.github: Bump actions/checkout from 6.0.3 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...3d3c42e5aa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -96,7 +96,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -138,7 +138,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -174,7 +174,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -259,7 +259,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -476,7 +476,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.gitignore

@@ -27,6 +27,9 @@ tags
 .mypy_cache
 __pycache__
 
+/AGENTS.md
+/CLAUDE.md
+
 /pkgs/development/libraries/qt-5/*/tmp/
 /pkgs/desktops/kde-5/*/tmp/
 /pkgs/development/mobile/androidenv/xml/*

doc/build-helpers/testers.chapter.md

@@ -758,6 +758,7 @@ An attribute set of derivations which perform the tests during their build.
   - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
     This attribute must be available even if `checkDrv` would fail.
   - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
+  - The generic tester only reads `config` and `checkDrv`. An integration may return additional attributes for its own integration-specific eval checks. Such extra attributes are optional.
 
 `mkTest` (function)
 
@@ -772,6 +773,14 @@ An attribute set of derivations which perform the tests during their build.
 : Path to a directory writable by service processes and readable by `testExe`.
   The integration must ensure this directory is available when the services and `testExe` run.
 
+`callReload` (function)
+
+: `path -> string`.
+  Given a service's name `path` (the list of service names from the top-level service down to the target sub-service, e.g. `[ "reload" "inner" ]`), returns a shell command that reloads that service.
+  The command is embedded in `testExe` and executed with sufficient privilege to reload the service (e.g. as root in the test VM).
+  There is no manager-agnostic reload command, so every integration must provide this; the integration joins the `path` per its own unit-naming convention (the suite does not assume one).
+  On NixOS the `path` dash-joins into the systemd unit name with a `.service` suffix, so the command is `systemctl reload ${lib.concatStringsSep "-" path}.service` (a top-level service is a single-element path `[ "svc" ]` -> `svc.service`; a nested sub-service `[ "parent" "child" ]` -> `parent-child.service`).
+
 :::{.example #ex-modularServiceCompliance-nixos}
 
 # NixOS invocation of the compliance suite
@@ -802,6 +811,7 @@ recurseIntoAttrs (
         config = machine.config.system.services;
         checkDrv = machine.config.system.build.toplevel;
       };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
     mkTest =
       {
         name,

doc/hooks/pnpm.section.md

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
     hash = lib.fakeHash;
   };
 
@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
     hash = lib.fakeHash;
   };
 

lib/services/service.nix

@@ -7,10 +7,11 @@
 {
   lib,
   config,
+  options,
   ...
 }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkEnableOption mkOption types;
   pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
 in
 {
@@ -40,7 +41,7 @@ in
       visible = "shallow";
     };
     process = {
-      argv = lib.mkOption {
+      argv = mkOption {
         type = types.listOf pathOrStr;
         example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';
         description = ''
@@ -72,15 +73,12 @@ in
     };
 
     notificationProtocol = mkOption {
-      type = types.listOf (
-        types.enum [
-          "systemd"
-          "s6"
-        ]
-      );
-
-      default = [ ];
-      apply = v: lib.unique v;
+      type = types.submodule {
+        options = {
+          systemd = mkEnableOption "Whether the service supports systemd-notify.";
+          s6 = mkEnableOption "Whether the service supports s6-notify.";
+        };
+      };
       description = ''
         Notification protocol that this service supports with the underlying service manager.
       '';
@@ -90,13 +88,20 @@ in
   config = {
     assertions = [
       {
-        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
+        # `reloadSignal` derives `reloadCommand` at `mkDefault` priority below, so a
+        # conflict only exists when the user *also* set `reloadCommand` explicitly.
+        # An explicit (non-`mkDefault`) definition has `defaultOverridePriority`.
+        assertion =
+          !(
+            config.process.reloadSignal != null
+            && options.process.reloadCommand.highestPrio <= lib.modules.defaultOverridePriority
+          );
         message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
       }
     ];
 
-    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
-      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
+      lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
     );
   };
 }

maintainers/maintainer-list.nix

@@ -4691,6 +4691,12 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
+  caspersonn = {
+    email = "lucakasper8@gmail.com";
+    github = "Caspersonn";
+    githubId = 96787412;
+    name = "Luca Kasper";
+  };
   cassandracomar = {
     name = "Cassandra Comar";
     github = "cassandracomar";
@@ -19937,6 +19943,12 @@
     name = "neo";
     email = "chojs990222@gmail.com";
   };
+  neobrain = {
+    github = "neobrain";
+    githubId = 4840017;
+    matrix = "@neobrain:matrix.org";
+    name = "Tony Wasserka";
+  };
   neonvoid = {
     email = "me@neonvoid.dev";
     github = "neonvoidx";
@@ -25000,6 +25012,12 @@
     githubId = 47582;
     name = "Samir Talwar";
   };
+  samiser = {
+    email = "nixos@me.samiser.xyz";
+    github = "samiser";
+    githubId = 32001364;
+    name = "Sam";
+  };
   samlich = {
     email = "nixos@samli.ch";
     github = "samlich";

nixos/modules/config/xdg/portal.nix

@@ -116,6 +116,8 @@ in
       packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
     in
     mkIf cfg.enable {
+      programs.fuse.enable = true;
+
       warnings = lib.optional (cfg.configPackages == [ ] && cfg.config == { }) ''
         xdg-desktop-portal 1.17 reworked how portal implementations are loaded, you
         should either set `xdg.portal.config` or `xdg.portal.configPackages`

nixos/modules/services/display-managers/dms-greeter.nix

@@ -4,7 +4,6 @@
   pkgs,
   ...
 }:
-
 let
   inherit (lib)
     types
@@ -24,13 +23,27 @@ let
   cfgAutoLogin = config.services.displayManager.autoLogin;
   sessionData = config.services.displayManager.sessionData;
 
+  # Miracle WM is nested under `programs.wayland.miracle-wm` unlike the rest
+  compositorOption =
+    if cfg.compositor.name == "miracle-wm" then "wayland.miracle-wm" else "${cfg.compositor.name}";
   cacheDir = "/var/lib/dms-greeter";
 
+  # Not all compositor packages match the name they use and Miracle does not have a package option
+  compositorPkg =
+    if cfg.compositor.name == "miracle-wm" then
+      pkgs.miracle-wm
+    else
+      lib.attrByPath [
+        "programs"
+        cfg.compositor.name
+        "package"
+      ] null config;
+
   greeterScript = pkgs.writeShellScriptBin "dms-greeter-start" ''
     export PATH=$PATH:${
       makeBinPath [
         cfg.quickshell.package
-        config.programs.${cfg.compositor.name}.package
+        compositorPkg
       ]
     }
     ${
@@ -123,6 +136,9 @@ in
           "niri"
           "hyprland"
           "sway"
+          "mangowc"
+          "miracle-wm"
+          "labwc"
         ];
         example = "niri";
         description = ''
@@ -135,6 +151,9 @@ in
           - niri: A scrollable-tiling Wayland compositor
           - hyprland: A dynamic tiling Wayland compositor
           - sway: An i3-compatible Wayland compositor
+          - mango: A dwm-inspired Wayland compositor with modern config options and multiple layouts
+          - miracle-wm: A keyboard-driven Wayland compositor with smooth animations and extensibility
+          - labwc: Lightweight stacking Wayland compositor inspired by Openbox
         '';
       };
 
@@ -242,12 +261,16 @@ in
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion = config.programs.${cfg.compositor.name}.enable or false;
+        assertion =
+          # Assemble the full attribute structure because miracle-wm is not nested in the same location as the others
+          lib.attrByPath (
+            [ "programs" ] ++ lib.splitString "." compositorOption ++ [ "enable" ]
+          ) false config;
         message = ''
           DankMaterialShell greeter: The compositor "${cfg.compositor.name}" is not enabled.
 
           Please enable the compositor via:
-            programs.${cfg.compositor.name}.enable = true;
+            programs.${compositorOption}.enable = true;
         '';
       }
       {

nixos/modules/services/mail/rspamd.nix

@@ -506,6 +506,7 @@ in
         CapabilityBoundingSet = "";
         DevicePolicy = "closed";
         LockPersonality = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;

nixos/modules/services/misc/paperless.nix

@@ -24,6 +24,8 @@ let
     GRANIAN_HOST = cfg.address;
     GRANIAN_PORT = toString cfg.port;
     GRANIAN_WORKERS_KILL_TIMEOUT = "60";
+    # django-allauth uses python requests, which doesn't use the systems CA bundle by default: https://requests.readthedocs.io/en/latest/user/advanced/#ca-certificates
+    REQUESTS_CA_BUNDLE = config.security.pki.caBundle;
   }
   // lib.optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;

nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix

@@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  dmcfg = config.services.xserver.displayManager;
-  ldmcfg = dmcfg.lightdm;
-  cfg = ldmcfg.greeters.enso;
-
-  theme = cfg.theme.package;
-  icons = cfg.iconTheme.package;
-  cursors = cfg.cursorTheme.package;
-
-  ensoGreeterConf = pkgs.writeText "lightdm-enso-os-greeter.conf" ''
-    [greeter]
-    default-wallpaper=${ldmcfg.background}
-    gtk-theme=${cfg.theme.name}
-    icon-theme=${cfg.iconTheme.name}
-    cursor-theme=${cfg.cursorTheme.name}
-    blur=${toString cfg.blur}
-    brightness=${toString cfg.brightness}
-    ${cfg.extraConfig}
-  '';
-in
-{
-  options = {
-    services.xserver.displayManager.lightdm.greeters.enso = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable enso-os-greeter as the lightdm greeter
-        '';
-      };
-
-      theme = {
-        package = mkPackageOption pkgs "gnome-themes-extra" { };
-        name = mkOption {
-          type = types.str;
-          default = "Adwaita";
-          description = ''
-            Name of the theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      iconTheme = {
-        package = mkPackageOption pkgs "papirus-icon-theme" { };
-        name = mkOption {
-          type = types.str;
-          default = "ePapirus";
-          description = ''
-            Name of the icon theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      cursorTheme = {
-        package = mkPackageOption pkgs "capitaine-cursors" { };
-        name = mkOption {
-          type = types.str;
-          default = "capitane-cursors";
-          description = ''
-            Name of the cursor theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      blur = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable blur
-        '';
-      };
-
-      brightness = mkOption {
-        type = types.int;
-        default = 7;
-        description = ''
-          Brightness
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Extra configuration that should be put in the greeter.conf
-          configuration file
-        '';
-      };
-    };
-  };
-
-  config = mkIf (ldmcfg.enable && cfg.enable) {
-    environment.etc."lightdm/greeter.conf".source = ensoGreeterConf;
-
-    environment.systemPackages = [
-      cursors
-      icons
-      theme
-    ];
-
-    services.xserver.displayManager.lightdm = {
-      greeter = mkDefault {
-        package = pkgs.lightdm-enso-os-greeter.xgreeters;
-        name = "pantheon-greeter";
-      };
-
-      greeters = {
-        gtk = {
-          enable = mkDefault false;
-        };
-      };
-    };
-  };
-}

