Merge dde6423243 into haskell-updates

Announcement: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html

.github/workflows/bot.yml

@@ -41,10 +41,6 @@ jobs:
   run:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
-    env:
-      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
-      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

doc/channels.chapter.md

@@ -0,0 +1,26 @@
+# How channels work {#how-channels-work}
+
+nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
+
+nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up to date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g. `nixos-22.11-small`).

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/rocq.section.md

@@ -68,7 +68,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
 * `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Rocq libraries and Rocq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environments of subsequent derivation, which is necessary for Rocq packages to work correctly,
 * `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `rocq-core.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Rocq was built against.
-* `useDuneifVersion` (optional, default to `(x: false)` uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
+* `useDuneifVersion` (optional, default to `(x: false)`) uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune` (optional, defaults to `false`) uses Dune to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
 * `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.

doc/languages-frameworks/texlive.section.md

@@ -32,6 +32,21 @@ There is a TeX Live packaging that lives entirely under attribute `texlive`.
   )
   ```
 
+- Packages can be overriden by passing a new package with the same `pname` to `.withPackages`. For instance, the following replaces Asymptote with the version from Nixpkgs, which is usually more up to date:
+  ```nix
+  texliveMedium.withPackages (ps: [ asymptote ])
+  ```
+
+- To exclude a package from a collection, use an empty override as below:
+  ```nix
+  texliveBasic.withPackages (
+    ps: with ps; [
+      collection-bibtexextra
+      { pname = "bib2gls"; }
+    ]
+  )
+  ```
+
 - To add the documentation for all packages in the environment, use
   ```nix
   texliveSmall.overrideAttrs { withDocs = true; }

doc/languages-frameworks/vim.section.md

@@ -149,6 +149,11 @@ Note: this is not possible anymore for Neovim.
 
 ## Adding new plugins to nixpkgs {#adding-new-plugins-to-nixpkgs}
 
+:::{.note}
+Before adding a Neovim Lua plugin, check if a release is available on [luarocks](https://luarocks.org/).
+If it is, add it as a [LuaRocks based plugin](#neovim-luarocks-based-plugins).
+:::
+
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`nix-shell -p vimPluginsUpdater --run vim-plugins-updater`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/updater.nix). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names).
 
 When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/update.py) to update the tree sitter grammars for `nvim-treesitter`.

doc/preface.chapter.md

@@ -1,50 +1,14 @@
-# Preface {#preface}
+# Overview {#preface}
 
-The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
-[Nix package manager](https://nixos.org/nix/), released under a
-[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
-Packages are available for several platforms, and can be used with the Nix
-package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
+Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
 
-This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
-It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
+Further documentation:
 
-To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
-- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
-- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
-- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
-
-## Overview of Nixpkgs {#overview-of-nixpkgs}
+- [NixOS Search](https://search.nixos.org)
+- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
 
 Nix expressions describe how to build packages from source and are collected in
-the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
-collection are Nix expressions for
-[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
-With these expressions the Nix package manager can build binary packages.
+the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
 
-Packages, including the Nix packages collection, are distributed through
-[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
-distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up-to-date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-Nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.,
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g., `nixos-22.11-small`).
+Packages are distributed through [channels](#how-channels-work).

doc/redirects.json

@@ -152,6 +152,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "how-channels-work": [
+    "index.html#how-channels-work"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -395,9 +398,7 @@
     "index.html#pnpm-build-hook-honored-variables"
   ],
   "preface": [
-    "index.html#preface"
-  ],
-  "overview-of-nixpkgs": [
+    "index.html#preface",
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
@@ -2920,7 +2921,8 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,6 +31,9 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

doc/using-nixpkgs.md

@@ -1,6 +1,7 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
+channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md

maintainers/maintainer-list.nix

@@ -1598,6 +1598,12 @@
     githubId = 153175;
     name = "Andrew Marshall";
   };
+  ambiso = {
+    email = "ambisotopy@gmail.com";
+    github = "ambiso";
+    githubId = 3750466;
+    name = "Robin Leander Schröder";
+  };
   ambossmann = {
     email = "timogottszky+git@gmail.com";
     github = "Ambossmann";
@@ -5238,6 +5244,12 @@
     githubId = 1448923;
     name = "Christian Kauhaus";
   };
+  ckgxrg = {
+    email = "ckgxrg@ckgxrg.io";
+    github = "ckgxrg-salt";
+    githubId = 165614491;
+    name = "ckgxrg";
+  };
   cko = {
     email = "christine.koppelt@gmail.com";
     github = "cko";
@@ -13260,12 +13272,6 @@
     githubId = 879272;
     name = "Julio Merino";
   };
-  jn-sena = {
-    email = "jn-sena@proton.me";
-    github = "jn-sena";
-    githubId = 45771313;
-    name = "Sena";
-  };
   jnsgruk = {
     email = "jon@sgrs.uk";
     github = "jnsgruk";
@@ -20788,8 +20794,9 @@
     github = "numinit";
     githubId = 369111;
     keys = [
-      # SSH
+      # SSH, per-machine yubikey ecdsa-sk keys
       { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
+      { fingerprint = "dye2C1N4RQaf+8ht5Ipd52BbnnuwBtdXxocPzk8b2mw"; }
       # GPG, >=2025, stays in one place
       { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
       # GPG, >=2025, travels with me

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

maintainers/scripts/luarocks-packages.csv

@@ -6,13 +6,13 @@ basexx,,,,,,
 bcrypt,,,,,,ulysseszhan
 binaryheap,,,,,,vcunat
 bit32,,,,,5.1,lblasc
-busted,,,,,,
+busted,,,,,,alerque
 busted-htest,,,,,,mrcjkb
 canola.nvim,,,,,,saadndm
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
-compat53,,,,,,vcunat
+compat53,,,,,,vcunat alerque
 coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
@@ -38,7 +38,7 @@ inspect,,,,,,
 jsregexp,,,,0.0.7-2,,
 kulala.nvim,,,,,,
 ldbus,,,https://luarocks.org/dev,,,
-ldoc,,,,,,
+ldoc,,,,,,alerque
 lgi,,,,,,
 linenoise,https://raw.githubusercontent.com/hoelzro/lua-linenoise/master/linenoise-0.9-1.rockspec,,,,,
 ljsyscall,,,,,5.1,lblasc
@@ -62,7 +62,7 @@ lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
 lua-ffi-zlib,,,,,,
-lua-iconv,,,,7.0.0,,
+lua-iconv,,,,7.0.0,,alerque
 lua-lsp,,,,,,
 lua-messagepack,,,,,,
 lua-protobuf,,,,,,lockejan
@@ -78,10 +78,10 @@ lua-toml,,,,,,
 lua-utils.nvim,,,,,,mrcjkb
 lua-yajl,,,,,,pstn
 lua-zlib,,,,,,koral
-lua_cliargs,,,,,,
+lua_cliargs,,,,,,alerque
 luabitop,https://raw.githubusercontent.com/teto/luabitop/master/luabitop-1.0.2-3.rockspec,,,,,
-luacheck,,,,,,
-luacov,,,,,,
+luacheck,,,,,,alerque
+luacov,,,,,,alerque
 luacov-reporter-lcov,,,,,,ulysseszhan
 luadbi,,,,,,
 luadbi-mysql,,,,,,
@@ -91,7 +91,7 @@ luaepnf,,,,,,
 luaevent,,,,,,
 luaexpat,,,,,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
-luafilesystem,,,,,,flosse
+luafilesystem,,,,,,flosse alerque
 lualdap,,,,,,aanderse
 lualine.nvim,,,https://luarocks.org/dev,,,
 lualogging,,,,,,
@@ -104,12 +104,12 @@ luarocks-build-rust-mlua,,,,,,mrcjkb
 luarocks-build-tree-sitter-cli,,,,,,
 luarocks-build-treesitter-parser,,,,,,mrcjkb
 luarocks-build-treesitter-parser-cpp,,,,,,mrcjkb
-luasec,,,,,,flosse
+luasec,,,,,,flosse alerque
 luasnip,,,,,,
-luasocket,,,,,,
+luasocket,,,,,,alerque
 luasql-sqlite3,,,,,,
-luassert,,,,,,
-luasystem,,,,,,
+luassert,,,,,,alerque
+luasystem,,,,,,alerque
 luatext,,,,,,
 luaunbound,,,,,,
 luaunit,,,,,,lockejan
@@ -159,7 +159,7 @@ rocks-git.nvim,,,,,5.1,mrcjkb
 rocks.nvim,,,,,5.1,mrcjkb
 rtp.nvim,,,,,5.1,mrcjkb
 rustaceanvim,,,,,5.1,mrcjkb
-say,,,,,,
+say,,,,,,alerque
 serpent,,,,,,lockejan
 sofa,,,,,,f4z3r
 sqlite,,,,,,

nixos/doc/manual/redirects.json

@@ -2306,6 +2306,9 @@
   "test-opt-meta.hydraPlatforms": [
     "index.html#test-opt-meta.hydraPlatforms"
   ],
+  "test-opt-meta.teams": [
+    "index.html#test-opt-meta.teams"
+  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -154,3 +154,5 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
+
+- `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).

nixos/lib/testing/meta.nix

@@ -1,6 +1,20 @@
-{ lib, ... }:
+{ lib, options, ... }:
 let
   inherit (lib) types mkOption literalMD;
+
+  # Approximate position of meta.teams / meta.maintainers in nixos tests.
+  # Right now this assumes only one such position and ignores other definitions.
+  # FIXME allow having multiple `maintainersPosition` et al..
+  getPosition =
+    definitionsWithLocations:
+    if definitionsWithLocations == [ ] then
+      null
+    else
+      {
+        file = (lib.head definitionsWithLocations).file;
+        column = 0;
+        line = 1;
+      };
 in
 {
   options = {
@@ -12,7 +26,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { config, ... }:
+        { options, config, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -22,6 +36,25 @@ in
                 The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
               '';
             };
+            maintainersPosition = mkOption {
+              internal = true;
+              readOnly = true;
+              type = types.nullOr types.attrs;
+              default = getPosition options.maintainers.definitionsWithLocations;
+            };
+            teams = mkOption {
+              type = types.listOf types.raw;
+              default = [ ];
+              description = ''
+                The [list of maintainer-teams](https://nixos.org/manual/nixpkgs/stable/#var-meta-teams) for this test.
+              '';
+            };
+            teamsPosition = mkOption {
+              internal = true;
+              readOnly = true;
+              type = types.nullOr types.attrs;
+              default = getPosition options.teams.definitionsWithLocations;
+            };
             timeout = mkOption {
               type = types.nullOr types.int;
               default = 3600; # 1 hour

nixos/modules/hardware/opentabletdriver.nix

@@ -61,16 +61,27 @@ in
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
 
+      unitConfig = {
+        After = "graphical-session.target";
+        ConditionEnvironment = [
+          "|WAYLAND_DISPLAY"
+          "|DISPLAY"
+        ];
+      };
+
       serviceConfig = {
         Type = "simple";
-        # workaround for https://github.com/NixOS/nixpkgs/issues/469340
-        ExecStartPre = pkgs.writeShellScript "disable-for-gdm-greeter" ''
-          if [[ "$USER" = "gdm-greeter"* ]]; then
+        # workaround for https://github.com/NixOS/nixpkgs/issues/469340 and
+        # https://github.com/OpenTabletDriver/OpenTabletDriver/issues/4885
+        ExecStartPre = pkgs.writeShellScript "poll-for-non-gdm-greeter-display" ''
+          if [[ "$USER" = "gdm-greeter"* \
+              || ( "$${XDG_SESSION_TYPE}" = wayland && -z "$${WAYLAND_DISPLAY}" ) ]]; then
             exit 1
           fi
         '';
         ExecStart = lib.getExe' cfg.package "otd-daemon";
         Restart = "on-failure";
+        RestartSec = 3;
       };
     };
   };

nixos/modules/security/account-utils.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.security.account-utils;
+  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -25,6 +26,16 @@ in
         :::
       '';
     };
+    pwaccessd.settings = lib.mkOption {
+      description = ''
+        Options for pwaccessd.
+        See {manpage}`pwaccessd.conf(5)` for available options.
+      '';
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -44,6 +55,8 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+    environment.etc."account-utils/pwaccessd.conf".source =
+      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };

nixos/modules/services/display-managers/gdm.nix

@@ -421,7 +421,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 
@@ -567,7 +567,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 
@@ -575,7 +575,7 @@ in
             {
               name = "unix";
               control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
               settings.nullok = true;
               settings.yescrypt = true;
             }

nixos/modules/services/display-managers/plasma-login-manager.nix

@@ -201,7 +201,7 @@ in
               # Setup session
               name = "unix";
               control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
             {
               name = "systemd";

nixos/modules/services/display-managers/sddm.nix

@@ -442,7 +442,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 

nixos/modules/services/misc/errbot.nix

@@ -91,6 +91,20 @@ in
     };
     users.groups.errbot = { };
 
