Merge master into staging-nixos

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>

ci/eval/compare/utils.nix

@@ -1,7 +1,6 @@
 { lib, ... }:
 rec {
-  # Borrowed from https://github.com/NixOS/nixpkgs/pull/355616
-  uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
+  inherit (lib) uniqueStrings;
 
   /*
     Converts a `packagePlatformPath` into a `packagePlatformAttr`

doc/release-notes/rl-2611.section.md

@@ -318,6 +318,9 @@
 
 - `typescript` 7.0.2 now uses the Golang implementation. The [announcement document](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) has information on what was changed.
 
+- `macaulay2` no longer installs Emacs files.
+  Users can now get the files from an Emacs lisp package, like `emacs.pkgs.withPackages (epkgs: [ epkgs.m2 ])`.
+
 - `navidrome`'s plugin infrastructure has significantly changed. `buildNavidromePlugin` is renamed to `buildNavidromeGoPlugin` to allow for other language types. Plugins must now be sourced from `pkgsCross.wasi32.navidromePlugins.<name>`.
 
 - `navidromePlugins.apple-music` now uses a `bundleName` attribute which sets the plugin's name to match the plugin's documentation for easier use. You will need to update your Agent from `apple-music-plugin` to `apple-music` as noted in [their docs](https://github.com/navidrome/apple-music-plugin#installation).

lib/attrsets.nix

@@ -699,20 +699,7 @@ rec {
   */
   filterAttrsRecursive =
     pred: set:
-    listToAttrs (
-      concatMap (
-        name:
-        let
-          v = set.${name};
-        in
-        if pred name v then
-          [
-            (nameValuePair name (if isAttrs v then filterAttrsRecursive pred v else v))
-          ]
-        else
-          [ ]
-      ) (attrNames set)
-    );
+    mapAttrs (_: v: if isAttrs v then filterAttrsRecursive pred v else v) (filterAttrs pred set);
 
   /**
     Like [`lib.lists.foldl'`](#function-library-lib.lists.foldl-prime) but for attribute sets.
@@ -1528,12 +1515,7 @@ rec {
   */
   zipAttrsWithNames =
     names: f: sets:
-    listToAttrs (
-      map (name: {
-        inherit name;
-        value = f name (catAttrs name sets);
-      }) names
-    );
+    genAttrs names (name: f name (catAttrs name sets));
 
   /**
     Merge sets of attributes and use the function `f` to merge attribute values.

lib/fixed-points.nix

@@ -341,9 +341,8 @@ rec {
     f: g: final: prev:
     let
       fApplied = f final prev;
-      prev' = prev // fApplied;
     in
-    fApplied // g final prev';
+    fApplied // g final (prev // fApplied);
 
   /**
     Composes a list of [`overlays`](#chap-overlays) and returns a single overlay function that combines them.
@@ -409,7 +408,7 @@ rec {
     ```
     :::
   */
-  composeManyExtensions = lib.foldr (x: y: composeExtensions x y) (final: prev: { });
+  composeManyExtensions = lib.foldr composeExtensions (final: prev: { });
 
   /**
     Create an overridable, recursive attribute set. For example:
@@ -510,13 +509,16 @@ rec {
     :::
   */
   toExtension =
+    let
+      inherit (lib) isFunction;
+    in
     f:
-    if lib.isFunction f then
+    if isFunction f then
       final: prev:
       let
         fPrev = f prev;
       in
-      if lib.isFunction fPrev then
+      if isFunction fPrev then
         # f is (final: prev: { ... })
         f final prev
       else

maintainers/maintainer-list.nix

@@ -9520,6 +9520,12 @@
     github = "fkautz";
     githubId = 135706;
   };
+  fkokosinski = {
+    name = "Filip Kokosiński";
+    email = "filip@kokosinski.me";
+    github = "fkokosinski";
+    githubId = 19800410;
+  };
   fkomarek = {
     name = "Filip Komárek";
     github = "filip2cz";
@@ -13185,6 +13191,13 @@
     githubId = 2377;
     name = "Jonathan del Strother";
   };
+  jderrac = {
+    email = "jeremy@derrac.fr";
+    github = "jderrac";
+    githubId = 1788613;
+    name = "Jérémy Derrac";
+    keys = [ { fingerprint = "7B18 DA58 169F AEB8 6826  D1D6 BED4 91C6 40AB 31DD"; } ];
+  };
   jdev082 = {
     email = "jdev0894@gmail.com";
     github = "jdev082";
@@ -13655,6 +13668,12 @@
     githubId = 474643;
     name = "José Miguel Martínez Carrasco";
   };
+  jm5905938 = {
+    email = "jm5905938@gmail.com";
+    github = "jm5905938";
+    githubId = 187073435;
+    name = "Aveline Noir";
+  };
   jmagnusj = {
     email = "jmagnusj@gmail.com";
     github = "magnusjonsson";
@@ -17626,6 +17645,12 @@
     githubId = 85435692;
     name = "Maxwell Berg";
   };
+  Mahdi-zarei = {
+    email = "mahdi.zrei@gmail.com";
+    github = "Mahdi-zarei";
+    githubId = 80265960;
+    name = "Mahdi";
+  };
   mahe = {
     email = "matthias.mh.herrmann@gmail.com";
     github = "2chilled";
@@ -18773,6 +18798,13 @@
     github = "mfairley";
     githubId = 4374785;
   };
+  mfocko = {
+    name = "Matej Focko";
+    github = "mfocko";
+    githubId = 8149784;
+    email = "me@mfocko.xyz";
+    matrix = "@mfocko:fedora.im";
+  };
   mfossen = {
     email = "msfossen@gmail.com";
     github = "mfossen";
@@ -26017,6 +26049,12 @@
     githubId = 11632726;
     name = "Arijit Basu";
   };
+  saylesss88 = {
+    email = "saylesss87@proton.me";
+    github = "saylesss88";
+    githubId = 209646716;
+    name = "T. Sawyer";
+  };
   sb0 = {
     email = "sb@m-labs.hk";
     github = "sbourdeauducq";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -207,6 +207,8 @@
 
 - The `jetty_11` package has been removed as it reached end of life. Use `jetty_12` instead.
 
+- The postsrsd module now supports integrating with Postfix as a milter. The [](#opt-services.postsrsd.configurePostfix) option has become an enum to reflect the different integration options. Boolean values are deprecated and will be removed in NixOS 27.05. The previous default `true` is equivalent to `socketmap`.
+
 - The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.
 
 - TUI command of `tracexec` now allocates a pseudo terminal by default. Use `--no-tty` to run without one and redirect the tracee's stdin, stdout, and

nixos/modules/programs/wayland/dwl.nix

@@ -61,11 +61,10 @@ in
         #!${pkgs.runtimeShell}
         # Import environment variables
         ${cfg.extraSessionCommands}
-        # Setup systemd user environment
-        systemctl --user import-environment DISPLAY WAYLAND_DISPLAY
-        systemctl --user start dwl-session.target
-        # Start dwl
-        exec ${lib.getExe cfg.package}
+        # Start dwl, then set up the systemd user environment once dwl
+        # has actually set WAYLAND_DISPLAY (see dwl(1) -s), instead of
+        # importing it before dwl exists.
+        exec ${lib.getExe cfg.package} -s "systemctl --user import-environment DISPLAY WAYLAND_DISPLAY; systemctl --user start dwl-session.target"
       '';
       mode = "0755"; # Make it executable
     };

nixos/modules/security/wrappers/default.nix

@@ -361,16 +361,19 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+            pkgs.file
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +385,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            magic=$(file --mime --brief --dereference "$path")
+            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

nixos/modules/services/mail/dovecot.nix

@@ -90,8 +90,6 @@ let
     }) cfg.sieve.pipeBins
   );
 
-  yesOrNo = v: if v then "yes" else "no";
-
   toOption =
     i: n: v:
     "${i}${toString n} = ${v}";
@@ -103,7 +101,7 @@ let
     if isInt v then
       toString v
     else if isBool v then
-      yesOrNo v
+      lib.boolToYesNo v
     else if isString v then
       v
     else if isPath v || isDerivation v then

nixos/modules/services/mail/mlmmj.nix

@@ -6,8 +6,6 @@
 }:
 let
 
-  concatMapLines = f: l: lib.concatStringsSep "\n" (map f l);
-
   cfg = config.services.mlmmj;
   stateDir = "/var/lib/mlmmj";
   spoolDir = "/var/spool/mlmmj";
@@ -141,10 +139,10 @@ in
         ];
       };
 
-      extraAliases = concatMapLines (alias cfg.listDomain) cfg.mailLists;
+      extraAliases = lib.concatMapStringsSep "\n" (alias cfg.listDomain) cfg.mailLists;
 
-      virtual = concatMapLines (virtual cfg.listDomain) cfg.mailLists;
-      transport = concatMapLines (transport cfg.listDomain) cfg.mailLists;
+      virtual = lib.concatMapStringsSep "\n" (virtual cfg.listDomain) cfg.mailLists;
+      transport = lib.concatMapStringsSep "\n" (transport cfg.listDomain) cfg.mailLists;
     };
 
     environment.systemPackages = [ pkgs.mlmmj ];
@@ -165,7 +163,7 @@ in
         ExecStart = "${pkgs.mlmmj}/bin/mlmmj-maintd -F -d ${spoolDir}/${cfg.listDomain}";
       };
       preStart = ''
-        ${concatMapLines (createList cfg.listDomain) cfg.mailLists}
+        ${lib.concatMapStringsSep "\n" (createList cfg.listDomain) cfg.mailLists}
         ${lib.getExe' config.services.postfix.package "postmap"} /etc/postfix/virtual
         ${lib.getExe' config.services.postfix.package "postmap"} /etc/postfix/transport
       '';

nixos/modules/services/mail/postfix-tlspol.nix

@@ -244,8 +244,6 @@ in
             "noroot"
             "noroot-locked"
           ];
-          RuntimeDirectory = "postfix-tlspol";
-          RuntimeDirectoryMode = "1750";
           WorkingDirectory = "/var/cache/postfix-tlspol";
           UMask = "0077";
         };

nixos/modules/services/mail/postsrsd.nix

@@ -46,6 +46,14 @@ let
   configFile = pkgs.writeText "postsrsd.conf" (
     renderAttr (lib.filterAttrsRecursive (_: v: v != null) cfg.settings)
   );
+
+  postfixIntegration =
+    if cfg.configurePostfix == true then
+      "socketmap"
+    else if cfg.configurePostfix == false then
+      "none"
+    else
+      cfg.configurePostfix;
 in
 {
   imports = [
@@ -122,6 +130,15 @@ in
               '';
             };
 
+            milter = lib.mkOption {
+              type = with lib.types; nullOr (strMatching "^(unix|inet):.+");
+              default = "unix:/run/postsrsd/milter";
+              example = "inet:localhost:9997";
+              description = ''
+                Milter listener configuration in `unix:/path/to/socket` or `inet:host:port` format.
+              '';
+            };
+
             secrets-file = lib.mkOption {
               type = lib.types.str;
               default = "\${CREDENTIALS_DIRECTORY}/secrets-file";
@@ -168,11 +185,11 @@ in
             };
 
             socketmap = lib.mkOption {
-              type = lib.types.strMatching "^(unix|inet):.+";
-              default = "unix:/run/postsrsd/socket";
+              type = with lib.types; nullOr (strMatching "^(unix|inet):.+");
+              default = "unix:/run/postsrsd/socketmap";
               example = "inet:localhost:10003";
               description = ''
-                Listener configuration in socket map format native to Postfix configuration.
+                Socketmap listener configuration in `unix:/path/to/socket` or `inet:host:port` format.
               '';
             };
 
@@ -212,10 +229,23 @@ in
       };
 
       configurePostfix = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
+        type = lib.types.enum [
+          true
+          false
+          "none"
+          "socketmap"
+          "milter"
+        ];
+        default = "socketmap";
+        example = "milter";
         description = ''
-          Whether to configure the required settings to use postsrsd in the local Postfix instance.
+          Whether and how to integrate postsrsd into the local Postfix instance.
+
+          ::: {.caution}
+          Boolean values are deprecated and retained for backwards
+          compatibility. `true` is equivalent to `socketmap`, and `false` is
+          equivalent to `none`.
+          :::
         '';
       };
 
@@ -234,17 +264,41 @@ in
   };
 
   config = lib.mkMerge [
-    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
-      services.postfix.settings.main = {
-        # https://github.com/roehling/postsrsd#configuration
-        sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
-        sender_canonical_classes = "envelope_sender";
-        recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
-        recipient_canonical_classes = [
-          "envelope_recipient"
-          "header_recipient"
-        ];
-      };
+    {
+      warnings = lib.optionals (cfg.enable && isBool cfg.configurePostfix) [
+        ''
+          Boolean values are deprecated for `services.postsrsd.configurePostfix` and will be rejected in NixOS 27.05.
+          Use `none`, `socketmap`, or `milter` instead. `true` is equivalent to `socketmap` and `false` is equivalent to `none`.
+        ''
+      ];
+    }
+    (lib.mkIf (cfg.enable && postfixIntegration != "none" && config.services.postfix.enable) {
+      assertions = [
+        {
+          assertion = postfixIntegration == "milter" -> cfg.settings.milter != null;
+          message = "Configuring Postfix `smtpd_milters` requires `services.postsrsd.settings.milter` to be set.";
+        }
+        {
+          assertion = postfixIntegration == "socketmap" -> cfg.settings.socketmap != null;
+          message = "Configuring Postfix canonical maps requires `services.postsrsd.settings.socketmap` to be set.";
+        }
+      ];
+
+      services.postfix.settings.main =
+        lib.optionalAttrs (postfixIntegration == "socketmap") {
+          # https://github.com/roehling/postsrsd#configuration
+          sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
+          sender_canonical_classes = "envelope_sender";
+          recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
+          recipient_canonical_classes = [
+            "envelope_recipient"
+            "header_recipient"
+          ];
+        }
+        // lib.optionalAttrs (postfixIntegration == "milter") {
+          # https://github.com/roehling/postsrsd/tree/main#milter-support
+          smtpd_milters = [ cfg.settings.milter ];
+        };
 
       users.users.postfix.extraGroups = [ cfg.group ];
     })

nixos/modules/services/misc/cliproxyapi.md

@@ -1,6 +1,6 @@
 # CLIProxyAPI {#module-services-cliproxyapi}
 
-[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) exposes OAuth-based subscription CLIs (Claude Code, Codex, Gemini, Qwen, Grok, Antigravity) behind OpenAI/Gemini/Anthropic-compatible HTTP APIs.
+[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) exposes OAuth-based subscription CLIs (Claude Code, Codex, Grok, Antigravity, Kimi, Devin, Meta) behind OpenAI/Gemini/Anthropic-compatible HTTP APIs.
 
 Enable it with:
 
@@ -10,11 +10,11 @@ Enable it with:
 }
 ```
 
-The service runs as a dedicated `cliproxyapi` user and keeps its configuration and OAuth tokens under `/var/lib/cliproxyapi`.
+The service runs as a dedicated `cliproxyapi` user and keeps its configuration and OAuth tokens under `/var/lib/cliproxyapi`. The configuration file is regenerated from [](#opt-services.cliproxyapi.settings) at startup, which overwrites any changes made through the management API.
 
 ## Authentication {#module-services-cliproxyapi-authentication}
 
-Provider logins use OAuth and must land in the service's `auth-dir` (`/var/lib/cliproxyapi`), which is owned by the `cliproxyapi` user. Either of the approaches below writes the token with the correct ownership, and the running service picks it up without a restart.
+Provider logins use OAuth and must land in the service's `oauth.auth-dir` (`/var/lib/cliproxyapi`), which is owned by the `cliproxyapi` user. Either of the approaches below writes the token with the correct ownership, and the running service picks it up without a restart.
 
 ### Management API {#module-services-cliproxyapi-authentication-management-api}
 
@@ -22,19 +22,31 @@ Set a management key in [](#opt-services.cliproxyapi.settings):
 
 ```nix
 {
-  services.cliproxyapi.settings.remote-management.secret-key._secret =
-    "/run/secrets/cliproxyapi-mgmt-key";
+  services.cliproxyapi.settings.management.secret-key._secret = "/run/secrets/cliproxyapi-mgmt-key";
 }
 ```
 
-Then request an authentication URL for the desired provider and open it in a browser:
+Request a login URL and open it in a browser:
 
 ```bash
 curl -H "Authorization: Bearer <management-key>" \
-  http://127.0.0.1:8317/v0/management/anthropic-auth-url
+  "http://127.0.0.1:8317/v8/management/oauth/auth-url?provider=claude"
 ```
 
-The daemon completes the OAuth flow itself and stores the token in its `auth-dir`. Authentication endpoints are available for the `anthropic`, `codex`, `xai`, `antigravity`, and `kimi` providers.
+Other values for `provider` are `codex`, `antigravity`, `kimi`, `kimi-ai`, `xai`, `devin` and `meta`. `kimi`, `kimi-ai`, `xai` and `meta` use a device code, so the login finishes once it is approved in the browser.
+
+For `claude`, `codex` and `antigravity`, the browser ends up on a `localhost` page that fails to load. Send that URL to the daemon to finish the login:
+
+```bash
+curl -H "Authorization: Bearer <management-key>" \
+  -H "Content-Type: application/json" \
+  -d '{"redirect_url": "<url>"}' \
+  http://127.0.0.1:8317/v8/management/oauth/callback
+```
+
+Alternatively, add `is_webui=true` to the login URL request, and the daemon will listen on the callback port and finish the login itself.
+
+To check on a login, query `/v8/management/oauth/status?state=<state>` with the `state` from the login URL response. It returns `wait` while the login is pending, `ok` once the token is saved and `error` if it failed.
 
 ### Command-line login {#module-services-cliproxyapi-authentication-cli}
 
@@ -52,4 +64,4 @@ Then run the login as the service user, pointing at the managed configuration:
 sudo -u cliproxyapi cliproxyapi -config /var/lib/cliproxyapi/config.yaml --claude-login
 ```
 
-Other providers use their matching flags, for example `--codex-login` or `--xai-login`. On a headless host, pass `-no-browser` to print the OAuth URL instead of launching a browser.
+Other providers have their own flags, such as `--codex-login` or `--xai-login`; see `cliproxyapi -help`. On a headless host, add `-no-browser` to print the login URL. The Claude, Codex, Antigravity and Devin logins then ask you to paste the `localhost` URL you were redirected to.

