.github: Bump cachix/install-nix-action from 31.10.7 to 31.11.0

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.7 to 31.11.0.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](a49548c11d...630ae543ea)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

ci/OWNERS

@@ -41,7 +41,7 @@
 /lib/meta.nix               @alyssais @NixOS/stdenv @llakala
 /lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
 /lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv @llakala
+/lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
 /lib/types.nix              @infinisil @roberth @hsjobeki @llakala
@@ -260,7 +260,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -143,3 +143,4 @@ lib.extendMkDerivation {
     });
 }
 ```
+:::

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-:::: {.note}
+::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-::::
+:::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -1,24 +0,0 @@
-# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
-
-This hook defaults a variety of environment variables known
-to control thread counts to 1. Many of these otherwise default
-to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
-compute capacity of a builder without additional parallelism.
-
-Currently sets the following environment variables:
-- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
-- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
-- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
-- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
-- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
-- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
-- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
-
-The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
-can be used to override the default thread count limit.
-`dontLimitCheckPhaseThreads = true;` can be used to disable
-thread limiting on an individual package.
-
-This hook will not attempt to override already existing
-definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,7 +13,6 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
-check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -35,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/rocq.section.md

@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,

doc/redirects.json

@@ -2920,8 +2920,7 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-check-phase-thread-limit": [
-    "index.html#setup-hook-check-phase-thread-limit",
+  "setup-hook-omp-check": [
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,9 +31,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
-  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
-
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
@@ -49,6 +46,8 @@
 
 - `mcphost` has been removed, as it was archived upstream and declared unmaintained.
 
+- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 

lib/attrsets.nix

@@ -1140,7 +1140,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    :::{#map-attrs-recursive-example .example}
+    ::: {.example #map-attrs-recursive-example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1165,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    :::{#map-attrs-recursive-cond-example .example}
+    ::: {.example #map-attrs-recursive-cond-example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.

lib/customisation.nix

@@ -564,7 +564,7 @@ rec {
 
     # Examples
 
-    :::{#ex-makeScope .example}
+    :::{.example #ex-makeScope}
     # Create an interdependent package set on top of `pkgs`
 
     The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
     ```
     :::
 
-    :::{#ex-makeScope-callPackage .example}
+    :::{.example #ex-makeScope-callPackage}
     # Using `callPackage` from a scope
 
     ```nix

lib/licenses/licenses.nix

@@ -310,6 +310,11 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
+    buddy = {
+      spdxId = "Buddy";
+      fullName = "Buddy License";
+    };
+
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -382,6 +387,13 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    cc-by-nc-30-igo = {
+      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
+      # spdxId = "CC-BY-NC-3.0-IGO";
+      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
+      free = false;
+    };
+
     cc-by-nc-40 = {
       spdxId = "CC-BY-NC-4.0";
       fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -926,6 +938,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    jpl-image = {
+      fullName = "JPL Image Use Policy";
+      spdxId = "JPL-image";
+    };
+
     knuth = {
       fullName = "Knuth CTAN License";
       spdxId = "Knuth-CTAN";
@@ -1611,6 +1628,11 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
     };
 
+    wordnet = {
+      spdxId = "WordNet";
+      fullName = "WordNet License";
+    };
+
     wtfpl = {
       spdxId = "WTFPL";
       fullName = "Do What The F*ck You Want To Public License";

maintainers/maintainer-list.nix

@@ -1629,12 +1629,6 @@
     githubId = 382798;
     name = "amfl";
   };
-  amiddelk = {
-    email = "amiddelk@gmail.com";
-    github = "amiddelk";
-    githubId = 1358320;
-    name = "Arie Middelkoop";
-  };
   aminechikhaoui = {
     email = "amine.chikhaoui91@gmail.com";
     github = "AmineChikhaoui";
@@ -2007,6 +2001,12 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -4432,6 +4432,12 @@
       { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
     ];
   };
+  caguiclajmg = {
+    email = "jmg.caguicla@guarandoo.me";
+    github = "caguiclajmg";
+    githubId = 32662060;
+    name = "John Mark Gabriel Caguicla";
+  };
   CaiqueFigueiredo = {
     email = "public@caiquefigueiredo.me";
     github = "caiquefigueiredo";
@@ -5607,6 +5613,11 @@
     githubId = 5953003;
     name = "Connor Nelson";
   };
+  conny = {
+    github = "ConstantConstantin";
+    githubId = 162139822;
+    name = "Constantin-Paul Hertel";
+  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -6797,6 +6808,13 @@
     githubId = 77843198;
     name = "Vasilis Manetas";
   };
+  Deric-W = {
+    email = "robo-eric@gmx.de";
+    github = "Deric-W";
+    githubId = 42873573;
+    name = "Eric Wolf";
+    keys = [ { fingerprint = "ADAA B6F3 A955 5589 D66C  CE61 80D2 DA42 8A4A 537F"; } ];
+  };
   DerickEddington = {
     email = "derick.eddington@pm.me";
     github = "DerickEddington";
@@ -9107,6 +9125,12 @@
     githubId = 41450706;
     name = "fin-w";
   };
+  fiona = {
+    email = "mail@fiona.hamburg";
+    github = "Fiona42069";
+    githubId = 260108682;
+    name = "fiona";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -21195,12 +21219,6 @@
     githubId = 19862;
     name = "KJ Ørbekk";
   };
-  orbitz = {
-    email = "mmatalka@gmail.com";
-    github = "orbitz";
-    githubId = 75299;
-    name = "Malcolm Matalka";
-  };
   orhun = {
     email = "orhunparmaksiz@gmail.com";
     github = "orhun";
@@ -25962,6 +25980,12 @@
     name = "Nikolay Korotkiy";
     keys = [ { fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5"; } ];
   };
+  silicalet = {
+    name = "Mr. why";
+    email = "silicalet@outlook.com";
+    github = "silicalet";
+    githubId = 188071249;
+  };
   silky = {
     name = "Noon van der Silk";
     email = "noonsilk+nixpkgs@gmail.com";
@@ -26632,12 +26656,6 @@
     github = "spreetin";
     githubId = 7392173;
   };
-  sprock = {
-    email = "rmason@mun.ca";
-    github = "sprock";
-    githubId = 6391601;
-    name = "Roger Mason";
-  };
   sputn1ck = {
     email = "kon@kon.ninja";
     github = "sputn1ck";

maintainers/scripts/update.py

@@ -307,7 +307,7 @@ async def commit_changes(
             commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
             if "commitMessage" in change:
                 commit_message = change["commitMessage"]
-            elif "commitBody" in change:
+            if "commitBody" in change:
                 commit_message = commit_message + "\n\n" + change["commitBody"]
             await check_subprocess_output(
                 "git",

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -41,5 +41,6 @@ and non-critical by adding `options = [ "nofail" ];`.
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
+nfs-file-systems.section.md
 overlayfs.section.md
 ```

nixos/doc/manual/configuration/nfs-file-systems.section.md

@@ -0,0 +1,52 @@
+# NFS File Systems {#sec-nfs-file-systems}
+
+[NFS][nfs] (Network File System) allows you to mount directories from remote machines over the network.
+
+[nfs]: https://en.wikipedia.org/wiki/Network_File_System
+[nfs-man]: https://man7.org/linux/man-pages/man5/nfs.5.html
+
+To mount NFS filesystems persistently, use the `fileSystems` option:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+  };
+}
+```
+
+## Automounting {#sec-nfs-automount}
+
+To have NFS filesystems mounted on-demand instead of at boot, add the `noauto` and `x-systemd.automount` options:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+    options = [
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+}
+```
+
+## Ad-hoc Mounting {#sec-nfs-adhoc}
+
+To mount NFS filesystems ad-hoc using the `mount` command, enable NFS and required RPC services:
+
+```nix
+{
+  boot.supportedFilesystems = [ "nfs" ];
+}
+```
+
+Then you can mount filesystems manually:
+
+```shell
+$ sudo mount -t nfs server.example.com:/export/data /mnt/data
+```
+
+For more information on NFS mount options, see the [nfs(5) man page][nfs-man].

nixos/doc/manual/redirects.json

@@ -619,6 +619,15 @@
   "sec-luks-file-systems-fido2-systemd": [
     "index.html#sec-luks-file-systems-fido2-systemd"
   ],
+  "sec-nfs-file-systems": [
+    "index.html#sec-nfs-file-systems"
+  ],
+  "sec-nfs-automount": [
+    "index.html#sec-nfs-automount"
+  ],
+  "sec-nfs-adhoc": [
+    "index.html#sec-nfs-adhoc"
+  ],
   "sec-sshfs-file-systems": [
     "index.html#sec-sshfs-file-systems"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -142,6 +142,8 @@
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
+- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
+
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
 
 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:

nixos/modules/misc/version.nix

@@ -54,8 +54,7 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
-        config.system.image.version;
+      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

nixos/modules/module-list.nix

@@ -1861,6 +1861,7 @@
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
+  ./services/web-servers/rustfs.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/send.nix
   ./services/web-servers/stargazer.nix

nixos/modules/rename.nix

@@ -511,7 +511,7 @@ in
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
-      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
+      security.pam.enableEcryptfs was removed since it was unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "rngd" ] ''
       rngd is not necessary for any device that the kernel recognises

nixos/modules/services/desktops/seatd.nix

@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/misc/graphical-desktop.nix

