kernel updates for 2026-10-03 (#569771)

https://github.com/python-wheel-build/elfdeps/releases/tag/v0.3.0
https://github.com/python-wheel-build/elfdeps/releases/tag/v0.3.1
https://github.com/python-wheel-build/elfdeps/releases/tag/0.4.0

.github/actions/checkout/action.yml

@@ -15,7 +15,7 @@ runs:
   steps:
     # We don't actually need anything in this directory, but we need a small
     # sparse checkout, and this directory is small.
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
         sparse-checkout: .github/actions

.github/workflows/backport.yml

@@ -36,13 +36,16 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # Avoid materializing full nixpkgs tree
           sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
+          # The PR is already merged, and its commits are only cherry-picked by
+          # git, never executed, so checking out fork PR commits is safe here.
+          allow-unsafe-pr-checkout: true
 
       - name: Log current API rate limits
         env:
@@ -51,7 +54,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@6b65649031ac6d18ffdfd0c0820e9436f3fde22b # v4.6.1
+        uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7 # v4.7.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

.github/workflows/bot.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/check.yml

@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -147,7 +147,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -58,13 +58,16 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
           path: untrusted
           sparse-checkout: |
             ci/pinned.json
+          # ci/pinned.json is only read as data by trusted/ci/supportedVersions.nix,
+          # so checking out the fork PR's merge commit is safe here.
+          allow-unsafe-pr-checkout: true
 
       - name: Find commit that touched ci/pinned.json
         id: find-pinned-commit

.github/workflows/lint.yml

@@ -122,7 +122,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-issues: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -64,7 +64,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
+            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.ts')
             await prepare({
               github,
               context,

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -46,7 +46,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            const { default: getTeams } = await import('${{ github.workspace }}/ci/github-script/get-teams.js')
+            const { default: getTeams } = await import('${{ github.workspace }}/ci/github-script/get-teams.ts')
             await getTeams({
               github,
               context,

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -35,7 +35,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
+            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.ts')
             await prepare({
               github,
               context,
@@ -88,13 +88,13 @@ jobs:
               'ci/github-script/merge.js',
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',
-              'ci/github-script/prepare.js',
+              'ci/github-script/prepare.ts',
               'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
               'ci/github-script/reviews.ts',
               'ci/github-script/supportedBranches.ts',
               'ci/github-script/supportedSystems.ts',
-              'ci/github-script/withRateLimit.js',
+              'ci/github-script/withRateLimit.ts',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file) || file.startsWith('ci/github-script/reminders/'))) core.setOutput('pr', true)

ci/README.md

@@ -48,7 +48,7 @@ To ensure security and a focused utility, the bot adheres to specific limitation
   - approved by a [committer][@NixOS/nixpkgs-committers].
   - backported via label.
   - opened by a [committer][@NixOS/nixpkgs-committers].
-  - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
+  - opened by [@r-ryantm](https://nixos.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
 - No [committer][@NixOS/nixpkgs-committers] has an outstanding "changes requested" review.

ci/github-script/bot.js

@@ -5,7 +5,7 @@ import { DefaultArtifactClient } from '@actions/artifact'
 import { handleMerge } from './merge.js'
 import { handleReviewers } from './reviewers.js'
 import { classify } from './supportedBranches.ts'
-import withRateLimit from './withRateLimit.js'
+import withRateLimit from './withRateLimit.ts'
 
 export default async ({ github, context, core, dry }) => {
   const artifactClient = new DefaultArtifactClient()

ci/github-script/check-target-branch.ts

@@ -9,9 +9,9 @@ import {
 import { dismissReviews, postReview } from './reviews.ts'
 import { split } from './supportedBranches.ts'
 
-// TODO: should this be combined with the branch checks in prepare.js?
+// TODO: should this be combined with the branch checks in prepare.ts?
 // They do seem quite similar, but this needs to run after eval,
-// and prepare.js obviously doesn't.
+// and prepare.ts obviously doesn't.
 
 const reviewKey = 'check-target-branch'
 

ci/github-script/commits.ts

@@ -4,7 +4,7 @@ import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
 import { dismissReviews, postReview } from './reviews.ts'
 import { classify } from './supportedBranches.ts'
-import withRateLimit from './withRateLimit.js'
+import withRateLimit from './withRateLimit.ts'
 
 const dirname = import.meta.dirname
 

ci/github-script/get-teams.ts

@@ -1,6 +1,5 @@
-// @ts-nocheck
 import { writeFileSync } from 'node:fs'
-import withRateLimit from './withRateLimit.js'
+import withRateLimit from './withRateLimit.ts'
 
 const excludeTeams = [
   /^voters.*$/,
@@ -8,25 +7,58 @@ const excludeTeams = [
   /^nixpkgs-committers$/,
 ]
 
-export default async ({ github, context, core, outFile }) => {
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Core = typeof import('@actions/core')
+type Team = Awaited<
+  ReturnType<GitHub['rest']['repos']['listTeams']>
+>['data'][number]
+type User = Awaited<
+  ReturnType<GitHub['rest']['teams']['listMembersInOrg']>
+>['data'][number]
+
+interface Result {
+  [slug: string]: {
+    description: string | null
+    id: number
+    maintainers: unknown
+    members: unknown
+    name: string
+  }
+}
+
+export default async ({
+  github,
+  context,
+  core,
+  outFile,
+}: {
+  github: GitHub
+  context: Context
+  core: Core
+  outFile: string
+}) => {
   const org = context.repo.owner
 
-  const result = {}
+  const result: Result = {}
 
   await withRateLimit({ github, core }, async () => {
     // Turn an Array of users into an Object, mapping user.login -> user.id
-    function makeUserSet(users) {
+    function makeUserSet(users: User[]) {
       // Sort in-place and build result by mutation
       users.sort((a, b) => (a.login > b.login ? 1 : -1))
 
-      return users.reduce((acc, user) => {
-        acc[user.login] = user.id
-        return acc
-      }, {})
+      return users.reduce(
+        (acc, user) => {
+          acc[user.login] = user.id
+          return acc
+        },
+        {} as { [login: string]: number },
+      )
     }
 
     // Process a list of teams and append to the result variable
-    async function processTeams(teams) {
+    async function processTeams(teams: Team[]) {
       for (const team of teams) {
         core.notice(`Processing team ${team.slug}`)
         if (!excludeTeams.some((regex) => team.slug.match(regex))) {
@@ -74,7 +106,7 @@ export default async ({ github, context, core, outFile }) => {
     .reduce((acc, key) => {
       acc[key] = result[key]
       return acc
-    }, {})
+    }, {} as Result)
 
   const json = `${JSON.stringify(sorted, null, 2)}\n`
 

ci/github-script/merge.js

@@ -71,7 +71,7 @@ function runChecklist({
         pull_request.head.ref.startsWith('backport-'),
       'Opened by a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
         committers.has(pull_request.user.id),
-      'Opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).':
+      'Opened by [@r-ryantm](https://nixos.github.io/nixpkgs-update/r-ryantm/).':
         pull_request.user.login === 'r-ryantm',
     },
     'PR is not a draft': !pull_request.draft,
@@ -84,7 +84,7 @@ function runChecklist({
 
   if (user) {
     checklist[
-      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers).`
+      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers) (_see [requesting a new invitation](https://github.com/NixOS/rfc39-record/blob/main/README.md#requesting-a-new-invitation)_).`
     ] = userIsMaintainer
     if (allByName) {
       // We can only determine the below, if all packages are in by-name, since

ci/github-script/prepare.ts

@@ -1,12 +1,26 @@
-// @ts-nocheck
 import { dismissReviews, postReview } from './reviews.ts'
-import { classify } from './supportedBranches.ts'
+import { type BranchClassification, classify } from './supportedBranches.ts'
 import supportedSystems from './supportedSystems.ts'
 
 const reviewKey = 'prepare'
 
-export default async ({ github, context, core, dry }) => {
-  const pull_number = context.payload.pull_request.number
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Core = typeof import('@actions/core')
+
+export default async ({
+  github,
+  context,
+  core,
+  dry,
+}: {
+  github: GitHub
+  context: Context
+  core: Core
+  dry: boolean
+}) => {
+  const pull_number = context.payload.pull_request?.number
+  if (!pull_number) throw new Error('Not a pull request')
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
     core.info('Checking whether the pull request can be merged...')
@@ -89,7 +103,11 @@ export default async ({ github, context, core, dry }) => {
         .filter(({ stable, type }) => type.includes('primary') && stable)
         .sort((a, b) => b.version.localeCompare(a.version))
 
-      async function mergeBase({ branch, order, version }) {
+      async function mergeBase({
+        branch,
+        order,
+        version,
+      }: Pick<BranchClassification, 'branch' | 'order' | 'version'>) {
         const { data } = await github.rest.repos.compareCommitsWithBasehead({
           ...context.repo,
           basehead: `${branch}...${head.sha}`,
@@ -152,7 +170,7 @@ export default async ({ github, context, core, dry }) => {
         )
         .sort((a, b) => a.order - b.order)
 
-      const best = candidates.at(0)
+      const best = candidates[0]
 
       core.info('The base branches for this PR are:')
       core.info(`github: ${base.ref}`)
@@ -188,9 +206,9 @@ export default async ({ github, context, core, dry }) => {
       }
     }
 
-    let mergedSha, targetSha
+    let mergedSha: string, targetSha: string
 
-    if (prInfo.mergeable) {
+    if (prInfo.mergeable && prInfo.merge_commit_sha != null) {
       core.info('The PR can be merged.')
 
       mergedSha = prInfo.merge_commit_sha
@@ -224,7 +242,7 @@ export default async ({ github, context, core, dry }) => {
     const files = (
       await github.paginate(github.rest.pulls.listFiles, {
         ...context.repo,
-        pull_number: context.payload.pull_request.number,
+        pull_number,
         per_page: 100,
       })
     ).map((file) => file.filename)

ci/github-script/reviews.ts

@@ -175,7 +175,7 @@ interface PostReviewProps {
   core: typeof import('@actions/core')
   dry: boolean
   body: string
-  event: keyof typeof eventToState
+  event?: keyof typeof eventToState
   reviewKey: string
 }
 

ci/github-script/run

@@ -48,7 +48,7 @@ program
   .argument('<pr>', 'Number of the Pull Request to check')
   .option('--no-dry', 'Make actual modifications')
   .action(async (owner, repo, pr, options) => {
-    const prepare = (await import('./prepare.js')).default
+    const prepare = (await import('./prepare.ts')).default
     await run(prepare, owner, repo, pr, options)
   })
 
@@ -90,7 +90,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
   .argument('[outFile]', 'Path to the output file (Example: github-teams.json). If not set, prints to stdout')
   .action(async (owner, repo, outFile, options) => {
-    const getTeams = (await import('./get-teams.js')).default
+    const getTeams = (await import('./get-teams.ts')).default
     await run(getTeams, owner, repo, undefined, { ...options, outFile })
   })
 

ci/github-script/supportedBranches.ts

@@ -5,7 +5,7 @@
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-type BranchType = 'channel' | 'development' | 'primary' | 'secondary'
+type BranchType = 'channel' | 'development' | 'primary' | 'secondary' | 'wip'
 
 const typeConfig: Record<string, BranchType[]> = {
   master: ['development', 'primary'],
@@ -19,7 +19,7 @@ const typeConfig: Record<string, BranchType[]> = {
 }
 
 // "order" ranks the development branches by how likely they are the intended base branch
-// when they are an otherwise equally good fit according to ci/github-script/prepare.js.
+// when they are an otherwise equally good fit according to ci/github-script/prepare.ts.
 const orderConfig: Record<string, number> = {
   master: 0,
   release: 1,
@@ -44,7 +44,7 @@ function split(branch: string) {
   return groups as unknown as SplitResult
 }
 
-interface BranchClassification {
+export interface BranchClassification {
   branch: string
   order: number
   stable: boolean

ci/github-script/withRateLimit.ts

@@ -1,8 +1,28 @@
-// @ts-nocheck
 import Bottleneck from 'bottleneck'
 
-export default async ({ github, core, maxConcurrent = 1 }, callback) => {
-  const stats = {
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Core = typeof import('@actions/core')
+
+export interface Stats {
+  issues: number
+  prs: number
+  requests: number
+  artifacts: number
+}
+
+export default async (
+  {
+    github,
+    core,
+    maxConcurrent = 1,
+  }: {
+    github: GitHub
+    core: Core
+    maxConcurrent?: number
+  },
+  callback: (stats: Stats) => Promise<void>,
+) => {
+  const stats: Stats = {
     issues: 0,
     prs: 0,
     requests: 0,
@@ -30,12 +50,12 @@ export default async ({ github, core, maxConcurrent = 1 }, callback) => {
     if (options.url.startsWith('/search/')) return request(options)
     stats.requests++
     if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-      return writeLimits.schedule(request.bind(null, options))
-    else return allLimits.schedule(request.bind(null, options))
+      return writeLimits.schedule(async () => request(options))
+    else return allLimits.schedule(async () => request(options))
   })
 
   async function updateReservoir() {
-    let response
+    let response: Awaited<ReturnType<typeof github.rest.rateLimit.get>>
     try {
       response = await github.rest.rateLimit.get()
     } catch (err) {

doc/README.md

@@ -1,6 +1,12 @@
 # Contributing to the Nixpkgs manual
 
-This directory houses the source files for the Nixpkgs manual.
+This directory houses the source files for the Nixpkgs manual, including
+
+- [Getting Started](./getting-started) guides
+- [Onboarding guides](./using-nixpkgs.md) for using Nixpkgs
+- [Language frameworks](./languages-frameworks) shipped with Nixpkgs.
+
+There are renderings for the [rolling release](https://nixos.org/manual/nixpkgs/unstable/) and [latest stable release](https://nixos.org/manual/nixpkgs/stable/).
 
 > [!NOTE]
 >
@@ -15,9 +21,6 @@ When writing new docs use **Progressive Disclosure:**
 
 Use our [style guide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here.
-This includes getting started guides and onboarding guides for *using* Nixpkgs and the language frameworks it ships.
-
 Write **guides** task-first: lead with a working example, then explain in prose.
 Write **reference** as the specification of functions and attributes.
 
@@ -30,55 +33,35 @@ nix-repl> :doc lib.mapAttrsToList
 
 See [Document structure](#document-structure) for a structural template.
 
-Rendered documentation:
-- [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
-- [Stable (from latest release)](https://nixos.org/manual/nixpkgs/stable/)
+## Building and navigating documentation locally
 
-The rendering tool is [nixos-render-docs](../pkgs/by-name/ni/nixos-render-docs), sometimes abbreviated `nrd`.
-
-## Contributing to this documentation
-
-You can quickly check your edits with `nix-build`:
-
-```ShellSession
-$ cd /path/to/nixpkgs
-$ nix-build doc
-```
-
-If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.html`.
+The Nixpkgs manual is rendered by [`nixos-render-docs`](../pkgs/by-name/ni/nixos-render-docs/).
+Its index is [`nav.json`](./nav.json).
 
 ### Development environment
 
-To reduce repetition, consider using tools from the documentation development environment:
+Consider using the tooling in the documentation development environment.
 
 ```ShellSession
 $ cd /path/to/nixpkgs/doc
 $ nix-shell
 ```
 
-To load the documentation development environment automatically when entering that directory:
+### Live preview
 
-1. Install [`nix-direnv`](https://search.nixos.org/packages?channel=unstable&query=nix-direnv#show=nix-direnv)
-1. Set up direnv in the documentation directory:
+Within the developer environment, run [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual.
+If the `nixos-render-docs` source-code changes, `devmode` must be restarted.
 
-   ```ShellSession
-   $ cd doc
-   $ echo "use nix" > .envrc
-   $ direnv allow
-   ```
+### Building the docs
 
-#### Live preview
-
-Run [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
-
-Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
+To build the documentation, run `nix-build doc`.
+A successful build is stored in `./result/share/doc/nixpkgs/manual.html`.
 
 ### Testing redirects
 
-Once you have a successful build, you can open the relevant HTML (path mentioned above) in a browser along with the anchor, and observe the redirection.
+Once you have a successful build, you can open the aforementioned path in a browser along with the anchor, and observe the redirection.
 
-Note that if you already loaded the page and *then* input the anchor, you will need to perform a reload.
-This is because browsers do not re-run client JS code when only the anchor has changed.
+To test redirects, perform a browser refresh, as browsers do not re-run client JS code when only the anchor has changed.
 
 ## Syntax
 

doc/hooks/pnpm.section.md

@@ -1,142 +0,0 @@
-# pnpmBuildHook {#pnpm-build-hook}
-
-[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
-
-The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
-
-:::{.example #ex-pnpm-build-hook}
-## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
-
-```nix
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  makeBinaryWrapper,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "coolPackages";
-  version = "1.0";
-
-  src = fetchFromGitHub {
-    owner = "JaneCool";
-    repo = "coolpackage";
-    tag = finalAttrs.version;
-    hash = lib.fakeHash;
-  };
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 4;
-    hash = lib.fakeHash;
-  };
-
-  nativeBuildInputs = [
-    pnpmConfigHook
-    pnpmBuildHook
-    makeBinaryWrapper
-  ];
-
-  pnpmBuildScript = "build";
-  pnpmBuildFlags = [
-    "--mode"
-    "production"
-  ];
-  pnpmWorkspaces = [
-    "test"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir "$out"
-    cp -r dist/. "$out"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "very cool package that does cool things";
-    mainProgram = "cool";
-  };
-})
-```
-:::
-
-## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
-
-### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
-
-#### `pnpmBuildScript` {#pnpm-build-hook-script}
-
-Controls the script ran to build the package, by default the script is `build`.
-
-#### `pnpmFlags` {#pnpm-build-hook-flags}
-
-Controls flags used for all invocations of pnpm across all hooks local to this derivation.
-
-#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
-
-Controls the flags pass only to the pnpm build script invocation.
-
-#### `dontPnpmBuild` {#pnpm-build-hook-dont}
-
-Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
-
-```nix
-{
-  lib,
-  rustPlatform,
-  pnpmBuildHook,
-  pnpmConfigHook,
-  fetchPnpmDeps,
-  emptyDirectory,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "super-fast-application";
-  version = "1.0";
-
-  src = emptyDirectory;
-
-  cargoHash = lib.fakeHash;
-
-  nativeBuildInputs = [
-    pnpmBuildHook
-    pnpmConfigHook
-  ];
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 4;
-    hash = lib.fakeHash;
-  };
-
-  dontPnpmBuild = true;
-  postBuild = ''
-    pnpmBuildHook
-  '';
-})
-```
-
-### Honored Variables {#pnpm-build-hook-honored-variables}
-
-The following variables are honored by `pnpmBuildHook`.
-
-* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
-* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)

doc/languages-frameworks/javascript.section.md

@@ -6,6 +6,12 @@ Package JavaScript applications with the tools below.
 
