vscode-extensions.detachhead.basedpyright: 1.39.6 -> 1.39.7 (#529225)

https://github.com/MatthewFlamm/pytest-homeassistant-custom-component/blob/0.13.339/CHANGELOG.md

ci/default.nix

@@ -30,128 +30,7 @@ let
         inherit (pinned.treefmt-nix) url;
         sha256 = pinned.treefmt-nix.hash;
       };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
-      "url": "https://github.com/NixOS/nixpkgs/archive/cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73.tar.gz",
-      "hash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA="
+      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
+      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
+      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
     },
     "treefmt-nix": {
       "type": "Git",

ci/treefmt.nix

@@ -0,0 +1,122 @@
+{ pkgs, ... }: {
+  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+  # which creates trees within the Git repository under `.git-rewrite/t`,
+  # notably without having a `.git` themselves.
+  # So if this projectRootFile were the default `.git/config`,
+  # having the auto-rebase script use treefmt on such a tree would make it
+  # format all files in the _parent_ Git tree as well.
+  projectRootFile = ".git-blame-ignore-revs";
+
+  # Be a bit more verbose by default, so we can see progress happening
+  settings.verbose = 1;
+
+  # By default it's info, which is too noisy since we have many unmatched files
+  settings.on-unmatched = "debug";
+
+  programs.actionlint.enable = true;
+
+  programs.biome = {
+    enable = true;
+    # Disable settings validation because its inputs are liable to hash mismatch
+    validate.enable = false;
+    settings.formatter = {
+      useEditorconfig = true;
+    };
+    settings.javascript.formatter = {
+      quoteStyle = "single";
+      semicolons = "asNeeded";
+    };
+    settings.json.formatter.enabled = false;
+  };
+  settings.formatter.biome.excludes = [
+    "*.min.js"
+    "pkgs/*"
+  ];
+
+  programs.keep-sorted.enable = true;
+
+  # This uses nixfmt underneath, the default formatter for Nix code.
+  # See https://github.com/NixOS/nixfmt
+  programs.nixfmt = {
+    enable = true;
+    package = pkgs.nixfmt;
+  };
+
+  programs.yamlfmt = {
+    enable = true;
+    settings.formatter = {
+      retain_line_breaks = true;
+    };
+  };
+  settings.formatter.yamlfmt.excludes = [
+    # Aligns comments with whitespace
+    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+    # TODO: Fix formatting for auto-generated file
+    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+  ];
+
+  programs.nixf-diagnose = {
+    enable = true;
+    ignore = [
+      # Rule names can currently be looked up here:
+      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+      # TODO: Remove the following and fix things.
+      "sema-unused-def-lambda-noarg-formal"
+      "sema-unused-def-lambda-witharg-arg"
+      "sema-unused-def-lambda-witharg-formal"
+      "sema-unused-def-let"
+      # Keep this rule, because we have `lib.or`.
+      "or-identifier"
+      # TODO: remove after outstanding prelude diagnostics issues are fixed:
+      # https://github.com/nix-community/nixd/issues/761
+      # https://github.com/nix-community/nixd/issues/762
+      "sema-primop-removed-prefix"
+      "sema-primop-overridden"
+      "sema-constant-overridden"
+      "sema-primop-unknown"
+    ];
+  };
+  settings.formatter.nixf-diagnose = {
+    # Ensure nixfmt cleans up after nixf-diagnose.
+    priority = -1;
+    excludes = [
+      # Auto-generated; violates sema-extra-with
+      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+      # https://github.com/inclyc/nixf-diagnose/issues/13
+      "pkgs/servers/home-assistant/component-packages.nix"
+      # https://github.com/nix-community/nixd/issues/708
+      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+    ];
+  };
+
+  settings.formatter.editorconfig-checker = {
+    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+    options = [
+      "-disable-indent-size"
+      # TODO: Remove this once this upstream issue is fixed:
+      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+      "-disable-charset"
+    ];
+    includes = [ "*" ];
+    priority = 1;
+  };
+
+  # TODO: Upstream this into treefmt-nix eventually:
+  #   https://github.com/numtide/treefmt-nix/issues/387
+  settings.formatter.markdown-code-runner = {
+    command = pkgs.lib.getExe pkgs.markdown-code-runner;
+    options =
+      let
+        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+          presets.nixfmt = {
+            language = "nix";
+            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+          };
+        };
+      in
+      [ "--config=${config}" ];
+    includes = [ "*.md" ];
+  };
+
+  programs.zizmor.enable = true;
+}

doc/release-notes/rl-2611.section.md

@@ -26,6 +26,10 @@
   - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
   - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
 
+- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
+  Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
+  Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
+
 - The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.

maintainers/maintainer-list.nix

@@ -157,6 +157,11 @@
     githubId = 105598867;
     matrix = "@0xmrtt:envs.net";
   };
+  _0xSA7 = {
+    name = "Saleh Diaa Ahmed";
+    github = "0xSA7";
+    githubId = 153073356;
+  };
   _1000101 = {
     email = "b1000101@pm.me";
     github = "1000101";
@@ -329,12 +334,6 @@
     githubId = 381298;
     name = "9R";
   };
-  _9yokuro = {
-    email = "xzstd099@protonmail.com";
-    github = "9yokuro";
-    githubId = 119095935;
-    name = "9yokuro";
-  };
   a-camarillo = {
     name = "Anthony Camarillo";
     email = "anthony.camarillo.96@gmail.com";
@@ -5103,12 +5102,6 @@
     githubId = 68112;
     name = "Simon";
   };
-  cirno-999 = {
-    email = "reverene@protonmail.com";
-    github = "cirno-999";
-    githubId = 73712874;
-    name = "cirno-999";
-  };
   citadelcore = {
     email = "alex@arctarus.co.uk";
     github = "RealityAnomaly";
@@ -8393,11 +8386,6 @@
     githubId = 16175276;
     keys = [ { fingerprint = "E4CE B0F0 B2EC 09A3 9678  F294 CC7A 7E3C 6CF3 1343"; } ];
   };
-  EstebanMacanek = {
-    name = "Esteban Macanek";
-    github = "EstebanMacanek";
-    githubId = 75503218;
-  };
   esteve = {
     name = "Esteve Fernandez";
     email = "nixpkgs@nara.ac";
@@ -11906,12 +11894,6 @@
     github = "ivan-timokhin";
     githubId = 9802104;
   };
-  ivan-tkatchev = {
-    email = "tkatchev@gmail.com";
-    github = "ivan-tkatchev";
-    githubId = 650601;
-    name = "Ivan Tkatchev";
-  };
   ivan770 = {
     email = "ivan@ivan770.me";
     github = "ivan770";
@@ -13469,12 +13451,6 @@
     github = "joshprk";
     githubId = 123624726;
   };
-  joshuafern = {
-    name = "Joshua Fern";
-    email = "joshuafern@protonmail.com";
-    github = "JoshuaFern";
-    githubId = 4300747;
-  };
   joshvanl = {
     email = " me@joshvanl.dev ";
     github = "JoshVanL";
@@ -19271,12 +19247,6 @@
     name = "Nasir Hussain";
     keys = [ { fingerprint = "7A10 AB8E 0BEC 566B 090C  9BE3 D812 6E55 9CE7 C35D"; } ];
   };
-  nasrally = {
-    email = "suffer.ring@ya.ru";
-    github = "nasrally";
-    githubId = 50599445;
-    name = "Nikita Grishko";
-  };
   nat-418 = {
     github = "nat-418";
     githubId = 93013864;
@@ -19808,6 +19778,11 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
+  nikhilmaddirala = {
+    name = "Nikhil Maddirala";
+    github = "nikhilmaddirala";
+    githubId = 4138581;
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikivdev";
@@ -22339,12 +22314,6 @@
     githubId = 6314611;
     keys = [ { fingerprint = "EEC7 53FC EAAA FD9E 4DC0  9BB5 CAEB 4185 C226 D76B"; } ];
   };
-  prominentretail = {
-    email = "me@jakepark.me";
-    github = "ProminentRetail";
-    githubId = 94048404;
-    name = "Jake Park";
-  };
   proofconstruction = {
     email = "source@proof.construction";
     github = "proofconstruction";
@@ -22793,11 +22762,6 @@
     matrix = "@qyriad:katesiria.org";
     name = "Qyriad";
   };
-  qzylinra = {
-    github = "qzylinra";
-    githubId = 225773816;
-    name = "qzylinra";
-  };
   r-aizawa = {
     github = "Xantibody";
     githubId = 109563705;
@@ -27126,7 +27090,7 @@
     email = "taranarmo@gmail.com";
     github = "taranarmo";
     githubId = 11619234;
-    name = "Sergey Volkov";
+    name = "Sergei Volkov";
   };
   tarantoj = {
     email = "taranto.james@gmail.com";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -24,6 +24,8 @@
 
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
+
 - `services.llama-cpp` is now configured using structured `services.llama-cpp.settings` attribute.
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
@@ -34,6 +36,8 @@
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
 
+- The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/make-multi-disk-zfs-image.nix

@@ -262,7 +262,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

nixos/lib/make-single-disk-zfs-image.nix

@@ -250,7 +250,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

nixos/lib/utils.nix

@@ -14,6 +14,7 @@ let
     escapeShellArg
     filter
     flatten
+    foldl'
     getName
     hasPrefix
     hasSuffix
@@ -31,13 +32,13 @@ let
     nameValuePair
     optionalString
     removePrefix
-    removeSuffix
     replaceStrings
+    splitString
     stringToCharacters
     types
     ;
 
-  inherit (lib.strings) toJSON normalizePath escapeC;
+  inherit (lib.strings) toJSON escapeC;
 in
 
 let
@@ -98,26 +99,60 @@ let
       || hasPrefix a'.mountPoint b'.mountPoint
       || any (hasPrefix a'.mountPoint) b'.depends;
 
-    # Escape a path according to the systemd rules. FIXME: slow
+    # Escape a path according to the systemd rules.
     # The rules are described in systemd.unit(5) as follows:
     # The escaping algorithm operates as follows: given a string, any "/" character is replaced by "-", and all other characters which are not ASCII alphanumerics, ":", "_" or "." are replaced by C-style "\x2d" escapes. In addition, "." is replaced with such a C-style escape when it would appear as the first character in the escaped string.
     # When the input qualifies as absolute file system path, this algorithm is extended slightly: the path to the root directory "/" is encoded as single dash "-". In addition, any leading, trailing or duplicate "/" characters are removed from the string before transformation. Example: /foo//bar/baz/ becomes "foo-bar-baz".
     escapeSystemdPath =
-      s:
       let
+        # These don't depend on the path being escaped, so build them once
+        # rather than on every call.
+        escapeChar = escapeC (stringToCharacters " !\"#$%&'()*+,;<=>?@[\\]^`{|}~-");
+        escapeLeadingDot = escapeC [ "." ] ".";
+        slashesToDashes = replaceStrings [ "/" ] [ "-" ];
         replacePrefix =
           p: r: s:
-          (if (hasPrefix p s) then r + (removePrefix p s) else s);
-        trim = s: removeSuffix "/" (removePrefix "/" s);
-        normalizedPath = normalizePath s;
+          (if hasPrefix p s then r + removePrefix p s else s);
       in
-      replaceStrings [ "/" ] [ "-" ] (
-        replacePrefix "." (escapeC [ "." ] ".") (
-          escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-") (
-            if normalizedPath == "/" then normalizedPath else trim normalizedPath
-          )
-        )
-      );
+      s:
+      let
+        isAbsolute = hasPrefix "/" s;
+        # path_simplify(): collapse duplicate slashes and drop "." components.
+        rawComponents = filter (c: c != "" && c != ".") (splitString "/" s);
+        # systemd accepts ".." only where it is redundant: a leading ".." in an
+        # absolute path refers to the root's parent, i.e. the root itself, and is
+        # dropped. Any other ".." cannot be resolved without the filesystem, so
+        # the path is not normalized and systemd-escape errors on it.
+        simplified =
+          foldl'
+            (
+              acc: c:
+              if c == ".." then
+                # A leading ".." in an absolute path is the only redundant case.
+                if isAbsolute && acc.components == [ ] then acc else acc // { normalized = false; }
+              else
+                acc // { components = acc.components ++ [ c ]; }
+            )
+            {
+              components = [ ];
+              normalized = true;
+            }
+            rawComponents;
+        notNormalized = throw "escapeSystemdPath: ${s} is not a normalized path";
+        simplifiedPath =
+          if !simplified.normalized then
+            notNormalized
+          else if simplified.components != [ ] then
+            concatStringsSep "/" simplified.components
+          # The root directory, and - matching systemd-escape - the empty string.
+          else if isAbsolute || s == "" then
+            "/"
+          # A relative path that reduces to nothing (e.g. "."), which has no
+          # valid escaping.
+          else
+            notNormalized;
+      in
+      slashesToDashes (replacePrefix "." escapeLeadingDot (escapeChar simplifiedPath));
 