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -83,7 +83,6 @@ in
   imports = [
     ./lightdm-greeters/gtk.nix
     ./lightdm-greeters/mini.nix
-    ./lightdm-greeters/enso-os.nix
     ./lightdm-greeters/pantheon.nix
     ./lightdm-greeters/lomiri.nix
     ./lightdm-greeters/tiny.nix
@@ -107,6 +106,9 @@ in
         "user"
       ]
     )
+    (lib.mkRemovedOptionModule [ "services" "xserver" "displayManager" "lightdm" "greeters" "enso" ]
+      "services.xserver.displayManager.lightdm.greeters.enso has been removed following removal of the corresponding package."
+    )
   ];
 
   options = {

nixos/modules/system/service/systemd/service.nix

@@ -126,33 +126,29 @@ in
         `%i` (instance), `%t` (runtime directory), and environment variables using
         `''${VAR}` syntax in your command line.
 
-        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
-        when specified to prevent systemd substitution. Set this option explicitly to enable
-        systemd's substitution features.
+        By default, it is set to {option}`process.reloadCommand` when specified, or an
+        empty string otherwise. Because {option}`process.reloadCommand` is already a
+        command line (not an argument list), it is used verbatim so that references
+        like `$MAINPID` are preserved.
 
         To extend {option}`process.reloadCommand` with systemd specifiers, you can append
-        to the escaped arguments:
+        to the command line:
 
         ```nix
         systemd.mainExecReload =
-          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
+          config.process.reloadCommand + " --systemd-unit %n";
         ```
 
         This pattern allows you to pass the unit name (or other systemd specifiers)
-        as additional arguments while keeping the base command from {option}`process.argv`
-        properly escaped.
+        as additional arguments.
 
         See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
         variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
         for available specifiers like `%n`, `%i`, `%t`.
       '';
       type = types.nullOr types.str;
-      default =
-        if config.process.reloadCommand then
-          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
-        else
-          "";
-      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
+      default = if config.process.reloadCommand != null then config.process.reloadCommand else "";
+      defaultText = lib.literalExpression "config.process.reloadCommand";
     };
 
     systemd.services = mkOption {
@@ -213,9 +209,7 @@ in
       wantedBy = lib.mkDefault [ "multi-user.target" ];
       serviceConfig = {
         ExecReload = config.systemd.mainExecReload;
-        Type = lib.mkDefault (
-          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
-        );
+        Type = lib.mkDefault (if config.notificationProtocol.systemd then "notify" else "simple");
         Restart = lib.mkDefault "always";
         RestartSec = lib.mkDefault "5";
         ExecStart = [

nixos/tests/system-services-compliance.nix

@@ -7,6 +7,23 @@
 
 let
   sharedDir = "/tmp/modular-service-compliance";
+
+  inherit (pkgs) lib coreutils;
+
+  evalSystemServices =
+    services:
+    evalSystem (
+      { ... }:
+      {
+        system.services = services;
+        system.stateVersion = "25.05";
+        fileSystems."/" = {
+          device = "/test/dummy";
+          fsType = "auto";
+        };
+        boot.loader.grub.enable = false;
+      }
+    );
 in
 let
   suite = pkgs.testers.modularServiceCompliance {
@@ -15,23 +32,13 @@ let
     evalConfig =
       { services }:
       let
-        machine = evalSystem (
-          { ... }:
-          {
-            system.services = services;
-            system.stateVersion = "25.05";
-            fileSystems."/" = {
-              device = "/test/dummy";
-              fsType = "auto";
-            };
-            boot.loader.grub.enable = false;
-          }
-        );
+        machine = evalSystemServices services;
       in
       {
         config = machine.config.system.services;
         checkDrv = machine.config.system.build.toplevel;
       };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
     mkTest =
       {
         name,
@@ -49,6 +56,80 @@ let
         meta.maintainers = with pkgs.lib.maintainers; [ roberth ];
       };
   };
+
+  # systemd-specific eval assertions. serviceConfig.Type/ExecReload only exist on
+  # the resolved host units, so a fresh eval is used per case.
+  systemdEvalTests =
+    let
+      defaultUnits =
+        (evalSystemServices {
+          service.process.argv = [ "${coreutils}/bin/true" ];
+        }).config.systemd.services;
+
+      notifyUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            notificationProtocol.systemd = true;
+          };
+        }).config.systemd.services;
+
+      reloadUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            process.reloadSignal = "HUP";
+          };
+        }).config.systemd.services;
+    in
+    {
+      testDefaultType = {
+        expr = defaultUnits.service.serviceConfig.Type;
+        expected = "simple";
+      };
+
+      testNotifyType = {
+        expr = notifyUnits.service.serviceConfig.Type;
+        expected = "notify";
+      };
+
+      testReloadExecReload = {
+        expr = reloadUnits.service.serviceConfig.ExecReload;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+
+  systemdEval = pkgs.stdenvNoCC.mkDerivation (finalAttrs: {
+    __structuredAttrs = true;
+    name = "system-services-compliance-systemd-eval-report";
+    passthru = {
+      tests = systemdEvalTests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
+    };
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
+    buildCommand = ''
+      touch $out
+      for testName in "''${!testResults[@]}"; do
+        if [[ -n "''${testResults[$testName]}" ]]; then
+          echo "PASS  $testName"
+        else
+          echo "FAIL  $testName"
+        fi
+      done
+    ''
+    + lib.optionalString (lib.any (v: !v) (lib.attrValues finalAttrs.testResults)) ''
+      {
+        echo ""
+        echo "systemd-specific eval-level compliance failures:"
+        for testName in "''${!testResults[@]}"; do
+          if [[ -z "''${testResults[$testName]}" ]]; then
+            echo "- $testName"
+          fi
+        done
+      } >&2
+      exit 1
+    '';
+  });
 in
 
 # Please the callTest pattern.
@@ -64,4 +145,4 @@ pkgs.lib.mapAttrs (
       test = v;
       driver = v;
     }
-) suite
+) (suite // { systemd-eval = systemdEval; })

pkgs/applications/editors/sublime/4/packages.nix

@@ -11,9 +11,9 @@ in
   } { };
 
   sublime4-dev = common {
-    buildVersion = "4205";
+    buildVersion = "4206";
     dev = true;
-    x64sha256 = "1Tg8m4FNrVOeHK6VSmlua30pW4Bu7Gz+sT0t/w01UyM=";
-    aarch64sha256 = "K94UipUVZRh8xJKYW35be0u9L/VHpZ+FYhC26v41b3U=";
+    x64sha256 = "WZ+MfKnOYTTfVbyW2QRstkAOhAxEv4nXsxsQnnAeA6I=";
+    aarch64sha256 = "opMVWTGsPQSb/SpN4Cz9CC8jL42BaqO/da6uC++6t3o=";
   } { };
 }

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -13,18 +13,18 @@
   writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.10.0";
+  version = "0.10.1";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff";
     tag = "v${version}";
-    hash = "sha256-nrstsxOxHTeSKkqpvyxdzyypfHU6wZBQpvNnCfjh9s4=";
+    hash = "sha256-GGoy8ghA87vwHEc0fi97uiBrpRTAGk/QgqzKu8BBRXo=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-Nlf2Bxwe5KvZF0unpeK/mMFmv4NM+IKPpFOopXoNRxU=";
+    cargoHash = "sha256-sOE3Zrs/ZtOIusH0+OvR1Ew5sfQfse6eWSLPwDPVSU4=";
 
     cargoBuildFlags = [
       "-p"

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-nDKqXhU97h0iBPPFASaCSzEdi6H48IW1rn4iB9cD36Y=";
+          hash = "sha256-Y6MXjJBmhMzuQMwhkPLHK/vtciTdjsGvkEblH3ofju0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-gIN2FE6ROma6v3vJX/Wi+OqFrq5/YV7kJXNMwGRw0Z8=";
+          hash = "sha256-8VvDtb+8SoLTRC7pXwH40amRurxTQgCmhdi0u7e5AfU=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rb50iFTniwhY/iqsKBN4jfV4j+RxjLF126opVkReyGA=";
+          hash = "sha256-bqjEgsjY+zyG1g/KtkRNxAlazIpc+HwGWvsMQNnPI2M=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.217";
+      version = "2.1.218";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1096,8 +1096,8 @@ let
         mktplcRef = {
           name = "csharpier-vscode";
           publisher = "csharpier";
-          version = "10.0.3";
-          hash = "sha256-YTDpBGLbyM6Nq5DlEtqFiSsSRRECLIEqSM4xgIIVWG0=";
+          version = "11.0.0";
+          hash = "sha256-LVGIKCW2z2Y2k0qPmJZZO66W3E9UDBtl5EnycanMPxA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/csharpier.csharpier-vscode/changelog";
@@ -1375,8 +1375,8 @@ let
         mktplcRef = {
           name = "competitive-programming-helper";
           publisher = "DivyanshuAgrawal";
-          version = "2026.6.1780853884";
-          hash = "sha256-4nxH5qW3u3/9Vqf+QFs7l5BDusE5wcxxHiJFcPq/2EE=";
+          version = "2026.7.1784455023";
+          hash = "sha256-mUiQ+35R1HXC+23qYKRJwV61poEsyhY2NkDizU+QMx8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -2346,8 +2346,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.84";
-          hash = "sha256-NijfD83LfEAsYsZtKwj/sBVqzpXht6pvtVZCQUUdfq0=";
+          version = "1.1.85";
+          hash = "sha256-hHbBg7h8iab8ArbiuEx+a5zqr02hIu8DGHnvh0XwH9g=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-07-13";
+  version = "0-unstable-2026-07-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "1edda8a2a6c6b9ae259d5c7cd7d54dcba9ee7e32";
-    hash = "sha256-dc7xRjFxfSL2q9u1N0QH2j+oPbRGng2Z3U3J484lXiU=";
+    rev = "74dd2a8c6319678ffce9f31bdf36279db5681762";
+    hash = "sha256-NHXOfKItLkQJ0/jH1gLBpLFqOKBB8qgH5gMw7j1YoLw=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-07-07";
+  version = "0-unstable-2026-07-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "31563d6e65faa6b9b7e975754d2062370bba4342";
-    hash = "sha256-eFRzbVTL5ARf650D0ZAEFGNTxjAy1CjBiAhwSQR8vJ4=";
+    rev = "c5b09532fa633e015ac75c0a2acfec049f65ded3";
+    hash = "sha256-13oL/U3uwNejqTIbKmITRbK8Eddg9YH5CMDIDXA6zKs=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2005.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "snes9x2005" + lib.optionalString withBlarggAPU "-plus";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2005";
-    rev = "b60356971fc9caae02cd0853676dced886a08be7";
-    hash = "sha256-6IuEFyJEoCHluSAXbk5qRTXku1XJCZ6p04BhdjqZqJQ=";
+    rev = "deb49d80d1836e3e737480a326e31a54c46c04ae";
+    hash = "sha256-UMW+YTzcSZ5CWSyRBYc8y1cDh/CU3Am11rkjSXlyxZA=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "helm-dt";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
     tag = "v${version}";
-    hash = "sha256-KjIlmioDyj79jCnEi+Iimdg0eZruHdeD9JorkJbifJg=";
+    hash = "sha256-ytbwUfjPpvKxX6d24ifCyeD1WtFpzA52QniMImTun+c=";
   };
 
   vendorHash = "sha256-dkE3eYZnaS+kC0kDVxaFW/Ev15TY2MY3m5xgPof7Y18=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1067,11 +1067,11 @@
     "vendorHash": null
   },
   "ovh_ovh": {
-    "hash": "sha256-01xbvlVgdpRXPw7S1J067cj92ogfcBOzC6y+/PTWtRM=",
+    "hash": "sha256-BKaPKG9xuRq2rNxkMJnN428woyeK0NnssZaJRrGutoM=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v2.16.1",
+    "rev": "v2.17.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -92,8 +92,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.12.1esr";
-    sha512 = "24e795483ba7bc112c0debe1becdaf79cc2de95703b9ee726d0216bfc1db7b33c169503f83ac867e5998a8d1d0284a6ef12c7d35d98b10d6432497c2db237477";
+    version = "140.13.0esr";
+    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/applications/science/logic/coq/default.nix

@@ -19,7 +19,7 @@
   ocamlPackages_4_10,
   ocamlPackages_4_12,
   ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
   rocqPackages, # for versions >= 9.0 that are transition shims on top of Rocq
   ncurses,
   buildIde ? null, # default is true for Coq < 8.14 and false for Coq >= 8.14
@@ -76,6 +76,7 @@ let
     "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
     "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
     "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
   };
   releaseRev = v: "V${v}";
   fetched =
@@ -140,12 +141,15 @@ let
           case = lib.versions.range "8.7" "8.10";
           out = ocamlPackages_4_09;
         }
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
   ocamlNativeBuildInputs = [
     ocamlPackages.ocaml
     ocamlPackages.findlib
   ]
   ++ lib.optional (coqAtLeast "8.14") dune;
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
   ocamlPropagatedBuildInputs =
     [ ]
     ++ lib.optional (!coqAtLeast "8.10") ocamlPackages.camlp5
@@ -225,6 +229,7 @@ let
     buildInputs = [
       ncurses
     ]
+    ++ ocamlBuildInputs
     ++ lib.optionals buildIde (
       if coqAtLeast "8.10" then
         [
@@ -328,11 +333,18 @@ let
       platforms = lib.platforms.unix;
       mainProgram = if buildIde then "coqide" else "coqtop";
     };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
   };
 in
 if coqAtLeast "8.21" then
   self.overrideAttrs (o: {
     # coq-core is now a shim for rocq
+    nativeBuildInputs = o.nativeBuildInputs ++ [
+      rocqPackages.rocq-core
+    ];
     propagatedBuildInputs = o.propagatedBuildInputs ++ [
       rocqPackages.rocq-core
     ];

pkgs/applications/science/logic/rocq-core/default.nix

@@ -14,7 +14,7 @@
   dune,
   customOCamlPackages ? null,
   ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
   ncurses,
   csdp ? null,
   version,
@@ -29,6 +29,7 @@ let
     "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
     "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
     "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
   };
   releaseRev = v: "V${v}";
   fetched =
@@ -66,12 +67,15 @@ let
       in
       lib.switch rocq-version [
         (case (range "9.0" "9.1") ocamlPackages_4_14)
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
   ocamlNativeBuildInputs = [
     ocamlPackages.ocaml
     ocamlPackages.findlib
     dune
   ];
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
   ocamlPropagatedBuildInputs = [ ocamlPackages.zarith ];
   self = stdenv.mkDerivation {
     pname = "rocq";
@@ -130,7 +134,7 @@ let
     };
 
     nativeBuildInputs = [ pkg-config ] ++ ocamlNativeBuildInputs;
-    buildInputs = [ ncurses ];
+    buildInputs = [ ncurses ] ++ ocamlBuildInputs;
 
     propagatedBuildInputs = ocamlPropagatedBuildInputs;
 
@@ -196,6 +200,10 @@ let
       platforms = lib.platforms.unix;
       mainProgram = "rocq";
     };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
   };
 in
 self

pkgs/build-support/testers/modular-service-compliance.nix

@@ -15,6 +15,7 @@
   evalConfig,
   mkTest,
   sharedDir,
+  callReload,
   namePrefix ? "modular-service-compliance",
 }:
 
@@ -45,6 +46,11 @@ let
           ];
           warnings = [ "compliance child warning" ];
         };
+        # A sub-service exercising reload derivation from a reload signal.
+        services.reloadee = {
+          process.argv = [ "${coreutils}/bin/true" ];
+          process.reloadSignal = "HUP";
+        };
       };
     };
   };
@@ -65,7 +71,7 @@ let
       };
 
       testAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = true;
           message = "compliance test assertion";
         } c.assertions;
@@ -73,12 +79,12 @@ let
       };
 
       testWarnings = {
-        expr = builtins.elem "compliance test warning" c.warnings;
+        expr = lib.elem "compliance test warning" c.warnings;
         expected = true;
       };
 
       testSubServiceAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = true;
           message = "compliance child assertion";
         } c.services.child.assertions;
@@ -86,14 +92,58 @@ let
       };
 
       testSubServiceWarnings = {
-        expr = builtins.elem "compliance child warning" c.services.child.warnings;
+        expr = lib.elem "compliance child warning" c.services.child.warnings;
+        expected = true;
+      };
+
+      # The reload-conflict assertion must not fire (its `assertion` must hold) for a
+      # service that sets only reloadSignal (guards the inverted-assertion fix, and the
+      # priority-aware conflict detection: reloadSignal derives reloadCommand internally,
+      # which must not be mistaken for a user-set conflict).
+      testNoReloadConflict = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) c.services.reloadee.assertions;
+        expected = false;
+      };
+
+      # Setting process.reloadSignal derives process.reloadCommand
+      # (guards the misplaced-paren mkIf fix).
+      testReloadSignalDerivesCommand = {
+        expr = c.services.reloadee.process.reloadCommand;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+
+      # notificationProtocol submodule bools default to false.
+      testNotificationProtocolSystemdDefault = {
+        expr = c.notificationProtocol.systemd;
+        expected = false;
+      };
+
+      testNotificationProtocolS6Default = {
+        expr = c.notificationProtocol.s6;
+        expected = false;
+      };
+
+      # Setting both reloadSignal and reloadCommand explicitly is a genuine conflict,
+      # so the assertion must fire. Separate eval: checkDrv would fail on this.
+      testReloadConflictFires = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) conflictEval.config.conflict.assertions;
         expected = true;
       };
 
       # Separate eval for a failing assertion — checkDrv would fail here,
       # so we only access config.
       testFailingAssertionValue = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = false;
           message = "compliance failing assertion";
         } failingEval.config.failing.assertions;
@@ -101,6 +151,16 @@ let
       };
     };
 
+  conflictEval = evalConfig {
+    services = {
+      conflict = {
+        process.argv = [ "${coreutils}/bin/true" ];
+        process.reloadSignal = "HUP";
+        process.reloadCommand = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+  };
+
   failingEval = evalConfig {
     services = {
       failing = {
@@ -129,6 +189,24 @@ let
     exec "${coreutils}/bin/sleep" infinity
   '';
 
+  /**
+    A reloadable service script. Like `svc`, it namespaces a comms subdirectory
+    by its first argument and records the remaining arguments. It traps SIGHUP
+    and appends a marker line to `$dir/reloads` on each reload, then stays alive
+    as the trapping shell itself (no `exec`, so the trap and MAINPID are kept).
+  */
+  reloadableSvc = writeShellScript "${namePrefix}-reloadable-svc" ''
+    id="$1"; shift
+    dir="${sharedDir}/$id"
+    mkdir -p "$dir"
+    : > "$dir/reloads"
+    reload() { printf 'reloaded\n' >> "$dir/reloads"; }
+    trap reload HUP
+    echo "$$" > "$dir/pid"
+    printf '%s\n' "$@" > "$dir/args"
+    while true; do "${coreutils}/bin/sleep" 1; done
+  '';
+
   mkArgv =
     id: extraArgs:
     [
@@ -171,6 +249,27 @@ let
       inherit text;
     });
 
+  # The reload runtime test's service tree. The reloadable unit is the *sub*-service,
+  # so its name path `[ "reload" "inner" ]` handed to `callReload` exercises the
+  # integration's nested unit naming (NixOS dash-joins to `reload-inner.service`).
+  reloadServices = {
+    reload = {
+      # Parent must run something; a bare keep-alive is enough.
+      process.argv = [
+        reloadableSvc
+        "reload-parent"
+      ];
+      services.inner.process = {
+        argv = [
+          reloadableSvc
+          "reload-inner"
+        ];
+        # The script traps SIGHUP; reloadSignal derives the manager's reload command.
+        reloadSignal = "HUP";
+      };
+    };
+  };
+
 in
 {
   # Eval-level tests: config structure, evaluated in the integration's
@@ -186,9 +285,9 @@ in
     representative = evalResult.checkDrv;
     passthru = {
       tests = evalTestDefs;
-      failures = lib.runTests finalAttrs.passthru.tests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
     };
-    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.passthru.tests;
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
     buildCommand = ''
       touch $out
       for testName in "''${!testResults[@]}"; do
@@ -247,5 +346,26 @@ in
     '';
   };
 
+  # Runtime reload: start a reloadable service, ask the integration to reload it,
+  # and assert the service observed the reload (recorded a SIGHUP marker).
+  reload = mkTest {
+    name = "${namePrefix}-reload";
+    services = reloadServices;
+    testExe = mkTestScript "reload" ''
+      ${waitAndCheck "reload-inner" [ ]}
+      ${callReload [
+        "reload"
+        "inner"
+      ]}
+      timeout=30; elapsed=0
+      while ! grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" && [ "$elapsed" -lt "$timeout" ]; do
+        sleep 1; elapsed=$((elapsed + 1))
+      done
+      grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" \
+        || { echo "reload: no reload recorded after ''${timeout}s"; cat "${sharedDir}/reload-inner/reloads"; exit 1; }
+      echo "reload: reload observed"
+    '';
+  };
+
   # See also the manual compliance items in doc/build-helpers/testers.chapter.md.
 }

pkgs/by-name/ap/apfel-llm/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apfel-llm";
-  version = "1.8.3";
+  version = "1.8.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Building from source requires swift 6.3.0 while nixpkgs only has 5.10.1
   src = fetchurl {
     url = "https://github.com/Arthur-Ficial/apfel/releases/download/v${finalAttrs.version}/apfel-${finalAttrs.version}-arm64-macos.tar.gz";
-    hash = "sha256-1AA86f5+Poo5YCrtxT1rAPGBctQbNa5hdAZmI008/yU=";
+    hash = "sha256-farvPPo3VU2qUat+72qaiMpcd9LwFO7kqzGGKKtPwGE=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.25";
+  version = "1.2.27";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IRiW4sZZyzqmYGxNEmLZgbRb/z+Gfbn5bi4ci3/Rz4g=";
+    hash = "sha256-yu7DGFscciEVRshiUYHNo9QEggljbSOFLX/dl2LYsFU=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-nms4bDB9z4H2IbMO49bri0aQBiBfVj4kzVqwzURZ75c=";
+  vendorHash = "sha256-4aQAnmmnwEPAZE/ph/xyQWcW+thfVX42dpFQq296Hf4=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

pkgs/by-name/ar/artalk/package.nix

@@ -3,7 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   installShellFiles,
@@ -31,14 +31,14 @@ let
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
     ];
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-HypDGYb0MRCIDBHY8pVgwFoZQWC8us44cunORZRk3RM=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-RSz/bx8/BAqLZH3/yQ6/H/nnwGvcCg8EzIEJ4/xkQgQ=";
     };
 
     buildPhase = ''

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.17.0";
+  version = "18.17.1";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cciogPSlbfiC9U3Dv+IGyuRI9PU9X4LdlequCFiG/a0=";
+    hash = "sha256-9wfeAqtE6HLNvQHdGlLX6Kv1kakmojgY14RVW/WpOSs=";
   };
 
-  cargoHash = "sha256-QX1JupLZafRdMUZjl58iFjiPgLSTYZazRVyU88n5QP8=";
+  cargoHash = "sha256-l2TX8thT+MnWhrTyD4ryapJkDg43mb2IurGDnyk2b74=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.

pkgs/by-name/be/bellepoule/package.nix

@@ -2,9 +2,9 @@
   lib,
   stdenv,
   fetchgit,
-  goocanvas_1,
+  goocanvas_2,
   pkg-config,
-  gtk2,
+  gtk3,
   libxml2,
   curl,
   libmicrohttpd,
@@ -39,11 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    gtk2
+    gtk3
     libxml2
     curl
     libmicrohttpd
-    goocanvas_1
+    goocanvas_2
     qrencode
     openssl
     json-glib
@@ -59,17 +59,27 @@ stdenv.mkDerivation (finalAttrs: {
     "DESTDIR=$(out)"
   ];
 
-  # Use system php
-  # Disable git soft depend
-  # Disable dch changelog generation
-  # FixUp `install` phase output
   postPatch = ''
+    # Use system php
     substituteInPlace ./sources/common/network/web_server.cpp --replace-fail "php7.4" "${php}/bin/php"
+
+    # FixUp desktop templates to point to our own output
     substituteInPlace ./build/BellePoule/debian/bellepoule.desktop.template --replace-fail "/usr" "$out"
+
+    # FixUp erroneous properties in glade files tripping-up GTK2 -> GTK3 upgrade (identation is intentional here)
+    # Such as https://git.launchpad.net/bellepoule/tree/resources/glade/contest.glade?h=5.0/master#n197
+    substituteInPlace ./resources/glade/*.glade --replace "            <property name=\"homogeneous\">True</property>" ""
+
+    # Disable git soft depend
+    # Disable dch changelog generation
+    # FixUp output path
+    # Upgrade GTK2 -> GTK3, goocanvas1 -> goocanvas2
     substituteInPlace ./build/BellePoule/Makefile \
       --replace-fail "git" "#git" \
       --replace-fail "dch" "echo Ignoring: dch" \
-      --replace-fail "/usr" ""
+      --replace-fail "/usr" "" \
+      --replace-fail "gtk+-2.0" "gtk+-3.0" \
+      --replace-fail "GOO = goocanvas" "GOO = goocanvas-2.0"
   '';
 
   # Prepare release directory for buildPhase

pkgs/by-name/bl/blazesym-c/package.nix

@@ -9,24 +9,27 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "blazesym-c";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "blazesym";
     tag = "capi-v${finalAttrs.version}";
-    hash = "sha256-IdeY9FCGziYN9glnvQJu2oa5ogdXb6D9QcY2MRnq7vA=";
+    hash = "sha256-gaDNRVcoI6Nc1zWEwS49FhKPep4uI5560t3AaIRCYfw=";
   };
 
-  cargoHash = "sha256-fsvdhahTKxjrrH9z6m1k3cTkXfMUZXZNZlYRi3tgTlA=";
+  cargoHash = "sha256-ZLGtskOe38fBP8o8zIezzsNwY4Xwr7UnVrbx1KysEis=";
 
   cargoBuildFlags = [
     "--package"
     "blazesym-c"
   ];
 
-  nativeCheckInputs = [
+  nativeBuildInputs = [
     pkg-config
+  ];
+
+  buildInputs = [
     elfutils
     zlib
   ];

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -136,7 +136,7 @@ buildFHSEnv {
       with pkgs;
       [
         gtk2-x11
-        openssl_1_1
+        # openssl_1_1
       ]
     );
 
@@ -166,5 +166,8 @@ buildFHSEnv {
     ];
     platforms = lib.platforms.linux;
     mainProgram = "bolt-launcher";
-  };
+  }
+  // (lib.optionalAttrs enableRS3 {
+    problems.broken.message = "OpenSSL 1.1 has been end of life since 2023 and will be removed soon.";
+  });
 }

pkgs/by-name/br/brave/package.nix

@@ -3,20 +3,20 @@
 
 let
   pname = "brave";
-  version = "1.92.141";
+  version = "1.92.143";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-FVzXaVpyfX+GIVofy3NfpE8rOH+9LjQpdEoEWQV0DqI=";
+      hash = "sha256-IHBJm9uow2d/X4Z9e117aGdP1Y+3R1ApWu40sPtdbr8=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-A87vCTtcyuNMPLaLYDjgyIm85zwAXNc3Z4ImtC9Kjek=";
+      hash = "sha256-jaxNneurduBiw3jho5Fp7gXnBfSpLB5hlE06i/JK+ic=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-b4BmNt+c0CSrtS2n+30gdWrSsFOQSZnFAy2vWbGJz6g=";
+      hash = "sha256-EvfZgO8FAijof1Ml6gqSOyRndL8KYFdT0MNmVmuxAnU=";
     };
   };
 

pkgs/by-name/bu/buck2/hashes.json

@@ -1,17 +1,17 @@
 {
   "aarch64-darwin": {
-    "buck2": "sha256-zBZ2gEPRxyaBYmnRfYfhYDqswqfiXvxYDHrUI92Z1UQ=",
-    "rust-project": "sha256-K86j0E32w0DUwzpPT0NBUiL3rV4Ze8hzfbKDkpy9JXo="
-  },
-  "x86_64-linux": {
-    "buck2": "sha256-IqDsyQ7Omy7QujT85oKrWwyirG7gwfupdxzvRoMRmQs=",
-    "rust-project": "sha256-iFSko4FTvAVlKUxJE/6FzR6H7V2SryRfEi7nRhfyhxQ="
+    "buck2": "sha256-CIysxyxAD6Q4vkBSw2eC9Wsq+GKHqt8T7OXpdy1yRVw=",
+    "rust-project": "sha256-o5m58wQ9zKkpa5GzgLpcLUV9LpA+n+MxVa/9hH9Tr40="
   },
   "aarch64-linux": {
-    "buck2": "sha256-VKV1vltATu3tAPmMiifba7MV9kNFH754FDda6i8cQrU=",
-    "rust-project": "sha256-oqxHdbNzQn1KHObboAd4/LTbilIJgLqMiWCgHLaPFrc="
+    "buck2": "sha256-4jm/cvQKeYfbkCTrbV4yVkL2SWxYnexr5UwQCNJhihk=",
+    "rust-project": "sha256-vGSOwVETwYqwBhkxlSTDJlVcMfbAIzYwDhEKbqz+6ok="
   },
-  "version": "2026-04-15",
-  "preludeGit": "f0896771c4cc1ab8f87e032c5293376c89e5096b",
-  "preludeFod": "sha256-Ga4q9zzifgFDGx0TbcbBoDN29H3A4s1BZnSwwv9Mix0="
+  "x86_64-linux": {
+    "buck2": "sha256-7MPYB90LD+/xpCNoi9WYJjuDOdIj5oVXiocZZFbBnZU=",
+    "rust-project": "sha256-de0SbH6cbjdDhcPpDTjxBo5HgQ8yS1eokQYjQrHKIDY="
+  },
+  "version": "2026-07-15",
+  "preludeGit": "caed0b8c0ee137c4e5e1f800a5054df151f490c2",
+  "preludeFod": "sha256-nMHnBf4vQJIxPgarmLPY38b15DFW2FlAQxDCzJgB+w8="
 }