+    systemd.tmpfiles.settings = {
+      "10-errbot" = lib.mapAttrs' (
+        name: instanceCfg:
+        let
+          dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else "/var/lib/errbot/${name}";
+        in
+        lib.nameValuePair "${dataDir}".d {
+          group = "errbot";
+          user = "errbot";
+          mode = "0755";
+        }
+      ) cfg.instances;
+    };
+
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
       lib.nameValuePair "errbot-${name}" (
@@ -103,12 +117,7 @@ in
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
-            PermissionsStartOnly = true;
           };
         }
       )

nixos/modules/services/networking/anubis.nix

@@ -374,6 +374,10 @@ in
       anubis = { };
     };
 
+    systemd.slices.system-anubis = {
+      description = "Anubis AI Firewall System Slice";
+      documentation = [ "https://anubis.techaro.lol" ];
+    };
     systemd.services = lib.mapAttrs' (
       name: instance:
       lib.nameValuePair "${instanceName name}" {
@@ -396,6 +400,7 @@ in
         );
 
         serviceConfig = {
+          Slice = "system-anubis.slice";
           User = instance.user;
           Group = instance.group;
           DynamicUser = true;

nixos/modules/services/networking/llama-swap.nix

@@ -42,6 +42,15 @@ in
       '';
     };
 
+    useLlamaCppCacheDir = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to use {file}`/var/cache/llama-cpp` as {env}`LLAMA_CACHE` instead
+        of {file}`/var/cache/llama-swap` to share models and other cache with {option}`services.llama-cpp`.
+      '';
+    };
+
     tls = {
       enable = lib.mkEnableOption "TLS encryption";
 
@@ -113,6 +122,10 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      environment = {
+        LLAMA_CACHE = lib.mkDefault "/var/cache/${config.systemd.services.llama-swap.serviceConfig.CacheDirectory}";
+      };
+
       serviceConfig = {
         Type = "exec";
         ExecStart = "${lib.getExe cfg.package} ${
@@ -130,6 +143,12 @@ in
         Restart = "on-failure";
         RestartSec = 3;
 
+        CacheDirectory =
+          if cfg.useLlamaCppCacheDir then
+            config.systemd.services.llama-cpp.serviceConfig.CacheDirectory
+          else
+            "llama-swap";
+
         # for GPU acceleration
         PrivateDevices = false;
 

nixos/modules/services/networking/tetrd.nix

@@ -5,13 +5,19 @@
   ...
 }:
 
+let
+  cfg = config.services.tetrd;
+in
 {
-  options.services.tetrd.enable = lib.mkEnableOption "tetrd";
+  options.services.tetrd = {
+    enable = lib.mkEnableOption "tetrd";
+    package = lib.mkPackageOption pkgs "tetrd" { };
+  };
 
-  config = lib.mkIf config.services.tetrd.enable {
+  config = lib.mkIf cfg.enable {
     environment = {
-      systemPackages = [ pkgs.tetrd ];
-      etc."resolv.conf".source = "/etc/tetrd/resolv.conf";
+      systemPackages = [ cfg.package ];
+      # etc."resolv.conf".source = "/etc/tetrd/resolv.conf"; # Disabled overwriting of resolve.conf since otherwise tetrd disables your dns when its not connected to a device.
     };
 
     # Our resolv.conf will override resolvconf's version.
@@ -21,11 +27,11 @@
       tmpfiles.rules = [ "f /etc/tetrd/resolv.conf - - -" ];
 
       services.tetrd = {
-        description = pkgs.tetrd.meta.description;
+        description = cfg.package.meta.description;
         wantedBy = [ "multi-user.target" ];
 
         serviceConfig = {
-          ExecStart = "${pkgs.tetrd}/opt/Tetrd/bin/tetrd";
+          ExecStart = "${cfg.package}/opt/Tetrd/bin/tetrd";
           Restart = "always";
           RuntimeDirectory = "tetrd";
           RootDirectory = "/run/tetrd";

nixos/modules/services/security/vaultwarden/default.nix

@@ -173,6 +173,7 @@ in
     domain = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
+      example = "bitwarden.example.com";
       description = "The domain under which VaultWarden will be reachable.";
     };
 

nixos/modules/services/ttys/kmscon.nix

@@ -214,7 +214,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
         session = utils.pam.autoOrderRules [
@@ -230,7 +230,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
           {
             name = "systemd";

nixos/modules/services/wayland/cage.nix

@@ -113,7 +113,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
             settings.nullok = true;
           }
         ];
@@ -121,14 +121,14 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
         session = utils.pam.autoOrderRules [
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
           {
             name = "env";

nixos/modules/services/web-apps/bentopdf.nix

@@ -60,7 +60,7 @@ in
     services.nginx = lib.mkIf cfg.nginx.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        cfg.nginx.virtualHost
+        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.virtualHost)
         {
           root = lib.mkForce "${cfg.package}";
 
@@ -82,7 +82,7 @@ in
     services.caddy = lib.mkIf cfg.caddy.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        cfg.caddy.virtualHost
+        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.caddy.virtualHost)
         {
           hostName = lib.mkForce cfg.domain;
           extraConfig = ''

nixos/modules/services/web-apps/flarum.nix

@@ -10,16 +10,23 @@ with lib;
 let
   cfg = config.services.flarum;
 
+  # Only placeholders reach the world-readable Nix store; the install
+  # script substitutes the real secrets at runtime.
   flarumInstallConfig = pkgs.writeText "config.json" (
     builtins.toJSON {
       debug = false;
       offline = false;
 
       baseUrl = cfg.baseUrl;
-      databaseConfiguration = cfg.database;
+      databaseConfiguration =
+        cfg.database
+        // optionalAttrs (cfg.databasePasswordFile != null) {
+          password = "@databasePassword@";
+        };
       adminUser = {
         username = cfg.adminUser;
-        password = cfg.initialAdminPassword;
+        password =
+          if cfg.initialAdminPasswordFile != null then "@adminPassword@" else cfg.initialAdminPassword;
         email = cfg.adminEmail;
       };
       settings = {
@@ -69,7 +76,26 @@ in
     initialAdminPassword = mkOption {
       type = types.str;
       default = "flarum";
-      description = "Initial password for the adminUser";
+      description = ''
+        Initial password for the adminUser.
+
+        WARNING: This is stored world-readable in the Nix store.
+        Use {option}`initialAdminPasswordFile` instead.
+      '';
+    };
+
+    initialAdminPasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/flarum-admin-password";
+      description = ''
+        File containing the initial password for adminUser.
+        Must be readable by the flarum user.
+        Takes precedence over {option}`initialAdminPassword`.
+
+        The password must not contain `"` or `\` characters, as it is
+        substituted into a JSON installation config verbatim.
+      '';
     };
 
     user = mkOption {
@@ -98,7 +124,12 @@ in
           bool
           int
         ]);
-      description = "MySQL database parameters";
+      description = ''
+        MySQL database parameters.
+
+        WARNING: A `password` set here is stored world-readable in the
+        Nix store. Use {option}`databasePasswordFile` instead.
+      '';
       default = {
         # the database driver; i.e. MySQL; MariaDB...
         driver = "mysql";
@@ -118,6 +149,20 @@ in
       };
     };
 
+    databasePasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/flarum-db-password";
+      description = ''
+        File containing the database password.
+        Must be readable by the flarum user.
+        Takes precedence over `database.password`.
+
+        The password must not contain `"` or `\` characters, as it is
+        substituted into a JSON installation config verbatim.
+      '';
+    };
+
     createDatabaseLocally = mkOption {
       type = types.bool;
       default = false;
@@ -210,6 +255,8 @@ in
         Type = "oneshot";
         User = cfg.user;
         Group = cfg.group;
+        # The secret-filled install config is staged in /tmp
+        PrivateTmp = true;
       };
       path = [ config.services.phpfpm.phpPackage ];
       script = ''
@@ -222,7 +269,18 @@ in
       ''
       + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
         if [ ! -f config.php ]; then
-          php flarum install --file=${flarumInstallConfig}
+          install -m 0600 ${flarumInstallConfig} /tmp/flarum-install.json
+          ${optionalString (cfg.initialAdminPasswordFile != null) ''
+            ${pkgs.replace-secret}/bin/replace-secret '@adminPassword@' \
+              ${escapeShellArg cfg.initialAdminPasswordFile} /tmp/flarum-install.json
+          ''}
+          ${optionalString (cfg.databasePasswordFile != null) ''
+            ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
+              ${escapeShellArg cfg.databasePasswordFile} /tmp/flarum-install.json
+          ''}
+          php flarum install --file=/tmp/flarum-install.json
+          # config.php contains the database password; stateDir is world-readable
+          chmod 600 config.php
         fi
       ''
       + ''

nixos/modules/services/web-servers/caddy/default.nix

@@ -448,8 +448,8 @@ in
     '';
 
     # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
-    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
-    boot.kernel.sysctl."net.core.wmem_max" = mkDefault 2500000;
+    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 7500000;
+    boot.kernel.sysctl."net.core.wmem_max" = mkDefault 7500000;
 
     systemd.packages = [ cfg.package ];
     systemd.services.caddy = {

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -362,7 +362,7 @@ in
           {
             name = "unix";
             control = "sufficient";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
 
@@ -446,7 +446,7 @@ in
           {
             name = "unix";
             control = "sufficient";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
 
