Merge master into staging-nixos

Changelog: https://github.com/lxc/incus-compose/blob/refs/tags/v1.3.4/CHANGELOG.md

doc/doc-support/include-to-nav.py

@@ -6,9 +6,10 @@ from typing import TypedDict
 
 # Coupled to where this file lives!
 # Needed to resolve the relative includes file paths
-DOC_ROOT = Path(__file__).resolve().parent.parent
+REPO_ROOT = Path(__file__).resolve().parent.parent.parent
 
-ROOT_FILE = DOC_ROOT / "manual.md.in"
+ROOT_FILE = REPO_ROOT / "nixos/doc/manual/manual.md"
+DOC_ROOT = ROOT_FILE.parent
 
 INCLUDE_RE = re.compile(r"^```\{=include=\}(?P<rest>.*)$")
 FENCE_RE = re.compile(r"^(```|~~~)")

doc/doc-support/lib-function-docs.nix

@@ -1,151 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
 # To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
 {
-  lib,
   stdenvNoCC,
   nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "fetchers";
-      description = "functions which can be reused across fetchers";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivations, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
 }:
-
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
   src = ../../lib;
 
-  nativeBuildInputs = [
-    nixdoc
-    nix
-  ];
+  nativeBuildInputs = [ nixdoc ];
+
+  buildPhase = ''
+    mkdir -p src
+    cp -r ${../../lib} src/lib
+
+    mkdir -p $out
+    nixdoc --manifest ${../function-catalog.json} --root src --output $out/lib-functions.json
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    cd ..
-
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      --store $(mktemp -d) \
-      > locations.json
-
-    function docgen {
-      name=$1
-      baseName=$2
-      description=$3
-      # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
-      else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
-      fi
-      echo "$out/$name.md" >> "$out/index.md"
-    }
-
-    mkdir -p "$out"
-
-    cat > "$out/index.md" << 'EOF'
-    ```{=include=} sections auto-id-prefix=auto-generated
-    EOF
-
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
-
-    echo '```' >> "$out/index.md"
-
     runHook postInstall
   '';
 }

doc/doc-support/lib-function-locations.nix

@@ -1,82 +0,0 @@
-{
-  nixpkgsPath,
-  revision,
-  libsetsJSON,
-}:
-let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
-
-  libDefPos =
-    prefix: set:
-    builtins.concatMap (
-      name:
-      [
-        {
-          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
-          location = builtins.unsafeGetAttrPos name set;
-        }
-      ]
-      ++ lib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
-        libDefPos (prefix ++ [ name ]) set.${name}
-      )
-    ) (builtins.attrNames set);
-
-  libset =
-    toplib:
-    map (subsetname: {
-      subsetname = subsetname;
-      functions = libDefPos [ ] toplib.${subsetname};
-    }) (map (x: x.name) libsets);
-
-  flattenedLibSubset =
-    { subsetname, functions }:
-    map (fn: {
-      name = "lib.${subsetname}.${fn.name}";
-      value = fn.location;
-    }) functions;
-
-  locatedlibsets = libs: map flattenedLibSubset (libset libs);
-  removeFilenamePrefix =
-    prefix: filename:
-    let
-      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
-      filenameLen = builtins.stringLength filename;
-      substr = builtins.substring prefixLen filenameLen filename;
-    in
-    substr;
-
-  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);
-
-  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));
-
-  fnLocationRelative =
-    { name, value }:
-    {
-      inherit name;
-      value = value // {
-        file = removeNixpkgs value.file;
-      };
-    };
-
-  relativeLocs = (map fnLocationRelative liblocations);
-  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
-
-  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
-  jsonLocs = builtins.listToAttrs (
-    map (
-      { name, value }:
-      {
-        name = sanitizeId name;
-        value =
-          let
-            text = "${value.file}:${toString value.line}";
-            target = "${urlPrefix}/${value.file}#L${toString value.line}";
-          in
-          "[${text}](${target}) in `<nixpkgs>`";
-      }
-    ) relativeLocs
-  );
-
-in
-jsonLocs

doc/doc-support/package.nix

@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
-      cat ./functions/library.md.in ${lib-docs}/index.md > ./functions/library.md
+      cp ${lib-docs}/lib-functions.json ./lib-functions.json
 
       substitute ./manual.md.in ./manual.md \
         --replace-fail '@MANUAL_VERSION@' '${lib.version}'
@@ -147,7 +147,7 @@ stdenvNoCC.mkDerivation (
     '';
 
     passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
+      lib-docs = callPackage ./lib-function-docs.nix { };
 
       epub = callPackage ./epub.nix { };
 

doc/function-catalog.json

@@ -0,0 +1,124 @@
+{
+  "version": 1,
+  "groups": [
+    { "id": "asserts", "description": "assertion functions" },
+    { "id": "attrsets", "description": "attribute set functions" },
+    { "id": "strings", "description": "string manipulation functions" },
+    { "id": "versions", "description": "version string functions" },
+    { "id": "trivial", "description": "miscellaneous functions" },
+    { "id": "fixedPoints", "description": "explicit recursion functions" },
+    { "id": "lists", "description": "list manipulation functions" },
+    { "id": "debug", "description": "debugging functions" },
+    { "id": "options", "description": "NixOS / nixpkgs option handling" },
+    { "id": "path", "description": "path functions" },
+    {
+      "id": "fetchers",
+      "description": "functions which can be reused across fetchers"
+    },
+    { "id": "filesystem", "description": "filesystem functions" },
+    { "id": "fileset" },
+    { "id": "sources", "description": "source filtering functions" },
+    { "id": "cli", "description": "command-line serialization functions" },
+    {
+      "id": "generators",
+      "description": "functions that create file formats from nix data structures"
+    },
+    {
+      "id": "gvariant",
+      "description": "GVariant formatted string serialization functions"
+    },
+    {
+      "id": "customisation",
+      "description": "Functions to customise (derivation-related) functions, derivations, or attribute sets"
+    },
+    { "id": "meta", "description": "functions for derivation metadata" },
+    {
+      "id": "derivations",
+      "description": "miscellaneous derivation-specific functions"
+    }
+  ],
+  "sources": [
+    { "path": "lib.trivial", "file": "lib/trivial.nix", "groups": ["trivial"] },
+    {
+      "path": "lib.fixedPoints",
+      "file": "lib/fixed-points.nix",
+      "groups": ["fixedPoints"]
+    },
+    {
+      "path": "lib.attrsets",
+      "file": "lib/attrsets.nix",
+      "groups": ["attrsets"]
+    },
+    { "path": "lib.lists", "file": "lib/lists.nix", "groups": ["lists"] },
+    { "path": "lib.strings", "file": "lib/strings.nix", "groups": ["strings"] },
+    {
+      "path": "lib.customisation",
+      "file": "lib/customisation.nix",
+      "groups": ["customisation"]
+    },
+    {
+      "path": "lib.derivations",
+      "file": "lib/derivations.nix",
+      "groups": ["derivations"]
+    },
+    { "path": "lib.meta", "file": "lib/meta.nix", "groups": ["meta"] },
+    {
+      "path": "lib.versions",
+      "file": "lib/versions.nix",
+      "groups": ["versions"]
+    },
+    { "path": "lib.cli", "file": "lib/cli.nix", "groups": ["cli"] },
+    {
+      "path": "lib.gvariant",
+      "file": "lib/gvariant.nix",
+      "groups": ["gvariant"]
+    },
+    {
+      "path": "lib.generators",
+      "file": "lib/generators.nix",
+      "groups": ["generators"]
+    },
+    { "path": "lib.asserts", "file": "lib/asserts.nix", "groups": ["asserts"] },
+    { "path": "lib.debug", "file": "lib/debug.nix", "groups": ["debug"] },
+    {
+      "path": "lib.fetchers",
+      "file": "lib/fetchers.nix",
+      "groups": ["fetchers"]
+    },
+    { "path": "lib.path", "file": "lib/path/default.nix", "groups": ["path"] },
+    {
+      "path": "lib.filesystem",
+      "file": "lib/filesystem.nix",
+      "groups": ["filesystem"]
+    },
+    {
+      "path": "lib.fileset",
+      "file": "lib/fileset/default.nix",
+      "groups": ["fileset"]
+    },
+    {
+      "path": "lib.sources",
+      "file": "lib/sources.nix",
+      "groups": ["sources"],
+      "mode": "deep",
+      "include": [
+        "pathIsGitRepo",
+        "commitIdFromGitRepo",
+        "cleanSource",
+        "cleanSourceWith",
+        "cleanSourceFilter",
+        "pathHasContext",
+        "canCleanSource",
+        "urlToName",
+        "shortRev",
+        "revOrTag",
+        "repoRevToName",
+        "sourceByRegex",
+        "sourceFilesBySuffices",
+        "sourceByGlobs",
+        "trace"
+      ]
+    },
+    { "path": "lib.options", "file": "lib/options.nix", "groups": ["options"] }
+  ]
+}

doc/functions/library.md

@@ -1,5 +1,3 @@
 # Nixpkgs Library Functions {#sec-functions-library}
 
 Nixpkgs provides a standard library at `pkgs.lib`, or through `import <nixpkgs/lib>`.
-
-<!-- nixdoc-generated documentation must be appended here during build! -->

doc/nav.json

@@ -628,9 +628,12 @@
           "file": "functions.md"
         },
         {
-          "id-prefix": "auto-generated",
           "file": "functions/library.md"
         },
+        {
+          "collection": "lib-functions.json",
+          "type": "nixdoc"
+        },
         {
           "file": "functions/generators.section.md"
         },

lib/fileset/internal.nix

@@ -30,6 +30,7 @@ let
   inherit (lib.lists)
     all
     commonPrefix
+    commonPrefixLength
     concatLists
     elemAt
     filter
@@ -873,9 +874,7 @@ rec {
       # The common base components prefix, e.g.
       # (/foo/bar, /foo/bar/baz) -> /foo/bar
       # (/foo/bar, /foo/baz) -> /foo
-      commonBaseComponentsLength =
-        # TODO: Have a `lib.lists.commonPrefixLength` function such that we don't need the list allocation from commonPrefix here
-        length (commonPrefix fileset1._internalBaseComponents fileset2._internalBaseComponents);
+      commonBaseComponentsLength = commonPrefixLength fileset1._internalBaseComponents fileset2._internalBaseComponents;
 
       # To be able to intersect filesetTree's together, they need to have the same base path.
       # Base paths can be intersected by taking the longest one (if any)
@@ -955,9 +954,7 @@ rec {
       # The common base components prefix, e.g.
       # (/foo/bar, /foo/bar/baz) -> /foo/bar
       # (/foo/bar, /foo/baz) -> /foo
-      commonBaseComponentsLength =
-        # TODO: Have a `lib.lists.commonPrefixLength` function such that we don't need the list allocation from commonPrefix here
-        length (commonPrefix positive._internalBaseComponents negative._internalBaseComponents);
+      commonBaseComponentsLength = commonPrefixLength positive._internalBaseComponents negative._internalBaseComponents;
 
       # We need filesetTree's with the same base to be able to compute the difference between them
       # This here is the filesetTree from the negative file set, but for a base path that matches the positive file set.

lib/lists.nix

@@ -1822,7 +1822,37 @@ rec {
 
     :::
   */
-  commonPrefix =
+  commonPrefix = list1: list2: take (commonPrefixLength list1 list2) list1;
+
+  /**
+    Returns the length of the common prefix of two lists,
+    i.e. the number of leading elements that are pairwise equal.
+
+    This is more efficient than `length (commonPrefix a b)` because
+    it avoids allocating an intermediate list.
+
+    # Type
+
+    ```
+    commonPrefixLength :: [a] -> [a] -> Int
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.commonPrefixLength` usage example
+
+    ```nix
+    commonPrefixLength [ 1 2 3 4 5 6 ] [ 1 2 4 8 ]
+    => 2
+    commonPrefixLength [ 1 2 3 ] [ 1 2 3 4 5 ]
+    => 3
+    commonPrefixLength [ 1 2 3 ] [ 4 5 6 ]
+    => 0
+    ```
+
+    :::
+  */
+  commonPrefixLength =
     list1: list2:
     let
       # Zip the lists together into a list of booleans whether each element matches
@@ -1831,9 +1861,8 @@ rec {
       # which will then also be the length of the common prefix.
       # If all elements match, we fall back to the length of the zipped list,
       # which is the same as the length of the smaller list.
-      commonPrefixLength = findFirstIndex id (length matchings) matchings;
     in
-    take commonPrefixLength list1;
+    findFirstIndex id (length matchings) matchings;
 
   /**
     Returns the last element of a list.

lib/tests/misc.nix

@@ -1851,6 +1851,42 @@ runTests {
       expected = longList;
     };
 
