Merge 0f1ed4ec26 into haskell-updates

2026-04-14 00:38:04 +00:00
parent 69e42a4456 0f1ed4ec26
commit 0aec2f8134
365 changed files with 4492 additions and 1952 deletions
@@ -1,6 +1,6 @@
 {
  "name": "nixpkgs",
-  "image": "mcr.microsoft.com/devcontainers/universal:2-linux",
+  "image": "mcr.microsoft.com/devcontainers/universal:5-linux",
  "features": {
    "ghcr.io/devcontainers/features/nix:1": {
      // fails in the devcontainer sandbox, enable sandbox via config instead
@@ -270,8 +270,14 @@
  - any:
      - changed-files:
          - any-glob-to-any-file:
+              - doc/packages/linux.section.md
+              - lib/kernel.nix
+              - nixos/doc/manual/configuration/linux-kernel.chapter.md
+              - nixos/modules/system/boot/kernel.nix
+              - nixos/tests/kernel-generic/**/*
              - pkgs/build-support/kernel/**/*
              - pkgs/os-specific/linux/kernel/**/*
+              - pkgs/top-level/linux-kernels.nix

 "6.topic: lib":
  - any:
@@ -312,6 +312,12 @@ jobs:
          script: |
            const { readFile } = require('node:fs/promises')
            const changed = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8'))
+            const removedByKernel = Object.fromEntries(
+              Object.entries(changed.attrdiffByKernel ?? {}).map(([kernel, diff]) => [
+                kernel,
+                diff.removed.length,
+              ]),
+            )
            const description =
              'Package: ' + [
                `added ${changed.attrdiff.added.length}`,
@@ -321,7 +327,15 @@ jobs:
              ' — Rebuild: ' + [
                `linux ${changed.rebuildCountByKernel.linux}`,
                `darwin ${changed.rebuildCountByKernel.darwin}`
-              ].join(', ')
+              ].join(', ') +
+              (
+                Object.values(removedByKernel).some((count) => count > 0)
+                  ? ' — Removed: ' + [
+                      `linux ${removedByKernel.linux ?? 0}`,
+                      `darwin ${removedByKernel.darwin ?? 0}`
+                    ].join(', ')
+                  : ''
+              )

            const { serverUrl, repo, runId, payload } = context
            const target_url =
@@ -303,8 +303,14 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/by-name/es/esphome @mweinelt

 # Linux kernel
-/pkgs/top-level/linux-kernels.nix @NixOS/linux-kernel
+/doc/packages/linux.section.md @NixOS/linux-kernel
+/lib/kernel.nix @NixOS/linux-kernel
+/nixos/doc/manual/configuration/linux-kernel.chapter.md @NixOS/linux-kernel
+/nixos/modules/system/boot/kernel.nix @NixOS/linux-kernel
+/nixos/tests/kernel-generic/ @NixOS/linux-kernel
+/pkgs/build-support/kernel/ @NixOS/linux-kernel
 /pkgs/os-specific/linux/kernel/ @NixOS/linux-kernel
+/pkgs/top-level/linux-kernels.nix @NixOS/linux-kernel

 # Network Time Daemons
 /pkgs/by-name/ch/chrony @thoughtpolice
@@ -74,9 +74,38 @@ let
        {
          attrdiff: {
            added: ["package1"],
-            changed: ["package2", "package3"],
+            changed: ["package2", "package3", "package4"],
            removed: ["package4"],
          },
+          attrdiffByKernel: {
+            darwin: {
+              added: [],
+              changed: ["package2", "package4"],
+              removed: ["package4"],
+            },
+            linux: {
+              added: ["package1"],
+              changed: ["package3", "package4"],
+              removed: [],
+            },
+          },
+          attrdiffByPlatform: {
+            aarch64-darwin: {
+              added: [],
+              changed: ["package2"],
+              removed: ["package4"],
+            },
+            aarch64-linux: {
+              added: ["package1"],
+              changed: ["package3"],
+              removed: [],
+            },
+            x86_64-linux: {
+              added: [],
+              changed: ["package4"],
+              removed: [],
+            },
+          },
          labels: {
            "10.rebuild-darwin: 1-10": true,
            "10.rebuild-linux: 1-10": true
@@ -113,6 +142,8 @@ let
  inherit (import ./utils.nix { inherit lib; })
    groupByKernel
    convertToPackagePlatformAttrs
+    groupAttrdiffByKernel
+    groupAttrdiffByPlatform
    groupByPlatform
    extractPackageNames
    getLabels
@@ -127,6 +158,15 @@ let

  changed-paths =
    let
+      attrdiff = lib.mapAttrs (_: extractPackageNames) {
+        inherit (diffAttrs) added changed removed;
+      };
+      attrdiffByPlatform = groupAttrdiffByPlatform {
+        inherit (diffAttrs) added changed removed;
+      };
+      attrdiffByKernel = groupAttrdiffByKernel {
+        inherit (diffAttrs) added changed removed;
+      };
      rebuildsByPlatform = groupByPlatform rebuildsPackagePlatformAttrs;
      rebuildsByKernel = groupByKernel rebuildsPackagePlatformAttrs;
      rebuildCountByKernel = lib.mapAttrs (
@@ -135,7 +175,7 @@ let
    in
    writeText "changed-paths.json" (
      builtins.toJSON {
-        attrdiff = lib.mapAttrs (_: extractPackageNames) { inherit (diffAttrs) added changed removed; };
+        inherit attrdiff attrdiffByKernel attrdiffByPlatform;
        inherit
          rebuildsByPlatform
          rebuildsByKernel
@@ -7,6 +7,7 @@
 }:
 let
  fun = import ./maintainers.nix { inherit lib; };
+  utils = import ./utils.nix { inherit lib; };

  mockPkgs =
    {
@@ -226,6 +227,83 @@ let
        ];
      };
    };
+    testGroupAttrdiffByPlatform = {
+      expr = utils.groupAttrdiffByPlatform {
+        added = [
+          "new-tool.aarch64-linux"
+          "new-tool.x86_64-darwin"
+        ];
+        changed = [
+          "updated-tool.x86_64-darwin"
+          "shared-tool.x86_64-darwin"
+        ];
+        removed = [
+          "removed-tool.aarch64-darwin"
+          "shared-tool.aarch64-darwin"
+        ];
+      };
+      expected = {
+        aarch64-darwin = {
+          added = [ ];
+          changed = [ ];
+          removed = [
+            "removed-tool"
+            "shared-tool"
+          ];
+        };
+        aarch64-linux = {
+          added = [ "new-tool" ];
+          changed = [ ];
+          removed = [ ];
+        };
+        x86_64-darwin = {
+          added = [ "new-tool" ];
+          changed = [
+            "shared-tool"
+            "updated-tool"
+          ];
+          removed = [ ];
+        };
+      };
+    };
+    testGroupAttrdiffByKernel = {
+      expr =
+        let
+          grouped = utils.groupAttrdiffByKernel {
+            added = [
+              "new-tool.aarch64-linux"
+              "new-tool.x86_64-darwin"
+            ];
+            changed = [
+              "updated-tool.x86_64-darwin"
+              "shared-tool.x86_64-darwin"
+            ];
+            removed = [
+              "removed-tool.aarch64-darwin"
+              "shared-tool.aarch64-darwin"
+            ];
+          };
+        in
+        lib.mapAttrs (_: diff: lib.mapAttrs (_: lib.sort lib.lessThan) diff) grouped;
+      expected = {
+        darwin = {
+          added = [ "new-tool" ];
+          changed = [
+            "shared-tool"
+            "updated-tool"
+          ];
+          removed = [
+            "removed-tool"
+            "shared-tool"
+          ];
+        };
+        linux = {
+          added = [ "new-tool" ];
+          changed = [ ];
+          removed = [ ];
+        };
+      };
+    };
  };
 in
 {
@@ -150,6 +150,50 @@ rec {
    in
    lib.genAttrs [ "linux" "darwin" ] filterKernel;

+  /*
+    Group an attrdiff-style mapping by a derived key such as platform or kernel.
+
+    Turns
+      {
+        added = [ "new-tool.aarch64-linux" "new-tool.x86_64-darwin" ];
+        changed = [ "updated-tool.x86_64-darwin" "shared-tool.x86_64-darwin" ];
+        removed = [ "removed-tool.aarch64-darwin" "shared-tool.aarch64-darwin" ];
+      }
+    into
+      {
+        aarch64-darwin = {
+          added = [ ];
+          changed = [ ];
+          removed = [ "removed-tool" "shared-tool" ];
+        };
+        aarch64-linux = {
+          added = [ "new-tool" ];
+          changed = [ ];
+          removed = [ ];
+        };
+        x86_64-darwin = {
+          added = [ "new-tool" ];
+          changed = [ "shared-tool" "updated-tool" ];
+          removed = [ ];
+        };
+      }
+    when used with `groupByPlatform`.
+  */
+  groupAttrdiffBy =
+    grouper: attrdiff:
+    let
+      groupedByKind = lib.mapAttrs (
+        _: packagePlatformPaths:
+        grouper (convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths))
+      ) attrdiff;
+      groups = uniqueStrings (lib.flatten (map builtins.attrNames (lib.attrValues groupedByKind)));
+    in
+    lib.genAttrs groups (group: lib.mapAttrs (_: byGroup: byGroup.${group} or [ ]) groupedByKind);
+
+  groupAttrdiffByPlatform = groupAttrdiffBy groupByPlatform;
+
+  groupAttrdiffByKernel = groupAttrdiffBy groupByKernel;
+
  /*
    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels

@@ -25,6 +25,16 @@ async function checkTargetBranch({ github, context, core, dry }) {
   *   changed: string[],
   *   removed: string[],
   *  },
+   *  attrdiffByKernel: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  attrdiffByPlatform: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
   *  labels: Record<string, boolean>,
   *  rebuildCountByKernel: Record<string, number>,
   *  rebuildsByKernel: Record<string, string[]>,
@@ -138,6 +138,13 @@
    github = "0xd61";
    githubId = 8351869;
  };
+  _0xErwin1 = {
+    email = "ignacio@feuer.me";
+    name = "Ignacio Perez";
+    github = "0xErwin1";
+    githubId = 67933444;
+    keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
+  };
  _0xMillyByte = {
    email = "emilia.daelman@gmail.com";
    name = "Emilia Daelman";
@@ -342,6 +342,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.

+- `services.openssh.enableRecommendedAlgorithms` has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
+
 - IPVLAN interfaces can now be configured through the `networking.ipvlans` option in the networking module.

 - `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.
@@ -45,13 +45,13 @@ in
      owner = mkOption {
        type = str;
        default = "root";
-        example = "nobody";
+        example = "alice";
        description = "Owner ${set}";
      };
      group = mkOption {
        type = str;
        default = defaultGroup;
-        example = "nobody";
+        example = "users";
        description = "Group ${set}";
      };
      mode = mkOption {
@@ -257,6 +257,7 @@
  ./programs/lazygit.nix
  ./programs/less.nix
  ./programs/liboping.nix
+  ./programs/librepods.nix
  ./programs/lix.nix
  ./programs/localsend.nix
  ./programs/mdevctl.nix
@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.librepods;
+in
+{
+  options = {
+    programs.librepods = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to configure system to enable librepods.
+          To grant access to a user, it must be part of librepods group:
+          `users.users.alice.extraGroups = ["librepods"];`
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ librepods ];
+    users.groups.librepods = { };
+
+    security.wrappers.librepods = {
+      source = lib.getExe pkgs.librepods;
+      capabilities = "cap_net_admin+ep";
+      owner = "root";
+      group = "librepods";
+      permissions = "u+rx,g+x";
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    thefossguy
+    Cameo007
+  ];
+}
@@ -148,8 +148,8 @@ let

  doveConf =
    let
-      configVersion = cfg.settings.dovecot_config_version or null;
-      storageVersion = cfg.settings.dovecot_storage_version or null;
+      configVersion = cfg.settings.dovecot_config_version;
+      storageVersion = cfg.settings.dovecot_storage_version;
      remainingSettings = builtins.removeAttrs cfg.settings [
        "dovecot_config_version"
        "dovecot_storage_version"
@@ -163,6 +163,11 @@ let
    );

  isPre24 = versionOlder cfg.package.version "2.4";
+
+  # HACK: We can not auto-add the default for sieve_script_bin_path unless we have the pigeonhole plugin loaded. Solve this in a better way in the future
+  hasPigeonhole = builtins.any (
+    pkg: pkg.pname or null == "dovecot-pigeonhole"
+  ) config.environment.systemPackages;
 in
 {
  imports = [
@@ -578,10 +583,30 @@ in