     # Quotes an argument for use in Exec* service lines.
     # systemd accepts "-quoted strings with escape sequences, toJSON produces

nixos/modules/programs/wayland/hyprland.nix

@@ -107,9 +107,9 @@ in
         services.displayManager.sessionPackages = [ cfg.package ];
 
         systemd = lib.mkIf cfg.systemd.setPath.enable {
-          user.extraConfig = ''
-            DefaultEnvironment="PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH"
-          '';
+          user.settings.Manager = {
+            DefaultEnvironment = "PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH";
+          };
         };
       }
 

nixos/modules/services/databases/postgresql.md

@@ -194,7 +194,7 @@ For an upgrade, a script like this can be used to simplify the process:
         # XXX specify the postgresql package you'd like to upgrade to.
         # Do not forget to list the extensions you need.
         newPostgres = pkgs.postgresql_15.withPackages (pp: [
-          # pp.plv8
+          # pp.pl_cron
         ]);
         cfg = config.services.postgresql;
       in

nixos/modules/services/databases/postgresql.nix

@@ -705,9 +705,6 @@ in
         "~@privileged" = true;
         "~@resources" = true;
       })
-      (mkIf (any extensionInstalled [ "plv8" ]) {
-        "@pkey" = true;
-      })
       (mkIf (any extensionInstalled [ "citus" ]) {
         "getpriority" = true;
         "setpriority" = true;
@@ -807,9 +804,7 @@ in
           PrivateTmp = true;
           ProtectHome = true;
           ProtectSystem = "strict";
-          MemoryDenyWriteExecute = lib.mkDefault (
-            cfg.settings.jit == "off" && (!any extensionInstalled [ "plv8" ])
-          );
+          MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off");
           NoNewPrivileges = true;
           LockPersonality = true;
           PrivateDevices = true;

nixos/modules/services/misc/llama-cpp.nix

@@ -164,7 +164,7 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.port;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -133,6 +133,7 @@ let
         "v2ray"
         "varnish"
         "wireguard"
+        "xray"
         "zfs-siebenmann"
         "zfs"
       ]

nixos/modules/services/monitoring/prometheus/exporters/xray.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.xray;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    optionalString
+    ;
+in
+{
+  port = 9550;
+
+  extraOpts = {
+    xrayEndpoint = mkOption {
+      type = types.str;
+      default = "127.0.0.1:8080";
+      description = ''
+        Xray gRPC API endpoint.
+      '';
+    };
+
+    metricsPath = mkOption {
+      type = types.str;
+      default = "/scrape";
+      description = ''
+        Path under which to expose metrics.
+      '';
+    };
+
+    scrapeTimeout = mkOption {
+      type = types.int;
+      default = 5;
+      description = ''
+        Timeout in seconds for every individual scrape.
+      '';
+    };
+
+    logPath = mkOption {
+      type = types.str;
+      default = "/var/log/xray/access.log";
+      description = ''
+        Path to Xray access log file. Set to empty string to disable user metrics.
+      '';
+    };
+
+    logTimeWindow = mkOption {
+      type = types.int;
+      default = 5;
+      description = ''
+        Time window in minutes for user metrics.
+      '';
+    };
+
+    withUserMetrics = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Collect user metrics from the Xray access log.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-xray-exporter}/bin/xray-exporter \
+          --listen ${cfg.listenAddress}:${toString cfg.port} \
+          --metrics-path ${cfg.metricsPath} \
+          --xray-endpoint ${cfg.xrayEndpoint} \
+          --scrape-timeout ${toString cfg.scrapeTimeout} \
+          ${optionalString (cfg.logPath != "") "--log-path ${cfg.logPath}"} \
+          --log-time-window ${toString cfg.logTimeWindow} \
+          ${optionalString cfg.withUserMetrics "--with-user-metrics"} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}

nixos/modules/services/networking/haproxy.nix

@@ -68,13 +68,10 @@ in
           # when the master process receives USR2, it reloads itself using exec(argv[0]),
           # so we create a symlink there and update it before reloading
           "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
-          # when running the config test, don't be quiet so we can see what goes wrong
-          "/run/haproxy/haproxy -c -f ${haproxyCfg}"
         ];
         ExecStart = "/run/haproxy/haproxy -Ws -f /etc/haproxy.cfg -p /run/haproxy/haproxy.pid";
         # support reloading
         ExecReload = [
-          "${lib.getExe cfg.package} -c -f ${haproxyCfg}"
           "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
           "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"
         ];

nixos/modules/services/networking/networkmanager.nix

@@ -24,6 +24,9 @@ let
       rc-manager = if config.networking.resolvconf.enable then "resolvconf" else "unmanaged";
     };
     keyfile = {
+      # NM's compiled-in default; made explicit so the tmpfiles rule below
+      # can follow it when the user redirects the keyfile store elsewhere.
+      path = "/etc/NetworkManager/system-connections";
       unmanaged-devices = if cfg.unmanaged == [ ] then null else lib.concatStringsSep ";" cfg.unmanaged;
     };
     logging = {
@@ -601,13 +604,27 @@ in
 
     systemd.packages = packages;
 
-    systemd.tmpfiles.rules = [
-      "d /etc/NetworkManager/system-connections 0700 root root -"
-      "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
+    systemd.tmpfiles.settings.networkmanager = {
+      ${configAttrs.keyfile.path}.d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+      # for dnsmasq.leases
+      "/var/lib/misc".d = {
+        mode = "0755";
+        user = "root";
+        group = "root";
+      };
       # ppp isn't able to mkdir that directory at runtime
-      "d /run/pppd/lock 0700 root root -"
-    ]
-    ++ pluginTmpfilesRules;
+      "/run/pppd/lock".d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+    };
+
+    systemd.tmpfiles.rules = pluginTmpfilesRules;
 
     systemd.services.NetworkManager = {
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/syncthing.nix

@@ -6,15 +6,13 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.syncthing;
   opt = options.services.syncthing;
   defaultUser = "syncthing";
   defaultGroup = defaultUser;
   settingsFormat = pkgs.formats.json { };
-  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
+  cleanedConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
 
   isUnixGui = lib.strings.hasPrefix "unix://" cfg.guiAddress;
 
@@ -35,7 +33,7 @@ let
     else
       "${cfg.guiAddress}${path}";
 
-  devices = mapAttrsToList (
+  devices = lib.mapAttrsToList (
     _: device:
     device
     // {
@@ -45,31 +43,10 @@ let
 
   anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;
 
-  folders = mapAttrsToList (
-    _: folder:
-    folder
-    //
-      throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
-        ''
-          The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
-          were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
-        ''
-        {
-          devices =
-            let
-              folderDevices = folder.devices;
-            in
-            map (
-              device:
-              if builtins.isString device then
-                { deviceId = cfg.settings.devices.${device}.id; }
-              else if builtins.isAttrs device then
-                { deviceId = cfg.settings.devices.${device.name}.id; } // device
-              else
-                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
-            ) folderDevices;
-        }
-  ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
+  folders = lib.pipe cfg.settings.folders [
+    (lib.filterAttrs (_: folder: folder.enable))
+    builtins.attrValues
+  ];
 
   jq = "${pkgs.jq}/bin/jq";
   grep = lib.getExe pkgs.gnugrep;
@@ -179,7 +156,7 @@ let
         [
           # Now for each of these attributes, write the curl commands that are
           # identical to both folders and devices.
-          (mapAttrs (
+          (lib.mapAttrs (
             conf_type: s:
             # We iterate the `conf` list now, and run a curl -X POST command for each, that
             # should update that device/folder only.
@@ -301,7 +278,7 @@ let
     +
       /*
         Now we update the other settings defined in cleanedConfig which are not
-        "folders", "devices", or "guiPasswordFile".
+        "folders", "devices", "guiPasswordFile", or "defaults".
       */
       (lib.pipe cleanedConfig [
         builtins.attrNames
@@ -309,14 +286,35 @@ let
           "folders"
           "devices"
           "guiPasswordFile"
+          "defaults"
         ])
         (map (subOption: ''
-          curl -X PUT -d ${
+          curl -X PATCH -d ${
             lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})
           } ${curlAddressArgs "/rest/config/${subOption}"}
         ''))
         (lib.concatStringsSep "\n")
       ])
+    +
+      # Handle the "defaults" option separately, as it has multiple sub-endpoints.
+      (lib.optionalString (cleanedConfig ? defaults) (
+        lib.pipe cleanedConfig.defaults [
+          builtins.attrNames
+          (map (
+            subOption:
+            let
+              # /rest/config/defaults/ignores only supports PUT
+              method = if subOption == "ignores" then "PUT" else "PATCH";
+            in
+            ''
+              curl -X ${method} -d ${
+                lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
+              } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
+            ''
+          ))
+          (lib.concatStringsSep "\n")
+        ]
+      ))
     +
       # Now we hash the contents of guiPasswordFile and use the result to update the gui password
       (lib.optionalString (cfg.guiPasswordFile != null) ''
@@ -337,10 +335,10 @@ in
   options = {
     services.syncthing = {
 
-      enable = mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
+      enable = lib.mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
 
-      cert = mkOption {
-        type = types.nullOr types.str;
+      cert = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `cert.pem` file, which will be copied into Syncthing's
@@ -348,8 +346,8 @@ in
         '';
       };
 
-      key = mkOption {
-        type = types.nullOr types.str;
+      key = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `key.pem` file, which will be copied into Syncthing's
@@ -357,16 +355,16 @@ in
         '';
       };
 
-      guiPasswordFile = mkOption {
-        type = types.nullOr types.str;
+      guiPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to file containing the plaintext password for Syncthing's GUI.
         '';
       };
 
-      overrideDevices = mkOption {
-        type = types.bool;
+      overrideDevices = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to delete the devices which are not configured via the
@@ -376,10 +374,10 @@ in
         '';
       };
 
-      overrideFolders = mkOption {
-        type = types.bool;
+      overrideFolders = lib.mkOption {
+        type = lib.types.bool;
         default = !anyAutoAccept;
-        defaultText = literalMD ''
+        defaultText = lib.literalMD ''
           `true` unless any device has the
           [autoAcceptFolders](#opt-services.syncthing.settings.devices._name_.autoAcceptFolders)
           option set to `true`.
@@ -392,47 +390,47 @@ in
         '';
       };
 
-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
           freeformType = settingsFormat.type;
           options = {
             # global options
-            options = mkOption {
+            options = lib.mkOption {
               default = { };
               description = ''
                 The options element contains all other global configuration options
               '';
-              type = types.submodule (
-                { name, ... }:
+              type = lib.types.submodule (
+                { ... }:
                 {
                   freeformType = settingsFormat.type;
                   options = {
-                    localAnnounceEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    localAnnounceEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to send announcements to the local LAN, also use such announcements to find other devices.
                       '';
                     };
 
-                    localAnnouncePort = mkOption {
-                      type = types.nullOr types.port;
+                    localAnnouncePort = lib.mkOption {
+                      type = lib.types.nullOr lib.types.port;
                       default = null;
                       description = ''
                         The port on which to listen and send IPv4 broadcast announcements to.
                       '';
                     };
 
-                    relaysEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    relaysEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         When true, relays will be connected to and potentially used for device to device connections.
                       '';
                     };
 
-                    urAccepted = mkOption {
-                      type = types.nullOr types.int;
+                    urAccepted = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         Whether the user has accepted to submit anonymous usage data.
@@ -441,16 +439,16 @@ in
                       '';
                     };
 
-                    limitBandwidthInLan = mkOption {
-                      type = types.nullOr types.bool;
+                    limitBandwidthInLan = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
                       '';
                     };
 
-                    maxFolderConcurrency = mkOption {
-                      type = types.nullOr types.int;
+                    maxFolderConcurrency = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
@@ -463,7 +461,7 @@ in
             };
 
             # device settings
-            devices = mkOption {
+            devices = lib.mkOption {
               default = { };
               description = ''
                 Peers/devices which Syncthing should communicate with.
@@ -478,30 +476,30 @@ in
                   addresses = [ "tcp://192.168.0.10:51820" ];
                 };
               };
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      name = mkOption {
-                        type = types.str;
+                      name = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The name of the device.
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         description = ''
                           The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
                         '';
                       };
 
-                      autoAcceptFolders = mkOption {
-                        type = types.bool;
+                      autoAcceptFolders = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           Automatically create or share folders that this device advertises at the default path.
@@ -516,7 +514,7 @@ in
             };
 
             # folder settings
-            folders = mkOption {
+            folders = lib.mkOption {
               default = { };
               description = ''
                 Folders which should be shared by Syncthing.
@@ -525,7 +523,7 @@ in
                 will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
                 is enabled.
               '';
-              example = literalExpression ''
+              example = lib.literalExpression ''
                 {
                   "/home/user/sync" = {
                     id = "syncme";
@@ -533,15 +531,15 @@ in
                   };
                 }
               '';
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      enable = mkOption {
-                        type = types.bool;
+                      enable = lib.mkOption {
+                        type = lib.types.bool;
                         default = true;
                         description = ''
                           Whether to share this folder.
@@ -550,12 +548,12 @@ in
                         '';
                       };
 
-                      path = mkOption {
+                      path = lib.mkOption {
                         # TODO for release 23.05: allow relative paths again and set
                         # working directory to cfg.dataDir
-                        type = types.str // {
-                          check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                          description = types.str.description + " starting with / or ~/";
+                        type = lib.types.str // {
+                          check = x: lib.types.str.check x && (lib.substring 0 1 x == "/" || lib.substring 0 2 x == "~/");
+                          description = lib.types.str.description + " starting with / or ~/";
                         };
                         default = name;
                         description = ''
@@ -566,24 +564,24 @@ in
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The ID of the folder. Must be the same on all devices.
                         '';
                       };
 
-                      label = mkOption {
-                        type = types.str;
+                      label = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The label of the folder.
                         '';
                       };
 
-                      type = mkOption {
-                        type = types.enum [
+                      type = lib.mkOption {
+                        type = lib.types.enum [
                           "sendreceive"
                           "sendonly"
                           "receiveonly"
@@ -596,17 +594,17 @@ in
                         '';
                       };
 
-                      devices = mkOption {
-                        type = types.listOf (
-                          types.oneOf [
-                            types.str
-                            (types.submodule (
+                      devices = lib.mkOption {
+                        type = lib.types.listOf (
+                          lib.types.oneOf [
+                            lib.types.str
+                            (lib.types.submodule (
                               { ... }:
                               {
                                 freeformType = settingsFormat.type;
                                 options = {
-                                  name = mkOption {
-                                    type = types.str;
+                                  name = lib.mkOption {
+                                    type = lib.types.str;
                                     default = null;
                                     description = ''
                                       The name of a device defined in the
@@ -614,8 +612,8 @@ in
                                       option.
                                     '';
                                   };
-                                  encryptionPasswordFile = mkOption {
-                                    type = types.nullOr types.externalPath;
+                                  encryptionPasswordFile = lib.mkOption {
+                                    type = lib.types.nullOr lib.types.externalPath;
                                     default = null;
                                     description = ''
                                       Path to encryption password. If set, the file will be read during
@@ -637,14 +635,14 @@ in
                         '';
                       };
 