nixos/modules/services/misc/cliproxyapi.nix

@@ -10,14 +10,9 @@ let
   format = pkgs.formats.yaml { };
   stateDir = "/var/lib/cliproxyapi";
   configPath = "${stateDir}/config.yaml";
-  settings = {
-    auth-dir = stateDir;
-  }
-  // cfg.settings;
   secretsReplacement = utils.genJqSecretsReplacement {
     loadCredential = true;
-  } settings configPath;
-  port = cfg.settings.port or 8317;
+  } cfg.settings configPath;
 in
 {
   options.services.cliproxyapi = {
@@ -26,14 +21,30 @@ in
     package = lib.mkPackageOption pkgs "cliproxyapi" { };
 
     settings = lib.mkOption {
-      type = format.type;
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          server.port = lib.mkOption {
+            type = lib.types.port;
+            default = 8317;
+            description = "Port on which CLIProxyAPI listens.";
+          };
+          oauth.auth-dir = lib.mkOption {
+            type = lib.types.str;
+            default = stateDir;
+            description = "Directory where OAuth tokens are stored.";
+          };
+        };
+      };
       default = { };
       example = lib.literalExpression ''
         {
-          host = "127.0.0.1";
-          port = 8317;
-          api-keys = [ { _secret = "/run/secrets/cliproxyapi-api-key"; } ];
-          remote-management.secret-key._secret = "/run/secrets/cliproxyapi-management-key";
+          server = {
+            host = "127.0.0.1";
+            port = 8317;
+          };
+          access.api-keys = [ { _secret = "/run/secrets/cliproxyapi-api-key"; } ];
+          management.secret-key._secret = "/run/secrets/cliproxyapi-management-key";
         }
       '';
       description = ''
@@ -54,7 +65,7 @@ in
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Whether to open the firewall for the specified port.";
+      description = "Whether to open the firewall for {option}`services.cliproxyapi.settings.server.port`.";
     };
 
     user = lib.mkOption {
@@ -142,7 +153,7 @@ in
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ port ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
   };
 

nixos/modules/services/monitoring/prometheus/default.nix

@@ -113,20 +113,7 @@ let
   filterAttrsListRecursive =
     pred: x:
     if isAttrs x then
-      listToAttrs (
-        concatMap (
-          name:
-          let
-            v = x.${name};
-          in
-          if pred name v then
-            [
-              (nameValuePair name (filterAttrsListRecursive pred v))
-            ]
-          else
-            [ ]
-        ) (attrNames x)
-      )
+      mapAttrs (_: filterAttrsListRecursive pred) (filterAttrs pred x)
     else if isList x then
       map (filterAttrsListRecursive pred) x
     else

nixos/modules/services/monitoring/telegraf.nix

@@ -11,6 +11,10 @@ let
   configFile = settingsFormat.generate "config.toml" cfg.extraConfig;
 in
 {
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
+  };
+
   ###### interface
   options = {
     services.telegraf = {

nixos/modules/services/networking/cgit.nix

@@ -21,8 +21,6 @@ let
       (listOf settingType)
     ];
 
-  genAttrs' = names: f: lib.listToAttrs (map f names);
-
   regexEscape =
     let
       # taken from https://github.com/python/cpython/blob/05cb728d68a278d11466f9a6c8258d914135c96c/Lib/re.py#L251-L266
@@ -300,7 +298,7 @@ in
       lib.mapAttrsToList (name: cfg: {
         ${cfg.nginx.virtualHost} = {
           locations =
-            (genAttrs' [ "cgit.css" "cgit.js" "cgit.png" "favicon.ico" "robots.txt" ] (
+            (lib.genAttrs' [ "cgit.css" "cgit.js" "cgit.png" "favicon.ico" "robots.txt" ] (
               fileName:
               lib.nameValuePair "= ${stripLocation cfg}/${fileName}" {
                 alias = lib.mkDefault "${cfg.package}/cgit/${fileName}";

nixos/modules/services/networking/cloudflare-ddns.nix

@@ -7,7 +7,6 @@
 let
   cfg = config.services.cloudflare-ddns;
 
-  boolToString = b: if b then "true" else "false";
   formatList = l: lib.concatStringsSep "," l;
 in
 {
@@ -265,7 +264,7 @@ in
           let
             toEnv = name: value: "${name}=\"${toString value}\"";
             toEnvList = name: value: "${name}=\"${formatList value}\"";
-            toEnvBool = name: value: "${name}=\"${boolToString value}\"";
+            toEnvBool = name: value: "${name}=\"${lib.boolToString value}\"";
             toEnvMaybe =
               pred: name: value:
               lib.optionalString pred (toEnv name value);

nixos/modules/services/networking/iscsi/initiator.nix

@@ -20,6 +20,24 @@ in
       default = null;
       description = "Portal to discover targets on";
     };
+
+    discoverType = mkOption {
+      description = ''
+        Target discovery type.
+        Change this if you want to discover your targes via an iSNS server
+        or use the targets provided via firmware settings.
+        See {manpage}`iscsiadm(8)`.
+      '';
+      default = "sendtargets";
+      example = "sendtargets";
+      type = enum [
+        "st"
+        "sendtargets"
+        "isns"
+        "fw"
+      ];
+    };
+
     name = mkOption {
       type = str;
       description = "Name of this iscsi initiator";
@@ -81,7 +99,7 @@ in
       wantedBy = [ "remote-fs.target" ];
       serviceConfig.ExecStartPre =
         mkIf (cfg.discoverPortal != null)
-          "${cfg.package}/bin/iscsiadm --mode discoverydb --type sendtargets --portal ${escapeShellArg cfg.discoverPortal} --discover";
+          "${cfg.package}/bin/iscsiadm --mode discoverydb --type ${cfg.discoverType} --portal ${escapeShellArg cfg.discoverPortal} --discover";
     };
 
     environment.systemPackages = [ cfg.package ];

nixos/modules/services/networking/iscsi/root-initiator.nix

@@ -43,6 +43,23 @@ in
       type = nullOr str;
     };
 
+    discoverType = mkOption {
+      description = ''
+        Target discovery type.
+        Change this if you want to discover your targes via an iSNS server
+        or use the targets provided via firmware settings.
+        See {manpage}`iscsiadm(8)`.
+      '';
+      default = "sendtargets";
+      example = "sendtargets";
+      type = enum [
+        "st"
+        "sendtargets"
+        "isns"
+        "fw"
+      ];
+    };
+
     target = mkOption {
       description = ''
         Name of the iSCSI target to boot from.
@@ -168,7 +185,7 @@ in
 
           iscsid --foreground --no-pid-file --debug ${toString cfg.logLevel} &
           iscsiadm --mode discoverydb \
-            --type sendtargets \
+            --type ${cfg.discoverType} \
             --discover \
             --portal ${escapeShellArg cfg.discoverPortal} \
             --debug ${toString cfg.logLevel}

nixos/modules/services/networking/rpcbind.nix

@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 {
 
   ###### interface
@@ -15,8 +13,8 @@ with lib;
 
     services.rpcbind = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -32,29 +30,34 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.rpcbind.enable {
-    environment.systemPackages = [ pkgs.rpcbind ];
+  config = lib.mkMerge [
+    (lib.mkIf config.services.rpcbind.enable {
+      environment.systemPackages = [ pkgs.rpcbind ];
 
-    systemd.packages = [ pkgs.rpcbind ];
+      systemd.packages = [ pkgs.rpcbind ];
 
-    systemd.services.rpcbind = {
-      wantedBy = [ "multi-user.target" ];
-      # rpcbind performs a check for /var/run/rpcbind.lock at startup
-      # and will crash if /var/run isn't present. In the stock NixOS
-      # var.conf tmpfiles configuration file, /var/run is symlinked to
-      # /run, so rpcbind can enter a race condition in which /var/run
-      # isn't symlinked yet but tries to interact with the path, so
-      # controlling the order explicitly here ensures that rpcbind can
-      # start successfully. The `wants` instead of `requires` should
-      # avoid creating a strict/brittle dependency.
-      wants = [ "systemd-tmpfiles-setup.service" ];
-      after = [ "systemd-tmpfiles-setup.service" ];
-    };
+      systemd.services.rpcbind = {
+        wantedBy = [ "multi-user.target" ];
+        # rpcbind performs a check for /var/run/rpcbind.lock at startup
+        # and will crash if /var/run isn't present. In the stock NixOS
+        # var.conf tmpfiles configuration file, /var/run is symlinked to
+        # /run, so rpcbind can enter a race condition in which /var/run
+        # isn't symlinked yet but tries to interact with the path, so
+        # controlling the order explicitly here ensures that rpcbind can
+        # start successfully. The `wants` instead of `requires` should
+        # avoid creating a strict/brittle dependency.
+        wants = [ "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];
+      };
+    })
 
-    users.users.rpc = {
-      group = "nogroup";
-      uid = config.ids.uids.rpc;
-    };
-  };
+    {
+      users.users.rpc = {
+        enable = config.services.rpcbind.enable;
+        group = "nogroup";
+        uid = config.ids.uids.rpc;
+      };
+    }
+  ];
 
 }

nixos/modules/services/networking/strongswan-swanctl/param-lib.nix

@@ -85,12 +85,10 @@ rec {
             else
               f (path ++ [ name ]) name value;
         in
-        mapAttrs'' g set;
+        concatMapAttrs g set;
     in
     recurse [ ] set;
 
-  mapAttrs'' = f: set: foldl' (a: b: a // b) { } (mapAttrsToList f set);
-
   # Extract the options from the given set of parameters.
   paramsToOptions = ps: mapParamsRecursive (_path: name: param: { ${name} = param.option; }) ps;
 

nixos/modules/services/search/manticore.nix

@@ -16,10 +16,6 @@ let
     }:
     attrsOfAttrs:
     let
-      # map function to string for each key val
-      mapAttrsToStringsSep =
-        sep: mapFn: attrs:
-        lib.concatStringsSep sep (lib.mapAttrsToList mapFn attrs);
       mkSection =
         sectName: sectValues:
         ''
@@ -29,7 +25,7 @@ let
         + "}";
     in
     # map input to ini sections
-    mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
+    lib.concatMapAttrsStringSep "\n" mkSection attrsOfAttrs;
 
   configFile = pkgs.writeText "manticore.conf" (
     toSphinx {

nixos/modules/services/web-apps/akkoma.nix

@@ -1167,17 +1167,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
           cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
+        '';
+      }
+    ];
     warnings =
       optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
         [

nixos/modules/system/boot/stratisroot.nix

@@ -34,6 +34,7 @@ in
           thin_repair = "${pkgs."thin-provisioning-tools"}/bin/thin_repair";
           thin_metadata_size = "${pkgs."thin-provisioning-tools"}/bin/thin_metadata_size";
           stratis-min = "${pkgs.stratisd}/bin/stratis-min";
+          cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
         };
         services = lib.attrsets.mapAttrs' (mountPoint: fileSystem: {
           name = "stratis-setup-${fileSystem.stratis.poolUuid}";

nixos/modules/virtualisation/qemu-vm.nix

@@ -337,7 +337,7 @@ let
             ${if share.writable then "--writeback" else "--readonly"} \
             --sandbox=none \
             --seccomp=none \
-            --cache=always \
+            --cache=${share.cache} \
             --no-announce-submounts \
             --translate-uid=host:65534:0:1 \
             --translate-gid=host:65534:0:1 \
@@ -595,6 +595,23 @@ in
           options.writable = lib.mkEnableOption "" // {
             description = "Whether the directory is writable on the host and guest.";
           };
+          options.cache = mkOption {
+            type = types.enum [
+              "auto"
+              "always"
+              "metadata"
+              "never"
+            ];
+            default = "auto";
+            description = ''
+              Cache policy for the virtiofs daemon.
+
+              For details refer to the [virtiofsd documentation](https://virtio-fs.gitlab.io/virtiofsd/doc/virtiofsd/passthrough/enum.CachePolicy.html).
+
+              Effective on Linux hosts only.
+              Ignored when using VirtFS (9P) (the default on non-Linux hosts).
+            '';
+          };
         }
       );
       default = { };
@@ -1238,6 +1255,7 @@ in
         # Always mount this to /nix/.ro-store because we never want to actually
         # write to the host Nix Store.
         target = "/nix/.ro-store";
+        cache = mkIf useVirtiofs "always";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';

nixos/tests/all-tests.nix

@@ -1572,6 +1572,7 @@ in
   qemu-firmware = runTestOn [ "x86_64-linux" ] ./qemu-firmware.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
+  qemu-vm-shared-directories = runTest ./qemu-vm-shared-directories.nix;
   qemu-vm-store = runTest ./qemu-vm-store.nix;
   qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   qgis = handleTest ./qgis.nix { package = pkgs.qgis; };

nixos/tests/cliproxyapi.nix

@@ -10,9 +10,11 @@
       services.cliproxyapi = {
         enable = true;
         settings = {
-          host = "127.0.0.1";
-          port = 8317;
-          api-keys = [ { _secret = "/etc/cliproxyapi-api-key"; } ];
+          server = {
+            host = "127.0.0.1";
+            port = 8317;
+          };
+          access.api-keys = [ { _secret = "/etc/cliproxyapi-api-key"; } ];
         };
       };
 

nixos/tests/installer.nix

@@ -1861,7 +1861,7 @@ in
     createPartitions = ''
       installer.succeed(
         "sgdisk --zap-all /dev/vda",
-        "sgdisk --new=1:0:+100M --typecode=0:ef00 /dev/vda", # /boot
+        "sgdisk --new=1:0:+200M --typecode=0:ef00 /dev/vda", # /boot
         "sgdisk --new=2:0:+1G --typecode=0:8200 /dev/vda", # swap
         "sgdisk --new=3:0:+5G --typecode=0:8300 /dev/vda", # /
         "udevadm settle",

nixos/tests/linux-builder-vz-store-gc.nix

@@ -1,12 +1,15 @@
-{ lib, ... }:
+{ hostPkgs, lib, ... }:
 
 {
   # Strictly speaking, this is not a precise test for VZ builder, but we don't
   # have vzvm backend for nixos tests, so we use qemu here, with config that
   # matches linux-builder-vz disk layout.
   name = "linux-builder-vz-store-gc";
+  meta.maintainers = hostPkgs.darwin.linux-builder-vz.meta.maintainers;
 
   nodes.machine = {
+    nix.enable = true;
+
     virtualisation = {
       # Match the vz-vm drive order: the read-only store image is /dev/vda,
       # followed by the writable data disk at /dev/vdb.

nixos/tests/qemu-vm-shared-directories.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  name = "qemu-vm-shared-directories";
+
+  meta.maintainers = with lib.maintainers; [
+    fricklerhandwerk
+  ];
+
+  meta.platforms = lib.platforms.linux;
+
+  nodes = lib.listToAttrs (
+    map
+      (policy: {
+        name = policy;
+        value.virtualisation.sharedDirectories.test = {
+          source = "/tmp/${policy}";
+          target = "/mnt/test";
+          cache = policy;
+          writable = true;
+        };
+      })
+      [
+        "never"
+        "metadata"
+        "auto"
+        "always"
+      ]
+  );
+
+  testScript = ''
+    import os
+
+    for policy in ${with builtins; toJSON (attrNames config.nodes)}:
+        os.makedirs(f"/tmp/{policy}", exist_ok=True)
+        with open(f"/tmp/{policy}/hello.txt", "w") as f:
+            f.write("before")
+
+    start_all()
+
+    for machine, policy in [${
+      lib.concatMapStringsSep ", " (p: ''(${p}, "${p}")'') (builtins.attrNames config.nodes)
+    }]:
+        with subtest(f"cache={policy} propagates host file changes to the guest as expected"):
+            machine.succeed("grep before /mnt/test/hello.txt")
+            with open(f"/tmp/{policy}/hello.txt", "w") as f:
+                f.write("after")
+            if policy == "always":
+                always.succeed("grep before /mnt/test/hello.txt")
+            else:
+                machine.succeed("grep after /mnt/test/hello.txt")
+  '';
+}

nixos/tests/telegraf.nix

@@ -1,8 +1,8 @@
 { pkgs, ... }:
 {
   name = "telegraf";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mic92 ];
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
   };
 
   containers.machine =

pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el

@@ -9,25 +9,7 @@
 
 ;; Try to make tests cause no side-effects.
 
-;;;; Tests that can be run in a batch Emacs
-
-(ert-deftest with-packages-requested-packages-are-available ()
-  (should (package-installed-p 'dash))
-  (should (package-installed-p 'flx-ido)))
-
-(ert-deftest with-packages-deps-of-requested-packages-are-available ()
-  "Test https://github.com/NixOS/nixpkgs/issues/388829."
-  (should (package-installed-p 'flx))
-  (should (package-installed-p 'flx-ido)))
-
-(ert-deftest with-packages-info-manual-of-requested-packages-is-available ()
-  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
-  ;; `package-activate-all' makes package info manuals available.
-  ;; It is called at startup normally, but not in batch mode.
-  ;; We call it if needed to emulate the "normal" case.
-  (unless package--activated
-    (package-activate-all))
-  (should (Info-find-file "dash" t)))
+;;;; Utils
 
 (defun with-packages--nix-store-dir ()
   "Return nix store dir.
@@ -56,6 +38,36 @@ which is generated by nix when building this elisp package."
   "Locate the natively-compiled LIBRARY file."
   (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
 
+(defun with-packages-unwrapped-site-start-is-loaded ()
+  (fboundp 'nix--profile-paths))
+
+(defun with-packages-eval-in-sub-emacs (form)
+  "Evaluate FORM in a subprocess Emacs and return its result."
+  (pcase-exhaustive
+      (process-lines "emacs" "--batch"
+                     "--eval" (format "(prin1 %S)" form))
+    (`(,result) (read result))))
+
+;;;; Tests that can be run in a batch Emacs
+
+(ert-deftest with-packages-requested-packages-are-available ()
+  (should (package-installed-p 'dash))
+  (should (package-installed-p 'flx-ido)))
+
+(ert-deftest with-packages-deps-of-requested-packages-are-available ()
+  "Test https://github.com/NixOS/nixpkgs/issues/388829."
+  (should (package-installed-p 'flx))
+  (should (package-installed-p 'flx-ido)))
+
+(ert-deftest with-packages-info-manual-of-requested-packages-is-available ()
+  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
+  ;; `package-activate-all' makes package info manuals available.
+  ;; It is called at startup normally, but not in batch mode.
+  ;; We call it if needed to emulate the "normal" case.
+  (unless package--activated
+    (package-activate-all))
+  (should (Info-find-file "dash" t)))
+
 (ert-deftest with-packages-aot-native-comp-eln-files-are-available ()
   (skip-unless (native-comp-available-p))
   (ert-info ("search eln files of Emacs proper")
@@ -63,14 +75,27 @@ which is generated by nix when building this elisp package."
   (ert-info ("search eln files of requested packages")
     (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "dash")))))
 
-(defun with-packages-unwrapped-site-start-is-loaded ()
-  (fboundp 'nix--profile-paths))
-
 (ert-deftest with-packages-unwrapped-site-start-is-loaded ()
   (should (with-packages-unwrapped-site-start-is-loaded)))
 
-(ert-deftest with-packages-bin-dirs-of-requested-packages-are-added-to-exec-path ()
-  (should (executable-find "cowsay")))
+(ert-deftest with-packages-binaries-of-requested-packages-are-available ()
+  (ert-info ("find binary via PATH")
+    (should (equal (call-process-shell-command "cowsay") 0)))
+  (ert-info ("find binary via exec-path")
+    (should (executable-find "cowsay")))
+  (ert-info ("each item is unique")
+    (cl-flet ((item-should-be-unique (items)
+                (should (equal items
+                               (cl-remove-duplicates items :test #'string=)))))
+      (ert-info ("PATH of this Emacs")
+        (item-should-be-unique (parse-colon-path (getenv "PATH"))))
+      (ert-info ("PATH of sub-Emacs")
+        (item-should-be-unique
+         (parse-colon-path (with-packages-eval-in-sub-emacs '(getenv "PATH")))))
+      (ert-info ("exec-path of this Emacs")
+        (item-should-be-unique exec-path))
+      (ert-info ("exec-path of sub-Emacs")
+        (item-should-be-unique (with-packages-eval-in-sub-emacs 'exec-path))))))
 
