Merge staging-next into staging

doc/languages-frameworks/index.md

@@ -79,6 +79,7 @@ ios.section.md
 java.section.md
 javascript.section.md
 julia.section.md
+lean4.section.md
 lisp.section.md
 lua.section.md
 maven.section.md

doc/languages-frameworks/lean4.section.md

@@ -0,0 +1,51 @@
+# Lean 4 {#sec-language-lean4}
+
+Lean 4 is a strict functional language with dependent types. `leanPackages` provides the toolchain and a curated set of libraries — including the full mathlib dependency tree — with its own Lean toolchain. A standalone compiler is also available as `pkgs.lean4` for use outside the package set.
+
+## Building Lean 4 projects with `buildLakePackage` {#lean4-buildLakePackage}
+
+```nix
+leanPackages.buildLakePackage {
+  pname = "my-project";
+  version = "0.1.0";
+  src = ./.;
+  leanDeps = with leanPackages; [ mathlib ];
+  lakeHash = null; # all deps nix-managed; set to lib.fakeHash for Lake-managed deps
+}
+```
+
+Dependencies are declared in the lakefile for Lake and in the Nix expression for Nix. `leanDeps` provides Nix-managed libraries whose `.olean` files — the default build artifact of the Lake library facet — are reused without recompilation. `buildLakePackage` injects them via `lake --packages`, which takes precedence over Lake's own dependency resolution, producing a hermetic build.
+
+Sui generis among nixpkgs builders, `buildLakePackage` supports heterogeneous dependency resolution, in that Nix transparently substitutes for upstream-managed dependencies at per-package granularity: Nix-managed dependencies via `leanDeps` and Lake-managed dependencies via `lakeHash` compose in the same derivation. Setting `lakeHash = lib.fakeHash` and building will report the expected hash for a fixed-output derivation that pins what Lake would normally fetch, less Nix-managed dependencies. Nix-managed dependencies take precedence by name — so moving a dependency from `lakeHash` to `leanDeps` will change the expected hash — providing an on-ramp for projects to incrementally adopt nix-managed libraries. Setting `lakeHash = null` (the default) declares that all dependencies are Nix-managed and no fixed-output fetch is performed during the build.
+
+A `lake-manifest.json` is required at the project root. If all dependencies are Nix-managed, an empty manifest suffices:
+
+```json
+{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}
+```
+
+## Development shells {#lean4-dev-shells}
+
+In `nix develop`, the scoped `lean4` and `buildLakePackage` provide the same toolchain used for hermetic builds. Note that Lake's normal dependency resolution is available in the shell — Lake may fetch dependencies not covered by `leanDeps` from the network, as is standard for Nix development shells.
+
+## The `leanPackages` scope {#lean4-leanPackages}
+
+`leanPackages` is a `lib.makeScope` with its own `lean4`. Overriding it propagates to all packages and to `buildLakePackage`:
+
+```nix
+leanPackages.overrideScope (
+  self: super: {
+    lean4 = myCustomLean4;
+  }
+)
+```
+
+The `lean4` supplied by `leanPackages` is binary-patched to ensure that the Lean language server discovers the wrapped `lake` rather than an unwrapped one. This is necessary because Lake's `serve` subcommand has a vexing invocation pattern: it derives `LAKE` from `IO.appPath` and unconditionally sets it in the spawned environment, bypassing any wrapper. The binary patch rewrites store path references so that this discovery mechanism finds the correct binary, enabling LSP integration — including the InfoView, which requires Lean-specific protocol extensions — without improper mutation of the user's project directory.
+
+Note that `leanPackages.lean4` supplants Lake's built-in cache invalidation for dependencies in `/nix/store/`, deferring entirely to Nix's bespoke dependency model. Lake's trace validation — which checks compiler "hash," platform, and package identity — is gracefully subsumed by guarantees Nix already provides. Cache coherence responsibilities are delegated to the orchestrator of streamlined Nix integration.
+
+For Emacs, `emacsPackages.nael` and `emacsPackages.nael-lsp` (eglot-based and lsp-mode-based respectively, available via MELPA) provide Lean 4 support including proof state display via eldoc. For VSCode (unfree) / VSCodium, `vscode-extensions.leanprover.lean4` is available. Editor packages discover the toolchain from `PATH`.
+
+## Relationship to earlier Lean 4 Nix support {#lean4-history}
+
+Users familiar with the per-module derivation approach (2020–2025) should note that `buildLakePackage` follows a different architecture. The earlier integration discovered dependencies at evaluation time via import-from-derivation — an ambitious attempt to reconcile declarative package management with fine-grained build semantics, ultimately undermined by Nix's own evaluation model. It was [removed upstream](https://github.com/leanprover/lean4/commit/535435955b482176e8d62a54deebcacdec0827db). `buildLakePackage` treats Lake as a build driver and uses Nix for package-level boundaries, while `nix develop` and `nix-shell` achieve feature parity with the vanilla Lake development experience.

doc/redirects.json

@@ -3597,6 +3597,9 @@
   "sec-language-java": [
     "index.html#sec-language-java"
   ],
+  "sec-language-lean4": [
+    "index.html#sec-language-lean4"
+  ],
   "language-javascript": [
     "index.html#language-javascript"
   ],
@@ -3756,6 +3759,18 @@
   "julia-withpackage-arguments": [
     "index.html#julia-withpackage-arguments"
   ],
+  "lean4-buildLakePackage": [
+    "index.html#lean4-buildLakePackage"
+  ],
+  "lean4-dev-shells": [
+    "index.html#lean4-dev-shells"
+  ],
+  "lean4-history": [
+    "index.html#lean4-history"
+  ],
+  "lean4-leanPackages": [
+    "index.html#lean4-leanPackages"
+  ],
   "lisp": [
     "index.html#lisp"
   ],

maintainers/maintainer-list.nix

@@ -18737,7 +18737,7 @@
     name = "nadir-ishiguro";
   };
   nadja-y = {
-    email = "git@njy.dev";
+    email = "nadja@njy.dev";
     github = "nadja-y";
     githubId = 255079535;
     name = "Nadja Yang";

nixos/doc/manual/configuration/ad-hoc-network-config.section.md

@@ -1,14 +1,24 @@
 # Ad-Hoc Configuration {#ad-hoc-network-config}
 
-You can use [](#opt-networking.localCommands) to
-specify shell commands to be run at the end of `network-setup.service`. This
-is useful for doing network configuration not covered by the existing NixOS
-modules. For instance, to statically configure an IPv6 address:
+You can use [](#opt-networking.localCommands) to specify shell commands to be
+run after the network interfaces have been created, but not necessarily fully
+configured.
+This is useful for doing network configuration not covered by the existing
+NixOS modules. For example, you can create a network namespace and a pair
+of virtual ethernet devices like this:
 
 ```nix
 {
   networking.localCommands = ''
-    ip -6 addr add 2001:610:685:1::1/64 dev eth0
+    ip netns add mynet
+    ip link add name veth-in type veth peer name veth-out
+    ip link set dev veth-out netns mynet
   '';
 }
 ```
+
+::: {.note}
+The commands should ideally be idempotent, so it's recommended to perform
+cleanups of the state you create (e.g. virtual interfaces), or at least make
+sure possible failures are handled.
