Merge staging-next into staging

2026-01-23 18:07:39 +00:00
parent 83408f2ad2 6908e14bb7
commit 1c44e537b3
98 changed files with 3445 additions and 1310 deletions
@@ -18201,6 +18201,14 @@
    githubId = 254145391;
    name = "n3tshift";
  };
+  N4CH723HR3R = {
+    email = "n4ch7@n3831.net";
+    github = "N4CH723HR3R";
+    githubId = 221765713;
+    keys = [ { fingerprint = "C5A6 76E5 DFDD 076B 9B59  ABEC D783 89DC 24B6 4620"; } ];
+    matrix = "@n4ch7:n3831.net";
+    name = "N4CH723HR3R";
+  };
  n8henrie = {
    name = "Nathan Henrie";
    email = "nate@n8henrie.com";
@@ -38,6 +38,10 @@

 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).

+- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
+
+- [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter), a tool used to set up IR cameras, used with Howdy.
+
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.

 - [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).
@@ -52,6 +56,8 @@

 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).

+- The packages `iw` and `wirelesstools` (`iwconfig`, `iwlist`, etc.) are no longer installed implicitly if wireless networking has been enabled.
+
 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
 package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead
 of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set:
@@ -878,6 +878,7 @@
  ./services/misc/languagetool.nix
  ./services/misc/leaps.nix
  ./services/misc/lifecycled.nix
+  ./services/misc/linux-enable-ir-emitter.nix
  ./services/misc/litellm.nix
  ./services/misc/llama-cpp.nix
  ./services/misc/local-content-share.nix
@@ -1489,6 +1490,7 @@
  ./services/security/hockeypuck.nix
  ./services/security/hologram-agent.nix
  ./services/security/hologram-server.nix
+  ./services/security/howdy
  ./services/security/infnoise.nix
  ./services/security/intune.nix
  ./services/security/jitterentropy-rngd.nix
@@ -322,6 +322,28 @@ let
          '';
        };

+        howdy = {
+          enable = lib.mkOption {
+            default = config.security.pam.howdy.enable;
+            defaultText = lib.literalExpression "config.security.pam.howdy.enable";
+            type = lib.types.bool;
+            description = ''
+              Whether to enable the Howdy PAM module.
+
+              If set, users can be authenticated using Howdy, the Windows
+              Hello™-style facial authentication service.
+            '';
+          };
+          control = lib.mkOption {
+            default = config.security.pam.howdy.control;
+            defaultText = lib.literalExpression "config.security.pam.howdy.control";
+            type = lib.types.str;
+            description = ''
+              This option sets the PAM "control" used for this module.
+            '';
+          };
+        };
+
        oathAuth = lib.mkOption {
          default = config.security.pam.oath.enable;
          defaultText = lib.literalExpression "config.security.pam.oath.enable";
@@ -951,6 +973,12 @@ let
                  control = "sufficient";
                  modulePath = "${config.services.fprintd.package}/lib/security/pam_fprintd.so";
                }
+                {
+                  name = "howdy";
+                  enable = cfg.howdy.enable;
+                  control = cfg.howdy.control;
+                  modulePath = "${config.services.howdy.package}/lib/security/pam_howdy.so";
+                }
              ]
              ++
                # Modules in this block require having the password set in PAM_AUTHTOK.
@@ -1797,6 +1825,28 @@ in
      };
    };

+    security.pam.howdy = {
+      enable = lib.mkOption {
+        default = config.services.howdy.enable;
+        defaultText = lib.literalExpression "config.services.howdy.enable";
+        type = lib.types.bool;
+        description = ''
+          Whether to enable the Howdy PAM module.
+
+          If set, users can be authenticated using Howdy, the Windows
+          Hello™-style facial authentication service.
+        '';
+      };
+      control = lib.mkOption {
+        default = config.services.howdy.control;
+        defaultText = lib.literalExpression "config.services.howdy.control";
+        type = lib.types.str;
+        description = ''
+          This option sets the PAM "control" used for this module.
+        '';
+      };
+    };
+
    security.pam.krb5 = {
      enable = lib.mkOption {
        default = config.security.krb5.enable;
@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.linux-enable-ir-emitter;
+in
+{
+  options = {
+    services.linux-enable-ir-emitter = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable IR emitter hardware. Designed to be used with the
+          Howdy facial authentication. After enabling the service, configure
+          the emitter with `sudo linux-enable-ir-emitter configure`.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "linux-enable-ir-emitter" { } // {
+        description = ''
+          Package to use for the Linux Enable IR Emitter service.
+        '';
+      };
+
+      device = lib.mkOption {
+        type = lib.types.str;
+        default = "video2";
+        description = ''
+          IR camera device to depend on. For example, for `/dev/video2`
+          the value would be `video2`. Find this with the command
+          {command}`realpath /dev/v4l/by-path/<generated-driver-name>`.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # https://github.com/EmixamPP/linux-enable-ir-emitter/blob/7e3a6527ef2efccabaeefc5a93c792628325a8db/sources/systemd/linux-enable-ir-emitter.service
+    systemd.services.linux-enable-ir-emitter =
+      let
+        targets = [
+          "suspend.target"
+          "sleep.target"
+          "hybrid-sleep.target"
+          "hibernate.target"
+          "suspend-then-hibernate.target"
+        ];
+      in
+      {
+        description = "Enable the infrared emitter";
+        # Added to match
+        # https://github.com/EmixamPP/linux-enable-ir-emitter/blob/6.1.2/boot_service/systemd/linux-enable-ir-emitter.service
+        # Prevents the program fail to detect the IR camera until a service
+        # restart.
+        preStart = ''
+          ${pkgs.kmod}/bin/modprobe uvcvideo
+          sleep 1
+        '';
+        script = "${lib.getExe cfg.package} --verbose run";
+        serviceConfig.StateDirectory = "linux-enable-ir-emitter";
+        serviceConfig.LogsDirectory = "linux-enable-ir-emitter";
+
+        wantedBy = targets ++ [ "multi-user.target" ];
+        after = targets ++ [ "dev-${cfg.device}.device" ];
+      };
+  };
+}
@@ -19,6 +19,29 @@ in
    openFirewall = (lib.mkEnableOption "") // {
      description = "Whether to open the firewall port (default 45876).";
    };
+    smartmon = {
+      enable = lib.mkOption {
+        default = false;
+        example = true;
+        description = "Include services.beszel.agent.smartmon.package in the Beszel agent path for disk monitoring and add the agent to the disk group.";
+        type = lib.types.bool;
+      };
+      package = lib.mkPackageOption pkgs "smartmontools" { };
+      deviceAllow = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "/dev/sda"
+          "/dev/sdb"
+          "/dev/nvme0"
+        ];
+        description = ''
+          List of device paths to allow access to for SMART monitoring.
+          This is only needed if the ambient capabilities are not sufficient.
+          Devices will be granted read-only access.
+        '';
+      };
+    };

    environment = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
@@ -47,6 +70,11 @@ in
  };

  config = lib.mkIf cfg.enable {
+    services.udev.extraRules = lib.optionalString cfg.smartmon.enable ''
+      # Change NVMe devices to disk group ownership for S.M.A.R.T. monitoring
+      KERNEL=="nvme[0-9]*", GROUP="disk", MODE="0660"
+    '';
+
    systemd.services.beszel-agent = {
      description = "Beszel Server Monitoring Agent";

@@ -57,6 +85,7 @@ in
      environment = cfg.environment;
      path =
        cfg.extraPath
+        ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
        ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
          (lib.getBin config.hardware.nvidia.package)
        ]
@@ -79,14 +108,32 @@ in
          lib.optionals config.virtualisation.docker.enable [ "docker" ]
          ++ lib.optionals (
            config.virtualisation.podman.enable && config.virtualisation.podman.dockerSocket.enable
-          ) [ "podman" ];
+          ) [ "podman" ]
+          ++ lib.optionals cfg.smartmon.enable [ "disk" ];

        DynamicUser = true;
        User = "beszel-agent";
+
+        # Capabilities needed for SMART monitoring
+        AmbientCapabilities = lib.mkIf cfg.smartmon.enable [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+        CapabilityBoundingSet = lib.mkIf cfg.smartmon.enable [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+
+        # Device access for SMART monitoring
+        DeviceAllow = lib.mkIf (cfg.smartmon.enable && cfg.smartmon.deviceAllow != [ ]) (
+          map (device: "${device} r") cfg.smartmon.deviceAllow
+        );
+
        LockPersonality = true;
-        NoNewPrivileges = true;
+        NoNewPrivileges = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable;
        PrivateTmp = true;
-        PrivateUsers = true;
+        PrivateUsers = !cfg.smartmon.enable;
        ProtectClock = true;
        ProtectControlGroups = "strict";
        ProtectHome = "read-only";
@@ -0,0 +1,122 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.howdy;
+  settingsType = pkgs.formats.ini { };
+
+  default_config = {
+    core = {
+      detection_notice = false;
+      timeout_notice = true;
+      no_confirmation = false;
+      suppress_unknown = false;
+      abort_if_ssh = true;
+      abort_if_lid_closed = true;
+      disabled = false;
+      use_cnn = false;
+      workaround = "off";
+    };
+
+    video = {
+      certainty = 3.5;
+      timeout = 4;
+      device_path = "/dev/video2";
+      warn_no_device = true;
+      max_height = 320;
+      frame_width = -1;
+      frame_height = -1;
+      dark_threshold = 60;
+      recording_plugin = "opencv";
+      device_format = "v4l2";
+      force_mjpeg = false;
+      exposure = -1;
+      device_fps = -1;
+      rotate = 0;
+    };
+
+    snapshots = {
+      save_failed = false;
+      save_successful = false;
+    };
+
+    rubberstamps = {
+      enabled = false;
+      stamp_rules = "nod		5s		failsafe     min_distance=12";
+    };
+
+    debug = {
+      end_report = false;
+      verbose_stamps = false;
+      gtk_stdout = false;
+    };
+  };
+in
+{
+  options = {
+    services.howdy = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable Howdy and its PAM module for face recognition. See
+          `services.linux-enable-ir-emitter` for enabling the IR emitter support.
+
+          ::: {.caution}
+          Howdy is not a safe alternative to unlocking with your password. It
+          can be fooled using a well-printed photo.
+
+          Do **not** use it as the sole authentication method for your system.
+          :::
+
+          ::: {.note}
+          By default, the {option}`config.services.howdy.control` option is set
+          to `"required"`, meaning it will act as a second-factor authentication
+          in most services. To change this, set the option to `"sufficient"`.
+          :::
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "howdy" { };
+
+      control = lib.mkOption {
+        type = lib.types.str;
+        default = "required";
+        description = ''
+          PAM control flag to use for Howdy.
+
+          Sets the {option}`security.pam.howdy.control` option.
+
+          Refer to {manpage}`pam.conf(5)` for options.
+        '';
+      };
+
+      settings = lib.mkOption {
+        inherit (settingsType) type;
+        default = default_config;
+        description = ''
+          Howdy configuration file. Refer to
+          <https://github.com/boltgolt/howdy/blob/d3ab99382f88f043d15f15c1450ab69433892a1c/howdy/src/config.ini>
+          for options.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      environment.systemPackages = [ cfg.package ];
+      environment.etc."howdy/config.ini".source = settingsType.generate "howdy-config.ini" cfg.settings;
+      assertions = [
+        {
+          assertion = !(builtins.elem "v4l2loopback" config.boot.kernelModules);
+          message = "Adding 'v4l2loopback' to `boot.kernelModules` causes Howdy to no longer work. Consider adding 'v4l2loopback' to `boot.extraModulePackages` instead.";
+        }
+      ];
+    })
+    {
+      services.howdy.settings = lib.mapAttrsRecursive (name: lib.mkDefault) default_config;
+    }
+  ];
+}
@@ -20,43 +20,8 @@ let

  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);

-  # Basically a tinkered lib.generators.mkKeyValueDefault
-  # It either serializes a top-level definition "key: { values };"
-  # or an expression "key = { values };"
-  mkAttrsString =
-    top:
-    mapAttrsToList (
-      k: v:
-      let
-        sep = if (top && isAttrs v) then ":" else "=";
-      in
-      "${escape [ sep ] k}${sep}${mkValueString v};"
-    );
-
-  # This serializes a Nix expression to the libconfig format.
-  mkValueString =
-    v:
-    if types.bool.check v then
-      boolToString v
-    else if types.int.check v then
-      toString v
-    else if types.float.check v then
-      toString v
-    else if types.str.check v then
-      "\"${escape [ "\"" ] v}\""
-    else if builtins.isList v then
-      "[ ${concatMapStringsSep " , " mkValueString v} ]"
-    else if types.attrs.check v then
-      "{ ${concatStringsSep " " (mkAttrsString false v)} }"
-    else
-      throw ''
-        invalid expression used in option services.picom.settings:
-        ${v}
-      '';
-
-  toConf = attrs: concatStringsSep "\n" (mkAttrsString true cfg.settings);
-
-  configFile = pkgs.writeText "picom.conf" (toConf cfg.settings);
+  libconfig = pkgs.formats.libconfig { };
+  configFile = libconfig.generate "picom.conf" cfg.settings;

 in
 {
@@ -279,56 +244,22 @@ in
      '';
    };

-    settings =
-      with types;
-      let
-        scalar =
-          oneOf [
-            bool
-            int
-            float
-            str
-          ]
-          // {
-            description = "scalar types";
+    settings = mkOption {
+      type = libconfig.type;
+      default = { };
+      example = literalExpression ''
+        blur =
+          { method = "gaussian";
+            size = 10;
+            deviation = 5.0;
          };
-
-        libConfig =
-          oneOf [
-            scalar
-            (listOf libConfig)
-            (attrsOf libConfig)
-          ]
-          // {
-            description = "libconfig type";
-          };
-
-        topLevel = attrsOf libConfig // {
-          description = ''
-            libconfig configuration. The format consists of an attributes
-            set (called a group) of settings. Each setting can be a scalar type
-            (boolean, integer, floating point number or string), a list of
-            scalars or a group itself
-          '';
-        };
-
-      in
-      mkOption {
-        type = topLevel;
-        default = { };
-        example = literalExpression ''
-          blur =
-            { method = "gaussian";
-              size = 10;
-              deviation = 5.0;
-            };
-        '';
-        description = ''
-          Picom settings. Use this option to configure Picom settings not exposed
-          in a NixOS option or to bypass one.  For the available options see the
-          CONFIGURATION FILES section at {manpage}`picom(1)`.
-        '';
-      };
+      '';
+      description = ''
+        Picom settings. Use this option to configure Picom settings not exposed
+        in a NixOS option or to bypass one.  For the available options see the
+        CONFIGURATION FILES section at {manpage}`picom(1)`.
+      '';
+    };
  };

  config = mkIf cfg.enable {
@@ -49,20 +49,22 @@ in
  config =
    let
      activationScript = lib.getExe (
-        pkgs.writeShellApplication {
+        (pkgs.writeShellApplication {
          name = "activate";
          text = config.system.activationScripts.script;
          checkPhase = "";
          bashOptions = [ ];
-        }
+        }).overrideAttrs
+          { preferLocalBuild = true; }
      );
      dryActivationScript = lib.getExe (
-        pkgs.writeShellApplication {
+        (pkgs.writeShellApplication {
          name = "dry-activate";
          text = config.system.dryActivationScript;
          checkPhase = "";
          bashOptions = [ ];
-        }
+        }).overrideAttrs
+          { preferLocalBuild = true; }
      );
    in
    {
@@ -185,7 +185,7 @@ in
      # If networkmanager is enabled, ask it to interface with resolved.
      networking.networkmanager.dns = "systemd-resolved";