              # 2.4-only options

+              dovecot_config_version = mkOption {
+                default = null;
+                description = ''
+                  Dovecot configuration version. It uses the same versioning as Dovecot in general, e.g. 3.0.5. It specifies the configuration syntax, the used setting names and the expected default values.
+
+                  See <https://doc.dovecot.org/latest/core/summaries/settings.html#dovecot_config_version>.
+                '';
+                type = nullOr str;
+              };
+
+              dovecot_storage_version = mkOption {
+                default = null;
+                description = ''
+                  Dovecot storage file format version. It uses the same versioning as Dovecot in general, e.g. 3.0.5. It specifies the oldest Dovecot version that must be able to read files written by this Dovecot instance.
+
+                  See <https://doc.dovecot.org/latest/core/summaries/settings.html#dovecot_storage_version>.
+                '';
+                type = nullOr str;
+              };
+
              sieve_script_bin_path = mkOption {
-                default = if isPre24 then null else "/tmp/dovecot-%{user|username|lower}";
+                default = if isPre24 || !hasPigeonhole then null else "/tmp/dovecot-%{user|username|lower}";
                defaultText = literalExpression ''
-                  if isPre24
+                  if isPre24 || !hasPigeonhole
                  then null
                  else "/tmp/dovecot-%{user|username|lower}"
                '';
@@ -27,10 +27,10 @@ in
    };
    group = mkOption {
      type = types.str;
-      default = "frrtty";
+      default = "frrvty";
      description = ''
        Group under which the frr exporter shall be run.
-        The exporter talks to frr using a unix socket, which is owned by frrtty group.
+        The exporter talks to frr using a unix socket, which is owned by frrvty group.
      '';
    };
    enabledCollectors = mkOption {
@@ -111,7 +111,8 @@ in
      type = lib.types.lines;
      default = "";
      example = lib.literalExpression ''
-        sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf
+        # replace users/groups that don't exist in the test
+        sed 's/skgid meadow/skgid root/g' -i ruleset.conf
      '';
      description = ''
        This script gets run before the ruleset is checked. It can be used to
@@ -34,8 +34,8 @@ in
        auth = "plain[passwd=./sample.passwd]"
        tcp-port = 443
        udp-port = 443
-        run-as-user = nobody
-        run-as-group = nogroup
+        run-as-user = ocserv
+        run-as-group = ocserv
        socket-file = /run/ocserv-socket
        server-cert = certs/server-cert.pem
        server-key = certs/server-key.pem
@@ -412,6 +412,16 @@ in
        '';
      };

+      enableRecommendedAlgorithms = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Use algorithms curated and recommended by NixOS.
+
+          Set to false to use upstream's default algorithms.
+        '';
+      };
+
      authorizedKeysFiles = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
@@ -571,37 +581,64 @@ in
              };
              KexAlgorithms = lib.mkOption {
                type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "mlkem768x25519-sha256"
-                  "sntrup761x25519-sha512"
-                  "sntrup761x25519-sha512@openssh.com"
-                  "curve25519-sha256"
-                  "curve25519-sha256@libssh.org"
-                  "diffie-hellman-group-exchange-sha256"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                '';
                description = ''
                  Allowed key exchange algorithms

-                  Uses the lower bound recommended in both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                '';
              };
              Macs = lib.mkOption {
                type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "hmac-sha2-512-etm@openssh.com"
-                  "hmac-sha2-256-etm@openssh.com"
-                  "umac-128-etm@openssh.com"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                '';
                description = ''
                  Allowed MACs

-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                '';
              };
              StrictModes = lib.mkOption {
@@ -613,21 +650,36 @@ in
              };
              Ciphers = lib.mkOption {
                type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "chacha20-poly1305@openssh.com"
-                  "aes256-gcm@openssh.com"
-                  "aes128-gcm@openssh.com"
-                  "aes256-ctr"
-                  "aes192-ctr"
-                  "aes128-ctr"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                '';
                description = ''
                  Allowed ciphers

-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                '';
              };
              AllowUsers = lib.mkOption {
@@ -16,7 +16,7 @@ let
  settingsFormat = pkgs.formats.json { };
  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;

-  isUnixGui = (builtins.substring 0 1 cfg.guiAddress) == "/";
+  isUnixGui = lib.strings.hasPrefix "unix://" cfg.guiAddress;

  # Syncthing supports serving the GUI over Unix sockets. If that happens, the
  # API is served over the Unix socket as well.  This function returns the correct
@@ -30,7 +30,7 @@ let
    # note that the dot in front of `${path}` is the hostname, which is
    # required.
    then
-      "--unix-socket ${cfg.guiAddress} http://.${path}"
+      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://.${path}"
    # no adjustments are needed if cfg.guiAddress is a network address
    else
      "${cfg.guiAddress}${path}";
@@ -290,7 +290,7 @@ let
              )"
              for id in ''${stale_${conf_type}_ids}; do
                >&2 echo "Deleting stale device: $id"
-                curl -X DELETE "${s.baseAddress}/$id"
+                curl -X DELETE ${s.baseAddress}/$id
              done
            ''
          ))
@@ -774,6 +774,7 @@ in
      guiAddress = mkOption {
        type = types.str;
        default = "127.0.0.1:8384";
+        apply = x: if lib.strings.hasPrefix "/" x then "unix://${x}" else x;
        description = ''
          The address to serve the web interface at.
        '';
@@ -1000,7 +1001,7 @@ in
              args = lib.escapeShellArgs (
                (lib.cli.toCommandLineGNU { } {
                  "no-browser" = true;
-                  "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
+                  "gui-address" = cfg.guiAddress;
                  "config" = cfg.configDir;
                  "data" = cfg.databaseDir;
                })
@@ -1008,6 +1009,7 @@ in
              );
            in
            "${lib.getExe cfg.package} ${args}";
+          RuntimeDirectory = "syncthing";
          MemoryDenyWriteExecute = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
@@ -350,7 +350,7 @@ in
          after = [ "peering-manager.service" ];
          serviceConfig = {
            Type = "oneshot";
-            ExecStart = "${pkg}/bin/peering-manager grab_prefixes";
+            ExecStart = "${pkg}/bin/peering-manager get_irr_data";
          };
        };

@@ -24,10 +24,8 @@ in
        # IP address or "*"
        Host: *
        Debug_Mode: Yes # Yes or No
-        # If available, "nobody" is much more secure for User:.
-        User: root
-        # If available, "nobody" is much more secure for Group:.
-        Group: root
+        User: mighttpd2
+        Group: mighttpd2
        Pid_File: /run/mighty.pid
        Logging: Yes # Yes or No
        Log_File: /var/log/mighty # The directory must be writable by User:
@@ -265,10 +265,12 @@ in
    };

    root = lib.mkOption {
-      type = lib.types.enum [
-        "fstab"
-        "gpt-auto"
-      ];
+      type = lib.types.nullOr (
+        lib.types.enum [
+          "fstab"
+          "gpt-auto"
+        ]
+      );
      default = "fstab";
      example = "gpt-auto";
      description = ''
@@ -277,6 +279,7 @@ in
        allow specifying the root file system itself this
        way. Instead, the `fstab` value is used in order to interpret
        the root file system specified with the `fileSystems` option.
+        If root shall be omitted, set this option to `null`.
      '';
    };

@@ -489,13 +492,13 @@ in
    ]
    ++ lib.optional cfg.package.withEfi "efivarfs";

-    boot.kernelParams = [
-      "root=${config.boot.initrd.systemd.root}"
-    ]
-    ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
-    # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
-    # For NixOS activation to succeed, we need to have root writable in initrd.
-    ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
+    boot.kernelParams =
+      lib.optional (config.boot.initrd.systemd.root != null) "root=${config.boot.initrd.systemd.root}"
+
+      ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
+      # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
+      # For NixOS activation to succeed, we need to have root writable in initrd.
+      ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";

    boot.initrd.systemd = {
      initrdBin = [
@@ -197,7 +197,7 @@ let
            Override the username or UID (and optionally groupname or GID) used
            in the container.
          '';
-          example = "nobody:nogroup";
+          example = "alice:users";
        };

        volumes = mkOption {
@@ -35,7 +35,7 @@ in

  nodes = {
    gitlab =
-      { ... }:
+      { config, ... }:
      {
        imports = [ ../common/user-account.nix ];

@@ -75,7 +75,14 @@ in

        services.dovecot2 = {
          enable = true;
-          enableImap = true;
+          enablePAM = true;
+          settings = {
+            dovecot_config_version = "2.4.3";
+            dovecot_storage_version = config.services.dovecot2.package.version;
+            protocols.imap = true;
+            mail_driver = "maildir";
+            mail_path = "~/mail";
+          };
        };

        systemd.services.gitlab-backup.environment.BACKUP = "dump";
@@ -90,9 +90,11 @@ in
        ];
      };

-    server-lazy-socket = {
+    # IP addresses are allocated according to the alphabetical order of the machine name, and since tests rely on the IP address of this machine, let's name it so it's order (and thus address) is predictable.
+    aaa-server-lazy-socket = {
      virtualisation.vlans = [
        1
+        # Allocate another VLAN so we can exercise listening on a non-standard address.
        2
      ];
      services.openssh = {
@@ -191,12 +193,32 @@ in
              path = "/etc/ssh/ssh_host_ed25519_key";
            }
          ];
+          # The NixOS-curated algorithms require OpenSSL, and so since this test is against an OpenSSH-without-OpenSSL, we have to use the default algorithms, which adapt to not having OpenSSL.
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-default-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-null-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
          settings = {
-            # Since this test is against an OpenSSH-without-OpenSSL,
-            # we have to override NixOS's defaults ciphers (which require OpenSSL)
-            # and instead set these to null, which will mean OpenSSH uses its defaults.
-            # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
-            # without OpenSSL.
            Ciphers = null;
            KexAlgorithms = null;
            Macs = null;
@@ -292,17 +314,19 @@ in

    server.wait_for_unit("sshd", timeout=60)
    server_allowed_users.wait_for_unit("sshd", timeout=60)
+    server_default_algorithms.wait_for_unit("sshd", timeout=60)
    server_localhost_only.wait_for_unit("sshd", timeout=60)
    server_match_rule.wait_for_unit("sshd", timeout=60)
    server_no_openssl.wait_for_unit("sshd", timeout=60)
    server_no_pam.wait_for_unit("sshd", timeout=60)
+    server_null_algorithms.wait_for_unit("sshd", timeout=60)
    server_null_pam.wait_for_unit("sshd", timeout=60)
    server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
    server_sftp.wait_for_unit("sshd", timeout=60)

    server_lazy.wait_for_unit("sshd.socket", timeout=60)
    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=60)
-    server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
+    aaa_server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)

    # sshd-keygen is a oneshot unit, so just wait for multi-user.target, which
    # pulls it in.
@@ -340,14 +364,14 @@ in
            timeout=30
        )

-    with subtest("socket activation on a non-standard port"):
+    with subtest("socket activation on a non-standard address and port"):
        client.succeed(
            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
        )
        client.succeed("chmod 600 privkey.snakeoil")
        # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
        client.succeed(
-            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.1 true",
            timeout=30
        )

@@ -400,6 +424,26 @@ in
            timeout=30
        )

+    with subtest("null-algorithms"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-null-algorithms true",
+            timeout=30
+        )
+
+    with subtest("no-openssl"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-default-algorithms true",
+            timeout=30
+        )
+
    with subtest("no-pam"):
        client.succeed(
            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
@@ -20,7 +20,7 @@
    machine.wait_for_x()

    with subtest("Wait until Servo has finished loading the Valgrind docs page"):
-      machine.execute("xterm -e 'servo file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' >&2 &");
+      machine.execute("xterm -e '${lib.getExe pkgs.servo} file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' >&2 &");
      machine.wait_for_window("Valgrind")
      machine.wait_for_text("Quick Start Guide")
  '';
@@ -26,6 +26,7 @@ in
          openDefaultPorts = true;
          cert = "${idA}/cert.pem";
          key = "${idA}/key.pem";
+          guiAddress = "unix:///run/syncthing/syncthing.sock";
          settings = {
            devices.b.id = lib.fileContents "${idB}/id";
            devices.c.id = lib.fileContents "${idC}/id";
@@ -1,21 +1,15 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 let
+  evalConfig =
+    module:
+    (import ../lib/eval-config.nix {
+      system = null;
+      modules = [ module ];
+    }).config.system.build.toplevel;

-  container =
+  common =
    { config, ... }:
    {
-      # We re-use the NixOS container option ...
-      boot.isNspawnContainer = true;
-      # ... and revert unwanted defaults
-      networking.useHostResolvConf = false;
-
-      # use networkd to obtain systemd network setup
-      networking.useNetworkd = true;
-      networking.useDHCP = false;
-
-      # systemd-nspawn expects /sbin/init
-      boot.loader.initScript.enable = true;
-
      imports = [ ../modules/profiles/minimal.nix ];

      system.stateVersion = config.system.nixos.release;
@@ -23,11 +17,87 @@ let
      nixpkgs.pkgs = pkgs;
    };