+  testListCommonPrefixLengthExample1 = {
+    expr = lists.commonPrefixLength [ 1 2 3 4 5 6 ] [ 1 2 4 8 ];
+    expected = 2;
+  };
+  testListCommonPrefixLengthExample2 = {
+    expr = lists.commonPrefixLength [ 1 2 3 ] [ 1 2 3 4 5 ];
+    expected = 3;
+  };
+  testListCommonPrefixLengthExample3 = {
+    expr = lists.commonPrefixLength [ 1 2 3 ] [ 4 5 6 ];
+    expected = 0;
+  };
+  testListCommonPrefixLengthEmpty = {
+    expr = lists.commonPrefixLength [ ] [ 1 2 3 ];
+    expected = 0;
+  };
+  testListCommonPrefixLengthSame = {
+    expr = lists.commonPrefixLength [ 1 2 3 ] [ 1 2 3 ];
+    expected = 3;
+  };
+  testListCommonPrefixLengthLazy = {
+    expr =
+      lists.commonPrefixLength
+        [ 1 ]
+        [ 1 (abort "lib.lists.commonPrefixLength shouldn't evaluate this") ];
+    expected = 1;
+  };
+  testListCommonPrefixLengthLong =
+    let
+      longList = genList (n: n) 100000;
+    in
+    {
+      expr = lists.commonPrefixLength longList longList;
+      expected = 100000;
+    };
+
   testSort = {
     expr = sort builtins.lessThan [
       40

maintainers/maintainer-list.nix

@@ -21506,6 +21506,12 @@
     name = "Nadia";
     keys = [ { fingerprint = "6B51 E324 238A F455 2381  313A 9254 1B0C D2A9 3AD8"; } ];
   };
+  nyakase = {
+    email = "hi@hakase.life";
+    github = "nyakase";
+    githubId = 46850780;
+    name = "nyakase";
+  };
   nyanloutre = {
     email = "paul@nyanlout.re";
     github = "nyanloutre";

nixos/doc/manual/administration/containers.chapter.md

@@ -20,9 +20,3 @@ get upgraded along with your host system when you run `nixos-rebuild`,
 which is often not what you want. By contrast, in the imperative
 approach, containers are configured and updated independently from the
 host system.
-
-```{=include=} sections
-imperative-containers.section.md
-declarative-containers.section.md
-container-networking.section.md
-```

nixos/doc/manual/administration/running.md

@@ -1,15 +1,3 @@
 # Administration {#ch-running}
 
 This chapter describes various aspects of managing a running NixOS system, such as how to use the {command}`systemd` service manager.
-
-```{=include=} chapters
-service-mgmt.chapter.md
-rebooting.chapter.md
-user-sessions.chapter.md
-control-groups.chapter.md
-logging.chapter.md
-system-state.chapter.md
-cleaning-store.chapter.md
-containers.chapter.md
-troubleshooting.chapter.md
-```

nixos/doc/manual/administration/system-state.chapter.md

@@ -8,10 +8,3 @@ However, it is possible and not-uncommon to create [impermanent systems], whose
 this kind of configuration, special care needs to be taken.
 
 [impermanent systems]: https://wiki.nixos.org/wiki/Impermanence
-
-
-```{=include=} sections
-nixos-state.section.md
-systemd-state.section.md
-zfs-state.section.md
-```

nixos/doc/manual/administration/troubleshooting.chapter.md

@@ -2,11 +2,3 @@
 
 This chapter describes solutions to common problems you might encounter
 when you manage your NixOS system.
-
-```{=include=} sections
-boot-problems.section.md
-maintenance-mode.section.md
-rollback.section.md
-store-corruption.section.md
-network-problems.section.md
-```

nixos/doc/manual/configuration/config-syntax.chapter.md

@@ -10,9 +10,3 @@ of the Nix language are fully described in the [Nix
 manual](https://nixos.org/nix/manual/#chap-writing-nix-expressions), but
 here we give a short overview of the most important constructs useful in
 NixOS configuration files.
-
-```{=include=} sections
-config-file.section.md
-abstractions.section.md
-modularity.section.md
-```

nixos/doc/manual/configuration/configuration.md

@@ -2,27 +2,4 @@
 
 This chapter describes how to configure various aspects of a NixOS machine through the configuration file {file}`/etc/nixos/configuration.nix`. As described in [](#sec-changing-config), changes to this file only take effect after you run {command}`nixos-rebuild`.
 
-```{=include=} chapters
-config-syntax.chapter.md
-package-mgmt.chapter.md
-user-mgmt.chapter.md
-file-systems.chapter.md
-x-windows.chapter.md
-wayland.chapter.md
-gpu-accel.chapter.md
-xfce.chapter.md
-networking.chapter.md
-linux-kernel.chapter.md
-subversion.chapter.md
-```
-
-```{=include=} chapters
-@MODULE_CHAPTERS@
-```
-
-```{=include=} chapters
-profiles.chapter.md
-mattermost.chapter.md
-kubernetes.chapter.md
-```
 <!-- Apache; libvirtd virtualisation -->

nixos/doc/manual/configuration/declarative-packages.section.md

@@ -39,8 +39,3 @@ configuration, use `pkgs` prefix (variable).
 
 To "uninstall" a package, remove it from
 [](#opt-environment.systemPackages) and run `nixos-rebuild switch`.
-
-```{=include=} sections
-customizing-packages.section.md
-adding-custom-packages.section.md
-```

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -37,10 +37,3 @@ System startup will fail if any of the filesystems fails to mount,
 dropping you to the emergency shell. You can make a mount asynchronous
 and non-critical by adding `options = [ "nofail" ];`.
 :::
-
-```{=include=} sections
-luks-file-systems.section.md
-sshfs-file-systems.section.md
-nfs-file-systems.section.md
-overlayfs.section.md
-```

nixos/doc/manual/configuration/networking.chapter.md

@@ -3,14 +3,4 @@
 This section describes how to configure networking components
 on your NixOS machine.
 
-```{=include=} sections
-network-manager.section.md
-ssh.section.md
-ipv4-config.section.md
-ipv6-config.section.md
-firewall.section.md
-wireless.section.md
-ad-hoc-network-config.section.md
-renaming-interfaces.section.md
-```
 <!-- TODO: OpenVPN, NAT -->

nixos/doc/manual/configuration/package-mgmt.chapter.md

@@ -11,8 +11,3 @@ NixOS has two distinct styles of package management:
 -   *Ad hoc*, where you install, upgrade and uninstall packages via the
     `nix-env` command. This style allows mixing packages from different
     Nixpkgs versions. It's the only choice for non-root users.
-
-```{=include=} sections
-declarative-packages.section.md
-ad-hoc-packages.section.md
-```

nixos/doc/manual/configuration/profiles.chapter.md

@@ -16,17 +16,3 @@ install media, many are actually intended to be used in real installs.
 
 What follows is a brief explanation of the purpose and use-case for each
 profile. Detailing each option configured by each one is out of scope.
-
-```{=include=} sections
-profiles/all-hardware.section.md
-profiles/base.section.md
-profiles/clone-config.section.md
-profiles/demo.section.md
-profiles/docker-container.section.md
-profiles/graphical.section.md
-profiles/headless.section.md
-profiles/installation-device.section.md
-profiles/perlless.section.md
-profiles/minimal.section.md
-profiles/qemu-guest.section.md
-```

nixos/doc/manual/default.nix

@@ -103,12 +103,16 @@ let
 
     cp -r ${../../../doc/release-notes} ./release-notes-nixpkgs
 
+    cp ${./nav.json} nav.json
+
     substituteInPlace ./manual.md \
       --replace-fail '@NIXOS_VERSION@' "${version}"
-    substituteInPlace ./configuration/configuration.md \
+    substituteInPlace ./nav.json \
       --replace-fail \
-          '@MODULE_CHAPTERS@' \
-          ${escapeShellArg (concatMapStringsSep "\n" (p: "${p.value}") config.meta.doc)}
+          '"@MODULE_CHAPTERS@"' \
+          ${escapeShellArg (
+            concatMapStringsSep ",\n" (p: ''{ "file": "${p.value}" }'') config.meta.doc
+          )}
     substituteInPlace ./nixos-options.md \
       --replace-fail \
         '@NIXOS_OPTIONS_JSON@' \
@@ -200,9 +204,10 @@ rec {
           --script ./highlightjs/loader.js \
           --script ./anchor.min.js \
           --script ./anchor-use.js \
-          --sidebar-depth 2 \
+          --sidebar-depth 3 \
           --header ${./header.html}\
           --no-navheader \
+          --experimental-config nav.json \
           ./manual.md \
           $dst/${common.indexPath}
 

nixos/doc/manual/development/development.md

@@ -1,16 +1,3 @@
 # Development {#ch-development}
 
 This chapter describes how you can modify and extend NixOS.
-
-```{=include=} chapters
-sources.chapter.md
-writing-modules.chapter.md
-building-parts.chapter.md
-bootspec.chapter.md
-what-happens-during-a-system-switch.chapter.md
-writing-documentation.chapter.md
-nixos-tests.chapter.md
-developing-the-test-driver.chapter.md
-testing-installer.chapter.md
-modular-services.md
-```

nixos/doc/manual/development/nixos-tests.chapter.md

@@ -4,11 +4,3 @@ When you add some feature to NixOS, you should write a test for it.
 NixOS tests are kept in the directory `nixos/tests`, and are executed
 (using Nix) by a testing framework that automatically starts one or more
 virtual machines containing the NixOS system(s) required for the test.
-
-```{=include=} sections
-writing-nixos-tests.section.md
-running-nixos-tests.section.md
-running-nixos-tests-interactively.section.md
-linking-nixos-tests-to-packages.section.md
-testing-hardware-features.section.md
-```

nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md

@@ -53,10 +53,3 @@ More detailed output can be displayed by setting `STC_DEBUG=1`.
 Most of these actions are either self-explaining but some of them have to do
 with our units or the activation script. For this reason, these topics are
 explained in the next sections.
-
-```{=include=} sections
-unit-handling.section.md
-activation-script.section.md
-non-switchable-systems.section.md
-etc-overlay.section.md
-```

