publisher = "Vue";
-          version = "3.3.9";
-          hash = "sha256-aJI96adY6ASvwtUY192i0okzxyBllCF4l3WYJ6lXbAc=";
+          version = "3.3.11";
+          hash = "sha256-wdELoM6czn0lrk9GdmBh55xUKXEXu5pkfaiRJvF06ew=";
         };
         meta = {
           changelog = "https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md";

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.1.8";
-    hash = "sha256-bhLnEsoifDQGHKCECTZ/BkAjuFQ9O9tODxzO2WMdybo=";
+    version = "4.1.12";
+    hash = "sha256-Wfo7CoFLcIE8yWSsfEtJ93VmIJ0TGlm1ZWF9BfK+38I=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-07-31";
+  version = "0-unstable-2026-08-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "b211204c7026dff6e86e79b00185512e2421fff8";
-    hash = "sha256-NfVgWG76T6cbb44F8Qva7rlwlsuhF8H6WtKjLPNfs7k=";
+    rev = "bebe2b13a840fbfd45cb501f5cd0efe01bdb1735";
+    hash = "sha256-z30s5uYhqBht7ZviljAu5WZlOCTS9sYqWBD2/hbWUbs=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-08-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ed640fac8986d7813e4db6604544a6aafddd3018";
-    hash = "sha256-dwat09yGQ0OnF8GaglqCVlgcoyAfqhleqD/mMlgHh1w=";
+    rev = "ef51860dbd71ad6b7ce67115d4780c2ee321d968";
+    hash = "sha256-Yzzh/1+ZcySuFwXCEravLjLRJHbIMpf3rr7Mj0p9JM0=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-supafaust";
-  version = "0-unstable-2026-07-22";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "supafaust";
-    rev = "d6187e5337e6c2646d003db3ab1936727ca75301";
-    hash = "sha256-r9sZGTpJo+jiEDZnzSgcwzBerI4BHL2p/WvJQpdW31g=";
+    rev = "642d1d1b6684aa7e306a02a89885f3f5456a5157";
+    hash = "sha256-malpQAapdRY/V4y2Csm36+Bo1WCRcAWnx4C4okC5S4k=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/bluemsx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-07-29";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "0f32f52c48d3e772bfdf0379756f81f00b4e08bc";
-    hash = "sha256-4XjaPkv5Tm58nhU6JUdiZXbto/uePljwXpcePRCqVus=";
+    rev = "e3086eb5d36d77fa11704cf53dc176686e70127d";
+    hash = "sha256-cwyXtawCUyM/ISswY+O3bzGFX0wNayb/VAIv99E9esI=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/desmume2015.nix

@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume2015";
-  version = "0-unstable-2026-07-26";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume2015";
-    rev = "1cc4f73f85cdf33be8338edb4ac519e5e66abc3b";
-    hash = "sha256-1dYVeNwBMHfa3BTv0vCV6n3TQvDEzQ76N9DTXLuJPmc=";
+    rev = "422b688009ccb9f2917c086a8fe79c8cecb030ae";
+    hash = "sha256-jkzUalzkrxNv3IfO3admuy5PwvOoMJ5RrJHE6T07oSE=";
   };
 