@@ -22,17 +22,23 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      # localectl looks into 00-keyboard.conf
-      etc."X11/xorg.conf.d/00-keyboard.conf".text = ''
-        Section "InputClass"
-          Identifier "Keyboard catchall"
-          MatchIsKeyboard "on"
-          Option "XkbModel" "${xcfg.xkb.model}"
-          Option "XkbLayout" "${xcfg.xkb.layout}"
-          Option "XkbOptions" "${xcfg.xkb.options}"
-          Option "XkbVariant" "${xcfg.xkb.variant}"
-        EndSection
-      '';
+      # systemd-localed looks into 00-keyboard.conf
+      # systemd-localed does not like if Option values are ""
+      etc."X11/xorg.conf.d/00-keyboard.conf".text =
+        let
+          optionLine =
+            name: value: lib.optionalString (value != null && value != "") ''Option "${name}" "${value}"'';
+        in
+        ''
+          Section "InputClass"
+            Identifier "Keyboard catchall"
+            MatchIsKeyboard "on"
+            ${optionLine "XkbModel" xcfg.xkb.model}
+            ${optionLine "XkbLayout" xcfg.xkb.layout}
+            ${optionLine "XkbOptions" xcfg.xkb.options}
+            ${optionLine "XkbVariant" xcfg.xkb.variant}
+          EndSection
+        '';
       systemPackages = with pkgs; [
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils

nixos/modules/services/monitoring/vnstat.nix

@@ -6,17 +6,32 @@
 }:
 let
   cfg = config.services.vnstat;
+  settingsFormat = pkgs.formats.keyValue { };
 in
 {
   options.services.vnstat = {
     enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
     package = lib.mkPackageOption pkgs "vnstat" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        Configuration for vnstat. Refer to
+        [https://humdi.net/vnstat/man/vnstat.conf.html]
+        or {manpage}`vnstat.conf(5)` for more information.
+      '';
+      example = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ cfg.package ];
 
+    environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
+
     users = {
       groups.vnstatd = { };
 
@@ -59,4 +74,8 @@ in
       };
     };
   };
+
+  meta = {
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
 }

nixos/modules/services/networking/headplane.nix

@@ -44,7 +44,7 @@ in
     settings = mkOption {
       description = ''
         Headplane configuration options. Generates a YAML config file.
-        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+        See <https://github.com/tale/headplane/blob/main/config.example.yaml>.
       '';
       type = types.submodule {
         options = {
@@ -129,6 +129,16 @@ in
           headscale = mkOption {
             type = types.submodule {
               options = {
+                api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing a Headscale API key.
+                    This is required for OIDC authentication aswell for the Headplane agent.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                };
+
                 url = mkOption {
                   type = types.str;
                   default = "http://127.0.0.1:${toString config.services.headscale.port}";
@@ -211,15 +221,6 @@ in
                           '';
                         };
 
-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing a Headscale pre-auth key for the agent.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
-                        };
-
                         executable_path = mkOption {
                           type = types.path;
                           readOnly = true;
@@ -237,20 +238,14 @@ in
                         };
 
                         cache_ttl = mkOption {
-                          type = types.nullOr types.int;
-                          default = null;
+                          type = types.ints.positive;
+                          default = 180000;
                           description = ''
-                            Deprecated cache TTL for the agent. This option is accepted
-                            by Headplane 0.6.2 but has no effect.
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
                           '';
                         };
 
-                        cache_path = mkOption {
-                          type = types.path;
-                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "The path to store the agent's cache.";
-                        };
-
                         work_dir = mkOption {
                           type = types.path;
                           default = "/var/lib/headplane/agent";
@@ -325,16 +320,6 @@ in
                     example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required for OIDC authentication.
-                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
-                  };
-
                   disable_api_key_login = mkOption {
                     type = types.bool;
                     default = false;
@@ -366,25 +351,6 @@ in
                     '';
                   };
 
-                  redirect_uri = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
-                      instead; Headplane derives the callback URL from it.
-                    '';
-                    example = "https://headplane.example.com/admin/oidc/callback";
-                  };
-
-                  strict_validation = mkOption {
-                    type = types.nullOr types.bool;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC validation setting. This option is accepted
-                      by Headplane 0.6.2 but has no effect.
-                    '';
-                  };
-
                   profile_picture_source = mkOption {
                     type = types.enum [
                       "oidc"
@@ -429,16 +395,6 @@ in
                     description = "Custom userinfo endpoint URL.";
                     example = "https://provider.example.com/userinfo";
                   };
-
-                  user_storage_file = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Deprecated path to the pre-0.6.2 JSON user database.
-                      Headplane uses this once to migrate users into its internal database.
-                    '';
-                    example = "/var/lib/headplane/users.json";
-                  };
                 };
               }
             );
@@ -452,33 +408,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    warnings =
-      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
-        ''
-          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
-          Use services.headplane.settings.server.base_url instead; Headplane derives
-          the OIDC callback URL from it.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
-        ''
-          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
-          in Headplane 0.6.2.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
-        ''
-          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
-          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
-        ''
-      ]
-      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
-        ''
-          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
-          effect in Headplane 0.6.2.
-        ''
-      ];
-
     assertions = [
       {
         assertion = config.services.headscale.enable;
@@ -502,26 +431,25 @@ in
         '';
       }
       {
-        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        assertion = cfg.settings.oidc == null || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.oidc.headscale_api_key_path must be set
-          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions.
+          services.headplane.settings.headscale.api_key_path must be set
+          when services.headplane.settings.oidc is non-null.
+          Headplane's OIDC flow requires a Headscale API key to mint sessions.
         '';
       }
       {
         assertion =
-          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+          agentSettings == null || !agentSettings.enabled || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when the agent is enabled.
+          services.headplane.settings.headscale.api_key_path must be set when the agent is enabled.
         '';
       }
     ];
 
     environment = {
       systemPackages = [ cfg.package ];
-      etc."headplane/config.yaml".source = "${settingsFile}";
+      etc."headplane/config.yaml".source = settingsFile;
     };
 
     systemd.services.headplane = {
@@ -534,6 +462,7 @@ in
         config.systemd.services.headscale.name
       ];
       requires = [ config.systemd.services.headscale.name ];
+      restartTriggers = [ settingsFile ];
 
       environment = {
         HEADPLANE_DEBUG_LOG = toString cfg.debug;

nixos/modules/services/networking/networkd-dispatcher.nix

@@ -93,8 +93,8 @@ in
 
   config = mkIf cfg.enable {
 
-    warnings = mkIf (!config.networking.useNetworkd) [
-      "services.networkd-dispatcher will not execute any scripts unless networking.useNetworkd is enabled."
+    warnings = mkIf (!config.systemd.network.enable) [
+      "services.networkd-dispatcher will not execute any scripts unless networkd is enabled, either via `systemd.network.enable` or via `networking.useNetworkd`."
     ];
 
     systemd = {

nixos/modules/services/networking/ssh/sshd.nix

@@ -232,6 +232,10 @@ in
       "openssh"
       "banner"
     ] "Use services.openssh.settings.Banner instead.")
+    (lib.mkRenamedOptionModule
+      [ "services" "openssh" "moduliFile" ]
+      [ "services" "openssh" "settings" "ModuliFile" ]
+    )
   ];
 
   ###### interface
@@ -729,6 +733,14 @@ in
                 '';
                 example = "/etc/ssh/banner";
               };
+              ModuliFile = lib.mkOption {
+                type = lib.types.path;
+                default = "${config.services.openssh.package}/etc/ssh/moduli";
+                defaultText = lib.literalExpression ''"''${config.services.openssh.package}/etc/ssh/moduli"'';
+                description = ''
+                  Specifies the {manpage}`moduli(5)` file to use for Diffie-Hellman key exchange.
+                '';
+              };
             };
           }
         );
@@ -740,16 +752,6 @@ in
         description = "Verbatim contents of {file}`sshd_config`.";
       };
 
-      moduliFile = lib.mkOption {
-        example = "/etc/my-local-ssh-moduli;";
-        type = lib.types.path;
-        description = ''
-          Path to `moduli` file to install in
-          `/etc/ssh/moduli`. If this option is unset, then
-          the `moduli` file shipped with OpenSSH will be used.
-        '';
-      };
-
     };
 
     users.users = lib.mkOption {
@@ -770,14 +772,12 @@ in
       };
       users.groups.sshd = { };
 
-      services.openssh.moduliFile = lib.mkDefault "${cfg.package}/etc/ssh/moduli";
       services.openssh.sftpServerExecutable = lib.mkDefault "${cfg.package}/libexec/sftp-server";
 
       environment.etc =
         authKeysFiles
         // authPrincipalsFiles
         // {
-          "ssh/moduli".source = cfg.moduliFile;
           "ssh/sshd_config".source = sshconf;
         };
 

nixos/modules/services/security/authelia.nix

@@ -268,15 +268,6 @@ let
       };
     };
 
