nixos/test-driver: coerced testScript merging (#556124)

This reverts commit 47a4ab7a96.

It was prematurely added, since the PR it belongs to only updates
emacs31 attrs, not top-level emacs attrs.

See https://github.com/NixOS/nixpkgs/pull/556042#discussion_r3847137386
for context.

CONTRIBUTING.md

@@ -957,7 +957,6 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
-If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.

lib/licenses/licenses.nix

@@ -715,6 +715,11 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
+    gccException20 = {
+      spdxId = "GCC-exception-2.0";
+      fullName = "GCC Runtime Library exception 2.0";
+    };
+
     gccException31 = {
       spdxId = "GCC-exception-3.1";
       fullName = "GCC Runtime Library exception 3.1";

maintainers/github-teams.json

@@ -262,6 +262,7 @@
       "stephenstubbs": 18033664,
       "t-monaghan": 62273348,
       "thefloweringash": 42933,
+      "thtrf": 82712122,
       "tricktron": 16036882,
       "uncenter": 47499684,
       "usertam": 22500027,
@@ -657,7 +658,6 @@
       "djacu": 7043297
     },
     "members": {
-      "Sigmanificient": 53050011,
       "flyfloh": 74379,
       "thilobillerbeck": 7442383
     },
@@ -856,6 +856,7 @@
       "lorenzleutgeb": 542154
     },
     "members": {
+      "Mic92": 96200,
       "ju1m": 21160136,
       "matthiasbeyer": 427866
     },

maintainers/maintainer-list.nix

@@ -3694,13 +3694,6 @@
     githubId = 185443;
     name = "Alexey Lebedeff";
   };
-  binary-eater = {
-    email = "sergeantsagara@protonmail.com";
-    github = "Binary-Eater";
-    githubId = 10691440;
-    name = "Rahul Rameshbabu";
-    keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110  BE53 FF24 7B3E 5411 387B"; } ];
-  };
   binarycat = {
     email = "binarycat@envs.net";
     github = "lolbinarycat";
@@ -20948,6 +20941,12 @@
     githubId = 41154684;
     name = "nokazn";
   };
+  nolight132 = {
+    email = "contact@nolight.dev";
+    github = "nolight132";
+    githubId = 71591964;
+    name = "Pavel Olizko";
+  };
   nolith = {
     github = "nolith";
     githubId = 78752;

nixos/doc/manual/development/running-nixos-tests.section.md

@@ -59,6 +59,6 @@ To make this path available, set the following option:
 
 ```nix
 {
-  nix.settings.sandbox-paths = [ "/dev/net" ];
+  nix.settings.extra-sandbox-paths = [ "/dev/net" ];
 }
 ```

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -106,6 +106,10 @@
 
 - [kvrocks_exporter](https://github.com/RocksLabs/kvrocks_exporter), a Prometheus exporter for Kvrocks metrics. Available as [services.prometheus.exporters.kvrocks](#opt-services.prometheus.exporters.kvrocks.enable).
 
+- [Umbriel](https://docs.noctalia.dev/umbriel/), a Wayland compositor built on wlroots and SceneFX. Available as [programs.umbriel](#opt-programs.umbriel.enable).
+
+- [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -197,12 +201,18 @@
 
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
+- The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
+
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
 
 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
 
 - `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
 
+- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1809,15 +1809,16 @@ class NspawnMachine(BaseMachine):
 
         # 1. Wait for the directory to actually be created by the container
         self.log(f"Waiting for journal at {journal_path}...")
-        max_attempts = 10
+        warn_after = 10
         attempts = 0
-        while not journal_path.exists() and attempts < max_attempts:
+        while not journal_path.exists():
+            if proc.poll() is not None:
+                self.log(f"Error: Journal directory {journal_path} never appeared.")
+                return
             time.sleep(1)
             attempts += 1
-
-        if not journal_path.exists():
-            self.log(f"Error: Journal directory {journal_path} never appeared.")
-            return
+            if attempts == warn_after:
+                self.log(f"Still waiting for journal at {journal_path}...")
 
         # 2. Start the journalctl process
         # Using a loop here handles cases where journalctl might exit unexpectedly

nixos/lib/testing/run.nix

@@ -35,8 +35,7 @@ let
     options = {
       devnet = mkOption {
         type = types.bool;
-        default =
-          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
+        default = containers != { } && nodes != { };
         defaultText = lib.literalMD "`true` if both VMs and containers are present.";
         description = ''
           This heuristic setting that assumes that the majority of tests requires VMs and containers
@@ -52,14 +51,14 @@ let
       };
       uid-range = mkOption {
         type = types.bool;
-        default = builtins.length (lib.attrNames containers) > 0;
+        default = containers != { };
         defaultText = lib.literalMD "`true` if containers are present.";
         description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
       };
       kvm = mkOption {
         type = types.bool;
-        default = isLinux;
-        defaultText = lib.literalMD "`true` if built to run on Linux.";
+        default = isLinux && nodes != { };
+        defaultText = lib.literalMD "`true` if built to run on Linux and any virtual machines are specified.";
         description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
       };
       apple-virt = mkOption {

nixos/lib/testing/testScript.nix

@@ -7,20 +7,15 @@ testModuleArgs@{
   ...
 }:
 let
-  inherit (lib) mkOption types;
-  inherit (types) either lines functionTo;
+  inherit (lib) mkOption types const;
+  inherit (types) coercedTo lines functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = either lines (functionTo lines);
-      apply =
-        v:
-        if lib.isFunction v then
-          # Only pass args the testScript function expects.
-          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
-        else
-          v;
+      type = coercedTo lines const (functionTo lines);
+      # Only pass args the testScript function expects.
+      apply = v: args: v (builtins.intersectAttrs (lib.functionArgs v) args);
       description = ''
         A series of python declarations and statements that you write to perform
         the test.
@@ -50,23 +45,19 @@ in
     withoutTestScriptReferences.includeTestScriptReferences = false;
     withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
 
-    testScriptString =
-      if lib.isFunction config.testScript then
-        config.testScript {
-          nodes = lib.mapAttrs (
-            k: v:
-            if v.virtualisation.useNixStoreImage then
-              # prevent infinite recursion when testScript would
-              # reference v's toplevel
-              config.withoutTestScriptReferences.nodesCompat.${k}
-            else
-              # reuse memoized config
-              v
-          ) config.nodesCompat;
-          containers = config.containers;
-        }
-      else
-        config.testScript;
+    testScriptString = config.testScript {
+      nodes = lib.mapAttrs (
+        k: v:
+        if v.virtualisation.useNixStoreImage then
+          # prevent infinite recursion when testScript would
+          # reference v's toplevel
+          config.withoutTestScriptReferences.nodesCompat.${k}
+        else
+          # reuse memoized config
+          v
+      ) config.nodesCompat;
+      containers = config.containers;
+    };
 
     nodeDefaults =
       { config, name, ... }:

nixos/modules/module-list.nix

@@ -372,6 +372,7 @@
   ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
+  ./programs/wayland/umbriel.nix
   ./programs/wayland/uwsm.nix
   ./programs/wayland/waybar.nix
   ./programs/wayland/wayfire.nix
@@ -1823,6 +1824,7 @@
   ./services/web-apps/romm.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rsshub.nix
+  ./services/web-apps/rundeck.nix
   ./services/web-apps/rustical.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix

nixos/modules/programs/wayland/umbriel.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.umbriel;
+in
+{
+  options.programs.umbriel = {
+    enable = lib.mkEnableOption "Umbriel, a Wayland compositor built on wlroots and SceneFX";
+    package = lib.mkPackageOption pkgs "umbriel" { };
+    portalPackage = lib.mkPackageOption pkgs "xdg-desktop-portal-umbriel" { };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [ cfg.package ];
+        services.displayManager.sessionPackages = [ cfg.package ];
+        systemd.packages = [ cfg.package ];
+
+        systemd.user.services.umbriel = {
+          restartIfChanged = false;
+          enableDefaultPath = false;
+        };
+
+        xdg.portal = {
+          enable = lib.mkDefault true;
+          extraPortals = [ cfg.portalPackage ];
+          configPackages = [ cfg.portalPackage ];
+        };
+      }
+
+      (import ./wayland-session.nix {
+        inherit lib pkgs;
+        enableXWayland = false;
+        enableWlrPortal = false;
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [
+    samiser
+    pyrox0
+  ];
+}

nixos/modules/services/misc/portunus.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.services.portunus;
-
 in
 {
   options.services.portunus = {
@@ -79,9 +78,15 @@ in
         type = lib.types.listOf (
           lib.types.submodule {
             options = {
+              redirectURIs = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+                description = "URLs where the OIDC client should redirect";
+              };
               callbackURL = lib.mkOption {
-                type = lib.types.str;
-                description = "URL where the OIDC client should redirect";
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                description = "URL where the OIDC client should redirect (deprecated, use redirectURIs)";
               };
               id = lib.mkOption {
                 type = lib.types.str;
@@ -93,7 +98,7 @@ in
         default = [ ];
         example = [
           {
-            callbackURL = "https://example.com/client/oidc/callback";
+            redirectURIs = [ "https://example.com/client/oidc/callback" ];
             id = "service";
           }
         ];
@@ -227,7 +232,7 @@ in
 
           staticClients = lib.forEach cfg.dex.oidcClients (client: {
             inherit (client) id;
-            redirectURIs = [ client.callbackURL ];
+            redirectURIs = client.redirectURIs ++ lib.optional (client.callbackURL != null) client.callbackURL;
             name = "OIDC for ${client.id}";
             secretEnv = "DEX_CLIENT_${client.id}";
           });

nixos/modules/services/networking/adguardhome.nix

@@ -20,8 +20,7 @@ let
 
   settings =
     if (cfg.settings != null) then
-      cfg.settings
-      // (
+      lib.recursiveUpdate cfg.settings (
         if cfg.settings.schema_version < 23 then
           {
             bind_host = cfg.host;
@@ -192,8 +191,9 @@ in
                 # Note: --check-config has the side effect of modifying the file at rest!
                 ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
 
-                # Writing directly to AdGuardHome.yaml results in empty file
-                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
+                # sed operation needed to fix protection_disabled_until value changed by yaml-merge
+                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" \
+                | sed -E "s/(protection_disabled_until: [0-9]{4}-[0-9]{2}-[0-9]{2}) /\1T/" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
                 mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
               else
                 ${installFresh}

nixos/modules/services/networking/syncthing.nix

@@ -1049,7 +1049,7 @@ in
       };
       syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
-        requisite = [ "syncthing.service" ];
+        requires = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
         wantedBy = [ "multi-user.target" ];
 

nixos/modules/services/web-apps/netbox.nix

@@ -434,11 +434,12 @@ in
     package = lib.mkOption {
       type = types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "26.05" then pkgs.netbox_4_5 else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then pkgs.netbox_4_6 else pkgs.netbox_4_5;
       defaultText = lib.literalExpression ''
-        if lib.versionAtLeast config.system.stateVersion "26.05"
-        then pkgs.netbox_4_5
-        else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then
+          pkgs.netbox_4_6
+        else
+          pkgs.netbox_4_5;
       '';
       description = ''
         NetBox package to use.

nixos/modules/services/web-apps/papra.nix

@@ -8,14 +8,22 @@ let
   cfg = config.services.papra;
   defaultUser = "papra";
   defaultGroup = "papra";
-  defaultEnv = {
-    SERVER_SERVE_PUBLIC_DIR = true;
-    PORT = 1221;
-    DATABASE_URL = "file:/var/lib/papra/db.sqlite";
-    DOCUMENT_STORAGE_FILESYSTEM_ROOT = "/var/lib/papra/local-documents";
-  };
 in
 {
+  imports = [
+    (lib.mkChangedOptionModule
+      [ "services" "papra" "environmentFile" ]
+      [ "services" "papra" "environmentFiles" ]
+      (
+        config:
+        let
+          value = lib.getAttrFromPath [ "services" "papra" "environmentFile" ] config;
+        in
+        if value == null then [ ] else [ value ]
+      )
+    )
+  ];
+
   options = {
     services.papra = {
       enable = lib.mkEnableOption "Papra";
@@ -37,31 +45,103 @@ in
 
       package = lib.mkPackageOption pkgs "papra" { };
 
-      environment = lib.mkOption {
-        type =
-          with lib.types;
-          attrsOf (oneOf [
-            str
-            int
-            float
-            bool
-            path
-            package
-          ]);
-        default = defaultEnv;
-        example = {
-          PORT = 1221;
-        };
-        description = "Environment variables to set for the service.";
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for Papra.
+        '';
       };
 
-      environmentFile = lib.mkOption {
-        type = with lib.types; nullOr path;
-        default = null;
-        description = "Environment file, usefult to provide secrets to the service";
+      environment = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              str
+              int
+              float
+              bool
+              path
+              package
+            ]);
+
+          options = {
+            PORT = lib.mkOption {
+              type = lib.types.port;
+              default = 1221;
+              description = ''
+                The port on which Papra listens.
+                See <https://docs.papra.app/self-hosting/configuration/#port> for more information.
+              '';
+            };
+
+            DATABASE_URL = lib.mkOption {
+              type = lib.types.str;
+              default = "file:/var/lib/papra/db.sqlite";
+              description = ''
+                The URL of the database.
+                See <https://docs.papra.app/self-hosting/configuration/#database_url> for more information.
+
+                ::: {.note}
+                When specifying a `file:` URL with an absolute path through this option,
+                the database's parent directory is automatically added to the systemd
+                service's `ReadWritePaths`. Other local database paths, including paths
+                specified through `environmentFiles`, may need to be added to `ReadWritePaths` manually.
+                :::
+              '';
+            };
+
+            INGESTION_FOLDER_ROOT_PATH = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/papra/ingestion";
+              description = ''
+                The root directory in which ingestion folders for each organization are stored.
+                The parent directory must already exist if using a custom path.
+                See <https://docs.papra.app/self-hosting/configuration/#ingestion_folder_root_path> for more information.
+              '';
+            };
+
+            DOCUMENT_STORAGE_FILESYSTEM_ROOT = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/papra/local-documents";
+              description = ''
+                The root directory to store documents in.
+                The parent directory must already exist if using a custom path.
+                See <https://docs.papra.app/self-hosting/configuration/#document_storage_filesystem_root> for more information.
+              '';
+            };
+
+            SERVER_SERVE_PUBLIC_DIR = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to serve the public directory.
+                See <https://docs.papra.app/self-hosting/configuration/#server_serve_public_dir> for more information.
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Environment variables to pass to Papra.
+          See <https://docs.papra.app/self-hosting/configuration/#configuration-variables> for more information.
+        '';
+      };
+
+      environmentFiles = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [ ];
+        example = [ "/run/secrets/papra.env" ];
+        description = ''
+          Files to load environment variables from in addition to [](#opt-services.papra.environment).
+          This is useful to avoid putting secrets into the nix store.
+          See <https://docs.papra.app/self-hosting/configuration/#configuration-variables> for more information.
+        '';
       };
     };
   };
+
   config = lib.mkIf cfg.enable {
     users = {
       users = lib.optionalAttrs (cfg.user == defaultUser) {
@@ -76,6 +156,18 @@ in
       };
     };
 