   extraBuildInputs = [

pkgs/applications/emulators/libretro/cores/gpsp.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2026-07-21";
+  version = "0-unstable-2026-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "5b6e751f4abf368509146cd143c949c1946ac1ae";
-    hash = "sha256-R9+cVqJWZHHyJ75fZXdz9xJSVCVOk1xuEs8kPUGkFDI=";
+    rev = "6b12231f03591e60deea389f7a122e594db61388";
+    hash = "sha256-fbKK6wsC+G0u6rWwqPsHSAtF9eAeTRn52Z1/aUhmqm8=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-08-12";
+  version = "0-unstable-2026-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "eb342748c828421bd15a1791162c885bfde61907";
-    hash = "sha256-R63AEUlUYh/xDsKCYQZermMYZvJtkDhyDqwr0yZ1Kfo=";
+    rev = "24cffe763621b164fc10be2ae3660f140be25182";
+    hash = "sha256-Gfdpt2R83SOZsD1iPYk6IWPmTEjmQdfdb2xMXSufF6c=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2026-08-13";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "5bbb84086c548a0ee0738f0b38966d7d4a5ff946";
-    hash = "sha256-fQ3wIylfkG6Q0LmU/mE3jc/GToubcXPJPSBKpBfThlY=";
+    rev = "dc1f391a830c085cb6e0a4bd732e0c2c69e13bbd";
+    hash = "sha256-xd/qhsqHaQQZFiBSt8vSNiNeWervywvYO8rxI2CTYZg=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2010.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-08-11";
+  version = "0-unstable-2026-08-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "421a8d9449031245f1dfdb632b84548a9f19fddd";
-    hash = "sha256-/F5/kU8zJzQGhy59c/0CwTM1Pb3aI9+iAWekwf74zDs=";
+    rev = "7db129b1ecdccb38cb4d7184bcbed39beed79656";
+    hash = "sha256-KvUseE8hYMv8W73gBYgzoFq5wklHHzU7B1DttBQS+yQ=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];

pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "2048";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-08-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-2048";
-    rev = "c90437d3c3913999624deca3fb55ecfa632b72c4";
-    hash = "sha256-dE3PanK+rpf01R4aoD3KMwVhEVvmmVS2klVPQUGTUC0=";
+    rev = "39333f7b13dc4daea7c151d9c38d22b961246343";
+    hash = "sha256-sMmRG126yg1diRPY1YMUfkTvwYjjTKyAXo367/CvcYo=";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -9,11 +9,11 @@
     "vendorHash": "sha256-RTfj2Omiqe92Ad0swEY/aGIMvcXb39bdQoObYKiekiw="
   },
   "a10networks_thunder": {
-    "hash": "sha256-mqCXiBtVHzEOdLW0KudPWJO6kGi0SiGawN/NQvjAJdg=",
+    "hash": "sha256-jwk2DKNYlYB6VJ9Y73SbLOcRzELqJTKbD0KOsrTqT3I=",
     "homepage": "https://registry.terraform.io/providers/a10networks/thunder",
     "owner": "a10networks",
     "repo": "terraform-provider-thunder",
-    "rev": "v1.6.0",
+    "rev": "v1.6.1",
     "spdx": "BSD-2-Clause",
     "vendorHash": null
   },
@@ -73,13 +73,13 @@
     "vendorHash": "sha256-L9IGENsL8Kibq5O/JOgCxLRUxgS7q9G/NovC/Q7tw48="
   },
   "auth0_auth0": {
-    "hash": "sha256-lqlQglt3zbNkoE4ORBWIq85r7/SYucIOPgIzJ7NrYaQ=",
+    "hash": "sha256-SpGTMAFEiJVGpXYAIigJQditDvs8sU2Bz57ohanccAM=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.54.1",
+    "rev": "v1.55.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gQHnTp3reX/1fmwQqjpqtjlb2z3wYk8E8vRf73jh48E="
+    "vendorHash": "sha256-ajl7q+9oA+NA5eqAXA5yjej03qdI5nimRNQW6GoGOq4="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -968,11 +968,11 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-dgOvrpgd6KWWJ55tZj69szSv/euafelfjEaAf19MbDY=",
+    "hash": "sha256-39GYcVZcUMkdn+IZd8IWQRw9Du6JszDxQGynsq1yBE4=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.96.2",
+    "rev": "v3.96.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ztdLwjNy91ldNc8/CamoKAHHg0JcNyCTq93vxDKYy7k="
   },
@@ -1040,13 +1040,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-6sziS47pZdVvcTlRtbGx0YId9UuTDOLL0EJyBo1Gqlc=",
+    "hash": "sha256-t2aiKujM84sfUJbXwHbDbRRQyw4Jc66sI0UI/QB0edI=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.37.3",
+    "rev": "v1.37.6",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ARdBbhC6F1LxZ+tXNMderJ65VKSubUmSBhtQb4SZqTY="
+    "vendorHash": "sha256-1CbQ4ufkwBOrGHW1f/6GnIDInuLcdHReE4o/Ck8Rnhs="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-YcKLw5PotrwRdGEmPzy1Ka/doJ9fDbKuP6Q9Dw24mG0=",
+    "hash": "sha256-3/apEon1W1iaB7UIkYgI4POV+f1uVDVXX4V6dyeqsLk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.27.0",
+    "rev": "v8.28.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1400,11 +1400,11 @@
     "vendorHash": "sha256-kM5itT82W2uy/y5uJkZsMH308LjRMSNKBJC09e5k5+8="
   },
   "turbot_turbot": {
-    "hash": "sha256-sJODPeFzU3vaiHbKlGe1dR5Pi7aS56JcmZUe8Yg1BcQ=",
+    "hash": "sha256-Az+eTY+eksfH89DGqTd8RVwD8KDztz6Bctm0Mt7GBN4=",
     "homepage": "https://registry.terraform.io/providers/turbot/turbot",
     "owner": "turbot",
     "repo": "terraform-provider-turbot",
-    "rev": "v1.13.3",
+    "rev": "v1.14.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/google-drive-ocamlfuse/default.nix