-  containerSystem =
-    (import ../lib/eval-config.nix {
-      system = null;
-      modules = [ container ];
-    }).config.system.build.toplevel;
+  profile-host-nspawn = {
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+
+    networking.firewall.extraCommands = ''
+      # open DHCP for nspawn interfaces
+      ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
+    '';
+  };
+
+  # improvement: move following profile to ../modules/profiles/nspawn-guest.nix
+  profile-guest-nspawn = {
+    # We re-use the NixOS container option ...
+    boot.isNspawnContainer = true;
+    # ... and revert unwanted defaults
+    networking.useHostResolvConf = false;
+
+    # systemd-nspawn expects /sbin/init
+    boot.loader.initScript.enable = true;
+
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+  };
+
+  profile-host-vmspawn =
+    { config, pkgs, ... }:
+    {
+      # use networkd to obtain systemd network setup
+      networking.useNetworkd = true;
+
+      networking.firewall.extraCommands = ''
+        # open DHCP for vmspawn interfaces
+        ${pkgs.iptables}/bin/iptables -A nixos-fw -i vt-+ -p udp -m udp --dport 67 -j nixos-fw-accept
+      '';
+
+      environment.systemPackages =
+        let
+          # improvement: following wrapper should be moved to pkgs
+          vmspawn-wrapped =
+            pkgs.runCommand "systemd-vmspawn-wrapped" { nativeBuildInputs = [ pkgs.makeWrapper ]; }
+              ''
+                makeWrapper ${config.systemd.package}/bin/systemd-vmspawn $out/bin/systemd-vmspawn-wrapped \
+                  --prefix PATH : ${
+                    lib.makeBinPath [
+                      pkgs.qemu
+                      pkgs.virtiofsd
+                      pkgs.openssh # ssh-keygen
+                    ]
+                  } \
+                  --prefix XDG_CONFIG_HOME : ${pkgs.qemu}/share
+              '';
+        in
+        [ vmspawn-wrapped ];
+    };
+
+  # improvement: move following profile to ../modules/profiles/vmspawn-guest.nix
+  profile-guest-vmspawn = {
+    imports = [ ../modules/profiles/qemu-guest.nix ];
+    # improvement: move following configuration to qemu-guest.nix
+    boot.initrd.availableKernelModules = [
+      "virtiofs"
+    ];
+
+    boot.initrd.systemd.enable = true;
+    # root is defined by systemd-vmspawn
+    boot.initrd.systemd.root = null;
+
+    boot.loader.grub.enable = false;
+
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+  };
+
+  container = {
+    imports = [
+      common
+      profile-guest-nspawn
+    ];
+  };
+
+  containerSystem = evalConfig container;

  containerName = "container";
  containerRoot = "/var/lib/machines/${containerName}";
@@ -51,16 +121,42 @@ let
      }
    ];
  };
+
+  vm = {
+    imports = [
+      common
+      profile-guest-vmspawn
+    ];
+
+    services.openssh.enable = true;
+  };
+  vmSystem = evalConfig vm;
+
+  vmShared = {
+    imports = [ vm ];
+
+    fileSystems."/nix/store" = {
+      device = "mnt0";
+      fsType = "virtiofs";
+      neededForBoot = true;
+    };
+  };
+  vmSharedSystem = evalConfig vmShared;
 in
 {
  name = "systemd-machinectl";
+  meta.maintainers = with lib.maintainers; [ ck3d ];

  nodes.machine =
-    { lib, ... }:
    {
-      # use networkd to obtain systemd network setup
-      networking.useNetworkd = true;
-      networking.useDHCP = false;
+      lib,
+      ...
+    }:
+    {
+      imports = [
+        profile-host-nspawn
+        profile-host-vmspawn
+      ];

      # do not try to access cache.nixos.org
      nix.settings.substituters = lib.mkForce [ ];
@@ -71,8 +167,12 @@ in
      virtualisation.additionalPaths = [
        containerSystem
        containerTarball
+        vmSystem
+        vmSharedSystem
      ];

+      virtualisation.diskSize = 2048;
+
      systemd.tmpfiles.rules = [
        "d /var/lib/machines/shared-decl 0755 root root - -"
      ];
@@ -101,23 +201,37 @@ in
        ];
        overrideStrategy = "asDropin";
      };
-
-      # open DHCP for container
-      networking.firewall.extraCommands = ''
-        ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
-      '';
    };

  testScript = ''
    start_all()
    machine.wait_for_unit("default.target");
+    # Workaround for nixos-install
+    machine.succeed("chmod o+rx /var/lib/machines");
+
+    with subtest("vm-shared"):
+      machine.succeed("mkdir -p /var/lib/machines/vm-shared");
+      # Start vm-shared
+      machine.succeed("systemd-run systemd-vmspawn-wrapped --directory=/var/lib/machines/vm-shared --bind-ro=/nix/store --linux=${vmSharedSystem}/kernel --initrd=${vmSharedSystem}/initrd ${vmSharedSystem}/kernel-params init=${vmSharedSystem}/init")
+      machine.wait_until_succeeds("machinectl status vm-shared");
+      machine.wait_until_succeeds("eval $(machinectl show vm-shared --property=SSHPrivateKeyPath --property=SSHAddress) && ssh -i $SSHPrivateKeyPath $SSHAddress true")
+      machine.succeed("machinectl stop vm-shared");
+
+    with subtest("vm"):
+      machine.succeed("mkdir -p /var/lib/machines/vm");
+      # Install vm
+      machine.succeed("nixos-install --root /var/lib/machines/vm --system ${vmSystem} --no-channel-copy --no-root-passwd");
+      # Start vm
+      machine.succeed("systemd-run systemd-vmspawn-wrapped --directory=/var/lib/machines/vm --linux=${vmSystem}/kernel --initrd=${vmSystem}/initrd ${vmSystem}/kernel-params init=${vmSystem}/init")
+      machine.wait_until_succeeds("machinectl status vm");
+      machine.wait_until_succeeds("eval $(machinectl show vm --property=SSHPrivateKeyPath --property=SSHAddress) && ssh -i $SSHPrivateKeyPath $SSHAddress true")
+      machine.succeed("machinectl stop vm");

    # Test machinectl start stop of shared-decl
    machine.succeed("machinectl start shared-decl");
    machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
    machine.succeed("machinectl stop shared-decl");

-    # create containers root
    machine.succeed("mkdir -p ${containerRoot}");

    # start container with shared nix store by using same arguments as for systemd-nspawn@.service
@@ -128,8 +242,6 @@ in
    machine.succeed("machinectl stop ${containerName}");

    # Install container
-    # Workaround for nixos-install
-    machine.succeed("chmod o+rx /var/lib/machines");
    machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");

    # Allow systemd-nspawn to apply user namespace on immutable files
@@ -183,6 +295,7 @@ in

    # Test auto-start
    machine.succeed("machinectl show ${containerName}")
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");

    # Test machinectl stop
    machine.succeed("machinectl stop ${containerName}");
@@ -273,6 +273,11 @@ in
      # add a virtual wlan interface
      boot.kernelModules = [ "mac80211_hwsim" ];

+      users.users.alice = {
+        isNormalUser = true;
+        group = "users";
+      };
+
      # wireless client
      networking.wireless = {
        enable = lib.mkOverride 0 true;
@@ -283,7 +288,7 @@ in
    };

    testScript = ''
-      wpa_cli = "sudo -u nobody -g wpa_supplicant wpa_cli"
+      wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"

      with subtest("Daemon is running and accepting connections"):
          machine.wait_for_unit("wpa_supplicant-wlan1.service")
@@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = if withGui then "elements" else "elementsd";
-  version = "23.3.2";
+  version = "23.3.3";

  src = fetchFromGitHub {
    owner = "ElementsProject";
    repo = "elements";
    rev = "elements-${finalAttrs.version}";
-    sha256 = "sha256-NLLM+stYOXcnAjEfXRerjvgMXM8jFSOyZhu/A0ZTnRw=";
+    sha256 = "sha256-u0/IVOr6ivN7SrM44NPNqs0yPBDqElD79pKcn+384B4=";
  };

  nativeBuildInputs = [
@@ -26,9 +26,9 @@ let
    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.3.5/android-studio-panda3-rc1-linux.tar.gz";
  };
  latestVersion = {
-    version = "2025.3.4.3"; # "Android Studio Panda 4 | 2025.3.4 Canary 3"
-    sha256Hash = "sha256-8fqHdU6IPuRmcJeCZQOqUPgfild9k98sLnN77dl2Hs8=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.3/android-studio-panda4-canary3-linux.tar.gz";
+    version = "2025.3.4.4"; # "Android Studio Panda 4 | 2025.3.4 Canary 4"
+    sha256Hash = "sha256-sPGJuOm5T7EZV5hhOJsZc7P8CTXyv9A6k82hM1GZGpY=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.4/android-studio-panda4-canary4-linux.tar.gz";
  };
 in
 {
@@ -4093,8 +4093,8 @@ let
        mktplcRef = {
          name = "sas-lsp";
          publisher = "SAS";
-          version = "1.18.0";
-          hash = "sha256-OP0UUANqoQoxr+10/NkwveEULKWFrDn/dmEg0CHMZp0=";
+          version = "1.19.1";
+          hash = "sha256-aVtMiSbPLs6zIdcD0TopIAVKvJksSdTy9ND+jGw/G0A=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/SAS.sas-lsp/changelog";
@@ -4634,8 +4634,8 @@ let
        mktplcRef = {
          name = "ayu";
          publisher = "teabyii";
-          version = "1.1.11";
-          sha256 = "sha256-0gfevhXxrZC2rpWIaZM7aNfZrh/KIjoDWkZreeVU+EI=";
+          version = "1.1.12";
+          sha256 = "sha256-pwLvik3GRMLyr6GeTmZh1MrkgH1MgbyoembNmQxg4I0=";
        };
        meta = {
          description = "Simple theme with bright colors and comes in three versions — dark, light and mirage for all day long comfortable work";
@@ -5222,8 +5222,8 @@ let
        mktplcRef = {
          name = "csharp-ls";
          publisher = "vytautassurvila";
-          version = "0.0.30";
-          hash = "sha256-BVSazrQxVm4yYBVdtFP3Aojl06xI2msFXIGw64LeePY=";
+          version = "0.0.31";
+          hash = "sha256-d2vHhM+/hzT/JdFzu2WtJiWY2BHGk8SicleHxwm8ciY=";
        };
        meta = {
          changelog = "https://github.com/vytautassurvila/vscode-csharp-ls/blob/master/CHANGELOG.md";
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "latex-workshop";
    publisher = "James-Yu";
-    version = "10.13.1";
-    hash = "sha256-UyujvtuS0dok5xC4w1lGCwDxOSr58t1/YQ5Mpe6yNPM=";
+    version = "10.14.1";
+    hash = "sha256-lsbiKzZTlkq/9K7ptLg0kHAd4i5OyNh2pLGGYUOJS9A=";
  };
  meta = {
    changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "vsliveshare";
    publisher = "ms-vsliveshare";
-    version = "1.1.119";
-    hash = "sha256-s7GCJvlMCcZ+OOwdSh82moU7BlQLz1hVPMwZ9MYtahM=";
+    version = "1.1.122";
+    hash = "sha256-XD8iLG8HA9u5Y4CKQKLnmeAN4IFf1LGDvhTKuroxkHg=";
  };

  postPatch = ''
@@ -3,9 +3,9 @@
  lib,
  coreutils,
  gawk,
+  getconf,
  gnugrep,
  gnused,
-  glibc,
  jq,
  copyDesktopItems,
  makeDesktopItem,
@@ -354,18 +354,23 @@ stdenv.mkDerivation (
              "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libdbusmenu ]}"
          }
        --prefix PATH : ${
-          lib.makeBinPath [
-            # for moving files to trash
-            glib
+          lib.makeBinPath (
+            [
+              # for moving files to trash
+              glib