-                      versioning = mkOption {
+                      versioning = lib.mkOption {
                         default = null;
                         description = ''
                           How to keep changed/deleted files with Syncthing.
                           There are 4 different types of versioning with different parameters.
                           See <https://docs.syncthing.net/users/versioning.html>.
                         '';
-                        example = literalExpression ''
+                        example = lib.literalExpression ''
                           [
                             {
                               versioning = {
@@ -680,13 +678,12 @@ in
                             }
                           ]
                         '';
-                        type =
-                          with types;
-                          nullOr (submodule {
+                        type = lib.types.nullOr (
+                          lib.types.submodule {
                             freeformType = settingsFormat.type;
                             options = {
-                              type = mkOption {
-                                type = enum [
+                              type = lib.mkOption {
+                                type = lib.types.enum [
                                   "external"
                                   "simple"
                                   "staggered"
@@ -698,11 +695,12 @@ in
                                 '';
                               };
                             };
-                          });
+                          }
+                        );
                       };
 
-                      copyOwnershipFromParent = mkOption {
-                        type = types.bool;
+                      copyOwnershipFromParent = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
@@ -710,8 +708,8 @@ in
                         '';
                       };
 
-                      ignorePatterns = mkOption {
-                        type = types.nullOr (types.listOf types.str);
+                      ignorePatterns = lib.mkOption {
+                        type = lib.types.nullOr (lib.types.listOf lib.types.str);
                         default = null;
                         description = ''
                           Syncthing can be configured to ignore certain files in a folder using ignore patterns.
@@ -771,8 +769,8 @@ in
         };
       };
 
-      guiAddress = mkOption {
-        type = types.str;
+      guiAddress = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1:8384";
         apply = x: if lib.strings.hasPrefix "/" x then "unix://${x}" else x;
         description = ''
@@ -780,16 +778,16 @@ in
         '';
       };
 
-      systemService = mkOption {
-        type = types.bool;
+      systemService = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to auto-launch Syncthing as a system service.
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = defaultUser;
         example = "yourUser";
         description = ''
@@ -799,8 +797,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = defaultGroup;
         example = "yourGroup";
         description = ''
@@ -809,8 +807,8 @@ in
         '';
       };
 
-      all_proxy = mkOption {
-        type = with types; nullOr str;
+      all_proxy = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "socks5://address.com:1234";
         description = ''
@@ -821,8 +819,8 @@ in
         '';
       };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/syncthing";
         example = "/home/yourUser";
         description = ''
@@ -832,15 +830,15 @@ in
 
       configDir =
         let
-          cond = versionAtLeast config.system.stateVersion "19.03";
+          cond = lib.versionAtLeast config.system.stateVersion "19.03";
         in
-        mkOption {
-          type = types.path;
+        lib.mkOption {
+          type = lib.types.path;
           description = ''
             The path where the settings and keys will exist.
           '';
-          default = cfg.dataDir + optionalString cond "/.config/syncthing";
-          defaultText = literalMD ''
+          default = cfg.dataDir + lib.optionalString cond "/.config/syncthing";
+          defaultText = lib.literalMD ''
             * if `stateVersion >= 19.03`:
 
                   config.${opt.dataDir} + "/.config/syncthing"
@@ -850,17 +848,17 @@ in
           '';
         };
 
-      databaseDir = mkOption {
-        type = types.path;
+      databaseDir = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The directory containing the database and logs.
         '';
         default = cfg.configDir;
-        defaultText = literalExpression "config.${opt.configDir}";
+        defaultText = lib.literalExpression "config.${opt.configDir}";
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "--reset-deltas" ];
         description = ''
@@ -868,8 +866,8 @@ in
         '';
       };
 
-      openDefaultPorts = mkOption {
-        type = types.bool;
+      openDefaultPorts = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = ''
@@ -883,35 +881,37 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "syncthing" { };
+      package = lib.mkPackageOption pkgs "syncthing" { };
     };
   };
 
   imports = [
-    (mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
+    (lib.mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
       This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
       It can be enabled on a per-folder basis through the web interface.
     '')
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "extraOptions" ]
       [ "services" "syncthing" "settings" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "folders" ]
       [ "services" "syncthing" "settings" "folders" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "devices" ]
       [ "services" "syncthing" "settings" "devices" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "options" ]
       [ "services" "syncthing" "settings" "options" ]
     )
   ]
   ++
     map
-      (o: mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ])
+      (
+        o: lib.mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
+      )
       [
         "cert"
         "key"
@@ -924,7 +924,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = !(cfg.overrideFolders && anyAutoAccept);
@@ -941,7 +941,7 @@ in
       }
     ];
 
-    networking.firewall = mkIf cfg.openDefaultPorts {
+    networking.firewall = lib.mkIf cfg.openDefaultPorts {
       allowedTCPPorts = [ 22000 ];
       allowedUDPPorts = [
         21027
@@ -952,7 +952,7 @@ in
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
-    users.users = mkIf (cfg.systemService && cfg.user == defaultUser) {
+    users.users = lib.mkIf (cfg.systemService && cfg.user == defaultUser) {
       ${defaultUser} = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -962,14 +962,14 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.systemService && cfg.group == defaultGroup) {
+    users.groups = lib.mkIf (cfg.systemService && cfg.group == defaultGroup) {
       ${defaultGroup}.gid = config.ids.gids.syncthing;
     };
 
     systemd.services = {
       # upstream reference:
       # https://github.com/syncthing/syncthing/blob/main/etc/linux-systemd/system/syncthing%40.service
-      syncthing = mkIf cfg.systemService {
+      syncthing = lib.mkIf cfg.systemService {
         description = "Syncthing service";
         after = [ "network.target" ];
         environment = {
@@ -986,13 +986,13 @@ in
           User = cfg.user;
           Group = cfg.group;
           ExecStartPre =
-            mkIf (cfg.cert != null || cfg.key != null)
+            lib.mkIf (cfg.cert != null || cfg.key != null)
               "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
                 install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
-                ${optionalString (cfg.cert != null) ''
+                ${lib.optionalString (cfg.cert != null) ''
                   install -Dm644 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
                 ''}
-                ${optionalString (cfg.key != null) ''
+                ${lib.optionalString (cfg.key != null) ''
                   install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
@@ -1034,7 +1034,7 @@ in
           ];
         };
       };
-      syncthing-init = mkIf (cleanedConfig != { }) {
+      syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
         requisite = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
@@ -1050,4 +1050,9 @@ in
       };
     };
   };
+
+  meta.maintainers = with lib.maintainers; [
+    doronbehar
+    seudonym
+  ];
 }

nixos/modules/services/web-apps/rustical.nix

@@ -55,12 +55,12 @@ in
           };
 
           http = {
-            host = mkOption {
+            bind = mkOption {
               type = types.str;
-              default = "[::1]";
-              example = "[::]";
+              default = "unix:/run/rustical/sock";
+              example = "[::]:4000";
               description = ''
-                Host address to bind the HTTP service to.
+                Address and port or UNIX socket path to bind the HTTP service to.
 
                 :::{.note}
                 Rustical expects to be hosted behind a reverse proxy that
@@ -69,14 +69,6 @@ in
                 :::
               '';
             };
-
-            port = mkOption {
-              type = types.port;
-              default = 4000;
-              description = ''
-                Port to bind the HTTP service to.
-              '';
-            };
           };
 
           dav_push.enabled = mkOption {
@@ -126,6 +118,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = lib.optionals (cfg.settings.http ? host || cfg.settings.http ? port) [
+      ''
+        Rustical 0.13 deprecations
+
+        The following options are now deprecated and will be removed in a
+        future release:
+        - `services.rustical.settings.http.host`
+        - `services.rustical.settings.http.port`
+
+        Migrate to `services.rustical.settings.http.bind` instead.
+      ''
+    ];
+
     # install the config at a path where the cli will find it
     environment.etc."rustical/config.toml".source = configFile;
 

nixos/modules/tasks/filesystems/bcachefs.nix

@@ -370,12 +370,16 @@ in
                   "sleep.target"
                 ];
 
-                script = "${lib.getExe cfg.package} data scrub ${fs}";
-
                 serviceConfig = {
                   Type = "oneshot";
                   Nice = 19;
                   IOSchedulingClass = "idle";
+
+                  ExecStart = lib.join " " [
+                    (lib.getExe cfg.package)
+                    (if lib.versionOlder cfg.package.version "v1.34.0" then "data scrub" else "scrub")
+                    (utils.escapeSystemdExecArg fs)
+                  ];
                 };
               };
           in

nixos/tests/all-tests.nix

@@ -1585,6 +1585,7 @@ in
   sx = runTest ./sx.nix;
   sympa = runTest ./sympa.nix;
   syncthing = runTest ./syncthing/main.nix;
+  syncthing-defaults = runTest ./syncthing/defaults.nix;
   syncthing-folders = runTest ./syncthing/folders.nix;
   syncthing-guiPassword = runTest ./syncthing/guiPassword.nix;
   syncthing-guiPasswordFile = runTest ./syncthing/guiPasswordFile.nix;

nixos/tests/firewall.nix

@@ -89,12 +89,17 @@
         else
           "nixos-firewall-tool open tcp 80";
       reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
     in
     ''
       start_all()
 
       walled.wait_for_unit("${unit}")
       walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
       attacker.wait_for_unit("network.target")
 
       # Local connections should still work.

nixos/tests/firewalld.nix

@@ -29,6 +29,8 @@
 
     walled.wait_for_unit("firewalld")
     walled.wait_for_unit("httpd")
+    # https://github.com/firewalld/firewalld/issues/1571
+    walled.wait_until_succeeds("firewall-cmd --state")
 
     open.wait_for_unit("network.target")
 

nixos/tests/postgresql/postgresql.nix

@@ -31,17 +31,6 @@ let
           INSERT INTO sth (id) VALUES (1);
           CREATE TABLE xmltest ( doc xml );
           INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-
-          -- check if hardening gets relaxed
-          CREATE EXTENSION plv8;
-          -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-          DO $$
-            let xs = [];
-            for (let i = 0, n = 400000; i < n; i++) {
-                xs.push(Math.round(Math.random() * n))
-            }
-            console.log(xs.reduce((acc, x) => acc + x, 0));
-          $$ LANGUAGE plv8;
         '';
 
       in
@@ -60,9 +49,6 @@ let
               identMap = ''
                 postgres root postgres
               '';
-              # TODO(@Ma27) split this off into its own VM test and move a few other
-              # extension tests to use postgresqlTestExtension.
-              extensions = ps: with ps; [ plv8 ];
             };
 
             services.postgresqlBackup = {

nixos/tests/restic.nix

@@ -122,7 +122,7 @@ in
             ];
           };
           remote-from-file-backup = {
-            inherit passwordFile exclude pruneOpts;
+            inherit passwordFile pruneOpts;
             initialize = true;
             repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
             paths = [
@@ -130,7 +130,8 @@ in
               "/opt/a_dir/a_file_2"
             ];
             dynamicFilesFrom = ''
-              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
+              # all files in /opt except for a_dir and excluded_file_*
+              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir ! -name excluded_file_*
             '';
           };
           remote-from-command-backup = {

nixos/tests/syncthing/defaults.nix

@@ -0,0 +1,42 @@
+{ lib, pkgs, ... }:
+let
+  expectedPath = "/tmp/syncthing-default";
+in
+{
+  name = "syncthing-defaults";
+  meta.maintainers = with pkgs.lib.maintainers; [ seudonym ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.libxml2
+        pkgs.curl
+      ];
+      services.syncthing = {
+        enable = true;
+        settings.defaults.folder.path = expectedPath;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_unit("syncthing-init.service")
+
+    # Get the API key by parsing the config.xml
+    api_key = machine.succeed(
+        "xmllint --xpath 'string(configuration/gui/apikey)' /var/lib/syncthing/.config/syncthing/config.xml"
+    ).strip()
+
+    # Query the defaults/folder endpoint via Syncthing's REST API
+    config = json.loads(machine.succeed(
+        f"curl -Ssf -H 'X-API-Key: {api_key}' http://127.0.0.1:8384/rest/config/defaults/folder"
+    ))
+
+    actual_path = config.get('path')
+    assert actual_path == "${expectedPath}", f"Default folder path is '{actual_path}', but expected '${expectedPath}'"
+    machine.log(f"Success: Default folder path is correctly set to '{actual_path}'")
+  '';
+}

nixos/tests/systemd-escaping.nix

@@ -36,6 +36,19 @@ in
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
+        # escapeSystemdPath simplifies the path like systemd-escape --path does:
+        # "." components are dropped and duplicate/leading/trailing slashes removed.
+        assert utils.escapeSystemdPath "/mnt/./foo" == "mnt-foo";
+        assert utils.escapeSystemdPath "/foo//bar/baz/" == "foo-bar-baz";
+        assert utils.escapeSystemdPath "/" == "-";
+        assert utils.escapeSystemdPath "" == "-";
+        assert utils.escapeSystemdPath "/.hidden/x" == "\\x2ehidden-x";
+        assert utils.escapeSystemdPath "/foo?bar" == "foo\\x3fbar";
+        # A leading ".." in an absolute path is the root's parent, i.e. the root.
+        assert utils.escapeSystemdPath "/../foo" == "foo";
+        # Non-normalized paths can't be escaped, matching systemd-escape.
+        assert !(builtins.tryEval (utils.escapeSystemdPath "/mnt/../foo")).success;
+        assert !(builtins.tryEval (utils.escapeSystemdPath ".")).success;
         {
           description = "Echo to the journal";
           serviceConfig.Type = "oneshot";

nixos/tests/web-apps/rustical.nix

@@ -3,28 +3,35 @@
   lib,
   ...
 }:
+
+let
+  port = "4000";
+in
+
 {
   name = "rustical";
 
   meta.maintainers = pkgs.rustical.meta.maintainers;
 