@@ -6,7 +6,7 @@
   extlib,
   fuse3,
   gapi-ocaml,
-  ocaml_sqlite3,
+  sqlite3,
   otoml,
   tiny_httpd,
   ounit2,
@@ -32,7 +32,7 @@ buildDunePackage (finalAttrs: {
     extlib
     fuse3
     gapi-ocaml
-    ocaml_sqlite3
+    sqlite3
     otoml
     tiny_httpd
   ];

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -28,7 +28,14 @@ let
       extraPatches = [
         # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
         (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
-      ];
+      ]
+      ++
+        lib.optional (lib.versionAtLeast version "154" && lib.versionOlder version "154.0.1")
+          (fetchpatch2 {
+            # Fix Success macros colliding: https://bugzilla.mozilla.org/show_bug.cgi?id=2065007
+            url = "https://github.com/mozilla-firefox/firefox/commit/f0b76eba072821d62e74ebdbd8da9243a2ce3b84.patch";
+            hash = "sha256-PCTmv1ZO7ce4q5fp+WPmy5Wga5OMY4hNzqIZ7iYCcp4=";
+          });
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
@@ -78,8 +85,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "153.0.3";
-    sha512 = "6a9271af8473fa6679d4943a35fab0a335e8eb736aebfab4d79e250578faf6090cda19e80708487bec7c2221242b059072dda9ca817478a6d76556594972202b";
+    version = "154.0";
+    sha512 = "aebdc5f0f4788124128a77b8a329767fa0f6d1d46c41ca6fd45889368e4e964a7a82a41f5367e825da0d544eff61d4da07dff2e6eb13f72c935bed79a184c5a8";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -105,8 +112,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.13.0esr";
-    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
+    version = "140.14.0esr";
+    sha512 = "4c95b1ca3fc7f6429b2360a7e732635bdfb60927622a7da4d8af9ca2abd550611b91763c587cddad5d51c0dd4e905ba8e106da3cd21591a1bec3dba1b9a2502d";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/applications/video/kodi/addons/controller-topology-project/default.nix

@@ -8,13 +8,13 @@
 let
   drv = stdenv.mkDerivation rec {
     pname = "controller-topology-project";
-    version = "1.0.13";
+    version = "1.0.14";
 
     src = fetchFromGitHub {
       owner = "kodi-game";
       repo = "controller-topology-project";
       rev = "v${version}";
-      sha256 = "sha256-i620L/ctKPaARgPDoXB+Pdii42KXe4WO+2Bnge0ZnrY=";
+      sha256 = "sha256-GfEnCx1DewxHipzblMBtnl2dsLewr87qLEi6R3CYh6Q=";
     };
 
     postPatch = ''

pkgs/build-support/bintools-wrapper/default.nix

@@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation {
       apple-sdk.__spliced.buildTarget or apple-sdk;
   };
 