-            # for launcher and bundled helper scripts
-            gawk
-            glibc.bin
-            gnugrep
-            gnused
-            coreutils
-            which
-          ]
+              # for launcher and bundled helper scripts
+              gawk
+              gnugrep
+              gnused
+              coreutils
+              which
+            ]
+            # provides `getconf` for ps-fallback script that only runs on Linux
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.sh#L2
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.ts#L203-L217
+            ++ lib.optional stdenv.hostPlatform.isLinux getconf
+          )
        }
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
        --add-flags ${lib.escapeShellArg commandLineArgs}
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-pce";
-  version = "0-unstable-2025-06-22";
+  version = "0-unstable-2026-04-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-pce-libretro";
-    rev = "9a301c0773c53702a882bbaa42ee9cbc6d523787";
-    hash = "sha256-RS5omi6LthQy8fFfouSEpYtaeD7QDlRENm0YuqHzUc0=";
+    rev = "ae99235c2139c176c1a8d0fde2957bf701d3cab0";
+    hash = "sha256-3bxKLWivTpCmAPYqu5r7AuwvREXRCndq6JQ4hgd18YU=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mame2003-plus";
-  version = "0-unstable-2026-04-04";
+  version = "0-unstable-2026-04-08";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2003-plus-libretro";
-    rev = "3da943f4bcf264c7af83a07b78617e98ce3822cd";
-    hash = "sha256-3hJj8BLePPdEEsQriHSWhIMhamr7pvpKswP5/RxtjcM=";
+    rev = "7d7fc6d9d6a5855118e6580a7b5554e08796a878";
+    hash = "sha256-J2VU9BqVLpre2nnpweYpzR3j7jYVbfcNvjQn3SFk4oI=";
  };

  makefile = "Makefile";
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "opera";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "opera-libretro";
-    rev = "889e52a07cd93074577bf1b2ea260a2beae7ff7b";
-    hash = "sha256-bsSrkYzkUgUxDz0798aB5etJ0er+RtlcdoJY12gB+WY=";
+    rev = "4c4ca6bf741c40715723a8b8dae4b6187ff6ac30";
+    hash = "sha256-AcuqEuK3bz+WJ0r723+w6Y9WGuNs04zUOWlQ3aMXk/U=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "2048";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-2048";
-    rev = "1892de39d80ec37e1fac79729cd91917b21f1349";
-    hash = "sha256-lNcDdkiWiXhvwwpzMnceTDY+mJl1JTZfGCY+WIOvrP8=";
+    rev = "c90437d3c3913999624deca3fb55ecfa632b72c4";
+    hash = "sha256-dE3PanK+rpf01R4aoD3KMwVhEVvmmVS2klVPQUGTUC0=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "vbam";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "vbam-libretro";
-    rev = "60b48a3a4a46562f29120c1868a54778b40b60a2";
-    hash = "sha256-UbXSHdKfa91MpcYityo+aILbI0DfkLqZh8YfGcRx/BI=";
+    rev = "e8b2875d6cad10fc3c7c9f57bb5f1acc324d7c10";
+    hash = "sha256-tq2MxjPwVPkZotaZAKxmiz7Zjws22E8tK+FPcS+uujk=";
  };

  makefile = "Makefile";
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "yabause";
-  version = "0-unstable-2025-12-20";
+  version = "0-unstable-2026-04-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "yabause";
-    rev = "65af22e96beb6d9b0b9a50a81a39c86a6d604c1c";
-    hash = "sha256-LafC48f1m6pRWhXmfN+D+5r9qCNm1v9uLJVq5Wa5naE=";
+    rev = "76faf7c601359bafc41785325d686644000a7ba9";
+    hash = "sha256-UHmUsqAK+As6qfvhto2aOsW9A/lZMypfn2NxFui2x8c=";
  };

  makefile = "Makefile";
@@ -151,9 +151,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.5";
+    version = "11.6";
    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-ETcLV+pdVIpU2Syc1l0LpjX08cPq2s4J7RxBn3BeGdE=";
+    hash = "sha256-1J0WaXVHj2Ceapzb2goHxlo7eV4GH8RU0/EDTIKNGeA=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-tkx1LB/iZoFvarMvc9QofuQLrZwZyaoL0FUh3nsvYjs=";
+      hash = "sha256-vI6GnnAqkyQSff9jrGYCTFR6fSIg2i9FT4mvbOlU1M4=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-diff";
-  version = "3.15.4";
+  version = "3.15.5";

  src = fetchFromGitHub {
    owner = "databus23";
    repo = "helm-diff";
    rev = "v${version}";
-    hash = "sha256-FZd1QW2/SHMrOS1/Ecin9SDuPjLKJ3C2kF7s8zB1zqw=";
+    hash = "sha256-ti247vkYPW6PH0DNkgdH99MyUy2uc2n+zHgpNET/cgU=";
  };

-  vendorHash = "sha256-P4fxAl3C2CzbIH7U38vHDxcuhSe3GLs1nck3t6IIw48=";
+  vendorHash = "sha256-b479InQ1ZoOtRgY1cyKeDDoGrOIg0aPqNfDrrY1E4tQ=";

  ldflags = [
    "-s"
@@ -472,13 +472,13 @@
    "vendorHash": "sha256-yOM4JcQxAvYAFPyAFfjJn4FK8pEXF3I55ddMTkijn9c="
  },
  "grafana_grafana": {
-    "hash": "sha256-eYVNiyD3hFxE9dqlyfsOZBaX6xVec0uPAuquOdxg78A=",
+    "hash": "sha256-szkdeprCEbrtZkoNzS6/FlICPsZpB+fgvAovNk8LXLM=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v4.29.0",
+    "rev": "v4.31.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9fBGjh/kstnMHi9aWQoq0tqJfDWoKHESlQwBoRA+8oA="
+    "vendorHash": "sha256-xcKcXakpjBQCy5JqWsXnDDQeR+53tyRxWeoLkxsStcs="
  },
  "gridscale_gridscale": {
    "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -508,13 +508,13 @@
    "vendorHash": "sha256-picwxtQOtsBX8SkA64+ekFNDC7zIpg0CG66kelO2THk="
  },
  "hashicorp_awscc": {
-    "hash": "sha256-tcDnXPoiwGcy4tW3r/YMM+eivGur90TeAZO5gWhT7DA=",
+    "hash": "sha256-/mQ8GrCbOudqpQ3+xyJccVCVVUkGsnozNHa4Ll/66RI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
    "owner": "hashicorp",
    "repo": "terraform-provider-awscc",
-    "rev": "v1.78.0",
+    "rev": "v1.79.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z2KPnztWBOlKTIwloRGdT1GMjBewQ1FlJgZkoGFK7XY="
+    "vendorHash": "sha256-ZhN2ap9U5xp2HNeAE7HmLGce19jVH4Y7GpuqrUtYf40="
  },
  "hashicorp_azuread": {
    "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -923,13 +923,13 @@
    "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
  },
  "mongodb_mongodbatlas": {
-    "hash": "sha256-8TcFJv8e9CJOzF+Fy0QvB2juTvyGAxUvgSKCL3fGYDM=",
+    "hash": "sha256-3zypsyMu7ZlEKtmA2brnc3Gidlkd96v1DG3C4HQLByw=",
    "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
    "owner": "mongodb",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v2.9.0",
+    "rev": "v2.10.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mgGmFrP/LhjHiYvxKtGBe2S/ZBHn2qT7eX5eBvNjxk8="
+    "vendorHash": "sha256-cvnxSUCiu6S5lkT9VAyn9K6lmridRb0WZyrrvMv+B48="
  },
  "namecheap_namecheap": {
    "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "urxvt-tabbedex";
-  version = "22.32";
+  version = "26.16.1";

  src = fetchFromGitHub {
    owner = "mina86";
    repo = "urxvt-tabbedex";
    rev = "v${version}";
-    sha256 = "sha256-4+4iPFoy1j5xjXRM5kBauhff44Y7/ik/+ZLZ1prc+Xo=";
+    sha256 = "sha256-e/t7AnP7nXkkazK6Oe6mw2Adf5wxR31/nFKeSaCpy/4";
  };

  nativeBuildInputs = [ perl ];
@@ -50,4 +50,8 @@ buildEnv {
        }"
    done
  '';
+
+  meta = {
+    inherit (kodi.meta) mainProgram;
+  };
 }
@@ -121,7 +121,6 @@ rec {
    inherit
      buildImage
      buildLayeredImage
-      fakeNss
      pullImage
      shadowSetup
      buildImageWithNixDb
@@ -11,7 +11,6 @@
  pkgs,
  buildImage,
  buildLayeredImage,
-  fakeNss,
  pullImage,
  shadowSetup,
  buildImageWithNixDb,
@@ -27,11 +26,37 @@ let
  };
  evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };

+  nonRootShadowSetup =
+    {
+      user,
+      uid,
+      gid ? uid,
+    }:
+    with pkgs;
+    [
+      (writeTextDir "etc/shadow" ''
+        root:!x:::::::
+        ${user}:!:::::::
+      '')
+      (writeTextDir "etc/passwd" ''
+        root:x:0:0::/root:${runtimeShell}
+        ${user}:x:${toString uid}:${toString gid}::/home/${user}:
+      '')
+      (writeTextDir "etc/group" ''
+        root:x:0:
+        ${user}:x:${toString gid}:
+      '')
+      (writeTextDir "etc/gshadow" ''
+        root:x::
+        ${user}:x::
+      '')
+    ];
+
  nginxArguments =
    let
      nginxPort = "80";
      nginxConf = pkgs.writeText "nginx.conf" ''
-        user nobody nobody;
+        user nginx nginx;
        daemon off;
        error_log /dev/stdout info;
        pid /dev/null;
@@ -55,9 +80,12 @@ let
      name = "nginx-container";
      tag = "latest";
      contents = [
-        fakeNss
        pkgs.nginx
-      ];
+      ]
+      ++ nonRootShadowSetup {
+        uid = 999;
+        user = "nginx";
+      };

      extraCommands = ''
        mkdir -p tmp/nginx_client_body
@@ -596,46 +624,18 @@ rec {
  };

  # buildLayeredImage with non-root user
-  bashLayeredWithUser =
-    let
-      nonRootShadowSetup =
-        {
-          user,
-          uid,
-          gid ? uid,
-        }:
-        with pkgs;
-        [
-          (writeTextDir "etc/shadow" ''
-            root:!x:::::::
-            ${user}:!:::::::
-          '')
-          (writeTextDir "etc/passwd" ''
-            root:x:0:0::/root:${runtimeShell}
-            ${user}:x:${toString uid}:${toString gid}::/home/${user}:
-          '')
-          (writeTextDir "etc/group" ''
-            root:x:0:
-            ${user}:x:${toString gid}:
-          '')
-          (writeTextDir "etc/gshadow" ''
-            root:x::
-            ${user}:x::
-          '')
-        ];
-    in
-    pkgs.dockerTools.buildLayeredImage {
-      name = "bash-layered-with-user";
-      tag = "latest";
-      contents = [
-        pkgs.bash
-        pkgs.coreutils
-      ]
-      ++ nonRootShadowSetup {
-        uid = 999;
-        user = "somebody";
-      };
+  bashLayeredWithUser = pkgs.dockerTools.buildLayeredImage {
+    name = "bash-layered-with-user";
+    tag = "latest";
+    contents = [
+      pkgs.bash
+      pkgs.coreutils
+    ]
+    ++ nonRootShadowSetup {
+      uid = 999;
+      user = "somebody";
    };
+  };

  # basic example, with cross compilation
  cross =
@@ -803,6 +803,10 @@ rec {
          }
        )
      );
+      etcCmd = pkgs.writeScript "etc-cmd" ''
+        #!${pkgs.busybox}/bin/sh
+        ${pkgs.busybox}/bin/cat /etc/some-config-file
+      '';
    in
    pkgs.dockerTools.streamLayeredImage {
      name = "etc";
@@ -812,10 +816,7 @@ rec {
        mkdir -p /etc
        ${nixosCore.config.system.build.etcActivationCommands}
      '';
-      config.Cmd = pkgs.writeScript "etc-cmd" ''
-        #!${pkgs.busybox}/bin/sh
-        ${pkgs.busybox}/bin/cat /etc/some-config-file
-      '';
+      config.Cmd = [ etcCmd ];
    };

  # Example export of the bash image
@@ -6,7 +6,7 @@ echo "Cloning Fossil $url [$rev] into $out"
 export HOME=$(pwd)

 # We must explicitly set the admin user for the clone to something reasonable.
-fossil clone -A nobody "$url" fossil-clone.fossil
+fossil clone -A $(whoami) "$url" fossil-clone.fossil

 mkdir fossil-clone
 WORKDIR=$(pwd)
@@ -77,7 +77,7 @@ export HOME="$tmpPath"
 echo "Fetching Fossil repository $url at revision $rev..." >&2

 # Clone the repository
-fossil clone -A nobody "$url" "$tmpPath/fossil-clone.fossil" >&2
+fossil clone -A $(whoami) "$url" "$tmpPath/fossil-clone.fossil" >&2

