Merge master into staging-next

changelog: https://codeberg.org/forgejo/forgejo/milestone/142240

doc/doc-support/include-to-nav.py

@@ -6,9 +6,10 @@ from typing import TypedDict
 
 # Coupled to where this file lives!
 # Needed to resolve the relative includes file paths
-DOC_ROOT = Path(__file__).resolve().parent.parent
+REPO_ROOT = Path(__file__).resolve().parent.parent.parent
 
-ROOT_FILE = DOC_ROOT / "manual.md.in"
+ROOT_FILE = REPO_ROOT / "nixos/doc/manual/manual.md"
+DOC_ROOT = ROOT_FILE.parent
 
 INCLUDE_RE = re.compile(r"^```\{=include=\}(?P<rest>.*)$")
 FENCE_RE = re.compile(r"^(```|~~~)")

doc/doc-support/lib-function-docs.nix

@@ -1,151 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
 # To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
 {
-  lib,
   stdenvNoCC,
   nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "fetchers";
-      description = "functions which can be reused across fetchers";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivations, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
 }:
-
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
   src = ../../lib;
 
-  nativeBuildInputs = [
-    nixdoc
-    nix
-  ];
+  nativeBuildInputs = [ nixdoc ];
+
+  buildPhase = ''
+    mkdir -p src
+    cp -r ${../../lib} src/lib
+
+    mkdir -p $out
+    nixdoc --manifest ${../function-catalog.json} --root src --output $out/lib-functions.json
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    cd ..
-
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      --store $(mktemp -d) \
-      > locations.json
-
-    function docgen {
-      name=$1
-      baseName=$2
-      description=$3
-      # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
-      else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
-      fi
-      echo "$out/$name.md" >> "$out/index.md"
-    }
-
-    mkdir -p "$out"
-
-    cat > "$out/index.md" << 'EOF'
-    ```{=include=} sections auto-id-prefix=auto-generated
-    EOF
-
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
-
-    echo '```' >> "$out/index.md"
-
     runHook postInstall
   '';
 }

doc/doc-support/lib-function-locations.nix

@@ -1,82 +0,0 @@
-{
-  nixpkgsPath,
-  revision,
-  libsetsJSON,
-}:
-let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
-
-  libDefPos =
-    prefix: set:
-    builtins.concatMap (
-      name:
-      [
-        {
-          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
-          location = builtins.unsafeGetAttrPos name set;
-        }
-      ]
-      ++ lib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
-        libDefPos (prefix ++ [ name ]) set.${name}
-      )
-    ) (builtins.attrNames set);
-
-  libset =
-    toplib:
-    map (subsetname: {
-      subsetname = subsetname;
-      functions = libDefPos [ ] toplib.${subsetname};
-    }) (map (x: x.name) libsets);
-
-  flattenedLibSubset =
-    { subsetname, functions }:
-    map (fn: {
-      name = "lib.${subsetname}.${fn.name}";
-      value = fn.location;
-    }) functions;
-
-  locatedlibsets = libs: map flattenedLibSubset (libset libs);
-  removeFilenamePrefix =
-    prefix: filename:
-    let
-      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
-      filenameLen = builtins.stringLength filename;
-      substr = builtins.substring prefixLen filenameLen filename;
-    in
-    substr;
-
-  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);
-
-  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));
-
-  fnLocationRelative =
-    { name, value }:
-    {
-      inherit name;
-      value = value // {
-        file = removeNixpkgs value.file;
-      };
-    };
-
-  relativeLocs = (map fnLocationRelative liblocations);
-  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
-
-  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
-  jsonLocs = builtins.listToAttrs (
-    map (
-      { name, value }:
-      {
-        name = sanitizeId name;
-        value =
-          let
-            text = "${value.file}:${toString value.line}";
-            target = "${urlPrefix}/${value.file}#L${toString value.line}";
-          in
-          "[${text}](${target}) in `<nixpkgs>`";
-      }
-    ) relativeLocs
-  );
-
-in
-jsonLocs

doc/doc-support/package.nix

@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
-      cat ./functions/library.md.in ${lib-docs}/index.md > ./functions/library.md
+      cp ${lib-docs}/lib-functions.json ./lib-functions.json
 
       substitute ./manual.md.in ./manual.md \
         --replace-fail '@MANUAL_VERSION@' '${lib.version}'
@@ -147,7 +147,7 @@ stdenvNoCC.mkDerivation (
     '';
 
     passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
+      lib-docs = callPackage ./lib-function-docs.nix { };
 
       epub = callPackage ./epub.nix { };
 

doc/function-catalog.json

@@ -0,0 +1,124 @@
+{
+  "version": 1,
+  "groups": [
+    { "id": "asserts", "description": "assertion functions" },
+    { "id": "attrsets", "description": "attribute set functions" },
+    { "id": "strings", "description": "string manipulation functions" },
+    { "id": "versions", "description": "version string functions" },
+    { "id": "trivial", "description": "miscellaneous functions" },
+    { "id": "fixedPoints", "description": "explicit recursion functions" },
+    { "id": "lists", "description": "list manipulation functions" },
+    { "id": "debug", "description": "debugging functions" },
+    { "id": "options", "description": "NixOS / nixpkgs option handling" },
+    { "id": "path", "description": "path functions" },
+    {
+      "id": "fetchers",
+      "description": "functions which can be reused across fetchers"
+    },
+    { "id": "filesystem", "description": "filesystem functions" },
+    { "id": "fileset" },
+    { "id": "sources", "description": "source filtering functions" },
+    { "id": "cli", "description": "command-line serialization functions" },
+    {
+      "id": "generators",
+      "description": "functions that create file formats from nix data structures"
+    },
+    {
+      "id": "gvariant",
+      "description": "GVariant formatted string serialization functions"
+    },
+    {
+      "id": "customisation",
+      "description": "Functions to customise (derivation-related) functions, derivations, or attribute sets"
+    },
+    { "id": "meta", "description": "functions for derivation metadata" },
+    {
+      "id": "derivations",
+      "description": "miscellaneous derivation-specific functions"
+    }
+  ],
+  "sources": [
+    { "path": "lib.trivial", "file": "lib/trivial.nix", "groups": ["trivial"] },
+    {
+      "path": "lib.fixedPoints",
+      "file": "lib/fixed-points.nix",
+      "groups": ["fixedPoints"]
+    },
+    {
+      "path": "lib.attrsets",
+      "file": "lib/attrsets.nix",
+      "groups": ["attrsets"]
+    },
+    { "path": "lib.lists", "file": "lib/lists.nix", "groups": ["lists"] },
+    { "path": "lib.strings", "file": "lib/strings.nix", "groups": ["strings"] },
+    {
+      "path": "lib.customisation",
+      "file": "lib/customisation.nix",
+      "groups": ["customisation"]
+    },
+    {
+      "path": "lib.derivations",
+      "file": "lib/derivations.nix",
+      "groups": ["derivations"]
+    },
+    { "path": "lib.meta", "file": "lib/meta.nix", "groups": ["meta"] },
+    {
+      "path": "lib.versions",
+      "file": "lib/versions.nix",
+      "groups": ["versions"]
+    },
+    { "path": "lib.cli", "file": "lib/cli.nix", "groups": ["cli"] },
+    {
+      "path": "lib.gvariant",
+      "file": "lib/gvariant.nix",
+      "groups": ["gvariant"]
+    },
+    {
+      "path": "lib.generators",
+      "file": "lib/generators.nix",
+      "groups": ["generators"]
+    },
+    { "path": "lib.asserts", "file": "lib/asserts.nix", "groups": ["asserts"] },
+    { "path": "lib.debug", "file": "lib/debug.nix", "groups": ["debug"] },
+    {
+      "path": "lib.fetchers",
+      "file": "lib/fetchers.nix",
+      "groups": ["fetchers"]
+    },
+    { "path": "lib.path", "file": "lib/path/default.nix", "groups": ["path"] },
+    {
+      "path": "lib.filesystem",
+      "file": "lib/filesystem.nix",
+      "groups": ["filesystem"]
+    },
+    {
+      "path": "lib.fileset",
+      "file": "lib/fileset/default.nix",
+      "groups": ["fileset"]
+    },
+    {
+      "path": "lib.sources",
+      "file": "lib/sources.nix",
+      "groups": ["sources"],
+      "mode": "deep",
+      "include": [
+        "pathIsGitRepo",
+        "commitIdFromGitRepo",
+        "cleanSource",
+        "cleanSourceWith",
+        "cleanSourceFilter",
+        "pathHasContext",
+        "canCleanSource",
+        "urlToName",
+        "shortRev",
+        "revOrTag",
+        "repoRevToName",
+        "sourceByRegex",
+        "sourceFilesBySuffices",
+        "sourceByGlobs",
+        "trace"
+      ]
+    },
+    { "path": "lib.options", "file": "lib/options.nix", "groups": ["options"] }
+  ]
+}

doc/functions/library.md

@@ -1,5 +1,3 @@
 # Nixpkgs Library Functions {#sec-functions-library}
 
 Nixpkgs provides a standard library at `pkgs.lib`, or through `import <nixpkgs/lib>`.
-
-<!-- nixdoc-generated documentation must be appended here during build! -->

doc/languages-frameworks/javascript.section.md

@@ -562,6 +562,29 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+##### `fetchYarnDeps` arguments {#javascript-fetchyarndeps}
+
+`fetchYarnDeps` accepts the following arguments:
+
+- `yarnLock`: Path to the `yarn.lock` file to fetch dependencies for.
+- `hash` (or `sha256`): The output hash of the offline cache.
+- `mirrorUrl`: Optional registry mirror URL used in place of the default yarn
+  registry (`https://registry.yarnpkg.com/`). When set, any resolved URL
+  pointing at the default registry is rewritten to use this mirror before
+  downloading. This is useful for pointing at a local or internal registry
+  mirror. Note that changing the mirror does not change the output hash, since
+  the downloaded contents are identical.
+
+```nix
+{
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    mirrorUrl = "https://registry.npmmirror.com/";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+}
+```
+
 ##### `yarnConfigHook` arguments {#javascript-yarnconfighook}
 
 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.

doc/nav.json

@@ -628,9 +628,12 @@
           "file": "functions.md"
         },
         {
-          "id-prefix": "auto-generated",
           "file": "functions/library.md"
         },
+        {
+          "collection": "lib-functions.json",
+          "type": "nixdoc"
+        },
         {
           "file": "functions/generators.section.md"
         },

doc/redirects.json

@@ -3906,6 +3906,9 @@
   "javascript-yarn-v3-v4": [
     "index.html#javascript-yarn-v3-v4"
   ],
+  "javascript-fetchyarndeps": [
+    "index.html#javascript-fetchyarndeps"
+  ],
   "javascript-yarnconfighook": [
     "index.html#javascript-yarnconfighook"
   ],

doc/release-notes/rl-2611.section.md

@@ -102,6 +102,8 @@
 
 - `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
 
+- `python3Packages.starlette-admin` v1.0.0 has released, which mainly refactors internals and adds a large set of new features. The high-level API is mostly unchanged, but users migrating from v0.17 may want to view [the migration guide](https://jowilf.github.io/starlette-admin/migration/#from-017x-to-100).
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).

nixos/doc/manual/administration/containers.chapter.md

@@ -20,9 +20,3 @@ get upgraded along with your host system when you run `nixos-rebuild`,
 which is often not what you want. By contrast, in the imperative
 approach, containers are configured and updated independently from the
 host system.
-
-```{=include=} sections
-imperative-containers.section.md
-declarative-containers.section.md
-container-networking.section.md
-```

nixos/doc/manual/administration/running.md

@@ -1,15 +1,3 @@
 # Administration {#ch-running}
 
 This chapter describes various aspects of managing a running NixOS system, such as how to use the {command}`systemd` service manager.
-
-```{=include=} chapters
-service-mgmt.chapter.md
-rebooting.chapter.md
-user-sessions.chapter.md
-control-groups.chapter.md
-logging.chapter.md
-system-state.chapter.md
-cleaning-store.chapter.md
-containers.chapter.md
-troubleshooting.chapter.md
-```

nixos/doc/manual/administration/system-state.chapter.md

@@ -8,10 +8,3 @@ However, it is possible and not-uncommon to create [impermanent systems], whose
 this kind of configuration, special care needs to be taken.
 
 [impermanent systems]: https://wiki.nixos.org/wiki/Impermanence
-
-
-```{=include=} sections
-nixos-state.section.md
-systemd-state.section.md
-zfs-state.section.md
-```

nixos/doc/manual/administration/troubleshooting.chapter.md

@@ -2,11 +2,3 @@
 
 This chapter describes solutions to common problems you might encounter
 when you manage your NixOS system.
-
-```{=include=} sections
-boot-problems.section.md
-maintenance-mode.section.md
-rollback.section.md
-store-corruption.section.md
-network-problems.section.md
-```

nixos/doc/manual/configuration/config-syntax.chapter.md

@@ -10,9 +10,3 @@ of the Nix language are fully described in the [Nix
 manual](https://nixos.org/nix/manual/#chap-writing-nix-expressions), but
 here we give a short overview of the most important constructs useful in
 NixOS configuration files.
-
-```{=include=} sections
-config-file.section.md
-abstractions.section.md
-modularity.section.md
-```

nixos/doc/manual/configuration/configuration.md

@@ -2,27 +2,4 @@
 
 This chapter describes how to configure various aspects of a NixOS machine through the configuration file {file}`/etc/nixos/configuration.nix`. As described in [](#sec-changing-config), changes to this file only take effect after you run {command}`nixos-rebuild`.
 
-```{=include=} chapters
-config-syntax.chapter.md
-package-mgmt.chapter.md
-user-mgmt.chapter.md
-file-systems.chapter.md
-x-windows.chapter.md
-wayland.chapter.md
-gpu-accel.chapter.md
-xfce.chapter.md
-networking.chapter.md
-linux-kernel.chapter.md
-subversion.chapter.md
-```
-
-```{=include=} chapters
-@MODULE_CHAPTERS@
-```
-
-```{=include=} chapters
-profiles.chapter.md
-mattermost.chapter.md
-kubernetes.chapter.md
-```
 <!-- Apache; libvirtd virtualisation -->

nixos/doc/manual/configuration/declarative-packages.section.md

@@ -39,8 +39,3 @@ configuration, use `pkgs` prefix (variable).
 
 To "uninstall" a package, remove it from
 [](#opt-environment.systemPackages) and run `nixos-rebuild switch`.
-
-```{=include=} sections
-customizing-packages.section.md
-adding-custom-packages.section.md
-```

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -37,10 +37,3 @@ System startup will fail if any of the filesystems fails to mount,
 dropping you to the emergency shell. You can make a mount asynchronous
 and non-critical by adding `options = [ "nofail" ];`.
 :::
-
-```{=include=} sections
-luks-file-systems.section.md
-sshfs-file-systems.section.md
-nfs-file-systems.section.md
-overlayfs.section.md
-```

nixos/doc/manual/configuration/networking.chapter.md

@@ -3,14 +3,4 @@
 This section describes how to configure networking components
 on your NixOS machine.
 
-```{=include=} sections
-network-manager.section.md
-ssh.section.md
-ipv4-config.section.md
-ipv6-config.section.md
-firewall.section.md
-wireless.section.md
-ad-hoc-network-config.section.md
-renaming-interfaces.section.md
-```
 <!-- TODO: OpenVPN, NAT -->

nixos/doc/manual/configuration/package-mgmt.chapter.md

@@ -11,8 +11,3 @@ NixOS has two distinct styles of package management:
 -   *Ad hoc*, where you install, upgrade and uninstall packages via the
     `nix-env` command. This style allows mixing packages from different
     Nixpkgs versions. It's the only choice for non-root users.
-
-```{=include=} sections
-declarative-packages.section.md
-ad-hoc-packages.section.md
-```

nixos/doc/manual/configuration/profiles.chapter.md

@@ -16,17 +16,3 @@ install media, many are actually intended to be used in real installs.
 
 What follows is a brief explanation of the purpose and use-case for each
 profile. Detailing each option configured by each one is out of scope.
-
-```{=include=} sections
-profiles/all-hardware.section.md
-profiles/base.section.md
-profiles/clone-config.section.md
-profiles/demo.section.md
-profiles/docker-container.section.md
-profiles/graphical.section.md
-profiles/headless.section.md
-profiles/installation-device.section.md
-profiles/perlless.section.md
-profiles/minimal.section.md
-profiles/qemu-guest.section.md
-```

nixos/doc/manual/default.nix

@@ -103,12 +103,16 @@ let
 
     cp -r ${../../../doc/release-notes} ./release-notes-nixpkgs
 
+    cp ${./nav.json} nav.json
+
     substituteInPlace ./manual.md \
       --replace-fail '@NIXOS_VERSION@' "${version}"
-    substituteInPlace ./configuration/configuration.md \
+    substituteInPlace ./nav.json \
       --replace-fail \
-          '@MODULE_CHAPTERS@' \
-          ${escapeShellArg (concatMapStringsSep "\n" (p: "${p.value}") config.meta.doc)}
+          '"@MODULE_CHAPTERS@"' \
+          ${escapeShellArg (
+            concatMapStringsSep ",\n" (p: ''{ "file": "${p.value}" }'') config.meta.doc
+          )}
     substituteInPlace ./nixos-options.md \
       --replace-fail \
         '@NIXOS_OPTIONS_JSON@' \
@@ -200,9 +204,10 @@ rec {
           --script ./highlightjs/loader.js \
           --script ./anchor.min.js \
           --script ./anchor-use.js \
-          --sidebar-depth 2 \
+          --sidebar-depth 3 \
           --header ${./header.html}\
           --no-navheader \
+          --experimental-config nav.json \
           ./manual.md \
           $dst/${common.indexPath}
 

nixos/doc/manual/development/development.md

@@ -1,16 +1,3 @@
 # Development {#ch-development}
 
 This chapter describes how you can modify and extend NixOS.
-
-```{=include=} chapters
-sources.chapter.md
-writing-modules.chapter.md
-building-parts.chapter.md
-bootspec.chapter.md
-what-happens-during-a-system-switch.chapter.md
-writing-documentation.chapter.md
-nixos-tests.chapter.md
-developing-the-test-driver.chapter.md
-testing-installer.chapter.md
-modular-services.md
-```

nixos/doc/manual/development/nixos-tests.chapter.md

@@ -4,11 +4,3 @@ When you add some feature to NixOS, you should write a test for it.
 NixOS tests are kept in the directory `nixos/tests`, and are executed
 (using Nix) by a testing framework that automatically starts one or more
 virtual machines containing the NixOS system(s) required for the test.
-
-```{=include=} sections
-writing-nixos-tests.section.md
-running-nixos-tests.section.md
-running-nixos-tests-interactively.section.md
-linking-nixos-tests-to-packages.section.md
-testing-hardware-features.section.md
-```

nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md

@@ -53,10 +53,3 @@ More detailed output can be displayed by setting `STC_DEBUG=1`.
 Most of these actions are either self-explaining but some of them have to do
 with our units or the activation script. For this reason, these topics are
 explained in the next sections.
-
-```{=include=} sections
-unit-handling.section.md
-activation-script.section.md
-non-switchable-systems.section.md
-etc-overlay.section.md
-```

nixos/doc/manual/development/writing-modules.chapter.md

@@ -209,16 +209,3 @@ in
 }
 ```
 :::
-
-```{=include=} sections
-option-declarations.section.md
-option-types.section.md
-option-def.section.md
-assertions.section.md
-meta-attributes.section.md
-importing-modules.section.md
-replace-modules.section.md
-freeform-modules.section.md
-settings-options.section.md
-state-revision.section.md
-```