+  __structuredAttrs = true;
+
   meta =
     let
       bintools_ = optionalAttrs (bintools != null) bintools;

pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix

@@ -9,7 +9,7 @@
 makeSetupHook {
   name = "dotnet-hook";
   substitutions = {
-    dotnetRuntime = dotnet-runtime;
+    dotnetRuntime = lib.defaultTo "" dotnet-runtime;
     wrapperPath = lib.makeBinPath [
       which
       coreutils

pkgs/build-support/release/default.nix

@@ -124,12 +124,16 @@ rec {
       name,
       constituents,
       meta ? { },
+      # Interpret string constituents as fnmatch patterns matched
+      # against all job names of the jobset.
+      globConstituents ? false,
     }:
     pkgs.runCommand name
       {
         inherit constituents meta;
         preferLocalBuild = true;
         _hydraAggregate = true;
+        _hydraGlobConstituents = globConstituents;
       }
       ''
         mkdir -p $out/nix-support

pkgs/build-support/trivial-builders/default.nix

@@ -735,7 +735,6 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-      __structuredAttrs ? false,
     }@args:
     script:
     runCommand name
@@ -745,10 +744,6 @@ rec {
           # Make the position of the derivation accurate.
           # Since not having `name` is deprecated, this should be fairly accurate.
           pos = lib.unsafeGetAttrPos "name" args;
-          # TODO(@Artturin:) substitutions should be inside the env attrset
-          # but users are likely passing non-substitution arguments through substitutions
-          # turn off __structuredAttrs to unbreak substituteAll
-          inherit __structuredAttrs;
           pname = name;
           version = "26.05pre-git";
           inherit meta;
@@ -756,6 +751,7 @@ rec {
           inherit propagatedBuildInputs;
           inherit propagatedNativeBuildInputs;
           strictDeps = true;
+          __structuredAttrs = true;
           # TODO 2023-01, no backport: simplify to inherit passthru;
           passthru =
             passthru
@@ -771,7 +767,9 @@ rec {
           recordPropagatedDependencies
         ''
         + lib.optionalString (substitutions != { }) ''
-          substituteAll ${script} $out/nix-support/setup-hook
+          substitute ${script} $out/nix-support/setup-hook ${
+            lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions
+          }
         ''
       );
 

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -19,6 +19,7 @@
   libpulseaudio,
   libzip,
   nlohmann_json,
+  stb,
   SDL2,
   spdlog,
   tinyxml-2,
@@ -89,12 +90,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -220,7 +215,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"

pkgs/by-name/ab/abracadabra/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TuOqTVBJSuZyA53UETR383md4LjqQx1FL/qRZwXOCRs=";
+    hash = "sha256-35E2a3UXyxcDixN5OAsiqlV0X+wkhS2vI6myHlpA2GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ab/abseil-cpp_202505/package.nix

@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ab/abseil-cpp_202508/package.nix

@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ab/abseil-cpp_202601/package.nix

@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ac/acli/sources.json

@@ -1,17 +1,17 @@
 {
-  "version": "1.3.23-stable",
+  "version": "1.3.29-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.23-stable/acli_1.3.23-stable_darwin_arm64.tar.gz",
-      "sha256": "af78f7bb06b137ddab785257fb74367ac3304629c7d240af0117a700c7b56b64"
+      "url": "https://acli.atlassian.com/darwin/1.3.29-stable/acli_1.3.29-stable_darwin_arm64.tar.gz",
+      "sha256": "b2f6343d13ac8f3c32ea1043aba8317876d845662967793eb00016a2e5b5cf79"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.23-stable/acli_1.3.23-stable_linux_arm64.tar.gz",
-      "sha256": "5d4e8580cf2aae681bc02bb4f61c8a62f3efa8fa2b051b3a5f4f560a90279a60"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_arm64.tar.gz",
+      "sha256": "cea39c4eb90c65d8d0cafc869a75fa3b6afaaf4573f8da650f4ae73801f8ec46"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.23-stable/acli_1.3.23-stable_linux_amd64.tar.gz",
-      "sha256": "1678a6d0ac36904b1b7788191b5740962a3dc8694aa6f3eee9ccd8f4774996e5"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_amd64.tar.gz",
+      "sha256": "8dcfc7bcf9dc788e7143e93d74445310094977ba1bad2513c6c613460851d34e"
     }
   }
 }