@@ -454,7 +454,7 @@ in
           {
             name = "unix";
             control = "requisite";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
             settings.nullok = true;
             settings.yescrypt = true;
           }

nixos/tests/all-tests.nix

@@ -604,6 +604,10 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr-140;
   };
+  firefox-esr-153 = runTest {
+    imports = [ ./firefox.nix ];
+    _module.args.firefoxPackage = pkgs.firefox-esr-153;
+  };
   firefox-syncserver = runTest ./firefox-syncserver.nix;
   firefox_decrypt = runTest ./firefox_decrypt.nix;
   firefoxpwa = runTest ./firefoxpwa.nix;

nixos/tests/flarum.nix

@@ -10,7 +10,7 @@
   };
 
   nodes.machine =
-    { ... }:
+    { pkgs, ... }:
     {
       # Flarum installs and migrates the database on first boot and runs a
       # MariaDB server alongside PHP-FPM and nginx, so give the VM some headroom.
@@ -28,8 +28,11 @@
 
         adminUser = "admin";
         adminEmail = "admin@example.com";
-        # Flarum rejects admin passwords shorter than 8 characters.
-        initialAdminPassword = "flarum-admin-password";
+        # The trailing newline matches how secret managers typically write files.
+        initialAdminPasswordFile = "${pkgs.writeText "admin-pass" "flarum-admin-password\n"}";
+        # MariaDB authenticates via unix socket and never checks this password;
+        # setting it still exercises the substitution path.
+        databasePasswordFile = "${pkgs.writeText "db-pass" "flarum-db-password\n"}";
       };
     };
 
@@ -48,5 +51,23 @@
 
     # The admin API endpoint should respond, confirming the app booted cleanly.
     machine.succeed("curl -sf http://localhost/api -o /dev/null")
+
+    # Only the placeholders may appear in the install config in the Nix store.
+    machine.succeed("grep -q '@adminPassword@' /nix/store/*-config.json")
+    machine.succeed("grep -q '@databasePassword@' /nix/store/*-config.json")
+    machine.fail("grep -qe 'flarum-admin-password' -e 'flarum-db-password' /nix/store/*-config.json")
+
+    # A successful login proves the admin password was substituted intact.
+    machine.succeed(
+        "curl -sf http://localhost/api/token "
+        + "-H 'Content-Type: application/json' "
+        + "-d '{\"identification\": \"admin\", \"password\": \"flarum-admin-password\"}' "
+        + "| grep -F token"
+    )
+
+    # The database password must arrive intact in config.php, which must
+    # not be world-readable.
+    machine.succeed("grep -q 'flarum-db-password' /var/lib/flarum/config.php")
+    machine.succeed("[ $(stat -c %a /var/lib/flarum/config.php) = 600 ]")
   '';
 }

nixos/tests/login-nosuid.nix

@@ -11,7 +11,12 @@
     {
       security.enableWrappers = false;
       systemd.settings.Manager.NoNewPrivileges = true;
-      security.account-utils.enable = true;
+      security.account-utils = {
+        enable = true;
+        pwaccessd.settings = {
+          ExpiredCheck.SpMin = true;
+        };
+      };
       users.mutableUsers = true;
       security.account-utils.extraArgs = [
         "-v"
@@ -46,6 +51,9 @@
         print(f"passwd path is: {passwd_path}")
         assert "account-utils" in passwd_path
 
+    with subtest("config file exists"):
+        machine.succeed("ls /etc/account-utils/pwaccessd.conf")
+
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")

nixos/tests/web-apps/immichframe.nix

@@ -31,9 +31,14 @@ in
         ../common/x11.nix
       ];
 
-      # When setting this to 2500 I got "Kernel panic - not syncing: Out of
+      # When setting memory to 2500 I got "Kernel panic - not syncing: Out of
       # memory: compulsory panic_on_oom is enabled".
-      virtualisation.memorySize = 3000;
+      # Setting cores to 1 (the default) also makes immich take a long time to start up.
+      # If this breaks, keep synced with the immich test.
+      virtualisation = {
+        memorySize = 4096;
+        cores = 2;
+      };
       hardware.graphics.enable = true;
       environment.variables.XAUTHORITY = "/home/${user}/.Xauthority";
       test-support.displayManager.auto.user = user;

pkgs/applications/audio/pianoteq/default.nix

@@ -13,6 +13,7 @@
   makeDesktopItem,
   makeWrapper,
   p7zip,
+  gnutar,
   writeShellScript,
 }:
 let
@@ -46,9 +47,17 @@ let
 
       pname = "pianoteq-${name}";
 
-      unpackPhase = ''
-        ${p7zip}/bin/7z x $src
-      '';
+      unpackPhase =
+        if lib.hasSuffix ".7z" src then
+          ''
+            ${p7zip}/bin/7z x $src
+          ''
+        else if lib.hasSuffix ".tar.xz" src then
+          ''
+            ${gnutar}/bin/tar -xf $src
+          ''
+        else
+          throw "unexpected file format";
 
       nativeBuildInputs = [
         autoPatchelfHook
@@ -243,6 +252,7 @@ let
   version6 = "6.7.3";
   version7 = "7.5.4";
   version8 = "8.4.0";
+  version9 = "9.1.2";
 
   mkStandard =
     version: hash:
@@ -292,8 +302,35 @@ let
         inherit hash;
       };
     };
+  mkTrial9 =
+    hash:
+    mkPianoteq {
+      name = "trial";
+      version = version9;
+      mainProgram = "Pianoteq 9";
+      startupWMClass = "Pianoteq Trial";
+      src = fetchPianoteqTrial {
+        name = "pianoteq_trial_v${versionForFile version9}.tar.xz";
+        inherit hash;
+      };
+    };
+  mkStage9 =
+    hash:
+    mkPianoteq {
+      name = "stage";
+      version = version9;
+      mainProgram = "Pianoteq 9 STAGE";
+      startupWMClass = "Pianoteq STAGE";
+      src = fetchPianoteqWithLogin {
+        name = "pianoteq_setup_v${versionForFile version9}.tar.xz";
+        inherit hash;
+      };
+    };
 in
 {
+  trial_9 = mkTrial9 "sha256-1ofPL6F12Gv+k2rZBadOa5Iyukuji6vdww87ufdKjM8=";
+  stage_9 = mkStage9 "sha256-Jvm/AhBwgj5INW8U48rJjgDB7j/Z1VnYKczvtrpl/AY=";
+
   standard_8 = mkStandard version8 "sha256-ZDGB/SOOz+sWz7P+sNzyaipEH452n8zq5LleO3ztSXc=";
   stage_8 = mkStage version8 "";
   standard-trial_8 = mkStandardTrial version8 "sha256-K3LbAWxciXt9hVAyRayxSoE/IYJ38Fd03+j0s7ZsMuw=";

pkgs/applications/editors/android-studio/default.nix

@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2026.1.1.10"; # "Android Studio Quail 1 | 2026.1.1 Patch 2"
-    sha256Hash = "sha256-+9PxFtEsrtck6o2g0s2ufnkRcPefKqESc+oPLSKiJNw=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.10/android-studio-quail1-patch2-linux.tar.gz";
+    version = "2026.1.2.10"; # "Android Studio Quail 2 | 2026.1.2"
+    sha256Hash = "sha256-ZERaVAkucFbG638aia0RbQ/uwu9flluOWU1iq9tYWQ8=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.10/android-studio-quail2-linux.tar.gz";
   };
   betaVersion = {
     version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"

pkgs/applications/editors/emacs/make-emacs.nix

@@ -116,8 +116,6 @@
 
   # test
   callPackage,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -254,11 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
 
   buildInputs = [
     gnutls
@@ -424,15 +418,10 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      # workaround for ld64 hardening issue
-      #
-      # TODO: Clean up on `staging`
-      NIX_CFLAGS_COMPILE =
-        "-fuse-ld=lld"
-        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-        # See https://github.com/NixOS/nixpkgs/issues/127902
-        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs (variant == "macport") {
+      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+      # See https://github.com/NixOS/nixpkgs/issues/127902
+      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0541";
+  version = "9.2.0782";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/default.nix

@@ -14,8 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -39,10 +37,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -50,13 +44,6 @@ stdenv.mkDerivation {
     gawk
   ];
 
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
-  };
-
   strictDeps = true;
 
   configureFlags = [

pkgs/applications/editors/vim/full.nix

@@ -48,9 +48,6 @@
   darwinSupport ? config.vim.darwin or false, # Enable Darwin support
   ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
   sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
-
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -172,9 +169,7 @@ stdenv.mkDerivation {
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner
-  # TODO: Clean up on `staging`
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optional waylandSupport wayland-scanner;
 
   buildInputs = [
     ncurses
@@ -201,10 +196,7 @@ stdenv.mkDerivation {
   ++ lib.optional sodiumSupport libsodium;
 
   # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";
 
   preConfigure = lib.optionalString ftNixSupport ''
     cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim

pkgs/applications/editors/vim/macvim.nix

@@ -17,8 +17,6 @@
   # This can be set to one of the `darwin.xcode_*` packages as well.
   # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
   withXcodePath ? null,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 # Try to match MacVim's documented script interface compatibility
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
   buildInputs = [
     # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -192,8 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
   hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
 
   # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
   # it's not clear what system-level components it may require, so for now we'll just allow full

pkgs/applications/editors/vim/plugins/generated.nix

@@ -446,12 +446,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-07-07";
+    version = "0-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "e954496f8ef22904e8a84f5078f4a110fdc7a0d3";
-      hash = "sha256-b8HOclkr3FoCNUDJ6f0ULsfyiQB38+9PNxl0CibVL60=";
+      rev = "e520902f405da5f5ad392d32babad5b5dd5ffa44";
+      hash = "sha256-zNXm/0W+Hv562zt6NxHnFuO2nBxjX5dlxS7pRB+KXQY=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1050,12 +1050,12 @@ final: prev: {
 
   artio-nvim = buildVimPlugin {
     pname = "artio.nvim";
-    version = "0-unstable-2026-06-23";
+    version = "0-unstable-2026-07-17";
     src = fetchFromGitHub {
       owner = "comfysage";
       repo = "artio.nvim";
-      rev = "52a074e6a15780df350c03b5c7ab47f706fe6da8";
-      hash = "sha256-8hbFtJXpkH1L2ZI6Rv9HTQcseog77yf78Wc/9WsvzPA=";
+      rev = "19d71f8d9c721872e97aa0e5f094041c96f3feca";
+      hash = "sha256-X1QXSoowhgs+uhO1T9OtaSXhAryzLCzGfHNgCFiO3is=";
     };
     meta.homepage = "https://github.com/comfysage/artio.nvim/";
     meta.license = getLicenseFromSpdxId "EUPL-1.2";
@@ -1414,12 +1414,12 @@ final: prev: {
 
   autoclose-nvim = buildVimPlugin {
     pname = "autoclose.nvim";
-    version = "0-unstable-2026-03-22";
+    version = "0-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "autoclose.nvim";
-      rev = "bafd0368716216fa6a7bb2a43ecd889b44efdb46";
-      hash = "sha256-DOKKyaDmfUPRTcXJvqD+0zAr63+93H0auax6Dse0Igo=";
+      rev = "27063904b2238ce7867e430885b6abcfb08357ea";
+      hash = "sha256-BjNP8Facn3Cy/EHYioUB9mXb19sBzBeSCY1xTpPOWG8=";
     };
     meta.homepage = "https://github.com/m4xshen/autoclose.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -1638,12 +1638,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-07-11";
+    version = "0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "cbb71c6cb56f53b30ab1a95a6d277f7e0524025b";
-      hash = "sha256-QG9FcdlCKYXzncvDt47RQQGyJ2ARt1N+ec75qtc7gSk=";
+      rev = "8d059b82367160cd530253afbbcd20dc4b34129f";
+      hash = "sha256-wW6UidkM6avqQVhPEgRtDXgxHsMdD+IM01A5ABebYT4=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -1946,12 +1946,12 @@ final: prev: {
 