 # Create directory for checkout
 checkoutDir="$tmpPath/checkout"
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "air";
-  version = "1.65.0";
+  version = "1.65.1";

  src = fetchFromGitHub {
    owner = "air-verse";
    repo = "air";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pqvnX/PiipZM8jLBN6zN/yVnuCCk+aTII5AH0N4nHEM=";
+    hash = "sha256-omyWDW5bE+HfXQ2EQZKthB9t+jBEFcPSVtPss5qeoMI=";
  };

  vendorHash = "sha256-03xZ3P/7xjznYdM9rv+8ZYftQlnjJ6ZTq0HdSvGpaWw=";
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alt-tab-macos";
-  version = "10.4.0";
+  version = "10.11.0";

  src = fetchurl {
    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-CbeQi50EbGP+GoXLN/M8iLJ65RI6awXjDoPzEB8Pb38=";
+    hash = "sha256-LLEmcZEC0DaMdp9a5e1wF74oahGvHQpzpKDnbkPqNto=";
  };

  sourceRoot = ".";
@@ -8,13 +8,13 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ansible-navigator";
-  version = "26.1.3";
+  version = "26.4.0";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) version;
    pname = "ansible_navigator";
-    hash = "sha256-WWbx4/BARcmDnCZDt7v2uCCyZUNlS8Ur8HYiCf5A/vE=";
+    hash = "sha256-FpDFWyNnlt28wAG6OgJjwvK+UMCEDyH4P9fQ+t5J8FQ=";
  };

  build-system = with python3Packages; [
@@ -7,11 +7,11 @@

 let
  pname = "apidog";
-  version = "2.8.23";
+  version = "2.8.24";

  src = fetchurl {
    url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-N3ULCrYJilcc3R102ndXjKH3g/km7WcEMdi+NL8nmqA=";
+    hash = "sha256-gGhA++wfgURhibGF2tXAmH0orX2VSUiJsAo3wAu6t1g=";
  };

  appimageContents = appimageTools.extract {
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "arkade";
-  version = "0.11.92";
+  version = "0.11.93";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    tag = finalAttrs.version;
-    hash = "sha256-7xBtmpi4Mm9C9HSGsuluu7N4IglZisw3fWSgK9DFizo=";
+    hash = "sha256-VWdWlUBSyRqHtApX2n/eBVBMw34zt+I2hi0Nmvx901o=";
  };

  env.CGO_ENABLED = 0;
@@ -1,7 +1,11 @@
 {
  armagetronad,
-}:
+  ...
+}@args:

-armagetronad.override {
-  dedicatedServer = true;
-}
+armagetronad.override (
+  {
+    dedicatedServer = true;
+  }
+  // args
+)
@@ -30,6 +30,7 @@
  gnugrep,
  nixosTests,
  dedicatedServer ? false,
+  ...
 }:

 let
@@ -71,8 +72,8 @@ let
      # https://gitlab.com/armagetronad/armagetronad/-/commits/trunk/?ref_type=heads
      ${unstableVersionMajor} =
        let
-          rev = "3675f21cd5be4932a7a168b321576e0b09e64aaf";
-          hash = "sha256-d2vPFAyx6LhEIxtEUdhrlqqYeCY0NnETlq7TVvX5vVo=";
+          rev = "ec0dbb09ce081be2879acf67bebcd2a2987fd0a4";
+          hash = "sha256-8fH0Q0N2bKCO0t+lOs8EamThpiial2CfEcVP3cZbHX0=";
        in
        dedicatedServer: {
          version = "${unstableVersionMajor}-${lib.substring 0 8 rev}";
@@ -104,8 +105,8 @@ let
      # https://gitlab.com/armagetronad/armagetronad/-/commits/hack-0.2.8-sty+ct+ap/?ref_type=heads
      "${latestVersionMajor}-sty+ct+ap" =
        let
-          rev = "22fdbee08ca301c09ae4dee7210ccef02536670d";
-          hash = "sha256-F+nnQxI2TTTa+gJYWjQPFjd8tQLCh/dEu/oTV0ie8BI=";
+          rev = "b74df624eae13e919b4b04f9b18043bce9d04431";
+          hash = "sha256-tjEcgyYxaGgHiIH8y9xYM7HEpgZa7DEWIVqK8r0dmaY=";
        in
        dedicatedServer: {
          version = "${latestVersionMajor}-sty+ct+ap-${lib.substring 0 8 rev}";
@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+  gem 'asmrepl'
+  # Extra dependencies
+  gem 'racc', '~> 1.8'
+  gem 'rbs', '~> 3.9'
@@ -0,0 +1,23 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    asmrepl (1.2.0)
+      fisk (~> 2.3.1)
+    fisk (2.3.2)
+    logger (1.7.0)
+    racc (1.8.1)
+    rbs (3.10.3)
+      logger
+      tsort
+    tsort (0.2.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  asmrepl
+  racc (~> 1.8)
+  rbs (~> 3.9)
+
+BUNDLED WITH
+   2.7.2
@@ -0,0 +1,67 @@
+{
+  asmrepl = {
+    dependencies = [ "fisk" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qvkqn34ldlip2yz3kdckqmvniyydswcclwdcalcpdwnahg25xjw";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  fisk = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0zypl29fpqd5pqkp8j67xnq9b2dwhl8kn01fyw1kxy9l2676dlmh";
+      type = "gem";
+    };
+    version = "2.3.2";
+  };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  racc = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  rbs = {
+    dependencies = [
+      "logger"
+      "tsort"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19nsjb0wkb1zk274q0zy41hfzqraanar3jg6akak8q8134wpyqkh";
+      type = "gem";
+    };
+    version = "3.10.3";
+  };
+  tsort = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17q8h020dw73wjmql50lqw5ddsngg67jfw8ncjv476l5ys9sfl4n";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+}
@@ -44,6 +44,6 @@ stdenv.mkDerivation {
      platforms
      ;

-    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.20");
+    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "7.1");
  };
 }
@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.17.5-2";
-  arm64-hash = "sha256-4I/Kb+kfO73doOw10+knRqNpwlKWAzOWBrh1akggALk=";
-  x86_64-hash = "sha256-ZqxqCsSpU71nS5+o+S1nscEFC+7wLgLzdpa6qLUUPYI=";
+  version = "1.17.6-1";
+  arm64-hash = "sha256-QAqxs8Jyu4kA8Zmox0GJ8KoPS/L5z3TTtP6JDk62zjk=";
+  x86_64-hash = "sha256-Lit/eIudO0V1USoP0VWHbR5QHCT+7RyX9omYM4PoCeQ=";
 }
@@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bird";
-  version = "2.18";
+  version = "2.18.1";

  src = fetchFromGitLab {
    domain = "gitlab.nic.cz";
    owner = "labs";
    repo = "bird";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Kta8zzM/EYC3Mz3mLptaJ+pFgs1Hi7MBsWjwkR4hwL8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tYICTipTzugtb7kv/zwsChM8v+zJ2TVsotEkJDcZCto=";
  };

  nativeBuildInputs = [
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    domain = "gitlab.nic.cz";
    owner = "labs";
    repo = "bird";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-FkrVrjT4Q9zLeauP2GOX38a7a4q7h2aQbEe/kmfKB3A=";
  };

@@ -1,24 +1,24 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  python3,
-  xmlbird,
+  autoPatchelfHook,
  cairo,
+  fetchFromGitHub,
  gdk-pixbuf,
-  libgee,
  glib,
-  gtk3,
-  webkitgtk_4_1,
-  libnotify,
-  sqlite,
-  vala,
  gobject-introspection,
  gsettings-desktop-schemas,
-  wrapGAppsHook3,
-  autoPatchelfHook,
+  gtk3,
+  lib,
+  libgee,
+  libnotify,
  nix-update-script,
+  pkg-config,
+  python3,
+  sqlite,
+  stdenv,
+  vala,
+  webkitgtk_4_1,
+  wrapGAppsHook3,
+  xmlbird,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -29,37 +29,40 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "johanmattssonm";
    repo = "birdfont";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-7xVjY/yH7pMlUBpQc5Gb4t4My24Mx5KkARVp2KSr+Iw=";
+    hash = "sha256-7xVjY/yH7pMlUBpQc5Gb4t4My24Mx5KkARVp2KSr+Iw=";
  };

  nativeBuildInputs = [
-    python3
-    pkg-config
-    vala
-    gobject-introspection
-    wrapGAppsHook3
    autoPatchelfHook
+    gobject-introspection
+    pkg-config
+    python3
+    vala
+    wrapGAppsHook3
  ];
  buildInputs = [
-    xmlbird
-    libgee
    cairo
    gdk-pixbuf
    glib
+    gsettings-desktop-schemas
    gtk3
-    webkitgtk_4_1
+    libgee
    libnotify
    sqlite
-    gsettings-desktop-schemas
+    webkitgtk_4_1
+    xmlbird
  ];

  postPatch = ''
    substituteInPlace install.py \
-      --replace 'platform.version()' '"Nix"'
+      --replace-fail 'platform.version()' '"Nix"'

    patchShebangs .
  '';

+  # workaround gcc >= 14 incompatibilities
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17 -Wno-error=incompatible-pointer-types";
+
  buildPhase = "./build.py";

  installPhase = "./install.py";
@@ -69,7 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Font editor which can generate fonts in TTF, EOT, SVG and BIRDFONT format";
    homepage = "https://birdfont.org";
-    license = lib.licenses.gpl3;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "birdfont";
+    maintainers = with lib.maintainers; [ drawbu ];
  };
 })
@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "blackmagic-desktop-video";
-  version = "15.3.1";
+  version = "16.0";

  buildInputs = [
    autoPatchelfHook
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
      {
        outputHashMode = "recursive";
        outputHashAlgo = "sha256";
-        outputHash = "sha256-4Y7bmN08fZ9hRsyFKP4cfGb4fggLY9bdm32+UTIGiTs=";
+        outputHash = "sha256-AdJiPG0kJBk3SH633kwLbS36LjFeFAwzYTrfEjkvup4=";

        impureEnvVars = lib.fetchers.proxyImpureEnvVars;

@@ -12,13 +12,13 @@

 buildNpmPackage rec {
  pname = "blockbench";
-  version = "5.1.2";
+  version = "5.1.3";

  src = fetchFromGitHub {
    owner = "JannisX11";
    repo = "blockbench";
    tag = "v${version}";
-    hash = "sha256-fU38Exv83cKaPFA26zmwYZlkscCbAEz/7Gch5j/qHjk=";
+    hash = "sha256-aGGvYIYQ3fw1fk5NUwJsMkq2YSugQD94xfy52LvHOKc=";
  };

  patches = [
@@ -36,7 +36,7 @@ buildNpmPackage rec {
    copyDesktopItems
  ];

-  npmDepsHash = "sha256-0FdPTyoVNrsx0LJYcpfZPKZwUKzyJaU6XNnm2bY9F/s=";
+  npmDepsHash = "sha256-RmUUdHSVrZYc4F1Qtkbvn/2oKspM/3SnCuT3McKlMn0=";
  makeCacheWritable = true;

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.45.0";
+  version = "5.46.0";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-5hYMRFdMXlnhHzwbj8Hy48WJBf7L5UUhZUfKSlr06Z0=";
+    hash = "sha256-uDZYy+Lkvc5YdIdn84l8QbNPcU5EQzOqTTdTezgCudw=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

@@ -12,14 +12,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "canaille";
-  version = "0.2.3";
+  version = "0.2.4";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "yaal";
    repo = "canaille";
    tag = version;
-    hash = "sha256-kBbkqoXyGO238EArwYyjO46Kk5SkfP31Dc51qglLmqQ=";
+    hash = "sha256-iCiQvB+wYpm/Cns63kjo2wVGnSbcQHWo3UJvi0xJf50=";
  };

  build-system = with python.pkgs; [
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-binstall";
-  version = "1.17.9";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "cargo-bins";
    repo = "cargo-binstall";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GTyMnbPHB7+E8IEdUd7bHBmCTcMI6UqYBysGqzDs8MA=";
+    hash = "sha256-005RXO9Ah8JA36n27CehwgOOij2d3S3BfmRaaYYqpeg=";
  };

-  cargoHash = "sha256-38KqQcpOtSkV0eYQsXRdte8Pzabv2nU0ipxqzQFHgtg=";
+  cargoHash = "sha256-bulcxmiQAt0WugUlXLFDjLlZi9q2/jFhZ/AuGbXF2K0=";

  nativeBuildInputs = [
    pkg-config
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-crev";
-  version = "0.26.5";
+  version = "0.27.1";

  src = fetchFromGitHub {
    owner = "crev-dev";
    repo = "cargo-crev";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-P6i2RvosI36rrg52kUcdrb5y4Fg0ms/mH5hcOWNgSik=";
+    sha256 = "sha256-ezMpxYrJJ2zqEwCaDu2DFMwd6d/nfPVO6z2Lm4elIYE=";
  };

