From 9d5859c1249fea128d39b621ae0c5520ed23a5ca Mon Sep 17 00:00:00 2001
From: Malix <alixbrunetcontact@gmail.com>
Date: Fri, 12 Sep 2025 20:35:18 +0200
Subject: [PATCH 01/55] nixos/pipewire: pin the linked docs

---
 nixos/modules/services/desktops/pipewire/pipewire.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index dca78ef6d301..db3c2f27e16d 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -144,7 +144,7 @@ in
 
           Enabling system-wide PipeWire is however not recommended and disabled
           by default according to
-          https://github.com/PipeWire/pipewire/blob/master/NEWS
+          https://github.com/PipeWire/pipewire/blob/0.3.11/NEWS#L14-L16
         '';
       };
 

From 7b2ff2f909a831733b3f2802695481e666f4a663 Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Thu, 8 Jan 2026 23:55:46 +0100
Subject: [PATCH 02/55] nixos/kanidm: Automatically rename server domain

---
 nixos/modules/services/security/kanidm.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 0abf864a8fc7..9c876a7948fd 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -905,6 +905,7 @@ in
           StateDirectory = "kanidm";
           StateDirectoryMode = "0700";
           RuntimeDirectory = "kanidmd";
+          ExecStartPre = "${cfg.package}/bin/kanidmd domain rename -c ${serverConfigFile}";
           ExecStart = "${cfg.package}/bin/kanidmd server -c ${serverConfigFile}";
           ExecStartPost = mkIf cfg.provision.enable postStartScript;
           User = "kanidm";

From 2b06eb171623f8d5707c9675250bc7aae3dce330 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Neumann?= <necoro@necoro.eu>
Date: Tue, 27 Jan 2026 14:30:06 +0100
Subject: [PATCH 03/55] podman: make gvproxy a darwin-only strict requirement

gvproxy is needed to run `podman machine` that is not necessary under
Linux. If one has the urge to also do so under Linux, it still can be added
to `extraRuntimes`.
---
 pkgs/by-name/po/podman/package.nix | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 6057168de143..9b4c712a8256 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -178,18 +178,19 @@ buildGoModule (finalAttrs: {
       name = "podman-helper-binary-wrapper";
 
       # this only works for some binaries, others may need to be added to `binPath` or in the modules
-      paths = [
-        gvproxy
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isLinux [
-        aardvark-dns
-        catatonit # added here for the pause image and also set in `containersConf` for `init_path`
-        netavark
-        passt
-        conmon
-        crun
-      ]
-      ++ extraRuntimes;
+      paths =
+        lib.optionals stdenv.hostPlatform.isDarwin [
+          gvproxy
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isLinux [
+          aardvark-dns
+          catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+          netavark
+          passt
+          conmon
+          crun
+        ]
+        ++ extraRuntimes;
     };
   };
 

From d7d4c518943a5cfccdfeabb6e2b1c7eae340ba77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 5 Feb 2026 15:10:15 +0100
Subject: [PATCH 04/55] octavePackages: remove broken packages

Remove fem-fenics, level-set, parallel, sparsersb, tisean, vibes, and
vrml packages which have been marked broken since NixOS 24.05 and
remain unfixed.

Per RFC 180, packages broken for a full release cycle are subject
to removal.

https://github.com/NixOS/rfcs/pull/180
---
 .../interpreters/octave/default.nix           |  2 +
 .../octave-modules/fem-fenics/default.nix     | 36 ------------
 .../octave-modules/level-set/default.nix      | 57 -------------------
 .../octave-modules/parallel/default.nix       | 43 --------------
 .../octave-modules/sparsersb/default.nix      | 29 ----------
 .../octave-modules/tisean/default.nix         | 36 ------------
 .../octave-modules/vibes/default.nix          | 43 --------------
 .../octave-modules/vrml/default.nix           | 45 ---------------
 pkgs/top-level/octave-packages.nix            | 34 ++++-------
 9 files changed, 12 insertions(+), 313 deletions(-)
 delete mode 100644 pkgs/development/octave-modules/fem-fenics/default.nix
 delete mode 100644 pkgs/development/octave-modules/level-set/default.nix
 delete mode 100644 pkgs/development/octave-modules/parallel/default.nix
 delete mode 100644 pkgs/development/octave-modules/sparsersb/default.nix
 delete mode 100644 pkgs/development/octave-modules/tisean/default.nix
 delete mode 100644 pkgs/development/octave-modules/vibes/default.nix
 delete mode 100644 pkgs/development/octave-modules/vrml/default.nix

diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index a1add4055af5..506e75019f04 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   pkgs,
+  config,
   lib,
   fetchurl,
   gfortran,
@@ -207,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
     octavePackages = import ../../../top-level/octave-packages.nix {
       pkgs = allPkgs;
       inherit
+        config
         lib
         stdenv
         fetchurl
diff --git a/pkgs/development/octave-modules/fem-fenics/default.nix b/pkgs/development/octave-modules/fem-fenics/default.nix
deleted file mode 100644
index 80029c9df0b3..000000000000
--- a/pkgs/development/octave-modules/fem-fenics/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  dolfin,
-  ffc,
-  pkg-config,
-}:
-
-buildOctavePackage rec {
-  pname = "fem-fenics";
-  version = "0.0.5";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1xd80nnkschldvrqx0wvrg3fzbf8sck8bvq24phr5x49xs7b8x78";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  propagatedBuildInputs = [
-    dolfin
-    ffc
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/fem-fenics/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Package for the resolution of partial differential equations based on fenics";
-    # Lots of compilation errors for newer octave versions and syntax errors
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/level-set/default.nix b/pkgs/development/octave-modules/level-set/default.nix
deleted file mode 100644
index 6ee69fa96eb3..000000000000
--- a/pkgs/development/octave-modules/level-set/default.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchgit,
-  automake,
-  autoconf,
-  autoconf-archive,
-  parallel,
-}:
-
-buildOctavePackage rec {
-  pname = "level-set";
-  version = "2019-04-13";
-
-  src = fetchgit {
-    url = "https://git.code.sf.net/p/octave/${pname}";
-    rev = "dbf46228a7582eef4fe5470fd00bc5b421dd33a5";
-    sha256 = "14qwa4j24m2j7njw8gbagkgmp040h6k0h7kyrrzgb9y0jm087qkl";
-    fetchSubmodules = false;
-  };
-
-  # The monstrosity of a regex below is to ensure that only error() calls are
-  # corrected to have a %s format specifier. However, logic_error() also
-  # exists, (a simple regex also matches that), but logic_error() doesn't
-  # require a format specifier. So, this regex was born to handle that...
-  postPatch = ''
-    substituteInPlace build.sh --replace "level-set-0.3.1" "${pname}-${version}" \
-                               --replace "\`pwd\`" '/build'
-    sed -i -E 's#[^[:graph:]]error \(# error \(\"%s\", #g' src/*.cpp
-  '';
-
-  nativeBuildInputs = [
-    automake
-    autoconf
-    autoconf-archive
-  ];
-
-  requiredOctavePackages = [
-    parallel
-  ];
-
-  preBuild = ''
-    mkdir -p $out
-    source ./build.sh
-    cd -
-  '';
-
-  meta = {
-    name = "Level Set";
-    homepage = "https://gnu-octave.github.io/packages/level-set/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Routines for calculating the time-evolution of the level-set equation and extracting geometric information from the level-set function";
-    # Got broke with octave 8.x update, and wasn't updated since 2019
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/parallel/default.nix b/pkgs/development/octave-modules/parallel/default.nix
deleted file mode 100644
index fc0681ea0a02..000000000000
--- a/pkgs/development/octave-modules/parallel/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  struct,
-  gnutls,
-  pkg-config,
-}:
-
-buildOctavePackage rec {
-  pname = "parallel";
-  version = "4.0.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1h8vw2r42393px6dk10y3lhpxl168r9d197f9whz6lbk2rg571pa";
-  };
-  patches = [
-    ../database/c_verror.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    gnutls
-  ];
-
-  requiredOctavePackages = [
-    struct
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/parallel/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Parallel execution package";
-    # Although upstream has added an identical patch to that of ../database, it
-    # still won't build with octave>8.1
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/sparsersb/default.nix b/pkgs/development/octave-modules/sparsersb/default.nix
deleted file mode 100644
index a55de57ccbcb..000000000000
--- a/pkgs/development/octave-modules/sparsersb/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  librsb,
-}:
-
-buildOctavePackage rec {
-  pname = "sparsersb";
-  version = "1.0.9";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0jyy2m7wylzyjqj9n6mjizhj0ccq8xnxm2g6pdlrmncxq1401khd";
-  };
-
-  propagatedBuildInputs = [
-    librsb
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/sparsersb/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Interface to the librsb package implementing the RSB sparse matrix format for fast shared-memory sparse matrix computations";
-    # Broken since octave>8.x
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/tisean/default.nix b/pkgs/development/octave-modules/tisean/default.nix
deleted file mode 100644
index b575b231843f..000000000000
--- a/pkgs/development/octave-modules/tisean/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  # Octave dependencies
-  signal, # >= 1.3.0
-  # Build dependencies
-  gfortran,
-}:
-
-buildOctavePackage rec {
-  pname = "tisean";
-  version = "0.2.3";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0nc2d9h91glxzmpizxdrc2dablw4bqhqhzs37a394c36myk4xjdv";
-  };
-
-  nativeBuildInputs = [
-    gfortran
-  ];
-
-  requiredOctavePackages = [
-    signal
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/tisean/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Port of TISEAN 3.0.1";
-    # Broken since octave 8.x update, and wasn't updated since 2021
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/vibes/default.nix b/pkgs/development/octave-modules/vibes/default.nix
deleted file mode 100644
index 7bdbf20316df..000000000000
--- a/pkgs/development/octave-modules/vibes/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  vibes,
-}:
-
-buildOctavePackage rec {
-  pname = "vibes";
-  version = "0.2.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1zn86rcsjkqg67hphz5inxc5xkgr18sby8za68zhppc2z7pd91ng";
-  };
-
-  buildInputs = [
-    vibes
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/vibes/";
-    license = with lib.licenses; [
-      gpl3Plus
-      mit
-    ];
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Easily display results (boxes, pavings) from interval methods";
-    longDescription = ''
-      The VIBes API allows one to easily display results (boxes, pavings) from
-      interval methods. VIBes consists in two parts: (1) the VIBes application
-      that features viewing, annotating and exporting figures, and (2) the
-      VIBes API that enables your program to communicate with the viewer in order
-      to draw figures. This package integrates the VIBes API into Octave. The
-      VIBes application is required for operation and must be installed
-      separately. Data types from third-party interval arithmetic libraries for
-      Octave are also supported.
-    '';
-    # Marked this way until KarlJoad gets around to packaging the vibes program.
-    # https://github.com/ENSTABretagneRobotics/VIBES
-    broken = true;
-  };
-}
diff --git a/pkgs/development/octave-modules/vrml/default.nix b/pkgs/development/octave-modules/vrml/default.nix
deleted file mode 100644
index 498837478f05..000000000000
--- a/pkgs/development/octave-modules/vrml/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  # Octave dependencies
-  linear-algebra,
-  miscellaneous,
-  struct,
-  statistics,
-  # Runtime dependencies
-  freewrl,
-}:
-
-buildOctavePackage rec {
-  pname = "vrml";
-  version = "1.0.14";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Vfj0Q2CyOi7CrphZSl10Xv7QxTSvWdGk0Ya+SiewqV4=";
-  };
-
-  propagatedBuildInputs = [
-    freewrl
-  ];
-
-  requiredOctavePackages = [
-    linear-algebra
-    miscellaneous
-    struct
-    statistics
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/vrml/";
-    license = with lib.licenses; [
-      gpl3Plus
-      fdl12Plus
-    ];
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "3D graphics using VRML";
-    # Marked this way until KarlJoad gets freewrl as a runtime dependency.
-    broken = true;
-  };
-}
diff --git a/pkgs/top-level/octave-packages.nix b/pkgs/top-level/octave-packages.nix
index 00901a75cb5b..2a779ccac1d2 100644
--- a/pkgs/top-level/octave-packages.nix
+++ b/pkgs/top-level/octave-packages.nix
@@ -13,6 +13,7 @@
 # from outside, we can `inherit` them from `pkgs`.
 {
   pkgs,
+  config,
   lib,
   stdenv,
   fetchurl,
@@ -91,12 +92,6 @@ makeScope newScope (
 
     econometrics = callPackage ../development/octave-modules/econometrics { };
 
-    fem-fenics = callPackage ../development/octave-modules/fem-fenics {
-      # PLACEHOLDER until KarlJoad gets dolfin packaged.
-      dolfin = null;
-      ffc = null;
-    };
-
     fits = callPackage ../development/octave-modules/fits { };
 
     financial = callPackage ../development/octave-modules/financial { };
@@ -131,8 +126,6 @@ makeScope newScope (
 
     interval = callPackage ../development/octave-modules/interval { };
 
-    level-set = callPackage ../development/octave-modules/level-set { };
-
     linear-algebra = callPackage ../development/octave-modules/linear-algebra { };
 
     lssa = callPackage ../development/octave-modules/lssa { };
@@ -182,8 +175,6 @@ makeScope newScope (
 
     optiminterp = callPackage ../development/octave-modules/optiminterp { };
 
-    parallel = callPackage ../development/octave-modules/parallel { };
-
     quaternion = callPackage ../development/octave-modules/quaternion { };
 
     queueing = callPackage ../development/octave-modules/queueing { };
@@ -192,8 +183,6 @@ makeScope newScope (
 
     sockets = callPackage ../development/octave-modules/sockets { };
 
-    sparsersb = callPackage ../development/octave-modules/sparsersb { };
-
     stk = callPackage ../development/octave-modules/stk { };
 
     splines = callPackage ../development/octave-modules/splines { };
@@ -208,22 +197,10 @@ makeScope newScope (
       inherit (octave) python;
     };
 
-    tisean = callPackage ../development/octave-modules/tisean { };
-
     tsa = callPackage ../development/octave-modules/tsa { };
 
-    vibes = callPackage ../development/octave-modules/vibes {
-      vibes = null;
-      # TODO: Need to package vibes:
-      # https://github.com/ENSTABretagneRobotics/VIBES
-    };
-
     video = callPackage ../development/octave-modules/video { };
 
-    vrml = callPackage ../development/octave-modules/vrml {
-      freewrl = null;
-    };
-
     windows = callPackage ../development/octave-modules/windows { };
 
     zeromq = callPackage ../development/octave-modules/zeromq {
@@ -231,4 +208,13 @@ makeScope newScope (
     };
 
   }
+  // lib.optionalAttrs config.allowAliases {
+    fem-fenics = throw "octavePackages.fem-fenics has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    level-set = throw "octavePackages.level-set has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    parallel = throw "octavePackages.parallel has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    sparsersb = throw "octavePackages.sparsersb has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    tisean = throw "octavePackages.tisean has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    vibes = throw "octavePackages.vibes has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    vrml = throw "octavePackages.vrml has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+  }
 )

From a1db34215f6b698b4c08e0617d4f4f3878d75c9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 5 Feb 2026 15:12:26 +0100
Subject: [PATCH 05/55] ocamlPackages: remove broken packages

Remove ocaml-freestanding and torch packages which have been marked
broken since NixOS 24.05 and remain unfixed.

- ocaml-freestanding: Not compatible with solo5 >= 0.7
- torch: Not compatible with libtorch >= 2.3.0

Per RFC 180, packages broken for a full release cycle are subject
to removal.

https://github.com/NixOS/rfcs/pull/180
---
 .../ocaml-modules/mirage-crypto/default.nix   |  5 -
 .../ocaml-modules/mirage-crypto/ec.nix        |  6 --
 .../configurable-binding.patch                | 49 ----------
 .../ocaml-freestanding/default.nix            | 93 -------------------
 .../ocaml-freestanding/no-opam.patch          | 47 ----------
 .../ocaml-modules/tcpip/default.nix           |  5 -
 .../ocaml-modules/torch/default.nix           | 70 --------------
 pkgs/top-level/ocaml-packages.nix             |  8 +-
 8 files changed, 2 insertions(+), 281 deletions(-)
 delete mode 100644 pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch
 delete mode 100644 pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
 delete mode 100644 pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
 delete mode 100644 pkgs/development/ocaml-modules/torch/default.nix

diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index ddfd916532f7..e6004bdad6d6 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -6,8 +6,6 @@
   ounit2,
   dune-configurator,
   eqaf,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:
 
 buildDunePackage (finalAttrs: {
@@ -30,9 +28,6 @@ buildDunePackage (finalAttrs: {
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     eqaf
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
   ];
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
index b654c6dc3a05..6699de8e39cc 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
@@ -1,5 +1,4 @@
 {
-  lib,
   buildDunePackage,
   mirage-crypto,
   dune-configurator,
@@ -12,8 +11,6 @@
   ppx_deriving_yojson,
   ppx_deriving,
   yojson,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:
 