+:::

nixos/doc/manual/configuration/ipv4-config.section.md

@@ -26,9 +26,16 @@ servers:
 ```
 
 ::: {.note}
-Statically configured interfaces are set up by the systemd service
-`interface-name-cfg.service`. The default gateway and name server
-configuration is performed by `network-setup.service`.
+Addresses and routes for statically configured interfaces and the default
+gateway are set up by systemd services named
+`network-addresses-<interface>.service`. The name servers configuration,
+instead, is performed by `network-local-commands.service` using resolvconf.
+:::
+
+::: {.note}
+If needed, for example if addresses/routes were added/removed,
+you can reset the network configuration by running
+`systemctl restart networking-scripted.target`
 :::
 
 The host name is set using [](#opt-networking.hostName):

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -223,6 +223,13 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
   Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on `networking.wireless`. So, if you had `networking.wireless.enable = false` in your configuration, you should remove that line.
 
+- Some implementation details of the NixOS network-interfaces module have been changed:
+
+  - In the "scripted" backend, `network-setup.service` has been removed and the network configuration services are now part of `network.target`, which is now directly pulled into `multi-user.target`.
+  - Interface addresses, routes and default gateways are now configured asynchronously as soon as the underlying network devices become available (fixes issue [#154737](https://github.com/NixOS/nixpkgs/issues/154737)).
+  - In both "networkd" and "scripted" backends, the configuration of name servers is now part of `network-local-commands.service` (fixes issue [#445496](https://github.com/NixOS/nixpkgs/issues/445496)).
+  - The issue that resulted in a completely unconfigured network if both `resolvconf` was disabled and no default gateway configured, has also been fixed.
+
 - `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
 
   - The `migrate sql` CLI command is now `migrate sql up`

nixos/lib/test-driver/src/test_driver/driver.py

@@ -228,6 +228,7 @@ class Driver:
         general_symbols = dict(
             start_all=self.start_all,
             test_script=self.test_script,
+            machines=self.machines,
             machines_qemu=self.machines_qemu,
             machines_nspawn=self.machines_nspawn,
             vlans=self.vlans,
@@ -243,6 +244,8 @@ class Driver:
             serial_stdout_on=self.serial_stdout_on,
             polling_condition=self.polling_condition,
             BaseMachine=BaseMachine,  # for typing
+            QemuMachine=QemuMachine,  # for typing
+            NspawnMachine=NspawnMachine,  # for typing
             t=AssertionTester(),
             debug=self.debug,
         )
@@ -369,7 +372,7 @@ class Driver:
         *,
         name: str | None = None,
         keep_machine_state: bool = False,
-    ) -> BaseMachine:
+    ) -> QemuMachine:
         """
         Create a `QemuMachine`. This currently only supports qemu "nodes", not containers.
         """

nixos/lib/test-script-prepend.py

@@ -36,7 +36,7 @@ class CreateMachineProtocol(Protocol):
         name: Optional[str] = None,
         keep_machine_state: bool = False,
         **kwargs: Any, # to allow usage of deprecated keep_vm_state
-    ) -> BaseMachine:
+    ) -> QemuMachine:
         raise Exception("This is just type information for the Nix test driver")
 
 
@@ -45,6 +45,8 @@ subtest: Callable[[str], ContextManager[None]]
 retry: RetryProtocol
 test_script: Callable[[], None]
 machines: List[BaseMachine]
+machines_qemu: List[QemuMachine]
+machines_nspawn: List[NspawnMachine]
 vlans: List[VLan]
 driver: Driver
 log: AbstractLogger

nixos/modules/misc/ids.nix

@@ -84,7 +84,7 @@ in
       tor = 35;
       cups = 36;
       foldingathome = 37;
-      #sabnzbd = 38; # dropped in 25.11
+      #sabnzbd = 38; # dropped in 26.05
       #kdm = 39; # dropped in 17.03
       #ghostone = 40; # dropped in 18.03
       git = 41;
@@ -570,7 +570,7 @@ in
       lambdabot = 191;
       asterisk = 192;
       plex = 193;
-      #sabnzbd = 194; # dropped in 25.11
+      #sabnzbd = 194; # dropped in 26.05
       #grafana = 196; #unused
       #skydns = 197; #unused
       # ripple-rest = 198; # unused, removed 2017-08-12

nixos/modules/security/pam.nix

@@ -666,6 +666,137 @@ let
           };
         };
 
+        slurm = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = ''
+              If set, ONLY prevents users from logging into nodes if they have no
+              jobs in the node. This module is a legacy implementation with
+              functionality limited to login restrictions.
+            '';
+          };
+
+          adopt = {
+            enable = lib.mkOption {
+              default = false;
+              type = lib.types.bool;
+              description = ''
+                If set, it prevents users from logging into nodes if they have no jobs
+                in the node. It also tracks any other spawned processes for accounting
+                and ensures complete job cleanup when a job is completed for any
+                successful connection. Spawned processes get "adopted" as external
+                steps into the current job. As such, those steps get integrated with
+                Slurm accounting and control group facilities.
+              '';
+            };
+
+            settings = lib.mkOption {
+              type = lib.types.submodule {
+                freeformType = moduleSettingsType;
+                options = {
+
+                  action_no_jobs = lib.mkOption {
+                    type = lib.types.enum [
+                      "ignore"
+                      "deny"
+                    ];
+                    default = "deny";
+                    description = ''
+                      What to do if no jobs from the user are found, deny or ignore
+                      (pass along to next PAM module).
+                    '';
+                  };
+
+                  action_unknown = lib.mkOption {
+                    type = lib.types.enum [
+                      "newest"
+                      "allow"
+                      "deny"
+                    ];
+                    default = "newest";
+                    description = ''
+                      If the user has jobs, attach them to the newest job. Allow
+                      the connection through without adoption.
+                    '';
+                  };
+
+                  action_adopt_failure = lib.mkOption {
+                    type = lib.types.enum [
+                      "allow"
+                      "deny"
+                    ];
+                    default = "deny";
+                    description = ''
+                      What to do if the process is unable to be adopted into a job.
+                      `allow` matches the upstream default which is only really
+                      suitable for testing; production systems will want `deny`
+                      as a default.
+                    '';
+                  };
+
+                  action_generic_failure = lib.mkOption {
+                    type = lib.types.enum [
+                      "ignore"
+                      "allow"
+                      "deny"
+                    ];
+                    default = "ignore";
+                    description = ''
+                      Catch all for failures related to kernel issues or slurmd
+                      access. Ignore falls through to the next PAM module, allowing
+                      the connection to go through without adoption.
+                    '';
+                  };
+
+                  disable_x11 = lib.mkOption {
+                    type = lib.types.enum [
+                      "0"
+                      "1"
+                    ];
+                    default = "0";
+                    description = ''
+                      Disable or enable x11 sessions. '0' means the adopted connection
+                      has Slurm X11 forwarding with DISPLAY overwritten using X11
+                      tunnel endpoint details.