-  writeOidcJwksConfigFile =
-    oidcIssuerPrivateKeyFile:
-    pkgs.writeText "oidc-jwks.yaml" ''
-      identity_providers:
-        oidc:
-          jwks:
-            - key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }}
-    '';
-
   # Remove an attribute in a nested set
   # https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5
   removeAttrByPath =
@@ -362,7 +353,12 @@ in
           execCommand = "${instance.package}/bin/authelia";
           configFile = format.generate "config.yml" cleanedSettings;
           oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (
-            writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile
+            pkgs.writeText "oidc-jwks.yaml" ''
+              identity_providers:
+                oidc:
+                  jwks:
+                    - key: {{ mustEnv "CREDENTIALS_DIRECTORY" | printf "%s/oidcIssuerPrivateKeyFile" | secret | mindent 10 "|" | msquote }}
+            ''
           );
           configArg = "--config ${
             builtins.concatStringsSep "," (
@@ -373,21 +369,25 @@ in
               ]
             )
           }";
+          # Mapping between the Authelia env variables and the secret keys defined in the module
+          envSecretsMap = {
+            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = "jwtSecretFile";
+            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "storageEncryptionKeyFile";
+            AUTHELIA_SESSION_SECRET_FILE = "sessionSecretFile";
+            AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "oidcHmacSecretFile";
+          };
+          nonNullEnvSecretsMap = lib.filterAttrs (_: v: instance.secrets.${v} != null) envSecretsMap;
         in
         {
           description = "Authelia authentication and authorization server";
           wantedBy = [ "multi-user.target" ];
           after = [ "network-online.target" ]; # Checks SMTP notifier creds during startup
           wants = [ "network-online.target" ];
-          environment =
-            (lib.filterAttrs (_: v: v != null) {
-              X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
-              AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
-              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
-              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
-              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
-            })
-            // instance.environmentVariables;
+          environment = {
+            X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
+          }
+          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
+          // instance.environmentVariables;
 
           preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
@@ -399,6 +399,12 @@ in
             StateDirectory = autheliaName instance.name;
             StateDirectoryMode = "0700";
 
+            LoadCredential =
+              lib.optional (
+                instance.secrets.oidcIssuerPrivateKeyFile != null
+              ) "oidcIssuerPrivateKeyFile:${instance.secrets.oidcIssuerPrivateKeyFile}"
+              ++ lib.mapAttrsToList (_: v: "${v}:${instance.secrets.${v}}") nonNullEnvSecretsMap;
+
             # Security options:
             AmbientCapabilities = "";
             CapabilityBoundingSet = "";

nixos/modules/services/torrent/rtorrent.nix

@@ -149,13 +149,6 @@ in
 
       protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
 
-      # Limits for file handle resources, this is optimized for
-      # an `ulimit` of 1024 (a common default). You MUST leave
-      # a ceiling of handles reserved for rTorrent's internal needs!
-      network.http.max_open.set = 50
-      network.max_open_files.set = 600
-      network.max_open_sockets.set = 3000
-
       # Memory resource usage (increase if you have a large number of items loaded,
       # and/or the available resources to spend)
       pieces.memory.max.set = 1800M
@@ -169,15 +162,14 @@ in
       execute.nothrow = sh, -c, (cat, "echo >", (session.path), "rtorrent.pid", " ", (system.pid))
 
       # Other operational settings (check & adapt)
-      encoding.add = utf8
       system.umask.set = 0027
       system.cwd.set = (cfg.basedir)
       network.http.dns_cache_timeout.set = 25
-      schedule2 = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
+      schedule = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
 
       # Watch directories (add more as you like, but use unique schedule names)
-      #schedule2 = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
-      #schedule2 = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
+      #schedule = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
+      #schedule = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
 
       # Logging:
       #   Levels = critical error warn notice info debug
@@ -218,6 +210,10 @@ in
               RuntimeDirectory = "rtorrent";
               RuntimeDirectoryMode = 750;
 
+              # rtorrent derives socket limits from this value since 0.16.15; see table in
+              # https://github.com/rakshasa/rtorrent/wiki/Socket-Manager-and-Resource-Allocation
+              LimitNOFILE = lib.mkDefault 16384;
+
               CapabilityBoundingSet = [ "" ];
               LockPersonality = true;
               NoNewPrivileges = true;

nixos/modules/services/web-servers/rustfs.nix

@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rustfs;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    marcel
+  ];
+
+  options.services.rustfs = {
+    enable = lib.mkEnableOption "RustFS Object Storage Server";
+
+    package = lib.mkPackageOption pkgs "rustfs" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The user RustFS should run as.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The group RustFS should run as.";
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for RustFS configuration. Refer to
+        <https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_5-configure-environment-variables>
+        for details on supported values.
+      '';
+      example = lib.literalExpression ''
+        {
+          RUSTFS_CONSOLE_ENABLE = "true";
+          RUSTFS_VOLUMES = "/mnt/rustfs";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+          ]
+        );
+        options = {
+          RUSTFS_VOLUMES = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/rustfs";
+            description = "The directory where RustFS stores it's data.";
+          };
+        };
+      };
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Path to environment file containing secrets like RUSTFS_ACCESS_KEY or RUSTFS_SECRET_KEY.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? RUSTFS_ACCESS_KEY);
+        message = "RUSTFS_ACCESS_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+      {
+        assertion = !(cfg.settings ? RUSTFS_SECRET_KEY);
+        message = "RUSTFS_SECRET_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+    ];
+
+    systemd = {
+      tmpfiles.settings."10-rustfs".${cfg.settings.RUSTFS_VOLUMES}.d = {
+        inherit (cfg) user group;
+      };
+
+      # https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_6-configure-system-service
+      services.rustfs = {
+        description = "RustFS Object Storage Server";
+        documentation = [ "https://rustfs.com/docs/" ];
+
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+
+        wantedBy = [ "multi-user.target" ];
+
+        environment = cfg.settings;
+
+        preStart = ''
+          if [ -z "$RUSTFS_ACCESS_KEY" ] || [ -z "$RUSTFS_SECRET_KEY" ]; then
+            echo "RustFS uses well-known default values for RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY,"
+            echo "please configure them using services.rustfs.environmentFile."
+            exit 1
+          fi
+        '';
+
+        serviceConfig = {
+          Type = "notify";
+          NotifyAccess = "main";
+          User = cfg.user;
+          Group = cfg.group;
+
+          EnvironmentFile = cfg.environmentFile;
+          ExecStart = lib.getExe cfg.package;
+
+          LimitNOFILE = 1048576;
+          LimitNPROC = 32768;
+          TasksMax = "infinity";
+
+          Restart = "always";
+          RestartSec = "10s";
+
+          OOMScoreAdjust = "-1000";
+          SendSIGKILL = false;
+
+          TimeoutStartSec = "30s";
+          TimeoutStopSec = "30s";
+
+          NoNewPrivileges = true;
+
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+        };
+      };
+    };
+
+    users = {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        inherit (cfg) group;
+      };
+      groups.${cfg.group} = { };
+    };
+  };
+}

nixos/modules/system/boot/plymouth.nix

@@ -68,7 +68,7 @@ let
 
   configFile = pkgs.writeText "plymouthd.conf" ''
     [Daemon]
-    ShowDelay=0
+    ShowDelay=${toString cfg.showDelay}
     DeviceTimeout=8
     Theme=${cfg.theme}
     ${cfg.extraConfig}
@@ -166,6 +166,15 @@ in
         '';
       };
 
+      showDelay = mkOption {
+        type = types.numbers.nonnegative;
+        default = 0;
+        example = 0.5;
+        description = ''
+          Time (in seconds) to delay the splash screen.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

nixos/modules/virtualisation/nspawn-container/default.nix

@@ -81,6 +81,34 @@ in
           which is prohibited within the Nix build sandbox where the test is run.
         '';
       }
+      {
+        # Check every interface defined in allInterfaces.
+        # Containers try to create a bridge "${config.system.name}-${interfaceName}"
+        assertion = lib.all (
+          iface:
+          let
+            hostName = "${config.system.name}-${iface.name}";
+          in
+          lib.stringLength hostName <= 15
+        ) (lib.attrValues cfg.allInterfaces);
+
+        message =
+          let
+            offendingInterfaces = lib.filter (
+              iface: lib.stringLength "${config.system.name}-${iface.name}" > 15
+            ) (lib.attrValues cfg.allInterfaces);
+            offenderList = map (
+              i:
+              "${config.system.name}-${i.name} (${toString (lib.stringLength "${config.system.name}-${i.name}")} chars)"
+            ) offendingInterfaces;
+          in
+          ''
+            The following generated host interface names exceed the Linux 15-character limit:
+              ${lib.concatStringsSep "\n            " offenderList}
+
+            Please shorten 'config.system.name' or the interface names in 'virtualisation.interfaces'.
+          '';
+      }
     ];
 
     virtualisation.systemd-nspawn.options = [

nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py

@@ -1,7 +1,6 @@
 import contextlib
 import dataclasses
 import fcntl
-import hashlib
 import logging
 import os
 import signal
@@ -125,13 +124,6 @@ def mk_veth(
     vlan: int,
 ) -> typing.Generator[None, None, None]:
     host_intf_name = f"{container_name}-{container_intf_name}"
-    # If the names for systemd-nspawn containers are too long,
-    # the generated bridge interface names will surpass the
-    # kernel limit IFNAMSIZ (15 characters + '\0').
-    if len(host_intf_name) > 15:
-        hashed = hashlib.sha256(host_intf_name.encode()).hexdigest()[:6]
-        host_intf_name = f"{host_intf_name[:8]}-{hashed}"
-
     with ensure_vlan_bridge(vlan) as bridge_name:
         logger.info("creating interface %s", host_intf_name)
         run_ip(