 buildDunePackage {
@@ -31,9 +28,6 @@ buildDunePackage {
   propagatedBuildInputs = [
     mirage-crypto
     mirage-crypto-rng
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
   ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch b/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch
deleted file mode 100644
index 25a7b92f01fc..000000000000
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-commit b273c9f7ab10475787db4d6e09bd4b71b374d0ec
-Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
-Date:   Thu Mar 18 01:28:46 2021 +0100
-
-    Let user specify solo5-binding to use
-    
-    This is a little feature for the configure script I wanted to have for
-    the NixOS package: It allows the user to set PKG_CONFIG_DEPS before
-    running configure.sh to disable the autodetection mechanism. This is
-    useful for NixOS as we have all bindings bundled in the solo5 package,
-    so the result would also be solo5-bindings-xen. Additionally, it allows
-    us to do the binding selection declaratively and minimize the risk of
-    accidentally switching backend.
-    
-    PKG_CONFIG_DEPS seems like a bit of an unappropriate variable name for a
-    user “interface”, let me know if you want a dedicated environment
-    variable for this in case there will be more PKG_CONFIG_DEPS.
-
-diff --git a/configure.sh b/configure.sh
-index c254f7b..c675a02 100755
---- a/configure.sh
-+++ b/configure.sh
-@@ -11,13 +11,19 @@ if pkg_exists solo5-bindings-hvt solo5-bindings-spt solo5-bindings-virtio solo5-
-     echo "ERROR: Only one of solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode, solo5-bindings-xen can be installed." 1>&2
-     exit 1
- fi
--PKG_CONFIG_DEPS=
--pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
--pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
--pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
--pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
--pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
--pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
-+if [ -z "${PKG_CONFIG_DEPS}" ]; then
-+    PKG_CONFIG_DEPS=
-+    pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
-+    pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
-+    pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
-+    pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
-+    pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
-+    pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
-+else
-+    pkg_exists "${PKG_CONFIG_DEPS}" \
-+        || (echo "ERROR: ${PKG_CONFIG_DEPS} is not installed" 1>&2; exit 1) \
-+        || exit 1
-+fi
- if [ -z "${PKG_CONFIG_DEPS}" ]; then
-     echo "ERROR: No supported Solo5 bindings package found." 1>&2
-     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
deleted file mode 100644
index a1e2906f1310..000000000000
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  ocaml,
-  pkg-config,
-  solo5,
-  target ? "xen",
-}:
-
-# note: this is not technically an ocaml-module,
-# but can be built with different compilers, so
-# the ocamlPackages set is very useful.
-
-let
-  pname = "ocaml-freestanding";
-in
-
-if lib.versionOlder ocaml.version "4.08" then
-  throw "${pname} is not available for OCaml ${ocaml.version}"
-else
-
-  stdenv.mkDerivation rec {
-    name = "ocaml${ocaml.version}-${pname}-${version}";
-    inherit pname;
-    version = "0.6.5";
-
-    src = fetchFromGitHub {
-      owner = "mirage";
-      repo = pname;
-      rev = "v${version}";
-      sha256 = "sha256:1mbyjzwcs64n7i3xkkyaxgl3r46drbl0gkqf3fqgm2kh3q03638l";
-    };
-
-    postUnpack = ''
-      # get ocaml-src from the ocaml drv instead of via ocamlfind
-      mkdir -p "${src.name}/ocaml"
-      tar --strip-components=1 -xf ${ocaml.src} -C "${src.name}/ocaml"
-    '';
-
-    patches = [
-      ./no-opam.patch
-      ./configurable-binding.patch
-    ];
-
-    strictDeps = true;
-
-    nativeBuildInputs = [
-      ocaml
-      pkg-config
-    ];
-
-    propagatedBuildInputs = [ solo5 ];
-
-    configurePhase = ''
-      runHook preConfigure
-      env PKG_CONFIG_DEPS=solo5-bindings-${target} sh configure.sh
-      runHook postConfigure
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      ./install.sh "$out"
-      runHook postInstall
-    '';
-
-    meta = {
-      broken = true; # Not compatible with solo5 ≥ 0.7
-      description = "Freestanding OCaml runtime";
-      license = lib.licenses.mit;
-      maintainers = [ lib.maintainers.sternenseemann ];
-      homepage = "https://github.com/mirage/ocaml-freestanding";
-      platforms = map ({ arch, os }: "${arch}-${os}") (
-        lib.cartesianProduct {
-          arch = [
-            "aarch64"
-            "x86_64"
-          ];
-          os = [ "linux" ];
-        }
-        ++ [
-          {
-            arch = "x86_64";
-            os = "freebsd";
-          }
-          {
-            arch = "x86_64";
-            os = "openbsd";
-          }
-        ]
-      );
-    };
-  }
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch b/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
deleted file mode 100644
index 45f271ec0f25..000000000000
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-commit 637b7ce639d54e617170433aa9596176b167d085
-Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
-Date:   Thu Mar 18 01:07:49 2021 +0100
-
-    Allow building without ocamlfind and opam
-    
-    This change is the result of my first go at packaging ocaml-freestanding
-    for NixOS. Our build infrastructure for ocaml there is completely
-    independent of opam at the moment, so depending on opam for the build
-    time is not an option, especially in this case where the information it
-    would give us would be garbage.
-    
-    Fortunately the build environment plays nicely with pkg-config which is
-    already heavily used by ocaml-freestanding. This patch leaves pkg-config
-    to its own devices if opam is not present (it can be assisted by a
-    manually set PKG_CONFIG_PATH environment variable).
-    
-    Additionally, in configure.sh we check if the target ocaml source
-    directory already exists. This allows for building ocaml-freestanding
-    without the ocaml-src package (which would be unnecessarily cumbersome
-    to package for NixOS) and ocamlfind (one less dependency is always a
-    nice bonus). The Makefile needs no fix since the target ocaml/Makefile
-    won't be built if it's already present.
-
-diff --git a/configure.sh b/configure.sh
-index 4d154ed..c254f7b 100755
---- a/configure.sh
-+++ b/configure.sh
-@@ -1,6 +1,8 @@
- #!/bin/sh
- 
--export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
-+if command -v opam &> /dev/null; then
-+    export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
-+fi
- pkg_exists() {
-     pkg-config --exists "$@"
- }
-@@ -21,7 +23,7 @@ if [ -z "${PKG_CONFIG_DEPS}" ]; then
-     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
-     exit 1
- fi
--ocamlfind query ocaml-src >/dev/null || exit 1
-+[ -e "$(dirname "$0")/ocaml" ] || ocamlfind query ocaml-src >/dev/null || exit 1
- 
- FREESTANDING_CFLAGS="$(pkg-config --cflags ${PKG_CONFIG_DEPS})"
- BUILD_ARCH="$(uname -m)"
diff --git a/pkgs/development/ocaml-modules/tcpip/default.nix b/pkgs/development/ocaml-modules/tcpip/default.nix
index 31337aee73b9..22aa7b3beed4 100644
--- a/pkgs/development/ocaml-modules/tcpip/default.nix
+++ b/pkgs/development/ocaml-modules/tcpip/default.nix
@@ -26,8 +26,6 @@
   ipaddr-cstruct,
   lru,
   metrics,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:
 
 buildDunePackage rec {
@@ -64,9 +62,6 @@ buildDunePackage rec {
     metrics
     arp
     mirage-flow
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
   ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/torch/default.nix b/pkgs/development/ocaml-modules/torch/default.nix
deleted file mode 100644
index 6138fb8a69bc..000000000000
--- a/pkgs/development/ocaml-modules/torch/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildDunePackage,
-  fetchFromGitHub,
-  fetchpatch,
-  cmdliner,
-  ctypes,
-  ctypes-foreign,
-  dune-configurator,
-  npy,
-  ocaml-compiler-libs,
-  ppx_custom_printf,
-  ppx_expect,
-  ppx_sexp_conv,
-  sexplib,
-  stdio,
-  torch,
-}:
-
-buildDunePackage rec {
-  pname = "torch";
-  version = "0.17";
-
-  minimalOCamlVersion = "4.08";
-
-  src = fetchFromGitHub {
-    owner = "LaurentMazare";
-    repo = "ocaml-${pname}";
-    rev = version;
-    hash = "sha256-z/9NUBjeFWE63Z/e8OyzDiy8hrn6qzjaiBH8G9MPeos=";
-  };
-
-  patches = [
-    # Pytorch 2.0 support. Drop when it reaches a release
-    (fetchpatch {
-      url = "https://github.com/LaurentMazare/ocaml-torch/commit/ef7ef30cafecb09e45ec1ed8ce4bedae5947cfa5.patch";
-      hash = "sha256-smdwKy40iIISp/25L2J4az6KmqFS1soeChBElUyhl5A=";
-    })
-  ];
-
-  buildInputs = [ dune-configurator ];
-
-  propagatedBuildInputs = [
-    cmdliner
-    ctypes
-    ctypes-foreign
-    npy
-    ocaml-compiler-libs
-    ppx_custom_printf
-    ppx_expect
-    ppx_sexp_conv
-    sexplib
-    stdio
-    torch
-    torch.dev
-  ];
-
-  preBuild = "export LIBTORCH=${torch.dev}/";
-
-  doCheck = !stdenv.hostPlatform.isAarch64;
-
-  meta = {
-    inherit (src.meta) homepage;
-    description = "Ocaml bindings to Pytorch";
-    maintainers = [ lib.maintainers.bcdarwin ];
-    license = lib.licenses.asl20;
-    broken = true; # Not compatible with libtorch ≥ 2.3.0
-  };
-}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 93228129e5f2..56f1b9a11e51 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1439,8 +1439,6 @@ let
 
         ocaml_expat = callPackage ../development/ocaml-modules/expat { };
 
-        ocaml-freestanding = callPackage ../development/ocaml-modules/ocaml-freestanding { };
-
         ocaml_gettext = callPackage ../development/ocaml-modules/ocaml-gettext { };
 
         ocaml_libvirt = callPackage ../development/ocaml-modules/ocaml-libvirt { };
@@ -2113,10 +2111,6 @@ let
 
         topkg = callPackage ../development/ocaml-modules/topkg { };
 
-        torch = callPackage ../development/ocaml-modules/torch {
-          torch = pkgs.libtorch-bin;
-        };
-
         trace = callPackage ../development/ocaml-modules/trace { };
 
         trace-tef = callPackage ../development/ocaml-modules/trace/tef.nix { };
@@ -2320,8 +2314,10 @@ let
         dune_2 = pkgs.dune_2; # Added 2025-12-08
         dune_3 = pkgs.dune_3; # Added 2025-12-08
         gd4o = throw "ocamlPackages.gd4o is not maintained, use ocamlPackages.gd instead";
+        ocaml-freestanding = throw "ocamlPackages.ocaml-freestanding has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
         ocaml-vdom = throw "2023-10-09: ocamlPackages.ocaml-vdom was renamed to ocamlPackages.vdom";
         ocaml_lwt = throw "ocamlPackages.ocaml_lwt has been renamed to ocamlPackages.lwt"; # Added 2025-12-05
+        torch = throw "ocamlPackages.torch has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
       }
     )).overrideScope
       liftJaneStreet;

From 2b115ef0cc14ebbc2ce66873873531eb7ba67b44 Mon Sep 17 00:00:00 2001
From: Jeremy Fleischman <jeremyfleischman@gmail.com>
Date: Tue, 3 Feb 2026 11:58:06 -0800
Subject: [PATCH 06/55] doc: update references to `nixfmt-rfc-style` to
 `treefmt`

This completes https://github.com/NixOS/nixpkgs/issues/425583.

Rather than putting `nixfmt` everywhere, I opted to teach people to use
`treefmt` instead. This is more correct, as we have formatting rules for
non-nix files, and also may invoke `nixfmt` with non-default options.
---
 doc/languages-frameworks/python.section.md            | 2 +-
 pkgs/applications/editors/vscode/extensions/README.md | 2 +-
 pkgs/by-name/ni/nixfmt-tree/package.nix               | 2 +-
 pkgs/development/lisp-modules/import/main.lisp        | 2 +-
 pkgs/development/lisp-modules/shell.nix               | 8 +++++---
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index f7a0ba9e4ba9..ce7ac04dd9b1 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -2136,7 +2136,7 @@ The following rules are desired to be respected:
 * `pythonImportsCheck` is set. This is still a good smoke test even if `pytestCheckHook` is set.
 * `meta.platforms` takes the default value in many cases.
   It does not need to be set explicitly unless the package requires a specific platform.
-* The file is formatted with `nixfmt-rfc-style`.
+* The file is formatted correctly (e.g., `nix-shell --run treefmt`).
 * Commit names of Python libraries must reflect that they are Python
   libraries (e.g. `python3Packages.numpy: 1.11 -> 1.12` rather than `numpy: 1.11 -> 1.12`).
   See also [`pkgs/README.md`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#commit-conventions).
diff --git a/pkgs/applications/editors/vscode/extensions/README.md b/pkgs/applications/editors/vscode/extensions/README.md
index 9cbbd2b8f94d..2b36a38de2bb 100644
--- a/pkgs/applications/editors/vscode/extensions/README.md
+++ b/pkgs/applications/editors/vscode/extensions/README.md
@@ -7,7 +7,7 @@
 
 * When adding a new extension, place its definition in a `default.nix` file in a directory with the extension's ID (e.g. `publisher.extension-name/default.nix`) and refer to it in `./default.nix`, e.g. `publisher.extension-name = callPackage ./publisher.extension-name { };`.
 
-* Currently `nixfmt-rfc-style` formatter is being used to format the VSCode extensions.
+* Use `nix-shell --run treefmt` to format the VSCode extensions.
 
 * Respect `alphabetical order` whenever adding extensions. If out of order, please kindly open a PR re-establishing the order.
 
diff --git a/pkgs/by-name/ni/nixfmt-tree/package.nix b/pkgs/by-name/ni/nixfmt-tree/package.nix
index d66d23ef3d2e..2d5c3a7f1422 100644
--- a/pkgs/by-name/ni/nixfmt-tree/package.nix
+++ b/pkgs/by-name/ni/nixfmt-tree/package.nix
@@ -95,7 +95,7 @@ treefmtWithConfig.overrideAttrs {
       You can achieve similar results by manually configuring `treefmt`:
       ```nix
       pkgs.treefmt.withConfig {
-        runtimeInputs = [ pkgs.nixfmt-rfc-style ];
+        runtimeInputs = [ pkgs.nixfmt ];
 
         settings = {
           # Log level for files treefmt won't format
diff --git a/pkgs/development/lisp-modules/import/main.lisp b/pkgs/development/lisp-modules/import/main.lisp
index 6671b8f22b4f..c131dc6efdb5 100644
--- a/pkgs/development/lisp-modules/import/main.lisp
+++ b/pkgs/development/lisp-modules/import/main.lisp
@@ -49,7 +49,7 @@
           (truename "imported.nix")))
 
 (defun run-nix-formatter ()
-  (uiop:run-program '("nixfmt" "imported.nix")))
+  (uiop:run-program '("treefmt" "imported.nix")))
 
 (defun main ()
   (format t "~%")
diff --git a/pkgs/development/lisp-modules/shell.nix b/pkgs/development/lisp-modules/shell.nix
index 811e8d3c1d28..02f9f2360828 100644
--- a/pkgs/development/lisp-modules/shell.nix
+++ b/pkgs/development/lisp-modules/shell.nix
@@ -1,10 +1,12 @@
 let
-  pkgs = import ../../../. { };
-  inherit (pkgs) mkShellNoCC sbcl nixfmt-rfc-style;
+  # Use CI-pinned (Hydra-cached) packages and formatter,
+  # rather than the local nixpkgs checkout.
+  inherit (import ../../../ci { }) pkgs fmt;
+  inherit (pkgs) mkShellNoCC sbcl;
 in
 mkShellNoCC {
   packages = [
-    nixfmt-rfc-style
+    fmt.pkg
     (sbcl.withPackages (
       ps:
       builtins.attrValues {

From bb832fe1145f16aba922b8a66eb9c4f1e6859203 Mon Sep 17 00:00:00 2001
From: Joshua Leivenzon <hacker1024@users.sourceforge.net>
Date: Sat, 8 Feb 2025 18:35:48 +1100
Subject: [PATCH 07/55] mimalloc: use `tag` and `finalAttrs`

Co-authored-by: kirillrdy <kirillrdy@gmail.com>
Co-authored-by: SandaruKasa <sandarukasa@ya.ru>
---
 pkgs/by-name/mi/mimalloc/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index 1c7f1e12eb43..dc3e89c7370d 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -10,14 +10,14 @@
 let
   soext = stdenv.hostPlatform.extensions.sharedLibrary;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mimalloc";
   version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "mimalloc";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-fk6nfyBFS1G0sJwUJVgTC1+aKd0We/JjsIYTO+IOfyg=";
   };
 
@@ -39,11 +39,11 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals secureBuild [ "-DMI_SECURE=ON" ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [ "-DMI_BUILD_SHARED=OFF" ]
-  ++ lib.optionals (!doCheck) [ "-DMI_BUILD_TESTS=OFF" ];
+  ++ lib.optionals (!finalAttrs.doCheck) [ "-DMI_BUILD_TESTS=OFF" ];
 
   postInstall =
     let
-      rel = lib.versions.majorMinor version;
+      rel = lib.versions.majorMinor finalAttrs.version;
       suffix = if stdenv.hostPlatform.isLinux then "${soext}.${rel}" else ".${rel}${soext}";
     in
     ''
@@ -76,4 +76,4 @@ stdenv.mkDerivation rec {
       thoughtpolice
     ];
   };
-}
+})

From 41236131f7cf014f96120425d657fb04e7b2a9b1 Mon Sep 17 00:00:00 2001
From: Joshua Leivenzon <hacker1024@users.sourceforge.net>
Date: Sat, 8 Feb 2025 18:35:48 +1100
Subject: [PATCH 08/55] mimalloc: use `cmakeBool`

Co-authored-by: kirillrdy <kirillrdy@gmail.com>
Co-authored-by: SandaruKasa <sandarukasa@ya.ru>
---
 pkgs/by-name/mi/mimalloc/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index dc3e89c7370d..6fd605e64521 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -34,12 +34,12 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
   ];
-  cmakeFlags = [
-    "-DMI_INSTALL_TOPLEVEL=ON"
-  ]
-  ++ lib.optionals secureBuild [ "-DMI_SECURE=ON" ]
-  ++ lib.optionals stdenv.hostPlatform.isStatic [ "-DMI_BUILD_SHARED=OFF" ]
-  ++ lib.optionals (!finalAttrs.doCheck) [ "-DMI_BUILD_TESTS=OFF" ];
+  cmakeFlags = lib.mapAttrsToList lib.cmakeBool {
+    MI_INSTALL_TOPLEVEL = true;
+    MI_SECURE = secureBuild;
+    MI_BUILD_SHARED = !stdenv.hostPlatform.isStatic;
+    MI_BUILD_TESTS = finalAttrs.doCheck;
+  };
 
   postInstall =
     let

From 48d10b0e049044ed8838cbcc771f8e8589f38303 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 8 Feb 2026 15:23:02 +0000
Subject: [PATCH 09/55] kanboard: 1.2.49 -> 1.2.50

---
 pkgs/by-name/ka/kanboard/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ka/kanboard/package.nix b/pkgs/by-name/ka/kanboard/package.nix
index f1abc2a49b1f..88aa8710d0eb 100644
--- a/pkgs/by-name/ka/kanboard/package.nix
+++ b/pkgs/by-name/ka/kanboard/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kanboard";
-  version = "1.2.49";
+  version = "1.2.50";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d74XjURu7vJwn+6p/br76jp4zJiYhYJLSjvxLamt48Q=";
+    hash = "sha256-/nC+V8KfVdEFEBozFFsyinUfXzZbu7h8/ROpjJoDchI=";
   };
 
   dontBuild = true;

From cfa982c06556eb4ff598048db7a97828e9eff275 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 15 Oct 2025 08:00:34 +0200
Subject: [PATCH 10/55] invoiceplane: init at 1.7.0