   blink-cmp-tmux = buildVimPlugin {
     pname = "blink-cmp-tmux";
-    version = "0-unstable-2026-02-11";
+    version = "0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "mgalliou";
       repo = "blink-cmp-tmux";
-      rev = "1ef35d8e388475ab8eaeecfc12e196c78bd5de04";
-      hash = "sha256-enoPsYF8llGShf+sx6rLYYnLLzrd+jdCdZ4gy9A2lKU=";
+      rev = "112ddbf2e09d9cb4736de70dd01eb9654cf01d70";
+      hash = "sha256-7Wj7bIg7vAOz0OygISORRphsEV6RcsR6m/S2tRyzEpU=";
     };
     meta.homepage = "https://github.com/mgalliou/blink-cmp-tmux/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -2254,12 +2254,12 @@ final: prev: {
 
   bullets-vim = buildVimPlugin {
     pname = "bullets.vim";
-    version = "2.0.0-unstable-2026-06-03";
+    version = "2.0.0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "bullets-vim";
       repo = "bullets.vim";
-      rev = "3f667eeca58bd4ba411b41edefef51e7fed1a2b1";
-      hash = "sha256-fq3ATtCeXeq3CR97KbEu8mOEF8CtpEt7z8z3OO5IQQY=";
+      rev = "81570b98ca44b4100b3ddcf8d9ca74b9a9b0c884";
+      hash = "sha256-yTxXXnVyk/vbr+tWD9RquJvk2ksa8Okuhg3NnyeBp3o=";
     };
     meta.homepage = "https://github.com/bullets-vim/bullets.vim/";
     meta.license = unfree;
@@ -3568,12 +3568,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.19.0";
+    version = "19.20.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.19.0";
-      hash = "sha256-1ypjttA0T6wnVrqBaiqGtcJnqiyhxeg2EXh7O9nPBpE=";
+      tag = "v19.20.0";
+      hash = "sha256-vDKbjW9izNruCLiPRQEs+yoOrA+YkuyvmdovFTY4nfw=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4185,12 +4185,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-07-12";
+    version = "0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "0b2b0db07b0426441ece46988d9ab28088f07cd5";
-      hash = "sha256-SjAiNoeAxuu2UFHupUnDtjrPtGqAiFdHoq21Qn35OVA=";
+      rev = "83580b587f6fc50568ec61ae79e18762fcf35c17";
+      hash = "sha256-OKlZh1FKIk4DhyAtc0rSnEOZoa75NQKRtdFYDjkTZPE=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -4605,12 +4605,12 @@ final: prev: {
 
   ddc-source-lsp = buildVimPlugin {
     pname = "ddc-source-lsp";
-    version = "1.2.0-unstable-2026-06-12";
+    version = "1.2.0-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "ddc-source-lsp";
-      rev = "7718b6d9539ebddc18e961f90ff1aca7975ffe5c";
-      hash = "sha256-2JVCuFXc6mtXUDEB1lVgWC2q38kvwr9tyjKO/Z4iY9k=";
+      rev = "2f476ae123bea5b3583f9d4ca141f63981e70b06";
+      hash = "sha256-2rMdU1FUP4HJP2o2MtL93po/FmloMzZ/sqeQWHPP55g=";
     };
     meta.homepage = "https://github.com/Shougo/ddc-source-lsp/";
     meta.license = unfree;
@@ -7171,12 +7171,12 @@ final: prev: {
 
   hardtime-nvim = buildVimPlugin {
     pname = "hardtime.nvim";
-    version = "1.2.0-unstable-2025-09-13";
+    version = "1.2.0-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "hardtime.nvim";
-      rev = "b4e431934af1fe224a3a801f632c008278cb7628";
-      hash = "sha256-Jy9ARUHU1ySpSxxoS3hLRjxp5Lqt7juWN5Jnbdo0rg0=";
+      rev = "244753782b945def87472d8f4e9e6a9d4ec18689";
+      hash = "sha256-Zers7vdGRGy8n520G9uMuHwMAP3STHqU5d5a2Ln9rDQ=";
     };
     meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8375,12 +8375,12 @@ final: prev: {
 
   kitty-scrollback-nvim = buildVimPlugin {
     pname = "kitty-scrollback.nvim";
-    version = "9.2.0";
+    version = "9.2.1";
     src = fetchFromGitHub {
       owner = "mikesmithgh";
       repo = "kitty-scrollback.nvim";
-      tag = "v9.2.0";
-      hash = "sha256-M/sd8lUv7leapzI3uD0VNkMAwaFhPmXsktFnHMPJz0U=";
+      tag = "v9.2.1";
+      hash = "sha256-8IkvoJ8nTlP5WCqMpJqUhBsz7OYB/Mlp1lH5TJRpvOE=";
     };
     meta.homepage = "https://github.com/mikesmithgh/kitty-scrollback.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11034,12 +11034,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-07-16";
+    version = "1.4.0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "50bdc4130d9e30d28d0b209544d49ee472f6bf12";
-      hash = "sha256-hsYouOS+ImmA6HnwqFRq3RMBTsn87oHrnijMqvargU4=";
+      rev = "1246df7a5d1811d84212f11edb43550cd8380ebd";
+      hash = "sha256-hlQf+xJ+/9OTqp5VtPsNE7QW6uVjWeUkqQ8r1u6MWkI=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11118,12 +11118,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-15";
+    version = "3.0.0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "95295edaa26e8e8db5a9bc4119256e602311c6bc";
-      hash = "sha256-hAswp9Ba5xfFfBS+NKjLOoSky+SRrLfd8fdFC46Dq2s=";
+      rev = "f8674ec894315c02449b61c9de9a116c5aafeb90";
+      hash = "sha256-ETu9zy2In3M8/3fqYUfTRt0mKiocm3paJFjgQ82Yj3I=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12142,12 +12142,12 @@ final: prev: {
 
   none-ls-extras-nvim = buildVimPlugin {
     pname = "none-ls-extras.nvim";
-    version = "0-unstable-2026-06-06";
+    version = "0-unstable-2026-07-17";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls-extras.nvim";
-      rev = "27681d797a26f1b4d6119296df42f5204c88a2dc";
-      hash = "sha256-GZLT8X1eLeSkiV5EN1nOkCQg5nwNATURi/KMj90i40I=";
+      rev = "9a8b8a9aeb43382e5aaf49b00b7cfb5d42d32118";
+      hash = "sha256-YmDhDUqSJPOllXzkyrVUgnshrI5+Kt5Te8tEmnjOAVQ=";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls-extras.nvim/";
     meta.license = getLicenseFromSpdxId "Unlicense";
@@ -12268,12 +12268,12 @@ final: prev: {
 
   nvchad-ui = buildVimPlugin {
     pname = "nvchad-ui";
-    version = "0-unstable-2026-07-11";
+    version = "0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "ui";
-      rev = "28019401865beffcedc744bb1506d0201b88f2f9";
-      hash = "sha256-QKBDxZzEQKGzHOVJmS9D9i9h2/0HubbgUlAvaA7Erh0=";
+      rev = "222c8cc1ad66076c05b7c9d0695781ebe3799d88";
+      hash = "sha256-SKSRwXi0KdJtWkmak1LLwXIUukwIhMxKHy9HIMnu0DQ=";
     };
     meta.homepage = "https://github.com/nvchad/ui/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -13746,12 +13746,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-04-03";
+    version = "0.10.0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "4916d6592ede8c07973490d9322f187e07dfefac";
-      hash = "sha256-PQR6tFt4lCrAZNQG7BLMD1IiCKja9wDS1S4laGJf/HE=";
+      rev = "7248feaca45e4d944591497964bc19afa89ad1c6";
+      hash = "sha256-FQj0+qeaW9rLy3dUbGbUG4UYtnry7UBA1n9SM2qXLdk=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -13858,12 +13858,12 @@ final: prev: {
 
   nvim-treesitter-textobjects = buildVimPlugin {
     pname = "nvim-treesitter-textobjects";
-    version = "0-unstable-2026-04-07";
+    version = "0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "851e865342e5a4cb1ae23d31caf6e991e1c99f1e";
-      hash = "sha256-fOpRElIwvsFWm4AwETx7fpC3RtdH2BpCfX4YHVitqw0=";
+      rev = "898ee307df58f854d11cd7edd06472574d48014e";
+      hash = "sha256-naZ+p5RrC+uUyFRaksmozDfNgJRifff+9TDWx79DCPk=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14170,8 +14170,8 @@ final: prev: {
     src = fetchFromGitHub {
       owner = "tarides";
       repo = "ocaml.nvim";
-      rev = "e12ded73f461d392cc2cad579a39733ebe34de61";
-      hash = "sha256-3NiRM02g7BU+MzCybSfsyZdODcPA+RbuNU9QOmmoCxo=";
+      rev = "d74934117fb7a513e64601ad1d1b53a34b00b01f";
+      hash = "sha256-zJJZP8jxa7e9Fn0N8JFzfP3d2TElkASFt8ptaWCOYpM=";
     };
     meta.homepage = "https://github.com/tarides/ocaml.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15076,6 +15076,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  present-nvim = buildVimPlugin {
+    pname = "present.nvim";
+    version = "0-unstable-2025-03-03";
+    src = fetchFromGitHub {
+      owner = "Chaitanyabsprip";
+      repo = "present.nvim";
+      rev = "c76e6996b346ff3ec6260c2461e56946c4a72d0d";
+      hash = "sha256-EPQlVv4zn3LNgYu58xpp3OlLrFOW+VuRgiP0YzO6REw=";
+    };
+    meta.homepage = "https://github.com/Chaitanyabsprip/present.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   presenting-vim = buildVimPlugin {
     pname = "presenting.vim";
     version = "0.1.0-unstable-2023-12-30";
@@ -15134,12 +15148,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "5.1.1-1";
+    version = "5.2.0-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v5.1.1-1";
-      hash = "sha256-NmkKA9AH1uOgHSQT9S8RIFQrkrhkDvpKIfDqHGfzoFI=";
+      tag = "v5.2.0-1";
+      hash = "sha256-p/p7VxmuNusgUXtPpiCGa+BSgDDS/yKvtAV93cKmIEg=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -16241,12 +16255,12 @@ final: prev: {
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2.1.0-unstable-2026-07-10";
+    version = "2.1.0-unstable-2026-07-18";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "9493405fb8ee683aa6efd50c529f6296ad8f40ad";
-      hash = "sha256-cMPRVxFMBVRpIcy7kCQyoXzgsIFJJ1cDgAcvOm9FNnI=";
+      rev = "de39b4d75695e2377401c7d05f896657637d244b";
+      hash = "sha256-Xqnre4RfIID/m8hXUpcMrsLssjfp/cbSpG24cory2BI=";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16255,12 +16269,12 @@ final: prev: {
 