 (ert-deftest with-packages-tree-sitter-dir-is-added-to-treesit-extra-load-path ()
   (skip-unless (treesit-available-p))

pkgs/applications/editors/emacs/build-support/wrapper.nix

@@ -171,16 +171,6 @@ runCommand (lib.appendToName "with-packages" emacs).name
           cat >"$siteStart" <<EOF
           ;;; -*- lexical-binding: t -*-
           (load "$emacs/share/emacs/site-lisp/site-start" nil t)
-          ;; "$out/share/emacs/site-lisp" is added to load-path in wrapper.sh
-          ;; "$out/share/emacs/native-lisp" is added to native-comp-eln-load-path in wrapper.sh
-          (add-to-list 'exec-path "$out/bin")
-          ;; Also expose extra package binaries via PATH so that subprocesses
-          ;; which rebuild their environment from PATH (e.g. direnv/envrc) can
-          ;; still find them. See https://github.com/purcell/envrc/issues/9
-          (let ((deps-bin "$out/bin")
-                (current-path (or (getenv "PATH") "")))
-            (unless (member deps-bin (split-string current-path path-separator))
-              (setenv "PATH" (concat deps-bin path-separator current-path))))
           ${lib.optionalString withTreeSitter ''
             (add-to-list 'treesit-extra-load-path "$out/lib/")
           ''}
@@ -220,6 +210,7 @@ runCommand (lib.appendToName "with-packages" emacs).name
         --subst-var-by bash ${emacs.stdenv.shell} \
         --subst-var-by wrapperSiteLisp "$deps/share/emacs/site-lisp" \
         --subst-var-by wrapperSiteLispNative "$deps/share/emacs/native-lisp" \
+        --subst-var-by wrapperBinDir "$deps/bin" \
         --subst-var-by wrapperInvocationDirectory "$out/bin/" \
         --subst-var-by wrapperInvocationName "$progname" \
         --subst-var prog
@@ -246,6 +237,7 @@ runCommand (lib.appendToName "with-packages" emacs).name
         --subst-var-by bash ${emacs.stdenv.shell} \
         --subst-var-by wrapperSiteLisp "$deps/share/emacs/site-lisp" \
         --subst-var-by wrapperSiteLispNative "$deps/share/emacs/native-lisp" \
+        --subst-var-by wrapperBinDir "$deps/bin" \
         --subst-var-by wrapperInvocationDirectory "$out/Applications/Emacs.app/Contents/MacOS/" \
         --subst-var-by wrapperInvocationName "Emacs" \
         --subst-var-by prog "$emacs/Applications/Emacs.app/Contents/MacOS/Emacs"

pkgs/applications/editors/emacs/build-support/wrapper.sh

@@ -53,4 +53,9 @@ export emacsWithPackages_siteLispNative=@wrapperSiteLispNative@
 export emacsWithPackages_invocationDirectory=@wrapperInvocationDirectory@
 export emacsWithPackages_invocationName=@wrapperInvocationName@
 
+if [[ ${PATH-} != *"@wrapperBinDir@":* ]]
+then
+    export PATH="@wrapperBinDir@${PATH:+:$PATH}"
+fi
+
 exec @prog@ "$@"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/m2/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  macaulay2,
+}:
+melpaBuild {
+  pname = "m2";
+  ename = "M2";
+
+  version = "1.26.6";
+
+  src = fetchFromGitHub {
+    owner = "Macaulay2";
+    repo = "M2-emacs";
+    rev = "ae882ab04da19f62c62462ef9604251a0b30a9f5";
+    hash = "sha256-8qnPzLR616Oypb6YGUm1cVj8jd1QDdeajHkVaTaEnX4=";
+  };
+
+  postPatch = ''
+    substituteInPlace M2.el \
+      --replace-fail 'defcustom M2-exe "M2"' 'defcustom M2-exe "${lib.getExe macaulay2}"'
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Major mode for editing Macaulay2 source code";
+    homepage = "https://github.com/Macaulay2/M2-emacs";
+    license = lib.licenses.gpl3Plus;
+  };
+}

pkgs/applications/editors/vim/plugins/aliases.nix

@@ -17,16 +17,8 @@ let
   # sets from building on Hydra.
   removeDistribute = alias: if lib.isDerivation alias then lib.dontDistribute alias else alias;
 
-  # Make sure that we are not shadowing something from
-  # all-packages.nix.
-  checkInPkgs =
-    n: alias: if builtins.hasAttr n prev then throw "Alias ${n} is still in vim-plugins" else alias;
-
   mapAliases =
-    aliases:
-    lib.mapAttrs (
-      n: alias: removeDistribute (removeRecurseForDerivations (checkInPkgs n alias))
-    ) aliases;
+    aliases: lib.mapAttrs (_: alias: removeDistribute (removeRecurseForDerivations alias)) aliases;
 
   deprecations = lib.mapAttrs (
     old: info:
@@ -64,7 +56,7 @@ mapAliases (
     playground = throw "'vimPlugins.playground' has been archived"; # Added 2025-12-18
     pure-lua = lib.warnOnInstantiate "Please replace 'vimPlugins.pure-lua' with 'vimPlugins.moonlight-nvim' as this name was an error" moonlight-nvim; # Added 2025-11-17
     registers-nvim = throw "'vimPlugins.registers-nvim' has been removed: the upstream repository got deleted"; # Added 2026-04-30
-    rust-tools-nvim = lib.warnOnInstantiate "'vimPlugins.rust-tools-nvim' is abandoned by upstream; you should use 'vimPlugins.rustaceanvim'" rust-tools-nvim; # Added 2026-02-04
+    rust-tools-nvim = throw "'vimPlugins.rust-tools-nvim' has been removed: abandoned by upstream. Use rustaceanvim"; # Added 2026-09-28
     Spacegray-vim = throw "'vimPlugins.Spacegray-vim' has been removed: abandoned by upstream"; # Added 2025-03-24
     SpaceVim = throw "'vimPlugins.SpaceVim' didn't work properly in vimPlugins, please use top-level 'spacevim' instead"; # Added 2024-11-27
     spacevim = throw "'vimPlugins.spacevim' was unmaintained for the last 6 years, please use top-level 'spacevim'"; # Added 2024-11-27

pkgs/applications/editors/vim/plugins/default.nix

@@ -55,7 +55,14 @@ let
     inherit llvmPackages;
   };
 
-  aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: { };
+  aliases =
+    final: prev:
+    let
+      defined = import ./aliases.nix lib final prev;
+      shadowed = builtins.attrNames (builtins.intersectAttrs prev defined);
+    in
+    assert lib.assertMsg (shadowed == [ ]) "vimPlugins aliases shadow plugins: ${toString shadowed}";
+    lib.optionalAttrs config.allowAliases defined;
 in
 lib.pipe initialPackages [
   (extends plugins)

pkgs/applications/editors/vim/plugins/generated.nix

@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-24";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "12dd0de1f15d598db2cc0d075f4f0d13a3290d4d";
-      hash = "sha256-CwAbTCSjMb85sSNNEFu0Cm09qj55WzNsw/01Yi1itKo=";
+      rev = "411163b2be396495c76788a016cb1354f1e8acd0";
+      hash = "sha256-x+nym6jprfHZSUH8qT+1JHmV/nG66BAhwMENxTah2pI=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1653,12 +1653,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-09-18";
+    version = "0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "91b29a33670e77b3705001804670511a17c0c1dc";
-      hash = "sha256-d3jSfJU0KS0MG0sm6aYJlqRxajwe3rMWlffufrGj1IE=";
+      rev = "7df2bd89295db00b649cbc49bdf6fe5a1cc5df3b";
+      hash = "sha256-LIYAurLRSHnGtDUvxUvIE0PJ1cZ6L0M4nQ+a1H2SgJg=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-22";
+    version = "0.0.82-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "f5910295483bfbe8b58e6f2002e9ae280e5b700e";
-      hash = "sha256-fXxJRSEfj/o/43fd+iADJl7ARYOZd01iLbSYnFHG1Sc=";
+      rev = "eda4d09170fd9bd08dd9abbe300f1f5bcaae0a20";
+      hash = "sha256-4chqsnJIuNyjNN6r7ct48qjQhZfJQRPCKkaWIOOj3/Y=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.25.0";
+    version = "19.26.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.25.0";
-      hash = "sha256-PTvllgZji45JdW1NW9YmRDJqiEvdmbpeB2QGvu10jbM=";
+      tag = "v19.26.0";
+      hash = "sha256-KS3F/h1UCYSsztWKy2RouS89I46+y7uB/qykHJ4lIf0=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";
@@ -5448,12 +5462,12 @@ final: prev: {
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "14.2.1-unstable-2026-05-31";
+    version = "14.2.1-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "808ba31cde89aec8833e9789f5e04557cd31c9e1";
-      hash = "sha256-S9TD5PkHKHoo2jfjOXkQoNtyr/PNtR/eljXB+8PtGU8=";
+      rev = "f7c6fa21e2a7c32576e7a1791774a3736987f467";
+      hash = "sha256-bxlbejtkSwKUQ0+H/+6k83hqUeBq29iHanpVxv7+cZk=";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -6220,12 +6234,12 @@ final: prev: {
 
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
-    version = "3.0.1";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "nvim-flutter";
       repo = "flutter-tools.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-rdwusVC1/1FTY3dTLkjZ6d1pjubt+fBgRZexih7ClsM=";
+      tag = "v3.1.0";
+      hash = "sha256-eJPZSO7ioKULD66n5A7Yb6lpKQft+p3R4h4AriybA0s=";
     };
     meta.homepage = "https://github.com/nvim-flutter/flutter-tools.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6473,12 +6487,12 @@ final: prev: {
 
   fzf-vim = buildVimPlugin {
     pname = "fzf.vim";
-    version = "0-unstable-2026-09-07";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "8a0068127ac9ee23d71dab2944ce995726bef462";
-      hash = "sha256-nv/C0UMpVLzu0mYODVnByMkWnNlILdoqkl4KkLGSfjk=";
+      rev = "a630ef91e1e050574e703f506cd0812b18d26939";
+      hash = "sha256-QgHHnwpchIyP3H8cP3aMHjXcOm6cCsVDwo/uOzYZAtQ=";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8323,12 +8337,13 @@ final: prev: {
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
     version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
     meta.license = unfree;
     meta.hydraPlatforms = [ ];
   };
@@ -8783,11 +8798,11 @@ final: prev: {
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "0-unstable-2026-09-19";
+    version = "0-unstable-2026-09-27";
     src = fetchgit {
       url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "32bde2e932417e8a065f039f00f0cebdd0da4710";
-      hash = "sha256-SXtPDUdu5cju3CQW64Pi21Ry4Swlbki5Qjwb5bizJnA=";
+      rev = "277e04fad21e3af05a55cc414757b09a704f2a92";
+      hash = "sha256-Yd64QLzeKWcfJEWkvr9944aKPkgNmlsN/OpARVFRBes=";
     };
     meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
     meta.license = unfree;
@@ -10714,12 +10729,12 @@ final: prev: {
 
   modus-themes-nvim = buildVimPlugin {
     pname = "modus-themes.nvim";
-    version = "1.4.4";
+    version = "1.6.0";
     src = fetchFromGitHub {
       owner = "miikanissi";
       repo = "modus-themes.nvim";
-      tag = "v1.4.4";
-      hash = "sha256-j10BCRHN6cTDx1+zBxgo6drtA9XoZAqaZg+1uTDQH4M=";
+      tag = "v1.6.0";
+      hash = "sha256-/HWmToZL9HnAYCjVNfpIu5IX21O+nuCzweqbah8pA/A=";
     };
     meta.homepage = "https://github.com/miikanissi/modus-themes.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -11218,12 +11233,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-24";
+    version = "1.4.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "03fad132dfb3f8a61b55b4731ee62d6fa7db9f2f";
-      hash = "sha256-JVprbeJUCAIXMw8vS5CW5qz0jR2DL5G/Fc9nYEfdUcM=";
+      rev = "4b39a6d9f2d3d481225eedcf85d04506e2cb997e";
+      hash = "sha256-iTBInA4dtl6aMioAxY2paZqV97jPYyi8hXX1N7SVkYY=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11302,12 +11317,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-08-22";
+    version = "3.0.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "5adc81b26232954cd7a90f158aa7844c18fc3165";
-      hash = "sha256-s0yrtTweFrrUsxVjLjr+1uNHTlhcxGI7JUvOkrpt13g=";
+      rev = "c51a1dc7e0e0f40c4c396a2b1ceaa44b44e96032";
+      hash = "sha256-ZAchwF5J+ftB5pk2Z+gBaNpNWMmT6wh/cf+z51vO6g0=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12102,12 +12117,12 @@ final: prev: {
 
   nfnl = buildVimPlugin {
     pname = "nfnl";
-    version = "1.4.0-unstable-2026-08-14";
+    version = "1.4.0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Olical";
       repo = "nfnl";
-      rev = "a4c47a1e7e52aaf234b358f73135acf783054e35";
-      hash = "sha256-AVxppifATGlZqtyOTuD6Ral4DcvVisbu1MAjdMlaExs=";
+      rev = "abf41f588ee6e3612816ec70402a4b182ddbbd51";
+      hash = "sha256-kx2Gto4x5fvEEhJ/oRcyJxDzePyAe4mH0zGXu0Qbd6M=";
     };
     meta.homepage = "https://github.com/Olical/nfnl/";
     meta.license = getLicenseFromSpdxId "Unlicense";
@@ -12283,12 +12298,12 @@ final: prev: {
 
   no-neck-pain-nvim = buildVimPlugin {
     pname = "no-neck-pain.nvim";
-    version = "3.0.1";
+    version = "3.0.4";
     src = fetchFromGitHub {
       owner = "shortcuts";
       repo = "no-neck-pain.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-RUCBdraqR1M9iYIXR8Rwp/9jj2gSPSzucAUJi5aYEUU=";
+      tag = "v3.0.4";
+      hash = "sha256-QR4gLwkv1/DLxhoOGiqXfAzeRrjNQDioUaKrGPy5ffY=";
     };
     meta.homepage = "https://github.com/shortcuts/no-neck-pain.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12437,12 +12452,12 @@ final: prev: {
 
   numb-nvim = buildVimPlugin {
     pname = "numb.nvim";
-    version = "1.2.1";
+    version = "1.3.0";
     src = fetchFromGitHub {
       owner = "nacro90";
       repo = "numb.nvim";
-      tag = "v1.2.1";
-      hash = "sha256-HlMAZhrM+HnMDwBqXhEjD26y0hkWq6orNDDuUMO0KGM=";
+      tag = "v1.3.0";
+      hash = "sha256-+3QZ4rjkDKdOGd1ck4U4oe4vHq2HTQyS7uuiqIlrrsA=";
     };
     meta.homepage = "https://github.com/nacro90/numb.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13327,12 +13342,12 @@ final: prev: {
 
   nvim-lsp-file-operations = buildVimPlugin {
     pname = "nvim-lsp-file-operations";
-    version = "1.0.0";
+    version = "1.1.0";
     src = fetchFromGitHub {
       owner = "antosha417";
       repo = "nvim-lsp-file-operations";
-      tag = "v1.0.0";
-      hash = "sha256-FObv42EGkIao2Rmq9CG+G4JsntO+00CFNaNIXc7IK7A=";
+      tag = "v1.1.0";
+      hash = "sha256-8wEIGdxMvnlXhQcqKBl0AwINGzfJr5DiLwaOggrQBR8=";
     };
     meta.homepage = "https://github.com/antosha417/nvim-lsp-file-operations/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -13971,12 +13986,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-19";
+    version = "0.10.0-unstable-2026-09-27";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "f603a2f4da48728f80257fb5fbb90145fd1dc173";
-      hash = "sha256-fXBJhWvjzBGivIiAys9oy2JB9h99CNIk+AdGkGgHgPg=";
+      rev = "728e031f6b11d03d1f0708b7dc4fb0f1d9c8a137";
+      hash = "sha256-z6e3Dvp8TQDjTRglfVq0B+7Ejozwnw/zSvpGuSy6rbY=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14377,12 +14392,12 @@ final: prev: {
 
   obsidian-nvim = buildVimPlugin {
     pname = "obsidian.nvim";
-    version = "3.16.7";
+    version = "3.16.8";
     src = fetchFromGitHub {
       owner = "obsidian-nvim";
       repo = "obsidian.nvim";
-      tag = "v3.16.7";
-      hash = "sha256-aOq0cg86hHgK4M/D1YCCyPNVusmsifUtxfAT9avhu7w=";
+      tag = "v3.16.8";
+      hash = "sha256-VQBopv4Lwjie5KyGD/n16V5fKmfn/PPRNBhoQ9E8/vI=";
     };
     meta.homepage = "https://github.com/obsidian-nvim/obsidian.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15807,12 +15822,12 @@ final: prev: {
 
   remember-nvim = buildVimPlugin {
     pname = "remember.nvim";
-    version = "1.5.1";
+    version = "1.5.2";
     src = fetchFromGitHub {
       owner = "vladdoster";
       repo = "remember.nvim";
-      tag = "v1.5.1";
-      hash = "sha256-kJABTjY6p+wFlNZ9VLmK5LvusHcbD/0aaZP6yOpR1Zc=";
+      tag = "v1.5.2";
+      hash = "sha256-qZnSzOr6ImGZ6uiV4GQCQGUPsSxYHdjHlAlAjMz83sE=";
     };
     meta.homepage = "https://github.com/vladdoster/remember.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16071,20 +16086,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  rust-tools-nvim = buildVimPlugin {
-    pname = "rust-tools.nvim";
-    version = "0-unstable-2024-01-03";
-    src = fetchFromGitHub {
-      owner = "simrat39";
-      repo = "rust-tools.nvim";
-      rev = "676187908a1ce35ffcd727c654ed68d851299d3e";
-      hash = "sha256-kFane5ze7VDiOzF7jdmXkr50XQsNvdb+a9HQtybEVE0=";
-    };
-    meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   rust-vim = buildVimPlugin {
     pname = "rust.vim";
     version = "0-unstable-2022-11-27";
@@ -16564,12 +16565,12 @@ final: prev: {
 
   smear-cursor-nvim = buildVimPlugin {
     pname = "smear-cursor.nvim";
-    version = "0.6.1";
+    version = "0.6.2";
     src = fetchFromGitHub {
       owner = "sphamba";
       repo = "smear-cursor.nvim";
-      tag = "v0.6.1";
-      hash = "sha256-OVdgXkaj498iejXDuX00E9aAKCJuqb45oTUQh0+UOfU=";
+      tag = "v0.6.2";
+      hash = "sha256-PI83Zvgx90Fvd52Ng1pmB1kL7SGIkq7R/T1awCUqKdY=";
     };
     meta.homepage = "https://github.com/sphamba/smear-cursor.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -20857,12 +20858,12 @@ final: prev: {
 
   vim-emoji = buildVimPlugin {
     pname = "vim-emoji";
-    version = "0-unstable-2018-01-30";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-emoji";
-      rev = "9ed6515401a6e20a9781ba508db7d67a5e4e231f";
-      hash = "sha256-3gdd2lFAMKJTqV9IV3CL7809RLkITa0Wi91dcMqvfC8=";
+      rev = "72c8bc4fe1a3a27e7a488a897b141599a6a7f385";
+      hash = "sha256-AMgSBJXk2PfRFoLH93Cpi73FzpMF7A7lTfDsQRToJtE=";
     };
     meta.homepage = "https://github.com/junegunn/vim-emoji/";
     meta.license = unfree;
@@ -24330,12 +24331,12 @@ final: prev: {
 
   vim-spirv = buildVimPlugin {
     pname = "vim-spirv";
-    version = "0.5.2-unstable-2026-09-19";
+    version = "0.5.2-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "kbenzie";
       repo = "vim-spirv";
-      rev = "5b199dcd521795cf78f50574e8f5ec3b8bcc6c10";
-      hash = "sha256-9kdpolFI57NFcuHiX5FJvspDsUylO0YtXDewYPSsCCI=";
+      rev = "8543d5adb87eb173ec2dee6bb1ad6dbb011741c4";
+      hash = "sha256-AExOpjZ+aoGl8RxR+2mlPKjLJtpyKH8MrL1KIviMD1s=";
     };
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26235,12 +26236,12 @@ final: prev: {
 
   yazi-nvim = buildVimPlugin {
     pname = "yazi.nvim";
-    version = "14.0.0";
+    version = "14.0.2";
     src = fetchFromGitHub {
       owner = "mikavilpas";
       repo = "yazi.nvim";
-      tag = "v14.0.0";
-      hash = "sha256-aCFCtSu7qD0HhNLS9o/W7vsh3EimQy6QcMtdXLPa5Zc=";
+      tag = "v14.0.2";
+      hash = "sha256-f+ymPNSEBkloZzgnpn6Zq3jkmuhzH8jPrGZB8tfxs78=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/mikavilpas/yazi.nvim/";

pkgs/applications/editors/vim/plugins/non-generated/macaulay2/default.nix

@@ -0,0 +1,47 @@
+{
+  fetchFromGitHub,
+  lib,
+  vimUtils,
+  writableTmpDirAsHomeHook,
+  macaulay2,
+}:
+vimUtils.buildVimPlugin {
+  pname = "macaulay2";
+  inherit (macaulay2) version;
+
+  # we don't need the whole (rather large) repo
+  src = fetchFromGitHub {
+    inherit (macaulay2.src) repo owner tag;
+    rootDir = "M2/Macaulay2/editors/vim";
+    hash = "sha256-F/Vo8tOA/ZRczZJiUHY0Sr3ibRXHBLtqqSYIamqjk18=";
+  };
+
+  postPatch = ''
+    substituteInPlace "ftplugin/m2.vim" \
+      --replace-fail "'M2'" "'${lib.getExe macaulay2}'"
+  '';
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildPhase = ''
+    ${lib.getExe macaulay2} <<EOF
+      needsPackage "Style"
+      generateGrammar("dict/m2.vim.dict", demark_" ")
+      generateGrammar("syntax/m2.vim", demark_" ")
+    EOF
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Syntax highlighting and key mappings to send code to a running Macaulay2 session.";
+    homepage = "https://github.com/Macaulay2/M2/tree/stable/M2/Macaulay2/editors/vim";
+    license =
+      with lib.licenses;
+      OR [
+        publicDomain
+        gpl2Plus
+      ];
+  };
+}