---
 .../in/invoiceplane/fix-yarn-lockfile.patch   | 19 +++++
 pkgs/by-name/in/invoiceplane/package.nix      | 80 +++++++++++++++++++
 pkgs/top-level/aliases.nix                    |  1 -
 3 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/in/invoiceplane/fix-yarn-lockfile.patch
 create mode 100644 pkgs/by-name/in/invoiceplane/package.nix

diff --git a/pkgs/by-name/in/invoiceplane/fix-yarn-lockfile.patch b/pkgs/by-name/in/invoiceplane/fix-yarn-lockfile.patch
new file mode 100644
index 000000000000..dc25725398f5
--- /dev/null
+++ b/pkgs/by-name/in/invoiceplane/fix-yarn-lockfile.patch
@@ -0,0 +1,19 @@
+diff --git a/yarn.lock b/yarn.lock
+index 227d51e2..11c80f04 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -1397,10 +1397,10 @@ safe-json-parse@~1.0.1:
+   resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+   integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+ 
+-sass@^1.89.2:
+-  version "1.97.2"
+-  resolved "https://registry.yarnpkg.com/sass/-/sass-1.97.2.tgz#e515a319092fd2c3b015228e3094b40198bff0da"
+-  integrity sha512-y5LWb0IlbO4e97Zr7c3mlpabcbBtS+ieiZ9iwDooShpFKWXf62zz5pEPdwrLYm+Bxn1fnbwFGzHuCLSA9tBmrw==
++sass@^1.97:
++  version "1.97.3"
++  resolved "https://registry.yarnpkg.com/sass/-/sass-1.97.3.tgz#9cb59339514fa7e2aec592b9700953ac6e331ab2"
++  integrity sha512-fDz1zJpd5GycprAbu4Q2PV/RprsRtKC/0z82z0JLgdytmcq0+ujJbJ/09bPGDxCLkKY3Np5cRAOcWiVkLXJURg==
+   dependencies:
+     chokidar "^4.0.0"
+     immutable "^5.0.2"
diff --git a/pkgs/by-name/in/invoiceplane/package.nix b/pkgs/by-name/in/invoiceplane/package.nix
new file mode 100644
index 000000000000..a0b8b6faf144
--- /dev/null
+++ b/pkgs/by-name/in/invoiceplane/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  fetchFromGitHub,
+  nixosTests,
+  fetchYarnDeps,
+  applyPatches,
+  php,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  grunt-cli,
+  fetchzip,
+}:
+let
+  version = "1.7.0";
+  # Fetch release tarball which contains language files
+  # https://github.com/InvoicePlane/InvoicePlane/issues/1170
+  languages = fetchzip {
+    #url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
+    url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v1.7.0/v1.7.0.zip";
+    hash = "sha256-D5wZg745xjbBsEPUbvle8ynErFB4xn9zdxOGh0xKCCU=";
+  };
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "invoiceplane";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "InvoicePlane";
+    repo = "InvoicePlane";
+    tag = "v${version}";
+    hash = "sha256-6fuUmXe8mFSnLYwQCwBzxmSQxM06rQXe00IKUZvWnpM=";
+  };
+
+  # Fixes error: Couldn't find any versions for "sass" that matches "^1.97" in our cache
+  patches = [ ./fix-yarn-lockfile.patch ];
+
+  # Composer.lock validation currently fails for unknown reason
+  composerStrictValidation = false;
+
+  vendorHash = "sha256-/fNVq3WJCr9f/NE0s1x8N48W3ZMRUxdh1Qf3pLl0Lpg=";
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    grunt-cli
+  ];
+
+  offlineCache = fetchYarnDeps {
+    inherit (finalAttrs) src patches;
+    hash = "sha256-YDknkQzdRKRRMXS6/cPRSrfhhIyTIDRnFPNGQueu74A=";
+  };
+
+  postBuild = ''
+    grunt build
+  '';
+
+  # Cleanup and language files
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/invoiceplane/* $out/
+    cp -r ${languages}/application/language $out/application/
+    rm -r $out/{composer.json,composer.lock,CONTRIBUTING.md,docker-compose.yml,Gruntfile.js,package.json,node_modules,yarn.lock,share}
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) invoiceplane;
+  };
+
+  meta = {
+    description = "Self-hosted open source application for managing your invoices, clients and payments";
+    changelog = "https://github.com/InvoicePlane/InvoicePlane/releases/tag/v${version}";
+    homepage = "https://www.invoiceplane.com";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ff99201372f2..19344be2a428 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -882,7 +882,6 @@ mapAliases {
   inotifyTools = throw "'inotifyTools' has been renamed to/replaced by 'inotify-tools'"; # Converted to throw 2025-10-27
   insync-emblem-icons = throw "'insync-emblem-icons' has been removed, use 'insync-nautilus' instead"; # Added 2025-05-14
   invalidateFetcherByDrvHash = throw "'invalidateFetcherByDrvHash' has been renamed to/replaced by 'testers.invalidateFetcherByDrvHash'"; # Converted to throw 2025-10-27
-  invoiceplane = throw "'invoiceplane' doesn't support non-EOL PHP versions"; # Added 2025-10-03
   ioccheck = throw "ioccheck was dropped since it was unmaintained."; # Added 2025-07-06
   ipfs = throw "'ipfs' has been renamed to/replaced by 'kubo'"; # Converted to throw 2025-10-27
   ipfs-migrator = throw "'ipfs-migrator' has been renamed to/replaced by 'kubo-migrator'"; # Converted to throw 2025-10-27

From 5c96a275a281a2fad10eb5d9a723ce6e6935ded1 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 15 Oct 2025 08:01:44 +0200
Subject: [PATCH 11/55] nixos/tests/invoiceplane: init

---
 nixos/tests/all-tests.nix    |   1 +
 nixos/tests/invoiceplane.nix | 116 +++++++++++++++++++++++++++++++++++
 2 files changed, 117 insertions(+)
 create mode 100644 nixos/tests/invoiceplane.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 68b920a4dd41..1bb0690ba773 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -788,6 +788,7 @@ in
   installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix { };
   intune = runTest ./intune.nix;
   invidious = runTest ./invidious.nix;
+  invoiceplane = runTest ./invoiceplane.nix;
   iodine = runTest ./iodine.nix;
   iosched = runTest ./iosched.nix;
   ipget = runTest ./ipget.nix;
diff --git a/nixos/tests/invoiceplane.nix b/nixos/tests/invoiceplane.nix
new file mode 100644
index 000000000000..4ead3ef94ee7
--- /dev/null
+++ b/nixos/tests/invoiceplane.nix
@@ -0,0 +1,116 @@
+{ pkgs, ... }:
+
+{
+  name = "invoiceplane";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      onny
+    ];
+  };
+
+  nodes = {
+    invoiceplane_caddy =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "caddy";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+
+    invoiceplane_nginx =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "nginx";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    invoiceplane_caddy.wait_for_unit("caddy")
+    invoiceplane_nginx.wait_for_unit("nginx")
+
+    site_names = ["site1.local", "site2.local"]
+
+    machines = [invoiceplane_caddy, invoiceplane_nginx]
+
+    for machine in machines:
+      machine.wait_for_open_port(80)
+      machine.wait_for_open_port(3306)
+
+      for site_name in site_names:
+          machine.wait_for_unit(f"phpfpm-invoiceplane-{site_name}")
+
+          with subtest("Website returns welcome screen"):
+              assert "Please install InvoicePlane" in machine.succeed(f"curl -L {site_name}")
+
+          with subtest("Finish InvoicePlane setup"):
+            machine.succeed(
+              f"curl -sSfL --cookie-jar cjar {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&ip_lang=english&btn_continue=Continue' {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/prerequisites"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/configure_database"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/install_tables"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/upgrade_tables"
+            )
+  '';
+}

From adefc02942ad8b4861fcbef83c2559cb3ab078db Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 15 Oct 2025 08:02:08 +0200
Subject: [PATCH 12/55] nixos/invoiceplane: init

---
 .../manual/release-notes/rl-2205.section.md   |   2 +-
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/rename.nix                      |   4 -
 .../services/web-apps/invoiceplane.nix        | 491 ++++++++++++++++++
 4 files changed, 493 insertions(+), 5 deletions(-)
 create mode 100644 nixos/modules/services/web-apps/invoiceplane.nix

diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index f45258d0038b..38f503570105 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -99,7 +99,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable).
 
-- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at `services.invoiceplane`.
+- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).
 
 - [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8211bb7ebc24..e16ecf28922c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1657,6 +1657,7 @@
   ./services/web-apps/immich.nix
   ./services/web-apps/immichframe.nix
   ./services/web-apps/invidious.nix
+  ./services/web-apps/invoiceplane.nix
   ./services/web-apps/isso.nix
   ./services/web-apps/jirafeau.nix
   ./services/web-apps/jitsi-meet.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index f3fcf6055946..0e4afc8935cd 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -442,10 +442,6 @@ in
       Consider migrating or switching to Incus, or remove from your configuration.
       https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/
     '')
-    (mkRemovedOptionModule [ "services" "invoiceplane" ] ''
-      services.invoiceplane has been removed since the service only supported PHP 8.1 which is EOL
-      and removed from nixpkgs.
-    '')
     (mkRemovedOptionModule [ "services" "filesender" ] ''
       services.filesender has been removed since it depends on simplesamlphp which was severely unmaintained.
     '')
diff --git a/nixos/modules/services/web-apps/invoiceplane.nix b/nixos/modules/services/web-apps/invoiceplane.nix
new file mode 100644
index 000000000000..bd261ea9ec23
--- /dev/null
+++ b/nixos/modules/services/web-apps/invoiceplane.nix
@@ -0,0 +1,491 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.invoiceplane;
+  eachSite = cfg.sites;
+  user = "invoiceplane";
+  webserver = config.services.${cfg.webserver};
+
+  invoiceplane-config =
+    hostName: cfg:
+    pkgs.writeText "ipconfig.php" ''
+      # <?php exit('No direct script access allowed'); ?>
+
+      IP_URL=http://${hostName}
+      ENABLE_DEBUG=false
+      DISABLE_SETUP=false
+      REMOVE_INDEXPHP=false
+      DB_HOSTNAME=${cfg.database.host}
+      DB_USERNAME=${cfg.database.user}
+      # NOTE: file_get_contents adds newline at the end of returned string
+      DB_PASSWORD=${
+        optionalString (
+          cfg.database.passwordFile != null
+        ) "trim(file_get_contents('${cfg.database.passwordFile}'), \"\\r\\n\")"
+      }
+      DB_DATABASE=${cfg.database.name}
+      DB_PORT=${toString cfg.database.port}
+      SESS_EXPIRATION=864000
+      ENABLE_INVOICE_DELETION=false
+      DISABLE_READ_ONLY=false
+      ENCRYPTION_KEY=
+      ENCRYPTION_CIPHER=AES-256
+      SETUP_COMPLETED=false
+      REMOVE_INDEXPHP=true
+    '';
+
+  mkPhpValue =
+    v:
+    if isString v then
+      escapeShellArg v
+    # NOTE: If any value contains a , (comma) this will not get escaped
+    else if isList v && strings.isConvertibleWithToString v then
+      escapeShellArg (concatMapStringsSep "," toString v)
+    else if isInt v then
+      toString v
+    else if isBool v then
+      boolToString v
+    else
+      abort "The Invoiceplane config value ${lib.generators.toPretty { } v} can not be encoded.";
+
+  extraConfig =
+    hostName: cfg:
+    let
+      settings = mapAttrsToList (k: v: "${k}=${mkPhpValue v}") cfg.settings;
+    in
+    pkgs.writeText "extraConfig.php" (concatStringsSep "\n" settings);
+
+  pkg =
+    hostName: cfg:
+    pkgs.stdenv.mkDerivation rec {
+      pname = "invoiceplane-${hostName}";
+      version = src.version;
+      src = pkgs.invoiceplane;
+
+      postPatch = ''
+        # Patch index.php file to load additional config file
+        substituteInPlace index.php \
+          --replace-fail "require __DIR__ . '/vendor/autoload.php';" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+      '';
+
+      installPhase = ''
+        mkdir -p $out
+        cp -r * $out/
+
+        # symlink uploads and log directories
+        rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
+        ln -sf ${cfg.stateDir}/uploads $out/
+        ln -sf ${cfg.stateDir}/logs $out/application/
+        ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
+
+        # symlink the InvoicePlane config
+        ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
+
+        # symlink the extraConfig file
+        ln -s ${extraConfig hostName cfg} $out/extraConfig.php
+
+        # symlink additional templates
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/"
+        ) cfg.invoiceTemplates}
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/quote_templates/pdf/"
+        ) cfg.quoteTemplates}
+      '';
+    };
+
+  siteOpts =
+    { lib, name, ... }:
+    {
+      options = {
+
+        enable = mkEnableOption "InvoicePlane web application";
+
+        stateDir = mkOption {
+          type = types.path;
+          default = "/var/lib/invoiceplane/${name}";
+          description = ''
+            This directory is used for uploads of attachments and cache.
+            The directory passed here is automatically created and permissions
+            adjusted as required.
+          '';
+        };
+
+        database = {
+          host = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = "Database host address.";
+          };
+
+          port = mkOption {
+            type = types.port;
+            default = 3306;
+            description = "Database host port.";
+          };
+
+          name = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database name.";
+          };
+
+          user = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database user.";
+          };
+
+          passwordFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/run/keys/invoiceplane-dbpassword";
+            description = ''
+              A file containing the password corresponding to
+              {option}`database.user`.
+            '';
+          };
+
+          createLocally = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Create the database and database user locally.";
+          };
+        };
+
+        invoiceTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        quoteTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'quote_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        poolConfig = mkOption {
+          type =
+            with types;
+            attrsOf (oneOf [
+              str
+              int
+              bool
+            ]);
+          default = {
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 4;
+            "pm.max_requests" = 500;
+          };
+          description = ''
+            Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
+            for details on configuration directives.
+          '';
+        };
+
+        settings = mkOption {
+          type = types.attrsOf types.anything;
+          default = { };
+          description = ''
+            Structural InvoicePlane configuration. Refer to
+            <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
+            for details and supported values.
+          '';
+          example = literalExpression ''
+            {
+              SETUP_COMPLETED = true;
+              DISABLE_SETUP = true;
+              IP_URL = "https://invoice.example.com";
+            }
+          '';
+        };
+
+        cron = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Enable cron service which periodically runs Invoiceplane tasks.
+              Requires key taken from the administration page. Refer to
+              <https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
+              on how to configure it.
+            '';
+          };
+          key = mkOption {
+            type = types.str;
+            description = "Cron key taken from the administration page.";
+          };
+        };
+
+      };
+
+    };
+in
+{
+  # interface
+  options = {
+    services.invoiceplane = mkOption {
+      type = types.submodule {
+
+        options.sites = mkOption {
+          type = types.attrsOf (types.submodule siteOpts);
+          default = { };
+          description = "Specification of one or more InvoicePlane sites to serve";
+        };
+
+        options.webserver = mkOption {
+          type = types.enum [
+            "caddy"
+            "nginx"
+          ];
+          default = "caddy";
+          example = "nginx";
+          description = ''
+            Which webserver to use for virtual host management.
+          '';
+        };
+      };
+      default = { };
+      description = "InvoicePlane configuration.";
+    };
+
+  };
+
+  # implementation
+  config = mkIf (eachSite != { }) (mkMerge [
+    {
+
+      assertions = flatten (
+        mapAttrsToList (hostName: cfg: [
+          {
+            assertion = cfg.database.createLocally -> cfg.database.user == user;
+            message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
+          }
+          {
+            assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+            message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
+          }
+          {
+            assertion = cfg.cron.enable -> cfg.cron.key != null;
+            message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
+          }
+        ]) eachSite
+      );
+
+      services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
+        enable = true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
+        ensureUsers = mapAttrsToList (hostName: cfg: {
+          name = cfg.database.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }) eachSite;
+      };
+
+      services.phpfpm = {
+        pools = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair "invoiceplane-${hostName}" {
+            inherit user;
+            group = webserver.group;
+            settings = {
+              "listen.owner" = webserver.user;
+              "listen.group" = webserver.group;
+            }
+            // cfg.poolConfig;
+          })
+        ) eachSite;
+      };
+
+    }
+
+    {
+
+      systemd.tmpfiles.rules = flatten (
+        mapAttrsToList (hostName: cfg: [
+          "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
+          "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
+        ]) eachSite
+      );
+
+      systemd.services.invoiceplane-config = {
+        serviceConfig.Type = "oneshot";
+        script = concatStrings (
+          mapAttrsToList (hostName: cfg: ''
+            mkdir -p ${cfg.stateDir}/logs \
+                     ${cfg.stateDir}/uploads
+            if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
+              cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
+            fi
+            if ! grep -q 'php exit' "${cfg.stateDir}/ipconfig.php"; then
+              sed -i "1i # <?php exit('No direct script access allowed'); ?>" "${cfg.stateDir}/ipconfig.php"
+            fi
+          '') eachSite
+        );
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      users.users.${user} = {
+        group = webserver.group;
+        isSystemUser = true;
+      };
+
+    }
+    {
+
+      # Cron service implementation
+
+      systemd.timers = mapAttrs' (
+        hostName: cfg:
+        (nameValuePair "invoiceplane-cron-${hostName}" (
+          mkIf cfg.cron.enable {
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "5m";
+              OnUnitActiveSec = "5m";
+              Unit = "invoiceplane-cron-${hostName}.service";
+            };
+          }
+        ))
+      ) eachSite;
+
+      systemd.services = mapAttrs' (
+        hostName: cfg:
+        (nameValuePair "invoiceplane-cron-${hostName}" (
+          mkIf cfg.cron.enable {
+            serviceConfig = {
+              Type = "oneshot";
+              User = user;
+              ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
+            };
+          }
+        ))
+      ) eachSite;
+
+    }
+
+    (mkIf (cfg.webserver == "caddy") {
+      services.caddy = {
+        enable = true;
+        virtualHosts = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair "http://${hostName}" {
+            extraConfig = ''
+              root * ${pkg hostName cfg}
+              file_server
+              php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
+            '';
+          })
+        ) eachSite;
+      };
+    })
+
+    (mkIf (cfg.webserver == "nginx") {
+      services.nginx = {
+        enable = true;
+        virtualHosts = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair hostName {
+            root = pkg hostName cfg;
+            extraConfig = ''
+              index index.php index.html index.htm;
+
+              if (!-e $request_filename){
+                rewrite ^(.*)$ /index.php break;
+              }
+            '';
+
+            locations = {
+              "/setup".extraConfig = ''
+                rewrite ^(.*)$ http://${hostName}/ redirect;
+              '';
+
+              "~ .php$" = {
+                extraConfig = ''
+                  fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                  fastcgi_pass unix:${config.services.phpfpm.pools."invoiceplane-${hostName}".socket};
+                  include ${config.services.nginx.package}/conf/fastcgi_params;
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
+                '';
+              };
+            };
+          })
+        ) eachSite;
+      };
+    })
+
+  ]);
+}

From 2fe88c3f4e5472078d25831c78d6404d893354e8 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 12:26:30 -0500
Subject: [PATCH 13/55] trivial-builders: Improve derivation positioning