-      networking.resolvconf.package = pkgs.systemd;
+      networking.resolvconf.package = config.systemd.package;

      nix.firewall.extraNftablesRules = [
        "ip daddr { 127.0.0.53, 127.0.0.54 } udp dport 53 accept comment \"systemd-resolved listening IPs\""
@@ -213,6 +213,12 @@ let
    # Capsule support
    "capsule@.service"
    "capsule.slice"
+
+    # Factory reset
+    "factory-reset.target"
+    "systemd-factory-reset-request.service"
+    "systemd-factory-reset-reboot.service"
+    "systemd-tpm2-clear.service"
  ]
  ++ cfg.additionalUpstreamSystemUnits;

@@ -222,6 +228,7 @@ let
    "local-fs.target.wants"
    "multi-user.target.wants"
    "timers.target.wants"
+    "factory-reset.target.wants"
  ];

  proxy_env = config.networking.proxy.envVars;
@@ -65,6 +65,8 @@ let
    "syslog.socket"
    "systemd-ask-password-console.path"
    "systemd-ask-password-console.service"
+    "systemd-factory-reset-complete.service"
+    "factory-reset-now.target"
    "systemd-fsck@.service"
    "systemd-halt.service"
    "systemd-hibernate-resume.service"
@@ -555,6 +557,7 @@ in
        "${cfg.package}/lib/systemd/systemd-sysctl"
        "${cfg.package}/lib/systemd/systemd-bsod"
        "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check"
+        "${cfg.package}/lib/systemd/systemd-factory-reset"

        # generators
        "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
@@ -562,6 +565,7 @@ in
        "${cfg.package}/lib/systemd/system-generators/systemd-gpt-auto-generator"
        "${cfg.package}/lib/systemd/system-generators/systemd-hibernate-resume-generator"
        "${cfg.package}/lib/systemd/system-generators/systemd-run-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-factory-reset-generator"

        # utilities needed by systemd
        "${cfg.package.util-linux}/bin/mount"
@@ -1770,13 +1770,9 @@ in

    environment.corePackages = [
      pkgs.host
-      pkgs.hostname-debian
+      pkgs.hostname
      pkgs.iproute2
-      pkgs.iputils
-    ]
-    ++ optionals config.networking.wireless.enable [
-      pkgs.wirelesstools # FIXME: obsolete?
-      pkgs.iw
+      pkgs.iputils # ping
    ]
    ++ bridgeStp;

@@ -1107,6 +1107,9 @@ in
  nixos-rebuild-specialisations = runTestOn [ "x86_64-linux" ] {
    imports = [ ./nixos-rebuild-specialisations.nix ];
  };
+  nixos-rebuild-store-path = runTestOn [ "x86_64-linux" ] {
+    imports = [ ./nixos-rebuild-store-path.nix ];
+  };
  nixos-rebuild-target-host = runTest {
    imports = [ ./nixos-rebuild-target-host.nix ];
  };
@@ -0,0 +1,101 @@
+{ hostPkgs, ... }:
+{
+  name = "nixos-rebuild-store-path";
+
+  # TODO: remove overlay from  nixos/modules/profiles/installation-device.nix
+  #        make it a _small package instead, then remove pkgsReadOnly = false;.
+  node.pkgsReadOnly = false;
+
+  nodes = {
+    machine =
+      { lib, pkgs, ... }:
+      {
+        imports = [
+          ../modules/profiles/installation-device.nix
+          ../modules/profiles/base.nix
+        ];
+
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
+
+        system.includeBuildDependencies = true;
+
+        system.extraDependencies = [
+          # Not part of the initial build apparently?
+          pkgs.grub2
+        ];
+
+        system.switch.enable = true;
+
+        virtualisation = {
+          cores = 2;
+          memorySize = 4096;
+        };
+      };
+  };
+
+  testScript =
+    let
+      configFile =
+        hostname:
+        hostPkgs.writeText "configuration.nix" # nix
+          ''
+            { lib, pkgs, ... }: {
+              imports = [
+                ./hardware-configuration.nix
+                <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
+              ];
+
+              boot.loader.grub = {
+                enable = true;
+                device = "/dev/vda";
+                forceInstall = true;
+              };
+
+              documentation.enable = false;
+
+              networking.hostName = "${hostname}";
+            }
+          '';
+
+    in
+    # python
+    ''
+      machine.start()
+      machine.succeed("udevadm settle")
+      machine.wait_for_unit("multi-user.target")
+
+      machine.succeed("nixos-generate-config")
+
+      with subtest("Build configuration without switching"):
+          machine.copy_from_host(
+              "${configFile "store-path-test"}",
+              "/etc/nixos/configuration.nix",
+          )
+          store_path = machine.succeed("nix-build '<nixpkgs/nixos>' -A system --no-out-link").strip()
+          machine.succeed(f"test -f {store_path}/nixos-version")
+
+      with subtest("Switch using --store-path"):
+          machine.succeed(f"nixos-rebuild switch --store-path {store_path}")
+          hostname = machine.succeed("cat /etc/hostname").strip()
+          assert hostname == "store-path-test", f"Expected hostname 'store-path-test', got '{hostname}'"
+
+      with subtest("Test using --store-path"):
+          machine.copy_from_host(
+              "${configFile "store-path-test-2"}",
+              "/etc/nixos/configuration.nix",
+          )
+          store_path_2 = machine.succeed("nix-build '<nixpkgs/nixos>' -A system --no-out-link").strip()
+          machine.succeed(f"nixos-rebuild test --store-path {store_path_2}")
+          hostname = machine.succeed("cat /etc/hostname").strip()
+          assert hostname == "store-path-test-2", f"Expected hostname 'store-path-test-2', got '{hostname}'"
+
+      with subtest("Ensure --store-path rejects invalid combinations"):
+          machine.fail(f"nixos-rebuild switch --store-path {store_path} --rollback")
+          machine.fail(f"nixos-rebuild switch --store-path {store_path} --flake .")
+          machine.fail(f"nixos-rebuild build --store-path {store_path}")
+    '';
+}
@@ -277,4 +277,106 @@ in
        assert "Adding new partition 2 to partition table." in systemd_repart_logs
      '';
  };
+
+  factory-reset = makeTest {
+    name = "systemd-repart-factory-reset";
+    meta.maintainers = with maintainers; [ willibutz ];
+
+    nodes.machine =
+      { pkgs, lib, ... }:
+      {
+        imports = [ common ];
+
+        virtualisation = {
+          useEFIBoot = true;
+          tpm.enable = true;
+          efi.OVMF = pkgs.OVMFFull;
+          useDefaultFilesystems = false;
+          fileSystems = {
+            "/state" = {
+              device = "/dev/mapper/state";
+              fsType = "ext4";
+            };
+          };
+        };
+
+        boot = {
+          loader.systemd-boot.enable = true;
+
+          initrd = {
+            systemd = {
+              enable = true;
+              # avoids reaching cryptsetup.target before recreation of the
+              # "state" volume completed, during the factory reset
+              services.systemd-repart.before = [
+                "systemd-cryptsetup@state.service"
+              ];
+              repart = {
+                enable = true;
+                extraArgs = [
+                  "--tpm2-pcrs=platform-code"
+                ];
+              };
+            };
+            luks.devices = lib.mkVMOverride {
+              state = {
+                device = "/dev/disk/by-partlabel/state";
+                crypttabExtraOpts = [ "tpm2-device=auto" ];
+              };
+            };
+          };
+        };
+
+        systemd.repart.partitions = {
+          "10-esp".Type = "esp";
+          "20-root".Type = "linux-generic";
+          "30-state" = {
+            Type = "linux-generic";
+            Label = "state";
+            Format = "ext4";
+            Encrypt = "tpm2";
+            SizeMinBytes = "64M";
+            SizeMaxBytes = "64M";
+            FactoryReset = true;
+          };
+        };
+
+        # doesn't actually reboot through the service because otherwise the test
+        # instrumentation becomes very unreliable, instead uses machine.reboot()
+        systemd.services.systemd-factory-reset-reboot.enable = false;
+      };
+
+    testScript =
+      { nodes, ... }:
+      # python
+      ''
+        ${useDiskImage {
+          inherit (nodes) machine;
+          sizeDiff = "+64M";
+        }}
+
+        machine.start(allow_reboot=True)
+        machine.wait_for_unit("default.target")
+
+        first_uuid = machine.succeed("blkid -s UUID -o value /dev/disk/by-label/state")
+
+        machine.succeed("mountpoint /state")
+        machine.succeed("touch /state/foo")
+
+        with subtest("factory reset requested through target"):
+          machine.systemctl("start factory-reset.target")
+
+        # reboot manually to keep control over test vm
+        machine.reboot()
+        machine.wait_for_unit("default.target")
+
+        with subtest("state partition recreated and empty after reset"):
+          second_uuid = machine.succeed("blkid -s UUID -o value /dev/disk/by-label/state")
+          t.assertNotEqual(first_uuid, second_uuid)
+
+          machine.succeed("mountpoint /state")
+          machine.fail("test -e /state/foo")
+      '';
+  };
+
 }
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.15";
-    hash = "sha256-BtVxSVp80qlZhMrh872+0DQ7sTskEdP/5p5T7n9jeGU=";
+    version = "2.1.17";
+    hash = "sha256-m8uRQeTyM0iM7sCSwKABnQH2dxMo/CGqC97ybW6Oq7g=";
  };

  postInstall = ''
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "147.0-1",
+  "packageVersion": "147.0.1-3",
  "source": {
-    "rev": "147.0-1",
-    "hash": "sha256-LZE4d1z4djtGSrnFsh1i9GXvFbK55RQMcqyID9ui0Ng="
+    "rev": "147.0.1-3",
+    "hash": "sha256-0BeC3zlL5cvnpTaPnKn26lT1XlvqBQuMc4rauNbeIIk="
  },
  "firefox": {
-    "version": "147.0",
-    "hash": "sha512-rJAXsaLaey8Tk5LDlMNjQf00duPU6ho8fl578QDcMNGFEy75JWvn5rD52/xpI0rFceofxtudhFQ7FXcvTshRYQ=="
+    "version": "147.0.1",
+    "hash": "sha512-8eG8SGRRJU8zsAD7RRP9lIpaboSEGYDudnxC0ybhhW9EqEN8j9v/LLNNF3/qKxkH/Nct0zvOw/Bt242IFRhTqA=="
  }
 }
@@ -9,29 +9,15 @@
  pkg-config,
  alsa-lib,
  xorg,
+  fontconfig,
  freetype,
-  libGLU,
  libjack2,
  juce,
-  webkitgtk_4_1,
-  libsysprof-capture,
-  pcre2,
-  util-linux,
-  libselinux,
-  libsepol,
-  libthai,
-  libxkbcommon,
-  libdatrie,
-  libepoxy,
  libsoup_3,
-  lerc,
-  sqlite,
  libdeflate,
  xz,
  libwebp,
  glib,
-  gtk3-x11,
-  curl,
  vcv-rack,
  jansson,
  glew,
@@ -56,7 +42,7 @@ let

  vcvRackSdk = srcOnly vcv-rack;
  pname = "airwin2rack";
-  version = "2.13.0-unstable-2025-12-07";
+  version = "2.13.0-unstable-2026-01-19";
 in
 stdenv.mkDerivation {
  inherit pname;
@@ -65,8 +51,8 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "baconpaul";
    repo = "airwin2rack";
-    rev = "a797d6c7a453006c6a08db32d7bb373ecccb572b";
-    hash = "sha256-+xGLVp4eR7Xb2dSEyfyHfAcoZGRSzL49l/U89N2VX+w=";
+    rev = "ed3700c223be0fd5eddf6d57b66216fff8389c2c";
+    hash = "sha256-JHARxie6y3mD/ZLEMGmfK8/b5GBcN/7lHpm7kI5BpTs=";
    fetchSubmodules = true;
  };

@@ -105,27 +91,11 @@ stdenv.mkDerivation {
    xorg.libXinerama
    xorg.libXrandr
    xorg.libXrender
-    xorg.libXtst
-    xorg.libXdmcp
-    libGLU
+    fontconfig
    libjack2
    freetype
-    webkitgtk_4_1
    glib
-    gtk3-x11
-    curl
-    libsysprof-capture
-    pcre2
-    util-linux
-    libselinux
-    libsepol
-    libthai
-    libxkbcommon
-    libdatrie
-    libepoxy
    libsoup_3
-    lerc
-    sqlite
    libdeflate
    xz # liblzma
    libwebp
@@ -208,14 +178,12 @@ stdenv.mkDerivation {
      "-lXinerama"
      "-lXrandr"
      "-lXrender"
-      "-lXtst"
-      "-lXdmcp"
    ]
  );

  meta = {
    description = "JUCE Plugin Version of Airwindows Consolidated";
-    homepage = "https://airwindows.com/";
+    homepage = "https://github.com/baconpaul/airwin2rack";
    platforms = [ "x86_64-linux" ];
    license =
      with lib.licenses;
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2328";
+  version = "2.0.2334";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-6+rb7eNPkifuIMsFs2YO0v27CY6RNWnHrzHYoVhtYCw=";
+    hash = "sha256-4/GKOjUSlj+upjGg0B642HRolCA46N+B2fM3fL1ip6Y=";
  };

-  npmDepsHash = "sha256-Q0vdon6Qbt5FOjKZJqB5ufiLcG18DPgL4EN9PSkoXDE=";
+  npmDepsHash = "sha256-fBoHOmMvmNSmldwME8i7Xo2C2koYcAo4aTsU+JIptcs=";

  passthru.updateScript = nix-update-script { };

@@ -79,6 +79,13 @@ stdenv.mkDerivation rec {

  makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];

+  outputs = [
+    "out"
+    "dev"
+    "man"
+    "lib"
+  ];
+
  enableParallelBuilding = true;

  doInstallCheck = true;
@@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.1.15",
+  "version": "2.1.17",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.1.15",
+      "version": "2.1.17",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.1.15";
+  version = "2.1.17";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-3zhjeAwKj1fMLuriX1qpVA8zaCk1oekJ1UmeEdDx4Xg=";
+    hash = "sha256-cLJ8qKa8OhGpjdB7l1KAcG73EvH5T+OUww3flAKWihI=";
  };

-  npmDepsHash = "sha256-K5re0co3Tkz5peXHe/UUlsqAWq4YzSULdY9+xncfL5A=";
+  npmDepsHash = "sha256-aUqPXF5L78wZ34pNRvpEJi6l2wl15Og1yCEvVoeV0tE=";

  strictDeps = true;

@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "code";
-  version = "0.6.45";
+  version = "0.6.49";

  src = fetchFromGitHub {
    owner = "just-every";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ycl+r0fcopsWhT2QsRYPKWGRcXRyylgUalFBOgFF800=";
+    hash = "sha256-iklIQPs44SjJlQq+qkuyuCQLfv+xcmvmBDSIweFsSTs=";
  };

  sourceRoot = "${finalAttrs.src.name}/code-rs";
@@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "corepack";
-  version = "0.34.4";
+  version = "0.34.6";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "corepack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AE2tDeDs1wzDdTrkG/ic2ydQC8G2wcaKD6s7ec7p+Ew=";
+    hash = "sha256-Wht1w6irfjj4cG4O1mWaP+uWvi794CsxoQPhk3uoKcw=";
  };

  patches = [
@@ -45,7 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      patches
      src
      ;
-    hash = "sha256-Yzm3PtdbR9Tx2bisdzTw0XGD6rAc/KUCzmhjGuXdft4=";
+    hash = "sha256-kngfdPGent5u231BFOzDLZFLp+EueDrm88iLbSoo5+g=";
  };

  postPatch = ''
@@ -1,35 +1,25 @@
 diff --git a/package.json b/package.json
-index fc8f2469ed5..7b3881e2a5d 100644
+index f2778bc2031..10496858378 100644
 --- a/package.json
 +++ b/package.json
-@@ -26,7 +26,6 @@
-     "@yarnpkg/eslint-config": "^3.0.0",
-     "@yarnpkg/fslib": "^3.0.0-rc.48",
+@@ -28,3 +28,2 @@
     "@zkochan/cmd-shim": "^6.0.0",
 -    "better-sqlite3": "^11.7.2",
     "clipanion": "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch",
-     "debug": "^4.1.1",
-     "esbuild": "^0.25.0",
 diff --git a/tests/recordRequests.js b/tests/recordRequests.js
 index b78edad0e44..27667abbae4 100644
 --- a/tests/recordRequests.js
 +++ b/tests/recordRequests.js
-@@ -1,7 +1,7 @@
- "use strict";
- const path = require(`node:path`);
+@@ -3,3 +3,3 @@ const path = require(`node:path`);
 const crypto = require(`node:crypto`);
 -const SQLite3 = require(`better-sqlite3`);
 +const { DatabaseSync: SQLite3 } = require(`node:sqlite`);
 