pkgs/by-name/bu/buck2/package.nix

@@ -55,19 +55,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "buck2";
-  version = "unstable-${buildHashes.version}"; # TODO (aseipp): kill 'unstable' once a non-prerelease is made
+  version = buildHashes.version;
 
   srcs = [
     # the platform-specific binary — which is also
     # zstd-compressed
     (fetchurl {
-      url = "https://github.com/facebook/buck2/releases/download/${lib.removePrefix "unstable-" finalAttrs.version}/buck2-${platform-suffix}.zst";
+      url = "https://github.com/facebook/buck2/releases/download/${finalAttrs.version}/buck2-${platform-suffix}.zst";
       hash = archHashes.buck2;
     })
     # rust-project, which is used to provide IDE integration Buck2 Rust projects,
     # is part of the official distribution
     (fetchurl {
-      url = "https://github.com/facebook/buck2/releases/download/${lib.removePrefix "unstable-" finalAttrs.version}/rust-project-${platform-suffix}.zst";
+      url = "https://github.com/facebook/buck2/releases/download/${finalAttrs.version}/rust-project-${platform-suffix}.zst";
       hash = archHashes.rust-project;
     })
   ];
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Fast, hermetic, multi-language build system";
     homepage = "https://buck2.build";
-    changelog = "https://github.com/facebook/buck2/releases/tag/${lib.removePrefix "unstable-" finalAttrs.version}";
+    changelog = "https://github.com/facebook/buck2/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [
       asl20 # or
       mit

pkgs/by-name/bu/buildah-unwrapped/package.nix

@@ -18,13 +18,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "buildah";
-  version = "1.44.0";
+  version = "1.44.1";
 
   src = fetchFromGitHub {
     owner = "podman-container-tools";
     repo = "buildah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/Rv5la54ikmP4qVT19tg0sv0kM+xpQO6w9XU1PpGFk4=";
+    hash = "sha256-EGoH+PvePNw7I28Vq1kH9W0x4lYuUTSa1Rd+fEE8fkc=";
   };
 
   outputs = [

pkgs/by-name/bu/burpsuite/package.nix

@@ -15,7 +15,7 @@ assert lib.assertMsg (
 
 let
   pname = "burpsuite";
-  version = "2026.6";
+  version = "2026.7";
 
   src = fetchurl {
     name = "burpsuite.jar";
@@ -24,7 +24,7 @@ let
       "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
       "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
     ];
-    hash = "sha256-nafdpcXgWpuIinmgYp+uXkfoFkQfhFRsDaxsh+Rgb3M=";
+    hash = "sha256-vZcCNFVEHg1zkhAjSqc6vVzFaU0YdZ27AF+eHLfLazs=";
   };
 
   description = "Integrated platform for performing security testing of web applications";

pkgs/by-name/cd/cdk8s-cli/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.207.40";
+  version = "2.207.41";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bSqvHUw9J9cmMqexZurVS14WFdD8budmjPGZ3Z6yOkc=";
+    hash = "sha256-O1L5cHw8Rrj7bwHJ1tH7idKivSPHyV/9ma8iQ5w87OY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-wmT/CBAebKlaue9/TVRwoe8pavA6Fl+9D+3FbUK3+SM=";
+    hash = "sha256-ShQbJUhLfgPEYHtQ7XgvXuYNt5xOjzT7VorbBLT21us=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.217",
-  "commit": "9963b018d22c3e6659c99e135e687870301b5c67",
-  "buildDate": "2026-07-21T18:45:36Z",
+  "version": "2.1.218",
+  "commit": "bce61b433bc397ce68686368abd12f545b0a013a",
+  "buildDate": "2026-07-22T18:42:19Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "5840c777fd47115e9ca276e165563c6e121e7c7e2b4d86598e0025f8cc37de56",
-      "size": 250456784
+      "checksum": "71abaff59312c9a9b6a1d818365048b42e4e95cc521a823660eded3e0880d9b7",
+      "size": 255069680
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "8387a6fd44edfd40d7e74c5fdc3270a15f5e6b1b58c7c6fee560e70d3d1943da",
-      "size": 259908496
+      "checksum": "9862b74a083e8a4ed572f99cbd4895185e0dd5a0a601affb0fb8e43d8d1f40e6",
+      "size": 264548368
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "40c53507ac669c1d438366c19760c22f52748a06e50e0fc0e353d2cb73425597",
-      "size": 265337760
+      "checksum": "295fd30481bd03b38450fdec2a6e25bb6472c2074f04b0c4a566cd5988f230bf",
+      "size": 269990816
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "2630fc5dc6db61bc03f86b95daf47766e5ed5b61873f7bb7cfea764c5ac5a9ba",
-      "size": 268573680
+      "checksum": "e12071751a9336b8af1012c103358ff04ac18f9aaff4a738cff7ba5cdfaf63f2",
+      "size": 273177584
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e219a631e194e71bccbea2f81f5678c75f745aa6e7a74e8a407610c906d1299b",
-      "size": 258585960
+      "checksum": "efcaae48f8f537a0e9a47b4317a5f8c184706c99ddd8ca0a9a21391e2a766ef8",
+      "size": 263239016
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "7c44188927edbf7b918b41bc7a284292359b1ad556b7802db0148adb4b395732",
-      "size": 263197264
+      "checksum": "62986293277153f5db97404cf7e3e96de136f02c28f79ccd5c7bc99766224db4",
+      "size": 267801168
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6e4a3a4679f381178a90cf741de9ce924a3274304b09277695ac3a679628ca17",
-      "size": 259460768
+      "checksum": "81fcf59bb7abb558aedc6f2361f4723b3d757d28e799962d88b18b4520df66ca",
+      "size": 263931552
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "f0128e1a50b8d7dec5bb4dbdff0ef622f617e798df61ebb009ed3f03d2afe613",
-      "size": 253836448
+      "checksum": "a7959fd87feb9557d56f4e5752f7ed1ddf405f3bea91b2571bf93af636efd193",
+      "size": 258307232
     }
   },
   "sdkCompat": {
@@ -67,7 +67,8 @@
       "0.3.207",
       "0.3.208",
       "0.3.209",
-      "0.3.215"
+      "0.3.215",
+      "0.3.217"
     ],
     "harnessSchema": 1
   }

pkgs/by-name/cl/cliamp/package.nix

@@ -16,16 +16,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliamp";
-  version = "1.57.1";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "cliamp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wRXF2bnl3xFJtuESJX2UVSsPwl4xo6E+k7nIdtzCULo=";
+    hash = "sha256-BbyaZw+OvC6rb60Z2whhHj2iKow/ZJJ8VzuwPX7bHIE=";
   };
 
-  vendorHash = "sha256-A2Ygc1a9e2flZzaNAEXvr8Ui1cE89TxBfUNALmDzIo0=";
+  vendorHash = "sha256-KYjP6qEINdSlcDSEMKxMwDfXzuQPAQSe4oZh+o4PrFs=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.6.1.1193-stable";
-  rev = "6615864161fd5332edfcb2864658bd9ccc65197b";
-  hash = "sha256-S+JJ/bOziG6w+9GSe+KDT2GliL3osRf4Y+WI8x5n2CI=";
+  version = "26.7.1.1315-stable";
+  rev = "a6156303df65c307bdb8b66e9e9cc5637346a6b8";
+  hash = "sha256-jCUSLYmhRLIUvDw3JYDtqmcjW92aJBzfFHyCAtxvlsY=";
   lts = false;
 }

pkgs/by-name/co/code-cursor/sources.json

@@ -1,18 +1,18 @@
 {
-  "version": "3.12.17",
+  "version": "3.12.30",
   "vscodeVersion": "1.128.0",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/x64/Cursor-3.12.17-x86_64.AppImage",
-      "hash": "sha256-Fu00p0vaLNOl9wbGgtseLwhseXxmIQMyyhlNF7VZ+qM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/x64/Cursor-3.12.30-x86_64.AppImage",
+      "hash": "sha256-7gyF8YtWLjFOjAxhqip2fVxTbaBj/4FtLsjw2JpTOD8="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/arm64/Cursor-3.12.17-aarch64.AppImage",
-      "hash": "sha256-/r6lFrSq7aSefGvOWqLw/YmyUy3VocaWRyOUHoHuSeM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/arm64/Cursor-3.12.30-aarch64.AppImage",
+      "hash": "sha256-UKPf2q4py0pN5FlgdwGbTEKA52T7iJpM63z2kemz9h8="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-WaUBglq+Jqa1Cn0sx62ccbBSKhYiBz1u1PjdHxcfQKE="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-uxAWl5wJISEbGSv7yHys29NZDquLe7z6wMNb61HC/7g="
     }
   }
 }

pkgs/by-name/co/concord-tui/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "concord-tui";
-  version = "2.4.1";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "chojs23";
     repo = "concord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3c5jxpJrBr6vYnbcJIYD06d932Da94hXUZA5FLa3kkU=";
+    hash = "sha256-BLfNgIXTTYMr5pFmCBMfu4euKR96GAPLsGTW/AaqJjo=";
   };
 