 ## Tools overview {#javascript-tools-overview}
 
+- **npm**: [`buildNpmPackage`](#javascript-buildNpmPackage), [`prefetch-npm-deps` (CLI)](#javascript-buildNpmPackage-prefetch-npm-deps), [`fetchNpmDeps`](#javascript-buildNpmPackage-fetchNpmDeps), [`importNpmLock`](#javascript-buildNpmPackage-importNpmLock)
+- [**corepack**](#javascript-corepack)
+- **pnpm**: [`fetchPnpmDeps`](#javascript-pnpm), [`pnpmConfigHook`](#javascript-pnpm-pnpmConfigHook), [`pnpmBuildHook`](#javascript-pnpm-pnpmBuildHook)
+- [**Yarn v1**](#javascript-yarn-v1): [`fetchYarnDeps`](#javascript-fetchyarndeps), [`yarnConfigHook`](#javascript-yarnconfighook), [`yarnBuildHook`](#javascript-yarnbuildhook), [`yarnInstallHook`](#javascript-yarninstallhook)
+- [**Yarn Berry (v3/v4)**](#javascript-yarn-v3-v4): [`fetchYarnBerryDeps`](#javascript-fetchYarnBerryDeps), [`yarnBerryConfigHook`](#javascript-yarnBerryConfigHook)
+
 ## General principles {#javascript-general-principles}
 
 The principles below are ordered by importance.
@@ -288,9 +294,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
-
-There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook [`pnpmConfigHook`](#javascript-pnpm-pnpmConfigHook) prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
 
 ```nix
 {
@@ -298,6 +302,7 @@ There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with
   nodejs,
   pnpm_11,
   pnpmConfigHook,
+  pnpmBuildHook,
   stdenv,
 }:
 let
@@ -319,7 +324,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs # in case scripts are run outside of a pnpm call
     pnpmConfigHook
-    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
+    pnpmBuildHook
+    pnpm # At least required by pnpmConfigHook and pnpmBuildHook, if not other (custom) phases
   ];
 
   pnpmDeps = fetchPnpmDeps {
@@ -331,49 +337,11 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase reproducibility. An older version may be required if the package needs a certain lock file version. To do so, pass the `pnpm` argument to `fetchPnpmDeps`. Then override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+The example also uses [`pnpmBuildHook`](#javascript-pnpm-pnpmBuildHook), which runs `pnpm run build` in the build phase.
 
-<!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the `fetchPnpmDeps` function as well (i.e., `inherit (finalAttrs) patches`).
 
-```diff
- {
-   fetchPnpmDeps,
-   nodejs,
--  pnpm,
-+  pnpm_10,
-   pnpmConfigHook,
-   stdenv,
- }:
-+let
-+  # Optionally override pnpm to use a custom nodejs version
-+  # Make sure that the same nodejs version is referenced in nativeBuildInputs
-+  # pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
-+in
- stdenv.mkDerivation (finalAttrs: {
-   pname = "foo";
-   version = "0-unstable-1980-01-01";
-
-   src = {
-     #...
-   };
-
-   nativeBuildInputs = [
-     nodejs # in case scripts are run outside of a pnpm call
-     pnpmConfigHook
--    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
-+    pnpm_10 # At least required by pnpmConfigHook, if not other (custom) phases
-   ];
-
-   pnpmDeps = fetchPnpmDeps {
-     inherit (finalAttrs) pname version src;
-+    pnpm = pnpm_10;
-     fetcherVersion = 4;
-     hash = "...";
-   };
- })
-```
-
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`).
+#### pnpmConfigHook {#javascript-pnpm-pnpmConfigHook}
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
@@ -391,6 +359,33 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 
 If needed, set `dontPnpmConfigure = true;` to fully disable `pnpmConfigHook` without removing it from inputs manually.
 
+#### pnpmBuildHook {#javascript-pnpm-pnpmBuildHook}
+
+The `pnpmBuildHook` in overrides the default build phase with `pnpm run <build-script>`.
+
+```nix
+{
+  nativeBuildInputs = [
+    pnpmBuildHook
+  ];
+
+  pnpmBuildScript = "build-ui";
+  pnpmBuildFlags = [
+    "--mode"
+    "production"
+  ];
+}
+```
+
+Available options:
+
+- `pnpmBuildScript`: select which script from `package.json` to run. Defaults to `build`.
+- `pnpmBuildFlags`: array of flags to pass to the build script.
+- `pnpmFlags`: currently the same as `pnpmBuildFlags`, but might be used by other hooks in the future.
+- `dontPnpmBuild`: disable this hook from running automatically. The hook can still be invoked manually.
+
+Both [`pnpmRoot`](#javascript-pnpm-sourceRoot) and [`pnpmWorkspaces`](#javascript-pnpm-workspaces) are honored by this hook.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
@@ -603,13 +598,8 @@ To install the package, `yarnInstallHook` uses both `npm` and `yarn` to clean up
 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
 
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
-Yarn Berry (v3 / v4) versions have similar formats. They start with blocks like these:
 
-```yaml
-__metadata:
-  version: 6
-  cacheKey: 8[cX]
-```
+Yarn Berry (v3 / v4) versions have similar formats. The `yarn.lock` file starts with blocks like these:
 
 ```yaml
 __metadata:
@@ -634,7 +624,6 @@ Explicitly pin the major version. For example, capture the `yarn-berry_Xn` argum
 