nixos/tests/all-tests.nix

@@ -1512,6 +1512,7 @@ in
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
   rush = runTest ./rush.nix;
+  rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
   rustls-libssl = runTest ./rustls-libssl.nix;
   rxe = runTest ./rxe.nix;
@@ -1539,7 +1540,7 @@ in
   sftpgo = runTest ./sftpgo.nix;
   sfxr-qt = runTest ./sfxr-qt.nix;
   sgt-puzzles = runTest ./sgt-puzzles.nix;
-  shadow = runTest ./shadow.nix;
+  shadow = import ./shadow { inherit runTest; };
   shadowsocks = handleTest ./shadowsocks { };
   shadps4 = runTest ./shadps4.nix;
   sharkey = runTest ./web-apps/sharkey.nix;
@@ -1684,6 +1685,7 @@ in
   systemd-journal = runTest ./systemd-journal.nix;
   systemd-journal-gateway = runTest ./systemd-journal-gateway.nix;
   systemd-journal-upload = runTest ./systemd-journal-upload.nix;
+  systemd-localed = runTest ./systemd-localed.nix;
   systemd-lock-handler = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./systemd-lock-handler.nix;
   systemd-machinectl = runTest ./systemd-machinectl.nix;
   systemd-misc = runTest ./systemd-misc.nix;
@@ -1842,6 +1844,7 @@ in
   };
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
+  vnstat = runTest ./vnstat.nix;
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
   vscodium = import ./vscodium.nix { inherit runTest; };
   vsftpd = runTest ./vsftpd.nix;

nixos/tests/authelia.nix

@@ -28,12 +28,10 @@
         # This is purely for testing purposes!
         environment.etc."authelia/storageEncryptionKeyFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
         };
         environment.etc."authelia/jwtSecretFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "a_very_important_secret";
         };
         environment.etc."authelia/users_database.yml" = {

nixos/tests/grafana/basic.nix

@@ -84,7 +84,7 @@ import ../make-test-python.nix (
       };
     };
 
-    containers = builtins.mapAttrs (
+    nodes = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -97,7 +97,7 @@ import ../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit containers;
+    inherit nodes;
 
     testScript = ''
       start_all()

nixos/tests/grafana/provision/default.nix

@@ -183,7 +183,7 @@ import ../../make-test-python.nix (
         };
     };
 
-    containers = builtins.mapAttrs (
+    nodes = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -196,7 +196,7 @@ import ../../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit containers;
+    inherit nodes;
 
     testScript = ''
       start_all()

nixos/tests/rustfs.nix

@@ -0,0 +1,69 @@
+{ pkgs, ... }:
+
+let
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+
+  rustfsPythonScript =
+    pkgs.writers.writePython3 "rustfs-test" { libraries = with pkgs.python3Packages; [ minio ]; }
+      /* python */ ''
+        import io
+        import os
+        from minio import Minio
+
+        minioClient = Minio(
+          'localhost:9000',
+          access_key='${accessKey}',
+          secret_key='${secretKey}',
+          secure=False
+        )
+        sio = io.BytesIO()
+        sio.write(b'Test from Python')
+        sio.seek(0, os.SEEK_END)
+        sio_len = sio.tell()
+        sio.seek(0)
+        minioClient.put_object(
+          'test-bucket',
+          'test.txt',
+          sio,
+          sio_len,
+          content_type='text/plain'
+        )
+      '';
+
+in
+{
+  name = "rustfs";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      marcel
+    ];
+  };
+
+  containers.machine =
+    { pkgs, ... }:
+    {
+      services.rustfs = {
+        enable = true;
+        environmentFile = builtins.toString (
+          pkgs.writeText "rustfs-secrets.env" ''
+            RUSTFS_ACCESS_KEY=${accessKey}
+            RUSTFS_SECRET_KEY=${secretKey}
+          ''
+        );
+      };
+
+      environment.systemPackages = with pkgs; [ minio-client ];
+    };
+
+  testScript = /* python */ ''
+    machine.wait_for_unit("rustfs.service")
+
+    machine.succeed("mc alias set rustfs http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
+    machine.succeed("mc mb rustfs/test-bucket")
+    machine.succeed("${rustfsPythonScript}")
+    assert "test-bucket" in machine.succeed("mc ls rustfs")
+    assert "Test from Python" in machine.succeed("mc cat rustfs/test-bucket/test.txt")
+    machine.succeed("mc rb --force rustfs/test-bucket")
+  '';
+}

nixos/tests/shadow/default.nix

@@ -0,0 +1,5 @@
+{ runTest }:
+{
+  login = runTest ./login.nix;
+  system = runTest ./system.nix;
+}

nixos/tests/shadow/system.nix

@@ -0,0 +1,147 @@
+{ pkgs, ... }:
+let
+  # Create a Python environment for the controller with all necessary test framework dependencies
+  controllerPython = pkgs.python3.withPackages (ps: [
+    ps.flaky
+    ps.jc
+    ps.pytest
+    ps.pytest-mh
+    ps.pytest-ticket
+  ]);
+
+  shadowHostName = "shadowhost";
+in
+{
+  name = "shadow-system-tests";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ joaosreis ];
+
+  nodes = {
+    # The target host: runs sshd, has shadow and other test dependencies installed, mutable users, and some specific settings to match the expectations of the test suite
+    shadowhost =
+      { pkgs, ... }:
+      {
+        networking.hostName = shadowHostName;
+        services.openssh = {
+          enable = true;
+          settings = {
+            PermitRootLogin = "yes";
+            PasswordAuthentication = false;
+          };
+        };
+
+        users.mutableUsers = true;
+
+        environment.systemPackages = with pkgs; [
+          shadow
+          expect
+        ];
+
+        users.defaultUserShell = "/bin/sh";
+
+        security.loginDefs.settings = {
+          PASS_MAX_DAYS = 99999;
+          PASS_MIN_DAYS = 0;
+          PASS_WARN_AGE = 7;
+          USERGROUPS_ENAB = "yes";
+          CREATE_HOME = "yes";
+          UID_MIN = 1001;
+          GID_MIN = 1001;
+        };
+
+        security.pam.services = {
+          newusers.text = ''
+            auth    required    pam_permit.so
+            account required    pam_permit.so
+            password required   pam_permit.so
+            session required    pam_permit.so
+          '';
+        };
+
+        services.envfs.enable = true;
+      };
+
+    # The controller: runs pytest-mh against the shadow host
+    controller =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          controllerPython
+          pkgs.openssh
+        ];
+      };
+
+  };
+
+  testScript = ''
+    import textwrap
+
+    start_all()
+
+    # ------------------------------------------------------------------
+    # 1. Generate an SSH keypair on the controller and authorise it
+    #    on the shadow host
+    # ------------------------------------------------------------------
+    controller.succeed("mkdir -p /root/.ssh && chmod 700 /root/.ssh")
+    controller.succeed(
+        "ssh-keygen -t ed25519 -N \'\' -f /root/.ssh/id_ed25519 2>&1"
+    )
+    pub_key = controller.succeed("cat /root/.ssh/id_ed25519.pub").strip()
+
+    # Inject the generated public key into the shadow host at runtime
+    shadowhost.succeed("mkdir -p /root/.ssh && chmod 700 /root/.ssh")
+    shadowhost.succeed(
+        f"echo '{pub_key}' >> /root/.ssh/authorized_keys && "
+        "chmod 600 /root/.ssh/authorized_keys"
+    )
+
+    # ------------------------------------------------------------------
+    # 2. Make sure the shadow host has a writable /etc/login.defs,
+    #    since the test framework expects to be able to write to it.
+    # ------------------------------------------------------------------
+    shadowhost.succeed(
+        "cp --remove-destination $(readlink -f /etc/login.defs) /etc/login.defs && "
+        "chmod 644 /etc/login.defs"
+    )
+
+    # ------------------------------------------------------------------
+    # 3. Copy the upstream test suite onto the controller
+    # ------------------------------------------------------------------
+    controller.succeed(
+        "cp -r ${pkgs.shadow.passthru.testFramework} /root/shadow-tests && "
+        "chmod -R u+w /root/shadow-tests"
+    )
+
+    # ------------------------------------------------------------------
+    # 4. Write the mhc.yaml topology config
+    #    This tells pytest-mh where the shadow host is and which role
+    #    it plays. The hostname must match the NixOS node name.
+    # ------------------------------------------------------------------
+    controller.succeed(textwrap.dedent("""
+        cat > /root/shadow-tests/mhc.yaml << 'EOF'
+        domains:
+          - id: shadow
+            hosts:
+              - hostname: ${shadowHostName}
+                role: shadow
+                ssh:
+                  user: root
+                  private_key: /root/.ssh/id_ed25519
+        EOF
+    """))
+
+
+    # ------------------------------------------------------------------
+    # 5. Run the upstream pytest-mh test suite from the controller
+    # ------------------------------------------------------------------
+    shadowhost.wait_for_unit("sshd.service")
+    # gpasswd tests are disabled, since they rely on specific behavior of the gpasswd command that is not applicable to NixOS
+    controller.succeed(
+        "cd /root/shadow-tests && "
+        "${controllerPython}/bin/pytest "
+        "--mh-config=mhc.yaml "
+        "--deselect=tests/test_gpasswd.py "
+        "-v tests/"
+    )
+  '';
+}

nixos/tests/systemd-localed.nix

@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  name = "systemd-localed";
+  meta.maintainers = [ lib.maintainers.haansn08 ];
+
+  nodes.machine = { ... }: {
+    # we don't use services.xserver.enable because some window managers like
+    # niri rely on systemd-localed for the keyboard layout:
+    # https://niri-wm.github.io/niri/Configuration%3A-Input.html#layout
+    services.graphical-desktop.enable = true;
+
+    services.xserver.xkb.layout = "jp";
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("default.target")
+    machine.wait_for_unit("dbus.socket")
+
+    status, stdout = machine.execute("localectl")
+    t.assertIn("X11 Layout: jp", stdout)
+  '';
+}

nixos/tests/vnstat.nix

@@ -0,0 +1,26 @@
+{ lib, ... }:
+{
+  name = "vnstat";
+  meta.maintainers = with lib.maintainers; [ hmenke ];
+
+  containers.machine = {
+    services.vnstat = {
+      enable = true;
+      settings = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("vnstat.service")
+
+    machine.succeed("vnstat --iflist")
+    machine.fail("vnstat -i dummy0")
+    machine.succeed("ip link add dummy0 type dummy")
+    machine.succeed("ip link set dummy0 up")
+    machine.wait_until_succeeds("vnstat -i dummy0", timeout=10)
+  '';
+}