+                    '';
+                  };
+
+                  nodename = lib.mkOption {
+                    type = with lib.types; nullOr nonEmptyStr;
+                    default = null;
+                    example = "compute-a-01";
+                    description = ''
+                      Set this only when the Slurm `NodeName` for this machine
+                      differs from `hostname -s`. If unset, `pam_slurm_adopt`
+                      uses the host short name.
+                    '';
+                  };
+
+                  join_container = lib.mkOption {
+                    type = lib.types.enum [
+                      "true"
+                      "false"
+                    ];
+                    default = "true";
+                    description = ''
+                      Attach to a container created by job_container/tmpfs
+                    '';
+                  };
+                };
+              };
+
+              default = {
+                service = name;
+              };
+              description = ''
+                Slurm Adopt Settings. More information is available at:
+                  - https://slurm.schedmd.com/pam_slurm_adopt.html
+              '';
+            };
+          };
+        };
+
         zfs = lib.mkOption {
           default = config.security.pam.zfs.enable;
           defaultText = lib.literalExpression "config.security.pam.zfs.enable";
@@ -810,6 +941,12 @@ let
                 control = "sufficient";
                 modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so";
               }
+              {
+                name = "slurm";
+                enable = cfg.slurm.enable;
+                control = "required";
+                modulePath = "${pkgs.slurm}/lib/security/pam_slurm.so";
+              }
               # The required pam_unix.so module has to come after all the sufficient modules
               # because otherwise, the account lookup will fail if the user does not exist
               # locally, for example with MySQL- or LDAP-auth.
@@ -818,6 +955,15 @@ let
                 control = "required";
                 modulePath = "${package}/lib/security/pam_unix.so";
               }
+              # pam_slurm_adopt must be the last module in the account stack.
+              {
+                name = "slurm_adopt";
+                enable = cfg.slurm.adopt.enable;
+                control = "required";
+                modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
+                settings = cfg.slurm.adopt.settings;
+              }
+
             ];
 
             auth = autoOrderRules (

nixos/modules/services/home-automation/matter-server.nix

@@ -14,7 +14,7 @@ in
 {
   meta.maintainers = with lib.maintainers; [ leonm1 ];
 
-  options.services.matter-server = with lib.types; {
+  options.services.matter-server = {
     enable = lib.mkEnableOption "Matter-server";
 
     package = lib.mkPackageOption pkgs "python-matter-server" { };
@@ -44,10 +44,10 @@ in
     };
 
     extraArgs = lib.mkOption {
-      type = listOf str;
-      default = [ ];
+      type = lib.types.attrs;
+      default = { };
       description = ''
-        Extra arguments to pass to the matter-server executable.
+        Attribute set of extra arguments to pass to the matter-server executable.
         See <https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server> for options.
       '';
     };
@@ -62,41 +62,52 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       description = "Matter Server";
-      environment.HOME = storagePath;
+      environment = {
+        HOME = storagePath;
+        SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      };
+      script = ''
+        # `python-matter-server` writes to /data even when a storage-path is
+        # specified. This symlinks /data at the systemd-managed
+        # /var/lib/matter-server, so all files get dropped into the state
+        # directory.
+        ln -s $STATE_DIRECTORY $RUNTIME_DIRECTORY/data
+
+        # Create directories to hold certificates and OTA updates.
+        CERT_DIR="$CACHE_DIRECTORY/certs"
+        mkdir -p "$CERT_DIR"
+        OTA_UPDATE_DIR="$CACHE_DIRECTORY/updates"
+        mkdir -p "$OTA_UPDATE_DIR"
+
+        "${lib.getExe cfg.package}" ${
+          lib.concatStringsSep " " (
+            lib.cli.toCommandLineGNU { } (
+              {
+                port = cfg.port;
+                vendorid = vendorId;
+                storage-path = storagePath;
+                log-level = cfg.logLevel;
+                paa-root-cert-dir = "$CERT_DIR";
+                ota-provider-dir = "$OTA_UPDATE_DIR";
+              }
+              // cfg.extraArgs
+            )
+          )
+        }
+      '';
       serviceConfig = {
-        ExecStart = (
-          lib.concatStringsSep " " [
-            # `python-matter-server` writes to /data even when a storage-path
-            # is specified. This symlinks /data at the systemd-managed
-            # /var/lib/matter-server, so all files get dropped into the state
-            # directory.
-            "${pkgs.bash}/bin/sh"
-            "-c"
-            "'"
-            "${pkgs.coreutils}/bin/ln -s %S/matter-server/ %t/matter-server/root/data"
-            "&&"
-            "${cfg.package}/bin/matter-server"
-            "--port"
-            (toString cfg.port)
-            "--vendorid"
-            vendorId
-            "--storage-path"
-            storagePath
-            "--log-level"
-            "${cfg.logLevel}"
-            "${lib.escapeShellArgs cfg.extraArgs}"
-            "'"
-          ]
-        );
         # Start with a clean root filesystem, and allowlist what the container
         # is permitted to access.
         # See https://discourse.nixos.org/t/hardening-systemd-services/17147/14.
         RuntimeDirectory = [ "matter-server/root" ];
         RootDirectory = "%t/matter-server/root";
+        CacheDirectory = [ "matter-server" ];
 
-        # Allowlist /nix/store (to allow the binary to find its dependencies)
-        # and dbus.
-        BindReadOnlyPaths = "/nix/store /run/dbus";
+        BindReadOnlyPaths = [
+          "/nix/store" # To allow the binary to find its dependencies.
+          "/run/dbus"
+          "/etc/resolv.conf" # For DNS resolution.
+        ];
         # Let systemd manage `/var/lib/matter-server` for us inside the
         # ephemeral TemporaryFileSystem.
         StateDirectory = storageDir;

nixos/modules/services/networking/sabnzbd/default.nix

@@ -33,7 +33,7 @@ let
     "__version__" = 19;
     "__encoding__" = "utf-8";
   };
-  allSettings = cfg.settings // mandatoryGlobalSettings;
+  allSettings = mandatoryGlobalSettings // cfg.settings;
 
   # sabnzbd uses configobj type inis, which support
   # nested sections specified by increasing numbers
@@ -514,10 +514,7 @@ in
     systemd.services.sabnzbd =
       let
         files =
-          if cfg.configFile != null then
-            [ sabnzbdIniPath ]
-          else
-            (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
+          (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
         iniPathQuoted = lib.escapeShellArg sabnzbdIniPath;
       in
       {
@@ -532,11 +529,18 @@ in
           StateDirectory = cfg.stateDir;
           ExecStart = "${lib.getExe cfg.package} -d -f ${iniPathQuoted}";
         };
+      }
+      // lib.optionalAttrs (cfg.configFile == null) {
         preStart = ''
           set -euo pipefail
 
           ${lib.toShellVar "files" files}
 
+          # We overwrite this immediately, but the merge script requires that
+          # all files exist
+          # See also: nixpkgs #504224
+          (touch ${iniPathQuoted} 2>/dev/null || true)
+
           tmpfile=$(mktemp)
 
           ${lib.getExe (pkgs.python3.withPackages (py: [ py.configobj ]))} \

nixos/modules/services/video/wivrn.nix

@@ -72,6 +72,11 @@ let
   );
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "wivrn" "defaultRuntime" ] ''
+      WiVRn now manages the active runtime itself, so this option has been removed.