 let
   yarn-berry = yarn-berry_4;
-
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "foo";
@@ -657,6 +646,7 @@ stdenv.mkDerivation (finalAttrs: {
 ```
 
 ##### `yarn-berry_X.fetchYarnBerryDeps` {#javascript-fetchYarnBerryDeps}
+
 `fetchYarnBerryDeps` runs `yarn-berry-fetcher fetch` in a fixed-output-derivation. It is a custom fetcher designed to reproducibly download all files in the `yarn.lock` file, validating their hashes in the process. For git dependencies, it creates a checkout at `${offlineCache}/checkouts/<40-character-commit-hash>` (relying on the git commit hash to describe the contents of the checkout).
 
 To produce the `hash` argument for the `fetchYarnBerryDeps` call, run `yarn-berry-fetcher prefetch`:
@@ -668,14 +658,17 @@ $ yarn-berry-fetcher prefetch </path/to/yarn.lock> [/path/to/missing-hashes.json
 This prints the hash to stdout. Use it in update scripts to recalculate the hash for a new `yarn.lock`.
 
 ##### `yarn-berry_X.yarnBerryConfigHook` {#javascript-yarnBerryConfigHook}
+
 `yarnBerryConfigHook` uses the store path `offlineCache` points to, to run a `yarn install` during the build, producing a usable `node_modules` directory from the downloaded dependencies.
 
 Internally, this uses a patched version of Yarn to ensure git dependencies are re-packed and any attempted downloads fail immediately.
 
 ##### Patching the project's `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
+
 In case patching the project's `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`).
 
 ##### Missing hashes in the `yarn.lock` file {#javascript-yarnBerry-missing-hashes}
+
 Unfortunately, `yarn.lock` files do not include hashes for optional/platform-specific dependencies. This is [by design](https://github.com/yarnpkg/berry/issues/6759).
 
 To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand to produce all missing hashes. These are stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
@@ -689,7 +682,6 @@ To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand t
 
 let
   yarn-berry = yarn-berry_4;
-
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "foo";

doc/nav.json

@@ -430,9 +430,6 @@
                 {
                   "file": "hooks/pkg-config.section.md"
                 },
-                {
-                  "file": "hooks/pnpm.section.md"
-                },
                 {
                   "file": "hooks/postgresql-test-hook.section.md"
                 },

doc/redirects.json

@@ -128,9 +128,6 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
-  "ex-pnpm-build-hook": [
-    "index.html#ex-pnpm-build-hook"
-  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -406,33 +403,6 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
-  "pnpm-build-hook": [
-    "index.html#pnpm-build-hook"
-  ],
-  "pnpm-build-hook-build-flags": [
-    "index.html#pnpm-build-hook-build-flags"
-  ],
-  "pnpm-build-hook-code-snippet": [
-    "index.html#pnpm-build-hook-code-snippet"
-  ],
-  "pnpm-build-hook-dont": [
-    "index.html#pnpm-build-hook-dont"
-  ],
-  "pnpm-build-hook-exclusive-variables": [
-    "index.html#pnpm-build-hook-exclusive-variables"
-  ],
-  "pnpm-build-hook-flags": [
-    "index.html#pnpm-build-hook-flags"
-  ],
-  "pnpm-build-hook-script": [
-    "index.html#pnpm-build-hook-script"
-  ],
-  "pnpm-build-hook-variables": [
-    "index.html#pnpm-build-hook-variables"
-  ],
-  "pnpm-build-hook-honored-variables": [
-    "index.html#pnpm-build-hook-honored-variables"
-  ],
   "preface": [
     "index.html#preface",
     "index.html#overview-of-nixpkgs"
@@ -1711,6 +1681,9 @@
   "var-meta-mainProgram": [
     "index.html#var-meta-mainProgram"
   ],
+  "var-meta-mainDarwinApp": [
+    "index.html#var-meta-mainDarwinApp"
+  ],
   "var-meta-priority": [
     "index.html#var-meta-priority"
   ],
@@ -3883,7 +3856,23 @@
     "index.html#javascript-corepack"
   ],
   "javascript-pnpm": [
-    "index.html#javascript-pnpm"
+    "index.html#javascript-pnpm",
+    "index.html#ex-pnpm-build-hook"
+  ],
+  "javascript-pnpm-pnpmBuildHook": [
+    "index.html#javascript-pnpm-pnpmBuildHook",
+    "index.html#pnpm-build-hook",
+    "index.html#pnpm-build-hook-build-flags",
+    "index.html#pnpm-build-hook-code-snippet",
+    "index.html#pnpm-build-hook-dont",
+    "index.html#pnpm-build-hook-exclusive-variables",
+    "index.html#pnpm-build-hook-flags",
+    "index.html#pnpm-build-hook-script",
+    "index.html#pnpm-build-hook-variables",
+    "index.html#pnpm-build-hook-honored-variables"
+  ],
+  "javascript-pnpm-pnpmConfigHook": [
+    "index.html#javascript-pnpm-pnpmConfigHook"
   ],
   "javascript-pnpm-sourceRoot": [
     "index.html#javascript-pnpm-sourceRoot"

doc/stdenv/meta.chapter.md

@@ -105,6 +105,10 @@ A list of the teams of this Nix expression. Teams are defined in [`nixpkgs/maint
 
 The name of the main binary for the package. This affects the binary `nix run` executes. Example: `"rg"`
 
+### `mainDarwinApp` {#var-meta-mainDarwinApp}
+
+The name of the main Darwin/macOS Application for the package. It must end in `.app`. Example: `"VSCodium.app"`
+
 ### `priority` {#var-meta-priority}
 
 The *priority* of the package, used by `nix-env` to resolve file name conflicts between packages. See the [manual page for `nix-env`](https://nixos.org/manual/nix/stable/command-ref/nix-env) for details. Example: `"10"` (a low-priority package).

lib/customisation.nix

@@ -87,7 +87,7 @@ rec {
     mySed = overrideDerivation pkgs.gnused (oldAttrs: {
       name = "sed-4.2.2-pre";
       src = fetchurl {
-        url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
+        url = "ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2";
         hash = "sha256-MxBJRcM2rYzQYwJ5XKxhXTQByvSg5jZc5cSHEZoB2IY=";
       };
       patches = [];

lib/default.nix

@@ -452,6 +452,8 @@ let
         getLicenseFromSpdxIdOr
         getExe
         getExe'
+        getDarwinApp
+        getDarwinApp'
         ;
       inherit (self.filesystem)
         pathType

lib/meta.nix

@@ -581,6 +581,90 @@ rec {
       || throw "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 
+  /**
+    Get the path to the main darwin app of a package based on `meta.mainDarwinApp`
+
+    # Inputs
+
+    `x`
+
+    : 1\. Function argument
+
+    # Type
+
+    ```
+    getDarwinApp :: Derivation -> StorePath
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.meta.getDarwinApp` usage example
+
+    ```nix
+    getDarwinApp pkgs.vscodium
+    => "/nix/store/0y95mgmlrs8cayv2cnj23xjfljwhlib0-vscodium-1.121.03429/Applications/VSCodium.app"
+    getDarwinApp pkgs.slack
+    => "/nix/store/g52cl8dblki8dr5bkr0vajpkralkmhi0-slack-4.49.89/Applications/Slack.app"
+    ```
+
+    :::
+  */
+  getDarwinApp =
+    x:
+    getDarwinApp' x (
+      x.meta.mainDarwinApp or (builtins.throw "getDarwinApp: Package ${
+        lib.strings.escapeNixIdentifier x.meta.name or x.pname or x.name
+      } does not have the meta.mainDarwinApp attribute. If the package has a main darwin app, please set `meta.mainDarwinApp` in its definition to make this error go away. Otherwise, if the package does not have a main darwin app, or if you don't control its definition, use getDarwinApp' to specify the name to the program, such as lib.getDarwinApp' vscodium \"VSCodium.app\".")
+    );
+
+  /**
+    Get the path of an darwin app for a derivation.
+
+    # Inputs
+
+    `x`
+
+    : 1\. Function argument
+
+    `y`
+
+    : 2\. Function argument
+
+    # Type
+
+    ```
+    getDarwinApp' :: Derivation -> String -> StorePath
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.meta.getDarwinApp'` usage example
+
+    ```nix
+    getDarwinApp' pkgs.linear "Linear.app"
+    => "/nix/store/z4vh6ldb2vpspv307q7mk6wazfmh5dic-linear-1.30.2/Applications/Linear.app"
+    getDarwinApp' pkgs.vscodium "VSCodium.app"
+    => "/nix/store/0y95mgmlrs8cayv2cnj23xjfljwhlib0-vscodium-1.121.03429/Applications/VSCodium.app"
+    ```
+
+    :::
+  */
+  getDarwinApp' =
+    x: y:
+    assert
+      isDerivation x
+      || throw "lib.meta.getDarwinApp': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
+    assert
+      isString y
+      || throw "lib.meta.getDarwinApp': The second argument is of type ${typeOf y}, but it should be a string instead.";
+    assert
+      lib.hasInfix "/" y == false
+      || throw "lib.meta.getDarwinApp': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the app instead.";
+    assert
+      lib.hasSuffix ".app" y
+      || throw "lib.meta.getDarwinApp': The second argument \"${y}\" must end in `.app`";
+    "${lib.getOutput "out" x}/Applications/${y}";
+
   /**
     Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` and `version` to the output, and sets `update` to `*`.
 

lib/tests/misc.nix

@@ -61,6 +61,8 @@ let
     genList
     getExe
     getExe'
+    getDarwinApp
+    getDarwinApp'
     getLicenseFromSpdxIdOr
     groupBy
     groupBy'
@@ -4752,6 +4754,31 @@ runTests {
 
   testGetExe'FailureSecondArg = testingThrow (getExe' { type = "derivation"; } "dir/executable");
 
+  testGetDarwinAppOutput = {
+    expr = getDarwinApp {
+      type = "derivation";
+      out = "somelonghash";
+      bin = "somelonghash";
+      meta.mainDarwinApp = "mainDarwinApp.app";
+    };
+    expected = "somelonghash/Applications/mainDarwinApp.app";
+  };
+
+  testGetDarwinApp'Output = {
+    expr = getDarwinApp' {
+      type = "derivation";
+      out = "somelonghash";
+      bin = "somelonghash";
+    } "app.app";
+    expected = "somelonghash/Applications/app.app";
+  };
+
+  testGetDarwinApp'FailureFirstArg = testingThrow (getDarwinApp' "not a derivation" "executable");
+
+  testGetDarwinApp'FailureSecondArg = testingThrow (
+    getDarwinApp' { type = "derivation"; } "dir/executable"
+  );
+
   testGetLicenseFromSpdxIdOrExamples = {
     expr = [
       (getLicenseFromSpdxIdOr "MIT" null)

maintainers/README.md

@@ -156,13 +156,28 @@ Feel free to merge changes to the team if the existing members are unresponsive.
 #### Synced GitHub teams
 
 As an alternative to tracking team members in `team-list.nix`, a corresponding GitHub team can be created by any org member and its members subsequently managed directly on GitHub.
-When creating the team it should be created with the `nixpkgs-maintainers` team as parent.
-Once approved, the team will have the right privileges to be pinged and requested for review in Nixpkgs.
 
-> [!TIP]
-> The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.
-
-After the first [weekly team sync](../.github/workflows/teams.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
+1. [Create a new team](https://github.com/orgs/NixOS/new-team?parent_team=nixpkgs-maintainers) on the NixOS org, with `@NixOS/nixpkgs-maintainers` as its parent.
+   - The team name should be as short as possible.
+     Because it is nested under the maintainers group, no -maintainers suffix is needed.
+   - If you do not use the above link, you may need to separately request for your new team to become a child of `@NixOS/nixpkgs-maintainers`.
+     [Open an issue](https://github.com/NixOS/org/issues/new) on `NixOS/org` if in doubt.
+1. Wait for an org-owner to approve the team's relationship with `@NixOS/nixpkgs-maintainers`.
+   - Once approved, the team will have the right privileges to be pinged and requested for review in Nixpkgs.
+   - Before approval, the weekly team sync will not include the team.
+   - Consider [opening an issue](https://github.com/NixOS/org/issues/new) on the `NixOS/org` repo, to make org-owners aware of the request.
+1. Wait for the [weekly team sync](../.github/workflows/teams.yml).
+   - Nixpkgs committers can also manually trigger the sync workflow.
+1. Wait for the sync PR to be merged.
+1. You can now inherit the GitHub team's members in `team-list.nix` entries.
+   The syntax is `github = "team-name"`:
+   ```nix
+   {
+     ci = {
+       github = "nixpkgs-ci";
+     };
+   }
+   ```
 
 # Maintainer scripts
 

maintainers/github-teams.json

@@ -161,8 +161,7 @@
       "samuela": 226872
     },
     "members": {
-      "ethancedwards8": 60861925,
-      "prusnak": 42201
+      "ethancedwards8": 60861925
     },
     "name": "cuda-maintainers"
   },
@@ -248,7 +247,6 @@
       "mstone": 412508,
       "n8henrie": 1234956,
       "ofalvai": 1694986,
-      "prusnak": 42201,
       "reckenrode": 7413633,
       "ryand56": 22267679,
       "samrose": 115821,
@@ -386,6 +384,31 @@
     },
     "name": "Freedesktop"
   },
+  "gaming": {
+    "description": "Maintain games, game engines, launchers, compatibility layers, game-related utilities and other gaming software in nixpkgs.",
+    "id": 19617985,
+    "maintainers": {
+      "TomaSajt": 62384384,
+      "ethancedwards8": 60861925,
+      "iedame": 60272,
+      "keenanweaver": 37268985,
+      "l0b0": 168301
+    },
+    "members": {
+      "DrymarchonShaun": 40149778,
+      "Gliczy": 129636582,
+      "Mistyttm": 51770769,
+      "PaulGrandperrin": 1748936,
+      "RoGreat": 64620440,
+      "carlossless": 498906,
+      "dwt": 57199,
+      "liamthexpl0rer": 119797945,
+      "liberodark": 4238928,
+      "qubitnano": 146656568,
+      "yvnth": 201552597
+    },
+    "name": "Gaming"
+  },
   "geospatial": {
     "description": "Maintain geospatial, remote sensing and OpenStreetMap software",
     "id": 7084621,
@@ -939,16 +962,16 @@
     "name": "Scala"
   },
   "sdl": {
-    "description": "Maintain core SDL libraries",
+    "description": "Maintain core SDL libraries. Matrix: #nixpkgs-sdl-team:nixos.org",
     "id": 13033942,
     "maintainers": {
+      "LordGrimmauld": 49513131,
+      "marcin-serwin": 12128106,
       "pbsds": 140964
     },
     "members": {
-      "LordGrimmauld": 49513131,
       "evysgarden": 92547295,
-      "jansol": 2588851,
-      "marcin-serwin": 12128106
+      "jansol": 2588851
     },
     "name": "SDL"
   },

maintainers/maintainer-list.nix

@@ -3256,6 +3256,12 @@
     githubId = 766221;
     name = "Ngoc Nguyen";
   };
+  baptiste0928 = {
+    email = "contact@bgirardeau.me";
+    github = "baptiste0928";
+    githubId = 22115890;
+    name = "Baptiste Girardeau";
+  };
   barab-i = {
     email = "barab_i@outlook.com";
     github = "barab-i";
@@ -11025,6 +11031,12 @@
     github = "GZGavinZhao";
     githubId = 74938940;
   };
+  h0nIg = {
+    name = "Hans-Joachim Kliemeck";
+    email = "git@kliemeck.de";
+    github = "h0nIg";
+    githubId = 2757302;
+  };
   h3cth0r = {
     name = "Hector Miranda";
     email = "hector.miranda@tec.mx";
@@ -15062,6 +15074,11 @@
     githubId = 45126464;
     name = "Adam J.";
   };
+  kfears = {
+    github = "kfearsoff";
+    githubId = 66781795;
+    name = "KFears";
+  };
   kfiz = {
     email = "doroerose@gmail.com";
     github = "kfiz";
@@ -15839,6 +15856,11 @@
     github = "kumpelinus";
     githubId = 174106140;
   };
+  kunkka19xx = {
+    name = "Kunkka";
+    github = "kunkka19xx";
+    githubId = 53131553;
+  };
   KunyaKud = {
     name = "KunyaKud";
     email = "wafuu@posteo.net";
@@ -16424,6 +16446,12 @@
     githubId = 80920;
     name = "Levi Gross";
   };
+  levihuayuzhang = {
+    email = "zhanghuayu.dev@gmail.com";
+    name = "Huayu Zhang";
+    github = "levihuayuzhang";
+    githubId = 68364307;
+  };
   Levizor = {
     email = "levizor@disroot.org";
     github = "Levizor";
@@ -18579,6 +18607,11 @@
       { fingerprint = "838A FE0D 55DC 074E 360F  943A 84B6 9CE6 F3F6 B767"; }
     ];
   };
+  MCT32 = {
+    github = "MCT32";
+    githubId = 32090502;
+    name = "MCT32";
+  };
   mcuste = {
     email = "github@muratcanuste.com";
     github = "mcuste";
@@ -20229,6 +20262,11 @@
     matrix = "@neoney:matrix.org";
     keys = [ { fingerprint = "9E6A 25F2 C1F2 9D76 ED00  1932 1261 173A 01E1 0298"; } ];
   };
+  n3tcat = {
+    name = "Sophie Cat";
+    github = "scd31";
+    githubId = 57571338;
+  };
   n3tshift = {
     email = "n3tshift@tilde.pink";
     github = "n3tshift";
@@ -22455,6 +22493,13 @@
     githubId = 20658472;
     name = "Parthiv Krishna";
   };
+  parthy = {
+    email = "markus.partheymueller@cyberus-technology.de";
+    matrix = "@parthy:cyberus-technology.de";
+    github = "parthy";
+    githubId = 101680;
+    name = "Markus Partheymueller";
+  };
   pascalj = {
     email = "nix@pascalj.de";
     github = "pascalj";
@@ -24659,6 +24704,12 @@
     githubId = 255667;
     name = "Linus Karl";
   };
+  reu = {
+    email = "rnavarro@rnavarro.com.br";
+    github = "reu";
+    githubId = 191614;
+    name = "Rodrigo Navarro";
+  };
   revol-xut = {
     email = "revol-xut@protonmail.com";
     name = "Tassilo Tanneberger";
@@ -26084,11 +26135,6 @@
     githubId = 13556969;
     name = "Scandiravian";
   };
-  scd31 = {
-    name = "scd31";
-    github = "scd31";
-    githubId = 57571338;
-  };
   SchahinRohani = {
     email = "schahin@rouhanizadeh.de";
     github = "SchahinRohani";
@@ -28691,6 +28737,11 @@
     githubId = 2389333;
     name = "Andy Tockman";
   };
+  Teamofeyy = {
+    name = "Teamofeyy";
+    github = "Teamofeyy";
+    githubId = 128955381;
+  };
   teatwig = {
     email = "nix@teatwig.net";
     name = "tea";

maintainers/scripts/luarocks-packages.csv

@@ -185,4 +185,5 @@ utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
+warna,,,,,,Freed-Wu
 xml2lua,,,,,,teto

maintainers/team-list.nix

@@ -291,6 +291,10 @@ with lib.maintainers;