-  nodes.machine =
+  containers.machine =
     {
       pkgs,
       ...
     }:
     {
-      services.rustical.enable = true;
+      services.rustical = {
+        enable = true;
+        settings.http.bind = "[::]:${port}";
+      };
       environment.systemPackages = with pkgs; [ calendar-cli ];
     };
 
   testScript =
     {
-      nodes,
+      containers,
       ...
     }:
     let
-      port = toString nodes.machine.services.rustical.settings.http.port;
       url = "http://localhost:${toString port}";
 
       createPrincipalScript = pkgs.writeScript "rustical-create-principal" ''

pkgs/applications/editors/android-studio/default.nix

@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.7/android-studio-quail1-rc2-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.2.4"; # "Android Studio Quail 2 | 2026.1.2 Canary 4"
-    sha256Hash = "sha256-fnJYHZPy9bOZJ2leG2+Mr5JGH5HMc2HeMeYGHBUxJXo=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.4/android-studio-quail2-canary4-linux.tar.gz";
+    version = "2026.1.2.7"; # "Android Studio Quail 2 | 2026.1.2 Canary 7"
+    sha256Hash = "sha256-LHszfAtM5ZLNbTZG0isb+aUW3uwp+zav/igHT4HDeEM=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.7/android-studio-quail2-canary7-linux.tar.gz";
   };
 in
 {

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1014,6 +1014,13 @@ assertNoAdditions {
 
   copilot-cmp = super.copilot-cmp.overrideAttrs {
     dependencies = [ self.copilot-lua ];
+    patches = [
+      (fetchpatch {
+        name = "fix-deprecated-function-call.patch";
+        url = "https://github.com/zbirenbaum/copilot-cmp/commit/06430ebf99834ebc5d86c63816e409f4cb51fe79.patch";
+        sha256 = "sha256-YOJPFC+qbyURFU58tAiAqbamQLmi7ovnJGkOeOTUPH0=";
+      })
+    ];
   };
 
   copilot-lualine = super.copilot-lualine.overrideAttrs {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-R3ab2IeY9QnDhZFk52/05pIv4A+sZU3kJ9Jn5uLRa4Y=";
+          hash = "sha256-XA4xSd/sg9vhOGqcCNliHzloBxPZsgXW/dSkKp/RzM0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-AE6zS8bJ4vec+P36NkxWYQ1tmcJG2WsFkv75+gRlrxA=";
+          hash = "sha256-l2NjDHBOMBzJT9Pis7sqSuFuG07eZPALximND+hVqDU=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-n1qV1Lrl65HSDthMc5/7hLppeNBO6067Z+Rf5+kxfnA=";
+          hash = "sha256-hE/1N28f9uAzg2fG3Hrc4z1kW21rdhtCRmF9SphqiFc=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-g+lkUYym43o8cEFseWCrcSUUTx296u8DS9JvnU1dBLU=";
+          hash = "sha256-68CmDax385o0juoQWNX/NLx+tjIt9YytTHjRZkqAR98=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.172";
+      version = "2.1.175";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -320,8 +320,8 @@ let
         mktplcRef = {
           name = "vscode-apollo";
           publisher = "apollographql";
-          version = "2.6.5";
-          hash = "sha256-WOt0bY/hi9tLJEo0bTAPLQhgM+2A7JPp0pypX4EcYNo=";
+          version = "2.6.6";
+          hash = "sha256-rvLZoLY0P031ZAjeYXNqPVYwRNkCRYUvedosxM51opc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";
@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.20.14";
-          hash = "sha256-jD+e+s4iaX1p+KR3neJUwvPm/DQiX1gSTt595ryw8xE=";
+          version = "3.22.1";
+          hash = "sha256-ln9DcfjW0QO7V6hF+QNqy+V13hbjWwhsisrgZPrk1R4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1204,8 +1204,8 @@ let
         mktplcRef = {
           name = "dart-code";
           publisher = "dart-code";
-          version = "3.134.0";
-          hash = "sha256-/tWH2uGfOuyvF8mfga2YdGK1ok2UYQchaOeCC2n+IHk=";
+          version = "3.136.0";
+          hash = "sha256-XPajPR0MX6TiUfaCw/+WYyc453cZOMaK1Uen6ND+RKY=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1226,8 +1226,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.10.8";
-          hash = "sha256-pBfD6HwPP9CybROC2W27CAq2RSAgRJ3ZrxvUOBzRyC8=";
+          version = "2.11.0";
+          hash = "sha256-9izhQvZmfUVeKS0H89XXkN1bNP4+AZyUuetfD0kRJ/c=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.42.0";
-          hash = "sha256-mk4ZgaBxLFPvrm3EU+hdidorhdWp7EGfRP0e/kARd1A=";
+          version = "0.43.1";
+          hash = "sha256-rZjdBzqXpSG4aCMjRCmIrWtQdmmh7vEJQLIuH65Ewf0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -2030,8 +2030,8 @@ let
         mktplcRef = {
           name = "Go";
           publisher = "golang";
-          version = "0.52.2";
-          hash = "sha256-8g+r4Mv06Bx1W3yAXWVbtz1B/gXPcRdmaV0tPkTP6Gk=";
+          version = "0.54.0";
+          hash = "sha256-o1SJjR6eQcGWN9BGoN5CBTdn6RsNG2a0+p/ZDcywzr0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/golang.Go/changelog";
@@ -2112,17 +2112,7 @@ let
         };
       };
 
-      gruntfuggly.todo-tree = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "todo-tree";
-          publisher = "Gruntfuggly";
-          version = "0.0.226";
-          hash = "sha256-Fj9cw+VJ2jkTGUclB1TLvURhzQsaryFQs/+f2RZOLHs=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      gruntfuggly.todo-tree = callPackage ./gruntfuggly.todo-tree { };
 
       hars.cppsnippets = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -3587,8 +3577,8 @@ let
         mktplcRef = {
           name = "vscode-just-syntax";
           publisher = "nefrob";
-          version = "0.10.1";
-          hash = "sha256-s/JxIALrYb/dew1CdvvM1UmnewyRcJPB/ETJ/Ai2QJA=";
+          version = "0.10.2";
+          hash = "sha256-F7H9f24TjB3JtWLVICYwRTjxa+GTOpYN7IzSlU1audo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/nefrob.vscode-just-syntax/changelog";
@@ -4130,8 +4120,8 @@ let
         mktplcRef = {
           name = "scala";
           publisher = "scala-lang";
-          version = "0.5.9";
-          hash = "sha256-zgCqKwnP7Fm655FPUkD5GL+/goaplST8507X890Tnhc=";
+          version = "0.5.10";
+          hash = "sha256-hGJbu/tRt1Du/OYuui7z/CINlMug/SlUQjPNy8Rvkxg=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -4222,8 +4212,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.27";
-          hash = "sha256-v4CZul1uuNlMrIgfml9EjUy0I626GkBArNH7F+5Z/dA=";
+          version = "0.8.30";
+          hash = "sha256-wtI+W+ZNxXv8WonGDmSt1NxeF8WN8fqPCuMougERxDE=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
@@ -4534,8 +4524,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "110.1.0";
-          hash = "sha256-i6FObecuMylaCZYl/KLMscE07JIzQz+NSkfRdxtSfgg=";
+          version = "110.2.0";
+          hash = "sha256-5WCaYhWA6soB2AALFY/5Z7Y8IBAj5/4XSR/I4jHhth8=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -5134,8 +5124,8 @@ let
         mktplcRef = {
           name = "vscode-java-pack";
           publisher = "vscjava";
-          version = "0.30.5";
-          hash = "sha256-MlBACPD880QvsQpPDXe5384dlrMeKMSX1CUSIfzwwPo=";
+          version = "0.31.0";
+          hash = "sha256-E0GJoITZIh2XemVpyPh3gAEtlvM2PZHgNzZDctSpwIA=";
         };
         meta = {
           description = "Popular extensions for Java development that provides Java IntelliSense, debugging, testing, Maven/Gradle support, project management and more";
@@ -5200,8 +5190,8 @@ let
         mktplcRef = {
           name = "volar";
           publisher = "Vue";
-          version = "3.3.3";
-          hash = "sha256-Q2PnfjO7wzHrmWAeD4dOFT+GFe8qGG8wHU1FpwYeDnA=";
+          version = "3.3.5";
+          hash = "sha256-Oz4or7AtfrlcAXmFB4lkNk4Uqmpm1AsGP4RLcdpzRbo=";
         };
         meta = {
           changelog = "https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md";

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.39.6";
-    hash = "sha256-shxV0g1XDu7qjrGiwyHGpY2qBCJt23tz7SuDbm5AXws=";
+    version = "1.39.7";
+    hash = "sha256-hm5jDcBVaRfmzhDTXFOpReN227lFyYT/i+HGPcpdkX0=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "fstar-vscode-assistant";
     publisher = "FStarLang";
-    version = "0.25.0";
-    hash = "sha256-sya3P9Kn3DM/z5p8xF6TLEUPgrCs5+jgD89Y1KSJAgY=";
+    version = "0.25.4";
+    hash = "sha256-9gPM/T3Kbwt40V2ZuzN/OkQVNATsp4AYK9HuOu/Ui+0=";
   };
   meta = {
     description = "Interactive editing mode VS Code extension for F*";

pkgs/applications/editors/vscode/extensions/gruntfuggly.todo-tree/default.nix

@@ -0,0 +1,47 @@
+{
+  jq,
+  lib,
+  moreutils,
+  ripgrep,
+  vscode-utils,
+  vscode-extension-update-script,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "todo-tree";
+    publisher = "Gruntfuggly";
+    version = "0.0.226";
+    hash = "sha256-Fj9cw+VJ2jkTGUclB1TLvURhzQsaryFQs/+f2RZOLHs=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ ripgrep ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '(.contributes.configuration[] | select(.title == "%todo-tree.configuration.regex%") | .properties."todo-tree.ripgrep.ripgrep".default) = $s' \
+      --arg s "${lib.getExe ripgrep}" \
+      package.json | sponge package.json
+  '';
+
+  passthru.updateScript = vscode-extension-update-script { };
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/Gruntfuggly.todo-tree/changelog";
+    description = "Show TODO, FIXME, etc. comment tags in a tree view";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=Gruntfuggly.todo-tree";
+    homepage = "https://github.com/Gruntfuggly/todo-tree";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      sandarukasa
+    ];
+  };
+}

pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.39.2";
-    hash = "sha256-Lb20IdQcroJ/9Jn+epcIDvciFb/GDmklR9pDzrC5JbQ=";
+    version = "2.39.3";
+    hash = "sha256-oU3kAhIsuadjyBvi+gJ6h19A3KueQYCZWLIN0ZUhoOE=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix

@@ -84,8 +84,8 @@ buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "remote-ssh";
     publisher = "ms-vscode-remote";
-    version = "0.123.0";
-    hash = "sha256-/9NyRSNUCx65FOA6w86e2DvrynAHRleIULzDpneV25E=";
+    version = "0.124.0";
+    hash = "sha256-GokSJOEpHomkBbkPUBhVXWZCrGbi5oZTlw5PFV12ZBY=";
   };
 
   postPatch = ''

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-8EjKZl0fWpdgaYHeZDTbVS8EpwbVpt9pYWXq85u1bEQ=";
+    hash = "sha256-13/qw2BZ/WG+TYNVncJ/PuFLaUhlAn63zaa27JcLITE=";
   };
 
   __structuredAttrs = true;

pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix

@@ -11,22 +11,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-vm12qVJ6+KbyHdzB/Q4SrEZDUKVsKJufjbVn9OBGbns=";
+          hash = "sha256-cP/oFn19CZ/G3kjdHNZGqXvoDE1qUtg6xrg/2MO14Lo=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-1dunJX+7oL2RqsK2pCScKAe/O0b3ypfgsuHXoDvvChM=";
+          hash = "sha256-wtk8SasxXEQ3pCJpVTWR8wcY/bNaIZmImbAtrFWYWOo=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-5IG0H3QIY6ll77aZ6/8uFeIpgjupjBx0GfFJaX7Wep4=";
+          hash = "sha256-XYdwVoDqK+88ZYUm6APyamFNx6XlYjy0R4CIhSMuRmU=";
         };
       };
     in
     {
       publisher = "redhat";
       name = "vscode-xml";
-      version = "0.29.2";
+      version = "0.29.3";
     }
     // sources.${stdenvNoCC.hostPlatform.system} or { };
 

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.86.2";
-    hash = "sha256-Peoja4AQUPlwAKeJMOziGjd/WU4wz5B8cplCTh20yTA=";
+    version = "3.89.2";
+    hash = "sha256-lDt/xn1PFs0UDg0rOOun8Bl/FTXSjvQ//ETkoHFypAM=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/yy0931.vscode-sqlite3-editor/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-sqlite3-editor";
     publisher = "yy0931";
-    version = "1.0.212";
-    hash = "sha256-mG75eEK7agZ8R4LNN5xM7GqaBQC5JKhUR0/ZogZTHpY=";
+    version = "1.0.214";
+    hash = "sha256-lxH+j83R2ZYCWrEB0c70DRSCMn5iH1Xz/vXLZBE42Eg=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/yy0931.vscode-sqlite3-editor/changelog";

pkgs/applications/editors/vscode/extensions/yzane.markdown-pdf/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "markdown-pdf";
     publisher = "yzane";
-    version = "2.0.1";
-    hash = "sha256-XykOUbCiTVtfmp5H9UC4gFPBxmrIJR7jv9VvLljOSM0=";
+    version = "2.1.0";
+    hash = "sha256-3N4de2jgLbBlDGouFU7XoH4ElL9En9+2ZprMqoL03/E=";
   };
   nativeBuildInputs = [
     jq

pkgs/applications/editors/vscode/generic.nix

@@ -188,6 +188,7 @@ stdenv.mkDerivation (
     passthru = {
       inherit
         executableName
+        iconName
         longName
         tests
         updateScript

pkgs/applications/editors/vscode/with-extensions.nix

@@ -52,6 +52,11 @@
 
 let
   inherit (vscode) executableName longName;
+  # The wrapped editor may override `iconName` (e.g. code-cursor, windsurf,
+  # kiro and antigravity-ide all set it to a name without the `vs` prefix). Read
+  # the real value from the package, falling back to the generic.nix default for
+  # editors built before `iconName` was exposed via passthru.
+  iconName = vscode.iconName or "vs${executableName}";
   wrappedPkgVersion = lib.getVersion vscode;
   wrappedPkgName = lib.removeSuffix "-${wrappedPkgVersion}" vscode.name;
 