nixos/doc/manual/development/writing-modules.chapter.md

@@ -209,16 +209,3 @@ in
 }
 ```
 :::
-
-```{=include=} sections
-option-declarations.section.md
-option-types.section.md
-option-def.section.md
-assertions.section.md
-meta-attributes.section.md
-importing-modules.section.md
-replace-modules.section.md
-freeform-modules.section.md
-settings-options.section.md
-state-revision.section.md
-```

nixos/doc/manual/installation/installation.md

@@ -1,13 +1,3 @@
 # Installation {#ch-installation}
 
 This section describes how to obtain, install, and configure NixOS for first-time use.
-
-```{=include=} chapters
-obtaining.chapter.md
-installing.chapter.md
-changing-config.chapter.md
-upgrading.chapter.md
-building-nixos.chapter.md
-building-images-via-nixos-rebuild-build-image.chapter.md
-building-images-via-systemd-repart.chapter.md
-```

nixos/doc/manual/installation/installing.chapter.md

@@ -577,12 +577,3 @@ With a partitioned disk.
 :::
 
 ## Additional installation notes {#sec-installation-additional-notes}
-
-```{=include=} sections
-installing-usb.section.md
-installing-pxe.section.md
-installing-kexec.section.md
-installing-virtualbox-guest.section.md
-installing-from-other-distro.section.md
-installing-behind-a-proxy.section.md
-```

nixos/doc/manual/manual.md

@@ -32,21 +32,6 @@
 
 -->
 
-```{=include=} preface
-preface.md
-```
-
-```{=include=} parts
-installation/installation.md
-configuration/configuration.md
-administration/running.md
-development/development.md
-```
-
-```{=include=} chapters
-contributing-to-this-manual.chapter.md
-```
-
 ```{=include=} appendix html:into-file=//options.html
 nixos-options.md
 ```

nixos/doc/manual/nav.json

@@ -0,0 +1,444 @@
+{
+  "open": [],
+  "items": [
+    {
+      "file": "preface.md"
+    },
+    {
+      "label": "Installation",
+      "id": "ch-installation",
+      "children": [
+        {
+          "file": "installation/installation.md"
+        },
+        {
+          "file": "installation/obtaining.chapter.md"
+        },
+        {
+          "label": "Installing NixOS",
+          "id": "sec-installation",
+          "children": [
+            {
+              "file": "installation/installing.chapter.md"
+            },
+            {
+              "file": "installation/installing-usb.section.md"
+            },
+            {
+              "file": "installation/installing-pxe.section.md"
+            },
+            {
+              "file": "installation/installing-kexec.section.md"
+            },
+            {
+              "file": "installation/installing-virtualbox-guest.section.md"
+            },
+            {
+              "file": "installation/installing-from-other-distro.section.md"
+            },
+            {
+              "file": "installation/installing-behind-a-proxy.section.md"
+            }
+          ]
+        },
+        {
+          "file": "installation/changing-config.chapter.md"
+        },
+        {
+          "file": "installation/upgrading.chapter.md"
+        },
+        {
+          "file": "installation/building-nixos.chapter.md"
+        },
+        {
+          "file": "installation/building-images-via-nixos-rebuild-build-image.chapter.md"
+        },
+        {
+          "file": "installation/building-images-via-systemd-repart.chapter.md"
+        }
+      ]
+    },
+    {
+      "label": "Configuration",
+      "id": "ch-configuration",
+      "children": [
+        {
+          "file": "configuration/configuration.md"
+        },
+        {
+          "label": "Configuration Syntax",
+          "id": "sec-configuration-syntax",
+          "children": [
+            {
+              "file": "configuration/config-syntax.chapter.md"
+            },
+            {
+              "file": "configuration/config-file.section.md"
+            },
+            {
+              "file": "configuration/abstractions.section.md"
+            },
+            {
+              "file": "configuration/modularity.section.md"
+            }
+          ]
+        },
+        {
+          "label": "Package Management",
+          "id": "sec-package-management",
+          "children": [
+            {
+              "file": "configuration/package-mgmt.chapter.md"
+            },
+            {
+              "label": "Declarative Package Management",
+              "id": "sec-declarative-package-mgmt",
+              "children": [
+                {
+                  "file": "configuration/declarative-packages.section.md"
+                },
+                {
+                  "file": "configuration/customizing-packages.section.md"
+                },
+                {
+                  "file": "configuration/adding-custom-packages.section.md"
+                }
+              ]
+            },
+            {
+              "file": "configuration/ad-hoc-packages.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/user-mgmt.chapter.md"
+        },
+        {
+          "label": "File Systems",
+          "id": "ch-file-systems",
+          "children": [
+            {
+              "file": "configuration/file-systems.chapter.md"
+            },
+            {
+              "file": "configuration/luks-file-systems.section.md"
+            },
+            {
+              "file": "configuration/sshfs-file-systems.section.md"
+            },
+            {
+              "file": "configuration/nfs-file-systems.section.md"
+            },
+            {
+              "file": "configuration/overlayfs.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/x-windows.chapter.md"
+        },
+        {
+          "file": "configuration/wayland.chapter.md"
+        },
+        {
+          "file": "configuration/gpu-accel.chapter.md"
+        },
+        {
+          "file": "configuration/xfce.chapter.md"
+        },
+        {
+          "label": "Networking",
+          "id": "sec-networking",
+          "children": [
+            {
+              "file": "configuration/networking.chapter.md"
+            },
+            {
+              "file": "configuration/network-manager.section.md"
+            },
+            {
+              "file": "configuration/ssh.section.md"
+            },
+            {
+              "file": "configuration/ipv4-config.section.md"
+            },
+            {
+              "file": "configuration/ipv6-config.section.md"
+            },
+            {
+              "file": "configuration/firewall.section.md"
+            },
+            {
+              "file": "configuration/wireless.section.md"
+            },
+            {
+              "file": "configuration/ad-hoc-network-config.section.md"
+            },
+            {
+              "file": "configuration/renaming-interfaces.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/linux-kernel.chapter.md"
+        },
+        {
+          "file": "configuration/subversion.chapter.md"
+        },
+        "@MODULE_CHAPTERS@",
+        {
+          "label": "Profiles",
+          "id": "ch-profiles",
+          "children": [
+            {
+              "file": "configuration/profiles.chapter.md"
+            },
+            {
+              "file": "configuration/profiles/all-hardware.section.md"
+            },
+            {
+              "file": "configuration/profiles/base.section.md"
+            },
+            {
+              "file": "configuration/profiles/clone-config.section.md"
+            },
+            {
+              "file": "configuration/profiles/demo.section.md"
+            },
+            {
+              "file": "configuration/profiles/docker-container.section.md"
+            },
+            {
+              "file": "configuration/profiles/graphical.section.md"
+            },
+            {
+              "file": "configuration/profiles/headless.section.md"
+            },
+            {
+              "file": "configuration/profiles/installation-device.section.md"
+            },
+            {
+              "file": "configuration/profiles/perlless.section.md"
+            },
+            {
+              "file": "configuration/profiles/minimal.section.md"
+            },
+            {
+              "file": "configuration/profiles/qemu-guest.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/mattermost.chapter.md"
+        },
+        {
+          "file": "configuration/kubernetes.chapter.md"
+        }
+      ]
+    },
+    {
+      "label": "Administration",
+      "id": "ch-running",
+      "children": [
+        {
+          "file": "administration/running.md"
+        },
+        {
+          "file": "administration/service-mgmt.chapter.md"
+        },
+        {
+          "file": "administration/rebooting.chapter.md"
+        },
+        {
+          "file": "administration/user-sessions.chapter.md"
+        },
+        {
+          "file": "administration/control-groups.chapter.md"
+        },
+        {
+          "file": "administration/logging.chapter.md"
+        },
+        {
+          "label": "Necessary system state",
+          "id": "ch-system-state",
+          "children": [
+            {
+              "file": "administration/system-state.chapter.md"
+            },
+            {
+              "file": "administration/nixos-state.section.md"
+            },
+            {
+              "file": "administration/systemd-state.section.md"
+            },
+            {
+              "file": "administration/zfs-state.section.md"
+            }
+          ]
+        },
+        {
+          "file": "administration/cleaning-store.chapter.md"
+        },
+        {
+          "label": "Container Management",
+          "id": "ch-containers",
+          "children": [
+            {
+              "file": "administration/containers.chapter.md"
+            },
+            {
+              "file": "administration/imperative-containers.section.md"
+            },
+            {
+              "file": "administration/declarative-containers.section.md"
+            },
+            {
+              "file": "administration/container-networking.section.md"
+            }
+          ]
+        },
+        {
+          "label": "Troubleshooting",
+          "id": "ch-troubleshooting",
+          "children": [
+            {
+              "file": "administration/troubleshooting.chapter.md"
+            },
+            {
+              "file": "administration/boot-problems.section.md"
+            },
+            {
+              "file": "administration/maintenance-mode.section.md"
+            },
+            {
+              "file": "administration/rollback.section.md"
+            },
+            {
+              "file": "administration/store-corruption.section.md"
+            },
+            {
+              "file": "administration/network-problems.section.md"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "label": "Development",
+      "id": "ch-development",
+      "children": [
+        {
+          "file": "development/development.md"
+        },
+        {
+          "file": "development/sources.chapter.md"
+        },
+        {
+          "label": "Writing NixOS Modules",
+          "id": "sec-writing-modules",
+          "children": [
+            {
+              "file": "development/writing-modules.chapter.md"
+            },
+            {
+              "file": "development/option-declarations.section.md"
+            },
+            {
+              "file": "development/option-types.section.md"
+            },
+            {
+              "file": "development/option-def.section.md"
+            },
+            {
+              "file": "development/assertions.section.md"
+            },
+            {
+              "file": "development/meta-attributes.section.md"
+            },
+            {
+              "file": "development/importing-modules.section.md"
+            },
+            {
+              "file": "development/replace-modules.section.md"
+            },
+            {
+              "file": "development/freeform-modules.section.md"
+            },
+            {
+              "file": "development/settings-options.section.md"
+            },
+            {
+              "file": "development/state-revision.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/building-parts.chapter.md"
+        },
+        {
+          "file": "development/bootspec.chapter.md"
+        },
+        {
+          "label": "What happens during a system switch?",
+          "id": "sec-switching-systems",
+          "children": [
+            {
+              "file": "development/what-happens-during-a-system-switch.chapter.md"
+            },
+            {
+              "file": "development/unit-handling.section.md"
+            },
+            {
+              "file": "development/activation-script.section.md"
+            },
+            {
+              "file": "development/non-switchable-systems.section.md"
+            },
+            {
+              "file": "development/etc-overlay.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/writing-documentation.chapter.md"
+        },
+        {