+    systemd.tmpfiles.settings."10-papra" = {
+      "${cfg.environment.DOCUMENT_STORAGE_FILESYSTEM_ROOT}".d = {
+        mode = "0700";
+        inherit (cfg) user group;
+      };
+
+      "${cfg.environment.INGESTION_FOLDER_ROOT_PATH}".d = {
+        mode = "0770";
+        inherit (cfg) user group;
+      };
+    };
+
     systemd.services.papra = {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
@@ -85,15 +177,58 @@ in
         User = cfg.user;
         Group = cfg.group;
         StateDirectory = "papra";
-        EnvironmentFile = cfg.environmentFile;
+        StateDirectoryMode = "0700";
+        EnvironmentFile = cfg.environmentFiles;
+        ReadWritePaths = lib.unique (
+          [
+            cfg.environment.DOCUMENT_STORAGE_FILESYSTEM_ROOT
+            cfg.environment.INGESTION_FOLDER_ROOT_PATH
+          ]
+          ++ lib.optional (lib.hasPrefix "file:/" cfg.environment.DATABASE_URL) (
+            dirOf (lib.removePrefix "file:" cfg.environment.DATABASE_URL)
+          )
+        );
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0007";
       };
-      environment =
-        let
-          environmentwithDefaults = defaultEnv // cfg.environment;
-        in
-        (lib.mapAttrs (
-          _: s: if lib.isBool s then lib.boolToString s else toString s
-        ) environmentwithDefaults);
+      environment = lib.mapAttrs (
+        _: s: if lib.isBool s then lib.boolToString s else toString s
+      ) cfg.environment;
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.environment.PORT ];
     };
   };
 

nixos/modules/services/web-apps/rundeck.nix

@@ -0,0 +1,651 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rundeck;
+  settingsFormat = pkgs.formats.javaProperties { };
+  effectivePort = if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort;
+  scheme = if cfg.ssl.enable then "https" else "http";
+
+  configFile = settingsFormat.generate "rundeck-config.properties" cfg.settings;
+  frameworkFile = settingsFormat.generate "framework.properties" cfg.frameworkSettings;
+
+  realmFile = pkgs.writeText "realm.properties" ''
+    ${cfg.adminUser}:@ADMIN_PASSWORD@,user,admin
+  '';
+
+  replaceSecret =
+    placeholder: file: target:
+    "replace-secret ${
+      lib.escapeShellArgs [
+        placeholder
+        file
+        target
+      ]
+    }";
+
+  rundeckStartScript = pkgs.writeShellScript "start-rundeck" ''
+    # Generate SSH
+    if [ ! -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ]; then
+      umask 0077
+      ${lib.getExe' pkgs.openssh "ssh-keygen"} -t ${cfg.sshKeyType} ${
+        lib.optionalString (cfg.sshKeyType == "rsa") "-b 4096"
+      } -N "" -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}
+      chmod 644 ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+      chown ${cfg.user}:${cfg.group} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+    fi
+
+    ${lib.getExe cfg.package} \
+      --skipinstall \
+      -b ${cfg.dataDir} \
+      -c ${cfg.configDir} \
+      -p ${cfg.dataDir}/projects
+  '';
+in
+{
+  options = {
+    services.rundeck = {
+      enable = lib.mkEnableOption "Rundeck service";
+
+      package = lib.mkPackageOption pkgs "rundeck" { };
+
+      adminUser = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+        description = "Username for the Rundeck admin user";
+        example = "rundeck-admin";
+      };
+
+      adminPasswordFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Path to a file containing the admin password";
+        example = "/run/secrets/rundeck-admin-password";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "User account under which Rundeck runs";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "Group account under which Rundeck runs";
+      };
+
+      serverHostname = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = "Hostname for the Rundeck server";
+      };
+
+      serverURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${scheme}://${cfg.serverHostname}:${toString effectivePort}";
+        defaultText = lib.literalMD ''
+          `<scheme>://<serverHostname>:<port>`, where scheme is `https` when
+          `ssl.enable` else `http`, and port is `ssl.port` when `ssl.enable`
+          else `serverPort`.
+        '';
+        description = "Complete Grails server URL";
+        example = "https://myhost:4443/rundeck";
+      };
+
+      serverPort = lib.mkOption {
+        type = lib.types.port;
+        default = 4440;
+        description = "Port on which Rundeck will listen";
+      };
+
+      serverUUID = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "UUID for the Rundeck server (automatically generated if not specified)";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/rundeck";
+        description = "Directory for Rundeck runtime data (RDECK_BASE)";
+      };
+
+      configDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/etc/rundeck";
+        description = "Directory for Rundeck configuration files";
+      };
+
+      javaOpts = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "-Xmx1024m"
+          "-Xms256m"
+          "-XX:MaxMetaspaceSize=256m"
+          "-server"
+        ];
+        description = "Additional Java options for Rundeck";
+      };
+
+      aclPolicies = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        description = "ACL policies for Rundeck, where the attribute name is the filename and the value is the policy content";
+        example = lib.literalExpression ''
+          {
+            "admin.aclpolicy" = '''
+              description: Admin access for administrators
+              context:
+                project: '.*'
+              for:
+                resource:
+                  - allow: '*'
+                job:
+                  - allow: '*'
+                node:
+                  - allow: '*'
+              by:
+                group: admin
+              ---
+              description: Admin access in application scope
+              context:
+                application: 'rundeck'
+              for:
+                resource:
+                  - allow: '*'
+                project:
+                  - allow: '*'
+              by:
+                group: admin
+            ''';
+          }
+        '';
+      };
+
+      sshKeyType = lib.mkOption {
+        type = lib.types.enum [
+          "rsa"
+          "ed25519"
+        ];
+        default = "rsa";
+        description = "Type of SSH key to generate (rsa for compatibility, ed25519 for better security)";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open the Rundeck port in the firewall";
+      };
+
+      startTimeout = lib.mkOption {
+        type = lib.types.int;
+        default = 180;
+        description = "Timeout in seconds before systemd considers the service startup as failed";
+        example = 120;
+      };
+
+      database = {
+        type = lib.mkOption {
+          type = lib.types.enum [
+            "h2"
+            "postgresql"
+            "mysql"
+          ];
+          default = "h2";
+          description = "Database type to use (h2, postgresql, or mysql)";
+        };
+
+        host = lib.mkOption {
+          type = lib.types.str;
+          default = "localhost";
+          description = "Database host";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.nullOr lib.types.port;
+          default =
+            if cfg.database.type == "postgresql" then
+              5432
+            else if cfg.database.type == "mysql" then
+              3306
+            else
+              null;
+          defaultText = lib.literalExpression ''
+            if config.services.rundeck.database.type == "postgresql" then
+              5432
+            else if config.services.rundeck.database.type == "mysql" then
+              3306
+            else
+              null
+          '';
+          description = "Database port (defaults: PostgreSQL: 5432, MySQL: 3306)";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database name";
+        };
+
+        username = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database username";
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = "Path to a file containing the database password";
+          example = "/run/secrets/rundeck-db-password";
+        };
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `rundeck-config.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+
+          Secrets must not be set here, as this ends up world-readable in the Nix
+          store. Use the dedicated `*File` options instead.
+        '';
+        example = lib.literalExpression ''
+          {
+            "rundeck.feature.repository.enabled" = "true";
+            "rundeck.projectsStorageType" = "db";
+            "rundeck.gui.title" = "My Rundeck Instance";
+            "rdeck.security.useHMacRequestTokens" = "true";
+            "rundeck.web.jetty.servlet.MaxFormKeys" = "2000";
+          }
+        '';
+      };
+
+      frameworkSettings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `framework.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+        '';
+        example = lib.literalExpression ''
+          {
+            "framework.ssh.timeout" = "120";
+            "framework.ssh.user" = "deploy";
+          }
+        '';
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "SSL support";
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 4443;
+          description = "Port on which Rundeck will listen for HTTPS when ssl.enable is true";
+        };
+
+        keyStore = lib.mkOption {
+          type = lib.types.path;
+          example = "/etc/rundeck/ssl/keystore";
+          description = "Path to the keystore containing the SSL certificate";
+        };
+
+        keyStorePasswordFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Path to a file containing the SSL keystore password";
+          example = "/run/secrets/rundeck-keystore-password";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion =
+          cfg.database.type == "h2"
+          || (cfg.database.host != "" && cfg.database.username != "" && cfg.database.passwordFile != null);
+        message = "When using external database (PostgreSQL/MySQL), host, username, and passwordFile must be provided";
+      }
+      {
+        assertion = cfg.database.type == "h2" || cfg.database.port != null;
+        message = "Database port must be set when using an external database";
+      }
+    ];
+
+    services.rundeck.settings = {
+      "server.address" = lib.mkDefault "0.0.0.0";
+      "server.port" = lib.mkDefault (toString cfg.serverPort);
+      "grails.serverURL" = lib.mkDefault cfg.serverURL;
+      "logging.config" = lib.mkDefault "${cfg.configDir}/log4j2.properties";
+      "dataSource.url" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "jdbc:h2:file:${cfg.dataDir}/data/rundeckdb;DB_CLOSE_ON_EXIT=FALSE;NON_KEYWORDS=MONTH,HOUR,MINUTE,YEAR,SECONDS"
+        else if cfg.database.type == "postgresql" then
+          "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}"
+        else
+          "jdbc:mysql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}?autoReconnect=true&useSSL=false"
+      );
+      "dataSource.driverClassName" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "org.h2.Driver"
+        else if cfg.database.type == "postgresql" then
+          "org.postgresql.Driver"
+        else
+          "org.mariadb.jdbc.Driver"
+      );
+      "dataSource.username" = lib.mkDefault cfg.database.username;
+    }
+    // lib.optionalAttrs (cfg.database.passwordFile != null) {
+      "dataSource.password" = lib.mkDefault "@DB_PASSWORD@";
+    }
+    // lib.optionalAttrs (cfg.database.type == "h2") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.H2Dialect";
+    }
+    // lib.optionalAttrs (cfg.database.type == "mysql") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.MariaDB103Dialect";
+    }
+    // lib.optionalAttrs cfg.ssl.enable {
+      "server.https.port" = lib.mkDefault (toString cfg.ssl.port);
+      "server.ssl.keyStore" = lib.mkDefault (toString cfg.ssl.keyStore);
+      "server.ssl.keyStorePassword" = lib.mkDefault "@KEYSTORE_PASSWORD@";
+    };
+
+    services.rundeck.frameworkSettings = {
+      "framework.server.name" = lib.mkDefault cfg.serverHostname;
+      "framework.server.hostname" = lib.mkDefault cfg.serverHostname;
+      "framework.server.port" = lib.mkDefault (toString effectivePort);
+      "framework.server.url" = lib.mkDefault cfg.serverURL;
+      "framework.ssh.keypath" = lib.mkDefault "${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}";
+      "framework.ssh.user" = lib.mkDefault cfg.user;
+      "framework.ssh.timeout" = lib.mkDefault "60";
+      "rdeck.base" = cfg.dataDir;
+      "framework.projects.dir" = "${cfg.dataDir}/projects";
+      "framework.etc.dir" = toString cfg.configDir;
+      "framework.var.dir" = "${cfg.dataDir}/var";
+      "framework.tmp.dir" = "${cfg.dataDir}/var/tmp";
+      "framework.logs.dir" = "${cfg.dataDir}/var/logs";
+      "framework.libext.dir" = "${cfg.dataDir}/libext";
+      "rundeck.server.uuid" = if cfg.serverUUID != "" then cfg.serverUUID else "@SERVER_UUID@";
+    };
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      home = cfg.dataDir;
+      createHome = true;
+    };
+
+    users.groups.${cfg.group} = { };
+
+    systemd.tmpfiles.settings."10-rundeck" = {
+      "${cfg.dataDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/etc" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/data" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/projects" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/libext" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/logs" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/tmp" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/.ssh" = {
+        d = {
+          mode = "0700";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}/ssl" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "/var/log/rundeck" = {
+        L = {
+          argument = "${cfg.dataDir}/var/logs";
+        };
+      };
+    };
+
+    environment.etc."rundeck/jaas-loginmodule.conf" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        RDpropertyfilelogin {
+          org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
+          debug="true"
+          file="/etc/rundeck/realm.properties";
+        };
+      '';
+    };
+
+    environment.etc."rundeck/log4j2.properties" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        status = info
+        name = RundeckPro
+
+        appender.console.type = Console
+        appender.console.name = STDOUT
+        appender.console.layout.type = PatternLayout
+        appender.console.layout.pattern = %d{DEFAULT} %-5p %c{1} - %m%n
+
+        appender.file.type = RollingFile
+        appender.file.name = FILE
+        appender.file.fileName = ${cfg.dataDir}/var/logs/rundeck.log
+        appender.file.filePattern = ${cfg.dataDir}/var/logs/rundeck.%d{yyyy-MM-dd}.log
+        appender.file.layout.type = PatternLayout
+        appender.file.layout.pattern = %d{DEFAULT} [%t] %-5p %c{1} - %m%n
+        appender.file.policies.type = Policies
+        appender.file.policies.time.type = TimeBasedTriggeringPolicy
+        appender.file.policies.time.interval = 1
+        appender.file.policies.time.modulate = true
+
+        rootLogger.level = info
+        rootLogger.appenderRef.stdout.ref = STDOUT
+        rootLogger.appenderRef.file.ref = FILE
+
+        logger.hibernate.name = org.hibernate
+        logger.hibernate.level = ERROR
+      '';
+    };
+
+    systemd.services.rundeck = {
+      description = "Rundeck Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional (cfg.database.type == "mysql") "mysql.service"
+      ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+      wants =
+        lib.optional (cfg.database.type == "mysql") "mysql.service"
+        ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+
+      environment = {
+        RDECK_BASE = cfg.dataDir;
+        RUNDECK_CONFIG_DIR = cfg.configDir;
+        JAVA_OPTS = lib.concatStringsSep " " cfg.javaOpts;
+      };
+
+      path = [ pkgs.replace-secret ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = rundeckStartScript;
+        WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = "rundeck";
+        RuntimeDirectoryMode = "0750";
+        UMask = "0027";
+
+        LimitNOFILE = 65536;
+        ReadWritePaths = [
+          cfg.dataDir
+          cfg.configDir
+        ];
+        RestartSec = "10s";
+        Restart = "always";
+        TimeoutStartSec = "${toString cfg.startTimeout}s";
+
+        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" ];
+        AmbientCapabilities = [ "CAP_SYS_ADMIN" ];
+
+        LimitCORE = 0;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+
+      preStart = ''
+        ${lib.optionalString (cfg.serverUUID == "") ''
+          # Generate UUID
+          UUID_FILE="${cfg.dataDir}/.uuid"
+          if [ ! -f "$UUID_FILE" ]; then
+            umask 0137
+            ${lib.getExe' pkgs.util-linux "uuidgen"} > "$UUID_FILE"
+          fi
+        ''}
+
+
+        install -m 0640 ${configFile} ${cfg.configDir}/rundeck-config.properties
+        install -m 0640 ${frameworkFile} ${cfg.configDir}/framework.properties
+        install -m 0600 ${realmFile} ${cfg.configDir}/realm.properties
+
+        ${replaceSecret "@ADMIN_PASSWORD@" cfg.adminPasswordFile "${cfg.configDir}/realm.properties"}
+
+        ${lib.optionalString (cfg.database.passwordFile != null) (
+          replaceSecret "@DB_PASSWORD@" cfg.database.passwordFile "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString cfg.ssl.enable (
+          replaceSecret "@KEYSTORE_PASSWORD@" cfg.ssl.keyStorePasswordFile
+            "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString (cfg.serverUUID == "") (
+          replaceSecret "@SERVER_UUID@" "${cfg.dataDir}/.uuid" "${cfg.configDir}/framework.properties"
+        )}
+
+        if [ -f ${cfg.dataDir}/etc/framework.properties ]; then
+          install -m 0640 ${cfg.configDir}/framework.properties ${cfg.dataDir}/etc/framework.properties
+        fi
+
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (
+            name: content:
+            "install -m 0640 ${pkgs.writeText "rundeck-${name}" content} ${cfg.dataDir}/etc/${name}"
+          ) cfg.aclPolicies
+        )}
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+      (if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort)
+    ];
+  };
+}

nixos/tests/actual.nix

@@ -3,13 +3,13 @@
   name = "actual";
   meta.maintainers = [ lib.maintainers.oddlama ];
 
-  nodes.machine =
+  containers.machine =
     { ... }:
     {
       services.actual.enable = true;
     };
 
-  nodes.machine2 =
+  containers.machine2 =
     { ... }:
     {
       services.actual = {

nixos/tests/all-tests.nix

@@ -802,7 +802,7 @@ in
     systemdStage1 = true;
   };
   hister = runTest ./hister.nix;
-  hitch = handleTest ./hitch { };
+  hitch = runTest ./hitch;
   hledger-web = runTest ./hledger-web.nix;
   hockeypuck = runTest ./hockeypuck.nix;
   holo-daemon-modular-service = runTest ./holo-daemon-modular.nix;
@@ -912,8 +912,14 @@ in
   keter = runTest ./keter.nix;
   kexec = runTest ./kexec.nix;
   keycloak = discoverTests (import ./keycloak.nix);
-  keyd = handleTest ./keyd.nix { };
-  keymap = handleTest ./keymap.nix { };
+  keyd = import ./keyd.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
+  keymap = import ./keymap.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   kimai = runTest ./kimai.nix;
   kismet = runTest ./kismet.nix;
   kiwix-serve = runTest ./kiwix-serve;
@@ -1007,7 +1013,7 @@ in
   lomiri-mediaplayer-app = runTest ./lomiri-mediaplayer-app.nix;
   lomiri-music-app = runTest ./lomiri-music-app.nix;
   lomiri-system-settings = runTest ./lomiri-system-settings.nix;
-  lorri = handleTest ./lorri/default.nix { };
+  lorri = runTest ./lorri/default.nix;
   luks = runTest ./luks.nix;
   luks-suspend = runTest ./luks-suspend.nix;
   lvm2 = import ./lvm2 { inherit pkgs runTest; };
@@ -1156,6 +1162,7 @@ in
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
   netbox_4_5 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_5; };
+  netbox_4_6 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_6; };
   netdata = runTest ./netdata.nix;
   netfoil = runTest ./netfoil.nix;
   netplan = runTest ./netplan.nix;
@@ -1553,6 +1560,7 @@ in
   rsyslogd = handleTest ./rsyslogd.nix { };
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
+  rundeck = runTest ./rundeck.nix;
   rush = runTest ./rush.nix;
   rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
@@ -1787,7 +1795,7 @@ in
   terminal-emulators = handleTest ./terminal-emulators.nix { };
   test-containers-bittorrent = runTest ./test-containers-bittorrent.nix;
   thanos = runTest ./thanos.nix;
-  thelounge = handleTest ./thelounge.nix { };
+  thelounge = runTest ./thelounge.nix;
   tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
@@ -1918,7 +1926,10 @@ in
     inherit pkgs runTest;
     inherit (pkgs) lib;
   };
-  wine = handleTest ./wine.nix { };
+  wine = import ./wine.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   wireguard = import ./wireguard {
     inherit pkgs runTest;
     inherit (pkgs) lib;

nixos/tests/blocky.nix

@@ -1,7 +1,7 @@
 {
   name = "blocky";
 
-  nodes = {
+  containers = {
     server =
       { pkgs, ... }:
       {

nixos/tests/cloudlog.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 {
   name = "cloudlog";
-  nodes = {
+  containers = {
     machine = {
       services.mysql.package = pkgs.mariadb;
       services.cloudlog.enable = true;

nixos/tests/hitch/default.nix

@@ -1,36 +1,34 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "hitch";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jflanglois ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.curl ];
-        services.hitch = {
-          enable = true;
-          backend = "[127.0.0.1]:80";
-          pem-files = [
-            ./example.pem
-          ];
-        };
-
-        services.httpd = {
-          enable = true;
-          virtualHosts.localhost.documentRoot = ./example;
-          adminAddr = "noone@testing.nowhere";
-        };
+{ pkgs, ... }:
+{
+  name = "hitch";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jflanglois ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.hitch = {
+        enable = true;
+        backend = "[127.0.0.1]:80";
+        pem-files = [
+          ./example.pem
+        ];
       };
 
-    testScript = ''
-      start_all()
+      services.httpd = {
+        enable = true;
+        virtualHosts.localhost.documentRoot = ./example;
+        adminAddr = "noone@testing.nowhere";
+      };
+    };
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("hitch.service")
-      machine.wait_for_open_port(443)
-      assert "We are all good!" in machine.succeed("curl -fk https://localhost:443/index.txt")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("hitch.service")
+    machine.wait_for_open_port(443)
+    assert "We are all good!" in machine.succeed("curl -fk https://localhost:443/index.txt")
+  '';
+}

nixos/tests/keyd.nix

@@ -1,12 +1,10 @@
 # The test template is taken from the `./keymap.nix`
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
   readyFile = "/tmp/readerReady";
   resultFile = "/tmp/readerResult";
@@ -29,8 +27,8 @@ let
   mkKeyboardTest =
     name:
     { default, test }:
-    with pkgs.lib;
-    makeTest {
+
+    runTest {
       inherit name;
 
       nodes.machine = {
@@ -72,7 +70,7 @@ let
     };
 
 in
-pkgs.lib.mapAttrs mkKeyboardTest {
+lib.mapAttrs mkKeyboardTest {
   swap-ab_and_ctrl-as-shift = {
     test.press = [
       "a"

nixos/tests/keymap.nix

@@ -1,11 +1,9 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
   readyFile = "/tmp/readerReady";
   resultFile = "/tmp/readerResult";
@@ -32,8 +30,8 @@ let
       extraConfig ? { },
       tests,
     }:
-    with pkgs.lib;
-    makeTest {
+    with lib;
+    runTest {
       name = "keymap-${layout}";
 
       nodes.machine.console.keyMap = mkOverride 900 layout;
@@ -105,7 +103,7 @@ let
     };
 
 in
-pkgs.lib.mapAttrs mkKeyboardTest {
+lib.mapAttrs mkKeyboardTest {
   azerty = {
     tests = {
       azqw.qwerty = [

nixos/tests/lorri/default.nix

@@ -1,4 +1,4 @@
-import ../make-test-python.nix {
+{
   name = "lorri";
 
   nodes.machine =

nixos/tests/rundeck.nix

@@ -0,0 +1,111 @@
+{
+  name = "rundeck";
+
+  nodes = {
+    rundeck =
+      { pkgs, ... }:
+      {
+        environment.etc."rundeck-admin-password" = {
+          text = "testpassword";
+          mode = "0400";
+          user = "rundeck";
+          group = "rundeck";
+        };
+
+        services.rundeck = {
+          enable = true;
+          serverHostname = "rundeck";
+          adminUser = "testadmin";
+          adminPasswordFile = "/etc/rundeck-admin-password";
+          serverPort = 4441;
+          database.type = "h2";
+          openFirewall = true;
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          jq
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    def login_and_verify_api(machine, host, port, user, password, timeout=300):
+        """Authenticate via Rundeck form login and verify API access."""
+        machine.wait_until_succeeds(
+            f"curl -s -c /tmp/cookies -L"
+            f" -d 'j_username={user}&j_password={password}'"
+            f" http://{host}:{port}/j_security_check -o /dev/null"
+            f" && curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            f" http://{host}:{port}/api/26/system/info"
+            f" | jq -e '.system.rundeck.version'",
+            timeout=timeout,
+        )
+
+    def properties(machine, path):
+        return machine.succeed(f"cat {path}").replace("\\", "").replace(" = ", "=")
+
+    with subtest("Rundeck starts and serves homepage"):
+        rundeck.wait_for_unit("rundeck.service")
+        rundeck.wait_for_open_port(4441)
+        rundeck.wait_until_succeeds(
+            "curl -sL http://rundeck:4441 | grep -qi Rundeck"
+        )
+
+    with subtest("Regression - port is included in generated URLs"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "grails.serverURL=http://rundeck:4441" in config, config
+        assert "server.port=4441" in config, config
+        assert "framework.server.url=http://rundeck:4441" in framework, framework
+
+    with subtest("Structural settings end up in the generated config"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+
+        assert "dataSource.driverClassName=org.h2.Driver" in config, config
+        assert "dataSource.dialect=org.hibernate.dialect.H2Dialect" in config, config
+
+    with subtest("Server UUID is generated and substituted"):
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "@SERVER_UUID@" not in framework, framework
+        rundeck.succeed(
+            "grep -qE '^rundeck\\.server\\.uuid = [0-9a-f-]{36}$'"
+            " /etc/rundeck/framework.properties"
+        )
+
+    with subtest("Secrets are substituted and not world-readable"):
+        rundeck.succeed(
+            "grep -qxF 'testadmin:testpassword,user,admin'"
+            " /etc/rundeck/realm.properties"
+        )
+        rundeck.fail("grep -q '@ADMIN_PASSWORD@' /etc/rundeck/realm.properties")
+        rundeck.succeed(
+            "[ \"$(stat -c %a /etc/rundeck/realm.properties)\" = 600 ]"
+        )
+        rundeck.succeed(
+            "[ \"$(stat -c %U /etc/rundeck/realm.properties)\" = rundeck ]"
+        )
+
+    with subtest("API authentication via form login"):
+        login_and_verify_api(rundeck, "rundeck", 4441, "testadmin", "testpassword")
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -X POST"
+            " -H 'Accept: application/json'"
+            " -H 'Content-Type: application/json'"
+            " -d '{\"name\":\"test-project\",\"config\":{}}'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e '.name == \"test-project\"'"
+        )
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e 'any(.[]; .name == \"test-project\")'"
+        )
+  '';
+}

nixos/tests/scion/freestanding-deployment/default.nix

@@ -122,7 +122,7 @@ in
           ret=0
           for as in "$@"
           do
-            scion ping "$as,127.0.0.1" -c 3
+            scion ping --sciond default "$as,127.0.0.1" -c 3
             ret=$?
             if [ "$ret" -ne "0" ]; then
               break

nixos/tests/scion/freestanding-deployment/topology1.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.1:50014",
+            "local": "192.168.1.1:50014",
             "remote": "192.168.1.4:50014"
           },
           "isd_as": "42-ffaa:1:4",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.1:50012",
+            "local": "192.168.1.1:50012",
             "remote": "192.168.1.2:50012"
           },
           "isd_as": "42-ffaa:1:2",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.1:50013",
+            "local": "192.168.1.1:50013",
             "remote": "192.168.1.3:50013"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/scion/freestanding-deployment/topology2.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.2:50012",
+            "local": "192.168.1.2:50012",
             "remote": "192.168.1.1:50012"
           },
           "isd_as": "42-ffaa:1:1",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.2:50023",
+            "local": "192.168.1.2:50023",
             "remote": "192.168.1.3:50023"
           },
           "isd_as": "42-ffaa:1:3",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.2:50025",
+            "local": "192.168.1.2:50025",
             "remote": "192.168.1.5:50025"
           },
           "isd_as": "42-ffaa:1:5",

nixos/tests/scion/freestanding-deployment/topology3.json

@@ -21,7 +21,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.3:50013",
+            "local": "192.168.1.3:50013",
             "remote": "192.168.1.1:50013"
           },
           "isd_as": "42-ffaa:1:1",
@@ -30,7 +30,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.3:50023",
+            "local": "192.168.1.3:50023",
             "remote": "192.168.1.2:50023"
           },
           "isd_as": "42-ffaa:1:2",
@@ -39,7 +39,7 @@
         },
         "3": {
           "underlay": {
-            "public": "192.168.1.3:50034",
+            "local": "192.168.1.3:50034",
             "remote": "192.168.1.4:50034"
           },
           "isd_as": "42-ffaa:1:4",
@@ -48,7 +48,7 @@
         },
         "4": {
           "underlay": {
-            "public": "192.168.1.3:50035",
+            "local": "192.168.1.3:50035",
             "remote": "192.168.1.5:50035"
           },
           "isd_as": "42-ffaa:1:5",

nixos/tests/scion/freestanding-deployment/topology4.json

@@ -19,7 +19,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.4:50014",
+            "local": "192.168.1.4:50014",
             "remote": "192.168.1.1:50014"
           },
           "isd_as": "42-ffaa:1:1",
@@ -28,7 +28,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.4:50034",
+            "local": "192.168.1.4:50034",
             "remote": "192.168.1.3:50034"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/scion/freestanding-deployment/topology5.json

@@ -19,7 +19,7 @@
       "interfaces": {
         "1": {
           "underlay": {
-            "public": "192.168.1.5:50025",
+            "local": "192.168.1.5:50025",
             "remote": "192.168.1.2:50025"
           },
           "isd_as": "42-ffaa:1:2",
@@ -28,7 +28,7 @@
         },
         "2": {
           "underlay": {
-            "public": "192.168.1.5:50035",
+            "local": "192.168.1.5:50035",
             "remote": "192.168.1.3:50035"
           },
           "isd_as": "42-ffaa:1:3",

nixos/tests/systemd-coredump.nix

@@ -4,15 +4,6 @@ let
 
   crasher = pkgs.writeCBin "crasher" "int main;";
 
-  commonConfig = {
-    systemd.services.crasher.serviceConfig = {
-      ExecStart = "${crasher}/bin/crasher";
-      StateDirectory = "crasher";
-      WorkingDirectory = "%S/crasher";
-      Restart = "no";
-    };
-  };
-
 in
 
 {
@@ -21,40 +12,33 @@ in
     maintainers = [ ];
   };
 
-  nodes.machine1 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.settings.Coredump = {
+  nodes.machine = {
+    systemd = {
+      services.crasher.serviceConfig = {
+        ExecStart = "${crasher}/bin/crasher";
+        StateDirectory = "crasher";
+        WorkingDirectory = "%S/crasher";
+        Restart = "no";
+      };
+
+      coredump.settings.Coredump = {
         Storage = "journal";
         ProcessSizeMax = "0";
       };
     };
-  nodes.machine2 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.enable = false;
-      systemd.package = pkgs.systemd.override {
-        withCoredump = false;
-      };
-    };
+  };
 
   testScript = ''
     with subtest("systemd-coredump enabled"):
-      machine1.wait_for_unit("multi-user.target")
-      machine1.wait_for_unit("systemd-coredump.socket")
-      machine1.systemctl("start crasher");
-      machine1.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
-      machine1.fail("stat /var/lib/crasher/core*")
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("systemd-coredump.socket")
+      machine.systemctl("start crasher");
+      machine.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
+      machine.fail("stat /var/lib/crasher/core*")
 
     with subtest("settings.Coredump renders coredump.conf"):
-      machine1.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
-
-    with subtest("systemd-coredump disabled"):
-      machine2.systemctl("start crasher");
-      machine2.wait_until_succeeds("stat /var/lib/crasher/core*", timeout=10)
+      machine.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
   '';
 }

nixos/tests/thelounge.nix

@@ -1,4 +1,4 @@
-import ./make-test-python.nix {
+{
   name = "thelounge";
 
   nodes = {

nixos/tests/web-apps/netbox-upgrade.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_4";
-  newNetbox = "netbox_4_5";
+  oldNetbox = "netbox_4_5";
+  newNetbox = "netbox_4_6";
 
   apiVersion =
     version:

nixos/tests/wine.nix

@@ -1,28 +1,25 @@
 {
-  system ? builtins.currentSystem,
-  pkgs ? import ../.. {
-    inherit system;
-    config = { };
-  },
+  pkgs,
+  lib,
+  runTest,
 }:
 
 let
-  inherit (pkgs.lib)
+  inherit (lib)
     concatMapStrings
     listToAttrs
     optionals
     optionalString
     ;
-  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
 
   hello32 = "${pkgs.pkgsCross.mingw32.hello}/bin/hello.exe";
   hello64 = "${pkgs.pkgsCross.mingwW64.hello}/bin/hello.exe";
 
   makeWineTest = packageSet: exes: variant: rec {
     name = "${packageSet}-${variant}";
-    value = makeTest {
+    value = runTest {
       inherit name;
-      meta = with pkgs.lib.maintainers; {
+      meta = with lib.maintainers; {
         maintainers = [ chkno ];
       };
 
@@ -74,6 +71,6 @@ listToAttrs (
       ])
       # This wayland combination times out after spending many hours.
       # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
-      (pkgs.lib.remove "wayland" variants)
+      (lib.remove "wayland" variants)
   )
 )

pkgs/applications/editors/emacs/sources.nix

@@ -107,10 +107,10 @@ in
 {
   emacs31 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "31.1-rc1";
+    version = "31.1";
     variant = "mainline";
-    rev = "emacs-31.1-rc1";
-    hash = "sha256-ZNCYFfMA2f14p57g/LdG6YK7nwUio8fdXmllkChMOSc=";
+    rev = "emacs-31.1";
+    hash = "sha256-lFT5Vt49G17t/fRm5yppO5p9ui10I9JNJVaGO1GPZFI=";
   });
 
   emacs30 = import ./make-emacs.nix (mkArgs {

pkgs/applications/editors/vim/plugins/generated.nix

@@ -262,20 +262,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  link-vim = buildVimPlugin {
-    pname = "link.vim";
-    version = "2.0.3";
-    src = fetchFromGitHub {
-      owner = "qadzek";
-      repo = "link.vim";
-      tag = "v2.0.3";
-      hash = "sha256-YjKFDv9QyuWDfWiKP6EvjSRbkz/K6e/Neq76ckghKh0=";
-    };
-    meta.homepage = "https://github.com/qadzek/link.vim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   LuaSnip-snippets-nvim = buildVimPlugin {
     pname = "LuaSnip-snippets.nvim";
     version = "0-unstable-2022-03-17";
@@ -475,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-20";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "cef8d093b63c9be7e8b49f7dc341e8447fc4c300";
-      hash = "sha256-yNlPcjlfjt+RxK/XVuVLbuKgZF++X/mKSfuV03dXT8c=";
+      rev = "73e89eb3e536a4dd8f991c963bd37189520c9919";
+      hash = "sha256-64QPVE298/XHx+UZeuvh5GndxiLgzWn1WfLJLBeZJKQ=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -897,12 +883,12 @@ final: prev: {
 
   ale = buildVimPlugin {
     pname = "ale";
-    version = "4.0.0-unstable-2026-08-19";
+    version = "4.0.0-unstable-2026-08-21";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "1c6e71732f3811197ec21cd6d3130791955ca80a";
-      hash = "sha256-Zqd7QD/rGV2GZNjyK05Zj2nVBYdHvAXo7ooE4yA/FnI=";
+      rev = "e1789bc54483d76ac9ddb40b633d1645c8281914";
+      hash = "sha256-aW0Gs10xe0sKptS7tPee/n9RoZRfrnZQKYd5X+MfEEk=";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
     meta.license = getLicenseFromSpdxId "BSD-2-Clause";
@@ -1093,12 +1079,12 @@ final: prev: {
 
   astrocore = buildVimPlugin {
     pname = "astrocore";
-    version = "3.0.8";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "AstroNvim";
       repo = "astrocore";
-      tag = "v3.0.8";
-      hash = "sha256-xpO2fcUuzZneBMLfykQpyknWU3pE7mrEZBZtGX+/QTw=";
+      tag = "v3.1.0";
+      hash = "sha256-ALLA4JVCfn1VS24uZEVkSN3wTW3df3RlmSQLbpn+pPk=";
     };
     meta.homepage = "https://github.com/AstroNvim/astrocore/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -2129,12 +2115,12 @@ final: prev: {
 
   bluloco-nvim = buildVimPlugin {
     pname = "bluloco.nvim";
-    version = "1.4.0-unstable-2026-08-19";
+    version = "1.4.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "uloco";
       repo = "bluloco.nvim";
-      rev = "424f5ea3c5f92423cbb8e32941e86919005fb4ab";
-      hash = "sha256-HHqLxD+aKIaCh5fFRfT4SlCrO48jhe1YVnXwQfoizqs=";
+      rev = "8973f4b595a96ceb45b3885d533f287182a73c20";
+      hash = "sha256-nBZCvS9LU/09cs8u92a+FBhMaMuG2LGldGxO+IfFMHo=";
     };
     meta.homepage = "https://github.com/uloco/bluloco.nvim/";
     meta.license = getLicenseFromSpdxId "LGPL-3.0-only";
@@ -3513,15 +3499,15 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-08-19";
+    version = "0.0.82-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "d7cf12d0dc873fcd276e89dff4e7c4949e3e5793";
-      hash = "sha256-X3baNWAjKwHusfDwRHbQSs7PUspVDVnA/DC0SsNr6KQ=";
+      rev = "95073dab304d4c35fd468c0eb57f4bfe25bf8eda";
+      hash = "sha256-9Z55Npuz64nUJoPXLH+FAD3litfXq8+Oahvd7GT9hus=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
-    meta.license = unfree;
+    meta.license = getLicenseFromSpdxId "MIT";
     meta.hydraPlatforms = [ ];
   };
 
@@ -4228,12 +4214,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-08-10";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "46c9880110511bcfe8598d368de07b8c488d1d19";
-      hash = "sha256-WW+oWMaXiY85GBOOnQV2rhikGNOa1NsqPjIkx3pqpRQ=";
+      rev = "f8ca1cde7fd7027a3ad5609295fc61931e987ea5";
+      hash = "sha256-CfBmu8Q8x6iW1kliLId45kps/RjxNnCeNigGIMW60Z4=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -5490,12 +5476,12 @@ final: prev: {
 
   easy-dotnet-nvim = buildVimPlugin {
     pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-08-18";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "GustavEikaas";
       repo = "easy-dotnet.nvim";
-      rev = "0a8cfb96e40b985921e6613f31f75811e31b8edf";
-      hash = "sha256-8KjAdKYAXQHrJ2ISBv0Eu4hl696fiz09c8yCtNPr2OY=";
+      rev = "7765221c078267bad975fdca307776ecc01c69cc";
+      hash = "sha256-x/NXqklLsCZraLzj6gUCTMPx54VWmEgPYIr5XfntAcE=";
     };
     meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6052,12 +6038,12 @@ final: prev: {
 
   flash-nvim = buildVimPlugin {
     pname = "flash.nvim";
-    version = "2.1.0-unstable-2026-07-10";
+    version = "2.1.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "flash.nvim";
-      rev = "b6346946d10d07998efee029fb0f7a593806d0cd";
-      hash = "sha256-1v2+iq4/TnJq37iiGedIKFf6PxlTHQac8RXECZ2HYdM=";
+      rev = "5f0f270fdc7c5b0c21d903ee85b9cb06f2ac636a";
+      hash = "sha256-88DoXkz8M6ehkzS9VNu2/T0FENpduTbgiUZd+GeVVX4=";
     };
     meta.homepage = "https://github.com/folke/flash.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -6347,12 +6333,12 @@ final: prev: {
 
   fugitive-gitlab-vim = buildVimPlugin {
     pname = "fugitive-gitlab.vim";
-    version = "0-unstable-2024-11-13";
+    version = "0-unstable-2026-08-20";
     src = fetchFromGitHub {
       owner = "shumphrey";
       repo = "fugitive-gitlab.vim";
-      rev = "3584cf7e607ba7822f991d407a8d780e05aae287";
-      hash = "sha256-bjKPh7EwA6wtp0lilaUA7f5b1VarR9QWFBuJm1j8Qfo=";
+      rev = "effc1fcb81803aa9c1322b089c7f7a2b53cf3dcc";
+      hash = "sha256-S+9xAHtlOlye/RgiLOPL5yNtyNJvwtkY2ihvdfVTmF4=";
     };
     meta.homepage = "https://github.com/shumphrey/fugitive-gitlab.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8643,12 +8629,12 @@ final: prev: {
 
   lazy-lsp-nvim = buildVimPlugin {
     pname = "lazy-lsp.nvim";
-    version = "2025.12.19-unstable-2026-03-12";
+    version = "2026.08.22";
     src = fetchFromGitHub {
       owner = "dundalek";
       repo = "lazy-lsp.nvim";
-      rev = "e2599ac3d2ee3b0c38d11edf1c01ce7e846f0079";
-      hash = "sha256-70roDFHMY2MB2d7wPrPbWdLqhr8r8TMkYTpaGI/GRRU=";
+      tag = "2026.08.22";
+      hash = "sha256-ZycJy86HJNLSAax2hSKvddbLvsOLL40a0NVZ+s2pQUM=";
     };
     meta.homepage = "https://github.com/dundalek/lazy-lsp.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8769,11 +8755,11 @@ final: prev: {
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-21";
     src = fetchgit {
       url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "e51ba2a70169bb6fd58342312ccde591242ac739";
-      hash = "sha256-0gF993CXulPD5LQhgV6VeDI8ToNkTl/SlXucFkUE6Vk=";
+      rev = "7884f9455e5bf07bd11a3dcd9f961095a966a5d7";
+      hash = "sha256-SwzjzwlGmFyV+iHprqrpbnLWVxgA8w5a8uJvbSu00d0=";
     };
     meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
     meta.license = unfree;
@@ -9060,6 +9046,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  link-vim = buildVimPlugin {
+    pname = "link.vim";
+    version = "2.0.3";
+    src = fetchFromGitHub {
+      owner = "qadzek";
+      repo = "link.vim";
+      tag = "v2.0.3";
+      hash = "sha256-YjKFDv9QyuWDfWiKP6EvjSRbkz/K6e/Neq76ckghKh0=";
+    };
+    meta.homepage = "https://github.com/qadzek/link.vim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   lir-nvim = buildVimPlugin {
     pname = "lir.nvim";
     version = "0-unstable-2026-03-29";
@@ -9202,12 +9202,12 @@ final: prev: {
 
   llama-vim = buildVimPlugin {
     pname = "llama.vim";
-    version = "0-unstable-2026-08-18";
+    version = "0.1.0";
     src = fetchFromGitHub {
       owner = "ggml-org";
       repo = "llama.vim";
-      rev = "93f8106ed7657859d7eefebdb210edad515e9463";
-      hash = "sha256-qv8E4Y8UkyQxdGFciLuPE0JQB3G42dI80n7P/ATY2lU=";
+      tag = "v0.1.0";
+      hash = "sha256-3g0Q4GZU1w5mHR6jQyx8kZyZ7aGclkB8giHZcIwIaY8=";
     };
     meta.homepage = "https://github.com/ggml-org/llama.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11190,12 +11190,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-08-14";
+    version = "1.4.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "8560c245f6a5bc7bb229c00d9d0627d02ef9b4e8";
-      hash = "sha256-ZYBigA6XdpPg3P9JhVgwsn9LaA05sGC7fJebrQDQv8k=";
+      rev = "93dc1293afc97c03ff7fecef654ba6d13e7e9f7e";
+      hash = "sha256-ixpdG8kxUOELP00mBTsXmpz6P6vXBpBXBDUNgW3+Qj0=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11274,12 +11274,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-27";
+    version = "3.0.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "37e0f22a2345bad1bffe01b31970885882f46275";
-      hash = "sha256-oyGGEbBCGr9mYeaG7siHl/Zz2HOBEKEkhQuwmJ2eA3o=";
+      rev = "5adc81b26232954cd7a90f158aa7844c18fc3165";
+      hash = "sha256-s0yrtTweFrrUsxVjLjr+1uNHTlhcxGI7JUvOkrpt13g=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12494,12 +12494,12 @@ final: prev: {
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "0.10.0-unstable-2026-05-08";
+    version = "0.10.0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "7b9923abad60b903ece7c52940e1321d39eccc79";
-      hash = "sha256-klOJgBPw8oGDnF9wKIpGDzuBY+tH1acRyvZSPR4wrjw=";
+      rev = "430522f95fe4fb7c511ec64f8c1a90cc6a66c05c";
+      hash = "sha256-WSSuk2lmBefKTseLDa/AwBUPEsjYsG41SYepPZw/rpM=";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13273,11 +13273,11 @@ final: prev: {
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "05-unstable-2026-08-17";
+    version = "05-unstable-2026-08-20";
     src = fetchgit {
       url = "https://codeberg.org/mfussenegger/nvim-lint/";
-      rev = "5b5b794458b5ff0b17d26c9d7400faaebd00b32d";
-      hash = "sha256-r143wOn0EK28H2uH6rCFnPVy0h8okUbhsNv0o/xsqZ8=";
+      rev = "0370fe965697aa8f04252a1562441bdc13723cd1";
+      hash = "sha256-MhQOZe4/FxcZUudadSRl7tfyxE8lazUq7RekhJT28rE=";
     };
     meta.homepage = "https://codeberg.org/mfussenegger/nvim-lint/";
     meta.license = unfree;
@@ -13916,12 +13916,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-08-15";
+    version = "0.10.0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "074aa4422bf029908338e855d0c0f71470a971bb";
-      hash = "sha256-gfysRZAwKXSLZpO8AhO1o3O93OwnzJTTbXhhdbbOJ7M=";
+      rev = "8b98b4470eb326f1c7b50dae79f8c963568e5720";
+      hash = "sha256-u+ESawp6hRUPYmgY+VVW3KpxhymC0Cy9ehgamRGXWSo=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14378,12 +14378,12 @@ final: prev: {
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "0-unstable-2026-07-30";
+    version = "0-unstable-2026-08-24";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "205f024d3ea4a3d81aac751b6bf8e2d01e0c204f";
-      hash = "sha256-p5s9JhujDEZezYYsNygi9ejI4qlxluRO3jYWFdJkSrw=";
+      rev = "37a416818c61bd2d150498e2f601744e5329e2eb";
+      hash = "sha256-gkb8jaSkxR7GumWtkD78zx9vtHPSgieoIUhDQgqTb1o=";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14630,12 +14630,12 @@ final: prev: {
 
   opencode-nvim = buildVimPlugin {
     pname = "opencode.nvim";
-    version = "0.14.0";
+    version = "1.0.0";
     src = fetchFromGitHub {
       owner = "nickjvandyke";
       repo = "opencode.nvim";
-      tag = "v0.14.0";
-      hash = "sha256-bAF3ssHly41AxqKEHFrsK9S1mTbrIZfEI3kzZ6alKXc=";
+      tag = "v1.0.0";
+      hash = "sha256-Au8vW7ISTH0jMxzgkRN3pFmLm4fMd9l27tBs1QH3v5c=";
     };
     meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15318,12 +15318,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.0.1-1";
+    version = "6.0.2-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.0.1-1";
-      hash = "sha256-j6N2M6YUjnqrhQt8F/AoGb/cDUa5TQc/EV5xX5hGyic=";
+      tag = "v6.0.2-1";
+      hash = "sha256-LE66wEabvJuvCSy0FlWg0LE/5YDq2TaJpNIRVrU4NKE=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15977,11 +15977,11 @@ final: prev: {
 
   run-nvim = buildVimPlugin {
     pname = "run.nvim";
-    version = "2.0.0";
+    version = "2.01";
     src = fetchgit {
       url = "https://codeberg.org/ssnoer/run.nvim";
-      tag = "v2.0.0";
-      hash = "sha256-MTxhhcD6lHLJCfwaivKF9reeUrMog/8I2kJarNWz5Kk=";
+      tag = "v2.01";
+      hash = "sha256-/3ouvPsPoGhsotAP+l0r0AacA1KmC11Z3Ch4C3XdQNg=";
     };
     meta.homepage = "https://codeberg.org/ssnoer/run.nvim";
     meta.license = unfree;
@@ -16158,12 +16158,12 @@ final: prev: {
 
   scretch-nvim = buildVimPlugin {
     pname = "scretch.nvim";
-    version = "1.2.4";
+    version = "1.2.5";
     src = fetchFromGitHub {
       owner = "0xJohnnyboy";
       repo = "scretch.nvim";
-      tag = "v1.2.4";
-      hash = "sha256-FCv6EI/aYV/RDSeLGPSCkrAbNMfbTWVCIrmX+7tV+AE=";
+      tag = "v1.2.5";
+      hash = "sha256-Gz5jW8K3Ysjm3yzadyKkFusyRvGVMIMXxWsiXDCGMs8=";
     };
     meta.homepage = "https://github.com/0xJohnnyboy/scretch.nvim/";
     meta.license = getLicenseFromSpdxId "AGPL-3.0-only";
@@ -16439,12 +16439,12 @@ final: prev: {
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2.1.0-unstable-2026-08-14";
+    version = "2.1.0-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "289971cfdbc7f7b1c91670a228b239d870130af7";
-      hash = "sha256-o7CFObuVo1O39v66wRRc7Kn8E1Hu51d59nkQBGAbmks=";
+      rev = "5e92431aa7f5e618c2f6825f682df6d94f6e0a02";
+      hash = "sha256-BoFfH4a5I8XnC8OIrXP+y6cp9+N+iPY9PbpcUk4VzQg=";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16579,12 +16579,12 @@ final: prev: {
 
   solarized-osaka-nvim = buildVimPlugin {
     pname = "solarized-osaka.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-24";
     src = fetchFromGitHub {
       owner = "craftzdog";
       repo = "solarized-osaka.nvim";
-      rev = "7be007658c1ba2ce303c004613e09af16efb5157";
-      hash = "sha256-+q15fTk3B5bVkHCc6uTvnAVzoM+Zo27OrFQ7QVuqzn4=";
+      rev = "476f0e7725598b752a673d7d6a6e9776bde4f6fe";
+      hash = "sha256-bdxQqayM8uhr9v1jJmjAEnC6NW8wrjNfwl71gLU4CCg=";
     };
     meta.homepage = "https://github.com/craftzdog/solarized-osaka.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -21012,12 +21012,12 @@ final: prev: {
 
   vim-floaterm = buildVimPlugin {
     pname = "vim-floaterm";
-    version = "0-unstable-2026-05-07";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "bb4ba7952e906408e1f83b215f55ffe57efcade6";
-      hash = "sha256-JEd8XR1LsY7Xb32dx+TSa961sxSfF+OHewBxiCSFRYs=";
+      rev = "0e8e95f7be74b900bc7d3bc54d9b65211b264ace";
+      hash = "sha256-1aITnfEL8Ea8E5/QNqrGrQJbMJD3kGyiIsI+/zbgbo8=";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21320,12 +21320,12 @@ final: prev: {
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "1.29-unstable-2026-07-24";
+    version = "1.29-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "bd1fcfeb79908001ff2a6f4b382a5a55da5ce11e";
-      hash = "sha256-teM/RaFh80SX9SVvefIeIr+SQ33qJe718xAfnmQWjbg=";
+      rev = "47694979496d4bf2e90ce75d95f1dec3f41cbefb";
+      hash = "sha256-AYeQpADkdGbTNGhzmxquttD+s15yHENVUKfNKgzX1vM=";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
     meta.license = unfree;
@@ -21362,11 +21362,11 @@ final: prev: {
 
   vim-graphql = buildVimPlugin {
     pname = "vim-graphql";
-    version = "1.6-unstable-2026-07-25";
+    version = "1.6-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "jparise";
       repo = "vim-graphql";
-      rev = "642c9931d6a4634f9cf9a1a91f450dc1a52a9d68";
+      rev = "ebea1e6bc93e85aa71848112b8a42f95468ac566";
       hash = "sha256-hN+YE6PQnApdK5dKERJBVpKepicYIgsfY5mpZiiOcfE=";
     };
     meta.homepage = "https://github.com/jparise/vim-graphql/";
@@ -22876,12 +22876,12 @@ final: prev: {
 
   vim-nixhash = buildVimPlugin {
     pname = "vim-nixhash";
-    version = "0-unstable-2026-08-16";
+    version = "0-unstable-2026-08-21";
     src = fetchFromGitHub {
       owner = "symphorien";
       repo = "vim-nixhash";
-      rev = "dd7b80f326b3a6b48d591dafdcf2648a6e279ad4";
-      hash = "sha256-9dJJ/zVIDtWdWOaRvx2wYm/nDnPpxyFtnAVSEteBMgs=";
+      rev = "16838857bb236051f02642e7cd999cbeebb9113d";
+      hash = "sha256-5gSHIvJ9mWs28HAmd6jSvpusonFaJ/Rb3PRBz/T0Ja4=";
     };
     meta.homepage = "https://github.com/symphorien/vim-nixhash/";
     meta.license = unfree;
@@ -26223,12 +26223,12 @@ final: prev: {
 
   zen-nvim = buildVimPlugin {
     pname = "zen.nvim";
-    version = "0-unstable-2026-07-18";
+    version = "0-unstable-2026-08-23";
     src = fetchFromGitHub {
       owner = "sand4rt";
       repo = "zen.nvim";
-      rev = "cc7306e9ea479b19e8ef4c5fba35b4efd4b66692";
-      hash = "sha256-ZFuhNDVmUU7A02w/rzDn8uze7ivHVu2GI3+6PyIxAgE=";
+      rev = "9ae3ce3cac4cf88b4369a8ec789aa755882f5cc9";
+      hash = "sha256-jJCtzZ4J4SsVMUK7wuVdh8fLbCKTzJQgEN2K/gGHqkY=";
     };
     meta.homepage = "https://github.com/sand4rt/zen.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26320,12 +26320,12 @@ final: prev: {
 
   zotcite = buildVimPlugin {
     pname = "zotcite";
-    version = "0.7-unstable-2026-08-19";
+    version = "0.7-unstable-2026-08-22";
     src = fetchFromGitHub {
       owner = "jalvesaq";
       repo = "zotcite";
-      rev = "b8b96a33dac53b8e9ed3a0a645ca14555fa1404d";
-      hash = "sha256-0jpgvZTU5hPd1wwyNiwAf17hV0XtnPMfNP1IvYk+A1k=";
+      rev = "04942208ff371972ddcd9089b6c50b6941b956e4";
+      hash = "sha256-UIdLbcchrf9dfRn6Xoo+VhLnSGBQiGWfEylCVRzMNNA=";
     };
     meta.homepage = "https://github.com/jalvesaq/zotcite/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -1,5 +1,5 @@
 # generated by pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
-# Using parser data from https://github.com/nvim-neorocks/nurr/blob/main/tree-sitter-parsers.json
+# Using parser data from ${vimPlugins.nvim-treesitter}/lua/nvim-treesitter/parsers.lua
 
 {
   buildGrammar,
@@ -63,12 +63,12 @@
     };
     apex = buildGrammar {
       language = "apex";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "apex";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@@ -1559,12 +1559,12 @@
     };
     json = buildGrammar {
       language = "json";
-      version = "0.0.0+rev=001c28d";
+      version = "0.0.0+rev=254c42a";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-json";
-        rev = "001c28d7a29832b06b0e831ec77845553c89b56d";
-        hash = "sha256-cUjbN+e8UtoLRm8ZnxG7iRGD5YIc032RbHBIlmV8aLc=";
+        rev = "254c42a6476413b776221e03982ac8ae159eeb72";
+        hash = "sha256-gK4suNfS1Olq3pONPSH+Uyn820ru5TQqgl5q3wN/ADU=";
       };
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=0169d92";
+      version = "0.0.0+rev=fa565a3";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "0169d92b0a93e9f32289533ef23abdafca579e56";
-        hash = "sha256-eFdZxTIHijT6IuOjyIlElfr2HBU+BdOKJsIA1COmW9g=";
+        rev = "fa565a337b673050ba4f1131d21a1d259153140b";
+        hash = "sha256-UjFgw3AUDvsFLBdAh/zbQDjpZL1qBlCFMyxx3VVmXfM=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -1931,12 +1931,12 @@
     };
     mlir = buildGrammar {
       language = "mlir";
-      version = "0.0.0+rev=5085767";
+      version = "0.0.0+rev=e9f60f9";
       src = fetchFromGitHub {
         owner = "artagnon";
         repo = "tree-sitter-mlir";
-        rev = "50857672166f6ba1efceb05c4ec82877d72b4043";
-        hash = "sha256-50APhoj6Q7wGxPO1r3EuuapRcFXg6FnUve6aOaArKy4=";
+        rev = "e9f60f952a8807f5769c51de14e44625c24a00f8";
+        hash = "sha256-sjTGATP+hddYi1Hg6dF30P0RNlCSXIWXx+aUHEtk7wg=";
       };
       generate = true;
       meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2214,12 +2214,12 @@
     };
     pkl = buildGrammar {
       language = "pkl";
-      version = "0.0.0+rev=3486521";
+      version = "0.0.0+rev=65f4483";
       src = fetchFromGitHub {
         owner = "apple";
         repo = "tree-sitter-pkl";
-        rev = "3486521eb1c2fcb3c9a5e88300215930ee515693";
-        hash = "sha256-bQNSSDVVi0kmsIlpmI+7LWf8/SrXylAyEju/DAahqzg=";
+        rev = "65f4483b9e8a5960a4d8948421ef3a8992013517";
+        hash = "sha256-+SjtOZBSaVrH2FdWmc+ciG8c/TNT6G3XEalYy3F+SQ8=";
       };
       meta.homepage = "https://github.com/apple/tree-sitter-pkl";
     };
@@ -2472,12 +2472,12 @@
     };
     racket = buildGrammar {
       language = "racket";
-      version = "0.0.0+rev=e2b8064";
+      version = "0.0.0+rev=b3cbbde";
       src = fetchFromGitHub {
         owner = "6cdh";
         repo = "tree-sitter-racket";
-        rev = "e2b8064b32ab1dfa30532aeac1577ae4c1cc3df5";
-        hash = "sha256-NuEFNKoP2JaodFfX/8wizLC3xjKPvLwHIgefzI5oXMg=";
+        rev = "b3cbbde75ce2de3079e33c7fe90bd41b1d45be48";
+        hash = "sha256-QSlMxijWwYOtZPjZF1KpqLXbmu15e2g7JXp6ABaP6AY=";
       };
       meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
     };
@@ -2560,12 +2560,12 @@
     };
     rego = buildGrammar {
       language = "rego";
-      version = "0.0.0+rev=7f8a431";
+      version = "0.0.0+rev=da2a1f6";
       src = fetchFromGitHub {
         owner = "FallenAngel97";
         repo = "tree-sitter-rego";
-        rev = "7f8a43138951a13832919312290147bd175180cd";
-        hash = "sha256-kBTK6IjEnMnSPIF964GmTv6m+RukfP2TLcPHqHnxyIc=";
+        rev = "da2a1f63cd877efb05d56de61fe516e90012b9a7";
+        hash = "sha256-FIZsxmP66BNAzYRba5ExOeEtQBU5fm/uKH+P4TvxL/s=";
       };
       meta.homepage = "https://github.com/FallenAngel97/tree-sitter-rego";
     };
@@ -2703,12 +2703,12 @@
     };
     scala = buildGrammar {
       language = "scala";
-      version = "0.0.0+rev=4799cfc";
+      version = "0.0.0+rev=d699806";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-scala";
-        rev = "4799cfc8543145b5ad79fdb81a6e6996cca97af2";
-        hash = "sha256-NJKAcvLDHwiejybDBgFOJOzTtCXgoVUbgIWmBX0eehk=";
+        rev = "d69980656ee2be375596d9d013d64e1d29aa7d8f";
+        hash = "sha256-eENBlIE3lXGCBNuYWqRQaHzdUXlHbqWeq6aBO/OD+Is=";
       };
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
     };
@@ -2750,12 +2750,12 @@
     };
     sflog = buildGrammar {
       language = "sflog";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "sflog";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@@ -2850,36 +2850,36 @@
     };
     soql = buildGrammar {
       language = "soql";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "soql";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
     };
     sosl = buildGrammar {
       language = "sosl";
-      version = "0.0.0+rev=27a3091";
+      version = "0.0.0+rev=da568ee";
       src = fetchFromGitHub {
         owner = "aheber";
         repo = "tree-sitter-sfapex";
-        rev = "27a3091a1a444ce19d6099e00cd3788f019d0c2b";
-        hash = "sha256-Pg8zZmjGFcLftPNPiASt0uUxYG6CRcsB9qKhTMC5G7U=";
+        rev = "da568eee10ce4724a40f368b2b7e795dacb4f1ba";
+        hash = "sha256-lnRmC8eGcoVIFpn9pB2XbvNSiHxR9h9Vup6aJUOevIQ=";
       };
       location = "sosl";
       meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
     };
     sourcepawn = buildGrammar {
       language = "sourcepawn";
-      version = "0.0.0+rev=fdf3113";
+      version = "0.0.0+rev=d6c8a08";
       src = fetchFromGitHub {
         owner = "nilshelmig";
         repo = "tree-sitter-sourcepawn";
-        rev = "fdf31136774c5d182344305e7f3605d77fa4084f";
-        hash = "sha256-3+NcSLxz16g80CY4PosyekiQk21p+Fj/+o8Xr3fIuqk=";
+        rev = "d6c8a0801f3becf95cc232003b53c82f9267e8b7";
+        hash = "sha256-FmVOiJDOGDgw/Uju1PZZkG7hsy/6u3XTRUCycpbZ7M8=";
       };
       meta.homepage = "https://github.com/nilshelmig/tree-sitter-sourcepawn";
     };
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=85d1773";
+      version = "0.0.0+rev=172ada1";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "85d1773baf6e53de3722f2035fd3a9e7b03bf8d9";
-        hash = "sha256-l7bIJ2YgRcQigv7RWCTe37LxbGpdro/+q0ScjrzL3iY=";
+        rev = "172ada1cc4117d0260d9340680b4134adba2bc2c";
+        hash = "sha256-6N4w0fMpc2e/D3/2rxNbO9e/MJzrgbZwTbVQrUlgkpw=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3417,12 +3417,12 @@
     };
     vhdl = buildGrammar {
       language = "vhdl";
-      version = "0.0.0+rev=68dc07f";
+      version = "0.0.0+rev=f87f5e4";
       src = fetchFromGitHub {
         owner = "jpt13653903";
         repo = "tree-sitter-vhdl";
-        rev = "68dc07f69d9571c2ebea6b32f995925905d09741";
-        hash = "sha256-TWn6KXkn+FTIATpATrMTCWk8HknZCUEK0dllkljP/z4=";
+        rev = "f87f5e4874dd05efb7a8ccf0a337b14c48d20903";
+        hash = "sha256-/pJC3AYOF3rwMFfDmmkt7HMFdNxkA9iDENCovw46vcY=";
       };
       meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
     };
@@ -3527,12 +3527,12 @@
     };
     wxml = buildGrammar {
       language = "wxml";
-      version = "0.0.0+rev=7b821c7";
+      version = "0.0.0+rev=1cc1761";
       src = fetchFromGitHub {
         owner = "BlockLune";
         repo = "tree-sitter-wxml";
-        rev = "7b821c748dc410332f59496c0dea2632168c4e5a";
-        hash = "sha256-ZJeBKccEreak/Fs/Zi5E3m2S//s2R54KwFK3atoCvf0=";
+        rev = "1cc1761c8c11cacab5516dbe64e20ee689aa4428";
+        hash = "sha256-RoeEY/Xc8bP+0/l9cQgCejyB5nPLdK6CYlOoVEjIiik=";
       };
       meta.homepage = "https://github.com/BlockLune/tree-sitter-wxml";
     };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -17,7 +17,6 @@ https://github.com/vigoux/LanguageTool.nvim/,,
 https://github.com/LazyVim/LazyVim/,,
 https://github.com/Yggdroot/LeaderF/,,
 https://github.com/goropikari/LibDeflate.nvim/,,
-https://github.com/qadzek/link.vim/,,
 https://github.com/molleweide/LuaSnip-snippets.nvim/,,
 https://github.com/Valloric/MatchTagAlways/,,
 https://github.com/numToStr/Navigator.nvim/,,
@@ -645,6 +644,7 @@ https://github.com/markgandolfo/lightswitch.nvim/,,
 https://github.com/junegunn/limelight.vim/,,
 https://github.com/AndrewRadev/linediff.vim/,,
 https://github.com/lf-lang/lingua-franca.vim/,,
+https://github.com/qadzek/link.vim/,,
 https://github.com/tamago324/lir.nvim/,,
 https://github.com/kkharji/lispdocs.nvim/,,
 https://github.com/ldelossa/litee-calltree.nvim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1742,8 +1742,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.26";
-          hash = "sha256-Bt3ELE5jlR0CEn4UIGzx/8P6OTzN3Ckm6W13yD04fC4=";
+          version = "0.7.28";
+          hash = "sha256-aUmVt5zlDFt+c9BmfDkKHtdBMEumlG+Wupz8iW681Uw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
@@ -4591,8 +4591,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "110.3.0";
-          hash = "sha256-vVLnjFOpOmfmkwP0Yz7zONrBgpNDFfFZ0TAAicxdZ64=";
+          version = "110.3.1";
+          hash = "sha256-C3lJ7MO6GTJIotBa71vQN/L6A8iWZ9viYNniT6I2DMQ=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -5273,8 +5273,8 @@ let
         mktplcRef = {
           name = "volar";
           publisher = "Vue";
-          version = "3.3.9";
-          hash = "sha256-aJI96adY6ASvwtUY192i0okzxyBllCF4l3WYJ6lXbAc=";
+          version = "3.3.11";
+          hash = "sha256-wdELoM6czn0lrk9GdmBh55xUKXEXu5pkfaiRJvF06ew=";
         };
         meta = {
           changelog = "https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md";

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.1.8";
-    hash = "sha256-bhLnEsoifDQGHKCECTZ/BkAjuFQ9O9tODxzO2WMdybo=";
+    version = "4.1.12";
+    hash = "sha256-Wfo7CoFLcIE8yWSsfEtJ93VmIJ0TGlm1ZWF9BfK+38I=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-07-31";
+  version = "0-unstable-2026-08-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "b211204c7026dff6e86e79b00185512e2421fff8";
-    hash = "sha256-NfVgWG76T6cbb44F8Qva7rlwlsuhF8H6WtKjLPNfs7k=";
+    rev = "bebe2b13a840fbfd45cb501f5cd0efe01bdb1735";
+    hash = "sha256-z30s5uYhqBht7ZviljAu5WZlOCTS9sYqWBD2/hbWUbs=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-supafaust";
-  version = "0-unstable-2026-07-22";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "supafaust";
-    rev = "d6187e5337e6c2646d003db3ab1936727ca75301";
-    hash = "sha256-r9sZGTpJo+jiEDZnzSgcwzBerI4BHL2p/WvJQpdW31g=";
+    rev = "642d1d1b6684aa7e306a02a89885f3f5456a5157";
+    hash = "sha256-malpQAapdRY/V4y2Csm36+Bo1WCRcAWnx4C4okC5S4k=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/desmume2015.nix

@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume2015";
-  version = "0-unstable-2026-07-26";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume2015";
-    rev = "1cc4f73f85cdf33be8338edb4ac519e5e66abc3b";
-    hash = "sha256-1dYVeNwBMHfa3BTv0vCV6n3TQvDEzQ76N9DTXLuJPmc=";
+    rev = "422b688009ccb9f2917c086a8fe79c8cecb030ae";
+    hash = "sha256-jkzUalzkrxNv3IfO3admuy5PwvOoMJ5RrJHE6T07oSE=";
   };
 
   extraBuildInputs = [

pkgs/applications/emulators/libretro/cores/gpsp.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2026-07-21";
+  version = "0-unstable-2026-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "5b6e751f4abf368509146cd143c949c1946ac1ae";
-    hash = "sha256-R9+cVqJWZHHyJ75fZXdz9xJSVCVOk1xuEs8kPUGkFDI=";
+    rev = "6b12231f03591e60deea389f7a122e594db61388";
+    hash = "sha256-fbKK6wsC+G0u6rWwqPsHSAtF9eAeTRn52Z1/aUhmqm8=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-08-12";
+  version = "0-unstable-2026-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "eb342748c828421bd15a1791162c885bfde61907";
-    hash = "sha256-R63AEUlUYh/xDsKCYQZermMYZvJtkDhyDqwr0yZ1Kfo=";
+    rev = "24cffe763621b164fc10be2ae3660f140be25182";
+    hash = "sha256-Gfdpt2R83SOZsD1iPYk6IWPmTEjmQdfdb2xMXSufF6c=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2026-08-13";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "5bbb84086c548a0ee0738f0b38966d7d4a5ff946";
-    hash = "sha256-fQ3wIylfkG6Q0LmU/mE3jc/GToubcXPJPSBKpBfThlY=";
+    rev = "dc1f391a830c085cb6e0a4bd732e0c2c69e13bbd";
+    hash = "sha256-xd/qhsqHaQQZFiBSt8vSNiNeWervywvYO8rxI2CTYZg=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2010.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-08-11";
+  version = "0-unstable-2026-08-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "421a8d9449031245f1dfdb632b84548a9f19fddd";
-    hash = "sha256-/F5/kU8zJzQGhy59c/0CwTM1Pb3aI9+iAWekwf74zDs=";
+    rev = "7db129b1ecdccb38cb4d7184bcbed39beed79656";
+    hash = "sha256-KvUseE8hYMv8W73gBYgzoFq5wklHHzU7B1DttBQS+yQ=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];

pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "2048";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-08-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-2048";
-    rev = "c90437d3c3913999624deca3fb55ecfa632b72c4";
-    hash = "sha256-dE3PanK+rpf01R4aoD3KMwVhEVvmmVS2klVPQUGTUC0=";
+    rev = "39333f7b13dc4daea7c151d9c38d22b961246343";
+    hash = "sha256-sMmRG126yg1diRPY1YMUfkTvwYjjTKyAXo367/CvcYo=";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -9,11 +9,11 @@
     "vendorHash": "sha256-RTfj2Omiqe92Ad0swEY/aGIMvcXb39bdQoObYKiekiw="
   },
   "a10networks_thunder": {
-    "hash": "sha256-mqCXiBtVHzEOdLW0KudPWJO6kGi0SiGawN/NQvjAJdg=",
+    "hash": "sha256-jwk2DKNYlYB6VJ9Y73SbLOcRzELqJTKbD0KOsrTqT3I=",
     "homepage": "https://registry.terraform.io/providers/a10networks/thunder",
     "owner": "a10networks",
     "repo": "terraform-provider-thunder",
-    "rev": "v1.6.0",
+    "rev": "v1.6.1",
     "spdx": "BSD-2-Clause",
     "vendorHash": null
   },
@@ -73,13 +73,13 @@
     "vendorHash": "sha256-L9IGENsL8Kibq5O/JOgCxLRUxgS7q9G/NovC/Q7tw48="
   },
   "auth0_auth0": {
-    "hash": "sha256-lqlQglt3zbNkoE4ORBWIq85r7/SYucIOPgIzJ7NrYaQ=",
+    "hash": "sha256-SpGTMAFEiJVGpXYAIigJQditDvs8sU2Bz57ohanccAM=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.54.1",
+    "rev": "v1.55.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gQHnTp3reX/1fmwQqjpqtjlb2z3wYk8E8vRf73jh48E="
+    "vendorHash": "sha256-ajl7q+9oA+NA5eqAXA5yjej03qdI5nimRNQW6GoGOq4="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -968,11 +968,11 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-dgOvrpgd6KWWJ55tZj69szSv/euafelfjEaAf19MbDY=",
+    "hash": "sha256-39GYcVZcUMkdn+IZd8IWQRw9Du6JszDxQGynsq1yBE4=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.96.2",
+    "rev": "v3.96.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ztdLwjNy91ldNc8/CamoKAHHg0JcNyCTq93vxDKYy7k="
   },
@@ -1040,13 +1040,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-6sziS47pZdVvcTlRtbGx0YId9UuTDOLL0EJyBo1Gqlc=",
+    "hash": "sha256-t2aiKujM84sfUJbXwHbDbRRQyw4Jc66sI0UI/QB0edI=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.37.3",
+    "rev": "v1.37.6",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ARdBbhC6F1LxZ+tXNMderJ65VKSubUmSBhtQb4SZqTY="
+    "vendorHash": "sha256-1CbQ4ufkwBOrGHW1f/6GnIDInuLcdHReE4o/Ck8Rnhs="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
@@ -1400,11 +1400,11 @@
     "vendorHash": "sha256-kM5itT82W2uy/y5uJkZsMH308LjRMSNKBJC09e5k5+8="
   },
   "turbot_turbot": {
-    "hash": "sha256-sJODPeFzU3vaiHbKlGe1dR5Pi7aS56JcmZUe8Yg1BcQ=",
+    "hash": "sha256-Az+eTY+eksfH89DGqTd8RVwD8KDztz6Bctm0Mt7GBN4=",
     "homepage": "https://registry.terraform.io/providers/turbot/turbot",
     "owner": "turbot",
     "repo": "terraform-provider-turbot",
-    "rev": "v1.13.3",
+    "rev": "v1.14.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/google-drive-ocamlfuse/default.nix

@@ -6,7 +6,7 @@
   extlib,
   fuse3,
   gapi-ocaml,
-  ocaml_sqlite3,
+  sqlite3,
   otoml,
   tiny_httpd,
   ounit2,
@@ -32,7 +32,7 @@ buildDunePackage (finalAttrs: {
     extlib
     fuse3
     gapi-ocaml
-    ocaml_sqlite3
+    sqlite3
     otoml
     tiny_httpd
   ];

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -28,7 +28,14 @@ let
       extraPatches = [
         # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
         (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
-      ];
+      ]
+      ++
+        lib.optional (lib.versionAtLeast version "154" && lib.versionOlder version "154.0.1")
+          (fetchpatch2 {
+            # Fix Success macros colliding: https://bugzilla.mozilla.org/show_bug.cgi?id=2065007
+            url = "https://github.com/mozilla-firefox/firefox/commit/f0b76eba072821d62e74ebdbd8da9243a2ce3b84.patch";
+            hash = "sha256-PCTmv1ZO7ce4q5fp+WPmy5Wga5OMY4hNzqIZ7iYCcp4=";
+          });
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
@@ -78,8 +85,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "153.0.3";
-    sha512 = "6a9271af8473fa6679d4943a35fab0a335e8eb736aebfab4d79e250578faf6090cda19e80708487bec7c2221242b059072dda9ca817478a6d76556594972202b";
+    version = "154.0";
+    sha512 = "aebdc5f0f4788124128a77b8a329767fa0f6d1d46c41ca6fd45889368e4e964a7a82a41f5367e825da0d544eff61d4da07dff2e6eb13f72c935bed79a184c5a8";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/applications/video/kodi/addons/controller-topology-project/default.nix

@@ -8,13 +8,13 @@
 let
   drv = stdenv.mkDerivation rec {
     pname = "controller-topology-project";
-    version = "1.0.13";
+    version = "1.0.14";
 
     src = fetchFromGitHub {
       owner = "kodi-game";
       repo = "controller-topology-project";
       rev = "v${version}";
-      sha256 = "sha256-i620L/ctKPaARgPDoXB+Pdii42KXe4WO+2Bnge0ZnrY=";
+      sha256 = "sha256-GfEnCx1DewxHipzblMBtnl2dsLewr87qLEi6R3CYh6Q=";
     };
 
     postPatch = ''

pkgs/build-support/release/default.nix

@@ -124,12 +124,16 @@ rec {
       name,
       constituents,
       meta ? { },
+      # Interpret string constituents as fnmatch patterns matched
+      # against all job names of the jobset.
+      globConstituents ? false,
     }:
     pkgs.runCommand name
       {
         inherit constituents meta;
         preferLocalBuild = true;
         _hydraAggregate = true;
+        _hydraGlobConstituents = globConstituents;
       }
       ''
         mkdir -p $out/nix-support

pkgs/by-name/ab/abracadabra/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TuOqTVBJSuZyA53UETR383md4LjqQx1FL/qRZwXOCRs=";
+    hash = "sha256-35E2a3UXyxcDixN5OAsiqlV0X+wkhS2vI6myHlpA2GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ac/acli/sources.json

@@ -1,17 +1,17 @@
 {
-  "version": "1.3.23-stable",
+  "version": "1.3.29-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.23-stable/acli_1.3.23-stable_darwin_arm64.tar.gz",
-      "sha256": "af78f7bb06b137ddab785257fb74367ac3304629c7d240af0117a700c7b56b64"
+      "url": "https://acli.atlassian.com/darwin/1.3.29-stable/acli_1.3.29-stable_darwin_arm64.tar.gz",
+      "sha256": "b2f6343d13ac8f3c32ea1043aba8317876d845662967793eb00016a2e5b5cf79"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.23-stable/acli_1.3.23-stable_linux_arm64.tar.gz",
-      "sha256": "5d4e8580cf2aae681bc02bb4f61c8a62f3efa8fa2b051b3a5f4f560a90279a60"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_arm64.tar.gz",
+      "sha256": "cea39c4eb90c65d8d0cafc869a75fa3b6afaaf4573f8da650f4ae73801f8ec46"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.23-stable/acli_1.3.23-stable_linux_amd64.tar.gz",
-      "sha256": "1678a6d0ac36904b1b7788191b5740962a3dc8694aa6f3eee9ccd8f4774996e5"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_amd64.tar.gz",
+      "sha256": "8dcfc7bcf9dc788e7143e93d74445310094977ba1bad2513c6c613460851d34e"
     }
   }
 }

pkgs/by-name/ac/actual-client/package.nix

@@ -2,7 +2,7 @@
   lib,
   actual-server,
   copyDesktopItems,
-  electron_41,
+  electron_42,
   imagemagick,
   jq,
   makeDesktopItem,
@@ -11,7 +11,7 @@
   stdenv,
 }:
 let
-  electron = electron_41;
+  electron = electron_42;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "actual-client";
@@ -45,12 +45,14 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
+    # TODO: uncomment once actual updates their electron version to v42+
+    # https://github.com/actualbudget/actual/issues/8767
     # verify electron version
-    upstreamElectronMajor=$(${lib.getExe jq} -r '.devDependencies.electron | match("[0-9]+").string' packages/desktop-electron/package.json)
-    if [[ "$upstreamElectronMajor" != "${lib.versions.major electron.version}" ]]; then
-      echo "Electron major version mismatch: Actual expects $upstreamElectronMajor, nixpkgs provides ${electron.version}" >&2
-      exit 1
-    fi
+    # upstreamElectronMajor=$(${lib.getExe jq} -r '.devDependencies.electron | match("[0-9]+").string' packages/desktop-electron/package.json)
+    # if [[ "$upstreamElectronMajor" != "${lib.versions.major electron.version}" ]]; then
+    #   echo "Electron major version mismatch: Actual expects $upstreamElectronMajor, nixpkgs provides ${electron.version}" >&2
+    #   exit 1
+    # fi
 
     export HOME=$(mktemp -d)
 

pkgs/by-name/ac/actual-server/package.nix

@@ -161,6 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux ++ darwin;
     maintainers = [
+      lib.maintainers.PerchunPak
       lib.maintainers.oddlama
       lib.maintainers.patrickdag
       lib.maintainers.yash-garg

pkgs/by-name/ad/adhammer/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "adhammer";
+  version = "1.3.10";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "icedracon";
+    repo = "adhammer";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QQjiyvj3e5unEsh17UyKck2rs8oKeLO5eodBG7cn1LQ=";
+  };
+
+  cargoHash = "sha256-Ebkvxl/JyiZ84ucv7FmOluHTqYd14I3B6z53QNmVQZw=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Active Directory security-assessment toolkit";
+    homepage = "https://github.com/icedracon/adhammer";
+    changelog = "https://github.com/icedracon/adhammer/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "adhammer";
+  };
+})

pkgs/by-name/am/amp-cli/package.nix

@@ -26,7 +26,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1786738049-g32e30e";
+  version = "0.0.1787515258-g1cbe6b";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -77,9 +77,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-8unf4fAZpdkR4LCBFQzfM/SJGJ8QAYDWEktGd9wJFhs=";
-            aarch64-linux = "sha256-YKS3uI2r5PMEXS81fpU3YUTnfC4eGR3E1uX3G+mDW40=";
-            aarch64-darwin = "sha256-x5FqwElBE4aZsF4OJtj3TWNqwTLFEsJSHM/gCQQSk4g=";
+            x86_64-linux = "sha256-8XrKtDrsDqgA17QLEgf6uhFBR6uKpO5wHzwmjsNY20c=";
+            aarch64-linux = "sha256-9ojGgakJurfS1rmXdLCnU9UEhDpF5g+9l4aU3WNEHb4=";
+            aarch64-darwin = "sha256-y77U/4OP8paz/F6rBaPhTbH95ydpPtVUrIpEakAzYiQ=";
           }
           .${system'};
       }

pkgs/by-name/ar/art/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "art";
-  version = "1.26.7";
+  version = "1.26.8";
 
   src = fetchFromGitHub {
     owner = "artraweditor";
     repo = "ART";
     tag = finalAttrs.version;
-    hash = "sha256-HuXDdrfb3r8B5u4Ifvb3EfbF/b1mMbDAunOIBtEaKtk=";
+    hash = "sha256-kgDmGxdmKK/19vxruTQ0845iaRSWthlkYoeAFVaju2U=";
   };
 
   # Fix the build with CMake 4.

pkgs/by-name/b3/b3sum/package.nix

@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "b3sum";
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchCrate {
     inherit (finalAttrs) version pname;
-    hash = "sha256-VWYsN/kNK/aR/Qc9nsTaXuJMO4PNBNOT6cfzwleKhD0=";
+    hash = "sha256-ZShgvrxccsaLXKl0wMF5GfpRzjlBi/ideUQSW+nQg5k=";
   };
 
-  cargoHash = "sha256-KOzFTLgbmrzUV5KmqJV9N7GUsUhaM3cwSxi/WlkeQBM=";
+  cargoHash = "sha256-aPFihFEmGDkAAd5fLcHQ0elpOR+KOmhZi28QxR7aQ8Q=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ba/bacon/package.nix

@@ -27,17 +27,17 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bacon";
-  version = "3.24.0";
+  version = "3.25.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rfbK5MrCytBVISXVkazBDnZZxjZQ3ze348mlTyanTWM=";
+    hash = "sha256-+7K8hy6zzLUshLc2I24md5FOYq3lB0ivx1VbCRHIXII=";
   };
 
-  cargoHash = "sha256-s49qZMD922l6KKSFRhVIGp6+7E0S+q7McV9PT2F0RQc=";
+  cargoHash = "sha256-fAdS77fBUFlSbXu1aw3X3z0ema2FC5fDo8At2GQpGn0=";
 
   buildFeatures = lib.optionals withSound [
     "sound"

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "baidupcs-go";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AvwdAOjuQxdmhg+IJxQ9e9iMXqveLjoF/W7ntZZmES4=";
+    hash = "sha256-o0Oh6zLJT25+smEgWy7E8fTigJ2FLpBXoaZSYCRFvic=";
   };
 
-  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
+  vendorHash = "sha256-3kvB5QxtWuElhDIFFr3Awf5myf6l2Hx0M2k53ltQYeQ=";
 
   doCheck = false;
 

pkgs/by-name/be/bearer/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "bearer";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OUsy3DDuo1ptTtbIOEOhqfG4wlaVu1ZSKJqt9h2ZRI0=";
+    hash = "sha256-I4XPt/egQJznJ9FS422fCJhiwLttjolx5adhiO1gDiM=";
   };
 
-  vendorHash = "sha256-PTyozkuRlD/VCqPqbDfdhMYHH1z3+S1X6ykPg/xP680=";
+  vendorHash = "sha256-XjpHnNrYY04ondhw9ZCUUkos2lgH2NJFFP0tU2frGvs=";
 
   subPackages = [ "cmd/bearer" ];
 
@@ -24,7 +24,6 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
-    "-w"
     "-X=github.com/bearer/bearer/cmd/bearer/build.Version=${finalAttrs.version}"
   ];
 

pkgs/by-name/bi/bitwarden-cli/package.nix

@@ -14,13 +14,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "bitwarden-cli";
-  version = "2026.7.0";
+  version = "2026.8.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-8PYjRa1lhs53FCfqPBqH9712X1ek02wbkI+kW5tkepE=";
+    hash = "sha256-Kz7vy3mt4uLGA6wGtH527P5vY55UYSZtq6e8IyNJvc4=";
   };
 
   postPatch = ''
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
   nodejs = nodejs_22;
   npmDepsFetcherVersion = 2;
 
-  npmDepsHash = "sha256-WRxlvkgWboO0ukUHgjC5CrfgfwnmUfDXI4r5dx9CKww=";
+  npmDepsHash = "sha256-5i6/TlqBhPLv00tN0sxFA/iRQ8QRyUxhCqYkhVBLz3w=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     perl

pkgs/by-name/br/breaktimer/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_42,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -13,18 +13,18 @@
 }:
 
 let
-  electron = electron_41;
+  electron = electron_42;
   nodejs = nodejs_24;
   description = "Cross-platform desktop app for managing periodic breaks";
 in
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "breaktimer";
   version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "tom-james-watson";
     repo = "breaktimer-app";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-STDb6+brlVk/ZPUbw3cQOpe2r03WlFKEBgVLqJrsrHI=";
   };
 
@@ -124,10 +124,10 @@ buildNpmPackage rec {
   meta = {
     inherit description;
     homepage = "https://github.com/tom-james-watson/breaktimer-app";
-    changelog = "https://github.com/tom-james-watson/breaktimer-app/releases/tag/v${version}";
+    changelog = "https://github.com/tom-james-watson/breaktimer-app/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ proitheus ];
     mainProgram = "breaktimer";
     platforms = electron.meta.platforms;
   };
-}
+})

pkgs/by-name/br/breitbandmessung/package.nix

@@ -4,7 +4,7 @@
   fetchurl,
   asar,
   dpkg,
-  electron_41,
+  electron_43,
   makeWrapper,
   nixosTests,
   undmg,
@@ -13,7 +13,7 @@
 let
   inherit (stdenv.hostPlatform) system;
 
-  electron = electron_41;
+  electron = electron_43;
 
   sources = import ./sources.nix;
 

pkgs/by-name/ca/cargo-apk/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-apk";
-  version = "0.9.6";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-1vCrM+0SNefd7FrRXnSjLhM3/MSVJfcL4k1qAstX+/A=";
+    hash = "sha256-aA+XxqSlugFa8vN8YIye5nV2f2wLmCMf/cdFjiGRGEY=";
   };
 
-  cargoHash = "sha256-8qjj5rcaqXBIte8+r0llj33Saat85SqNljGRaS1E3q0=";
+  cargoHash = "sha256-qd8xJz2nJb3R6EAi9GS7UhWK9Esm9eBsm4+rA1DjYPI=";
 
   meta = {
     description = "Tool for creating Android packages";

pkgs/by-name/cd/cdncheck/package.nix

@@ -2,12 +2,16 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
   version = "1.2.50";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
@@ -21,7 +25,6 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
-    "-w"
   ];
 
   preCheck = ''
@@ -31,6 +34,13 @@ buildGoModule (finalAttrs: {
       --replace-fail "TestCheckDNSResponse" "SkipTestCheckDNSResponse"
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  doInstallCheck = true;
+
   meta = {
     description = "Tool to detect various technology for a given IP address";
     homepage = "https://github.com/projectdiscovery/cdncheck";

pkgs/by-name/cf/cfitsio/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cfitsio";
-  version = "4.6.4";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "HEASARC";
     repo = "cfitsio";
     tag = "cfitsio-${finalAttrs.version}";
-    hash = "sha256-8AFPTr8j8f+x1h78IXOV8GHkDPWvI8w8aRxyke3Dras=";
+    hash = "sha256-k05ylMYf+hsYur3BgNAweMeDc89rsBBtie+P7bd+7qg=";
   };
 
   outputs = [

pkgs/by-name/ch/chawan/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chawan";
-  version = "0.3.3";
+  version = "0.4.4";
 
   src = fetchFromSourcehut {
     owner = "~bptato";
     repo = "chawan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GVDh94pgdMlwHMyqtT8q2yM+rwioodBYQfA+AOZ/CsU=";
+    hash = "sha256-4MrJoBNQ4Sbx02/Cl/JdTux5UUu8ioSwRNvDxCH6gcY=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
     libssh2
   ];
 
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
   buildFlags = [
     "all"
   ];

pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-dynamic-dns";
-  version = "4.5.3";
+  version = "4.5.5";
 
   src = fetchFromGitHub {
     owner = "zebradil";
     repo = "cloudflare-dynamic-dns";
     tag = finalAttrs.version;
-    hash = "sha256-sKfQJXWrL6x9EPz94dGdvXZPy7cPgce+w8UvPEletJE=";
+    hash = "sha256-+mFApn2ClRXAPY7pSLm9SDw3gibxH5471Y/whn/cQg8=";
   };
 
-  vendorHash = "sha256-JV8BWSH7d0TCMbCnMOsWBpCltDdiejy9oQhXgWiVvaQ=";
+  vendorHash = "sha256-7yqvpl6BvDiBMHu4cpoK66t9a5gwtK0PEfkjIHe6fJQ=";
 
   subPackages = ".";
 

pkgs/by-name/cl/cloudflared/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudflared";
-  version = "2026.7.3";
+  version = "2026.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = finalAttrs.version;
-    hash = "sha256-hIDx9Nd7CKlM0vCKqkVHxBMj4QzvnnsYYMjhzOqcECU=";
+    hash = "sha256-6pepcjGOLbG+lJ/sGCU8tJVW4nVq7/xGkZ7lLz3KHRQ=";
   };
 
   vendorHash = null;

pkgs/by-name/co/codecov-cli/package.nix

@@ -19,14 +19,14 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "codecov-cli";
-  version = "11.2.6";
+  version = "11.2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "prevent-cli";
     tag = "v${version}";
-    hash = "sha256-8KBemqwMqiio4pnftsBgnFj69Bgb5jQr5YlMegujPZY=";
+    hash = "sha256-1CVl8X05e0Fm7TCKlZtQk+o9i26O9KVdnlUIBYqa8IE=";
   };
 
   sourceRoot = "${src.name}/${pname}";

pkgs/by-name/co/collada-dom/package.nix

@@ -8,7 +8,6 @@
   libxml2,
   minizip,
   pkg-config,
-  pcre-cpp,
   readline,
   uriparser,
   zlib,
@@ -16,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "collada-dom";
-  version = "2.5.4";
+  version = "2.5.5";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Gepetto";
     repo = "collada-dom";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6V1Ew1YWybgqt0dikNdXwK+4D1odgVN/7NvaikjRqE4=";
+    hash = "sha256-51CwWqxQP+rTQgsHfnI/krJcpI9Lb6PXe/td/ztoiRY=";
   };
 
   postInstall = ''
@@ -42,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     bzip2
     libxml2
     minizip
-    pcre-cpp
     readline
     uriparser
     zlib

pkgs/by-name/co/comfyui/package.nix

@@ -74,7 +74,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "comfyui";
-  version = "0.33.1";
+  version = "0.33.3";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "Comfy-Org";
     repo = "ComfyUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r6amApYXBjfE8+UvhiJ/7VcUibd4kd5i+JLPXxo8H9w=";
+    hash = "sha256-c3a5xBKusx3Xk26U421JrK9tqb27XTq7I9HBiNHP1/0=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/co/containerd/package.nix

@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.3.3";
+  version = "2.3.4";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-wa9Pixaq5RRrJucWibbBe4n6s53Pdj+mr5gLoFmDgLU=";
+    hash = "sha256-IGgToUpkbqtjGJD+GtCPSeHW9ZRnSS8NMfECok9HgjU=";
   };
 
   postPatch = ''

pkgs/by-name/co/copyparty/package.nix

@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.20";
+  version = "1.20.21";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-ox+eSkPlZgh2XhCDUxQHhNUBgcN+cF6c6O2fOJn1ffo=";
+    hash = "sha256-ZU70dVW7QC4n2JBckAyZ9Ut/HW24dKdJ7/35qyPPQiM=";
   };
 
   pyproject = true;

pkgs/by-name/co/corrode-scanner/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "corrode-scanner";
+  version = "0.5.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ul0gic";
+    repo = "corrode";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cxmX0UOEI78P9K4glTh7B2b+/Uc5pHY961RamarvZm0=";
+  };
+
+  cargoHash = "sha256-f+gwucHpQu5IJqll/DmGYkNwu/5a2esl9URpwj7c3Pc=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Security scanner for finding exposed credentials, secrets, and vulnerabilities";
+    homepage = "https://github.com/ul0gic/corrode";
+    changelog = "https://github.com/ul0gic/corrode/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "corrode-scanner";
+  };
+})

pkgs/by-name/cr/credhub-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "credhub-cli";
-  version = "2.9.59";
+  version = "2.9.60";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "credhub-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-jHMVLkRDEIch8naxEbCkfD2sTChbfiejcaoliQTZqt0=";
+    sha256 = "sha256-sus0jCdRj9ZwDeAGgw85tJkWC4UAZQPzonAjUvY3sfs=";
   };
 
   # these tests require network access that we're not going to give them

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DLVIEFXQCmfSkFIRd6s9VbpdsypuyYgaI+ZwmV55YVs=";
+    hash = "sha256-CyjXE4cDPp8pmVqjgJFzLiVgR1I0lv2PEusS659KKP4=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor

pkgs/by-name/cr/cross-seed/package.nix

@@ -4,9 +4,11 @@
   fetchFromGitHub,
   nix-update-script,
   nixosTests,
+  nodejs_22,
 }:
 
-buildNpmPackage rec {
+# Override can be removed once cross-seed v7 releases
+buildNpmPackage.override { nodejs = nodejs_22; } rec {
   pname = "cross-seed";
   version = "6.13.7";
 

pkgs/by-name/cs/csharp-ls/package.nix

@@ -11,9 +11,9 @@ in
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "csharp-ls";
-  version = "0.26.0";
+  version = "0.27.0";
 
-  nugetHash = "sha256-KwOYeu8Hu3CL/lanv7NwNkx8ggPmmqZ3o3WUu+IaFbA=";
+  nugetHash = "sha256-pJo01GZOT7pHgctQ1TfvrRdxOTgoNw4y7OP+deK87a8=";
 
   inherit dotnet-sdk;
   dotnet-runtime = dotnet-sdk;

pkgs/by-name/cu/cubelify/package.nix

@@ -6,11 +6,11 @@
 }:
 appimageTools.wrapType2 rec {
   pname = "cubelify";
-  version = "1.25.13";
+  version = "1.25.14";
 
   src = fetchurl {
     url = "https://storage.cubelify.com/overlay/v1/Cubelify%20Overlay-${version}.AppImage";
-    hash = "sha512-1gNMoaEdh5qAySgRl9rjrFPLFpdTt6YxMaYdry4AJpQhNYxv45M1pq7D5HqJ4xgZHQZxfERPo+Wvfzk1rwaWog==";
+    hash = "sha512-R2J1u+XAeOwNe6lzsntXzIU0wk7UEXa4QBncpMnc3qgp/uYzaV+rBbk5+NyL+GBjLEVPkUDoMjoL2K2iCZpdYw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/cy/cyclonedx-gomod/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cyclonedx-gomod";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-gomod";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9EjmYoOBn8BbSo+1L+9AO0Q2G7UmY6lp2LobJhKACu4=";
+    hash = "sha256-lTIgASBf+mbbsugRDYlPIeNoIrhGwftpoB+lKj/9H44=";
   };
 
-  vendorHash = "sha256-py0K2ReoWY7q19P3VJE8jtDZ/1EgMPNIVnCs2/nz7wg=";
+  vendorHash = "sha256-BtSBlkdEgJNJ1JWK33FIWMLfxbEDgx8mv36Mx2QesA4=";
 
   ldflags = [
     "-w"

pkgs/by-name/da/daktari/package.nix

@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.348";
+  version = "0.0.350";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d1wSzz+GiH5R/8SzIlsd32Dz/FJxuYeMSLFGnL6aMPY=";
+    hash = "sha256-JpLY+s88UcNgpy6K7+ZmLUCDlxqNtbuW3wIz8phy7Ag=";
   };
 
   patches = [ ./optional-pyclip.patch ];

pkgs/by-name/da/dapr-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dapr-cli";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "dapr";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lMHuXf4v4xcCcvTqVVXwszMjQ/C3P80J1hXh4Py/jls=";
+    hash = "sha256-A21Fk5WzlyMcHG2wpPQVChwkDdcCrDx3zhzl0KZLBS0=";
   };
 
   vendorHash = "sha256-P7zrfUcb/Hxo7QbIQfq9JSf2d7meZShQ++GG8HkEoLE=";

pkgs/by-name/da/dashy-ui/package.nix

@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "4.5.10";
+  version = "4.6.0";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-oHTe2vilrtvApLQ7x8L+upTgkhz2TsXsbA8KcvsZg64=";
+    hash = "sha256-fU8sbxaHs+j2Z/+xvE6w8qBF2cxKtRx+ARQlpfJ2n5Y=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-43z3gn58eb7Dh9QXLDoeAJAViCQX+8IeSN4xx+hYfPI=";
+    hash = "sha256-EBtJW3atTgLeLn+PLxePmrnEG9Xl0R+9LIlTh+Vgw5g=";
   };
 
   passthru = {

pkgs/by-name/da/datadog-pup/package.nix

@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "datadog-pup";
-  version = "1.10.8";
+  version = "1.12.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "DataDog";
     repo = "pup";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EETtgS9ubFa8aQxefXyZiu8CNfqf7PpyqCCpz07Ld9I=";
+    hash = "sha256-zq3XlBO70S3VUn7tky58/ObWHJSEhaaJVism1r614Fs=";
   };
 
-  cargoHash = "sha256-IhGAykqkxTnLtbHW0hh3a/7SkY5XxaA/ZP9czfXWPrM=";
+  cargoHash = "sha256-yBe5hmzy0oqgA9Nu0L2BNn17dr5mdvXLbvwdN7xHg3k=";
 
   checkType = "debug";
   dontUseCargoParallelTests = true;

pkgs/by-name/db/dblab/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dblab";
-  version = "0.48.0";
+  version = "0.48.1";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JOwET0v6EENlbK0iDBY7/zjreZQ2EUddfFvaiv3y858=";
+    hash = "sha256-6TNczWq7EAMNo1z2zIpLG9TshSuvQ5S+QOI2XH3S/ik=";
   };
 
   vendorHash = "sha256-nFgwoX2GxjRdqXcocTvz7L0NA+kN1+67uTpler8di/E=";

pkgs/by-name/de/decker/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "decker";
-  version = "1.69";
+  version = "1.70";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-N1g+jaINbUZcTazvgfBc3G0QD4fevJMINRGL9Lp27us=";
+    hash = "sha256-QVv5kLwQZojTCUgnGTX2r622YOoYzIDjrWbj8mkFubE=";
   };
 
   buildInputs = [

pkgs/by-name/de/desync/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "desync";
-  version = "1.0.4";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "desync";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/ojucBo+UOr5WFahVMSz7xJ84dzenwuotZk+5QqODls=";
+    hash = "sha256-ViwNE+8fmYbAMPFd8yiWXDLbaenkgri9PBe92M0Se5U=";
   };
 
-  vendorHash = "sha256-PU2EbYei6X/fmA/POaFI6flAZYb2WcBA10E9+rS651U=";
+  vendorHash = "sha256-dAFci7GXe1fPPABIG1dngEyGqC5TKa90fyQPYSbJJrk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -41,6 +41,8 @@ buildGoModule (finalAttrs: {
         "TestUnTarDirMTime" # xattr.list: operation not supported
         "TestUnTarIntoReadOnlyDir" # xattr.list: operation not supported
         "TestUnTarNoSamePermissionsOverReadOnlyTree" # xattr.list: operation not supported
+        "TestUnTarReadOnlyDir" # xattr.list: operation not supported
+        "TestUnTarReadOnlyDirNoSamePermissions" # xattr.list: operation not supported
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         "TestS3StoreGetChunk/fail" # sendfile is not permitted in Darwin sandbox

pkgs/by-name/di/diskwatch/package.nix

@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "diskwatch";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "diskwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/wR+tUQPV6EnWcZvOdZY9di9Eu07NSnAn25du/KMlfw=";
+    hash = "sha256-pKo4zXyoX2OiOIwirCdzQuuFW1dMye/AA4MNVYgki3A=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-UTO7jkO+a1n9HcVYrw1m4EAMaiXk4z3TlOa/JtlpFV8=";
+  cargoHash = "sha256-Nr01CMCsh3llYAlVS0O0F+/rmopTywxw9itISYoyQRI=";
 
   nativeCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/do/docfd/package.nix

@@ -54,7 +54,7 @@ ocamlPackages.buildDunePackage rec {
     nottui
     nottui-unix
     notty-community
-    ocaml_sqlite3
+    sqlite3
     ocolor
     oseq
     ppx_deriving

pkgs/by-name/do/doctl/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.166.0";
+  version = "1.167.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m4KJ/WzmnLuL4/6RQV1sPUEc+PdKDNkTL2+HBGgN5x8=";
+    hash = "sha256-N8G9bJUd12FsV3ANW2LHMq6ED5YHe8vSJydNhA427SM=";
   };
 
   meta = {

pkgs/by-name/do/doppler/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "doppler";
-  version = "3.76.4";
+  version = "3.76.5";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = finalAttrs.version;
-    hash = "sha256-GkM4pSmMIjoyOMPmtb4GoSrZdz69kL1s1r+krRhedR8=";
+    hash = "sha256-98RBpWjBzsLSFTarI5fyc26oyAIuGl5Sm5PeqW3RU0A=";
   };
 
   vendorHash = "sha256-rDpr4qWhMWXEhgZrmoW5tzPZif3KAv3gDtJNtXzbVq0=";

pkgs/by-name/dr/dracula-theme/package.nix

@@ -10,7 +10,7 @@ let
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
-  version = "4.0.0-unstable-2026-03-01";
+  version = "4.0.0-unstable-2026-05-21";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -18,8 +18,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "1188c8eabdfc33c42738862b91caf7fab884c767";
-    hash = "sha256-Z3dMgkk5SvpCWjxdm8hd5FBeEvq0uCJuj3zC5boQEdk=";
+    rev = "81d0287950e8093dd8f8c753347763bce8588465";
+    hash = "sha256-gbotOIGG55oqQZZNDkc9s5fPXvJQr+YHqxt5ZWS5bF8=";
   };
 
   installPhase = ''

pkgs/by-name/du/dusklight/package.nix

@@ -200,7 +200,10 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/TwilitRealm/dusklight/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.cc0;
     mainProgram = "dusklight";
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     maintainers = with lib.maintainers; [ liberodark ];
   };
 })