nixos/doc/manual/installation/installation.md

@@ -1,13 +1,3 @@
 # Installation {#ch-installation}
 
 This section describes how to obtain, install, and configure NixOS for first-time use.
-
-```{=include=} chapters
-obtaining.chapter.md
-installing.chapter.md
-changing-config.chapter.md
-upgrading.chapter.md
-building-nixos.chapter.md
-building-images-via-nixos-rebuild-build-image.chapter.md
-building-images-via-systemd-repart.chapter.md
-```

nixos/doc/manual/installation/installing.chapter.md

@@ -577,12 +577,3 @@ With a partitioned disk.
 :::
 
 ## Additional installation notes {#sec-installation-additional-notes}
-
-```{=include=} sections
-installing-usb.section.md
-installing-pxe.section.md
-installing-kexec.section.md
-installing-virtualbox-guest.section.md
-installing-from-other-distro.section.md
-installing-behind-a-proxy.section.md
-```

nixos/doc/manual/manual.md

@@ -32,21 +32,6 @@
 
 -->
 
-```{=include=} preface
-preface.md
-```
-
-```{=include=} parts
-installation/installation.md
-configuration/configuration.md
-administration/running.md
-development/development.md
-```
-
-```{=include=} chapters
-contributing-to-this-manual.chapter.md
-```
-
 ```{=include=} appendix html:into-file=//options.html
 nixos-options.md
 ```

nixos/doc/manual/nav.json

@@ -0,0 +1,444 @@
+{
+  "open": [],
+  "items": [
+    {
+      "file": "preface.md"
+    },
+    {
+      "label": "Installation",
+      "id": "ch-installation",
+      "children": [
+        {
+          "file": "installation/installation.md"
+        },
+        {
+          "file": "installation/obtaining.chapter.md"
+        },
+        {
+          "label": "Installing NixOS",
+          "id": "sec-installation",
+          "children": [
+            {
+              "file": "installation/installing.chapter.md"
+            },
+            {
+              "file": "installation/installing-usb.section.md"
+            },
+            {
+              "file": "installation/installing-pxe.section.md"
+            },
+            {
+              "file": "installation/installing-kexec.section.md"
+            },
+            {
+              "file": "installation/installing-virtualbox-guest.section.md"
+            },
+            {
+              "file": "installation/installing-from-other-distro.section.md"
+            },
+            {
+              "file": "installation/installing-behind-a-proxy.section.md"
+            }
+          ]
+        },
+        {
+          "file": "installation/changing-config.chapter.md"
+        },
+        {
+          "file": "installation/upgrading.chapter.md"
+        },
+        {
+          "file": "installation/building-nixos.chapter.md"
+        },
+        {
+          "file": "installation/building-images-via-nixos-rebuild-build-image.chapter.md"
+        },
+        {
+          "file": "installation/building-images-via-systemd-repart.chapter.md"
+        }
+      ]
+    },
+    {
+      "label": "Configuration",
+      "id": "ch-configuration",
+      "children": [
+        {
+          "file": "configuration/configuration.md"
+        },
+        {
+          "label": "Configuration Syntax",
+          "id": "sec-configuration-syntax",
+          "children": [
+            {
+              "file": "configuration/config-syntax.chapter.md"
+            },
+            {
+              "file": "configuration/config-file.section.md"
+            },
+            {
+              "file": "configuration/abstractions.section.md"
+            },
+            {
+              "file": "configuration/modularity.section.md"
+            }
+          ]
+        },
+        {
+          "label": "Package Management",
+          "id": "sec-package-management",
+          "children": [
+            {
+              "file": "configuration/package-mgmt.chapter.md"
+            },
+            {
+              "label": "Declarative Package Management",
+              "id": "sec-declarative-package-mgmt",
+              "children": [
+                {
+                  "file": "configuration/declarative-packages.section.md"
+                },
+                {
+                  "file": "configuration/customizing-packages.section.md"
+                },
+                {
+                  "file": "configuration/adding-custom-packages.section.md"
+                }
+              ]
+            },
+            {
+              "file": "configuration/ad-hoc-packages.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/user-mgmt.chapter.md"
+        },
+        {
+          "label": "File Systems",
+          "id": "ch-file-systems",
+          "children": [
+            {
+              "file": "configuration/file-systems.chapter.md"
+            },
+            {
+              "file": "configuration/luks-file-systems.section.md"
+            },
+            {
+              "file": "configuration/sshfs-file-systems.section.md"
+            },
+            {
+              "file": "configuration/nfs-file-systems.section.md"
+            },
+            {
+              "file": "configuration/overlayfs.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/x-windows.chapter.md"
+        },
+        {
+          "file": "configuration/wayland.chapter.md"
+        },
+        {
+          "file": "configuration/gpu-accel.chapter.md"
+        },
+        {
+          "file": "configuration/xfce.chapter.md"
+        },
+        {
+          "label": "Networking",
+          "id": "sec-networking",
+          "children": [
+            {
+              "file": "configuration/networking.chapter.md"
+            },
+            {
+              "file": "configuration/network-manager.section.md"
+            },
+            {
+              "file": "configuration/ssh.section.md"
+            },
+            {
+              "file": "configuration/ipv4-config.section.md"
+            },
+            {
+              "file": "configuration/ipv6-config.section.md"
+            },
+            {
+              "file": "configuration/firewall.section.md"
+            },
+            {
+              "file": "configuration/wireless.section.md"
+            },
+            {
+              "file": "configuration/ad-hoc-network-config.section.md"
+            },
+            {
+              "file": "configuration/renaming-interfaces.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/linux-kernel.chapter.md"
+        },
+        {
+          "file": "configuration/subversion.chapter.md"
+        },
+        "@MODULE_CHAPTERS@",
+        {
+          "label": "Profiles",
+          "id": "ch-profiles",
+          "children": [
+            {
+              "file": "configuration/profiles.chapter.md"
+            },
+            {
+              "file": "configuration/profiles/all-hardware.section.md"
+            },
+            {
+              "file": "configuration/profiles/base.section.md"
+            },
+            {
+              "file": "configuration/profiles/clone-config.section.md"
+            },
+            {
+              "file": "configuration/profiles/demo.section.md"
+            },
+            {
+              "file": "configuration/profiles/docker-container.section.md"
+            },
+            {
+              "file": "configuration/profiles/graphical.section.md"
+            },
+            {
+              "file": "configuration/profiles/headless.section.md"
+            },
+            {
+              "file": "configuration/profiles/installation-device.section.md"
+            },
+            {
+              "file": "configuration/profiles/perlless.section.md"
+            },
+            {
+              "file": "configuration/profiles/minimal.section.md"
+            },
+            {
+              "file": "configuration/profiles/qemu-guest.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/mattermost.chapter.md"
+        },
+        {
+          "file": "configuration/kubernetes.chapter.md"
+        }
+      ]
+    },
+    {
+      "label": "Administration",
+      "id": "ch-running",
+      "children": [
+        {
+          "file": "administration/running.md"
+        },
+        {
+          "file": "administration/service-mgmt.chapter.md"
+        },
+        {
+          "file": "administration/rebooting.chapter.md"
+        },
+        {
+          "file": "administration/user-sessions.chapter.md"
+        },
+        {
+          "file": "administration/control-groups.chapter.md"
+        },
+        {
+          "file": "administration/logging.chapter.md"
+        },
+        {
+          "label": "Necessary system state",
+          "id": "ch-system-state",
+          "children": [
+            {
+              "file": "administration/system-state.chapter.md"
+            },
+            {
+              "file": "administration/nixos-state.section.md"
+            },
+            {
+              "file": "administration/systemd-state.section.md"
+            },
+            {
+              "file": "administration/zfs-state.section.md"
+            }
+          ]
+        },
+        {
+          "file": "administration/cleaning-store.chapter.md"
+        },
+        {
+          "label": "Container Management",
+          "id": "ch-containers",
+          "children": [
+            {
+              "file": "administration/containers.chapter.md"
+            },
+            {
+              "file": "administration/imperative-containers.section.md"
+            },
+            {
+              "file": "administration/declarative-containers.section.md"
+            },
+            {
+              "file": "administration/container-networking.section.md"
+            }
+          ]
+        },
+        {
+          "label": "Troubleshooting",
+          "id": "ch-troubleshooting",
+          "children": [
+            {
+              "file": "administration/troubleshooting.chapter.md"
+            },
+            {
+              "file": "administration/boot-problems.section.md"
+            },
+            {
+              "file": "administration/maintenance-mode.section.md"
+            },
+            {
+              "file": "administration/rollback.section.md"
+            },
+            {
+              "file": "administration/store-corruption.section.md"
+            },
+            {
+              "file": "administration/network-problems.section.md"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "label": "Development",
+      "id": "ch-development",
+      "children": [
+        {
+          "file": "development/development.md"
+        },
+        {
+          "file": "development/sources.chapter.md"
+        },
+        {
+          "label": "Writing NixOS Modules",
+          "id": "sec-writing-modules",
+          "children": [
+            {
+              "file": "development/writing-modules.chapter.md"
+            },
+            {
+              "file": "development/option-declarations.section.md"
+            },
+            {
+              "file": "development/option-types.section.md"
+            },
+            {
+              "file": "development/option-def.section.md"
+            },
+            {
+              "file": "development/assertions.section.md"
+            },
+            {
+              "file": "development/meta-attributes.section.md"
+            },
+            {
+              "file": "development/importing-modules.section.md"
+            },
+            {
+              "file": "development/replace-modules.section.md"
+            },
+            {
+              "file": "development/freeform-modules.section.md"
+            },
+            {
+              "file": "development/settings-options.section.md"
+            },
+            {
+              "file": "development/state-revision.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/building-parts.chapter.md"
+        },
+        {
+          "file": "development/bootspec.chapter.md"
+        },
+        {
+          "label": "What happens during a system switch?",
+          "id": "sec-switching-systems",
+          "children": [
+            {
+              "file": "development/what-happens-during-a-system-switch.chapter.md"
+            },
+            {
+              "file": "development/unit-handling.section.md"
+            },
+            {
+              "file": "development/activation-script.section.md"
+            },
+            {
+              "file": "development/non-switchable-systems.section.md"
+            },
+            {
+              "file": "development/etc-overlay.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/writing-documentation.chapter.md"
+        },
+        {
+          "label": "NixOS Tests",
+          "id": "sec-nixos-tests",
+          "children": [
+            {
+              "file": "development/nixos-tests.chapter.md"
+            },
+            {
+              "file": "development/writing-nixos-tests.section.md"
+            },
+            {
+              "file": "development/running-nixos-tests.section.md"
+            },
+            {
+              "file": "development/running-nixos-tests-interactively.section.md"
+            },
+            {
+              "file": "development/linking-nixos-tests-to-packages.section.md"
+            },
+            {
+              "file": "development/testing-hardware-features.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/developing-the-test-driver.chapter.md"
+        },
+        {
+          "file": "development/testing-installer.chapter.md"
+        },
+        {
+          "file": "development/modular-services.md"
+        }
+      ]
+    },
+    {
+      "file": "contributing-to-this-manual.chapter.md"
+    }
+  ]
+}

nixos/doc/manual/redirects.json

@@ -1,4 +1,13 @@
 {
+  "module-services-netbird-relay": [
+    "index.html#module-services-netbird-relay"
+  ],
+  "module-services-netbird-relay-quickstart": [
+    "index.html#module-services-netbird-relay-quickstart"
+  ],
+  "module-services-netbird-relay-tls": [
+    "index.html#module-services-netbird-relay-tls"
+  ],
   "module-services-portmaster": [
     "index.html#module-services-portmaster"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -132,6 +132,8 @@
 
 - [qbit-manage](https://github.com/StuffAnThings/qbit_manage), a tool to help manage tedious tasks in qBittorrent and automate them. Available as [services.qbit-manage](#opt-services.qbit-manage.enable).
 