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -786,12 +786,12 @@
     };
     fidl = buildGrammar {
       language = "fidl";
-      version = "0.0.0+rev=0a8910f";
+      version = "0.0.0+rev=3faeeae";
       src = fetchFromGitHub {
         owner = "google";
         repo = "tree-sitter-fidl";
-        rev = "0a8910f293268e27ff554357c229ba172b0eaed2";
-        hash = "sha256-QFAkxQo2w/+OR7nZn9ldBk2yHOd23kzciAcQvIZ5hrY=";
+        rev = "3faeeae0dbe66b54be0086daa0e0af4da44e7d68";
+        hash = "sha256-G2a0NGfMnY4e8WbH7QIiX4kaZ7G2Plzt2KO0HXf6vcQ=";
       };
       meta.homepage = "https://github.com/google/tree-sitter-fidl";
     };
@@ -1725,12 +1725,12 @@
     };
     ledger = buildGrammar {
       language = "ledger";
-      version = "0.0.0+rev=22a1ab8";
+      version = "0.0.0+rev=d5f3973";
       src = fetchFromGitHub {
         owner = "cbarrete";
         repo = "tree-sitter-ledger";
-        rev = "22a1ab8195c1f6e808679f803007756fe7638c6f";
-        hash = "sha256-62xgcEavI5RKi77sbEnx9f3hA4faFeUCw0/uec8Nx3k=";
+        rev = "d5f3973cfe2d42f98819336ce6334ada75b7696f";
+        hash = "sha256-+BgSLNGbtRsQZkw4gBe2K2pcGynDDv8bh9upN3lDPAg=";
       };
       meta.homepage = "https://github.com/cbarrete/tree-sitter-ledger";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=301f669";
+      version = "0.0.0+rev=a094345";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "301f66950622949f630fef9fa758ba69f66cf97a";
-        hash = "sha256-BPRaHi/TqU7s/XsrVz9+1aSfelmesOKr98ynELBgWM0=";
+        rev = "a094345ace46277b23dbcb81a5d8cd972df32183";
+        hash = "sha256-MtLdRTujZ/LOUkzcitgS0k8gIh08E14mWNFSFL61e/w=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -1931,12 +1931,12 @@
     };
     mlir = buildGrammar {
       language = "mlir";
-      version = "0.0.0+rev=eb0541b";
+      version = "0.0.0+rev=d93ac1b";
       src = fetchFromGitHub {
         owner = "artagnon";
         repo = "tree-sitter-mlir";
-        rev = "eb0541bba21c4ebb3661f02332d1f087d72dbc7c";
-        hash = "sha256-QQeii7jaaM0CtrFau50zMFkTsAxI4LhZRinvFYuy1ew=";
+        rev = "d93ac1b150580040d16e183ea8bf9daa7841bcc4";
+        hash = "sha256-yN+NJ1ZuoLKQHN/E9m59Ltv5BPqutxDFe2ZcJjVRwHE=";
       };
       generate = true;
       meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2012,12 +2012,12 @@
     };
     nix = buildGrammar {
       language = "nix";
-      version = "0.0.0+rev=17f290c";
+      version = "0.0.0+rev=a2cd7f4";
       src = fetchFromGitHub {
         owner = "nix-community";
         repo = "tree-sitter-nix";
-        rev = "17f290c8b5104d9aba8a1ba7383a2ca83c3d14c4";
-        hash = "sha256-yWbf/Ms5y3x7qhpu2aGjX0R76Rzg3UH3nehHft2K87w=";
+        rev = "a2cd7f4011c6e5830c0c9af5aa35441b3ddd5fba";
+        hash = "sha256-IOanyzxBlLzlCOmLQa7hn+n1Yyc30upbmeuth7M4VcA=";
       };
       meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
     };
@@ -2070,24 +2070,24 @@
     };
     ocaml = buildGrammar {
       language = "ocaml";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/ocaml";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
     };
     ocaml_interface = buildGrammar {
       language = "ocaml_interface";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/interface";
       passthru.requires = [
@@ -2097,12 +2097,12 @@
     };
     ocamllex = buildGrammar {
       language = "ocamllex";
-      version = "0.0.0+rev=33722b8";
+      version = "0.0.0+rev=64d543e";
       src = fetchFromGitHub {
         owner = "atom-ocaml";
         repo = "tree-sitter-ocamllex";
-        rev = "33722b8be73079946a7c6dd9598e3f57956ed36d";
-        hash = "sha256-mqp/qHr1zWMJinlMJ0HNAKuFUQ4NqQiLzKx0DoN4wGI=";
+        rev = "64d543e98b4092e2efe5d0c93d78ff4db9cbff39";
+        hash = "sha256-11fcvNtvz06HpkCe+Y37y8LhSgta9O5LSIB0sMKzOZg=";
       };
       generate = true;
       meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
@@ -2165,12 +2165,12 @@
     };
     php = buildGrammar {
       language = "php";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php";
       passthru.requires = [
@@ -2180,12 +2180,12 @@
     };
     php_only = buildGrammar {
       language = "php_only";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php_only";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@@ -2214,12 +2214,12 @@
     };
     pkl = buildGrammar {
       language = "pkl";
-      version = "0.0.0+rev=9eaf196";
+      version = "0.0.0+rev=c95d828";
       src = fetchFromGitHub {
         owner = "apple";
         repo = "tree-sitter-pkl";
-        rev = "9eaf196bb1cb9ce862036ed28b188ab6664a2492";
-        hash = "sha256-BG7BLzUOepbhkCI30iCwpw126R7upNDX3wDWp+dvtvs=";
+        rev = "c95d8284940f5e1da2cd0d8f1ee45d7ef9ef75d1";
+        hash = "sha256-dnGqTZ7Kga1sIJkzRSbqkhvIrPJMxOEhHnDKJuLyudM=";
       };
       meta.homepage = "https://github.com/apple/tree-sitter-pkl";
     };
@@ -2325,12 +2325,12 @@
     };
     proto = buildGrammar {
       language = "proto";
-      version = "0.0.0+rev=6c878d1";
+      version = "0.0.0+rev=be5691c";
       src = fetchFromGitHub {
         owner = "coder3101";
         repo = "tree-sitter-proto";
-        rev = "6c878d18628ebbff3474479d2fdd6d8ba1954c3e";
-        hash = "sha256-N7GpIolkFkmVs1wLtx22HZ1+CmeXDSI2J1FmohtnY7M=";
+        rev = "be5691cf82ca284f83e68b9c8cdc4cac5d7fa208";
+        hash = "sha256-AdaEJPzekM5olFNrwqQXXnE1jvI/U2/zDgN8dyZbtnY=";
       };
       meta.homepage = "https://github.com/coder3101/tree-sitter-proto";
     };
@@ -2582,12 +2582,12 @@
     };
     rescript = buildGrammar {
       language = "rescript";
-      version = "0.0.0+rev=19ed8a8";
+      version = "0.0.0+rev=90643a6";
       src = fetchFromGitHub {
         owner = "rescript-lang";
         repo = "tree-sitter-rescript";
-        rev = "19ed8a8e6bcc844b71c37e9edaffc60c77f74d7c";
-        hash = "sha256-mQJSmb9Qy5pFS+nNz4+C7RPs1mpAoxxqbx7seYo8+JI=";
+        rev = "90643a6302057b969c51e1bf235b8ecf1da49232";
+        hash = "sha256-k510+GOLhputcgoo3l8JyoaI9IAtDw+aEKoPjMjRyWI=";
       };
       meta.homepage = "https://github.com/rescript-lang/tree-sitter-rescript";
     };
@@ -2725,12 +2725,12 @@
     };
     scheme = buildGrammar {
       language = "scheme";
-      version = "0.0.0+rev=c6cb7c7";
+      version = "0.0.0+rev=1b112d9";
       src = fetchFromGitHub {
         owner = "6cdh";
         repo = "tree-sitter-scheme";
-        rev = "c6cb7c7d7a04b3f5d999c28e2e9c0c31b2d50ece";
-        hash = "sha256-aFonUd15PJkQmz5lDJthtd1rU+8OXNknHDlgqH2s+OA=";
+        rev = "1b112d9571e4f62fb3d095d52a51f1da7756fb94";
+        hash = "sha256-7bMxrSeJpIIYkD8brP6oIW2F9ePYRsx1l2ZRfx6yGwM=";
       };
       meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
     };
@@ -2984,12 +2984,12 @@
     };
     superhtml = buildGrammar {
       language = "superhtml";
-      version = "0.0.0+rev=23ef2f4";
+      version = "0.0.0+rev=f0deee8";
       src = fetchFromGitHub {
         owner = "kristoff-it";
         repo = "superhtml";
-        rev = "23ef2f44ca0df2d2e05a0be3874370553c5b591d";
-        hash = "sha256-+M8eRsadeIQmW3pWTZ5WprJ1glQ18Pu8AgOeLvrLagY=";
+        rev = "f0deee80ae422938d5cdc43a5598c417670db38b";
+        hash = "sha256-xeM7uPqGVVuAHHwA94TOKrwpLbBH0Ruy2XnZsb35K54=";
       };
       location = "tree-sitter-superhtml";
       meta.homepage = "https://github.com/kristoff-it/superhtml";
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=00bbb0a";
+      version = "0.0.0+rev=187fd4d";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "00bbb0a2550f8bc0023a2a4992922d51ae045626";
-        hash = "sha256-1HZ6LNvBWUntNONR1aNxbN8zHsnLQisgh+k2Fp/XpXk=";
+        rev = "187fd4d3e55e2088da9cb31e414a2bac866292e8";
+        hash = "sha256-Qzl3rs1dOokT4gU14uaXCBG7RFgieoFWu24pEh8gPfU=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3141,12 +3141,12 @@
     };
     tera = buildGrammar {
       language = "tera";
-      version = "0.0.0+rev=3a38c36";
+      version = "0.0.0+rev=54b3f8b";
       src = fetchFromGitHub {
         owner = "uncenter";
         repo = "tree-sitter-tera";
-        rev = "3a38c368e806268daac9923a27e72bcafbbc16bb";
-        hash = "sha256-JyH5iBaqW+qylqkZEN+JmG3NkMc5NKGwHp/xJ3NRR2Y=";
+        rev = "54b3f8b43aecdbcf12a7366920f0bc8274af1dd0";
+        hash = "sha256-lFNfLFLoRQwxzRfvnWaGSa1aUOgyIJcRBPkN60pZ8Kg=";
       };
       meta.homepage = "https://github.com/uncenter/tree-sitter-tera";
     };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3183,7 +3183,7 @@ assertNoAdditions {
     };
   });
 
-  notmuch-nvim = super.notmuch-nvim.overrideAttrs {
+  notmuch-nvim = super.notmuch-nvim.overrideAttrs (old: {
     checkInputs = [
       notmuch
     ];
@@ -3206,8 +3206,10 @@ assertNoAdditions {
           --replace-fail 'ffi.load("notmuch")' 'ffi.load("${notmuchLib}")'
       '';
 
-    meta.license = lib.licenses.mit;
-  };
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
 
   NrrwRgn = super.NrrwRgn.overrideAttrs (old: {
     meta = old.meta // {
@@ -4144,10 +4146,6 @@ assertNoAdditions {
     };
   });
 
-  rust-tools-nvim = super.rust-tools-nvim.overrideAttrs {
-    dependencies = [ self.nvim-lspconfig ];
-  };
-
   rustaceanvim = super.rustaceanvim.overrideAttrs {
     checkInputs = [
       # Optional integration

pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix

@@ -38,15 +38,16 @@
             postInstall
             ;
 
-          installPhase = ''
-            runHook preInstall
+          installPhase =
+            attrs.installPhase or ''
+              runHook preInstall
 
-            target=$out/${rtpPath}/${path}
-            mkdir -p $out/${rtpPath}
-            cp -r . $target
+              target=$out/${rtpPath}/${path}
+              mkdir -p $out/${rtpPath}
+              ${lib.optionalString (!(attrs.dontUnpack or false)) "cp -r . $target"}
 
-            runHook postInstall
-          '';
+              runHook postInstall
+            '';
 
           meta = {
             platforms = lib.platforms.all;

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,
@@ -592,7 +593,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
@@ -1146,7 +1147,6 @@ https://github.com/keith/rspec.vim/,,
 https://github.com/ccarpita/rtorrent-syntax-file/,,
 https://codeberg.org/ssnoer/run.nvim,,
 https://github.com/TheLazyCat00/runner-nvim/,,
-https://github.com/simrat39/rust-tools.nvim/,,
 https://github.com/rust-lang/rust.vim/,,
 https://github.com/tris203/rzls.nvim/,,
 https://github.com/hauleth/sad.vim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-yUrFhJa/DkAQXH/0EZ3N0axloCNtrPvaFfmJ5/bnqRg=";
+          hash = "sha256-CftijAYW4hoMryxPSXfq/GffTZahAn8FeCParZcRHdM=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-2L5+MZNnBraXmX4npH1/aLlU+uBRsGEKdpAZ6kh7krc=";
+          hash = "sha256-qaE5dSnOFECIK7PoJOgOYAuEqH7wEcewL5XhFaxyPu0=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Ztzy6ZrqdhCy/bd+zAxGaq07KZBKHS4GMGTAe62Dxk8=";
+          hash = "sha256-rOTO8zbsL+YrsrPhj1TN5PhQWp8y6XoJqn7z1ZJh5pw=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.283";
+      version = "2.1.285";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1776,8 +1776,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.148";
-          hash = "sha256-bqyi1uk4Y1PMOjVv+io3WxJMrJb7UKy368xt6TiySPg=";
+          version = "0.4.149";
+          hash = "sha256-bGDU3/5Pysagt8aoEJJH6VVvR4Oy8IU12AmaAvnKnY8=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2047,8 +2047,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.90.3";
-          hash = "sha256-/6R/3FUXuvy836YeZSbw6HMrrIXdPbKqdNFBl4z36Y0=";
+          version = "6.92.0";
+          hash = "sha256-DR0g4aHAWePu46IHNPvxrFDBHoYmHMmiEm4z4AvB4mQ=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2751,8 +2751,8 @@ let
         mktplcRef = {
           name = "intellij-idea-keybindings";
           publisher = "k--kato";
-          version = "1.7.7";
-          hash = "sha256-+XF+Odb9nMKclQkB/lwFuVpCHlVq6LNG/gQATVBcrYc=";
+          version = "1.7.8";
+          hash = "sha256-771I7W5jrYVtN25N4jnKudPqhlX1ohGP5dI1vUciYXs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/k--kato.intellij-idea-keybindings/changelog";

pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "hardhat-solidity";
     publisher = "nomicfoundation";
-    version = "0.9.1";
-    hash = "sha256-PlqYeUe6qbyP/ec2EwxG8Uxg6wmJhayUzt4HpInpLAg=";
+    version = "0.9.2";
+    hash = "sha256-iaTVu2IVPfprOf44OAhwFla5k6+WSYMFlagKkZCMhDw=";
   };
 
   meta = {

pkgs/applications/misc/sweethome3d/default.nix

@@ -33,6 +33,8 @@ let
       "aarch64-darwin"
     ];
     mainProgram = "sweethome3d";
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 in
 {

pkgs/applications/misc/xpdf/default.nix

@@ -93,8 +93,5 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ sikmir ];
-    knownVulnerabilities = [
-      "CVE-2023-26930"
-    ];
   };
 }

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "154.0.8037.57",
+    "version": "154.0.8037.92",
     "chromedriver": {
-      "version": "154.0.8037.58",
-      "hash_darwin": "sha256-oMomlVZiLv+QQGHNq0Ao5tq++wCt1wAQmmddj0ARUKU=",
-      "hash_darwin_aarch64": "sha256-9Yy5BKjSdTr44fZp15lHPgXV9nMynXjF6Srw6CoAlAY="
+      "version": "154.0.8037.93",
+      "hash_darwin": "sha256-98b3h7D4+HHaZ7sLsr8v4Uv0xc3TqJLI2DWd8jchMCY=",
+      "hash_darwin_aarch64": "sha256-RVAlxmcKbxi7VPYXOwJlup3CLwLE/YPpISWDlaYQdPI="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "73c14f6228d7cd537c855007e8f88678969cc0eb",
-        "hash": "sha256-LqS0Up2B1g7YWGx9N85hwMDQ2SktPjvxlJDfo8gxFOg=",
+        "rev": "334b65d254ccc35df4fca82706d1753227b01039",
+        "hash": "sha256-UtjuCxGPAHukLFqtwvyW7QRlOah4N1xJ5bHAT1hYUVA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "1ff8799c596d4fc9acea28343610b1f33650a6fa",
-        "hash": "sha256-aNsNXGV9V3tE9Xj0eb80EdPGi4gYJzmgQk3BIo/wxmY="
+        "rev": "802a8704ca940b633b731493ee192e0661eb8cdd",
+        "hash": "sha256-HqMu7GkWXTyIj/a4SY6f8x1wS/ficMQYyI/g0zuTlvM="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "8597a1aaec546a7f19e8e662a49ebf03b2e91308",
-        "hash": "sha256-zCY7dE1C2PGb2pQ/H6oNGjpSHUhhRTfTFkAgdJm3efE="
+        "rev": "38bc7fb0b3a024d05212958ae843e4ddf8c44ff1",
+        "hash": "sha256-l1naz112kynSTtFsE0LrpLSzvdGLxJJ19UMNfHvUkmw="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -847,8 +847,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "671f7c27ac0403ceb8074a8dfbcc02cdd7369c3f",
-        "hash": "sha256-0eEMZgbwW5edL4as79OibOVQidQL5rWYcGSdpq7ZPQo="
+        "rev": "31fac3bef58c3def36b0760e4ddc54ec77099596",
+        "hash": "sha256-hJfc8TsOIGi9pBXwDcxLoaO6RxczIn9mwYJAQoGBnI0="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -44,9 +44,7 @@ let
 
   arch = mozillaPlatforms.${stdenv.hostPlatform.system};
 