     github = "freedesktop";
   };
 
+  gaming = {
+    github = "gaming";
+  };
+
   gcc = {
     members = [
       vcunat

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -144,10 +144,14 @@
 
 - [Netbird Relay](https://netbird.io/), a module to relay traffic when a point-to-point connection is not possible.
 
+- [ollaya](https://ollaya.dev), a server for local decision models, with an Ollama-style CLI and a TypeSafe-compatible API. Available as [services.ollaya](#opt-services.ollaya.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `services.autobrr.secretFile` has been removed, as autobrr no longer uses a session secret since version 1.82.0. Remove the option from your configuration.
+
 - Artalk has been updated to 2.10.0. Its default configuration and data
   directory discovery changed; see the [upstream migration
   guide](https://artalk.js.org/en/guide/releases/v2.10.0.html) when invoking
@@ -327,6 +331,8 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
+- `services.kanidm` supports declarative entry management via [`services.kanidm.server.entryManagement.migrations`](#opt-services.kanidm.server.entryManagement.migrations) to import `person` and `group` records natively on server startup as a lightweight alternative to `services.kanidm.provision`.
+
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
   notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
 

nixos/modules/hardware/video/displaylink.nix

@@ -46,7 +46,7 @@ in
 
     powerManagement.powerDownCommands = ''
       #flush any bytes in pipe
-      while read -n 1 -t 1 SUSPEND_RESULT < /tmp/PmMessagesPort_out; do : ; done;
+      while read -r -n 1 -t 1 < /tmp/PmMessagesPort_out; do : ; done;
 
       #suspend DisplayLinkManager
       echo "S" > /tmp/PmMessagesPort_in
@@ -54,7 +54,7 @@ in
       #wait until suspend of DisplayLinkManager finish
       if [ -f /tmp/PmMessagesPort_out ]; then
         #wait until suspend of DisplayLinkManager finish
-        read -n 1 -t 10 SUSPEND_RESULT < /tmp/PmMessagesPort_out
+        read -r -n 1 -t 10 < /tmp/PmMessagesPort_out
       fi
     '';
 

nixos/modules/module-list.nix

@@ -959,6 +959,7 @@
   ./services/misc/nzbhydra2.nix
   ./services/misc/octoprint.nix
   ./services/misc/ollama.nix
+  ./services/misc/ollaya.nix
   ./services/misc/ombi.nix
   ./services/misc/omnom.nix
   ./services/misc/open-webui.nix

nixos/modules/security/wrappers/default.nix

@@ -361,16 +361,19 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+            pkgs.file
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +385,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            magic=$(file --mime --brief --dereference "$path")
+            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

nixos/modules/services/audio/navidrome.nix

@@ -13,6 +13,8 @@ let
     mkPackageOption
     mkOption
     maintainers
+    optionals
+    optionalString
     ;
   inherit (lib.types)
     addCheck
@@ -23,6 +25,10 @@ let
     str
     submodule
     ;
+  inherit (pkgs)
+    writeShellScriptBin
+    ;
+
   cfg = config.services.navidrome;
   settingsFormat = pkgs.formats.json { };
 in
@@ -146,6 +152,29 @@ in
     let
       inherit (lib) mkIf optional getExe;
       WorkingDirectory = "/var/lib/navidrome";
+
+      settingsFile = settingsFormat.generate "navidrome.json" cfg.settings;
+
+      # Wrapper so that users can do admin tasks with the configured navidrome
+      #
+      # Since it is common that the user may be running this from their home directory,
+      # or possible something else, we should not inherit the CWD or else it may error
+      # trying to chdir to it since this runs as the navidrome user.
+      wrappedNavi = writeShellScriptBin "navidrome-cli" ''
+        exec systemd-run \
+          --quiet \
+          --pty \
+          --wait \
+          --service-type=exec \
+          --collect \
+          --working-directory=${WorkingDirectory} \
+          ${optionalString (cfg.environmentFile != null) "-p EnvironmentFile=${cfg.environmentFile}"} \
+          -p Group=${cfg.user} \
+          -p User=${cfg.group} \
+          -u navidrome-admin.service \
+          -- \
+          ${lib.getExe cfg.package} --configfile ${settingsFile} "$@"
+      '';
     in
     mkIf cfg.enable {
       systemd = {
@@ -169,9 +198,7 @@ in
           after = [ "network.target" ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
-            ExecStart = ''
-              ${getExe cfg.finalPackage} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
-            '';
+            ExecStart = "${lib.getExe cfg.finalPackage} --configfile ${settingsFile}";
             EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
             User = cfg.user;
             Group = cfg.group;
@@ -235,6 +262,10 @@ in
       users.groups = mkIf (cfg.group == "navidrome") { navidrome = { }; };
 
       networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.Port ];
+
+      environment.systemPackages = [
+        wrappedNavi
+      ];
     };
 
   meta.doc = ./navidrome.md;

nixos/modules/services/hardware/rasdaemon.nix

@@ -174,7 +174,7 @@ in
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${cfg.package}/bin/ras-mc-ctl --register-labels";
+          ExecStart = "${cfg.package}/bin/ras-mc-ctl dimm --register-labels";
           RemainAfterExit = true;
         };
       };

nixos/modules/services/misc/autobrr.nix

@@ -11,6 +11,14 @@ let
   configFile = configFormat.generate "autobrr.toml" cfg.settings;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "autobrr"
+      "secretFile"
+    ] "autobrr no longer uses a session secret since version 1.82.0.")
+  ];
+
   options = {
     services.autobrr = {
       enable = lib.mkEnableOption "Autobrr";
@@ -21,11 +29,6 @@ in
         description = "Open ports in the firewall for the Autobrr web interface.";
       };
 
-      secretFile = lib.mkOption {
-        type = lib.types.path;
-        description = "File containing the session secret for the Autobrr web interface.";
-      };
-
       settings = lib.mkOption {
         type = lib.types.submodule {
           freeformType = configFormat.type;
@@ -67,17 +70,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = !(cfg.settings ? sessionSecret);
-        message = ''
-          Session secrets should not be passed via settings, as
-          these are stored in the world-readable nix store.
-
-          Use the secretFile option instead.'';
-      }
-    ];
-
     systemd = {
       tmpfiles.settings = {
         "10-autobrr" = {
@@ -101,8 +93,6 @@ in
         serviceConfig = {
           Type = "simple";
           DynamicUser = true;
-          LoadCredential = "sessionSecret:${cfg.secretFile}";
-          Environment = [ "AUTOBRR__SESSION_SECRET_FILE=%d/sessionSecret" ];
           StateDirectory = "autobrr";
           ExecStart = "${lib.getExe cfg.package} --config %S/autobrr";
           Restart = "on-failure";

nixos/modules/services/misc/comfyui.nix

@@ -9,6 +9,19 @@ let
 
   # By default a StateDirectory is used; anything else needs its own directory and a hole in the unit's mount namespace.
   isDefaultDataDir = cfg.dataDir == "/var/lib/comfyui";
+
+  modelDrvs = map (m: {
+    inherit m;
+    drv = pkgs.fetchurl (lib.filterAttrs (n: _: n == "name" || n == "url" || n == "hash") m);
+  }) cfg.models;
+
+  modelSymlinks = lib.concatMapStringsSep "\n" (
+    x:
+    lib.concatMapStringsSep "\n" (p: ''
+      mkdir -p ${lib.escapeShellArg "${cfg.dataDir}/models/${p}"}
+      ln -sn ${lib.escapeShellArg "${x.drv}"} ${lib.escapeShellArg "${cfg.dataDir}/models/${p}/${x.m.name}"}
+    '') x.m.installPaths
+  ) modelDrvs;
 in
 {
   options = {
@@ -67,6 +80,64 @@ in
           Flags set by the module are prepended with `lib.mkBefore`, so any user supplied flag wins over that.
         '';
       };
+
+      models = lib.mkOption {
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  The model file name, used as the link name in `models/<installPath>/<name>`.
+                  It must be unique within the same `<installPath>`, to avoid conflicts.
+                '';
+              };
+              url = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  The download URL of the model file.
+                  Pinned-resolve URLs (e.g. HuggingFace's `/resolve/<commit>/<file>`) are recommended to have a stable hash.
+                '';
+              };
+              hash = lib.mkOption {
+                type = lib.types.str;
+                example = lib.fakeHash;
+                description = ''
+                  The SRI hash of the model file. Generate it with `nix-prefetch-url <url>`,
+                  or set this to `lib.fakeHash`, build once and copy the hash from the error message.
+                '';
+              };
+              installPaths = lib.mkOption {
+                # A directory string is converted to a list.
+                type =
+                  with lib.types;
+                  coercedTo (strMatching "[A-Za-z0-9_-]+") lib.singleton (
+                    nonEmptyListOf (strMatching "[A-Za-z0-9_-]+")
+                  );
+                description = ''
+                  String or list of target subdirectory names below `models/`, such as `upscale_models`, `loras`, `checkpoints`.
+                  Write bare directory names (the module assembles them into `models/<installPath>`,
+                  one symlink per install path); a single string is also accepted and upgraded to a one-element list.
+                '';
+                example = [ "upscale_models" ];
+              };
+            };
+          }
+        );
+        default = [ ];
+        example = lib.literalExpression ''
+          [ {
+            name = "RealESRGAN_x4plus_anime_6B.pth";
+            url = "https://github.com/xinntao/Real-ESRGAN/releases/download/v0.2.2.4/RealESRGAN_x4plus_anime_6B.pth";
+            hash = "sha256-+HLYN9PJDtLgUie+1xGvVnGm/RyffX6RyRGmHxVemdo=";
+            installPaths = "upscale_models";
+          } ]
+        '';
+        description = ''
+          ComfyUI models to fetch and symlink into `''${services.comfyui.dataDir}/models/<installPath>/<name>`.
+          Files placed manually in the `models` directory are left untouched.
+        '';
+      };
     };
   };
 
@@ -98,6 +169,17 @@ in
             cp --no-preserve=all -r ${cfg.package}/share/comfyui/$d "${cfg.dataDir}/"
           fi
         done
+
+        # Remove all symlinks pointing into /nix/store, then relink them, so that no stale ones are left behind.
+        readarray -d "" stale < <(find "${cfg.dataDir}/models" -type l -print0)
+        for link in "''${stale[@]}"; do
+          if [[ "$(readlink "$link")" == ${lib.escapeShellArg builtins.storeDir}/* ]]; then
+            rm "$link"
+          fi
+        done
+
+        # Rebuild model symlinks
+        ${modelSymlinks}
       '';
 
       serviceConfig = {

nixos/modules/services/misc/gitlab/default.nix

@@ -1801,7 +1801,6 @@ in
         Slice = "system-gitlab.slice";
         ExecStart = "${gitlab-rake}/bin/gitlab-rake gitlab:backup:create";
         Type = "oneshot";
-        RemainAfterExit = true;
       };
     };
 

nixos/modules/services/misc/ollaya.nix

@@ -0,0 +1,228 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) literalExpression types;
+
+  cfg = config.services.ollaya;
+  ollaya = lib.getExe cfg.package;
+
+  staticUser = cfg.user != null && cfg.group != null;
+in
+{
+  options.services.ollaya = {
+    enable = lib.mkEnableOption "ollaya server for local decision models";
+
+    package = lib.mkPackageOption pkgs "ollaya" { };
+
+    user = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "ollaya";
+      description = ''
+        User account under which to run ollaya. Defaults to
+        [`DynamicUser`](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=)
+        when set to `null`.
+
+        The user will automatically be created when this option is non-null.
+      '';
+    };
+
+    group = lib.mkOption {
+      type = types.nullOr types.str;
+      default = cfg.user;
+      defaultText = literalExpression "config.services.ollaya.user";
+      example = "ollaya";
+      description = ''
+        Group under which to run ollaya. Only used when `services.ollaya.user` is set.
+      '';
+    };
+
+    home = lib.mkOption {
+      type = types.str;
+      default = "/var/lib/ollaya";
+      example = "/home/foo";
+      description = "The home directory that the ollaya service is started in.";
+    };
+
+    modelsDir = lib.mkOption {
+      type = types.str;
+      default = "${cfg.home}/models";
+      defaultText = literalExpression "\${config.services.ollaya.home}/models";
+      example = "/path/to/ollaya/models";
+      description = ''
+        Directory where ollaya reads and stores downloaded models.
+      '';
+    };
+
+    host = lib.mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "IP address on which the server listens.";
+    };
+
+    port = lib.mkOption {
+      type = types.port;
+      default = 11435;
+      example = 11111;
+      description = "Port on which the server listens.";
+    };
+
+    settings = lib.mkOption {
+      type = types.submodule { freeformType = types.attrsOf types.str; };
+      default = { };
+      example = {
+        OLLAYA_DEVICE = "cuda";
+        OLLAYA_KEEP_ALIVE = "30m";
+      };
+      description = ''
+        Environment variables passed to the ollaya server process.
+        See <https://ollaya.dev/docs/cli#ollaya-serve> for available variables.
+      '';
+    };
+
+    loadModels = lib.mkOption {
+      type = types.listOf types.str;
+      apply = builtins.filter (model: model != "");
+      default = [ ];
+      example = [ "winnow:e4b" ];
+      description = ''
+        Models to download after the ollaya service starts. This creates a
+        separate `ollaya-model-loader.service`.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for ollaya. This adds
+        `services.ollaya.port` to `networking.firewall.allowedTCPPorts`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = lib.mkIf staticUser {
+      users.${cfg.user} = {
+        inherit (cfg) home;
+        isSystemUser = true;
+        group = cfg.group;
+      };
+      groups.${cfg.group} = { };
+    };
+
+    systemd.services.ollaya = {
+      description = "Server for local decision models";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = cfg.settings // {
+        HOME = cfg.home;
+        OLLAYA_MODELS = cfg.modelsDir;
+        OLLAYA_HOST = "${cfg.host}:${toString cfg.port}";
+      };
+      serviceConfig =
+        lib.optionalAttrs staticUser {
+          User = cfg.user;
+          Group = cfg.group;
+        }
+        // {
+          Type = "exec";
+          DynamicUser = true;
+          ExecStart = "${ollaya} serve";
+          WorkingDirectory = cfg.home;
+          StateDirectory = [ "ollaya" ];
+          ReadWritePaths = [
+            cfg.home
+            cfg.modelsDir
+          ];
+
+          CapabilityBoundingSet = [ "" ];
+          DeviceAllow = [
+            "char-nvidiactl"
+            "char-nvidia-caps"
+            "char-nvidia-frontend"
+            "char-nvidia-uvm"
+            "char-drm"
+            "char-fb"
+            "char-kfd"
+            "/dev/dxg"
+          ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = false;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "all";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          SupplementaryGroups = [ "render" ];
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service @resources"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+    };
+
+    systemd.services.ollaya-model-loader = lib.mkIf (cfg.loadModels != [ ]) {
+      description = "Download ollaya models in the background";
+      wantedBy = [
+        "multi-user.target"
+        "ollaya.service"
+      ];
+      wants = [ "network-online.target" ];
+      after = [
+        "ollaya.service"
+        "network-online.target"
+      ];
+      bindsTo = [ "ollaya.service" ];
+      environment = config.systemd.services.ollaya.environment;
+      serviceConfig = {
+        Type = "exec";
+        DynamicUser = true;
+        Restart = "on-failure";
+        RestartSec = "1s";
+        RestartMaxDelaySec = "2h";
+        RestartSteps = "10";
+      };
+      script =
+        let
+          nproc = lib.getExe' pkgs.coreutils "nproc";
+          xargs = lib.getExe' pkgs.findutils "xargs";
+        in
+        ''
+          printf "%s\0" ${lib.escapeShellArgs cfg.loadModels} | '${xargs}' -0 -r -n 1 -P "$('${nproc}')" '${ollaya}' pull
+        '';
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ happysalada ];
+}

nixos/modules/services/networking/amuled.md

@@ -5,26 +5,33 @@ It allows users to search for, download, and share files with others on these ne
 The `amuled` daemon is the command-line version of aMule, designed to run as a background service without a graphical user interface, making it suitable for servers or headless systems.
 It handles finding sources, managing download and upload queues, and interacting with the eD2k servers and Kad network.
 
-Here an example which also enables the web server and sets custom paths for the downloads:
+Here an example which also enables amuleapi (the REST API and Web UI) and sets custom paths for the downloads:
 