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.6";
+  version = "1.33.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-kpp8GLpmK4knrtTeIprZroqytIBt0PMLkBE+sbTiGVo=";
+    hash = "sha256-DX68jaCv88o4PIxrWmrb5ALuW7JWaFuMVJnzpzn51t0=";
   };
 
   outputs = [

pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix

@@ -47,7 +47,6 @@ melpaBuild (finalAttrs: {
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"
-      "x86_64-darwin"
       "x86_64-linux"
       "x86_64-windows"
     ];

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -28,10 +28,6 @@ let
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
       hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
-      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
       hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";

pkgs/applications/editors/jetbrains/ides/datagrip.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
       hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg";
-      hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
       hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";

pkgs/applications/editors/jetbrains/ides/dataspell.nix

@@ -21,10 +21,6 @@ let
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.tar.gz";
       hash = "sha256-SSmIPF0pDMolxeXL21UaHMbZdtYbChWVxTKZOsPhH+I=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.dmg";
-      hash = "sha256-2qzwzGMYuy1qEuTprxwNa5gOPgCZq2MadSKN8FT8w8c=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.dmg";
       hash = "sha256-MGWufS0nlswdqhACNQWtlXJwfPiYw8wUx7olIxPS15k=";

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
       hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg";
-      hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
       hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
       hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
-      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
       hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -22,10 +22,6 @@ let
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
       hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
-      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
       hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";

pkgs/applications/editors/jetbrains/ides/mps.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
       hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos.dmg";
-      hash = "sha256-whYAjKkF79mrknHflZnvOOy2bLosYUguelZDSuPt3uY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg";
       hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ=";

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
-      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -20,10 +20,6 @@ let
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
-      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
       hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -31,10 +31,6 @@ let
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
       hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
-      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
       hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
       hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
-      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
       hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -25,10 +25,6 @@ let
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
       hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
-      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
       hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";

pkgs/applications/editors/jetbrains/ides/webstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg";
-      hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";

pkgs/applications/editors/jetbrains/readme.md

@@ -78,7 +78,5 @@ Any comments or other manual changes between these markers will be removed when
  - on `aarch64-linux`:
    - from source build
    - see if build (binary or source) works without expat
- - on `x86_64-darwin`:
-   - from source build
  - on `aarch64-darwin`:
    - from source build

pkgs/applications/editors/jetbrains/updater/jetbrains_nix_updater/config.py

@@ -3,7 +3,7 @@ import os
 import dataclasses
 from pathlib import Path
 
-SUPPORTED_SYSTEMS = ["x86_64-linux", "aarch64-linux", "x86_64-darwin", "aarch64-darwin"]
+SUPPORTED_SYSTEMS = ["x86_64-linux", "aarch64-linux", "aarch64-darwin"]
 
 
 def find_nixpkgs(current_path: Path) -> Path:

pkgs/applications/editors/jetbrains/updater/updateInfo.json

@@ -4,7 +4,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg"
     }
   },
@@ -13,7 +12,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg"
     }
   },
@@ -22,7 +20,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg"
     }
   },
@@ -31,7 +28,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.dmg"
     }
   },
@@ -40,7 +36,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/go/goland-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg"
     }
   },
@@ -49,7 +44,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg"
     }
   },
@@ -62,7 +56,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg"
     }
   },
@@ -71,7 +64,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg"
     }
   },
@@ -80,7 +72,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/pycharm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/pycharm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.dmg"
     }
   },
@@ -93,7 +84,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg"
     }
   },
@@ -102,7 +92,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg"
     }
   },
@@ -111,7 +100,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg"
     }
   },
@@ -120,7 +108,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg"
     }
   }

pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix

@@ -13,7 +13,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel clojupyter.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.clojure = clojupyter.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.clojure = clojupyter.definition; }) ]' -c jupyter-notebook
 
 let
   cljdeps = import ./deps.nix { inherit pkgs; };

pkgs/applications/editors/jupyter-kernels/octave/default.nix

@@ -12,7 +12,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel octave-kernel.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.octave = octave-kernel.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.octave = octave-kernel.definition; }) ]' -c jupyter-notebook
 
 let
   kernel = callPackage ./kernel.nix {

pkgs/applications/editors/jupyter-kernels/wolfram/default.nix

@@ -7,7 +7,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel wolfram-for-jupyter-kernel.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.wolfram = wolfram-for-jupyter-kernel.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.wolfram = wolfram-for-jupyter-kernel.definition; }) ]' -c jupyter-notebook
 
 let
   kernel = callPackage ./kernel.nix { };

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0782";
+  version = "9.2.0541";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
+    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/generated.nix

@@ -1610,12 +1610,12 @@ final: prev: {
 
   base16-nvim = buildVimPlugin {
     pname = "base16-nvim";
-    version = "0-unstable-2026-07-11";
+    version = "0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "base16-nvim";
-      rev = "012273e4bbf3e143224a272ad2efd10b69a000ba";
-      hash = "sha256-8npfL3fYQ05dHWGm46bdRS3tMOyooXhyxM0gpI0Ompw=";
+      rev = "fd128e380624c34f12a201690944bf657f861361";
+      hash = "sha256-W5tHY4U87eCAiOerNMAeqcbz1JlMZ6YGqSC0TBhI6t4=";
     };
     meta.homepage = "https://github.com/RRethy/base16-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -1736,12 +1736,12 @@ final: prev: {
 
   bitbake = buildVimPlugin {
     pname = "bitbake";
-    version = "6.0.1";
+    version = "6.0.2";
     src = fetchFromGitHub {
       owner = "openembedded";
       repo = "bitbake";
-      tag = "yocto-6.0.1";
-      hash = "sha256-ReX6cGzy6IOfMR1z90U5QWdWLkRqO524zXcp/7xBfBk=";
+      tag = "yocto-6.0.2";
+      hash = "sha256-Jho1X7udSvh413u8ueRqR8z1Q7E2qcotdkzl9azBu7g=";
     };
     meta.homepage = "https://github.com/openembedded/bitbake/";
     meta.license = unfree;
@@ -2310,12 +2310,12 @@ final: prev: {
 
   catppuccin-vim = buildVimPlugin {
     pname = "catppuccin-vim";
-    version = "0-unstable-2026-06-30";
+    version = "0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "vim";
-      rev = "029e9a878a58eba039e47847a2f17e10acefb3f5";
-      hash = "sha256-gDq7vXIBc2mY8DMl+A6Ps0qPvAIR3NDhCRxBgqMOYCM=";
+      rev = "78c40a773e56d05e1c4e29216c45a483bdd67351";
+      hash = "sha256-xOf5PwhgVWwMGtJt+om9z0MULrMLoO6AmaJ/G/vWGrk=";
     };
     meta.homepage = "https://github.com/catppuccin/vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3484,12 +3484,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-07-07";
+    version = "0.0.82-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "0ff79c0056910e574af2b2aa31aa359065705c4b";
-      hash = "sha256-Pp+qMv4Inc4JsrK59XDS+5CX/F9bEd4Pp4Cb611K+lk=";
+      rev = "d1689a4876305e5fc6691910c8ee6f1eb5da2219";
+      hash = "sha256-6AjcLD8gh3rG3uXj8LjdXr5pbzIKwtu+14ZcCVwXCuI=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = unfree;
@@ -3652,12 +3652,12 @@ final: prev: {
 
   cole-nvim = buildVimPlugin {
     pname = "cole.nvim";
-    version = "0-unstable-2026-05-29";
+    version = "0-unstable-2026-07-14";
     src = fetchFromGitHub {
       owner = "thekylehuang";
       repo = "cole.nvim";
-      rev = "1920cfa31c717e1f73a5a6e5a2c02a44b5faeb5c";
-      hash = "sha256-k153XzTkkBm1qF6iKK8fzmAHIPnoIbXEAxAOQIoAPo0=";
+      rev = "74f6a8e1bbce0d9a845a339d849bca3c0bec7aaa";
+      hash = "sha256-TJxpLhabIl73I9O6Soi9TEd/9Xa7FVfpV7sNrza64oM=";
     };
     meta.homepage = "https://github.com/thekylehuang/cole.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3778,12 +3778,12 @@ final: prev: {
 