---
 .../trivial-builders/default.nix              | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b350d51455cd..7a73baea2388 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -111,7 +111,7 @@ rec {
       allowSubstitutes ? false,
       preferLocalBuild ? true,
       derivationArgs ? { },
-    }:
+    }@args:
     assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
       destination must be an absolute path, relative to the derivation's out path,
       got '${destination}' instead.
@@ -125,6 +125,7 @@ rec {
     runCommand name
       (
         {
+          pos = builtins.unsafeGetAttrPos "name" args;
           inherit
             text
             executable
@@ -333,7 +334,7 @@ rec {
          Type: Bool
       */
       inheritPath ? true,
-    }:
+    }@args:
     writeTextFile {
       inherit
         name
@@ -613,6 +614,13 @@ rec {
           "failOnMissing"
         ]
         // {
+          # Allow getting the proper position of the output derivation.
+          # Since one of these are required, it should be fairly accurate.
+          pos =
+            if args_ ? pname then
+              builtins.unsafeGetAttrPos "pname" args_
+            else
+              builtins.unsafeGetAttrPos "name" args_;
           inherit preferLocalBuild allowSubstitutes;
           paths = mapPaths (path: "${path}${stripPrefix}") paths;
           passAsFile = [ "paths" ];
@@ -675,6 +683,14 @@ rec {
     in
     runCommand name
       {
+        # Get the position from the `entries` attrset if it exists.
+        # This is the best we can do since the other attrs are either defined here, or curried values that
+        # we cannot extract a position from
+        pos =
+          if lib.isAttrs entries then
+            builtins.unsafeGetAttrPos (builtins.head (builtins.attrNames entries)) entries
+          else
+            null;
         preferLocalBuild = true;
         allowSubstitutes = false;
         passthru.entries = entries';
@@ -744,12 +760,15 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-    }:
+    }@args:
     script:
     runCommand name
       (
         substitutions
         // {
+          # Make the position of the derivation accurate.
+          # Since not having `name` is deprecated, this should be fairly accurate.
+          pos = lib.unsafeGetAttrPos "name" args;
           # TODO(@Artturin:) substitutions should be inside the env attrset
           # but users are likely passing non-substitution arguments through substitutions
           # turn off __structuredAttrs to unbreak substituteAll

From 9b986c917b2188cc434a5b7d9b71b4142daebb2c Mon Sep 17 00:00:00 2001
From: Joshua Leivenzon <hacker1024@users.sourceforge.net>
Date: Sat, 8 Feb 2025 18:35:48 +1100
Subject: [PATCH 14/55] mimalloc: Fixes and portability improvements

Co-authored-by: kirillrdy <kirillrdy@gmail.com>
Co-authored-by: SandaruKasa <sandarukasa@ya.ru>
---
 pkgs/by-name/mi/mimalloc/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index 6fd605e64521..faccc49d6699 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -37,10 +37,19 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = lib.mapAttrsToList lib.cmakeBool {
     MI_INSTALL_TOPLEVEL = true;
     MI_SECURE = secureBuild;
-    MI_BUILD_SHARED = !stdenv.hostPlatform.isStatic;
+    MI_BUILD_SHARED = stdenv.hostPlatform.hasSharedLibraries;
+    MI_LIBC_MUSL = stdenv.hostPlatform.libc == "musl";
     MI_BUILD_TESTS = finalAttrs.doCheck;
   };
 
+  postPatch = ''
+    substituteInPlace cmake/mimalloc-config.cmake \
+      --replace-fail 'string(REPLACE "/lib/cmake" "/lib" MIMALLOC_LIBRARY_DIR "''${MIMALLOC_CMAKE_DIR}")' \
+                     "set(MIMALLOC_LIBRARY_DIR \"$out/lib\")" \
+      --replace-fail 'string(REPLACE "/lib/cmake/" "/lib/" MIMALLOC_OBJECT_DIR "''${CMAKE_CURRENT_LIST_DIR}")' \
+                     "set(MIMALLOC_OBJECT_DIR \"$out/lib\")"
+  '';
+
   postInstall =
     let
       rel = lib.versions.majorMinor finalAttrs.version;

From c54e477305b0f4d0973f5e2953224d476e369c32 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:15:30 -0500
Subject: [PATCH 15/55] applyPatches: migrate to extendMkDerivation

naive translation
---
 .../trivial-builders/default.nix              | 114 +++++++++---------
 1 file changed, 57 insertions(+), 57 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b350d51455cd..bf93fa840a39 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1000,33 +1000,34 @@ rec {
       ];
     }
   */
-  applyPatches =
-    {
-      src,
-      name ?
-        (
-          if builtins.typeOf src == "path" then
-            baseNameOf src
-          else if builtins.isAttrs src && builtins.hasAttr "name" src then
-            src.name
-          else
-            throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
-        )
-        + "-patched",
-      patches ? [ ],
-      prePatch ? "",
-      postPatch ? "",
-      ...
-    }@args:
-    assert lib.assertMsg (
-      !args ? meta
-    ) "applyPatches will not merge 'meta', change it in 'src' instead";
-    assert lib.assertMsg (
-      !args ? passthru
-    ) "applyPatches will not merge 'passthru', change it in 'src' instead";
-    if patches == [ ] && prePatch == "" && postPatch == "" then
-      src # nothing to do, so use original src to avoid additional drv
-    else
+  applyPatches = lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
+
+    extendDrvArgs =
+      finalAttrs:
+      {
+        src,
+        name ?
+          (
+            if builtins.typeOf src == "path" then
+              baseNameOf src
+            else if builtins.isAttrs src && builtins.hasAttr "name" src then
+              src.name
+            else
+              throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
+          )
+          + "-patched",
+        patches ? [ ],
+        prePatch ? "",
+        postPatch ? "",
+        ...
+      }@args:
+      assert lib.assertMsg (
+        !args ? meta
+      ) "applyPatches will not merge 'meta', change it in 'src' instead";
+      assert lib.assertMsg (
+        !args ? passthru
+      ) "applyPatches will not merge 'passthru', change it in 'src' instead";
       let
         keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
         # enables tools like nix-update to determine what src attributes to replace
@@ -1040,36 +1041,35 @@ rec {
           ] src
         );
       in
-      stdenvNoCC.mkDerivation (
-        {
-          inherit
-            name
-            src
-            patches
-            prePatch
-            postPatch
-            ;
-          preferLocalBuild = true;
-          allowSubstitutes = false;
-          phases = "unpackPhase patchPhase installPhase";
-          installPhase = "cp -R ./ $out";
-        }
-        # Carry (and merge) information from the underlying `src` if present.
-        // (optionalAttrs (src ? meta) {
-          inherit (src) meta;
-        })
-        // (optionalAttrs (extraPassthru != { } || src ? passthru) {
-          passthru = extraPassthru // src.passthru or { };
-        })
-        # Forward any additional arguments to the derivation
-        // (removeAttrs args [
-          "src"
-          "name"
-          "patches"
-          "prePatch"
-          "postPatch"
-        ])
-      );
+      {
+        inherit
+          name
+          src
+          patches
+          prePatch
+          postPatch
+          ;
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        phases = "unpackPhase patchPhase installPhase";
+        installPhase = "cp -R ./ $out";
+      }
+      # Carry (and merge) information from the underlying `src` if present.
+      // (optionalAttrs (src ? meta) {
+        inherit (src) meta;
+      })
+      // (optionalAttrs (extraPassthru != { } || src ? passthru) {
+        passthru = extraPassthru // src.passthru or { };
+      })
+      # Forward any additional arguments to the derivation
+      // (removeAttrs args [
+        "src"
+        "name"
+        "patches"
+        "prePatch"
+        "postPatch"
+      ]);
+  };
 
   # TODO: move docs to Nixpkgs manual
   # An immutable file in the store with a length of 0 bytes.

From 3b4c6073c14a9e4a4b9ec003de7e9c2ee2707fed Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:17:32 -0500
Subject: [PATCH 16/55] applyPatches: use extendMkDerivation machinery for arg
 inheritance

---
 pkgs/build-support/trivial-builders/default.nix | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index bf93fa840a39..7ebde268f9f0 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1017,9 +1017,6 @@ rec {
               throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
           )
           + "-patched",
-        patches ? [ ],
-        prePatch ? "",
-        postPatch ? "",
         ...
       }@args:
       assert lib.assertMsg (
@@ -1044,10 +1041,6 @@ rec {
       {
         inherit
           name
-          src
-          patches
-          prePatch
-          postPatch
           ;
         preferLocalBuild = true;
         allowSubstitutes = false;
@@ -1060,15 +1053,7 @@ rec {
       })
       // (optionalAttrs (extraPassthru != { } || src ? passthru) {
         passthru = extraPassthru // src.passthru or { };
-      })
-      # Forward any additional arguments to the derivation
-      // (removeAttrs args [
-        "src"
-        "name"
-        "patches"
-        "prePatch"
-        "postPatch"
-      ]);
+      });
   };
 
   # TODO: move docs to Nixpkgs manual

From 4b67bd98f4cd63c91cb54dd40143e9fdac4a892b Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:21:13 -0500
Subject: [PATCH 17/55] applyPatches: remove explicit phases

---
 pkgs/build-support/trivial-builders/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 7ebde268f9f0..ed447c9be101 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1044,7 +1044,11 @@ rec {
           ;
         preferLocalBuild = true;
         allowSubstitutes = false;
-        phases = "unpackPhase patchPhase installPhase";
+
+        dontConfigure = true;
+        dontBuild = true;
+        doCheck = false;
+
         installPhase = "cp -R ./ $out";
       }
       # Carry (and merge) information from the underlying `src` if present.

From 9268517647203e379f54eb98736457d5e8892045 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:50:24 -0500
Subject: [PATCH 18/55] applyPatches: remove inherited meta.position

---
 pkgs/build-support/trivial-builders/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index ed447c9be101..3051885345ae 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1053,7 +1053,7 @@ rec {
       }
       # Carry (and merge) information from the underlying `src` if present.
       // (optionalAttrs (src ? meta) {
-        inherit (src) meta;
+        meta = removeAttrs src.meta [ "position" ];
       })
       // (optionalAttrs (extraPassthru != { } || src ? passthru) {
         passthru = extraPassthru // src.passthru or { };

From 315a3525ceca8f442d419114233b98cd5bd57cb1 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:50:24 -0500
Subject: [PATCH 19/55] applyPatches: reorganize name handling, and fix
 meta.position

---
 .../trivial-builders/default.nix              | 30 +++++++++++--------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 3051885345ae..88e4ef6dbe88 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1007,16 +1007,6 @@ rec {
       finalAttrs:
       {
         src,
-        name ?
-          (
-            if builtins.typeOf src == "path" then
-              baseNameOf src
-            else if builtins.isAttrs src && builtins.hasAttr "name" src then
-              src.name
-            else
-              throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
-          )
-          + "-patched",
         ...
       }@args:
       assert lib.assertMsg (
@@ -1039,9 +1029,23 @@ rec {
         );
       in
       {
-        inherit
-          name
-          ;
+        name =
+          args.name or (
+            if builtins.isPath src then
+              baseNameOf src + "-patched"
+            else if builtins.isAttrs src && (src ? name) then
+              let
+                srcName = builtins.parseDrvName src;
+              in
+              "${srcName.name}-patched${lib.optionalString (srcName.version != "") "-${srcName.version}"}"
+            else
+              throw "applyPatches: please supply a `name` argument because a default name can only be computed when the `src` is a path or is an attribute set with a `name` attribute."
+          );
+
+        # Manually setting `name` can mess up positioning.
+        # This should fix it.
+        pos = builtins.unsafeGetAttrPos "src" args;
+
         preferLocalBuild = true;
         allowSubstitutes = false;
 

From c7609637eb119bf0bd54ee6f52067ae826b967b4 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 15:50:24 -0500
Subject: [PATCH 20/55] applyPatches: unconditionally set attrsets that are
 always set regardless

---
 pkgs/build-support/trivial-builders/default.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 88e4ef6dbe88..6a4daf3809ac 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1054,14 +1054,12 @@ rec {
         doCheck = false;
 
         installPhase = "cp -R ./ $out";
-      }
-      # Carry (and merge) information from the underlying `src` if present.
-      // (optionalAttrs (src ? meta) {
-        meta = removeAttrs src.meta [ "position" ];
-      })
-      // (optionalAttrs (extraPassthru != { } || src ? passthru) {
+
         passthru = extraPassthru // src.passthru or { };
-      });
+
+        # Carry (and merge) information from the underlying `src` if present.
+        meta = lib.optionalAttrs (src ? meta) removeAttrs src.meta [ "position" ];
+      };
   };
 
   # TODO: move docs to Nixpkgs manual

From 652080d15f0945d249f2c6ab9fbb945995fffa12 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 9 Feb 2026 16:09:53 -0500
Subject: [PATCH 21/55] applyPatches: ensure overrides are carried down

---
 .../trivial-builders/default.nix              | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 6a4daf3809ac..686271082928 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1018,24 +1018,24 @@ rec {
       let
         keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
         # enables tools like nix-update to determine what src attributes to replace
-        extraPassthru = lib.optionalAttrs (lib.isAttrs src) (
+        extraPassthru = lib.optionalAttrs (lib.isAttrs finalAttrs.src) (
           keepAttrs [
             "rev"
             "tag"
             "url"
             "outputHash"
             "outputHashAlgo"
-          ] src
+          ] finalAttrs.src
         );
       in
       {
         name =
           args.name or (
-            if builtins.isPath src then
-              baseNameOf src + "-patched"
-            else if builtins.isAttrs src && (src ? name) then
+            if builtins.isPath finalAttrs.src then
+              baseNameOf finalAttrs.src + "-patched"
+            else if builtins.isAttrs finalAttrs.src && (finalAttrs.src ? name) then
               let
-                srcName = builtins.parseDrvName src;
+                srcName = builtins.parseDrvName finalAttrs.src.name;
               in
               "${srcName.name}-patched${lib.optionalString (srcName.version != "") "-${srcName.version}"}"
             else
@@ -1055,10 +1055,13 @@ rec {
 
         installPhase = "cp -R ./ $out";
 
-        passthru = extraPassthru // src.passthru or { };
+        # passthru the git and hash info for nix-update, as well
+        # as all the src's passthru attrs.
+        passthru = extraPassthru // finalAttrs.src.passthru or { };
 
         # Carry (and merge) information from the underlying `src` if present.
-        meta = lib.optionalAttrs (src ? meta) removeAttrs src.meta [ "position" ];
+        # If there is not src.meta, this meta block will be blank regardless.
+        meta = lib.optionalAttrs (finalAttrs.src ? meta) removeAttrs finalAttrs.src.meta [ "position" ];
       };
   };
 

From fe1a3f1631d7e1ee06deabe06710421ea3bf2bec Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Tue, 10 Feb 2026 02:58:40 +0200
Subject: [PATCH 22/55] gopro-tool: move overrides to package.nix

---
 pkgs/by-name/go/gopro-tool/package.nix | 6 +++++-
 pkgs/top-level/all-packages.nix        | 6 ------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index a5b848d28b5d..460b498dd2bc 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -5,7 +5,11 @@
   makeWrapper,
   ffmpeg,
   vlc,
+  vlc' ? vlc.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ x264 ];
+  }),
   jq,
+  x264,
 }:
 
 stdenv.mkDerivation {
@@ -30,7 +34,7 @@ stdenv.mkDerivation {
       --prefix PATH : ${
         lib.makeBinPath [
           ffmpeg
-          vlc
+          vlc'
           jq
         ]
       }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fa357ead5f9b..ebd26f56c63e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4528,12 +4528,6 @@ with pkgs;
 
   dotnetPackages = recurseIntoAttrs (callPackage ./dotnet-packages.nix { });
 
-  gopro-tool = callPackage ../by-name/go/gopro-tool/package.nix {
-    vlc = vlc.overrideAttrs (old: {
-      buildInputs = old.buildInputs ++ [ x264 ];
-    });
-  };
-
   gwe = callPackage ../tools/misc/gwe {
     nvidia_x11 = linuxPackages.nvidia_x11;
   };

From eb955cdba5981d6d121c4ed47f7a56080ab8c324 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Tue, 10 Feb 2026 02:58:57 +0200
Subject: [PATCH 23/55] gopro-tool: enable strictDeps and structuredAttrs

---
 pkgs/by-name/go/gopro-tool/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index 460b498dd2bc..e7b53ca984c9 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   installPhase = ''
     mkdir -p $out/bin
     cp $src/gopro-tool $out/bin/gopro-tool

From db5fa7acafcbe7835f10ffcac683fab888cedf52 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Tue, 10 Feb 2026 02:59:14 +0200
Subject: [PATCH 24/55] gopro-tool: add passthru.tests

---
 pkgs/by-name/go/gopro-tool/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index e7b53ca984c9..8f9f7306300d 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -10,6 +10,7 @@
   }),
   jq,
   x264,
+  nixosTests,
 }:
 
 stdenv.mkDerivation {
@@ -43,6 +44,10 @@ stdenv.mkDerivation {
       }
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) gopro-tool;
+  };
+
   meta = {
     description = "Tool to control GoPro webcam mode in Linux (requires v4l2loopback kernel module and a firewall rule)";
     license = lib.licenses.bsd3;

From 662fd4baf42ff3ffe1fb8d61abcad16bb7e6d661 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Tue, 10 Feb 2026 02:59:31 +0200
Subject: [PATCH 25/55] gopro-tool: 0-unstable-2024-04-18 -> 1.18

---
 pkgs/by-name/go/gopro-tool/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index 8f9f7306300d..475d2df02067 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -13,15 +13,15 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gopro-tool";
-  version = "0-unstable-2024-04-18";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "juchem";
     repo = "gopro-tool";
-    rev = "a678f0ea65e24dca9b8d848b245bd2d487d3c8ca";
-    sha256 = "0sh3s38m17pci24x4kdlmlhn0gwgm28aaa6p7qs16wysk0q0h6wz";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nxsIMJjacxM0PtcopZCojz9gIa20TdKJiOyeUNHQA2o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -54,4 +54,4 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [ ZMon3y ];
     platforms = lib.platforms.linux;
   };
-}
+})

From e958308ebcc4722c789367703efd7786638357e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Feb 2026 04:27:46 +0000
Subject: [PATCH 26/55] mediainfo: 25.10 -> 26.01

---
 pkgs/by-name/me/mediainfo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/mediainfo/package.nix b/pkgs/by-name/me/mediainfo/package.nix
index dd9f50623d80..07f6a45dd05a 100644
--- a/pkgs/by-name/me/mediainfo/package.nix
+++ b/pkgs/by-name/me/mediainfo/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mediainfo";
-  version = "25.10";
+  version = "26.01";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${finalAttrs.version}/mediainfo_${finalAttrs.version}.tar.xz";
-    hash = "sha256-NmsyUQGrGppO55+9uOPdnni8wKIcD5sZZjE6rtPTNQI=";
+    hash = "sha256-FQZWytiO9O+k6Cmc/CTZt6cjVFdqaTSZIFiKzuLMPHY=";
   };
 
   nativeBuildInputs = [

From 6de60d5d0311aee078fae7ee9d316702d5dee483 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sun, 8 Feb 2026 10:35:09 +0100
Subject: [PATCH 27/55] hydra-ant-logger: rename from hydraAntLogger