@@ -100,7 +105,12 @@ runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}"
         mkdir -p "$out/share/applications"
         mkdir -p "$out/share/pixmaps"
 
-        ln -sT "${vscode}/share/pixmaps/vs${executableName}.png" "$out/share/pixmaps/vs${executableName}.png"
+        ln -sT "${vscode}/share/pixmaps/${iconName}.png" "$out/share/pixmaps/${iconName}.png"
+        # Carry over the themed icons too; the .desktop entry's `Icon=` is
+        # resolved against the icon theme before falling back to pixmaps.
+        if [ -d "${vscode}/share/icons" ]; then
+          ln -sT "${vscode}/share/icons" "$out/share/icons"
+        fi
         ln -sT "${vscode}/share/applications/${executableName}.desktop" "$out/share/applications/${executableName}.desktop"
         ln -sT "${vscode}/share/applications/${executableName}-url-handler.desktop" "$out/share/applications/${executableName}-url-handler.desktop"
         makeWrapper "${vscode}/bin/${executableName}" "$out/bin/${executableName}" ${extensionsFlag}

pkgs/applications/emulators/libretro/cores/gpsp.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-06-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "d6decfa351b575e2936afebba26d41ec20e4ddcd";
-    hash = "sha256-kqqNyBEaWlj9E4tZz7VK2186Y6DRDtcFBMIH7GpUDx4=";
+    rev = "2db57b11a437c4432ab69823bdcd951181de6213";
+    hash = "sha256-oiq79/wGja8ZMOrjgeDid1hYxVkG2YfKe9h+Dkq48kY=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2026-05-23";
+  version = "0-unstable-2026-06-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "31c9da911c8b3227f4bd5e70dc5a1e3876cf9ada";
-    hash = "sha256-5RipbW1eL+VOcl1JuwEOe9ZcTZiig7WWBfJONzAdVNE=";
+    rev = "2cca4441706b952c2eaf8264713b53fd5452e0bd";
+    hash = "sha256-g4fphqSN2ray4qHI0gPrCdYjQFJP7sLAhzHaRdjN+vI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2003.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-06-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "099c2ef21c67c463a97b9ab19403e58b31c69740";
-    hash = "sha256-D3/d/TzTjK0t4bh6Il9CMfHTHdYgMsQNE52PxjrXeyE=";
+    rev = "299789ce642b34c2679cfd89d7ecf06b09851bc1";
+    hash = "sha256-FX+onEaaQUdcjAvgsrdW0m408oCSXJEJHQncrN2Uk/Y=";
   };
 
   # Fix build with GCC 14

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2026-06-03";
+  version = "0-unstable-2026-06-13";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "c9bededa26315b0a7564f72821ce61a5420c79b4";
-    hash = "sha256-bm83QjqhyployW+LzC3/AvR6qgEF9DpQrDqRAtI+4dU=";
+    rev = "238a88e92b092215dd0cbdc33da6f5e4385ccfb2";
+    hash = "sha256-dROUYWxpefM+2SuK/vcnPDnwdh9LH6oGoadGrz+gGJk=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/xppen/generic.nix

@@ -63,7 +63,6 @@ stdenv.mkDerivation {
     mainProgram = "PenTablet";
     maintainers = with lib.maintainers; [
       gepbird
-      nasrally
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "149.0.7827.102",
+    "version": "149.0.7827.114",
     "chromedriver": {
-      "version": "149.0.7827.103",
-      "hash_darwin": "sha256-3ws6RyF5SwjRcdo4IY+MzqcaZ6214dCVV3YB4YL+h6k=",
-      "hash_darwin_aarch64": "sha256-S8/dGAlipcYXzZIEJEGAnvsu3ilqjnBb8IdXUxGrp2o="
+      "version": "149.0.7827.115",
+      "hash_darwin": "sha256-DOhM1knKphvLNyrkf0uvb9NZ3kBwSuVN5hkQLqAZR1Y=",
+      "hash_darwin_aarch64": "sha256-HXWvAjMdMMbeF8DsgFKNM+S0ZEYr2M8Wj0uUZC7tmxY="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "112f665d98a2fe84b156c74fbea2aed742f16c15",
-        "hash": "sha256-75PYsss5Qob493WCc28XHncjFIlvUr2HQx79w5UmK/k=",
+        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
+        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -823,7 +823,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.53",
+    "version": "149.0.7827.114",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.53-1",
-        "hash": "sha256-j4maEZiU38tqs57cTmg8OhIAAQcT+liWU0fDA7GMZHM="
+        "rev": "149.0.7827.114-1",
+        "hash": "sha256-F0pIlZM/EBPLIZxD8jyLX7HWe0vFn2HXs2vkM5+Xplg="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "9d2c8156a72129edca4785abb98866fad60ea338",
-        "hash": "sha256-RPFeHTWAeJUzbWU7QyRPmT3sqf3bAEuJ7/IJ3TP40pA=",
+        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
+        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "ded782bca9d5f165d1c4a70124cdc5384043a8b3",
-        "hash": "sha256-7+Hhx/V554hO3zzGuIZswkaRVDElz7ost7vbnf2wyZc="
+        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
+        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1815a06195d9c74ac737a96f87c05111926e04f8",
-        "hash": "sha256-71KbW0w60VB67+HM48WpOo18hrVId4/4QBDl+xl5pgo="
+        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
+        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1374,8 +1374,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "a7849e8a5e9c996bef2332efae897e7301055a20",
-        "hash": "sha256-ftOTwWULKNplqjQQ9oM9t+PU3S6/ySDOBoE5E/HWuHg="
+        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
+        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1429,8 +1429,8 @@
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "846203c4b3b25f834a0bebc101fa8e1b8f9d0ca9",
-        "hash": "sha256-YOgOau9vNrOOqyUf6WylI/oQ2drCxoW7jnrHt7fAfQM="
+        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
+        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1474,8 +1474,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "53348aa333da02b77c4b5797e2de722f5abde7d0",
-        "hash": "sha256-Qh0ytA45zP67VQE417iUtjPcJmJmDzcu4BAatyh6p0w="
+        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
+        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "5a7e0ff57a52e12f834d64c57d040d1105ea17f2",
-        "hash": "sha256-V1accCSU6LV5Ixhd+HBOvqZ7GxT57ALsvaF8ABLIXxM="
+        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
+        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5a39b146dd810a52812202fae891281d5dc4db7d",
-        "hash": "sha256-UbX88nE4VyWUm4PvFTOy3mC04MzSdgC006ZpQrEY8cQ="
+        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
+        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
       }
     }
   }

pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml

@@ -16,4 +16,3 @@ treat_warnings_as_errors=false
 use_official_google_api_keys=false
 use_unofficial_version_number=false
 v8_drumbrake_bounds_checks=true
-v8_enable_drumbrake=true

pkgs/applications/networking/cluster/helm/default.nix

@@ -72,15 +72,15 @@ buildGoModule (finalAttrs: {
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/dependency_build_test.go \
+    substituteInPlace pkg/cmd/dependency_build_test.go \
       --replace-fail "TestDependencyBuildCmd" "SkipDependencyBuildCmd"
-    substituteInPlace cmd/helm/dependency_update_test.go \
+    substituteInPlace pkg/cmd/dependency_update_test.go \
       --replace-fail "TestDependencyUpdateCmd" "SkipDependencyUpdateCmd"
     # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/install_test.go \
+    substituteInPlace pkg/cmd/install_test.go \
       --replace-fail "TestInstall" "SkipInstall"
     # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/pull_test.go \
+    substituteInPlace pkg/cmd/pull_test.go \
       --replace-fail "TestPullCmd" "SkipPullCmd" \
       --replace-fail "TestPullWithCredentialsCmd" "SkipPullWithCredentialsCmd"
   '';

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-HQDXazrYuO4Sy2p5M3T+ic34GXaLuAt/oPlUPC6kHSk=",
+    "hash": "sha256-10cdMZSGJuhUx432/2NazA8T88zclcnbolcU31wfIEM=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.108.0",
+    "rev": "v0.109.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pk4FEx/GpI3pbRt1zXEnTwfEy2renn8gh0mVbBiwUE0="
+    "vendorHash": "sha256-Tx5DjRLZJXm0GjKRaogra7m55Opeu9LVvT25UW5q4D0="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -128,13 +128,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-R9jG7ww2iEU1qif6NeV0lpgG6Nv5rsh5h+IVhSscuKI=",
+    "hash": "sha256-MoucQgeikKMh4P8nRWIJ5SkLFGeVfDutsSBUSowz6VM=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.33.0",
+    "rev": "v1.34.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-n6+8mufcH3rNe4yLkc+7NkV7UwNwyIVzDFStSC7iqE4="
+    "vendorHash": "sha256-uYyj6GSV5bWEfRTOODMuReEHe9wnF4cVoHM9rBMpgmM="
   },
   "camptocamp_pass": {
     "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -155,13 +155,13 @@
     "vendorHash": "sha256-SO3CX7pZ+q7ytz/55cxTPlW7ByY1zKhxkQxMiqAvm8o="
   },
   "checkly_checkly": {
-    "hash": "sha256-C85OWP4y5Kh4coaUwxW07bgQWrB6LntEKtXia3Xu7Bg=",
+    "hash": "sha256-9kcZXbrfl8ovrg1w3bWdta/ABnLtVIfseRptZn5NrgI=",
     "homepage": "https://registry.terraform.io/providers/checkly/checkly",
     "owner": "checkly",
     "repo": "terraform-provider-checkly",
-    "rev": "v1.24.0",
+    "rev": "v1.25.0",
     "spdx": null,
-    "vendorHash": "sha256-CkrDrGP20Gby2wWsl+un3hp3u5gAmWOpjzgs9HQytjg="
+    "vendorHash": "sha256-7XgTkzYBfkpF8Dd4YsgpB+YIfkANsg/60b3AyO8Y8FA="
   },
   "ciscodevnet_aci": {
     "hash": "sha256-Z3qat3S7dv5kGpc82RxAwlgp3hfscFbkokVsgGnBRHY=",
@@ -319,11 +319,11 @@
     "vendorHash": null
   },
   "digitalocean_digitalocean": {
-    "hash": "sha256-Ekuvv1D3f+ePvTpuye207/y5HGf+2WqtdeFgQCtjQ2w=",
+    "hash": "sha256-gvLdDUFg8WoBg8+351CCK84LhLJlsV6Nqm9kbxlQQ50=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.87.0",
+    "rev": "v2.89.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -391,11 +391,11 @@
     "vendorHash": "sha256-WFlKj1IO9ylXn5frdnLcctQawjUXBTqcoMhQUQTU06A="
   },
   "exoscale_exoscale": {
-    "hash": "sha256-eK9XWu1Hh/sFWkUO5r0HIcw8tIhhP1nzkI41B0DpMZg=",
+    "hash": "sha256-JSDlAtLvbk36OBUV22JoSrxV7nRegDirdyOUobUwrWg=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.69.2",
+    "rev": "v0.69.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -409,13 +409,13 @@
     "vendorHash": null
   },
   "fastly_fastly": {
-    "hash": "sha256-dWT0E6eugOD79Cn51P0KQbwwY1seSL1NvZVzjWxtGNs=",
+    "hash": "sha256-S6VIwqwTPr276TTqgEFTxhE5c97lCd8/5dJnDGori4s=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v9.2.0",
+    "rev": "v9.2.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-+5eeZdU5iS/StHuo/7KRkdM+DW4IDvJ52BDKNZI7lAc="
+    "vendorHash": "sha256-8QF9gOuvuZwAoFWePjti4h6VzmA+TGiFaC/ShuEAZqA="
   },
   "flexibleenginecloud_flexibleengine": {
     "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -481,13 +481,13 @@
     "vendorHash": "sha256-874QpqIFFhzIGJZ8nKGcUe9qEpR9jQkx4nl75Cpqpww="
   },
   "grafana_grafana": {
-    "hash": "sha256-STYK0M5eq5hECKJUrk2Q4qhOrPt+eiyIGi0boukSHBM=",
+    "hash": "sha256-TyO5Owo8LFQVQmsAD40/L0VaAY1+X3h4pSPbJIE97mY=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v4.36.2",
+    "rev": "v4.38.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-VEAtUCVZ3nJ1jfDYkkek+VQ1LjNQgRstRNtsM05ebZo="
+    "vendorHash": "sha256-Fnn5/UiSQtvv/XykeXhbR4GuSrGBy/j03vzyBI2LnGg="
   },
   "gridscale_gridscale": {
     "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -517,13 +517,13 @@
     "vendorHash": "sha256-DyYT8SK5/IbkXWvzRTF6TjTi4aIpokLPOz5H/O05YU8="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-ywRxQKGrQ+kT08gNgNgdT5FmvsHYucT/W29+uyz1mwg=",
+    "hash": "sha256-/4NhHZs/8LwrL+TXoOGyszvHZcKps5tDu7uewKeNmb4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.87.0",
+    "rev": "v1.88.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Bf2XnjX0G5iufWOi6E/imRQ+qgr8Yse73rrnY8CbSMg="
+    "vendorHash": "sha256-vTJI/71O8u6DqAF3E7pde1Z1qsoyTTJMNen3AvRomls="
   },
   "hashicorp_azuread": {
     "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -851,13 +851,13 @@
     "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
   },
   "linode_linode": {
-    "hash": "sha256-ZDU8rEmbq9tIXq9+jL30i5GnTIWM6lMJ+rljVJhBJis=",
+    "hash": "sha256-aOLto01ntce/l+1ZcQf5Rsdu6ptgpYWpf5JpJ0zRUNs=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.14.0",
+    "rev": "v3.14.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6wWNt0TDqqwtRFMCLH81WQ55XLEn4dHx+prM0DA+e4U="
+    "vendorHash": "sha256-dnvv6sSzEUZ4Hbrq/pAgi/O1RyxCx89omCVzvCe70S0="
   },
   "loafoe_htpasswd": {
     "hash": "sha256-1HCvAGWsYlcYCA8iOmBb/AawxHPLuoxxQWLzNy0x79M=",
@@ -1175,11 +1175,11 @@
     "vendorHash": "sha256-InCRL4k6v0avmnNja+b6Ozg5+injxa8EmrRHIWrq4Ag="
   },
   "sap_btp": {
-    "hash": "sha256-8YQxOUgQkmH7FZFqIbSdR3QfwPcPMIV7fWwnPtfxjbc=",
+    "hash": "sha256-kTH3diM9jbncv80+I//mj+zCWGosIXjjMETXa6IS2HU=",
     "homepage": "https://registry.terraform.io/providers/SAP/btp",
     "owner": "SAP",
     "repo": "terraform-provider-btp",
-    "rev": "v1.22.0",
+    "rev": "v1.23.1",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-w/AmSHydCeyp/EURgPY2c/E2LjqAXXCORI53X1hEdxY="
   },
@@ -1202,13 +1202,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-1KHFXjYJIWgdZo5nAsckQI9ff+74yO0A5Q65symJjlw=",
+    "hash": "sha256-xoIwvrjeuY1T+7pyBQfoU8orWC4qMuQ9IgbLYIEzLIA=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v8.0.1",
+    "rev": "v8.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ICMbdEr2vGKZ1ETZLmmrW8h+bzPkpSQk9U3qF+LHPzk="
+    "vendorHash": "sha256-Y2oj1DIn80CCdJ7ZM/p6sGqT64dGIEFg/vXXSv6B+iE="
   },
   "siderolabs_talos": {
     "hash": "sha256-/NACmEpodBNx+Q2M9y3JnKpw9a3Y1eFDdTQ+48MXAc8=",