-  isPrefixOf = prefix: string: builtins.substring 0 (builtins.stringLength prefix) string == prefix;
-
-  sourceMatches = locale: source: (isPrefixOf source.locale locale) && source.arch == arch;
+  sourceMatches = locale: source: (lib.hasPrefix source.locale locale) && source.arch == arch;
 
   policies = {
     DisableAppUpdate = true;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -218,13 +218,13 @@
     "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-F/Qkcu9XHxWrVbGVqWw2/AB1CDcY4hKm5cGDDtnsxP8=",
+    "hash": "sha256-cazO/sszoutiwMYjM709aHNzKIpOzZbB/5nHDEgbm08=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.25.0",
+    "rev": "v5.26.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-FGt4e+WyF5Wx3jw+U+L2kdybOnnAW/AA+mBeVbRQI0Y="
+    "vendorHash": "sha256-9blJRFzwwOcdFAB93C109qqXsh2tYft1bTOldvW0a/Y="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-STiMgzJWnWfUz2Y+O/6QfTxZ3hClHOa+guJer33dEDg="
   },
   "hashicorp_random": {
-    "hash": "sha256-Y5p9/H3g85AYr/FVWO6zLaeHIGo7iGvMV6eHTGO0ehI=",
+    "hash": "sha256-wfRgzuV4UbP1lonqRcCreCqVje1YBt8lwoysMGH2yYg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/random",
     "owner": "hashicorp",
     "repo": "terraform-provider-random",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
+    "vendorHash": "sha256-J6zLLrX7/kKrkf00W2hDUYKpNmbrRzrziqb6aFRcO38="
   },
   "hashicorp_tfe": {
     "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
@@ -679,13 +679,13 @@
     "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
-    "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",
+    "hash": "sha256-7els7FaCojWzXp+0YP9YYJTAKS2PqpR1SMC1WxsfVb0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/time",
     "owner": "hashicorp",
     "repo": "terraform-provider-time",
-    "rev": "v0.14.1",
+    "rev": "v0.14.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pIuZNark35Aqstd2hDf5QGmegzfFa439+5zI/qBsWLA="
+    "vendorHash": "sha256-t20uPPaKr43Al7ExOPD+cw1hVwaVwxljHHR0tVPmrYw="
   },
   "hashicorp_tls": {
     "hash": "sha256-lUaVcnN+1Siz78XqrPLUlpUPRNLzp1VtWxgZEysL3pM=",
@@ -914,13 +914,13 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-C5zx1uf5VKZN/CBbcFe+GOYpso2L/ocztEBsDEL53mA=",
+    "hash": "sha256-3RCE2KCWgS8j30Ggh0HfX0D9ZPpgiTtgIk7+YmzYSfc=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.9.17",
+    "rev": "2026.9.24",
     "spdx": "0BSD",
-    "vendorHash": "sha256-wQPGzn9g0HUvelcQb7Ai29Zcoif6hNGOAK3sdzINPCU="
+    "vendorHash": "sha256-b2YIkwpeYCGsENzXSAPD7nhvmZ1Phxfcm3S5xsiC2t0="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -1148,13 +1148,13 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-bn5QMl+9okXzkfZDOdbYPpMs5x0JDL22cwW6AXFkE5A=",
+    "hash": "sha256-sWCG6mD7fYi2Yon5Wu/54+m+T8KcUYd38yDt8M3LS+E=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.21.1",
+    "rev": "v5.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2zHDQyIQQm9ySpPSjobQXTXFopT4290b1O0y+lvVD88="
+    "vendorHash": "sha256-Lusa+8VL8wQGIHYMiuiNTy4tqza4zO1A4ROpZ7X42KM="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",

pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix

@@ -46,9 +46,7 @@ let
 
   arch = mozillaPlatforms.${stdenv.hostPlatform.system} or throwSystem;
 
-  isPrefixOf = prefix: string: builtins.substring 0 (builtins.stringLength prefix) string == prefix;
-
-  sourceMatches = locale: source: (isPrefixOf source.locale locale) && source.arch == arch;
+  sourceMatches = locale: source: (lib.hasPrefix source.locale locale) && source.arch == arch;
 
   defaultSource = lib.findFirst (sourceMatches "en-US") { } sources;
 

pkgs/applications/networking/mumble/default.nix

@@ -154,6 +154,7 @@ let
 
       patches = [
         ./fix-plugin-copy.patch
+        ./fix-plugin-updater-cxx20.patch
       ];
 
       postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/applications/networking/mumble/fix-plugin-updater-cxx20.patch

@@ -0,0 +1,34 @@
+Backported from upstream commit a2d5c363b5e457ed842971d68f8b945247cc4a04
+("REFAC(plugin): Add constructors to UpdateEntry struct"), which landed on
+master but was never backported to the 1.5.x branch.  Adjusted for the
+member ordering used in 1.5.x.
+
+UpdateEntry declares a defaulted default constructor, which keeps it an
+aggregate under C++17 but not under C++20, so the brace-enclosed initialiser
+below stops compiling.  abseil-cpp exports cxx_std_20 as an interface compile
+feature and protobuf::libprotobuf propagates it, which raises the standard used
+for the client targets above the C++17 requested via CMAKE_CXX_STANDARD.
+
+--- a/src/mumble/PluginUpdater.h
++++ b/src/mumble/PluginUpdater.h
+@@ -29,6 +29,8 @@
+ /// the same plugin.
+ struct UpdateEntry {
+ 	UpdateEntry() = default;
++	explicit UpdateEntry(plugin_id_t id, const QUrl &url, const QString &name, int redirectCount = 0)
++		: pluginID(id), updateURL(url), fileName(name), redirects(redirectCount) {}
+ 
+ 	plugin_id_t pluginID = std::numeric_limits< plugin_id_t >::max();
+ 	QUrl updateURL;
+--- a/src/mumble/PluginUpdater.cpp
++++ b/src/mumble/PluginUpdater.cpp
+@@ -45,8 +45,7 @@
+ 				QUrl updateURL = plugin->getUpdateDownloadURL();
+ 
+ 				if (updateURL.isValid() && !updateURL.isEmpty() && !updateURL.fileName().isEmpty()) {
+-					UpdateEntry entry = { plugin->getID(), updateURL, updateURL.fileName(), 0 };
+-					m_pluginsToUpdate << entry;
++					m_pluginsToUpdate.append(UpdateEntry(plugin->getID(), updateURL, updateURL.fileName()));
+ 				}
+ 			}
+ 

pkgs/applications/office/libreoffice/default.nix

@@ -429,6 +429,46 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     ./fix-unpack-collabora.patch
+
+    # Add missing climits includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/6ebc3c540f2aa13363e3dcb32a44bfa2c7f66a9f.patch";
+      hash = "sha256-5GCosJryorH1P1Z2Zjey7oEC3seLHN5kH/ar4U7E74E=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0084c2b22ce26084df5a379135ba8ac174585ac0.patch";
+      hash = "sha256-zssmbzfaZX2sBdHbzm+aIC8ncidp3eupQoUloeGdPcQ=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/19c32b44fead600118377417012b111a4f238766.patch";
+      hash = "sha256-jO7oFEfoL7V1dj67vwDAEp2BwjQvfva4zV8sVAAc+2g=";
+    })
+
+    # Add missing limits.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/a6325b777b7bb9e1c760a4f1a02d48ba0889a7b1.patch";
+      hash = "sha256-QECBAdJ+4Q8c2kbdadNxzgDEebLvPy9cvRb34O7m5bA=";
+    })
+
+    # Add missing cstdint includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/47cabcb187dfbccb36ee02513998fbfcee509d5e.patch";
+      hash = "sha256-q883AMTtLzXwbwNRytCk6qiFA1snzba4JUsr7IaUEvI=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0fede06b020fa0327877f4a8722290d48a742a2c.patch";
+      hash = "sha256-8w89mtZuFvpZU0GVZoWPZVBM+UlgnbTYxoDJ8Ss64Bo=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/aa9a194a99cec1dbcee9226b703fdcf9b62962d7.patch";
+      hash = "sha256-Eztv186ke97u0ucdd3jQmJaxtrxnsiWWE/qVOBc2uGc=";
+    })
+
+    # Add missing stdint.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/d0265596672d78ad6f3980ff6fb900535aefd11f.patch";
+      hash = "sha256-tp7MW+8ExivGKKWjLy60lxWNf2hXF+jCD0pajo+YbVo=";
+    })
   ]
   ++ lib.optionals (lib.versionAtLeast version "26.8" && lib.versionOlder version "26.8.999") [
     ./26.8-add-dir-prereq.patch

pkgs/build-support/fetchrepoproject/tests.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  testers,
+  fetchRepoProject,
+  ...
+}:
+
+{
+  # fetch repo by git rev
+  manifest-demo-by-rev = testers.invalidateFetcherByDrvHash fetchRepoProject {
+    name = "manifest-demo-git-repo-by-rev";
+    manifest = "https://github.com/iayanpahwa/manifest-demo.git";
+    rev = "6f731a3dd689d58333e53e259cd3b7d2242a4dc8";
+    hash = "sha256-cMEvM9lqi8Zl/cFLnTHYv/VVxTzBTHkvhs+jp5U7M/g=";
+  };
+
+  # fetch repo by tag
+  sel4test-by-tag = testers.invalidateFetcherByDrvHash fetchRepoProject {
+    name = "sel4test-by-tag";
+    manifest = "https://github.com/seL4/sel4test-manifest.git";
+    rev = "refs/tags/16.0.0";
+    hash = "sha256-W2vOPWpbcgYPdo+Ife2ddFi3Xpe5Q9jjYqUJd31NQBA=";
+  };
+
+  # use different manifest in repo
+  sel4test-manifestName = testers.invalidateFetcherByDrvHash fetchRepoProject {
+    name = "sel4refos-manifestName";
+    manifest = "https://github.com/seL4/refos-manifest.git";
+    rev = "ccb3225268ec9802a7a23b1d3e1b193067484741";
+    manifestName = "working.xml";
+    hash = "sha256-p/pqSkmWMtTXFg5ABgGcScXczF2rzuL1Vz4/v14OrZs=";
+  };
+}

pkgs/build-support/nix-gitignore/default.nix

@@ -17,15 +17,13 @@ let
     head
     isList
     length
-    optionals
     optionalString
     pathExists
     readFile
     removePrefix
     replaceStrings
-    stringLength
+    stringToCharacters
     sub
-    substring
     toList
     trace
     ;
@@ -88,19 +86,11 @@ rec {
         let
           special = "^$.+{}()";
           escs = "\\*?";
-          splitString =
-            let
-              recurse =
-                str:
-                [ (substring 0 1 str) ] ++ (optionals (str != "") (recurse (substring 1 (stringLength str) str)));
-            in
-            str: recurse str;
-          chars = s: filter (c: c != "" && !isList c) (splitString s);
-          escape = s: map (c: "\\" + c) (chars s);
+          escape = s: map (c: "\\" + c) (stringToCharacters s);
         in
         replaceStrings
           (
-            (chars special)
+            (stringToCharacters special)
             ++ (escape escs)
             ++ [
               "**/"

pkgs/build-support/replace-dependencies.nix

@@ -48,6 +48,7 @@ let
     attrValues
     mapAttrs
     filter
+    getAttrs
     hasAttr
     mapAttrsToList
     ;
@@ -169,12 +170,7 @@ let
       drv: references:
       let
         rewrittenReferences = filter (dep: dep != drv && toString rewriteMemo.${dep} != dep) references;
-        rewrites = listToAttrs (
-          map (reference: {
-            name = reference;
-            value = rewriteMemo.${reference};
-          }) rewrittenReferences
-        );
+        rewrites = getAttrs rewrittenReferences rewriteMemo;
       in
       replaceDirectDependencies {
         drv = storePathOrKnownTargetDerivationMemo.${drv};

pkgs/build-support/writers/scripts.nix

@@ -877,12 +877,16 @@ rec {
   */
   writeNu =
     name: argsOrScript:
+    # Separate the shebang from doc comments attached to `main`.
     if lib.isAttrs argsOrScript && !lib.isDerivation argsOrScript then
+      script:
       makeScriptWriter (
         argsOrScript // { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; }
-      ) name
+      ) name "\n${script}"
     else
-      makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; } name argsOrScript;
+      makeScriptWriter {
+        interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
+      } name "\n${argsOrScript}";
 
   /**
     Like writeScriptBin but the first line is a shebang to nu
@@ -1198,10 +1202,8 @@ rec {
         interpreter =
           if libraries == [ ] then
             python.interpreter
-          else if (lib.isFunction libraries) then
-            (python.withPackages libraries).interpreter
           else
-            (python.withPackages (ps: libraries)).interpreter;
+            (python.withPackages (toFunction libraries)).interpreter;
         check = optionalString (python.isPy3k && doCheck) (
           writeDash "pythoncheck.sh" ''
             exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"

pkgs/build-support/writers/test.nix

@@ -254,6 +254,23 @@ recurseIntoAttrs {
       ''
     );
 
+    nuDocComment =
+      let
+        script = writeNu "test-writers-nushell-doc-comment" ''
+          # Doc comment example
+          def main [] {}
+        '';
+      in
+      runCommand "test-writers-nushell-doc-comment" { } ''
+        ${script} --help > help
+        grep -F "Doc comment example" help
+        if grep -F "#!" help; then
+          echo "shebang included in Nushell doc comment" >&2
+          exit 1
+        fi
+        touch $out
+      '';
+
     babashka = expectSuccess (
       writeBabashka "test-writers-babashka" { } ''
         (println "success")

pkgs/by-name/_1/_1password-cli/update.sh

@@ -6,7 +6,7 @@ set -eu
 ROOT="$(dirname "$(readlink -f "$0")")"
 NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find default.nix in $ROOT"
+  echo "ERROR: cannot find package.nix in $ROOT"
   exit 1
 fi
 

pkgs/by-name/aa/aarch64-esr-decoder/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aarch64-esr-decoder";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "aarch64-esr-decoder";
     tag = finalAttrs.version;
-    hash = "sha256-ZpSrz7iwwzNrK+bFTMn5MPx4Zjceao9NKhjAyjuPLWY=";
+    hash = "sha256-DO/MS/Mt5KBFEEQt9BuJHF1J9UWqDJ3eWKzsw3X75jc=";
   };
 
-  cargoHash = "sha256-xOBJ8QYiWu5vmkRpttN2CXCXi4bNj+qph31hSkDadjI=";
+  cargoHash = "sha256-pbBIvenBe0+tt3VPuoTtFTDFy6yO5bju0FS2hXJtGZU=";
 
   meta = {
     description = "Utility for decoding aarch64 ESR register values";

pkgs/by-name/ac/acme-sh/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "acme.sh";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "acmesh-official";
     repo = "acme.sh";
     tag = finalAttrs.version;
-    hash = "sha256-wybDNQ0shmRPvYpBkMWZA0UQjh866+yFclqyMAlNeiE=";
+    hash = "sha256-x7V4yIFODVH2H9cjH3xMi4dFrQUKeRJBM+ckpmnvD+0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adscan/package.nix

@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "13.0.0";
+  version = "13.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FcsxW30xmAODVvi7YUPwp+0+ETA/W4e/JrA5jZ+RXE8=";
+    hash = "sha256-BmzXsbgS4gE5osU5Vt2GZrSYKOgKRkiPPoK2gurAk0I=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];

pkgs/by-name/ad/adw-bluetooth/package.nix

@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "1.1.2";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
     tag = version;
-    hash = "sha256-0rySzx03KeKeqtl0yrbnj/tVbpVPBAKDz+1qLQ5kZRc=";
+    hash = "sha256-UQg2pEmRfTOt6QKdiL1Z86SeGYJ/zZ4XM09l7F/4+UU=";
   };
 
   daemon = buildGoModule {

pkgs/by-name/ag/agentaps/package.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  git,
+  pkg-config,
+  makeWrapper,
+  versionCheckHook,
+  fontconfig,
+  freetype,
+  libGL,
+  libxcb,
+  libxkbcommon,
+  vulkan-loader,
+  wayland,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "agentaps";
+  version = "0.3.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domenkozar";
+    repo = "agentaps";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pHESE5ML5zeDylz07t8k1jJop/IGyIhTTffPN4dWrY0=";
+  };
+
+  cargoHash = "sha256-ko+ytnpQGLIA41+aurIcY5Rp0Aemf7Z4PFC5GdLFLvw=";
+
+  patches = [
+    # Add --version support until the next release.
+    (fetchpatch {
+      url = "https://github.com/domenkozar/agentaps/commit/1665c2792929226d675d427e0eef42cd3ede7a71.patch";
+      hash = "sha256-+wL5G6Ln9uuWxt2fRW2QPbD54Zif51hGxcNAC3Q3f84=";
+      includes = [ "src/main.rs" ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    vulkan-loader
+    wayland
+  ];
+
+  nativeCheckInputs = [ git ];
+
+  # The login shell test requires /bin/sh and /usr/bin/env, which are absent in the sandbox.
+  checkFlags = [ "--skip=shell_env::tests::reads_path_from_a_login_shell" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  postFixup = ''
+    wrapProgram "$out/bin/agentaps" \
+      --suffix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libGL
+          libxcb
+          libxkbcommon
+          vulkan-loader
+          wayland
+        ]
+      }"
+  '';
+
+  meta = {
+    description = "Desktop client for Agent Client Protocol agents";
+    homepage = "https://github.com/domenkozar/agentaps";
+    changelog = "https://github.com/domenkozar/agentaps/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    mainProgram = "agentaps";
+    maintainers = with lib.maintainers; [ domenkozar ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ag/agentsploit/package.nix

@@ -63,6 +63,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Offensive security framework for AI agents and MCP servers";
     homepage = "https://github.com/agentsploit/agentsploit";

pkgs/by-name/ai/airplay-cli/package.nix

@@ -16,6 +16,8 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "airplay-cli";
+  # nixpkgs-update: no auto update
+  # updated together with music-assistant
   version = "0.5.3";
 
   __structuredAttrs = true;

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2568";
+  version = "2.0.2578";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-9Okp0Fli+MyVYqOQDg867ic/t+bOJr86MVIshntiy78=";
+    hash = "sha256-fFJuN1MPpnpYCotAiQoRU5qEsyC6HjOTrjxfnyWj/+o=";
   };
 
-  npmDepsHash = "sha256-YOvzCKN2PqbyOgR5qhshI52/grQT2DStbdJgWBrVvsI=";
+  npmDepsHash = "sha256-8xzyypPgtfxYxPcVIJYLNL0a6EE7L93eISanWqPFGM4=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/an/ansible-navigator/package.nix

@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-navigator";
-  version = "26.8.0";
+  version = "26.9.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "ansible_navigator";
-    hash = "sha256-V5UyoCrLr4iZvDeFQUIcXSxTWP1G3TmCJUdhWQIpn+Q=";
+    hash = "sha256-MLzoipI+LPjNmFAC56ITwr1iUuxJYmDaYlMUaw2hi5Y=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/as/aseprite/package.nix