+- [Netbird Relay](https://netbird.io/), a module to relay traffic when a point-to-point connection is not possible.
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -209,6 +211,8 @@
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
+- `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.
+
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
 - `virtualisation.containers.registries.block` / `insecure` / `search` were deprecated,
@@ -291,6 +295,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `services.k3s` and `services.rke2` now expose the images declared in `images` through a `/nix/store` directory symlinked into `/var/lib/rancher/${name}/agent/images/nixos/`. The directory's store path changes whenever any image derivation changes, which makes k3s/rke2 detect and re-import the new archives, while `/var/lib/rancher/${name}/agent/images/` itself remains a normal directory that can still be used for manually added images. Previously, each image was linked with a fixed file name directly in that directory, so the cluster would not notice image updates and old symlinks could become dangling. After upgrading, you may want to remove those dangling symlinks (that was the case already when you wanted to stop deploying an image).
+
 - `programs.regreet` has been renamed to `services.displayManager.regreet`.
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).

nixos/modules/hardware/printers.nix

@@ -78,11 +78,6 @@ in
                 config.hardware.printers.ensurePrinters. Specifying a symblic
                 name here that does not match any of those printers is
                 considered a hard error.
-
-                ::: {.warning}
-                Print jobs to this class will quietly fail if there are no
-                printers in this class. CUPS reports them as pending
-                :::
               '';
             };
             classes = mkOption {
@@ -267,7 +262,14 @@ in
           '';
         }
       )
-    ];
+    ]
+    ++ map (class: {
+      assertion = cfg.ensureClasses.${class}.printers != [ ] || cfg.ensureClasses.${class}.classes != [ ];
+      message = ''
+        At least one of the lists `config.hardware.printers.ensureClasses.${class}.printers`
+        and `config.hardware.printers.ensureClasses.${class}.classes` has to be non-empty.
+      '';
+    }) (builtins.attrNames cfg.ensureClasses);
 
     systemd.services.cups = {
       postStart =
@@ -333,17 +335,6 @@ in
             d = cfg.ensureDefaultPrinter;
           })}
 
-          #### CLASS DEFINITIONS ####
-          lpadmin -p _tmp -v file:/dev/null
-          ${lib.concatMapStringsSep "\n" (
-            className:
-            lpadmin {
-              p = "_tmp";
-              c = className;
-            }
-          ) classNames}
-          lpadmin -x _tmp
-
           #### ADDING PRINTERS TO CLASSES ####
           ${lib.concatMapStringsSep "\n" (
             className:

nixos/modules/module-list.nix

@@ -967,7 +967,6 @@
   ./services/misc/paisa.nix
   ./services/misc/paperless.nix
   ./services/misc/persistent-evdev.nix
-  ./services/misc/pghero.nix
   ./services/misc/pinchflat.nix
   ./services/misc/pinnwand.nix
   ./services/misc/plex.nix
@@ -1353,6 +1352,7 @@
   ./services/networking/nebula-lighthouse-service.nix
   ./services/networking/nebula.nix
   ./services/networking/netbird.nix
+  ./services/networking/netbird/netbird-relay.nix
   ./services/networking/netbird/server.nix
   ./services/networking/netclient.nix
   ./services/networking/netfoil.nix

nixos/modules/rename.nix

@@ -520,6 +520,9 @@ in
     (mkRemovedOptionModule [ "services" "filesender" ] ''
       services.filesender has been removed since it depends on simplesamlphp which was severely unmaintained.
     '')
+    (mkRemovedOptionModule [ "services" "pghero" ] ''
+      services.pghero has been removed because the (unmaintained) package was removed from Nixpkgs.
+    '')
     (mkRemovedOptionModule [ "services" "postfixadmin" ] ''
       services.postfixadmin has been removed since it was unmaintained in nixpkgs and the version
       available only supported PHP 8.1 which is EOL.

nixos/modules/services/cluster/kubernetes/kubelet.nix

@@ -129,13 +129,24 @@ in
     };
 
     clusterDns = mkOption {
-      description = "Use alternative DNS.";
+      description = ''
+        List of DNS resolvers (IP addresses) used inside containers.
+
+        Defaulted to {option}`services.kubernetes.addons.dns.clusterIp`
+        when {option}`services.kubernetes.addons.dns.enable` is `true`.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
       default = [ "10.1.0.1" ];
       type = listOf str;
     };
 
     clusterDomain = mkOption {
-      description = "Use alternative domain.";
+      description = ''
+        Search DNS domain used inside containers.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
       default = config.services.kubernetes.addons.dns.clusterDomain;
       defaultText = literalExpression "config.${options.services.kubernetes.addons.dns.clusterDomain}";
       type = str;

nixos/modules/services/cluster/rancher/default.nix

@@ -849,13 +849,22 @@ let
                 "L+".argument = "${manifest.source}";
               };
             };
-            # Make a systemd-tmpfiles rule for a container image
-            mkImageRule = image: {
-              name = "${imageDir}/${image.name}";
-              value = {
-                "L+".argument = "${image}";
-              };
-            };
+            # Build a single store directory containing symlinks to all
+            # container images declared in the NixOS configuration. The
+            # directory's store path changes whenever any image changes, so
+            # k3s/rke2 re-imports images on every generation switch. It is
+            # exposed under ${imageDir}/nixos so that ${imageDir} itself
+            # remains a normal directory that users can still populate manually.
+            agentImagesDir = pkgs.linkFarm "${name}-agent-images" (
+              map (image: {
+                # The store-path hash is included in the link name so that two
+                # different images with the same tarball base name do not
+                # collide. The context is discarded because tmpfiles link names
+                # must not carry store-path references.
+                name = builtins.unsafeDiscardStringContext (builtins.baseNameOf image);
+                path = image;
+              }) cfg.images
+            );
             # Merge charts with charts contained in enabled auto deploying charts
             helmCharts =
               (lib.concatMapAttrs (n: v: { ${n} = v.package; }) (
@@ -873,7 +882,11 @@ let
             };
           in
           (lib.mapAttrs' (_: v: mkManifestRule v) enabledManifests)
-          // (builtins.listToAttrs (map mkImageRule cfg.images))
+          // (lib.optionalAttrs (cfg.images != [ ]) {
+            "${imageDir}/nixos" = {
+              "L+".argument = "${agentImagesDir}";
+            };
+          })
           // (lib.optionalAttrs (cfg.containerdConfigTemplate != null) {
             ${containerdConfigTemplateFile} = {
               "L+".argument = "${pkgs.writeText "config.toml.tmpl" cfg.containerdConfigTemplate}";

nixos/modules/services/cluster/rancher/k3s.nix

@@ -74,7 +74,7 @@ in
       '';
       description = ''
         List of derivations that provide container images.
-        All images are linked to {file}`${baseModule.paths.imageDir}` before k3s starts and are consequently imported
+        All images are linked into {file}`${baseModule.paths.imageDir}/nixos/` before k3s starts and are consequently imported
         by the k3s agent. Consider importing the k3s airgap images archive of the k3s package in
         use, if you want to pre-provision this node with all k3s container images. This option
         only makes sense on nodes with an enabled agent.

nixos/modules/services/cluster/rancher/rke2.nix

@@ -72,7 +72,7 @@ in
       '';
       description = ''
         List of derivations that provide container images.
-        All images are linked to {file}`${baseModule.paths.imageDir}` before rke2 starts and are consequently imported
+        All images are linked into {file}`${baseModule.paths.imageDir}/nixos/` before rke2 starts and are consequently imported
         by the rke2 agent. Consider importing the rke2 core and CNI image archives of the rke2 package in
         use, if you want to pre-provision this node with all rke2 container images. For a full list of available airgap images, check the
         [source](https://github.com/NixOS/nixpkgs/blob/c8a1939887ee6e5f5aae29ce97321c0d83165f7d/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json).

nixos/modules/services/misc/pghero.nix

@@ -1,159 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.pghero;
-  settingsFormat = pkgs.formats.yaml { };
-  settingsFile = settingsFormat.generate "pghero.yaml" cfg.settings;
-in
-{
-  options.services.pghero = {
-    enable = lib.mkEnableOption "PgHero service";
-    package = lib.mkPackageOption pkgs "pghero" { };
-
-    listenAddress = lib.mkOption {
-      type = lib.types.str;
-      example = "[::1]:3000";
-      description = ''
-        `hostname:port` to listen for HTTP traffic.
-
-        This is bound using the systemd socket activation.
-      '';
-    };
-
-    extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = ''
-        Additional command-line arguments for the systemd service.
-
-        Refer to the [Puma web server documentation] for available arguments.
-
-        [Puma web server documentation]: https://puma.io/puma#configuration
-      '';
-    };
-
-    settings = lib.mkOption {
-      type = settingsFormat.type;
-      default = { };
-      example = {
-        databases = {
-          primary = {
-            url = "<%= ENV['PRIMARY_DATABASE_URL'] %>";
-          };
-        };
-      };
-      description = ''
-        PgHero configuration. Refer to the [PgHero documentation] for more
-        details.
-
-        [PgHero documentation]: https://github.com/ankane/pghero/blob/master/guides/Linux.md#multiple-databases
-      '';
-    };
-
-    environment = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      default = { };
-      description = ''
-        Environment variables to set for the service. Secrets should be
-        specified using {option}`environmentFile`.
-      '';
-    };
-
-    environmentFiles = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        File to load environment variables from. Loaded variables override
-        values set in {option}`environment`.
-      '';
-    };
-
-    extraGroups = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [ "tlskeys" ];
-      description = ''
-        Additional groups for the systemd service.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.sockets.pghero = {
-      unitConfig.Description = "PgHero HTTP socket";
-      wantedBy = [ "sockets.target" ];
-      listenStreams = [ cfg.listenAddress ];
-    };
-
-    systemd.services.pghero = {
-      description = "PgHero performance dashboard for PostgreSQL";
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "pghero.socket" ];
-      after = [
-        "pghero.socket"
-        "network.target"
-      ];
-
-      environment = {
-        RAILS_ENV = "production";
-        PGHERO_CONFIG_PATH = settingsFile;
-      }
-      // cfg.environment;
-
-      serviceConfig = {
-        Type = "notify";
-        WatchdogSec = "10";
-
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            (lib.getExe cfg.package)
-            "--bind-to-activated-sockets"
-            "only"
-          ]
-          ++ cfg.extraArgs
-        );
-        Restart = "always";
-
-        WorkingDirectory = "${cfg.package}/share/pghero";
-
-        EnvironmentFile = cfg.environmentFiles;
-        SupplementaryGroups = cfg.extraGroups;
-
-        DynamicUser = true;
-        UMask = "0077";
-
-        ProtectHome = true;
-        ProtectProc = "invisible";
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectHostname = true;
-        ProtectControlGroups = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        PrivateUsers = true;
-        PrivateDevices = true;
-        RestrictRealtime = true;
-        RestrictNamespaces = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        DeviceAllow = [ "" ];
-        DevicePolicy = "closed";
-        CapabilityBoundingSet = [ "" ];
-        MemoryDenyWriteExecute = true;
-        LockPersonality = true;
-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
-        SystemCallFilter = [ "@system-service" ];
-      };
-    };
-  };
-}

nixos/modules/services/networking/netbird.md

@@ -1,4 +1,4 @@
-# Netbird {#module-services-netbird}
+# Netbird Client {#module-services-netbird}
 
 ## Quickstart {#module-services-netbird-quickstart}
 

nixos/modules/services/networking/netbird/netbird-relay.md

@@ -0,0 +1,92 @@
+# Netbird Relay {#module-services-netbird-relay}
+
+The Relay service forwards encrypted WireGuard traffic between peers that cannot establish a direct P2P connection
+
+For more information, check [external relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays) documentation.
+
+## Quickstart {#module-services-netbird-relay-quickstart}
+
+You can run the relay directly, or behind a reverse proxy, like `traefik`.
+
+To run it directly, you'll have to run it on HTTPS port (443) and it will need the TLS certificates. Which you can configure using the `acme` module.
+
+In the following example, we can see the `traefik` route and the relay configuration.
+The operator should configure the TLS for the domain used by the relay, whether it's via `traefik` itself or using the `acme` module.
+
+```nix
+let
+  relayDomain = "relay.example.com";
+in
+{
+  services.netbird.relay = {
+    enable = true;
+    settings = {
+      listen-address = ":33080";
+      exposed-address = "rels://${relayDomain}:443";
+      log-level = "info";
+      enable-stun = true;
+      stun-ports = [ 3479 ];
+    };
+    openFirewall = true;
+    authSecretFile = "/run/auth_secret";
+  };
+
+  services.traefik = {
+    enable = true;
+    dynamicConfigOptions = {
+      http = {
+        routers = {
+          vpn-relay = {
+            rule = "Host(`${relayDomain}`)";
+            entryPoints = [ "websecure" ];
+            service = "vpn-relay-svc";
+            tls = { };
+          };
+        };
+        services = {
+          vpn-relay-svc = {
+            loadBalancer.servers = [ { url = "http://[::1]:33080"; } ];
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+Finally, you must let `netbird.server` know about the new relay:
+
+```nix
+{ }:
+{
+  services.netbird.server = {
+    # ...other config...
+    management = {
+      # ...other config...
+      settings = {
+        # ...other config...
+        Relay = {
+          Addresses = [ "rels://${relayDomain}:443" ];
+          CredentialsTTL = "24h0m0s";
+          Secret = {
+            _secret = "/run/auth_secret";
+          };
+        };
+      };
+    };
+  };
+}
+```
+Done!
+
+## TLS with Let's Encrypt {#module-services-netbird-relay-tls}
+
+You can expose the netbird relay directly to the internet with TLS. Then you won't need a reverse proxy.
+
+To use TLS, set `settings."letsencrypt-domains"`.
+The relay gets and renews the certificates only when `settings."letsencrypt-domains"` is set.
+
+Certificates are stored on disk, and the services runs as a systemd dynamic user.
+The only writable location is therefore a `StateDirectory`, which can only be under `/var/lib`.
+
+Open the ports `tcp/443` and `tcp/80` manually for the HTTP challenge.