pkgs/applications/networking/cluster/terraform/default.nix

@@ -200,8 +200,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.15.5";
-    hash = "sha256-U3A+Zwe+oj107z635uxzt4y06hvbv9sfokknYdFIglE=";
+    version = "1.15.6";
+    hash = "sha256-FH5s0uyRESytv/1xloU3HXuH2ApjBC3FfEqFqIgBgFs=";
     vendorHash = "sha256-3y9+KCmvskJ24X4F6gSLglmsl4hUlvzBb/ep4kcbS8A=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/office/libreoffice/default.nix

@@ -111,6 +111,7 @@
   gpgmepp,
   libwebp,
   abseil-cpp,
+  libfreehand,
   libepubgen,
   libetonyek,
   libpng,
@@ -518,6 +519,7 @@ stdenv.mkDerivation (finalAttrs: {
       libatomic_ops
       libcdr
       libcmis
+      libfreehand
       libe-book
       libepoxy
       libepubgen
@@ -662,6 +664,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-system-headers"
     "--with-system-libabw"
     "--with-system-libcmis"
+    "--with-system-libfreehand"
     "--with-system-libepubgen"
     "--with-system-libetonyek"
     "--with-system-liblangtag"
@@ -679,7 +682,6 @@ stdenv.mkDerivation (finalAttrs: {
     # TODO: package these as system libraries
     "--without-system-altlinuxhyph"
     "--without-system-libeot"
-    "--without-system-libfreehand"
     "--without-system-libmspub"
     "--without-system-libnumbertext"
     "--without-system-libpagemaker"

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -515,13 +515,25 @@ unset XDG_CONFIG_HOME
 export GIT_CONFIG_NOSYSTEM=1
 
 
-# Disable maintenance: it's not useful for a short-lived clone, and
-# background maintenance causes non-deterministic builds.
+# Append a config entry via the GIT_CONFIG_* environment variables. Unlike
+# `git config` (writes a single repo) or `git -c` (one invocation), these
+# propagate to every git invocation *and* its children, including (nested)
+# submodule fetches. Done additively so it composes with any GIT_CONFIG_* the
+# caller passes via `impureEnvVars`.
+git_config_env(){
+    export GIT_CONFIG_COUNT=$(( ${GIT_CONFIG_COUNT:-0} + 1 ))
+    export "GIT_CONFIG_KEY_$(( GIT_CONFIG_COUNT - 1 ))=$1"
+    export "GIT_CONFIG_VALUE_$(( GIT_CONFIG_COUNT - 1 ))=$2"
+}
+
+# Disable maintenance and auto-gc: they're not useful for a short-lived clone,
+# and their background/detached processes race the later `.git` removal,
+# producing non-deterministic output (and outright failures with nested
+# submodules, where the legacy gc.auto path still fires).
 # https://github.com/NixOS/nixpkgs/issues/524215
-export GIT_CONFIG_COUNT=$(( ${GIT_CONFIG_COUNT:-0} + 1 ))
-# Not the best but generic enough that it will work with `impureEnvVars`
-export "GIT_CONFIG_KEY_$(( GIT_CONFIG_COUNT - 1 ))=maintenance.auto"
-export "GIT_CONFIG_VALUE_$(( GIT_CONFIG_COUNT - 1 ))=false"
+git_config_env maintenance.auto false
+git_config_env gc.auto 0
+git_config_env gc.autoDetach false
 
 if test -n "$builder"; then
     test -n "$out" -a -n "$url" -a -n "$rev" || usage

pkgs/build-support/node/fetch-pnpm-deps/default.nix

@@ -52,19 +52,7 @@ in
       pnpm-fixup-state-db' =
         if pnpm.nodejs-slim or null != null then
           pnpm-fixup-state-db.override {
-            # FIXME: make npm-config-hook accept nodejs-slim
-            nodejs =
-              let
-                inherit (pnpm) nodejs-slim;
-              in
-              if nodejs-slim ? paths && builtins.isList nodejs-slim.paths then
-                # If nodejs-slim has a list `paths` attribute, it's likely a simlinkJoin
-                nodejs-slim
-              else
-                # Otherwise we need to recreate one by overriding the default one
-                pnpm-fixup-state-db.nodejs.override {
-                  inherit nodejs-slim;
-                };
+            inherit (pnpm) nodejs-slim;
           }
         else
           pnpm-fixup-state-db;

pkgs/build-support/src-only/default.nix

@@ -37,37 +37,44 @@
 
 attrs:
 let
-  argsToOverride = args: {
-    name = "${args.name or "${args.pname}-${args.version}"}-source";
+  argsToOverride =
+    args:
+    {
+      name = "${args.name or "${args.pname}-${args.version}"}-source";
 
-    outputs = [ "out" ];
+      outputs = [ "out" ];
 
-    phases = [
-      "unpackPhase"
-      "patchPhase"
-      "installPhase"
-    ];
-    separateDebugInfo = false;
+      phases = [
+        "unpackPhase"
+        "patchPhase"
+        "installPhase"
+      ];
+      separateDebugInfo = false;
 
-    dontUnpack = lib.warnIf (args.dontUnpack or false
-    ) "srcOnly: derivation has dontUnpack set, overriding" false;
+      dontUnpack = lib.warnIf (args.dontUnpack or false
+      ) "srcOnly: derivation has dontUnpack set, overriding" false;
 
-    dontInstall = false;
-    installPhase = "cp -pr --reflink=auto -- . $out";
+      dontInstall = false;
+      installPhase = "cp -pr --reflink=auto -- . $out";
 
-    # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
-    # some things get confused and error if one of these is set to an output that doesn't exist
-    # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
-    outputDev = "out";
-    outputBin = "out";
-    outputInclude = "out";
-    outputLib = "out";
-    outputDoc = "out";
-    outputDevdoc = "out";
-    outputMan = "out";
-    outputDevman = "out";
-    outputInfo = "out";
-  };
+      # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
+      # some things get confused and error if one of these is set to an output that doesn't exist
+      # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
+      outputDev = "out";
+      outputBin = "out";
+      outputInclude = "out";
+      outputLib = "out";
+      outputDoc = "out";
+      outputDevdoc = "out";
+      outputMan = "out";
+      outputDevman = "out";
+      outputInfo = "out";
+
+    }
+    // lib.optionalAttrs (lib.isAttrs args.outputChecks or null) {
+      # If the original derivation includes outputChecks for output we are removing, we need to reset it to an empty check.
+      outputChecks = { };
+    };
 in
 
 # If we are passed a derivation (based on stdenv*), we can use overrideAttrs to

pkgs/build-support/trivial-builders/default.nix

@@ -893,7 +893,7 @@ rec {
   # Docs in doc/build-helpers/fetchers.chapter.md
   # See https://nixos.org/manual/nixpkgs/unstable/#requirefile
   requireFile = lib.extendMkDerivation {
-    constructDrv = stdenv.mkDerivation;
+    constructDrv = stdenvNoCC.mkDerivation;
 
     excludeDrvArgNames = [
       "hash"

pkgs/build-support/trivial-builders/test/default.nix

@@ -25,6 +25,7 @@ recurseIntoAttrs {
   symlinkJoin = recurseIntoAttrs (callPackage ./symlink-join.nix { });
   overriding = callPackage ../test-overriding.nix { };
   inherit references;
+  requireFile = callPackage ./requireFile.nix { };
   writeCBin = callPackage ./writeCBin.nix { };
   writeClosure-union = callPackage ./writeClosure-union.nix {
     inherit (references) samples;

pkgs/build-support/trivial-builders/test/requireFile.nix

@@ -0,0 +1,22 @@
+{
+  pkgsStatic,
+  lib,
+  requireFile,
+  emptyFile,
+}:
+let
+  name = "this-is-a-test";
+  requireFileTest =
+    requireFile:
+    requireFile {
+      inherit name;
+      url = "this-is-a-test";
+      hash = lib.fakeHash;
+    };
+  requireFile-native = requireFileTest requireFile;
+  requireFile-static = requireFileTest pkgsStatic.requireFile;
+in
+assert lib.assertMsg (
+  requireFile-native.name == name && requireFile-static.name == name
+) "requireFile derivation name must be the same across different package sets";
+emptyFile

pkgs/build-support/vm/default.nix

@@ -30,7 +30,22 @@
   # ----------------------------
   customQemu ? null,
   kernel ? linux,
-  img ? kernel.target,
+  # Name of the kernel image file inside the `kernel` output.
+  kernelImage ?
+    kernel.target or (throw ''
+      vmTools: the `kernel` argument (${kernel.name or "<unknown>"}) has no
+      `target` attribute, so the kernel image filename cannot be determined.
+
+      If you are passing a module tree (e.g. from `pkgs.aggregateModules`) to
+      make extra modules available, pass it via `kernelModules` instead and
+      keep `kernel` pointing at a real kernel derivation. Alternatively, pass
+      `kernelImage` explicitly with the path of the bootable image relative
+      to the `kernel` derivation output (e.g. "bzImage" or "Image").
+    ''),
+  # Package providing `lib/modules` for the VM initrd. Override this (e.g.
+  # with `pkgs.aggregateModules [ ... ]`) to make extra kernel modules
+  # available inside the VM without replacing the boot kernel.
+  kernelModules ? kernel,
   storeDir ? builtins.storeDir,
   rootModules ? [
     "virtio_pci"
@@ -50,9 +65,9 @@ let
   qemu = buildPackages.qemu_kvm;
 
   modulesClosure = makeModulesClosure {
-    kernel = lib.getOutput "modules" kernel;
+    kernel = lib.getOutput "modules" kernelModules;
     inherit rootModules;
-    firmware = kernel;
+    firmware = kernelModules;
   };
 
   hd = "vda"; # either "sda" or "vda"
@@ -220,7 +235,7 @@ let
     fi
 
     # Set up automatic kernel module loading.
-    export MODULE_DIR=${lib.getOutput "modules" kernel}/lib/modules/
+    export MODULE_DIR=${lib.getOutput "modules" kernelModules}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
     #! ${bash}/bin/sh
     export MODULE_DIR=$MODULE_DIR
@@ -260,7 +275,7 @@ let
       -chardev socket,id=xchg,path=virtio-xchg.sock \
       -device vhost-user-fs-pci,chardev=xchg,tag=xchg \
       ''${diskImage:+-drive file=$diskImage,if=virtio,cache=unsafe,werror=report} \
-      -kernel ${kernel}/${img} \
+      -kernel ${kernel}/${kernelImage} \
       -initrd ${initrd}/initrd \
       -append "console=${qemu-common.qemuSerialDevice} panic=1 command=${stage2Init} mountDisk=$mountDisk loglevel=4" \
       $QEMU_OPTS
@@ -417,7 +432,7 @@ let
         name = "extract-file";
         buildInputs = [ util-linux ];
         buildCommand = ''
-          ln -s ${kernel}/lib /lib
+          ln -s ${kernelModules}/lib /lib
           ${kmod}/bin/modprobe loop
           ${kmod}/bin/modprobe ext4
           ${kmod}/bin/modprobe hfs
@@ -449,7 +464,7 @@ let
           mtdutils
         ];
         buildCommand = ''
-          ln -s ${kernel}/lib /lib
+          ln -s ${kernelModules}/lib /lib
           ${kmod}/bin/modprobe mtd
           ${kmod}/bin/modprobe mtdram total_size=131072
           ${kmod}/bin/modprobe mtdchar