- const db = new SQLite3(path.join(__dirname, `nocks.db`));
- process.once(`exit`, () => {
 diff --git a/yarn.lock b/yarn.lock
-index fc5bd2b1248..46777cbe979 100644
+index a2f193d1ee0..74f52dc46d9 100644
 --- a/yarn.lock
 +++ b/yarn.lock
-@@ -1145,44 +1145,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1147,40 +1147,2 @@ __metadata:
 
 -"base64-js@npm:^1.3.1":
 -  version: 1.5.1
@@ -70,11 +60,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "brace-expansion@npm:^1.1.7":
-   version: 1.1.12
-   resolution: "brace-expansion@npm:1.1.12"
-@@ -1211,16 +1173,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1213,12 +1175,2 @@ __metadata:
 
 -"buffer@npm:^5.5.0":
 -  version: 5.7.1
@@ -87,11 +73,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "cac@npm:^6.7.14":
-   version: 6.7.14
-   resolution: "cac@npm:6.7.14"
-@@ -1316,13 +1268,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1318,9 +1270,2 @@ __metadata:
 
 -"chownr@npm:^1.1.1":
 -  version: 1.1.4
@@ -101,19 +83,11 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "chownr@npm:^3.0.0":
-   version: 3.0.0
-   resolution: "chownr@npm:3.0.0"
-@@ -1394,7 +1339,6 @@ __metadata:
-     "@yarnpkg/eslint-config": "npm:^3.0.0"
-     "@yarnpkg/fslib": "npm:^3.0.0-rc.48"
+@@ -1396,3 +1341,2 @@ __metadata:
     "@zkochan/cmd-shim": "npm:^6.0.0"
 -    better-sqlite3: "npm:^11.7.2"
     clipanion: "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch"
-     debug: "npm:^4.1.1"
-     esbuild: "npm:^0.25.0"
-@@ -1468,15 +1412,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1470,11 +1414,2 @@ __metadata:
 
 -"decompress-response@npm:^6.0.0":
 -  version: 6.0.0
@@ -125,11 +99,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "deep-eql@npm:^5.0.1":
-   version: 5.0.2
-   resolution: "deep-eql@npm:5.0.2"
-@@ -1484,13 +1419,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1486,9 +1421,2 @@ __metadata:
 
 -"deep-extend@npm:^0.6.0":
 -  version: 0.6.0
@@ -139,11 +109,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "deep-is@npm:^0.1.3":
-   version: 0.1.4
-   resolution: "deep-is@npm:0.1.4"
-@@ -1520,13 +1448,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1522,9 +1450,2 @@ __metadata:
 
 -"detect-libc@npm:^2.0.0":
 -  version: 2.1.2
@@ -153,11 +119,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "doctrine@npm:^2.1.0":
-   version: 2.1.0
-   resolution: "doctrine@npm:2.1.0"
-@@ -1577,15 +1498,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1579,11 +1500,2 @@ __metadata:
 
 -"end-of-stream@npm:^1.1.0, end-of-stream@npm:^1.4.1":
 -  version: 1.4.5
@@ -169,11 +131,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "env-paths@npm:^2.2.0":
-   version: 2.2.1
-   resolution: "env-paths@npm:2.2.1"
-@@ -2004,13 +1916,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2006,9 +1918,2 @@ __metadata:
 
 -"expand-template@npm:^2.0.3":
 -  version: 2.0.3
@@ -183,11 +141,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "expect-type@npm:^1.2.1":
-   version: 1.2.2
-   resolution: "expect-type@npm:1.2.2"
-@@ -2089,13 +1994,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2091,9 +1996,2 @@ __metadata:
 
 -"file-uri-to-path@npm:1.0.0":
 -  version: 1.0.0
@@ -197,11 +151,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "fill-range@npm:^7.1.1":
-   version: 7.1.1
-   resolution: "fill-range@npm:7.1.1"
-@@ -2151,13 +2049,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2153,9 +2051,2 @@ __metadata:
 
 -"fs-constants@npm:^1.0.0":
 -  version: 1.0.0
@@ -211,11 +161,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "fs-minipass@npm:^3.0.0":
-   version: 3.0.3
-   resolution: "fs-minipass@npm:3.0.3"
-@@ -2272,13 +2163,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2274,9 +2165,2 @@ __metadata:
 
 -"github-from-package@npm:0.0.0":
 -  version: 0.0.0
@@ -225,11 +171,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "glob-parent@npm:^5.1.2":
-   version: 5.1.2
-   resolution: "glob-parent@npm:5.1.2"
-@@ -2451,13 +2335,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2453,9 +2337,2 @@ __metadata:
 
 -"ieee754@npm:^1.1.13":
 -  version: 1.2.1
@@ -239,11 +181,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "ignore@npm:^5.2.0":
-   version: 5.3.2
-   resolution: "ignore@npm:5.3.2"
-@@ -2489,20 +2366,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2491,16 +2368,2 @@ __metadata:
 
 -"inherits@npm:^2.0.3, inherits@npm:^2.0.4":
 -  version: 2.0.4
@@ -260,11 +198,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "internal-slot@npm:^1.1.0":
-   version: 1.1.0
-   resolution: "internal-slot@npm:1.1.0"
-@@ -2982,13 +2845,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2984,9 +2847,2 @@ __metadata:
 
 -"mimic-response@npm:^3.1.0":
 -  version: 3.1.0
@@ -273,12 +207,8 @@ index fc5bd2b1248..46777cbe979 100644
 -  languageName: node
 -  linkType: hard
 -
- "minimatch@npm:^10.0.3":
-   version: 10.1.1
-   resolution: "minimatch@npm:10.1.1"
-@@ -3016,13 +2872,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+ "minimatch@npm:^10.1.1":
+@@ -3018,9 +2874,2 @@ __metadata:
 
 -"minimist@npm:^1.2.0, minimist@npm:^1.2.3":
 -  version: 1.2.8
@@ -288,11 +218,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "minipass-collect@npm:^2.0.1":
-   version: 2.0.1
-   resolution: "minipass-collect@npm:2.0.1"
-@@ -3099,13 +2948,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3101,9 +2950,2 @@ __metadata:
 
 -"mkdirp-classic@npm:^0.5.2, mkdirp-classic@npm:^0.5.3":
 -  version: 0.5.3
@@ -302,11 +228,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "ms@npm:^2.1.3":
-   version: 2.1.3
-   resolution: "ms@npm:2.1.3"
-@@ -3122,13 +2964,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3124,9 +2966,2 @@ __metadata:
 
 -"napi-build-utils@npm:^2.0.0":
 -  version: 2.0.0
@@ -316,11 +238,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "natural-compare@npm:^1.4.0":
-   version: 1.4.0
-   resolution: "natural-compare@npm:1.4.0"
-@@ -3143,15 +2978,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3145,11 +2980,2 @@ __metadata:
 
 -"node-abi@npm:^3.3.0":
 -  version: 3.85.0
@@ -332,11 +250,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "node-gyp@npm:latest":
-   version: 12.1.0
-   resolution: "node-gyp@npm:12.1.0"
-@@ -3254,15 +3080,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3256,11 +3082,2 @@ __metadata:
 
 -"once@npm:^1.3.1, once@npm:^1.4.0":
 -  version: 1.4.0
@@ -348,11 +262,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "optionator@npm:^0.9.3":
-   version: 0.9.4
-   resolution: "optionator@npm:0.9.4"
-@@ -3413,28 +3230,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3415,24 +3232,2 @@ __metadata:
 
 -"prebuild-install@npm:^7.1.1":
 -  version: 7.1.3
@@ -377,11 +287,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "prelude-ls@npm:^1.2.1":
-   version: 1.2.1
-   resolution: "prelude-ls@npm:1.2.1"
-@@ -3477,16 +3272,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3479,12 +3274,2 @@ __metadata:
 
 -"pump@npm:^3.0.0":
 -  version: 3.0.3
@@ -394,11 +300,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "punycode@npm:^2.1.0":
-   version: 2.3.1
-   resolution: "punycode@npm:2.3.1"
-@@ -3501,20 +3286,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3503,16 +3288,2 @@ __metadata:
 
 -"rc@npm:^1.2.7":
 -  version: 1.2.8
@@ -415,11 +317,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "react-is@npm:^16.13.1":
-   version: 16.13.1
-   resolution: "react-is@npm:16.13.1"
-@@ -3522,17 +3293,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3524,13 +3295,2 @@ __metadata:
 
 -"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0":
 -  version: 3.6.2
@@ -433,11 +331,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "reflect.getprototypeof@npm:^1.0.6, reflect.getprototypeof@npm:^1.0.9":
-   version: 1.0.10
-   resolution: "reflect.getprototypeof@npm:1.0.10"
-@@ -3720,13 +3480,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3722,9 +3482,2 @@ __metadata:
 
 -"safe-buffer@npm:^5.0.1, safe-buffer@npm:~5.2.0":
 -  version: 5.2.1
@@ -447,11 +341,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "safe-push-apply@npm:^1.0.0":
-   version: 1.0.0
-   resolution: "safe-push-apply@npm:1.0.0"
-@@ -3888,24 +3641,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3890,20 +3643,2 @@ __metadata:
 
 -"simple-concat@npm:^1.0.0":
 -  version: 1.0.1
@@ -472,11 +362,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "smart-buffer@npm:^4.2.0":
-   version: 4.2.0
-   resolution: "smart-buffer@npm:4.2.0"
-@@ -4074,15 +3809,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4076,11 +3811,2 @@ __metadata:
 
 -"string_decoder@npm:^1.1.1":
 -  version: 1.3.0
@@ -488,11 +374,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
-   version: 6.0.1
-   resolution: "strip-ansi@npm:6.0.1"
-@@ -4108,13 +3834,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4110,9 +3836,2 @@ __metadata:
 
 -"strip-json-comments@npm:~2.0.1":
 -  version: 2.0.1
@@ -502,11 +384,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "strip-literal@npm:^3.0.0":
-   version: 3.1.0
-   resolution: "strip-literal@npm:3.1.0"
-@@ -4147,31 +3866,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4149,27 +3868,2 @@ __metadata:
 
 -"tar-fs@npm:^2.0.0":
 -  version: 2.1.4
@@ -533,12 +411,8 @@ index fc5bd2b1248..46777cbe979 100644
 -  languageName: node
 -  linkType: hard
 -
- "tar@npm:^7.4.0, tar@npm:^7.5.2":
-   version: 7.5.2
-   resolution: "tar@npm:7.5.2"
-@@ -4271,15 +3965,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+ "tar@npm:^7.5.2, tar@npm:^7.5.4":
+@@ -4273,11 +3967,2 @@ __metadata:
 
 -"tunnel-agent@npm:^0.6.0":
 -  version: 0.6.0
@@ -550,11 +424,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "typanion@npm:^3.8.0":
-   version: 3.14.0
-   resolution: "typanion@npm:3.14.0"
-@@ -4422,13 +4107,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4424,9 +4109,2 @@ __metadata:
 
 -"util-deprecate@npm:^1.0.1":
 -  version: 1.0.2
@@ -564,11 +434,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "v8-compile-cache@npm:^2.3.0":
-   version: 2.4.0
-   resolution: "v8-compile-cache@npm:2.4.0"
-@@ -4697,13 +4375,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4699,9 +4377,2 @@ __metadata:
 
 -"wrappy@npm:1":
 -  version: 1.0.2
@@ -578,5 +444,3 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "yallist@npm:^4.0.0":
-   version: 4.0.0
-   resolution: "yallist@npm:4.0.0"
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2025-12-04";
+  version = "0-unstable-2026-01-23";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "bed368eb0d901ec4b7921a8d704ca469b7fb4e19";
-    hash = "sha256-Y9qSqU8BsAcD+uBmAvKYzlZFJ7LZAdbtSt1Lc59iOG0=";
+    rev = "484857522c73318c06f18ba0a3e17525fa98c608";
+    hash = "sha256-Uq+UINIXc3uuqS7MwbTQ5pL72KmknM33/3CLH21Od/Y=";
  };

  outputs = [
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
  pname = "dart-sass";
-  version = "1.97.2";
+  version = "1.97.3";

  src = fetchFromGitHub {
    owner = "sass";
    repo = "dart-sass";
    tag = version;
-    hash = "sha256-/T3kD2Xu9JESEbbeEhXwZRzN1uo/jgnfjmxjv6hZ/7o=";
+    hash = "sha256-9yhjqkWmtSqdLcmZWvHcz46xqN7yd27Quygg/I+WHag=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -374,11 +374,11 @@
      "dependency": "direct main",
      "description": {
        "name": "meta",
-        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
+        "sha256": "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.17.0"
+      "version": "1.18.0"
    },
    "mime": {
      "dependency": "transitive",
@@ -494,21 +494,21 @@
      "dependency": "direct main",
      "description": {
        "name": "protobuf",
-        "sha256": "2fcc8a202ca7ec17dab7c97d6b6d91cf03aa07fe6f65f8afbb6dfa52cc5bd902",
+        "sha256": "75ec242d22e950bdcc79ee38dd520ce4ee0bc491d7fadc4ea47694604d22bf06",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "5.1.0"
+      "version": "6.0.0"
    },
    "protoc_plugin": {
      "dependency": "direct dev",
      "description": {
        "name": "protoc_plugin",
-        "sha256": "d43d92eeec74bf1da8e790570c1ef7cf00cdc47566ad62e2455f1deaab03a22b",
+        "sha256": "d1ea363e9118f954d9d482c2f7281c5ff5149b059e68672d1faa564d49091f05",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "24.0.0"
+      "version": "25.0.0"
    },
    "pub_api_client": {
      "dependency": "direct dev",
@@ -0,0 +1,40 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  openssl,
+  fontconfig,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "emissary";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "altonen";
+    repo = "emissary";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-A3Kkod2oQdprswoEY9Z6A5r2PsHMUEwqyDB8ycSEUqQ=";
+  };
+  cargoHash = "sha256-alruzRWeLGwfiX/kj7grC7+fgu6i0/T/EJwrF/0VDtw=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    fontconfig
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    changelog = "https://github.com/altonen/emissary/releases/tag/${finalAttrs.version}";
+    description = "Rust implementation of the I2P protocol stack";
+    homepage = "https://altonen.github.io/emissary/";
+    license = lib.licenses.mit; # https://github.com/altonen/emissary/blob/master/LICENSE (found an apache2 as well but thats for https://github.com/altonen/emissary/commit/c4a1c849ebfceba892adce53f512f1f099721de2)
+    mainProgram = "emissary";
+    maintainers = [ lib.maintainers.N4CH723HR3R ];
+  };
+})
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "examine";
-  version = "1.0.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "examine";
    tag = finalAttrs.version;
-    hash = "sha256-9xYUJeAYqnDYZzjWM21HuSNDY+ZcUlTdj/g/MUH2A54=";
+    hash = "sha256-6U8reOzeqamX/MG/mWbso+kjuZQ6cK8j9XhuEtGZ1q4=";
  };