   command-t = buildVimPlugin {
     pname = "command-t";
-    version = "8.1";
+    version = "8.2";
     src = fetchFromGitHub {
       owner = "wincent";
       repo = "command-t";
-      tag = "8.1";
-      hash = "sha256-yp3kqhHQMtUFFPfbqgnrmmclx6r39k3ohen4Ys3s3BU=";
+      tag = "8.2";
+      hash = "sha256-Q2fYHr9GFQvkoyoAOkvxJDArtqMxq7352eSGQNHBFZ8=";
     };
     meta.homepage = "https://github.com/wincent/command-t/";
     meta.license = getLicenseFromSpdxId "BSD-2-Clause";
@@ -9325,12 +9325,12 @@ final: prev: {
 
   lspsaga-nvim = buildVimPlugin {
     pname = "lspsaga.nvim";
-    version = "0-unstable-2026-05-14";
+    version = "0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "nvimdev";
       repo = "lspsaga.nvim";
-      rev = "3e33a6a6c5d379f3d4fae77fae6b53b762a0a30f";
-      hash = "sha256-hkXvv5NgW+wnbR7wGtAs+aUDv/4o/T5Mv7rGhk1qR3U=";
+      rev = "cf6fc9473bba1d332eda9887855ea29ed9b37701";
+      hash = "sha256-ggw3U/LXNCDaSmXmHWEV9coOjoDW6v0JvD5BGSvDCaM=";
     };
     meta.homepage = "https://github.com/nvimdev/lspsaga.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11034,12 +11034,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-07-12";
+    version = "1.4.0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "e3a0a2bfcc5e7dc26f11e102e26ff6c1f43582fb";
-      hash = "sha256-fflB8jO6lwvLctuKDAdobWvksHEfNNrHsx6pEJdmwEQ=";
+      rev = "50bdc4130d9e30d28d0b209544d49ee472f6bf12";
+      hash = "sha256-hsYouOS+ImmA6HnwqFRq3RMBTsn87oHrnijMqvargU4=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11118,12 +11118,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-09";
+    version = "3.0.0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "a0847c4bea5a5f92a36e3f3bf7da99d7d685d3ac";
-      hash = "sha256-37iNw57kC+fFk+hEgHKd07+NNDKP2g0YAmLwPYw6NyQ=";
+      rev = "95295edaa26e8e8db5a9bc4119256e602311c6bc";
+      hash = "sha256-hAswp9Ba5xfFfBS+NKjLOoSky+SRrLfd8fdFC46Dq2s=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -11611,12 +11611,12 @@ final: prev: {
 
   neotest-python = buildVimPlugin {
     pname = "neotest-python";
-    version = "0-unstable-2026-07-03";
+    version = "0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest-python";
-      rev = "51c453d57f8d5156671b42ea57fafa2e1c9fb641";
-      hash = "sha256-M0FROtTXMiAmmo83m1WwSQ5px5I6awV4I3/UY+sTYAc=";
+      rev = "1b56ca4ba51c6014f986d6548ee629bdc95589d1";
+      hash = "sha256-9FL0qWTdkeX57ujRvSa9QqO/ZIthlzLSJyKHtNitbSg=";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest-python/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12140,6 +12140,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  none-ls-extras-nvim = buildVimPlugin {
+    pname = "none-ls-extras.nvim";
+    version = "0-unstable-2026-06-06";
+    src = fetchFromGitHub {
+      owner = "nvimtools";
+      repo = "none-ls-extras.nvim";
+      rev = "27681d797a26f1b4d6119296df42f5204c88a2dc";
+      hash = "sha256-GZLT8X1eLeSkiV5EN1nOkCQg5nwNATURi/KMj90i40I=";
+    };
+    meta.homepage = "https://github.com/nvimtools/none-ls-extras.nvim/";
+    meta.license = getLicenseFromSpdxId "Unlicense";
+    meta.hydraPlatforms = [ ];
+  };
+
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
     version = "0-unstable-2026-06-02";
@@ -12436,12 +12450,12 @@ final: prev: {
 
   nvim-colorizer-lua = buildVimPlugin {
     pname = "nvim-colorizer.lua";
-    version = "0-unstable-2026-07-11";
+    version = "0-unstable-2026-07-14";
     src = fetchFromGitHub {
       owner = "catgoose";
       repo = "nvim-colorizer.lua";
-      rev = "149fbd9f5e25511b0a8bad3ccecd43d1bc584f86";
-      hash = "sha256-jRqUMQuJVxMfQpLZ0A7hlwIXPqcip990Ay5X140uh0Y=";
+      rev = "72a05f62c52241bc7441c820eb53946f92b2e6a4";
+      hash = "sha256-hdnk816SBKWD/Ula4hjQ3o14I3+fBmEengfo72S4+8U=";
     };
     meta.homepage = "https://github.com/catgoose/nvim-colorizer.lua/";
     meta.license = unfree;
@@ -12657,12 +12671,12 @@ final: prev: {
 
   nvim-dap-ui = buildVimPlugin {
     pname = "nvim-dap-ui";
-    version = "4.0.0-unstable-2026-04-05";
+    version = "4.0.0-unstable-2026-07-14";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-dap-ui";
-      rev = "1a66cabaa4a4da0be107d5eda6d57242f0fe7e49";
-      hash = "sha256-J/gUD4X//JtC2HB3HBeONivCQdMnXDnZJWd6jFF9+nk=";
+      rev = "cc9dd33aade7f20bae414d0cba163bc60d4d4b43";
+      hash = "sha256-za3/6W1J6aMvNZQq8ANCq+TGHKHJtSxR/C5t3/oL3DI=";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-dap-ui/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14152,12 +14166,12 @@ final: prev: {
 
   ocaml-nvim = buildVimPlugin {
     pname = "ocaml.nvim";
-    version = "1.0.0-unstable-2026-07-03";
+    version = "1.0.0-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "tarides";
       repo = "ocaml.nvim";
-      rev = "333647c7d16aa0e28a6d7cf15f2716111bec53af";
-      hash = "sha256-+RUoWuV9YEOsx+jOTa8No5OyoeO6iVUuSsrtHmYKpb4=";
+      rev = "e12ded73f461d392cc2cad579a39733ebe34de61";
+      hash = "sha256-3NiRM02g7BU+MzCybSfsyZdODcPA+RbuNU9QOmmoCxo=";
     };
     meta.homepage = "https://github.com/tarides/ocaml.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16086,12 +16100,12 @@ final: prev: {
 
   seoul256-vim = buildVimPlugin {
     pname = "seoul256.vim";
-    version = "0-unstable-2026-05-20";
+    version = "0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "seoul256.vim";
-      rev = "88997adf362f57c3eadedde6b8c1393fe218c02c";
-      hash = "sha256-Em9vpXJmUyLfBHOLHVQQUGsOuluwyx+J4Q5vU8akyS0=";
+      rev = "0357ff3e44faab66c98bc98dfc89c834e37012da";
+      hash = "sha256-TEu6ybYthrtTd7k2HkQEEH1z2iImU0I6SEclt87oAGQ=";
     };
     meta.homepage = "https://github.com/junegunn/seoul256.vim/";
     meta.license = unfree;
@@ -17926,12 +17940,12 @@ final: prev: {
 
   tinted-nvim = buildVimPlugin {
     pname = "tinted-nvim";
-    version = "1.0.0-unstable-2026-06-27";
+    version = "1.0.0-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-nvim";
-      rev = "f72f46057151de65ece4c280f67db84c63d64c76";
-      hash = "sha256-U9SSaB68n/rDaeyQfRk0SnEwKW7MKG9gUaFG0ivt70A=";
+      rev = "a229fe0efadb4d9bfa92cad16175bb4e93fa70d4";
+      hash = "sha256-a79rQSpPyCH/zbunrW9NxtsnwKVcQiwLzhW/1YNl3a4=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -17940,12 +17954,12 @@ final: prev: {
 
   tinted-vim = buildVimPlugin {
     pname = "tinted-vim";
-    version = "01-unstable-2026-06-21";
+    version = "01-unstable-2026-07-15";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-vim";
-      rev = "65a386074124f211536dc04f7427cbcbd80ee183";
-      hash = "sha256-hRgKzVnFtpAsI4dxmOTdSdi02+VEvTydbdTU+HqyhzI=";
+      rev = "1ee9f7bbb3e5928b84ab0bedaf04f6ad9dafdfb2";
+      hash = "sha256-fwFxfq0Kr/EPdx4r9qTjzvjxkQsNoAD9KvB6kP3NwlE=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-vim/";
     meta.license = unfree;
@@ -18504,12 +18518,12 @@ final: prev: {
 
   typst-preview-nvim = buildVimPlugin {
     pname = "typst-preview.nvim";
-    version = "1.4.2-unstable-2026-03-30";
+    version = "1.5.0";
     src = fetchFromGitHub {
       owner = "chomosuke";
       repo = "typst-preview.nvim";
-      rev = "87db18b8d19c8b0eed399f52e4c527ce5afe4817";
-      hash = "sha256-EUYiHzDWJQM9Guk6ZM5GWE/etB+GHM48myRg/BPtOV0=";
+      tag = "v1.5.0";
+      hash = "sha256-UTugVfydwGTmf5RomQ0R72Yf6fSz8gGeY/fg51qW454=";
     };
     meta.homepage = "https://github.com/chomosuke/typst-preview.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -18770,12 +18784,12 @@ final: prev: {
 