@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve

pkgs/by-name/at/atmos/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.229.0";
+  version = "1.230.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N/IFSgMg1w1uH7p7TBahBpIHjSww0MZSEf5mt3r6DzQ=";
+    hash = "sha256-2iyRkQQ+NKER60jBiGrcq+QKBO8+pt3nfHm9Tn3e+iU=";
   };
 
   vendorHash = "sha256-J5TNPXzEz4gaNi2mEqkQ+t1JzmocbRRLwUwzLgAZU40=";

pkgs/by-name/au/audiobookshelf/client.nix

@@ -0,0 +1,23 @@
+{
+  src,
+  version,
+
+  buildNpmPackage,
+  nodejs,
+}:
+buildNpmPackage {
+  pname = "audiobookshelf-client";
+  inherit version nodejs;
+
+  src = "${src}/client";
+
+  npmDepsHash = "sha256-Rvy/bULWyVkGthfpIGkTMO8Lv1miywwea7jLODfm54Y=";
+
+  env = {
+    # don't download the Cypress binary
+    CYPRESS_INSTALL_BINARY = 0;
+    NODE_OPTIONS = "--openssl-legacy-provider";
+  };
+
+  npmBuildScript = "generate";
+}

pkgs/by-name/au/audiobookshelf/package.nix

@@ -2,51 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  runCommand,
   buildNpmPackage,
-  nodejs_22,
+  callPackage,
+  nodejs_24,
   ffmpeg_8-full,
   nunicode,
   util-linux,
   python3,
   getopt,
   nixosTests,
+  nix-update-script,
 }:
 
 let
   ffmpeg-full = ffmpeg_8-full;
-
-  source = {
-    version = "2.36.1";
-    hash = "sha256-HBaTTfZEbhR2n/XafScZB/gX29erTQHZ+IdErwhA11A=";
-    npmDepsHash = "sha256-kp0LbSKaHTBppeyfLAFrGYnSWS3V2trO5yaZWoxVPo8=";
-    clientNpmDepsHash = "sha256-g3Y/4UU2YH/CeU8Z/NNkLP0OTeBM+4/rQfL406uVdio=";
-  };
-
-  src = fetchFromGitHub {
-    owner = "advplyr";
-    repo = "audiobookshelf";
-    tag = "v${source.version}";
-    inherit (source) hash;
-  };
-
-  client = buildNpmPackage {
-    pname = "audiobookshelf-client";
-    inherit (source) version;
-
-    nodejs = nodejs_22;
-
-    src = runCommand "cp-source" { } ''
-      cp -r ${src}/client $out
-    '';
-
-    # don't download the Cypress binary
-    CYPRESS_INSTALL_BINARY = 0;
-    NODE_OPTIONS = "--openssl-legacy-provider";
-
-    npmBuildScript = "generate";
-    npmDepsHash = source.clientNpmDepsHash;
-  };
+  nodejs = nodejs_24;
 
   wrapper = import ./wrapper.nix {
     inherit
@@ -56,14 +26,21 @@ let
       getopt
       ;
   };
-
 in
-buildNpmPackage {
+buildNpmPackage (finalAttrs: {
   pname = "audiobookshelf";
+  version = "2.37.1";
 
-  inherit src;
-  inherit (source) npmDepsHash version;
-  nodejs = nodejs_22;
+  src = fetchFromGitHub {
+    owner = "advplyr";
+    repo = "audiobookshelf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rTn64PrGPSKwDbsQmzvdSRa7UQEV1f2xXaYGtcVfrpk=";
+  };
+
+  npmDepsHash = "sha256-xHjZ3E1DGeb5NueP67hEX3vHH0Qlk4LTeZkMEFBhGyE=";
+
+  inherit nodejs;
 
   buildInputs = [ util-linux ];
   nativeBuildInputs = [ python3 ];
@@ -71,16 +48,18 @@ buildNpmPackage {
   dontNpmBuild = true;
   npmInstallFlags = [ "--only-production" ];
 
+  client = callPackage ./client.nix { inherit (finalAttrs) src version nodejs; };
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/opt/client
     cp -r index.js server package* node_modules $out/opt/
-    cp -r ${client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
+    cp -r ${finalAttrs.client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
     mkdir $out/bin
 
     echo '${wrapper}' > $out/bin/audiobookshelf
-    echo "  exec ${nodejs_22}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
+    echo "  exec ${finalAttrs.nodejs}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
 
     chmod +x $out/bin/audiobookshelf
 
@@ -89,13 +68,13 @@ buildNpmPackage {
 
   passthru = {
     tests.basic = nixosTests.audiobookshelf;
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { extraArgs = [ "--subpackage=client" ]; };
   };
 
   meta = {
     homepage = "https://www.audiobookshelf.org/";
     description = "Self-hosted audiobook and podcast server";
-    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${source.version}";
+    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       jvanbruegge
@@ -105,4 +84,4 @@ buildNpmPackage {
     platforms = lib.platforms.linux;
     mainProgram = "audiobookshelf";
   };
-}
+})

pkgs/by-name/au/audiobookshelf/update.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix-prefetch-git common-updater-scripts jq prefetch-npm-deps ripgrep
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-REPO="advplyr/audiobookshelf"
-
-NEW_VER=$(list-git-tags --url=https://github.com/$REPO | rg 'v[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
-OLD_VER=$(nix-instantiate --eval --raw -A audiobookshelf.version)
-
-if [ "$NEW_VER" == "$OLD_VER" ]; then
-  echo "No update needed."
-  exit 0
-fi
-
-replace_hash() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-get_npm_hash() {
-  pushd "$(mktemp -d)" >/dev/null
-  curl -s "https://raw.githubusercontent.com/$REPO/v$NEW_VER/$1" -o package-lock.json
-  prefetch-npm-deps package-lock.json
-  rm -f package-lock.json
-  popd >/dev/null
-}
-
-src_hash() {
-  nix-prefetch-git --url https://github.com/$REPO --rev "refs/tags/v${NEW_VER}" | jq --exit-status --raw-output .hash
-}
-
-sed -i "s/version = \".*\"/version = \"$NEW_VER\"/" "$NIX_DRV"
-replace_hash "hash" "$(src_hash)"
-replace_hash "npmDepsHash" "$(get_npm_hash "package-lock.json")"
-replace_hash "clientNpmDepsHash" "$(get_npm_hash "client/package-lock.json")"

pkgs/by-name/au/augeas/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "augeas";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "hercules-team";
     repo = "augeas";
     tag = "release-${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-U5tm3LDUeI/idHtL2Zy33BigkyvHunXPjToDC59G9VE=";
+    hash = "sha256-FH+i/6nnhbp2j+45eNT63LzI/uY5KvLYePivyaO1odM=";
   };
 
   patches = [

pkgs/by-name/au/authentik/package.nix

@@ -17,7 +17,7 @@
   perl,
   rustPlatform,
   go,
-  typescript_5,
+  typescript_7,
   makeSetupHook,
   writeShellScript,
 }:
@@ -102,7 +102,7 @@ let
     nativeBuildInputs = [
       nodejs
       openapi-generator-cli
-      typescript_5
+      typescript_7
     ];
 
     buildPhase = ''

pkgs/by-name/au/auto-editor/lock.json

@@ -1,17 +1,5 @@
 {
   "depends": [
-    {
-      "method": "fetchzip",
-      "path": "/nix/store/63sp165yl6is029c8g5cn3550vq8pp1x-source",
-      "rev": "e9f0c49b234fd4a2038b752ab02703288346ce98",
-      "sha256": "1rwr4d150l0v14ccmwr13zi6fr8din1h8spivmxwkcfa66jm73j1",
-      "url": "https://github.com/WyattBlue/csort/archive/e9f0c49b234fd4a2038b752ab02703288346ce98.tar.gz",
-      "ref": "1.0.0",
-      "packages": [
-        "csort"
-      ],
-      "srcDir": "src"
-    },
     {
       "method": "fetchzip",
       "path": "/nix/store/f2xp1v0vnplwfjnk8nqsi7gd9pnb9gcv-source",

pkgs/by-name/au/auto-editor/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildNimPackage,
   fetchFromGitHub,
 
@@ -10,6 +11,7 @@
   x264,
   dav1d,
   zlib,
+  alsa-lib,
 
   python3,
   python3Packages,
@@ -17,25 +19,26 @@
 
 buildNimPackage rec {
   pname = "auto-editor";
-  version = "31.0.0";
+  version = "31.6.0";
 
   src = fetchFromGitHub {
     owner = "WyattBlue";
     repo = "auto-editor";
     tag = version;
-    hash = "sha256-25xzVaG9seu4hE5rc776lvNucf8lsEDvjkQPbFzjgII=";
+    hash = "sha256-N7pQQD6SVl566z3ud3yY/EFiSbIVRFWwNtlJPTPSgsI=";
   };
 
   lockFile = ./lock.json;
 
   buildInputs = [
     ffmpeg-full
-    lame
+    lame # Upstream uses a minimal, unpackaged fork of `lame` named `lamer`.
     libopus
     x264
     dav1d
     zlib
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
   env = {
     # Nothing should be dynamically linked, as ffmpeg should already link it.

pkgs/by-name/aw/aws-vault/package.nix

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.14.0";
+  version = "7.15.0";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Adb0k6Cb0Jq4LTexNYmCHThE+/4ariIutwy7pH2onoU=";
+    hash = "sha256-SwV0eEABEhZoDGYFsGmpXOJMbCABYxwBZ76+ZS2pTvo=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-vdgQS4ziTzLHWVaIiHORlSEOYPEbMF3fsSabEJh26t0=";
+  vendorHash = "sha256-Ilv0kg0RsPbV2TRiGyEbq9C7UowXXPZ5xQprY2ZbK04=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ba/babashka-unwrapped/package.nix

@@ -10,11 +10,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "babashka-unwrapped";
-  version = "1.13.220";
+  version = "1.13.223";
 
   src = fetchurl {
     url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-0fpvbrEJU89mMo9A9IM7kAqiGCdnexrEslGtjt+iBxg=";
+    sha256 = "sha256-DaDYD5pCV05/UwRre5xRxc2dAZJqkc1snKzEOTmM+Rs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/babashka/clojure-tools.nix

@@ -7,10 +7,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.12.5.1664";
+  version = "1.12.6.1673";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-d91oaJSAdK3Mk+g6eW+OjxWhqSvLG5AC1xX9IhDkdvM=";
+    hash = "sha256-/pGUhY511a8TwuKv+S1xBnTVvFEF8rQvkKfZTYLsAjw=";
   };
 })

pkgs/by-name/ba/balena-compose-parser/package.nix

@@ -6,13 +6,13 @@
 buildGoModule rec {
   __structuredAttrs = true;
   pname = "balena-compose-parser";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "balena-io-modules";
     repo = "balena-compose-parser";
     rev = "v${version}";
-    hash = "sha256-fEvLu2xZlYoILM4DThiSQHG2gbGOB5IQVgmwcLKsKwo=";
+    hash = "sha256-agZQjtkXBVMk7UAcQXPa7cRBq/H2uyCE5AC9hEfSWDM=";
   };
 
   modRoot = "lib";

pkgs/by-name/ba/bark-server/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bark-server";
-  version = "2.3.5";
+  version = "2.3.7";
 
   src = fetchFromGitHub {
     owner = "Finb";
     repo = "bark-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s02nLAlKO5SGX0Nx5z/5fZBf6R0kkY4IofbGW8ica50=";
+    hash = "sha256-uuMeBGCp15Rnw9rl6DX/mSG8dM4j0qqSoFv7LPXsVvw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-+WyTKyWVzJAgCQ6bXbOjrJUZkw5XVrvAdgALL2eXU64=";
+  vendorHash = "sha256-9bG2spKX2UTgPenWWNUGOmJLuQFbJE8CgMpKZvLYSHE=";
 
   ldflags = [
     "-s"

pkgs/by-name/bo/bottles/package.nix

@@ -39,6 +39,7 @@ let
             libxcursor
             libxdmcp
             libxext
+            libxfixes
             libxi
             libxinerama
             libxmu

pkgs/by-name/br/brial/package.nix

@@ -2,13 +2,13 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   boost,
   m4ri,
   gd,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   version = "1.2.15";
   pname = "brial";
@@ -20,6 +20,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-I8p2jdc2/oq9piy1QvNl+N0+MHDE5Xv1kawkRTjrWSU=";
   };
 
+  patches = [
+    # https://github.com/BRiAl/BRiAl/pull/64
+    (fetchpatch {
+      url = "https://github.com/BRiAl/BRiAl/commit/df5b4fd300cdbdd4cda920a27fdc5257f3cfea26.patch";
+      hash = "sha256-MwpXTmK+3hJB/J7V8iHPfgyrxc/s9LhHgkAZDq7wZb0=";
+    })
+  ];
+
   # FIXME package boost-test and enable checks
   doCheck = false;
 

pkgs/by-name/ca/capa/package.nix

@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa

pkgs/by-name/ca/cargo-tally/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tally";
-  version = "1.0.77";
+  version = "1.0.78";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-bkikJU5qyq+6+PYCJrEmdZHIsPGz4prOt6g69hOIZ8o=";
+    hash = "sha256-+zAi4Cgfi7rO0OcWv50Y7q3NiebLrdaPUR/SFKerrRA=";
   };
 
-  cargoHash = "sha256-hVkQdWOhM/R0hcrtzvlSFtw51jSRKNPmhDCNUbiK3rI=";
+  cargoHash = "sha256-iYb2K70+jVJTdS65bZmcxE4eJstcqtx10NisU7NaW/Q=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";

pkgs/by-name/ca/castopod/update.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 
 nixpkgs="$(git rev-parse --show-toplevel)"
-castopod_nix="$nixpkgs/pkgs/applications/audio/castopod/default.nix"
+castopod_nix="$(dirname "$0")/package.nix"
 
 # https://www.meetup.com/api/guide/#p02-querying-section
 query='

pkgs/by-name/ce/certgraph/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "certgraph";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "lanrat";
     repo = "certgraph";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WlNrKmny4fODnSEkP8HUF+VzMX1/LKYMdSnm7DON8Po=";
+    hash = "sha256-76OqwLGg+ZMLvY281XvRTSpOq6iLPAnLRjDs/Xee2hQ=";
   };
 
-  vendorHash = "sha256-4wj96eDibGB3oX56yIr01CYLZCYMFnfoaPWaNdFH7IE=";
+  vendorHash = "sha256-AvwoQffkiaK3QsV5UXO0EwFM/Y3DxVMp0brKiFD+N7I=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/ce/certigo/package.nix

@@ -6,20 +6,21 @@
 
 buildGoModule (finalAttrs: {
   pname = "certigo";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "square";
     repo = "certigo";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-U+VbtY34lxLBHWI1BjkPxzSS6q41R9DQkGvDvSDX9WY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y2m+uO/jxwWdutry859Y6IdNJpXjjkrlJ+LJrjS616Y=";
   };
 
-  vendorHash = "sha256-5DpgOb0YxZ/os23y+siCB73dUwutxXIW5RlCZqdbxao=";
+  vendorHash = "sha256-u10YSa2xFswJk/2iC7eyfQ51oTaa30/6JA5aLk5021k=";
 
   meta = {
     description = "Utility to examine and validate certificates in a variety of formats";
     homepage = "https://github.com/square/certigo";
+    changelog = "https://github.com/square/certigo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "certigo";

pkgs/by-name/ch/cht-sh/package.nix

@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation {
   pname = "cht.sh";
-  version = "0-unstable-2025-12-23";
+  version = "0-unstable-2026-09-22";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "chubin";
     repo = "cheat.sh";
-    rev = "031a5d3887f035aaa3bf1a3f83dff4fde2aac53d";
-    sha256 = "T6v58bmdA3EvC4QUgCR+FJLonN3QdHpkdvNGauq/i5Q=";
+    rev = "06af0000259bde1a347da368225c5962d7ffed3e";
+    sha256 = "v9NpTSBMAYIt14jSAQJQAUsBUvVjRQDo6VUc2p1lwBE=";
   };
 