+          "label": "NixOS Tests",
+          "id": "sec-nixos-tests",
+          "children": [
+            {
+              "file": "development/nixos-tests.chapter.md"
+            },
+            {
+              "file": "development/writing-nixos-tests.section.md"
+            },
+            {
+              "file": "development/running-nixos-tests.section.md"
+            },
+            {
+              "file": "development/running-nixos-tests-interactively.section.md"
+            },
+            {
+              "file": "development/linking-nixos-tests-to-packages.section.md"
+            },
+            {
+              "file": "development/testing-hardware-features.section.md"
+            }
+          ]
+        },
+        {
+          "file": "development/developing-the-test-driver.chapter.md"
+        },
+        {
+          "file": "development/testing-installer.chapter.md"
+        },
+        {
+          "file": "development/modular-services.md"
+        }
+      ]
+    },
+    {
+      "file": "contributing-to-this-manual.chapter.md"
+    }
+  ]
+}

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -88,6 +88,8 @@
 
 - [Kener](https://kener.ing), a modern, open-source status page application built with Node.js. Available as [services.kener](#opt-services.kener.enable).
 
+- [OpenSearch Dashboards](https://opensearch.org/platform/opensearch-dashboards/), a powerful, open-source visualization tool that you can use to explore, analyze, and understand your data in real time. Available as [services.opensearch-dashboards](#opt-services.opensearch-dashboards.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).

nixos/modules/module-list.nix

@@ -1545,6 +1545,7 @@
   ./services/search/manticore.nix
   ./services/search/meilisearch.nix
   ./services/search/nominatim.nix
+  ./services/search/opensearch-dashboards.nix
   ./services/search/opensearch.nix
   ./services/search/qdrant.nix
   ./services/search/quickwit.nix

nixos/modules/services/misc/ntfy-sh.nix

@@ -29,6 +29,26 @@ in
 
     package = lib.mkPackageOption pkgs "ntfy-sh" { };
 
+    nginx = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = "Whether to set up an nginx virtual host.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 2586;
+        description = "Internal port for ntfy to listen to.";
+      };
+
+      virtualHost = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        example = "push.example.com";
+        description = "Virtual host to use for nginx.";
+      };
+    };
+
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = settingsFormat.type;
@@ -89,7 +109,7 @@ in
 
       services.ntfy-sh.settings = {
         auth-file = lib.mkDefault "/var/lib/ntfy-sh/user.db";
-        listen-http = lib.mkDefault "127.0.0.1:2586";
+        listen-http = if cfg.nginx.enable then "[::1]:${cfg.nginx.port}" else lib.mkDefault "[::1]:2586";
         attachment-cache-dir = lib.mkDefault "/var/lib/ntfy-sh/attachments";
         cache-file = lib.mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
@@ -125,5 +145,23 @@ in
           EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         };
       };
+
+      services.nginx = lib.mkIf cfg.nginx.enable {
+        enable = true;
+        virtualHosts."${cfg.nginx.virtualHost}" = {
+          forceSSL = true;
+
+          locations."/" = {
+            proxyPass = "http://[::1]:${cfg.nginx.port}";
+            proxyWebsockets = true;
+            extraConfig = ''
+              proxy_connect_timeout 3m;
+              proxy_send_timeout 3m;
+              proxy_read_timeout 3m;
+              client_max_body_size 0;
+            '';
+          };
+        };
+      };
     };
 }

nixos/modules/services/search/opensearch-dashboards.nix

@@ -0,0 +1,108 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+
+  cfg = config.services.opensearch-dashboards;
+  yaml = pkgs.formats.yaml { };
+  stateDir = "/var/lib/opensearch-dashboards";
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    makefu
+    shymega
+  ];
+
+  options.services.opensearch-dashboards = {
+    enable = lib.mkEnableOption "OpenSearch Dashboards";
+
+    package = lib.mkPackageOption pkgs "OpenSearch Dashboards" {
+      default = [ "opensearch-dashboards" ];
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "opensearch-dashboards";
+      description = ''
+        The user to run OpenSearch Dashboards under.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = yaml.type;
+      };
+      default = { };
+      example = lib.literalExpression ''
+        {
+          opensearch = {
+            username = "foo";
+            password._secret = "/run/keys/opensearch_password";
+          };
+
+          server = {
+            name = "your-hostname";
+            port = 5601;
+            maxPayloadbytes = 104857;
+          };
+        };
+      '';
+      description = ''
+        OpenSearch Dashboards settings.
+
+        Available settings can be found by looking at the
+        [opensearch_dashboards.yml](https://github.com/opensearch-project/OpenSearch-Dashboards/blob/main/config/opensearch_dashboards.yml)
+        from the Opensearch Dashboards repo.
+
+        {file}`config/nixos_site_settings.json` file,
+        attribute set containing the attribute
+        `_secret` - a string pointing to a file
+        containing the value the option should be set to. See the
+        example to get a better picture of this: in the resulting
+        {file}`opensearch_dashboards.yml` file,
+        the `opensearch.password` key will
+        be set to the contents of the
+        {file}`/run/keys/opensearch_password`
+        file.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.enable) {
+    systemd.services.opensearch-dashboards = {
+      description = "OpenSearch Dashboards Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = {
+        BABEL_CACHE_PATH = "${stateDir}/.babelcache.json";
+      };
+      serviceConfig =
+        let
+          configPath = stateDir + "/opensearch_dashboards.yml";
+        in
+        {
+          ExecStartPre = pkgs.writeShellScript "dashboards-exec-pre" ''
+            set -euo pipefail
+            umask 077
+            ${utils.genJqSecretsReplacementSnippet cfg.settings configPath}
+            chown ${cfg.user} ${configPath}
+          '';
+          ExecStart = "${cfg.package}/bin/opensearch-dashboards --config ${configPath} --path.data ${stateDir}";
+          StateDirectory = "opensearch-dashboards";
+          User = cfg.user;
+          DynamicUser = true;
+        };
+    };
+  };
+}

nixos/modules/services/security/canaille.nix

@@ -15,6 +15,7 @@ let
     mkPackageOption
     types
     getExe
+    getExe'
     optional
     converge
     filterAttrsRecursive
@@ -28,29 +29,40 @@ let
   # Remove null values, so we can document optional/forbidden values that don't end up in the generated TOML file.
   filterConfig = converge (filterAttrsRecursive (_: v: v != null));
 
-  finalPackage = cfg.package.overridePythonAttrs (old: {
-    dependencies =
-      old.dependencies
-      ++ old.optional-dependencies.front
-      ++ old.optional-dependencies.oidc
-      ++ old.optional-dependencies.scim
-      ++ old.optional-dependencies.ldap
-      ++ old.optional-dependencies.sentry
-      ++ old.optional-dependencies.postgresql
-      ++ old.optional-dependencies.otp
-      ++ old.optional-dependencies.sms;
-    makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
-      "--set CANAILLE_CONFIG /etc/canaille/config.toml"
-      "--set SECRETS_DIR \"${secretsDir}\""
-    ];
-  });
-  inherit (finalPackage) python;
-  pythonEnv = python.buildEnv.override {
-    extraLibs = with python.pkgs; [
-      (toPythonModule finalPackage)
-      celery
-    ];
+  python = cfg.package.python.override {
+    self = python;
+    packageOverrides = _final: prev: {
+      gunicorn = prev.gunicorn.overridePythonAttrs (old: {
+        # Allows Gunicorn to set a meaningful process name
+        dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
+      });
+      canaille = prev.toPythonModule (
+        (cfg.package.override { python3 = python; }).overridePythonAttrs (old: {
+          dependencies =
+            old.dependencies
+            ++ old.optional-dependencies.front
+            ++ old.optional-dependencies.oidc
+            ++ old.optional-dependencies.scim
+            ++ old.optional-dependencies.ldap
+            ++ old.optional-dependencies.sentry
+            ++ old.optional-dependencies.postgresql
+            ++ old.optional-dependencies.otp
+            ++ old.optional-dependencies.sms;
+          makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
+            "--set CANAILLE_CONFIG /etc/canaille/config.toml"
+            "--set SECRETS_DIR \"${secretsDir}\""
+          ];
+        })
+      );
+    };
   };
+  pythonEnv = python.withPackages (
+    ps: with ps; [
+      canaille
+      gunicorn
+      celery
+    ]
+  );
 
   commonServiceConfig = {
     WorkingDirectory = dataDir;
@@ -285,7 +297,7 @@ in
       after = optional createLocalPostgresqlDb "postgresql.target";
       serviceConfig = commonServiceConfig // {
         Type = "oneshot";
-        ExecStart = "${getExe finalPackage} install";
+        ExecStart = "${getExe python.pkgs.canaille} install";
       };
     };
 
@@ -308,21 +320,16 @@ in
       };
       serviceConfig = commonServiceConfig // {
         Restart = "on-failure";
-        ExecStart =
-          let
-            gunicorn = python.pkgs.gunicorn.overridePythonAttrs (old: {
-              # Allows Gunicorn to set a meaningful process name
-              dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
-            });
-          in
-          ''
-            ${getExe gunicorn} \
-              --name=canaille \
-              --bind='unix:///run/canaille.socket' \
-              'canaille:create_app()'
-          '';
+        ExecStart = ''
+          ${getExe' pythonEnv "gunicorn"} \
+            --name=canaille \
+            --bind='unix:///run/canaille.socket' \
+            'canaille:create_app()'
+        '';
       };
-      restartTriggers = [ "/etc/canaille/config.toml" ];
+      restartTriggers = [
+        config.environment.etc."canaille/config.toml".source
+      ];
     };
 
     systemd.sockets.canaille = {
@@ -355,10 +362,10 @@ in
       locations = {
         "/".proxyPass = "http://unix:///run/canaille.socket";
         "/static" = {
-          root = "${finalPackage}/${python.sitePackages}/canaille";
+          root = "${python.pkgs.canaille}/${python.sitePackages}/canaille";
         };
         "~* ^/static/.+\\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$" = {
-          root = "${finalPackage}/${python.sitePackages}/canaille";
+          root = "${python.pkgs.canaille}/${python.sitePackages}/canaille";
           extraConfig = ''
             access_log off;
             expires 30d;
@@ -382,7 +389,7 @@ in
     users.users.canaille = {
       isSystemUser = true;
       group = "canaille";
-      packages = [ finalPackage ];
+      packages = [ python.pkgs.canaille ];
     };
 
     users.groups.canaille.members = [ config.services.nginx.user ];

nixos/tests/all-tests.nix

@@ -573,6 +573,7 @@ in
   documize = runTest ./documize.nix;
   docuseal-psql = runTest ./docuseal-postgres.nix;
   docuseal-sqlite = runTest ./docuseal-sqlite.nix;
+  docuum = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docuum.nix;
   doh-proxy-rust = runTest ./doh-proxy-rust.nix;
   dokuwiki = runTest ./dokuwiki.nix;
   dolibarr = runTest ./dolibarr.nix;
@@ -1398,6 +1399,7 @@ in
   openldap = runTest ./openldap.nix;
   openresty-lua = runTest ./openresty-lua.nix;
   opensearch = discoverTests (import ./opensearch.nix);
+  opensearch-dashboards = handleTest ./opensearch-dashboards.nix { };
   opensmtpd = handleTest ./opensmtpd.nix { };
   opensmtpd-rspamd = handleTest ./opensmtpd-rspamd.nix { };
   opensnitch = runTest ./opensnitch.nix;

nixos/tests/docuum.nix

@@ -0,0 +1,58 @@
+{ pkgs, lib, ... }:
+{
+  name = "docuum";
+  meta.maintainers = [ lib.maintainers.h7x4 ];
+
+  containers.machine = {
+    virtualisation.docker.enable = true;
+
+    services.docuum = {
+      enable = true;
+      threshold = "5 MB";
+      keep = [ "^keep-me:" ];
+    };
+  };
+
+  testScript =
+    let
+      # Each image is 2 MB, so the third non-exempt image should be evicted.
+      imageSizeKb = 2 * 1024;
+
+      mkTestImage =
+        name:
+        pkgs.dockerTools.buildImage {
+          inherit name;
+          tag = "test";
+          copyToRoot = pkgs.runCommand "docuum-test-data-${name}" { } ''
+            mkdir -p $out
+            echo "${name}" > $out/name
+            dd if=/dev/zero of=$out/data bs=1024 count=${toString imageSizeKb}
+          '';
+        };
+
+      images = {
+        keepMe = mkTestImage "keep-me";
+        old = mkTestImage "old-image";
+        new = mkTestImage "new-image";
+      };
+    in
+    ''
+      start_all()
+
+      machine.wait_for_unit("docker.service")
+      machine.wait_for_unit("docuum.service")