 ```nix
 {
   services.amule = {
     enable = true;
     openPeerPorts = true;
-    openWebServerPort = true;
     ExternalConnectPasswordFile = "/run/secrets/amule-password";
-    WebServerPasswordFile = "/run/secrets/amule-web/password";
+    AmuleApiAdminPasswordFile = "/run/secrets/amule-api-password";
     settings = {
       eMule = {
         IncomingDir = "/mnt/hd/amule";
         TempDir = "/mnt/hd/amule/Temp";
       };
-      WebServer.Enabled = 1;
+      AmuleApi.Enabled = 1;
     };
   };
 }
 ```
 
 You can connect using `amulegui` and choosing the host, port (`4712` by default) and password, the username is always `amule`.
-Otherwise, if you enabled the web server, connect using the browser (port `4711` by default).
+Otherwise, if you enabled amuleapi, connect using the browser (port `4713` by default) and log in with the admin password.
+
+Make `AmuleApiAdminPasswordFile` readable by the service user; a missing or unreadable file prevents startup.
+amuleapi uses the EC port configured in `settings.ExternalConnect.ECPort`.
+
+amuleapi listens on `127.0.0.1` by default, the upstream recommendation is to keep it there and put a reverse proxy in front of it.
+To listen on another address set `settings.AmuleApi.BindAddress`, this requires an admin password, and `openAmuleApiPort` to open the port in the firewall.
+
+The legacy web server, `amuleweb`, is deprecated upstream in favour of amuleapi but can still be enabled with `settings.WebServer.Enabled = 1` (port `4711` by default).

nixos/modules/services/networking/amuled.nix

@@ -113,9 +113,37 @@ let
         description = "Web server port";
       };
     };
+    AmuleApi = {
+      Enabled = mkOption {
+        type = types.enum [
+          0
+          1
+        ];
+        default = 0;
+        description = ''
+          Set to 1 to let amuled spawn amuleapi, the REST API and Web UI
+          replacing the deprecated web server.
+        '';
+      };
+      BindAddress = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = ''
+          Address amuleapi listens on.
+          amuleapi refuses to bind anything other than `127.0.0.1` unless an admin password is set,
+          see {option}`services.amule.AmuleApiAdminPasswordFile`.
+        '';
+      };
+      HttpPort = mkOption {
+        type = types.port;
+        default = 4713;
+        description = "amuleapi HTTP port, serving both the REST API and the Web UI";
+      };
+    };
   };
 
   webServerEnabled = cfg.settings.WebServer.Enabled == 1;
+  amuleApiEnabled = cfg.settings.AmuleApi.Enabled == 1;
 in
 {
   options.services.amule = {
@@ -125,6 +153,8 @@ in
 
     amuleWebPackage = mkPackageOption pkgs "amule-web" { };
 
+    amuleApiPackage = mkPackageOption pkgs "amule-api" { };
+
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -155,6 +185,8 @@ in
 
     openWebServerPort = mkEnableOption "open the web server port";
 
+    openAmuleApiPort = mkEnableOption "open the amuleapi (REST API and Web UI) port";
+
     ExternalConnectPasswordFile = mkOption {
       type = types.nullOr types.path;
       default = null;
@@ -173,6 +205,16 @@ in
       '';
     };
 
+    AmuleApiAdminPasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        File containing the admin password for amuleapi (REST API and Web UI).
+        It is set with `amuleapi --set-admin-pass` before amuled starts,
+        so it is briefly visible in the process list.
+      '';
+    };
+
     settings = mkOption {
       type = types.submodule {
         freeformType = settingsFormat.type;
@@ -188,7 +230,7 @@ in
             IncomingDir = "/mnt/hd/amule/Incoming";
             TempDir = "/mnt/hd/amule/Temp";
           };
-          WebServer.Enabled = 1;
+          AmuleApi.Enabled = 1;
         }
       '';
       default = { };
@@ -209,6 +251,10 @@ in
       }
     ];
 
+    warnings = optionals webServerEnabled [
+      "services.amule: amuleweb (`settings.WebServer.Enabled`) is deprecated upstream, consider switching to amuleapi with `settings.AmuleApi.Enabled = 1`"
+    ];
+
     users.users = optionalAttrs (cfg.user == "amule") {
       amule = {
         group = cfg.group;
@@ -264,7 +310,26 @@ in
       + optionalString (!isNull cfg.WebServerPasswordFile) ''
         WEB_PASSWORD=$(cat ${cfg.WebServerPasswordFile} | md5sum | cut -d ' ' -f 1)
         crudini --inplace --set "$AMULE_CONF" "WebServer" "Password" "$WEB_PASSWORD"
-      '';
+      ''
+      + optionalString amuleApiEnabled (
+        # amuled spawns amuleapi itself, looking it up by this path
+        ''
+          crudini --inplace --set "$AMULE_CONF" "AmuleApi" "Path" "${getExe cfg.amuleApiPackage}"
+
+          AMULE_API_CONF=${lib.escapeShellArg "${cfg.dataDir}/amuleapi.conf"}
+          if [ ! -e "$AMULE_API_CONF" ]; then
+            install -m 600 /dev/null "$AMULE_API_CONF"
+          fi
+          crudini --inplace --set "$AMULE_API_CONF" "EC" "Port" \
+            "${toString cfg.settings.ExternalConnect.ECPort}"
+        ''
+        + optionalString (!isNull cfg.AmuleApiAdminPasswordFile) ''
+          AMULE_API_PASSWORD=$(cat -- ${lib.escapeShellArg cfg.AmuleApiAdminPasswordFile})
+          ${getExe cfg.amuleApiPackage} \
+            --config-dir=${lib.escapeShellArg cfg.dataDir} --no-log-file \
+            --set-admin-pass="$AMULE_API_PASSWORD"
+        ''
+      );
 
       serviceConfig = {
         User = cfg.user;
@@ -313,6 +378,9 @@ in
       (mkIf cfg.openWebServerPort {
         allowedTCPPorts = [ cfg.settings.WebServer.Port ];
       })
+      (mkIf cfg.openAmuleApiPort {
+        allowedTCPPorts = [ cfg.settings.AmuleApi.HttpPort ];
+      })
     ];
   };
 

nixos/modules/services/networking/rpcbind.nix

@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 {
 
   ###### interface
@@ -15,8 +13,8 @@ with lib;
 
     services.rpcbind = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -32,29 +30,34 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.rpcbind.enable {
-    environment.systemPackages = [ pkgs.rpcbind ];
+  config = lib.mkMerge [
+    (lib.mkIf config.services.rpcbind.enable {
+      environment.systemPackages = [ pkgs.rpcbind ];
 
-    systemd.packages = [ pkgs.rpcbind ];
+      systemd.packages = [ pkgs.rpcbind ];
 
-    systemd.services.rpcbind = {
-      wantedBy = [ "multi-user.target" ];
-      # rpcbind performs a check for /var/run/rpcbind.lock at startup
-      # and will crash if /var/run isn't present. In the stock NixOS
-      # var.conf tmpfiles configuration file, /var/run is symlinked to
-      # /run, so rpcbind can enter a race condition in which /var/run
-      # isn't symlinked yet but tries to interact with the path, so
-      # controlling the order explicitly here ensures that rpcbind can
-      # start successfully. The `wants` instead of `requires` should
-      # avoid creating a strict/brittle dependency.
-      wants = [ "systemd-tmpfiles-setup.service" ];
-      after = [ "systemd-tmpfiles-setup.service" ];
-    };
+      systemd.services.rpcbind = {
+        wantedBy = [ "multi-user.target" ];
+        # rpcbind performs a check for /var/run/rpcbind.lock at startup
+        # and will crash if /var/run isn't present. In the stock NixOS
+        # var.conf tmpfiles configuration file, /var/run is symlinked to
+        # /run, so rpcbind can enter a race condition in which /var/run
+        # isn't symlinked yet but tries to interact with the path, so
+        # controlling the order explicitly here ensures that rpcbind can
+        # start successfully. The `wants` instead of `requires` should
+        # avoid creating a strict/brittle dependency.
+        wants = [ "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];
+      };
+    })
 
-    users.users.rpc = {
-      group = "nogroup";
-      uid = config.ids.uids.rpc;
-    };
-  };
+    {
+      users.users.rpc = {
+        enable = config.services.rpcbind.enable;
+        group = "nogroup";
+        uid = config.ids.uids.rpc;
+      };
+    }
+  ];
 
 }

nixos/modules/services/security/kanidm.nix

@@ -44,11 +44,21 @@ let
 
   cfg = config.services.kanidm;
   settingsFormat = pkgs.formats.toml { };
+  jsonFormat = pkgs.formats.json { };
+
   # Remove null values, so we can document optional values that don't end up in the generated TOML file.
   filterConfig = converge (filterAttrsRecursive (_: v: v != null));
   serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.server.settings);
   clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.client.settings);
   unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unix.settings);
+
+  entryManagementDir = pkgs.linkFarm "kanidm-entry-management" (
+    mapAttrsToList (name: value: {
+      name = "${name}.json";
+      path = jsonFormat.generate "${name}.json" value;
+    }) cfg.server.entryManagement.migrations
+  );
+
   provisionSecretFiles = filter (x: x != null) (
     [
       cfg.provision.idmAdminPasswordFile
@@ -293,6 +303,37 @@ in
     };
 
     server.enable = mkEnableOption "the Kanidm server";
+
+    server.entryManagement.migrations = mkOption {
+      description = ''
+        Entry management (migrations) to apply to the Kanidm database.
+        These are JSON formatted person and group records that are imported to the server on startup.
+        Keys of this attribute set should follow the pattern `xx-name` (e.g. `00-base`, `99-accounts`),
+        and values are the JSON representation of the migration.
+        See [the documentation](https://kanidm.github.io/kanidm/stable/entry_management.html)
+        for details on the record syntax.
+      '';
+      default = { };
+      type = types.attrsOf jsonFormat.type;
+      example = {
+        "00-base" = {
+          id = "a2b58e97-0aaf-4b04-a4e4-7984616fe1df";
+          assertions = [
+            {
+              state = "present";
+              id = "0ee875bd-408d-4ff9-85ca-c162f262493d";
+              class = [
+                "person"
+                "account"
+              ];
+              name = "tobias";
+              displayname = "Tobias";
+            }
+          ];
+        };
+      };
+    };
+
     server.settings = mkOption {
       type = types.submodule {
         freeformType = settingsFormat.type;
@@ -732,6 +773,7 @@ in
     services.kanidm = {
       unix.settings.version = "2";
       server.settings.version = "2";
+      server.settings.migration_path = entryManagementDir;
     };
 
     assertions =
@@ -768,6 +810,10 @@ in
             assertion = (cfg.server.enable && cfg.provision.enable) -> unknownEntities == [ ];
             message = "${opt} refers to unknown entities: ${toString unknownEntities}";
           };
+
+        invalidEntryManagementNames = filter (name: builtins.match "[0-9]{2}-.+" name == null) (
+          attrNames cfg.server.entryManagement.migrations
+        );
       in
       [
         {
@@ -848,6 +894,14 @@ in
             You may want to set `services.kanidm.package = pkgs.kanidm.withSecretProvisioning;`.
           '';
         }
+        # Entry Management file name validation
+        {
+          assertion = invalidEntryManagementNames == [ ];
+          message = ''
+            The keys in <option>services.kanidm.server.entryManagement.migrations</option> must follow the pattern `XX-<name>` where `XX` is a two-digit number (e.g., "00-base", "99-accounts").
+            Invalid keys found: ${toString invalidEntryManagementNames}
+          '';
+        }
         # Entity names must be globally unique:
         (
           let
@@ -858,9 +912,7 @@ in
             assertion = cfg.provision.enable -> duplicateNames == { };
             message = ''
               services.kanidm.provision requires all entity names (group, person, oauth2, ...) to be unique!
-              ${concatLines (
-                mapAttrsToList (name: xs: "  - '${name}' used as: ${toString xs}") duplicateNames
-              )}'';
+              ${concatLines (mapAttrsToList (name: xs: "  - '${name}' used as:${toString xs}") duplicateNames)}'';
           }
         )
       ]

nixos/modules/services/web-apps/bulwark.nix

@@ -499,6 +499,7 @@ in
           themePolicy =
             let
               builtinThemes = [
+                "builtin-flat-fields"
                 "builtin-qui"
                 "builtin-nord"
                 "builtin-catppuccin"

nixos/modules/system/boot/systemd/tpm2.nix

@@ -29,6 +29,9 @@
 
     boot.initrd.systemd.tpm2.pcrphases.enable =
       lib.mkEnableOption "systemd initrd boot phase measurements";
+
+    boot.initrd.systemd.tpm2.pcrosseparator.enable =
+      lib.mkEnableOption "systemd initrd boot phase OS userspace separator";
   };
 
   # TODO: pcrextend, pcrfs, pcrmachine
@@ -102,5 +105,17 @@
         boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
       }
     )
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrosseparator.enable) {
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-pcrosseparator.service"
+        ];
+        boot.initrd.systemd.services.systemd-pcrosseparator.wantedBy = [ "initrd.target" ];
+        boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
+      }
+    )
   ];
 }

nixos/modules/virtualisation/qemu-vm.nix

@@ -337,7 +337,7 @@ let
             ${if share.writable then "--writeback" else "--readonly"} \
             --sandbox=none \
             --seccomp=none \
-            --cache=always \
+            --cache=${share.cache} \
             --no-announce-submounts \
             --translate-uid=host:65534:0:1 \
             --translate-gid=host:65534:0:1 \
@@ -595,6 +595,23 @@ in
           options.writable = lib.mkEnableOption "" // {
             description = "Whether the directory is writable on the host and guest.";
           };
+          options.cache = mkOption {
+            type = types.enum [
+              "auto"
+              "always"
+              "metadata"
+              "never"
+            ];
+            default = "auto";
+            description = ''
+              Cache policy for the virtiofs daemon.
+
+              For details refer to the [virtiofsd documentation](https://virtio-fs.gitlab.io/virtiofsd/doc/virtiofsd/passthrough/enum.CachePolicy.html).
+
+              Effective on Linux hosts only.
+              Ignored when using VirtFS (9P) (the default on non-Linux hosts).
+            '';
+          };
         }
       );
       default = { };
@@ -1238,6 +1255,7 @@ in
         # Always mount this to /nix/.ro-store because we never want to actually
         # write to the host Nix Store.
         target = "/nix/.ro-store";
+        cache = mkIf useVirtiofs "always";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';

nixos/tests/all-tests.nix

@@ -278,6 +278,7 @@ in
   amazon-init-shell = runTest ./amazon-init-shell.nix;
   amazon-ssm-agent = runTest ./amazon-ssm-agent.nix;
   amd-sev = runTest ./amd-sev.nix;
+  amuled = runTest ./amuled.nix;
   android-translation-layer = runTest ./android-translation-layer.nix;
   angie-api = runTest ./angie-api.nix;
   angrr = runTest ./angrr.nix;
@@ -380,6 +381,7 @@ in
   budgie = runTest ./budgie.nix;
   buildbot = runTest ./buildbot.nix;
   buildkite-agents = runTest ./buildkite-agents.nix;
+  buildstream = runTest ./buildstream.nix;
   bulwark = runTest ./bulwark.nix;
   c2fmzq = runTest ./c2fmzq.nix;
   caddy = runTest ./caddy.nix;
@@ -1377,6 +1379,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ollama-vulkan = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-vulkan.nix;
+  ollaya = runTest ./ollaya.nix;
   omada = runTestOn [ "x86_64-linux" ] ./omada.nix;
   ombi = runTest ./ombi.nix;
   omnom = runTest ./omnom;
@@ -1572,6 +1575,7 @@ in
   qemu-firmware = runTestOn [ "x86_64-linux" ] ./qemu-firmware.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
+  qemu-vm-shared-directories = runTest ./qemu-vm-shared-directories.nix;
   qemu-vm-store = runTest ./qemu-vm-store.nix;
   qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   qgis = handleTest ./qgis.nix { package = pkgs.qgis; };

nixos/tests/amuled.nix

@@ -0,0 +1,141 @@
+{ lib, pkgs, ... }:
+
+let
+  adminPassword = "admin-secret";
+
+  # No eD2k server nor Kad network is reachable from the test: the two peers
+  # bootstrap a Kad network between themselves (aMule only asks sources for
+  # downloads while connected to a network) and the leecher finds the seeder
+  # through the `sources` field of the ed2k link.
+  # Both require accepting peers on private addresses.
+  node = {
+    environment.systemPackages = [
+      pkgs.curl
+      pkgs.jq
+    ];
+    services.amule = {
+      enable = true;
+      openPeerPorts = true;
+      ExternalConnectPasswordFile = pkgs.writeText "amule-ec-password" "ec-secret";
+      AmuleApiAdminPasswordFile = pkgs.writeText "amule-api-password" adminPassword;
+      settings = {
+        eMule.FilterLanIPs = 0;
+        AmuleApi.Enabled = 1;
+      };
+    };
+  };
+in
+{
+  name = "amuled";
+
+  meta.maintainers = with lib.maintainers; [ aciceri ];
+
+  nodes = {
+    seeder = {
+      imports = [ node ];
+      services.amule = {
+        AmuleApiAdminPasswordFile = lib.mkForce "/run/amule admin password";
+        settings.ExternalConnect.ECPort = 14712;
+      };
+      # Observe individual startup failures rather than automatic retries.
+      systemd.services.amuled.serviceConfig.Restart = lib.mkForce "no";
+    };
+    leecher = node;
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import datetime as dt
+      import json
+      import shlex
+
+      api = "http://127.0.0.1:4713/api/v1"
+      incoming = "/var/lib/amuled/Incoming"
+
+
+      def login(machine):
+          machine.wait_until_succeeds(f"curl -sf {api}/health | jq -e '.ec_connected'")
+          body = json.dumps({"password": "${adminPassword}"})
+          return machine.succeed(
+              f"curl -sf -X POST '{api}/auth/login?include_token=true' "
+              f"-H 'Content-Type: application/json' -d {shlex.quote(body)} | jq -r .token"
+          ).strip()
+
+
+      def call(machine, token, method, path, body=None):
+          cmd = f"curl -sf -X {method} -H 'Authorization: Bearer {token}' {api}{path}"
+          if body is not None:
+              cmd += f" -H 'Content-Type: application/json' -d {shlex.quote(json.dumps(body))}"
+          return machine.succeed(cmd)
+
+
+      start_all()
+      with subtest("missing or unreadable admin secrets prevent startup"):
+          secret = shlex.quote("${nodes.seeder.services.amule.AmuleApiAdminPasswordFile}")
+          seeder.wait_until_succeeds("systemctl is-failed amuled.service")
+          seeder.fail("test -e /var/lib/amuled/amuleapi-passwords")
+          seeder.succeed(
+              f"install -m 600 ${pkgs.writeText "amule-admin-secret" adminPassword} {secret}",
+              "systemctl reset-failed amuled.service",
+          )
+          seeder.fail("systemctl start amuled.service")
+          seeder.fail("test -e /var/lib/amuled/amuleapi-passwords")
+          seeder.succeed(
+              f"chown amule:amule {secret}",
+              "systemctl reset-failed amuled.service",
+              "systemctl start amuled.service",
+          )
+
+      for machine in (seeder, leecher):
+          machine.wait_for_unit("amuled.service")
+          machine.wait_for_open_port(4662)
+          machine.wait_for_open_port(4713)
+
+      with subtest("amuleapi serves the Web UI and enforces the admin password"):
+          seeder.succeed("curl -sf http://127.0.0.1:4713/ | grep -i '<html'")
+          seeder.fail(
+              f"curl -sf -X POST '{api}/auth/login' -H 'Content-Type: application/json' "
+              """-d '{"password":"wrong"}'"""
+          )
+          seeder_token = login(seeder)
+          leecher_token = login(leecher)
+
+      with subtest("seeder shares a file"):
+          seeder.succeed(
+              f"head -c 3M /dev/urandom > {incoming}/payload.bin",