-  cargoHash = "sha256-BcBCPkahV6+xw+K+Vk4QjwX5QI1j4hNkD9YTyL24iRA=";
+  cargoHash = "sha256-V+ClzaG7LnkOl84j5mVGJPTLVfaVqxaSH7ufmjXdwyM=";

  nativeBuildInputs = [
    just
@@ -14,14 +14,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.72.tar.xz"
+          "factorio_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.72.tar.xz",
+        "name": "factorio_alpha_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "87d9f593569cbdf2f7a160f6a573f4939cbf01206209fbcdbaebf0385c2c7331",
+        "sha256": "68280b39bd01d7647df0cfa0e291d82c8123ffc2d522c8565860f6d52a7673eb",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/alpha/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/alpha/linux64",
+        "version": "2.0.73"
      }
    },
    "demo": {
@@ -38,14 +38,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.69.tar.xz"
+          "factorio-demo_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_demo_x64-2.0.69.tar.xz",
+        "name": "factorio_demo_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "a670a4cd2fa59cb8dc6db10d969867266080f171e47ebed78880ccd5ed42356c",
+        "sha256": "1c04ab58fe5e47eb83ba984014e355e8edbc7f941f655bad0b1ff0c5e68bd0f2",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.69/demo/linux64",
-        "version": "2.0.69"
+        "url": "https://factorio.com/get-download/2.0.73/demo/linux64",
+        "version": "2.0.73"
      }
    },
    "expansion": {
@@ -62,14 +62,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.72.tar.xz"
+          "factorio-space-age_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.72.tar.xz",
+        "name": "factorio_expansion_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "9a667dd899ad4c8c410739a1da3a9318b46a5f34ee190e8b75ec22beac708249",
+        "sha256": "85d7223258f0001cd943004f30cb4d4f4c1a05d1f0fd3d19e05bc42c42b0d7a4",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/expansion/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/expansion/linux64",
+        "version": "2.0.73"
      }
    },
    "headless": {
@@ -87,15 +87,15 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.72.tar.xz",
-          "factorio_headless_x64_2.0.72.tar.xz"
+          "factorio-headless_linux_2.0.73.tar.xz",
+          "factorio_headless_x64_2.0.73.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.72.tar.xz",
+        "name": "factorio_headless_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "cf3057340dbc9d82bd5161949ae3e7b8fad912ec7ca07b8a3151e0424a5568cd",
+        "sha256": "752025f81b5ec1229919edc869f9c8773db4bb548a90d370f85938236c857d9a",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/headless/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/headless/linux64",
+        "version": "2.0.73"
      }
    }
  }
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "filtr";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "filtr";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-LRVwJ/Eh+XeNGnlbd2c56hWV8StHZGhxy0XLjGZ0toY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "FILTR_artefacts/Release/LV2/FILT-R.lv2" $out/lib/lv2
+    cp -r "FILTR_artefacts/Release/VST3/FILT-R.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Envelope based filter modulator";
+    homepage = "https://github.com/tiagolr/filtr";
+    changelog = "https://github.com/tiagolr/filtr/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -49,17 +49,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "12.5.3";
+  version = "12.6.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-qCk2GvPWKIQfEjYtx2Uc7GcVDehUu0/u4LP88FxoA9A=";
+    hash = "sha256-Otvv8NSGfze/WKN78nipVWkycqHh94ReHkVjYR8L0/E=";
  };

-  vendorHash = "sha256-pGLZmSW7MKEy/K+njgcPv5a+7Qtf8mqUI4OwKhfEZXY=";
+  vendorHash = "sha256-fvSiEIE4XSJ8Ot4Tcmt8chD11fHVsECD2/8xrgIKhJs=";

  nativeBuildInputs = [ makeWrapper ];

@@ -6,22 +6,21 @@
  openssl,
  gzip,
  gitMinimal,
-  deno,
  nix-update-script,
  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fresh";
-  version = "0.1.86";
+  version = "0.1.87";

  src = fetchFromGitHub {
    owner = "sinelaw";
    repo = "fresh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o67oowSU1V9Cy2RvLEaZ5J3CPX2kD7qByDOc+8gpDq8=";
+    hash = "sha256-th4wlkGP9WNdRRhJy3pBC5dcqRbkUooM65FoftQHqBE=";
  };

-  cargoHash = "sha256-I78sdf/p5TZZufMZF8rETRb91veklwNHHByHF1WbLgk=";
+  cargoHash = "sha256-6b4iDXJme3uanEfz/e4jI1kqljaH8iOqS+7p1MPwhY4=";

  nativeBuildInputs = [
    pkg-config
@@ -37,10 +36,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    openssl
  ];

-  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
-  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
-  env.RUSTY_V8_ARCHIVE = deno.librusty_v8;
-
  preBuild = ''
    mkdir -p $out/share/fresh-editor/plugins/
  '';
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gate12";
+  version = "1.3.3";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "gate12";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-dyeIWD315+aKZRwtkRYaWNOS8bNDFboMVPHHe7l+IIY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "GATE12_artefacts/Release/LV2/GATE-12.lv2" $out/lib/lv2
+    cp -r "GATE12_artefacts/Release/VST3/GATE-12.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Trance gate / volume shaper";
+    homepage = "https://github.com/tiagolr/gate12";
+    changelog = "https://github.com/tiagolr/gate12/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -8,7 +8,7 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  name = "gdb-dashboard";
+  pname = "gdb-dashboard";
  version = "0.17.4";

  src = fetchFromGitHub {
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "go-ios";
-  version = "1.0.192";
+  version = "1.0.193";

  src = fetchFromGitHub {
    owner = "danielpaulus";
    repo = "go-ios";
    rev = "v${version}";
-    sha256 = "sha256-2M53jcAZXzUjV53YdENjLpK9o26Xr/gFniuS0T2NZ0E=";
+    sha256 = "sha256-l5ob2wnUOHgR8awPkCBKPCFBEQhrDflN+scUXm7290o=";
  };

  proxyVendor = true;
@@ -0,0 +1,166 @@
+{
+  stdenv,
+  lib,
+  copyDesktopItems,
+  fetchFromGitHub,
+  fetchpatch,
+  fetchurl,
+  bzip2,
+  gobject-introspection,
+  imagemagick,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook3,
+  makeDesktopItem,
+  makeWrapper,
+  fmt,
+  gettext,
+  gtk3,
+  inih,
+  libevdev,
+  pam,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "howdy";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "boltgolt";
+    repo = "howdy";
+    # The 3.0.0 release does not have a corresponding tag yet.
+    # The maintainer was asked to provide one here https://github.com/boltgolt/howdy/pull/1023#issuecomment-3722339500
+    rev = "d3ab99382f88f043d15f15c1450ab69433892a1c";
+    hash = "sha256-Xd/uScMnX1GMwLD5GYSbE2CwEtzrhwHocsv0ESKV8IM=";
+  };
+
+  patches = [
+    # Allows specifying whether to install config file. Paired with the
+    # `install_config` meson option. Needed to disallow installing the config
+    # file in `/etc/howdy`, as it is not allowed by the Nix sandbox. A NixOS
+    # module creates `/etc/howdy` and the config file of course.
+    # PR sent upstream https://github.com/boltgolt/howdy/pull/1050
+    (fetchpatch {
+      url = "https://github.com/boltgolt/howdy/commit/1f3b83e2db5a8dfd9c7c88706ecce033e154060a.patch";
+      hash = "sha256-OIN8A4q0zjtMOMzZgBqrKy2qOD8BDPB+euG6zerFbCE=";
+    })
+
+    # Fix python path for howdy-gtk. Uses python from meson option instead of
+    # the system installation (which is not defined in this package).
+    # PR sent upstream https://github.com/boltgolt/howdy/pull/1049
+    (fetchpatch {
+      url = "https://github.com/boltgolt/howdy/commit/b056724f84361dc6150554e7a806152af032c54b.patch";
+      hash = "sha256-ZOb+QmWagKWtyXI0Xg00tnw8UP8uDWw7wb4Fwjy3VeE=";
+    })
+  ];
+
+  mesonFlags = lib.concatLists [
+    (lib.mapAttrsToList lib.mesonOption {
+      config_dir = "/etc/howdy";
+      python_path = "${finalAttrs.finalPackage.pythonEnv}/bin/python";
+      user_models_dir = "/var/lib/howdy/models";
+    })
+    (lib.mapAttrsToList lib.mesonBool {
+      install_config = false;
+      with_polkit = true;
+    })
+  ];
+
+  nativeBuildInputs = [
+    bzip2
+    copyDesktopItems
+    gobject-introspection
+    imagemagick
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fmt
+    gettext
+    gtk3
+    inih
+    libevdev
+    pam
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "howdy";
+      exec = "howdy-gtk";
+      icon = "howdy";
+      comment = "Howdy facial authentication";
+      desktopName = "Howdy";
+      genericName = "Facial authentication";
+      categories = [
+        "System"
+        "Security"
+      ];
+    })
+  ];
+
+  postInstall = ''
+    # install dlib data
+    rm -rf $out/share/dlib-data/*
+    ${lib.concatStrings (
+      lib.mapAttrsToList (n: v: ''
+        bzip2 -dc ${v} > $out/share/dlib-data/${n}.dat
+      '') finalAttrs.finalPackage.passthru.dlibModels
+    )}
+
+    for size in 16 24 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      magick -background none "$out/share/howdy-gtk/logo.png" -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/howdy.png
+    done
+
+    chmod +x $out/lib/howdy-gtk/init.py
+  '';
+
+  pythonEnv = python3.buildEnv.override {
+    extraLibs = lib.attrVals finalAttrs.finalPackage.passthru.pythonDeps python3.pkgs;
+    makeWrapperArgs = [
+      "--set"
+      "OMP_NUM_THREADS"
+      "1"
+    ];
+  };
+
+  passthru = {
+    pythonDeps = [
+      "dlib"
+      "elevate"
+      "face-recognition"
+      "keyboard"
+      "opencv4Full"
+      "pycairo"
+      "pygobject3"
+    ];
+    dlibModels = lib.mapAttrs (
+      name: hash:
+      fetchurl {
+        name = "howdy-${name}.dat";
+        url = "https://github.com/davisking/dlib-models/raw/daf943f7819a3dda8aec4276754ef918dc26491f/${name}.dat.bz2";
+        inherit hash;
+      }
+    ) finalAttrs.finalPackage.passthru.dlibModelsHashes;
+    dlibModelsHashes = {
+      dlib_face_recognition_resnet_model_v1 = "sha256-q7H2EEHkNEZYVc6Bwr1UboMNKLy+2NJ/++W7QIsRVTo=";
+      mmod_human_face_detector = "sha256-256eQPCSwRjV6z5kOTWyFoOBcHk1WVFVQcVqK1DZ/IQ=";
+      shape_predictor_5_face_landmarks = "sha256-bnh7vr9cnv23k/bNHwIyMMRBMwZgXyTymfEoaflapHI=";
+    };
+  };
+
+  meta = {
+    description = "Windows Hello™ style facial authentication for Linux";
+    homepage = "https://github.com/boltgolt/howdy";
+    license = lib.licenses.mit;
+    mainProgram = "howdy";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ fufexan ];
+  };
+})
@@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+  stdenv,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hyprdynamicmonitors";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "fiffeek";
+    repo = "hyprdynamicmonitors";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-msAgix63TsGgETwJajdr//F19+UUhGCbrjinNbgMPHo=";
+  };
+
+  vendorHash = "sha256-WBK1PhhxaRa0FUAfSxtKOiesw71wy0753FYIgSlo0bE=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.Version=${finalAttrs.version}"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.Commit=unknown"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd hyprdynamicmonitors \
+      --bash <($out/bin/hyprdynamicmonitors completion bash) \
+      --fish <($out/bin/hyprdynamicmonitors completion fish) \
+      --zsh <($out/bin/hyprdynamicmonitors completion zsh)
+  '';
+
+  meta = {
+    description = "Dynamic monitor configuration for Hyprland";
+    homepage = "https://github.com/fiffeek/hyprdynamicmonitors";
+    changelog = "https://github.com/fiffeek/hyprdynamicmonitors/releases/tag/v${finalAttrs.version}";
+    mainProgram = "hyprdynamicmonitors";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nukdokplex ];
+  };
+})
@@ -25,13 +25,13 @@

 gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "hyprtoolkit";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprtoolkit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AEnLjthDHNqD1uPBsVWdo7Pb+Xveh4DzwAPFM2stzNM=";
+    hash = "sha256-kf7Q31BXRZsiNuQjkvRbGkM1aGj9u8HwyOCIUtwKS0o=";
  };

  nativeBuildInputs = [
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "komac";
-  version = "2.14.0";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "russellbanks";
    repo = "Komac";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BZzEt/aqAogWAWXEyVPY77hZp3VE1FUyg2uAjQuwxEE=";
+    hash = "sha256-yNUHtYH8gVLjznDaQMuvcTFvK3smuuSLg3uKVVgcUfs=";
  };

-  cargoHash = "sha256-KrMGZvgMtkfeF4dHUJzxtSqB0nea5ru4sLgnjAoQkYk=";
+  cargoHash = "sha256-W3CL8lObRHkbTwNKZjbN0ErpXGn5KADCGfFTJDw1vfo=";

  nativeBuildInputs = [
    pkg-config
@@ -76,6 +76,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      HeitorAugustoLN
+      dvdznf
    ];
    mainProgram = "komac";
  };
@@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "korrect";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-AOYwknKVtvw/gQ10gwHTNFQ2KvPuldRk8UxRcbkO6tE=";
+    hash = "sha256-2NzfMCMIIZM9/Z7MM8cenqtNCZsbivrjhBFlBQSgV8s=";
  };
-  cargoHash = "sha256-2od1FlV7yx9bAV1eSvTVeJfm7FsGtFGTzsBPh6Of+SU=";
+  cargoHash = "sha256-Xjbc/QpcL6U8z+YwK5UjLRkHThqTIccjQc86nlOMEqE=";

  # Tests create a local http server to check the download functionality
  __darwinAllowLocalNetworking = true;
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "lazyworktree";
-  version = "1.26.0";
+  version = "1.26.2";

  src = fetchFromGitHub {
    owner = "chmouel";
    repo = "lazyworktree";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NEZ8bMI7FxiHuCmFy7sjDlZv4aoX431VRQHQXigaHOM=";
+    hash = "sha256-TLQEqHcDEiASe4MzSRVmbpHd0RsMz+nTY05LFH6nCC0=";
  };

-  vendorHash = "sha256-6Fxri3Ge2iaMluc5h5tL03yXeJcHT6kG3O2ewDG7Acs=";
+  vendorHash = "sha256-esZcuFWSztJvQUgK4rX8nu0UB8UCSuzoOkbUigH0Em0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  argparse,
+  gtk3,
+  python3,
+  spdlog,
+  usbutils,
+  yaml-cpp,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "linux-enable-ir-emitter";
+  version = "6.1.2";
+
+  src = fetchFromGitHub {
+    owner = "EmixamPP";
+    repo = "linux-enable-ir-emitter";
+    tag = finalAttrs.version;
+    hash = "sha256-wSmWebX4H3Hj8bbFoVMq3DY3i/nKkQaeu3mXX0o6IaY=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    argparse
+    gtk3
+    spdlog
+    usbutils
+    yaml-cpp
+    python3.pkgs.opencv4Full
+  ];
+
+  mesonFlags = lib.lists.flatten [
+    (lib.attrsets.mapAttrsToList lib.strings.mesonOption {
+      config_dir = "/var/lib";
+      localstatedir = "/var";
+    })
+    (lib.attrsets.mapAttrsToList lib.strings.mesonBool {
+      create_config_dir = false;
+      create_log_dir = false;
+    })
+  ];
+
+  meta = {
+    description = "Provides support for infrared cameras that are not directly enabled out-of-the box";
+    homepage = "https://github.com/EmixamPP/linux-enable-ir-emitter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fufexan ];
+    mainProgram = "linux-enable-ir-emitter";
+    platforms = lib.platforms.linux;
+  };
+})
@@ -74,13 +74,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "7772";
+  version = "7815";