-  cargoHash = "sha256-ZlcKnSVpMxQqstbr/VkR/iT1B0wR5qnh5VLpNpYsTRw=";
+  cargoHash = "sha256-CYvvwgDZ+yAr7kLGEVZLVx7+sZUc5vu85AT5xLJBSbQ=";

  preCheck = ''
    export HOME=$(mktemp -d)
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-wizard";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "kobzol";
    repo = "cargo-wizard";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-oFPSgjXZ+Kq59tV/7s6WPF6FHXENoZv8D245yyT0E9E=";
+    hash = "sha256-WLGE2ZuytjSridZwfUTtNQF5woeBbx5ZoHfB9eyvedI=";
  };

-  cargoHash = "sha256-ClulQP+1/RLvOWWB3uKTCn2Sx3+TO25qRs456DWHKu0=";
+  cargoHash = "sha256-vRakgwZRyYkk3xFfZzl197tgRmx+/g2b8eaDunwrCzM=";

  preCheck = ''
    export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-xwin";
-  version = "0.21.4";
+  version = "0.21.5";

  src = fetchFromGitHub {
    owner = "rust-cross";
    repo = "cargo-xwin";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-mgFMjNxjB4S9/nou6S8NN8ZpXX7K49lLArt/cXcSPIE=";
+    hash = "sha256-RgR0YBjgpk10IS62+/CdIbZ+7oSnkOC5npIqRrib6eU=";
  };

-  cargoHash = "sha256-Md2pk8kYqUDPzRQedbne4Crg5UbGHHE5OTRz4LXLs3E=";
+  cargoHash = "sha256-dJkfEPRyXFpMwqExvyimLMc+iOAby5yeEUpHt0MoQ6M=";

  meta = {
    description = "Cross compile Cargo project to Windows MSVC target with ease";
@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      aleksana
      amerino
+      _0xErwin1
    ];
    platforms = lib.platforms.linux;
  };
@@ -12,13 +12,13 @@
  libepoxy,
  wayland,
  wayland-scanner,
-  wlroots_0_19,
+  wlroots_0_20,
  libxkbcommon,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "casilda";
-  version = "1.2.0";
+  version = "1.2.2";

  outputs = [
    "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "jpu";
    repo = "casilda";
    tag = finalAttrs.version;
-    hash = "sha256-JaWHKKNYeeW7QKB6DpGrXowvufeBZUnc9pP0ZAAo3gU=";
+    hash = "sha256-JMDS+fx0vUZnfNz5bzmTy8/4BkgMypWBp+qjorTVmK4=";
  };

  depsBuildBuild = [ pkg-config ];
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    wayland-protocols
    wayland # for wayland-server
    libxkbcommon
-    wlroots_0_19
+    wlroots_0_20
  ];

  propagatedBuildInputs = [ gtk4 ];
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "certigo";
-  version = "1.17.1";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "square";
    repo = "certigo";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-dn2GqEiSzlcqNPoAZhPESRsl3LOUBlaPs59rUjf2c5k=";
+    sha256 = "sha256-U+VbtY34lxLBHWI1BjkPxzSS6q41R9DQkGvDvSDX9WY=";
  };

-  vendorHash = "sha256-hBuR6a0gBhuYICbuiHxJdbDr4hLF4mQvIcMr5FHfOu8=";
+  vendorHash = "sha256-5DpgOb0YxZ/os23y+siCB73dUwutxXIW5RlCZqdbxao=";

  meta = {
    description = "Utility to examine and validate certificates in a variety of formats";
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cgif";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "dloebl";
    repo = "cgif";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Eoq2QPDz5YYw22Ux1H9CYFN1x+/1YTYqi/rmdwf+Hk4=";
+    hash = "sha256-sZan1SLY4HGoifgGOb+uo4/q4dtxZuWAYhMbvdl/Ap8=";
  };

  nativeBuildInputs = [
@@ -6,11 +6,11 @@
 }:
 let
  pname = "chatbox";
-  version = "1.19.1";
+  version = "1.20.0";

  src = fetchurl {
    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-xR653w7jiJlSHvbDcJG5pFjbgf/jZzbyx8C+pa0cPp4=";
+    hash = "sha256-VzrAXWacrX6ldHdSw12RmElMdWmHiCsE3qPEPoJqFA0=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -1,2 +1,4 @@
 source 'https://rubygems.org'
 gem "chef-cli"
+
+gem "syslog", "~> 0.4.0"
@@ -1,59 +1,56 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (7.0.8.7)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 1.6, < 2)
-      minitest (>= 5.1)
-      tzinfo (~> 2.0)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
    ast (2.4.3)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1110.0)
-    aws-sdk-core (3.225.0)
+    aws-partitions (1.1213.0)
+    aws-sdk-core (3.242.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
      base64
+      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-kms (1.102.0)
-      aws-sdk-core (~> 3, >= 3.225.0)
+    aws-sdk-kms (1.121.0)
+      aws-sdk-core (~> 3, >= 3.241.4)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.189.0)
-      aws-sdk-core (~> 3, >= 3.225.0)
+    aws-sdk-s3 (1.213.0)
+      aws-sdk-core (~> 3, >= 3.241.4)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.116.0)
-      aws-sdk-core (~> 3, >= 3.225.0)
+    aws-sdk-secretsmanager (1.128.0)
+      aws-sdk-core (~> 3, >= 3.241.4)
      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.12.0)
+    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
    base64 (0.3.0)
-    bigdecimal (3.2.1)
+    benchmark (0.5.0)
+    bigdecimal (4.0.1)
    builder (3.3.0)
-    chef (18.7.10)
+    chef (18.3.0)
      addressable
      aws-sdk-s3 (~> 1.91)
      aws-sdk-secretsmanager (~> 1.46)
-      chef-config (= 18.7.10)
-      chef-utils (= 18.7.10)
+      chef-config (= 18.3.0)
+      chef-utils (= 18.3.0)
      chef-vault
-      chef-zero (>= 15.0.17)
+      chef-zero (>= 14.0.11)
      corefoundation (~> 0.3.4)
      diff-lcs (>= 1.2.4, < 1.6.0, != 1.4.0)
      erubis (~> 2.7)
-      ffi (>= 1.15.5, <= 1.16.3)
+      ffi (>= 1.15.5)
      ffi-libarchive (~> 1.0, >= 1.0.3)
      ffi-yajl (~> 2.2)
      iniparse (~> 1.4)
-      inspec-core (>= 5, < 6)
+      inspec-core (>= 5)
      license-acceptance (>= 1.0.5, < 3)
      mixlib-archive (>= 0.4, < 2.0)
      mixlib-authentication (>= 2.1, < 4)
      mixlib-cli (>= 2.1.1, < 3.0)
-      mixlib-log (>= 2.0.3, < 3.2)
+      mixlib-log (>= 2.0.3, < 4.0)
      mixlib-shellout (>= 3.1.1, < 4.0)
      net-ftp
      net-sftp (>= 2.1.2, < 5.0)
@@ -61,13 +58,13 @@ GEM
      plist (~> 3.2)
      proxifier2 (~> 1.1)
      syslog-logger (~> 1.6)
-      train-core (~> 3.10, <= 3.12.13)
+      train-core (~> 3.10)
      train-rest (>= 0.4.1)
-      train-winrm (~> 0.2.17)
-      unf_ext (~> 0.0.8.2)
+      train-winrm (>= 0.2.5)
+      unf_ext (>= 0.0.8.2)
      uuidtools (>= 2.1.5, < 3.0)
-      vault (~> 0.18.2)
-    chef-cli (5.6.21)
+      vault (~> 0.16)
+    chef-cli (5.6.23)
      addressable (>= 2.3.5, < 2.9)
      chef (~> 18.0)
      cookbook-omnifetch (~> 0.5)
@@ -79,116 +76,136 @@ GEM
      mixlib-shellout (>= 2.0, < 4.0)
      pastel (~> 0.7)
      solve (> 2.0, < 5.0)
-    chef-config (18.7.10)
+    chef-config (18.3.0)
      addressable
-      chef-utils (= 18.7.10)
+      chef-utils (= 18.3.0)
      fuzzyurl
      mixlib-config (>= 2.2.12, < 4.0)
      mixlib-shellout (>= 2.0, < 4.0)
      tomlrb (~> 1.2)
-    chef-gyoku (1.4.5)
+    chef-gyoku (1.5.0)
      builder (>= 2.1.2)
      rexml (~> 3.4)
+    chef-licensing (1.4.0)
+      chef-config (>= 15)
+      faraday (>= 1, < 3)
+      faraday-http-cache
+      mixlib-log (~> 3.0)
+      ostruct (~> 0.6.0)
+      pstore (~> 0.1.1)
+      tty-prompt (~> 0.23)
+      tty-spinner (~> 0.9.3)
    chef-telemetry (1.1.1)
      chef-config
      concurrent-ruby (~> 1.0)
-    chef-utils (18.7.10)
+    chef-utils (18.3.0)
      concurrent-ruby
-    chef-vault (4.1.23)
-    chef-winrm (2.3.12)
+    chef-vault (4.2.5)
+      syslog (~> 0.3)
+    chef-winrm (2.5.0)
      builder (>= 2.1.2)
-      chef-gyoku (~> 1.4.0, <= 1.4.5)
+      chef-gyoku (~> 1.5)
      erubi (~> 1.8)
-      ffi (>= 1.15.5, < 1.17.0)
      gssapi (~> 1.2)
      httpclient (~> 2.2, >= 2.2.0.2)
      logging (>= 1.6.1, < 3.0)
-      nori (= 2.7.0)
-      rexml (~> 3.3)
+      nori (~> 2.7)
+      rexml (>= 3.4.2, < 4.0)
      rubyntlm (~> 0.6.0, >= 0.6.3)
    chef-winrm-elevated (1.2.5)
      chef-winrm (>= 2.3.11)
      chef-winrm-fs (>= 1.3.7)
      erubi (~> 1.8)
-    chef-winrm-fs (1.3.7)
-      chef-winrm (>= 2.3.11)
+    chef-winrm-fs (1.4.2)
+      benchmark (~> 0.5.0)
+      chef-winrm (~> 2.4)
+      csv (~> 3.3)
      erubi (>= 1.7)
      logging (>= 1.6.1, < 3.0)
      rubyzip (~> 2.0)
-    chef-zero (15.0.17)
-      activesupport (~> 7.0, < 7.1)
-      ffi-yajl (~> 2.2)
-      hashie (>= 2.0, < 5.0)
+    chef-zero (15.1.0)
+      ffi-yajl (>= 2.2, < 4.0)
+      hashie (>= 2.0, < 6.0)
      mixlib-log (>= 2.0, < 4.0)
-      rack (~> 3.1, >= 3.1.10)
+      rack (~> 3.1, >= 3.1.16)
      rackup (~> 2.2, >= 2.2.1)
+      unf_ext (~> 0.0.8)
      uuidtools (~> 2.1)
      webrick
    coderay (1.1.3)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.6)
+    connection_pool (2.5.5)
    cookbook-omnifetch (0.12.2)
      mixlib-archive (>= 0.4, < 2.0)
-    cookstyle (8.1.4)
-      rubocop (= 1.75.8)
+    cookstyle (8.5.3)
+      rubocop (= 1.81.7)
    corefoundation (0.3.13)
      ffi (>= 1.15.0)
-    date (3.4.1)
+    csv (3.3.5)
+    date (3.5.1)
    diff-lcs (1.5.1)
    domain_name (0.6.20240107)
    erubi (1.13.1)
    erubis (2.7.0)
-    faraday (2.13.1)
+    faraday (2.14.1)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
-    faraday-follow_redirects (0.3.0)
+    faraday-follow_redirects (0.5.0)
      faraday (>= 1, < 3)
-    faraday-net_http (3.4.0)
-      net-http (>= 0.5.0)
-    ffi (1.16.3)
+    faraday-http-cache (2.6.1)
+      faraday (>= 0.8)
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
+    ffi (1.17.3)
    ffi-libarchive (1.1.14)
      ffi (~> 1.0)
-    ffi-yajl (2.6.0)
-      libyajl2 (>= 1.2)
+    ffi-yajl (2.7.7)
+      libyajl2 (>= 2.1)
+      yajl
    fuzzyurl (0.9.0)
    gssapi (1.3.1)
      ffi (>= 1.0.1)
-    hashie (4.1.0)
+    hashie (5.1.0)
+      logger
    http-accept (1.7.0)
-    http-cookie (1.0.8)
+    http-cookie (1.1.0)
      domain_name (~> 0.5)
    httpclient (2.9.0)
      mutex_m
-    i18n (1.14.7)
-      concurrent-ruby (~> 1.0)
    iniparse (1.5.0)
-    inspec-core (5.22.80)
+    inspec-core (7.0.95)
      addressable (~> 2.4)
+      chef-licensing (>= 1.2.0)
      chef-telemetry (~> 1.0, >= 1.0.8)
      cookstyle
+      csv (~> 3.0)
      faraday (>= 1, < 3)
      faraday-follow_redirects (~> 0.3)
      hashie (>= 3.4, < 6.0)
      license-acceptance (>= 0.2.13, < 3.0)
      method_source (>= 0.8, < 2.0)
-      mixlib-log (~> 3.0, < 3.2)
+      mixlib-log (~> 3.0)
      multipart-post (~> 2.0)
+      ostruct (>= 0.1, < 0.7)
      parallel (~> 1.9)
      parslet (>= 1.5, < 3.0)
      pry (~> 0.13)
-      rspec (>= 3.9, <= 3.12)
-      rspec-its (~> 1.2)
-      rubyzip (>= 1.2.2, < 3.0)
+      rspec (>= 3.9, <= 3.14)
+      rspec-its (>= 1.2, < 3.0)
+      rubyzip (>= 1.2.2, < 4.0)
      semverse (~> 3.0)
      sslshake (~> 1.2)
-      thor (>= 0.20, < 1.3.0)
-      tomlrb (>= 1.2, < 2.1)
-      train-core (~> 3.12.13)
+      syslog (~> 0.1)
+      thor (>= 0.20, < 1.5.0)
+      tomlrb (>= 1.3, < 2.1)
+      train-core (~> 3.13, >= 3.13.4)
      tty-prompt (~> 0.17)
      tty-table (~> 0.10)
+    io-console (0.8.2)
    ipaddress (0.8.3)
    jmespath (1.6.2)
-    json (2.12.2)
+    json (2.18.1)
    language_server-protocol (3.17.0.5)
    libyajl2 (2.1.0)
    license-acceptance (2.1.13)
@@ -206,28 +223,29 @@ GEM
    mime-types (3.7.0)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0527)
-    minitar (1.0.2)
-    minitest (5.25.5)
-    mixlib-archive (1.1.7)
+    mime-types-data (3.2026.0203)
+    minitar (1.1.0)
+    mixlib-archive (1.3.3)
      mixlib-log
    mixlib-authentication (3.0.10)
    mixlib-cli (2.1.8)
    mixlib-config (3.0.27)
      tomlrb
-    mixlib-log (3.1.2.1)
-      ffi (< 1.17.0)
-    mixlib-shellout (3.3.9)
+    mixlib-log (3.2.3)
+      ffi (>= 1.15.5)
+    mixlib-shellout (3.4.10)
      chef-utils
    molinillo (0.8.0)
-    multi_json (1.15.0)
+    multi_json (1.19.1)
    multipart-post (2.4.1)
    mutex_m (0.3.0)
-    net-ftp (0.3.8)
+    net-ftp (0.3.9)
      net-protocol
      time
-    net-http (0.6.0)
-      uri
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
    net-protocol (0.2.2)
      timeout
    net-scp (4.1.0)
@@ -236,12 +254,12 @@ GEM
      net-ssh (>= 5.0.0, < 8.0.0)
    net-ssh (7.3.0)
    netrc (0.11.0)
-    nori (2.7.0)
+    nori (2.7.1)
      bigdecimal
-    ohai (18.2.6)
+    ohai (18.1.18)
      chef-config (>= 14.12, < 19)
      chef-utils (>= 16.0, < 19)
-      ffi (~> 1.9, <= 1.17.0)
+      ffi (~> 1.9)
      ffi-yajl (~> 2.2)
      ipaddress
      mixlib-cli (>= 1.7.0)
@@ -251,49 +269,54 @@ GEM
      plist (~> 3.1)
      train-core
      wmi-lite (~> 1.0)
+    ostruct (0.6.3)
    parallel (1.27.0)
-    parser (3.3.8.0)
+    parser (3.3.10.1)
      ast (~> 2.4.1)
      racc
    parslet (2.0.0)
    pastel (0.8.0)
      tty-color (~> 0.5)
    plist (3.7.2)
-    prism (1.4.0)
+    prism (1.9.0)
    proxifier2 (1.1.0)
-    pry (0.15.2)
+    pry (0.16.0)
      coderay (~> 1.1)
      method_source (~> 1.0)
-    public_suffix (6.0.2)
+      reline (>= 0.6.0)
+    pstore (0.1.4)
+    public_suffix (7.0.2)
    racc (1.8.1)
-    rack (3.1.15)
-    rackup (2.2.1)
+    rack (3.2.4)
+    rackup (2.3.1)
      rack (>= 3)
    rainbow (3.1.1)
-    regexp_parser (2.10.0)
+    regexp_parser (2.11.3)
+    reline (0.6.3)
+      io-console (~> 0.5)
    rest-client (2.1.0)
      http-accept (>= 1.7.0, < 2.0)
      http-cookie (>= 1.0.2, < 2.0)
      mime-types (>= 1.16, < 4.0)
      netrc (~> 0.8)
-    rexml (3.4.1)
-    rspec (3.12.0)
-      rspec-core (~> 3.12.0)
-      rspec-expectations (~> 3.12.0)
-      rspec-mocks (~> 3.12.0)
-    rspec-core (3.12.3)
-      rspec-support (~> 3.12.0)
-    rspec-expectations (3.12.4)
+    rexml (3.4.4)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-its (1.3.1)
-      rspec-core (>= 3.0.0)
-      rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.12.7)
+      rspec-support (~> 3.13.0)
+    rspec-its (2.0.0)
+      rspec-core (>= 3.13.0)
+      rspec-expectations (>= 3.13.0)
+    rspec-mocks (3.13.7)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-support (3.12.2)
-    rubocop (1.75.8)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    rubocop (1.81.7)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -301,17 +324,18 @@ GEM
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.44.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.45.0)
+    rubocop-ast (1.49.0)
      parser (>= 3.3.7.2)
-      prism (~> 1.4)
+      prism (~> 1.7)
    ruby-progressbar (1.13.0)
    rubyntlm (0.6.5)
      base64
    rubyzip (2.4.1)
    semverse (3.0.2)
+    socksify (1.8.1)
    solve (4.0.4)
      molinillo (~> 0.6)
      semverse (>= 1.1, < 4.0)
@@ -321,15 +345,17 @@ GEM
      unicode-display_width (>= 1.5, < 3.0)
      unicode_utils (~> 1.4)
    strings-ansi (0.2.0)
+    syslog (0.4.0)
+      logger
    syslog-logger (1.6.8)
-    thor (1.2.2)
-    time (0.4.1)
+    thor (1.4.0)
+    time (0.4.2)
      date
-    timeout (0.4.3)
+    timeout (0.6.0)
    tomlrb (1.3.0)
-    train-core (3.12.13)
+    train-core (3.16.1)
      addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (>= 1.16.0, < 1.18)
      json (>= 1.8, < 3.0)
      mixlib-shellout (>= 2.0, < 4.0)
      net-scp (>= 1.2, < 5.0)
@@ -338,10 +364,11 @@ GEM
      aws-sigv4 (~> 1.5)
      rest-client (~> 2.1)
      train-core (~> 3.0)
-    train-winrm (0.2.19)
-      chef-winrm (~> 2.3.12)
-      chef-winrm-elevated (~> 1.2.5)
-      chef-winrm-fs (~> 1.3.7)
+    train-winrm (0.4.3)
+      chef-winrm (>= 2.4.4, < 3.0)
+      chef-winrm-elevated (>= 1.2.5, < 2.0)
+      chef-winrm-fs (>= 1.4.1, < 2.0)
+      socksify (~> 1.8)
    tty-box (0.7.0)
      pastel (~> 0.8)
      strings (~> 0.2.0)
@@ -356,28 +383,33 @@ GEM
      tty-screen (~> 0.8)
      wisper (~> 2.0)
    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
    tty-table (0.12.0)
      pastel (~> 0.8)
      strings (~> 0.2.0)
      tty-screen (~> 0.8)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    unf_ext (0.0.8.2)
+    unf_ext (0.0.9.1)
    unicode-display_width (2.6.0)
    unicode_utils (1.4.0)
-    uri (1.0.3)
+    uri (1.1.1)
    uuidtools (2.2.0)
-    vault (0.18.2)
+    vault (0.20.0)
      aws-sigv4
-    webrick (1.9.1)
+      base64
+      connection_pool (~> 2.4)
+      net-http-persistent (~> 4.0, >= 4.0.2)
+    webrick (1.9.2)
    wisper (2.0.1)
    wmi-lite (1.0.7)
+    yajl (0.3.4)