-  cargoHash = "sha256-6iAyKsS+FoNCKkMvbL70vKSPoAaKQtUDiAQGaEMuxWk=";
+  cargoHash = "sha256-jaHDy/5e9BXXLRe3oc9g3JCCSg28bb1d2dMPkPJTkB4=";
 
   buildInputs = [
     opus

pkgs/by-name/co/conduktor/package.nix

@@ -1,89 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchzip,
-  jdk11,
-  openjfx17,
-  gtk3,
-  glib,
-  pango,
-  cairo,
-  gdk-pixbuf,
-  libxtst,
-  makeBinaryWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-}:
-
-let
-  openjfx_jdk = openjfx17.override { withWebKit = true; };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "conduktor";
-  version = "2.24.9";
-
-  src = fetchzip {
-    url = "https://github.com/conduktor/builds/releases/download/v${finalAttrs.version}/Conduktor-linux-${finalAttrs.version}.zip";
-    hash = "sha256-c9QjlKPZpeJi5YTq4gm+sg7my4EP0LI95AfGguF4ork=";
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      type = "Application";
-      name = "conduktor";
-      desktopName = "Conduktor";
-      genericName = finalAttrs.meta.description;
-      exec = "conduktor";
-      icon = fetchurl {
-        url = "https://github.com/conduktor/builds/raw/v${finalAttrs.version}/.github/resources/Conduktor.png";
-        hash = "sha256-mk4c9ecookRb7gR56cedIWfPfQy2uGF+ZbX6NI90KI0=";
-      };
-      comment = "A beautiful and fully-featured desktop client for Apache Kafka";
-    })
-  ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-    wrapProgram $out/bin/conduktor \
-      --set JAVA_HOME ${jdk11.home} \
-      --set LD_LIBRARY_PATH ${
-        lib.makeLibraryPath [
-          openjfx_jdk
-          gtk3
-          gtk3
-          glib
-          pango
-          cairo
-          gdk-pixbuf
-          libxtst
-        ]
-      } \
-       --add-flags "--module-path ${openjfx_jdk}/lib --add-modules=javafx.controls,javafx.fxml"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Apache Kafka Desktop Client";
-    longDescription = ''
-      Conduktor is a GUI over the Kafka ecosystem, to make the development
-      and management of Apache Kafka clusters as easy as possible.
-    '';
-    homepage = "https://www.conduktor.io/";
-    changelog = "https://www.conduktor.io/changelog/#${finalAttrs.version}";
-    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ trobert ];
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.521.0";
+  version = "1.526.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-uHt22/756jxh34HhIbMEu3nGebbTF1325ylWuKzZzEI=";
+    hash = "sha256-T1DYN/mVqISYtNGD1KBitXPgEIcrKQMqxquC7CywDo4=";
     stripRoot = false;
   };
 

pkgs/by-name/co/coroot/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.23.3";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-93WJv11NDk2/ScmdE4D2E8JmyBlP4FYuX7j4Jbm8bDE=";
+    hash = "sha256-50VB7qONhRQ5FehPH6uemA8+4HZin/vdJ7JmD0S7AEk=";
   };
 
-  vendorHash = "sha256-npMQah59pJqF6wgD2dlEleneIZbP/atDGEpjjb+KCpI=";
+  vendorHash = "sha256-P7EXBRG6OYIwaoObqpKBK2n0f6QYphr+DRNLbfysotA=";
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/front";
     hash = "sha256-5N4dmtKdZgwulqxFHYKhnHOYAg0gnb/rzVVcmzjYFUg=";

pkgs/by-name/co/cotp/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cotp";
-  version = "1.9.10";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yVzVo4l2bMZXrWlDfJXSgHUmic7Fe0Og+I5ROv3iQCQ=";
+    hash = "sha256-L/HxdNufqmNZ8pF8tQ1VuOJIz+pEQN5IRpmg2+QTYos=";
   };
 
-  cargoHash = "sha256-M0lI/DAMUVRMNbvoLc2w7PtU0rjjXiMYZM6vzfdEi0s=";
+  cargoHash = "sha256-Es9X9PDFeluHtPrOImLhWUstrawopX5yShdN0G7TuzI=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 

pkgs/by-name/cr/crush/package.nix

@@ -11,16 +11,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "crush";
-  version = "0.81.0";
+  version = "0.86.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FOvkCQxDW1dipzIzgQz2uvHIv6bm/TVV1WwhrvmBDWg=";
+    hash = "sha256-dUeXU65A9/d365a9Z+eUoHOR0RnJV9SAYsks+Vtz9js=";
   };
 
-  vendorHash = "sha256-4gHvyEqiFhEvZ90lJbXeI/1fMMo6L19P/PD5Eu5YUmI=";
+  vendorHash = "sha256-9WkkosPMwXsj32a5Zj4ZxphuB7aVteKq/YTzxP9Xmf0=";
 
   ldflags = [
     "-s"

pkgs/by-name/cs/csvtk/package.nix

@@ -7,7 +7,7 @@
   buildPackages,
 }:
 let
-  version = "0.33.0";
+  version = "0.37.0";
 in
 buildGoModule {
   pname = "csvtk";
@@ -17,10 +17,13 @@ buildGoModule {
     owner = "shenwei356";
     repo = "csvtk";
     tag = "v${version}";
-    hash = "sha256-Zacs1hw4pryVNxnrkLIoBNWo0jcKjtYdx6kW2LTFEIs=";
+    hash = "sha256-dpWxLOckdA0tNhSM8wGqBag/cXmMFhonybN+W1+KBXA=";
   };
 
-  vendorHash = "sha256-T9flXxly3i8SKQlhp4AF2FNCqgcnGAHxv5b7nqzM3DI=";
+  vendorHash = "sha256-wi7WPwCg0MoNxgCLZO1UxG4M0g/Vo/GCiCGu8c5avyU=";
+
+  # stale upstream test: asserts byte length, but expr-lang now returns rune count
+  checkFlags = [ "-skip=TestMutate3" ];
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ct/ctx7/package.nix

@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.4";
+  version = "0.5.5";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
+    hash = "sha256-Ea281W/CT/TfFNFMKV7xQzXnMo/25mCAB/Gs9ofyUU4=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
+    hash = "sha256-F1A0y4uZczVqzce0FfugCaU5Y2qqMZQXy7T6oqlgkbA=";
   };
 
   buildPhase = ''

pkgs/by-name/cz/czkawka/package.nix

@@ -15,6 +15,7 @@
   libxi,
   libxkbcommon,
   libxrandr,
+  lld,
   pango,
   pkg-config,
   rustPlatform,
@@ -44,6 +45,9 @@ let
       gobject-introspection
       pkg-config
       wrapGAppsHook4
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      lld # ld crashes
     ];
 
     buildInputs = [

pkgs/by-name/da/datafusion-cli/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "datafusion-cli";
-  version = "54.0.0";
+  version = "54.1.0";
 
   src = fetchFromGitHub {
     name = "datafusion-cli-source";
     owner = "apache";
     repo = "datafusion";
     tag = finalAttrs.version;
-    hash = "sha256-BWpHiLCn7idvzI2rlsre8l23TbxQU1Ma6bCjAMxQ6m8=";
+    hash = "sha256-zeR6eyU4Cc5gHiE331ap8wuyYEj7s7BgqB+oOKwMfZw=";
   };
 
-  cargoHash = "sha256-Sj/biBiJPIYwxpL+Fua0k47vOu6gyyAhcKb4ZSUli6k=";
+  cargoHash = "sha256-XXR1Turs+QwONZHq38MZHbcjv5DYZH9iqeuBl20gy3U=";
 
   buildAndTestSubdir = "datafusion-cli";
 

pkgs/by-name/di/di-tui/package.nix

@@ -2,17 +2,18 @@
   lib,
   nix-update-script,
   buildGoModule,
-  fetchFromGitHub,
+  fetchFromGitea,
 }:
 buildGoModule (finalAttrs: {
   pname = "di-tui";
-  version = "1.14.0";
+  version = "1.15.0";
 
-  src = fetchFromGitHub {
-    owner = "acaloiaro";
+  src = fetchFromGitea {
+    domain = "code.adriano.fyi";
+    owner = "me";
     repo = "di-tui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P784Tf3XA/28PgKTr89yizKAX1MhAb4877gV7vVHBYE=";
+    hash = "sha256-3dYcecrDSfd5sP5PjkagbFt2RmhaQSVw6kMt9J7wyeM=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
@@ -21,7 +22,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Simple terminal UI player for di.fm";
-    homepage = "https://github.com/acaloiaro/di-tui";
+    homepage = "https://code.adriano.fyi/me/di-tui";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.acaloiaro ];
     mainProgram = "di-tui";

pkgs/by-name/do/dokuwiki/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
-  version = "2025-05-14b";
+  version = "2026-07-14a";
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
     repo = "dokuwiki";
     rev = "release-${version}";
-    sha256 = "sha256-J7B+mvvGtAPK+WjlkHyadG61vli+zZfozfEmEynYQaE=";
+    sha256 = "sha256-qj+Ng20aB3qV2afrER309kvlh6gXRFPh3MqnomvvCf4=";
   };
 
   preload = writeText "preload.php" ''

pkgs/by-name/ea/earlybird/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "earlybird";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "americanexpress";
     repo = "earlybird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P8kA9MJA+2jtVOYLBu0oG9xTUTGCtiX4R+4ecmXDAAw=";
+    hash = "sha256-Wjvg0+IQHIB5wFwY+4grTOagk5fHMf6YlIB83Jv/ZwE=";
   };
 
   vendorHash = "sha256-pQ8gSDHsdDT/cgvRB0OSqnMZz2W5vAzFBzph0xksC2o=";

pkgs/by-name/ed/eddie/package.nix

@@ -17,7 +17,6 @@
   openvpn,
   stunnel,
 
-  gtk2,
   libayatana-indicator,
 
   mono,
@@ -70,7 +69,6 @@ buildDotnetModule (finalAttrs: {
   ];
 
   runtimeInputs = lib.makeLibraryPath [
-    gtk2
     gtk3
     libayatana-indicator
   ];

pkgs/by-name/et/etherpad-lite/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   nix-update-script,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeWrapper,
@@ -30,14 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-scJhcZDyqUVdKv/EQvB5+EJN/SvMw220+QOcTUxTFJQ=";
   };
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     makeWrapper
   ];
 
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper ${lib.getExe nodejs} $out/bin/etherpad-lite \
       --inherit-argv0 \
       --add-flags "--require tsx/cjs $out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node/server.ts" \
-      --suffix PATH : "${lib.makeBinPath [ pnpm_9 ]}" \
+      --suffix PATH : "${lib.makeBinPath [ pnpm_10 ]}" \
       --set NODE_PATH "$out/lib/node_modules:$out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node_modules" \
       --set-default NODE_ENV production
     find $out/lib -xtype l -delete

pkgs/by-name/ex/exim/package.nix

@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "exim";
-  version = "4.99.4";
+  version = "4.99.5";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/exim-${finalAttrs.version}.tar.xz";
-    hash = "sha256-h/84gVcA37HuTrfo26eRbfenVZBTVNLQ+qGuF5DE/Z0=";
+    hash = "sha256-wtL4Ctx8cdQk/YKkZlXqotfZtMoud4g+upB2lHt+5ic=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ex/expresslrs-configurator/package.nix