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-qARA75QjtqBiRI4Hjr+dHs4Kr+Gk9n1DxRk401y+m68=";
+    hash = "sha256-KeLi/DsbSbTNK7EwDOugsJaYEAU3JLOYno59hgJgXhc=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    install -Dm444 -t $out/share/licenses/masscan LICENSE

    wrapProgram $out/bin/masscan \
-      --prefix LD_LIBRARY_PATH : "${libpcap}/lib"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libpcap ]}"
  '';

  doInstallCheck = true;
@@ -3,6 +3,7 @@
  stdenv,
  util-linux,
  coreutils,
+  fetchgit,
  fetchurl,
  groff,
  system-sendmail,
@@ -16,9 +17,10 @@ stdenv.mkDerivation rec {
  pname = "mdadm";
  version = "4.4";

-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/raid/mdadm/mdadm-${version}.tar.xz";
-    sha256 = "sha256-m0iPNe0VPfmZJLX+Qe7TgOhRLejxihGGKMrN1oGx1XM=";
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
+    tag = "mdadm-${version}";
+    hash = "sha256-jGmc8fkJM0V9J7V7tQPXSF/WD0kzyEAloBAwaAFenS0=";
  };

  patches = [
@@ -8,14 +8,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook-pdf";
-  version = "0.1.11";
+  version = "0.1.13";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-1VMVobiRCCUv8aWLxNbaDSvNs1Pt2jlsVPzfrieOudc=";
+    hash = "sha256-aADHRlIVWVc43DEfZx8ha/E4FaiAoKtjHccx+LAghtU=";
  };

-  cargoHash = "sha256-t3dlmeJNaHySIhJdJmSaeS0mXM7TgAUa/0hcG06lHvo=";
+  cargoHash = "sha256-aHpycw9WmaNsI0VAYxI89KnB7fC31FxH+8ONnMEGtTM=";

  nativeBuildInputs = [ pkg-config ];

@@ -8,7 +8,7 @@
  installShellFiles,
 }:
 let
-  version = "0.5.1";
+  version = "0.5.2";
 in
 rustPlatform.buildRustPackage rec {
  inherit version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
    owner = "rust-lang";
    repo = "mdBook";
    tag = "v${version}";
-    hash = "sha256-t7Qou3H6dlO97puWQGkPlyb0jjpGoYCrz041iZWWL/s=";
+    hash = "sha256-gyjD47ZR9o2lIxipzesyJ6mxb9J9W+WS77TNWhKHP6U=";
  };

-  cargoHash = "sha256-bJr0u025syrP/LGgIbXD0mRvQrvnnOntiaAfr/9tQ90=";
+  cargoHash = "sha256-230KljOUSrDy8QCQki7jvJvdAsjVlUEjKDNVyTF4tWs=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,11 +1,11 @@
 {
  lib,
  fetchFromGitHub,
-  php83,
+  php,
  versionCheckHook,
 }:

-php83.buildComposerProject2 (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "n98-magerun2";
  version = "9.2.1";

@@ -43,7 +43,9 @@ stdenv.mkDerivation rec {

  outputs = [
    "out"
+    "doc"
    "info"
+    "man"
  ];

  configureFlags = [
@@ -21,7 +21,7 @@ nixos-rebuild - reconfigure a NixOS machine
 _nixos-rebuild_ \[--verbose] [--quiet] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS] [--include INCLUDE]++
 	\[--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file] [--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file]++
 	\[--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT] [--no-build-output] [--use-substitutes] [--help] [--debug] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader]++
-	\[--profile-name PROFILE_NAME] [--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
+	\[--profile-name PROFILE_NAME] [--specialisation SPECIALISATION] [--rollback] [--store-path STORE_PATH] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
 	\[--build-host BUILD_HOST] [--target-host TARGET_HOST] [--no-build-nix] [--image-variant IMAGE_VARIANT]++
 	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-image,build-vm,build-vm-with-bootloader,list-generations}]

@@ -182,6 +182,20 @@ It must be one of the following:
 	(The previous configuration is defined as the one before the “current”
 	generation of the Nix profile _/nix/var/nix/profiles/system_.)

+*--store-path* _path_
+	Use a pre-built NixOS system store path at _path_ instead of evaluating
+	and building from the configuration. This skips the evaluation and build
+	phases entirely. The path must be a valid NixOS system closure
+	(containing _nixos-version_ and _bin/switch-to-configuration_).
+
+	This is useful for deploying closures that were built elsewhere, such as
+	in CI systems or on remote build machines.
+
+	Can only be used with *switch*, *boot*, *test*, and *dry-activate*
+	actions. Mutually exclusive with *--rollback*, *--flake*, *--file*, and
+	*--attr*. The *--build-host* option is ignored when *--store-path* is
+	specified.
+
 *--builders* _builder-spec_
 	Allow ad-hoc remote builders for building the new system. This requires
 	the user executing *nixos-rebuild* (usually root) to be configured as a
@@ -98,6 +98,7 @@ python3Packages.buildPythonApplication rec {
          # FIXME: this test is disabled since it times out in @ofborg
          # nixos-rebuild-install-bootloader
          nixos-rebuild-specialisations
+          nixos-rebuild-store-path
          nixos-rebuild-target-host
          ;
        repl = callPackage ./tests/repl.nix { };
@@ -136,6 +136,11 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
        action="store_true",
        help="Roll back to the previous configuration",
    )
+    main_parser.add_argument(
+        "--store-path",
+        metavar="PATH",
+        help="Use a pre-built NixOS system store path instead of building",
+    )
    main_parser.add_argument(
        "--upgrade",
        action="store_true",
@@ -269,6 +274,22 @@ def parse_args(
    if args.flake and (args.file or args.attr):
        parser.error("--flake cannot be used with --file or --attr")

+    if args.store_path:
+        if args.rollback:
+            parser.error("--store-path and --rollback are mutually exclusive")
+        if args.flake or args.file or args.attr:
+            parser.error("--store-path cannot be used with --flake, --file, or --attr")
+        if args.action not in (
+            Action.SWITCH.value,
+            Action.BOOT.value,
+            Action.TEST.value,
+            Action.DRY_ACTIVATE.value,
+        ):
+            parser.error(f"--store-path cannot be used with '{args.action}'")
+        if args.flake is None:
+            # Disable flake auto-detection since we're using a pre-built store path
+            args.flake = False
+
    return args, grouped_nix_args


@@ -297,7 +318,7 @@ def execute(argv: list[str]) -> None:
    build_attr = BuildAttr.from_arg(args.attr, args.file)
    flake = Flake.from_arg(args.flake, target_host)

-    if can_run and not flake:
+    if can_run and not flake and not args.store_path:
        services.write_version_suffix(grouped_nix_args)

    match action:
@@ -224,7 +224,7 @@ def copy_closure(
        )

    match (to_host, from_host):
-        case (None, None):
+        case (x, y) if x == y:
            return
        case (Remote(_) as host, None) | (None, Remote(_) as host):
            nix_copy_closure(host, to=bool(to_host))
@@ -290,7 +290,14 @@ def build_and_activate_system(
        grouped_nix_args=grouped_nix_args,
    )

-    if args.rollback:
+    if args.store_path:
+        path_to_config = Path(args.store_path)
+        nix.copy_closure(
+            path_to_config,
+            to_host=target_host,
+            copy_flags=grouped_nix_args.copy_flags,
+        )
+    elif args.rollback:
        path_to_config = _rollback_system(
            action=action,
            args=args,
@@ -34,6 +34,30 @@ def test_parse_args() -> None:
        nr.parse_args(["nixos-rebuild", "edit", "--attr", "attr"])
    assert e.value.code == 2

+    # --store-path validation tests
+    with pytest.raises(SystemExit) as e:
+        nr.parse_args(
+            ["nixos-rebuild", "switch", "--store-path", "/nix/store/foo", "--rollback"]
+        )
+    assert e.value.code == 2
+
+    with pytest.raises(SystemExit) as e:
+        nr.parse_args(
+            ["nixos-rebuild", "switch", "--store-path", "/nix/store/foo", "--flake"]
+        )
+    assert e.value.code == 2
+
+    with pytest.raises(SystemExit) as e:
+        nr.parse_args(["nixos-rebuild", "build", "--store-path", "/nix/store/foo"])
+    assert e.value.code == 2
+
+    # --store-path should disable flake auto-detection
+    r_store_path, _ = nr.parse_args(
+        ["nixos-rebuild", "switch", "--store-path", "/nix/store/foo"]
+    )
+    assert r_store_path.flake is False
+    assert r_store_path.store_path == "/nix/store/foo"
+
    r1, g1 = nr.parse_args(
        [
            "nixos-rebuild",
@@ -1214,3 +1238,163 @@ def test_execute_test_rollback(
            ),
        ]
    )
+
+
+@patch.dict(
+    os.environ,
+    {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"},
+    clear=True,
+)
+@patch("subprocess.run", autospec=True)
+def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test-system"
+    config_path.mkdir()
+
+    mock_run.return_value = CompletedProcess([], 0)
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "switch",
+            "--store-path",
+            str(config_path),
+            "--no-reexec",
+        ]
+    )
+
+    # --store-path skips build and write_version_suffix, so only activation calls
+    assert mock_run.call_count == 3
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix-env",
+                    "-p",
+                    Path("/nix/var/nix/profiles/system"),
+                    "--set",
+                    config_path,
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                ["test", "-d", "/run/systemd/system"],
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                    config_path / "bin/switch-to-configuration",
+                    "switch",
+                ],
+                check=True,
+                **(
+                    DEFAULT_RUN_KWARGS
+                    | {
+                        "env": {
+                            "NIXOS_INSTALL_BOOTLOADER": "0",
+                            "NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1",
+                        }
+                    }
+                ),
+            ),
+        ]
+    )
+
+
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+@patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True)
+def test_execute_switch_store_path_target_host(
+    mock_cleanup_ssh: Mock,
+    mock_run: Mock,
+    tmp_path: Path,
+) -> None:
+    config_path = tmp_path / "test-system"
+    config_path.mkdir()
+
+    mock_run.return_value = CompletedProcess([], 0)
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "switch",
+            "--store-path",
+            str(config_path),
+            "--target-host",
+            "user@remote-host",
+            "--sudo",
+            "--no-reexec",
+        ]
+    )
+
+    # --store-path skips build and write_version_suffix, so only copy/activation calls
+    assert mock_run.call_count == 5
+    mock_run.assert_has_calls(
+        [
+            call(
+                ["nix-copy-closure", "--to", "user@remote-host", config_path],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@remote-host",
+                    "--",
+                    "test",
+                    "-f",
+                    str(config_path / "nixos-version"),
+                ],
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@remote-host",
+                    "--",
+                    "sudo",
+                    "nix-env",
+                    "-p",
+                    "/nix/var/nix/profiles/system",
+                    "--set",
+                    str(config_path),
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@remote-host",
+                    "--",
+                    "test",
+                    "-d",
+                    "/run/systemd/system",
+                ],
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@remote-host",
+                    "--",
+                    "sudo",
+                    "env",
+                    "NIXOS_INSTALL_BOOTLOADER=0",
+                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                    str(config_path / "bin/switch-to-configuration"),
+                    "switch",
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+        ]
+    )
@@ -294,28 +294,29 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
  ];

-  env = {
-    NIX_LDFLAGS = "-z,noexecstack";
-  }
-  // lib.optionalAttrs rocmSupport {
-    MIOPEN_PATH = rocmPackages.miopen;
-    # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
-    # fatal error: 'rocrand/rocrand.h' file not found
-    HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
-      rocmPackages.hipblas
-      rocmPackages.hipcub
-      rocmPackages.hiprand
-      rocmPackages.hipsparse
-      rocmPackages.rocblas
-      rocmPackages.rocprim
-      rocmPackages.rocrand
-      rocmPackages.rocthrust
-    ];
-  }
-  // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
-    NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
-    GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
-  };
+  env =
+    lib.optionalAttrs effectiveStdenv.hostPlatform.isLinux {
+      NIX_LDFLAGS = "-z,noexecstack";
+    }
+    // lib.optionalAttrs rocmSupport {
+      MIOPEN_PATH = rocmPackages.miopen;
+      # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
+      # fatal error: 'rocrand/rocrand.h' file not found
+      HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
+        rocmPackages.hipblas
+        rocmPackages.hipcub
+        rocmPackages.hiprand
+        rocmPackages.hipsparse
+        rocmPackages.rocblas
+        rocmPackages.rocprim
+        rocmPackages.rocrand
+        rocmPackages.rocthrust
+      ];
+    }
+    // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
+      NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
+      GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
+    };

  doCheck =
    !(
@@ -26,16 +26,9 @@ stdenv.mkDerivation rec {
    owner = "owncloud";
    repo = "client";
    tag = "v${version}";
-    hash = "sha256-11ZqCqFKJexMRH73IEBRuNx5Dxf4aMHlShwull0z4hI=";
+    hash = "sha256-RNa3i+Qf/cPE+TvYFt5FjbQcHgep3z/XBzno/EyJ3EQ==";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/owncloud/client/commit/ef0791a727051191f0c0ff7bca78b10d5dd97e1e.patch";
-      hash = "sha256-r/TlRjmnZdPWXZ8Kn/9GgcisWiF/qOO5X8m2ReooKWo=";
-    })
-  ];
-
  nativeBuildInputs = [
    pkg-config
    cmake
@@ -4,22 +4,25 @@
  rustPlatform,
  pkg-config,
  openssl,
+  libxcrypt,
+  libisoburn,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage {
  pname = "proxmox-auto-install-assistant";
-  version = "9.0.7";
+  version = "9.1.6";

  src = fetchgit {
    url = "git://git.proxmox.com/git/pve-installer.git";
-    rev = "cfcaceacb797bfdbff8c7e8fed76e56642390b20";
-    hash = "sha256-tXwNuT25GzQhdDtYiiQKPu6EPZQffUOZhBqkLZK/+DY=";
+    rev = "eab66c74a79663008ab12990bd27195a8d5c4204";
+    hash = "sha256-nMyi3GfdQv/L05hpReSIoFrvmpbs4+5t/lUXXgP0bUs=";
  };

  postPatch = ''
    rm -v .cargo/config.toml
    cp -v ${./Cargo.lock} Cargo.lock
+    chmod u+w Cargo.lock
    # pre-generated using `make locale-info.json`
    # depends on non-packaged perl modules and debian-specific files
    cp -v ${./locale-info.json} locale-info.json
@@ -27,23 +30,32 @@ rustPlatform.buildRustPackage {

  buildAndTestSubdir = "proxmox-auto-install-assistant";

-  cargoLock.lockFile = ./Cargo.lock;
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "proxmox-io-1.2.1" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+      "proxmox-lang-1.5.0" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+      "proxmox-sys-1.0.0" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+    };
+  };

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl.dev ];
+  buildInputs = [
+    libxcrypt
+    openssl.dev
+  ];
+
+  propagatedBuildInputs = [ libisoburn ];

  postFixup = ''
    # these libraries are not actually necessary, only linked in by cargo
    # through crate dependencies (unfortunately)
    patchelf \
      --remove-needed libcrypto.so.3 \
-      --remove-needed libssl.so.3 \
      $out/bin/proxmox-auto-install-assistant
    patchelf --shrink-rpath $out/bin/proxmox-auto-install-assistant
  '';

-  disallowedReferences = [ openssl.out ];
-
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -55,7 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
  enableParallelBuilding = true;

  cmakeFlags = [
-    "-DCOPY_PLUGIN_AFTER_BUILD=FALSE"
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
@@ -75,30 +76,9 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/bin $out/lib/vst3
+    mkdir -p $out/lib/vst3 $out/lib/lv2