+    '')
+  ];
   options = {
     services.wivrn = {
       enable = mkEnableOption "WiVRn, an OpenXR streaming application";

nixos/modules/services/web-apps/grocy.nix

@@ -216,6 +216,7 @@ in
     systemd.services.grocy-setup = {
       wantedBy = [ "multi-user.target" ];
       before = [ "phpfpm-grocy.service" ];
+      unitConfig.RequiresMountsFor = [ cfg.dataDir ];
       script = ''
         rm -rf ${cfg.dataDir}/viewcache/*
       '';

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -685,12 +685,14 @@ struct(GrubState => {
     efi => '$',
     devices => '$',
     efiMountPoint => '$',
+    grub => '$',
+    grubEfi => '$',
     extraGrubInstallArgs => '@',
 });
 # If you add something to the state file, only add it to the end
 # because it is read line-by-line.
 sub readGrubState {
-    my $defaultGrubState = GrubState->new(name => "", version => "", efi => "", devices => "", efiMountPoint => "", extraGrubInstallArgs => () );
+    my $defaultGrubState = GrubState->new(name => "", version => "", efi => "", devices => "", efiMountPoint => "", grub => "", grubEfi => "", extraGrubInstallArgs => () );
     open my $fh, "<", "$bootPath/grub/state" or return $defaultGrubState;
     local $/ = "\n";
     my $name = <$fh>;
@@ -721,8 +723,10 @@ sub readGrubState {
     }
     my %jsonState = %{decode_json($jsonStateLine)};
     my @extraGrubInstallArgs = exists($jsonState{'extraGrubInstallArgs'}) ? @{$jsonState{'extraGrubInstallArgs'}} : ();
+    my $grubValue = exists($jsonState{'grub'}) ? $jsonState{'grub'} : "";
+    my $grubEfiValue = exists($jsonState{'grubEfi'}) ? $jsonState{'grubEfi'} : "";
     close $fh;
-    my $grubState = GrubState->new(name => $name, version => $version, efi => $efi, devices => $devices, efiMountPoint => $efiMountPoint, extraGrubInstallArgs => \@extraGrubInstallArgs );
+    my $grubState = GrubState->new(name => $name, version => $version, efi => $efi, devices => $devices, efiMountPoint => $efiMountPoint, extraGrubInstallArgs => \@extraGrubInstallArgs, grub => $grubValue, grubEfi => $grubEfiValue );
     return $grubState
 }
 
@@ -734,15 +738,16 @@ my @prevExtraGrubInstallArgs = @{$prevGrubState->extraGrubInstallArgs};
 
 my $devicesDiffer = scalar (List::Compare->new( '-u', '-a', \@deviceTargets, \@prevDeviceTargets)->get_symmetric_difference());
 my $extraGrubInstallArgsDiffer = scalar (List::Compare->new( '-u', '-a', \@extraGrubInstallArgs, \@prevExtraGrubInstallArgs)->get_symmetric_difference());
-my $nameDiffer = get("fullName") ne $prevGrubState->name;
-my $versionDiffer = get("fullVersion") ne $prevGrubState->version;
 my $efiDiffer = $efiTarget ne $prevGrubState->efi;
 my $efiMountPointDiffer = $efiSysMountPoint ne $prevGrubState->efiMountPoint;
+# re-installing grub once the package store path changes is necessary, because
+# introducing patches or adjusting builds does not always bump the version number
+my $grubStorePathsDiffer = ($grub ne $prevGrubState->grub) || ($grubEfi ne $prevGrubState->grubEfi);
 if (($ENV{'NIXOS_INSTALL_GRUB'} // "") eq "1") {
     warn "NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER";
     $ENV{'NIXOS_INSTALL_BOOTLOADER'} = "1";
 }
-my $requireNewInstall = $devicesDiffer || $extraGrubInstallArgsDiffer || $nameDiffer || $versionDiffer || $efiDiffer || $efiMountPointDiffer || (($ENV{'NIXOS_INSTALL_BOOTLOADER'} // "") eq "1");
+my $requireNewInstall = $devicesDiffer || $extraGrubInstallArgsDiffer || $efiDiffer || $efiMountPointDiffer || $grubStorePathsDiffer || (($ENV{'NIXOS_INSTALL_BOOTLOADER'} // "") eq "1");
 
 # install a symlink so that grub can detect the boot drive
 my $tmpDir = File::Temp::tempdir(CLEANUP => 1) or die "Failed to create temporary space: $!";
@@ -795,7 +800,9 @@ if ($requireNewInstall != 0) {
     print $fh join( ",", @deviceTargets ), "\n" or die;
     print $fh $efiSysMountPoint, "\n" or die;
     my %jsonState = (
-        extraGrubInstallArgs => \@extraGrubInstallArgs
+        extraGrubInstallArgs => \@extraGrubInstallArgs,
+        grub => $grub,
+        grubEfi => $grubEfi
     );
     my $jsonStateLine = encode_json(\%jsonState);
     print $fh $jsonStateLine, "\n" or die;

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -51,6 +51,71 @@ let
       (lib.concatStringsSep " ")
     ];
 
+  # Converts an IPv4 address literal to a list of bits
+  parseAddr.ipv4 =
+    addr:
+    let
+      pad = b: lib.replicate (8 - builtins.length b) 0 ++ b;
+      toBin = n: pad (lib.toBaseDigits 2 (lib.toInt n));
+    in
+    lib.concatMap toBin (builtins.splitVersion addr);
+
+  # Converts an IPv6 address literal to a list of bits
+  parseAddr.ipv6 =
+    addr:
+    let
+      pad = b: lib.replicate (16 - builtins.length b) 0 ++ b;
+      fromHex = n: (builtins.fromTOML "n = 0x${n}").n;
+      toBin = n: pad (lib.toBaseDigits 2 (fromHex n));
+      normal = (lib.network.ipv6.fromString addr).address;
+    in
+    lib.concatMap toBin (lib.splitString ":" normal);
+
+  # Checks if `addr` is part of the `net` subnet
+  inSubnet =
+    v: net: addr:
+    let
+      prefix = lib.take net.prefixLength (parseAddr.${v} net.address);
+      match = lib.zipListsWith (a: b: a == b) prefix (parseAddr.${v} addr);
+    in
+    lib.all lib.id match;
+
+  # Checks if the netmask of all addresses on interface `iface` includes
+  # the IP address of `gateway`
+  #
+  # Note: this is used to check whether networking.defaultGateway relies on
+  # the given interface, either explicitly, via the `interface` (optional),
+  # or explicitly, by using an address in a subnet of this interface.
+  #
+  # Configuration of the default gateway is then performed as part of that
+  # interface setup in `configureAddrs`, below.