   smartcolumn-nvim = buildVimPlugin {
     pname = "smartcolumn.nvim";
-    version = "1.1.1-unstable-2025-07-21";
+    version = "1.1.1-unstable-2026-07-20";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "smartcolumn.nvim";
-      rev = "b9cdbdf42f7ac5a659204cd5926017c7ff724a19";
-      hash = "sha256-QAb0O/ZwTVogRyTK8+Y4ORaN6nVaeYepKgfSCF/fIPU=";
+      rev = "5351ae24e992a397d2abac48b7774dc8ef0acf40";
+      hash = "sha256-+ICVS16n0CFWbTqBzGkvxQohyYiAvr6gIxZqura3PUw=";
     };
     meta.homepage = "https://github.com/m4xshen/smartcolumn.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21122,12 +21136,12 @@ final: prev: {
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "1.29-unstable-2026-07-08";
+    version = "1.29-unstable-2026-07-18";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "551d423ba27915d96721c8709702edd23bc2bb48";
-      hash = "sha256-ps2QQ6xyQpvfCZ+tTUTzBt3kxu7+VtDcvLnH2HS8pRY=";
+      rev = "d69962d20a2a60e4bdc92a2281e5f0aaaa109635";
+      hash = "sha256-tXA45Hhnr9Vv4p6MyNAxj2SOC+P8eGkIEVE8PDnyFx4=";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
     meta.license = unfree;
@@ -21908,12 +21922,12 @@ final: prev: {
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "0-unstable-2026-07-11";
+    version = "0-unstable-2026-07-19";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "b3301b091c730061a6da1f9fab670eece6af187c";
-      hash = "sha256-ZcrnrD8ZHb76U1SrjEGlDLSr54WbtAyqjeooj8y0tug=";
+      rev = "d9aa6784fe3a870e78ba82b5d176c0c5745e23f7";
+      hash = "sha256-/QrVhax5PTidfSi6WAxJNX4mbBhUGFZLlG3WsqoT2Ro=";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -22216,12 +22230,12 @@ final: prev: {
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "0.0.1-unstable-2026-07-11";
+    version = "0.0.1-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "1b1803c4ae35ef8fecaaea1e6580ee700278804f";
-      hash = "sha256-kGQZWrg6tf5j/iHfTIKiQC/JZJRoKbKxMYzfhERvN+8=";
+      rev = "22d06c9e4b620d5c2f055aec590dec6d383e5316";
+      hash = "sha256-LiWvL9QpZFPUH+Uek19ce6/e8B6uATmje/emUvyLWJk=";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -25253,12 +25267,12 @@ final: prev: {
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2.17-unstable-2026-07-05";
+    version = "2.17-unstable-2026-07-18";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "a5949d2800c1866c878956d49c51fc8d003c6b99";
-      hash = "sha256-P7zDZBNy2WivNbwCURpS3zTNd5nXenYu2PZEbyWnbCY=";
+      rev = "6368e31fdaf766ff908a2c06e9ee14fc66dec409";
+      hash = "sha256-/0DoAJ3Iv8eJlRqNodumYqllY+4c3zv+oY1EpbvC8ak=";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26011,12 +26025,12 @@ final: prev: {
 
   zen-nvim = buildVimPlugin {
     pname = "zen.nvim";
-    version = "0-unstable-2026-04-17";
+    version = "0-unstable-2026-07-18";
     src = fetchFromGitHub {
       owner = "sand4rt";
       repo = "zen.nvim";
-      rev = "8d77a06063d74393ace9a984f32c4c158dcef6ba";
-      hash = "sha256-1zLxgs1EqAoGrjIr26awTFZ+NS06Ph/SDQHczBNCsaA=";
+      rev = "cc7306e9ea479b19e8ef4c5fba35b4efd4b66692";
+      hash = "sha256-ZFuhNDVmUU7A02w/rzDn8uze7ivHVu2GI3+6PyIxAgE=";
     };
     meta.homepage = "https://github.com/sand4rt/zen.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3602,7 +3602,6 @@ assertNoAdditions {
       snacks-nvim
       telescope-nvim
     ];
-    dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
       # Issue reproduction file
       "minimal"

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1075,6 +1075,7 @@ https://github.com/RishabhRD/popfix/,,
 https://github.com/nvim-lua/popup.nvim/,,
 https://github.com/tris203/precognition.nvim/,,
 https://github.com/andweeb/presence.nvim/,,
+https://github.com/Chaitanyabsprip/present.nvim/,,
 https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/RKpbsdp7MjakNvKWvq2OiwLJ7mftHKKrb5xwKlM76Y=";
+          hash = "sha256-vx8fRGGW9fJYKC1Q1627NrjxqqO/zRkH83aLyc4Rxn0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-mdgzM0dymFjSYFm018wsuWzzUJJsA896YmRwoH1wLmM=";
+          hash = "sha256-ZWwau/aSMsamcVBrtuSWI2HiKeZHfMqBLj9WQO8IA20=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-0EFuSvcSLTfrR74Uxpwiq2K39cWqi33q80AhtlilCnQ=";
+          hash = "sha256-a4yKVABQ0nVzlqS071ae5DYEqv8jgjSwLjxkEAroZvE=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.214";
+      version = "2.1.216";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1457,8 +1457,8 @@ let
         mktplcRef = {
           name = "protobuf-vsc";
           publisher = "DrBlury";
-          version = "1.6.6";
-          hash = "sha256-uMyxdLptaLZBlLEugvYQgJTZCtysmnZix9faXsQfHGk=";
+          version = "1.6.9";
+          hash = "sha256-4Mas35dRrPaXvrlpe0HdCUp/1+XDwhLeUhnq7EvKsco=";
         };
         meta = {
           description = "Comprehensive Protocol Buffers support with syntax highlighting, IntelliSense, diagnostics and formatting";
@@ -2047,8 +2047,8 @@ let
         mktplcRef = {
           name = "Go";
           publisher = "golang";
-          version = "0.54.0";
-          hash = "sha256-o1SJjR6eQcGWN9BGoN5CBTdn6RsNG2a0+p/ZDcywzr0=";
+          version = "0.56.0";
+          hash = "sha256-n1lZ+xe6Co29gEOH3dpQl1/Kqd1SZ6oz6qqJkSByqss=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/golang.Go/changelog";
@@ -3512,8 +3512,8 @@ let
         mktplcRef = {
           name = "veriloghdl";
           publisher = "mshr-h";
-          version = "1.28.1";
-          hash = "sha256-+Pc9blI/n6JeokdUhWjLzicwBv90p4MjhK2rvpQ2xrA=";
+          version = "1.29.0";
+          hash = "sha256-/VIAT9nnDG52Jzh+j0E038NSjoLCXZSVRSvGWXOeuuY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mshr-h.VerilogHDL/changelog";
@@ -3665,8 +3665,8 @@ let
         mktplcRef = {
           name = "just-black";
           publisher = "nur";
-          version = "3.1.1";
-          hash = "sha256-fatJZquCDsLDFGVzBol2D6LIZUbZ6GzqcVEFAwLodW0=";
+          version = "4.0.2";
+          hash = "sha256-gfUavJXIgbNLYJNVrDeEIrpbKkgXs0YJNNb5P4480M0=";
         };
         meta = {
           description = "Dark theme designed specifically for syntax highlighting";
@@ -5501,8 +5501,8 @@ let
         mktplcRef = {
           name = "markdown-editor";
           publisher = "zaaack";
-          version = "0.1.17";
-          hash = "sha256-j7K1MS9XBLwCjER41NsSt22LUh0Zmm2sUK9JqZLiSfk=";
+          version = "0.1.19";
+          hash = "sha256-W0lL0JMNyEszyJa6I7RbXYLu4cU9DQUh0ZEAOd6eshI=";
         };
         meta = {
           description = "Visual Studio Code extension for WYSIWYG markdown editing";

pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix

@@ -68,11 +68,11 @@ vscode-utils.buildVscodeMarketplaceExtension {
 
   nativeBuildInputs = [
     autoPatchelfHook
+    jq
     makeWrapper
   ];
 
   buildInputs = [
-    jq
     libkrb5
     zlib
     (lib.getLib stdenv.cc.cc)

pkgs/applications/editors/vscode/extensions/pkief.material-icon-theme/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "material-icon-theme";
     publisher = "PKief";
-    version = "5.36.1";
-    hash = "sha256-1yxTjIsyj8o97VlvDlWqPCNIxd6XgbjpqF5qNbVtEwg=";
+    version = "5.37.0";
+    hash = "sha256-remt7+OQnOqSrtUoUN3QCXXR3Bti/lWIMfb7i4j3w84=";
   };
   meta = {
     description = "Material Design Icons for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/vscode-utils.nix

@@ -73,6 +73,9 @@ let
         # This cannot be removed, it is used by some extensions.
         installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
 
+        strictDeps = true;
+        __structuredAttrs = true;
+
         nativeBuildInputs = [ unpackVsixSetupHook ] ++ nativeBuildInputs;
 
         installPhase =

pkgs/applications/editors/vscode/generic.nix

@@ -181,7 +181,6 @@ stdenv.mkDerivation (
       buildFHSEnv customizedArgs;
   in
   {
-
     inherit
       pname
       version
@@ -199,8 +198,16 @@ stdenv.mkDerivation (
         updateScript
         vscodeVersion
         ;
-      fhs = fhs { };
-      fhsWithPackages = f: fhs { additionalPkgs = f; };
+      fhs = (fhs { }).overrideAttrs (old: {
+        strictDeps = true;
+        __structuredAttrs = true;
+      });
+      fhsWithPackages =
+        f:
+        (fhs { additionalPkgs = f; }).overrideAttrs (old: {
+          strictDeps = true;
+          __structuredAttrs = true;
+        });
     }
     // lib.optionalAttrs (vscodeServer != null) {
       inherit rev vscodeServer;
@@ -419,7 +426,11 @@ stdenv.mkDerivation (
         let
           nodeModulesPath =
             if stdenv.hostPlatform.isDarwin then
-              if lib.versionAtLeast vscodeVersion "1.94.0" then
+              # 1.129 moved node_modules back into app.asar, shipping native
+              # binaries in the asar.unpacked directory like before 1.94
+              if lib.versionAtLeast vscodeVersion "1.129.0" then
+                "Contents/Resources/app/node_modules.asar.unpacked"
+              else if lib.versionAtLeast vscodeVersion "1.94.0" then
                 "Contents/Resources/app/node_modules"
               else
                 "Contents/Resources/app/node_modules.asar.unpacked"
@@ -433,6 +444,7 @@ stdenv.mkDerivation (
               armv7l-linux = "linux-arm";
               aarch64-linux = "linux-arm64";
               i686-linux = "linux-ia32";
+              loongarch64-linux = "linux-loong64";
               powerpc64-linux = "linux-ppc64";
               riscv64-linux = "linux-riscv64";
               s390x-linux = "linux-s390x";
@@ -474,6 +486,7 @@ stdenv.mkDerivation (
         patchelf \
           --add-needed ${lib.getLib openssl}/lib/libssl.so.3 \
           $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
+        chmod +x $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
       '')
     );
 