pkgs/by-name/ac/actual-client/package.nix

@@ -2,7 +2,7 @@
   lib,
   actual-server,
   copyDesktopItems,
-  electron_41,
+  electron_42,
   imagemagick,
   jq,
   makeDesktopItem,
@@ -11,7 +11,7 @@
   stdenv,
 }:
 let
-  electron = electron_41;
+  electron = electron_42;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "actual-client";
@@ -45,12 +45,14 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
+    # TODO: uncomment once actual updates their electron version to v42+
+    # https://github.com/actualbudget/actual/issues/8767
     # verify electron version
-    upstreamElectronMajor=$(${lib.getExe jq} -r '.devDependencies.electron | match("[0-9]+").string' packages/desktop-electron/package.json)
-    if [[ "$upstreamElectronMajor" != "${lib.versions.major electron.version}" ]]; then
-      echo "Electron major version mismatch: Actual expects $upstreamElectronMajor, nixpkgs provides ${electron.version}" >&2
-      exit 1
-    fi
+    # upstreamElectronMajor=$(${lib.getExe jq} -r '.devDependencies.electron | match("[0-9]+").string' packages/desktop-electron/package.json)
+    # if [[ "$upstreamElectronMajor" != "${lib.versions.major electron.version}" ]]; then
+    #   echo "Electron major version mismatch: Actual expects $upstreamElectronMajor, nixpkgs provides ${electron.version}" >&2
+    #   exit 1
+    # fi
 
     export HOME=$(mktemp -d)
 

pkgs/by-name/ac/actual-server/package.nix

@@ -161,6 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux ++ darwin;
     maintainers = [
+      lib.maintainers.PerchunPak
       lib.maintainers.oddlama
       lib.maintainers.patrickdag
       lib.maintainers.yash-garg

pkgs/by-name/ad/ada/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ada";
-  version = "3.4.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
+    hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adhammer/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "adhammer";
+  version = "1.4.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "icedracon";
+    repo = "adhammer";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Jn3hmCSpc/9zxfIzebrCkDOgZ4HzfXdKOcJSXNvxZGM=";
+  };
+
+  cargoHash = "sha256-037x5bhTizcCqW/pszIadAVA9ElQzJOQ9W1dh5Kpg9Y=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Active Directory security-assessment toolkit";
+    homepage = "https://github.com/icedracon/adhammer";
+    changelog = "https://github.com/icedracon/adhammer/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "adhammer";
+  };
+})

pkgs/by-name/al/alsa-utils/package.nix

@@ -5,6 +5,7 @@
   fetchurl,
   alsa-lib,
   alsa-plugins,
+  bashNonInteractive,
   gettext,
   makeWrapper,
   pkg-config,
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
+    bashNonInteractive
     alsa-lib
     ncurses
     libsamplerate

pkgs/by-name/am/amp-cli/package.nix

@@ -26,7 +26,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1786738049-g32e30e";
+  version = "0.0.1787515258-g1cbe6b";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -77,9 +77,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-8unf4fAZpdkR4LCBFQzfM/SJGJ8QAYDWEktGd9wJFhs=";
-            aarch64-linux = "sha256-YKS3uI2r5PMEXS81fpU3YUTnfC4eGR3E1uX3G+mDW40=";
-            aarch64-darwin = "sha256-x5FqwElBE4aZsF4OJtj3TWNqwTLFEsJSHM/gCQQSk4g=";
+            x86_64-linux = "sha256-8XrKtDrsDqgA17QLEgf6uhFBR6uKpO5wHzwmjsNY20c=";
+            aarch64-linux = "sha256-9ojGgakJurfS1rmXdLCnU9UEhDpF5g+9l4aU3WNEHb4=";
+            aarch64-darwin = "sha256-y77U/4OP8paz/F6rBaPhTbH95ydpPtVUrIpEakAzYiQ=";
           }
           .${system'};
       }