   # Fix ".cht.sh-wrapped" in the help message

pkgs/by-name/ch/chuckya/missing-hashes.json

@@ -0,0 +1,146 @@
+{
+  "@esbuild/aix-ppc64@npm:0.27.7": "ff8c15b43770c8df995a7274efdb1df5553a3264bff0a42a66bc96a07fc0733a6825b4a339972d2d49fc9be9bec4ac2f4f3f072730fdedc879ce4f9cbf0b242d",
+  "@esbuild/android-arm64@npm:0.27.7": "c340fffda73dfcdf3513f900403d582cbcd8a5fc4cf7abd71aa0d4945391b4c0289e4389f51616cebaac63ec652457941e3e2eefe408230521227ae128c35c9f",
+  "@esbuild/android-arm@npm:0.27.7": "4abbbcb6b0f38d345b530148ebf883d3b1b7321a5c31f9c492bf645813e85afb8984c9d75295d779dbe602807b85995d9ff47ab8e8b22fa1bc67b1cbab9c45db",
+  "@esbuild/android-x64@npm:0.27.7": "719956b9b7eb922a2bf92cc3df93f7f476ae37ad2976bc2185c97b93d63bd1f17b031aec41e9d9a7c3d75c83d6df8daa68191bdfa0d02f4dc39b6fafa6999fd7",
+  "@esbuild/darwin-arm64@npm:0.27.7": "aefb157b95bb749ebf0cd70dd39d20c00825565a0fcc248b775b4cce6252adf694bf3e4894b25368652252139bfdc0d08b75d1139a78f197ee58ed8972cdb28d",
+  "@esbuild/darwin-x64@npm:0.27.7": "898b6b02589dccb0a51655c57c407866bdb2ae5202dacce33e7d9b2f35dd117b3245f6393ffd6726373616147c3d12a462830f51da2a5cfd06e0f60cc252373e",
+  "@esbuild/freebsd-arm64@npm:0.27.7": "aaf8ebcd359f1228f5dd9d90ceca51eaa06d91570b27fa8be9da858ee124e37d45a5fed2aa4849320eb256215acf39b98623cf770ae87f0a0d50323d1acc7fbc",
+  "@esbuild/freebsd-x64@npm:0.27.7": "cc7fa741cebc7041643f1fbfe45d99ce870b8ea42e9a67f4d1cf2fddeb991623619d00865427b3d6aa63ae7618f10c5635c4d047859eaba8d5c7f317d7138d44",
+  "@esbuild/linux-arm64@npm:0.27.7": "b1aea26033d1de82966141b350405e1205ea04fa24707084b50992bfc9d0fbf99e0ad83a31ecd8f8cbc01101f3d92f648ce2cc24273c1e8ced573726393f9c68",
+  "@esbuild/linux-arm@npm:0.27.7": "0950f67b72af73de69483363f046d6a50fc85f6491adcfeadcb6014bdc8a1731e2575fc58d6c68d6834cd6be45e0b247a23f128162864e7686accda1ada3a9d6",
+  "@esbuild/linux-ia32@npm:0.27.7": "6247a3b2658de166c69099208c72ba65d8ddc5ce1575f5e8fd05d4570f3a59bfbd6a5570cfbd890e19a24258edd1b7e91cebe75e2acf182c6087297f26bba29c",
+  "@esbuild/linux-loong64@npm:0.27.7": "0d7f9b60a46e95d09889365b54ea0e2fd6e471e9ceeef27a0cc6b77616b1abe275456b50eae94bed3322dc6ee17fedebc3258dcc88a5522bd5318f6def0d0642",
+  "@esbuild/linux-mips64el@npm:0.27.7": "f3732fa442590b2219d2ec7de1d5086cd31682831dfc25516f2805326b4bd9f68a9fdbf3cce876ee764bf47765b85fdf22290b6a09f87a29c9d0c2d4af0a83c3",
+  "@esbuild/linux-ppc64@npm:0.27.7": "df156f801042116c438c9259451e716533adec6b7d7af5c75cf27feec09ee4d941281049bf979dc0bb7a5b73b955d3974ecac4391a97600a4440a4a003b820e4",
+  "@esbuild/linux-riscv64@npm:0.27.7": "76eccec1c7f047075353ef1f908998a0723f367a39aae39608f7978e5e231ea51ae25fd5258d16345567b94b77e28524cba45bc76afa5eda350adc5bda672142",
+  "@esbuild/linux-s390x@npm:0.27.7": "788799f3e6e61efe6ec0a4a5e2d413dcfe57b27518d679a3d5f82265672fe53604a348658bc09b958cedaead008b63ef02e700469aed2a725e79361458901808",
+  "@esbuild/linux-x64@npm:0.27.7": "77c8cc00c2f647f5a04ca6640711c6e83214a8c619aeb3de52fee36c51709d5f44becaff095ffa2d1d40d53d1a792e80a1702193c155614350cc14de23a48e81",
+  "@esbuild/netbsd-arm64@npm:0.27.7": "cffa469f49165446e82f3031d6601e977131fcf619204370b3fad1b2a4a7dbf57d52e26e146cd1550c80af27470fb016d4b519fb74e3e6947a50391f84b87935",
+  "@esbuild/netbsd-x64@npm:0.27.7": "123b51f84b61f13ae916c0d7b1fa057181ded0e510f762acca178fe7fb679041a30df4f740db381afe8919d41877630ccef0a16ded46248820da0af4b967c29d",
+  "@esbuild/openbsd-arm64@npm:0.27.7": "cca5a166f47d125703451c4369bd337f08516e17aa69db17ff6822c229fcd9beb9bd29b2856c0f13d9d441178011e8c081879418f376c002f72c6aeab83576ed",
+  "@esbuild/openbsd-x64@npm:0.27.7": "d9c2ca562e27331124fcddb230f5b204adfadfd87b746d8369c1c3a72fc6f6e7375684cded7ffadab6f785228d80c4a4ff2c6f593f7ce354f6d57f5b4e43c3c3",
+  "@esbuild/openharmony-arm64@npm:0.27.7": "6566b08b37e3faee6577ae43253f163ce5af22e872e30a93c08fc41e5b3525d742366b1049ba87de16c75c77abd6fce002b49b52a5a1898efb8be5eb18d8dcf3",
+  "@esbuild/sunos-x64@npm:0.27.7": "589389cd4be3de5c24bb5820e4fd1f15f665b3be6b0ab6167f435776bb367e32209d6bf477bdba481195fbe515e1999c1e73adf321a8fb8400fe72052a4aef48",
+  "@esbuild/win32-arm64@npm:0.27.7": "519a2c68186c2cd9f548d89f00f5aa3b5f2fa481fd03908d7b1c922de03bf20236d9fc21a3b4e83915d3611471843b41536c97d74273fb3369b2525767c278be",
+  "@esbuild/win32-ia32@npm:0.27.7": "76470f36efe5290ac694e675a799a46a364aeba9a734cf10869769094b8b9022adc51fdea5869c45a8fdbfcb60ef8d787ae652c264468cdc0f4afb3869157b9c",
+  "@esbuild/win32-x64@npm:0.27.7": "b4df3d0c4024f0daf0891075822718dc31d35aeb91c18c4e8ee750be69f35ebd840d184006746dd88eca0e44574e438d5ab81c614605cc707fb79cf45cf76cba",
+  "@oxc-parser/binding-android-arm-eabi@npm:0.150.0": "73863947453369f2f9b7983986cda8d292dbaaa6881c216a3e2d3c12aa6e8b51df71371f32b81b748eecb31a0c81c513f8fbaacf2a268d143564d931a8b9a777",
+  "@oxc-parser/binding-android-arm64@npm:0.150.0": "c41de7e4fd68441f538371e624cf753745e69b6e1e3574e761511ff5f4afe41241d75c0cc19a0677ac8bb31ef629b584b21151244a83717c7eef58357964c966",
+  "@oxc-parser/binding-darwin-arm64@npm:0.150.0": "136b1ce9ff08e613d32442c50d6bd0ee6b45fc2601091664ae70c53539a2a5fac61f12b35a29cc2482e1d98e733fb325f02f6769c7cbc5e51d4a83225644e412",
+  "@oxc-parser/binding-darwin-x64@npm:0.150.0": "f4fd874c15c9a6f37b4d0acc9a3ffd37813e69ecbc35a33e41db3d24c791c6302860bcce3de6f855c17d3cc7f55e71204b6fa5089fb3305332286171060892fc",
+  "@oxc-parser/binding-freebsd-x64@npm:0.150.0": "504a549e48e73bc5e054eb4a16c82df38a6f1ba35e33fbf1f676cf3e3b51c1fd11f80ed9fdea9bd6d026426bdda9a962e2afbea9f79e2aa56342d180a7bd9f95",
+  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.150.0": "c852755046a4fb78658e1c4d1c3e28b3ffd77fee0aea554807f00a982ca0a06fa4df4518e4719bbe2765b10bc99892e44e83dc4658b0d0261cd561ed1a6699aa",
+  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.150.0": "470423574411979ec017d5bcef31b8be2e35861ac239ece84c56f2183f1bf2d314f5e6d7744d42ca1257eafd1eec644f23c4d08a2782785774741cbf31ae8d61",
+  "@oxc-parser/binding-linux-arm64-gnu@npm:0.150.0": "0756f92ff8c7934b21e67d72d8c1216aed04d50fd61b46e762406890550bc3497c021a1f982f9e86b5c36ca766a77361eb435efb8e6db04bb989258a874fecef",
+  "@oxc-parser/binding-linux-arm64-musl@npm:0.150.0": "a7a2ddd8cf4b875368d1973893fbb44ad1f286236ddd941fadc786647c62cb32a80cfeb40905380ca5e67b33e489307de23446dfc6d87aff349f1c57ad05d184",
+  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.150.0": "818cd990bac1f8ad807f44ea0b9ea1fc80452633e463d57dc2ddf90177e36c95ed8e563e4bd8cfeff57e5e03ea43f004fb5f25d3fcbaa092852c5b18a643a0cc",
+  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.150.0": "fdd10a4ddf18b17c890c9dc72357b2a599f65220573d41c766cad5bf98ed8ee73479d2aae213d9b6eafb24792fe7e413f907666629edcc93310e3f3321f85e68",
+  "@oxc-parser/binding-linux-riscv64-musl@npm:0.150.0": "1ecaa11c67b95a14d7f02275c19999d5fe050fad4604d3a44305b7e65320d5154fb1303e3f5c875fbc9b9e1153175f37d24d8287fc40a1d006d26bd00abe6d58",
+  "@oxc-parser/binding-linux-s390x-gnu@npm:0.150.0": "580bd97104958737f8aca2da96fac85c4cfdaec11a54ff0a7bcf6f730cf5f166fd1d2d995150aa65de58e02612c5554a58b8b82bdf2a4a17cf902d7fb6849824",
+  "@oxc-parser/binding-linux-x64-gnu@npm:0.150.0": "7c007911e43953af3a5aa9d90cc3e01e1f4451893095d1ac3f74d333725d33f0a07011de8fad321f0cba1e8be720e22a64ec24ae51bde8ab0a7f65a17f6bc40d",
+  "@oxc-parser/binding-linux-x64-musl@npm:0.150.0": "01cf7f33997dfa0aa235d4adaed8e3520e5e12dfad10cd1945af7238ef69708653666ffc57358c55b3e7bb5241a64a306370cfbe218918f7b0d44b6e150023b1",
+  "@oxc-parser/binding-openharmony-arm64@npm:0.150.0": "32123a8ce29efcf1711f55b4241924a3f4bdb55c6e80689a719a30d9a8b3f926e8aa1666a347a1958a5e2c2dcca0e5c672e01001cd1ae3cd5055593a2929d5fa",
+  "@oxc-parser/binding-win32-arm64-msvc@npm:0.150.0": "8cc96ec818e9723cfc6c7bb485fe1cbdb33e4535fbf7b5154f6bc663a659d0b63fbeece1e1d6e7762db2dea2f69fb5488142ee6823f73410d354c2d513965efe",
+  "@oxc-parser/binding-win32-ia32-msvc@npm:0.150.0": "02479fb963ebe4343e21b72dcfdf510cc24bd80f3000437a5cc1b3fcfcdd8f143cfce6d69cbe6f68add6d93a1727cd36ecb50a484a4e02625c5a576439bf26cc",
+  "@oxc-parser/binding-win32-x64-msvc@npm:0.150.0": "9359c4a5c007347c3bb7173ddae628dc3b078dcb96a08bde35433d355185e3dbea154de74e8939fb07910eb5103a4c7993260e311846d98e2782711eb8f69fd6",
+  "@oxfmt/binding-android-arm-eabi@npm:0.70.0": "f3aae5cb2dfb814af4dd09fbc2efcdbeb60a5d69570fe121871eed5b620f5d5fdedeea9086442835e0598ad3f36670f949c1169d42bcedf0f0fd2775dca72c81",
+  "@oxfmt/binding-android-arm64@npm:0.70.0": "d0b3e1c7930f0d7da8e654a2c19e5ee87d36ea1403522380426527d840992336090d4276eff7cb4dd3f7d4abaae614a35784fe801bfdee938f50a2744eb344fc",
+  "@oxfmt/binding-darwin-arm64@npm:0.70.0": "2955b64f114f31418a59df0f71f56c5251b081e28462f94490e3a1580ba2e12e9d30e2dbc4c5b94ce2c87f0395fa912aa0225831ee2b72b0d55c74edefc67941",
+  "@oxfmt/binding-darwin-x64@npm:0.70.0": "a7dac0504dc44c47a1a27c98d6941fbca7f71c94ceb8c8f71f8bfcbbcdbfe112dd18eeb8c2ce8aee333dee28b30481fc6a412ea20323a75502b0ee76473e9cb5",
+  "@oxfmt/binding-freebsd-x64@npm:0.70.0": "8b67a0a46c4f2f6afd3f55213e904ecddb1c1395ea6efa85c2c26c647c94fd9744ec8be102cefbc7298e721e3680465d4df83d783d59350355bdea893d1cab9f",
+  "@oxfmt/binding-linux-arm-gnueabihf@npm:0.70.0": "1630fdb3abe56983caead781f9e43e3c222b9287b0484df3b45d806d163e542294e2d261a7024f8661b10344ce0612d64ed8d2bdb803653e35ae5b60f7e7161e",
+  "@oxfmt/binding-linux-arm-musleabihf@npm:0.70.0": "24bed9de838faa4f4d3e5af04174d7c0682e37934f73219dfa0750c697545ce20b53d67da7dc67d5a9d3844e61fbbd3b280bbedae45d21a731a61c52d7315ac6",
+  "@oxfmt/binding-linux-arm64-gnu@npm:0.70.0": "4f4031cec1ba423d011fe5188e6fd4b8728485b8ede2825de1a7148c1e1b452e2afe5b16d1d278991d6dc126912ede4089a8be2b1343e9a9c6c041e3fc7e9525",
+  "@oxfmt/binding-linux-arm64-musl@npm:0.70.0": "41d2987412f8019352815f3e8976fc84bd9573097450ae84eca646ebd305d0d93d89b8ea9e3d78fd515ad175d8cff88c49b1975f1b5b162ba4b69984dc47c043",
+  "@oxfmt/binding-linux-ppc64-gnu@npm:0.70.0": "3ee0a4807da901e976a98d382247c63ff88c88fe6cafc5390bc08103c557bd2b8b844e47c99a8cbd0d06035c7ae08895fefd52f0725b4b352313253b81ae45ab",
+  "@oxfmt/binding-linux-riscv64-gnu@npm:0.70.0": "d3db2e3bece08cc4f73f8d029fe3829d4f456b79195dc0e6b5b6d3bf8e2e0ab8c7faeb62d2e9e23484f168cd9dbf7498b16cad9fc6c17e87e7cf8ca76fbc251d",
+  "@oxfmt/binding-linux-riscv64-musl@npm:0.70.0": "9a37759241f480602af345a6023bb81c4fc999578b099271c5b27086dea892fe3fcc141561dbda5d85b3f8e91896af766411b52cdc8dbf705cb2844b2327007c",
+  "@oxfmt/binding-linux-s390x-gnu@npm:0.70.0": "83989c86afbc69646c7ecc92e3027344bf0fed55bac0086e311dd52c30ba2567546ab3d5cd5814cdf5d492963cad1ff1df7ad35f5675e3c5b8235ff791082717",
+  "@oxfmt/binding-linux-x64-gnu@npm:0.70.0": "401355d3f2963632a8d8de9906cc58a96f9bd7a7fcb951f62e12da26f8197fb3a6bf9fb4f721cbd677a4242dfb0af98f2cd8e592f607d97f30cb7dd24a10c493",
+  "@oxfmt/binding-linux-x64-musl@npm:0.70.0": "55202881323a5e919d8bdfe103f7b5f98cbf02932e026c77d7b1478d1d7462c1ddb0204a4d840fc5e2133848ded563b08975bca28e3e1e0bf5491a03f3ccd38b",
+  "@oxfmt/binding-openharmony-arm64@npm:0.70.0": "2f113f422edd7d9925d7c494b9d99df308242247783424e72c0ffb7a575bb18cb3130697d39131729af8c3fc3b79e33e1470f4d3ac4e036adf1e30561b8f7094",
+  "@oxfmt/binding-win32-arm64-msvc@npm:0.70.0": "e8df6ed14da24fdc05eaed88a75d47216d8b24d4763c08c8589e877e6528fef936024e182cb09ef5fe8908f7e8e7617f0b0cc9edeb53a2ccb007c8237595b902",
+  "@oxfmt/binding-win32-ia32-msvc@npm:0.70.0": "accfc38c5dc7758e183ba8936f27fd76ac20b6f5df4f1cfb9e7d15d2beef73b04a1c331102f4be1ff1a72bced14103689dfb6c8f88580488d9bc53053ada9ff7",
+  "@oxfmt/binding-win32-x64-msvc@npm:0.70.0": "808c18af1e4075f74c3d2b20f9357885a42c626b2924b3dda67f010ede59f4c2997e00040a97e9f4e8e2a459dbfba3d842cd5006162acfdab955bf279b297169",
+  "@parcel/watcher-android-arm64@npm:2.6.0": "0f640015f902d28cb333c52a7c0c0dde0fd77aeaa989ca1ddd3038f408f80ea9c2a21cf180ec044ae8599e6ec6c772f853b53d8ec952992f1ba281e7db05a5b6",
+  "@parcel/watcher-darwin-arm64@npm:2.6.0": "8c18d0692f64c209d61a70f054cb8dd9502519ef698730b9aaf8dc975aacc5bbc6c47f84b6ba0da1fd140aa5446673b2cfcaf79a2395951cd7889d900a37fe56",
+  "@parcel/watcher-darwin-x64@npm:2.6.0": "0de8694d4f2c4c99176bbc18f667ebf3971b628306ee62b68b11df00b9aacdf1ecc54ea8ed6b54278d6dc291f1585a416c6732e8f6e696d6a6590c266a5c3c16",
+  "@parcel/watcher-freebsd-x64@npm:2.6.0": "8fcfcb967b8f8116c29854cc537747fd1eaa3fe1d40e8db7bf0907ce676c8adcd3deb9272f52d46a89f5a28cd15b720fe31dc015fb638fdfe144a972dd1b3321",
+  "@parcel/watcher-linux-arm-glibc@npm:2.6.0": "16af495deaf97aea2976f1c239230493f84b54bf8c9ea9a68cf163570cd342d4536eaec198e10a895c011125f3bf2c74b38a304f8d814aa78dc39a3dd462f980",
+  "@parcel/watcher-linux-arm-musl@npm:2.6.0": "1df94801c5444292a30298578ae4defbd02b26a0f35354c3281159d53021f14a7a9f8f43de9e807a43fc94d847c0bbf0c2ba9651d8e04cf75f00f86417af3fcf",
+  "@parcel/watcher-linux-arm64-glibc@npm:2.6.0": "c64940c318524258bb2306c00300dab263d1e0fcd63bbcde804fc048290461e8cfd1b845337c96dbfcc7f865a81f67aa1cb2ffeb61abebbba8e1fcc7c97f2b93",
+  "@parcel/watcher-linux-arm64-musl@npm:2.6.0": "79d294928efe057522c8dd86ca76b13be39474830461d130e5b935acfe9262744f3e8b7995b3efc5705ec511c7b2553e7d7d226e11b00ccca942a53242782df9",
+  "@parcel/watcher-linux-x64-glibc@npm:2.6.0": "b91af444351fcd8cba668326139b62e4698f0414c1882df671ce026c261d96c3de04b242787bb0f33888e81f90ceb543b35a2ec98ffc6b042be20388db224cba",
+  "@parcel/watcher-linux-x64-musl@npm:2.6.0": "9aa3a06af35f81d02936b8d5ed58aa82512e2d9e1883cf45af9948dabc004cc36be8041af6948b6956dff7dded2f82459a18c7ff12e02cbc55ef63df92c96785",
+  "@parcel/watcher-win32-arm64@npm:2.6.0": "36deb76930e491a58781a74ea5e2286926161cceb7087504a9d117488ca0616e70c3061d690d18a7d0b597e8c2f3714063921c1bc4b59678d8b27742e4d51c1f",
+  "@parcel/watcher-win32-x64@npm:2.6.0": "6e6646f910898d13792a02e81beed0e2f09125a4ed3e6545521e9475fd672a163f020d61af4a6d3c936acf773fadeba7d3edc3fd0e75ecd47527cf0c14bc77c1",
+  "@rolldown/binding-android-arm-eabi@npm:1.2.9": "1ce723761c6f6909e9f7657f3d0c157d11ab0397662679cecc46f87a5493754b05a5eacbbff8c0f21ca9f6bf6f18afb7914999e85dad926852ff6e63f98985ba",
+  "@rolldown/binding-android-arm64@npm:1.2.9": "1d597c83de815f2cb2375b8c6bb291ba34fdb6cc4fbbe7ad109f0b6a41d7434f5072655b143349ec81c9bd765f130475b0895d6d0fbf5addb51a0016aa8de015",
+  "@rolldown/binding-darwin-arm64@npm:1.2.9": "9be017bac93b93c0d4211cc87180a6cc00cca2e68b3857677f030fb37ba3cd9530b33f706a523c85625cfcf1121613353d392bb11ca5e841c72f7baec04ab1b7",
+  "@rolldown/binding-darwin-x64@npm:1.2.9": "2c6af58173c4177145db94fc210e56c32f20255ebe6df782647e39fc4811071d03e7a25b52412ffa24bc67178c800af53fbadce92f3dfd62da901672e46c9c19",
+  "@rolldown/binding-freebsd-x64@npm:1.2.9": "d6c2a208797defebe61e56b1a462a6bef90200253950f9b24f970b93cf91f7b3b0d591f5cf5f4426079cf5c9a6e5051a20d789ae2b837b1c680c2c47260aec4a",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.2.9": "99a39c7958ef1a7ba6764b288f2d9295a682d38d280ceb401165643c83c659db766ce1185d86646c84396a9acfad25b48c7e11302adc8cd53bf629c106b45a26",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.2.9": "9e84c6c18dde65e53fa4e8aba5d4855806b423df2453b28bc8dd15f0e48c46b7b1cd3c9992a9b88e173efca5f12283f1650468a327fe5dee968d2b1187ea66aa",
+  "@rolldown/binding-linux-arm64-musl@npm:1.2.9": "7fedfcaaac962bec943e7b4da51b176aadd02631d1fcaf4880ae72365d4d868f409799cbe3f7025672bb2007a0004dd33729d986404ac1c7cc8b88215716adc2",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.2.9": "dcd54975afc4f736e2b736a37158bb8eeadc58801fb40c0f3bf177d504fcea455209dd527151da7ffc818ae83327017cbd8549aee5d1eb07286049a652d79503",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.2.9": "a3187e4309c9a3765f83e92e099baaf978581351d9e14f9ba6cd087ceb71010c9d807c08649ddfdffc0d93ac4530abdcbfa2611cb00198fa49a1fe16ba706d7e",
+  "@rolldown/binding-linux-x64-gnu@npm:1.2.9": "9fed0b83539a4e7d9ddc84d2a43194f4d3f697649a0856f342f947291ba21e7730f89f333960f0229e559f75cf752a4ea4632060b448f7a405602dd216d5035d",
+  "@rolldown/binding-linux-x64-musl@npm:1.2.9": "f8fa1d238157f5c397a8426696d2907f846e3c38e9dc4eadd2d841f84cda5966c3975864cd460c3ce3a0564ab212e329cfe923d911177efe14aef612a8174c26",
+  "@rolldown/binding-openharmony-arm64@npm:1.2.9": "13ac71327a28246eb9c38b458617d01ed93835ff8e17122606e718fc06e99fba4805e051b8d3786f0674ed95c0a98ec79431144e72d7452942dc17d8af4a14fc",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.2.9": "a2f65e085ab4c6859361b97120a8298d2edeed0650ea6f3f70cb2a1e81f0b7f4ae7a0cb002af68d68c24f0706a9a3d55fdd8d4d96d4e8f7d5b73711abdf6e5d9",
+  "@rolldown/binding-win32-x64-msvc@npm:1.2.9": "6a8c186b5b9b9031bb870470f5da7fd4c9272c0e8602ceb77b6a0da78c46f82b4be6e9c34fc3723211d229e13f92d7bb30523f8195715299cee23fcf5dbd18e2",
+  "@typescript/typescript-aix-ppc64@npm:7.0.2": "6135266f6e9c5928a8efd220b2ec972ecd6fa8c771dea432d2b8ffcec606aedd57b949db98ccb2a216e3fb87d4c6d42fd449258e0ee4cbda3d5994c69c5e84d2",
+  "@typescript/typescript-darwin-arm64@npm:7.0.2": "c859259821baf9d7a8c1811bc1d0c0cb67b0d7fa9f99f1a3b50aa0e656a2df35c6142f77a9d2b1cd200874fd33bc3bf7ffb5cb5491d57be8e0522319ee3453f8",
+  "@typescript/typescript-darwin-x64@npm:7.0.2": "4c689effd4a83b881b993903901f58d13aded3c61b2a9b6a0f8f591eeab595dbfab82930b1b2af3b1595829ead0e86c9278ea7b7f8fad47c8c76dd6b0e7fec4c",
+  "@typescript/typescript-freebsd-arm64@npm:7.0.2": "3339e5cbf127f689cdd977133f903e9549afbf1c85fd12d2b61944bc8cb9cca2c18f45070066476273cb8af992591e340e9b661cbbe62c5bd4882615c2a62892",
+  "@typescript/typescript-freebsd-x64@npm:7.0.2": "52b1180545def7206ac4a944b3a4bf38809b22b3816e9b0f553e87a4ecbf8e61a6039bb6bcc3a353ad0c16f90195e7ff86f25874ada409dcbbf4c4a587e40c2d",
+  "@typescript/typescript-linux-arm64@npm:7.0.2": "b3873b9c64ff950230eb1d087eb2f46f7102cbf0f483b5280cb76221626833a1065e4e4dfdd99777151d03c0abde157fde73b605829343a022f3fcc6862490dc",
+  "@typescript/typescript-linux-arm@npm:7.0.2": "ff6a5f61931a97dd4555c2055001c4720cd0c44e3f102ecb79998799cdf156f39884c87f096036c7a57a09a132b4b545b3830c0ca952292661170a7c10c7ae73",
+  "@typescript/typescript-linux-loong64@npm:7.0.2": "7cdf90b48bf0792e6cd6f9c151bbfd1963980e50f20e73f75c27fa210ba8de65c8b69092b1dd4c6db5d86396cbe8fb5473ca2986ad45be0afc42e7dc863e5ac6",
+  "@typescript/typescript-linux-mips64el@npm:7.0.2": "6c669e865878a186249631ac720126ea9a71637170cf14cf6d0aef3dfa0f496cdf8fc1a71db1ed24064b1aa612e9b902c64e53689995a0671e6b6146cc68d156",
+  "@typescript/typescript-linux-ppc64@npm:7.0.2": "702ac3a57ed2e9932185b2b6a3aaeb12d50152d78b453ced55f936d442d9fd7669a5c8a81c76b44ec60201f96533aa38ad2ca80f70ea8b3e6dcbc5cc4a200208",
+  "@typescript/typescript-linux-riscv64@npm:7.0.2": "ea92265112cf9320f09fcaef847c8612421cc0a907b50bbc8aa928de1a6306cdf7f4d0c1426c3e475923c99f490dc4469042b2edab3c2eff3afef8c14456650d",
+  "@typescript/typescript-linux-s390x@npm:7.0.2": "dc6b678125ee4c1b81a91c64076490ec985b84e9dde9c017fbc50ec34808aefe45bf90e04c57bf9d0146ea453d71cd1543ac7c47f7a7ef77635758317d0b2173",
+  "@typescript/typescript-linux-x64@npm:7.0.2": "93d1142b9099dce38f9f2b25a7c4800289c72699e93e695aba5a6923f3661720b336cdd437f4cb3d49324226b7288c606f24f32a85c8e4be5f97c523f5b27b0a",
+  "@typescript/typescript-netbsd-arm64@npm:7.0.2": "b3274f1c526a20f4436b0f1167dc0e60dac5606f31491429c61439519a3f6a68fcee3a3f7f26f2fafb6557d918af75795b37d2fb6ede7b857bab772eb529140d",
+  "@typescript/typescript-netbsd-x64@npm:7.0.2": "d3c15af4176791e21927d35afe4935c8a98d21509db7ecb4dd7769a02c2f983500ef6d0f1646ad614a59a748269d517604af98cbd7c3c0450bb57a12cccd7270",
+  "@typescript/typescript-openbsd-arm64@npm:7.0.2": "09feda2dcbe2e3f9d31f2e98b09477158da1bb9509fe42dda2ce0b12a33b43bd31bb0caee24c6bde4c735c9d33662bcf65593ee762a2a5fee225798b5d674692",
+  "@typescript/typescript-openbsd-x64@npm:7.0.2": "e29ffc0538c2843b1e731b90626b5d2855345627fbb6b2ad7ee40b8f88ed1df6f91b03cf5c227645c4fc35a18fb6ff1612de98a9b449da25042f66478e671875",
+  "@typescript/typescript-sunos-x64@npm:7.0.2": "1647e487c452504c646c01e9e4a504e41c180bc09c9af7ccd2a6db23b6fedad436861de2681674793baccbbfc8970dccc85fce59a4da3d802dd67966774fc188",
+  "@typescript/typescript-win32-arm64@npm:7.0.2": "26cf8934a58378a2e8467914407f2d06028ca0e211bd68403994f9b27353439d8b0935ebeb7b9a03d8768a64e444285f87756a77ce72211efeecf5239af52bc5",
+  "@typescript/typescript-win32-x64@npm:7.0.2": "7f8408c4b3a58a2ef8851103c0575b97654e34c5aa0658e32be5584030f395f8a8e8a7fa87eb3afe2c794a01a0eb2e77db743c6025af57ed2915605b8e0a7c82",
+  "@unrs/resolver-binding-android-arm-eabi@npm:1.12.2": "78d31e85fbbb97d43947e0dab41409de1345d1f9eb5a40b3a291ec05c50de1414a0022ec91c9934330d196f9338106bc49ca837715e9eae8c229dc30c2421984",
+  "@unrs/resolver-binding-android-arm64@npm:1.12.2": "f8ef84285392f922833e60ae781fce0e0d606ddb7d9f7b673b1046ae7e341dd1f5cda5baa7e0ed41ebaa7d1125f46a52058a942e66a936609363627fb6ba1d06",
+  "@unrs/resolver-binding-darwin-arm64@npm:1.12.2": "608dbb1a2a3ea564d50e12634c77cd2fa245790f3ab0682dd55cefd9458bab6297bc5afe6528028e2072381e07f4b65a6ede6466c9dbf70aecd9d8d03bf0ce58",
+  "@unrs/resolver-binding-darwin-x64@npm:1.12.2": "eca4288f053800dd40036ff23f2cc138e4e48058f72893e7a41af2a37927ae4a497476afda16c32d82e88979b643f68da4bda7d4e17cd53faf56de0d28ccf032",
+  "@unrs/resolver-binding-freebsd-x64@npm:1.12.2": "1b6a38ef89c642f85c86d6fdbc93074562b4db8f486ba3f623ef3e108949f7ee62b5e237054560e71acbe1d661915747c74824f0d79eecc3f08526bdd103efc5",
+  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.12.2": "94e87415c3e335595ee9f73ed7fb7ba03878e84515f656a72d039806a23801749406172e886bce06d6ad2af4fa49aa328f96608b5bf1fa345a96f5b4b6b0c63d",
+  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.12.2": "3270d2c551fb3364db42a1ea1d215c226923904957ea793a4e10f8fae7609446581714e1c624ffe22d59af8309d0ebe50fc5b3c2388c502215e354dd7a50bc86",
+  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.12.2": "28008225537106ba502ff38eaf140edd1eb96f6a5c580cb608f66f13454c588511686118894d507aa4f8311d35a68f44e0e28a31be51d5ace82cd899a5023f7f",
+  "@unrs/resolver-binding-linux-arm64-musl@npm:1.12.2": "f904329e483fd29a69f9ce45b240b39cb9dcb0eed85ca730ea47b029ffe0f45d366a69f0ede28a9fa310e9c8ebd714f90e0de041a685801727a85ae73c0e2977",
+  "@unrs/resolver-binding-linux-loong64-gnu@npm:1.12.2": "a70e01e9a1661b379710e12cb7a1bf66e47b0bacfeb28ec98d41446e3e622a22d7bafcc7a79bcfdba232d02ef4fa6d6d70023782fc0429b8e69d5fb2a45b851e",
+  "@unrs/resolver-binding-linux-loong64-musl@npm:1.12.2": "7d479e515449b9ee3e315ed752f742f43d73308ab173e625fdca46b5c5f74db4c934fda1d71471b1160ac6899c095ca9e9b77934755130900bc49288c7b094c6",
+  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.12.2": "27fca56c2ba1c3e83186a5e5fb25294acfec8236ec87ebe92ca558047483d0c54760cf8571e0680081abfa395e8fcde177bd40eb1c86ec71cce08e6cf339f801",
+  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.12.2": "b72c979acfedfb9f3dfe4127754d8e385a4358eb1277372b253be82e30b14723e6b0125cca298027c2a5cadda79a58259c7ba99466e2a85ae2b44537549f0b29",
+  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.12.2": "ebd42e17022db356ed79aa9ef654b4943704abb7493d341c20f97aad14ac95d0dc754dcfa7d44309a41215963178aa5e7ab3853c4873847d02cdc931e392dc0d",
+  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.12.2": "4d3b19693df4864087791b815cfee10bbfe81078744fd9f69c07b2420053828264b541ac66c4d5665be866dfda9f365d6fe65664c77208e79467cee3624ed6ab",
+  "@unrs/resolver-binding-linux-x64-gnu@npm:1.12.2": "290e0c59a96cc7e940fd203828027953c6bf5f946bc2961526fae68a839d41595bf0232d31271d54cb2c2427f2eefa12dbbe06d5fc294f289d471b8ee481fd99",
+  "@unrs/resolver-binding-linux-x64-musl@npm:1.12.2": "c466cc2f1687acc8aebf6e34b83bb32c18d0a3c15321724c1547f9543ba4ad89282c2fdb44afe878ff4061e5321dbd760ba0161b06a17cead498209a8e7cbbd1",
+  "@unrs/resolver-binding-openharmony-arm64@npm:1.12.2": "87aaeb0aa1a62cc4dc1cbe5f1cf05902870eda80bb10f0dae65dd341dbad782dd5fb79430cc4a5140e4d0b4ced6828310bc97a28527fa89243f736c7685b3b38",
+  "@unrs/resolver-binding-wasm32-wasi@npm:1.12.2": "b9ecd9336f631c1664589e0a354e71b3747ec4d7efba1382967e10cc56750aeac8a12db133d3992286de9fbbd1c26df581651a52c4e597f33b21b3eb2fcc634a",
+  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.12.2": "ba009d8326e6712b539fb7357eb5fbdbfff55d100c06f65c0af5880f3928a1707f3cf7ac8d55eb75adb5ae6811de77eff7cd50c8f8b59bd48766b1137fadc33e",
+  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.12.2": "467322fec2622b9b89ccd744bc66cab7931e15d44b933f972238b034d4f3cf1b4aa7584a74f865bfd2a87201ce401fadbcd0ecf0670e76ca5f14feb148db3475",
+  "@unrs/resolver-binding-win32-x64-msvc@npm:1.12.2": "4fb01c3d900099b0a4a8367c4d6084b7ac493746682a6284c713d188eee628c7fba856e46a893f50c012b5c7ad6bcc7d49dc3c97fb7ae14dc49bfbaa0ccbdf35",
+  "lightningcss-android-arm64@npm:1.33.0": "46c40a0474a7a9ddcdc33e0ea634912894a9360b6ba6f2bc42f1a817d16992784d2fe6f421d293a90ea94fb481503e27fdc54f0540de0b41d7028fe9e9c9e56a",
+  "lightningcss-darwin-arm64@npm:1.33.0": "398b770e33f66db9e4c14e4a45d0e93fa59644bd29ce5082de79ee9560a5946321ac55e896aa7fb3f177d218bef3f2dca530e209a857f0f066bf3296f5dc0742",
+  "lightningcss-darwin-x64@npm:1.33.0": "132bdab8f7b66dc99730f1ccfcb882880e411420e3f9ca764c348c686112d75962d5d7e928f3bbce7088c1be168d00ea8d722fd909033b807eef191b5a2832c0",
+  "lightningcss-freebsd-x64@npm:1.33.0": "05001395776e994ea1254dcc2613f06b44458ba33769e3a1679a0f577e43632af378cc1582f3bd1cb36e480d237066a371bc04233d6c84f8e2fe9979ab4a4032",
+  "lightningcss-linux-arm-gnueabihf@npm:1.33.0": "d0f6d993846992cf6db80f2992d0b89ffddd65a8260bbe6a1534bde28510bcfa214e8831df9ccfef5ede006a6368de1649e1d96a3e122169286647b704e08f5f",
+  "lightningcss-linux-arm64-gnu@npm:1.33.0": "278a5c553e15ed7645d3e83a3b1515060e98a8742b7008af28d610d6495a09368e73ed8b90bcb537b37249bfc2446ef5b9614b3626222f25153c538909488548",
+  "lightningcss-linux-arm64-musl@npm:1.33.0": "7aa2a2ef42e8c713e6e8eb947bf64d5272c6fdbfca7b4eb3adde555357652be27cc0d84d6fef6266543c2d303943a4c4472679d1e258458119b159f0ca868ffe",
+  "lightningcss-linux-x64-gnu@npm:1.33.0": "fa57a09af3340dc5f11fdbff820fbb7b08e306e69350a500b523c88f54c1e3a40b3785fed6043d69e2e18bacd4b72410518c9b817ee987c704a80851d9201e45",
+  "lightningcss-linux-x64-musl@npm:1.33.0": "4b0cad846f8fbe4ec321a45ef9c0d02cf4277980ac34dcfc7b422b34381e7cb11512819401b01bf029d10aa0fb8a35906ce850ba38d9f43605917ccc9b0b5d4a",
+  "lightningcss-win32-arm64-msvc@npm:1.33.0": "5e4b58d7a41fe3c37ce2af7b1a95c3722a6064a84fb6286ba2cf1106651223403b5a5863ecd3eb8fb9732480e612e30d786b859329391b0197dffc88ca18c953",
+  "lightningcss-win32-x64-msvc@npm:1.33.0": "7beb4c8580f9ea45fea6d92a8de42f706c4935b2ca68f4f5163a2bd9f6ed1574f7e53686e4927883078b07a4063a9fffdc4b41968568354259066c7a70c156a4"
+}