+  isGateway =
+    v: gateway: iface:
+    lib.any lib.id (
+      [ (iface.name == gateway.interface) ]
+      ++ map (net: inSubnet v net gateway.address) iface.${v}.addresses
+    );
+
+  # Checks if `gateway` uses an address from `iface` as default source
+  #
+  # Note: this is needed to delay the configuration of the gateway and default
+  # source until the right interfaces and address have been set up, otherwise
+  # the commands will fail.
+  hasSource =
+    v: gateway: iface:
+    builtins.elem gateway.source (map (i: i.address) iface.${v}.addresses);
+
+  # Interfaces corresponding to the default gateways
+  gateway4Iface = builtins.filter (isGateway "ipv4" cfg.defaultGateway) interfaces;
+  gateway6Iface = builtins.filter (isGateway "ipv6" cfg.defaultGateway6) interfaces;
+
+  # Interfaces corresponding to the default source addresses
+  #
+  # Note: the use of `head` here is safe because these expressions
+  # are evaluated only when `needsSourceIface`, see `configureAddrs` below.
+  source4Iface = builtins.head (builtins.filter (hasSource "ipv4" cfg.defaultGateway) interfaces);
+  source6Iface = builtins.head (builtins.filter (hasSource "ipv6" cfg.defaultGateway6) interfaces);
+
   # warn that these attributes are deprecated (2017-2-2)
   # Should be removed in the release after next
   bondDeprecation = rec {
@@ -118,121 +183,71 @@ let
           else
             optional (!config.boot.isContainer) (subsystemDevice dev);
 
-        hasDefaultGatewaySet =
-          (cfg.defaultGateway != null && cfg.defaultGateway.address != "")
-          || (cfg.enableIPv6 && cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "");
-
-        needNetworkSetup =
-          cfg.resolvconf.enable || cfg.defaultGateway != null || cfg.defaultGateway6 != null;
-
-        networkLocalCommands = lib.mkIf needNetworkSetup {
-          after = [ "network-setup.service" ];
-          bindsTo = [ "network-setup.service" ];
-        };
-
-        networkSetup = lib.mkIf needNetworkSetup {
-          description = "Networking Setup";
-
-          after = [ "network-pre.target" ];
-          before = [
-            "network.target"
-            "shutdown.target"
-          ];
-          wants = [ "network.target" ];
-          # exclude bridges from the partOf relationship to fix container networking bug #47210
-          partOf = map (i: "network-addresses-${i.name}.service") (
-            filter (i: !(hasAttr i.name cfg.bridges)) interfaces
-          );
-          conflicts = [ "shutdown.target" ];
-          wantedBy = [ "multi-user.target" ] ++ optional hasDefaultGatewaySet "network-online.target";
-
-          unitConfig.ConditionCapability = "CAP_NET_ADMIN";
-
-          path = [ pkgs.iproute2 ];
-
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-          };
-
-          unitConfig.DefaultDependencies = false;
-
-          script = ''
-            ${optionalString config.networking.resolvconf.enable ''
-              # Set the static DNS configuration, if given.
-              ${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
-              ${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
-                domain ${cfg.domain}
-              ''}
-              ${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
-              ${flip concatMapStrings cfg.nameservers (ns: ''
-                nameserver ${ns}
-              '')}
-              EOF
-            ''}
-
-            # Set the default gateway
-            ${flip concatMapStrings
-              [
-                {
-                  version = "-4";
-                  gateway = cfg.defaultGateway;
-                }
-                {
-                  version = "-6";
-                  gateway = cfg.defaultGateway6;
-                }
-              ]
-              (
-                { version, gateway }:
-                optionalString (gateway != null && gateway.address != "") ''
-                  ${optionalString (gateway.interface != null) ''
-                    ip ${version} route replace ${gateway.address} proto static ${
-                      formatIpArgs {
-                        metric = gateway.metric;
-                        dev = gateway.interface;
-                      }
-                    }
-                  ''}
-                  ip ${version} route replace default proto static ${
-                    formatIpArgs {
-                      metric = gateway.metric;
-                      via = gateway.address;
-                      window = cfg.defaultGatewayWindowSize;
-                      dev = gateway.interface;
-                      src = gateway.source;
-                    }
-                  }
-                ''
-              )
-            }
-          '';
-        };
-
-        # For each interface <foo>, create a job ‘network-addresses-<foo>.service"
-        # that performs static address configuration.  It has a "wants"
-        # dependency on ‘<foo>.service’, which is supposed to create
-        # the interface and need not exist (i.e. for hardware
-        # interfaces).  It has a binds-to dependency on the actual
-        # network device, so it only gets started after the interface
-        # has appeared, and it's stopped when the interface
-        # disappears.
+        # For each interface <foo>, creates a network-addresses-<foo>.service
+        # job that performs static address configuration.
+        #
+        # It has a Wants dependency on <foo>-netdev.service, which creates
+        # create the interface, or on a device unit (for hardware interfaces).
+        # It also has a BindsTo dependency on the device unit: so, it only gets
+        # started after the interface has appeared and it's stopped when the
+        # interface disappears.
+        #
+        # Unless in a container, the job is not made part of network.target, so
+        # if an interface is not found (e.g. a USB interface not plugged in) it
+        # will not hang the boot sequence.
+        #
+        # If the interface is the default gateway, the job will also set the
+        # default gateway and delay network-online.target.