pkgs/applications/emulators/libretro/cores/atari800.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "atari800";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-07-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-atari800";
-    rev = "3f036fd69a0f0948d32a9a7cd97af3e0dd7ec434";
-    hash = "sha256-WnozEFNpW6qmSsQGTKzflitG6TVaozyOMcnAka+E1fE=";
+    rev = "9d3bcf283502512052e21c6f1453fbdf7aa3122b";
+    hash = "sha256-uLMQWi+Z21irwkFBArlHNXILintSWF7PfGy5bgKmAhQ=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/bluemsx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-07-04";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "fe7173f801fd2d6c3564ebe816797a44524e4bbf";
-    hash = "sha256-NcDcFexU2jPWwQmWo9CK+jbYtEFiqZmzKLfrQrB9Cmg=";
+    rev = "2f31e9ca38785ad4c2bd9e1d91829eda14a92954";
+    hash = "sha256-J1LbOsUR+9HX/LRtkG9XQIiRdhfyHUYvqXYBKWdGxBI=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/bsnes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "d62d219ac22f1ed179738d107d8a4da2c4289845";
-    hash = "sha256-XYCzXAFkSFNMlRjzH4zR3lpRguOqvAJM4TBcL9Feog8=";
+    rev = "9c1285dda7dd6bb9a9951d37bcee8794ada640e6";
+    hash = "sha256-hu4Odi+6A8OrpsNbWZI5JrBkFI1brsqp08fyOySFyr8=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -8,11 +8,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.12.0esr";
+  version = "140.13.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "3d598dd964bca074d11b71f84d586811b0a736bdd4d1e6cedb9286c56b1e11584e85ca1d0369c9b2f8d9e4d0eaf014d1b9232a96e71ac25f71fa9ed0807f642d";
+    sha512 = "937a4103d71c5e1e4bf051821729f6ea70b5c18d444930a487695cc23d74712a0134047248f6ac02305e01becb705426a55b9d89739f02a01eda01ecf5bc27f1";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  callPackage,
+  fetchurl,
+  nixosTests,
+  buildMozillaMach,
+}:
+
+buildMozillaMach rec {
+  pname = "firefox";
+  version = "153.0esr";
+  applicationName = "Firefox ESR";
+  src = fetchurl {
+    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
+    sha512 = "3ea7956ef2fdcaa86430ef922f04484cbb1a3faf447e035107159fcd5ecd8d0a0e4507a332fc3d7b66e4308c38733bd0624affd7629447b89c655a9ea0fb0936";
+  };
+
+  meta = {
+    changelog = "https://www.firefox.com/en-US/firefox/${lib.removeSuffix "esr" version}/releasenotes/";
+    description = "Web browser built from Firefox source tree";
+    homepage = "http://www.mozilla.com/en-US/firefox/";
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = lib.platforms.unix;
+    badPlatforms = [ lib.systems.inspect.patterns.is32bit ];
+    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
+    license = lib.licenses.mpl20;
+    mainProgram = "firefox";
+  };
+  tests = {
+    inherit (nixosTests) firefox-esr-153;
+  };
+  updateScript = callPackage ../update.nix {
+    attrPath = "firefox-esr-153-unwrapped";
+    versionPrefix = "153";
+    versionSuffix = "esr";
+  };
+}

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "152.0.6";
+  version = "153.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "c4d877837d7007fb611c38d49d9b6dd3bc4c5c9ca900b54e722e140ce7ecd0924f69b5cedc7f8c1fe602e7efe1d7159b019de27999e29235cd631821bb13e6b0";
+    sha512 = "a1af5866e1c9a732818123f2f041bfd5993d093e96dd743b583312fb11d2b39d429df750f9ec22ded64b58a209bb1ecabc7aaf73057d7a64c7349e4da043d66d";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -435,7 +435,7 @@ let
                 ;;
               *)
                 # Copy if the symlink resolves to a Mach-O dylib
-                otool -l "$file" 2>/dev/null | grep -q 'LC_ID_DYLIB' || continue
+                otool -l "$file" 2>/dev/null | grep -F 'LC_ID_DYLIB' >/dev/null || continue
                 ;;
             esac
 

pkgs/applications/networking/cluster/nomad/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
-  buildGoModule,
   buildGo125Module,
+  buildGo126Module,
   fetchFromGitHub,
   nixosTests,
   installShellFiles,
@@ -82,6 +82,19 @@ rec {
 
   nomad = nomad_1_11;
 
+  nomad_2_0 = generic {
+    buildGoModule = buildGo126Module;
+    version = "2.0.0";
+    hash = "sha256-5rCAcOXWQ6g2iK1d5wy/a/DZQC2xwwdpI1SscDX98C8=";
+    vendorHash = "sha256-3/H7QgVOHtaUs6BOF7ATVgrA0cfNBbm940Axrvq2bKU=";
+    license = lib.licenses.bsl11;
+    passthru.tests.nomad = nixosTests.nomad;
+    preCheck = ''
+      export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
+    '';
+    __structuredAttrs = true;
+  };
+
   nomad_1_11 = generic {
     buildGoModule = buildGo125Module;
     version = "1.11.3";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -119,13 +119,13 @@
     "vendorHash": "sha256-kvHI8cd/rl9kVKKzSwjrC0+Qikz3w2P9jgLvYa+T2DE="
   },
   "brightbox_brightbox": {
-    "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
+    "hash": "sha256-bvwdtiwzXElhsXLmftXZQ567ExcC0E0L/5OeqIdp1SQ=",
     "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
     "owner": "brightbox",
     "repo": "terraform-provider-brightbox",
-    "rev": "v3.4.3",
+    "rev": "v3.4.4",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
+    "vendorHash": "sha256-TLNHhSyMw0rKFtd9EChg7zSGoxe57rh36nAPqu1j8w8="
   },
   "buildkite_buildkite": {
     "hash": "sha256-egeZCTQFyhKG0giyjNK9C/W+OGMOGv2l+65Vg3iTi2A=",
@@ -580,22 +580,22 @@
     "vendorHash": "sha256-sPQR+LDZRMXygLUd9xj6/bI+8DhAPKbkytlTzmrEOBU="
   },
   "hashicorp_google": {
-    "hash": "sha256-TQFMOZZbMabLfTDPON1OMd+DgyssfprzqMbc9/u7cbQ=",
+    "hash": "sha256-QgGEF8L4O6ON1VhEUFrLwc2WNUSt8qIjn5DWVOQAxB0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.39.0",
+    "rev": "v7.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ayt8FR4684ZV5kd6exMw0AEgkMJLW5huvTYZqcr3q/s="
+    "vendorHash": "sha256-moP2fqZnj8J6IFAhb0n6pikVYVg2Is22xd/xuuJ+zIQ="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-pEdNv1MViCsCb3wFoDghCeQ5q2FErtGrQL9noL5B11g=",
+    "hash": "sha256-wf+pFYuDMqlFYvaTKTpgaeSSBoLgQlUAarobUAotLMo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.39.0",
+    "rev": "v7.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-u4zldvOO/TtNHC8B+c63DWMbk7iEix+S+y/RLExchI8="
+    "vendorHash": "sha256-7f0HZQXVsIq7m8CUApTnHIroOjKwT1GaP+GjCf4C6n0="
   },
   "hashicorp_helm": {
     "hash": "sha256-Dw6khnp0pronRKbBv2gx8ygtVvRV9uQIHCXj2BblZ6k=",
@@ -824,11 +824,11 @@
     "vendorHash": "sha256-JTcIyUKoeCRxAzUWJy9FkMCYy3+D70uyzuiSTW3nHlA="
   },
   "kislerdm_neon": {
-    "hash": "sha256-1o5EnAI9X8Q+dXxh1/jZwimy1MmPDF3X2aRc+HO7HpQ=",
+    "hash": "sha256-NvAQY8uoTtBoyx6XF8rruaRXVRARAr1yFKFkBes6Css=",
     "homepage": "https://registry.terraform.io/providers/kislerdm/neon",
     "owner": "kislerdm",
     "repo": "terraform-provider-neon",
-    "rev": "v0.13.0",
+    "rev": "v0.14.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-7mJ+BX7laBKsr4DX1keMXnGi79CZp8M1jD0COQ1lcmU="
   },
@@ -842,13 +842,13 @@
     "vendorHash": "sha256-EAv8EeNn0PJ3BElmg6sKkd/LXNe0lFjEIjHuZRG3CoQ="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-PgAK0BUTSyW4CXssQkENohnhtd2O5GPuFVvSDcHWjQ8=",
+    "hash": "sha256-xQhWB5gUO10v7KXXHci3gvXlI/hg7JXsn9bYxHVGJwc=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.30.0",
+    "rev": "v2.30.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
+    "vendorHash": "sha256-9RisIZUblqqylMW6Bz6ehpwRUXyvTdicuhEGI+n5G3Y="
   },
   "linode_linode": {
     "hash": "sha256-N/SVZ1ajNRT53zxdYBT6Hd/wwAuKhEre0QSZUYbkwGA=",
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-ENFE5nK1qxZcOxIMzXiilCLxRGBg0dc3lTPODk9e99g=",
+    "hash": "sha256-ZDpyBnralPWEMorou9A8+llGqavGlPMe1YJlUMrfYRY=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.22.0",
+    "rev": "v8.23.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1274,11 +1274,11 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic_sumologic": {
-    "hash": "sha256-MraUjj18ooGYfOnsEJ0oCPIFQITagNRGMeAqZqEQWU4=",
+    "hash": "sha256-h4ipmgcEK8Cv9/gQwdOtQqbhfXO/QXJsrHHV6O1HtL8=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.2.9",
+    "rev": "v3.2.10",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
   },

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -34,7 +34,6 @@
   libjxl,
   libicns,
   apple-sdk_15,
-  llvmPackages,
   nix-update-script,
 }:
 
@@ -66,11 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     gobject-introspection
-  ]
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -107,12 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapQtApps = true;
 
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   cmakeFlags = [
     # We're allowed to used the API ID of the Snap package:
     (lib.cmakeFeature "TDESKTOP_API_ID" "611335")

pkgs/applications/networking/irc/weechat/default.nix

@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.3";
+  version = "4.9.4";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-XH2VOfqGyZ6nalUaiJqSusIeq3uyeQ29NGRS0AsQw3w=";
+    hash = "sha256-P8UDWfOjsljJ8DFIsC87nFkZRTXRtGXEgfuFp2wu0AU=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031

pkgs/applications/science/math/R/default.nix

@@ -27,7 +27,6 @@
   pkg-config,
   bison,
   which,
-  llvmPackages,
   jdk,
   blas,
   lapack,
@@ -69,10 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     tzdata
     which
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
-
+  ];
   buildInputs = [
     bzip2
     gfortran
@@ -130,11 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontDisableStatic = static;
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   preConfigure = ''
     configureFlagsArray=(
       --disable-lto

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix

@@ -13,13 +13,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.55.0";
+            version = "0.56.0";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-WMUJ7tyw/9QbKUyRzLndEQSqX05fQLmFlRdMAmPD7tI=";
+              hash = "sha256-piRpwar7VZI3YviYo0a/UMFz9+rLesfv3nRLGKxjVGg=";
             };
           in
           mkHyprlandPlugin {

pkgs/build-support/build-typst-package.nix

@@ -40,6 +40,9 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       dontBuild = true;
 
       installPhase =

pkgs/build-support/fetchurl/mirrors.nix

@@ -53,10 +53,13 @@
   ];
 