-  ''
-  + (
-    if stdenv.hostPlatform.isDarwin then
-      ''
-        mkdir -p $out/Applications
-        cp -R QDelay_artefacts/Release/Standalone/QDelay.app \
-          $out/Applications/QDelay.app
-        ln -s \
-          $out/Applications/QDelay.app/Contents/MacOS/QDelay \
-          $out/bin/QDelay
-      ''
-    else
-      ''
-        install -Dm755 \
-          QDelay_artefacts/Release/Standalone/QDelay \
-          $out/bin/QDelay
-
-        mkdir -p $out/bin $out/lib/lv2
-        cp -r "QDelay_artefacts/Release/LV2/QDelay.lv2" $out/lib/lv2
-      ''
-  )
-  + ''
+    cp -r "QDelay_artefacts/Release/LV2/QDelay.lv2" $out/lib/lv2
    cp -r "QDelay_artefacts/Release/VST3/QDelay.vst3" $out/lib/vst3

    runHook postInstall
@@ -110,7 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/tiagolr/qdelay/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ magnetophon ];
-    mainProgram = "QDelay";
    platforms = lib.platforms.all;
  };
 })
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "reevr";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "reevr";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-uOaImmc8MXhH6P3IN53LGntsWAbsVnqkz8TUk67aYcU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_OSX_ARCHITECTURES" "${stdenv.hostPlatform.darwinArch}")
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "REEVR_artefacts/Release/LV2/REEV-R.lv2" $out/lib/lv2
+    cp -r "REEVR_artefacts/Release/VST3/REEV-R.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Convolution reverb with pre and post modulation";
+    homepage = "https://github.com/tiagolr/reevr";
+    changelog = "https://github.com/tiagolr/reevr/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.18.5";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-YAicTu83IKw2reZefdCjNfhRwiOCtKieyq0vPJ510lQ=";
+    sha256 = "sha256-vpFwiVLF3ekPgjxTEl4UlY/oGK03prHRtt15k5i+M6I=";
  };

  vendorHash = "sha256-E/Y4kW5xy7YamUP5bxFmDCAK6RqiqGN7DpEPG1MaCHc=";
@@ -16,18 +16,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ruff";
-  version = "0.14.13";
+  version = "0.14.14";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    tag = finalAttrs.version;
-    hash = "sha256-ComgiY6fvM2f3Ul8kTgykyktvxEHL85X5C1Tudi5ZB4=";
+    hash = "sha256-h6XYWK6NxelLCfqG0geiAj3XbcqzbeFKeFMMDsy8fm8=";
  };

  cargoBuildFlags = [ "--package=ruff" ];

-  cargoHash = "sha256-Vd9y9VQF7d62tjHJ0ikWlvV7+KDs4q61ld9yoJWaqpY=";
+  cargoHash = "sha256-H5ZaBDV0YTdExu42Dt1Bq379vJ3FtddKtdLkMW+qC78=";

  nativeBuildInputs = [ installShellFiles ];

@@ -5,23 +5,22 @@
  nix-update-script,
  installShellFiles,
  rustPlatform,
+  sqlite,
  pkg-config,
 }:

-rustPlatform.buildRustPackage rec {
-  pname = "sequoia-sqop";
-  version = "0.35.0";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "sequoia-sop";
+  version = "0.37.3";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
-    # From some reason the repository is not sequoia-sqop - like the command
-    # generated etc
    repo = "sequoia-sop";
-    rev = "v${version}";
-    hash = "sha256-JgLozj9LZwk6TRHj2d4kiq8j3aILBUWaE9ldzvlTBNs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7fyItwtzNia97fbLJ1YkpkS7KmCo3I81uksh3lNvxwU=";
  };

-  cargoHash = "sha256-Cg07SlNmG6ELZmoQfkr6ADrGJirbFm0D1Iko1WVNfl0=";
+  cargoHash = "sha256-NrJYFf2bK/QwfFpIrPD8Zc9N/tKVbN2I48jA2B0rNWk=";

  nativeBuildInputs = [
    pkg-config
@@ -31,17 +30,20 @@ rustPlatform.buildRustPackage rec {

  buildInputs = [
    nettle
+    sqlite
  ];
+
  buildFeatures = [ "cli" ];

+  env.ASSET_OUT_DIR = "/tmp/";
+
  # Install manual pages
  postInstall = ''
-    mkdir -p $out/share/man
-    cp -r man-sqop $out/share/man/man1
+    installManPage /tmp/man-pages/*.*
    installShellCompletion --cmd sqop \
-      --bash target/*/release/build/sequoia-sop*/out/sqop.bash \
-      --fish target/*/release/build/sequoia-sop*/out/sqop.fish \
-      --zsh target/*/release/build/sequoia-sop*/out/_sqop
+      --bash /tmp/shell-completions/sqop.bash \
+      --fish /tmp/shell-completions/sqop.fish \
+      --zsh /tmp/shell-completions/_sqop
    # Also elv and powershell are generated there
  '';

@@ -52,8 +54,9 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "Implementation of the Stateless OpenPGP Command Line Interface using Sequoia";
    homepage = "https://gitlab.com/sequoia-pgp/sequoia-sop";
+    changelog = "https://gitlab.com/sequoia-pgp/sequoia-sop/-/blob/v${finalAttrs.src.tag}/NEWS";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ doronbehar ];
    mainProgram = "sqop";
  };
-}
+})
@@ -25,14 +25,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "stevia";
-  version = "0.52.0";
+  version = "0.52.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World/Phosh";
    repo = "stevia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LE2+1RkxD8Sj2H/3NFzcYXZktlVGoNzWrE0UO5sJCAM=";
+    hash = "sha256-GdAKy7F8SRGtfmN6as6AAg6p/WJrcDPp338OHUXoORM=";
  };

  mesonFlags = [
@@ -32,13 +32,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "swayimg";
-  version = "4.6";
+  version = "4.7";

  src = fetchFromGitHub {
    owner = "artemsen";
    repo = "swayimg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q5TqY5UgSGZVVoARcz1ig0UkZBKgRoT9Ndvg/f1T38Q=";
+    hash = "sha256-1dJf339lM8ETcYyjtWCJEyNmwmoxt72+rXdTH/48s6Q=";
  };

  strictDeps = true;
@@ -9,7 +9,7 @@
 }:

 let
-  version = "2.0.2";
+  version = "2.0.2-unstable-2025-01-15";
 in
 rustPlatform.buildRustPackage {
  pname = "system76-scheduler";
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage {
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "system76-scheduler";
-    rev = version;
-    hash = "sha256-5GiHmu++YRCewDHm/qxKmQwDIAZwlW5Eya/fDriVSdA=";
+    rev = "b0b7e98b0dbd2cd05e9fe80829e7083048202da7";
+    hash = "sha256-I+LN7Q5/VQ203Vk0eKM4HZw8oSS0bkcY/wIWbu4hPnI=";
  };

-  cargoHash = "sha256-o2Ma9WNmBz+18SSMBPXYK4BXzHFLQwa3JWhq4S7jSBg=";
+  cargoHash = "sha256-rTe016jxRdL3xOw6yHz8btyfnecGuPTIashKQustYP0=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "time12";
+  version = "1.2.3";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "time12";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-/siQGQRHPqIP17NE4e/IGEQIzLPnBAXXzU6ucL1y5os=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "TIME12_artefacts/Release/LV2/TIME-12.lv2" $out/lib/lv2
+    cp -r "TIME12_artefacts/Release/VST3/TIME-12.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An envelope based delay modulator";
+    homepage = "https://github.com/tiagolr/time12";
+    changelog = "https://github.com/tiagolr/time12/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -12,7 +12,7 @@
  nix-update-script,
 }:
 let
-  version = "4.19.7";
+  version = "4.19.9";

  desktopItem = makeDesktopItem {
    name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-wRZNfirTBNFKVwHW+Wdu2hT2GLbQQO93HC/ngYmvaTw=";
+    hash = "sha256-+HVpzm60hyJhD1b7VlDLpa5NY48ffBIPF54SHqDYfF8=";
  };

  dontUnpack = true;
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "virtnbdbackup";
-  version = "2.43";
+  version = "2.44";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "abbbi";
    repo = "virtnbdbackup";
    tag = "v${version}";
-    hash = "sha256-WR8MXfk+jFxGX2GpzuqTwZj053HyQ9N16v7zKU3iCPs=";
+    hash = "sha256-p3oTd0RT/bw9C73QO83OD21/BHH2E3qX2KS687NyN9Q=";
  };

  build-system = with python3Packages; [
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "witr";
-  version = "0.2.5";
+  version = "0.2.6";

  src = fetchFromGitHub {
    owner = "pranshuparmar";
    repo = "witr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2Du3Z6p/IqrP7uqB1fz0d0prCX02+Iw59wikviV7z84=";
+    hash = "sha256-0OjGVdZ6WZbEtrOmkygsA5UdPya3feGNQ3jdCvxiTM0=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "llef";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "foundryzero";
    repo = "llef";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PqPsZNLiKW1czxfpJMNnQbdak37WbGc7Otq1uU6wXqc=";
+    hash = "sha256-w1Chaq/rGv1amvpJqiyKFxK0dQdsyplgFmBKj/Xmtqg=";
  };

  dontBuild = true;
@@ -0,0 +1,57 @@
+{
+  fetchFromGitHub,
+  buildDunePackage,
+  lib,
+  logs,
+  miou,
+  fmt,
+  h2,
+  h1,
+  ca-certs,
+  bstr,
+  tls-miou-unix,
+  dns-client-miou-unix,
+  happy-eyeballs-miou-unix,
+  mirage-crypto-rng-miou-unix,
+  alcotest,
+  digestif,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "httpcats";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "robur-coop";
+    repo = "httpcats";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t3gSfv73XYntle1dd4k9bv893pGStk1NHz62mAvcHAs=";
+  };
+
+  propagatedBuildInputs = [
+    h2
+    h1
+    ca-certs
+    bstr
+    tls-miou-unix
+    dns-client-miou-unix
+    happy-eyeballs-miou-unix
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    logs
+    fmt
+    mirage-crypto-rng-miou-unix
+    alcotest
+    digestif
+  ];
+
+  meta = {
+    inherit (finalAttrs.src.meta) homepage;
+    description = "A simple HTTP client / server using h1, h2, and miou";
+    changelog = "https://github.com/robur-coop/httpcats/blob/${finalAttrs.src.tag}/CHANGES.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ rpqt ];
+  };
+})
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "galois";
-  version = "0.4.7";
+  version = "0.4.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mhostetter";
    repo = "galois";
    tag = "v${version}";
-    hash = "sha256-YVAmjmkAhU518x+eCCgA6RY99XPQ5s+xvonkaoc5t8A=";
+    hash = "sha256-0Fj/KYfR6SVfG7/uTo0mNrU1mv/QkKD8ja1dyDYVG/0=";
  };

  pythonRelaxDeps = [
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "imgw-pib";
-  version = "2.0.0";
+  version = "2.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bieniu";
    repo = "imgw-pib";
    tag = version;
-    hash = "sha256-Kd0vy8FQIH2eoSE8PHtCFTbwj02ZdKkrW46KfJ5sDds=";
+    hash = "sha256-scpMdJJMwoKcNdjM9YQsgxkhYOtjjnQjJOS2JhELxvA=";
  };

  build-system = [ setuptools ];
@@ -26,14 +26,14 @@

 buildPythonPackage rec {
  pname = "mypyllant";
-  version = "0.9.8";
+  version = "0.9.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "signalkraft";
    repo = "myPyllant";
    tag = "v${version}";
-    hash = "sha256-eneAFJ4xRL8EKj8Act/YcW7Gx0B85u0g3LTWPlI/B/0=";
+    hash = "sha256-wvqlTlcNy/ue2yfrQyS93vfRSOTsHbvARI+7BKuUuYs=";
  };

  build-system = [
@@ -38,7 +38,7 @@ buildPythonPackage {
    chmod +w dist
  '';

-  env = {
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
    NIX_LDFLAGS = "-z,noexecstack";
  };

@@ -10,19 +10,19 @@

 buildPythonPackage rec {
  pname = "pcodec";
-  version = "0.4.9";
+  version = "1.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pcodec";
    repo = "pcodec";
    tag = "v${version}";
-    hash = "sha256-XwK2cLd+SQmo/p7w/MmRh/EajQiN4rv/EMjTBH0EeXs=";
+    hash = "sha256-WE71Xbr0iUsnP5oqqMlvXzIhasQ7YQm6rB8hEA6FvnM=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-R2iVlw2ricCBbHCthttX2RX7+j7AEKeN6h08nZvOxSQ=";
+    hash = "sha256-h40rlCd/qyf3hbvm8EdWo1hqAgiiwExmWNnKgU3iYEU=";
  };

  buildAndTestSubdir = "pco_python";
@@ -21,14 +21,14 @@ let
 in
 buildPythonPackage rec {
  pname = "yaramod";
-  version = "4.5.0";
+  version = "4.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "avast";
    repo = "yaramod";
    tag = "v${version}";
-    hash = "sha256-iIPMwN/kHrbN3ca+IJdyIfvrsnwiiflQY/gHAT3p+S4=";
+    hash = "sha256-5tZhJcgpS8BwLEFlIM+RnXeUC5gXq4TPfSe0KI6U34w=";
  };

  postPatch = ''
@@ -42,5 +42,16 @@
            "x86_64-linux": "a676357322bdf28153ba3ad67e8558dd54d76757fe2b1ad48c53f4a5e20614c6"
        },
        "version": "39.3.0"
+    },
+    "40": {
+        "hashes": {
+            "aarch64-darwin": "bfa742c44b0053a9b6cf46a8124baff4a8a567feca2a5adbabf749075b298b69",
+            "aarch64-linux": "46969d090510b26af41d7cde74cab15a9ad35eb45e61e976076626f2db3589a1",
+            "armv7l-linux": "f87d8643c911c2e3678447be5a44636bdf375a1c3a9a7f20be3171a7ed510b86",
+            "headers": "0wjpbk33i1z74djqyscribisd281cs5c266nrh2r6aabn2byh16l",
+            "x86_64-darwin": "0120bcbd5cd063953b477fe8f950244b2f37770b9f85e60ca9b6bcaf85627b33",
+            "x86_64-linux": "2ac22df42a4368cdd93ff9f9f25c7f04b9157143a3a3a06d4f01ae0dbb4e6fd5"
+        },
+        "version": "40.0.0"
    }
 }
@@ -42,5 +42,16 @@
            "x86_64-linux": "44e15ac6c421e7bc7b36c55721085e5ccd4996c0770785dc78c55baaf4f73322"
        },
        "version": "39.3.0"
+    },
+    "40": {
+        "hashes": {
+            "aarch64-darwin": "27393f69ecca3686dad7a0e594ff06081631f7659307071f136bdb680e5c3649",
+            "aarch64-linux": "588aafc8b3afdb1abefccf9dfee95ebd1a590bea77370553103dcb03406f3366",
+            "armv7l-linux": "3ac8f1f6b2f3da81d2ebadb56f6d8cd05ada3dfa340f84b39e266ae8c35b7cf7",
+            "headers": "0wjpbk33i1z74djqyscribisd281cs5c266nrh2r6aabn2byh16l",
+            "x86_64-darwin": "633c29541cb253ceacb6fe2855086d18060ced216ad869d1f887a298467c2e28",
+            "x86_64-linux": "77f71758783822b7e24fb6777f9e4ccabf1cd5e4e964b905fb63a068b4d849da"
+        },
+        "version": "40.0.0"
    }
 }
@@ -28,14 +28,14 @@

 stdenv.mkDerivation (self: {
  pname = "godot3";
-  version = "3.6";
+  version = "3.6.2";
  godotBuildDescription = "X11 tools";

  src = fetchFromGitHub {
    owner = "godotengine";
    repo = "godot";
    rev = "${self.version}-stable";
-    sha256 = "sha256-4WQYO1BBDK9+eyblpI8qRgbBG4+qPRVZMjeAFAtot+0=";
+    hash = "sha256-loNjE+NmHniZ827Eb9MHSNo27F2LrURhWURjUq4d8xw=";
  };