+              f"chown amule:amule {incoming}/payload.bin",
+          )
+          call(seeder, seeder_token, "POST", "/shared_reload")
+          seeder.wait_until_succeeds(
+              f"curl -sf -H 'Authorization: Bearer {seeder_token}' {api}/shared "
+              "| jq -e '.shared[] | select(.name == \"payload.bin\")'",
+              timeout=dt.timedelta(minutes=2),
+          )
+          shared = json.loads(call(seeder, seeder_token, "GET", "/shared"))
+          link = next(f["ed2k_link"] for f in shared["shared"] if f["name"] == "payload.bin")
+
+      with subtest("peers form a LAN Kad network"):
+          for machine, token, peer in (
+              (seeder, seeder_token, "${nodes.leecher.networking.primaryIPAddress}"),
+              (leecher, leecher_token, "${nodes.seeder.networking.primaryIPAddress}"),
+          ):
+              call(machine, token, "POST", "/kad/bootstrap", {"ip": peer, "port": 4672})
+          for machine, token in ((seeder, seeder_token), (leecher, leecher_token)):
+              machine.wait_until_succeeds(
+                  f"curl -sf -H 'Authorization: Bearer {token}' {api}/status "
+                  "| jq -e '.kad.state == \"connected\"'",
+                  timeout=dt.timedelta(minutes=2),
+              )
+
+      with subtest("leecher downloads it from the seeder"):
+          link += "|sources,${nodes.seeder.networking.primaryIPAddress}:4662|/"
+          call(leecher, leecher_token, "POST", "/downloads", {"links": [link]})
+          leecher.wait_for_file(f"{incoming}/payload.bin", timeout=dt.timedelta(minutes=10))
+          expected = seeder.succeed(f"sha256sum < {incoming}/payload.bin")
+          leecher.wait_until_succeeds(
+              f"[ \"$(sha256sum < {incoming}/payload.bin)\" = {shlex.quote(expected.strip())} ]",
+              timeout=dt.timedelta(minutes=1),
+          )
+    '';
+}

nixos/tests/autobrr.nix

@@ -4,28 +4,17 @@
   name = "autobrr";
   meta.maintainers = with lib.maintainers; [ av-gal ];
 
-  nodes.machine =
-    { pkgs, ... }:
-    let
-      # We create this secret in the Nix store (making it readable by everyone).
-      # DO NOT DO THIS OUTSIDE OF TESTS!!
-      testSecretFile = pkgs.writeText "session_secret" "not-secret";
-    in
-    {
+  nodes.machine = {
+    services.autobrr.enable = true;
+
+    # Use port other than default to test if settings options work.
+    specialisation.settingsPort.configuration = {
       services.autobrr = {
         enable = true;
-        secretFile = testSecretFile;
-      };
-
-      # Use port other than default to test if settings options work.
-      specialisation.settingsPort.configuration = {
-        services.autobrr = {
-          enable = true;
-          secretFile = testSecretFile;
-          settings.port = 7777;
-        };
+        settings.port = 7777;
       };
     };
+  };
 
   testScript =
     { nodes, ... }:

nixos/tests/budgie.nix

@@ -67,6 +67,9 @@
           machine.succeed(f"{cmd} | grep 'SSH_AUTH_SOCK' | grep 'gcr'")
 
       with subtest("Open run dialog"):
+          machine.wait_for_console_text("Monitoring /home/${user.name}/.config/budgie-desktop/labwc/environment for keyboard layout changes")
+          machine.wait_for_console_text("Published CurrentLayout=us")
+          machine.sleep(2)
           machine.send_key("alt-f2")
           machine.wait_until_succeeds("pgrep -xf budgie-run-dialog")
           machine.sleep(2)
@@ -76,7 +79,7 @@
       with subtest("Open Budgie Control Center"):
           machine.succeed("su - ${user.name} -c '${env} budgie-control-center >&2 &'")
           machine.wait_until_succeeds("su - ${user.name} -c '${env} wlrctl toplevel list | grep org.buddiesofbudgie.ControlCenter'")
-          machine.wait_for_text("Network|Ethernet|Control|Connected")
+          machine.wait_for_text(r"(Network|Introduction|Privacy)")
 
       with subtest("Open GNOME terminal"):
           machine.succeed("su - ${user.name} -c '${env} gnome-terminal >&2 &'")

nixos/tests/buildstream.nix

@@ -0,0 +1,71 @@
+{ pkgs, ... }:
+let
+  bst = pkgs.buildstream;
+
+  # `bst` is a buildPythonApplication; its own site-packages only contains
+  # buildstream's own files, not the propagated runtime deps (protobuf,
+  # grpcio, click, ...) that only reach the wrapped `bst` script's PYTHONPATH.
+  # `toPythonModule` reinterprets it as a regular library so its full
+  # dependency closure gets merged in by `withPackages` below.
+  bstModule = pkgs.python3.pkgs.toPythonModule bst;
+
+  # Test fixture plugin package used by test_source_mirror_plugin[pip]; upstream
+  # normally installs this via tox before running the pip-origin plugin loading test.
+  samplePlugins = pkgs.python3Packages.buildPythonPackage {
+    pname = "sample-plugins";
+    version = "1.2.3";
+    pyproject = true;
+    build-system = [ pkgs.python3Packages.setuptools ];
+    src = "${bst.src}/tests/plugins/sample-plugins";
+    dontCheck = true;
+  };
+in
+{
+  name = "buildstream";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ shymega ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # The default "auto" diskSize only sizes the root filesystem to fit
+      # the system closure, with no scratch space; the suite builds real
+      # CAS/cache artifacts under pytest's basetemp (`./tmp`, per
+      # setup.cfg) for hundreds of parametrized cases, which exhausts that
+      # in a few minutes (`OSError: could not create numbered dir`).
+      virtualisation.diskSize = 16 * 1024;
+      virtualisation.memorySize = 2048;
+
+      environment.systemPackages = [
+        (pkgs.python3.withPackages (
+          ps: with ps; [
+            bstModule
+            pexpect
+            pyftpdlib
+            pytest
+            pytest-datafiles
+            pytest-env
+            pytest-timeout
+            pytest-xdist
+            samplePlugins
+          ]
+        ))
+        bst
+        pkgs.buildbox
+        pkgs.gitMinimal
+      ];
+    };
+
+  testScript = ''
+    machine.succeed("cp -r ${bst.src} /tmp/src && chmod -R u+w /tmp/src")
+
+    # The dummy buildbox-casd scripts spawned by tests/internals/cascache.py use
+    # an `/usr/bin/env sh` shebang, which doesn't exist here either.
+    machine.succeed(
+        "sed -i 's|#!/usr/bin/env sh|#!${pkgs.runtimeShell}|'"
+        + " /tmp/src/tests/internals/cascache.py"
+    )
+
+    machine.succeed("cd /tmp/src && HOME=/root pytest")
+  '';
+}

nixos/tests/firefly-iii.nix

@@ -12,7 +12,7 @@ in
   };
 
   nodes.fireflySqlite =
-    { config, ... }:
+    { ... }:
     {
       environment.etc = {
         "firefly-iii-appkey".text = app-key;
@@ -29,7 +29,7 @@ in
     };
 
   nodes.fireflyPostgresql =
-    { config, pkgs, ... }:
+    { pkgs, ... }:
     {
       environment.etc = {
         "firefly-iii-appkey".text = app-key;
@@ -67,7 +67,7 @@ in
     };
 
   nodes.fireflyMysql =
-    { config, pkgs, ... }:
+    { pkgs, ... }:
     {
       environment.etc = {
         "firefly-iii-appkey".text = app-key;
@@ -100,21 +100,40 @@ in
       };
     };
 
-  testScript = ''
-    fireflySqlite.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflySqlite.wait_for_unit("nginx.service")
-    fireflySqlite.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflySqlite.succeed("curl -fvvv -Ls http://localhost/v1/js/app.js")
-    fireflySqlite.succeed("systemctl start firefly-iii-cron.service")
-    fireflyPostgresql.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflyPostgresql.wait_for_unit("nginx.service")
-    fireflyPostgresql.wait_for_unit("postgresql.target")
-    fireflyPostgresql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflyPostgresql.succeed("systemctl start firefly-iii-cron.service")
-    fireflyMysql.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflyMysql.wait_for_unit("nginx.service")
-    fireflyMysql.wait_for_unit("mysql.service")
-    fireflyMysql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflyMysql.succeed("systemctl start firefly-iii-cron.service")
-  '';
+  testScript =
+    let
+      checkCron = node: ''
+        ${node}.succeed(
+            "curl -fsS -c /tmp/jar -b /tmp/jar -o /tmp/register.html http://localhost/register",
+            "grep -oP 'name=\"_token\" value=\"\\K[^\"]+' /tmp/register.html | tr -d '\\n' > /tmp/token",
+        )
+        redirect = ${node}.succeed(
+            "curl -fsS -c /tmp/jar -b /tmp/jar -o /dev/null -w '%{redirect_url}' http://localhost/register"
+            + " --data-urlencode _token@/tmp/token"
+            + " --data-urlencode email=test@example.com"
+            + " --data-urlencode password=TestTestTestTest1"
+            + " --data-urlencode password_confirmation=TestTestTestTest1"
+        )
+        # A failed registration redirects back to the form.
+        assert "register" not in redirect, f"registration failed, redirected to {redirect}"
+        ${node}.succeed("systemctl start firefly-iii-cron.service")
+      '';
+    in
+    ''
+      fireflySqlite.wait_for_unit("phpfpm-firefly-iii.service")
+      fireflySqlite.wait_for_unit("nginx.service")
+      fireflySqlite.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
+      fireflySqlite.succeed("curl -fvvv -Ls http://localhost/build/manifest.json")
+      ${checkCron "fireflySqlite"}
+      fireflyPostgresql.wait_for_unit("phpfpm-firefly-iii.service")
+      fireflyPostgresql.wait_for_unit("nginx.service")
+      fireflyPostgresql.wait_for_unit("postgresql.target")
+      fireflyPostgresql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
+      ${checkCron "fireflyPostgresql"}
+      fireflyMysql.wait_for_unit("phpfpm-firefly-iii.service")
+      fireflyMysql.wait_for_unit("nginx.service")
+      fireflyMysql.wait_for_unit("mysql.service")
+      fireflyMysql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
+      ${checkCron "fireflyMysql"}
+    '';
 }

nixos/tests/grist.nix

@@ -103,5 +103,19 @@ in
       record = check_answer(r)["records"][0]
       if record["fields"]["result"] != record["fields"]["number"] * 2:
         sys.exit(1)
+
+    # Importing a file needs the built-in parsers registered in plugins/ and a
+    # gVisor sandbox that can read the upload.
+    with subtest("Import a CSV file"):
+      r = requests.post(
+        f"{url}docs",
+        files={"upload": ("import.csv", "name,value\nfoo,1\nbar,2\n")},
+        headers={"X-Requested-With": "XMLHttpRequest"},
+      )
+      import_doc_id = check_answer(r)
+      r = requests.get(f"{url}docs/{import_doc_id}/tables/Import/records")
+      names = [rec["fields"]["name"] for rec in check_answer(r)["records"]]
+      if names != ["foo", "bar"]:
+        sys.exit(1)
   '';
 }

nixos/tests/kanidm.nix

@@ -31,6 +31,25 @@ in
         package = kanidmPackage;
         server = {
           enable = true;
+
+          entryManagement.migrations = {
+            "00-base" = {
+              id = "a2b58e97-0aaf-4b04-a4e4-7984616fe1df";
+              assertions = [
+                {
+                  state = "present";
+                  id = "0ee875bd-408d-4ff9-85ca-c162f262493d";
+                  class = [
+                    "person"
+                    "account"
+                  ];
+                  name = "migration_user";
+                  displayname = "Migration User";
+                }
+              ];
+            };
+          };
+
           settings = {
             origin = "https://${serverDomain}";
             domain = serverDomain;
@@ -119,6 +138,10 @@ in
           client.send_chars(f"{idm_admin_password}\n")
           client.wait_until_tty_matches("1", "Login Success for idm_admin")
 
+      with subtest("Test entry management migration"):
+          output = client.succeed("kanidm person get migration_user")
+          assert "No matching entries" not in output, "The migration user was not created"
+
       with subtest("Test unixd connection"):
           client.wait_for_unit("kanidm-unixd.service")
           client.wait_for_file("/run/kanidm-unixd/sock")

nixos/tests/matrix/conduit.nix

@@ -77,7 +77,7 @@ in
                 # Close the client
                 await client.close()
 
-            asyncio.get_event_loop().run_until_complete(main())
+            asyncio.run(main())
           '')
         ];
       };

nixos/tests/matrix/dendrite.nix

@@ -77,7 +77,7 @@ in
                 # Close the client
                 await client.close()
 
-            asyncio.get_event_loop().run_until_complete(main())
+            asyncio.run(main())
           '')
         ];
       };

nixos/tests/navidrome.nix

@@ -28,5 +28,8 @@
     # Make sure we saw at least one plugin load
     machine.wait_for_console_text("plugin=listenbrainz-daily-playlist")
     machine.wait_for_open_port(4533)
+    # Make sure the admin wrapper is working
+    machine.succeed("cd ~")
+    assert "--version" in machine.succeed("navidrome-cli --help")
   '';
 }

nixos/tests/ollaya.nix

@@ -0,0 +1,44 @@
+{ lib, ... }:
+
+let
+  port = 11435;
+  apiKey = "ollaya-test-key";
+in
+{
+  name = "ollaya";
+  meta.maintainers = with lib.maintainers; [ happysalada ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.ollaya = {
+        enable = true;
+        inherit port;
+        settings.OLLAYA_API_KEY = apiKey;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("ollaya.service")
+    machine.wait_for_open_port(${toString port})
+
+    # `GET /` is the liveness endpoint and the only one that takes no API key.
+    assert "Ollaya is running" in machine.succeed(
+        "curl --fail http://127.0.0.1:${toString port}/"
+    )
+
+    # `services.ollaya.settings` reaches the server: the API refuses a request
+    # without the key, and answers the model list with it.
+    status = machine.succeed(
+        "curl -so /dev/null -w '%{http_code}' http://127.0.0.1:${toString port}/api/tags"
+    )
+    assert status == "401", status
+
+    tags = machine.succeed(
+        "curl --fail -H 'Authorization: Bearer ${apiKey}' http://127.0.0.1:${toString port}/api/tags"
+    )
+    assert json.loads(tags)["models"] == [], tags
+  '';
+}

nixos/tests/qemu-vm-shared-directories.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  name = "qemu-vm-shared-directories";
+
+  meta.maintainers = with lib.maintainers; [
+    fricklerhandwerk
+  ];
+
+  meta.platforms = lib.platforms.linux;
+
+  nodes = lib.listToAttrs (
+    map
+      (policy: {
+        name = policy;
+        value.virtualisation.sharedDirectories.test = {
+          source = "/tmp/${policy}";
+          target = "/mnt/test";
+          cache = policy;
+          writable = true;
+        };
+      })
+      [
+        "never"
+        "metadata"
+        "auto"
+        "always"
+      ]
+  );
+
+  testScript = ''
+    import os
+
+    for policy in ${with builtins; toJSON (attrNames config.nodes)}:
+        os.makedirs(f"/tmp/{policy}", exist_ok=True)
+        with open(f"/tmp/{policy}/hello.txt", "w") as f:
+            f.write("before")
+
+    start_all()
+
+    for machine, policy in [${
+      lib.concatMapStringsSep ", " (p: ''(${p}, "${p}")'') (builtins.attrNames config.nodes)
+    }]:
+        with subtest(f"cache={policy} propagates host file changes to the guest as expected"):
+            machine.succeed("grep before /mnt/test/hello.txt")
+            with open(f"/tmp/{policy}/hello.txt", "w") as f:
+                f.write("after")
+            if policy == "always":
+                always.succeed("grep before /mnt/test/hello.txt")
+            else:
+                machine.succeed("grep after /mnt/test/hello.txt")
+  '';
+}

nixos/tests/rasdaemon.nix

@@ -24,11 +24,13 @@
     };
 
   testScript = ''
+    import json
     start_all()
     machine.wait_for_unit("multi-user.target")
     # confirm rasdaemon is running and has a valid database
     # some disk errors detected in qemu for some reason ¯\_(ツ)_/¯
-    machine.wait_until_succeeds("ras-mc-ctl --errors | tee /dev/stderr | grep -q 'No .* errors.'")
+    errors = json.loads(machine.wait_until_succeeds("ras-mc-ctl database --errors --json"))
+    assert errors["records"] == []
     # confirm the supplied labels text made it into the system
     machine.succeed("grep -q 'vendor: none' /etc/ras/dimm_labels.d/labels >&2")
     machine.shutdown()

nixos/tests/signal-desktop.nix

@@ -69,7 +69,7 @@ in
       )
       # Only SQLCipher should be able to read the encrypted DB:
       machine.fail(
-          "su - alice -c 'sqlite3 ~/.config/Signal/sql/db.sqlite .tables'"
+          "su - alice -c 'sqlite3 ~/.config/Signal/sql/db.sqlite \"SELECT count(*) FROM sqlite_master\"'"
       )
       print(machine.succeed(
           "su - alice -c 'sqlcipher ~/.config/Signal/sql/db.sqlite'"

nixos/tests/zoom-us.nix

@@ -10,11 +10,38 @@
     };
 
   testScript = ''
+    import time
+
     machine.succeed("which zoom")  # fail early if this is missing
     machine.wait_for_x()
-    machine.execute("zoom >&2 &")
-    machine.wait_for_window("Zoom Workplace")
+    machine.execute("zoom > /tmp/zoom-us.log 2>&1 & echo $! > /tmp/zoom-us.pid")
+
+    def has_zoom_window():
+        return any("Zoom Workplace" in name for name in machine.get_window_names())
+
+    # Zoom should open its main window shortly after startup. Poll for it, but
+    # stop as soon as the launcher process exits (for example because of a
+    # missing shared library) instead of waiting for the whole window timeout.
+    deadline = time.time() + 120
+    while not has_zoom_window():
+        if machine.execute("kill -0 $(cat /tmp/zoom-us.pid)")[0] != 0:
+            raise Exception(
+                "zoom exited before opening its main window:\n"
+                + machine.execute("cat /tmp/zoom-us.log")[1]
+            )
+        if time.time() > deadline:
+            raise Exception(
+                "timed out waiting for the Zoom Workplace window:\n"
+                + machine.execute("cat /tmp/zoom-us.log")[1]
+            )
+        time.sleep(1)
+
+    # The window should stay open for a while instead of crashing on startup.
     machine.sleep(20)
-    machine.wait_for_window("Zoom Workplace")
+    if not has_zoom_window():
+        raise Exception(
+            "the Zoom Workplace window disappeared shortly after startup:\n"
+            + machine.execute("cat /tmp/zoom-us.log")[1]
+        )
   '';
 }

pkgs/README.md

@@ -912,9 +912,9 @@ stdenv.mkDerivation {
 ## Automatic package updates
 [automatic-package-updates]: #automatic-package-updates
 
-The [community bot `r-ryantm`](https://nix-community.org/update-bot/), periodically tries to update all packages in Nixpkgs.
-It runs the program [`nixpkgs-update`](https://nix-community.github.io/nixpkgs-update/) which finds new versions of packages, modifies the relevant files, and opens a Nixpkgs PR.
-`nixpkgs-update` has a specific set of capabilities of finding new versions for a package, and updating Nix files accordingly (see their [FAQ](https://nix-community.github.io/nixpkgs-update/nixpkgs-maintainer-faq/)).
+The [community bot `r-ryantm`](https://github.com/NixOS/infra/blob/main/non-critical-infra/modules/nixpkgs-update/README.md), periodically tries to update all packages in Nixpkgs.
+It runs the program [`nixpkgs-update`](https://nixos.github.io/nixpkgs-update/) which finds new versions of packages, modifies the relevant files, and opens a Nixpkgs PR.
+`nixpkgs-update` has a specific set of capabilities of finding new versions for a package, and updating Nix files accordingly (see their [FAQ](https://nixos.github.io/nixpkgs-update/nixpkgs-maintainer-faq/)).
 However, setting a `passthru.updateScript` for a package, sets an explicit update procedure for `nixpkgs-update`, that can find the latest version more reliably than `nixpkgs-update`, and modify the necessary files more correctly.
 
 ### Valid `passthru.updateScript` values

pkgs/applications/editors/android-studio/default.nix

@@ -101,15 +101,15 @@ let
     };
   };