The upstream repo is called hydra-ant-logger, so this is probably another package name relic.
---
 pkgs/by-name/hy/{hydraAntLogger => hydra-ant-logger}/package.nix | 0
 pkgs/top-level/aliases.nix                                       | 1 +
 2 files changed, 1 insertion(+)
 rename pkgs/by-name/hy/{hydraAntLogger => hydra-ant-logger}/package.nix (100%)

diff --git a/pkgs/by-name/hy/hydraAntLogger/package.nix b/pkgs/by-name/hy/hydra-ant-logger/package.nix
similarity index 100%
rename from pkgs/by-name/hy/hydraAntLogger/package.nix
rename to pkgs/by-name/hy/hydra-ant-logger/package.nix
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 45239bd1f633..ad28e4924940 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -860,6 +860,7 @@ mapAliases {
   hspellDicts = throw "'hspellDicts' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
   http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
+  hydraAntLogger = warnAlias "'hydraAntLogger' has been renamed to 'hydra-ant-logger'" hydra-ant-logger; # Added 2026-02-08
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
   i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
   ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25

From c4cd6cf804ce67aa6db4a4cf4a63699af9ec8a94 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Tue, 10 Feb 2026 22:53:54 +0100
Subject: [PATCH 28/55] gitlab: 18.8.3 -> 18.8.4

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released
---
 pkgs/by-name/gi/gitaly/git.nix                     |  2 +-
 pkgs/by-name/gi/gitaly/package.nix                 |  4 ++--
 pkgs/by-name/gi/gitlab-pages/package.nix           |  4 ++--
 pkgs/by-name/gi/gitlab/data.json                   | 14 +++++++-------
 .../by-name/gi/gitlab/gitlab-workhorse/default.nix |  2 +-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile             |  2 +-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock        |  4 ++--
 pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix          |  4 ++--
 8 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/gi/gitaly/git.nix b/pkgs/by-name/gi/gitaly/git.nix
index 793627658ff6..7f35dc62e87f 100644
--- a/pkgs/by-name/gi/gitaly/git.nix
+++ b/pkgs/by-name/gi/gitaly/git.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./dont-clone-git-repo.patch
   ];
 
-  sourceRoot = finalAttrs.src.name;
+  sourceRoot = "source";
 
   buildFlags = [ "install-git" ];
   GIT_REPO_PATH = finalAttrs.src;
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 58a6748bdc40..1afb2c08e3df 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.8.3";
+  version = "18.8.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-ALUOgSPl+tNh/hmnYq2Mfw7R0ECQ/ohUZZNnBeItQds=";
+      hash = "sha256-/zl25h2kYP4nUOJoNkOs3Tp1QsY5YcOutykchPEVa1I=";
     };
 
     vendorHash = "sha256-CSjsxwumKUbp/tSewE8iAp4c3DH6V6fNY4OCgzjvHP0=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 2c7e5c474f6f..8a5e35d07f6c 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.8.3";
+  version = "18.8.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OmIhZwNmuOGYpBe32EYXVw4nX7XArkxdj3uoP9qurN4=";
+    hash = "sha256-cGl/Huhy9RJxP786MVlzbMNjgBfEQzZTdHt+KRElXoA=";
   };
 
   vendorHash = "sha256-AZIv/CU01OAbn5faE4EkSuDCakYzDjRprB5ox5tIlck=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index a279d1c03545..fcbf0c4eaaf0 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.8.3",
-  "repo_hash": "sha256-c9e6HhJ1ERXSMHYW+MHTVzxpqtUIfVHrlIUlCJ+zX0A=",
+  "version": "18.8.4",
+  "repo_hash": "sha256-gX5Cy3CxNqLj4HFgqGmFKLrvAhdcgag+XcQMEB9UNZ4=",
   "yarn_hash": "sha256-s4+NpzynaR5ab1DlXRMmtOeFZCwpexMoWjwX00hnx5o=",
   "frontend_islands_yarn_hash": "sha256-DiGj3eJMLnlWBTePwGmEvmY9d1Li3p/Y6h3GtZnsvhg=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.8.3-ee",
+  "rev": "v18.8.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.8.3",
-    "GITLAB_KAS_VERSION": "18.8.3",
-    "GITLAB_PAGES_VERSION": "18.8.3",
+    "GITALY_SERVER_VERSION": "18.8.4",
+    "GITLAB_KAS_VERSION": "18.8.4",
+    "GITLAB_PAGES_VERSION": "18.8.4",
     "GITLAB_SHELL_VERSION": "14.45.5",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.12.2",
-    "GITLAB_WORKHORSE_VERSION": "18.8.3"
+    "GITLAB_WORKHORSE_VERSION": "18.8.4"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 87e326e59a30..8d147eb8c1d7 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.8.3";
+  version = "18.8.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 9026b832bb45..0aa66cfebd4a 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -747,7 +747,7 @@ gem 'paper_trail', '~> 16.0', feature_category: :workspaces
 
 gem "i18n_data", "~> 0.13.1", feature_category: :system_access
 
-gem "gitlab-cloud-connector", "~> 1.40", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
+gem "gitlab-cloud-connector", "~> 1.43", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
 
 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index d369b2afc16c..70fa0bd63332 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -743,7 +743,7 @@ GEM
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.6)
       numerizer (~> 0.2)
-    gitlab-cloud-connector (1.40.0)
+    gitlab-cloud-connector (1.43.0)
       activesupport (>= 7.0)
       jwt (~> 2.9)
     gitlab-crystalball (1.1.1)
@@ -2191,7 +2191,7 @@ DEPENDENCIES
   gitlab-active-context!
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.40)
+  gitlab-cloud-connector (~> 1.43)
   gitlab-crystalball (~> 1.1.0)
   gitlab-dangerfiles (~> 4.10.0)
   gitlab-duo-workflow-service-client (~> 0.6)!
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index f7e808cff9c6..aaf6b35a12a9 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -2886,10 +2886,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wkffbl793jvkjw3qdfqfb1j4adsvyakdv7sc0g3cdp2q6lrrmah";
+      sha256 = "1cjn1vqnvr3lhbdqfpy88aq7qmvd1j7i08gd8cly91914cd22pi9";
       type = "gem";
     };
-    version = "1.40.0";
+    version = "1.43.0";
   };
   gitlab-crystalball = {
     dependencies = [

From eabee7d804c2c4328b5d65162f1550cde3940bf6 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Tue, 10 Feb 2026 16:12:51 -0700
Subject: [PATCH 29/55] limine: 10.6.6 -> 10.7.0

https://codeberg.org/Limine/Limine/releases/tag/v10.7.0
Diff: https://codeberg.org/Limine/Limine/compare/v10.6.6...v10.7.0
---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 547fb8c08d5f..442f393016f8 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.6.6";
+  version = "10.7.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xU0uygvqeWfsy5FsYQQAEwc0H15j8amW0097Fojw1DM=";
+    hash = "sha256-1gwgzyISeOj4QE8hZ/KDCVW8qCQYvpQE6lf/N1jt0J4=";
   };
 
   enableParallelBuilding = true;

From 451e0185d87933e9122063b829ce37577d6a0df6 Mon Sep 17 00:00:00 2001
From: Narrator <dethereal@protonmail.com>
Date: Wed, 11 Feb 2026 16:27:21 +0100
Subject: [PATCH 30/55] vscode: 1.109.0 -> 1.109.2

release notes: https://code.visualstudio.com/updates/v1_109
---
 pkgs/applications/editors/vscode/vscode.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index a749560518e8..2284c514a303 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,20 +36,20 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-N8dBXYpBbaymuGWFb8+77/4yJ6Meo5eqoYpnlsjGlN8=";
-      x86_64-darwin = "sha256-li+29ukZXvwBihnHti+AntMNwhr3g1tOOdmalZchL40=";
-      aarch64-linux = "sha256-ASzpE721RBAiVFxnGCRMCWj/RFa+TpxA4gaZJFxk7I0=";
-      aarch64-darwin = "sha256-afaADPPWJlW3HdWGAMDuibGhBtR7toEm2T58jR/nsic=";
-      armv7l-linux = "sha256-BgG1RglSISrKm+KRq7AXhp7EUOssts2LSLCVqSD7E/Q=";
+      x86_64-linux = "sha256-ST5i8gvNtAaBbmcpcg9GJipr8e5d0A0qbdG1P9QViek=";
+      x86_64-darwin = "sha256-BRGXLasiHZSKsijq02bCa2RbaBc7iC1ZtLe29u4KTH0=";
+      aarch64-linux = "sha256-7plpHWoi8eYDKQZVV3OCXZJUk8j173M1xpRgTOTsPZ0=";
+      aarch64-darwin = "sha256-RgfhGjVFmaIAAotTYNPUDrJZ8qj8e4yR9bVfal/Hl6o=";
+      armv7l-linux = "sha256-Zzz4HsmiWcKiBRE19pGll8BRQy26wbmpuYSi89PDoBo=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.109.0";
+  version = "1.109.2";
 
   # This is used for VS Code - Remote SSH test
-  rev = "bdd88df003631aaa0bcbe057cb0a940b80a476fa";
+  rev = "591199df409fbf59b4b52d5ad4ee0470152a9b31";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -82,7 +82,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-qdXYNkc7u1s/HexmK3Dwc4H/nsfoyhL0/c8TgK94JwU=";
+      hash = "sha256-CbU8VdJETTzpwCpzVgavoeSQMdz3RdwDYJ7wUqs8LJ8=";
     };
     stdenv = stdenvNoCC;
   };

From 9359589e004547b5b382550be0c6ff86e2bd9dad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 11 Feb 2026 19:40:07 +0000
Subject: [PATCH 31/55] app2unit: 1.2.1 -> 1.3.0

---
 pkgs/by-name/ap/app2unit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ap/app2unit/package.nix b/pkgs/by-name/ap/app2unit/package.nix
index 904eb912f24d..21879d196f59 100644
--- a/pkgs/by-name/ap/app2unit/package.nix
+++ b/pkgs/by-name/ap/app2unit/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "app2unit";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "app2unit";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-DZ0W7SygOUmjIO0+K8hS9K1U+gSp1gA6Q15eXr6rOmo=";
+    sha256 = "sha256-HkwcYYGNReDtPxZumnz3ZDb1sr1JcngAOqs/inO/350=";
   };
 
   passthru.updateScript = nix-update-script { };

From d8c6c327f43ca5b1a68fa854295c2df33834e5a7 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sun, 8 Feb 2026 17:48:27 +0300
Subject: [PATCH 32/55] mimalloc: set `MI_NO_OPT_ARCH`

---
 pkgs/by-name/mi/mimalloc/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index faccc49d6699..a808fd8e12ac 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -40,6 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
     MI_BUILD_SHARED = stdenv.hostPlatform.hasSharedLibraries;
     MI_LIBC_MUSL = stdenv.hostPlatform.libc == "musl";
     MI_BUILD_TESTS = finalAttrs.doCheck;
+
+    # MI_OPT_ARCH is inaccurate (e.g. it assumes aarch64 == armv8.1-a).
+    # Nixpkgs's native platform configuration does a better job.
+    MI_NO_OPT_ARCH = true;
   };
 
   postPatch = ''

From 0088bc55d3839cc3288e195952c49e98bbf467e8 Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Wed, 11 Feb 2026 22:47:49 +0000
Subject: [PATCH 33/55] moonlight: 1.3.39 -> 2026.2.1

Diff: https://github.com/moonlight-mod/moonlight/compare/v1.3.39...v2026.2.1

Changelog: https://raw.githubusercontent.com/moonlight-mod/moonlight/refs/tags/v2026.2.1/CHANGELOG.md
---
 pkgs/by-name/mo/moonlight/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 52d9ba4da6d2..4cfc622e53a3 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.39";
+  version = "2026.2.1";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-85W5OrP9Ju4ZJRUEZLpBreKxgUrHgxxZEv7KzcpqNDo=";
+    hash = "sha256-BpTN9AdQEDD2XnEUsUxgkoq+EPGhtnYgJhLKF4GVZoc=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-+wGup5wJIqTzkr4mTo/CxofffQmUz3JD2s/s/oY0viM=";
+    hash = "sha256-b3d8VcfQjCkcJThebXJ2yvKZfU8u4QnpZgNyqP6XIu0=";
   };
 
   env = {

From 817c93c1b6dbd4a5abbdd675e648bed87bfc2c99 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 11 Feb 2026 22:50:08 +0000
Subject: [PATCH 34/55] zensical: 0.0.21 -> 0.0.23

---
 pkgs/by-name/ze/zensical/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zensical/package.nix b/pkgs/by-name/ze/zensical/package.nix
index a17ba20eef3b..70ecee996539 100644
--- a/pkgs/by-name/ze/zensical/package.nix
+++ b/pkgs/by-name/ze/zensical/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zensical";
-  version = "0.0.21";
+  version = "0.0.23";
   pyproject = true;
 
   # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   # We could combine sources, but then nix-update won't work.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-wTVjg2+mOjyr7/2D/jp3DKdAz6Wue4XfhdiYN+MbO0o=";
+    hash = "sha256-XE/DqvB135nYz0G58lZuTViBgNmolJMBTTYH3+UKxLw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-zkF0Yf7EPFHmkWy3FEhTKYFlWW4pLFG1OZPi1z7vZXU=";
+    hash = "sha256-cS8gxMPRpMMHwrjqXjyxBl4dbwll01Y+G4eOBZ3/vdM=";
   };
 
   nativeBuildInputs = with rustPlatform; [

From c065e89c97dbfa72a880d836600e7338af9a7cfd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 00:49:54 +0000
Subject: [PATCH 35/55] linuxKernel.kernels.linux_lqx: 6.18.8 -> 6.18.9

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6ff6c1c44fbe..a59b8bd5075d 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -23,9 +23,9 @@ let
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.18.8"; # lqx
+      version = "6.18.9"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "1fdrsq4rbr4l90qzj0qdh55n9y8859v6ixdp9bdms123l8f4iqr3"; # lqx
+      sha256 = "014kixm8p8xfpwsf6bk21dypknv29h5qac79n306z56mg3q79qhd"; # lqx
       isLqx = true;
     };
   };

From 251643d45fb939c2360e6e8b00bbe53695b11955 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Jan 2026 14:43:03 +0000
Subject: [PATCH 36/55] vue-language-server: 3.2.2 -> 3.2.4

---
 pkgs/by-name/vu/vue-language-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vu/vue-language-server/package.nix b/pkgs/by-name/vu/vue-language-server/package.nix
index 7aba59e43a00..efaf36d47cee 100644
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -11,19 +11,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";
-  version = "3.2.2";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "vuejs";
     repo = "language-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oVIWRCnJkJK1CsgNp7l95uuILeXv2XuwwfGElGnOEyU=";
+    hash = "sha256-GxIIqRK8wBVlo8jvCox6Fdp705EMg1YoHB46bvs5kkE=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-lxRify3uJnqYH6btmXU9yaO8LJDGBZcyONLUHv2rLqg=";
+    hash = "sha256-QLey523pqhjOBn4xhN9mZTKRAC96imVka+li7C4BXQY=";
   };
 
   nativeBuildInputs = [

From 1161ddefa878c2eb33fc45b9bcd6c3f51bd3d8f8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 01:53:51 +0000
Subject: [PATCH 37/55] ndcurves: 2.1.0 -> 2.1.1

---
 pkgs/by-name/nd/ndcurves/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nd/ndcurves/package.nix b/pkgs/by-name/nd/ndcurves/package.nix
index ba6732ab08e6..770fea0fa4b9 100644
--- a/pkgs/by-name/nd/ndcurves/package.nix
+++ b/pkgs/by-name/nd/ndcurves/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ndcurves";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = "ndcurves";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VHxGm6fzoS51PtTj/qeZumz58ZHtxy28ihbzbnoHvHg=";
+    hash = "sha256-YnpC2yYEe9VNcHHDyv+glLrue/J/HXbK/VP7DTAE/q0=";
   };
 
   outputs = [

From 09a52efe3dae9d7dd072452417710084f493bccf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 02:13:44 +0000
Subject: [PATCH 38/55] cargo-expand: 1.0.119 -> 1.0.120

---
 pkgs/by-name/ca/cargo-expand/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index e4dd50fbe586..17607da8aeb2 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-expand";
-  version = "1.0.119";
+  version = "1.0.120";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     tag = finalAttrs.version;
-    hash = "sha256-N48BUPnVnMJSiM3EzpSiDNLGZNWFW05toHRhokNO5gI=";
+    hash = "sha256-KXnAKv8202Trkkr9D9HRmxTOZ67M2Jt4dhZ9o7D86uI=";
   };
 
-  cargoHash = "sha256-a8swmPQ+JuE/tqRYbV+kekZV8TloxszYq9k8VOGRBrM=";
+  cargoHash = "sha256-eCDjGKLPy98SuknzzIE2GZEsxFjNZKuV30Y5nBQao3s=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From 805fe4e2c557eafcf2f98bf30599f6b0e21dc3e6 Mon Sep 17 00:00:00 2001
From: kyehn <228304369+kyehn@users.noreply.github.com>
Date: Thu, 12 Feb 2026 09:50:29 +0800
Subject: [PATCH 39/55] flutter341: 3.41.0-0.3.pre -> 3.41.0