  # Fix PIE hardening: https://github.com/godotengine/godot/pull/50737
@@ -83,9 +83,6 @@ stdenv.mkDerivation (self: {
    # of the OS. This isn't as surgical as just fixing the PATH, but it seems to work, and
    # seems to be the Nix community's current strategy when using Scons.
    /SConstruct/dontClobberEnvironment.patch
-    # Fix compile error with mono 6.14
-    # https://github.com/godotengine/godot/pull/106578
-    /move-MonoGCHandle-into-gdmono-namespace.patch
  ];

  enableParallelBuilding = true;
@@ -16,7 +16,7 @@ index 98bbb4d9be..5189f2551b 100644
 -            latest_mtime = mtime if mtime > latest_mtime else latest_mtime
 -
 -    glue_version = int(latest_mtime)  # The latest modified time will do for now
-+    glue_version = 1725828088
+    glue_version = 1761170065
 
     with open(version_header_dst, "w") as version_header:
         version_header.write("/* THIS FILE IS GENERATED DO NOT EDIT */\n")
@@ -16,7 +16,7 @@ gdversion=$1
 # Download and extract the official stable 64-bit X11 mono build of Godot.
 gddir="$(mktemp -d)"
 trap 'rm -rf -- "$gddir"' EXIT
-wget -P "$gddir" https://downloads.tuxfamily.org/godotengine/$gdversion/mono/Godot_v$gdversion-stable_mono_x11_64.zip
+wget -O "$gddir"/Godot_v$gdversion-stable_mono_x11_64.zip "https://downloads.godotengine.org/?version=$gdversion&flavor=stable&slug=mono_x11_64.zip&platform=linux.64"
 unzip "$gddir"/Godot_v$gdversion-stable_mono_x11_64.zip -d "$gddir"

 # Generate the mono glue from the official build.
@@ -1,403 +0,0 @@
-From 7f90c622f5f04ad6aed5729913684a64827b751f Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sun, 18 May 2025 20:56:50 -0300
-Subject: [PATCH] mono: move MonoGCHandle into gdmono namespace
-
-This conflicts with ::MonoGCHandle in mono 6.14 (maintained by winehq).
---
- modules/mono/csharp_script.cpp             | 44 +++++++++++-----------
- modules/mono/csharp_script.h               | 10 ++---
- modules/mono/glue/base_object_glue.cpp     |  4 +-
- modules/mono/mono_gc_handle.cpp            |  4 ++
- modules/mono/mono_gc_handle.h              |  4 ++
- modules/mono/mono_gd/gd_mono_cache.cpp     |  4 +-
- modules/mono/mono_gd/gd_mono_cache.h       |  2 +-
- modules/mono/mono_gd/gd_mono_internals.cpp |  4 +-
- modules/mono/mono_gd/gd_mono_utils.cpp     |  4 +-
- modules/mono/signal_awaiter_utils.cpp      |  2 +-
- modules/mono/signal_awaiter_utils.h        |  4 +-
- 11 files changed, 47 insertions(+), 39 deletions(-)
-
-diff --git a/modules/mono/csharp_script.cpp b/modules/mono/csharp_script.cpp
-index fa041f4cba..2ad9722eca 100644
--- a/modules/mono/csharp_script.cpp
-+++ b/modules/mono/csharp_script.cpp
-@@ -653,7 +653,7 @@ void CSharpLanguage::pre_unsafe_unreference(Object *p_obj) {
- 
- void CSharpLanguage::frame() {
- 	if (gdmono && gdmono->is_runtime_initialized() && gdmono->get_core_api_assembly() != NULL) {
-		const Ref<MonoGCHandle> &task_scheduler_handle = GDMonoCache::cached_data.task_scheduler_handle;
-+		const Ref<gdmono::MonoGCHandle> &task_scheduler_handle = GDMonoCache::cached_data.task_scheduler_handle;
- 
- 		if (task_scheduler_handle.is_valid()) {
- 			MonoObject *task_scheduler = task_scheduler_handle->get_target();
-@@ -1189,15 +1189,15 @@ void CSharpLanguage::set_language_index(int p_idx) {
- 	lang_idx = p_idx;
- }
- 
-void CSharpLanguage::release_script_gchandle(Ref<MonoGCHandle> &p_gchandle) {
-+void CSharpLanguage::release_script_gchandle(Ref<gdmono::MonoGCHandle> &p_gchandle) {
- 	if (!p_gchandle->is_released()) { // Do not lock unnecessarily
- 		MutexLock lock(get_singleton()->script_gchandle_release_mutex);
- 		p_gchandle->release();
- 	}
- }
- 
-void CSharpLanguage::release_script_gchandle(MonoObject *p_expected_obj, Ref<MonoGCHandle> &p_gchandle) {
-	uint32_t pinned_gchandle = MonoGCHandle::new_strong_handle_pinned(p_expected_obj); // We might lock after this, so pin it
-+void CSharpLanguage::release_script_gchandle(MonoObject *p_expected_obj, Ref<gdmono::MonoGCHandle> &p_gchandle) {
-+	uint32_t pinned_gchandle = gdmono::MonoGCHandle::new_strong_handle_pinned(p_expected_obj); // We might lock after this, so pin it
- 
- 	if (!p_gchandle->is_released()) { // Do not lock unnecessarily
- 		MutexLock lock(get_singleton()->script_gchandle_release_mutex);
-@@ -1213,7 +1213,7 @@ void CSharpLanguage::release_script_gchandle(MonoObject *p_expected_obj, Ref<Mon
- 		}
- 	}
- 
-	MonoGCHandle::free_handle(pinned_gchandle);
-+	gdmono::MonoGCHandle::free_handle(pinned_gchandle);
- }
- 
- CSharpLanguage::CSharpLanguage() {
-@@ -1267,7 +1267,7 @@ bool CSharpLanguage::setup_csharp_script_binding(CSharpScriptBinding &r_script_b
- 	r_script_binding.inited = true;
- 	r_script_binding.type_name = type_name;
- 	r_script_binding.wrapper_class = type_class; // cache
-	r_script_binding.gchandle = MonoGCHandle::create_strong(mono_object);
-+	r_script_binding.gchandle = gdmono::MonoGCHandle::create_strong(mono_object);
- 	r_script_binding.owner = p_object;
- 
- 	// Tie managed to unmanaged
-@@ -1351,7 +1351,7 @@ void CSharpLanguage::refcount_incremented_instance_binding(Object *p_object) {
- 	CRASH_COND(!data);
- 
- 	CSharpScriptBinding &script_binding = ((Map<Object *, CSharpScriptBinding>::Element *)data)->get();
-	Ref<MonoGCHandle> &gchandle = script_binding.gchandle;
-+	Ref<gdmono::MonoGCHandle> &gchandle = script_binding.gchandle;
- 
- 	if (!script_binding.inited)
- 		return;
-@@ -1368,9 +1368,9 @@ void CSharpLanguage::refcount_incremented_instance_binding(Object *p_object) {
- 			return; // Called after the managed side was collected, so nothing to do here
- 
- 		// Release the current weak handle and replace it with a strong handle.
-		uint32_t strong_gchandle = MonoGCHandle::new_strong_handle(target);
-+		uint32_t strong_gchandle = gdmono::MonoGCHandle::new_strong_handle(target);
- 		gchandle->release();
-		gchandle->set_handle(strong_gchandle, MonoGCHandle::STRONG_HANDLE);
-+		gchandle->set_handle(strong_gchandle, gdmono::MonoGCHandle::STRONG_HANDLE);
- 	}
- }
- 
-@@ -1386,7 +1386,7 @@ bool CSharpLanguage::refcount_decremented_instance_binding(Object *p_object) {
- 	CRASH_COND(!data);
- 
- 	CSharpScriptBinding &script_binding = ((Map<Object *, CSharpScriptBinding>::Element *)data)->get();
-	Ref<MonoGCHandle> &gchandle = script_binding.gchandle;
-+	Ref<gdmono::MonoGCHandle> &gchandle = script_binding.gchandle;
- 
- 	int refcount = ref_owner->reference_get_count();
- 
-@@ -1404,9 +1404,9 @@ bool CSharpLanguage::refcount_decremented_instance_binding(Object *p_object) {
- 			return refcount == 0; // Called after the managed side was collected, so nothing to do here
- 
- 		// Release the current strong handle and replace it with a weak handle.
-		uint32_t weak_gchandle = MonoGCHandle::new_weak_handle(target);
-+		uint32_t weak_gchandle = gdmono::MonoGCHandle::new_weak_handle(target);
- 		gchandle->release();
-		gchandle->set_handle(weak_gchandle, MonoGCHandle::WEAK_HANDLE);
-+		gchandle->set_handle(weak_gchandle, gdmono::MonoGCHandle::WEAK_HANDLE);
- 
- 		return false;
- 	}
-@@ -1414,7 +1414,7 @@ bool CSharpLanguage::refcount_decremented_instance_binding(Object *p_object) {
- 	return refcount == 0;
- }
- 
-CSharpInstance *CSharpInstance::create_for_managed_type(Object *p_owner, CSharpScript *p_script, const Ref<MonoGCHandle> &p_gchandle) {
-+CSharpInstance *CSharpInstance::create_for_managed_type(Object *p_owner, CSharpScript *p_script, const Ref<gdmono::MonoGCHandle> &p_gchandle) {
- 	CSharpInstance *instance = memnew(CSharpInstance);
- 
- 	Reference *ref = Object::cast_to<Reference>(p_owner);
-@@ -1832,7 +1832,7 @@ MonoObject *CSharpInstance::_internal_new_managed() {
- 	}
- 
- 	// Tie managed to unmanaged
-	gchandle = MonoGCHandle::create_strong(mono_object);
-+	gchandle = gdmono::MonoGCHandle::create_strong(mono_object);
- 
- 	if (base_ref)
- 		_reference_owner_unsafe(); // Here, after assigning the gchandle (for the refcount_incremented callback)
-@@ -1902,9 +1902,9 @@ void CSharpInstance::refcount_incremented() {
- 		// so the owner must hold the managed side alive again to avoid it from being GCed.
- 
- 		// Release the current weak handle and replace it with a strong handle.
-		uint32_t strong_gchandle = MonoGCHandle::new_strong_handle(gchandle->get_target());
-+		uint32_t strong_gchandle = gdmono::MonoGCHandle::new_strong_handle(gchandle->get_target());
- 		gchandle->release();
-		gchandle->set_handle(strong_gchandle, MonoGCHandle::STRONG_HANDLE);
-+		gchandle->set_handle(strong_gchandle, gdmono::MonoGCHandle::STRONG_HANDLE);
- 	}
- }
- 
-@@ -1925,9 +1925,9 @@ bool CSharpInstance::refcount_decremented() {
- 		// the managed instance takes responsibility of deleting the owner when GCed.
- 
- 		// Release the current strong handle and replace it with a weak handle.
-		uint32_t weak_gchandle = MonoGCHandle::new_weak_handle(gchandle->get_target());
-+		uint32_t weak_gchandle = gdmono::MonoGCHandle::new_weak_handle(gchandle->get_target());
- 		gchandle->release();
-		gchandle->set_handle(weak_gchandle, MonoGCHandle::WEAK_HANDLE);
-+		gchandle->set_handle(weak_gchandle, gdmono::MonoGCHandle::WEAK_HANDLE);
- 
- 		return false;
- 	}
-@@ -2298,7 +2298,7 @@ bool CSharpScript::_update_exports(PlaceHolderScriptInstance *p_instance_to_upda
- 				return false;
- 			}
- 
-			tmp_pinned_gchandle = MonoGCHandle::new_strong_handle_pinned(tmp_object); // pin it (not sure if needed)
-+			tmp_pinned_gchandle = gdmono::MonoGCHandle::new_strong_handle_pinned(tmp_object); // pin it (not sure if needed)
- 
- 			GDMonoMethod *ctor = script_class->get_method(CACHED_STRING_NAME(dotctor), 0);
- 
-@@ -2313,7 +2313,7 @@ bool CSharpScript::_update_exports(PlaceHolderScriptInstance *p_instance_to_upda
- 			if (ctor_exc) {
- 				// TODO: Should we free 'tmp_native' if the exception was thrown after its creation?
- 
-				MonoGCHandle::free_handle(tmp_pinned_gchandle);
-+				gdmono::MonoGCHandle::free_handle(tmp_pinned_gchandle);
- 				tmp_object = NULL;
- 
- 				ERR_PRINT("Exception thrown from constructor of temporary MonoObject:");
-@@ -2409,7 +2409,7 @@ bool CSharpScript::_update_exports(PlaceHolderScriptInstance *p_instance_to_upda
- 				GDMonoUtils::debug_print_unhandled_exception(exc);
- 			}
- 
-			MonoGCHandle::free_handle(tmp_pinned_gchandle);
-+			gdmono::MonoGCHandle::free_handle(tmp_pinned_gchandle);
- 			tmp_object = NULL;
- 
- 			if (tmp_native && !base_ref) {
-@@ -2970,7 +2970,7 @@ CSharpInstance *CSharpScript::_create_instance(const Variant **p_args, int p_arg
- 	}
- 
- 	// Tie managed to unmanaged
-	instance->gchandle = MonoGCHandle::create_strong(mono_object);
-+	instance->gchandle = gdmono::MonoGCHandle::create_strong(mono_object);
- 
- 	if (instance->base_ref)
- 		instance->_reference_owner_unsafe(); // Here, after assigning the gchandle (for the refcount_incremented callback)
-diff --git a/modules/mono/csharp_script.h b/modules/mono/csharp_script.h
-index 3be55848d5..7b3981ef90 100644
--- a/modules/mono/csharp_script.h
-+++ b/modules/mono/csharp_script.h
-@@ -220,7 +220,7 @@ class CSharpInstance : public ScriptInstance {
- 	bool destructing_script_instance;
- 
- 	Ref<CSharpScript> script;
-	Ref<MonoGCHandle> gchandle;
-+	Ref<gdmono::MonoGCHandle> gchandle;
- 
- 	bool _reference_owner_unsafe();
- 
-@@ -236,7 +236,7 @@ class CSharpInstance : public ScriptInstance {
- 
- 	// Do not use unless you know what you are doing
- 	friend void GDMonoInternals::tie_managed_to_unmanaged(MonoObject *, Object *);
-	static CSharpInstance *create_for_managed_type(Object *p_owner, CSharpScript *p_script, const Ref<MonoGCHandle> &p_gchandle);
-+	static CSharpInstance *create_for_managed_type(Object *p_owner, CSharpScript *p_script, const Ref<gdmono::MonoGCHandle> &p_gchandle);
- 
- 	void _call_multilevel(MonoObject *p_mono_object, const StringName &p_method, const Variant **p_args, int p_argcount);
- 
-@@ -293,7 +293,7 @@ struct CSharpScriptBinding {
- 	bool inited;
- 	StringName type_name;
- 	GDMonoClass *wrapper_class;
-	Ref<MonoGCHandle> gchandle;
-+	Ref<gdmono::MonoGCHandle> gchandle;
- 	Object *owner;
- };
- 
-@@ -371,8 +371,8 @@ public:
- 	_FORCE_INLINE_ EditorPlugin *get_godotsharp_editor() const { return godotsharp_editor; }
- #endif
- 
-	static void release_script_gchandle(Ref<MonoGCHandle> &p_gchandle);
-	static void release_script_gchandle(MonoObject *p_expected_obj, Ref<MonoGCHandle> &p_gchandle);
-+	static void release_script_gchandle(Ref<gdmono::MonoGCHandle> &p_gchandle);
-+	static void release_script_gchandle(MonoObject *p_expected_obj, Ref<gdmono::MonoGCHandle> &p_gchandle);
- 
- 	bool debug_break(const String &p_error, bool p_allow_continue = true);
- 	bool debug_break_parse(const String &p_file, int p_line, const String &p_error);
-diff --git a/modules/mono/glue/base_object_glue.cpp b/modules/mono/glue/base_object_glue.cpp
-index 7a3ec459de..4931583884 100644
--- a/modules/mono/glue/base_object_glue.cpp
-+++ b/modules/mono/glue/base_object_glue.cpp
-@@ -70,7 +70,7 @@ void godot_icall_Object_Disposed(MonoObject *p_obj, Object *p_ptr) {
- 	if (data) {
- 		CSharpScriptBinding &script_binding = ((Map<Object *, CSharpScriptBinding>::Element *)data)->get();
- 		if (script_binding.inited) {
-			Ref<MonoGCHandle> &gchandle = script_binding.gchandle;
-+			Ref<gdmono::MonoGCHandle> &gchandle = script_binding.gchandle;
- 			if (gchandle.is_valid()) {
- 				CSharpLanguage::release_script_gchandle(p_obj, gchandle);
- 			}
-@@ -117,7 +117,7 @@ void godot_icall_Reference_Disposed(MonoObject *p_obj, Object *p_ptr, MonoBoolea
- 		if (data) {
- 			CSharpScriptBinding &script_binding = ((Map<Object *, CSharpScriptBinding>::Element *)data)->get();
- 			if (script_binding.inited) {
-				Ref<MonoGCHandle> &gchandle = script_binding.gchandle;
-+				Ref<gdmono::MonoGCHandle> &gchandle = script_binding.gchandle;
- 				if (gchandle.is_valid()) {
- 					CSharpLanguage::release_script_gchandle(p_obj, gchandle);
- 				}
-diff --git a/modules/mono/mono_gc_handle.cpp b/modules/mono/mono_gc_handle.cpp
-index eb2227dd78..e70c701331 100644
--- a/modules/mono/mono_gc_handle.cpp
-+++ b/modules/mono/mono_gc_handle.cpp
-@@ -32,6 +32,8 @@
- 
- #include "mono_gd/gd_mono.h"
- 
-+namespace gdmono {
-+
- uint32_t MonoGCHandle::new_strong_handle(MonoObject *p_object) {
- 	return mono_gchandle_new(p_object, /* pinned: */ false);
- }
-@@ -76,3 +78,5 @@ MonoGCHandle::MonoGCHandle(uint32_t p_handle, HandleType p_handle_type) {
- MonoGCHandle::~MonoGCHandle() {
- 	release();
- }
-+
-+} // namespace gdmono
-diff --git a/modules/mono/mono_gc_handle.h b/modules/mono/mono_gc_handle.h
-index 5f99a46479..28fcbd7a78 100644
--- a/modules/mono/mono_gc_handle.h
-+++ b/modules/mono/mono_gc_handle.h
-@@ -35,6 +35,8 @@
- 
- #include "core/reference.h"
- 
-+namespace gdmono {
-+
- class MonoGCHandle : public Reference {
- 	GDCLASS(MonoGCHandle, Reference);
- 
-@@ -72,4 +74,6 @@ public:
- 	~MonoGCHandle();
- };
- 
-+} // namespace gdmono
-+
- #endif // MONO_GC_HANDLE_H
-diff --git a/modules/mono/mono_gd/gd_mono_cache.cpp b/modules/mono/mono_gd/gd_mono_cache.cpp
-index 2ece9d0f36..976a8f2ff2 100644
--- a/modules/mono/mono_gd/gd_mono_cache.cpp
-+++ b/modules/mono/mono_gd/gd_mono_cache.cpp
-@@ -178,7 +178,7 @@ void CachedData::clear_godot_api_cache() {
- 
- 	// End of MarshalUtils methods
- 
-	task_scheduler_handle = Ref<MonoGCHandle>();
-+	task_scheduler_handle = Ref<gdmono::MonoGCHandle>();
- }
- 
- #define GODOT_API_CLASS(m_class) (GDMono::get_singleton()->get_core_api_assembly()->get_class(BINDINGS_NAMESPACE, #m_class))
-@@ -300,7 +300,7 @@ void update_godot_api_cache() {
- 	// TODO Move to CSharpLanguage::init() and do handle disposal
- 	MonoObject *task_scheduler = mono_object_new(mono_domain_get(), GODOT_API_CLASS(GodotTaskScheduler)->get_mono_ptr());
- 	GDMonoUtils::runtime_object_init(task_scheduler, GODOT_API_CLASS(GodotTaskScheduler));
-	cached_data.task_scheduler_handle = MonoGCHandle::create_strong(task_scheduler);
-+	cached_data.task_scheduler_handle = gdmono::MonoGCHandle::create_strong(task_scheduler);
- 
- 	cached_data.godot_api_cache_updated = true;
- }
-diff --git a/modules/mono/mono_gd/gd_mono_cache.h b/modules/mono/mono_gd/gd_mono_cache.h
-index 2ed8482552..a4e05bbf5b 100644
--- a/modules/mono/mono_gd/gd_mono_cache.h
-+++ b/modules/mono/mono_gd/gd_mono_cache.h
-@@ -149,7 +149,7 @@ struct CachedData {
- 
- 	// End of MarshalUtils methods
- 
-	Ref<MonoGCHandle> task_scheduler_handle;
-+	Ref<gdmono::MonoGCHandle> task_scheduler_handle;
- 
- 	bool corlib_cache_updated;
- 	bool godot_api_cache_updated;
-diff --git a/modules/mono/mono_gd/gd_mono_internals.cpp b/modules/mono/mono_gd/gd_mono_internals.cpp
-index 4d2209ccec..a0102335b7 100644
--- a/modules/mono/mono_gd/gd_mono_internals.cpp
-+++ b/modules/mono/mono_gd/gd_mono_internals.cpp
-@@ -71,7 +71,7 @@ void tie_managed_to_unmanaged(MonoObject *managed, Object *unmanaged) {
- 		script_binding.inited = true;
- 		script_binding.type_name = NATIVE_GDMONOCLASS_NAME(klass);
- 		script_binding.wrapper_class = klass;
-		script_binding.gchandle = ref ? MonoGCHandle::create_weak(managed) : MonoGCHandle::create_strong(managed);
-+		script_binding.gchandle = ref ? gdmono::MonoGCHandle::create_weak(managed) : gdmono::MonoGCHandle::create_strong(managed);
- 		script_binding.owner = unmanaged;
- 
- 		if (ref) {
-@@ -101,7 +101,7 @@ void tie_managed_to_unmanaged(MonoObject *managed, Object *unmanaged) {
- 		return;
- 	}
- 
-	Ref<MonoGCHandle> gchandle = ref ? MonoGCHandle::create_weak(managed) : MonoGCHandle::create_strong(managed);
-+	Ref<gdmono::MonoGCHandle> gchandle = ref ? gdmono::MonoGCHandle::create_weak(managed) : gdmono::MonoGCHandle::create_strong(managed);
- 
- 	Ref<CSharpScript> script = CSharpScript::create_for_managed_type(klass, native);
- 
-diff --git a/modules/mono/mono_gd/gd_mono_utils.cpp b/modules/mono/mono_gd/gd_mono_utils.cpp
-index 4b6b0af21f..0f6545c6ef 100644
--- a/modules/mono/mono_gd/gd_mono_utils.cpp
-+++ b/modules/mono/mono_gd/gd_mono_utils.cpp
-@@ -83,7 +83,7 @@ MonoObject *unmanaged_get_managed(Object *unmanaged) {
- 		}
- 	}
- 
-	Ref<MonoGCHandle> &gchandle = script_binding.gchandle;
-+	Ref<gdmono::MonoGCHandle> &gchandle = script_binding.gchandle;
- 	ERR_FAIL_COND_V(gchandle.is_null(), NULL);
- 
- 	MonoObject *target = gchandle->get_target();
-@@ -103,7 +103,7 @@ MonoObject *unmanaged_get_managed(Object *unmanaged) {
- 	MonoObject *mono_object = GDMonoUtils::create_managed_for_godot_object(script_binding.wrapper_class, script_binding.type_name, unmanaged);
- 	ERR_FAIL_NULL_V(mono_object, NULL);
- 
-	gchandle->set_handle(MonoGCHandle::new_strong_handle(mono_object), MonoGCHandle::STRONG_HANDLE);
-+	gchandle->set_handle(gdmono::MonoGCHandle::new_strong_handle(mono_object), gdmono::MonoGCHandle::STRONG_HANDLE);
- 
- 	// Tie managed to unmanaged
- 	Reference *ref = Object::cast_to<Reference>(unmanaged);
-diff --git a/modules/mono/signal_awaiter_utils.cpp b/modules/mono/signal_awaiter_utils.cpp
-index 6c7bb1028c..f3adf4cd77 100644
--- a/modules/mono/signal_awaiter_utils.cpp
-+++ b/modules/mono/signal_awaiter_utils.cpp
-@@ -117,7 +117,7 @@ void SignalAwaiterHandle::_bind_methods() {
- }
- 
- SignalAwaiterHandle::SignalAwaiterHandle(MonoObject *p_managed) :
-		MonoGCHandle(MonoGCHandle::new_strong_handle(p_managed), STRONG_HANDLE) {
-+		gdmono::MonoGCHandle(gdmono::MonoGCHandle::new_strong_handle(p_managed), STRONG_HANDLE) {
- #ifdef DEBUG_ENABLED
- 	conn_target_id = 0;
- #endif
-diff --git a/modules/mono/signal_awaiter_utils.h b/modules/mono/signal_awaiter_utils.h
-index 5a8154b001..8cf20e98fd 100644
--- a/modules/mono/signal_awaiter_utils.h
-+++ b/modules/mono/signal_awaiter_utils.h
-@@ -39,8 +39,8 @@ namespace SignalAwaiterUtils {
- Error connect_signal_awaiter(Object *p_source, const String &p_signal, Object *p_target, MonoObject *p_awaiter);
- }
- 
-class SignalAwaiterHandle : public MonoGCHandle {
-	GDCLASS(SignalAwaiterHandle, MonoGCHandle);
-+class SignalAwaiterHandle : public gdmono::MonoGCHandle {
-+	GDCLASS(SignalAwaiterHandle, gdmono::MonoGCHandle);
- 
- 	bool completed;
- 
-- 
-2.49.0
-
@@ -563,10 +563,6 @@ let
        # Enable CEC over DisplayPort
        DRM_DP_CEC = whenOlder "6.10" yes;
        DRM_DISPLAY_DP_AUX_CEC = whenAtLeast "6.10" yes;
-
-        # Required for Nova
-        # FIXME: remove after https://gitlab.freedesktop.org/drm/rust/kernel/-/commit/3d3352e73a55a4ccf110f8b3419bbe2fbfd8a030 lands
-        RUST_FW_LOADER_ABSTRACTIONS = lib.mkIf withRust (whenAtLeast "6.12" yes);
      }
      //
        lib.optionalAttrs
@@ -25,13 +25,13 @@
        "lts": true
    },
    "6.12": {
-        "version": "6.12.66",
-        "hash": "sha256:1bvfadb5149sh927f8cbr1rnypn7v0h6znjdrc1mmc30q2hrff5s",
+        "version": "6.12.67",
+        "hash": "sha256:0cn42b7pam5ssk740s3d42sp3cggl923yvs67y5fz98z5v35v00n",
        "lts": true
    },
    "6.18": {
-        "version": "6.18.6",
-        "hash": "sha256:06x3z649mzwwkb1hvsy0yh7j5jk9qrnwqcmwy7dx8s1ggccrf927",
+        "version": "6.18.7",
+        "hash": "sha256:07lgbc0w7fd9akxmazhkpjgxhd3ffwh7in2nkchhdbprbk8s89mp",
        "lts": false
    }
 }
@@ -16,9 +16,9 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.18.5"; # zen
+      version = "6.18.6"; # zen
      suffix = "zen1"; # zen
-      sha256 = "1slclm2mgv7z3s0lcjrhqhzhbas4yq9yxkdjr27hlx7madplwbmi"; # zen
+      sha256 = "13qr95dncg3n2ijcnvxwgsh5jvmls60znfq68ikivmji06klps2r"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
@@ -1,21 +0,0 @@
-diff --git a/tests/test_services.py b/tests/test_services.py
-index 1fb07b3..f7a552c 100644
--- a/tests/test_services.py
-+++ b/tests/test_services.py
-@@ -3,6 +3,7 @@ from dataclasses import asdict
- 
- import pytest
- from homeassistant.helpers.entity_registry import DATA_REGISTRY, EntityRegistry
-+from homeassistant.helpers.trigger import TRIGGERS, TRIGGER_PLATFORM_SUBSCRIPTIONS
- from homeassistant.loader import (
-     DATA_COMPONENTS,
-     DATA_INTEGRATIONS,
-@@ -31,6 +32,8 @@ def setup_hass_for_service_test(hass):
-     hass.data[DATA_PRELOAD_PLATFORMS] = {}
-     hass.data[DATA_MISSING_PLATFORMS] = {}
-     hass.data[DATA_REGISTRY] = EntityRegistry(hass)
-+    hass.data[TRIGGER_PLATFORM_SUBSCRIPTIONS] = []
-+    hass.data[TRIGGERS] = {}
-     return hass
- 
- 
@@ -19,20 +19,15 @@
 buildHomeAssistantComponent rec {
  owner = "signalkraft";
  domain = "mypyllant";
-  version = "0.9.9";
+  version = "0.9.10";