 PLATFORMS
  ruby

 DEPENDENCIES
  chef-cli
+  syslog (~> 0.4.0)

 BUNDLED WITH
-   2.6.6
+   2.7.2
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "cherry-studio";
-  version = "1.8.4";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "CherryHQ";
    repo = "cherry-studio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TLV4N9WYuTD24UY+2lYmxRLO2jtdvuXyIOeH5mXb1V0=";
+    hash = "sha256-gk/sTkBr7PKBGS96bYVUXGpZuoaech4/0npB+NSstTA=";
  };

  postPatch = ''
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-qryToH1tytLSwPORkLBCCn3m/Xsl+vift9WF3Pn8oGg=";
+    hash = "sha256-DidMffZQEdYSERZZgDpQ8DqV773iBju89Pa0Z1Gz3I8=";
  };

  nativeBuildInputs = [
@@ -88,10 +88,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
    pnpm build
  '';

-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/bin
-    makeWrapper "$out/Applications/Chiri.app/Contents/MacOS/chiri" "$out/bin/chiri"
-  '';
+  postInstall =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/bin
+        makeWrapper "$out/Applications/Chiri.app/Contents/MacOS/chiri" "$out/bin/chiri"
+      ''
+    else
+      ''
+        mv $out/bin/Chiri $out/bin/chiri
+        substituteInPlace $out/share/applications/Chiri.desktop \
+          --replace-fail "Exec=Chiri" "Exec=chiri"
+      '';

  doCheck = false;

@@ -16,16 +16,16 @@

 buildGoModule (finalAttrs: {
  pname = "cliamp";
-  version = "1.34.0";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "bjarneo";
    repo = "cliamp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0WT3DRII4o58KFK+7UW0QgrJwrJwmPkKmTQeVXmtoZ0=";
+    hash = "sha256-8Att+SEJd2MdAgQ8SM49S4c4fM7t0/f/kHl6a+DbO2U=";
  };

-  vendorHash = "sha256-+uh+4ZYvnlKmRSIvZFlnfBPqU0CFFe/Op1Gr9hjIr4U=";
+  vendorHash = "sha256-sS0tjZoZ81Jwn/KJnJD01fTA4z0HxEYYM89Ta398MP0=";

  nativeBuildInputs = [
    pkg-config
@@ -6,18 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "cnspec";
-  version = "13.3.3";
+  version = "13.4.1";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yCxry1f5CEF51WSgrYN1m9F8YpVjtt+UNZG978nPXbY=";
+    hash = "sha256-3Uo2x30K7b7NA5OGP8YYlcoEJmFhlkL7t7ohvzUlmYI=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-wgebRTa1ox+LUzxlYLb3pqcLEF/uUushZ1Oq2mvRGCk=";
+  vendorHash = "sha256-7XwLkvG0LYL0pIbjMs78wMSqbXR5SScPAgjRxYsPwlA=";

  subPackages = [ "apps/cnspec" ];

@@ -7,16 +7,16 @@

 buildNpmPackage {
  pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-04-01";
+  version = "0-unstable-2026-04-09";

  src = fetchFromGitHub {
    owner = "fannheyward";
    repo = "coc-rust-analyzer";
-    rev = "569c6c56e815ae29ad7873b472ebb750c19d0d38";
-    hash = "sha256-4IZhCQl+iKChGaT0ghn5MnB+h6U5DJSa7YgPDoObiBg=";
+    rev = "561aea31f1e263c8386ab7e09b7ffa95e64cd351";
+    hash = "sha256-Ee/5nkPdQBXwt5jQOMN+2/nHRwk33HigeY/L0NpTLAY=";
  };