@@ -12,7 +12,7 @@
 
 let
   pname = "expresslrs-configurator";
-  version = "1.8.1";
+  version = "1.8.2";
   installPath = "share/${pname}";
   resourcesPath = "${installPath}/resources";
 in
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   src = fetchzip {
     url = "https://github.com/ExpressLRS/ExpressLRS-Configurator/releases/download/v${version}/${pname}-${version}.zip";
     stripRoot = false;
-    hash = "sha256-3f2/ifXLs/gHZVVDI0EUBP05FEHH8exDvBzALDXq0Wo=";
+    hash = "sha256-fVERT1JkXYwEqP0UJZZxT8AgkEMRzlvSqWPM4Zo9KXU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/f3/f3d/package.nix

@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Fast and minimalist 3D viewer using VTK";
-    homepage = "https://f3d-app.github.io/f3d";
+    homepage = "https://f3d.app";
     changelog = "https://github.com/f3d-app/f3d/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [

pkgs/by-name/fa/faas-cli/package.nix

@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "faas-cli";
-  version = "0.18.10";
+  version = "0.18.11";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-MctMhuaXJpm25VKqlhaAPG2QzSDQ//Ei8B1lRCKdz68=";
+    sha256 = "sha256-4bfp9nM6cAglx9mNzjQZ4uo6nJNWI9Q9g9zIdkev9FM=";
   };
 
   vendorHash = null;

pkgs/by-name/fi/filebeat8/package.nix

@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.17";
+  version = "8.19.19";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xpth1SoXMXCUh/DFf3wA+Ql6SedtUB7tCYzDElpX5Lc=";
+    hash = "sha256-3hvP+4U3PWlOsaLHO1MZuIpcB6YzPv2dMPlC68esiHE=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-Wxk+eI0XfBpQqqUNuskyr+/bTRqT38hszdkz/LJweQo=";
+  vendorHash = "sha256-e++Y5mhwms/uJnZCUyZNifoYqGH4TGEugSFHSGl0AQE=";
 
   subPackages = [ "filebeat" ];
 

pkgs/by-name/fi/firezone-server/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   beam27Packages,
   gitMinimal,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -34,10 +34,10 @@ beam27Packages.mixRelease rec {
 
   pnpmDeps = fetchPnpmDeps {
     inherit pname version;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
     src = "${src}/apps/web/assets";
-    fetcherVersion = 3;
-    hash = "sha256-tB0y3T/dZBe8BHz7AV913zQ4oQu7VLyqHCnzBycNg18=";
+    fetcherVersion = 4;
+    hash = "sha256-Uq6dAYYWT8G6upYcNEzVc8Gb2HUj8SaWRD0/w0quaRE=";
   };
   pnpmRoot = "apps/web/assets";
 
@@ -63,7 +63,7 @@ beam27Packages.mixRelease rec {
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     nodejs
   ];
 

pkgs/by-name/fl/flexget/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.19.28";
+  version = "3.19.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NEBE39rqYegFO7f1fd0rTIZzkamuQM+5d3dD/zYHCoU=";
+    hash = "sha256-LfitvBEg9qjv6glIK9KbttM/5nSnKA0i8+Q8gCNMVx8=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/fl/flightgear/openscenegraph-flightgear.nix

@@ -9,7 +9,6 @@
   fetchurl,
   glib,
   libxml2,
-  pcre,
   zlib,
   libjpeg,
   giflib,
@@ -53,7 +52,6 @@ stdenv.mkDerivation {
     ++ [
       glib
       libxml2
-      pcre
       zlib
       libjpeg
       giflib

pkgs/by-name/fr/frankenphp/package.nix

@@ -30,13 +30,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "frankenphp";
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchFromGitHub {
     owner = "php";
     repo = "frankenphp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DzncOAhdDyc5qOipMI8OPss0WciAQIam6GmaUoe8mR8=";
+    hash = "sha256-1f+3w9x6P1euUZr4hC4jOkgEJEbS/MJ11u+chGShCno=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/caddy";
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-XY5a8pd5vJ/ouZMASzVqPoeXVfPbnEVDJFKkVNQF+2M=";
+  vendorHash = "sha256-d6ZTi1Ihu011eKVdHMiW9oSdPB4SYpDHMFxH65XLGac=";
 
   buildInputs = [
     phpUnwrapped

pkgs/by-name/fr/freeipa/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  fetchpatch,
   pkg-config,
   autoconf,
   automake,
@@ -75,26 +74,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freeipa";
-  version = "4.12.5";
+  version = "4.13.1";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${finalAttrs.version}.tar.gz";
-    hash = "sha256-jvXS9Hx9VGFccFL19HogfH15JVIW7pc3/TY1pOvJglM=";
+    hash = "sha256-U1MSfXxWynK8LUWDdtRX+LDMRRzb0x3Hk5qIBY6RUnw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "support-pyca-44.0";
-      url = "https://github.com/freeipa/freeipa/pull/7619/commits/2dc4133920fe58ce414c545102c74173d40d1997.patch";
-      hash = "sha256-PROnPc/1qS3hcO8s5sel55tsyZ1VPjEKLcua8Pd4DP0=";
-    })
-    (fetchpatch {
-      name = "fix-tripledes-cipher-warnings";
-      url = "https://github.com/freeipa/freeipa/pull/7619/commits/e2bf6e4091c7b5320ec6387dab2d5cabe4a9a42d.patch";
-      hash = "sha256-AyMK0hjXMrFK4/qIcjPMFH9DKvnvYOK2QS83Otcc+l4=";
-    })
-  ];
-
   nativeBuildInputs = [
     python3Packages.wrapPython
     jre

pkgs/by-name/fr/freetube/package.nix

@@ -22,13 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-oXa+3BXLVDTaLUzt0imgTtZ4/NywibFzul/y0wymnWk=";
+    hash = "sha256-CQiwAoOJoAZpcDIwqcOfUAvJHLWTdj8fIInlR3qyjg8=";
   };
 
   __structuredAttrs = true;
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-xHlxmeMtMd9/ImheeMH1K22MC0zmIzzgAHXzK+tLnQc=";
+    hash = "sha256-NWCgUjBuSeEl65mmAeJzOyIxCi2ha0Nr5qjOQq+CtMQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gitea-actions-runner/package.nix

@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jkK61OZgbMDHD5yxrpyP1BWCVzDiR79dVaC5ItS99BU=";
+    hash = "sha256-aiba7Tdyyy8aDzJq62zOWNkEZE+twIxReW7clbIoVTI=";
   };
 
-  vendorHash = "sha256-5K0vL0CDYgL/Ud7i4um3mz887Er4qmuhCd9dt5zyUHA=";
+  vendorHash = "sha256-Zpq/G/SZ959SRUIMGo2votFv4DzB46OmPmZwFoae3gU=";
 
   # Tests require network access (artifactcache tests try to determine outbound IP)
   doCheck = false;

pkgs/by-name/gi/gitlab-container-registry/package.nix

@@ -6,7 +6,7 @@
 
 buildGo125Module rec {
   pname = "gitlab-container-registry";
-  version = "4.39.0";
+  version = "4.40.2";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo125Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
+    hash = "sha256-k94uEM2VoOtdFRXWm6CDmeRt8LMXSNegRGes3ZKPg0I=";
   };
 
-  vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
+  vendorHash = "sha256-MD98JYwTo/t5/E7clIlUfjmv8t7nDPpVElbuYDRjMMc=";
 
   excludedPackages = [
     "devvm/*"

pkgs/by-name/gi/gitoxide/package.nix

@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.55.0";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UtdXlIvX82UUhc4RWZZTBV5kz4YqfOTd4D/pGhDUfSI=";
+    hash = "sha256-2zNXe+niwH8oDZEx6It7APggOtL7vrnRGKO4OoteTIw=";
   };
 
-  cargoHash = "sha256-Kv0NKA3OdHBn2M8DmcGyjcN2acGJYOdbczOb/nRsvDs=";
+  cargoHash = "sha256-u9O4y6W0TuwdedNaQ127Bz4d3Olw9RzV/+AzxAstJQE=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/go/godotpcktool/package.nix

@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "godotpcktool";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "hhyyrylainen";
     repo = "GodotPckTool";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H0v432PyKscazR9PN5d+MmYZ8ND497m3RHmWpw16UY4=";
+    hash = "sha256-v8etiUKVxSgVSB3ARqdLgbp3SEC12xBf0HXDl1RJRug=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/go/google-chrome/package.nix

@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.181";
+    version = "150.0.7871.186";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-/sUJBfexI1pECXeoM0duAWKHT1ynnlBs30C3GvZNkvQ=";
+      hash = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.182";
+    version = "150.0.7871.187";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/mb6usb7722qbv5pqtlgpq72utm_150.0.7871.182/GoogleChrome-150.0.7871.182.dmg";
-      hash = "sha256-eNrCQqKqd+6cuvGDbQ0VM5JpolHusOZou2elsAh0TD4=";
+      url = "http://dl.google.com/release2/chrome/ecziwrw2etq4lm3vlbpv5wzvce_150.0.7871.187/GoogleChrome-150.0.7871.187.dmg";
+      hash = "sha256-I1a+wR5zNfOSYyns2ehDek5DP1xccRQvmBLymxB/R7A=";
     };
 
     dontPatch = true;

pkgs/by-name/go/goose/package.nix

@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "goose";
-  version = "3.27.2";
+  version = "3.27.3";
 
   src = fetchFromGitHub {
     owner = "pressly";
     repo = "goose";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4m/YYyQtz/Nj94vIUxChgmDsJVZqtzmp7qsSiuZVB38=";
+    hash = "sha256-CSS0OtC4/EeQD7PGin64U0Fag2z490RQ7CKNBRyp8f8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-8riGHomL3wKqBOPOzgE13jWYjJT03tqz1UMWR/01pcE=";
+  vendorHash = "sha256-opO6G9Fdyt27GlWyaB/6J1xhm3wTgH9Xc/FYcLcqBVs=";
 