         configureAddrs =
           i:
           let
             ips = interfaceIps i;
+            isDefaultGateway4 = cfg.defaultGateway != null && builtins.elem i gateway4Iface;
+            isDefaultGateway6 = cfg.defaultGateway6 != null && builtins.elem i gateway6Iface;
+            needsSourceIface4 =
+              isDefaultGateway4 && cfg.defaultGateway.source != null && i.name != source4Iface.name;
+            needsSourceIface6 =
+              isDefaultGateway6 && cfg.defaultGateway6.source != null && i.name != source6Iface.name;
+
+            configureGateway =
+              version: gateway:
+              optionalString (gateway.address != "") ''
+                echo -n "setting ${i.name} as default IPv${version} gateway... "
+                ${optionalString (gateway.interface != null) ''
+                  ip -${version} route replace ${gateway.address} proto static ${
+                    formatIpArgs {
+                      metric = gateway.metric;
+                      dev = gateway.interface;
+                    }
+                  }
+                ''}
+                ip -${version} route replace default proto static ${
+                  formatIpArgs {
+                    metric = gateway.metric;
+                    via = gateway.address;
+                    window = cfg.defaultGatewayWindowSize;
+                    dev = gateway.interface;
+                    src = gateway.source;
+                  }
+                }
+                echo "done"
+              '';
           in
           nameValuePair "network-addresses-${i.name}" {
             description = "Address configuration of ${i.name}";
-            wantedBy = [
-              "network-setup.service"
-              "network.target"
-            ];
-            # order before network-setup because the routes that are configured
-            # there may need ip addresses configured
-            before = [ "network-setup.service" ];
+
+            wantedBy =
+              deviceDependency i.name
+              ++ optional config.boot.isContainer "network.target"
+              ++ optional (isDefaultGateway4 || isDefaultGateway6) "network-online.target";
             bindsTo = deviceDependency i.name;
-            after = [ "network-pre.target" ] ++ (deviceDependency i.name);
+            partOf = [ "networking-scripted.target" ];
+            after = [
+              "network-pre.target"
+            ]
+            ++ optional needsSourceIface4 "network-addresses-${source4Iface.name}.service"
+            ++ optional needsSourceIface6 "network-addresses-${source6Iface.name}.service"
+            ++ deviceDependency i.name;
             serviceConfig.Type = "oneshot";
             serviceConfig.RemainAfterExit = true;
             # Restart rather than stop+start this unit to prevent the
@@ -284,6 +299,10 @@ let
                   fi
                 ''
               )}
+
+              # Set the default gateway
+              ${optionalString isDefaultGateway4 (configureGateway "4" cfg.defaultGateway)}
+              ${optionalString isDefaultGateway6 (configureGateway "6" cfg.defaultGateway6)}
             '';
             preStop = ''
               state="/run/nixos/network/routes/${i.name}"
@@ -311,13 +330,13 @@ let
           nameValuePair "${i.name}-netdev" {
             description = "Virtual Network Interface ${i.name}";
             bindsTo = optional (!config.boot.isContainer) "dev-net-tun.device";
+            partOf = [ "networking-scripted.target" ];
             after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
             wantedBy = [
               "network.target"
-              "network-setup.service"
               (subsystemDevice i.name)
             ];
-            before = [ "network-setup.service" ];
+            before = [ "network.target" ];
             path = [ pkgs.iproute2 ];
             serviceConfig = {
               Type = "oneshot";
@@ -343,18 +362,21 @@ let
               description = "Bridge Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps ++ optional v.rstp "mstpd.service";
-              partOf = [ "network-setup.service" ] ++ optional v.rstp "mstpd.service";
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ]
+              ++ optional v.rstp "mstpd.service";
               after = [
                 "network-pre.target"
               ]
               ++ deps
               ++ optional v.rstp "mstpd.service"
               ++ map (i: "network-addresses-${i}.service") v.interfaces;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -448,15 +470,14 @@ let
               description = "Open vSwitch Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ]
               ++ internalConfigs;
-              # before = [ "network-setup.service" ];
-              # should work without internalConfigs dependencies because address/link configuration depends
-              # on the device, which is created by ovs-vswitchd with type=internal, but it does not...
-              before = [ "network-setup.service" ] ++ internalConfigs;
-              partOf = [ "network-setup.service" ]; # shutdown the bridge when network is shutdown
+              before = [ "network.target" ] ++ internalConfigs;
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ]; # shutdown the bridge when network is shutdown
               bindsTo = [ "ovs-vswitchd.service" ]; # requires ovs-vswitchd to be alive at all times
               after = [
                 "network-pre.target"
@@ -521,12 +542,12 @@ let
               description = "Bond Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps ++ map (i: "network-addresses-${i}.service") v.interfaces;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [
@@ -570,12 +591,12 @@ let
               description = "MACVLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -602,12 +623,12 @@ let
               description = "IPVLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -647,12 +668,12 @@ let
               description = "FOU endpoint ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -677,12 +698,11 @@ let
               description = "IPv6 in IPv4 Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -720,12 +740,12 @@ let
               description = "IP in IP Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -768,12 +788,12 @@ let
               description = "GRE Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -803,13 +823,15 @@ let
               description = "VLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
-              partOf = [ "network-setup.service" ];
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -845,10 +867,27 @@ let
       // mapAttrs' createGreDevice cfg.greTunnels
       // mapAttrs' createVlanDevice cfg.vlans
       // {
-        network-setup = networkSetup;
-        network-local-commands = networkLocalCommands;
+        network-local-commands = {
+          after = [ "network-pre.target" ];
+          wantedBy = [ "network.target" ];
+        };
       };
 
+    # Note: the scripted networking backend consistent of many
+    # independent services that are linked to the network.target.
+    # Since there is no daemon (e.g systemd-networkd) that is
+    # started as part of the system and pulls in network.target.
+    # Thus, to start these services we link network.target directly
+    # to multi-user.target, this has the same result.
+    systemd.targets.network.wantedBy = [ "multi-user.target" ];
+
+    # This target serves no purpose during the boot, but can be
+    # used to quickly reset the network configuration by running
+    # systemctl restart networking-scripted.target
+    systemd.targets.networking-scripted = {
+      description = "NixOS scripted networking setup";
+    };
+
     services.udev.extraRules = ''
       KERNEL=="tun", TAG+="systemd"
     '';

nixos/modules/tasks/network-interfaces.nix

@@ -747,10 +747,9 @@ in
       default = "";
       example = "text=anything; echo You can put $text here.";
       description = ''
-        Shell commands to be executed at the end of the
-        `network-setup` systemd service.  Note that if
-        you are using DHCP to obtain the network configuration,
-        interfaces may not be fully configured yet.
+        Shell commands to be executed after all the network
+        interfaces have been created, but not necessarily
+        fully configured.
       '';
     };
 
@@ -1851,6 +1850,20 @@ in
         '';
       };
     };
+
+    networking.localCommands = lib.mkIf config.networking.resolvconf.enable ''
+      # Set the static DNS configuration, if given.
+      ${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
+      ${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
+        domain ${cfg.domain}
+      ''}
+      ${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
+      ${flip concatMapStrings cfg.nameservers (ns: ''
+        nameserver ${ns}
+      '')}
+      EOF
+    '';
+
     services.mstpd = mkIf needsMstpd { enable = true; };
 
     virtualisation.vswitch = mkIf (cfg.vswitches != { }) { enable = true; };

nixos/tests/all-tests.nix

@@ -1472,6 +1472,7 @@ in
   slimserver = runTest ./slimserver.nix;
   slipshow = runTest ./slipshow.nix;
   slurm = runTest ./slurm.nix;
+  slurm-pam = runTest ./slurm-pam.nix;
   smokeping = runTest ./smokeping.nix;
   snapcast = runTest ./snapcast.nix;
   snapper = runTest ./snapper.nix;

nixos/tests/garage/common.nix

@@ -21,14 +21,14 @@
          node_id: str
          host: str
 
-      def get_node_fqn(machine: Machine) -> GarageNode:
+      def get_node_fqn(machine: BaseMachine) -> GarageNode:
         node_id, host = machine.succeed("garage node id").split('@')
         return GarageNode(node_id=node_id, host=host)
 
-      def get_node_id(machine: Machine) -> str:
+      def get_node_id(machine: BaseMachine) -> str:
         return get_node_fqn(machine).node_id
 
-      def get_layout_version(machine: Machine) -> int:
+      def get_layout_version(machine: BaseMachine) -> int:
         version_data = machine.succeed("garage layout show")
         m = cur_version_regex.search(version_data)
         if m and m.group('ver') is not None:
@@ -36,17 +36,17 @@
         else:
           raise ValueError('Cannot find current layout version')
 
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
+      def apply_garage_layout(machine: BaseMachine, layouts: List[str]):
          for layout in layouts:
             machine.succeed(f"garage layout assign {layout}")
          version = get_layout_version(machine)
          machine.succeed(f"garage layout apply --version {version}")
 
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
+      def create_api_key(machine: BaseMachine, key_name: str) -> S3Key:
          output = machine.succeed(f"garage key create {key_name}")
          return parse_api_key_data(output)
 
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
+      def get_api_key(machine: BaseMachine, key_pattern: str) -> S3Key:
          output = machine.succeed(f"garage key info {key_pattern}")
          return parse_api_key_data(output)
 

nixos/tests/incus/incus_machine.py

@@ -1,7 +1,7 @@
 import json
 
 
-class IncusHost(Machine):
+class IncusHost(QemuMachine):
     def __init__(self, base):
         with subtest("Wait for startup"):
             base.wait_for_unit("incus.service")

nixos/tests/matter-server.nix

@@ -30,7 +30,7 @@ in
       start_all()
 
       machine.wait_for_unit("matter-server.service", timeout=20)
-      machine.wait_for_open_port(1234, timeout=20)
+      machine.wait_for_open_port(1234, timeout=100)
 
       with matter_server_running: # type: ignore[union-attr]
         with subtest("Check websocket server initialized"):

nixos/tests/networking-proxy.nix

@@ -72,7 +72,7 @@ in
     from typing import Dict, Optional
 
 
-    def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
+    def get_machine_env(machine: BaseMachine, user: Optional[str] = None) -> Dict[str, str]:
         """
         Gets the environment from a given machine, and returns it as a
         dictionary in the form:

nixos/tests/networking/networkd-and-scripted.nix

@@ -44,17 +44,13 @@ let
           defaultGateway6 = {
             address = "fd00:1234:5678:1::1";
             interface = "enp1s0";
-            source = "fd00:1234:5678:1::3";
+            source = "fd00:1234:5678:1::3"; # implicit dependency on enp2s0
           };
           interfaces.enp1s0.ipv6.addresses = [
             {
               address = "fd00:1234:5678:1::2";
               prefixLength = 64;
             }
-            {
-              address = "fd00:1234:5678:1::3";
-              prefixLength = 128;
-            }
           ];
           interfaces.enp1s0.ipv4.addresses = [
             {
@@ -76,6 +72,12 @@ let
               prefixLength = 24;
             }
           ];
+          interfaces.enp2s0.ipv6.addresses = [
+            {
+              address = "fd00:1234:5678:1::3";
+              prefixLength = 128;
+            }
+          ];
         };
       };
       testScript = ''
@@ -108,6 +110,41 @@ let
             client.succeed("ip -6 route show default | grep -q 'src fd00:1234:5678:1::3'")
       '';
     };
+    dynamicInterface = {
+      name = "dynamicInterface";
+      nodes.machine = clientConfig {
+        networking.interfaces.usb0 = {
+          ipv6.addresses = lib.singleton {
+            address = "fd::1";
+            prefixLength = 127;
+          };
+        };
+        networking.defaultGateway6 = {
+          address = "fd::";
+          interface = "usb0";
+          source = "fd::1";
+        };
+      };
+      testScript = ''
+        with subtest("Network comes up without usb0"):
+          machine.wait_for_unit("network.target")
+
+        with subtest("multi-user.target does not hang"):
+          machine.require_unit_state("multi-user.target", "active")
+
+        with subtest("usb0 is configured when plugged in"):
+          machine.succeed("ip link add usb0 type sit local 1.2.3.4")
+          machine.wait_until_succeeds("ip addr show dev usb0 | grep -q fd::1")
+
+        with subtest("Network is now online"):
+          machine.systemctl("start network-online.target")
+          machine.require_unit_state("network-online.target", "active")
+
+        with subtest("Default gateway is now set"):
+          machine.succeed("ip -6 route show default | grep -q 'via fd::'")
+          machine.succeed("ip -6 route show default | grep -q 'src fd::1'")
+      '';
+    };
     routeType = {
       name = "RouteType";
       nodes.client = clientConfig {

nixos/tests/pacemaker.nix

@@ -86,7 +86,7 @@ rec {
         output = node1.succeed("crm_resource -r cat --locate")
         match = re.search("is running on: (.+)", output)
         if match:
-          for machine in machines:
+          for machine in machines_qemu:
             if machine.name == match.group(1):
               current_node = machine
           break
@@ -96,7 +96,7 @@ rec {
       current_node.crash()
 
       # pick another node that's still up
-      for machine in machines:
+      for machine in machines_qemu:
         if machine.booted:
           check_node = machine
       # find where the service has been started next
@@ -105,7 +105,7 @@ rec {
         match = re.search("is running on: (.+)", output)
         # output will remain the old current_node until the crash is detected by pacemaker
         if match and match.group(1) != current_node.name:
-          for machine in machines:
+          for machine in machines_qemu:
             if machine.name == match.group(1):
               next_node = machine
           break

nixos/tests/password-option-override-ordering.nix

@@ -112,22 +112,22 @@ in
       assert stored_hash == pass_hash, f"{username} user password does not match"
 
     with subtest("alice user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         assert_password_sha512crypt_match(machine, "alice", "${password1}")
         assert "${hashed_sha512crypt}" not in machine.succeed("getent shadow alice"), f"{machine}: alice user password is not correct"
 
     with subtest("bob user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow bob"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow bob"), f"{machine}: bob user password is not correct"
 
     with subtest("cat user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow cat"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow cat"), f"{machine}: cat user password is not correct"
 
     with subtest("dan user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow dan"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow dan"), f"{machine}: dan user password is not correct"
 