---
 .../development/compilers/flutter/default.nix | 39 ++++++---
 .../flutter/update/get-dart-hashes.nix.in     | 35 +++-----
 .../compilers/flutter/versions/3_41/data.json | 86 +++++++++----------
 3 files changed, 83 insertions(+), 77 deletions(-)

diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index c8b2026c5f88..f7461b01739d 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -50,19 +50,32 @@ let
           ;
 
         dart =
-          (dart.overrideAttrs (_: {
-            # This overrideAttrs is used to replace the version in src.url
-            version = dartVersion;
-            __intentionallyOverridingVersion = true;
-          })).overrideAttrs
-            (oldAttrs: {
-              src = fetchzip {
-                inherit (oldAttrs.src) url;
-                hash =
-                  dartHash.${stdenv.hostPlatform.system}
-                    or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-              };
-            });
+          let
+            hash =
+              dartHash.${stdenv.hostPlatform.system}
+                or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+          in
+          (
+            if lib.versionAtLeast version "3.41" then
+              (dart.overrideAttrs (oldAttrs: {
+                version = dartVersion;
+                src = oldAttrs.src.overrideAttrs (_: {
+                  inherit hash;
+                });
+              }))
+            else
+              (dart.overrideAttrs (_: {
+                # This overrideAttrs is used to replace the version in src.url
+                version = dartVersion;
+                __intentionallyOverridingVersion = true;
+              })).overrideAttrs
+                (oldAttrs: {
+                  src = fetchzip {
+                    inherit (oldAttrs.src) url;
+                    inherit hash;
+                  };
+                })
+          );
         src =
           let
             source = fetchFromGitHub {
diff --git a/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in b/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in
index 326b2f672d62..0972a3578b52 100644
--- a/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in
+++ b/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in
@@ -1,29 +1,22 @@
 {
   lib,
-  fetchzip,
+  fetchurl,
 }:
 
 let
   dartVersion = "@dart_version@";
-  platform = "@platform@";
-  channel = if lib.strings.hasSuffix ".beta" dartVersion then "beta" else "stable";
+  system =
+    {
+      x86_64-linux = "linux-x64";
+      aarch64-linux = "linux-arm64";
+      x86_64-darwin = "macos-x64";
+      aarch64-darwin = "macos-arm64";
+    }
+    ."@platform@";
 in
-{
-  x86_64-linux = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  aarch64-linux = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  x86_64-darwin = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-macos-x64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  aarch64-darwin = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-macos-arm64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
+fetchurl {
+  url = "https://storage.googleapis.com/dart-archive/channels/${
+    if lib.strings.hasSuffix ".beta" dartVersion then "beta" else "stable"
+  }/release/${dartVersion}/sdk/dartsdk-${system}-release.zip";
+  hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
 }
-.${platform}
diff --git a/pkgs/development/compilers/flutter/versions/3_41/data.json b/pkgs/development/compilers/flutter/versions/3_41/data.json
index ac018edd16b4..6f8b5d74dc99 100644
--- a/pkgs/development/compilers/flutter/versions/3_41/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_41/data.json
@@ -1,73 +1,73 @@
 {
-  "version": "3.41.0-0.3.pre",
-  "engineVersion": "492bf6df86d056e47d05a3d5404f3d78939b3dae",
+  "version": "3.41.0",
+  "engineVersion": "3452d735bd38224ef2db85ca763d862d6326b17f",
   "engineSwiftShaderHash": "sha256-qbtCl2nTpmtp9dnaoXc7rF3RqLnAZEmzw1BzPoCRWrc=",
   "engineSwiftShaderRev": "794b0cfce1d828d187637e6d932bae484fbe0976",
-  "channel": "beta",
+  "channel": "stable",
   "engineHashes": {
     "aarch64-linux": {
-      "aarch64-linux": "sha256-sL+RfXTdy5qAzgbSdfxeZHDcHSBzBLsbJ0Q8qLC9KMU=",
-      "x86_64-linux": "sha256-sL+RfXTdy5qAzgbSdfxeZHDcHSBzBLsbJ0Q8qLC9KMU="
+      "aarch64-linux": "sha256-XZvyhT3X4MBehSxWdceVFCNH9teXuGYjTaquuoiVp0w=",
+      "x86_64-linux": "sha256-XZvyhT3X4MBehSxWdceVFCNH9teXuGYjTaquuoiVp0w="
     },
     "x86_64-linux": {
-      "aarch64-linux": "sha256-82KrH53pKiLCwdwzxlFRCD/IKe0RcP8NEnjItA2whdA=",
-      "x86_64-linux": "sha256-82KrH53pKiLCwdwzxlFRCD/IKe0RcP8NEnjItA2whdA="
+      "aarch64-linux": "sha256-u2JDoBxDdOIj7no+9Ym+JLwAQZxTKXmOjrRtaDlktuc=",
+      "x86_64-linux": "sha256-u2JDoBxDdOIj7no+9Ym+JLwAQZxTKXmOjrRtaDlktuc="
     }
   },
-  "dartVersion": "3.11.0-296.5.beta",
+  "dartVersion": "3.11.0",
   "dartHash": {
-    "x86_64-linux": "sha256-7EJPXQQrViX66lnpdqapSuTYrcT2uNwpqZClpjvNzRY=",
-    "aarch64-linux": "sha256-2xgSEH9HQj8oJNH8eNs0NYxK3UGGaVBWnyuDbdam7XQ=",
-    "x86_64-darwin": "sha256-cz7VM3lBWxnpFNaOI3ERZXVOgtEPVa6LVpvnvqFcw2M=",
-    "aarch64-darwin": "sha256-eSTSzsjaIQUoTHqdwc3ZVkSKcXeiz+MIc0fh2XW935Q="
+    "x86_64-linux": "sha256-8xcptWe+MYx8wjva/muamX+n3b+CnfUBbwZiJ7aqDJk=",
+    "aarch64-linux": "sha256-dr/vXICcCCF332xRu/SADY1NdV8ulvt1Fiv40rAy74M=",
+    "x86_64-darwin": "sha256-Wlwpx6g4EmkzKAEyaxHMrc8M/nMB7QGj8G6BdmvLjXQ=",
+    "aarch64-darwin": "sha256-IjJFpC6rG4EeUC4VYluGcHX/4BLenrU3Skzd4u4IdTQ="
   },
-  "flutterHash": "sha256-dCfrPq1oJOmDb3bP24D2rmDQzoB8uI3qJF2hqWmXywI=",
+  "flutterHash": "sha256-/rgmV0BMOF3Mlw/9DVEQkptDUXzJCNEYmQX+BIXlyxY=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-+HRucNf5J3fb1uVcYEte5zw4LcnfbmBL0kmeSQBHBlw=",
-      "aarch64-linux": "sha256-7t3r/mq8KnWEbY2CVCv7l2HAV2dncrJj18vb2QxTh+8=",
-      "x86_64-darwin": "sha256-+HRucNf5J3fb1uVcYEte5zw4LcnfbmBL0kmeSQBHBlw=",
-      "x86_64-linux": "sha256-7t3r/mq8KnWEbY2CVCv7l2HAV2dncrJj18vb2QxTh+8="
+      "aarch64-darwin": "sha256-9bjCiMYvcwMMWU8lJdJB+f2P0WxZzzjfs/pUD4qr74g=",
+      "aarch64-linux": "sha256-u8O8uDaGrmAPexC+TIq0/dlnt3+B5+RQNiyk2GnVWLM=",
+      "x86_64-darwin": "sha256-9bjCiMYvcwMMWU8lJdJB+f2P0WxZzzjfs/pUD4qr74g=",
+      "x86_64-linux": "sha256-u8O8uDaGrmAPexC+TIq0/dlnt3+B5+RQNiyk2GnVWLM="
     },
     "fuchsia": {
-      "aarch64-darwin": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "aarch64-linux": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "x86_64-darwin": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "x86_64-linux": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg="
+      "aarch64-darwin": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "aarch64-linux": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "x86_64-darwin": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "x86_64-linux": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o="
     },
     "ios": {
-      "aarch64-darwin": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "aarch64-linux": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "x86_64-darwin": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "x86_64-linux": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o="
+      "aarch64-darwin": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "aarch64-linux": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "x86_64-darwin": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "x86_64-linux": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ="
     },
     "linux": {
-      "aarch64-darwin": "sha256-NouPte/10GE7QctNlMpDXP/Yl3dDEjC52cf3Zd8Si40=",
-      "aarch64-linux": "sha256-NouPte/10GE7QctNlMpDXP/Yl3dDEjC52cf3Zd8Si40=",
-      "x86_64-darwin": "sha256-ELqekEn0ofBiDMh+cUXYhYTweu81k7Qc2f3WlO0fZzE=",
-      "x86_64-linux": "sha256-ELqekEn0ofBiDMh+cUXYhYTweu81k7Qc2f3WlO0fZzE="
+      "aarch64-darwin": "sha256-RwXbextfT+342Zg19z0k1EykHo6flPYPHuHE5czDs+4=",
+      "aarch64-linux": "sha256-RwXbextfT+342Zg19z0k1EykHo6flPYPHuHE5czDs+4=",
+      "x86_64-darwin": "sha256-J9cGfpF5LIjY17lVJlmlcyucLCpT49jt5P8jAWyeoiU=",
+      "x86_64-linux": "sha256-J9cGfpF5LIjY17lVJlmlcyucLCpT49jt5P8jAWyeoiU="
     },
     "macos": {
-      "aarch64-darwin": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "aarch64-linux": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "x86_64-darwin": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "x86_64-linux": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84="
+      "aarch64-darwin": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "aarch64-linux": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "x86_64-darwin": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "x86_64-linux": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY="
     },
     "universal": {
-      "aarch64-darwin": "sha256-ymXBamYKnmhcTwgc2rX/RgFdQml7obiYOpBh5ghKhlU=",
-      "aarch64-linux": "sha256-bULGcWqxjolrksGQYFXEx6zmlcDSD6ngw0L9kDoIVvY=",
-      "x86_64-darwin": "sha256-+erTasrFkQTXPQtuu8YzvfFspEVb0wIVX5jKPp9RXBE=",
-      "x86_64-linux": "sha256-8foy5AZZwTBPn2WrUiG8qgc+H/0bajCgSApJ/vIlVIw="
+      "aarch64-darwin": "sha256-OKUry7x+5lrGzElLnmltaIaLyq5tHtNR40z33FgL+Z0=",
+      "aarch64-linux": "sha256-ZqmkJ5KGnKU4FGAOBGTF7vU7XZ7UmgCML0Pdg0bXNn4=",
+      "x86_64-darwin": "sha256-orb4XUtX9Uq3Uq1xwoZAzrd+GgkOKGiOek3NEEDVQR4=",
+      "x86_64-linux": "sha256-uN/wDyFnMLxqEfFR2PWesRGnigbsnqzs+mPDxEMZ+1g="
     },
     "web": {
-      "aarch64-darwin": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "aarch64-linux": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "x86_64-darwin": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "x86_64-linux": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0="
+      "aarch64-darwin": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "aarch64-linux": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "x86_64-darwin": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "x86_64-linux": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE="
     },
     "windows": {
-      "x86_64-darwin": "sha256-J+N6ADOB3SF298uxN0hPydslw3k+5+nwHln2NwTQTgc=",
-      "x86_64-linux": "sha256-J+N6ADOB3SF298uxN0hPydslw3k+5+nwHln2NwTQTgc="
+      "x86_64-darwin": "sha256-YZ7HehFv90UHmv0hfcyv0YsQxsNRRzOitPdf5BqaJJM=",
+      "x86_64-linux": "sha256-YZ7HehFv90UHmv0hfcyv0YsQxsNRRzOitPdf5BqaJJM="
     }
   },
   "pubspecLock": {

From 75f9a38deffe6b3c02edabd59258871b8f6f50fb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 03:07:45 +0000
Subject: [PATCH 40/55] python3Packages.sagemaker-core: 1.0.75 -> 1.0.76

---
 pkgs/development/python-modules/sagemaker-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix
index 2084a52bb7ac..d193fc110bfc 100644
--- a/pkgs/development/python-modules/sagemaker-core/default.nix
+++ b/pkgs/development/python-modules/sagemaker-core/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sagemaker-core";
-  version = "1.0.75";
+  version = "1.0.76";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yRXnXGH4BoURohty/daPYd6FDGsAk9a1AiXtyCkKxug=";
+    hash = "sha256-IAgHAmmN00nyE1rcPV09DMb/LFCZnwrD0OhXTeNuTik=";
   };
 
   build-system = [

From d9e2d4dcebdf6482adade0fb9c61e5891dafe6e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 03:42:16 +0000
Subject: [PATCH 41/55] secretspec: 0.6.2 -> 0.7.0

---
 pkgs/by-name/se/secretspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
index 9d7e85329716..8040cf5e544b 100644
--- a/pkgs/by-name/se/secretspec/package.nix
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "secretspec";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ZbyeYol8TaQz4ljTHTIHIlQwxmi/fr/ReILIOtilfEY=";
+    hash = "sha256-ik4ieQifB5MFvyr6cmcwvcyr3HyUB5aHpVIhnpVB1i8=";
   };
 
-  cargoHash = "sha256-UcSHFf9afU+2gl6K7XkYNEkJvslTkEO9u7qkNOKSNxg=";
+  cargoHash = "sha256-3xaJySTsGPjU8sDL7j0biEdpcrNuOspdf41iHH6BE4o=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];

From e9aed135b3bbcb61a0400e0f168b21182aa88fe5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 05:12:30 +0000
Subject: [PATCH 42/55] wit-bindgen: 0.52.0 -> 0.53.0

---
 pkgs/by-name/wi/wit-bindgen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wi/wit-bindgen/package.nix b/pkgs/by-name/wi/wit-bindgen/package.nix
index 87361189e5ca..3b7bb0abbe4a 100644
--- a/pkgs/by-name/wi/wit-bindgen/package.nix
+++ b/pkgs/by-name/wi/wit-bindgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wit-bindgen";
-  version = "0.52.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S3iOmkAg1H6sEcXhC/7cQcrwH5OwR5ZROn0iPkUrwEY=";
+    hash = "sha256-TTSc4T8QR7cmAPAFzoV/9oBfKrUzVs20qMP3rwjELr4=";
   };
 
-  cargoHash = "sha256-RqDlBpwCxwwoG+u7zUz8j4t5JXonTe7mvAk8PxU7Gdc=";
+  cargoHash = "sha256-SybsgrOlxh27CQ73IXVYlTROTRR0MU3O7Sieh5pYeHw=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.

From fd3ff5aae9f6cbd860cb8a84ffcb3a3dd1f40cfc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 06:06:51 +0000
Subject: [PATCH 43/55] python3Packages.homematicip: 2.5.0 -> 2.6.0

---
 pkgs/development/python-modules/homematicip/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 1f0525638641..f6f1cc1a928b 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "homematicip";
-  version = "2.5.0";
+  version = "2.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage (finalAttrs: {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = finalAttrs.version;
-    hash = "sha256-UdVOYJyWLtqJaZgiRa3M9JL+gPzZeecZwElBXqrAdFM=";
+    hash = "sha256-0i3sXtwEBd9rXOEcoL7E3pCwviCcMcIQcTFFLSV3s+0=";
   };
 
   build-system = [

From 02b74722d86f55b367011ac4b9ebafe7ffcbb11c Mon Sep 17 00:00:00 2001
From: Cameron Smith <cameron.ray.smith@gmail.com>
Date: Wed, 11 Feb 2026 22:51:11 -0500
Subject: [PATCH 44/55] nixos/nix-required-mounts: fix infinite recursion with
 userborn

---
 .../modules/programs/nix-required-mounts.nix  |  7 +++---
 .../ni/nix-required-mounts/eval-test.nix      | 23 +++++++++++++++++++
 .../ni/nix-required-mounts/package.nix        |  1 +
 3 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/by-name/ni/nix-required-mounts/eval-test.nix

diff --git a/nixos/modules/programs/nix-required-mounts.nix b/nixos/modules/programs/nix-required-mounts.nix
index a7ec09fe5f9a..df00047f6565 100644
--- a/nixos/modules/programs/nix-required-mounts.nix
+++ b/nixos/modules/programs/nix-required-mounts.nix
@@ -47,10 +47,7 @@ let
     );
 
   driverPaths = [
-    # opengl:
-    # NOTE: Since driverLink is just a symlink, we need to include its target as well.
     pkgs.addDriverRunpath.driverLink
-    config.systemd.tmpfiles.settings.graphics-driver."/run/opengl-driver"."L+".argument
 
     # mesa:
     config.hardware.graphics.package
@@ -62,7 +59,9 @@ let
   defaults = {
     nvidia-gpu.onFeatures = package.allowedPatterns.nvidia-gpu.onFeatures;
     nvidia-gpu.paths = package.allowedPatterns.nvidia-gpu.paths ++ driverPaths;
-    nvidia-gpu.unsafeFollowSymlinks = false;
+    # TODO: Refactor `hardware.graphics` to ease referencing the closure
+    # NOTE: A naive implementation may e.g. introduce a conditional infinite recursion (https://github.com/NixOS/nixpkgs/pull/488199)
+    nvidia-gpu.unsafeFollowSymlinks = true;
   };
 in
 {
diff --git a/pkgs/by-name/ni/nix-required-mounts/eval-test.nix b/pkgs/by-name/ni/nix-required-mounts/eval-test.nix
new file mode 100644
index 000000000000..ba7fc1234033
--- /dev/null
+++ b/pkgs/by-name/ni/nix-required-mounts/eval-test.nix
@@ -0,0 +1,23 @@
+{
+  nixos,
+  lib,
+  runCommand,
+}:
+let
+  machine = nixos {
+    services.userborn.enable = true;
+    hardware.graphics.enable = true;
+    programs.nix-required-mounts = {
+      enable = true;
+      presets.nvidia-gpu.enable = true;
+    };
+    fileSystems."/".device = "/dev/null";
+    boot.loader.grub.enable = false;
+    system.stateVersion = lib.trivial.release;
+  };
+in
+runCommand "nix-required-mounts-eval-nvidia-gpu-preset" { } ''
+  echo "Successfully evaluated ${machine.config.system.build.toplevel}"
+  echo "This means that combining nix-required-mounts with userborn no longer causes infinite recursion (#488199)"
+  touch $out
+''
diff --git a/pkgs/by-name/ni/nix-required-mounts/package.nix b/pkgs/by-name/ni/nix-required-mounts/package.nix
index 89069a112051..9f91c14692a1 100644
--- a/pkgs/by-name/ni/nix-required-mounts/package.nix
+++ b/pkgs/by-name/ni/nix-required-mounts/package.nix
@@ -55,6 +55,7 @@ python3Packages.buildPythonApplication {
     inherit allowedPatterns;
     tests = {
       inherit (nixosTests) nix-required-mounts;
+      eval-nvidia-gpu-preset = callPackage ./eval-test.nix { };
     };
   };
   meta = {

From 867b4878b711adce951ee21e5e0bdc30039d6e80 Mon Sep 17 00:00:00 2001
From: Cameron Smith <cameron.ray.smith@gmail.com>
Date: Sun, 8 Feb 2026 14:29:07 -0500
Subject: [PATCH 45/55] nixos/nix-required-mounts: nvidia-gpu preset requires
 hardware.graphics

---
 nixos/modules/programs/nix-required-mounts.nix    | 1 +
 pkgs/by-name/ni/nix-required-mounts/eval-test.nix | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/programs/nix-required-mounts.nix b/nixos/modules/programs/nix-required-mounts.nix
index df00047f6565..962116c97575 100644
--- a/nixos/modules/programs/nix-required-mounts.nix
+++ b/nixos/modules/programs/nix-required-mounts.nix
@@ -111,6 +111,7 @@ in
     lib.mkMerge [
       { nix.settings.pre-build-hook = lib.getExe cfg.package; }
       (lib.mkIf cfg.presets.nvidia-gpu.enable {
+        hardware.graphics.enable = lib.mkDefault true;
         nix.settings.system-features = cfg.allowedPatterns.nvidia-gpu.onFeatures;
         programs.nix-required-mounts.allowedPatterns = {
           inherit (defaults) nvidia-gpu;
diff --git a/pkgs/by-name/ni/nix-required-mounts/eval-test.nix b/pkgs/by-name/ni/nix-required-mounts/eval-test.nix
index ba7fc1234033..81f1a4f8ca84 100644
--- a/pkgs/by-name/ni/nix-required-mounts/eval-test.nix
+++ b/pkgs/by-name/ni/nix-required-mounts/eval-test.nix
@@ -4,9 +4,8 @@
   runCommand,
 }:
 let
-  machine = nixos {
+  base = nixos {
     services.userborn.enable = true;
-    hardware.graphics.enable = true;
     programs.nix-required-mounts = {
       enable = true;
       presets.nvidia-gpu.enable = true;
@@ -15,8 +14,12 @@ let
     boot.loader.grub.enable = false;
     system.stateVersion = lib.trivial.release;
   };
+  machine = base.extendModules {
+    modules = [ { hardware.graphics.enable = true; } ];
+  };
 in
 runCommand "nix-required-mounts-eval-nvidia-gpu-preset" { } ''
+  echo "Successfully evaluated ${base.config.system.build.toplevel}"
   echo "Successfully evaluated ${machine.config.system.build.toplevel}"
   echo "This means that combining nix-required-mounts with userborn no longer causes infinite recursion (#488199)"
   touch $out