+      machine.wait_until_succeeds("journalctl -u docuum --grep 'Listening for Docker events'")
+
+      machine.succeed(
+          "docker load < ${images.keepMe}",
+          "docker load < ${images.old}",
+          "docker load < ${images.new}",
+      )
+
+      machine.wait_until_fails("docker image inspect old-image:test")
+      machine.succeed(
+          "docker image inspect keep-me:test",
+          "docker image inspect new-image:test",
+      )
+    '';
+}

nixos/tests/freshrss/extensions.nix

@@ -20,6 +20,7 @@
   ];
 
   testScript = ''
+    import json
     from lxml import etree
 
     machine.wait_for_unit("multi-user.target")
@@ -29,7 +30,7 @@
 
     # enable Title-Wrap extension
     tree = etree.HTML(response)
-    csrf = tree.xpath("/html/body/header/nav/form/input/@value")[0]
+    csrf = json.loads(tree.xpath('//script[@id="jsonVars"]/text()')[0])["context"]["csrf"]
     machine.succeed(f"curl --fail-with-body --silent 'http://localhost:80/i/?c=extension&a=enable&e=Title-Wrap' -d '_csrf={csrf}'")
     # verify that the Title-Wrap css is accessible.
     machine.succeed("curl --fail-with-body --silent 'http://localhost:80/ext.php?1=&f=xExtension-TitleWrap/static/title_wrap.css'")

nixos/tests/opensearch-dashboards.nix

@@ -0,0 +1,117 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  {
+    name = "opensearch-dashboards";
+    meta.maintainers = [ ];
+
+    nodes.machine = {
+      virtualisation.memorySize = 4096;
+
+      services.opensearch = {
+        enable = true;
+        # security is disabled by default
+      };
+
+      services.opensearch-dashboards = {
+        enable = true;
+        package = pkgs.opensearch-dashboards.override {
+          disableSecurity = true;
+        };
+        settings = {
+          server.host = "0.0.0.0";
+          server.port = 5601;
+          opensearch.hosts = [ "http://localhost:9200" ];
+        };
+      };
+    };
+
+    testScript = ''
+      import json
+      import shlex
+
+      machine.start()
+
+      with subtest("opensearch starts and is reachable"):
+          machine.wait_for_unit("opensearch.service")
+          machine.wait_for_open_port(9200)
+          machine.succeed("curl --fail http://localhost:9200/")
+
+      with subtest("opensearch-dashboards starts and is reachable"):
+          machine.wait_for_unit("opensearch-dashboards.service")
+          machine.wait_for_open_port(5601)
+          # Dashboards takes a while to fully initialize
+          machine.wait_until_succeeds(
+              "curl --fail -s http://localhost:5601/api/status"
+              " | grep -q '\"state\":\"green\"'",
+              timeout=120,
+          )
+
+      with subtest("inject logs into opensearch"):
+          # Create an index with timestamped log entries
+          for i in range(5):
+              doc = json.dumps({
+                  "@timestamp": f"2026-04-14T10:00:0{i}Z",
+                  "message": f"test log entry {i}",
+                  "level": "info",
+                  "service": "vmtest",
+              })
+              machine.succeed(
+                  "curl --fail -s -X POST http://localhost:9200/test-logs/_doc"
+                  f" -H 'Content-Type: application/json' -d {shlex.quote(doc)}"
+              )
+
+          # Refresh the index so documents are searchable
+          machine.succeed(
+              "curl --fail -s -X POST http://localhost:9200/test-logs/_refresh"
+          )
+
+          # Verify documents are in opensearch
+          result = machine.succeed(
+              "curl --fail -s http://localhost:9200/test-logs/_count"
+          )
+          count = json.loads(result)["count"]
+          assert count == 5, f"Expected 5 documents, got {count}"
+
+      with subtest("create index pattern in dashboards"):
+          payload = json.dumps({
+              "attributes": {
+                  "title": "test-logs*",
+                  "timeFieldName": "@timestamp",
+              }
+          })
+          machine.succeed(
+              "curl --fail -s -X POST"
+              " http://localhost:5601/api/saved_objects/index-pattern/test-logs"
+              " -H 'osd-xsrf: true'"
+              f" -H 'Content-Type: application/json' -d {shlex.quote(payload)}"
+          )
+
+      with subtest("query logs through dashboards discover search"):
+          # Use the internal search API that the Discover view uses
+          query = json.dumps({
+              "params": {
+                  "index": "test-logs*",
+                  "body": {
+                      "query": {"match_all": {}},
+                      "size": 10,
+                  },
+              }
+          })
+          result = machine.succeed(
+              "curl --fail -s -X POST"
+              " http://localhost:5601/internal/search/opensearch"
+              " -H 'osd-xsrf: true'"
+              f" -H 'Content-Type: application/json' -d {shlex.quote(query)}"
+          )
+          data = json.loads(result)
+          hits = data["rawResponse"]["hits"]["hits"]
+          assert len(hits) == 5, f"Expected 5 hits from dashboards, got {len(hits)}"
+
+          # Verify the log messages are present
+          messages = sorted([h["_source"]["message"] for h in hits])
+          for i in range(5):
+              expected = f"test log entry {i}"
+              assert expected in messages, f"Missing log entry: {expected}"
+    '';
+  }
+)

pkgs/applications/editors/vim/plugins/generated.nix

@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-12";
+    version = "0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "05e938c0aa5dfbdbb11972fa4c8a85f27f402ba0";
-      hash = "sha256-p+h2y42PRUM1ZPIlBe31/n7IPmh3oEiWgL3HuoUI8Yg=";
+      rev = "ab094b7f788231fe9b68deac78c3d512302c58a6";
+      hash = "sha256-AKGx8ubYHhDireMwOcimvr7zpM1sjytkaRHtguAfVLo=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1135,12 +1135,12 @@ final: prev: {
 
   async-nvim = buildVimPlugin {
     pname = "async.nvim";
-    version = "0-unstable-2026-09-03";
+    version = "0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "async.nvim";
-      rev = "ca8f5696c45bd4786b8840923d86b6932ce92ded";
-      hash = "sha256-dUP9knuzL4qiXdbcjil3Yu5Ve3sVL1DSKJbEY5FwDpA=";
+      rev = "15f28ec323a75f34f317336831c00c2d1b0a7192";
+      hash = "sha256-8S2HNBBwB3c58NudCGrTyBKoQkGDIG0Syravh+sl/Dw=";
     };
     meta.homepage = "https://github.com/lewis6991/async.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-11";
+    version = "0.0.82-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "90b55f067595e7f9dd920c957d6345f434f32dd2";
-      hash = "sha256-6gX6voB7AZhBmG/NYUCEwEm6V5gunT+WHVSvOsZ0Kj4=";
+      rev = "c39eba4cf90254dd9e3ce54f617f07d1853d5da5";
+      hash = "sha256-FMP/UaBSAj29Cei7CDLamtjOAOAqcZLGBYjt/6uQHlI=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.24.1";
+    version = "19.25.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.24.1";
-      hash = "sha256-oihHiKhU093AT5aqvTxJ4wXmH+pMKFJ5zgzUo5SJ/Yw=";
+      tag = "v19.25.0";
+      hash = "sha256-PTvllgZji45JdW1NW9YmRDJqiEvdmbpeB2QGvu10jbM=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4228,12 +4228,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-09-04";
+    version = "0-unstable-2026-09-14";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "a0689fdab9ad5a46bc8730c96a43f215d605f23c";
-      hash = "sha256-ZKju7Pb5GdhWVwF1oXgGt6DXZvyaaQKQHSuKce6P+DI=";
+      rev = "735596a7ec4f4984c90827f8e1100e320eb14cba";
+      hash = "sha256-igRYHOoBBz7R5aUuxPkaAfmTH6TYSXMNV2pBTcT5Pe0=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -4816,12 +4816,12 @@ final: prev: {
 
   demicolon-nvim = buildVimPlugin {
     pname = "demicolon.nvim";
-    version = "2.0-unstable-2026-06-20";
+    version = "2.0-unstable-2026-09-16";
     src = fetchFromGitHub {
       owner = "mawkler";
       repo = "demicolon.nvim";
-      rev = "153444f17494e2ff6ab7d226e6173c1841b1130a";
-      hash = "sha256-gBGJphvT1AXN/UImrSWiWhhzcQt4i68Vbwtr9jXipwo=";
+      rev = "d4bc516cc346202eb7f933b38e47534d41769f46";
+      hash = "sha256-N60NIspY5QspqvqfndU74jJDClm7uBL5VpKwnamuodM=";
     };
     meta.homepage = "https://github.com/mawkler/demicolon.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5490,12 +5490,12 @@ final: prev: {
 
   easy-dotnet-nvim = buildVimPlugin {
     pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-09-10";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "GustavEikaas";
       repo = "easy-dotnet.nvim";
-      rev = "bde7a1cf7c4dbad61d68b2ca41672bfe194b06f8";
-      hash = "sha256-/1FzQEXnPOl+jcj0QQ04u9lJgmDb2Ejhy3KurFpkCnU=";
+      rev = "df600029a54754d90ac35fe284b3921bb7bf1023";
+      hash = "sha256-1F1IXv3lNC7PP+fQESrQtx/7YTrMgl2SGRIAZzuxUQI=";
     };
     meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5799,12 +5799,12 @@ final: prev: {
 
   executor-nvim = buildVimPlugin {
     pname = "executor.nvim";
-    version = "0-unstable-2025-08-15";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "google";
       repo = "executor.nvim";
-      rev = "56dfbe6f7fbf4a6ba7e5934df2d95810e0235f64";
-      hash = "sha256-FdcOzT3LgJBifXdEAzfMtcfrIDlYFcY1RogVxcl3Avk=";
+      rev = "f40ff80b0831c34e8feae92b996477b4bba67764";
+      hash = "sha256-UaBqJzR+s4DgtMJ2JDKhr+jJekPr8LspQvVdfgU9x/8=";
     };
     meta.homepage = "https://github.com/google/executor.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -6753,12 +6753,12 @@ final: prev: {
 
   gitignore-nvim = buildVimPlugin {
     pname = "gitignore.nvim";
-    version = "0-unstable-2025-05-30";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "wintermute-cell";
       repo = "gitignore.nvim";
-      rev = "0344f643768c4d64af4add8c1bdddf6f7d4c9010";
-      hash = "sha256-9Qu+oVOtufvf+ekj2rY+T9c2y7BXh9d7hfl6ZiMYpPY=";
+      rev = "15ed88abbaeb5deffe6d7c6d51af9b6ff784135f";
+      hash = "sha256-45PCvabbqcgasvuFg/g8c/N6XkU43/lmqoATMnvc8NY=";
     };
     meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8125,12 +8125,12 @@ final: prev: {
 
   iron-nvim = buildVimPlugin {
     pname = "iron.nvim";
-    version = "0-unstable-2026-08-30";
+    version = "0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "Vigemus";
       repo = "iron.nvim";
-      rev = "1ad44e4e82ad31b7df1cdb7f154c707bfd0d303c";
-      hash = "sha256-59+/yLkvBsAVmYt7HfQYn0A2oPAewAQcNx3XneyKVaQ=";
+      rev = "0168b419bc7df70cd2d97c2ec8158b6b002450b2";
+      hash = "sha256-2oQ4CGcdxVJpubxv+NQLbVk3cW38iP45xX3rAL1ZOl4=";
     };
     meta.homepage = "https://github.com/Vigemus/iron.nvim/";
     meta.license = getLicenseFromSpdxId "BSD-3-Clause";
@@ -11218,12 +11218,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-03";
+    version = "1.4.0-unstable-2026-09-17";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "931000cfab0120191ee914afbbc3f2b02f3533de";
-      hash = "sha256-IfL6Rbp6KIHs/QZ25kPQU2NDTkasYv4B2yiAAmbLSKg=";
+      rev = "54f249a7f1a87a51ff1f559e873daf05e20a454b";
+      hash = "sha256-tpjnVOIaULSgEzPypvKipNWlEbYvtMossbu/yhHgsWY=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -12130,12 +12130,12 @@ final: prev: {
 
   nginx-vim = buildVimPlugin {
     pname = "nginx.vim";
-    version = "1.1.0-unstable-2026-02-09";
+    version = "1.1.0-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "chr4";
       repo = "nginx.vim";
-      rev = "a5991f38135d0c6c259d0b9f5e629ba33b891b9e";
-      hash = "sha256-rGqNjdaK5HX6Cad3x+awRLz24PfsA+APWg+vKjWn490=";
+      rev = "3f1ce6c24ba3b5bde979cfac2c017612d7bfd311";
+      hash = "sha256-7UVwoZjyfl2YiNzQnfanoqAmfmZlhRlrbtYxqrBVTGY=";
     };
     meta.homepage = "https://github.com/chr4/nginx.vim/";
     meta.license = unfree;
@@ -12409,12 +12409,12 @@ final: prev: {
 
   notmuch-nvim = buildVimPlugin {
     pname = "notmuch.nvim";
-    version = "0.4.0";
+    version = "0.5.0";
     src = fetchFromGitHub {
       owner = "yousefakbar";
       repo = "notmuch.nvim";
-      tag = "v0.4.0";
-      hash = "sha256-A+vlH8fUNd3/lTH++sp90YXRqe3/uTxOTNw43CJQQyc=";
+      tag = "v0.5.0";
+      hash = "sha256-Q2xxAC10xZFa+xKXnnyJRe5qi/aqZUwp0+l7SIIBriM=";
     };
     meta.homepage = "https://github.com/yousefakbar/notmuch.nvim/";
     meta.license = unfree;
@@ -13871,6 +13871,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-surround-wk = buildVimPlugin {
+    pname = "nvim-surround-wk";
+    version = "1.0.0-unstable-2026-06-11";
+    src = fetchFromGitHub {
+      owner = "gregorias";
+      repo = "nvim-surround-wk";
+      rev = "d8f4058cab1f0a4805e0e9f7e1415607681265f6";
+      hash = "sha256-41RttsqCI9y3ID7h8tmlcRmNtA9WNjyKp9R7ISLghjQ=";
+    };
+    meta.homepage = "https://github.com/gregorias/nvim-surround-wk/";
+    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-teal-maker = buildVimPlugin {
     pname = "nvim-teal-maker";
     version = "0-unstable-2022-04-09";
@@ -14671,12 +14685,12 @@ final: prev: {
 
   opencode-nvim = buildVimPlugin {
     pname = "opencode.nvim";
-    version = "1.0.1";
+    version = "1.0.2";
     src = fetchFromGitHub {