nixos/modules/services/networking/netbird/netbird-relay.nix

@@ -0,0 +1,248 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    types
+    ;
+
+  cfg = config.services.netbird.relay;
+  cmd = getExe' cfg.package "netbird-relay";
+  derivedLEDataDir = lib.optionalAttrs (
+    cfg.settings ? "letsencrypt-domain" && !cfg.settings ? "letsencrypt-data-dir"
+  ) { "letsencrypt-data-dir" = "/var/lib/netbird-relay"; };
+
+  args = lib.cli.toCommandLineShellGNU { } (cfg.settings // derivedLEDataDir);
+
+  listenPortMatch = builtins.match ".*:([0-9]+)$" cfg.settings.listen-address;
+  listenPort = if listenPortMatch == null then null else lib.toInt (builtins.head listenPortMatch);
+
+  # Checks
+  authSecretSet = cfg.authSecretFile != null;
+  needsPrivPort = listenPort != null && listenPort < 1024;
+  letsencryptEnabled = cfg.settings ? "letsencrypt-domain";
+in
+{
+  options.services.netbird.relay = {
+    enable = lib.mkEnableOption "Netbird's Relay Service";
+    package = lib.mkPackageOption pkgs "netbird-relay" { };
+
+    # as per RFC 0042:
+    settings = lib.mkOption {
+      type = types.submodule {
+        freeformType =
+          with lib.types;
+          nullOr (oneOf [
+            bool
+            str
+            # For --letsencrypt-domains strings
+            (listOf (oneOf [ str ]))
+          ]);
+        options.listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            The host address and port separated by colon where the relay will listen
+          '';
+          default = ":33080";
+        };
+        options.exposed-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Exposed address for peers. Address told to the peers to connect to
+          '';
+          example = "rels://relay.example.com:443";
+        };
+        options.enable-stun = lib.mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable embedded STUN server";
+        };
+        options.stun-ports = lib.mkOption {
+          type = types.listOf types.port;
+          default = [ 3478 ];
+          description = "STUN server UDP ports";
+        };
+        options.log-level = lib.mkOption {
+          type = types.enum [
+            "panic"
+            "fatal"
+            "error"
+            "warn"
+            "info"
+            "debug"
+            "trace"
+          ];
+          default = "info";
+          description = "Log level of the netbird relay service";
+        };
+        options.metrics-port = lib.mkOption {
+          type = types.port;
+          default = 9092;
+          description = "Metrics endpoint http port. Metrics are accessible under host:metrics-port/metrics";
+        };
+        options.health-listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Listen address of healthcheck server
+          '';
+          default = ":9000";
+        };
+      };
+      default = null;
+      description = ''
+        Settings to configure the netbird relay.
+        Converted automatically into cli args, check all the options with `netbird-relay --help`
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to an environmentFile with the netbird relay environment variables.
+        You can find all the variables under [Relay runtime env variables](https://docs.netbird.io/selfhosted/environment-variables#runtime-variables-2).
+
+        WARNING: You must manually open any port configured via environmentFile.
+        If you use an Internet domain privileged port (e.g 443), add CAP_NET_BIND_SERVICE to systemd's CapabilityBoundingSet and AmbientCapabilities
+      '';
+      example = "/run/netbird-relay.env";
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open STUN ports in the firewall for the netbird relay.
+
+        WARNING: You must manually open listen-address port/tcp and port 80/tcp,
+        if you are exposing the relay directly to the internet.
+        Review [set-up-external-relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays)
+      '';
+    };
+
+    authSecretFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to a file containing the auth-secret used by netbird to connect to the relay server.
+        It will populate `NB_AUTH_SECRET`
+      '';
+      example = "/run/auth_secret";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = authSecretSet || cfg.environmentFile != null;
+        message = "services.netbird.relay requires NB_AUTH_SECRET, either set authSecretFile or configure it in environmentFile";
+      }
+      {
+        assertion = !(cfg.settings.auth-secret or null != null);
+        message = "settings.auth-secret puts the secret into the nix store and the cli args. Use relay.authSecretFile instead";
+      }
+      {
+        assertion =
+          !letsencryptEnabled || lib.hasPrefix "/var/lib/" (cfg.settings."letsencrypt-data-dir" or "");
+        message = "settings.letsencrypt-data-dir must be under /var/lib, the only writable location when using DynamidcUser in systemd";
+      }
+      {
+        assertion = !(cfg.settings.enable-stun && cfg.settings.stun-ports == [ ]);
+        message = "Missing stun ports while enable-stun = true";
+      }
+    ];
+
+    systemd.services.netbird-relay = {
+      description = "Relay for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+      after = [
+        "network.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        ${lib.optionalString authSecretSet ''
+          export NB_AUTH_SECRET="$(< "$CREDENTIALS_DIRECTORY/auth_secret")"
+        ''}
+        exec ${cmd} ${args}
+      '';
+      unitConfig = {
+        # Spread the restart
+        StartLimitIntervalSec = 60;
+        StartLimitBurst = 10;
+      };
+      serviceConfig = {
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+
+        # Let systemd ingest the secret safely
+        LoadCredential = lib.mkIf authSecretSet "auth_secret:${cfg.authSecretFile}";
+
+        Restart = "always";
+        RestartSec = "5s";
+
+        StateDirectory = lib.mkIf letsencryptEnabled (
+          lib.removeSuffix "/" (lib.removePrefix "/var/lib/" cfg.settings."letsencrypt-data-dir")
+        );
+
+        # Hardening::Start
+        # Dynamic user automatically sets:
+        #   NoNewPrivileges = true;
+        #   RemoveIPC = true;
+        #   RestrictSUIDSGID = true;
+        #   ProtectSystem = "strict";
+        #   ProtectHome = "read-only";
+        # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+        DynamicUser = true;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        # Relay is mostly stateless, no need to give access to any of this:
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallFilter = [ "@system-service" ];
+        SystemCallArchitectures = "native";
+
+        # If a user wants to bind netbird to 443, we must allow binding to
+        # a socket to Internet domain privileged ports
+        CapabilityBoundingSet = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+
+        # Use only IP, no socket needed
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        UMask = "0077";
+        # Hardening::End
+      };
+    };
+    networking.firewall.allowedUDPPorts = lib.mkIf (
+      cfg.openFirewall && cfg.settings.enable-stun
+    ) cfg.settings.stun-ports;
+  };
+
+  meta = {
+    doc = ./netbird-relay.md;
+    maintainers = [
+      lib.maintainers.woile
+    ];
+  };
+}

nixos/tests/all-tests.nix

@@ -573,6 +573,7 @@ in
   documize = runTest ./documize.nix;
   docuseal-psql = runTest ./docuseal-postgres.nix;
   docuseal-sqlite = runTest ./docuseal-sqlite.nix;
+  docuum = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docuum.nix;
   doh-proxy-rust = runTest ./doh-proxy-rust.nix;
   dokuwiki = runTest ./dokuwiki.nix;
   dolibarr = runTest ./dolibarr.nix;
@@ -1240,6 +1241,7 @@ in
   nebula.reload = runTest ./nebula/reload.nix;
   neo4j = runTest ./neo4j.nix;
   netbird = runTest ./netbird.nix;
+  netbird-relay = runTest ./netbird-relay.nix;
   netbox = runTest ./web-apps/netbox/default.nix;
   netdata = runTest ./netdata.nix;
   netfoil = runTest ./netfoil.nix;
@@ -1461,7 +1463,6 @@ in
   pgadmin4 = runTest ./pgadmin4.nix;
   pgbackrest = import ./pgbackrest { inherit runTest; };
   pgbouncer = runTest ./pgbouncer.nix;
-  pghero = runTest ./pghero.nix;
   pgmanage = runTest ./pgmanage.nix;
   pgweb = runTest ./pgweb.nix;
   phosh = runTest ./phosh.nix;

nixos/tests/docuum.nix

@@ -0,0 +1,58 @@
+{ pkgs, lib, ... }:
+{
+  name = "docuum";
+  meta.maintainers = [ lib.maintainers.h7x4 ];
+
+  containers.machine = {
+    virtualisation.docker.enable = true;
+
+    services.docuum = {
+      enable = true;
+      threshold = "5 MB";
+      keep = [ "^keep-me:" ];
+    };
+  };
+
+  testScript =
+    let
+      # Each image is 2 MB, so the third non-exempt image should be evicted.
+      imageSizeKb = 2 * 1024;
+
+      mkTestImage =
+        name:
+        pkgs.dockerTools.buildImage {
+          inherit name;
+          tag = "test";
+          copyToRoot = pkgs.runCommand "docuum-test-data-${name}" { } ''
+            mkdir -p $out
+            echo "${name}" > $out/name
+            dd if=/dev/zero of=$out/data bs=1024 count=${toString imageSizeKb}
+          '';
+        };
+
+      images = {
+        keepMe = mkTestImage "keep-me";
+        old = mkTestImage "old-image";
+        new = mkTestImage "new-image";
+      };
+    in
+    ''
+      start_all()
+
+      machine.wait_for_unit("docker.service")
+      machine.wait_for_unit("docuum.service")
+      machine.wait_until_succeeds("journalctl -u docuum --grep 'Listening for Docker events'")
+
+      machine.succeed(
+          "docker load < ${images.keepMe}",
+          "docker load < ${images.old}",
+          "docker load < ${images.new}",
+      )
+
+      machine.wait_until_fails("docker image inspect old-image:test")
+      machine.succeed(
+          "docker image inspect keep-me:test",
+          "docker image inspect new-image:test",
+      )
+    '';
+}

nixos/tests/lomiri.nix

@@ -88,6 +88,7 @@ let
 
   sharedTestFunctions = lib: ''
     from collections.abc import Callable
+    import datetime
     import tempfile
     import subprocess
 
@@ -140,7 +141,7 @@ let
       with machine.nested("Waiting for the screen to have terminalTextColor {} on it:".format(terminalTextColor)):
         retry(check_for_color(terminalTextColor))
       with machine.nested("Ensuring terminalTextColor {} stays present on the screen:".format(terminalTextColor)):
-        retry(fn=check_for_color_continued_presence(terminalTextColor), timeout_seconds=5)
+        retry(fn=check_for_color_continued_presence(terminalTextColor), timeout=datetime.timedelta(seconds=5))
 
     def change_tty_back_forth(ttynumMain: int, ttynumDiff: int) -> None:
       """
@@ -148,9 +149,9 @@ let
       """
 
       machine.send_key(f"ctrl-alt-f{ttynumDiff}")
-      machine.sleep(10)
+      machine.sleep(datetime.timedelta(seconds=10))
       machine.send_key(f"ctrl-alt-f{ttynumMain}")
-      machine.sleep(10)
+      machine.sleep(datetime.timedelta(seconds=10))
 
     def ensure_greeter_launched() -> None:
       """
@@ -189,7 +190,7 @@ let
       with machine.nested("Waiting for the screen to have launcherColor {} on it:".format(launcherColor)):
         retry(check_for_color(launcherColor))
       with machine.nested("Ensuring launcherColor {} stays present on the screen:".format(launcherColor)):
-        retry(fn=check_for_color_continued_presence(launcherColor), timeout_seconds=30)
+        retry(fn=check_for_color_continued_presence(launcherColor), timeout=datetime.timedelta(seconds=30))
 
       # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that launcher button is still shown
       change_tty_back_forth(ttynumMain, ttynumDiff)
@@ -198,7 +199,7 @@ let
 
       # First input seems to get dropped while Mir registers the new input device. Send a key that does nothing, to get that out of the way, and sleep a tiny bit for registration to finish.
       machine.send_key("left")
-      machine.sleep(3)
+      machine.sleep(datetime.timedelta(seconds=3))
 
       machine.screenshot("lomiri_launched")
 
@@ -207,7 +208,7 @@ let
       Wait for on-screen text, and try to optimise retry count for slow hardware.
       """
 
-      machine.sleep(30)
+      machine.sleep(datetime.timedelta(seconds=30))
       machine.wait_for_text(text)
 
     def toggle_maximise() -> None:
@@ -220,9 +221,9 @@ let
       # For some reason, Lomiri in these VM tests very frequently opens the starter menu a few seconds after sending the above.
       # Because this isn't 100% reproducible all the time, and there is no command to await when OCR doesn't pick up some text,
       # the best we can do is send some Escape input after waiting some arbitrary time and hope that it works out fine.
-      machine.sleep(5)
+      machine.sleep(datetime.timedelta(seconds=5))
       machine.send_key("esc")
-      machine.sleep(5)
+      machine.sleep(datetime.timedelta(seconds=5))
 
     def mouse_click(xpos, ypos) -> None:
       """
@@ -231,11 +232,11 @@ let
 
       # Move
       machine.execute(f"ydotool mousemove --absolute -- {xpos} {ypos}")
-      machine.sleep(2)
+      machine.sleep(datetime.timedelta(seconds=2))
 
       # Click (C0 - left button: down & up)
       machine.execute("ydotool click 0xC0")
-      machine.sleep(2)
+      machine.sleep(datetime.timedelta(seconds=2))
 
     def open_starter() -> None:
       """
@@ -672,10 +673,10 @@ in
                   machine.send_chars("run0 touch /tmp/polkit-test\n")
                   # There's an authentication notification here that gains focus, but we struggle with OCRing it
                   # Just hope that it's up after a short wait
-                  machine.sleep(10)
+                  machine.sleep(datetime.timedelta(seconds=10))
                   machine.screenshot("polkit_agent")
                   machine.send_chars("${password}")
-                  machine.sleep(2) # Hopefully enough delay to make sure all the password characters have been registered? Maybe just placebo
+                  machine.sleep(datetime.timedelta(seconds=2)) # Hopefully enough delay to make sure all the password characters have been registered? Maybe just placebo
                   machine.send_chars("\n")
                   machine.wait_for_file("/tmp/polkit-test", 10)
 
@@ -732,7 +733,7 @@ in
               machine.send_key("tab")
               machine.send_key("ret")
 
-              machine.sleep(2) # sleep a tiny bit so gallery can close & the focus can return to LSS
+              machine.sleep(datetime.timedelta(seconds=2)) # sleep a tiny bit so gallery can close & the focus can return to LSS
               machine.send_key("alt-f4")
         '';
     }
@@ -824,9 +825,9 @@ in
                 machine.wait_for_console_text('SET KEYMAP "us"')
 
                 # Handle keybind fallout
-                machine.sleep(10) # wait for everything to settle
+                machine.sleep(datetime.timedelta(seconds=10)) # wait for everything to settle
                 machine.send_key("esc") # close launcher in case it was opened
-                machine.sleep(2) # wait for animation to finish
+                machine.sleep(datetime.timedelta(seconds=2)) # wait for animation to finish
                 # Make sure input leaks are gone
                 machine.send_key("backspace")
                 machine.send_key("backspace")

nixos/tests/netbird-relay.nix

@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+{
+  name = "netbird-relay";
+
+  meta.maintainers = [
+    pkgs.lib.maintainers.woile
+  ];
+
+  nodes = {
+    relay = {
+      environment.systemPackages = [
+        pkgs.coturn
+      ];
+      networking.hosts = {
+        "127.0.0.1" = [ "relay.example.com" ];
+      };
+      systemd.tmpfiles.rules = [
+        "d /run/ 0755 root root -"
+        "f /run/auth_secret 0600 root root - super-secret-token"
+      ];
+
+      services.netbird.relay = {
+        enable = true;
+        settings = {
+          listen-address = ":33080";
+          # rel -> http ; rels -> https
+          exposed-address = "rel://relay.example.com:33080";
+          log-level = "info";
+          enable-stun = true;
+          stun-ports = [ 3479 ];
+          health-listen-address = ":9000";
+        };
+        authSecretFile = "/run/auth_secret";
+      };
+    };
+  };
+
+  testScript = ''
+    # Wait for service to start
+    relay.start()
+    relay.wait_for_unit("netbird-relay.service")
+
+    # Wait for TCP ports to be open an active
+    relay.wait_for_open_port(9000)
+    relay.wait_for_open_port(33080)
+
+    # Test the STUN port (UDP)
+    relay.wait_until_succeeds("turnutils_stunclient -p 3479 127.0.0.1", timeout=10)
+
+    # assert on health
+    relay.succeed("curl -f http://127.0.0.1:9000/health")
+  '';
+}

nixos/tests/pghero.nix

@@ -1,68 +0,0 @@
-let
-  pgheroPort = 1337;
-  pgheroUser = "pghero";
-  pgheroPass = "pghero";
-in
-{ lib, ... }:
-{
-  name = "pghero";
-  meta.maintainers = [ lib.maintainers.tie ];
-
-  nodes.machine =
-    { config, ... }:
-    {
-      services.postgresql = {
-        enable = true;
-        # This test uses default peer authentication (socket and its directory is
-        # world-readably by default), so we essentially test that we can connect
-        # with DynamicUser= set.
-        ensureUsers = [
-          {
-            name = "pghero";
-            ensureClauses.superuser = true;
-          }
-        ];
-      };
-      services.pghero = {
-        enable = true;
-        listenAddress = "[::]:${toString pgheroPort}";
-        settings = {
-          databases = {
-            postgres.url = "<%= ENV['POSTGRES_DATABASE_URL'] %>";
-            nulldb.url = "nulldb:///";
-          };
-        };
-        environment = {
-          PGHERO_USERNAME = pgheroUser;
-          PGHERO_PASSWORD = pgheroPass;
-          POSTGRES_DATABASE_URL = "postgresql:///postgres?host=/run/postgresql";
-        };
-      };
-    };
-
-  testScript = ''
-    pgheroPort = ${toString pgheroPort}
-    pgheroUser = "${pgheroUser}"
-    pgheroPass = "${pgheroPass}"
-
-    pgheroUnauthorizedURL = f"http://localhost:{pgheroPort}"
-    pgheroBaseURL = f"http://{pgheroUser}:{pgheroPass}@localhost:{pgheroPort}"
-
-    def expect_http_code(node, code, url):
-        http_code = node.succeed(f"curl -s -o /dev/null -w '%{{http_code}}' '{url}'")
-        assert http_code.split("\n")[-1].strip() == code, \
-          f"expected HTTP status code {code} but got {http_code}"
-
-    machine.wait_for_unit("postgresql.target")
-    machine.wait_for_unit("pghero.service")
-
-    with subtest("requires HTTP Basic Auth credentials"):
-      expect_http_code(machine, "401", pgheroUnauthorizedURL)
-
-    with subtest("works with some databases being unavailable"):
-      expect_http_code(machine, "500", pgheroBaseURL + "/nulldb")
-
-    with subtest("connects to the PostgreSQL database"):
-      expect_http_code(machine, "200", pgheroBaseURL + "/postgres")
-  '';
-}

nixos/tests/rancher/default.nix

@@ -99,6 +99,7 @@ let
       auto-deploy = mkTests ./auto-deploy.nix;
       configuration = mkTests ./configuration.nix;
       etcd = mkTests ./etcd.nix;
+      image-upgrade = mkTests ./image-upgrade.nix;
       multi-node = mkTests ./multi-node.nix;
       single-node = mkTests ./single-node.nix;
     };

nixos/tests/rancher/image-upgrade.nix

@@ -0,0 +1,118 @@
+# Tests that a container image whose contents change (same name and tag)
+# is detected and re-imported by the cluster.
+# It only declares the image change (via a NixOS specialisation) and checks
+# the end result (the pod output); it never inspects how the image is linked.
+{
+  pkgs,
+  lib,
+  rancherDistro,
+  rancherPackage,
+  serviceName,
+  disabledComponents,
+  coreImages,
+  vmResources,
+  ...
+}:
+let
+  containerdSocket =
+    {
+      k3s = "/run/k3s/containerd/containerd.sock";
+      rke2 = "/run/rke2/containerd/containerd.sock";
+    }
+    .${rancherDistro};
+
+  # Build a Docker image with a fixed name but an auto-generated tag based on
+  # the derivation hash. Two derivations with different contents produce
+  # different tags, so the cluster treats them as distinct images.
+  mkTestImage =
+    commandOutput:
+    pkgs.dockerTools.buildImage {
+      name = "test.local/test";
+      compressor = "zstd";
+      copyToRoot = pkgs.busybox;
+      config = {
+        Entrypoint = [ "sh" ];
+        Cmd = [
+          "-c"
+          "echo '${commandOutput}'"
+        ];
+      };
+    };
+
+  testImageV1 = mkTestImage "image v1 deployed";
+  testImageV2 = mkTestImage "image v2 deployed";
+in
+{
+  name = "${rancherPackage.name}-image-upgrade";
+  interactive.sshBackdoor.enable = true;
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../../modules/profiles/base.nix ];
+
+      environment.systemPackages = with pkgs; [
+        kubectl
+        cri-tools
+      ];
+      environment.sessionVariables.KUBECONFIG = "/etc/rancher/${rancherDistro}/${rancherDistro}.yaml";
+
+      virtualisation = vmResources;
+
+      services.${rancherDistro} = {
+        enable = true;
+        role = "server";
+        package = rancherPackage;
+        disable =
+          {
+            k3s = lib.remove "traefik" disabledComponents;
+            rke2 = lib.remove "rke2-ingress-nginx" disabledComponents;
+          }
+          .${rancherDistro};
+        images =
+          coreImages ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images ++ [ testImageV1 ];
+      };
+
+      # A declaration that swaps the image for one with the same name but a
+      # different auto-generated tag and different contents. Switching to this
+      # specialisation is the only thing the test does to trigger a re-import.
+      specialisation.image-v2 = {
+        inheritParentConfig = true;
+        configuration =
+          { lib, ... }:
+          {
+            services.${rancherDistro}.images = lib.mkForce (
+              coreImages ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images ++ [ testImageV2 ]
+            );
+          };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      def switch_to_v2():
+          toplevel = "${nodes.machine.system.build.toplevel}"
+          machine.succeed(f"{toplevel}/specialisation/image-v2/bin/switch-to-configuration switch")
+
+      machine.wait_for_unit("${serviceName}")
+
+      with subtest("v1 image is imported and runs"):
+          machine.wait_until_succeeds("crictl -r ${containerdSocket} img | grep 'test\\.local/test'")
+          machine.wait_until_succeeds("kubectl get sa default")
+          machine.succeed("kubectl create job test-job --image=${testImageV1.imageName}:${testImageV1.imageTag}")
+          machine.wait_until_succeeds("kubectl wait --for=condition=complete job/test-job --timeout=180s")
+          v1_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=test-job --tail=-1").rstrip()
+          t.assertEqual(v1_output, "image v1 deployed", f"unexpected v1 output: {v1_output!r}")
+
+      with subtest("Same-name image with different auto-generated tag is re-imported"):
+          machine.succeed("kubectl delete job test-job --ignore-not-found=true")
+          switch_to_v2()
+          machine.succeed("kubectl create job test-job --image=${testImageV2.imageName}:${testImageV2.imageTag}")
+          machine.wait_until_succeeds("kubectl wait --for=condition=complete job/test-job --timeout=240s")
+          v2_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=test-job --tail=-1").rstrip()
+          t.assertEqual(v2_output, "image v2 deployed", f"unexpected v2 output: {v2_output!r}")
+    '';
+
+  meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;
+}

nixos/tests/redis.nix

@@ -4,12 +4,8 @@
   package,
   ...
 }:
-let
-  mkTestName =
-    pkg: "${pkg.pname}_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
-in
 {
-  name = mkTestName package;
+  name = package.pname;
   meta.maintainers = lib.teams.redis.members;
 
   nodes = {

pkgs/applications/editors/vim/plugins/generated.nix

@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-12";
+    version = "0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "05e938c0aa5dfbdbb11972fa4c8a85f27f402ba0";
-      hash = "sha256-p+h2y42PRUM1ZPIlBe31/n7IPmh3oEiWgL3HuoUI8Yg=";
+      rev = "ab094b7f788231fe9b68deac78c3d512302c58a6";
+      hash = "sha256-AKGx8ubYHhDireMwOcimvr7zpM1sjytkaRHtguAfVLo=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1135,12 +1135,12 @@ final: prev: {
 
   async-nvim = buildVimPlugin {
     pname = "async.nvim";
-    version = "0-unstable-2026-09-03";
+    version = "0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "async.nvim";
-      rev = "ca8f5696c45bd4786b8840923d86b6932ce92ded";
-      hash = "sha256-dUP9knuzL4qiXdbcjil3Yu5Ve3sVL1DSKJbEY5FwDpA=";
+      rev = "15f28ec323a75f34f317336831c00c2d1b0a7192";
+      hash = "sha256-8S2HNBBwB3c58NudCGrTyBKoQkGDIG0Syravh+sl/Dw=";
     };
     meta.homepage = "https://github.com/lewis6991/async.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-11";
+    version = "0.0.82-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "90b55f067595e7f9dd920c957d6345f434f32dd2";
-      hash = "sha256-6gX6voB7AZhBmG/NYUCEwEm6V5gunT+WHVSvOsZ0Kj4=";
+      rev = "c39eba4cf90254dd9e3ce54f617f07d1853d5da5";
+      hash = "sha256-FMP/UaBSAj29Cei7CDLamtjOAOAqcZLGBYjt/6uQHlI=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.24.1";
+    version = "19.25.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.24.1";
-      hash = "sha256-oihHiKhU093AT5aqvTxJ4wXmH+pMKFJ5zgzUo5SJ/Yw=";
+      tag = "v19.25.0";
+      hash = "sha256-PTvllgZji45JdW1NW9YmRDJqiEvdmbpeB2QGvu10jbM=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4228,12 +4228,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-09-04";
+    version = "0-unstable-2026-09-14";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "a0689fdab9ad5a46bc8730c96a43f215d605f23c";
-      hash = "sha256-ZKju7Pb5GdhWVwF1oXgGt6DXZvyaaQKQHSuKce6P+DI=";
+      rev = "735596a7ec4f4984c90827f8e1100e320eb14cba";
+      hash = "sha256-igRYHOoBBz7R5aUuxPkaAfmTH6TYSXMNV2pBTcT5Pe0=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -4816,12 +4816,12 @@ final: prev: {
 
   demicolon-nvim = buildVimPlugin {
     pname = "demicolon.nvim";
-    version = "2.0-unstable-2026-06-20";
+    version = "2.0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "mawkler";
       repo = "demicolon.nvim";
-      rev = "153444f17494e2ff6ab7d226e6173c1841b1130a";
-      hash = "sha256-gBGJphvT1AXN/UImrSWiWhhzcQt4i68Vbwtr9jXipwo=";
+      rev = "d4bc516cc346202eb7f933b38e47534d41769f46";
+      hash = "sha256-N60NIspY5QspqvqfndU74jJDClm7uBL5VpKwnamuodM=";
     };
     meta.homepage = "https://github.com/mawkler/demicolon.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5490,12 +5490,12 @@ final: prev: {
 
   easy-dotnet-nvim = buildVimPlugin {
     pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-09-10";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "GustavEikaas";
       repo = "easy-dotnet.nvim";
-      rev = "bde7a1cf7c4dbad61d68b2ca41672bfe194b06f8";
-      hash = "sha256-/1FzQEXnPOl+jcj0QQ04u9lJgmDb2Ejhy3KurFpkCnU=";
+      rev = "df600029a54754d90ac35fe284b3921bb7bf1023";
+      hash = "sha256-1F1IXv3lNC7PP+fQESrQtx/7YTrMgl2SGRIAZzuxUQI=";
     };
     meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5799,12 +5799,12 @@ final: prev: {
 
   executor-nvim = buildVimPlugin {
     pname = "executor.nvim";
-    version = "0-unstable-2025-08-15";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "google";
       repo = "executor.nvim";
-      rev = "56dfbe6f7fbf4a6ba7e5934df2d95810e0235f64";
-      hash = "sha256-FdcOzT3LgJBifXdEAzfMtcfrIDlYFcY1RogVxcl3Avk=";
+      rev = "f40ff80b0831c34e8feae92b996477b4bba67764";
+      hash = "sha256-UaBqJzR+s4DgtMJ2JDKhr+jJekPr8LspQvVdfgU9x/8=";
     };
     meta.homepage = "https://github.com/google/executor.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -6753,12 +6753,12 @@ final: prev: {
 
   gitignore-nvim = buildVimPlugin {
     pname = "gitignore.nvim";
-    version = "0-unstable-2025-05-30";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "wintermute-cell";
       repo = "gitignore.nvim";
-      rev = "0344f643768c4d64af4add8c1bdddf6f7d4c9010";
-      hash = "sha256-9Qu+oVOtufvf+ekj2rY+T9c2y7BXh9d7hfl6ZiMYpPY=";
+      rev = "15ed88abbaeb5deffe6d7c6d51af9b6ff784135f";
+      hash = "sha256-45PCvabbqcgasvuFg/g8c/N6XkU43/lmqoATMnvc8NY=";
     };
     meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8125,12 +8125,12 @@ final: prev: {
 
   iron-nvim = buildVimPlugin {
     pname = "iron.nvim";
-    version = "0-unstable-2026-08-30";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "Vigemus";
       repo = "iron.nvim";
-      rev = "1ad44e4e82ad31b7df1cdb7f154c707bfd0d303c";
-      hash = "sha256-59+/yLkvBsAVmYt7HfQYn0A2oPAewAQcNx3XneyKVaQ=";
+      rev = "0168b419bc7df70cd2d97c2ec8158b6b002450b2";
+      hash = "sha256-2oQ4CGcdxVJpubxv+NQLbVk3cW38iP45xX3rAL1ZOl4=";
     };
     meta.homepage = "https://github.com/Vigemus/iron.nvim/";
     meta.license = getLicenseFromSpdxId "BSD-3-Clause";
@@ -11218,12 +11218,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-03";
+    version = "1.4.0-unstable-2026-09-17";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "931000cfab0120191ee914afbbc3f2b02f3533de";
-      hash = "sha256-IfL6Rbp6KIHs/QZ25kPQU2NDTkasYv4B2yiAAmbLSKg=";
+      rev = "54f249a7f1a87a51ff1f559e873daf05e20a454b";
+      hash = "sha256-tpjnVOIaULSgEzPypvKipNWlEbYvtMossbu/yhHgsWY=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -12130,12 +12130,12 @@ final: prev: {
 
   nginx-vim = buildVimPlugin {
     pname = "nginx.vim";
-    version = "1.1.0-unstable-2026-02-09";
+    version = "1.1.0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "chr4";
       repo = "nginx.vim";
-      rev = "a5991f38135d0c6c259d0b9f5e629ba33b891b9e";
-      hash = "sha256-rGqNjdaK5HX6Cad3x+awRLz24PfsA+APWg+vKjWn490=";
+      rev = "3f1ce6c24ba3b5bde979cfac2c017612d7bfd311";
+      hash = "sha256-7UVwoZjyfl2YiNzQnfanoqAmfmZlhRlrbtYxqrBVTGY=";
     };
     meta.homepage = "https://github.com/chr4/nginx.vim/";
     meta.license = unfree;
@@ -12409,12 +12409,12 @@ final: prev: {
 
   notmuch-nvim = buildVimPlugin {
     pname = "notmuch.nvim";
-    version = "0.4.0";
+    version = "0.5.0";
     src = fetchFromGitHub {
       owner = "yousefakbar";
       repo = "notmuch.nvim";
-      tag = "v0.4.0";
-      hash = "sha256-A+vlH8fUNd3/lTH++sp90YXRqe3/uTxOTNw43CJQQyc=";
+      tag = "v0.5.0";
+      hash = "sha256-Q2xxAC10xZFa+xKXnnyJRe5qi/aqZUwp0+l7SIIBriM=";
     };
     meta.homepage = "https://github.com/yousefakbar/notmuch.nvim/";
     meta.license = unfree;
@@ -14671,12 +14671,12 @@ final: prev: {
 
   opencode-nvim = buildVimPlugin {
     pname = "opencode.nvim";
-    version = "1.0.1";
+    version = "1.0.2";
     src = fetchFromGitHub {
       owner = "nickjvandyke";
       repo = "opencode.nvim";
-      tag = "v1.0.1";
-      hash = "sha256-rJz8AtUEgyTMvLd5cMD0wcsaNgW8FmPX1dtLymHM00o=";
+      tag = "v1.0.2";
+      hash = "sha256-AoQXcrIymg2DDHKYQFkV039bFo/AN1QJVevhsIcc/+I=";
     };
     meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15373,12 +15373,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.2.1-1";
+    version = "6.3.0-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.2.1-1";
-      hash = "sha256-jJwnMO5rYhlDp+ykL/72o4fllbtLCxdX+2ZCBJGxtwg=";
+      tag = "v6.3.0-1";
+      hash = "sha256-X8Jd6KtX/oM8Oe1KsRlixfGNAUwfkWfXQO/Xkg7EAqU=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15849,12 +15849,12 @@ final: prev: {
 
   render-markdown-nvim = buildVimPlugin {
     pname = "render-markdown.nvim";
-    version = "8.13.0";
+    version = "8.14.0";
     src = fetchFromGitHub {
       owner = "MeanderingProgrammer";
       repo = "render-markdown.nvim";
-      tag = "v8.13.0";
-      hash = "sha256-ukJUaqEYI60o/lyLM5GaKsRdMW/24IZnzVzPB9/Q/zo=";
+      tag = "v8.14.0";
+      hash = "sha256-pG8lAo4qucIu+gAwrEaK79VkDFTLcuuPBYhq3sg951E=";
     };
     meta.homepage = "https://github.com/MeanderingProgrammer/render-markdown.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18233,6 +18233,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tiny-code-action-nvim = buildVimPlugin {
+    pname = "tiny-code-action.nvim";
+    version = "0-unstable-2026-04-25";
+    src = fetchFromGitHub {
+      owner = "rachartier";
+      repo = "tiny-code-action.nvim";
+      rev = "0d040ed81f7953118b81cd12681fcdfcac069803";
+      hash = "sha256-UF9zeO5Uujdt2MEwy2d2Lhk6JRnEN4vrEvYslv0/zaA=";
+    };
+    meta.homepage = "https://github.com/rachartier/tiny-code-action.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   tiny-devicons-auto-colors-nvim = buildVimPlugin {
     pname = "tiny-devicons-auto-colors.nvim";
     version = "0-unstable-2026-05-29";
@@ -26403,12 +26417,12 @@ final: prev: {
 
   zotcite = buildVimPlugin {
     pname = "zotcite";
-    version = "0.7-unstable-2026-08-24";
+    version = "0.7-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "jalvesaq";
       repo = "zotcite";
-      rev = "282bd8963218f840d7286ce6874bafc7c6b4b535";
-      hash = "sha256-qR2/SLTUw4Mc2KpdPbkPETuvxKpOg6N3Qu3XgrNy48k=";
+      rev = "669110c668cee18565069ed8980c14af7798df0b";
+      hash = "sha256-vOO70rXJMIOH8xdP0z4E5+JU+Nx+NBYdMlYaFkU4XOs=";
     };
     meta.homepage = "https://github.com/jalvesaq/zotcite/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -4655,6 +4655,13 @@ assertNoAdditions {
     };
   });
 