   # GCC
+  # The commented out ones don't seem to be keeping up with the latest releases
+  # as of 2026-07-07 they don't have tarballs for 14.4 or 15.3
   gcc = [
-    "https://mirror.koddos.net/gcc/"
-    "https://bigsearcher.com/mirrors/gcc/"
-    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
+    # "https://mirror.koddos.net/gcc/"
+    # "https://bigsearcher.com/mirrors/gcc/"
+    "https://mirrorservice.org/sites/sourceware.org/pub/gcc/"
+    # "ftp://ftp.nluug.nl/mirror/languages/gcc/"
     "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
     "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
     "ftp://gcc.gnu.org/pub/gcc/"

pkgs/build-support/go/module.nix

@@ -320,10 +320,15 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -3,6 +3,8 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/_4/_4ti2/package.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://4ti2.github.io/";
     description = "Software package for algebraic, geometric and combinatorial problems on linear spaces";
     license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ coolcuber ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/ac/account-utils/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "account-utils";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "thkukuk";
     repo = "account-utils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9l+y7FLb0IZXXp4RstlhNR6yA7b4b831obFuiVtO9+k=";
+    hash = "sha256-F0jM7qEpUjDjf0FTMfTNbD3WDoBShE0SyhDKzgI2K0k=";
   };
 
   __structuredAttrs = true;
@@ -54,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "c_args" "-ffat-lto-objects")
   ];
 
+  doCheck = true;
+
   passthru.tests = {
     inherit (nixosTests) login-nosuid;
   };

pkgs/by-name/ad/addchain/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "addchain";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "mmcloughlin";
+    repo = "addchain";
+    tag = "v${version}";
+    fetchSubmodules = false;
+    hash = "sha256-msuZgNYqN1QldrbXJJ4BFXYhUsllAPt8W0KRrr8p6TM=";
+  };
+
+  vendorHash = "sha256-qxlVGkbm95WFmH0+48XRXwrF7HRUWFxYHFzmFOaj4GA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/mmcloughlin/addchain/meta.buildversion=${version}"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  subPackages = [ "cmd/addchain" ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "addchain generates short addition chains for exponents of cryptographic interest with results rivaling the best hand-optimized chains";
+    homepage = "https://github.com/mmcloughlin/addchain";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      ambiso
+    ];
+    mainProgram = "addchain";
+  };
+}

pkgs/by-name/ad/adrs/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adrs";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "joshrotenberg";
     repo = "adrs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vs7EtIfyfBsXQQKPUKnJlAfUIuj+b17alDBT1WgH8xc=";
+    hash = "sha256-sYeJ+5gAZXjKiwHLcS2iiBM3OZUWXo6lS0OxiNLtBXM=";
   };
 
-  cargoHash = "sha256-8iDb6DNBCJkjKORIOLZQNPthMLSHC0Lfd6vo9+HIkS4=";
+  cargoHash = "sha256-jI0FAZ+QzqTTiRKcnfo1Uh0J1rFWNqNvSLQU/GIjLbc=";
 
   meta = {
     description = "Command-line tool for managing Architectural Decision Records";

pkgs/by-name/ae/aerion-creds/package.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+let
+  version = "0.3.2";
+
+  archMap = {
+    "x86_64-linux" = "x86_64";
+    "aarch64-linux" = "aarch64";
+  };
+  sysArch =
+    archMap.${stdenv.hostPlatform.system}
+      or (throw "Unsupported architecture: ${stdenv.hostPlatform.system}");
+
+  shimHashes = {
+    "x86_64" = "sha256-8WvuQgWTJNe4UpmS6uSYDYm46sIqxJbwVZ/J3CRz0OI=";
+    "aarch64" = "sha256-4RvFbxJGwM70huziY2ELoCouTrtMasgoqFUncBeBFvU=";
+  };
+in
+stdenv.mkDerivation {
+  pname = "aerion-creds";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/hkdb/aerion/releases/download/v${version}/flathub-build-env-v${version}-linux-${sysArch}";
+    hash = shimHashes.${sysArch};
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $src $out/bin/aerion-creds
+    chmod +x $out/bin/aerion-creds
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "OAuth credentials shim for Aerion";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ curious ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/ae/aerion/package.nix

@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  pkg-config,
+  wrapGAppsHook3,
+  gtk3,
+  webkitgtk_4_1,
+  glib,
+
+  aerion-creds,
+  withOAuth ? false,
+}:
+
+let
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "hkdb";
+    repo = "aerion";
+    rev = "v${version}";
+    hash = "sha256-elmk4huz4mvc7t+5/ZM5AK2R4pSKrLsZM0HxWFmQldE=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "aerion-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/frontend";
+
+    npmDepsHash = "sha256-dC+xGwSqdzItIfDipAVIVnbUJHiFkmzanjV/5xFsbkc=";
+
+    buildPhase = ''
+      npm run build
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r dist/* $out/
+    '';
+  };
+
+in
+buildGoModule {
+  pname = "aerion";
+  inherit version src;
+
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-ptsrOpJo3i+yRSCGuHynbzi+C+GD/mBmPuHqWSVV/+4=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    gtk3
+    webkitgtk_4_1
+    glib
+  ];
+
+  tags = [
+    "production"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "desktop"
+    "webkit2_41"
+  ];
+
+  preBuild = ''
+    mkdir -p frontend/dist
+    cp -r ${frontend}/* frontend/dist/
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux (
+    ''
+      install -Dm644 build/linux/aerion.png $out/share/pixmaps/io.github.hkdb.Aerion.png
+      install -Dm644 build/linux/aerion.desktop $out/share/applications/io.github.hkdb.Aerion.desktop
+    ''
+    + lib.optionalString withOAuth ''
+      rm -f $out/bin/aerion-creds
+      ln -s ${aerion-creds}/bin/aerion-creds $out/bin/aerion-creds
+    ''
+  );
+
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "An Open Source Lightweight E-Mail Client";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    mainProgram = "aerion";
+    maintainers = with lib.maintainers; [ curious ];
+  };
+}

pkgs/by-name/ae/aerion/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix nix-update nix-prefetch-scripts common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+aerion_creds_file="$nixpkgs/pkgs/by-name/ae/aerion-creds/package.nix"
+
+version=$(list-git-tags --url=https://github.com/hkdb/aerion \
+  | grep -oP '^v\d+\.\d+\.\d+$' \
+  | sed 's/^v//' \
+  | sort -V \
+  | tail -1)
+
+echo "Updating aerion and aerion-creds to v$version"
+
+# Update version in creds file
+sed -i "s/version = \".*\";/version = \"$version\";/" "$aerion_creds_file"
+
+# Update creds binary hashes
+for arch in x86_64 aarch64; do
+    url="https://github.com/hkdb/aerion/releases/download/v$version/flathub-build-env-v$version-linux-$arch"
+    echo "  Fetching creds hash for $arch..."
+    hash=$(nix-prefetch-url --type sha256 "$url")
+    sri_hash=$(nix-hash --to-sri --type sha256 "$hash")
+    sed -i "s|\"$arch\" = \"sha256-[^\"]*\";|\"$arch\" = \"$sri_hash\";|" "$aerion_creds_file"
+done
+
+# Update main package (handles version, source hash, npmDepsHash, vendorHash)
+cd "$nixpkgs"
+nix-update --version="$version" --subpackage frontend aerion
+
+echo "Done!"

pkgs/by-name/af/afew/package.nix

@@ -9,12 +9,12 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "afew";
-  version = "4.0.1";
+  version = "4.0.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-LPKSD4aMAREtf5Y4A9oa6Sh5lv/uuLpamcP35SBgA/M=";
+    hash = "sha256-gsfqyoVD6CXXd14MiyA5nq0e7wE6yymW9Ssmxpu6+E4=";
   };
 
   build-system = [

pkgs/by-name/ag/agi/package.nix

@@ -13,13 +13,13 @@
   android-tools,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "agi";
   version = "3.3.1";
 
   src = fetchzip {
-    url = "https://github.com/google/agi/releases/download/${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-Yawl6InBYSWNw3clHyGAeC2PVfXEzWmbd6vcYrqAPO0=";
+    url = "https://github.com/google/agi/releases/download/${finalAttrs.version}/agi-${finalAttrs.version}-linux.zip";
+    hash = "sha256-Yawl6InBYSWNw3clHyGAeC2PVfXEzWmbd6vcYrqAPO0=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation rec {
     cp -r lib $out
 
     for i in 16 32 48 64 96 128 256 512 1024; do
-      install -D ${src}/icon.png $out/share/icons/hicolor/''${i}x$i/apps/agi.png
+      install -D ${finalAttrs.src}/icon.png $out/share/icons/hicolor/''${i}x$i/apps/agi.png
     done
 
     runHook postInstall
@@ -71,7 +71,7 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "Android GPU Inspector";
     homepage = "https://gpuinspector.dev";
-    changelog = "https://github.com/google/agi/releases/tag/v${version}";
+    changelog = "https://github.com/google/agi/releases/tag/v${finalAttrs.version}";
     platforms = [ "x86_64-linux" ];
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ kashw2 ];
@@ -80,4 +80,4 @@ stdenvNoCC.mkDerivation rec {
       binaryNativeCode
     ];
   };
-}
+})

pkgs/by-name/ag/ags/package.nix

@@ -105,7 +105,6 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/Aylur/ags/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
-      PerchunPak
       johnrtitor
     ];
     mainProgram = "ags";

pkgs/by-name/ai/air-formatter/package.nix

@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "air-formatter";
-  version = "0.10.0";
+  version = "0.11.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "posit-dev";
     repo = "air";
     tag = finalAttrs.version;
-    hash = "sha256-u0icSo6aW6tLgY57RPAoVte5Awn16FLIvZEeeYNr5fk=";
+    hash = "sha256-BWtQLgNFf/kULGvet33k3T1k2oL1hbDn2VPCj0JxrX4=";
   };
 
-  cargoHash = "sha256-51xkTVs6j7n0os5wHWxpFC/uLHm3tz+SiWUHsd+bNRw=";
+  cargoHash = "sha256-xcNVioDbejCLrWMaUA06r9GK5KEIPq6w0W7G7290kOU=";
 
   useNextest = true;
 

pkgs/by-name/al/alsa-lib/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
+    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
   };
 
   patches = [
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
     mainProgram = "aserver";
 

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
+    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
   };
 
   patches = [
@@ -47,6 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
     description = "ALSA Use Case Manager configuration";
 
     longDescription = ''

pkgs/by-name/al/alsa-utils/package.nix

@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture utils";
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and

pkgs/by-name/am/amp-cli/package.nix

@@ -26,7 +26,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1783629102-g8185a2";
+  version = "0.0.1784391370-g49c6a1";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -77,9 +77,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-KNXCbNhY7njmGQlv3NxBmkIDciVVZlXl9JedBerdrZM=";
-            aarch64-linux = "sha256-HJf1Ikmai/h/Y2HybYcKxRhx5VhiyoPaubocCkoxF3s=";
-            aarch64-darwin = "sha256-agoKx8pXQf1HGUwsfqpgeZBubwhnPG+xqIfu3Y+AK2Y=";
+            x86_64-linux = "sha256-x7p8BIQbu/ylyCkE63NZQUYfOn5nzwvwqXRWYbW4Q8w=";
+            aarch64-linux = "sha256-X2xQzlu2VfucXii92mFWsp1Ab8blBORtT/BE0kcZi6g=";
+            aarch64-darwin = "sha256-8jj4+dtc54eaFHVlCYKdX9F3s/qrCVICgi5Dyi+n3cg=";
           }
           .${system'};
       }

pkgs/by-name/an/anda/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "anda";
-  version = "0.7.3";
+  version = "0.7.8";
 
   src = fetchFromGitHub {
     owner = "FyraLabs";
     repo = "anda";
     tag = finalAttrs.version;
-    hash = "sha256-2I+4n/RWC8hqztjiKjqJadaajTaiwFrqGDL7166Gvso=";
+    hash = "sha256-/1N3ivvnlSBK9qYOAiH96tE/k+S3+EBfsycN2QV8o70=";
   };
 