pkgs/by-name/an/angle/package.nix

@@ -24,11 +24,7 @@ let
   llvmPackages = llvmPackages_21;
   llvmMajorVersion = lib.versions.major llvmPackages.llvm.version;
   arch = stdenv.hostPlatform.parsed.cpu.name;
-  triplet = lib.getAttr arch {
-    "x86_64" = "x86_64-unknown-linux-gnu";
-    "aarch64" = "aarch64-unknown-linux-gnu";
-    "riscv64" = "riscv64-unknown-linux-gnu";
-  };
+  triplet = stdenv.hostPlatform.config;
 
   clang = symlinkJoin {
     name = "angle-clang-llvm-join";
@@ -115,30 +111,32 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-uninitialized-const-pointer-error-001.patch
   ];
 
-  postPatch = ''
-    substituteInPlace build/config/clang/BUILD.gn \
-      --replace-fail \
-        "_dir = \"${triplet}\"" \
-        "_dir = \"${triplet}\"
-         _suffix = \"-${arch}\""
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace build/config/clang/BUILD.gn \
+        --replace-fail \
+          "_dir = \"${triplet}\"" \
+          "_dir = \"${triplet}\"
+           _suffix = \"-${arch}\""
+    ''
+    + ''
+      # Don't precompile Metal shaders, because the compiler is non-free.
+      substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
+        --replace-fail \
+          "metal_internal_shader_compilation_supported =" \
+          "metal_internal_shader_compilation_supported = false &&"
 
-    # Don't precompile Metal shaders, because the compiler is non-free.
-    substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
-      --replace-fail \
-        "metal_internal_shader_compilation_supported =" \
-        "metal_internal_shader_compilation_supported = false &&"
+      cat > build/config/gclient_args.gni <<EOF
+      # Generated from 'DEPS'
+      checkout_angle_internal = false
+      checkout_angle_mesa = false
+      checkout_angle_restricted_traces = false
+      generate_location_tags = false
+      EOF
 
-    cat > build/config/gclient_args.gni <<EOF
-    # Generated from 'DEPS'
-    checkout_angle_internal = false
-    checkout_angle_mesa = false
-    checkout_angle_restricted_traces = false
-    generate_location_tags = false
-    EOF
-
-    # For sandboxed build on darwin.
-    patchShebangs build/toolchain/apple
-  '';
+      # For sandboxed build on darwin.
+      patchShebangs build/toolchain/apple
+    '';
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ar/argp-standalone/package.nix

@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
+  strictDeps = true;
+
   doCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/argp-standalone/argp-standalone";
     description = "Standalone version of arguments parsing functions from Glibc";

pkgs/by-name/ar/art/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "art";
-  version = "1.26.7";
+  version = "1.26.8";
 
   src = fetchFromGitHub {
     owner = "artraweditor";
     repo = "ART";
     tag = finalAttrs.version;
-    hash = "sha256-HuXDdrfb3r8B5u4Ifvb3EfbF/b1mMbDAunOIBtEaKtk=";
+    hash = "sha256-kgDmGxdmKK/19vxruTQ0845iaRSWthlkYoeAFVaju2U=";
   };
 
   # Fix the build with CMake 4.

pkgs/by-name/as/asciidoc/package.nix

@@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "asciidoc-py";
     repo = "asciidoc-py";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0=";
   };
 
@@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

pkgs/by-name/au/auto-patchelf/package.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ pythonEnv ];
 
+  strictDeps = true;
+
   src = ./source;
 
   buildPhase = ''
@@ -33,6 +35,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Automatically patch ELF binaries using patchelf";
     mainProgram = "auto-patchelf";

pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py

@@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l
             return Path(rpath)
     return None
 