pkgs/by-name/_1/_1password-cli/package.nix

@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.34.0";
+  version = "2.34.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-LuOI9r1VRnL9IGsK4vy4ENOS64xdpIZ+ZskIkUJ0s34=" "zip";
-    i686-linux = fetch "linux_386" "sha256-VvqEyDHEIY3BsgubiJKXql1WEnwXHkSHpFvCcKBIeYw=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-sbydXPoT0Vo3r2gyZBdl4OMtOejbhvra5JM4wB6Ex5s=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-uEukRq71eeayvNguD9XepvP1Br5AkE2Ag/Chv2idf4A=" "zip";
+    i686-linux = fetch "linux_386" "sha256-p/F3YZLJnlimrVE2qxTHvIB4m47kuwhoCWTC40VIvMs=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-oAABMlwwv5X91TT6FK2aPpg+e2CvmHT1rqIVRTjQNCQ=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-9h+Z7INYcJcWeVQ9QnXKjtT5QyV2J+dP857qSOpBAy8="
+      fetch "apple_universal" "sha256-vp1Y1M6DUanx1CAVhLrqgBovwws6Y/5jOgnwTZE8Hhc="
         "pkg";
     x86_64-darwin = aarch64-darwin;
   };

pkgs/by-name/_7/_7zip-zstd/package.nix

@@ -16,7 +16,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "7zip-zstd";
-  version = "25.01-v1.5.7-R4";
+  version = "26.01-v1.5.7-R1";
 
   src = fetchFromGitHub {
     owner = "mcmilk";
@@ -24,9 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
     tag = "v${finalAttrs.version}";
     hash =
       if enableUnfree then
-        "sha256-qP4L5PIG7CHsmYbRock+cbCOGdgujUFG4LHenvvlqzw="
+        "sha256-P6kwg3McroMwqB5bryfoS9dIBsxcd84bVzsjUv5Bk5k="
       else
-        "sha256-R9AUWL35TPh0anyRDhnF28ZYG9FeOxntVIwnnW9e2xA=";
+        "sha256-WowqcjcA/DUwj7DJrKDTYKpCDWd/tTIZ3yiuBgqXpmU=";
     # remove the unRAR related code from the src drv
     # > the license requires that you agree to these use restrictions,
     # > or you must remove the software (source and binary) from your hard disks

pkgs/by-name/ab/ab-av1/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ab-av1";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kT0BJr4xoYigKObD6vZNRieslaJj/MWuqQmhYLWNwvs=";
+    hash = "sha256-lLZAECwF8V19Qx/FugbjLeVns7lhVlwWDTK9cdYb0xo=";
   };
 
-  cargoHash = "sha256-o64GrmHvwF2VUKw+nIRK0jesSuelxNo0TFnyKaP/YlQ=";
+  cargoHash = "sha256-AONJz1BoDi6weHT7W9DmzwoPW5khfgYjDqLNl7OM5bY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ac/acl2/libipasirglucose4/default.nix

@@ -6,18 +6,18 @@
   unzip,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libipasirglucose4";
   # This library has no version number AFAICT (beyond generally being based on
   # Glucose 4.x), but it was submitted to the 2017 SAT competition so let's use
   # that as the version number, I guess.
   version = "2017";
 
-  libname = pname + stdenv.hostPlatform.extensions.sharedLibrary;
+  libname = finalAttrs.pname + stdenv.hostPlatform.extensions.sharedLibrary;
 
   src = fetchurl {
     url = "https://baldur.iti.kit.edu/sat-competition-2017/solvers/incremental/glucose-ipasir.zip";
-    sha256 = "0xchgady9vwdh8frmc8swz6va53igp2wj1y9sshd0g7549n87wdj";
+    hash = "sha256-svGDbCLlPNCg1skHycV9cRS1zecasZodgo3v5Jt6kHU=";
   };
   nativeBuildInputs = [ unzip ];
 
@@ -29,13 +29,13 @@ stdenv.mkDerivation rec {
   makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ];
 
   postBuild = ''
-    $CXX -shared -o ${libname} \
-        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${libname}"} \
+    $CXX -shared -o ${finalAttrs.libname} \
+        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${finalAttrs.libname}"} \
         ipasirglucoseglue.o libipasirglucose4.a
   '';
 
   installPhase = ''
-    install -D ${libname} $out/lib/${libname}
+    install -D ${finalAttrs.libname} $out/lib/${finalAttrs.libname}
   '';
 
   meta = {
@@ -44,4 +44,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ kini ];
   };
-}
+})

pkgs/by-name/ac/acl2/package.nix

@@ -32,15 +32,15 @@ let
   '';
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "acl2";
   version = "8.6";
 
   src = fetchFromGitHub {
     owner = "acl2-devel";
     repo = "acl2-devel";
-    rev = version;
-    sha256 = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
+    tag = finalAttrs.version;
+    hash = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
   };
 
   # You can swap this out with any other IPASIR implementation at
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     })
 
     (replaceVars ./0001-path-changes-for-nix.patch {
-      libipasir = "${libipasir}/lib/${libipasir.libname}";
+      libipasir = "${finalAttrs.libipasir}/lib/${finalAttrs.libipasir.libname}";
       libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
       libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     glucose
     minisat
     abc-verifier
-    libipasir
+    finalAttrs.libipasir
     z3
     (python3.withPackages (ps: [ ps.z3-solver ]))
   ];
@@ -115,10 +115,10 @@ stdenv.mkDerivation rec {
     # ACL2 and its books need to be built in place in the out directory because
     # the proof artifacts are not relocatable. Since ACL2 mostly expects
     # everything to exist in the original source tree layout, we put it in
-    # $out/share/${pname} and create symlinks in $out/bin as necessary.
-    mkdir -p $out/share/${pname}
-    cp -pR . $out/share/${pname}
-    cd $out/share/${pname}
+    # $out/share/acl2 and create symlinks in $out/bin as necessary.
+    mkdir -p $out/share/acl2
+    cp -pR . $out/share/acl2
+    cd $out/share/acl2
   '';
 
   preBuild = "mkdir -p $HOME";
@@ -132,19 +132,19 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/bin
-    ln -s $out/share/${pname}/saved_acl2           $out/bin/${pname}
+    ln -s $out/share/acl2/saved_acl2           $out/bin/acl2
   ''
   + lib.optionalString certifyBooks ''
-    ln -s $out/share/${pname}/books/build/cert.pl  $out/bin/${pname}-cert
-    ln -s $out/share/${pname}/books/build/clean.pl $out/bin/${pname}-clean
+    ln -s $out/share/acl2/books/build/cert.pl  $out/bin/acl2-cert
+    ln -s $out/share/acl2/books/build/clean.pl $out/bin/acl2-clean
   '';
 
   preDistPhases = [ (if certifyBooks then "certifyBooksPhase" else "removeBooksPhase") ];
 
   certifyBooksPhase = ''
     # Certify the community books
-    pushd $out/share/${pname}/books
-    makeFlags="ACL2=$out/share/${pname}/saved_acl2"
+    pushd $out/share/acl2/books
+    makeFlags="ACL2=$out/share/acl2/saved_acl2"
     buildFlags="all"
     buildPhase
 
@@ -157,7 +157,7 @@ stdenv.mkDerivation rec {
 
   removeBooksPhase = ''
     # Delete the community books
-    rm -rf $out/share/${pname}/books
+    rm -rf $out/share/acl2/books
   '';
 
   meta = {
@@ -172,9 +172,9 @@ stdenv.mkDerivation rec {
       ACL2 is part of the Boyer-Moore family of provers, for which its authors
       have received the 2005 ACM Software System Award.
 
-      This package installs the main ACL2 executable ${pname}, as well as the
-      build tools cert.pl and clean.pl, renamed to ${pname}-cert and
-      ${pname}-clean.
+      This package installs the main ACL2 executable acl2, as well as the
+      build tools cert.pl and clean.pl, renamed to acl2-cert and
+      acl2-clean.
 
     ''
     + (
@@ -212,4 +212,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/al/alglib/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alglib3";
-  version = "4.07.0";
+  version = "4.08.0";
 
   src = fetchurl {
     url = "https://www.alglib.net/translator/re/alglib-${finalAttrs.version}.cpp.gpl.tgz";
-    sha256 = "sha256-y4mlU+4gKwqUFgUHKoVxAjdq5EsMzSJeT6Dg4Llwi/A=";
+    sha256 = "sha256-mKPtCE+wLFagvBVDida8oQCyO7N0klWkyHFjkip3aoY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.18";
+  version = "3.3.23";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tTwVcvBk6SMDbDM3dPZZZdkbzlOAwg+K6gbeUc6XEqw=";
+    hash = "sha256-0AsrdD9ans1CmyJVK9tcAKGLeptpxdNAtOUuSv4i4zU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/alpaca-proxy/package.nix

@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "HTTP forward proxy with PAC and NTLM authentication support";
     homepage = "https://github.com/samuong/alpaca";
-    changelog = "https://github.com/samuong/alpaca/releases/tag/v${finalAttrs.src.rev}";
+    changelog = "https://github.com/samuong/alpaca/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ _1nv0k32 ];

pkgs/by-name/al/alsa-firmware/package.nix

@@ -53,11 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    homepage = "http://www.alsa-project.org/";
+    homepage = "https://www.alsa-project.org/";
     description = "Soundcard firmwares from the alsa project";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
     sourceProvenance = with lib.sourceTypes; [
       binaryFirmware
       fromSource

pkgs/by-name/al/alsa-plugins/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Various plugins for ALSA";
-    homepage = "http://alsa-project.org/";
+    homepage = "https://alsa-project.org/";
 
     license = with lib.licenses; [
       lgpl21Plus
@@ -46,7 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus # attributes.m4 & usb_stream.h
     ];
 
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/al/altermime/package.nix

@@ -4,13 +4,13 @@
   fetchurl,
 }:
 
-gccStdenv.mkDerivation rec {
+gccStdenv.mkDerivation (finalAttrs: {
   pname = "altermime";
   version = "0.3.11";
 
   src = fetchurl {
-    url = "https://pldaniels.com/altermime/altermime-${version}.tar.gz";
-    sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
+    url = "https://pldaniels.com/altermime/altermime-${finalAttrs.version}.tar.gz";
+    hash = "sha256-R17ScQWH0k8R0A2vpcP234rHnhO4xdVNLqNVdrV5/Zc=";
   };
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,4 +36,4 @@ gccStdenv.mkDerivation rec {
     downloadPage = "https://pldaniels.com/altermime/";
     mainProgram = "altermime";
   };
-}
+})

pkgs/by-name/am/aml/package.nix

@@ -3,33 +3,34 @@
   stdenv,
   fetchFromGitHub,
   meson,
-  pkg-config,
   ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "aml";
-  version = "0.3.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = "aml";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-BX+MRqvnwwLPhz22m0gfJ2EkW31KQEi/YTgOCMcQk2Q=";
+    hash = "sha256-10gm6YphZrpLShj3NUj/AG24dSVLZAZbbnXr7GiF4DI=";
   };
 
   nativeBuildInputs = [
     meson
-    pkg-config
     ninja
   ];
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   meta = {
-    description = "Another main loop";
-    inherit (finalAttrs.src.meta) homepage;
+    description = "Andri's Main Loop";
+    homepage = "https://github.com/any1/aml";
     license = lib.licenses.isc;
-    platforms = lib.platforms.unix;
-    maintainers = [ ];
-    broken = stdenv.hostPlatform.isDarwin;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 })

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -81,7 +81,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.15.4";
+  version = "4.8.18.0";
 
   __structuredAttrs = true;
 
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-ZUWesEpXb+L7NzL/jkWpS3b4DGq4733T5zc+VXSw9Ic=";
+    hash = "sha256-/A1juZzNWjdShdg41M1nfO3pMukMFzyBjQaZvZjYaJs=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix

@@ -5,12 +5,12 @@
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "anki-quizlet-importer-extended";
-  version = "2026.01.17";
+  version = "2026.06.08";
   src = fetchFromGitHub {
     owner = "sviatoslav-lebediev";
     repo = "anki-quizlet-importer-extended";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BTddZColXM193x8xFa1axHeiWukjxXvwkXGpHxsLtR0=";
+    hash = "sha256-f8Y2Tp3Wo41rKhz/YX602xhxvR7xWUOfvjIKuprt/bo=";
   };
   meta = {
     description = "Import Quizlet Decks into Anki";

pkgs/by-name/an/ansilove/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ansilove";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "ansilove";
     repo = "ansilove";
     tag = finalAttrs.version;
-    hash = "sha256-13v2NLVJt11muwocBiQYz/rxQkte/W6LXwB/H/E9Nvk=";
+    hash = "sha256-U8SKh+GBwtuJbHeB7x430YmbOdS38CIBsNXCWvs8XY8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/an/antigravity-cli/package.nix