   # skipping: end-to-end tests require a docker daemon
   postPatch = ''

pkgs/by-name/go/gotosocial/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rslzi9WqPqN/wm9PN6SWdXtLdMRJJV6Hhb3whJ0RicU=";
+    hash = "sha256-fRMQISOYf0rGcnNBpdlDeYWO0vvVwW0UPXdeT1y0+Ec=";
   };
 
   vendorHash = null;

pkgs/by-name/gt/gtkwave/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtkwave";
-  version = "3.3.127";
+  version = "3.3.128";
 
   src = fetchurl {
     url = "mirror://sourceforge/gtkwave/gtkwave-gtk3-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-8Z2i20Oye7zGaXJYQ0UZRaaMOkziMlYuNB1vY7gLVeQ=";
+    sha256 = "sha256-gX4Zf8GAj4qsNUPCwvloPLATaMkRkrjq5a9YBw7x0fg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/he/headlamp-frontend/package.nix

@@ -12,7 +12,7 @@ buildNpmPackage {
 
   sourceRoot = "${headlamp-server.src.name}/frontend";
 
-  npmDepsHash = "sha256-73xc/GK1Cvz67D6ftYVRe5GARNgG5qD86CGK6uhoyWA=";
+  npmDepsHash = "sha256-v8aMlOk2JD2DzcUMWTK+2QP44n1Nl0LQPcIry7W51vg=";
 
   postPatch = ''
     chmod -R u+w ../app

pkgs/by-name/he/headlamp-server/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "headlamp-server";
-  version = "0.42.0";
+  version = "0.43.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -17,12 +17,12 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = "headlamp";
     tag = "v${version}";
-    hash = "sha256-SBPSh6dsKvMw1C80THri0mNPoTMgcrjONk455S/g9v0=";
+    hash = "sha256-6TGKBKR0WR4Xv7lGCgMFVG/nc19oMOP5cJcgT0bw6Ag=";
   };
 
   modRoot = "backend";
 
-  vendorHash = "sha256-dBU053QtUEMWjzkOEHzELH3j7PJOKuoBZCVZFmZ5z7E=";
+  vendorHash = "sha256-U0H1Dj38ajRGFqcWszveWckxenaKa4nrPg81GyIpS0U=";
 
   # Don't embed frontend - Electron serves it directly. This also prevents
   # the server from auto-opening a browser window.

pkgs/by-name/he/headlamp/package.nix

@@ -17,7 +17,7 @@ buildNpmPackage {
 
   sourceRoot = "${headlamp-server.src.name}/app";
 
-  npmDepsHash = "sha256-k7rABbEmYY24k/obKm1GZUnM0Udjtyv2bhrVEvc0ebc=";
+  npmDepsHash = "sha256-gZr+ni3dmrjqHDwoFxgGM0/Kf3R1Qy2SZetLtGtDY+0=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 

pkgs/by-name/he/heimdall-proxy/package.nix

@@ -4,7 +4,7 @@
   lib,
 }:
 let
-  version = "0.17.17";
+  version = "0.17.18";
 in
 buildGoModule {
   pname = "heimdall-proxy";
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "dadrus";
     repo = "heimdall";
     tag = "v${version}";
-    hash = "sha256-LRanZw1LCt1ICrQcnxFHHr89ryT6GdkO/xwkd7rlPTI=";
+    hash = "sha256-XNcUn/Xr1zYEfURX1POwGdSZqdmPTA8SqRzP+4qNECE=";
   };
 
-  vendorHash = "sha256-efDG99grxfm+uIHVzYK0O/51NsaIk70E2LO2fjJ8Hxs=";
+  vendorHash = "sha256-r2IpMllA8EDCGwz91qXhsRR2LoTqRbxPXfN6PIJWvqk=";
 
   tags = [ "sqlite" ];
 

pkgs/by-name/he/herdr/package.nix

@@ -12,7 +12,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "herdr";
-  version = "0.7.4";
+  version = "0.7.5";
 
   __structuredAttrs = true;
 
@@ -20,16 +20,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "ogulcancelik";
     repo = "herdr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dBOQYLFitJ+E3XNz44Ag3CIrBxFj16CmVPp7qil0ssg=";
+    hash = "sha256-3BA8eredGku+vsL2Af7sUf43QiArR5XTHNrI+X11vFM=";
   };
 
-  cargoHash = "sha256-XHzZy2tKLbMQy4POmXowUcGf77ZPunG/oQ3P2wOoVls=";
+  cargoHash = "sha256-lWnc0Ka0hp7bbm+dkKKj22Dbk+Cwrld86romXs3lzBs=";
 
   zigDeps = zig_0_15.fetchDeps {
     inherit (finalAttrs) pname version;
     src = "${finalAttrs.src}/vendor/libghostty-vt";
     fetchAll = true;
-    hash = "sha256-pgGu8+NwvFcj6SrN4VaTHLeHdA7QY731ctyrHZwgFAc=";
+    hash = "sha256-PnM+hZIlLyQwK8vJgd/Bhjt1lNIz06T8FahwliRmMrY=";
   };
 
   nativeBuildInputs = [
@@ -77,7 +77,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://herdr.dev";
     changelog = "https://github.com/ogulcancelik/herdr/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ kevinpita ];
+    maintainers = with lib.maintainers; [
+      kevinpita
+      faukah
+    ];
     mainProgram = "herdr";
     platforms = lib.platforms.unix;
   };

pkgs/by-name/hm/hmcl/0001-nix-use-terracotta-from-nix.patch

@@ -4,14 +4,14 @@ Date: Wed, 4 Feb 2026 15:36:17 +0800
 Subject: [PATCH 1/2] nix: use terracotta from nix
 
 ---
- .../hmcl/terracotta/TerracottaBundle.java     | 21 +++----------------
- 1 file changed, 3 insertions(+), 18 deletions(-)
+ .../hmcl/terracotta/TerracottaBundle.java     | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
 
 diff --git a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
-index 727edde9b..5b6e8b02f 100644
+index ecc99f3..b46ada0 100644
 --- a/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
 +++ b/HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java
-@@ -139,26 +139,11 @@ public final class TerracottaBundle {
+@@ -147,26 +147,11 @@ public final class TerracottaBundle {
      }
  
      public Path locate(String file) {
@@ -33,20 +33,13 @@ index 727edde9b..5b6e8b02f 100644
 -                return AbstractTerracottaProvider.Status.LEGACY_VERSION;
 -            }
 -        } catch (IOException e) {
--            Logger.LOG.warning("Cannot determine whether legacy versions exist.", e);
+-            LOG.warning("Cannot determine whether legacy versions exist.", e);
 -        }
 -        return AbstractTerracottaProvider.Status.NOT_EXIST;
 +        return AbstractTerracottaProvider.Status.READY;
      }
  
      private boolean isLocalBundleValid() throws IOException { // FIXME: Make control flow clearer.
-@@ -188,4 +173,4 @@ public final class TerracottaBundle {
-         }
-         return true;
-     }
--}
-+}
-\ No newline at end of file
 -- 
 2.52.0
 

pkgs/by-name/hm/hmcl/package.nix

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.15.3";
+  version = "3.16.2";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-/7RLhSHCnxtKxmusjnrfUEweYXzOoKcQO3G9+loBofk=";
+    hash = "sha256-kvQDDZwA2sy8UQLZG4FqGmSh0sDcEuSg5CM6uy0DzCc=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for
@@ -71,12 +71,12 @@ stdenv.mkDerivation (finalAttrs: {
   terracottaBundleJava = fetchurl {
     name = "hmcl-terracotta-bundle-java-${finalAttrs.version}";
     url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.terracottaBundleJavaPath}";
-    hash = "sha256-1o/CUDeywtDlhAxqInk77aUwGCCYeZ84VMIyouN49uU=";
+    hash = "sha256-dZHRim/7VNW0/nA6I8r3t5zGfzIMxG2lzdZ//dzv2Gs=";
   };
   macOSProviderJava = fetchurl {
     name = "hmcl-macos-provider-java-${finalAttrs.version}";
     url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.macOSProviderJavaPath}";
-    hash = "sha256-+Zji2B8ksT7P+IObyrM9q7vHPJVl5ZtH+v/J8Mfr0Q4=";
+    hash = "sha256-7vI2U8vx3GYwlshoHJF/J8n2RS6TZ/cvoAivqYtW23Q=";
   };
   terracottaBundleJavaPath = "HMCL/src/main/java/org/jackhuang/hmcl/terracotta/TerracottaBundle.java";
   macOSProviderJavaPath = "HMCL/src/main/java/org/jackhuang/hmcl/terracotta/provider/MacOSProvider.java";

pkgs/by-name/hy/hyperscan/package.nix

@@ -8,7 +8,7 @@
   util-linux,
   pkg-config,
   boost,
-  pcre,
+  pcre2,
   withStatic ? false, # build only shared libs by default, build static+shared if true
 }:
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = lib.optionalString withStatic (
     ''
       mkdir -p pcre
-      tar xvf ${pcre.src} --strip-components 1 -C pcre
+      tar xvf ${pcre2.src} --strip-components 1 -C pcre
     ''
     # - CMake 4 dropped support of versions lower than 3.5, versions lower than 3.10 are deprecated.
     #   https://github.com/NixOS/nixpkgs/issues/445447
@@ -111,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    broken = stdenv.hostPlatform.isStatic; # A minimum of SSSE3 compiler support is required
     description = "High-performance multiple regex matching library";
     longDescription = ''
       Hyperscan is a high-performance multiple regex matching library.

pkgs/by-name/hy/hyprmag/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  cmake,
+  pkg-config,
+  wayland-scanner,
+  cairo,
+  libGL,
+  libjpeg,
+  libxkbcommon,
+  pango,
+  wayland,
+  wayland-protocols,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "hyprmag";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "SIMULATAN";
+    repo = "hyprmag";
+    tag = finalAttrs.version;
+    hash = "sha256-IHYxQeCcPH2XoRyTgFEi+HVlWGVAnaTdS0Jf96H9PNU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    cairo
+    libGL
+    libjpeg
+    libxkbcommon
+    pango
+    wayland
+    wayland-protocols
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "wlroots-compatible Wayland screen magnifier, based on hyprpicker";
+    homepage = "https://github.com/SIMULATAN/hyprmag";
+    changelog = "https://github.com/SIMULATAN/hyprmag/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ samiser ];
+    mainProgram = "hyprmag";
+    platforms = lib.platforms.linux;
+  };
+})