       owner = "nickjvandyke";
       repo = "opencode.nvim";
-      tag = "v1.0.1";
-      hash = "sha256-rJz8AtUEgyTMvLd5cMD0wcsaNgW8FmPX1dtLymHM00o=";
+      tag = "v1.0.2";
+      hash = "sha256-AoQXcrIymg2DDHKYQFkV039bFo/AN1QJVevhsIcc/+I=";
     };
     meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15373,12 +15387,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.2.1-1";
+    version = "6.3.0-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.2.1-1";
-      hash = "sha256-jJwnMO5rYhlDp+ykL/72o4fllbtLCxdX+2ZCBJGxtwg=";
+      tag = "v6.3.0-1";
+      hash = "sha256-X8Jd6KtX/oM8Oe1KsRlixfGNAUwfkWfXQO/Xkg7EAqU=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15849,12 +15863,12 @@ final: prev: {
 
   render-markdown-nvim = buildVimPlugin {
     pname = "render-markdown.nvim";
-    version = "8.13.0";
+    version = "8.14.0";
     src = fetchFromGitHub {
       owner = "MeanderingProgrammer";
       repo = "render-markdown.nvim";
-      tag = "v8.13.0";
-      hash = "sha256-ukJUaqEYI60o/lyLM5GaKsRdMW/24IZnzVzPB9/Q/zo=";
+      tag = "v8.14.0";
+      hash = "sha256-pG8lAo4qucIu+gAwrEaK79VkDFTLcuuPBYhq3sg951E=";
     };
     meta.homepage = "https://github.com/MeanderingProgrammer/render-markdown.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18233,6 +18247,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tiny-code-action-nvim = buildVimPlugin {
+    pname = "tiny-code-action.nvim";
+    version = "0-unstable-2026-04-25";
+    src = fetchFromGitHub {
+      owner = "rachartier";
+      repo = "tiny-code-action.nvim";
+      rev = "0d040ed81f7953118b81cd12681fcdfcac069803";
+      hash = "sha256-UF9zeO5Uujdt2MEwy2d2Lhk6JRnEN4vrEvYslv0/zaA=";
+    };
+    meta.homepage = "https://github.com/rachartier/tiny-code-action.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   tiny-devicons-auto-colors-nvim = buildVimPlugin {
     pname = "tiny-devicons-auto-colors.nvim";
     version = "0-unstable-2026-05-29";
@@ -26403,12 +26431,12 @@ final: prev: {
 
   zotcite = buildVimPlugin {
     pname = "zotcite";
-    version = "0.7-unstable-2026-08-24";
+    version = "0.7-unstable-2026-09-15";
     src = fetchFromGitHub {
       owner = "jalvesaq";
       repo = "zotcite";
-      rev = "282bd8963218f840d7286ce6874bafc7c6b4b535";
-      hash = "sha256-qR2/SLTUw4Mc2KpdPbkPETuvxKpOg6N3Qu3XgrNy48k=";
+      rev = "669110c668cee18565069ed8980c14af7798df0b";
+      hash = "sha256-vOO70rXJMIOH8xdP0z4E5+JU+Nx+NBYdMlYaFkU4XOs=";
     };
     meta.homepage = "https://github.com/jalvesaq/zotcite/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -4655,6 +4655,13 @@ assertNoAdditions {
     };
   });
 
+  tiny-code-action-nvim = super.tiny-code-action-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # test for optional previewer
+      "tiny-code-action.previewers.snacks"
+    ];
+  };
+
   tmux-complete-vim = super.tmux-complete-vim.overrideAttrs {
     # Vim plugin with optional nvim-compe lua module
     nvimSkipModules = [ "compe_tmux" ];

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -989,6 +989,7 @@ https://github.com/ishan9299/nvim-solarized-lua/,,
 https://github.com/prismatic-koi/nvim-sops/,,
 https://github.com/chrisgrieser/nvim-spider/,,
 https://github.com/kylechui/nvim-surround/,main,
+https://github.com/gregorias/nvim-surround-wk/,main,
 https://github.com/svermeulen/nvim-teal-maker/,,
 https://github.com/norcalli/nvim-terminal.lua/,,
 https://github.com/klen/nvim-test/,,
@@ -1300,6 +1301,7 @@ https://github.com/levouh/tint.nvim/,,
 https://github.com/tinted-theming/tinted-nvim/,,
 https://github.com/tinted-theming/tinted-vim/,,
 https://github.com/rachartier/tiny-cmdline.nvim/,,
+https://github.com/rachartier/tiny-code-action.nvim/,,
 https://github.com/rachartier/tiny-devicons-auto-colors.nvim/,,
 https://github.com/rachartier/tiny-glimmer.nvim/,,
 https://github.com/rachartier/tiny-inline-diagnostic.nvim/,,

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-0Sfnhxgcws/Nk57lF1UV7DQh2pq5OJlFpRaPHhSSAlg=";
+          hash = "sha256-sZ9dwKsCNHIQQDnHRLF7U/sq3tt3MECDjpEwO4emn6I=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-Vu38YBqcpYbzFUE5D63/1A9+hoAmQ88VenQ4jeq1XWU=";
+          hash = "sha256-sUjRLPUM8gc1ddBajfd+C0HQsY87mzQ+/BcXxOS6a0I=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Vi+ClxIVz+Ko34mRGMk11xTL88t3EkZ346RciMTL9es=";
+          hash = "sha256-ifxVrJmXZPdOvfS0Dnl/ns/qtP1UP4RbZhLWs10AweU=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.78.0";
+      version = "2026.82.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4530,8 +4530,8 @@ let
         mktplcRef = {
           publisher = "streetsidesoftware";
           name = "code-spell-checker";
-          version = "4.7.3";
-          hash = "sha256-xvvw+8JvRte3f3Zm24NzfjFMeTAkKeUS0EqqxFoEl/0=";
+          version = "4.9.3";
+          hash = "sha256-8MfXeGFCeKhxa3Z/YISz60N6ZmGHRJde3X/y4I6Totw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.39.10";
-    hash = "sha256-jvhWtI8orTEKT/NZf+ADzi2BZUGN9sZImEi7UuaJjzg=";
+    version = "1.40.1";
+    hash = "sha256-1vtico0e2lVJ43ZEYcQpXt8nlD5+8KWxe2o1q8f0yZU=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-containers/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-containers";
-    version = "2.5.0";
-    hash = "sha256-NYYI2w5N8PEPeFcO1PHtD6hinK6Rb6Ux6Ot8OYxYydU=";
+    version = "2.5.1";
+    hash = "sha256-FHS93HCKHFzleRIJP+pxpdTZZjqBkZOjHlmJ5M0ojbs=";
   };
 
   meta = {

pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix

@@ -0,0 +1,10 @@
+{
+  traefik-crd = {
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-41.4.2+up41.4.0.tgz";
+    sha256 = "0dfvh65gilw4z3cyia8gq0hqgcp09cbdihq6g6n93af9lbpwysnf";
+  };
+  traefik = {
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-41.4.2+up41.4.0.tgz";
+    sha256 = "1379f54pci4y41szpnw016wr6kkawyyr6sfzijdsz3f8fryhp3xp";
+  };
+}

pkgs/applications/networking/cluster/k3s/1_37/images-versions.json

@@ -0,0 +1,26 @@
+{
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "936f0ef6acaacb1950367308fbbe0388244df2ffc2a80cbd99e1f01ddde413e7"
+  },
+  "airgap-images-amd64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0b4ff0d6e233de54be4e16cb5aa298fd53ad88f66ad8ae31093b5ef4dcefcdd0"
+  },
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "b7d9f8e94a28d0f70b8b9d6782f3d3190fe94b0b19fca4554e41ad3dbdee1f3f"
+  },
+  "airgap-images-arm-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "be1628b6beb17937140171374beed94e550a9c3c8ea98eec23ae6f21ca8493f1"
+  },
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "d1b534c7b5b67e06fdea2231813b3adc596ba36d7a63699fec1eb23e3c0baf17"
+  },
+  "airgap-images-arm64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "b3bd28d3a20144927b25ebb1d255a16ce55bb050b9af5e63abd1bf91c0838fe5"
+  }
+}

pkgs/applications/networking/cluster/k3s/1_37/versions.nix

@@ -0,0 +1,21 @@
+{
+  k3sVersion = "1.37.0+k3s1";
+  k3sCommit = "bb7cf0657bafdfbb4349d1740810442d09c2248a";
+  k3sRepoSha256 = "0glzg974w7f0jdaljr9bxw36qv53chii25rjbrvlbzlyzjq19wws";
+  k3sVendorHash = "sha256-AObmRWcIyFDy1aTA66LLFYnnUQzpf6+Ts6HQRA3i26A=";
+  chartVersions = import ./chart-versions.nix;
+  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
+  k3sRootVersion = "0.15.2";
+  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.3.4-k3s1";
+  containerdSha256 = "18kci7drnlxkn4vk166jijavgwaml1vhlfqirhzljmb4g16ydrah";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
+  criCtlVersion = "1.37.0-k3s1";
+  flannelVersion = "v0.28.4";
+  flannelPluginVersion = "v1.9.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s5";
+  helmJobVersion = "v0.13.3-build20260727";
+}

pkgs/applications/networking/cluster/k3s/default.nix

@@ -15,4 +15,5 @@ in
   k3s_1_34 = forVersions ./1_34/versions.nix;
   k3s_1_35 = forVersions ./1_35/versions.nix;
   k3s_1_36 = forVersions ./1_36/versions.nix;
+  k3s_1_37 = forVersions ./1_37/versions.nix;
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -670,13 +670,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-0cDJS89LsTuE2MJoNCnG8Xy7pJYisOggKrqQlK4OeAw=",
+    "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.80.0",
+    "rev": "v0.81.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-O+UMVIed8JEwjaXGTewOY6Vk+MopCQSx+qyMvJW7bkI="
+    "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
     "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",
@@ -1436,11 +1436,11 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-t5vN18z7gjF4oxD31oGn8ZPoNCypxQJemDOxFFAVfXs=",
+    "hash": "sha256-9ODFjrawdF0XtmCjfelwSP+10RsYQMjTB2BBqracnos=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v3.1.0",
+    "rev": "v3.1.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ZeO1E/9F9rco4p++pjzjiVWPCYQXdPeHWdtghZP6irY="
   },

pkgs/applications/video/kodi/addons/jellyfin/default.nix

@@ -17,13 +17,13 @@ in
 buildKodiAddon rec {
   pname = "jellyfin";
   namespace = "plugin.video.jellyfin";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-kodi";
     rev = "v${version}";
-    sha256 = "sha256-S5LAIeYwApyGPsj999rotFgfAZmLxnJjuJD8CE4QDro=";
+    sha256 = "sha256-TWDhCOe4EO2HJ/Px+en2++YWniiw4Y+vU3sQtxOvT8U=";
   };
 
   nativeBuildInputs = [ python ];

pkgs/applications/virtualization/virtualbox/default.nix

@@ -72,9 +72,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.2.16";
+  virtualboxVersion = "7.2.18";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
+  virtualboxSha256 = "06db4060caadc70346335c0a731ca6667cdabf206de289c64f3f96f2d341b9d0";
 
   kvmPatchVboxVersion = "7.2.6";
   kvmPatchVersion = "20260201";

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl rec {
   pname = "virtualbox-extpack";
-  version = "7.2.16";
+  version = "7.2.18";
   name = "Oracle_VirtualBox_Extension_Pack-${version}.vbox-extpack";
   url = "https://download.virtualbox.org/virtualbox/${version}/${name}";
   sha256 =
@@ -13,7 +13,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
     let
-      value = "d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689";
+      value = "e06834239947db06cc077d464bbb15d6441917ca03573e518506344dc28b64b9";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "c9349c0231d81c821fc1de7b9592bf07bb7c3f111c3f942ddddc211496ef7a3e";
+  sha256 = "346ea2b9ed47bb954464af83835b14bd8afa5fc1864f34e2561ed923fb74981c";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -18,9 +18,9 @@
   libx11,
 }:
 let
-  virtualboxVersion = "7.2.16";
+  virtualboxVersion = "7.2.18";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
+  virtualboxSha256 = "06db4060caadc70346335c0a731ca6667cdabf206de289c64f3f96f2d341b9d0";
 
   platform =
     if stdenv.hostPlatform.isAarch64 then
@@ -98,7 +98,9 @@ stdenv.mkDerivation {
 
   # https://github.com/VirtualBox/virtualbox/issues/812
   postPatch = ''
-    substituteInPlace ./src/vboxguest-${virtualboxVersion}_NixOS/vboxvideo/vbox_fb.c --replace-fail "RTLNX_VER_MIN(6,19,0)" "RTLNX_VER_RANGE(6,6,152, 6,6,999) || RTLNX_VER_RANGE(6,12,103, 6,12,999) || RTLNX_VER_RANGE(6,18,44, 6,18,999) || RTLNX_VER_MIN(6,19,0)"
+    substituteInPlace ./src/vboxguest-${virtualboxVersion}_NixOS/vboxvideo/vbox_fb.c \
+      --replace-fail "RTLNX_VER_MIN(6,19,0) || RTLNX_VER_RANGE(6,12,103, 6,13,0)" \
+      "RTLNX_VER_MIN(6,19,0) || RTLNX_VER_RANGE(6,12,103, 6,13,0) || RTLNX_VER_RANGE(6,6,152, 6,6,999) || RTLNX_VER_RANGE(6,18,44, 6,18,999)"
   '';
 
   buildPhase = ''

pkgs/by-name/ag/agent-browser/package.nix

@@ -16,13 +16,13 @@
 let
   pnpm = pnpm_11;
 
-  version = "0.37.1";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "agent-browser";
     tag = "v${version}";
-    hash = "sha256-AgpKazIBT3CKd4Q7yQsEGhoTW+7R0Pflma6aH+6UI/U=";
+    hash = "sha256-C+XplCHOdFDQGPUnrCDuq7U4LkAX0QB3fC4uVA8o11w=";
   };
 
   # The Rust CLI embeds the dashboard UI via RustEmbed at compile time.
@@ -83,7 +83,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/cli";
 
-  cargoHash = "sha256-ziN4UMeEcgsD5BDXWjffreGjyew7oTUtq59b/Um8Dfk=";
+  cargoHash = "sha256-Ei26Iz0qMqayucULLCSwN+fjw0VJ3S2L2A4vGhfYGqI=";
 
   # Place the pre-built dashboard where RustEmbed expects it
   postUnpack = ''

pkgs/by-name/au/audiobookshelf/package.nix

@@ -17,10 +17,10 @@ let
   ffmpeg-full = ffmpeg_8-full;
 
   source = {
-    version = "2.36.0";
-    hash = "sha256-oohjRiKARpIyoPFEXR24nlKK4xBBEHUMVTaq/i6NfV8=";
-    npmDepsHash = "sha256-uDIL9PxbFUa3MwLoPomTfq1A/R1ewDIv+EFWml/8uy8=";
-    clientNpmDepsHash = "sha256-0xqqpls8FLuXngjjdwjoNLpq9dSixWouROviTjsFCbU=";
+    version = "2.36.1";
+    hash = "sha256-HBaTTfZEbhR2n/XafScZB/gX29erTQHZ+IdErwhA11A=";
+    npmDepsHash = "sha256-kp0LbSKaHTBppeyfLAFrGYnSWS3V2trO5yaZWoxVPo8=";
+    clientNpmDepsHash = "sha256-g3Y/4UU2YH/CeU8Z/NNkLP0OTeBM+4/rQfL406uVdio=";
   };
 
   src = fetchFromGitHub {

pkgs/by-name/av/avogadrolibs/package.nix

@@ -96,6 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ sheepforce ];
     homepage = "https://github.com/OpenChemistry/avogadrolibs";
     platforms = lib.platforms.linux;
-    license = lib.licenses.gpl2Only;
+    license = lib.licenses.bsd3;
   };
 })

pkgs/by-name/be/bedtools/package.nix