From 61dfeb6d154136e87fa1911f6c57226db8837410 Mon Sep 17 00:00:00 2001
From: Bart Brouns <bart@magnetophon.nl>
Date: Fri, 6 Feb 2026 11:07:18 +0100
Subject: [PATCH 46/55] ardour: 8.12 -> 9.0

---
 pkgs/by-name/ar/ardour/package.nix            |  17 +-
 pkgs/by-name/ar/ardour_8/as-flags.patch       |  12 +
 .../default-plugin-search-paths.patch         |  55 ++++
 pkgs/by-name/ar/ardour_8/package.nix          | 243 ++++++++++++++++++
 4 files changed, 324 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/ar/ardour_8/as-flags.patch
 create mode 100644 pkgs/by-name/ar/ardour_8/default-plugin-search-paths.patch
 create mode 100644 pkgs/by-name/ar/ardour_8/package.nix

diff --git a/pkgs/by-name/ar/ardour/package.nix b/pkgs/by-name/ar/ardour/package.nix
index e21a47802dcd..9f7f7be04f7d 100644
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@@ -36,6 +36,7 @@
   libusb1,
   libuv,
   libwebsockets,
+  libxi,
   libxml2,
   libxslt,
   lilv,
@@ -71,14 +72,14 @@ stdenv.mkDerivation (
   in
   {
     pname = "ardour";
-    version = "8.12";
+    version = "9.0";
 
     # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
     # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
     src = fetchgit {
       url = "git://git.ardour.org/ardour/ardour.git";
       rev = finalAttrs.version;
-      hash = "sha256-4IgBQ53cwPA35YwNQyo+qBqsMGv+TLn6w1zaDX97erE=";
+      hash = "sha256-zgWNKYN45qa2xLWnL3W/UWfRVBJN3+hya9dpIZLLJvo=";
     };
 
     bundledContent = fetchzip {
@@ -146,6 +147,7 @@ stdenv.mkDerivation (
       libusb1
       libuv
       libwebsockets
+      libxi
       libxml2
       libxslt
       lilv
@@ -190,6 +192,15 @@ stdenv.mkDerivation (
     ]
     ++ lib.optional optimize "--optimize";
 
+    env.NIX_CFLAGS_COMPILE = toString [
+      # 'ioprio_set' syscall support:
+      "-D_GNU_SOURCE"
+      # compiler doesn't find headers without these:
+      "-I${lib.getDev serd}/include/serd-0"
+      "-I${lib.getDev sratom}/include/sratom-0"
+      "-I${lib.getDev sord}/include/sord-0"
+    ];
+
     postInstall = ''
       # wscript does not install these for some reason
       install -vDm 644 "build/gtk2_ardour/ardour.xml" \
@@ -231,7 +242,7 @@ stdenv.mkDerivation (
       '';
       homepage = "https://ardour.org/";
       license = lib.licenses.gpl2Plus;
-      mainProgram = "ardour8";
+      mainProgram = "ardour9";
       platforms = lib.platforms.linux;
       maintainers = with lib.maintainers; [
         magnetophon
diff --git a/pkgs/by-name/ar/ardour_8/as-flags.patch b/pkgs/by-name/ar/ardour_8/as-flags.patch
new file mode 100644
index 000000000000..b8aab70ddca6
--- /dev/null
+++ b/pkgs/by-name/ar/ardour_8/as-flags.patch
@@ -0,0 +1,12 @@
+--- a/libs/ardour/wscript
++++ b/libs/ardour/wscript
+@@ -379,8 +379,7 @@ def build(bld):
+
+     # remove '${DEFINES_ST:DEFINES}' from run_str.
+     # x86_64-w64-mingw32-as (mingw) -D flag is for debug messages
+-    if bld.env['build_target'] == 'mingw':
+-        class asm(Task.classes['asm']): run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
++    class asm(Task.classes['asm']): run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
+
+     # operate on copy to avoid adding sources twice
+     sources = list(libardour_sources)
diff --git a/pkgs/by-name/ar/ardour_8/default-plugin-search-paths.patch b/pkgs/by-name/ar/ardour_8/default-plugin-search-paths.patch
new file mode 100644
index 000000000000..68d67ce8b9bc
--- /dev/null
+++ b/pkgs/by-name/ar/ardour_8/default-plugin-search-paths.patch
@@ -0,0 +1,55 @@
+From 1217722e4bf6c65b5c24da17a7de4bf712ca6775 Mon Sep 17 00:00:00 2001
+From: Tamara Schmitz <tamara.zoe.schmitz@posteo.de>
+Date: Sat, 17 Jun 2023 14:05:53 +0200
+Subject: [PATCH] add NixOS plugin paths as default search paths
+
+Since NixOS uses unusual paths, we should tell Ardour about this. During
+first launch, Ardour does indeed check for environmentals but not when
+you press the "Reset to Defaults" button in the Settings menu. This
+path fixes this by including NixOS paths in the defaults.
+---
+ libs/ardour/plugin_manager.cc | 5 +++--
+ libs/ardour/search_paths.cc   | 4 ++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/libs/ardour/plugin_manager.cc b/libs/ardour/plugin_manager.cc
+index a572ed55dd..3dd6c2fda6 100644
+--- a/libs/ardour/plugin_manager.cc
++++ b/libs/ardour/plugin_manager.cc
+@@ -305,7 +305,8 @@ PluginManager::PluginManager ()
+ 	if (lxvst_path.length() == 0) {
+ 		lxvst_path = "/usr/local/lib64/lxvst:/usr/local/lib/lxvst:/usr/lib64/lxvst:/usr/lib/lxvst:"
+ 			"/usr/local/lib64/linux_vst:/usr/local/lib/linux_vst:/usr/lib64/linux_vst:/usr/lib/linux_vst:"
+-			"/usr/lib/vst:/usr/local/lib/vst";
++			"/usr/lib/vst:/usr/local/lib/vst:$HOME/.nix-profile/lib/vst:"
++			"$HOME/.lxvst:$HOME/.nix-profile/lib/lxvst:/run/current-system/sw/lib/lxvst:/etc/profiles/per-user/$USER/lib/lxvst";
+ 	}
+ 
+ 	/* first time setup, use 'default' path */
+@@ -2040,7 +2041,7 @@ PluginManager::vst3_refresh (bool cache_only)
+ 	std::string prog = PBD::get_win_special_folder_path (CSIDL_PROGRAM_FILES);
+ 	vst3_discover_from_path (Glib::build_filename (prog, "Common Files", "VST3"), cache_only);
+ #else
+-	vst3_discover_from_path ("~/.vst3:/usr/local/lib/vst3:/usr/lib/vst3", cache_only);
++	vst3_discover_from_path ("~/.vst3:/usr/local/lib/vst3:/usr/lib/vst3:~/.nix-profile/lib/vst3:/run/current-system/sw/lib/vst3:/etc/profiles/per-user/$USER/lib/vst3", cache_only);
+ #endif
+ }
+ 
+diff --git a/libs/ardour/search_paths.cc b/libs/ardour/search_paths.cc
+index e6d8744369..b9774cb006 100644
+--- a/libs/ardour/search_paths.cc
++++ b/libs/ardour/search_paths.cc
+@@ -112,6 +112,10 @@ ladspa_search_path ()
+ 	spath.push_back ("/usr/local/lib/ladspa");
+ 	spath.push_back ("/usr/lib64/ladspa");
+ 	spath.push_back ("/usr/lib/ladspa");
++	spath.push_back ("/run/current-system/sw/lib/ladspa");
++	spath.push_back (path_expand ("$HOME/.ladspa"));
++	spath.push_back (path_expand ("$HOME/.nix-profile/lib/ladspa"));
++	spath.push_back (path_expand ("/etc/profiles/per-user/$USER/lib/ladspa"));
+ #endif
+ 
+ #ifdef __APPLE__
+-- 
+2.40.1
+
diff --git a/pkgs/by-name/ar/ardour_8/package.nix b/pkgs/by-name/ar/ardour_8/package.nix
new file mode 100644
index 000000000000..e21a47802dcd
--- /dev/null
+++ b/pkgs/by-name/ar/ardour_8/package.nix
@@ -0,0 +1,243 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  fetchzip,
+  alsa-lib,
+  aubio,
+  boost,
+  cairomm,
+  cppunit,
+  curl,
+  dbus,
+  doxygen,
+  ffmpeg,
+  fftw,
+  fftwSinglePrec,
+  flac,
+  fluidsynth,
+  glibc,
+  glibmm,
+  graphviz,
+  harvid,
+  hidapi,
+  itstool,
+  kissfft,
+  libarchive,
+  libjack2,
+  liblo,
+  libltc,
+  libogg,
+  libpulseaudio,
+  librdf_rasqal,
+  libsamplerate,
+  libsigcxx,
+  libsndfile,
+  libusb1,
+  libuv,
+  libwebsockets,
+  libxml2,
+  libxslt,
+  lilv,
+  lrdf,
+  lv2,
+  makeWrapper,
+  pango,
+  pangomm,
+  perl,
+  pkg-config,
+  python3,
+  qm-dsp,
+  readline,
+  rubberband,
+  serd,
+  sord,
+  soundtouch,
+  sratom,
+  suil,
+  taglib,
+  vamp-plugin-sdk,
+  wafHook,
+  xjadeo,
+  libxrandr,
+  libxinerama,
+  optimize ? true, # disable to print Lua DSP script output to stdout
+  videoSupport ? true,
+}:
+stdenv.mkDerivation (
+  finalAttrs:
+  let
+    majorVersion = lib.versions.major finalAttrs.version;
+  in
+  {
+    pname = "ardour";
+    version = "8.12";
+
+    # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
+    # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
+    src = fetchgit {
+      url = "git://git.ardour.org/ardour/ardour.git";
+      rev = finalAttrs.version;
+      hash = "sha256-4IgBQ53cwPA35YwNQyo+qBqsMGv+TLn6w1zaDX97erE=";
+    };
+
+    bundledContent = fetchzip {
+      url = "https://web.archive.org/web/20221026200824/http://stuff.ardour.org/loops/ArdourBundledMedia.zip";
+      hash = "sha256-IbPQWFeyMuvCoghFl1ZwZNNcSvLNsH84rGArXnw+t7A=";
+      # archive does not contain a single folder at the root
+      stripRoot = false;
+    };
+
+    patches = [
+      # AS=as in the environment causes build failure https://tracker.ardour.org/view.php?id=8096
+      ./as-flags.patch
+      ./default-plugin-search-paths.patch
+    ];
+
+    # Ardour's wscript requires git revision and date to be available.
+    # Since they are not, let's generate the file manually.
+    postPatch = ''
+      printf '#include "libs/ardour/ardour/revision.h"\nnamespace ARDOUR { const char* revision = "${finalAttrs.version}"; const char* date = ""; }\n' > libs/ardour/revision.cc
+      sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
+      patchShebangs ./tools/
+      substituteInPlace libs/ardour/video_tools_paths.cc \
+        --replace-fail 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
+        --replace-fail 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
+    '';
+
+    nativeBuildInputs = [
+      doxygen
+      graphviz # for dot
+      itstool
+      makeWrapper
+      perl
+      pkg-config
+      python3
+      wafHook
+    ];
+
+    buildInputs = [
+      alsa-lib
+      aubio
+      boost
+      cairomm
+      cppunit
+      curl
+      dbus
+      ffmpeg
+      fftw
+      fftwSinglePrec
+      flac
+      fluidsynth
+      glibmm
+      hidapi
+      itstool
+      kissfft
+      libarchive
+      libjack2
+      liblo
+      libltc
+      libogg
+      libpulseaudio
+      librdf_rasqal
+      libsamplerate
+      libsigcxx
+      libsndfile
+      libusb1
+      libuv
+      libwebsockets
+      libxml2
+      libxslt
+      lilv
+      lrdf
+      lv2
+      pango
+      pangomm
+      perl
+      python3
+      qm-dsp
+      readline
+      rubberband
+      serd
+      sord
+      soundtouch
+      sratom
+      suil
+      taglib
+      vamp-plugin-sdk
+      libxinerama
+      libxrandr
+    ]
+    ++ lib.optionals videoSupport [
+      harvid
+      xjadeo
+    ];
+
+    wafConfigureFlags = [
+      "--cxx17"
+      "--docs"
+      "--freedesktop"
+      "--no-phone-home"
+      "--ptformat"
+      "--run-tests"
+      "--test"
+      # since we don't have https://github.com/agfline/LibAAF yet,
+      # we need to use some of ardours internal libs, see:
+      # https://discourse.ardour.org/t/ardour-8-2-released/109615/6
+      # and
+      # https://discourse.ardour.org/t/ardour-8-2-released/109615/8
+      # "--use-external-libs"
+    ]
+    ++ lib.optional optimize "--optimize";
+
+    postInstall = ''
+      # wscript does not install these for some reason
+      install -vDm 644 "build/gtk2_ardour/ardour.xml" \
+        -t "$out/share/mime/packages"
+      install -vDm 644 "build/gtk2_ardour/ardour${majorVersion}.desktop" \
+        -t "$out/share/applications"
+      for size in 16 22 32 48 256 512; do
+        install -vDm 644 "gtk2_ardour/resources/Ardour-icon_''${size}px.png" \
+          "$out/share/icons/hicolor/''${size}x''${size}/apps/ardour${majorVersion}.png"
+      done
+      install -vDm 644 "ardour.1"* -t "$out/share/man/man1"
+
+      # install additional bundled beats, chords and progressions
+      cp -rp "${finalAttrs.bundledContent}"/* "$out/share/ardour${majorVersion}/media"
+    ''
+    + lib.optionalString videoSupport ''
+      # `harvid` and `xjadeo` must be accessible in `PATH` for video to work.
+      wrapProgram "$out/bin/ardour${majorVersion}" \
+        --prefix PATH : "${
+          lib.makeBinPath [
+            harvid
+            xjadeo
+          ]
+        }"
+    '';
+
+    LINKFLAGS = "-lpthread";
+
+    meta = {
+      description = "Multi-track hard disk recording software";
+      longDescription = ''
+        Ardour is a digital audio workstation (DAW), You can use it to
+        record, edit and mix multi-track audio and midi. Produce your
+        own CDs. Mix video soundtracks. Experiment with new ideas about
+        music and sound.
+
+        Please consider supporting the ardour project financially:
+        https://community.ardour.org/donate
+      '';
+      homepage = "https://ardour.org/";
+      license = lib.licenses.gpl2Plus;
+      mainProgram = "ardour8";
+      platforms = lib.platforms.linux;
+      maintainers = with lib.maintainers; [
+        magnetophon
+        mitchmindtree
+        ryand56
+      ];
+    };
+  }
+)

From 040369bb89be1a6c41d6dc5968a831af00c11c50 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 05:24:32 +0000
Subject: [PATCH 47/55] python3Packages.jupyter-docprovider: 2.2.0 -> 2.2.1

---
 .../python-modules/jupyter-docprovider/default.nix     | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-docprovider/default.nix b/pkgs/development/python-modules/jupyter-docprovider/default.nix
index 04e2f5a615e7..55eeef745a50 100644
--- a/pkgs/development/python-modules/jupyter-docprovider/default.nix
+++ b/pkgs/development/python-modules/jupyter-docprovider/default.nix
@@ -7,15 +7,15 @@
   jupyter-collaboration,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupyter-docprovider";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_docprovider";
-    inherit version;
-    hash = "sha256-UZwPhBJsb7qWIOUYm+9t8GfX14nRJt69czAapLiN/Qw=";
+    inherit (finalAttrs) version;
+    hash = "sha256-2Ko7XbO5tAHeBRWd+No24th0hebc31l6IOWMkh9wXdo=";
   };
 
   postPatch = ''
@@ -41,4 +41,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };
-}
+})

From 756ba3eafcad2ba40cc49c6941ab1cbfbcc0f076 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Thu, 12 Feb 2026 10:24:28 +0100
Subject: [PATCH 48/55] cfn-nag: remove version from bundlerEnv

---
 pkgs/by-name/cf/cfn-nag/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/cf/cfn-nag/package.nix b/pkgs/by-name/cf/cfn-nag/package.nix
index 71c198c9a9b7..b5f7cd01298a 100644
--- a/pkgs/by-name/cf/cfn-nag/package.nix
+++ b/pkgs/by-name/cf/cfn-nag/package.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "cfn-nag";
-  version = "0.8.10";
 
   inherit ruby;
   gemdir = ./.;

From 22f0092301e865754cbc3251246b80dbf3f460e0 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Thu, 12 Feb 2026 10:24:40 +0100
Subject: [PATCH 49/55] compass: remove version from bundlerEnv

---
 pkgs/development/tools/compass/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/tools/compass/default.nix b/pkgs/development/tools/compass/default.nix
index cbf28b43f425..e09f5e9f3926 100644
--- a/pkgs/development/tools/compass/default.nix
+++ b/pkgs/development/tools/compass/default.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "compass";
-  version = "1.0.3";
 
   inherit ruby;
   gemdir = ./.;

From 849f9faa4f6a44416fc6c4c042bd73bedb8ef4a3 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Thu, 12 Feb 2026 10:25:18 +0100
Subject: [PATCH 50/55] license_finder: remove version from bundlerEnv

---
 pkgs/development/tools/license_finder/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/tools/license_finder/default.nix b/pkgs/development/tools/license_finder/default.nix
index 6eb7fe397a9c..2b3247c504df 100644
--- a/pkgs/development/tools/license_finder/default.nix
+++ b/pkgs/development/tools/license_finder/default.nix
@@ -7,7 +7,6 @@
 
 bundlerEnv {
   pname = "license_finder";
-  version = "7.0.1";
 
   inherit ruby;
   gemdir = ./.;

From ce31931fe48a310195cb405da95200d7c393f5a2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 12 Feb 2026 11:16:52 +0000
Subject: [PATCH 51/55] balatro: add some whitespace

Make the direvation slightly more readable.
---
 pkgs/by-name/ba/balatro/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index eb039b8808a7..56e3b21a7539 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -34,8 +34,11 @@ stdenv.mkDerivation (finalAttrs: {
     copyDesktopItems
     makeWrapper
   ];
+
   buildInputs = [ love ] ++ lib.optional withMods lovely-injector;
+
   dontUnpack = true;
+
   desktopItems = [
     (makeDesktopItem {
       name = "balatro";
@@ -46,13 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
       icon = "balatro";
     })
   ];
+
   buildPhase = ''
     runHook preBuild
+
     tmpdir=$(mktemp -d)
     7z x ${finalAttrs.src} -o$tmpdir -y
     ${if withLinuxPatch then "patch $tmpdir/globals.lua -i ${./globals.patch}" else ""}
     patchedExe=$(mktemp -u).zip
     7z a $patchedExe $tmpdir/*
+
     runHook postBuild
   '';
 
@@ -61,12 +67,14 @@ stdenv.mkDerivation (finalAttrs: {
   # 'official' way of doing it.
   installPhase = ''
     runHook preInstall
+
     install -Dm644 $srcIcon $out/share/icons/hicolor/scalable/apps/balatro.png
 
     cat ${lib.getExe love} $patchedExe > $out/share/Balatro
     chmod +x $out/share/Balatro
 
     makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods "--prefix LD_PRELOAD : '${lovely-injector}/lib/liblovely.so'"}
+
     runHook postInstall
   '';
 

From f7f227913daf667b08b7218d0c658175d1c30ab7 Mon Sep 17 00:00:00 2001
From: Bazinga9000 <bazonkidonk@gmail.com>
Date: Mon, 24 Nov 2025 23:36:13 -0500
Subject: [PATCH 52/55] balatro: add curl to LD_LIBRARY_PATH

Resolves #464807
---
 pkgs/by-name/ba/balatro/package.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index 56e3b21a7539..bb4cf28bca89 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -4,6 +4,7 @@
   lib,
   love,
   lovely-injector,
+  curl,
   p7zip,
   copyDesktopItems,
   makeWrapper,
@@ -35,7 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
   ];
 
-  buildInputs = [ love ] ++ lib.optional withMods lovely-injector;
+  buildInputs = [
+    love
+  ]
+  ++ lib.optionals withMods [
+    lovely-injector
+    curl
+  ];
 
   dontUnpack = true;
 
@@ -63,8 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # The `cat` bit is a hack suggested by whitelje (https://github.com/ethangreen-dev/lovely-injector/pull/66#issuecomment-2319615509)
-  # to make it so that lovely will pick up Balatro as the game name. The `LD_PRELOAD` bit is used to load lovely and it is the
-  # 'official' way of doing it.
+  # to make it so that lovely will pick up Balatro as the game name.
+  # The `LD_PRELOAD` bit is used to load lovely and it is the 'official' way of doing it.
+  # The `LD_LIBRARY_PATH` bit adds `curl` as that is the community standard backend for network-related mods on non-Windows systems
   installPhase = ''
     runHook preInstall
 
@@ -73,7 +81,9 @@ stdenv.mkDerivation (finalAttrs: {
     cat ${lib.getExe love} $patchedExe > $out/share/Balatro
     chmod +x $out/share/Balatro
 
-    makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods "--prefix LD_PRELOAD : '${lovely-injector}/lib/liblovely.so'"}
+    makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods ''
+      --prefix LD_PRELOAD : '${lovely-injector}/lib/liblovely.so' \
+      --prefix LD_LIBRARY_PATH : '${lib.makeLibraryPath [ curl ]}''}
 
     runHook postInstall
   '';

From dc09e2399b75887b5010b913ac28348f345661aa Mon Sep 17 00:00:00 2001
From: Haylin Moore <me@haylinmoore.com>
Date: Fri, 12 Sep 2025 21:02:11 -0700
Subject: [PATCH 53/55] balatro: add requireFile message

Resolves #441819
---
 pkgs/by-name/ba/balatro/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index bb4cf28bca89..9cb86751ae16 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -20,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
   src = requireFile {
     name = "Balatro-${finalAttrs.version}.exe";
     url = "https://store.steampowered.com/app/2379780/Balatro/";
+    message = ''
+      Balatro cannot be automatically downloaded. Please download
+      it from Steam, locate the Balatro.exe on disk, likely in
+      ~/.local/share/Steam/steamapps/common/Balatro/, then upload it
+      to your nix store with nix-store --add-fixed sha256 Balatro.exe.
+    '';
+
     # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
     hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
   };

From 49e2946b62e6a210822c40572b779b35e732c066 Mon Sep 17 00:00:00 2001
From: Brenton Simpson <appsforartists@google.com>
Date: Sat, 31 Jan 2026 23:56:33 -0500
Subject: [PATCH 54/55] balatro: use substituteInPlace for withLinuxPatch

The previous patch relied on git, which meant it only worked on one
specific version of the game.  Moreover, it curtailed the ability to
make the patch more dynamic in the future.

This accomplishes the same, but is more forgiving to updates/alternate
editions.
---
 pkgs/by-name/ba/balatro/globals.patch | 15 ---------------
 pkgs/by-name/ba/balatro/package.nix   | 19 ++++++++++++++++++-
 2 files changed, 18 insertions(+), 16 deletions(-)
 delete mode 100644 pkgs/by-name/ba/balatro/globals.patch

diff --git a/pkgs/by-name/ba/balatro/globals.patch b/pkgs/by-name/ba/balatro/globals.patch
deleted file mode 100644
index b896a1deb61a..000000000000
--- a/pkgs/by-name/ba/balatro/globals.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- result/share/balatro/globals.lua    1970-01-01 01:00:01.000000000 +0100
-+++ result/share/balatro/globals.lua    1970-01-01 01:00:01.000000000 +0100
-@@ -56,6 +56,12 @@ function Game:set_globals()
-         self.F_CRASH_REPORTS = false
-     end
- 
-+    if love.system.getOS() == 'Linux' then
-+        self.F_SAVE_TIMER = 5
-+        self.F_DISCORD = true
-+        self.F_ENGLISH_ONLY = false
-+    end
-+
-     if love.system.getOS() == 'Nintendo Switch' then
-         self.F_HIDE_BETA_LANGS = true
-         self.F_BASIC_CREDITS = true
diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index 9cb86751ae16..4a06a2a1a5ae 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -69,7 +69,24 @@ stdenv.mkDerivation (finalAttrs: {
 
     tmpdir=$(mktemp -d)
     7z x ${finalAttrs.src} -o$tmpdir -y
-    ${if withLinuxPatch then "patch $tmpdir/globals.lua -i ${./globals.patch}" else ""}
+
+    ${
+      let
+        patchMarker = "if love.system.getOS() == 'Nintendo Switch' then";
+      in
+      lib.optionalString withLinuxPatch ''
+        substituteInPlace "$tmpdir/globals.lua" --replace-fail \
+          "${patchMarker}" \
+          "if love.system.getOS() == 'Linux' then
+            self.F_SAVE_TIMER = 5
+            self.F_DISCORD = true
+            self.F_ENGLISH_ONLY = false
+        end
+
+        ${patchMarker}"
+      ''
+    }
+
     patchedExe=$(mktemp -u).zip
     7z a $patchedExe $tmpdir/*
 

From 5122924f493a0c9bc3354c86e34c1c97d4350788 Mon Sep 17 00:00:00 2001
From: Brenton Simpson <appsforartists@google.com>
Date: Sat, 31 Jan 2026 19:40:37 -0500
Subject: [PATCH 55/55] balatro: add support for Google Play and Xbox PC
 editions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Different editions of Balatro have essentially the same Lua codebase,
delegating to a native bridge `love.platform` to handle cloud
functionality like profiles and achievements.  These bridges are not
part of the standard LÖVE SDK, and hence aren't provided
by`pkgs.love`.

`withBridgePatch` uses the local filesystem for loading/saving games,
and short-circuits the other bridge functions.  This enables the Google
Play and Xbox PC editions of the game to be played with the open source
LÖVE runtime.
---
 doc/release-notes/rl-2605.section.md      |   2 +
 pkgs/by-name/ba/balatro/bridge_detour.lua | 229 ++++++++++++++++++++++
 pkgs/by-name/ba/balatro/package.nix       |  76 +++++--
 3 files changed, 288 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/by-name/ba/balatro/bridge_detour.lua

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index b0d55f8f5022..cd78b670c342 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -148,6 +148,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `balatro` now supports the Google Play and Xbox PC versions of the game.  Pass the `apk` or `Assets.zip` as `balatro.override { src = "…" }`.
+
 - `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
   If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
   See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
diff --git a/pkgs/by-name/ba/balatro/bridge_detour.lua b/pkgs/by-name/ba/balatro/bridge_detour.lua
new file mode 100644
index 000000000000..a60126b34a36
--- /dev/null
+++ b/pkgs/by-name/ba/balatro/bridge_detour.lua
@@ -0,0 +1,229 @@
+--[[
+The game Balatro is implemented in Lua, with the standard LÖVE SDK.  However,
+each store that it's sold on (Steam, Google Play, Xbox PC, etc.) has its own SDK
+to provide features like cloud saving and achievement unlocking.
+
+To allow the same platform-agnostic Lua codebase to be deployed in all these
+contexts, each one has a custom bridge - `love.platform`.  This allows the game
+to call `writeSaveFile` and trust that it will be handled appropriately for
+whatever platform the player has available.  Unfortunately, that bridge is not
+supplied by LÖVE, and is therefore missing from Nix's `pkgs.love`.
+
+This file implements the functions that would otherwise utilize that missing
+bridge.  It was created by finding all of the `love.platform` callsites in the
+Balatro codebase, putting them in this file, and asking Gemini to implement a
+Linux version.
+]]
+
+love.platform = love.platform or {}
+package.loaded["love.platform"] = love.platform
+
+local FileOperationStatus = {
+  SUCCESS = 0,
+  FETCH_ERROR = 1,
+  CLOUD_SAVE_ERROR = 2,
+  CONFLICT = 3,
+  OFFLINE = 4,
+  LOAD_ERROR = 5,
+  NOT_FOUND = 6
+}
+
+function love.platform.init(onInitSuccess, onInitFailure)
+  love.filesystem.setIdentity("balatro")
+
+  if onInitSuccess then
+    onInitSuccess(love.system.getOS(), love.platform.getLocalPlayerName())
+  end
+  return true
+end
+
+function love.platform.setOnPlatformStatusChangedCallback(callback)
+  if callback then
+    callback(false, "Cloud unavailable.")
+  end
+end
+
+function love.platform.earlyInit() end
+function love.platform.update(dt) end
+function love.platform.shutdown() end
+
+
+function love.platform.getPlatformId()
+  return love.system.getOS()
+end
+
+function love.platform.getLocalPlayerName()
+  return os.getenv("USER") or os.getenv("LOGNAME") or "Player"
+end
+
+function love.platform.getLocalPlayerAvatar()
+  return nil
+end
+
+function love.platform.isPremium()
+  return true
+end
+
+function love.platform.isArcade()
+  return false
+end
+
+function love.platform.isFirstTimePlaying()
+  return not love.platform.saveGameExists("1", "profile.jkr")
+end
+
+function love.platform.isOffline()
+  -- If the game ever uses this for more than showing the offline warning, we
+  -- should set this back to true
+  return false
+end
+
+function love.platform.getNotchPosition()
+  return nil
+end
+
+
+-- Different builds use different file APIs; therefore, we implement both the
+-- thin wrapper around the framework's filesystem module and the more complex
+-- signatures with individual save slots.
+love.platform.localGetInfo = love.filesystem.getInfo
+love.platform.localRead = love.filesystem.read
+love.platform.localWrite = love.filesystem.write
+love.platform.localRemove = love.filesystem.remove
+love.platform.localCreateDirectory = love.filesystem.createDirectory
+
+
+-- some versions store their settings files in `common/`
+function love.filesystem.getInfo(filename, ...)
+  local info = love.platform.localGetInfo(filename, ...)
+
+  if not info then
+    info = love.platform.localGetInfo("common/" .. filename, ...)
+  end
+
+  return info
+end
+
+function love.filesystem.read(filename, ...)
+  local content, size = love.platform.localRead(filename, ...)
+
+  if not content then
+    content, size = love.platform.localRead("common/" .. filename, ...)
+  end
+
+  return content, size
+end
+
+
+function love.platform.writeSaveGame(profile, filename, data)
+  local parent = tostring(profile)
+
+  if not love.platform.localGetInfo(parent) then
+    love.platform.localCreateDirectory(parent)
+  end
+
+  return love.platform.localWrite(parent .. "/" .. filename, data)
+end
+
+function love.platform.loadSaveGame(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localRead(parent .. "/" .. filename)
+end
+
+function love.platform.saveGameExists(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localGetInfo(parent .. "/" .. filename) ~= nil
+end
+
+function love.platform.deleteSaveGameFile(profile, filename)
+  local parent = tostring(profile)
+  return love.platform.localRemove(parent .. "/" .. filename)
+end
+
+function love.platform.deleteSaveGame(profile)
+  local parent = tostring(profile)
+  return love.platform.localRemove(parent)
+end
+
+local load_game_callback
+local save_game_callback
+
+function love.platform.setLoadGameCallback(callback)
+  load_game_callback = callback
+end
+
+function love.platform.loadGameFile(filename)
+  local content, size = love.filesystem.read(filename)
+
+  if load_game_callback then
+    if content then
+      load_game_callback(filename, FileOperationStatus.SUCCESS, "", content, nil, nil)
+    else
+      load_game_callback(filename, FileOperationStatus.NOT_FOUND, "File not found", nil, nil, nil)
+    end
+  end
+end
+
+
+function love.platform.setOnSaveInitializedCallback(callback)
+  if callback then
+    callback()
+  end
+end
+
+function love.platform.setSaveGameCallback(callback)
+  save_game_callback = callback
+end
+
+function love.platform.saveGameFile(filename, data)
+  local success, msg = love.filesystem.write(filename, data)
+  if save_game_callback then
+    if success then
+      save_game_callback(filename, FileOperationStatus.SUCCESS, "", data, nil, nil)
+    else
+      save_game_callback(filename, FileOperationStatus.CLOUD_SAVE_ERROR, msg, nil, nil, nil)
+    end
+  end
+end
+
+
+-- no-ops when there's no cloud saving
+function love.platform.runLoadGameCallbacks() end
+function love.platform.runSaveGameCallbacks() end
+function love.platform.resolveConflict(file, content, conflictId) end
+
+
+function love.platform.unlockAchievement(achievementId)
+  love.filesystem.append(
+    "unlock_awards.lua",
+    string.format("love.platform.unlockAchievement(%q)\n", achievementId)
+  )
+end
+
+function love.platform.unlockAward(awardName)
+  love.filesystem.append(
+    "unlock_awards.lua",
+    string.format("love.platform.unlockAward(%q)\n", awardName)
+  )
+end
+
+
+function love.platform.event(name, ...) end
+function love.platform.hideSplashScreen() end
+function love.platform.anyButtonPressed() return false end
+
+--[[ these are checked before they're used by the game, so we don't have to
+--   support them
+function love.platform.requestReview() end
+function love.platform.requestTrackingPermission() end
+function love.platform.setProfileButtonActive(active) end
+function love.platform.authenticateLocalPlayer() end
+]]
+
+if love.graphics then
+  if love.graphics.isActive and not love.graphics.checkActive then
+    love.graphics.checkActive = love.graphics.isActive
+  end
+
+  love.graphics.beginFrame = love.graphics.beginFrame or function() end
+end
diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index 4a06a2a1a5ae..ff6fb1ab4a43 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -10,26 +10,56 @@
   makeWrapper,
   makeDesktopItem,
   requireFile,
+  src ? null,
   withMods ? true,
+  withBridgePatch ? true,
   withLinuxPatch ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "balatro";
   version = "1.0.1o";
 
-  src = requireFile {
-    name = "Balatro-${finalAttrs.version}.exe";
-    url = "https://store.steampowered.com/app/2379780/Balatro/";
-    message = ''
-      Balatro cannot be automatically downloaded. Please download
-      it from Steam, locate the Balatro.exe on disk, likely in
-      ~/.local/share/Steam/steamapps/common/Balatro/, then upload it
-      to your nix store with nix-store --add-fixed sha256 Balatro.exe.
-    '';
+  src =
+    if src != null then
+      src
+    else
+      requireFile {
+        name = "Balatro-${finalAttrs.version}.exe";
+        url = "https://store.steampowered.com/app/2379780/Balatro/";
+        message = ''
+          You must own Balatro in order to install it with Nix.  The Steam,
+          Google Play, and Xbox PC versions are supported.
 
-    # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
-    hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
-  };
+          - If you have the Steam version, you can use Balatro.exe.  Find it in
+
+            ~/.local/share/Steam/steamapps/common/Balatro/
+
+            and run
+
+            nix-store --add-fixed sha256 Balatro.exe
+
+          - If you have the Google Play version, you'll need to pull base.apk from
+            your device:
+
+            adb shell pm path com.playstack.balatro.android
+            adb pull ( path from above )/base.apk ~/Downloads/com.playstack.balatro.android.apk
+
+            and add it to /nix/store:
+
+            nix-prefetch-url file:///home/deck/Downloads/com.playstack.balatro.android.apk
+
+          - If you have the Xbox PC version, you can do the same with Assets.zip.
+
+          If you've used nix-prefetch-url to add it to your store, you'll need to
+          pass the resulting path to override:
+
+            balatro.override {
+              src = /nix/store/g44bp7ymc7qlkfv5f03b55cgs1wdmkzl-com.playstack.balatro.android.apk;
+            }
+        '';
+        # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
+        hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
+      };
 
   srcIcon = fetchurl {
     name = "balatro.png";
@@ -70,6 +100,16 @@ stdenv.mkDerivation (finalAttrs: {
     tmpdir=$(mktemp -d)
     7z x ${finalAttrs.src} -o$tmpdir -y
 
+    ${lib.optionalString withBridgePatch ''
+      cp ${./bridge_detour.lua} $tmpdir/bridge_detour.lua
+
+      for file in main.lua engine/load_manager.lua engine/save_manager.lua; do
+        if [ -f "$tmpdir/$file" ]; then
+          sed -i '1i require("bridge_detour")' "$tmpdir/$file"
+        fi
+      done
+    ''}
+
     ${
       let
         patchMarker = "if love.system.getOS() == 'Nintendo Switch' then";
@@ -87,22 +127,20 @@ stdenv.mkDerivation (finalAttrs: {
       ''
     }
 
-    patchedExe=$(mktemp -u).zip
-    7z a $patchedExe $tmpdir/*
+    loveFile=game.love
+    7z a -tzip $loveFile $tmpdir/*
 
     runHook postBuild
   '';
 
-  # The `cat` bit is a hack suggested by whitelje (https://github.com/ethangreen-dev/lovely-injector/pull/66#issuecomment-2319615509)
-  # to make it so that lovely will pick up Balatro as the game name.
-  # The `LD_PRELOAD` bit is used to load lovely and it is the 'official' way of doing it.
-  # The `LD_LIBRARY_PATH` bit adds `curl` as that is the community standard backend for network-related mods on non-Windows systems
   installPhase = ''
     runHook preInstall
 
     install -Dm644 $srcIcon $out/share/icons/hicolor/scalable/apps/balatro.png
 
-    cat ${lib.getExe love} $patchedExe > $out/share/Balatro
+    # Packaging the love file into the executable ensures lovely finds the game's name
+    # https://github.com/ethangreen-dev/lovely-injector/pull/66#issuecomment-2319615509
+    cat ${lib.getExe love} $loveFile > $out/share/Balatro
     chmod +x $out/share/Balatro
 
     makeWrapper $out/share/Balatro $out/bin/balatro ${lib.optionalString withMods ''