  src = fetchFromGitHub {
    owner = "signalkraft";
    repo = "mypyllant-component";
    tag = "v${version}";
-    hash = "sha256-6T8SGAP2535VqZmvSeITpMIa0SBJhnWsOKM1Y66WhHE=";
+    hash = "sha256-4IfLd+NEaWyxgdnAz7YGM/6i0usoqwgKlBJFzDOlJ4A=";
  };

-  patches = [
-    # Migrates tests to the new version of `pytest-homeassistant-custom-component` (see https://github.com/signalkraft/mypyllant-component/pull/394).
-    ./migrate-to-new-pytest-homeassistant-custom-component.patch
-  ];
-
  dependencies = [
    mypyllant
    voluptuous
@@ -1577,6 +1577,7 @@ mapAliases {
  seahub = throw "'seahub' has been removed as it is unmaintained"; # Added 2025-08-21
  semiphemeral = throw "'semiphemeral' has been removed as it is archived upstream"; # Added 2025-11-06
  sequoia = throw "'sequoia' has been renamed to/replaced by 'sequoia-sq'"; # Converted to throw 2025-10-27
+  sequoia-sqop = sequoia-sop; # Added 2026-01-23
  serverless = throw "'serverless' has been removed because version 3.x is unmaintained upstream and vulnerable, and version 4.x lacks a suitable binary or source download."; # Added 2025-11-22
  session-desktop-appimage = throw "'session-desktop-appimage' has been renamed to/replaced by 'session-desktop'"; # Converted to throw 2025-10-27
  sexp = throw "'sexp' has been renamed to/replaced by 'sexpp'"; # Converted to throw 2025-10-27
@@ -5784,6 +5784,7 @@ with pkgs;
    electron_37-bin
    electron_38-bin
    electron_39-bin
+    electron_40-bin
    ;

  inherit (callPackages ../development/tools/electron/chromedriver { })
@@ -5791,6 +5792,7 @@ with pkgs;
    electron-chromedriver_37
    electron-chromedriver_38
    electron-chromedriver_39
+    electron-chromedriver_40
    ;

  electron_36 = electron_36-bin;
@@ -5809,6 +5811,11 @@ with pkgs;
      electron-source.electron_39
    else
      electron_39-bin;
+  electron_40 =
+    if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_40 then
+      electron-source.electron_40
+    else
+      electron_40-bin;
  electron = electron_38;
  electron-bin = electron_38-bin;
  electron-chromedriver = electron-chromedriver_38;
@@ -825,6 +825,8 @@ let

        httpaf-lwt-unix = callPackage ../development/ocaml-modules/httpaf/lwt-unix.nix { };

+        httpcats = callPackage ../development/ocaml-modules/httpcats { };
+
        httpun = callPackage ../development/ocaml-modules/httpun { };

        httpun-eio = callPackage ../development/ocaml-modules/httpun/eio.nix { };