   vague-nvim = buildVimPlugin {
     pname = "vague.nvim";
-    version = "2.1.3";
+    version = "2.1.4";
     src = fetchFromGitHub {
       owner = "vague-theme";
       repo = "vague.nvim";
-      tag = "v2.1.3";
-      hash = "sha256-ULBLMmJQe93N3uOPx6h8wif+38g0OSC7haklfVJyZdA=";
+      tag = "v2.1.4";
+      hash = "sha256-57dHWOUPFIyFdLEs9RDv0cateLRc8XAqT4TmDUSQyV4=";
     };
     meta.homepage = "https://github.com/vague-theme/vague.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -25098,12 +25112,12 @@ final: prev: {
 
   vimade = buildVimPlugin {
     pname = "vimade";
-    version = "2.5.1-unstable-2026-05-17";
+    version = "2.5.1-unstable-2026-07-16";
     src = fetchFromGitHub {
       owner = "TaDaa";
       repo = "vimade";
-      rev = "a5323f4930e3f1f48c0329e50bd218ba61577aaf";
-      hash = "sha256-sBCZ/EEuGoqCBSg3Jh1o05sSuAJNOdortEB7b4sR2Z4=";
+      rev = "3d3d2db7ecd43c0181b20fede11d26f090dbc0d9";
+      hash = "sha256-dR+h9pPglZmpOsrmOUJpwVDcx5m+RqeNMjsoWcGhMsQ=";
     };
     meta.homepage = "https://github.com/TaDaa/vimade/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";

pkgs/applications/editors/vim/plugins/non-generated/windsurf-nvim/default.nix

@@ -14,7 +14,6 @@ let
   codeiumHashes = {
     x86_64-linux = "sha256-IeNK7UQtOhqC/eQv7MAya4jB1WIGykSR7IgutZatmHM=";
     aarch64-linux = "sha256-ujTFki/3V79El2WCkG0PJhbaMT0knC9mrS9E7Uv9HD4=";
-    x86_64-darwin = "sha256-r2KloEQsUku9sk8h76kwyQuMTHcq/vwfTSK2dkiXDzE=";
     aarch64-darwin = "sha256-1jNH0Up8mAahDgvPF6g42LV+RVDVsPqDM54lE2KYY48=";
   };
 
@@ -30,7 +29,6 @@ let
           {
             x86_64-linux = "linux_x64";
             aarch64-linux = "linux_arm";
-            x86_64-darwin = "macos_x64";
             aarch64-darwin = "macos_arm";
           }
           .${system} or throwSystem;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3098,6 +3098,10 @@ assertNoAdditions {
     dependencies = [ self.nui-nvim ];
   };
 
+  none-ls-extras-nvim = super.none-ls-extras-nvim.overrideAttrs {
+    dependencies = [ self.none-ls-nvim ];
+  };
+
   none-ls-nvim = super.none-ls-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -865,6 +865,7 @@ https://github.com/aktersnurra/no-clown-fiesta.nvim/,,
 https://github.com/shortcuts/no-neck-pain.nvim/,,
 https://github.com/kartikp10/noctis.nvim/,,
 https://github.com/folke/noice.nvim/,,
+https://github.com/nvimtools/none-ls-extras.nvim/,,
 https://github.com/nvimtools/none-ls.nvim/,,
 https://github.com/nordtheme/vim/,,nord-vim
 https://github.com/shaunsingh/nord.nvim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-YVomTY/KpBcR4dZr0EN4egkuzvQXUCj7RvwgMo88z9Q=";
+          hash = "sha256-JswgBhADhoEUug2h1ZZ7OtFjFUVgCxiqIaWCYCMf+Sw=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-jbTFmXqtdt6+1SdhfOLcnhOhtSESYM9th8k5EJ4Nex4=";
+          hash = "sha256-+TBwLHUsPx+TiFP+5Gg59Yii76IERNbBQT3RLidogSo=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-YFLVhDckeXIItc+AvHlJ/B45c43Ubi3BKr8gy3Ui68w=";
+          hash = "sha256-Xglh5yLP4QoeMxqqUUAJyuyehN9hdDookhjwU6znRX4=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.209";
+      version = "2.1.211";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -14,10 +14,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-lhDt8XEF90y4pj8RLUZgfZNmHkV1XlmHsYuT6sGJMRc=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-SqFRn5FVQ+LcpmYT7/AIdIKTOxbapaKvPi+I360dVW8=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-iuYVCG4YWPFI8o4GmuNjkbXvzJsAre0gSSEWq6CUk2E=";
@@ -57,7 +53,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = [ lib.maintainers.azd325 ];
   };

pkgs/applications/editors/vscode/extensions/continue.continue/default.nix

@@ -13,10 +13,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-4GiTNT+UPdTth9VDhHTXfqhQ5gM6vfLAaU5Cy3VMTCI=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-XJfDXWYpxYV5YHIBINqNJdyVho7Xd9OGMu11WE0LENM=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-QngCharrjiDKrY7RgWtKzIJxjXazuRvpuHVUAxknWfA=";
@@ -44,7 +40,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     maintainers = with lib.maintainers; [ flacks ];
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
     ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.23.1";
-          hash = "sha256-B97cImVKnholhZV0ZBru/gpeVSaTHOFfQywwmjk+kq8=";
+          version = "3.24.12";
+          hash = "sha256-2vpFCxF65Y/VfyTHDO0wLAe0+m/lc0+iloEI//FdaQg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1226,8 +1226,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.12.1";
-          hash = "sha256-GKm3rZMvU/5Ii01GjUg7rE15TnOtDTh0LwkDVsuSLfY=";
+          version = "2.12.3";
+          hash = "sha256-/hFBw6STQG4zycS44em1DlaQSpKGP4w7YlH+fu/cHlA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.44.1";
-          hash = "sha256-OH4i4cGh/ivHQNAI55FHjM9ZjnhMaJSnsuQUnxub9/g=";
+          version = "0.44.2";
+          hash = "sha256-jz1j8KzD5PDZ+P5V7yLo1BEmcW+q+D2nYKzYEf7Sg2w=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -2015,8 +2015,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.84.2";
-          hash = "sha256-UBoZ6DxT5d7zeTycgmuLomzoVcB7iAnflfxAup6QslI=";
+          version = "6.85.3";
+          hash = "sha256-EsQ+95Wo/5F9mEMQ7X36vBgUWlsz5BCOm+7QrGHuepc=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2592,8 +2592,8 @@ let
         mktplcRef = {
           publisher = "jnoortheen";
           name = "nix-ide";
-          version = "0.5.9";
-          hash = "sha256-hPOcp6Yksgfu1+In21/gJ3MthV8JUV5WaRpYHvo5GGk=";
+          version = "0.5.10";
+          hash = "sha256-5rNqQRFLryzeIezUiqgvSY8Vz5n48367RHQrFDxpoD8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@@ -3190,10 +3190,6 @@ let
                 arch = "linux-x64";
                 hash = "sha256-pmA7BNwyHiaU93j61/MyrBV5kH0DlW+7BA6HNlKGnso=";
               };
-              "x86_64-darwin" = {
-                arch = "darwin-x64";
-                hash = "sha256-E2KRzjIxLFmwArzEKittjejacrCOFFNNzphWw8v5CpE=";
-              };
               "aarch64-linux" = {
                 arch = "linux-arm64";
                 hash = "sha256-pnQP1OKr3NJgUuXzO1InYqGA49OuMFn2iEf8wpl4PqM=";
@@ -3224,7 +3220,6 @@ let
           maintainers = [ lib.maintainers.magnouvean ];
           platforms = [
             "x86_64-linux"
-            "x86_64-darwin"
             "aarch64-darwin"
             "aarch64-linux"
           ];
@@ -5118,8 +5113,8 @@ let
         mktplcRef = {
           name = "vscode-gradle";
           publisher = "vscjava";
-          version = "3.17.3";
-          hash = "sha256-heFcGOe10r7y23xyFc/nFKk/nsrX4wc5fT9e4GKGhW0=";
+          version = "3.18.0";
+          hash = "sha256-ybMejIJER9HHVh1z+tazgvQ0UIa8eKoJBb7JOLU1Kpw=";
         };
 
         meta = {

pkgs/applications/editors/vscode/extensions/docker.docker/default.nix

@@ -10,10 +10,6 @@ let
       hash = "sha256-jfjd2V7IJ4GQlz/pXmrY/LlBjQ2qtlsQV4ZRD8RiWTg=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-aOFoTLVaaMFsdGoWV0OC31/nmOHXUhr2Y8K4SWcNil8=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-ugluaghNNZ/VrQORVIhc0Fuv3rHo++LO3Uwg2ujmsQc=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -45,7 +45,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix

@@ -14,10 +14,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
@@ -52,7 +48,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ xiaoxiangmoe ];
   };

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.16.0";
-    hash = "sha256-cnKYDrExL3yDJkEofWPglzMa50KDMgKQxsM5zK1RaBs=";
+    version = "1.16.1";
+    hash = "sha256-UIxXrJpH/Ix4Ev6veumcT/9h1SgZgEXHjnwkOH9ch44=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix

@@ -22,10 +22,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-1zz9xrMALIOXzMpArWSwO12WmRE+0ldbIwUFH1G2GQI=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-3PoSbp8M2X4bhSQyxvNC7jtNDVNEuEKeYRZQMFOmbtQ=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-F4CsyiX46SpjilJNV+qYps1JAw09pVruLmW+muN9/B4=";
@@ -138,7 +134,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -24,10 +24,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-EV3745OXbwrRmc8P5e13DZbomyJGcYQUF07WflRWU1Q=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-i2cALeaSXfwIdfXNeWfND99nFYIiOFwsxbqU7/Effx8=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-KCIkjBmYZPiuFmQ3/aDycARYIHPyDTmMkoGcuG5DQX8=";
@@ -159,7 +155,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -18,10 +18,6 @@ let
       hash = "sha256-HQfmDV6rJX6l1pGybe8//2QrTSwE+rlEJOi4/iW69lY=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-tAZyt2fwB/GOhffY5lhHJTmbXG8UloynPtjoMtWRHok=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-v7fatW/LMJ8CeSRrE/5b7dLqOrhNhwzUySUxtAMuBUE=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/ms-vscode.vscode-speech/default.nix

@@ -16,10 +16,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-dZwOBehoYEqaYskvcPB55IKnG1CMToioyUJXlndqorA=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-b6LobvVngC0TFuWTC9JBQrECkoX7ewLNCpCROkXHk20=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-/EaOfoubfq1ufwB7TTQ2hqmh1ZJiZ1+B6QeYu3MoFPI=";
@@ -68,7 +64,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     license = lib.licenses.unfree;
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
     ];

pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix

@@ -13,10 +13,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-cP/oFn19CZ/G3kjdHNZGqXvoDE1qUtg6xrg/2MO14Lo=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-wtk8SasxXEQ3pCJpVTWR8wcY/bNaIZmImbAtrFWYWOo=";
-        };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
           hash = "sha256-XYdwVoDqK+88ZYUm6APyamFNx6XlYjy0R4CIhSMuRmU=";
@@ -42,7 +38,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-darwin"
-      "x86_64-darwin"
     ];
   };
 }

pkgs/applications/editors/vscode/extensions/sourcery.sourcery/default.nix

@@ -15,10 +15,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       arch = "linux-x64";
       hash = "sha256-Oz4Buraof4yXIxGeKXIsDkvEQQ0Gzf/b5mdses1nHlo=";
     };
-    "x86_64-darwin" = {
-      arch = "darwin-x64";
-      hash = "sha256-Iqe4KZXQHenKAypXK/qzG2BCXbk2cZ0i/0xhWhlfQxo=";
-    };
     "aarch64-darwin" = {
       arch = "darwin-arm64";
       hash = "sha256-vMDB5zmdBNt3R5AkeuCYhxzW/rSGwM+wtU5K4v3ZU/U=";

pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix

@@ -20,10 +20,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-Z3cRojI4mCCS2t3aLojgImULQOobq5liDwoeHuzKEhY=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-Th0cseTJk+CD3BO/99t0VMD7zcF6nxAfmHFhfN8j5sw=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-rHgMl71YCs9ea0nFnx+E2U8isL4zQzIvvE9tgxM7IiA=";
@@ -66,7 +62,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = [ ];
   };

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -10,10 +10,6 @@ let
       hash = "sha256-DWrKvjWpUYvyqgZCShqwBKw33MHW31cxb4ERV65O+uc=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-CYDutYtU0+AAn6PYO/EQ/Suv8BNuMtvePpFdKRtiqAs=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-iFHeZiTubXA/t2Gib9hP42d7yjq/WRyywp+l8VhGfmo=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix

@@ -180,7 +180,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Native debugger extension for VSCode based on LLDB";
     homepage = "https://github.com/vadimcn/vscode-lldb";
-    license = [ lib.licenses.mit ];
+    license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.all;
   };

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -15,10 +15,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-htZGjy7ZnQLGZUncokGaGHyLpvPM5jzWUvCdnfN1vbM=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-OFdrXunh63xBZW/HwDDjj17TTiOLGY1Enb6ARxNc4bI=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-rgeNJbl6G2yKAWYW7NarQwVLmd3oZ4YTOVeCUat6ZqQ=";
@@ -56,7 +52,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ sandarukasa ];
   };

pkgs/applications/editors/vscode/extensions/yoshi47.selection-path-copier/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     publisher = "yoshi47";
     name = "selection-path-copier";
-    version = "1.5.0";
-    hash = "sha256-ip8dsU8B2vghINPSftvfC5OtM0bjIP0V3JAMt5skmdg=";
+    version = "1.6.0";
+    hash = "sha256-KnV9WariqK3GMjoQARtamxriBkL0Pi9y7+fhfwObCWE=";
   };
   meta = {
     description = "Copy file paths with line numbers, code snippets, and GitHub permalinks in multiple formats";

pkgs/applications/editors/vscode/generic.nix

@@ -429,7 +429,6 @@ stdenv.mkDerivation (
           # see https://www.npmjs.com/package/@vscode/ripgrep-universal?activeTab=code
           ripgrepSystem =
             {
-              x86_64-darwin = "darwin-x64";
               aarch64-darwin = "darwin-arm64";
               armv7l-linux = "linux-arm";
               aarch64-linux = "linux-arm64";

pkgs/applications/editors/vscode/update-vscodium.sh

@@ -21,8 +21,7 @@ for i in \
     "aarch64-linux linux-arm64 tar.gz" \
     "armv7l-linux linux-armhf tar.gz" \
     "loongarch64-linux linux-loong64 tar.gz" \
-    "aarch64-darwin darwin-arm64 zip" \
-    "x86_64-darwin darwin-x64 zip"; do
+    "aarch64-darwin darwin-arm64 zip"; do
     set -- $i
     hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
     update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version

pkgs/applications/editors/vscode/vscode.nix

@@ -24,7 +24,6 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
-      x86_64-darwin = "darwin";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -36,7 +35,6 @@ let
   hash =
     {
       x86_64-linux = "sha256-4G+zZ5HJuvdJXUt9wPWqqCVOfRpgpe5D5sfevAXJYrU=";
-      x86_64-darwin = "sha256-+o+UZwmJMeGyf2n1VZcm0zl4dzuC/0UBV5jyUANKsEQ=";
       aarch64-linux = "sha256-UEkpGlTV/KZ8Qcw/OBOCNDQHblD7gHHloSzM62FvDnw=";
       aarch64-darwin = "sha256-IHu9EwW9/oS2FTr/mB7ugMss5Pku3IyslqFYr4riZyk=";
       armv7l-linux = "sha256-Rfp2H6L7bXXhdxf2yphW9YXDGW1+Ea0nKdyTFS8Y/tU=";
@@ -128,7 +126,6 @@ buildVscode {
     ];
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
       "armv7l-linux"

pkgs/applications/editors/vscode/vscodium.nix

@@ -15,7 +15,6 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
-      x86_64-darwin = "darwin-x64";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -28,7 +27,6 @@ let
   hash =
     {
       x86_64-linux = "sha256-LJsGc11MH6zlcJNfSWjTWPn2Jp9dkjeBPQuCXH1woUM=";
-      x86_64-darwin = "sha256-bC7AfH2eKmmsWIOHifNGKD/kVQCYyuMfU3SUil0DXkM=";
       aarch64-linux = "sha256-mT5dvw8GOZ0GnZaKRS/TAzQDEEYDOgcj6w6lNLy5kQ0=";
       aarch64-darwin = "sha256-c8K17XKpRG1ji2mUfoyg2+cRF+qc1KVMYVkaQoUIz7Y=";
       armv7l-linux = "sha256-91ZHhEUDVoDiRBLwMHVLhzKmb9gWcPBUsVRZVLhCA4M=";
@@ -88,7 +86,6 @@ buildVscode rec {
     mainProgram = "codium";
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
       "armv7l-linux"

pkgs/applications/editors/your-editor/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Small and simple terminal editor core that is meant to be extended through a powerful plugin architecture";
     homepage = "https://your-editor.org/";
     changelog = "https://github.com/your-editor/yed/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     mainProgram = "yed";
   };

pkgs/applications/emulators/libretro/cores/dolphin.nix

@@ -20,13 +20,13 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-07-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "894fdda35688f3ac33c680ef6fe17ce965a16bf1";
-    hash = "sha256-Dkvv8EgQjLjyt0muSVF0Cnex/3xUcZXvWTzgUw61Sv0=";
+    rev = "0b766a68cc835775b3216500bb9af2f5d4602b12";
+    hash = "sha256-JaUiDc4/vEWjEXe6H9+i6pft2DTsl5my5wyFmtbjdR0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-07-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "340f9e9014c292fc47a8844a871a71dafe072b6d";
-    hash = "sha256-geBK8RIlaRcWn4CDzVl3pjK0WOFQcMZl7zFMXE2oZNo=";
+    rev = "1edda8a2a6c6b9ae259d5c7cd7d54dcba9ee7e32";
+    hash = "sha256-dc7xRjFxfSL2q9u1N0QH2j+oPbRGng2Z3U3J484lXiU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-07-01";
+  version = "0-unstable-2026-07-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "141978db577b52cb943641629401776e49ccbbe6";
-    hash = "sha256-USRBq+h2HAoDIdYVd47wGLEnUzJAEOvikuvSNTHpboI=";
+    rev = "31563d6e65faa6b9b7e975754d2062370bba4342";
+    hash = "sha256-eFRzbVTL5ARf650D0ZAEFGNTxjAy1CjBiAhwSQR8vJ4=";
   };
 
   makefile = "Makefile";