@@ -6,21 +6,23 @@
   python3,
   bzip2,
   xz,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bedtools";
   version = "2.31.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "arq5x";
     repo = "bedtools2";
-    rev = "v${version}";
-    sha256 = "sha256-rrk+FSv1bGL0D1lrIOsQu2AT7cw2T4lkDiCnzil5fpg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rrk+FSv1bGL0D1lrIOsQu2AT7cw2T4lkDiCnzil5fpg=";
   };
 
-  strictDeps = true;
-
   nativeBuildInputs = [
     python3
   ];
@@ -31,16 +33,28 @@ stdenv.mkDerivation rec {
     xz
   ];
 
-  cxx = if stdenv.cc.isClang then "clang++" else "g++";
-  cc = if stdenv.cc.isClang then "clang" else "gcc";
-  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
-  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} install";
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    # The Makefiles hardcode `CC = gcc` and `CXX = g++`.
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
 
   meta = {
     description = "Powerful toolset for genome arithmetic";
-    license = lib.licenses.gpl2;
     homepage = "https://bedtools.readthedocs.io/en/latest/";
+    downloadPage = "https://github.com/arq5x/bedtools2";
+    changelog = "https://github.com/arq5x/bedtools2/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    mainProgram = "bedtools";
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/bi/bind/package.nix

@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.26";
+  version = "9.20.29";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VSSN7w+HDExGs95yl46pcmFRMVFmYxiKRWTcodIL81A=";
+    hash = "sha256-WHApUIs7G0Min65BbJflVDq6RYCc76ypilAEoCpXNsE=";
   };
 
   outputs = [
@@ -121,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
   preCheck = ''
     # skip timezone-related tests, they are flaky inside the nix sandbox
     sed -i '/^ISC_TEST_ENTRY(isc_time_formatISO8601L/d' tests/isc/time_test.c
+    sed -i '/^ISC_TEST_ENTRY(isc_time_formattimestamp_test/d' tests/isc/time_test.c
   ''
   + lib.optionalString stdenv.hostPlatform.isRiscV64 ''
     # lock benchmarks exceed the 300s test watchdog on slower hardware

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "bootdev-cli";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6IwqKV/PWy+QMfHcDmhHvKUo9so5EECXgCrA4hg4oSs=";
+    hash = "sha256-MWK/1hscAky6ampB4n8NQTVchDT0EADRtub+8sgAYXg=";
   };
 
-  vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";
+  vendorHash = "sha256-LCvJDsg4MANhQ0V/ymP1heCN5rFNgeOYCYILsPdXYag=";
 
   ldflags = [
     "-s"

pkgs/by-name/bu/buildstream/package.nix

@@ -124,6 +124,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/apache/buildstream/blob/${finalAttrs.src.tag}/NEWS";
     description = "Powerful software integration tool";
     downloadPage = "https://buildstream.build/install.html";
     homepage = "https://buildstream.build";

pkgs/by-name/ca/canaille/package.nix

@@ -2,41 +2,41 @@
   lib,
   python3,
   fetchFromGitLab,
-  fetchpatch2,
+  fetchFromGitHub,
   openldap,
   nixosTests,
   postgresql,
 }:
 
 let
-  python = python3;
+  python = python3.override {
+    self = python;
+    packageOverrides = _final: prev: {
+      # TODO remove when wtforms has a 3.3 stable release
+      wtforms = prev.wtforms.overridePythonAttrs (_old: rec {
+        version = "3.3.0b3";
+        src = fetchFromGitHub {
+          owner = "wtforms";
+          repo = "wtforms";
+          tag = version;
+          hash = "sha256-h+rzhFPN+N4Jxs9lugvWqNy2eXkXtSCpMW3wp2KgrFk=";
+        };
+      });
+    };
+  };
 in
-python.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "canaille";
-  version = "0.2.7";
+  version = "0.3.6";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "yaal";
     repo = "canaille";
-    tag = version;
-    hash = "sha256-hreEjMrD6mRapgrSDPRWcmqfLxfsOpK7dC8lHJkAY7Y=";
+    tag = finalAttrs.version;
+    hash = "sha256-Zn1MZa4TYNfdVrDmi6KHQxrdK9UfRxYqJpCXVbqnvII=";
   };
 
-  patches = [
-    # Backport authlib 1.7 compatibility.
-    (fetchpatch2 {
-      url = "https://gitlab.com/yaal/canaille/-/commit/b356baa82109a7fdf61a8258572d199ffd3c9604.diff";
-      hash = "sha256-/U6S3h6qIl763ZsGpOm6CVk4NaY3A7mq3PkT193aLEs=";
-    })
-    # Update OIDC tests for authlib 1.7 behavior.
-    (fetchpatch2 {
-      url = "https://gitlab.com/yaal/canaille/-/commit/c1b6d103ebf374cd6a21d9af8376c910c2d0d5d9.diff";
-      hash = "sha256-MjwkUb54ikt1+xUXBTOIBi9E+DmPdwYhw0W0c0prF/Q=";
-      includes = [ "tests/oidc/*" ];
-    })
-  ];
-
   build-system = with python.pkgs; [
     hatchling
     babel
@@ -79,7 +79,7 @@ python.pkgs.buildPythonApplication rec {
       time-machine
       pytest-scim2-server
     ]
-    ++ (lib.concatLists (builtins.attrValues optional-dependencies));
+    ++ (lib.concatLists (builtins.attrValues finalAttrs.passthru.optional-dependencies));
 
   postInstall = ''
     mkdir -p $out/etc/schema
@@ -115,14 +115,13 @@ python.pkgs.buildPythonApplication rec {
       flask-talisman
       flask-themer
       isodate
-      pycountry
       pytz
-      tomlkit
       zxcvbn-rs-py
     ];
     oidc = [
       authlib
       joserfc
+      tomlkit
     ];
     scim = [
       authlib
@@ -172,11 +171,11 @@ python.pkgs.buildPythonApplication rec {
   meta = {
     description = "Lightweight Identity and Authorization Management";
     homepage = "https://canaille.readthedocs.io/en/latest/index.html";
-    changelog = "https://gitlab.com/yaal/canaille/-/blob/${src.tag}/CHANGES.rst";
+    changelog = "https://gitlab.com/yaal/canaille/-/blob/${finalAttrs.src.tag}/CHANGES.rst";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ erictapen ];
     mainProgram = "canaille";
   };
 
-}
+})

pkgs/by-name/ca/cargo-codspeed/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-codspeed";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zu5PltGimy+8JYTEh8fTflW/L4zTW94IKgldT5kzPjA=";
+    hash = "sha256-RX+2jjEPBIKG3KR15MjXa9GvQGAKD30aGRGcHPLGTq4=";
   };
 
-  cargoHash = "sha256-hihwHbyNAJcl/mUy9obh2UDZfUA9Lq64c1TRZbUr+L0=";
+  cargoHash = "sha256-qiLUKzaVjHQNmjhT728/fldsuUHNW2G0TcgAQsJobqc=";
 
   nativeBuildInputs = [
     curl

pkgs/by-name/ca/cargo-release/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-release";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ukzR9VAbrvI+r01D7vCXeBouQeamCtEnKmBg8kKGRpg=";
+    hash = "sha256-w+7kvJQBlb40W+vRAXmySOaL513501fj25PkWI8lQTw=";
   };
 
-  cargoHash = "sha256-E+ZhFMfASA6rP4E/+hbZihe0Rzf7RRe3I+W+wj389bo=";
+  cargoHash = "sha256-rU8HQBrK/0aRCz5hvUQCMxRCbP2N98S+0gvVNqkap7s=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/cargo-risczero/package.nix

@@ -6,6 +6,7 @@
   pkg-config,
   openssl,
   nix-update-script,
+  stdenv, # for meta.broken
 }:
 let
   # That is from cargoDeps/risc0-circuit-recursion/build.rs
@@ -44,6 +45,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Cargo extension to help create, manage, and test RISC Zero projects";
     mainProgram = "cargo-risczero";
     homepage = "https://risczero.com";

pkgs/by-name/ca/cargo-temp/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-temp";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "yozhgoor";
     repo = "cargo-temp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5GTsVqQOS0HL2q++t4ms9srFx1t1DJkdyUx150H6CT0=";
+    hash = "sha256-ILkv6axwyOneJAD/gvO24vh1J1F8XtwZzmsx6WU7DJQ=";
   };
 
-  cargoHash = "sha256-wiFEsnBHFaQH7WyJv5FEEWXPiRfFFWm8NUjd0ea05Ko=";
+  cargoHash = "sha256-ziHwGU2+qENsm/UuT9ZxzPVonwn8ldG8o+iWDaZIfw0=";
 
   meta = {
     description = "CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";

pkgs/by-name/ca/cargo-ui/package.nix

@@ -61,6 +61,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "GUI for Cargo";
     mainProgram = "cargo-ui";
     homepage = "https://github.com/slint-ui/cargo-ui";

pkgs/by-name/ch/checkpwn/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "checkpwn";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-jQEg6wDZl2ar/KzhSPPpBRQ3JNThXk7j/zTbqeY6L58=";
+    hash = "sha256-QofPCfdOurEBGY1mwj5pQXtWA0+EJaEsjnHCXFjW1L8=";
   };
 
-  cargoHash = "sha256-R7IGqZrnF/dsl94fuB4Z2hLdPozCWUZTCryFuSW89FQ=";
+  cargoHash = "sha256-U5EXX8EzZC3uJ0cWzB5dT9sGDqIc9GsAbstts9PtjQ0=";
 
   # requires internet access
   checkFlags = [

pkgs/by-name/ci/civetweb/package.nix

@@ -4,6 +4,12 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  zlib,
+  versionCheckHook,
+
+  withZlib ? false,
+  withUnixSockets ? false,
+  withWebSockets ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,11 +38,18 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-I";
 
   nativeBuildInputs = [
     cmake
   ];
 
+  buildInputs = lib.optional withZlib zlib;
+
   # The existence of the "build" script causes `mkdir -p build` to fail:
   #   mkdir: cannot create directory 'build': File exists
   preConfigure = ''
@@ -60,12 +73,22 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Workaround CMake 4 compat
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
-  ];
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_WEBSOCKETS" withWebSockets)
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_ZLIB" withZlib)
+  ]
+
+  # Support for listening for HTTP requests on a Unix domain socket.
+  ++ lib.optional withUnixSockets "-DCMAKE_C_FLAGS=-DUSE_X_DOM_SOCKET";
+  # NOTE Once 1.17 is released, we can use a CMake flag:
+  # (lib.cmakeBool "CIVETWEB_ENABLE_X_DOM_SOCKET" withUnixSockets)
 
   meta = {
     description = "Embedded C/C++ web server";
     mainProgram = "civetweb";
     homepage = "https://github.com/civetweb/civetweb";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
   };
 })

pkgs/by-name/cl/claude-agent-acp/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.75.1";
+  version = "0.79.0";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LEubm7Ck22olYsP+l9tis9Qcw77fpy7gBT42P/Aj+KY=";
+    hash = "sha256-Xezx6CM44czWrfJ/1LyJkMXV33ufIfYKtNL7qeQCths=";
   };
 
-  npmDepsHash = "sha256-78vx17sJlklHPq98gZxgQFB6BFGp0uGrcpj7tv978qg=";
+  npmDepsHash = "sha256-d0UpoVGVC3q0jhgOAvGLqxul1J8ZO1bTwXprWg+FKc4=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/by-name/cl/clfft/package.nix

@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
   env.CXXFLAGS = "-std=c++98";
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Library containing FFT functions written in OpenCL";
     longDescription = ''
       clFFT is a software library containing FFT functions written in OpenCL.

pkgs/by-name/co/colmap/package.nix

@@ -191,6 +191,11 @@ stdenv'.mkDerivation (finalAttrs: {
         "*GPU*"
         "*OpenGL*"
       ]
+      ++ lib.optionals stdenv'.hostPlatform.isAarch64 [
+        # least_absolute_deviations_test.cc:311: Failure
+        # Value of: solver.Valid(), Actual: true, Expected: false
+        "*ParameterizedLeastAbsoluteDeviationsTests.RidgeRegularization/0"
+      ]
       ++ lib.optionals stdenv'.hostPlatform.isDarwin [
         # reconstruction_pruning_test.cc:65: Failure
         # Expected: (redundant_point3D_ids.size()) > (prev_num_redundant_points3D), actual: 0 vs 0

pkgs/by-name/co/comaps/package.nix

@@ -38,18 +38,18 @@ let
 
   # Update mapRev based on v field and mapSeries near the top in https://codeberg.org/comaps/comaps/src/branch/main/data/countries.txt
   mapSeries = "2026.06.28";
-  mapRev = 260714;
+  mapRev = 260830;
 
   worldMap = fetchurl {
     name = "World-${mapSeries}-${toString mapRev}.mwm";
     url = "https://mapgen-fi-1.comaps.app/maps/${mapSeries}/${toString mapRev}/World.mwm";
-    hash = "sha256-+EttNsix+9bB0/eOsPaxtZEfPDqQrj8qfZg2qDaLFVc=";
+    hash = "sha256-TcaGJK8xAkceA7wFsCrYt6euOnts0w7LZCKLFPnU3wM=";
   };
 
   worldCoasts = fetchurl {
     name = "WorldCoasts-${mapSeries}-${toString mapRev}.mwm";
     url = "https://mapgen-fi-1.comaps.app/maps/${mapSeries}/${toString mapRev}/WorldCoasts.mwm";
-    hash = "sha256-MsXFqnoyQQTTJR1f8ihiqzCYuuRAVbRpoXfPPkVFa1E=";
+    hash = "sha256-pNb0cLGRN6YkliraL+DZyAPh+JJSM6vTzoejeKvi/oc=";
   };
 
   pythonEnv = python3.withPackages (
@@ -60,7 +60,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "comaps";
-  version = "2026.08.07-3";
+  version = "2026.08.31-14";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "comaps";
     repo = "comaps";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ft7VYIMdg8IOl4gfm7Zg5EQjli0YDGuepwP1X9w2Sos=";
+    hash = "sha256-mnLvDuXCi7guw0vU3TnqmvvgB1l7mN/AKwtF/79LGd4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cy/cyclonedx-python/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cyclonedx-python";
-  version = "7.3.1";
+  version = "7.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BBnWnxhi7vDfzdFdimncy8u3djW2K3TooYxNBnAkEf8=";
+    hash = "sha256-tyYMofGXtnk0tAaryhdcSaZxi8LDVJmuUMGeO6v0zdg=";
   };
 
   build-system = with python3Packages; [ poetry-core ];

pkgs/by-name/db/dbc-parser-cpp/0001-fix-pkg-config-file.patch

@@ -0,0 +1,12 @@
+--- a/dbc.pc.in
++++ b/dbc.pc.in
+@@ -1,7 +1,7 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: @PROJECT_NAME@
+ Description: @CPACK_PACKAGE_DESCRIPTION_SUMMARY@

pkgs/by-name/db/dbc-parser-cpp/0002-fix-testcase-aarch64.patch