@@ -6,7 +6,7 @@
   versionCheckHook,
 }:
 let
-  wholeVersion = "1.0.7-5858071034068992"; # unfortunately this has dumb versioning
+  wholeVersion = "1.0.8-6513509081677824"; # unfortunately this has dumb versioning
   version = builtins.head (lib.splitString "-" wholeVersion);
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@@ -14,19 +14,19 @@ let
   sourceData = {
     x86_64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-8kaHmc0XPAPuATHb4rrkMhUzBqaLqi7n1UQPFcRB4Go=";
+      hash = "sha256-/BxcglSN6NqZdEbq50MypFW4bv2bCN37L0PqcuYz+e4=";
     };
     aarch64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-3ylG6ZW/9AuKydzzyMLtqC1ec2NnixFG/CJih26S0K0=";
+      hash = "sha256-QWQevvVezRdubRbG3V64C/XMHunfDsdA1OM8yhHoCHA=";
     };
     aarch64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-e4VhL/9rUNgE2XyW8REz8QXEbzwsUFg41xNpUHfNLK0=";
+      hash = "sha256-j+/brIYCKjIOa0KSGZHt4Ic4tjTzOrfPtA4J8iY9tHE=";
     };
     x86_64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-SECE7bAd0VneVeAvBs14Ortkcqg8CJy9xcq3ZnuqfKY=";
+      hash = "sha256-0Cp76whEYtBdZS6GOnC+qqICGoqexX+v3KCFJmfaFAU=";
     };
   };
 in

pkgs/by-name/ao/aocl-utils/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "aocl-utils";
-  version = "5.3.0";
+  version = "5.3";
 
   src = fetchFromGitHub {
     owner = "amd";

pkgs/by-name/ap/apidog/package.nix

@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.32";
+  version = "2.8.33";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-7MaDC9VsiC+iHe83Vd4vDJQPoDLwUFmCu3R1OwVcTjM=";
+    hash = "sha256-RimlzPkIAFmsTgtSBocZy4g2S3eCvGq/r993u0Gjj/4=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/aq/aquamarine/package.nix

@@ -23,13 +23,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TtAhxedbRAl1u6OyT+4eRxZ417G2NMJNoqEbIhjvWo0=";
+    hash = "sha256-cUQENbJn0PHQUttXame5+PbGGew+BckHZFTfpb8XGI8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ar/arpa2cm/package.nix

@@ -3,21 +3,27 @@
   stdenv,
   fetchFromGitLab,
   cmake,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "arpa2cm";
-  version = "1.0.4";
+  version = "1.0.7";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitLab {
     owner = "arpa2";
     repo = "arpa2cm";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-2vb/7UL+uWGrQNh8yOZ3gih5G1/eOp064hF78SDsPGk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JkMZUXqmrVzURVi8BJRsHprD4Jz6l83qhPxnOfq4KE4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "CMake Module library for the ARPA2 project";
     longDescription = ''
@@ -33,8 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://gitlab.com/arpa2/arpa2cm";
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [
-      fufexan
-    ];
+    maintainers = with lib.maintainers; [ fufexan ];
+    teams = [ lib.teams.ngi ];
   };
 })

pkgs/by-name/as/asymptote/package.nix

@@ -30,10 +30,12 @@
   curl,
   texinfo,
   texliveSmall,
+  vulkan-headers,
+  glfw,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.11";
+  version = "3.12";
   pname = "asymptote";
 
   outputs = [
@@ -46,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
-    hash = "sha256-U36fImIb+E8J7g1E3EVcTqkboZODDx12JKB9RxDX59E=";
+    hash = "sha256-6uwel0Y+8hOjk8OI1GanNHiwgY+UA8liuRJAZZybjxs=";
   };
 
   # override with TeX Live containers to avoid building sty, docs from source
@@ -111,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
         pyqt5
       ]
     ))
+    vulkan-headers
+    glfw
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ libtirpc ];
 

pkgs/by-name/at/atlas/package.nix

@@ -9,19 +9,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlas";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hTRD3QndYlW564UJMhjj7EP+Otlgkt59nGkd5aXbOSU=";
+    hash = "sha256-2wmmvNezi/AJ86r5m0rZOskqxfaT49870Pe615QycHg=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-bPw1Gq+g69W09nU8vbNXwLcLxG4jcQOx9il7X2xZZSg=";
+  vendorHash = "sha256-9yg8VkRtyaMQjCAAOHIG4A9QSV1VOFOLBK9cTrE83a4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/at/attyx/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "attyx";
-  version = "0.4.3";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "semos-labs";
     repo = "attyx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DJe1HreijOwFaqDY+Ai1utiK4u66pUbBkEY6TOat27A=";
+    hash = "sha256-9/Zl6IrgrT8vHYllCKb977Ar5QRYQiXDmK/g+4YWcqM=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };

pkgs/by-name/au/autoprefixer/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
@@ -11,26 +11,26 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "autoprefixer";
-  version = "10.4.24";
+  version = "10.5.0";
 
   src = fetchFromGitHub {
     owner = "postcss";
     repo = "autoprefixer";
-    rev = finalAttrs.version;
-    hash = "sha256-9XZWkBDqkaBbIHq3wIbo4neToPM+NCxi9c1AyVqmnvc=";
+    tag = finalAttrs.version;
+    hash = "sha256-s152v9sIuQLvhfPsZvQa+O9UhoASgm/e8dnz0t4pP3A=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
   ];
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-PPYyEsc0o5ufBexUdiX9EJLEsQZ0wX7saBzxJGsnseU=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-Sxt4vtdlMdXxXqt22hfZJskj8mkB5t85IZ5BsbCoDF4=";
   };
 
   installPhase = ''
@@ -60,9 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website";
     homepage = "https://github.com/postcss/autoprefixer";
-    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     mainProgram = "autoprefixer";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.skohtv ];
   };
 })

pkgs/by-name/ay/ayatana-indicator-datetime/package.nix

@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "${if enableLomiriFeatures then "lomiri" else "ayatana"}-indicator-datetime";
-  version = "25.4.0";
+  version = "26.6.0";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-datetime";
     tag = finalAttrs.version;
-    hash = "sha256-8E9ucy8I0w9DDzsLtzJgICz/e0TNqOHgls9LrgA5nk4=";
+    hash = "sha256-zjAQjd5kFho8YfcoWRGbQbzzAJT0id5nh7zQoZXB1Uk=";
   };
 
   postPatch = ''
@@ -131,6 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "ENABLE_LOMIRI_FEATURES" enableLomiriFeatures)
+    (lib.cmakeBool "ENABLE_MKCAL" enableLomiriFeatures)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
   ]
   ++ lib.optionals enableLomiriFeatures [

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -174,9 +174,9 @@
 
   confcom = mkAzExtension rec {
     pname = "confcom";
-    version = "2.0.1";
+    version = "2.1.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-Nol3gbwgq76ijbmRyfV64kcArqeCk4/riBr4FxAeNtk=";
+    hash = "sha256-mcUYTxpjounvP2500nFgXF+WKERJdLuYXb6zt31v4NA=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl ];

pkgs/by-name/ba/bashunit/package.nix

@@ -17,13 +17,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.36.0";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-alhqJ7coRk5O4dYGx8m6u8/j7KMfr2m9Jeb5pn0wwiU=";
+    hash = "sha256-yMzi2SFEMSNNFztapWavMmbueWwVK0GWjyFR3cJZmTg=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -30,18 +30,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.38.3";
+  version = "1.38.5";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DR/aGCfqXUOubVEVmeJYOiF71rMYRYq8k23EXqluh5k=";
+    hash = "sha256-EXd+BOTAFUddK/4Vwi7GqRqndi2x4bb5gs7IIkMX6HU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-aiLSgpK3wadrBvclrQrdCzCiSjLcxg58oeP6ijL+JbY=";
+    hash = "sha256-6uwvwOVPYtegXTPwz2SEeQPC6OrKoFWZrH4Nx+ZVa5A=";
   };
 
   postPatch = ''

pkgs/by-name/be/betula/package.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "betula";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromSourcehut {
     owner = "~bouncepaw";
     repo = "betula";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8iDWWAL8JDZyKl3o0IJsWml410jh3cTPC2AoonvqiTI=";
+    hash = "sha256-cZ7xMtJ6I1lvWllwdNSFzeUsvGXWJnUtUR4iPn3oosc=";
   };
   vendorHash = "sha256-HGjaS2Sqsjk/pilt8wtx5Ect8Y8S5638PWEpXCqeZ6w=";
 

pkgs/by-name/bo/bombsquad/package.nix

@@ -25,7 +25,7 @@ let
     {
       x86_64-linux = {
         name = "BombSquad_Linux_x86_64";
-        hash = "sha256-Su7xEVzgFBl+Q2iFWdIRbyO8lRs8Xd4KabFhycZUVjs=";
+        hash = "sha256-zKZpRsyBCTYDJbTwjaP/HFXfYvD9zBhetUGzriB9754=";
       };
       aarch64-linux = {
         name = "BombSquad_Linux_Arm64";
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Note: This version trails behind the latest version by one since the latest
   # version sometimes gets replaced for minor updates. The builds in /old/ are
   # stable.
-  version = "1.7.62";
+  version = "1.7.63";
 
   src = fetchurl {
     url = "https://files.ballistica.net/bombsquad/builds/old/${archive.name}_${finalAttrs.version}.tar.gz";

pkgs/by-name/bo/boost-build/package.nix

@@ -78,6 +78,6 @@ stdenv.mkDerivation {
     homepage = "https://www.boost.org/build/";
     license = lib.licenses.boost;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ivan-tkatchev ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/bu/buildbox/package.nix

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.4.7";
+  version = "1.4.8";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-+OK9rmAGGLq/rJIHs++dbdyvh6WFu+Xhcp48TpnYV0w=";
+    hash = "sha256-P7CFgK5CkHAf5gddmm0SBGIkC/AAdCO5pkya/XNuby0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bu/buildkite-agent/package.nix

@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.127.1";
+  version = "3.127.2";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nG7pvoQfVQrrF+s8Ghc4OITXtW1D0dPAuU3Ef7yDr7E=";
+    hash = "sha256-dSG/F/KtV4nBpm2EeXjGI/2uM2/CgRkjYq5uq7+vZVw=";
   };
 
-  vendorHash = "sha256-Ow2nQAf0G4vsY167S0SbXhPnB6y1qRSf0+EFNPrC2CE=";
+  vendorHash = "sha256-N4m7Dak0EBkbJtOjatv0GQKsdxt0B/fZn08T9HpAXDA=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash

pkgs/by-name/ca/camunda-modeler/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.46.1";
+  version = "5.48.0";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-uB+EAZgpll81RifNjKp9AkPLupbDLYHG+zFj0atsXRA=";
+    hash = "sha256-92KWs2mLcKMhM/v3GRkX5CFcRrtPA1viczZVFkAdVLQ=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 

pkgs/by-name/ca/cargo-rdme/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-rdme";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-TmV6Fc5vlc4fm9w4+iuxmnonwsEbqoJ3jvpIyQOuxjg=";
+    hash = "sha256-d3WughXxh9cBzy33s3iB75paldZFokGGI1L9yTLGYoc=";
   };
 
-  cargoHash = "sha256-EjIvKf1XgHubvyWPOAjysNH4nD0xqOWYg1FeiPSYh4c=";
+  cargoHash = "sha256-26Poh5lUCYi+a+/E7pOYwilKX+eqRmbRNYRFdVfRSCw=";
 
   meta = {
     description = "Cargo command to create the README.md from your crate's documentation";

pkgs/by-name/ch/checkov/package.nix

@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.2.533";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-WuHmMqtDcivwsZpvZB5wQuKWm5BoDSX4LGJEW7oKJrA=";
+    hash = "sha256-1hm3ZNvrO+U3PWb5gBSwKSXgOHQLU4avncSZOH/ijCM=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.172",
-  "commit": "1b719ca2781a2dccc4a769b66bc35b4a60509ad7",
-  "buildDate": "2026-06-10T16:38:17Z",
+  "version": "2.1.175",
+  "commit": "0b9163019454512fd2b2ed8e6bef5470f9259f35",
+  "buildDate": "2026-06-12T01:33:39Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "3c31f345575bf6f261c7e19981f6491bb93eeb0ffb499e95033610a7184831ce",
-      "size": 223390752
+      "checksum": "6b75bf132c866ed409bf913c318ca32011e73ffb12d3cd67ecc37bc4ee9ec65d",
+      "size": 224216352
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "c507f98750c5230e4247f7eadff38e4db04c006904f85379e31c5d5e82e1c384",
-      "size": 225892528
+      "checksum": "3770f2cb42d3f776e62a59aa16230843dc7b8422b36be9b1532e02a6e92e7fa8",
+      "size": 226734640
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "4ef0d735bd4180c3bffc381f6dc38df979229a8637d294be751c6043d93d12e1",
-      "size": 248624776
+      "checksum": "360f1f6f43ec26d9bb6e20e487bf44b753d9b8407e89e74bfeeb79707399f435",
+      "size": 249476744
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "c0915dd1691d569aeebc7978b12e029718323685ec0dd4b5c6a453108d6be1f7",
-      "size": 248743632
+      "checksum": "4fc72fa6090c9a03f1850e1b1ccb3d6806bf802b67e3cb9dc5f2ced4b7ed5ca1",
+      "size": 249566928
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "6b10aad4270348175206bd2475f82ef3c56007dfb55d7b90f1950dfa8fb9eb40",
-      "size": 241479512
+      "checksum": "27234d99851b2e343184466924d8f5c9318d1cfc4156fc4198c99e26c8a8ab86",
+      "size": 242331480
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "58f2c60711f95e51d86d1af5b915cbdd0458710f1830b7c26d59b78f1ad1f861",
-      "size": 243153968
+      "checksum": "f40f977d2555f349e4d94f6efdc7deece3596c2cffa9d1a6a66b14ee30cfca54",
+      "size": 243977264
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "07132ca4bbef551c92c1ae6ca0220a5e523092c9fa9cf402f65f428450687455",
-      "size": 244181152
+      "checksum": "c1b5b0ae1b607c1f8623d222c9eb6005a35dd6873aa834910a6fb3e00450e096",
+      "size": 244979872
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "1e3e165c03de2af83c1e3516b73890b56e9785a2382338adcc28f41918bf4d2f",
-      "size": 240146080
+      "checksum": "f01eea49c920e990a7c3d2c1071abbc7e79ab54a099380982c11a6f462ca7c4a",
+      "size": 240943776
     }
   }
 }

pkgs/by-name/cl/claude-code/package.nix

@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
     homepage = "https://github.com/anthropics/claude-code";
     downloadPage = "https://claude.com/product/claude-code";
-    changelog = "https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md";
+    changelog = "https://github.com/anthropics/claude-code/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [