maintainers/github-teams.json: Automated sync

The `find_a_program`/`for_each_path` machine-prefix patch series has now
landed on gcc `master`, so point the `fetchpatch` entries at the
`gcc-mirror/gcc` commit `.diff`s rather than the v5 mailing-list `raw`
URLs (matching the existing `for_each_path` rework patch).

Linking the approving mailing list posts, along with the commit hash
each of the 4 commits (by title) landed as.

- <https://inbox.sourceware.org/gcc-patches/6c3a085d-fa62-4b24-b4ca-ee5c6ac11be0@oss.qualcomm.com/>

  Approved the first two patches together.

  1. `find_a_program: Separate from find_a_file` → 948eb02800777d0318ee2a38bf32076afee739f2
  2. `driver: Simplify find_a_program and find_a_file` → 073b4656d07e40f83a1db7f4462ab2d68b1875a2

- <https://inbox.sourceware.org/gcc-patches/324798d3-effb-4dc5-86ab-a1c461390d64@oss.qualcomm.com/>

  3. `for_each_path: Pass to callback whether dir is machine-disambiguated` → f62f68e7c4bde0385fbd2dba3e926586dd2f1281

- <https://inbox.sourceware.org/gcc-patches/ae270a41-fae9-4442-a276-0433ea752f2e@oss.qualcomm.com/>

  4. `find_a_program: Search with machine prefix in some cases` → a514707ffd7d58b140686036c2dece43ecb7d33c

We also include an additional commit,
6b008944e7bc3a342a734c4fcf1001d63fd0a6f8, a one-line `for_each_path` fix
against a mistake that I made in the previous commit. It is applied as a
prerequisite both so we also have the fix, and because without the
latter patches would have conflicts.

doc/release-notes/rl-2611.section.md

@@ -36,6 +36,12 @@
 
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
+  for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
+  - Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
+    Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
+  - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
@@ -74,4 +80,3 @@
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-

maintainers/github-teams.json

@@ -128,7 +128,6 @@
       "Pandapip1": 45835846,
       "a-kenji": 65275785,
       "drakon64": 6444703,
-      "michaelBelsanti": 62124625,
       "thefossguy": 44400303
     },
     "name": "COSMIC"
@@ -847,6 +846,18 @@
     },
     "name": "Radicle"
   },
+  "redis": {
+    "description": "Maintain Redis, related packages, module, and tests.",
+    "id": 17932473,
+    "maintainers": {
+      "Hythera": 87016780,
+      "MiniHarinn": 52773156,
+      "debtquity": 225436867,
+      "kybe236": 118068228
+    },
+    "members": {},
+    "name": "Redis"
+  },
   "reproducible": {
     "description": "Team that is interested in reproducible builds",
     "id": 7625643,

maintainers/maintainer-list.nix

@@ -3444,12 +3444,6 @@
     githubId = 20448408;
     keys = [ { fingerprint = "D446 E58D 87A0 31C7 EC15  88D7 B461 2924 45C6 E696"; } ];
   };
-  berce = {
-    email = "bert.moens@gmail.com";
-    github = "berce";
-    githubId = 10439709;
-    name = "Bert Moens";
-  };
   bergey = {
     email = "bergey@teallabs.org";
     github = "bergey";
@@ -4445,12 +4439,6 @@
     githubId = 54632731;
     name = "Cameron Dugan";
   };
-  cameronfyfe = {
-    email = "cameron.j.fyfe@gmail.com";
-    github = "cameronfyfe";
-    githubId = 21013281;
-    name = "Cameron Fyfe";
-  };
   cameronnemo = {
     email = "cnemo@tutanota.com";
     github = "CameronNemo";
@@ -13057,6 +13045,13 @@
     name = "João Moreira";
     keys = [ { fingerprint = "F457 0A3A 5F89 22F8 F572  E075 EF8B F2C8 C5F4 097D"; } ];
   };
+  joaosreis = {
+    email = "joaosreis@outlook.pt";
+    github = "joaosreis";
+    githubId = 3420596;
+    name = "João Santos Reis";
+    keys = [ { fingerprint = "9BEB F137 4CAC 96D6 A4ED  EC49 BA2E 05BD B7F8 C0EE"; } ];
+  };
   joaquintrinanes = {
     email = "hi@joaquint.io";
     github = "JoaquinTrinanes";
@@ -18478,13 +18473,6 @@
     github = "mohe2015";
     githubId = 13287984;
   };
-  momeemt = {
-    name = "Mutsuha Asada";
-    email = "me@momee.mt";
-    github = "momeemt";
-    githubId = 43488453;
-    keys = [ { fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6"; } ];
-  };
   monaaraj = {
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
@@ -28968,6 +28956,14 @@
     githubId = 110242808;
     name = "Vasilii Pustovoit";
   };
+  vavakado = {
+    email = "xor@vavakado.xyz";
+    github = "vavakado";
+    githubId = 80159210;
+    name = "Vladimir Rubin";
+    matrix = "@vavakado:imagisphe.re";
+    keys = [ { fingerprint = "A054 0374 CD37 2C71 FE6D  E0CF CAB7 4472 7F36 B524"; } ];
+  };
   vbgl = {
     email = "Vincent.Laporte@gmail.com";
     github = "vbgl";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -30,6 +30,8 @@
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.

nixos/modules/config/fonts/fontconfig.nix

@@ -127,6 +127,38 @@ let
       </fontconfig>
     '';
 
+  # user defined font aliases
+  # priority 53
+  aliases =
+    let
+      mkFontBlock =
+        key: fonts:
+        lib.optionalString ((builtins.length fonts) > 0) ''
+          <${key}>
+          ${lib.concatMapStrings (font: "<family>${font}</family>") fonts}
+          </${key}>
+        '';
+
+      mkAliasBlock = family: opts: ''
+        <alias binding="${opts.binding}">
+          <family>${family}</family>
+          ${mkFontBlock "prefer" opts.prefer}
+          ${mkFontBlock "accept" opts.accept}
+          ${mkFontBlock "default" opts.default}
+        </alias>
+      '';
+    in
+    pkgs.writeText "fc-53-user-aliases.conf" ''
+      <?xml version='1.0'?>
+      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
+      <fontconfig>
+
+        <!-- User defined aliases -->
+        ${lib.concatStrings (lib.mapAttrsToList mkAliasBlock cfg.aliases)}
+
+      </fontconfig>
+    '';
+
   # bitmap font options
   # priority 53
   rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
@@ -245,6 +277,9 @@ let
         # 53-no-bitmaps.conf
         ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf
 
+        # 53-user-aliases.conf
+        ln -s ${aliases} $dst/53-user-aliases.conf
+
         ${lib.optionalString (!cfg.allowType1) ''
           # 53-nixos-reject-type1.conf
           ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf
@@ -522,6 +557,69 @@ in
           description = "Use embedded bitmaps in fonts like Calibri.";
         };
 
+        aliases = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.submodule {
+              options = {
+                binding = lib.mkOption {
+                  type = lib.types.enum [
+                    "same"
+                    "weak"
+                    "strong"
+                  ];
+                  default = "same";
+                  description = ''
+                    Binding precedence for this font family. See
+                    fontconfig "Font Matching" section for details.
+                  '';
+                };
+
+                prefer = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts whose glyphs are chosen preferentially prior
+                    to fonts which match the alias family.
+                  '';
+                };
+
+                accept = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts that are chosen if none of the preferred
+                    fonts, nor the alias family could provide the
+                    desired glyph.
+                  '';
+                };
+
+                default = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Last chance fallback fonts which are chosen by
+                    default if none of the other options could
+                    provide the desired glyph.
+                  '';
+                };
+              };
+            }
+          );
+          default = { };
+          example = lib.literalExpression ''
+            {
+                # use FreeSans for Greek symbols missing in Helvetica
+                "Helvetica" = {
+                    default = [ "FreeSans" ];
+                };
+            };
+          '';
+          description = ''
+            Font aliases that can substitute preferential fonts,
+            or specify custom fallback fonts.
+          '';
+        };
+
       };
 
     };
@@ -557,6 +655,9 @@ in
         # 52-nixos-default-fonts.conf
         r ${defaultFontsConf},
 
+        # 53-user-aliases.conf
+        r ${aliases},
+
         # 53-no-bitmaps.conf
         r ${rejectBitmaps},
 

nixos/modules/config/xdg/autostart.nix

@@ -4,21 +4,33 @@
     teams = [ lib.teams.freedesktop ];
   };
 
-  options = {
-    xdg.autostart.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = ''
-        Whether to install files to support the
-        [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest).
-      '';
-    };
+  options.xdg.autostart = {
+    enable =
+      lib.mkEnableOption "auto-starting of desktop applications according to the [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest)."
+      // lib.mkOption {
+        default = true;
+      };
+    install =
+      lib.mkEnableOption ''
+        install desktop files following the [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest) into `/etc/xdg/autostart/`.
+
+        These are handled by your desktop environment or [`systemd-xdg-autostart-generator`](https://www.freedesktop.org/software/systemd/man/latest/systemd-xdg-autostart-generator.html).
+      ''
+      // lib.mkOption {
+        default = true;
+      };
   };
 
-  config = lib.mkIf config.xdg.autostart.enable {
-    environment.pathsToLink = [
+  config = {
+    # FIXME this does not actually work because "/etc/xdg" is linked
+    # unconditionally in `nixos/modules/config/system-path.nix`
+    environment.pathsToLink = lib.mkIf config.xdg.autostart.install [
       "/etc/xdg/autostart"
     ];
-  };
 
+    # On by default
+    systemd.user.generators.systemd-xdg-autostart-generator = lib.mkIf (!config.xdg.autostart.enable) (
+      lib.mkDefault "/dev/null"
+    );
+  };
 }

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix

@@ -11,6 +11,9 @@ in
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
+  # required for calamares
+  security.polkit.enablePkexecWrapper = true;
+
   # required for kpmcore to work correctly
   programs.partition-manager.enable = true;
 

nixos/modules/installer/tools/tools.nix

@@ -330,7 +330,7 @@ in
           '';
 
           config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
-            security.polkit.enable = lib.mkDefault true;
+            security.run0.enable = lib.mkDefault true;
             environment.systemPackages = [ pkgs.polkit-stdin-agent ];
           };
         }

nixos/modules/module-list.nix

@@ -1961,6 +1961,7 @@
   ./system/boot/systemd/userdbd.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
+  ./system/boot/tzpfms.nix
   ./system/boot/uki.nix
   ./system/boot/unl0kr.nix
   ./system/boot/uvesafb.nix

nixos/modules/programs/gamemode.nix

@@ -60,7 +60,10 @@ in
     };
 
     security = {
-      polkit.enable = true;
+      polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       wrappers = lib.mkIf cfg.enableRenice {
         gamemoded = {
           owner = "root";

nixos/modules/programs/throne.nix

@@ -64,32 +64,36 @@ in
     # 3. Put ThroneCore into a systemd service, and let polkit check service name.
     #    This is the most secure and convenient way but requires heavy modification
     #    to Throne source code. Would be good to let upstream support that eventually.
-    security.polkit.extraConfig =
-      lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
-        ''
-          polkit.addRule(function(action, subject) {
-            const allowedActionIds = [
-              "org.freedesktop.resolve1.revert",
-              "org.freedesktop.resolve1.set-domains",
-              "org.freedesktop.resolve1.set-default-route",
-              "org.freedesktop.resolve1.set-dns-servers"
-            ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+      extraConfig =
+        lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
+          ''
+            polkit.addRule(function(action, subject) {
+              const allowedActionIds = [
+                "org.freedesktop.resolve1.revert",
+                "org.freedesktop.resolve1.set-domains",
+                "org.freedesktop.resolve1.set-default-route",
+                "org.freedesktop.resolve1.set-dns-servers"
+              ];
 
-            if (allowedActionIds.indexOf(action.id) !== -1) {
-              try {
-                var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
-                var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
-                if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
-                  return polkit.Result.YES;
-                } else {
+              if (allowedActionIds.indexOf(action.id) !== -1) {
+                try {
+                  var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
+                  var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
+                  if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
+                    return polkit.Result.YES;
+                  } else {
+                    return polkit.Result.NOT_HANDLED;
+                  }
+                } catch (e) {
                   return polkit.Result.NOT_HANDLED;
                 }
-              } catch (e) {
-                return polkit.Result.NOT_HANDLED;
               }
-            }
-          })
-        '';
+            })
+          '';
+    };
   };
 
   meta.maintainers = with lib.maintainers; [ aleksana ];

nixos/modules/security/polkit.nix

@@ -6,27 +6,52 @@
 }:
 let
 
-  cfg = config.security.polkit;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkIf
+    mkPackageOption
+    mkRemovedOptionModule
+    types
+    ;
 
+  cfg = config.security.polkit;
 in
 
 {
+  imports = [
+    (mkRemovedOptionModule [ "security" "polkit" "debug" ] "Use security.polkit.extraArgs instead")
+  ];
 
-  options = {
+  options.security.polkit = {
+    enable = mkEnableOption "polkit";
 
-    security.polkit.enable = lib.mkEnableOption "polkit";
+    enablePkexecWrapper = mkEnableOption "the setuid pkexec wrapper";
 
-    security.polkit.package = lib.mkPackageOption pkgs "polkit" { };
+    package = mkPackageOption pkgs "polkit" { };
 
-    security.polkit.debug = lib.mkEnableOption "debug logs from polkit. This is required in order to see log messages from rule definitions";
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "--no-debug"
+        "--log-level=notice"
+      ];
+      description = ''
+        List of arguments to pass to the polkitd executable.
 
-    security.polkit.extraConfig = lib.mkOption {
-      type = lib.types.lines;
+        ::: {.note}
+        To see debug logs you need to negate the default `--no-debug` setting.
+        :::
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
       default = "";
       example = ''
         /* Log authorization checks. */
         polkit.addRule(function(action, subject) {
-          // Make sure to set { security.polkit.debug = true; } in configuration.nix
+          // Make sure to negate --no-debug in services.polkit.extraArgs: { security.polkit.extraArgs = [ "--log-level=notice" ]; }
           polkit.log("user " +  subject.user + " is attempting action " + action.id + " from PID " + subject.pid);
         });
 
@@ -41,8 +66,8 @@ in
       '';
     };
 
-    security.polkit.adminIdentities = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
+    adminIdentities = mkOption {
+      type = with types; listOf str;
       default = [ "unix-group:wheel" ];
       example = [
         "unix-user:alice"
@@ -58,25 +83,34 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
 
     environment.systemPackages = [
       cfg.package.bin
       cfg.package.out
     ];
 
+    services.dbus.packages = [ cfg.package.out ];
+
     systemd.packages = [ cfg.package.out ];
 
-    systemd.services.polkit.serviceConfig.ExecStart = [
-      ""
-      "${cfg.package.out}/lib/polkit-1/polkitd ${lib.optionalString (!cfg.debug) "--no-debug"}"
-    ];
-
-    systemd.services.polkit.restartTriggers = [ config.system.path ];
-    systemd.services.polkit.reloadTriggers = [
-      config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
-    ];
-    systemd.services.polkit.stopIfChanged = false;
+    systemd.services.polkit = {
+      restartTriggers = [ config.system.path ];
+      reloadTriggers = [
+        config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
+      ];
+      serviceConfig.ExecStart = [
+        # nuke default ExecStart
+        ""
+        # provide our own instead
+        (toString (
+          [
+            "${lib.getLib cfg.package}/lib/polkit-1/polkitd"
+          ]
+          ++ cfg.extraArgs
+        ))
+      ];
+    };
 
     systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
 
@@ -89,7 +123,7 @@ in
       # The upstream unit uses PrivateDevices=yes and ProtectHome=yes,
       # which prevents PAM modules from accessing hardware (e.g. FIDO
       # tokens via /dev/hidraw*) or reading key files from home directories.
-      (lib.mkIf config.security.pam.u2f.enable {
+      (mkIf config.security.pam.u2f.enable {
         # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
         PrivateDevices = false;
         DeviceAllow = [
@@ -100,7 +134,7 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
-      (lib.mkIf config.security.pam.zfs.enable {
+      (mkIf config.security.pam.zfs.enable {
         PrivateDevices = false;
         DeviceAllow = [
           "/dev/zfs rw"
@@ -120,23 +154,16 @@ in
       ${cfg.extraConfig}
     ''; # TODO: validation on compilation (at least against typos)
 
-    services.dbus.packages = [ cfg.package.out ];
-
     security.pam.services.polkit-1 = { };
 
     security.wrappers.pkexec = {
+      enable = cfg.enablePkexecWrapper;
       setuid = true;
       owner = "root";
       group = "root";
-      source = "${cfg.package.bin}/bin/pkexec";
+      source = lib.getExe' cfg.package "pkexec";
     };
 
-    systemd.tmpfiles.rules = [
-      # Probably no more needed, clean up
-      "R /var/lib/polkit-1"
-      "R /var/lib/PolicyKit"
-    ];
-
     users.users.polkituser = {
       description = "PolKit daemon";
       uid = config.ids.uids.polkituser;

nixos/modules/security/run0.nix

@@ -6,6 +6,13 @@
 }:
 
 let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    ;
+
   cfg = config.security.run0;
 
   sudoAlias = pkgs.writeShellScriptBin "sudo" ''
@@ -18,7 +25,9 @@ let
 in
 {
   options.security.run0 = {
-    wheelNeedsPassword = lib.mkOption {
+    enable = mkEnableOption "support for run0";
+
+    wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
       description = ''
@@ -27,26 +36,45 @@ in
       '';
     };
 
-    enableSudoAlias = lib.mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+    enableSudoAlias = mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
   };
 
-  config = {
-    assertions = [
-      {
-        assertion =
-          cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
-        message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
-      }
-    ];
-
-    security.polkit.extraConfig = lib.mkIf (!cfg.wheelNeedsPassword) ''
-      polkit.addRule(function(action, subject) {
-        if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-          return polkit.Result.YES;
+  config = mkMerge [
+    {
+      # Late introduction of the enable toggle, this should help during migration.
+      # TODO: Remove after 26.11 release
+      assertions = [
+        {
+          assertion = !cfg.wheelNeedsPassword -> cfg.enable;
+          message = "`security.run0.enable` is currently disabled, but is required for the `security.run0.wheelNeedsPassword` option to take effect";
         }
-      });
-    '';
+        {
+          assertion = cfg.enableSudoAlias -> cfg.enable;
+          message = "`security.run0.enableSudoAlias` depends on `security.run0.enable`, which is disabled.";
+        }
+      ];
+    }
+    (mkIf cfg.enable {
+      assertions = [
+        {
+          assertion =
+            cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
+          message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
+        }
+      ];
 
-    environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
-  };
+      security.polkit = {
+        enable = true;
+        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+              return polkit.Result.YES;
+            }
+          });
+        '';
+      };
+
+      environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
+    })
+  ];
 }

nixos/modules/services/audio/music-assistant.nix

@@ -83,7 +83,18 @@ in
         lib.optional cfg.enable 8097 # Music Assistant stream port
         ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
         ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927
-        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780;
+        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780
+        ++ lib.optionals (lib.elem "squeezelite" cfg.providers) [
+          # https://lyrion.org/reference/slimproto-protocol/
+          3483 # Slimproto control
+          # https://lyrion.org/reference/cli/using-the-cli/
+          9000 # Slimproto JSON-RPC
+          9090 # Slimproto CLI
+        ];
+      allowedUDPPorts = lib.optionals (lib.elem "squeezelite" cfg.providers) [
+        # https://lyrion.org/reference/slimproto-protocol/
+        3483 # Slimproto discovery
+      ];
       # The information published by Apple 1 seem to not apply to libraop.
       # The closest we could find that represents the port range being used as observed by tcpdump is the ephemeral port range.
       # 1: https://support.apple.com/en-us/103229#:~:text=49152%E2%80%93-,65535,-TCP%2C%20UDP

nixos/modules/services/desktop-managers/budgie.nix

@@ -243,6 +243,8 @@ in
 
     # Required by Budgie's Polkit Dialog.
     security.polkit.enable = mkDefault true;
+    # Required by Budige's Control Center and Desktop
+    security.polkit.enablePkexecWrapper = mkDefault true;
 
     # Required by Budgie Panel plugins and/or Budgie Control Center panels.
     networking.networkmanager.enable = mkDefault true; # for BCC's Network panel.

nixos/modules/services/desktop-managers/cosmic.nix

@@ -146,7 +146,10 @@ in
     environment.sessionVariables.X11_EXTRA_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.extras.xml";
     programs.dconf.enable = true;
     programs.dconf.packages = [ pkgs.cosmic-session ];
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     security.rtkit.enable = true;
     services.accounts-daemon.enable = true;
     services.displayManager.sessionPackages = [ pkgs.cosmic-session ];

nixos/modules/services/desktop-managers/gnome.nix

@@ -325,7 +325,11 @@ in
       i18n.inputMethod.enable = mkDefault true;
       i18n.inputMethod.type = mkDefault "ibus";
       programs.dconf.enable = true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        # Required by gnome-initial-setup, gnome-system-monitor, gvfs for admin://
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       security.rtkit.enable = mkDefault true;
       services.accounts-daemon.enable = true;
       services.dleyna.enable = mkDefault true;

nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix

@@ -22,6 +22,10 @@
   config = lib.mkIf config.services.gnome.gnome-remote-desktop.enable {
     services.pipewire.enable = true;
     services.dbus.packages = [ pkgs.gnome-remote-desktop ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     environment.systemPackages = [ pkgs.gnome-remote-desktop ];
 

nixos/modules/services/hardware/tuned.nix

@@ -246,7 +246,10 @@ in
       systemPackages = [ cfg.package ];
     };
 
-    security.polkit.enable = lib.mkDefault true;
+    security.polkit = {
+      enable = lib.mkDefault true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     services = {
       dbus.packages = [ cfg.package ];

nixos/modules/services/networking/syncthing.nix

@@ -46,6 +46,19 @@ let
   folders = lib.pipe cfg.settings.folders [
     (lib.filterAttrs (_: folder: folder.enable))
     builtins.attrValues
+    (map (
+      folder:
+      folder
+      // {
+        devices = map (
+          device:
+          if builtins.isString device then
+            { deviceId = cfg.settings.devices.${device}.id; }
+          else
+            { deviceId = cfg.settings.devices.${device.name}.id; } // device
+        ) folder.devices;
+      }
+    ))
   ];
 
   jq = "${pkgs.jq}/bin/jq";

nixos/modules/services/networking/xrdp.nix

@@ -19,7 +19,7 @@ let
     cat > $out/startwm.sh <<EOF
     #!/bin/sh
     . /etc/profile
-    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init"}
+    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init"}
     ${cfg.defaultWindowManager}
     EOF
     chmod +x $out/startwm.sh

nixos/modules/services/scheduling/scx-loader.nix

@@ -75,7 +75,11 @@ in
       }
     ];
 
-    environment.systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+    environment = {
+      systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+      etc."scx_loader.toml".source = configFile;
+    };
+
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
 
@@ -84,10 +88,6 @@ in
     systemd.services.scx_loader = {
       path = cfg.schedsPackages;
       wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        TemporaryFileSystem = [ "/etc" ];
-        BindReadOnlyPaths = [ "${configFile.outPath}:/etc/scx_loader.toml" ];
-      };
     };
   };
 

nixos/modules/services/web-apps/pretalx.nix

@@ -27,6 +27,28 @@ let
         cfg.settings.database.backend == "postgresql"
       ) finalPackage.optional-dependencies.postgres;
   };
+
+  pretalxManageWrapper = pkgs.writeShellApplication {
+    name = "pretalx-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.filesystem.data}
+      set -a
+      ${lib.concatMapStringsSep "\n" (file: ''
+        . ${lib.escapeShellArg file}
+      '') cfg.environmentFiles}
+      set +a
+      export PRETALX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          preserve-environment = true;
+        }
+      } -- ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+    '';
+  };
 in
 
 {
@@ -325,18 +347,7 @@ in
     # https://docs.pretalx.org/administrator/installation/
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretalx-manage" ''
-        cd ${cfg.settings.filesystem.data}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
-        fi
-        set -a
-        ${lib.concatMapStringsSep "\n" (file: ". ${lib.escapeShellArg file}") cfg.environmentFiles}
-        set +a
-        export PRETALX_CONFIG_FILE=${configFile}
-        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
-      '')
+      pretalxManageWrapper
     ];
 
     services.logrotate.settings.pretalx = {

nixos/modules/services/web-apps/pretix.nix

@@ -24,7 +24,6 @@ let
     mkOption
     mkPackageOption
     optionals
-    optionalString
     recursiveUpdate
     types
     ;
@@ -60,6 +59,24 @@ let
   };
 
   withRedis = cfg.settings.redis.location != null;
+
+  pretixManageWrapper = pkgs.writeShellApplication {
+    name = "pretix-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.pretix.datadir}
+      export PRETIX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          supp-group = if withRedis then config.services.redis.servers.pretix.group else null;
+          whitelist-environment = "PRETIX_CONFIG_FILE";
+        }
+      } -- ${getExe' pythonEnv "pretix-manage"} "$@"
+    '';
+  };
 in
 {
   meta = {
@@ -396,15 +413,7 @@ in
     # https://docs.pretix.eu/en/latest/admin/installation/index.html
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretix-manage" ''
-        cd ${cfg.settings.pretix.datadir}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} ${optionalString withRedis "-g redis-pretix"} --preserve-env=PRETIX_CONFIG_FILE'
-        fi
-        export PRETIX_CONFIG_FILE=${configFile}
-        $sudo ${getExe' pythonEnv "pretix-manage"} "$@"
-      '')
+      pretixManageWrapper
     ];
 
     services.logrotate.settings.pretix = {

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -111,7 +111,10 @@ in
       services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       services.hardware.bolt.enable = mkDefault (notExcluded pkgs.bolt);
       hardware.bluetooth.enable = mkDefault true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
       services.dbus.packages = with pkgs; [

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -220,7 +220,10 @@ in
 
     # Enable helpful DBus services.
     services.udisks2.enable = true;
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     services.accounts-daemon.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.gnome.glib-networking.enable = true;

nixos/modules/system/boot/tzpfms.nix

@@ -0,0 +1,247 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+# NOTE: the loading of keys is done in separate tzpfms systemd services
+# defined below rather than inline in the ZFS import scripts.
+
+let
+  cfgZFS = config.boot.zfs;
+  cfg = cfgZFS.tzpfms;
+
+  datasetToPool = x: lib.elemAt (lib.splitString "/" x) 0;
+
+  pools = lib.unique (map datasetToPool cfg.datasets);
+
+  # All ZFS filesystems
+  zfsFilesystems = lib.filter (x: x.fsType == "zfs") config.system.build.fileSystems;
+
+  # Pools that are already imported in initrd (have neededForBoot filesystems)
+  fsToPool = fs: lib.elemAt (lib.splitString "/" fs.device) 0;
+  rootPools = lib.unique (map fsToPool (lib.filter utils.fsNeededForBoot zfsFilesystems));
+
+  # Only include initrd resources if datasets belong to pools that need initrd import.
+  # A pool needs initrd import if it has neededForBoot filesystems.
+  initrdPools = lib.filter (pool: lib.elem pool rootPools) pools;
+  systemPools = lib.filter (pool: !(lib.elem pool rootPools)) pools;
+
+  needsInitrd = initrdPools != [ ];
+
+  datasetsByPool = lib.groupBy datasetToPool cfg.datasets;
+
+  # Goup neededForBoot filesystems by pool → initrd mount units
+  initrdMountsByPool = lib.foldl' (
+    acc: fs:
+    let
+      p = lib.elemAt (lib.splitString "/" fs.device) 0;
+      mount = "${utils.escapeSystemdPath ("/sysroot" + (lib.removeSuffix "/" fs.mountPoint))}.mount";
+    in
+    if utils.fsNeededForBoot fs then acc // { ${p} = (acc.${p} or [ ]) ++ [ mount ]; } else acc
+  ) { } zfsFilesystems;
+
+  # Group all ZFS filesystems by pool → system mount units
+  systemMountsByPool = lib.foldl' (
+    acc: fs:
+    let
+      pool = lib.elemAt (lib.splitString "/" fs.device) 0;
+      mount = "${utils.escapeSystemdPath (lib.removeSuffix "/" fs.mountPoint)}.mount";
+    in
+    acc // { ${pool} = (acc.${pool} or [ ]) ++ [ mount ]; }
+  ) { } zfsFilesystems;
+
+  # Generate tzpfms key-loading bash script
+  mkTzpfmsScript = datasets: /* bash */ ''
+    tzpfms_load_key() {
+      zfs-tpm-list -H ${backendArgs} "$@" 2>/dev/null | while IFS=$'\t' read -r name backend status _; do
+        case "$backend" in
+          ${lib.optionalString (lib.elem "TPM2" cfg.backends) /* bash */ ''
+            TPM2)
+              zfs-tpm2-load-key "$name" || true
+              ;;
+          ''}
+          ${lib.optionalString (lib.elem "TPM1.X" cfg.backends) /* bash */ ''
+            TPM1.X)
+              zfs-tpm1x-load-key "$name" || true
+              ;;
+          ''}
+          *)
+            echo "[WARN] boot.zfs.tzpfms: Unsupported tzpfms backend: “$backend”; “$name” not unlocked" >&2
+            ;;
+        esac
+      done
+    }
+
+    ${lib.concatMapStringsSep "\n" (ds: "tzpfms_load_key -u ${lib.escapeShellArg ds}") datasets}
+  '';
+
+  mkTzpfmsService =
+    {
+      pool,
+      mountUnits,
+      script,
+    }:
+    {
+      description = "Load TPM keys for ZFS pool “${pool}”";
+      after = [ "zfs-import-${pool}.service" ];
+      before = mountUnits ++ [ "zfs-import.target" ];
+      requiredBy = mountUnits ++ [ "zfs-import.target" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      inherit script;
+    };
+
+  backendArgs = lib.escapeShellArgs (
+    lib.concatMap (b: [
+      "-b"
+      b
+    ]) cfg.backends
+  );
+in
+{
+  meta.maintainers = with lib.maintainers; [ toastal ];
+
+  options = {
+    boot.zfs.tzpfms = {
+      enable = lib.mkEnableOption ''
+        TPM-backed ZFS encryption using tzpfms.
+        Supports both TPM 2.0 & TPM 1.x.
+      '';
+
+      package = lib.mkPackageOption pkgs "tzpfms" { };
+
+      backends = lib.mkOption {
+        type =
+          with lib.types;
+          nonEmptyListOf (enum [
+            "TPM2"
+            "TPM1.X"
+          ]);
+        default = [
+          "TPM2"
+        ];
+        description = ''
+          TPM backends to include in for tzpfms.
+        '';
+      };
+
+      datasets = lib.mkOption {
+        # Needs to be explicit so we can build thy systemd services
+        type = with lib.types; nonEmptyListOf str;
+        example = [
+          "tank/root"
+          "tank/var"
+        ];
+        description = ''
+          Explicit list of ZFS datasets to unlock with TPM at boot.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          config.boot.supportedFilesystems.zfs or config.boot.initrd.supportedFilesystems.zfs or false;
+        message = "ZFS filesystem support needs to be enabled for boot.tzpfms to work";
+      }
+      {
+        assertion = initrdPools != { } -> config.boot.initrd.systemd.enable;
+        message = "boot.zfs.tzpfms requires boot.initrd.systemd.enable = true";
+      }
+      {
+        assertion =
+          !(cfgZFS.requestEncryptionCredentials == true) || cfgZFS.requestEncryptionCredentials == [ ];
+        message = ''
+          boot.zfs.requestEncryptionCredentials = true would prompt for all
+          encrypted dataset passphrases at boot, which conflicts with automatic
+          TPM unlock via tzpfms. Either set it to false, or explicitly list the
+          datasets that still need passphrase prompting.
+        '';
+      }
+      (
+        let
+          intersected = lib.intersectLists cfg.datasets (
+            if lib.isList cfgZFS.requestEncryptionCredentials then cfgZFS.requestEncryptionCredentials else [ ]
+          );
+        in
+        {
+          assertion = builtins.length intersected == 0;
+          message = ''
+            The following datasets are listed in both boot.zfs.tzpfms.datasets
+            & boot.zfs.requestEncryptionCredentials, which would cause a
+            passphrase prompt to block boot before tzpfms can unlock them via
+            TPM:
+
+            ${lib.concatMapStringsSep "\n" (d: "• ${d}") intersected}
+
+            Remove them from boot.zfs.requestEncryptionCredentials to allow
+            automatic TPM unlock.
+          '';
+        }
+      )
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    # Automatically register pools from tzpfms datasets as extraPools
+    boot.zfs.extraPools = pools;
+
+    boot.initrd = lib.mkMerge [
+      (lib.mkIf cfg.enable {
+        availableKernelModules = [
+          "tpm_tis"
+          "tpm_crb"
+        ];
+      })
+      (lib.mkIf needsInitrd (
+        lib.mkMerge [
+          (lib.mkIf config.boot.initrd.systemd.enable {
+            systemd.extraBin = {
+              zfs-tpm-list = "${lib.getBin cfg.package}/bin/zfs-tpm-list";
+            }
+            // lib.optionalAttrs (lib.elem "TPM2" cfg.backends) {
+              zfs-tpm2-load-key = "${lib.getBin cfg.package}/bin/zfs-tpm2-load-key";
+            }
+            // lib.optionalAttrs (lib.elem "TPM1.X" cfg.backends) {
+              zfs-tpm1x-load-key = "${lib.getBin cfg.package}/bin/zfs-tpm1x-load-key";
+            };
+            systemd.storePaths =
+              lib.optional (lib.elem "TPM2" cfg.backends) pkgs.tpm2-tss
+              ++ lib.optional (lib.elem "TPM1.X" cfg.backends) pkgs.trousers;
+            systemd.services = lib.genAttrs' initrdPools (pool: {
+              name = "tzpfms-load-${pool}";
+              value = mkTzpfmsService {
+                inherit pool;
+                mountUnits = initrdMountsByPool.${pool} or [ ];
+                script = mkTzpfmsScript (datasetsByPool.${pool} or [ ]);
+              };
+            });
+          })
+        ]
+      ))
+    ];
+
+    systemd.services = lib.genAttrs' systemPools (
+      pool:
+      let
+        mnts = systemMountsByPool.${pool} or [ ];
+      in
+      {
+        name = "tzpfms-load-${pool}";
+        value = mkTzpfmsService {
+          inherit pool;
+          mountUnits = mnts;
+          script = mkTzpfmsScript (datasetsByPool.${pool} or [ ]);
+        };
+      }
+    );
+  };
+}

nixos/release.nix

@@ -111,7 +111,7 @@ let
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       }).config.system.build.isoImage
@@ -123,7 +123,7 @@ let
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       }).config.system.build.sdImage
@@ -141,7 +141,7 @@ let
     let
 
       config =
-        (import lib/eval-config.nix {
+        (import ./lib/eval-config.nix {
           inherit system;
           modules = makeModules module { };
         }).config;
@@ -183,7 +183,7 @@ let
   makeNetboot =
     { module, system, ... }:
     let
-      configEvaled = import lib/eval-config.nix {
+      configEvaled = import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       };
@@ -209,7 +209,7 @@ let
 in
 rec {
 
-  channel = import lib/make-channel.nix {
+  channel = import ./lib/make-channel.nix {
     inherit
       pkgs
       nixpkgs
@@ -232,7 +232,7 @@ rec {
 
   kexec = forMatchingSystems supportedSystems (
     system:
-    (import lib/eval-config.nix {
+    (import ./lib/eval-config.nix {
       inherit system;
       modules = [
         ./modules/installer/netboot/netboot-minimal.nix
@@ -312,7 +312,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-image.nix
@@ -331,7 +331,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-image.nix
@@ -346,7 +346,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-lxc.nix
@@ -362,7 +362,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           configuration
@@ -379,7 +379,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           configuration
@@ -403,7 +403,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -427,7 +427,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -451,7 +451,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -475,7 +475,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -491,7 +491,7 @@ rec {
     system:
     pkgs.runCommand "dummy" {
       toplevel =
-        (import lib/eval-config.nix {
+        (import ./lib/eval-config.nix {
           inherit system;
           modules = singleton (
             { ... }:
@@ -539,14 +539,14 @@ rec {
       { ... }:
       {
         boot.isContainer = true;
-        imports = [ modules/profiles/minimal.nix ];
+        imports = [ ./modules/profiles/minimal.nix ];
       }
     );
 
     ec2 = makeClosure (
       { ... }:
       {
-        imports = [ modules/virtualisation/amazon-image.nix ];
+        imports = [ ./modules/virtualisation/amazon-image.nix ];
       }
     );
 

nixos/tests/all-tests.nix

@@ -1700,6 +1700,7 @@ in
   tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
+  timekpr = runTest ./timekpr.nix;
   timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };
@@ -1739,6 +1740,7 @@ in
   twingate = runTest ./twingate.nix;
   txredisapi = runTest ./txredisapi.nix;
   typesense = runTest ./typesense.nix;
+  tzpfms = runTest ./tzpfms.nix;
   tzupdate = runTest ./tzupdate.nix;
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;

nixos/tests/kea.nix

@@ -6,7 +6,6 @@
 # address.
 
 {
-  pkgs,
   lib,
   ...
 }:
@@ -15,7 +14,7 @@
 
   name = "kea";
 
-  nodes = {
+  containers = {
     router =
       { config, pkgs, ... }:
       {
@@ -26,6 +25,7 @@
           firewall.allowedUDPPorts = [ 67 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -141,6 +141,7 @@
           firewall.allowedUDPPorts = [ 53 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -153,8 +154,6 @@
           };
         };
 
-        services.resolved.enable = false;
-
         # Set up an authoritative nameserver, serving the `lan.nixos.test`
         # zone and configure an ACL that allows dynamic updates from
         # the router's ip address.
@@ -213,6 +212,7 @@
       {
         virtualisation.vlans = [ 1 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;
@@ -222,16 +222,23 @@
       };
   };
   testScript =
-    { ... }:
+    # python
     ''
       start_all()
+
       router.wait_for_unit("kea-dhcp4-server.service")
-      client.systemctl("start systemd-networkd-wait-online.service")
-      client.wait_for_unit("systemd-networkd-wait-online.service")
-      client.wait_until_succeeds("ping -c 5 10.0.0.1")
-      router.wait_until_succeeds("ping -c 5 10.0.0.3")
-      nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
-      router.log(router.execute("curl 127.0.0.1:9547")[1])
-      router.succeed("curl --no-buffer 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
+
+      with subtest("DHCPv4"):
+          client.systemctl("start systemd-networkd-wait-online.service")
+          client.wait_for_unit("systemd-networkd-wait-online.service")
+          client.wait_until_succeeds("ping -c 5 10.0.0.1")
+          router.wait_until_succeeds("ping -c 5 10.0.0.3")
+
+      with subtest("DDNS"):
+          nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
+
+      with subtest("Prometheus Exporter"):
+          router.log(router.execute("curl 127.0.0.1:9547")[1])
+          router.succeed("curl --silent 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
     '';
 }

nixos/tests/lomiri.nix

@@ -669,7 +669,7 @@ in
 
               # Doing this here, since we need an in-session shell & separately starting a terminal again wastes time
               with subtest("polkit agent works"):
-                  machine.send_chars("pkexec touch /tmp/polkit-test\n")
+                  machine.send_chars("run0 touch /tmp/polkit-test\n")
                   # There's an authentication notification here that gains focus, but we struggle with OCRing it
                   # Just hope that it's up after a short wait
                   machine.sleep(10)

nixos/tests/rtkit.nix

@@ -55,7 +55,7 @@
 
       # Provide a little logging of polkit checks - otherwise it's
       # impossible to know what's going on.
-      security.polkit.debug = true;
+      security.polkit.extraArgs = [ "--log-level=notice" ];
       security.polkit.extraConfig = ''
         polkit.addRule(function(action, subject) {
           const ns = "org.freedesktop.RealtimeKit1.";

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

@@ -17,7 +17,7 @@ import ./make-test-python.nix (
         hexa
       ];
     };
-    nodes = {
+    containers = {
 
       # The ISP's routers job is to delegate IPv6 prefixes via DHCPv6. Like with
       # regular IPv6 auto-configuration it will also emit IPv6 router
@@ -38,6 +38,7 @@ import ./make-test-python.nix (
             interfaces.eth1 = lib.mkForce { }; # Don't use scripted networking
           };
 
+          services.resolved.enable = false;
           systemd.network = {
             enable = true;
 
@@ -204,6 +205,7 @@ import ./make-test-python.nix (
           interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           networks = {
             # systemd-networkd will load the first network unit file
@@ -300,6 +302,7 @@ import ./make-test-python.nix (
       client = {
         virtualisation.vlans = [ 2 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;

nixos/tests/timekpr.nix

@@ -1,13 +1,15 @@
-{ pkgs, lib, ... }:
+{
+  lib,
+  ...
+}:
+
 {
   name = "timekpr";
   meta.maintainers = [ lib.maintainers.atry ];
 
-  nodes.machine =
-    { pkgs, lib, ... }:
-    {
-      services.timekpr.enable = true;
-    };
+  containers.machine = {
+    services.timekpr.enable = true;
+  };
 
   testScript = ''
     start_all()

nixos/tests/tzpfms.nix

@@ -0,0 +1,135 @@
+{ lib, ... }:
+
+{
+  name = "tzpfms";
+
+  meta = {
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.jq
+        pkgs.parted
+        pkgs.tzpfms
+      ];
+
+      boot = {
+        initrd.systemd.enable = true;
+        loader = {
+          systemd-boot.enable = true;
+          timeout = 0;
+          efi.canTouchEfiVariables = true;
+        };
+        supportedFilesystems = [ "zfs" ];
+        zfs = {
+          devNodes = "/dev";
+          forceImportRoot = lib.mkDefault false;
+          requestEncryptionCredentials = false;
+        };
+      };
+
+      networking.hostId = "deadbeef";
+
+      virtualisation = {
+        emptyDiskImages = [ 1024 ];
+        mountHostNixStore = true;
+        useBootLoader = true;
+        useEFIBoot = true;
+        tpm.enable = true;
+      };
+
+      specialisation.tzpfms-unlock.configuration = {
+        boot = {
+          kernelParams = [
+            "rd.debug"
+            "rd.log=all"
+          ];
+          zfs = {
+            devNodes = "/dev";
+            requestEncryptionCredentials = false;
+            tzpfms = {
+              enable = true;
+              datasets = [
+                "tpmpool/boot"
+                "tpmpool/data"
+              ];
+            };
+          };
+        };
+
+        virtualisation.fileSystems = {
+          "/bootz" = {
+            device = "tpmpool/boot";
+            fsType = "zfs";
+            options = [ "zfsutil" ];
+            neededForBoot = true;
+          };
+          "/dataz" = {
+            device = "tpmpool/data";
+            fsType = "zfs";
+            options = [ "zfsutil" ];
+            neededForBoot = false;
+          };
+        };
+      };
+    };
+
+  testScript = /* python */ ''
+    datasets = ["boot", "data"]
+
+    machine.start(allow_reboot=True)
+
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("test -e /dev/tpm0")
+    machine.succeed("test -e /dev/tpmrm0")
+
+    machine.succeed("parted --script /dev/vdb mklabel gpt")
+    machine.succeed("parted --script /dev/vdb -- mkpart primary 1M 100%")
+
+    with subtest("Create encrypted ZFS datasets"):
+        machine.succeed("zpool create -O mountpoint=none tpmpool /dev/vdb1")
+        for ds in datasets:
+          machine.succeed("echo aoeuhtns | zfs create -o encryption=aes-128-gcm -o keyformat=passphrase -o mountpoint=/" + ds + "z tpmpool/" + ds)
+
+    with subtest("Wrap keys to TPM with backup"):
+        for ds in datasets:
+          machine.succeed("printf '\\n\\n' | zfs-tpm2-change-key -b /tmp/tzpfms-backup-" + ds + ".key tpmpool/" + ds)
+          machine.succeed("test -f /tmp/tzpfms-backup-" + ds + ".key")
+        list = machine.succeed("zfs-tpm-list -H")
+        for ds in datasets:
+          assert "tpmpool/" + ds in list
+
+    with subtest("Verify backup keys work"):
+        for ds in datasets:
+          machine.succeed("zfs unmount tpmpool/" + ds + " || true")
+          machine.succeed("zfs unload-key tpmpool/" + ds)
+          machine.succeed("zfs load-key tpmpool/" + ds + " </tmp/tzpfms-backup-" + ds + ".key")
+          assert "available" in machine.succeed("zfs get -Ho value keystatus tpmpool/" + ds)
+
+    with subtest("Verify loading key"):
+        # Assertion that the key is loadable, as suggested in the manpage
+        for ds in datasets:
+          assert "OK" in machine.succeed("zfs-tpm2-load-key -n tpmpool/" + ds)
+
+    with subtest("Switch to tzpfms configuration & reboot"):
+        machine.succeed("zpool export tpmpool || true")
+        # Set the specialization as the default boot entry
+        entry_id = machine.succeed("bootctl list --json=short | jq -r '.[] | select(.title | test(\"tzpfms-unlock\")) | .id'")
+        assert id != "", "Missing boot entry"
+        machine.succeed("bootctl set-default " + entry_id)
+        machine.succeed("sync")
+        machine.reboot()
+
+    with subtest("Verify automatic TPM unlock at boot"):
+        machine.wait_for_unit("multi-user.target")
+
+        for ds in datasets:
+          status = machine.succeed("zfs get -Ho value keystatus tpmpool/" + ds).strip()
+          print("tpmpool/" + ds + ": " + status)
+          assert status == "available", ds + " key must be auto-loaded"
+  '';
+}

nixos/tests/web-apps/pretalx.nix

@@ -4,37 +4,38 @@
   name = "pretalx";
   meta.maintainers = pkgs.pretalx.meta.maintainers;
 
-  nodes = {
-    pretalx =
-      { config, ... }:
-      {
-        networking.extraHosts = ''
-          127.0.0.1 talks.local
-        '';
+  containers.pretalx =
+    { config, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
 
-        services.pretalx = {
-          enable = true;
-          plugins = with config.services.pretalx.package.plugins; [
-            pages
-          ];
-          nginx.domain = "talks.local";
-          settings = {
-            site.url = "http://talks.local";
-          };
+      services.pretalx = {
+        enable = true;
+        plugins = with config.services.pretalx.package.plugins; [
+          pages
+        ];
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
         };
       };
-  };
+    };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretalx.wait_for_unit("pretalx-web.service")
-    pretalx.wait_for_unit("pretalx-worker.service")
+      pretalx.wait_for_unit("pretalx-web.service")
+      pretalx.wait_for_unit("pretalx-worker.service")
 
-    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+      pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
 
-    pretalx.succeed("pretalx-manage --help")
+      pretalx.log(pretalx.succeed("id"))
+      pretalx.succeed("pretalx-manage --help | grep -q 'createsuperuser'")
 
-    pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
-  '';
+      pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
+    '';
 }

nixos/tests/web-apps/pretix.nix

@@ -1,50 +1,47 @@
 {
-  lib,
   pkgs,
   ...
 }:
 
 {
   name = "pretix";
-  meta.maintainers = with lib.maintainers; [ hexa ];
+  meta.maintainers = pkgs.pretix.meta.maintainers;
 
-  nodes = {
-    pretix = {
-      virtualisation.memorySize = 2048;
+  containers.pretix = {
+    networking.extraHosts = ''
+      127.0.0.1 tickets.local
+    '';
 
-      networking.extraHosts = ''
-        127.0.0.1 tickets.local
-      '';
-
-      services.pretix = {
-        enable = true;
-        nginx.domain = "tickets.local";
-        plugins = with pkgs.pretix.plugins; [
-          passbook
-          pages
-          zugferd
-        ];
-        settings = {
-          pretix = {
-            instance_name = "NixOS Test";
-            url = "http://tickets.local";
-          };
-          mail.from = "hello@tickets.local";
+    services.pretix = {
+      enable = true;
+      nginx.domain = "tickets.local";
+      plugins = with pkgs.pretix.plugins; [
+        passbook
+        pages
+        zugferd
+      ];
+      settings = {
+        pretix = {
+          instance_name = "NixOS Test";
+          url = "http://tickets.local";
         };
+        mail.from = "hello@tickets.local";
       };
     };
   };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretix.wait_for_unit("pretix-web.service")
-    pretix.wait_for_unit("pretix-worker.service")
+      pretix.wait_for_unit("pretix-web.service")
+      pretix.wait_for_unit("pretix-worker.service")
 
-    pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
+      pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
 
-    pretix.succeed("pretix-manage --help")
+      pretix.succeed("pretix-manage --help | grep -q 'createsuperuser'")
 
-    pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
-  '';
+      pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
+    '';
 }

pkgs/applications/audio/deadbeef/plugins/statusnotifier.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deadbeef-statusnotifier-plugin";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "vovochka404";
     repo = "deadbeef-statusnotifier-plugin";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6WEbY59vPNrL3W5GUwFQJimmSS+td8Ob+G46fPAxfV4=";
+    sha256 = "sha256-pDiQn+iHSTNWTO01j/fbEq3P374TMmnUiC5/Jn2hwBI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix

@@ -5097,6 +5097,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1.0.20260530.4";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/devel/keymap-popup-0.3.1.0.20260530.4.tar";
+        sha256 = "1k6aqp65x3azbipj2pwdg15pip045cawx4im04s84kbk91fx0fxs";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/devel/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -5015,6 +5015,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/keymap-popup-0.3.1.tar";
+        sha256 = "0m44s8618n7g5pajxiv4k1dfx6l58gr01a3ga26fxc51j1d05q8b";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/nongnu-common-overrides.nix

@@ -20,5 +20,22 @@ in
       yasnippet
     ]
   );
+
+  # requires optional dependency for OMEMO support.
+  jabber = super.jabber.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ pkgs.mbedtls ];
+    nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ];
+
+    # We need to run this in postInstall for package directory to become available
+    postInstall =
+      (old.postInstall or "")
+      + "\n"
+      + ''
+        pushd $out/share/emacs/site-lisp/elpa/jabber-*/src
+        make CC=$CC
+        rm -r $out/share/emacs/site-lisp/elpa/jabber-*/src
+        popd
+      '';
+  });
   # keep-sorted end
 }

pkgs/applications/editors/emacs/elisp-packages/nongnu-devel-generated.nix

@@ -3225,17 +3225,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5.0.20260423.192938";
+      version = "0.11.0.0.20260614.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.10.5.0.20260423.192938.tar";
-        sha256 = "1q79iv4znishj6rdz1m76r0c8h72i2g47xfh6xfw2gqxbkkyilv3";
+        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.11.0.0.20260614.0.tar";
+        sha256 = "19h0w85m6vzwwpsgg6ifcyx2j082cgj6dpd7s5yd7pr438jazkn3";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu-devel/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -3240,17 +3240,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5";
+      version = "0.11.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/jabber-0.10.5.tar";
-        sha256 = "1vjmajcls0l6mwccqdp7gr4g4r1z6f2qaf2palnimjb7w3gzh4mk";
+        url = "https://elpa.nongnu.org/nongnu/jabber-0.11.0.tar";
+        sha256 = "1wikfd8iqj9r1qrh6cd593vgbkjndfpm9f12ilsdwxwh0nx3cpd7";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -67,10 +67,10 @@ vimUtils.buildVimPlugin {
     in
     ''
       mkdir -p $out/build
-      ln -s ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
+      cp ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
+      cp ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
+      cp ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
+      cp ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
 
       # Fixes PKCE auth flows not finding libcrypto
       substituteInPlace "$out/lua/avante/auth/pkce.lua" \

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "2.2.0";
-    hash = "sha256-HwgInQOaSKHSs8CU+Ng4jYA6aaP/g3l4CSb/0ewkmc4=";
+    version = "2.3.0";
+    hash = "sha256-2EEhGU+I61yiVvPEIJlQUgTej9Oi7jW3n5znN2Y2vP4=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-containers/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-containers";
-    version = "2.4.2";
-    hash = "sha256-qkQAv53y+PVKJdReffjHwoJbvj20o4DF/c6omLIWB80=";
+    version = "2.4.5";
+    hash = "sha256-Js+403StdF3WmlHOiB78UKM77njReuKOiQ9NHnFljs8=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "pylint";
-    version = "2026.4.0";
-    hash = "sha256-yWp7poC1PCoou+1XADmW0ftzyQDtJbqb3YyMf24Jprc=";
+    version = "2026.6.0";
+    hash = "sha256-lJl+nQyLjnkuMfewYXcrU+Nne7R2foUPn50TtE9OqDA=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.pylint/changelog";

pkgs/applications/editors/vscode/extensions/pkief.material-icon-theme/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "material-icon-theme";
     publisher = "PKief";
-    version = "5.33.1";
-    hash = "sha256-GWHWEdi2kPkxS0RGAxFcy+njFCl1iiEBu41V/5sHqvc=";
+    version = "5.35.0";
+    hash = "sha256-u4c5KTSsdsR92Nm0a+eK17pnOpfHxXkgsr8RExcX6NE=";
   };
   meta = {
     description = "Material Design Icons for Visual Studio Code";

pkgs/applications/editors/vscode/vscode.nix

@@ -35,17 +35,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-L975R3F779LgaFTL4B6ZtImPd1LyXhImnDgCPmO5PI8=";
-      x86_64-darwin = "sha256-Sygw/VkIiyV+iABylgFpTiHs0f5dS6NYPWSm5BNh9tQ=";
-      aarch64-linux = "sha256-jcFC668WKAjlYju33RI6poAKnhm3fL1hO16alUwjwv4=";
-      aarch64-darwin = "sha256-AY6WeDzGEH5zXRosN1H/osxC3e5j0Hs9s2Ys2xe1UxI=";
-      armv7l-linux = "sha256-LqofnnZid/I0lVTyhC7yHD+Fxz4dSBxKJ8n+lp2uucQ=";
+      x86_64-linux = "sha256-L0o9+vxfAkmtOHJvmf0G8WIbp3bXjAuuIAtTtFvbwjQ=";
+      x86_64-darwin = "sha256-WYcRDrFLEjwyQhVdNASz3JUQlLuubDuPjBXa/ROs3h8=";
+      aarch64-linux = "sha256-3CBrenqZs35gMWmVtI//4w0JGSKP8cbu3cJH14P4aEU=";
+      aarch64-darwin = "sha256-0JVfgcYxgdaeWfeGFrfG3qxpWHilQte/dLiW33yxm8o=";
+      armv7l-linux = "sha256-O8nDg1aJ0IbjbRS5kiNoFHzciyHErKK8PP+uujzJOxk=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.123.0";
+  version = "1.124.2";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -53,7 +53,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "6a44c352bd24569c417e530095901b649960f9f8";
+  rev = "6928394f91b684055b873eecb8bc281365131f1c";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -86,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-i034bIsaPlxlVFNY5cKf/ftWPy17SFokbFUMa+zeLng=";
+      hash = "sha256-S4RcYGjK9vEtPp+vTNFV4SN+7osYzfuCiXmQC39PYhI=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ee042b73f8fe2aa9c8c73408b5bf200a3ce1a67b";
-    hash = "sha256-k1DvQHGQH/d6W7jTIAW9jIk0qVHUji3PeYAa8MuUP9w=";
+    rev = "d460f8342060526678e7fd8222048324c2a80d86";
+    hash = "sha256-QzlVlXfJmSwd+gp+fROMKrTj8AxCisYJN5WTff6eHLA=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-06-05";
+  version = "0-unstable-2026-06-12";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "751295151eed3cae619b14bcee49bb07f4fdb59c";
-    hash = "sha256-PwmJspKYWS7WUAK7XRr2FYiAMnc03xp8qH23EZUC6Hs=";
+    rev = "c0f2cf4319d6c77d577599906ca0a90627a3afc8";
+    hash = "sha256-ie0mP7IcvWsFX/k0UhJ6eMkdyDq69W8aCcjwkAoL5II=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/gimp/default.nix

@@ -338,8 +338,6 @@ stdenv.mkDerivation (finalAttrs: {
     gtk = gtk3;
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "GNU Image Manipulation Program";
     homepage = "https://www.gimp.org/";

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.11.0esr";
+  version = "140.12.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "d06adb3ef4de1324e3d61872d70de31ab08ac013f33903549bed28c6ebcc5b4dee94bb36388282c1935d77d1a564079f3adbf08d6bb80284a899cbb3d861300c";
+    sha512 = "3d598dd964bca074d11b71f84d586811b0a736bdd4d1e6cedb9286c56b1e11584e85ca1d0369c9b2f8d9e4d0eaf014d1b9232a96e71ac25f71fa9ed0807f642d";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "151.0.4";
+  version = "152.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "7df6099411843764321e1480b058530193bf134f590b97aadf053603c356c34599f42d6b83d739c2d6440a78cd81dd0b19fd2ddc2a59746d6bbe7e39f00b7e04";
+    sha512 = "2c7adf367004063ee9f3385e692f612d8e5c0c10662bf294996c118001e43dec12ca8cb4fd70e67a25a903dbf5adf83d22e487f04bf3f930da2a815c80378ceb";
   };
 
   meta = {

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cni-plugins";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    hash = "sha256-0ZonR8pV20bBbC2AkNCJhoseDVxNwwMa7coD/ON6clA=";
+    hash = "sha256-3OhUvIJPU5Ayc4/po9Rj4Tfa5536aN8bj+51M6Xg5os=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "1.1.0";
+  version = "1.1.1";
 in
 buildGoModule {
   pname = "helm-unittest";
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "helm-unittest";
     repo = "helm-unittest";
     tag = "v${version}";
-    hash = "sha256-tSagZzAEaJRNZwflrqoyuIMWmt3oCsyHPHwctNTrtVM=";
+    hash = "sha256-oiTW8F0yo+kN943MI2mR5uEEYbMVxJx4RdEislJ3XSo=";
   };
 
-  vendorHash = "sha256-LZOvss6wiZZi5USuXfivqtt69dTKzEmm7lM2LUDACfY=";
+  vendorHash = "sha256-4ckjM520MGYb64LbjYURe7AIScm4aGbj81rGKSSYaAo=";
 
   # NOTE: Remove the install and upgrade hooks.
   postPatch = ''

pkgs/applications/networking/cluster/rke2/1_33/images-versions.json

@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "dd6d234775759b8abdd3a87a1a748f92db648f096cc9381eb27afd8ae8186f20"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "f2341239b5fd73f2b07b074d88c7b34334a808684462f4a6e70fa27591e479a7"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "1c10516660617d6db897bec16e362b4c4e4a0c1f43f08bb9a87663e051d8b806"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "8b91f83ee480ae60cc85601e150a2bf412531763ab8e2eaab0b0e4cefa1a83a5"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "02a2df53bea7805ee124e17db2263d17588a74d091c9656dd07052bcaf7fc159"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "4fdf2f4bc634c60e6503c7ddd52042baa2d65570a8a0a41eb883bd34920e6766"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "7b8e832bfde832d24335786c43a8c0aeede3c04e2aee4c8349822383f2fa390e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "dacd942276d2ffe8487bee4f7ff8df1522b935eed4eef2cae89f260580eb3305"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "16275efc94e4a399f0edbbf5ebfe46d8c5c7784d5a4ea300c7313ebbb24190d8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "a3e0c2e05174839fe3e66639afa40bb96466a09e60fb73ec15685d1628f96191"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-canal.linux-amd64.tar.zst",
     "sha256": "3a7828ce0143c3eb91cae940cebdfa0145960e91be056e88a8b077ee39ccc54d"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "14fb90f2931bea3f030e7ba6c682013911260177bce91eadb2b45f23936465a5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "d86eb346ca1db9ab0efaaf5b4c3418cc096ffd476d2c57f9d4a98a3bab06ef32"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "ede6d29451a99d7f4663b6a2b8eb0cfa093f83b7b025fd5c4899fb02edac703d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "63b0888d1adebb72a77c2d1f1eb1ced1519cfdeb57681026a94c1f53f87f5610"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "59f494c03d9aa0f96d99d28e505fae57dd2c30907ea055b888705555ae289d3c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "fd6f6e0051f68efd21425364f17156d58f605063f562069fddf398e208a08032"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "21ebfe2078b4ef92b2ac3dfe664fd48556cf2b79f9058dd3cd6ed5ed10fcbe1b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "3623e1e59fd4d4a47c4b5e4143d7a8ef31707efbca7d7bf9c299d700c0e1d291"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "766acd7cbff87a3eab89cc0dc433df34c5d44bfc5304872adfffa432f968450c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "70b362df86f882e64c4d7a8a01901a528bb22e12a28a6996d754bd04b9f396e5"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "6bd03722d01aa1d281da47318ddca6e1dafbac7acf23f7dc864c7799b4616479"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "030d22fd0cb52d90321b37e2d1cd9448b571ba5eeb6b1d68daba40ecff515214"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "4b61e3e97e6770b9a2625a21925282e1774bc9114f0a9df5392cd1199b4df744"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "4513f277d0380330eba4d31dc8096142c2a654a34f01f1c90ab167b78dc58181"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "c9a0fe7e3a747fb01d19b0a846df97d4d53a31f563e5308d86401d6b000b031b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "a82003606da83f683a7025de7481ef9939d1b10a9f9b222ca5e80f34885a87dc"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "899f8e8b8ece3d85384de407fd3f8d375daa9b6f0c1bbd54108426e22fa4a623"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "121690236b9c7f0dd094d4070e80cf9b624888e2418b10c66ebbf894d63c2788"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "be6bc62be91cef6ebb9f995fb4a3e7ca68ab485eec7eb304d129c9d44d543e0c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "26edec0d747a5578f7e638a36f54e8f301a06bcc87814d3b2274db571900f44f"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "56c322cf540988649257018f8be4cac80ff1fafb206c3efeb7cfc190d76eff6f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "cb33139d9e7569f9b6ad5822f481c83f259a6cd13639f3980e2ad8c2dabb8284"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "832aae87b5eba45be64b47a5ebc04824060095dbc79d58adb009dbc0b738252a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "23695fd8c2a77f043a089c44437d12b5bde88422dbcd1d70edcda7a78f651137"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "ffc90536663d1edd4cd101e492d84dcd79dd1af1b3b16643786ab8a5d2fcccb7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "a4d428464b3e3e11aafa8fab70a7f183d57d152049f02bd295a6bb4e925a4dbf"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "39b36764f09857c01eaa9520da3e2d5023d7df881bc72379e4c55d05ebde8f6f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "8aa8e19b739bc3fd897115f92d54acd081453441ee4dae8ca694ec47662838a7"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "93e0f6a8e5024f054cdce242aea4fdb833e476d7b2531b454f5f3267f724594e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "97cd2eb0920d433ef57c1a8c8f4a6680faba9a0589c9605c30a56e2c09110c77"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "2b72f3bf1485a986d4a325cd15cb12163f4acabcdd4fcf77400a4c226a26c097"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "f16ef32d0b9586fb7e600013e56dd9098149dc5ce5239f4828ad03dc7463553f"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "4e675fca42ba1862810e021570f58462046e11fb92552d699e20d314be4dd54f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "86fe56d8a277208c26c13a9b04b18b4eb4f2b6debcc7ad754af873e4c64d66c5"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "c642cadb4f1ccf8439e3c47b10933cae6db0d29c2d9bb9b45267ca69191b0c3f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "dc8e9aa0dd1ce2a62b58b7ebfc673911364bd2c3228781f4a226e4796d0436be"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "080cbffc7710eb25167e65619101b9cbfbd80d6510da2c857a7fe2d70140358d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "287437a99ff5c42516764d625571c10d2fbb44ef82cdb026d37b141e56305664"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-multus.linux-amd64.tar.zst",
     "sha256": "108543225439fc50053a904b953813a39a0d0d4e6c7a76a2e99a8ee26a69f1a2"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "1009e845edf77dbe04e8d815ce036c73f1309c0a4a2ec69abafb3e058365513c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "98f213f7c8a70c4b0d0fb22329212190e08c82d6be482b227e3256637388c732"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "f76f06cd2344a2c44283733c0e02a94b1bea6c63bc0b7cb6aa2871a474661628"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "c310597f504b2dd8ac46cc2b87125dcf57a3ae77e4bbbeba4f436a598a2b96f3"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "4268db05101d1022ee1002f46516aebeac1b9f8171288ea2d14ddd4763b35ff1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "86a46ecea0d7a60a68314a5794698d6421aa4ce69c05a1f836360e9be996a36b"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-traefik.linux-amd64.tar.zst",
     "sha256": "aec23459c8e51ec16491b4657a3b2a64e49357d3e6cef0a11ac7d3c2f285fe4b"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "39381c15bf462071edeb8f735d447ec6d750cc23f6dd3efb45d7b38193ccb7a2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "29372e44e2c1b682c4bc070a764746138a850e24c2cef7edbc97bb2afae51bd8"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-traefik.linux-arm64.tar.zst",
     "sha256": "dd5efa19d02ca7a8a0bcb05febd2781e8ad85016c09b1defe09cdc5f494f05fc"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "6bcd307750c4077eca4cf934dffa4e93277479512639f4c2458f0b0b0eb2cddb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "237d3f47fdbc2e511b002ed700536125ccb0fcf7c69f2b192db3bd351043d3cc"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "707374e5a6066ec39b70f46ac43e5ca7c10a04811c509dbbacd3edd2cbc8fc0f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.12%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "be5e7d4a33142cb07ac687b777c2c892354f44061d769a72b4731af49c307ec1"
   }
 }

pkgs/applications/networking/cluster/rke2/1_33/versions.nix

@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.33.12+rke2r1";
-  rke2Commit = "2cf00d600ee7064fe19efee3e35195ad92c006ef";
-  rke2TarballHash = "sha256-CESLU8qyr0MnVmXRKaPZ7CFvBmIqpLAiklBrsuw9W/k=";
+  rke2Version = "1.33.12+rke2r2";
+  rke2Commit = "341f3e620b43d178daccfe5199f9cb752b0c3922";
+  rke2TarballHash = "sha256-fjhAeDjX8w3c943wjaOamlR4NXZEIhE68iSIP6co6OQ=";
   rke2VendorHash = "sha256-I09PTw359mW9b8j/tjbedu7gJ0cp+NPEvmikxJMOufQ=";
-  k8sImageTag = "v1.33.12-rke2r1-build20260512";
+  k8sImageTag = "v1.33.12-rke2r2-build20260521";
   etcdVersion = "v3.6.7-k3s1-build20260512";
   pauseVersion = "3.6";
   ccmVersion = "v1.33.11-0.20260415182038-2566e39d309b-build20260416";
-  dockerizedVersion = "v1.33.12-rke2r1";
+  dockerizedVersion = "v1.33.12-rke2r2";
   helmJobVersion = "v0.10.0-build20260513";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }

pkgs/applications/networking/cluster/rke2/1_34/images-versions.json

@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "9191dccc4fa6bdb8bc589d20d34c643227fe2c1e3d198eaf600780a1c44dfd5d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "351e9047ce160cbf3b9ed4a32996f36bb4266c200e9957407178d2d28e55f8e5"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "707eaba12e9e9d5e5090bb5fb3e066b893c0b0aeeee6f3627c1153e2db380567"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "aa746ea4dd91422e37d2cac07b36854ddc1c551b4da061c261d1e0132a983656"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "33421abe9967b3f00799b3251f84a3a36ab03378a4f1c556663ac2b829f59cf4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "96829f58e60b02ccee8e19b9ec4ad2ce7ade6f9030b1379eadedd42d151a783b"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "f727fa092650bf685b68358cf41422c260fe9eee7a2aebecc68f14a2fd24a678"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "6a7f4404f92e88eb515bbff4513b5771e82c69111dfdd7e88c7d83d4366480e6"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "b46d57b12bd62a5f4c4227fc1339ba8785853e55f81031c97774f44844c6769d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "16bc527e0b4ab9612747534c2b5801487a12379a364da4936d01816fcb608040"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-canal.linux-amd64.tar.zst",
     "sha256": "d4d14e4ae3f34d0615fd6007e7048b54bc5a15be9f57fa6be6cd72346c39ccdf"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "977c126339368ac55ccd3cb658dcc6530d46426292735dc8cff95dad99543ebd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "ece067531498aec3847a73cd4e4e379c2bb3186f72717601b4766f2a50df0f3a"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-canal.linux-arm64.tar.zst",
     "sha256": "ede6d29451a99d7f4663b6a2b8eb0cfa093f83b7b025fd5c4899fb02edac703d"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "2ad31cd1bcb0ba5ca050bda0942a0b6b79f21ae4dfc70f70001be08921c4c3cb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "95d566220546d6b49f6b79fb729c976fc435ae85fcb39add9ca4e8cade953e8f"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "c812ea710fcac1dd25e1be8f45e9fd3218296fdd6414c90a5b856fc16a5835f5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "fc146c92933270bd4291a75069f1d724629c84ebb6c8cd5549756a895a5a9e3d"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "07507811563e82578142bd56c2b394b32b55bd53c965f8fc9a9881570feac68d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "d5bfc28db9031a8be3a5c325fe6f6cc6dca8f101af5fce394d11e00a0e866dc2"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "0d5813611f47a460c7762f1902e1be7785f52903b8340fc112dd67c5ba9e0adf"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "0590f43bf3d6ea590a9069d62170956d72f6ff1b1a45574ef7129a6fb07481ae"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "4716d37e4c4974c50d88a6c4a4dd1ae59e5d416b06161dc97af267ac91005200"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "2d89ef07043ee8475bd91c97c7419dcb068e089ba8d74f31a503749fdd29a700"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "c326f685c5037ae41a76d0a57d81ad365664fdb4f09dd8ed1c085daef6e8898c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "663f048d7ad31aeaf5820effc4e9fd6499ee038c2736afa6721c2384c049765c"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "8439de0d0159a2d0458a94c48d4f856dd499106bb97a1228315172a8ccf7a227"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "740bed7351bab07dbdaaef316d3c9c817c381fefff4ce43af78381596e1f34d6"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "dbfb0ba0d552b9f09d6fd7c3f1313c2d3a65b1fe9d003925f90206bb908ceb1c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "d224ffbf50eb2be8edaa1b923323df17336b8c435bce034e2ba4ae96a54244ec"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "2b65ebfff9edad28dc5df77d58a9f9191ae6ed1ffd47e001c61979940dbd30cc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "1a84527d66538b5ff96e331493006bbd3ccc06529d51a8b7c9a3e0d219c25a6f"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-flannel.linux-amd64.tar.zst",
     "sha256": "832aae87b5eba45be64b47a5ebc04824060095dbc79d58adb009dbc0b738252a"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "17393dba1ce79c78739381ba2c6dc9383f41bf78e511b04a3eca0564d88a58d9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "80d7ab29cce2d595926ed0999e663932489c62c9e4b818909a05739357e584bc"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "8aa8e19b739bc3fd897115f92d54acd081453441ee4dae8ca694ec47662838a7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "39b36764f09857c01eaa9520da3e2d5023d7df881bc72379e4c55d05ebde8f6f"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "8d6e85fbf15c10faa6c50098f462e1f042e37e80df8aaa67f4e4a4cfbb61b3f7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "86299476461d69c9db81c47f1bff915f122dd31f229679033cb9ac3888f34d20"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "44bca782f1503b189e17248edbfc344c129ffedeabf886c5ecae89717a68e6df"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "c3c2539999dbd963deb1533d76fef211902322d7204c977b7534c37342a6ccba"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "0af1f6bf05788880ac4617271b8896662c41ed3b099ad617bae21aa41f669f68"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "dadfbc1e60b11be02c186343748f3c5e6a7c03bedf4bf36b1007b6addafaf6e2"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "085489645c3bdeb44216be70e0194f6e356a4e0116e861fac7009dfc671f99b8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "ec9d3370c2cb488fe98ed38688fd3cec14ba136783efd894b3bec2a5599f8c08"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "6c759cc8ce3e9ae7b6aef0b5cdf4094762f6f69d55dd70b6d9a405db796f1cb3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "a4bbad1ab2c8d7f65e6cc9238d63f29524774bc07163a4a23688d9a0a63c4629"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "530f83485923076b7769c4ced5c87b88979dff0e4d28faf33fc5e9b67fc5dadf"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "98e17b69423ff3de402803a0ec2fb63748252c800c672a232f912d312cf41ff5"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "efc94b4850aef8d2973f51bff0df31ce0689949e22bd05161fd5c12cfa9672ce"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "1ec1676f8bcb054ab243cc7b3df555e0099fd2a227683615f15c8cbb95db040a"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "883d23d8ef3733d9747251c8a1d223571153fd233eb93e5d32a76129a6c64f2c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "c310597f504b2dd8ac46cc2b87125dcf57a3ae77e4bbbeba4f436a598a2b96f3"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "282c456cbcdaf42f2b4c62b110aaa459e5517dba0a7dd8c6fd539ce93c9fd632"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "288cb12a19e0419f91a56286c934823eda31c523f865bb24b66c9cdeb89cc73f"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-traefik.linux-amd64.tar.zst",
     "sha256": "aec23459c8e51ec16491b4657a3b2a64e49357d3e6cef0a11ac7d3c2f285fe4b"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "4ffe8a7b25bc4c116f34b29f51de69ffbe7702f473f8b68577ac086f88e0c5fb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "f3d34ffea490540c028f800362862c74d1b45efb0acb3db072f5417443b71733"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-traefik.linux-arm64.tar.zst",
     "sha256": "dd5efa19d02ca7a8a0bcb05febd2781e8ad85016c09b1defe09cdc5f494f05fc"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "b15c7523c8ece5525acdd1e04bdcde1a3e54435fcdb1a8ec949de9395f69a3aa"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "c87a8f5b553e664f0c7dfa44b2fdea40b7bbe22bbf4d96667009a76f5b181f86"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "ca086d7c16de41dfd1fd5f2e745949f0a51d4de45f9bacdaa3b1955936f595e9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.8%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "df524665950321e45d0b8521532263e969533af82f7c77dddc86b4b6dfa675a3"
   }
 }

pkgs/applications/networking/cluster/rke2/1_34/versions.nix

@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.34.8+rke2r1";
-  rke2Commit = "4fdfd151975bbc58c8d392620db8eea72fea2abc";
-  rke2TarballHash = "sha256-n98pZhWARQMyKj8G9+ymmMZyzoiGo+KPMr0F5KDphqU=";
+  rke2Version = "1.34.8+rke2r2";
+  rke2Commit = "b227fefe1936a550450ce3b6248c559fa58b5cd3";
+  rke2TarballHash = "sha256-Ojc4PhsEYJBhgj+r+XEcdFEjZIlJCCVNC+w7mZWY2hA=";
   rke2VendorHash = "sha256-752RlnL+7reFk4G/X8kgHdad71fatY+Ss714MbJDvg8=";
-  k8sImageTag = "v1.34.8-rke2r1-build20260512";
+  k8sImageTag = "v1.34.8-rke2r2-build20260521";
   etcdVersion = "v3.6.7-k3s1-build20260512";
   pauseVersion = "3.6";
   ccmVersion = "v1.34.7-0.20260415182025-e7567db58dd7-build20260416";
-  dockerizedVersion = "v1.34.8-rke2r1";
+  dockerizedVersion = "v1.34.8-rke2r2";
   helmJobVersion = "v0.10.0-build20260513";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }

pkgs/applications/networking/cluster/rke2/1_35/images-versions.json

@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "483d18ab6a64d279b4411098dec8b6f4219839bdb0d3e023f87679e6c71905de"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "d53e659b7f934fb811eadeb7d6e348b12ef932b0a414073301bdf03d1501f32f"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "c8ab27e9f5cd0d85cc20ed8c02c71128f021199a0256c5a051734817193e913c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "b7cf99a56b03469169e8b1a32f9aa61b828268dd5aff9482503d00c884260f0e"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "01339c90624d6745e16b7706585fdb32825df66adb892a9bd265257d2de315a5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "53a95f56dbd4aeefe631afdf05d00592da7bbb2c089e694d06ffd6c6c8665375"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "9816fa61d5b89ab40ba59db3c0593ed37f712c6bfd1f3b763641b0bfad8b5d04"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "c49ef55be8b1a30597e4315fac563282cac7870045a465ba7e1ee2c81db44cf6"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "cc4d48fde0650c666f87322ef3fec4987de06d99b4f008a07b667a7650451069"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "f6ffb60b14b0fda2e3a138f4d6a7e9cb71e8fc759d69cb0fda00aedcaa03ab0f"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-canal.linux-amd64.tar.zst",
     "sha256": "3a7828ce0143c3eb91cae940cebdfa0145960e91be056e88a8b077ee39ccc54d"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "977c126339368ac55ccd3cb658dcc6530d46426292735dc8cff95dad99543ebd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "2319ab1753330cb13ea7ac56198d9da78123aaa6a3b66ea3d970a6c57de9ce41"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "ede6d29451a99d7f4663b6a2b8eb0cfa093f83b7b025fd5c4899fb02edac703d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "63b0888d1adebb72a77c2d1f1eb1ced1519cfdeb57681026a94c1f53f87f5610"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "0877802ec5502223f1b233573b2e87e3347a7922f2bb52702f9461958ac0c043"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "9c6ab1f22a157e7a74c35c4be3c025eb154e6315be9c2085451f59b11b63f8e1"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "345afdae010cf3c77e02c4e339749f3c3a5d4d62c3ed486edab0bb1d4089c67e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "38892592ae5e45e27e4cad76d4364c549bdb386def54398cc26c9249bbd34760"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "00161836b5f27f1ce07be67337d08781033d6df4efe429bd922459738145ecdc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "a0a02109ef5a5f4eae1a06003ba80544b405b155840ce5c3535b1c4e02d16f0e"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "32b275bc86c35471d9deea33b6119a33667a28477c06500db3ea9d1d0cdf7d4b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "8110fc9517469dad0c291258e0dbdece6e4e3c9a51d539531527f4236692b7bd"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "e0519dd39f2f3297a84fa7c2e9c6fdda508386169474a47ebbb570c66f51c27c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "2d32c6205a83ac776fe54d7777472725edfc204fd7a30befa0ee9c5f7fde80cc"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "6f63f6cf296f828ef1ff98041691e9a6126490000ae2e90648c0699ab1bde91f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "48bdbb2bc2652eb6647ce3f2ce215ac9bf12cf5fbe4936688e5de34605f0fb2c"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "b66332a3a903e1d18c783a7d58d9eb74aef9d4cb0fe91a4aa75a63cff5b3e92a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "3e392555a295ec6f7e3ea477ded0bb71c04957dccd168de87d87226dfdbb753f"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "98abe8232378ef17f9890e3c77cd405a90e7aa2fdf5d612bd7d42ee174714cf6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "29d28cb1b2035c1d5123fdb6bb0fa8cc647ad9cd570edf434bc7e560806426fa"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "4ea4b1fb4a653a5ad00dd206406482abddf9f53a1b1c4f884e7e7fb4fe720c90"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "e86e5631c691d2dcac99764542c875e4bed902f385f5a6e2f6e6b88facf114aa"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-flannel.linux-amd64.tar.zst",
     "sha256": "23695fd8c2a77f043a089c44437d12b5bde88422dbcd1d70edcda7a78f651137"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "d4dcaa35507a5f9d407a5d3a3fccee3e52061256bd0b420123bf888a24915758"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "396084ee38b31e5b78e3d8c3a015f8a56194119204aecb9de052a5be20c61e01"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-flannel.linux-arm64.tar.zst",
     "sha256": "39b36764f09857c01eaa9520da3e2d5023d7df881bc72379e4c55d05ebde8f6f"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "b47becfdf139af069eaf1f691498ff689b577af43ed934edba119257bf652cab"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "38eecc385bbb77bde48d7dec9aa48bc897136c5714e5eff9c56c9df580dfb35d"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "b00afa052e7b67d4111f19a4eefb22095c836a7972911880e65dee2044975898"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "20e7b012ab2802a057be6cf6ef3d8f04a65484403615ddd3c2852d59d3ed7453"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "1e9a034a075472ecaa6f9e66c7ff2ada6f97b4a02a5e070ce36208b4eb4f1fcc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "8b712f389d2118a802a70ec4175e83be0557a4b699bc238bd228c862aa337419"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "8ddfde1b1ceea2f08db9fef9da9cb9745bbe74b2520cfceeb150c623102401a3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "dfa539c18041a6e0ef1747c469c718f7e608e031dbc99eada2dbf56768f6de72"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "b75549d8d650823ac9c8f5b5ba247901a8c5681ac91d909aea5a0d4f66d0b5bd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "48a6e3c5fc5534b6c77957dd82e488f46cd6c6a713233da32ab18e94961f33a2"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "108543225439fc50053a904b953813a39a0d0d4e6c7a76a2e99a8ee26a69f1a2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "98e17b69423ff3de402803a0ec2fb63748252c800c672a232f912d312cf41ff5"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "c0f20bbcc6b238af7249c265a7c6458c30f9358007c1380c7b99de01ee219398"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "cf99f6af0ae8389926f9cba977370ffbe1ee261d429281957eb2b5cfb015a71e"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "eee8c18cf3bfea3df603e2d9fb0c30c75fcc7e88dc58c1cab1b8d5926aa8dd52"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "f76f06cd2344a2c44283733c0e02a94b1bea6c63bc0b7cb6aa2871a474661628"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "1aed02afe45b0f6abe3b8934bdd6beee5a8018b31e81be896e9bbfbf75cd2bc5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "f77681adb7835d43c2eb77d189573990f32fa8b3d98bf7d8fb559788f0e30eea"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-traefik.linux-amd64.tar.zst",
     "sha256": "aec23459c8e51ec16491b4657a3b2a64e49357d3e6cef0a11ac7d3c2f285fe4b"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "4ffe8a7b25bc4c116f34b29f51de69ffbe7702f473f8b68577ac086f88e0c5fb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "5a57534fd048ad725e15a38a8be65a642f6ad443cb55c9dad6eff276d704dd44"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-traefik.linux-arm64.tar.zst",
     "sha256": "dd5efa19d02ca7a8a0bcb05febd2781e8ad85016c09b1defe09cdc5f494f05fc"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "4d1a7ba7c43d474d796d7b05a0f24a423b6c3a5a53388e9d803fd31c54efb912"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "c3e5339a35bba7b7184850935bbfcda7d6c2dc7dd4e34d7c9f390a58766ac654"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "d2f8909d694493222aa1051f8c013ffa73615567141336b872ada5c9e6312cd8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.5%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "f0a388912b6150d4ff820b53ee58c398d5572c325f381ad5ce4d82f0d10f5849"
   }
 }

pkgs/applications/networking/cluster/rke2/1_35/versions.nix

@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.35.5+rke2r1";
-  rke2Commit = "e28e7c1a0404f1e9bf36e8b7222d64aec6b7a004";
-  rke2TarballHash = "sha256-t++HKNbR4WGzZiR6rVMke7lbixXA8H5ibovfitwPuXE=";
+  rke2Version = "1.35.5+rke2r2";
+  rke2Commit = "a779b949d9a7987fc51e7c71c146db4160d0e3bf";
+  rke2TarballHash = "sha256-eMqaz7DmIwANpvcQxEA6rJQcLmdBlEFT8Qju+Wr0dTo=";
   rke2VendorHash = "sha256-LV3ISu7bW6kxlKFe0GUqkB9Jte1Ey5DaWm+OKq1/1uY=";
-  k8sImageTag = "v1.35.5-rke2r1-build20260512";
+  k8sImageTag = "v1.35.5-rke2r2-build20260521";
   etcdVersion = "v3.6.7-k3s1-build20260512";
   pauseVersion = "3.6";
   ccmVersion = "v1.35.4-0.20260415195656-e51c0636351d-build20260415";
-  dockerizedVersion = "v1.35.5-rke2r1";
+  dockerizedVersion = "v1.35.5-rke2r2";
   helmJobVersion = "v0.10.0-build20260513";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }

pkgs/applications/networking/cluster/rke2/1_36/images-versions.json

@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "bc9fb1ba72af6185de90e4e0f8a384993657c4b0fdedbb14e7ca5cf93bf2303d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "ec37f597d76bbe3f30b6108049faaf9f4a6e99b4d228f9b8485fb492c31aa0aa"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "38fc5ecd017e9a66e3831ece42efedcfedaafc000759eaa4fb9f19a68122ec51"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "5112e4bf4f4f5f553addb98abf53636b8ff57cbf18514d7537ec03c344d5b345"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "e86ac7f4cf14e4f02fcdd0e3d74e832fa43654f592068c2b5d8c044c69e2b749"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "7161e8af4ae5c45d480be7083f15d3e7992745e9559d460584c5136d9caca789"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "03df93db61bc54f351bb6131c632279c265d4b71af0a90e2a6898f9b99b453f4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "f63ba6f6b30564626d6839002117325b3d48b2f2a131a8bfeb1192244da1de7e"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "5cce5314ed6ff237c646723456c81876e89517b9164368728a9df00697655858"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "7478fa0950554451cd856dbb8a800486f73fbb4758ccad28d1d218febe9b0b39"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "3a7828ce0143c3eb91cae940cebdfa0145960e91be056e88a8b077ee39ccc54d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "d4d14e4ae3f34d0615fd6007e7048b54bc5a15be9f57fa6be6cd72346c39ccdf"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "e8346348137747fbd626846e5b71d182c49e8a1dcb997ea9e91f50e7bd907129"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "4a77a243413b7963e3f3a98fcdb1cc2bd96cbe83b6a3f3d7ca73f05c1d7bd855"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "ede6d29451a99d7f4663b6a2b8eb0cfa093f83b7b025fd5c4899fb02edac703d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "63b0888d1adebb72a77c2d1f1eb1ced1519cfdeb57681026a94c1f53f87f5610"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "8c52261340b4af54186f83d2913c676a2dcef820f25a1b42b8c51cfef1dcdbc6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "83642c47920ab60e3042895aee5e56914187c822ac279178096c5430ce655988"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "865913456dc55b2ba4748b0fe76489e4960a60990f207341c66bcbf9e93e95b3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "442a391b5486a551fec98464a02396179e6f70a4cc41e0bb631b0ea70a8affc3"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "4170bfc7d0ebf9167a94d24e393fbff0fc7dce4da1443257709fdbe603ffc579"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "a5d7ec33831f617546aee8ad44a521e06cdef30c5ac9e3c23b1876dddacccb9b"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "016caf748e5c39460b9618d998d261c7db8fe8348f9fa43d35693a47d4913b86"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "d5b757ba6313c6bfb4e85b238aa318ac12aeed7ec8f1e4af825405648737e1bb"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "03a72f2c228131b7cb616c5b7758cd1c00b7f3e7d589573c5faf837e4e2ab764"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "30ff144583c0b3249b06801d78c902305e1a5009bf3ab7211862d989fca18267"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "37acd15d183693fb0bb465840590593ed78d72415752a052d282a418fdb905cf"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "e056f1ba054b8b39a68c4df19480d878327327583ea843f4a80ea0289e796e15"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "4798bf3293e7b5b62e694bee8a811c3ace86bb5c7516c9f196a4ba48dc947c3f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "54d0d3d97462f8f70c75479cc77edd482cf318bef31ecaa3063b354432d7af9a"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "ff8c770fa2b17151e333a0a4449bc4dc3cd5c65662ec88b2ffc31fde6a40d0ed"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "62528323277c307d46e0564288508d9203dc460f93be222075b5a1c1be1c910e"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "0e5c71c9ecd89f11bb1cc0ea72a0297090e7a44395efe5fd74e14af3db3581a8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "b9742e4656c394dff69f7356e9fd22bc7ed4e0b4cac2d86e224cdbb5d793158e"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-flannel.linux-amd64.tar.zst",
     "sha256": "23695fd8c2a77f043a089c44437d12b5bde88422dbcd1d70edcda7a78f651137"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "d9f75aaace63bcba2cbaeba2662d9877d39ec822621fd96824e9ec3fbe62a79c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "e2ea34d8f0207197758c75dbadb1e6ea1e31758ea26f49ac6cd8cb5ea941e743"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "8aa8e19b739bc3fd897115f92d54acd081453441ee4dae8ca694ec47662838a7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "39b36764f09857c01eaa9520da3e2d5023d7df881bc72379e4c55d05ebde8f6f"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "c9442d489c4170fc515d04c2c5c7c76ff3ca2fb4093a94aea0d0a6fb1719c5d3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "34d08bdfe771f5d6c2c1a077519aa9dea2c4ec5ff6598812630b5175e15b0436"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "9551558d7baba1a78de7954f4801cf4329b5fb5ffd0cc3566b9fa32732ff950c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "04e83f1ee26a6e40cd4267025b85a8afba847e8b89bbf25ad33d3f598128c3d5"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "11ea150625fc1a4700cec2859367692d533f7f9288f7196b331a77682766d742"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "b56ec39e51d0f99a3bee9cb7b93fa5c07e4b91a2709bf6cca246d3c47f442c1d"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "045db3938a0a11f6d5b4936f63471fec48fd76d29ef85e9cfe6bae5bddd8525e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "e8a51c1926db9e71ab970b0a08a2becb85b2c2aab0108120d1f3d6d21f17f1cd"
   },
   "images-ingress-nginx-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-ingress-nginx.linux-amd64.tar.gz",
-    "sha256": "0af77531d170d30b844518bb4665b29f3f386cf160f7c2b955467516f4d04dc3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-ingress-nginx.linux-amd64.tar.gz",
+    "sha256": "100d6841727443cc9558a4aaed924c1f23e8d39e4302bd32dac6fbdebed940e9"
   },
   "images-ingress-nginx-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-ingress-nginx.linux-amd64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-ingress-nginx.linux-amd64.tar.zst",
     "sha256": "d5b7d3f12de0799cebf84fc6260fc4f093f2837c5fef6fc84849d8f1da5cbc22"
   },
   "images-ingress-nginx-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-ingress-nginx.linux-arm64.tar.gz",
-    "sha256": "8c5d5eea216102e5dd07621671f2e462dfade184f20c81adb8facbaa58e59c2c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-ingress-nginx.linux-arm64.tar.gz",
+    "sha256": "f10675c08075e5312f650bde022990e2122de979e4559f2c56aa1ec941516eb2"
   },
   "images-ingress-nginx-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-ingress-nginx.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-ingress-nginx.linux-arm64.tar.zst",
     "sha256": "363f42d83118e3398e72996f6b42477230000ffd50d93fdda570140ea020539b"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "ec3d8557e36db43acd9a76c38242de6feea354e41ae3ff8b9ab55de82ee19026"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "70dd5bf043e5ade8f15bf794ed68c2632fa168cdabb88a59e1664c21802b1b72"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "8be7075092a5e179e50fb526ea730018103d9f8a609f22f0d1431482690a9d7f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "98e17b69423ff3de402803a0ec2fb63748252c800c672a232f912d312cf41ff5"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "caebabf77d9d3190d76156990d8eaa0c2df5cb563a8447f1e506b50f4104e1a0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "70dc7d7e6b5ceee67e1ea31a9fb8915b23697b46ab81962fcf2bc23994eadcdb"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "39bd89d250894254f7c1f9b061401a574716574ab3f51cc3a82c03eb4e804825"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "7d768e2a1ba9eeb051e2cc74e1886a21cef515230a531a300dfe8b988a426fdf"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "d07ed8b72db67fae9024540fca3eed7990b4a4b3a7ba6eef78a2eae8e6b3b4d3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "a16d790a062b96f792952a8e87df314050032e1306d3f1b411c4c1e80cea574a"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "4cd43197b21bd1344c0a7e87a7f28c8766b3edfab8e2fb2bb6954d144f3b44a7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.36.1%2Brke2r2/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "bb33b083c06d621bb430942aad52ddfe45fd4cff956072104d83ea22ef91be02"
   }
 }

pkgs/applications/networking/cluster/rke2/1_36/versions.nix

@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.36.1+rke2r1";
-  rke2Commit = "b4a8e78038f35eb282a8d6e3c29797a1181fa961";
-  rke2TarballHash = "sha256-SD7+lNYu6/5iMxEmHEpkD8g9UCgN6gjkFsGdQn9o1Cc=";
+  rke2Version = "1.36.1+rke2r2";
+  rke2Commit = "05cf623e2245271b63d1d7ef2caced897636175c";
+  rke2TarballHash = "sha256-hxnO8w+ec9cx6betH2hdC50AO/VHmPlseeKV8HgH5ZE=";
   rke2VendorHash = "sha256-gUgRAC9yKDa8JYb/jdCxZdP6500XxjqHprmYlPv5A8c=";
-  k8sImageTag = "v1.36.1-rke2r1-build20260512";
+  k8sImageTag = "v1.36.1-rke2r2-build20260521";
   etcdVersion = "v3.6.7-k3s1-build20260512";
   pauseVersion = "3.6";
-  ccmVersion = "v1.36.0-rc2.0.20260427154526-d239025e2a23-build20260429";
-  dockerizedVersion = "v1.36.1-rke2r1";
+  ccmVersion = "v1.36.1-0.20260508014929-7bbbf7c9b258-build20260515";
+  dockerizedVersion = "v1.36.1-rke2r2";
   helmJobVersion = "v0.10.0-build20260513";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-+doYnLRuseR5YtqMJeoxJtnb0UGBx+UgZ7S1sOLiF68=",
+    "hash": "sha256-kA2s+STTaax/PEevdHdbGzhQcFPJFRin6ALu1FkRzsg=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.23.2",
+    "rev": "v1.23.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-sPQR+LDZRMXygLUd9xj6/bI+8DhAPKbkytlTzmrEOBU="
   },
   "hashicorp_google": {
-    "hash": "sha256-GTcMwL5lZ81KDtohog4cCvy9zxXU/jh5k+aLosZZfRM=",
+    "hash": "sha256-xAzkBYqQR1VdERjt9zJFyItTj8dpfywHO8xex0biXPQ=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.35.0",
+    "rev": "v7.36.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-R3Bd+n/ySx4FyDQAP72P0hIjTSQjzNJE2QqUgRV+eQE="
+    "vendorHash": "sha256-Ub+Dvddw5jcSy2hR72OSsy4EgHphhCW1kekPyrQGc9E="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-WsZY4O5kUoOkDcP2iKmkLo85XaBM2oQxaB/7ibJMDwA=",
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-uIggPhDgTMQei6LpXPzAbfbsoNjVN35P60QcqqHyCIA=",
+    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.17.0",
+    "rev": "v8.18.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
-    "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",
+    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.23.1",
+    "rev": "v0.23.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-chDZVBd7tb1VsfTXcWz7j29LzHpUnJpXKRFAyqxnR8s="
+    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
   },
   "vinyldns_vinyldns": {
     "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",

pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -153,14 +153,13 @@ let
   stageModules = writeShellScript "discord-stage-modules" ''
     store_modules="$1"
     modules_dir="''${XDG_CONFIG_HOME:-$HOME/.config}/${lib.toLower binaryName}/${version}/modules"
-    if [ ! -f "$modules_dir/installed.json" ]; then
-      mkdir -p "$modules_dir"
-      for m in ${lib.concatStringsSep " " (lib.attrNames moduleSrcs)}; do
-        ln -sfn "$store_modules/$m" "$modules_dir/$m"
-      done
-      echo '${builtins.toJSON (lib.mapAttrs (_: mod: { installedVersion = mod; }) moduleVersions)}' \
-        > "$modules_dir/installed.json"
-    fi
+    rm -rf "$modules_dir"
+    mkdir -p "$modules_dir"
+    for m in ${lib.concatStringsSep " " (lib.attrNames moduleSrcs)}; do
+      ln -sn "$store_modules/$m" "$modules_dir/$m"
+    done
+    echo '${builtins.toJSON (lib.mapAttrs (_: mod: { installedVersion = mod; }) moduleVersions)}' \
+      > "$modules_dir/installed.json"
   '';
 
   disableBreakingUpdates =
@@ -261,6 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
         ${lib.strings.optionalString enableAutoscroll "--add-flags \"--enable-blink-features=MiddleClickAutoscroll\""} \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName}:${addDriverRunpath.driverLink}/lib \
+        --suffix VK_ADD_DRIVER_FILES : "${addDriverRunpath.driverLink}/share/vulkan/icd.d" \
         ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
         --run "${stageModules} $out/opt/${binaryName}/modules" \
         --add-flags ${lib.escapeShellArg commandLineArgs}

pkgs/applications/networking/p2p/deluge/default.nix

@@ -5,6 +5,7 @@
   libtorrent-rasterbar,
   python3Packages,
   gtk3,
+  libappindicator-gtk3,
   glib,
   gobject-introspection,
   librsvg,
@@ -54,6 +55,7 @@ let
           gtk3
           gobject-introspection
           pygobject3
+          libappindicator-gtk3
         ];
 
       nativeBuildInputs = [

pkgs/applications/science/logic/easycrypt/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easycrypt";
-  version = "2026.05";
+  version = "2026.06";
 
   src = fetchFromGitHub {
     owner = "easycrypt";
     repo = "easycrypt";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-+tVGJAfngTHpn7qFGwl36verbcxOqH21zwojgOxcuuY=";
+    hash = "sha256-+exP4UWfNGZauznLZTA/NkMOHJNstz4oaTqI0bSnkH8=";
   };
 
   nativeBuildInputs =

pkgs/applications/video/kodi/addons/jellycon/default.nix

@@ -17,13 +17,13 @@ in
 buildKodiAddon rec {
   pname = "jellycon";
   namespace = "plugin.video.jellycon";
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellycon";
     rev = "v${version}";
-    sha256 = "sha256-bSAzd0nKD0S3hNEM0azmCNPw9wHQK5XH6lbfcz3sW9o=";
+    sha256 = "sha256-1o9mkMjlLDIcokpTqDKmFlCOF1XjrVOxlFfy0bpZolc=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix

@@ -10,18 +10,15 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vertical-canvas";
-  version = "1.6.2";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "Aitum";
     repo = "obs-vertical-canvas";
     rev = version;
-    sha256 = "sha256-LaVDwC+L96cvq3OpNnD33bf+tV1RZ9AdUHjG4oIFzpY=";
+    sha256 = "sha256-cWiC4e+ZojTuNAaNwuBQ1pPlchdiuTsVhWMHvcyxx2A=";
   };
 
-  # Remove after https://github.com/Aitum/obs-vertical-canvas/pull/26 is released :)
-  patches = [ ./obs-vertical-canvas.diff ];
-
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [

pkgs/build-support/trivial-builders/test/symlink-join.nix

@@ -1,7 +1,7 @@
 {
   symlinkJoin,
   writeTextFile,
-  runCommand,
+  runCommandLocal,
   testers,
 }:
 
@@ -31,7 +31,7 @@ let
     text = "qux";
   };
 
-  emulatedSymlinkJoinFooBarStrip = runCommand "symlinkJoin-strip-foo-bar" { } ''
+  emulatedSymlinkJoinFooBarStrip = runCommandLocal "symlinkJoin-strip-foo-bar" { } ''
     mkdir $out
     ln -s ${foo}/etc/test.d/foo $out/
     ln -s ${bar}/etc/test.d/bar $out/
@@ -48,7 +48,7 @@ in
         baz
       ];
     };
-    expected = runCommand "symlinkJoin-foo-bar-baz" { } ''
+    expected = runCommandLocal "symlinkJoin-foo-bar-baz" { } ''
       mkdir -p $out/{var/lib/arbitrary,etc/test.d}
       ln -s {${foo},${bar}}/etc/test.d/* $out/etc/test.d
       ln -s ${baz}/var/lib/arbitrary/baz $out/var/lib/arbitrary/
@@ -66,7 +66,7 @@ in
         baz
       ];
     };
-    expected = runCommand "symlinkJoin-foo-bar-baz" { } ''
+    expected = runCommandLocal "symlinkJoin-foo-bar-baz" { } ''
       mkdir -p $out/{var/lib/arbitrary,etc/test.d}
       ln -s {${foo},${bar}}/etc/test.d/* $out/etc/test.d
       ln -s ${baz}/var/lib/arbitrary/baz $out/var/lib/arbitrary/
@@ -115,7 +115,7 @@ in
   };
 
   symlinkJoin-fails-on-missing =
-    runCommand "symlinkJoin-fails-on-missing"
+    runCommandLocal "symlinkJoin-fails-on-missing"
       {
         failed = testBuildFailure (symlinkJoin {
           name = "symlinkJoin-fail";
@@ -134,7 +134,7 @@ in
       '';
 
   symlinkJoin-fails-on-file =
-    runCommand "symlinkJoin-fails-on-file"
+    runCommandLocal "symlinkJoin-fails-on-file"
       {
         failed = testBuildFailure (symlinkJoin {
           name = "symlinkJoin-fail";

pkgs/build-support/vm/default.nix

@@ -873,7 +873,7 @@ let
               ;;
           esac
         '') packagesLists}
-        perl -w ${rpm/rpm-closure.pl} \
+        perl -w ${./rpm/rpm-closure.pl} \
           ${
             lib.concatImapStrings (i: pl: "./packages_${toString i}.xml ${pl.snd} ") (
               lib.zipLists packagesLists urlPrefixes
@@ -973,7 +973,7 @@ let
           esac
         done
 
-        perl -w ${deb/deb-closure.pl} \
+        perl -w ${./deb/deb-closure.pl} \
           ./Packages ${urlPrefix} ${toString packages} > $out
         nixfmt $out
       '';

pkgs/by-name/ac/actionlint/package.nix

@@ -53,7 +53,7 @@ buildGoModule (finalAttrs: {
     description = "Static checker for GitHub Actions workflow files";
     changelog = "https://github.com/rhysd/actionlint/raw/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "actionlint";
   };
 })

pkgs/by-name/al/albyhub/bark-ffi-go/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  protobuf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bark-ffi-go";
+  version = "0.2.3";
+
+  src = fetchFromGitLab {
+    owner = "ark-bitcoin";
+    repo = "bark-ffi-bindings";
+    rev = "3c626a43d7523c4d19e867bd453ec80c541780c7";
+    hash = "sha256-PbGTbVMO2L+gQpZQewkR0uo6fxqrVUjT/eAsnz2o/u4=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/golang/rust";
+
+  cargoHash = "sha256-OED+NqNt71771UDZ1M8Ks/Yfx8YNjfL246FKMeLFfLg=";
+
+  cargoBuildFlags = [ "--lib" ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [
+    protobuf
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 target/*/release/libbark_ffi_go.a \
+      $out/lib/libbark_ffi_go.a
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Go bindings static library for Bark";
+    homepage = "https://gitlab.com/ark-bitcoin/bark-ffi-bindings";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bleetube ];
+  };
+})

pkgs/by-name/al/albyhub/ldk-node-go/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "ldk-node-go";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node-go";
-    rev = "3690cdb3031c75f0ee0a67222c2db3c69fea8f2c";
-    hash = "sha256-OlJGHhal5fkR0r0FtsVbG1aILZSTLsSRcqrZ84pIRLU=";
+    rev = "5ba22268f000c78baa5cf57329eb0b1c07bd91d7";
+    hash = "sha256-+fuCvc2SuxBLXiacfc+0oNzAsBgFjUJgZ0+5B4Sy4vs=";
   };
 
   vendorHash = null;

pkgs/by-name/al/albyhub/ldk-node/default.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ldk-node";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node";
-    rev = "6d5546ec5fff10d4e560188cfcff6f294944c16e";
-    hash = "sha256-k3AZ1k/hV4Bh+RfOqmpo22wRQ5sdDaFR4bcnw58iwNI=";
+    rev = "549107b4d731bc9af06b81fbcd65463e3055df16";
+    hash = "sha256-7S/+po+a6DkUCnfCrwBMfMnsHzbLcvSiPxEmQc2Hzr0=";
   };
 
   buildFeatures = [ "uniffi" ];

pkgs/by-name/al/albyhub/package.nix

@@ -8,10 +8,12 @@
   yarn,
   stdenv,
   makeWrapper,
+  runCommand,
   callPackage,
 }:
 
 let
+  barkFfiGo = callPackage ./bark-ffi-go { };
   ldkNode = callPackage ./ldk-node { };
   ldkNodeGo = callPackage ./ldk-node-go {
     inherit ldkNode;
@@ -21,18 +23,25 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "albyhub";
-  version = "1.22.2";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xP/J9zdh4sZ1x+JUpOf12ft8f2II2Mn1Q7/gnMuFzy8=";
+    hash = "sha256-1mdpsctrQN012+HAWSgorzlN2UBA5D4+sZIIVYCq8k8=";
   };
 
-  vendorHash = "sha256-nzdHXY14o4D8NrcXu2JvDagvIfemfVAaGU3IDifhyW0=";
+  vendorHash = "sha256-xQkQIWBrbrXzU9/5BMD3/+KKR847gh4XQrwj/CDoml0=";
   proxyVendor = true; # needed for secp256k1-zkp CGO bindings
 
+  postPatch = ''
+    cp -r ${barkFfiGo.src}/golang bark-ffi-bindings-golang
+    chmod -R u+w bark-ffi-bindings-golang
+    rm -r bark-ffi-bindings-golang/lib
+    go mod edit -replace gitlab.com/ark-bitcoin/bark-ffi-bindings/golang=./bark-ffi-bindings-golang
+  '';
+
   nativeBuildInputs = [
     fixup-yarn-lock
     nodejs
@@ -41,16 +50,21 @@ buildGoModule (finalAttrs: {
   ];
 
   buildInputs = [
+    barkFfiGo
     ldkNodeGo
     (lib.getLib stdenv.cc.cc)
   ];
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/frontend/yarn.lock";
-    hash = "sha256-BeuTBLJ/Iakd4jhIkI2+oHc4MFy6DSn8QcygTHEMmQo=";
+    hash = "sha256-VI4FRe1kzVMqqcZ68nZmZqmXW7FOQMbJ0z8QqZoLYEA=";
   };
 
   preBuild = ''
+    mkdir -p bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}
+    cp ${barkFfiGo}/lib/libbark_ffi_go.a \
+      bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}/libbark_ffi_go.a
+
     export HOME=$TMPDIR
     pushd frontend
       fixup-yarn-lock yarn.lock
@@ -85,6 +99,41 @@ buildGoModule (finalAttrs: {
     } $out/bin/albyhub
   '';
 
+  passthru.tests.startup = runCommand "${finalAttrs.pname}-startup-test" { } ''
+    export HOME="$TMPDIR"
+    export AUTO_LINK_ALBY_ACCOUNT=false
+    export WORK_DIR="$TMPDIR/albyhub"
+    export DATABASE_URI="$WORK_DIR/nwc.db"
+    export PORT=8099
+    export LDK_LOG_LEVEL=2
+    export LOG_LEVEL=5
+
+    mkdir -p "$WORK_DIR"
+
+    ${lib.getExe finalAttrs.finalPackage} > "$TMPDIR/albyhub.log" 2>&1 &
+    pid=$!
+    trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+    for _ in $(seq 1 30); do
+      if grep -q "http server started" "$TMPDIR/albyhub.log"; then
+        touch "$out"
+        exit 0
+      fi
+
+      if ! kill -0 "$pid" 2>/dev/null; then
+        echo "albyhub exited before startup" >&2
+        cat "$TMPDIR/albyhub.log" >&2
+        exit 1
+      fi
+
+      sleep 1
+    done
+
+    echo "timed out waiting for albyhub to start" >&2
+    cat "$TMPDIR/albyhub.log" >&2
+    exit 1
+  '';
+
   meta = {
     description = "Control lightning wallets over nostr";
     homepage = "https://github.com/getAlby/hub";

pkgs/by-name/al/algolia-cli/package.nix

@@ -43,6 +43,6 @@ buildGoModule {
     mainProgram = "algolia";
     homepage = "https://algolia.com/doc/tools/cli/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/al/allmytoes/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  nix-update-script,
+  rustPlatform,
+  fetchFromGitLab,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "allmytoes";
+  version = "0.5.1";
+
+  src = fetchFromGitLab {
+    owner = "allmytoes";
+    repo = "allmytoes";
+    tag = finalAttrs.version;
+    hash = "sha256-BYKcDJN/uKESj0pnb2xvrx1lO6rOGdi+PVT6ywZqjbQ=";
+  };
+
+  cargoHash = "sha256-Pzbruv1E4mMohw//lf1JBoK+4BHDJVr4/9xXE4FrWbA==";
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Provides thumbnails by using the freedesktop-specified thumbnail database (aka XDG standard)";
+    homepage = "https://gitlab.com/allmytoes/allmytoes";
+    mainProgram = "allmytoes";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luminarleaf ];
+  };
+})

pkgs/by-name/al/almo/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     homepage = "https://github.com/abap34/almo";
     changelog = "https://github.com/abap34/almo/releases/tag/${finalAttrs.src.tag}";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "almo";
   };
 })

pkgs/by-name/am/amp-cli/package.nix

@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1780564400-g2007df";
+  version = "0.0.1781370323-g977781";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-7hUa1Qs1pNH2+31rrc9T99eDQ9Vq+CSwxROISyPqogY=";
-            aarch64-linux = "sha256-ThT2J1YBoZM5+YanRbL40GyxYQtK/xyDqac8fv0gfZs=";
-            x86_64-darwin = "sha256-VnuMqXVzqge5jgduxB+woYLVZkFtu92MEsEsrh4tJgE=";
-            aarch64-darwin = "sha256-gYAI+eQitglQTBtuilHkHKd8rsYsJ7s2QKoFQR85l6o=";
+            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
+            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
+            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
+            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
           }
           .${system'};
       }

pkgs/by-name/an/ansel/package.nix

@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2026-06-04";
+  version = "0-unstable-2026-06-13";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "05dc2ee4269f59143596f368acb83efd4c9da604";
-    hash = "sha256-1lR+xSBsq9N3R9gVJ+mvZxiPIQKFpFTybjQym/YJfqo=";
+    rev = "2a9850bdc393d88f799b2cb3d80f22757d467d3e";
+    hash = "sha256-hCleHtaqH9dRHDtOVuKN16L1jPMeYJbr4qSwVPLIgL8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/as/astroterm/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astroterm";
-  version = "1.0.10";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "da-luce";
     repo = "astroterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z9KblIAoXk///NnRFHCSAFNDuNiPxDuuiliajcsyJM0=";
+    hash = "sha256-u0UKYoZCDClRmG12czmm0rmOcy3nruarSyjdh8Lu2dw=";
   };
 
   bsc5File = fetchurl {

pkgs/by-name/at/athens/package.nix

@@ -10,14 +10,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "athens";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = applyPatches {
     src = fetchFromGitHub {
       owner = "gomods";
       repo = "athens";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-hNk0hW7R7HdE4Wt1KuKSIUarRGKbtbFqQbfls1HXTqI=";
+      hash = "sha256-sFNxAG0hIxsoKCuef/ROy2MOjA7iC5ehXRvnUr20U0Y=";
     };
     # Trim the patch version, not needed anyway.
     postPatch = ''
@@ -25,7 +25,7 @@ buildGo126Module (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-he7GNkCfqLgOXuCTahvqOnwW5TpbYjlCMfMGfKGwYZ4=";
+  vendorHash = "sha256-nTkrma32+JR+5a5u/XM+EFh9o7YwKMvZJ9cz4evo7Ec=";
 
   env.CGO_ENABLED = "0";
   ldflags = [

pkgs/by-name/au/audacity/package.nix

@@ -63,13 +63,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "audacity";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-UyQffN9vOSD3uDk4jpYGsjH577pU4V7FpFAu0xdsXUA=";
+    hash = "sha256-Vp3Nx3LuNu5fqeLF6dvZ9/hhkoUCu0eCAdIEDtS1IwU=";
   };
 
   patches = [

pkgs/by-name/av/avell-unofficial-control-center/package.nix

@@ -7,7 +7,7 @@
 python3Packages.buildPythonApplication {
   pname = "avell-unofficial-control-center";
   version = "1.0.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rodgomesc";
@@ -17,14 +17,16 @@ python3Packages.buildPythonApplication {
     sha256 = "1qz1kv7p09nxffndzz9jlkzpfx26ppz66f8603zyamjq9dqdmdin";
   };
 
-  # No tests included
-  doCheck = false;
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     pyusb
     elevate
   ];
 
+  # No tests included
+  doCheck = false;
+
   meta = {
     homepage = "https://github.com/rodgomesc/avell-unofficial-control-center";
     description = "Software for controlling RGB keyboard lights on some gaming laptops that use ITE Device(8291) Rev 0.03";

pkgs/by-name/av/avro-tools/package.nix

@@ -36,6 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "avro-tools";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/ba/backintime-common/package.nix

@@ -9,6 +9,7 @@
   cron,
   openssh,
   sshfs-fuse,
+  fuse3,
   gocryptfs,
   which,
   ps,
@@ -73,11 +74,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "share" "${python'.sitePackages}"
 
     substituteInPlace "schedule.py" \
-      --replace-fail "'crontab'" "'${cron}/bin/crontab'" \
+      --replace-fail "'crontab'" "'${lib.getExe' cron "crontab"}'" \
       --replace-fail "'which'" "'${lib.getExe which}'" \
       --replace-fail "'ps'" "'${lib.getExe ps}'" \
       --replace-fail "'grep'" "'${lib.getExe gnugrep}'" \
 
+    substituteInPlace mount.py \
+      --replace-fail "'fusermount'" "'${lib.getExe' fuse3 "fusermount3"}'"
+
     substituteInPlace "bitlicense.py" \
       --replace-fail "/usr/share/doc" "$out/share/doc" \
   '';

pkgs/by-name/ba/bazel-gazelle/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-gazelle";
-  version = "0.47.0";
+  version = "0.51.3";
 
   src = fetchFromGitHub {
-    owner = "bazelbuild";
+    owner = "bazel-contrib";
     repo = "bazel-gazelle";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-rnJ8rht7ccAI8ceOv3B0mlcY0fQg9Nfy+hu+/pmQQqE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ooqk4xutkjXoy9Irikos/53+6Mhdh3+WmJF7vo3JVFw=";
   };
 
   vendorHash = null;
@@ -22,14 +22,18 @@ buildGoModule (finalAttrs: {
   subPackages = [ "cmd/gazelle" ];
 
   meta = {
-    homepage = "https://github.com/bazelbuild/bazel-gazelle";
+    changelog = "https://github.com/bazel-contrib/bazel-gazelle/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/bazel-contrib/bazel-gazelle";
     description = ''
       Gazelle is a Bazel build file generator for Bazel projects. It natively
       supports Go and protobuf, and it may be extended to support new languages
       and custom rule sets.
     '';
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [
+      kalbasit
+      hythera
+    ];
     mainProgram = "gazelle";
   };
 })

pkgs/by-name/ba/bazel_8/examples.nix

@@ -108,10 +108,10 @@ in
     bazelVendorDepsFOD = {
       outputHash =
         {
-          aarch64-darwin = "sha256-wjVwHQEtIoApY01s9AEVExmRhy+LLQv0/B2vAxmXz+o=";
-          aarch64-linux = "sha256-Z7Y8bBEaPgp9y6RZoC5Ewqvzi//vnamkpeHXGpoBFAQ=";
-          x86_64-darwin = "sha256-aUTfOrsa59zUE0Wb+u5TORQR0nAGQ/7MWSRHc2hcXoo=";
-          x86_64-linux = "sha256-yrXIJocCGq4NYW0jg5s2cMDEvknrtjtBQo6cZFbz8CE=";
+          aarch64-darwin = "sha256-50cAS1okGT1Mq3+TNLk2dk6OdBOAF2LdcskcYuVNOSY=";
+          aarch64-linux = "sha256-2Oia7+2nzLrWeo/bK/5L7du5Y30DY+S0jit6e1ixJXw=";
+          x86_64-darwin = "sha256-+vgvj3ABm+vvXT7U7JxjuzIMwVAiUh1gcWZnFNzcmY0=";
+          x86_64-linux = "sha256-kBnSlFRfYsotZTRMrTNhk8/106+BLzwuU6MIRXlD1jE=";
         }
         .${stdenv.hostPlatform.system};
       outputHashAlgo = "sha256";

pkgs/by-name/ba/bazel_8/package.nix

@@ -31,7 +31,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "8.6.0",
+  version ? "8.7.0",
 }:
 
 let
@@ -45,7 +45,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-W22eB0IzHNZe3xaF8AZOkUTDCic3NXkypdqSDY61Su0=";
+    hash = "sha256-bm+gkkrAVepJWZddDEV1+jX4jRdD+tZ1TH2YG9adIyk=";
     stripRoot = false;
   };
 

pkgs/by-name/bc/bcachefs-tools/kernel-module.nix

@@ -44,6 +44,6 @@ stdenv.mkDerivation {
       platforms
       ;
 
-    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "7.1");
+    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "7.2");
   };
 }

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -95,9 +95,6 @@ buildNpmPackage rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # make electron-builder not attempt to codesign the app on darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   nativeBuildInputs = [
     cargo
     dart-sass

pkgs/by-name/bl/bloaty/package.nix

@@ -86,6 +86,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/google/bloaty";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/bl/blocky/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SZpAPX+MIQA0HRUUmjXi7g+DEJ+jyub4rlyc0RLclew=";
+    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-DahHFf0w0ksQniuVByX45/fLcqpAga23qMjAGnZTjjY=";
+  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
 
   ldflags = [
     "-s"

pkgs/by-name/bo/boundary/package.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "boundary";
-  version = "0.19.0";
+  version = "0.21.2";
 
   src =
     let
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-tqgY0308n3F/ZYGhn3bAsHa4cBdFz0oGgSHI6y6J1LY=";
-        aarch64-linux = "sha256-vvc8rOpyOd91crZTQQofj3RixUuWHe7SbMM0BZDkdRw=";
-        x86_64-darwin = "sha256-wsI8hqULVN+W6zwQsXcWQHbxmocrijsl5eUJgUxLxf8=";
-        aarch64-darwin = "sha256-S0QXBBiO2qgSazjtwd1bWgL/6gJUimKYPv369L419UU=";
+        x86_64-linux = "sha256-S5wt4Wy2SfO+36YwxQo86vnSIv4I0tMdfXro3i2qS6k=";
+        aarch64-linux = "sha256-bu+tYL5uHs67JG1MxCUDIQ9xwYxArbz/FElN0QCXNU4=";
+        x86_64-darwin = "sha256-sRPq9+JnKYD5+0JVqhfGpCflHZgFdsrPprJqfxuAlpI=";
+        aarch64-darwin = "sha256-PEaxwEKCidLvDbMSfXZ2ehWOwblLjzU+yy9Qq9tavtw=";
       };
     in
     fetchzip {