+
+def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]:
+    """
+    Rewrite absolute RPATH entries to use $ORIGIN when the entry sits
+    under containing_path (the --paths entry the binary was found
+    under).
+
+    The resulting RPATH is relocatable: as long as the directory layout
+    within containing_path is preserved, the whole tree can be moved
+    and the binary will still find its dependencies.
+
+    Entries that already contain $ORIGIN are left untouched.
+    Entries outside containing_path are also left absolute.
+    """
+    containing_norm: Path = Path(os.path.normpath(containing_path))
+    new_rpath_entries: list[Path] = []
+    for entry in rpath_entries:
+        if "$ORIGIN" in entry.as_posix():
+            new_rpath_entries.append(entry)
+            continue
+        entry_norm: Path = Path(os.path.normpath(entry))
+        if not entry_norm.is_relative_to(containing_norm):
+            new_rpath_entries.append(entry)
+            continue
+        rel = os.path.relpath(entry_norm, binary_path.parent)
+        new_rpath_entries.append(Path("$ORIGIN") / rel)
+    return new_rpath_entries
+
+
 class Event(Protocol):
     """Protocol for loggable events that occur during the auto-patchelf process."""
     def to_human_readable_str(self) -> str: ...
@@ -317,7 +346,18 @@ class Logger:
 
 
 
-def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]:
+def auto_patchelf_file(
+    *,
+    logger: Logger,
+    runtime_deps: list[Path],
+    append_rpaths: list[Path] = [],
+    keep_libc: bool = False,
+    preserve_origin: bool = False,
+    relativize_rpath: bool = False,
+    extra_args: list[str] = [],
+    path: Path,
+    containing_path: Path
+) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
             if "$ORIGIN" in existing_rpath:
                 rpath.append(Path(existing_rpath))
 
+    if relativize_rpath:
+        rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path)
+
     # Dedup the rpath
     rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
 
@@ -458,6 +501,7 @@ def auto_patchelf(
         append_rpaths: list[Path] = [],
         keep_libc: bool = False,
         preserve_origin: bool = False,
+        relativize_rpath: bool = False,
         add_existing: bool = True,
         extra_args: list[str] = []) -> None:
 
@@ -472,9 +516,20 @@ def auto_patchelf(
     populate_cache(lib_dirs)
 
     dependencies = []
-    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
-        if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args)
+    for containing_path in paths_to_patch:
+        for path in glob(containing_path, '*', recursive):
+            if not path.is_symlink() and path.is_file():
+                dependencies += auto_patchelf_file(
+                    logger=logger,
+                    runtime_deps=runtime_deps,
+                    append_rpaths=append_rpaths,
+                    keep_libc=keep_libc,
+                    preserve_origin=preserve_origin,
+                    relativize_rpath=relativize_rpath,
+                    extra_args=extra_args,
+                    path=path,
+                    containing_path=containing_path
+                )
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -560,6 +615,12 @@ def main() -> None:
         action="store_true",
         help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.",
     )
+    parser.add_argument(
+        "--relativize-rpath",
+        dest="relativize_rpath",
+        action="store_true",
+        help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.",
+    )
     parser.add_argument(
         "--ignore-existing",
         dest="add_existing",
@@ -597,6 +658,7 @@ def main() -> None:
         append_rpaths=args.append_rpaths,
         keep_libc=args.keep_libc,
         preserve_origin=args.preserve_origin,
+        relativize_rpath=args.relativize_rpath,
         add_existing=args.add_existing,
         extra_args=args.extra_args)
 

pkgs/by-name/au/autoconf-archive/package.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ xz ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Archive of autoconf m4 macros";
     homepage = "https://www.gnu.org/software/autoconf-archive/";

pkgs/by-name/b3/b3sum/package.nix

@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "b3sum";
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchCrate {
     inherit (finalAttrs) version pname;
-    hash = "sha256-VWYsN/kNK/aR/Qc9nsTaXuJMO4PNBNOT6cfzwleKhD0=";
+    hash = "sha256-ZShgvrxccsaLXKl0wMF5GfpRzjlBi/ideUQSW+nQg5k=";
   };
 
-  cargoHash = "sha256-KOzFTLgbmrzUV5KmqJV9N7GUsUhaM3cwSxi/WlkeQBM=";
+  cargoHash = "sha256-aPFihFEmGDkAAd5fLcHQ0elpOR+KOmhZi28QxR7aQ8Q=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ba/bacon/package.nix

@@ -27,17 +27,17 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bacon";
-  version = "3.24.0";
+  version = "3.25.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rfbK5MrCytBVISXVkazBDnZZxjZQ3ze348mlTyanTWM=";
+    hash = "sha256-+7K8hy6zzLUshLc2I24md5FOYq3lB0ivx1VbCRHIXII=";
   };
 
-  cargoHash = "sha256-s49qZMD922l6KKSFRhVIGp6+7E0S+q7McV9PT2F0RQc=";
+  cargoHash = "sha256-fAdS77fBUFlSbXu1aw3X3z0ema2FC5fDo8At2GQpGn0=";
 
   buildFeatures = lib.optionals withSound [
     "sound"

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "baidupcs-go";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AvwdAOjuQxdmhg+IJxQ9e9iMXqveLjoF/W7ntZZmES4=";
+    hash = "sha256-o0Oh6zLJT25+smEgWy7E8fTigJ2FLpBXoaZSYCRFvic=";
   };
 
-  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
+  vendorHash = "sha256-3kvB5QxtWuElhDIFFr3Awf5myf6l2Hx0M2k53ltQYeQ=";
 
   doCheck = false;
 

pkgs/by-name/be/bearer/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "bearer";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OUsy3DDuo1ptTtbIOEOhqfG4wlaVu1ZSKJqt9h2ZRI0=";
+    hash = "sha256-I4XPt/egQJznJ9FS422fCJhiwLttjolx5adhiO1gDiM=";
   };
 
-  vendorHash = "sha256-PTyozkuRlD/VCqPqbDfdhMYHH1z3+S1X6ykPg/xP680=";
+  vendorHash = "sha256-XjpHnNrYY04ondhw9ZCUUkos2lgH2NJFFP0tU2frGvs=";
 
   subPackages = [ "cmd/bearer" ];
 
@@ -24,7 +24,6 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
-    "-w"
     "-X=github.com/bearer/bearer/cmd/bearer/build.Version=${finalAttrs.version}"
   ];
 

pkgs/by-name/bi/bison/package.nix

@@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     "host"
   ];
 
-  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
-  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
-  # cannot add bash to buildInputs due to infinite recursion
-  strictDeps = stdenv.hostPlatform != stdenv.buildPlatform;
+  strictDeps = true;
 
   nativeBuildInputs = [
     m4
@@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
+  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
+  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
+  # cannot add bash to buildInputs due to infinite recursion
+  postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
+    patchShebangs --build $out/bin/yacc
+  '';
+
   enableParallelBuilding = true;
   # tests are flaky / timing sensitive on FreeBSD
   enableParallelChecking = !stdenv.hostPlatform.isFreeBSD;
@@ -50,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO: enable doInstallCheck unconditionally when fixed upstream.
   doInstallCheck = !stdenv.cc.isClang;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/bison/";
     description = "Yacc-compatible parser generator";

pkgs/by-name/bi/bitwarden-cli/package.nix

@@ -14,13 +14,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "bitwarden-cli";
-  version = "2026.7.0";
+  version = "2026.8.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-8PYjRa1lhs53FCfqPBqH9712X1ek02wbkI+kW5tkepE=";
+    hash = "sha256-Kz7vy3mt4uLGA6wGtH527P5vY55UYSZtq6e8IyNJvc4=";
   };
 
   postPatch = ''
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
   nodejs = nodejs_22;
   npmDepsFetcherVersion = 2;
 
-  npmDepsHash = "sha256-WRxlvkgWboO0ukUHgjC5CrfgfwnmUfDXI4r5dx9CKww=";
+  npmDepsHash = "sha256-5i6/TlqBhPLv00tN0sxFA/iRQ8QRyUxhCqYkhVBLz3w=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     perl

pkgs/by-name/bo/boost-build/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     useBoost.src or (fetchFromGitHub {
       owner = "boostorg";
       repo = "build";
-      rev = defaultVersion;
+      tag = defaultVersion;
       sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
     });
 
@@ -58,6 +58,8 @@ stdenv.mkDerivation {
     bison
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     runHook preBuild
     ./bootstrap.sh
@@ -76,6 +78,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.boost.org/build/";
     license = lib.licenses.boost;