pkgs/by-name/ch/chuckya/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  applyPatches,
+  mastodon,
+
+  patches ? [ ],
+  gemset ? ./gemset.nix,
+  yarnMissingHashes ? ./missing-hashes.json,
+  yarnHash ? "sha256-1kdslAHO6goCo6GwU3zPpaN6Zx9nXEXuxF3E35Xzcac=",
+}:
+
+let
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "TheEssem";
+      repo = "mastodon";
+      rev = "a7610aa2b86ffdcabc86008cca4234f135f642bd";
+      hash = "sha256-c786uMkC0fEj3h4FKTGzz+GADUOfWCfTziLOCM0xWSI=";
+    };
+    inherit patches;
+  };
+in
+
+(mastodon.override {
+  pname = "chuckya";
+  version = "0-unstable-2026-09-25";
+
+  srcOverride = src;
+
+  inherit gemset yarnMissingHashes yarnHash;
+}).overrideAttrs
+  {
+    passthru = {
+      updateScript = ./update.sh;
+
+      # needed for nix-update
+      inherit src;
+    };
+
+    meta = {
+      description = "Close-to-upstream soft fork of Mastodon Glitch Edition";
+      homepage = "https://github.com/TheEssem/mastodon";
+      license = lib.licenses.agpl3Plus;
+      maintainers = with lib.maintainers; [ defelo ];
+    };
+  }

pkgs/by-name/ch/chuckya/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update common-updater-scripts gnused bundix yarn-berry_4.yarn-berry-fetcher nixfmt
+
+set -euo pipefail
+
+pkgdir="pkgs/by-name/ch/chuckya"
+
+nix-update chuckya --src-only --version=branch --override-filename "$pkgdir/package.nix"
+
+# tags haven't been created since 2017, so it doesn't make sense to use this one as the base version
+sed -i -E 's/version = "1\.2\.2-unstable/version = "0-unstable/' "$pkgdir/package.nix"
+
+src="$(nix-build --no-out-link -A chuckya.src)"
+bundix --lockfile="$src/Gemfile.lock" --gemfile="$src/Gemfile" --gemset="$pkgdir/gemset.nix"
+nixfmt "$pkgdir/gemset.nix"
+yarn-berry-fetcher missing-hashes "$src/yarn.lock" > "$pkgdir/missing-hashes.json"
+update-source-version chuckya --source-key=mastodonModules.yarnOfflineCache --ignore-same-version --file="$pkgdir/package.nix"

pkgs/by-name/ci/ciel/package.nix

@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ciel";
-  version = "3.10.4";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "AOSC-Dev";
     repo = "ciel-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oKYPhevy0o5IxxqMneWAamRyZr7yForbsuhszWDUaQk=";
+    hash = "sha256-Axb41MJr59NTT1WruGpYlTOXnCa0cIgC8i4uhDkv6FI=";
   };
 
-  cargoHash = "sha256-hrjZKowkTQaNDrwOYM6pvUomcBrMrvlgvLl0UreeW8U=";
+  cargoHash = "sha256-VLTPcPmdUpa/6A/iaL8Oe8/QmeQMMP40j8J4nEEAeTQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ci/cine/package.nix

@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cine";
-  version = "1.8.4";
+  version = "1.8.6";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "diegopvlk";
     repo = "Cine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zUsfAe8PdfBv9XzJ0mY+ELIcl+x35v11THj9gtG/fxg=";
+    hash = "sha256-wtHrKrDpjMVOP1XZ4q+KQ5UBPRq/MNxyKTKuJpryU6o=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ci/ciphey/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  oniguruma,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  sqlite,
+  writableTmpDirAsHomeHook,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ciphey";
+  version = "0.12.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bee-san";
+    repo = "Ciphey";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jaI++uyAHXbx/o0qqbrDtVQbYjffecfKXAb4NCSXIRU=";
+  };
+
+  # cargo-nextest is only used as the upstream test runner. It is not needed
+  # by the test suite itself, and its nextest-runner dependency pulls in usdt,
+  # which fails to build on Darwin.
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Cargo.toml \
+      --replace-fail 'cargo-nextest = "0.9.117"' ""
+  '';
+
+  cargoHash = "sha256-Kn2lHsw4SGV8kE6AxjryL+To9OMq5loUE7GCndVbyWI=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    oniguruma
+    openssl
+    sqlite
+    zstd
+  ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
+    RUSTONIG_SYSTEM_LIBONIG = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Tool to automatically decrypt encryptions or hashes";
+    homepage = "https://github.com/bee-san/Ciphey";
+    changelog = "https://github.com/bee-san/Ciphey/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ciphey";
+  };
+})