-  npmDepsHash = "sha256-B/EBAhwEEqLgGshK3Fw7nG7Mv9kk0v4ClLglLhooYBM=";
+  npmDepsHash = "sha256-+3eXdiM0Nll7V6EnDXq88rBjRkPN6GLFASdJ3fMXbq4=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codebook";
-  version = "0.3.36";
+  version = "0.3.37";

  src = fetchFromGitHub {
    owner = "blopker";
    repo = "codebook";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nME4B9z66Xvnll37jkNBMmswFk3oYGA9rSLTJufOo1s=";
+    hash = "sha256-1eZ9HzGK/Zyjb0ffGZc08DKqwMtUh6Ei04vAtgCOQoc=";
  };

  buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-mHGuhTGMWWgaLJe71GxgWBwmRcEZGZAQgvJb4TQOKrw=";
+  cargoHash = "sha256-lWl2E5I/1Qj5TvQfxBfNsMYIIpL+yGlrA7YVokKwtqQ=";

  env = {
    CARGO_PROFILE_RELEASE_LTO = "fat";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cotp";
-  version = "1.9.7";
+  version = "1.9.9";

  src = fetchFromGitHub {
    owner = "replydev";
    repo = "cotp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-N3UPeEc3xPIRHt1lOwd8c7e61jZk3PPo3sC/7BQBosY=";
+    hash = "sha256-P7QeT3q//nmv11i0pELfTCC/wi9jHqbYClqSvvkvqwA=";
  };

-  cargoHash = "sha256-3IJV7X3G12+ca723sDhOn4SN9CeqKPzGs59IQBYS5QY=";
+  cargoHash = "sha256-PhUHFLl0yr/eWy2A+zp+gTNlW+zbruCqQLkHA6Ivf04=";

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];

@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2026-03-25";
+  version = "0-unstable-2026-04-06";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "774182f2c1b6d5e0d8ce975f2ed9f58fab7f1da2";
-    hash = "sha256-Wh/yKAritCLg0FGbM4i+iorgOZvmFysLlDxpuZH7NjI=";
+    rev = "626d7d9f906e9f3cfb70be9e58af0f5a5f399a74";
+    hash = "sha256-qo3gVlYGxKef7RVGngFDKuSODoVbSCaFZwoKY4RDaAk=";
  };

  outputs = [
@@ -1,11 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  ply,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "cxxtest";
  version = "4.4";
  format = "setuptools";
@@ -19,7 +18,7 @@ buildPythonApplication rec {

  sourceRoot = "${src.name}/python";

-  nativeCheckInputs = [ ply ];
+  nativeCheckInputs = [ python3Packages.ply ];

  preCheck = ''
    cd ../
@@ -41,8 +40,6 @@ buildPythonApplication rec {
    cp -r ../../cxxtest "$out/include"
  '';

-  dontWrapPythonPrograms = true;
-
  meta = {
    homepage = "https://github.com/CxxTest/cxxtest";
    description = "Unit testing framework for C++";
@@ -1,18 +1,19 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchPypi,
-  setuptools,
 }:
-buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dazel";
  version = "0.0.43";
  pyproject = true;

-  build-system = [ setuptools ];
+  build-system = [
+    python3Packages.setuptools
+  ];

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-2enQRKg4CAPGHte02io+EfiW9AmuP3Qi41vNQeChg+8=";
  };

@@ -24,4 +25,4 @@ buildPythonApplication rec {
      malt3
    ];
  };
-}
+})
@@ -7,14 +7,18 @@
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dcnnt";
  version = "0.10.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
    hash = "sha256-73ZLgb5YcXlAOjbKLVv8oqgS6pstBdJxa7LFUgIHpUE=";
  };

-  propagatedBuildInputs = with python3Packages; [
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
    pycryptodome
  ];

@@ -6,16 +6,16 @@
 }:
 buildNpmPackage rec {
  pname = "decktape";
-  version = "3.15.0";
+  version = "3.16.0";

  src = fetchFromGitHub {
    owner = "astefanutti";
    repo = "decktape";
    rev = "v${version}";
-    hash = "sha256-SsdjqkMEVD0pVgIZ9Upmrz/1KOWcb1KUy/v/xTCVGc0=";
+    hash = "sha256-hriWwH7/YKCwdDhXwqoOmjOJX3Dk4aKMnCBJKepUTzg=";
  };

-  npmDepsHash = "sha256-Z5fLGMvxVhM8nW81PQ5ZFPHK6m2uoYUv0A4XsTa3Z2Y=";
+  npmDepsHash = "sha256-wnT6kRiYanwi8G9ZtBmqxAFctJEyyi0XlwaOXTjvlA8=";
  npmPackFlags = [ "--ignore-scripts" ];

  dontNpmBuild = true;
@@ -28,13 +28,13 @@ buildGoModule (
  in
  {
    pname = "dms-shell";
-    version = "1.4.4";
+    version = "1.4.4.1";

    src = fetchFromGitHub {
      owner = "AvengeMedia";
      repo = "DankMaterialShell";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-rfWvWbPVrpujmBp/q9My/70fWgRLaELdrnZB3CZKlWg=";
+      hash = "sha256-iYBdSBvcW7bJtc84G6k5TFJEbPHQrif9KzZyE9Lbq8M=";
    };

    sourceRoot = "${finalAttrs.src.name}/core";
@@ -1,19 +1,19 @@
 {
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.9": "1777af709a7dee1cf188aa8248f915b9a8e33ebf08e542dad502bbc71d2b4da454cdb27099177606e8b180df406273abcd45d52774ce4e27cf2a439b84d52683",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.9": "7c5a281f86d91ba3d18d079e8b67b4bb6cc9f0d414b13be2f0c4e9d4b821e8a16045c1324244841be48b94bb5312cb61295f9bf97808553614c6d5eddeb7a64a",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.9": "eec443021e7fc115a8378f3d664df84db7cd6e97b1741d663efdd7c68340d7e61558241031ea5434ef9ca1dfa66c1a4a480177e194cfd38925de876c157efb85",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.9": "51c5863b592936299620c9200e704880ebd38b6f1ce4c4ba944558162913a8d7891c24982e85a484838fa80b025737dbd4042f94e2a25a2d927379ad572c1631",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.9": "d5b5391a590a9d3f0a792d78be5eaef4595c6bc25704caf28c7cc2b01853322d807bae922deabb1f2c2a197ac48dbf97b9ef4aef0212e8830a1f3c1d70af3608",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.9": "504c4d38e115f77fb44aa9ac56948e8d870021a5f4153af5b91fc5823b468f0268a9d451b11f7dea9aab47bc5fa07a014eecf34ad0baeb12eec46282aa8b4a22",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.9": "e3ebfeb46b68eca14fd36177d8e40edd5a3e8634f2b00a55531a88fa467ddc46a9a9d650e3b085b85b7a8377ad5223ebdf5b226507f3ac150528758eab70ed29",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.9": "e240025464e6bf73aaff02e9412937948b6b944eee24a26ed578956e0ab7c6b00da5300e35650c1fbd5c37dee3cc8ad66c9ac3c1e036e17ea33b3cbca58f1356",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.9": "50e631b2efcdc93573311bc8ce8d1319bee3212c1872929d2b3752bf0be0896100f271aae829d3aafa9413b24ef47edf4a0fea48ee8dfa8386edbb23381dcd93",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.9": "8d59328c46ac1250c7666f2d723ec30be3119553c60e22656d08391c2a217c938f906906b6662da1984666643ba00ad7d43899041380fe6a7f5072f5e1cc4b97",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.9": "cd27570608123a824d4c779cca3cee1e93ac3a8318e030a881bb72d80a6ff3b9a22add1f550c13fd7472407aea02cda2cfbd04016975f88474826848bf463b0e",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.9": "0bb2f5ab0e2a461ac0f05e1efafaf4145702479792afc7b5229c92da18d0544fd63189fd15f6bca71a511d07131b231665933470ceceec7db67c628e2c43a152",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.9": "7208c5618e61b484d1272650c68d8908ac0a1b35ce365ef78f0b4290afa171055b24a15585c2a62d95abf1e6298e4aa3d08b71db6656415b8e7d2fdf37fd8b24",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.9": "f2605a92b218d088c20b0a2e71a8f47a5d5b5b04ed2edcafc59d692974cf62984228350eee176e94ea605b4326363c0962a8e97e2de34c926447c38ed6a73636",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.9": "091a4d27b9675b61dd598aa6ee827c5a2959b532ae52a0ac73aafd167567328a53fb38f2c0d556f8f78625c275f86d54491134fceefa9e43cb796c6af982fb75",
+  "@rolldown/binding-android-arm64@npm:1.0.0-rc.15": "0c78d6321d2dedc0c6ed4b5541328f6c04e8530a3c294b477cd9741e2af7c8377a51474f0171c85ecf63bff5c8bb31ee586f40f13fa265a869247ec3d6293204",
+  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.15": "598b8cb87d8ba8df4e880e0d6903f7f4f32b3e7b2804429cb3ccc47a69b8e7b852b2e3115a8c3a882d14979909f9464e8da55c2c52a52cb18a81df7e8a1aa654",
+  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.15": "92fdfa58a8d9edaec4c1766c38c34f657715d2c8faec141590812d11ba6a6ce52530e55a6a2515fcd2ec6287e50187a458f06ca3c6813130cb9869a99c9f6f29",
+  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.15": "04e8288accf007c82e8bbe75af62d4ed570bddd7b25a178506fcf97daa0907cf6f85ea095be5826095242ac1a4923196059f53a9e8fdd0e3c34d9ed1c00d64ae",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.15": "4cd7452e4fe4433b730585bcbaf210efc50621bca5906204179ffe80748bea187398d4091dae64079f0c7ebfea1987f0b1c045ff60209ab0f60be9e04eccbef7",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.15": "fbddea791134b45a94aa5aea640a177d6feacd81a44f9ee3615da3daa824dc2a193ced6e8f2a0bb0676fca7b224525513b451cd8f78b379d7b1983fe6a0360ff",
+  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.15": "b325fa98753bf41100c5d95145f30ce92b5f69f6989973306344b1644fb21633454aa216f28355c74d0e7bd5885bb6d2c80d0f96dcc2b869ca7e63d8b22dbe91",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.15": "0bff0d2724912079dcedfbc0a86dbad8e3e376d2d619cf36917964701b9ae5a39afa5ff49d3cb5b2c3e17437c559314cf8e17433ad3bfb4b64229d9c8bf1ebca",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.15": "6718fd91ead389f3bdefe22fd0344b490d3f9350697e4aa35a0fb55957aa1b127d26aaecf9bc2d49f1dfde62d9d4717cf5dfb7d93ce3b871372ef9c6cb7a1b1a",
+  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.15": "cb7628e1a7398ab5fd07dc79a38c73a27524d45adc989b5d906ea37e23b7692123d607d07fb9fda35485d6caba545ae41c561b9632aefa0bff76997208f83eae",
+  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.15": "f59fb354b8cac55d123f6f3fe7bf8210402f97ed4be3f3a883c6c544ce1b825e36154f479d45f6e9f23c1fcd8861e9f3873dc24278631db871d263db3bea5580",
+  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.15": "b6c220a48ace9c381d238dce2caaa8453da1d3fe9312bab7babf127a500bdec2bbe30bd381f9945af79c30fe9ca0185108b86ef311fc83ecb83ef24f7a587902",
+  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.15": "9cd39e02ad5f43fc45901d074df10c0e3532d9077a6e334e431de60f90555c15e5445d1b5156c10df49d28839f9f15d5d808666bc8e70ab065bb9af3b8567e7a",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.15": "cfc32a72e8a3900f356b0b359520df3f18ac79379a273a4c53b00b1555123dcfd8204cf9976762664898b0c6c949c0edd4be850ae254d2e84a40fcb8352858eb",
+  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.15": "f0bd2876247f0834f135c1ae150b7d5626d54ff399b4a6193626dc46a0eca22374a43c64afdf3eff8e8e9cf1f20df826bcd9fd4219df3fece03972b8ae080e20",
  "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
  "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
  "lightningcss-darwin-x64@npm:1.32.0": "b1d298c9173f839e8447d1917ed8bc5ab098ed0fc4e4b419d36ac5afe8b27bf21cb47d00a35c3d2edadcac598086e9b4f26c992a809d79f9681d6865a230d79e",
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "dokieli";
-  version = "0-unstable-2026-03-25";
+  version = "0-unstable-2026-04-13";

  src = fetchFromGitHub {
    owner = "dokieli";
    repo = "dokieli";
-    rev = "d684e852325b2247b831b179efed5d96c211f864";
-    hash = "sha256-Af8KsH1tqPDuOUEaHRN3ULJwGWgZc5JgFT99sGKkkec=";
+    rev = "6f574408bc914347c3ba27869e61225fabbe6272";
+    hash = "sha256-PSDsV5Gg+JT9qwMBiRkyv/ZiZY9qvqhRuKjEiPMuQDU=";
  };

  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-bUXAYeTJqz11Rl7vaNPNRBTqjLdSr0FrEQBAFLd9oEs=";
+    hash = "sha256-bO3yEh+P8al/oXXjqNOMOpXc0ggc17Wc00WtahniilE=";
  };

  buildPhase = ''
--- a/Show More
+++ b/Show More