+  tiny-code-action-nvim = super.tiny-code-action-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # test for optional previewer
+      "tiny-code-action.previewers.snacks"
+    ];
+  };
+
   tmux-complete-vim = super.tmux-complete-vim.overrideAttrs {
     # Vim plugin with optional nvim-compe lua module
     nvimSkipModules = [ "compe_tmux" ];

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1300,6 +1300,7 @@ https://github.com/levouh/tint.nvim/,,
 https://github.com/tinted-theming/tinted-nvim/,,
 https://github.com/tinted-theming/tinted-vim/,,
 https://github.com/rachartier/tiny-cmdline.nvim/,,
+https://github.com/rachartier/tiny-code-action.nvim/,,
 https://github.com/rachartier/tiny-devicons-auto-colors.nvim/,,
 https://github.com/rachartier/tiny-glimmer.nvim/,,
 https://github.com/rachartier/tiny-inline-diagnostic.nvim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1391,8 +1391,8 @@ let
         mktplcRef = {
           name = "competitive-programming-helper";
           publisher = "DivyanshuAgrawal";
-          version = "2026.8.1785865132";
-          hash = "sha256-/JVuIOoTgeENtbvYFri1/RtiZ6PCabOrwC1mzHoaML4=";
+          version = "2026.9.1789051951";
+          hash = "sha256-Et8v+Yl51tKTGoKx8rOMW3VscFkfIKwwqcLyw9fmI90=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";

pkgs/applications/editors/vscode/extensions/quarto.quarto/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "quarto";
     publisher = "quarto";
-    version = "1.137.0";
-    hash = "sha256-huXW4duf8MbilHPlYMyMPxMd+s0Gv9BejE20PxcYsjo=";
+    version = "1.138.0";
+    hash = "sha256-xwqs28ihgYnk7lPLjGQGwnG7ig2HLT9ZyCg1jiHpmR8=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/quarto.quarto/changelog";

pkgs/applications/graphics/gimp/default.nix

@@ -83,7 +83,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "3.2.4";
+  version = "3.2.6";
 
   outputs = [
     "out"
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cxK8U+nG0tAFbKe5PxxrmHB5Rt2TT3FMIbh0bstgFYg=";
+    hash = "sha256-QLFekK0MDGMbdto8Rn6phH+lwk83QTrFtJKASGCijNg=";
   };
 
   patches = [

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "chromedriver": {
-      "version": "153.0.8010.37",
-      "hash_darwin": "sha256-IMyEnUmK3slNB/QDZ+vtUyzHyU0AB+L6+BMbpCRluYA=",
-      "hash_darwin_aarch64": "sha256-cd1ZWatLQFIkPtCdVacrxFaFfj3rjG9qJ7kGlL3C6OA="
+      "version": "153.0.8010.48",
+      "hash_darwin": "sha256-/4yv3KWuvKNAro9oeK+PFsTOrg878yS11aDYSX5S890=",
+      "hash_darwin_aarch64": "sha256-5eO1WwJ8iQrXUjHb776Z1YahR/A8aCoX7JrJXQEcIQ8="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -632,8 +632,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -672,8 +672,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -842,8 +842,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -853,7 +853,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "deps": {
       "depot_tools": {
         "rev": "6411ed52842756261c66b6b8ece6b53ade2570f1",
@@ -865,16 +865,16 @@
         "hash": "sha256-qvQ13Ws2tb4i2Hdu34kBHivYPAn8w06zjLdQgK4BIJg="
       },
       "ungoogled-patches": {
-        "rev": "153.0.8010.36-1",
-        "hash": "sha256-JyvizS0oJC8J6VhtnpTKUGVbc31KCvTvwa4TmO+CHaY="
+        "rev": "153.0.8010.47-1",
+        "hash": "sha256-J/IiNmqJzL35TfiGbsqrXnI8lUizCWuxzVBHgo7cG80="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -984,8 +984,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1524,8 +1524,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1694,8 +1694,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix

@@ -0,0 +1,10 @@
+{
+  traefik-crd = {
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-41.4.2+up41.4.0.tgz";
+    sha256 = "0dfvh65gilw4z3cyia8gq0hqgcp09cbdihq6g6n93af9lbpwysnf";
+  };
+  traefik = {
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-41.4.2+up41.4.0.tgz";
+    sha256 = "1379f54pci4y41szpnw016wr6kkawyyr6sfzijdsz3f8fryhp3xp";
+  };
+}

pkgs/applications/networking/cluster/k3s/1_37/images-versions.json

@@ -0,0 +1,26 @@
+{
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "936f0ef6acaacb1950367308fbbe0388244df2ffc2a80cbd99e1f01ddde413e7"
+  },
+  "airgap-images-amd64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0b4ff0d6e233de54be4e16cb5aa298fd53ad88f66ad8ae31093b5ef4dcefcdd0"
+  },
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "b7d9f8e94a28d0f70b8b9d6782f3d3190fe94b0b19fca4554e41ad3dbdee1f3f"
+  },
+  "airgap-images-arm-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "be1628b6beb17937140171374beed94e550a9c3c8ea98eec23ae6f21ca8493f1"
+  },
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "d1b534c7b5b67e06fdea2231813b3adc596ba36d7a63699fec1eb23e3c0baf17"
+  },
+  "airgap-images-arm64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "b3bd28d3a20144927b25ebb1d255a16ce55bb050b9af5e63abd1bf91c0838fe5"
+  }
+}

pkgs/applications/networking/cluster/k3s/1_37/versions.nix

@@ -0,0 +1,21 @@
+{
+  k3sVersion = "1.37.0+k3s1";
+  k3sCommit = "bb7cf0657bafdfbb4349d1740810442d09c2248a";
+  k3sRepoSha256 = "0glzg974w7f0jdaljr9bxw36qv53chii25rjbrvlbzlyzjq19wws";
+  k3sVendorHash = "sha256-AObmRWcIyFDy1aTA66LLFYnnUQzpf6+Ts6HQRA3i26A=";
+  chartVersions = import ./chart-versions.nix;
+  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
+  k3sRootVersion = "0.15.2";
+  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.3.4-k3s1";
+  containerdSha256 = "18kci7drnlxkn4vk166jijavgwaml1vhlfqirhzljmb4g16ydrah";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
+  criCtlVersion = "1.37.0-k3s1";
+  flannelVersion = "v0.28.4";
+  flannelPluginVersion = "v1.9.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s5";
+  helmJobVersion = "v0.13.3-build20260727";
+}

pkgs/applications/networking/cluster/k3s/default.nix

@@ -15,4 +15,5 @@ in
   k3s_1_34 = forVersions ./1_34/versions.nix;
   k3s_1_35 = forVersions ./1_35/versions.nix;
   k3s_1_36 = forVersions ./1_36/versions.nix;
+  k3s_1_37 = forVersions ./1_37/versions.nix;
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -598,13 +598,13 @@
     "vendorHash": "sha256-EikYOTTTkj5E82xza6nYvd1AWFg8fzo1ka2umc+25/k="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-S1fCXg59/+f/QH181Ii8Z4kjYP+qsDYCMiTYYF6J810=",
+    "hash": "sha256-EvcjgQupjAPKkbPObTTXNUsyyo7Udwc6rriD4/K7UhE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v8.1.0",
+    "rev": "v8.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zskGz3bL89H3df4QmwX2JXhHv2K34nHxOLiExeZ7lUY="
+    "vendorHash": "sha256-t3lzDRh0v6vMbw8qLXTOjKNUtaBlXOZkqNO+mJyP9NQ="
   },
   "hashicorp_helm": {
     "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
@@ -670,13 +670,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-0cDJS89LsTuE2MJoNCnG8Xy7pJYisOggKrqQlK4OeAw=",
+    "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.80.0",
+    "rev": "v0.81.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-O+UMVIed8JEwjaXGTewOY6Vk+MopCQSx+qyMvJW7bkI="
+    "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
     "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",
@@ -851,11 +851,11 @@
     "vendorHash": "sha256-BFhxDYfbHNY4omovikg01UDqt2oxCtg9Q85DPuHSUeE="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-bcZ2DGQMCRR5fLn0ixuSk1ghw7xT4GGgEjcqx6zwri8=",
+    "hash": "sha256-DVpsm3adZEwWzgvIFu8pXUGVTch18oW4UdXPQ8XZZb0=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v3.1.4",
+    "rev": "v3.1.5",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-d8RQfuLRNGTUzA2Ygy3QEis5j5Ape5kmcnZSs77c84M="
   },

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -85,8 +85,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "155.0";
-    sha512 = "fe0247ac50d2741a49517fabe729dc990a66e7044f450e4fe6871b663096bcd15f22ed83eea0557106d38eee34e464fead5a7567d0906995ff2a945fae64b60c";
+    version = "156.0";
+    sha512 = "8fd524f9d622f007e9bd5e8bcc440f185427a928a04d3aae14fc476e011ff1c15b68607292624ea4c4e4d596722193dda88e233cdfb6bbf5d05bd180870532ba";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/applications/virtualization/virtualbox/default.nix

@@ -72,9 +72,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.2.16";
+  virtualboxVersion = "7.2.18";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
+  virtualboxSha256 = "06db4060caadc70346335c0a731ca6667cdabf206de289c64f3f96f2d341b9d0";
 
   kvmPatchVboxVersion = "7.2.6";
   kvmPatchVersion = "20260201";

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl rec {
   pname = "virtualbox-extpack";
-  version = "7.2.16";
+  version = "7.2.18";
   name = "Oracle_VirtualBox_Extension_Pack-${version}.vbox-extpack";
   url = "https://download.virtualbox.org/virtualbox/${version}/${name}";
   sha256 =
@@ -13,7 +13,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
     let
-      value = "d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689";
+      value = "e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "c9349c0231d81c821fc1de7b9592bf07bb7c3f111c3f942ddddc211496ef7a3e";
+  sha256 = "346ea2b9ed47bb954464af83835b14bd8afa5fc1864f34e2561ed923fb74981c";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -18,9 +18,9 @@
   libx11,
 }:
 let
-  virtualboxVersion = "7.2.16";
+  virtualboxVersion = "7.2.18";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
+  virtualboxSha256 = "06db4060caadc70346335c0a731ca6667cdabf206de289c64f3f96f2d341b9d0";
 
   platform =
     if stdenv.hostPlatform.isAarch64 then
@@ -98,7 +98,9 @@ stdenv.mkDerivation {
 
   # https://github.com/VirtualBox/virtualbox/issues/812
   postPatch = ''
-    substituteInPlace ./src/vboxguest-${virtualboxVersion}_NixOS/vboxvideo/vbox_fb.c --replace-fail "RTLNX_VER_MIN(6,19,0)" "RTLNX_VER_RANGE(6,6,152, 6,6,999) || RTLNX_VER_RANGE(6,12,103, 6,12,999) || RTLNX_VER_RANGE(6,18,44, 6,18,999) || RTLNX_VER_MIN(6,19,0)"
+    substituteInPlace ./src/vboxguest-${virtualboxVersion}_NixOS/vboxvideo/vbox_fb.c \
+      --replace-fail "RTLNX_VER_MIN(6,19,0) || RTLNX_VER_RANGE(6,12,103, 6,13,0)" \
+      "RTLNX_VER_MIN(6,19,0) || RTLNX_VER_RANGE(6,12,103, 6,13,0) || RTLNX_VER_RANGE(6,6,152, 6,6,999) || RTLNX_VER_RANGE(6,18,44, 6,18,999)"
   '';
 
   buildPhase = ''

pkgs/build-support/node/fetch-yarn-deps/default.nix

@@ -104,6 +104,7 @@ in
           src ? null,
           hash ? "",
           sha256 ? "",
+          mirrorUrl ? null,
           ...
         }@args:
         let
@@ -148,7 +149,9 @@ in
 
               yarnLock=''${yarnLock:=$PWD/yarn.lock}
               mkdir -p $out
-              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock ${
+                lib.optionalString (mirrorUrl != null) "--mirrorUrl ${lib.escapeShellArg mirrorUrl}"
+              })
 
               runHook postBuild
             '';
@@ -161,6 +164,7 @@ in
               "name"
               "hash"
               "sha256"
+              "mirrorUrl"
             ]
             ++ (lib.optional (src == null) "src")
           ))

pkgs/build-support/node/fetch-yarn-deps/index.js

@@ -21,15 +21,27 @@ const exec = async (...args) => {
   return res
 }
 
-const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
+const yarnRegistryUrl = 'https://registry.yarnpkg.com/';
+
+function ensureTrailingSlash(str) {
+  return str.endsWith('/') ? str : str + '/';
+}
+
+const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1', mirrorRegistryUrl = null) => {
+
+  const registryUrl =
+    mirrorRegistryUrl && url.startsWith(yarnRegistryUrl)
+      ? url.replace(yarnRegistryUrl, ensureTrailingSlash(mirrorRegistryUrl))
+      : url;
+
   return new Promise((resolve, reject) => {
-    const get = (url, redirects = 0) => https.get(url, (res) => {
+    const get = (registryUrl, redirects = 0) => https.get(registryUrl, (res) => {
       if(redirects > 10) {
         reject('Too many redirects!');
         return;
       }
       if(res.statusCode === 301 || res.statusCode === 302) {
-        const location = new URL(res.headers.location, url);
+        const location = new URL(res.headers.location, registryUrl);
         if (verbose) console.log('following redirect to ' + location);
         return get(location, redirects + 1);
       }
@@ -41,13 +53,13 @@ const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha
         file.close()
         const h = hash.read()
         if (expectedHash === undefined){
-          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
-        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+          console.log(`Warning: lockfile url ${registryUrl} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${registryUrl}`))
         resolve()
       })
       res.on('error', e => reject(e))
     })
-    get(url)
+    get(registryUrl)
   })
 }
 
@@ -90,7 +102,7 @@ const isGitUrl = pattern => {
   return false
 }
 
-const downloadPkg = (pkg, verbose) => {
+const downloadPkg = (pkg, verbose, mirrorUrl = null) => {
   for (let marker of ['@file:', '@link:']) {
     const split = pkg.key.split(marker)
     if (split.length == 2) {
@@ -122,9 +134,9 @@ const downloadPkg = (pkg, verbose) => {
   } else if (url.startsWith('https://')) {
     if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
       const [ type, checksum ] = pkg.integrity.split('-')
-      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type, mirrorUrl)
     }
-    return downloadFileHttps(fileName, url, hash, verbose)
+    return downloadFileHttps(fileName, url, hash, verbose, 'sha1', mirrorUrl)
   } else if (url.startsWith('file:')) {
     console.warn(`ignoring unsupported file:path url "${url}"`)
   } else {
@@ -155,11 +167,11 @@ const uniqueBy = (arr, callback) => {
   return [...map.values()]
 }
 
-const prefetchYarnDeps = async (lockContents, verbose) => {
+const prefetchYarnDeps = async (lockContents, verbose, mirrorUrl) => {
   const lockData = lockfile.parse(lockContents)
   await performParallel(
     uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
-    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose, mirrorUrl))
   )
   await fs.promises.writeFile('yarn.lock', lockContents)
   if (verbose) console.log('Done')
@@ -173,18 +185,23 @@ Options:
   -h --help         Show this help
   -v --verbose      Verbose output
   --builder         Only perform the download to current directory, then exit
+  --mirrorUrl <url> Use the given registry mirror URL in place of the default
+                    yarn registry (${yarnRegistryUrl})
 `)
   process.exit(1)
 }
 
 const main = async () => {
   const args = process.argv.slice(2)
-  let next, lockFile, verbose, isBuilder
+  let next, lockFile, verbose, isBuilder, mirrorUrl
   while (next = args.shift()) {
     if (next == '--builder') {
       isBuilder = true
     } else if (next == '--verbose' || next == '-v') {
       verbose = true
+    } else if (next == '--mirrorUrl') {
+      mirrorUrl = args.shift()
+      if (!mirrorUrl) showUsage()
     } else if (next == '--help' || next == '-h') {
       showUsage()
     } else if (!lockFile) {
@@ -201,13 +218,13 @@ const main = async () => {
   }
 
   if (isBuilder) {
-    await prefetchYarnDeps(lockContents, verbose)
+    await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
   } else {
     const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
 
     try {
       process.chdir(tmpDir.trim())
-      await prefetchYarnDeps(lockContents, verbose)
+      await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
       const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
       console.log(hash)
     } finally {

pkgs/build-support/node/fetch-yarn-deps/tests/default.nix

@@ -9,6 +9,11 @@
     yarnLock = ./simple.lock;
     sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
   };
+  mirrorUrl = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    mirrorUrl = "https://registry.npmjs.com/";
+    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
+  };
   gitDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
     yarnLock = ./git.lock;
     sha256 = "sha256-f90IiEzHDiBdswWewRBHcJfqqpPipaMg8N0DVLq2e8Q=";

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -11,15 +11,13 @@
 }:
 
 let
-  python = python3.override {
-    self = python;
-    packageOverrides = final: prev: {
-      # The ast-serialize package, a dependency for mypy, depends on
-      # fetchCargoVendor and is part of the bootstrap chain for requests.
-      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+  python3Packages = python3.pkgs // {
+    # Break the requests -> charset-normalizer -> mypy -> ast-serialize ->
+    # fetchCargoVendor bootstrap cycle without overriding the whole Python scope.
+    requests = python3.pkgs.requests.override {
+      charset-normalizer = python3.pkgs.charset-normalizer.override { withMypyc = false; };
     };
   };
-  python3Packages = python.pkgs;
 
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [

pkgs/by-name/_7/_7zip-zstd/package.nix

@@ -119,11 +119,12 @@ stdenv.mkDerivation (finalAttrs: {
     ''
       runHook preInstall
 
+      # Upstream always names this module 7z.so on Unix, including Darwin.
       install -Dt "$out/${if isWindows then "bin" else "lib"}/7zip" \
         CPP/7zip/Bundles/Alone/b/*/7za${extensions.executable} \
         CPP/7zip/Bundles/Alone2/b/*/7zz${extensions.executable} \
         CPP/7zip/Bundles/Alone7z/b/*/7zr${extensions.executable} \
-        CPP/7zip/Bundles/Format7zF/b/*/7z${extensions.sharedLibrary} \
+        CPP/7zip/Bundles/Format7zF/b/*/7z${if isWindows then extensions.sharedLibrary else ".so"} \
         CPP/7zip/UI/Console/b/*/7z${extensions.executable}
       install -D CPP/7zip/Bundles/SFXCon/b/*/7zCon${extensions.executable} "$out/lib/7zip/7zCon.sfx"
 

pkgs/by-name/_7/_7zip-zstd/setup-hook.sh

@@ -3,10 +3,10 @@ unpackCmdHooks+=(_tryUnpackDmg)
 
 _try7zip() {
   if ! [[ $curSrc =~ \.7z$ ]]; then return 1; fi
-  7z x "$curSrc"
+  7z x -snld "$curSrc"
 }
 
 _tryUnpackDmg() {
   if ! [[ $curSrc =~ \.dmg$ ]]; then return 1; fi
-  7z x "$curSrc"
+  7z x -sns- -snld "$curSrc"
 }

pkgs/by-name/_7/_7zz/setup-hook.sh

@@ -1,5 +1,5 @@
 unpackCmdHooks+=(_tryUnpackDmg)
 _tryUnpackDmg() {
     if ! [[ "$curSrc" =~ \.dmg$ ]]; then return 1; fi
-    7zz x "$curSrc"
+    7zz x -sns- -snld "$curSrc"
 }

pkgs/by-name/al/alsa-tools/package.nix

@@ -15,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-tools";
   version = "1.2.15";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://alsa/tools/alsa-tools-${finalAttrs.version}.tar.bz2";
     hash = "sha256-gASY01IzZy72f0v3TMbh034f5wwFQOLS4GLyMZ57Xfc=";
@@ -23,11 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     pkg-config
+    fltk_1_3
   ];
 
   buildInputs = [
     alsa-lib
-    fltk_1_3
     gtk3
     gtk4
     psmisc

pkgs/by-name/am/amnezia-vpn/disable-conan-runtime-bundling.patch

@@ -1,6 +1,8 @@
+diff --git a/service/server/CMakeLists.txt b/service/server/CMakeLists.txt
+index 4cc47168..b7840b4d 100644
 --- a/service/server/CMakeLists.txt
 +++ b/service/server/CMakeLists.txt
-@@ -341,56 +341,6 @@
+@@ -341,115 +341,6 @@ if(APPLE)
      )
  endif()
  
@@ -32,6 +34,30 @@
 -        ${CONAN_EXECS} ${CONAN_BINS}
 -        "$<TARGET_FILE_DIR:${PROJECT}>"
 -)
+-
+-# prebuilt openvpn carries the rpath of whatever machine baked it; point the
+-# build-tree copy at the local conan openssl (install rewrites it to $ORIGIN)
+-if(LINUX)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-        CONTENT "file(RPATH_SET FILE \"$<TARGET_FILE_DIR:${PROJECT}>/openvpn\" NEW_RPATH \"$<TARGET_FILE_DIR:OpenSSL::SSL>\")\n"
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-elseif(APPLE)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake CONTENT
+-[=[
+-set(ovpn "$<TARGET_FILE_DIR:AmneziaVPN-service>/openvpn")
+-set(dir "$<TARGET_FILE_DIR:OpenSSL::SSL>")
+-execute_process(COMMAND install_name_tool -delete_rpath "${dir}" "${ovpn}" ERROR_QUIET)
+-execute_process(COMMAND install_name_tool -add_rpath "${dir}" "${ovpn}")
+-]=]
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-endif()
+-
 -if(WIN32)
 -    # using PERMISSIONS on Windows appends read-only flag
 -    # to the files so just omit it for it
@@ -40,7 +66,11 @@
 -        COMPONENT AmneziaVPN
 -    )
 -else()
--    install(FILES ${CONAN_EXECS}
+-    set(CONAN_EXECS_INSTALL ${CONAN_EXECS})
+-    if(LINUX)
+-        list(REMOVE_ITEM CONAN_EXECS_INSTALL "$<TARGET_FILE:openvpn::openvpn>")
+-    endif()
+-    install(FILES ${CONAN_EXECS_INSTALL}
 -        DESTINATION ${CMAKE_INSTALL_BINDIR}
 -        COMPONENT AmneziaVPN
 -        PERMISSIONS
@@ -53,6 +83,37 @@
 -    DESTINATION ${CMAKE_INSTALL_BINDIR}
 -    COMPONENT AmneziaVPN
 -)
+-
+-# install openvpn via the service's dep set to ship its openssl, then
+-# rewrite conan's absolute build rpath to a relative one for the package
+-if(LINUX)
+-    install(IMPORTED_RUNTIME_ARTIFACTS openvpn::openvpn
+-        RUNTIME_DEPENDENCY_SET service_deps
+-        PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE
+-            GROUP_READ GROUP_EXECUTE
+-            WORLD_READ WORLD_EXECUTE
+-        COMPONENT AmneziaVPN
+-    )
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-        file(RPATH_SET FILE \"\${_ovpn}\" NEW_RPATH \"$ORIGIN:$ORIGIN/../lib\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-elseif(APPLE)
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        execute_process(COMMAND install_name_tool -delete_rpath \"$<TARGET_FILE_DIR:OpenSSL::SSL>\" \"\${_ovpn}\" ERROR_QUIET)
+-        execute_process(COMMAND install_name_tool -add_rpath \"@executable_path/../Frameworks\" \"\${_ovpn}\")
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-endif()
 -
  # install drivers
  if (WIN32)

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -22,13 +22,13 @@ let
   # Even minor updates can break VPN connections without failing the build.
   amneziawg-go-pinned = amneziawg-go.overrideAttrs (
     finalAttrs: _: {
-      version = "3.0.1";
+      version = "3.1.20260814";
 
       src = fetchFromGitHub {
         owner = "amnezia-vpn";
         repo = "amneziawg-go";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-wtjUJSTDWWgJLedyQPlPa+TtOztciyDWIbyZ24N5ELM=";
+        hash = "sha256-HMmbKd1wYzotB+GAZ8GulyJmX7+XUnXOEerab0OCPO8=";
       };
 
       vendorHash = "sha256-Y2dCwlKMVLrkzDcNKyCPxFJwMbCA2mQKkakvzwbamCY=";
@@ -84,7 +84,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "5.0.0.5";
+  version = "5.0.1.5";
 
   __structuredAttrs = true;
 
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-knQgGyNkOV9CX1I0hJ8xEMRENBV35E2DwWUOgby3iUo=";
+    hash = "sha256-pSuKAv/Vy4k9kCotIzN1g5NbnyUG/6hDeuQQcGOt5Ow=";
     fetchSubmodules = true;
     # Preserve VCS metadata needed by the build before .git is removed.
     postCheckout = ''

pkgs/by-name/am/amnezia-vpn/xray-lib.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amnezia-xray";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-xray-bindings";
     tag = "v${version}";
-    hash = "sha256-kGtRw5Ic/++1ehwLToZ96WfC3ULp+DIsPYArqjL06ck=";
+    hash = "sha256-lvU3bDzd5kgYl5DjdglnQzgjPwhtczxWu6LyxeVvVXE=";
   };
 
-  vendorHash = "sha256-JAHpQUMQT6tJKwGld0QCobDxgLVujA4KHkhOLXHS65w=";
+  vendorHash = "sha256-L05GHzj9lyFAm9JgR8ZDQf+2auumug6PcoD1F4ozk3E=";
 
   env.CGO_ENABLED = 1;
 

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-08-31";
+  version = "0-unstable-2026-09-08";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "7870e04fb5b1dfc57dc3ed4e576459246f826149";
-    hash = "sha256-06sKcoJQoYvfGDKkAmlBhDiApg8IDXn8BUmihZsWr/4=";
+    rev = "03ef03fbf7e834385377432ccecaedd32e3414bb";
+    hash = "sha256-7aM+IsRctA/XIYVkqpljf4kHttoUtG9t/FO+Ium1XaM=";
   };
 
   dontConfigure = true;

pkgs/by-name/an/anda/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "anda";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "FyraLabs";
     repo = "anda";
     tag = finalAttrs.version;
-    hash = "sha256-QPB5wLuvCf/bLkqZqsPkvfCeOmiHUtxzbIa3lWMjWoo=";
+    hash = "sha256-Uch/QFHmqgxtv1tDwBK5lEPYGf8fS1h3hcKzSNITFHg=";
   };
 
-  cargoHash = "sha256-Qh4tVzMU7VI//+3AsK9r7+WlxBAGzG/QnBsvrMxgudM=";
+  cargoHash = "sha256-VaP4eAgg8cLMOX6b1a5/QTHF+K9a+jD+FmgUZScjFtI=";
 
   __structuredAttrs = true;
 

pkgs/by-name/an/antigravity-acp/package.nix

@@ -4,6 +4,8 @@
   fetchurl,
   unzip,
   autoPatchelfHook,
+  makeBinaryWrapper,
+  cacert,
 }:
 let
   sources = {
@@ -35,6 +37,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     unzip
+    makeBinaryWrapper
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
@@ -53,11 +56,16 @@ stdenv.mkDerivation {
     install -m755 agy_acp_server.par $out/bin/agy_acp_server.par
     install -m555 localharness_external $out/bin/localharness_external
 
-    ln -s $out/bin/agy_acp_server.par $out/bin/agy_acp_server
+    ln -s agy_acp_server.par $out/bin/agy_acp_server
 
     runHook postInstall
   '';
 
+  postFixup = ''
+    wrapProgram $out/bin/agy_acp_server.par \
+      --set-default SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+  '';
+
   meta = {
     description = "Google's AI coding agent. Official ACP server powered by Antigravity";
     homepage = "https://antigravity.google/docs/ide/extensions";

pkgs/by-name/ap/apt/package.nix

@@ -11,10 +11,7 @@
   doxygen,
   dpkg,
   gettext,
-  gnutls,
   gtest,
-  libgcrypt,
-  libgpg-error,
   libseccomp,
   libtasn1,
   libxslt,
@@ -75,10 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     db
     dpkg
-    gnutls
     gtest
-    libgcrypt
-    libgpg-error
     libseccomp
     libtasn1
     lz4
@@ -96,7 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeOptionType "filepath" "BERKELEY_INCLUDE_DIRS" "${lib.getDev db}/include")
     (lib.cmakeOptionType "filepath" "DPKG_DATADIR" "${dpkg}/share/dpkg")
     (lib.cmakeOptionType "filepath" "DOCBOOK_XSL" "${docbook_xsl}/share/xml/docbook-xsl")
-    (lib.cmakeOptionType "filepath" "GNUTLS_INCLUDE_DIR" "${lib.getDev gnutls}/include")
     (lib.cmakeFeature "DROOT_GROUP" "root")
     (lib.cmakeBool "USE_NLS" withNLS)
     (lib.cmakeBool "WITH_DOC" withDocs)

pkgs/by-name/ar/art/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "art";
-  version = "1.26.8";
+  version = "1.26.9";
 
   src = fetchFromGitHub {
     owner = "artraweditor";
     repo = "ART";
     tag = finalAttrs.version;
-    hash = "sha256-kgDmGxdmKK/19vxruTQ0845iaRSWthlkYoeAFVaju2U=";
+    hash = "sha256-C4mA16FX+3LUeGtDaJnQdcVFoKpPGC4asYv0GKjbTJo=";
   };
 
   # Fix the build with CMake 4.

pkgs/by-name/au/aurral/package.nix

@@ -16,7 +16,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "aurral";
-  version = "2.8.0";
+  version = "2.9.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
     owner = "lklynet";
     repo = "aurral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
   };
 
   # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
     ./package.json.patch
   ];
 
-  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+  npmDepsHash = "sha256-NVz5eqDDtMBKiTDl3aX0pHBYGTcYal8lmCf8mbKu31I=";
 
   nodejs = nodejs_26;
 

pkgs/by-name/au/ausaxs/cmake-no-fetchcontent.patch

@@ -1,36 +1,36 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -110,7 +110,7 @@
- 	set(DLIB_USE_MKL_FFT OFF)
- 	set(DLIB_USE_FFMPEG OFF)
- 	set(CMAKE_CXX_STANDARD 17) # dlib must be compiled with C++17
--	FetchContent_MakeAvailable(dlib)
-+	add_subdirectory(dlib)
- 	set(CMAKE_CXX_STANDARD 20) # continue with C++20	
+@@ -75,7 +75,7 @@
+ 		set(DLIB_USE_MKL_FFT OFF)
+ 		set(DLIB_USE_FFMPEG OFF)
+ 		set(CMAKE_CXX_STANDARD 17) # dlib must be compiled with C++17
+-		FetchContent_MakeAvailable(dlib)
++		add_subdirectory(dlib)
+ 		set(CMAKE_CXX_STANDARD 20) # continue with C++20
+ 	endif()
  	add_compile_definitions("DLIB_AVAILABLE")
- endif()
-@@ -141,7 +141,6 @@
+@@ -106,7 +106,6 @@
  		thread_pool
  		GIT_REPOSITORY https://github.com/bshoshany/thread-pool
  	)
 -	FetchContent_MakeAvailable(thread_pool)
+ 	set(BS_THREAD_POOL_INCLUDE_DIR ${thread_pool_SOURCE_DIR}/include)
  endif()
  
- if(USE_SYSTEM_GCEM)
-@@ -151,7 +150,6 @@
+@@ -121,7 +120,6 @@
  		gcem
  		GIT_REPOSITORY https://github.com/klytje/gcem
  	)
 -	FetchContent_MakeAvailable(GCEM)
+ 	set(GCEM_INCLUDE_DIR ${gcem_SOURCE_DIR}/include)
  endif()
  
- set_property(
-@@ -160,7 +158,9 @@
+@@ -131,7 +129,9 @@
  )
  unset(compile_options)
  
--include_directories(${thread_pool_SOURCE_DIR}/include ${gcem_SOURCE_DIR}/include ${backward_SOURCE_DIR})
-+include_directories(${backward_SOURCE_DIR})
+-include_directories(${BS_THREAD_POOL_INCLUDE_DIR} ${GCEM_INCLUDE_DIR} ${BACKWARD_INCLUDE_DIR})
++include_directories(${BACKWARD_INCLUDE_DIR})
 +add_subdirectory(gcem)
 +include_directories(thread_pool/include gcem/include)
  

pkgs/by-name/au/ausaxs/package.nix

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausaxs";
-  version = "1.2.8";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "AUSAXS";
     repo = "AUSAXS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-elzkFzLyECiDuA8TokA8/wUYBZisKY1IRxQmikMn2f4=";
+    hash = "sha256-H3lozYImLNwQ7FYz3idgBX/o3miSyUxdZ+ZlJQP2Xms=";
   };
 
   patches = [ ./cmake-no-fetchcontent.patch ];

pkgs/by-name/av/avbroot/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.34.0";
+  version = "3.34.1";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-uukbK8RANF708tawY8k6u5RPqqt4XXv0joRD2vLVZ0Q=";
+    hash = "sha256-iw06eQOSbWQBIBqmmQ/07stGLIDv41odD3yf7ODoLBU=";
   };
 
-  cargoHash = "sha256-Az4w1JNJsbl/vs+lpVcrXg4Yu1Cg2Lc50/X4Kqg/M1Q=";
+  cargoHash = "sha256-63fmeZMazvSRjXqdO0l+go98DIWER60U3bDSp9jc+kQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ba/bazarr/package.nix

@@ -1,29 +1,16 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchNpmDeps,
-  nodejs,
-  npmHooks,
+  buildNpmPackage,
   dart-sass,
-  makeBinaryWrapper,
-  python313,
+  fetchFromGitHub,
   ffmpeg,
-  unar,
-  nixosTests,
+  lib,
   nix-update-script,
+  nixosTests,
+  nodejs_22,
+  python313Packages,
+  unar,
 }:
-let
-  python = python313.withPackages (ps: [
-    ps.lxml
-    ps.numpy
-    ps.pillow
-    ps.psycopg2
-    ps.setuptools
-    ps.webrtcvad
-  ]);
-in
-stdenv.mkDerivation (finalAttrs: {
+python313Packages.buildPythonApplication (finalAttrs: {
   pname = "bazarr";
   version = "1.6.0";
 
@@ -34,41 +21,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-r3H0JEcGYzQOTHVR/zONmtOIF+LnJd+qn2pcAj8vdOA=";
   };
 
-  npmRoot = "frontend";
-  npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-    hash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    npmHooks.npmConfigHook
-    dart-sass
-    makeBinaryWrapper
+  dependencies = with python313Packages; [
+    lxml
+    numpy
+    pillow
+    psycopg2
+    setuptools
+    webrtcvad
   ];
 
-  buildPhase = ''
-    runHook preBuild
-    pushd frontend
-    # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
-    # https://github.com/sass/embedded-host-node/issues/334
-    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
-    npm run build
-    popd
-    runHook postBuild
-  '';
+  __structuredAttrs = true;
+  dontBuild = true;
+  dontWrapPythonPrograms = true;
+  pyproject = false;
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/bazarr/frontend
-    cp -r bazarr bazarr.py custom_libs libs migrations $out/share/bazarr/
-    cp -r frontend/build $out/share/bazarr/frontend/build
+    mkdir -p $out/lib/bazarr/frontend
+    cp -r bazarr bazarr.py custom_libs libs migrations $out/lib/bazarr/
+    cp -r ${finalAttrs.passthru.frontend} $out/lib/bazarr/frontend/build
 
-    printf '%s' "${finalAttrs.version}" > $out/share/bazarr/VERSION
+    printf '%s' "${finalAttrs.version}" > $out/lib/bazarr/VERSION
 
     printf '%s' "${
       lib.generators.toKeyValue { } {
@@ -77,29 +51,62 @@ stdenv.mkDerivation (finalAttrs: {
         packageversion = finalAttrs.version;
         packageauthor = "nixpkgs";
       }
-    }" > $out/share/bazarr/package_info
+    }" > $out/lib/bazarr/package_info
 
-    makeWrapper ${lib.getExe python} $out/bin/bazarr \
-      --add-flags $out/share/bazarr/bazarr.py \
+    makeWrapper ${lib.getExe python313Packages.python} $out/bin/bazarr \
+      --add-flags $out/lib/bazarr/bazarr.py \
       --prefix PATH : ${
         lib.makeBinPath [
           ffmpeg
           unar
         ]
-      }
+      } \
+      --prefix PYTHONPATH : ${python313Packages.makePythonPath finalAttrs.passthru.dependencies} \
+      --set PYTHONNOUSERSITE true
 
     runHook postInstall
   '';
 
   passthru = {
+    frontend = buildNpmPackage {
+      inherit (finalAttrs) src version;
+      pname = "${finalAttrs.pname}-frontend";
+
+      sourceRoot = "${finalAttrs.src.name}/frontend";
+
+      nodejs = nodejs_22;
+
+      npmDepsHash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
+
+      nativeBuildInputs = [ dart-sass ];
+
+      # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
+      # https://github.com/sass/embedded-host-node/issues/334
+      preBuild = ''
+        substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+          --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mv build $out
+        runHook postInstall
+      '';
+
+      dontFixup = true;
+    };
+
     tests.smoke-test = nixosTests.bazarr;
-    updateScript = nix-update-script { };
+
+    updateScript = nix-update-script {
+      extraArgs = lib.cli.toCommandLineGNU { } { subpackage = "frontend"; };
+    };
   };
 
   meta = {
     description = "Subtitle manager for Sonarr and Radarr";
     homepage = "https://www.bazarr.media/";
-    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/${finalAttrs.src.tag}";
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [

pkgs/by-name/bb/bbedit/package.nix

@@ -18,11 +18,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ _7zz ];
 
-  # 7zz extracts APFS alternate data streams as separate files, breaking the seal
-  postUnpack = ''
-    find . -name "*:com.apple.*" -delete
-  '';
-
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/be/beads/package.nix

@@ -15,16 +15,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "beads";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gastownhall";
     repo = "beads";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSZ1z4WaHQDPomW6nNs8iUnld36BuHnOVaODD5mxY00=";
+    hash = "sha256-QryUnK04c9Wm9/VgWoaOJW9M2HoZVZzSDMSMBtjKiyc=";
   };
 
-  vendorHash = "sha256-WWEwGpCwMPD7jaz02zN745RQQqYTQttehbcT3J9hayM=";
+  vendorHash = "sha256-DFS9dSZX3v3q3Yk6+bfnoEN1uIULs2h8t/P9W2tk6l8=";
 
   subPackages = [ "cmd/bd" ];
 

pkgs/by-name/be/bedtools/package.nix

@@ -6,21 +6,23 @@
   python3,
   bzip2,
   xz,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bedtools";
   version = "2.31.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "arq5x";
     repo = "bedtools2";
-    rev = "v${version}";
-    sha256 = "sha256-rrk+FSv1bGL0D1lrIOsQu2AT7cw2T4lkDiCnzil5fpg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rrk+FSv1bGL0D1lrIOsQu2AT7cw2T4lkDiCnzil5fpg=";
   };
 
-  strictDeps = true;
-
   nativeBuildInputs = [
     python3
   ];
@@ -31,16 +33,28 @@ stdenv.mkDerivation rec {
     xz
   ];
 
-  cxx = if stdenv.cc.isClang then "clang++" else "g++";
-  cc = if stdenv.cc.isClang then "clang" else "gcc";
-  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
-  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} install";
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    # The Makefiles hardcode `CC = gcc` and `CXX = g++`.
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
 
   meta = {
     description = "Powerful toolset for genome arithmetic";
-    license = lib.licenses.gpl2;
     homepage = "https://bedtools.readthedocs.io/en/latest/";
+    downloadPage = "https://github.com/arq5x/bedtools2";
+    changelog = "https://github.com/arq5x/bedtools2/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    mainProgram = "bedtools";
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/bi/bichon/package.nix

@@ -3,7 +3,7 @@
   fetchFromGitHub,
   rustPlatform,
   fetchPnpmDeps,
-  pnpm,
+  pnpm_11,
   pnpmConfigHook,
   nodejs,
   openssl,
@@ -11,6 +11,9 @@
   versionCheckHook,
   nix-update-script,
 }:
+let
+  pnpm = pnpm_11;
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bichon";
   version = "2.0.3";
@@ -27,6 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
+    inherit pnpm;
     sourceRoot = "${finalAttrs.src.name}/web";
     fetcherVersion = 4;
     hash = "sha256-Ax8z1sjt8v6XOenhw7eRuEEo0huPv9fbcfzqc8RxJEc=";

pkgs/by-name/bi/bisq2/package.nix

@@ -26,7 +26,7 @@
 }:
 
 let
-  version = "2.1.12";
+  version = "2.1.13";
 
   jdk = zulu25.override { enableJavaFX = true; };
 
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   # nixpkgs-update: no auto update
   src = fetchurl {
     url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb";
-    hash = "sha256-oLNvCc52lkp/efh7ehnV/0JjkY5+oKv0A2Dj0xtBK7Y=";
+    hash = "sha256-B708w9aC5ERXCE1QnIMPkvl8clJbhyKW7+GC7Fdkyno=";
 
     # Verify the upstream Debian package prior to extraction.
     # See https://bisq.wiki/Bisq_2#Installation
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   signature = fetchurl {
     url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb.asc";
-    hash = "sha256-dydNfzk8EMUPGP9W6GI5H0iZA+SCP9PHw+RbWCmMlTM=";
+    hash = "sha256-8FQ/HVWYENCbqtG4MD40QF6eQp3iUyqPNfZkRMAUc2A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bl/blender/package.nix

@@ -119,12 +119,12 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LXdJZDJoO9/yjkxn6qT42jv0YRpiwCiIWWGKubs3VLI=";
+    hash = "sha256-r4XT6ZoVwMXieauP5jOC0DdfNOilTmkGu8JPMAFjuDs=";
   };
 
   patches = [

pkgs/by-name/bp/bpftrace/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.26.1";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "bpftrace";
     repo = "bpftrace";
     rev = "v${version}";
-    hash = "sha256-h3gFnQq48oM5uK07xrykOCSJxhr6dqcyVUDoIKIRREY=";
+    hash = "sha256-wYDSx2WngWS4Ucj82hLO0G46tiXhqskhMjmv7NuUVfw=";
   };
 
   buildInputs = with llvmPackages; [

pkgs/by-name/br/brlcad/package.nix

@@ -29,7 +29,7 @@
   qt6,
   stepcode,
   tcl,
-  tinygltf,
+  tinygltf_2,
   tk,
   zlib,
 
@@ -187,12 +187,21 @@ stdenv.mkDerivation (finalAttrs: {
         build/bext/tktable/tktable/CMake/FindTCL.cmake \
         build/bext/tkhtml/tkhtml/CMake/FindTCL.cmake
     ''
-    # remove a failing test
+    # remove failing tests
     + lib.optionalString stdenv.hostPlatform.isAarch64 ''
       substituteInPlace src/libbu/tests/CMakeLists.txt \
         --replace-fail \
           "brlcad_add_test(NAME bu_color_to_rgb_floats_1 COMMAND bu_test test_color 4 192,78,214)" \
           ""
+    ''
+    # This test opens 16k mapped files from every CPU, each open being a linear scan
+    # under one global semaphore, so its runtime explodes on many-core machines and
+    # blows past ctest's 1500s default timeout on our 80-core aarch64 builders.
+    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+      substituteInPlace src/libbu/tests/CMakeLists.txt \
+        --replace-fail \
+          "brlcad_add_test(NAME bu_mappedfile_parallel_16384 COMMAND bu_test test_mappedfile 2 16384)" \
+          ""
     '';
 
   nativeBuildInputs = [
@@ -224,7 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
     pugixml
     stepcode
     tcl
-    tinygltf
+    tinygltf_2
     tk
     zlib
   ]

pkgs/by-name/br/brook/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "brook";
-  version = "20240606";
+  version = "20270101";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = "brook";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
+    sha256 = "sha256-OIuEJFGOUkvHjxI4FPKWU65VFvgXG0+pu9giGJXYS0w=";
   };
 
-  vendorHash = "sha256-dYiifLUOq6RKAVSXuoGlok9Jp8jHmbXN/EjQeQpoqWw=";
+  vendorHash = "sha256-974jdNwpQbdTbYjY/6KaicwNclizeIQXfyMZI3v/9aA=";
 
   meta = {
     homepage = "https://github.com/txthinking/brook";

pkgs/by-name/ca/cargo-risczero/package.nix

@@ -6,6 +6,7 @@
   pkg-config,
   openssl,
   nix-update-script,
+  stdenv, # for meta.broken
 }:
 let
   # That is from cargoDeps/risc0-circuit-recursion/build.rs
@@ -44,6 +45,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Cargo extension to help create, manage, and test RISC Zero projects";
     mainProgram = "cargo-risczero";
     homepage = "https://risczero.com";

pkgs/by-name/ca/cargo-ui/package.nix

@@ -61,6 +61,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "GUI for Cargo";
     mainProgram = "cargo-ui";
     homepage = "https://github.com/slint-ui/cargo-ui";