-  cargoHash = "sha256-v0HnWbLq8zwJZr0uNVj/1c5fg6b//X1szm6eel/8Ls8=";
+  cargoHash = "sha256-keS3z1Kyx6TKObAneQ/+qCp/1ueYQOdepdnAPiJs9qI=";
 
   __structuredAttrs = true;
 

pkgs/by-name/an/android-studio-tools/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "android-studio-tools";
-  version = "14742923";
+  version = "15859902";
 
   src = fetchzip {
     # The only difference between the Linux and Mac versions is a single comment at the top of all the scripts
     # Therefore, we will use the Linux version and just patch the comment
-    url = "https://dl.google.com/android/repository/commandlinetools-linux-14742923_latest.zip";
-    hash = "sha256-oimC4ToDFIa8Rlv+5RB+swl8M5PHdX4omlrMZMQEx8M=";
+    url = "https://dl.google.com/android/repository/commandlinetools-linux-15859902_latest.zip";
+    hash = "sha256-tCbccw7qa7ncHGyWPWjwQOpaisN3QMRYXRpK7WtyjWY=";
   };
 
   postPatch = ''

pkgs/by-name/an/antigravity-ide/information.json

@@ -0,0 +1,18 @@
+{
+  "version": "2.1.1",
+  "vscodeVersion": "1.107.0",
+  "sources": {
+    "x86_64-linux": {
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/linux-x64/Antigravity%20IDE.tar.gz",
+      "sha256": "5b2cebf7d33a68d003fd8f1fa988d1600905ace22504a085e5384214290878bd"
+    },
+    "aarch64-linux": {
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/linux-arm/Antigravity%20IDE.tar.gz",
+      "sha256": "c6b6fef97cfc078ae7f92d02f9483a12437b6602c7d322a7d445668c2f0c16a6"
+    },
+    "aarch64-darwin": {
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/darwin-arm/Antigravity%20IDE.zip",
+      "sha256": "3491f5bc9faad111e5be6d9126bf5d566a0c591bd159a61ef0dcdd30c58672aa"
+    }
+  }
+}

pkgs/by-name/an/antigravity-ide/package.nix

@@ -14,22 +14,22 @@ let
   information = (lib.importJSON ./information.json);
   source =
     information.sources."${hostPlatform.system}"
-      or (throw "antigravity: unsupported system ${hostPlatform.system}");
+      or (throw "antigravity-ide: unsupported system ${hostPlatform.system}");
 in
 buildVscode {
   inherit commandLineArgs useVSCodeRipgrep;
   inherit (information) version vscodeVersion;
-  pname = "antigravity";
+  pname = "antigravity-ide";
 
-  executableName = "antigravity";
-  longName = "Antigravity";
-  shortName = "Antigravity";
-  libraryName = "antigravity";
-  iconName = "antigravity";
+  executableName = "antigravity-ide";
+  longName = "Antigravity IDE";
+  shortName = "Antigravity IDE";
+  libraryName = "antigravity-ide";
+  iconName = "antigravity-ide";
 
   src = fetchurl { inherit (source) url sha256; };
 
-  sourceRoot = if hostPlatform.isDarwin then "Antigravity.app" else "Antigravity";
+  sourceRoot = if hostPlatform.isDarwin then "Antigravity IDE.app" else "Antigravity IDE";
 
   tests = { };
   updateScript = ./update.js;
@@ -44,7 +44,7 @@ buildVscode {
       extraBuildCommands = (args.extraBuildCommands or "") + ''
         mkdir -p "$out/opt/google/chrome"
       '';
-      runScript = writeShellScript "antigravity-wrapper" ''
+      runScript = writeShellScript "antigravity-ide-wrapper" ''
         for candidate in google-chrome-stable google-chrome chromium-browser chromium; do
           if target=$(command -v "$candidate"); then
             ${coreutils}/bin/ln -sf "$target" /opt/google/chrome/chrome
@@ -56,10 +56,10 @@ buildVscode {
     };
 
   meta = {
-    mainProgram = "antigravity";
+    mainProgram = "antigravity-ide";
     description = "Agentic development platform, evolving the IDE into the agent-first era";
-    homepage = "https://antigravity.google";
-    downloadPage = "https://antigravity.google/download";
+    homepage = "https://antigravity.google/product/antigravity-ide";
+    downloadPage = "https://antigravity.google/download#antigravity-ide";
     changelog = "https://antigravity.google/changelog";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -71,6 +71,7 @@ buildVscode {
     maintainers = with lib.maintainers; [
       xiaoxiangmoe
       Zaczero
+      schembriaiden
     ];
   };
 }

pkgs/by-name/an/antigravity-ide/update.js

@@ -20,14 +20,15 @@ let version = "";
 let vscodeVersion = "";
 async function getLatestInformation(/** @type {"linux-x64" | "linux-arm64" | "darwin-arm64"} */ targetSystem) {
   /** @type {UpdateInfo} */
-  const latestInfo = await (await fetch(`https://antigravity-auto-updater-974169037036.us-central1.run.app/api/update/${targetSystem}/stable/latest`)).json();
+  const latestInfo = await (await fetch(`https://antigravity-ide-auto-updater-974169037036.us-central1.run.app/api/update/${targetSystem}/stable/latest`)).json();
   const newVersion = /\/antigravity\/stable\/([\d.]+)-[\d]+/.exec(latestInfo.url)?.[1] ?? ""; // Current API lack version field now, we need to parse it from the URL temporarily.
+  assert(newVersion !== "", `Could not parse Antigravity IDE version from ${latestInfo.url}`);
   assert(version === '' || version === newVersion, `Version mismatch: ${version}(linux-x64) != ${newVersion}(${targetSystem})`);
   version = newVersion;
   assert(vscodeVersion === '' || vscodeVersion === latestInfo.productVersion, `VSCode version mismatch: ${vscodeVersion}(linux-x64) != ${latestInfo.productVersion}(${targetSystem})`);
   vscodeVersion = latestInfo.productVersion;
   return {
-    url: latestInfo.url,
+    url: latestInfo.url.replaceAll(" ", "%20"),
     sha256: latestInfo.sha256hash,
   };
 }
@@ -40,4 +41,4 @@ const sources = {
 /** @type {Information} */
 const information = { version, vscodeVersion, sources };
 fs.writeFileSync(path.join(import.meta.dirname, "./information.json"), JSON.stringify(information, null, 2) + "\n", "utf-8");
-console.log(`[update] Updating Antigravity complete, version: ${version}, vscodeVersion: ${vscodeVersion}`);
+console.log(`[update] Updating Antigravity IDE complete, version: ${version}, vscodeVersion: ${vscodeVersion}`);

pkgs/by-name/an/antigravity/information.json

@@ -1,18 +0,0 @@
-{
-  "version": "1.23.2",
-  "vscodeVersion": "1.107.0",
-  "sources": {
-    "x86_64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.23.2-4781536860569600/linux-x64/Antigravity.tar.gz",
-      "sha256": "5232a4048ff4fa15685d9a981ba4fba573e297f3efc9b76f638e794baf775725"
-    },
-    "aarch64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.23.2-4781536860569600/linux-arm/Antigravity.tar.gz",
-      "sha256": "64d11085f17edc691adbe8952d59887f257d58448705dc2a19dfa23890d36df1"
-    },
-    "aarch64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.23.2-4781536860569600/darwin-arm/Antigravity.zip",
-      "sha256": "4a8a90feed7078dae30d1dbcb268a0497c103ba76df7012a4467587aa7cffdf8"
-    }
-  }
-}

pkgs/by-name/an/anytype/package.nix

@@ -143,6 +143,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     substituteInPlace scripts/generate-protos.sh \
       --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
 
+    substituteInPlace package.json \
+      --replace-fail \
+        '"build:nmh": "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"' \
+        '"build:nmh": "go build -trimpath -ldflags=-buildid= -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"'
+
     cp -r ${anytype-heart}/lib dist/
     cp -r ${anytype-heart}/bin/anytypeHelper dist/
 
@@ -168,7 +173,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   # remove unnecessary files
   preInstall = ''
     chmod u+w -R dist node_modules
-    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
+    find dist node_modules -type f \( -name '*.ts' -o -name '*.map' \) -delete
+    rm -f node_modules/keytar/build/{Makefile,binding.Makefile,config.gypi,keytar.target.mk}
+    rm -rf node_modules/keytar/build/Release/{.deps,obj.target}
   '';
 
   installPhase = ''

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -30,15 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
   '';
 
-  patches = [
-    (fetchpatch {
-      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
-      # Patches generated yacc parser code to compile with format-security
-      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
-      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
-    })
-  ];
-
   nativeBuildInputs = [
     bison
     flex

pkgs/by-name/aq/aquamarine/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   fetchFromGitHub,
   hwdata,
@@ -21,7 +21,7 @@
   wayland-protocols,
   wayland-scanner,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
   version = "0.13.0";
 

pkgs/by-name/ar/arandr/package.nix

@@ -48,10 +48,6 @@ buildPythonApplication (finalAttrs: {
     wrapGAppsHook3
   ];
 
-  propagatedBuildInputs = [
-    xrandr
-  ];
-
   buildInputs = [
     gsettings-desktop-schemas
     gtk3
@@ -73,9 +69,13 @@ buildPythonApplication (finalAttrs: {
 
   dontWrapGApps = true;
 
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ xrandr ])
+    "\${gappsWrapperArgs[@]}"
+  ];
 
   passthru.updateScript = nix-update-script {
     extraArgs = [

pkgs/by-name/ar/arftracksat/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "arftracksat";
-  version = "1.0-unstable-2025-09-15";
+  version = "1.0-unstable-2026-02-19";
 
   src = fetchFromGitHub {
     owner = "arf20";
     repo = "arftracksat";
-    rev = "5c9b3866b6fcd95382ff56c68cdd38f3d08c1372";
-    hash = "sha256-inCgsxrJkBNGmdGPd28XnOJYCiatL35TxDcfvZjA2cY=";
+    rev = "a9b86878e2ee6f332dc1df07685b7d20970c2f7e";
+    hash = "sha256-guDgy4H0pnQCihYwG7HoKApOlEcDtcaRaj6fRuVdLlc=";
   };
 
   nativeBuildInputs = [
@@ -35,11 +35,13 @@ stdenv.mkDerivation {
   buildInputs = [
     curl
     nlohmann_json
+    curlpp
+    glm
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     freeglut
     libGL
     libGLU
-    curlpp
-    glm
   ];
 
   meta = {