   latestVersion = {
-    version = "2026.2.2.1"; # "Android Studio Rabbit 2 | 2026.2.2 Canary 1"
+    version = "2026.2.2.3"; # "Android Studio Rabbit 2 | 2026.2.2 Canary 3"
     sources = {
       x86_64-linux = {
-        sha256Hash = "sha256-m6E5gAI6hO2M5zf7nDQaQtnHmdimdXZsBYSKOVH4nbQ=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.2.1/android-studio-rabbit2-canary1-linux.tar.gz";
+        sha256Hash = "sha256-I1BUkbgkEQjoxzhRBUeZvz+gG4EMxgr4FZKJy7m062E=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.2.3/android-studio-rabbit2-canary3-linux.tar.gz";
       };
       aarch64-darwin = {
-        sha256Hash = "sha256-HfIEtxeeDM5wOBn1lBV0aPP7iYe4Ih+RUC6F2culXao=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.2.1/android-studio-rabbit2-canary1-mac_arm.dmg";
+        sha256Hash = "sha256-Z6mDdui46xm3K1Tr1mogfU28VCh6T1AvJn9xVVEKc8E=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.2.3/android-studio-rabbit2-canary3-mac_arm.dmg";
       };
     };
   };

pkgs/applications/editors/eclipse/default.nix

@@ -21,8 +21,7 @@
 }:
 
 # ./update.sh fully automates updating for each quarterly release.  you can run
-# it manually, or wait for https://nix-community.github.io/nixpkgs-update/ to do
-# so.
+# it manually, or wait for nixpkgs-update to do so.
 #
 # then, to test (on x86_64):
 # for e in $(cat pkgs/applications/editors/eclipse/eclipses.json | jq '.eclipses | keys | .[] | ascii_downcase' -r); do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix-build -A ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done

pkgs/applications/editors/vim/plugins/aliases.nix

@@ -65,6 +65,7 @@ mapAliases (
     todo-nvim = throw "'vimPlugins.todo-nvim' has been removed: abandoned by upstream"; # Added 2023-08-23
     typescript-nvim = throw "'vimPlugins.typescript-nvim' has been removed: upstream deleted repository"; # Added 2026-06-15
     vim-csharp = throw "'vimPlugins.vim-csharp' has been removed: repository deleted"; # Added 2026-05-12
+    vim-gml = throw "'vimPlugins.vim-gml' has been removed because the author deleted their GitHub account"; # Added 2026-10-02
     vim-sourcetrail = throw "'vimPlugins.vim-sourcetrail' has been removed: abandoned by upstream"; # Added 2022-08-14
     vimacs = throw "'vimPlugins.vimacs' has been removed due to lack of maintenance"; # Added 2026-07-07
     # keep-sorted end

pkgs/applications/editors/vim/plugins/deprecated.json

@@ -259,6 +259,10 @@
         "date": "2026-02-04",
         "new": "vim-hier"
     },
+    "himalaya-vim": {
+        "date": "2026-10-01",
+        "new": "himalaya-vim9"
+    },
     "hlint-refactor": {
         "date": "2026-02-04",
         "new": "hlint-refactor-vim"

pkgs/applications/editors/vim/plugins/generated.nix

@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-28";
+    version = "0-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "411163b2be396495c76788a016cb1354f1e8acd0";
-      hash = "sha256-x+nym6jprfHZSUH8qT+1JHmV/nG66BAhwMENxTah2pI=";
+      rev = "ec1b50c7fb9638e0a7b35e0182a54343b45f8d0d";
+      hash = "sha256-EBgK4HuMjJa71tDV3dgH60XgQ7Z1GRrWlaoHmMDwU+Q=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-28";
+    version = "0.0.82-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "eda4d09170fd9bd08dd9abbe300f1f5bcaae0a20";
-      hash = "sha256-4chqsnJIuNyjNN6r7ct48qjQhZfJQRPCKkaWIOOj3/Y=";
+      rev = "0ab39f2ab540676d413431fee65ec0ad9c2829ac";
+      hash = "sha256-qxKim8R/kUeTUMLDQDWAG5Ag2gabW6Fk6dDhdHJyxUM=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.26.0";
+    version = "19.27.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.26.0";
-      hash = "sha256-KS3F/h1UCYSsztWKy2RouS89I46+y7uB/qykHJ4lIf0=";
+      tag = "v19.27.0";
+      hash = "sha256-8iJyUnsgdJsLqrMKasoaDjSiAwgWAEujF6GMEF9Jq2k=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4130,12 +4130,12 @@ final: prev: {
 
   copilot-lua = buildVimPlugin {
     pname = "copilot.lua";
-    version = "3.1.10";
+    version = "3.1.11";
     src = fetchFromGitHub {
       owner = "zbirenbaum";
       repo = "copilot.lua";
-      tag = "v3.1.10";
-      hash = "sha256-zL2yBu52mnMEj52tutE1aa++O75CAYGr9uHafDH8Qv0=";
+      tag = "v3.1.11";
+      hash = "sha256-EwiQt71RuOrF334rxMb0YoejfYALqrkH88kcJWYBX1U=";
     };
     meta.homepage = "https://github.com/zbirenbaum/copilot.lua/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5308,12 +5308,12 @@ final: prev: {
 
   diffview-plus-nvim = buildVimPlugin {
     pname = "diffview-plus.nvim";
-    version = "0.37";
+    version = "0.38";
     src = fetchFromGitHub {
       owner = "dlyongemallo";
       repo = "diffview-plus.nvim";
-      tag = "v0.37";
-      hash = "sha256-5ZYl7D/V5tFhlojwj6EvHXnQVvfdiLxzpAlNUejLJzI=";
+      tag = "v0.38";
+      hash = "sha256-g9pzU0BmW4TapywQj344PzvKWWSiybt1tUZL1oIoTLI=";
     };
     meta.homepage = "https://github.com/dlyongemallo/diffview-plus.nvim/";
     meta.license = unfree;
@@ -5392,12 +5392,12 @@ final: prev: {
 
   doom-one-nvim = buildVimPlugin {
     pname = "doom-one.nvim";
-    version = "0-unstable-2025-06-28";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "NTBBloodbath";
       repo = "doom-one.nvim";
-      rev = "beae92173315c7282f6897e666cfd67fbf0f3ac9";
-      hash = "sha256-gsS/n0CQ41WTl0sQxEWoWe7+wzTUyVKlrgaTC+Q2Nuc=";
+      rev = "960d8bf49904001b7cf37fdc34ca18dffb21b024";
+      hash = "sha256-8rZ6zs1IooJwpS3wBNeBspHd7UQUgtWqZFASWVidO+o=";
     };
     meta.homepage = "https://github.com/NTBBloodbath/doom-one.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6487,12 +6487,12 @@ final: prev: {
 
   fzf-vim = buildVimPlugin {
     pname = "fzf.vim";
-    version = "0-unstable-2026-09-26";
+    version = "0-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "a630ef91e1e050574e703f506cd0812b18d26939";
-      hash = "sha256-QgHHnwpchIyP3H8cP3aMHjXcOm6cCsVDwo/uOzYZAtQ=";
+      rev = "023de3c0e158ff9c2b0992175af10be97c2f2158";
+      hash = "sha256-HP8uwFiAVvw0E+vIDnMdwZ+ovgRJPAnJarYqmDeYFS4=";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -7549,16 +7549,16 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  himalaya-vim = buildVimPlugin {
-    pname = "himalaya-vim";
-    version = "0-unstable-2026-02-24";
+  himalaya-vim9 = buildVimPlugin {
+    pname = "himalaya-vim9";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "pimalaya";
-      repo = "himalaya-vim";
-      rev = "978f2b463c4ece28f5e1457029d399638e439704";
-      hash = "sha256-mm7fU/xnKzUfIvJN7tQfIRswWood7HPAmuD9PZUEN6I=";
+      repo = "himalaya-vim9";
+      rev = "c85636dcebbb8060599ff1f94ba18c99f6a3a677";
+      hash = "sha256-DJ8rsMHBPG8gvq/88kEWm/iQ5khyenoh4MwGq48/s08=";
     };
-    meta.homepage = "https://github.com/pimalaya/himalaya-vim/";
+    meta.homepage = "https://github.com/pimalaya/himalaya-vim9/";
     meta.license = getLicenseFromSpdxId "MIT";
     meta.hydraPlatforms = [ ];
   };
@@ -8343,8 +8343,8 @@ final: prev: {
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
       hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
-    meta.license = unfree;
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim/";
+    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
     meta.hydraPlatforms = [ ];
   };
 
@@ -11233,12 +11233,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-28";
+    version = "1.4.0-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "4b39a6d9f2d3d481225eedcf85d04506e2cb997e";
-      hash = "sha256-iTBInA4dtl6aMioAxY2paZqV97jPYyi8hXX1N7SVkYY=";
+      rev = "e7a24a8b3f0abbea46acb5b2f8402289d20328d1";
+      hash = "sha256-MMCEotktabUzrfIIPdVHGYTOqyqKJMk+KDO4bJJJXTU=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11317,12 +11317,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-09-28";
+    version = "3.0.0-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "c51a1dc7e0e0f40c4c396a2b1ceaa44b44e96032";
-      hash = "sha256-ZAchwF5J+ftB5pk2Z+gBaNpNWMmT6wh/cf+z51vO6g0=";
+      rev = "70708be9664b7fcdd010eb07bdc3ebc9311c2027";
+      hash = "sha256-GRsi6WHNa87RsOD/S+wCYFr4TOqNql/ivT5a/vyRqf8=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11668,12 +11668,12 @@ final: prev: {
 
   neotest-gtest = buildVimPlugin {
     pname = "neotest-gtest";
-    version = "0-unstable-2025-09-26";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "alfaix";
       repo = "neotest-gtest";
-      rev = "b66f1d33cbf3b37b9803e6bc7ef47ac60eba86b1";
-      hash = "sha256-3za8pI1WmKprBhEVcf8P6rWtsc3pe55EqshN7xDIIQY=";
+      rev = "bdffb45731ed2a6f40ca94ed662cadb8add73b30";
+      hash = "sha256-qQfNur/XKGI6yTSMdqaGZrO6LqWD41TXL2E2Y9zH3tc=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/alfaix/neotest-gtest/";
@@ -11697,12 +11697,12 @@ final: prev: {
 
   neotest-java = buildVimPlugin {
     pname = "neotest-java";
-    version = "0.39.0";
+    version = "0.39.1";
     src = fetchFromGitHub {
       owner = "rcasia";
       repo = "neotest-java";
-      tag = "v0.39.0";
-      hash = "sha256-FByGkU2pig8b9w59812B7o7IgSFnEjeDM7shRzAaoi8=";
+      tag = "v0.39.1";
+      hash = "sha256-WyqvtLOtY+wWSSi+NHO1wbHqPoo4vmK8MeppTxgqKnI=";
     };
     meta.homepage = "https://github.com/rcasia/neotest-java/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11879,12 +11879,12 @@ final: prev: {
 
   neotest-vitest = buildVimPlugin {
     pname = "neotest-vitest";
-    version = "0.2.0-unstable-2026-07-12";
+    version = "0.2.0-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "marilari88";
       repo = "neotest-vitest";
-      rev = "c3c69715da4b158069fd4262083e7219a5c14cfb";
-      hash = "sha256-BPERc4+iWEu1UWDXv+MaSUXJR4KNFFAqrPXxyJCSe9I=";
+      rev = "b0c265743c877058068dbc40d104ea5d40e6b257";
+      hash = "sha256-3BeHnwu+bpESfiyE/wAcJdX0afDt+dA+wFqX+wEf9yQ=";
     };
     meta.homepage = "https://github.com/marilari88/neotest-vitest/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13986,12 +13986,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-27";
+    version = "0.10.0-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "728e031f6b11d03d1f0708b7dc4fb0f1d9c8a137";
-      hash = "sha256-z6e3Dvp8TQDjTRglfVq0B+7Ejozwnw/zSvpGuSy6rbY=";
+      rev = "910fdf6f49e9dee7e7257c7d11a76b040fdfb9de";
+      hash = "sha256-xmwLHE8JeSDyXeFggx1DzOPHc6OcNHngYEyuAcfI/Ck=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15402,12 +15402,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.4.0-1";
+    version = "6.4.1-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.4.0-1";
-      hash = "sha256-YpLFIn1Kz/WwbGlJLt9urbOyVSwvjeZlr/aRnWW4o8g=";
+      tag = "v6.4.1-1";
+      hash = "sha256-LUwPYPmgu4eM6ChyNcgQ9IztCF4Pu7tkDWRsj5WofnU=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15458,12 +15458,12 @@ final: prev: {
 
   pum-vim = buildVimPlugin {
     pname = "pum.vim";
-    version = "2.0-unstable-2026-09-19";
+    version = "2.0-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "pum.vim";
-      rev = "c7140bef217dbb6bf8f41e8c649d2c6a8a3d6e05";
-      hash = "sha256-5KsNU842iEa1tm2feJowW4g+JIbfpN5jG4/yjfdyvIQ=";
+      rev = "4ed3576e3399fa65611be00670a084702f110acb";
+      hash = "sha256-RIHbIpM6NqGzKpIkBmHvGDRCOnw/4jFYxduk/Mnxf74=";
     };
     meta.homepage = "https://github.com/Shougo/pum.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16844,12 +16844,12 @@ final: prev: {
 
   splitjoin-vim = buildVimPlugin {
     pname = "splitjoin.vim";
-    version = "1.2.0-unstable-2026-05-24";
+    version = "1.2.0-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "AndrewRadev";
       repo = "splitjoin.vim";
-      rev = "b26971a7fdc7ca645b766459e3ed7949300c404f";
-      hash = "sha256-IWBFDaltzAhM0QSTPTgb7wdrCM4CysQpaZ3kw0NkQAU=";
+      rev = "659635fd768d8061b0db89a1ecb4611718a41277";
+      hash = "sha256-oILmvdkdc8pF/kwTIdn1nlI9E5LSAcvyGCYS2v3vT7k=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/AndrewRadev/splitjoin.vim/";
@@ -18208,12 +18208,12 @@ final: prev: {
 
   tinted-nvim = buildVimPlugin {
     pname = "tinted-nvim";
-    version = "1.0.0-unstable-2026-09-24";
+    version = "1.0.0-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-nvim";
-      rev = "7df9050dc4fa07efcdaf4046b2d746a9f39b0a5b";
-      hash = "sha256-8KL8OKA7iib0L1jfVMhkR8VHbgk+AMTJDRJj1dAjpXY=";
+      rev = "19f5ca22a98e8bded44e461f41758a08bad77984";
+      hash = "sha256-+BjpFxR8wp6N7WGDpRHVbALYn7cFFIQjJJCVQxTQVpA=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18222,12 +18222,12 @@ final: prev: {
 
   tinted-vim = buildVimPlugin {
     pname = "tinted-vim";
-    version = "01-unstable-2026-09-24";
+    version = "01-unstable-2026-09-30";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-vim";
-      rev = "57f981abc891b9adaa69cdc43d590f569bd5ec18";
-      hash = "sha256-TESqcY8VNmi/ONSqcILNPHvGVRfXMxttFDIvwKB+doU=";
+      rev = "915ed775399bad0f2995c05a1633067a252eab63";
+      hash = "sha256-esdTyb0OiafqHv4khFFxZrl2XL3pX3ZDrcFSuGnfWps=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-vim/";
     meta.license = unfree;
@@ -18348,12 +18348,12 @@ final: prev: {
 
   tmux-nvim = buildVimPlugin {
     pname = "tmux.nvim";
-    version = "0-unstable-2026-04-13";
+    version = "0-unstable-2026-09-29";
     src = fetchFromGitHub {
       owner = "aserowy";
       repo = "tmux.nvim";
-      rev = "32ceaf2793582955ef9576809730878c4d2d9426";
-      hash = "sha256-dKarwc0NByKV8/rMHnHqwiRTgeiXAPGsviFBP+bOaXI=";
+      rev = "8d79b15bc8f115c956f467788db58b827afd0764";
+      hash = "sha256-DVqCNcIxYt2rhdBAQHyzTEtJztT0EOWFQX+QiI4bk7I=";
     };
     meta.homepage = "https://github.com/aserowy/tmux.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -19136,12 +19136,12 @@ final: prev: {
 
   vifm-vim = buildVimPlugin {
     pname = "vifm.vim";
-    version = "0.14-unstable-2026-09-04";
+    version = "0.14-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "vifm";
       repo = "vifm.vim";
-      rev = "4327c00ecc8c3dcefb5f898bbfaa2ca20bac9927";
-      hash = "sha256-Wb0I+tL/QX/xkbxCJh/sEuSbYnywhSSxGnvT6lz/IMs=";
+      rev = "a2a66fd3c43144dad1fb15e9e99a7fcdb77707a3";
+      hash = "sha256-cU8rCdEO5McQA0Bm81HL+uNBqeHw174zcKlJ8Ry2EkM=";
     };
     meta.homepage = "https://github.com/vifm/vifm.vim/";
     meta.license = unfree;
@@ -21402,20 +21402,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  vim-gml = buildVimPlugin {
-    pname = "vim-gml";
-    version = "0-unstable-2022-10-04";
-    src = fetchFromGitHub {
-      owner = "JafarDakhan";
-      repo = "vim-gml";
-      rev = "382f7aecf6da88c077f34df2f863e750b4d0fdd3";
-      hash = "sha256-xIchBiNEZbrz0LRIWorJEac8y4DBa4akuM4JPqM0Yp4=";
-    };
-    meta.homepage = "https://github.com/JafarDakhan/vim-gml/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   vim-gnupg = buildVimPlugin {
     pname = "vim-gnupg";
     version = "2.7.1-unstable-2022-05-19";
@@ -21544,12 +21530,12 @@ final: prev: {
 
   vim-habamax = buildVimPlugin {
     pname = "vim-habamax";
-    version = "0-unstable-2026-09-12";
+    version = "0-unstable-2026-10-02";
     src = fetchFromGitHub {
       owner = "habamax";
       repo = "vim-habamax";
-      rev = "c538284552cf22abb733140c77cd0cc95cb80a05";
-      hash = "sha256-TjFLjy3TOZCkC4vWAtCCPJul+ZsTyaBh8NK/tpUUS9s=";
+      rev = "260292e1ece7b6239378e7841bb6a2235c353077";
+      hash = "sha256-MyUflNyUkzXf0JVRF3TWq6bFs6Ye1FSIuo8k3yjeAtQ=";
     };
     meta.homepage = "https://github.com/habamax/vim-habamax/";
     meta.license = unfree;
@@ -22526,12 +22512,12 @@ final: prev: {
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "0.0.1-unstable-2026-09-05";
+    version = "0.0.1-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "c61a46e4cc31ec58159d3908e5b1f1003923990b";
-      hash = "sha256-7DW9ONktKXIxWM08Xok4RBhnEPnRrVCDKpkH9LKMX8k=";
+      rev = "adbd9698b7cd417d76038487fc9158208c1e8566";
+      hash = "sha256-X8Yo3XYFodgpp9R1KFzsyj292iIbY/QPwU4jn/LU7LM=";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -24010,12 +23996,12 @@ final: prev: {
 
   vim-sexp = buildVimPlugin {
     pname = "vim-sexp";
-    version = "0-unstable-2026-05-16";
+    version = "0-unstable-2026-10-01";
     src = fetchFromGitHub {
       owner = "guns";
       repo = "vim-sexp";
-      rev = "1bf50921308f0188d1c1ecf8a712cc72ab2775e5";
-      hash = "sha256-JbqCrNNCu+JiHMg74SwHGs0RimfKnC7J9rQGQpGMUHM=";
+      rev = "b2ff4532c5913f539fe96fd8425e0e150ab21997";
+      hash = "sha256-17jDobDR1ZVptPIgrCESeCEBrl9sqAD8gJ1QJqtLTig=";
     };
     meta.homepage = "https://github.com/guns/vim-sexp/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -25422,12 +25408,12 @@ final: prev: {
 
   vimade = buildVimPlugin {
     pname = "vimade";
-    version = "2.5.1-unstable-2026-07-16";
+    version = "2.5.1-unstable-2026-09-29";
     src = fetchFromGitHub {
       owner = "TaDaa";
       repo = "vimade";
-      rev = "3d3d2db7ecd43c0181b20fede11d26f090dbc0d9";
-      hash = "sha256-dR+h9pPglZmpOsrmOUJpwVDcx5m+RqeNMjsoWcGhMsQ=";
+      rev = "bc6e2d3031b81de39e7b48d20f62ea716a97446d";
+      hash = "sha256-l+mkcdIdcQOIy+licmNE4NdeTmwrfnnky7QFbn5nk+4=";
     };
     meta.homepage = "https://github.com/TaDaa/vimade/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -26221,12 +26207,12 @@ final: prev: {
 
   yats-vim = buildVimPlugin {
     pname = "yats.vim";
-    version = "0-unstable-2026-09-10";
+    version = "0-unstable-2026-09-29";
     src = fetchFromGitHub {
       owner = "HerringtonDarkholme";
       repo = "yats.vim";
-      rev = "ed51b581160bf7b04092a5448c8dc3c8b4c6849b";
-      hash = "sha256-pfMBi+FbLYj1YOJpitq/BGCCBXf/GJryXjxM4ZK/oZA=";
+      rev = "a7ad1651c02460d29e3e2648ce939e51bc8673b3";
+      hash = "sha256-j18YDHj/x/kpcH2vEU4loXGtbKTRU6KpC8/lvq1Cnw0=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/HerringtonDarkholme/yats.vim/";
@@ -26418,12 +26404,12 @@ final: prev: {
 
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
-    version = "0.5.2";
+    version = "0.5.3";
     src = fetchFromGitHub {
       owner = "zk-org";
       repo = "zk-nvim";
-      tag = "v0.5.2";
-      hash = "sha256-KZIQXjEvFsJCkGxGILcKzSYJpBL+wa39mI28tccPlDg=";
+      tag = "v0.5.3";
+      hash = "sha256-uCh2v4cZ2NuPkhHzsyhKfvBocUC779Gr9XZtVQQYFpo=";
     };
     meta.homepage = "https://github.com/zk-org/zk-nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -786,12 +786,12 @@
     };
     fidl = buildGrammar {
       language = "fidl";
-      version = "0.0.0+rev=3faeeae";
+      version = "0.0.0+rev=bd81f64";
       src = fetchFromGitHub {
         owner = "google";
         repo = "tree-sitter-fidl";
-        rev = "3faeeae0dbe66b54be0086daa0e0af4da44e7d68";
-        hash = "sha256-G2a0NGfMnY4e8WbH7QIiX4kaZ7G2Plzt2KO0HXf6vcQ=";
+        rev = "bd81f6429a1539b05f52a4344bc9f6ac11d73d1f";
+        hash = "sha256-z2j/GKgrR33jKxGQmFj5NjTUcXngtC6Ar2oubdoIKec=";
       };
       meta.homepage = "https://github.com/google/tree-sitter-fidl";
     };
@@ -1181,12 +1181,12 @@
     };
     groovy = buildGrammar {
       language = "groovy";
-      version = "0.0.0+rev=deb0dcf";
+      version = "0.0.0+rev=2a6ddd5";
       src = fetchFromGitHub {
         owner = "murtaza64";
         repo = "tree-sitter-groovy";
-        rev = "deb0dcf8c4544f07564060f6e9b9f6e4b0bfc27d";
-        hash = "sha256-x7PawYYtgsduh60KNnS4LgB7SvoBV9aOJ9cHNsLBBhc=";
+        rev = "2a6ddd558b6aa39c5b77d8db9fe9baf817486b2c";
+        hash = "sha256-VCGG8La067V2m/16wxwldj3rKrAl822j58u7j9Qa1d0=";
       };
       meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
     };
@@ -1592,12 +1592,12 @@
     };
     julia = buildGrammar {
       language = "julia";
-      version = "0.0.0+rev=e04970e";
+      version = "0.0.0+rev=9b92fdd";
       src = fetchFromGitHub {
         owner = "tree-sitter-grammars";
         repo = "tree-sitter-julia";
-        rev = "e04970eea7b8cc1a526191b37ab2113c3ebc374f";
-        hash = "sha256-GuCzs6d4Uhu0+rgJDrbKCfVjUUwbxRegFAVUYJoaa2w=";