@@ -0,0 +1,29 @@
+--- a/test/test_parse_message.cpp
++++ b/test/test_parse_message.cpp
+@@ -50,7 +50,7 @@ TEST_CASE("Parse Message Big Number not aligned little endian") {
+ 		CHECK(refData.size() == 7);
+ 		CHECK(out_values.size() == refData.size());
+ 		for (size_t i = 0; i < refData.size(); i++) {
+-			CHECK(out_values.at(i) == refData.at(i));
++			CHECK(out_values.at(i) == Catch::Approx(refData.at(i)).margin(1e-9));
+ 		}
+ 	}
+ 
+@@ -61,7 +61,7 @@ TEST_CASE("Parse Message Big Number not aligned little endian") {
+ 		CHECK(refData.size() == 7);
+ 		CHECK(out_values.size() == refData.size());
+ 		for (size_t i = 0; i < refData.size(); i++) {
+-			CHECK(out_values.at(i) == refData.at(i));
++			CHECK(out_values.at(i) == Catch::Approx(refData.at(i)).margin(1e-9));
+ 		}
+ 	}
+ 
+@@ -72,7 +72,7 @@ TEST_CASE("Parse Message Big Number not aligned little endian") {
+ 		CHECK(refData.size() == 7);
+ 		CHECK(out_values.size() == refData.size());
+ 		for (size_t i = 0; i < refData.size(); i++) {
+-			CHECK(out_values.at(i) == refData.at(i));
++			CHECK(out_values.at(i) == Catch::Approx(refData.at(i)).margin(1e-9));
+ 		}
+ 	}
+ }

pkgs/by-name/db/dbc-parser-cpp/package.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  fast-float,
+  catch2_3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dbc-parser-cpp";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "LinuxDevon";
+    repo = "dbc_parser_cpp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oyC7NihrlYvoR3CH07FeZcXfQ1JH2Ymsb7ocgim4dZ8=";
+  };
+
+  patches = [
+    # Submitted upstream:  https://github.com/LinuxDevon/dbc_parser_cpp/pull/37
+    # Remove when upstream merges the PR
+    ./0001-fix-pkg-config-file.patch
+  ]
+  # Submitted upstream: https://github.com/LinuxDevon/dbc_parser_cpp/pull/36
+  # Remove when upstream merges the PR
+  ++ lib.optional stdenv.hostPlatform.isAarch64 ./0002-fix-testcase-aarch64.patch;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    fast-float
+  ];
+
+  checkInputs = [
+    catch2_3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "DBC_ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    # Cmake test file doesn't check for system installed Catch2 and directly uses FetchContent to download Catch2
+    (lib.cmakeFeature "FETCHCONTENT_TRY_FIND_PACKAGE_MODE" "ALWAYS")
+  ];
+
+  doCheck = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "DBC file parsing library written in C++";
+    homepage = "https://github.com/LinuxDevon/dbc_parser_cpp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      AhmedAmr
+    ];
+    teams = with lib.teams; [ ngi ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/de/deploy-rs/package.nix

@@ -2,20 +2,28 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage {
   pname = "deploy-rs";
-  version = "0-unstable-2026-02-02";
+  version = "0-unstable-2026-09-14";
 
   src = fetchFromGitHub {
     owner = "serokell";
     repo = "deploy-rs";
-    rev = "77c906c0ba56aabdbc72041bf9111b565cdd6171";
-    hash = "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=";
+    rev = "e760371d631165e7d8de5b0dcf148e21ec4c16f0";
+    hash = "sha256-UXFQ7tFiwn8sPz0EV4CBB2PCf/ZiGIHWn/6MXk81Lxs=";
   };
 
-  cargoHash = "sha256-9O93YTEz+e2oxenE0gwxsbz55clbKo9+37yVOqz7ErE=";
+  cargoHash = "sha256-ONGMdmkKGPJ+6KF2hkZQBefkug/C5ZEqPidKR6OkCbU=";
+
+  # Tests use the FSEvents API on macOS, which the darwin sandbox blocks by default
+  sandboxProfile = ''
+    (allow mach-lookup (global-name "com.apple.FSEvents"))
+  '';
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
   meta = {
     description = "Multi-profile Nix-flake deploy tool";

pkgs/by-name/de/descent3-unwrapped/package.nix

@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
   # the wrapped version of Descent 3. Once there’s a stable version of Descent
   # 3 that supports the -additionaldir command-line option, we can stop using
   # an unstable version of Descent 3.
-  version = "1.5.0-beta-unstable-2026-01-21";
+  version = "1.5.0-beta-unstable-2026-09-16";
   src = fetchFromGitHub {
     owner = "DescentDevelopers";
     repo = "Descent3";
-    rev = "156cba8aafd997d27deb0902ba6026bcdcc1cfaf";
+    rev = "a3e82bc292dab95afd2bf3dc0988c065e041b3ef";
     leaveDotGit = true;
     # Descent 3 is supposed to display its Git commit hash in the bottom right
     # corner of the main menu. That feature only works if either the .git
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
       git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
       rm -r .git
     '';
-    hash = "sha256-NsZPGgIzI2mE3mJ7eoczaNDkGZUpMUMBRLK2qt2WPgk=";
+    hash = "sha256-yS2tjVNtUEbsMbdt21TK7VqN3rm66BxNxI/GNcAHCIA=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/by-name/di/dico/package.nix

@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Flexible dictionary server and client implementing RFC 2229";
     homepage = "https://www.gnu.org/software/dico/";
     license = lib.licenses.gpl3Plus;

pkgs/by-name/do/docuum/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -28,7 +29,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.nixos = nixosTests.docuum;
+  };
 
   meta = {
     description = "Least recently used (LRU) eviction of Docker images";

pkgs/by-name/du/dust/package.nix

@@ -12,13 +12,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tK7cAckvRmWcaDTd92+XccswKHLAr4r8IzYYzcZYu/g=";
+    hash = "sha256-BHlasERvwS/mr6EUfgItvrL/oozFta4/XwwI3hYyMGo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-KQPCRQLTmltoJTgbA3ri5U/w+JJb/J+iclK7Mcb4hfU=";
+  cargoHash = "sha256-oIR10K/vn9sexW+m9vOuGJDqXRk2gjB0WoPj71cT+eg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ew/eww/package.nix

@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eww";
-  version = "0.6.0-unstable-2026-07-05";
+  version = "0.6.0-unstable-2026-07-17";
 
   src = fetchFromGitHub {
     owner = "elkowar";
     repo = "eww";
-    rev = "4ded06345553e4c2bcf8179fc7438e53c5e54d89";
-    hash = "sha256-fnI8XgBowMxs/j9FGf+pQI2U8YjN8pTRqkVmFm8PBHE=";
+    rev = "48f5aa8b379adf29da0b0bb9ca04164f65d8bdaa";
+    hash = "sha256-qctOkZtSvJPx3Gv/BaZE6oZ6qSl7/VGWuUkIVfp3IOw=";
   };
 
   cargoHash = "sha256-Kf99eojqXvdbZ3eRS8GBgyLYNpZKJGIJtsOsvhhSVDk=";

pkgs/by-name/ex/exa-agent-skills/package.nix

@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "exa-agent-skills";
-  version = "2026.09.11-e7de871";
+  version = "2026.09.16-73cc4b0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "exa-labs";
     repo = "agent-skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v8iHcDvKe7Ls1P7V0izJneyo3vYyW4dSzgUdmWeAP7o=";
+    hash = "sha256-cQMUDaHTHgwMjq1P6pMdulhADNAO78S+9WuyA7kssrg=";
   };
 
   nativeBuildInputs = [ installAgentSkills ];

pkgs/by-name/fa/far2l/package.nix

@@ -46,13 +46,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "far2l";
-  version = "2.9.0-unstable-06-09-2026";
+  version = "_2.9.0-unstable-2026-09-08";
 
   src = fetchFromGitHub {
     owner = "elfmz";
     repo = "far2l";
-    rev = "1d45c50547f4459c13f3613cb89b09bf8d6139b1";
-    hash = "sha256-/AxtL7L6YYKFrtdsUXiBQ1ljuqCBymkdajeMB2xlVrM=";
+    rev = "8afb44570f29cae97ab637e8d7432c1e7354565f";
+    hash = "sha256-M4kUBTdNn01B56GLANrWsxR7Q2P0s3k1iOxtiLHbFAs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/flatpak-builder-tools/package.nix

@@ -7,12 +7,12 @@
   enableDeno ? false,
 }:
 let
-  version = "0-unstable-2026-08-30";
+  version = "0-unstable-2026-09-12";
   src = fetchFromGitHub {
     owner = "flatpak";
     repo = "flatpak-builder-tools";
-    rev = "1fc32195e3e60fe5c97f0af646dec7a99df5962b";
-    hash = "sha256-Yc/fWlwhN38mbejTlM7XG1uY/WpREwETXwWWEMbv7tc=";
+    rev = "de2225a6dee4818c1339b3cdbf29f90c471fcb7e";
+    hash = "sha256-ih1Bq7MWHP6Vw1+mFoFE5rQpeDLKhldcfHTwQiyEM9I=";
   };
 in
 buildEnv {

pkgs/by-name/fo/forgejo/lts.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.8";
-  hash = "sha256-tpgqa6RvQ/xesSv/THjlXiM0JQqzgMQJiuUAOFrgGpo=";
+  version = "15.0.9";
+  hash = "sha256-6EtUVoB8/PsgbWiB4j9hLYOYyjPKCykzILWezDpJnAs=";
   npmDepsHash = "sha256-g3ebO2W8lnHeS6T6bMJkC/UVDA3pa5O5v64QJG5irn0=";
-  vendorHash = "sha256-p9U/nvAHSC2Pj09gfDWQVKl+1TKB0PTqW2E+gKZ4/D4=";
+  vendorHash = "sha256-KW0WIfRm53pVOiWOYoSQaCz7BO+lFykAQdgdgXesXkY=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/fo/forgejo/package.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "16.0.4";
-  hash = "sha256-oEw8FdJuTfxjMaVxQqbpAIWCYDhxPvifZv8UfqeHbRs=";
-  npmDepsHash = "sha256-QwZ8X0pVxs5u4jMOqy3VGcBGVqqDKpLCMPmwoECVwEg=";
-  vendorHash = "sha256-GRh9jh7x4xP8MPEEWG0BxKAXtTz3wjueIcPtbkksgqY=";
+  version = "16.0.5";
+  hash = "sha256-Ci6QuRNZ4miUzqPz5/YPQgo/wbndN3vFsBigApW8XOY=";
+  npmDepsHash = "sha256-CMShFS5JOqVwjLf1VKRaRD04GLuL4kRti27pVe4Pe2k=";
+  vendorHash = "sha256-yI74OphRoUvnsQ9qfnQdpUg2Jj4j72zVzP/Jr10XUWM=";
   lts = false;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/fs/fstrm/package.nix

@@ -15,8 +15,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "farsightsec";
     repo = "fstrm";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-/WFP2g3Vuf/qaY8pprY8XFAlpEE+0SJUlFNWfa+7ZlE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/WFP2g3Vuf/qaY8pprY8XFAlpEE+0SJUlFNWfa+7ZlE=";
   };
 
   outputs = [
@@ -34,12 +34,16 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ];
 
+  strictDeps = true;
+
   preBuild = ''
     NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -L${openssl}/lib"
   '';
 
   doCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Frame Streams implementation in C";
     homepage = "https://github.com/farsightsec/fstrm";

pkgs/by-name/gd/gdal/package.nix

@@ -92,6 +92,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8rTCv0Nsb+BhRypwXDY5SWP7Bo1vqJBlm7y6YCOMa2M=";
   };
 
+  patches = [
+    # https://github.com/OSGeo/gdal/pull/15259
+    ./proj-9.9.0-compat.patch
+  ];
+
   nativeBuildInputs = [
     bison
     cmake

pkgs/by-name/gd/gdal/proj-9.9.0-compat.patch

@@ -0,0 +1,29 @@
+diff --git a/autotest/utilities/test_gdalalg_mdim_info.py b/autotest/utilities/test_gdalalg_mdim_info.py
+index 33b87f60fc..63c283b350 100755
+--- a/autotest/utilities/test_gdalalg_mdim_info.py
++++ b/autotest/utilities/test_gdalalg_mdim_info.py
+@@ -180,7 +180,14 @@ def test_gdalalg_mdim_info_all_options():
+ def test_gdalalg_mdim_info_binary(gdal_path):
+ 
+     out = gdaltest.runexternal(f"{gdal_path} mdim info ../gdrivers/data/netcdf/byte.nc")
+-    assert json.loads(out) == {
++
++    info = json.loads(out)
++
++    # make PROJ 9.9.0 output equivalent to previous versions (#15250)
++    srs = info["arrays"]["Band1"]["srs"]
++    srs["wkt"] = srs["wkt"].replace("(E)", "easting").replace("(N)", "northing")
++
++    expected = {
+         "arrays": {
+             "Band1": {
+                 "attributes": {
+@@ -313,6 +320,8 @@ def test_gdalalg_mdim_info_binary(gdal_path):
+         "type": "group",
+     }
+ 
++    assert info == expected
++
+ 
+ def test_gdalalg_mdim_info_completion_array_invalid_ds(gdal_path):
+ 

pkgs/by-name/gd/gdevelop/darwin.nix

@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-I63Pdgyyck3x47Lb+p+92OfeKISxLI0Y8yVw4Hhor+A=";
+    hash = "sha256-P7DLp6ofmDw9OULfT6qFFOjN2Bv/75Z/52ElKaIYi+I=";
   };
 
   sourceRoot = ".";

pkgs/by-name/gd/gdevelop/linux.nix

@@ -13,7 +13,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-U5MW8NDJLDEcxFxYpRViv22YzRrdAlekE/JWUQIwzYQ=";
+        hash = "sha256-fvCh4GVWH37mn7tpnTXMs8J0/8o03bg1H1Zw2JtpK3k=";
       }
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";

pkgs/by-name/gd/gdevelop/package.nix

@@ -4,7 +4,7 @@
   callPackage,
 }:
 let
-  version = "5.6.281";
+  version = "5.6.282";
   pname = "gdevelop";
   meta = {
     description = "Graphical Game Development Studio";

pkgs/by-name/ge/genact/package.nix

@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/svenstaro/genact";
     changelog = "https://github.com/svenstaro/genact/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.novalkun ];
     mainProgram = "genact";
   };
 })

pkgs/by-name/gi/git-chain/package.nix

@@ -6,6 +6,7 @@
   openssl,
   git,
   nix-update-script,
+  stdenv, # for meta.broken
 }:
 
 rustPlatform.buildRustPackage {
@@ -30,6 +31,8 @@ rustPlatform.buildRustPackage {
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Tool for rebasing a chain of local git branches";
     homepage = "https://github.com/dashed/git-chain";
     license = lib.licenses.mit;

pkgs/by-name/gi/git-together/package.nix

@@ -4,6 +4,7 @@
   rustPlatform,
   openssl,
   pkg-config,
+  stdenv, # for meta.broken
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -25,6 +26,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-5LKKjHzIlXw0bUmF7GDCVW0cptCxohq6CNPIrMZKorM=";
 
   meta = {
+    # last successful hydra build on darwin was in 2024
+    broken = stdenv.hostPlatform.isDarwin;
     changelog = "https://github.com/kejadlen/git-together/releases/tag/v${finalAttrs.version}";
     description = "Better commit attribution while pairing without messing with your git workflow";
     homepage = "https://github.com/kejadlen/git-together";