+        rev = "9b92fddcedb55003b32601238653b121bc46f544";
+        hash = "sha256-VvZHh2JpQ7s9djH13IZFvLYzlsb0+fT8PNnmXGue0iA=";
       };
       meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-julia";
     };
@@ -2012,12 +2012,12 @@
     };
     nix = buildGrammar {
       language = "nix";
-      version = "0.0.0+rev=a2cd7f4";
+      version = "0.0.0+rev=929f535";
       src = fetchFromGitHub {
         owner = "nix-community";
         repo = "tree-sitter-nix";
-        rev = "a2cd7f4011c6e5830c0c9af5aa35441b3ddd5fba";
-        hash = "sha256-IOanyzxBlLzlCOmLQa7hn+n1Yyc30upbmeuth7M4VcA=";
+        rev = "929f53586dcc0611d2c9406886d9d18033ed71bc";
+        hash = "sha256-fAdq5luxS6klTenlFOztDSnCgtE9JfA+VJpYcDAJz/Q=";
       };
       meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
     };
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=187fd4d";
+      version = "0.0.0+rev=35245fb";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "187fd4d3e55e2088da9cb31e414a2bac866292e8";
-        hash = "sha256-Qzl3rs1dOokT4gU14uaXCBG7RFgieoFWu24pEh8gPfU=";
+        rev = "35245fbfee2fccf16273c6f4299438fb76875970";
+        hash = "sha256-uHlltkIrkbWHLNasn346h9v4MXzvhF8O+uNQNt3pkvA=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3063,12 +3063,12 @@
     };
     systemverilog = buildGrammar {
       language = "systemverilog";
-      version = "0.0.0+rev=3390da8";
+      version = "0.0.0+rev=d6be611";
       src = fetchFromGitHub {
         owner = "gmlarumbe";
         repo = "tree-sitter-systemverilog";
-        rev = "3390da8c76a976b6f47d19667accc43e81a1483b";
-        hash = "sha256-ukebcwVJvMsGi91NDF1VZMJZufSzTZqsDapZzf33V20=";
+        rev = "d6be6119fe4d04c65c567e7b79625aa6280fea34";
+        hash = "sha256-3g5hAh5r5YJ96bdtLS74OeIiSbDhiLRYGzRa3iUhPHg=";
       };
       meta.homepage = "https://github.com/gmlarumbe/tree-sitter-systemverilog";
     };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1841,7 +1841,7 @@ assertNoAdditions {
     runtimeDeps = [ xxd ];
   };
 
-  himalaya-vim = super.himalaya-vim.overrideAttrs {
+  himalaya-vim9 = super.himalaya-vim9.overrideAttrs {
     buildInputs = [ himalaya ];
     # Optional integrations
     checkInputs = with self; [

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -537,7 +537,7 @@ https://github.com/lmilojevicc/herdr-splits.nvim/,,
 https://github.com/RaafatTurki/hex.nvim/,,
 https://github.com/Yggdroot/hiPairs/,,
 https://github.com/tzachar/highlight-undo.nvim/,,
-https://github.com/pimalaya/himalaya-vim/,,
+https://github.com/pimalaya/himalaya-vim9/,,
 https://github.com/m-demare/hlargs.nvim/,,
 https://github.com/shellRaining/hlchunk.nvim/,,
 https://github.com/mpickering/hlint-refactor-vim/,,
@@ -1526,7 +1526,6 @@ https://github.com/itchyny/vim-gitbranch/,,
 https://github.com/airblade/vim-gitgutter/,,
 https://github.com/junegunn/vim-github-dashboard/,,
 https://github.com/stykhomyrov/vim-glsl/,,
-https://github.com/JafarDakhan/vim-gml/,,
 https://github.com/jamessan/vim-gnupg/,,
 https://github.com/fatih/vim-go/,,
 https://github.com/habamax/vim-godot/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-CftijAYW4hoMryxPSXfq/GffTZahAn8FeCParZcRHdM=";
+          hash = "sha256-TY0MaNfh/Iv0K/AYy0frD71US0NFpgk7k2yrClTeXTc=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-qaE5dSnOFECIK7PoJOgOYAuEqH7wEcewL5XhFaxyPu0=";
+          hash = "sha256-BGEyoZX6WARlrPevsunwrX5C9YvhTTURuzRi9A/c594=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rOTO8zbsL+YrsrPhj1TN5PhQWp8y6XoJqn7z1ZJh5pw=";
+          hash = "sha256-QTEgBlSjb/Y8eYBl9HQVgZCyeDIXZR5gzEizv/JxVN0=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.285";
+      version = "2.1.287";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/astral-sh.ty/default.nix

@@ -0,0 +1,59 @@
+{
+  stdenvNoCC,
+  lib,
+  vscode-utils,
+  ty,
+  vscode-extension-update-script,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-A9cFMhVMC+duJmRIbWcVWExZdAtDi7bj95cphL8FQ1g=";
+        };
+        "aarch64-linux" = {
+          arch = "linux-arm64";
+          hash = "sha256-//xadLpMq3b/vIfK93Gd3yCwAvpSRqJ7NdvpFtRgDRE=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-pGW+TEc69V50dmDdgbqBeFSrzRjfIVxp9NUX+CGQ84g=";
+        };
+      };
+    in
+    {
+      name = "ty";
+      publisher = "astral-sh";
+      version = "2026.76.0";
+    }
+    // sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+  postInstall = ''
+    test -x "$out/$installPrefix/bundled/libs/bin/ty" || {
+      echo "Replacing the bundled ty binary failed, because 'bundled/libs/bin/ty' is missing."
+      echo "Update the package to the match the new path/behavior."
+      exit 1
+    }
+    ln -sf ${lib.getExe ty} "$out/$installPrefix/bundled/libs/bin/ty"
+  '';
+
+  passthru.updateScript = vscode-extension-update-script { };
+
+  meta = {
+    license = lib.licenses.mit;
+    changelog = "https://marketplace.visualstudio.com/items/astral-sh.ty/changelog";
+    description = "Visual Studio Code extension with support for the ty type checker and language server";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=astral-sh.ty";
+    homepage = "https://github.com/astral-sh/ty-vscode";
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-linux"
+    ];
+    maintainers = [ lib.maintainers.thegu5 ];
+  };
+}

pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "calva";
     publisher = "betterthantomorrow";
-    version = "2.0.597";
-    hash = "sha256-/vUTCigRl1iH9IWa7DzBbeKjrR3dvQKhw15+UEdLwa0=";
+    version = "2.0.599";
+    hash = "sha256-gfI4l/G3Yr6uk0ZCsJKPM+/Dp09xWv6k8GvUj8tEPYs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-sZ9dwKsCNHIQQDnHRLF7U/sq3tt3MECDjpEwO4emn6I=";
+          hash = "sha256-rcF2hINVWsnGkOoGz/pCbUngaK9p/Wan03qSTnxB/Xs=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-sUjRLPUM8gc1ddBajfd+C0HQsY87mzQ+/BcXxOS6a0I=";
+          hash = "sha256-j7pv4MICFzqfFCI+dmgB7xtnMRIXkgRYyEBzIZaJwNI=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-ifxVrJmXZPdOvfS0Dnl/ns/qtP1UP4RbZhLWs10AweU=";
+          hash = "sha256-ef52k2aBnFnTdrUWyw5n4tIaMHXaOpWTW+3DWIai1+o=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.82.0";
+      version = "2026.84.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -408,6 +408,8 @@ let
         };
       };
 
+      astral-sh.ty = callPackage ./astral-sh.ty { };
+
       astro-build.astro-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "astro-vscode";
@@ -513,8 +515,8 @@ let
         mktplcRef = {
           publisher = "banacorn";
           name = "agda-mode";
-          version = "0.10.2";
-          hash = "sha256-XpVhFFxmvoIHh64abRVQ+hrdauJBwg+doJGNoweH2hU=";
+          version = "0.10.3";
+          hash = "sha256-z1s4edXz1Wx29v/iSyxyEae5dygYuMsfawkGBMBeb94=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -1190,8 +1192,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.24.72";
-          hash = "sha256-yIQALNOm9C0ji+g96oqaXDuwlbS+088+whbFTQAe5Z8=";
+          version = "3.24.76";
+          hash = "sha256-8HwYwCtROlU8txNVREr45Jx1tpCI2a50uHfAb6iT7V8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1244,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.18.0";
-          hash = "sha256-Qf3o0QIW864p8BsRxB+RmGXe28N68Jqrzs+tpxeCceM=";
+          version = "2.19.0";
+          hash = "sha256-hW0Q0gnAanWZ4IuF/AY5uypvHZ5YDjvFnJzGn4Hd7V8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1302,8 +1304,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.53.0";
-          hash = "sha256-M+wFee1x/cCgGMFrDaV7OtIhEORHkLHf/Z06/VuZZmg=";
+          version = "3.53.1";
+          hash = "sha256-9OGG/ZvqzRzTQ6ERT0fKBkGwx1+zwD2FUWr9Hp1wLK0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";
@@ -1362,8 +1364,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.29.10";
-          hash = "sha256-t1FbUeFw5WMKyb/qwVJBpILB8z4wtWH/BOnMVEDg0pU=";
+          version = "2.29.12";
+          hash = "sha256-ZTrwgdbnyqBn4CIfH3+6vTvE1AXKgNHmm7bPExakXL8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1792,8 +1794,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.44.6";
-          hash = "sha256-9OAQIXdFqV3pLFmixB2ES8Ti/qK3uPk6yMRs9Y+w4aI=";
+          version = "0.46.0";
+          hash = "sha256-DUPUUSZX1lfC604BIaRKKlci0Eh0u2xyyLFclVjFacI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -2244,8 +2246,8 @@ let
         mktplcRef = {
           name = "vscode-drawio";
           publisher = "hediet";
-          version = "1.9.0";
-          hash = "sha256-gi3+mMJcUnkb0FFb6gmx9eI8BRLX3z/kTr7Rk0hudP4=";
+          version = "1.15.0";
+          hash = "sha256-4tRtVxdDYAtkgMu0rpgDnTNqfN4j7JoIpAWYUcfJVRA=";
         };
         meta = {
           description = "This unofficial extension integrates Draw.io into VS Code";
@@ -2723,8 +2725,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.242.2";
-          hash = "sha256-E8SdCf5emB/ix3qmj56CfWhCGCVIm4voI8fJoyCA2kE=";
+          version = "1.243.2";
+          hash = "sha256-907pr/y67bDKpKs1Sxk+XV7xUL8+e3jYW0tkHNWUEUs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4302,8 +4304,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.36";
-          hash = "sha256-acmubrmOUirHkam1CreoP7p/LR2/6A6kpBku8Den83Y=";
+          version = "0.8.39";
+          hash = "sha256-bRFEb6YtLFOTe9K1Y0vyfQDTgYVa6udy2CU2wz4Ht3w=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
@@ -5014,8 +5016,8 @@ let
         mktplcRef = {
           name = "errorlens";
           publisher = "usernamehw";
-          version = "3.28.0";
-          hash = "sha256-7eu7y9IR1uxSFZ0IplDieFt3iWbcmdwf1lAcXq+S4C8=";
+          version = "3.29.0";
+          hash = "sha256-kK9Axp2tMUGZ/04VtL5hzg35zvnRIjHpnmCJt9OhHQ8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -18,7 +18,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     # it does not matter which binary is fetched. Using only a single
     # hash makes this easier to maintain.
     arch = "linux-x64";
-    hash = "sha256-v/NDg3lQa/N1NwXmLlDPWFDHD0YpFWGY72QrQ4OoXrU=";
+    hash = "sha256-aAAojb6FvTj1xjS86LAAINRBJxxcEOrKPnaiYwrwSic=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "magic-racket";
     publisher = "evzen-wybitul";
-    version = "0.8.0";
-    hash = "sha256-yWmJFLXktsJDEDwHO8ZCXQBTw8j5bOv6TXEOO/V8mZs=";
+    version = "0.9.0";
+    hash = "sha256-EpSSSYoVnXHgJKoqSuMf/fTnGxAVqmc+RfXE5/HZ/C0=";
   };
   nativeBuildInputs = [
     jq

pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-Uym2S4NN78yUDQdg1qFednfYT5K6AkQfBOmDp3fFGoc=";
+          hash = "sha256-TCgYmw0uZ5NEoiIvNLCNrY7wXfich7sYmfoZEAyaeFU=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-tB6Z/rXYYLo/SsPLQiaQZ6KUJZhh+aiYaBMpJz0wbtk=";
+          hash = "sha256-LfkfByHLUB1KZ7BH49dSlP+84AqLf+19RdTt7BJZgBE=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-IicI0BbpGBDw+tGFlbefXA1iSPQZNLj/n0nv6zEGkHA=";
+          hash = "sha256-iHKlTHZ4wdHhrTqpPjLl/Fm5nYDEjPo0J+g0IAxJS58=";
         };
       };
     in
     {
       publisher = "kilocode";
       name = "Kilo-Code";
-      version = "7.6.2";
+      version = "7.7.9";
     }
     // sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system ${stdenv.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.17.1";
-    hash = "sha256-yoUFxyu4rgJVbSLU4BMdR4rF53DHQHw5qGFwqRw0X7I=";
+    version = "1.18.0";
+    hash = "sha256-ML44PSVZoW9aRyFVFd7IsRX2T9XQiqt0Tel9SutqErA=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -18,15 +18,15 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-FTS8cK9ovmxGLnywOGTIP7oUOHZ4RLE5t7lfhltdmIc=";
+        hash = "sha256-NnINb4ywaINKqNagJK6XampTqhBb3ztT/crNe0YV0fg=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-EV3745OXbwrRmc8P5e13DZbomyJGcYQUF07WflRWU1Q=";
+        hash = "sha256-ejzWiDT7Ie3rWkfXHUEyIJGh7Tn/vwXAHRz7q7gwjD8=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-KCIkjBmYZPiuFmQ3/aDycARYIHPyDTmMkoGcuG5DQX8=";
+        hash = "sha256-LXAtSvfxEGxt7YHMl8S9imDIb6/Mfi7BsTamwnx9sGE=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -50,7 +50,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.140.8";
+    version = "2.160.4";
     inherit (extInfo) hash arch;
   };
 

pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix

@@ -17,19 +17,19 @@ let
   vsix = stdenv.mkDerivation (finalAttrs: {
     name = "vscode-js-debug-${finalAttrs.version}.vsix";
     pname = "vscode-js-debug-vsix";
-    version = "1.117.0";
+    version = "1.140.0";
 
     src = fetchFromGitHub {
       owner = "microsoft";
       repo = "vscode-js-debug";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-1Mj7nfX5iVO0hhydCV/VbqN1x77WFEzG6/ahk1kN1fw=";
+      hash = "sha256-4bYss4fWLGrOsmfKYbaF9zSGl45jmUH73GCuba2IFw0=";
     };
 
     npmDeps = fetchNpmDeps {
       name = "${finalAttrs.pname}-npm-deps";
       inherit (finalAttrs) src;
-      hash = "sha256-uTtA5XjHfuI2e9IuNAYfDNKZE8c/wa+CWqAsmd/M3Xk=";
+      hash = "sha256-VoWBedocCL1EyMm7y2f4eOfl3s8SB6LujJQp6wAUJRM=";
     };
     makeCacheWritable = true;
 

pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "oxc";
     name = "oxc-vscode";
-    version = "1.61.0";
-    hash = "sha256-b+X57zVNIz2T/A4zmpd9Bc2x99gxbnUL9Yls1VVgUxc=";
+    version = "1.62.0";
+    hash = "sha256-ETz3fvkxZDLR9S0coibdKB0tU6JO66pXn+1AdUo9yKA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/posit.air-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "air-vscode";
     publisher = "posit";
-    version = "0.28.0";
-    hash = "sha256-/B5Qzbndk4l+PyEWlODfIOkBPSVrh6Qi3gFrNmUjykE=";
+    version = "0.30.0";
+    hash = "sha256-RAyXl111qODYMN0CiN/F+i6O3W0MvKdoV8Ap4dDzdsA=";
   };
   patchPhase = ''
     runHook prePatch

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.1.19";
-    hash = "sha256-Qo02ve7dIzkaotwqy5L1104v5EQpAj/JQUXya0Mm0c4=";
+    version = "4.1.22";
+    hash = "sha256-E0tUr5Th5Mxs0HIkph9oc8QMhF2fuh+eaqUQ3W4sU4I=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-gdyO/zg0NS8Md0o8WG96/0SrMw+VdJnRge6Io16l30Q=";
+      hash = "sha256-yDOQ1WYX9yt5nQkzTIRfSmDAQvPbusgkz9OS26nrTgY=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-MLj1xREDTZCrWVsTZGifSUNFKKMLGDtF3xV9kIR3umQ=";
+      hash = "sha256-TR8pA3F36t3SHVnLwAMUSBl5/G5EOd2rEO7MCzjopCg=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-4fy778ogxyuN6irrAO9ZTHAMH9Va/QjF4PoHEZCBdFY=";
+      hash = "sha256-K3bPccJzf0KRKOjuGp0OkAPyltr4yNk8amZkWI7WIig=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.5.5";
+    version = "1.5.8";
   };
   meta = {
     description = "TOML Language Server";

pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix

@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ufo5260987423";
     name = "magic-scheme";
-    version = "0.0.6";
-    hash = "sha256-ibEdsw/ulr+cagB90uALDbSsQV18dPULANCdnjPvhuI=";
+    version = "0.0.16";
+    hash = "sha256-ru7/AkbJi7Ogt/VZ6n2nDesvctv0UcyliEUKVWLp1/Q=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -13,22 +13,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-is7nNav1inG96NoND/XcVQhltT2sbvHa7qkb+wMGAC0=";
+          hash = "sha256-41D15WSCK67DK1ArIOgbApndYYq6X0Br1cDajjkhHsE=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-hsuV25YRGatyfK7QEZkdxgc4hyyC6JEfzF2ilRd8hYI=";
+          hash = "sha256-gWBEMWsootSivCnPI0q0VqMvw3vaQUS+AYTrGd9mV20=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-hHrr3ni0dcSSBqbs+XRP6P9xiyWcMqDYUi1z0+WnJNk=";
+          hash = "sha256-Qs3+dRfHs3iZ+mS1uj6o4vPrMF66NgH/8Xmpyo6vTeE=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.35.1";
+      version = "0.35.4";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/vscodium.nix

@@ -82,6 +82,7 @@ buildVscode rec {
       bobby285271
     ];
     mainProgram = "codium";
+    mainDarwinApp = "VSCodium.app";
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "154.0.8037.92",
+    "version": "154.0.8037.97",
     "chromedriver": {
-      "version": "154.0.8037.93",
-      "hash_darwin": "sha256-98b3h7D4+HHaZ7sLsr8v4Uv0xc3TqJLI2DWd8jchMCY=",
-      "hash_darwin_aarch64": "sha256-RVAlxmcKbxi7VPYXOwJlup3CLwLE/YPpISWDlaYQdPI="
+      "version": "154.0.8037.98",
+      "hash_darwin": "sha256-wFF742FI5Te8Sbi0pf5zSyMgywxNn+wL/zUmZz6afws=",
+      "hash_darwin_aarch64": "sha256-8xLtpiOei8IGi0RdHYcQQniTvDKlYjipzZ+/vcag40E="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "334b65d254ccc35df4fca82706d1753227b01039",
-        "hash": "sha256-UtjuCxGPAHukLFqtwvyW7QRlOah4N1xJ5bHAT1hYUVA=",
+        "rev": "b510e9d7cd3a2fbd78d0ddc42234103206c5f78d",
+        "hash": "sha256-AEolOO7VpF2DRA27gidQCmvhjj2Q71lz0qu3YEMO7fQ=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "802a8704ca940b633b731493ee192e0661eb8cdd",
-        "hash": "sha256-HqMu7GkWXTyIj/a4SY6f8x1wS/ficMQYyI/g0zuTlvM="
+        "rev": "e12217f3e133cb1029b050d893b1806d141483be",
+        "hash": "sha256-U2jOqL9RgpwA8CLJ6Ev+zw7+rOS+IRGMpcHYCz1v+PI="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -817,8 +817,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "3a8b0c76e6b7bf0e72141047f82eb2c3f4862c8d",
-        "hash": "sha256-G0R6xmcvBfbd+UghQScDeOvRxB8vbpDA8DxMSvQvkS8="
+        "rev": "dbaaaf413fe8c1d01c340af1a461c069960f43fc",
+        "hash": "sha256-BW6ve8ofEfDfeI/D5ZYxhJzctm63ERQ/l7Dk/ZotVmU="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -847,8 +847,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "31fac3bef58c3def36b0760e4ddc54ec77099596",
-        "hash": "sha256-hJfc8TsOIGi9pBXwDcxLoaO6RxczIn9mwYJAQoGBnI0="
+        "rev": "b3d6849efaf11696198e15b32290e6d6b0d540c1",
+        "hash": "sha256-Z8rruB23ovlJ6BtuVfJ/OqjqdfLPSrqyaAqZi47V5Ng="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -858,7 +858,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "154.0.8037.57",
+    "version": "154.0.8037.97",
     "deps": {
       "depot_tools": {
         "rev": "c101dcbe0489c455fce7c2247bfee19680b116c3",
@@ -870,16 +870,16 @@
         "hash": "sha256-2PZkXvE7GSxFhZinIwMMzz+8ObAH97vCvX4JlG11h/A="
       },
       "ungoogled-patches": {
-        "rev": "154.0.8037.57-1",
-        "hash": "sha256-Ykt3qX7GOcKuv3cRcx3/5Ccv/2JHavd+7+uOVYi6dpE="
+        "rev": "154.0.8037.97-1",
+        "hash": "sha256-Wdh12r7zgD6/j4cXvGXPMlA+KG/u2LOE8YR/BAq/jPg="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "73c14f6228d7cd537c855007e8f88678969cc0eb",
-        "hash": "sha256-LqS0Up2B1g7YWGx9N85hwMDQ2SktPjvxlJDfo8gxFOg=",
+        "rev": "b510e9d7cd3a2fbd78d0ddc42234103206c5f78d",
+        "hash": "sha256-AEolOO7VpF2DRA27gidQCmvhjj2Q71lz0qu3YEMO7fQ=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -949,8 +949,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "1ff8799c596d4fc9acea28343610b1f33650a6fa",
-        "hash": "sha256-aNsNXGV9V3tE9Xj0eb80EdPGi4gYJzmgQk3BIo/wxmY="
+        "rev": "e12217f3e133cb1029b050d893b1806d141483be",
+        "hash": "sha256-U2jOqL9RgpwA8CLJ6Ev+zw7+rOS+IRGMpcHYCz1v+PI="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -989,8 +989,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "8597a1aaec546a7f19e8e662a49ebf03b2e91308",
-        "hash": "sha256-zCY7dE1C2PGb2pQ/H6oNGjpSHUhhRTfTFkAgdJm3efE="
+        "rev": "38bc7fb0b3a024d05212958ae843e4ddf8c44ff1",
+        "hash": "sha256-l1naz112kynSTtFsE0LrpLSzvdGLxJJ19UMNfHvUkmw="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1674,8 +1674,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "3a8b0c76e6b7bf0e72141047f82eb2c3f4862c8d",
-        "hash": "sha256-G0R6xmcvBfbd+UghQScDeOvRxB8vbpDA8DxMSvQvkS8="
+        "rev": "dbaaaf413fe8c1d01c340af1a461c069960f43fc",
+        "hash": "sha256-BW6ve8ofEfDfeI/D5ZYxhJzctm63ERQ/l7Dk/ZotVmU="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1704,8 +1704,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "671f7c27ac0403ceb8074a8dfbcc02cdd7369c3f",
-        "hash": "sha256-0eEMZgbwW5edL4as79OibOVQidQL5rWYcGSdpq7ZPQo="
+        "rev": "b3d6849efaf11696198e15b32290e6d6b0d540c1",
+        "hash": "sha256-Z8rruB23ovlJ6BtuVfJ/OqjqdfLPSrqyaAqZi47V5Ng="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",