@@ -138,11 +138,11 @@ in
       assert_password_sha512crypt_match(immutable, "greg", "${password1}")
       assert "${hashed_sha512crypt}" not in immutable.succeed("getent shadow greg"), "greg user password is not correct"
 
-    for machine in machines:
+    for machine in machines_qemu:
       machine.wait_for_unit("multi-user.target")
       machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-    def check_login(machine: Machine, tty_number: str, username: str, password: str):
+    def check_login(machine: QemuMachine, tty_number: str, username: str, password: str):
       machine.send_key(f"alt-f{tty_number}")
       machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
       machine.wait_for_unit(f"getty@tty{tty_number}.service")
@@ -158,11 +158,11 @@ in
       assert username in machine.succeed(f"cat /tmp/{tty_number}"), f"{machine}: {username} password is not correct"
 
     with subtest("Test initialPassword override"):
-      for machine in machines:
+      for machine in machines_qemu:
         check_login(machine, "2", "egon", "${password1}")
 
     with subtest("Test initialHashedPassword override"):
-      for machine in machines:
+      for machine in machines_qemu:
         check_login(machine, "3", "fran", "meow")
   '';
 }

nixos/tests/rtkit.nix

@@ -103,7 +103,7 @@
       Result = namedtuple("Result", ["command", "machine", "status", "out", "value"])
       Value = namedtuple("Value", ["type", "data"])
 
-      def busctl(node: Machine, *args: Any, user: Optional[str] = None) -> Result:
+      def busctl(node: BaseMachine, *args: Any, user: Optional[str] = None) -> Result:
           command = f"busctl --json=short {shlex.join(map(str, args))}"
           if user is not None:
               command = f"su - {user} -c {shlex.quote(command)}"
@@ -121,7 +121,7 @@
           if result.status == 0:
               raise Exception(f"command `{result.command}` unexpectedly succeeded")
 
-      def rtkit_make_process_realtime(node: Machine, pid: int, priority: int, user: Optional[str] = None) -> Result:
+      def rtkit_make_process_realtime(node: BaseMachine, pid: int, priority: int, user: Optional[str] = None) -> Result:
           return busctl(node, "call", "org.freedesktop.RealtimeKit1", "/org/freedesktop/RealtimeKit1", "org.freedesktop.RealtimeKit1", "MakeThreadRealtimeWithPID", "ttu", pid, 0, priority, user=user)
 
       def get_max_realtime_priority() -> int:
@@ -133,7 +133,7 @@
       def parse_chrt(out: str, field: str) -> str:
           return next(map(lambda l: l.split(": ")[1], filter(lambda l: field in l, out.splitlines())))
 
-      def get_pid(node: Machine, unit: str, user: Optional[str] = None) -> int:
+      def get_pid(node: BaseMachine, unit: str, user: Optional[str] = None) -> int:
           node.wait_for_unit(unit, user=user)
           (status, out) = node.systemctl(f"show -P MainPID {unit}", user=user)
           if status == 0:
@@ -142,7 +142,7 @@
               node.log(out)
               raise Exception(f"unable to determine MainPID of {unit} (systemctl exit code {status})")
 
-      def assert_sched(node: Machine, pid: int, policy: Optional[str] = None, priority: Optional[int] = None):
+      def assert_sched(node: BaseMachine, pid: int, policy: Optional[str] = None, priority: Optional[int] = None):
           out = node.succeed(f"chrt -p {pid}")
           node.log(out)
           if policy is not None:

nixos/tests/sabnzbd-module.nix

@@ -1,12 +1,7 @@
 { lib, ... }:
-{
-  name = "sabnzbd";
-  meta.maintainers = with lib.maintainers; [ jojosch ];
-
-  node.pkgsReadOnly = false;
-
-  nodes.machine =
-    { pkgs, lib, ... }:
+let
+  common-config =
+    { pkgs, ... }:
     {
       services.sabnzbd = {
         enable = true;
@@ -62,14 +57,65 @@
       # unrar is unfree
       nixpkgs.config.allowUnfreePackages = [ "unrar" ];
     };
+in
+{
+  name = "sabnzbd";
+  meta.maintainers = with lib.maintainers; [ jojosch ];
+
+  node.pkgsReadOnly = false;
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ common-config ];
+    };
+  nodes.with_writeable_config =
+    { ... }:
+    {
+      imports = [ common-config ];
+      config.services.sabnzbd.allowConfigWrite = true;
+    };
+  nodes.with_raw_config_file =
+    { pkgs, ... }:
+    {
+      imports = [ common-config ];
+      config = {
+        services.sabnzbd = {
+          configFile = builtins.toFile "config.ini" ''
+            [misc]
+            inet_exposure = 2
+            html_login = 0
+            api_key = abcdef
+            log_dir = /var/lib/sabnzbd
+            admin_dir = /var/lib/sabnzbd
+          '';
+        };
+
+        environment.systemPackages = [
+          pkgs.jq
+          (pkgs.writeScriptBin "do_test_2" ''
+            set -euxo pipefail
+
+            misc_url="http://127.0.0.1:8080/api?mode=get_config&section=misc&output=json&apikey=abcdef"
+
+            [[ $(curl $misc_url | jq .config.misc.inet_exposure) == 2 ]]
+            [[ $(curl $misc_url | jq .config.misc.html_login) == "false" ]]
+          '')
+        ];
+      };
+    };
 
   testScript = ''
+    def wait_for_up(m):
+      m.wait_for_unit("sabnzbd.service")
+      m.wait_until_succeeds("curl --fail -L http://localhost:8080")
 
-    machine.wait_for_unit("sabnzbd.service")
-    machine.wait_until_succeeds(
-        "curl --fail -L http://localhost:8080/"
-    )
+    wait_for_up(machine)
+    wait_for_up(with_writeable_config)
+    wait_for_up(with_raw_config_file)
 
     machine.succeed("do_test")
+    with_writeable_config.succeed("do_test")
+    with_raw_config_file.succeed("do_test_2")
   '';
 }

nixos/tests/slurm-pam.nix

@@ -0,0 +1,411 @@
+{ lib, pkgs, ... }:
+
+let
+
+  slurmConf = "/etc/slurm.conf";
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
+  sshConf = ''
+    UserKnownHostsFile /dev/null
+    StrictHostKeyChecking no
+  '';
+  sshConfigPubkey = pkgs.writeText "ssh_config_pubkey" (
+    sshConf
+    + ''
+
+      BatchMode yes
+      PreferredAuthentications publickey
+      KbdInteractiveAuthentication no
+      PasswordAuthentication no
+      IdentityFile /root/privkey.snakeoil
+    ''
+  );
+  sshConfigPassword = pkgs.writeText "ssh_config_password" (
+    sshConf
+    + ''
+      BatchMode no
+      PreferredAuthentications password
+      PubkeyAuthentication no
+      KbdInteractiveAuthentication no
+      PasswordAuthentication yes
+    ''
+  );
+  sshOpts = "-F " + sshConfigPubkey;
+  sshPassOpts = "-F " + sshConfigPassword;
+  adoptRemoteScript = pkgs.writeShellScript "slurm-pam-adopt-remote" ''
+    echo $$ > /home/submitter/ssh.pid
+    trap : TERM INT
+    while true; do
+      sleep 1
+    done
+  '';
+  mkWaitJob =
+    node: name:
+    pkgs.writeText "${name}.sbatch" ''
+      #!${pkgs.runtimeShell}
+      #SBATCH --job-name=${name}
+      #SBATCH --nodes=1
+      #SBATCH --nodelist=${node}
+      while true; do sleep 60; done
+    '';
+
+  slurmconfig =
+    { config, ... }:
+    {
+      services.slurm = {
+        controlMachine = "control";
+        nodeName = map (n: n + " CPUs=1 State=UNKNOWN") [
+          "regular"
+          "pamslurm"
+          "pamslurmadopt"
+        ];
+        partitionName = [ "debug Nodes=ALL Default=YES MaxTime=INFINITE State=UP" ];
+        extraConfig = ''
+          PrologFlags=contain
+          ProctrackType=proctrack/cgroup
+          TaskPlugin=task/cgroup,task/affinity
+          SlurmdDebug=debug
+        '';
+      };
+
+      services.openssh = {
+        enable = true;
+        settings = {
+          AllowUsers = [ "submitter" ];
+          PubkeyAuthentication = true;
+          # leave password auth available on the regular node for
+          # regression testing plain pam_unix behavior
+          KbdInteractiveAuthentication = false;
+          PasswordAuthentication = true;
+        };
+      };
+
+      environment.systemPackages = [
+        pkgs.pamtester
+        pkgs.sshpass
+      ];
+
+      networking.firewall.enable = false;
+      systemd.tmpfiles.rules = [
+        "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
+      ];
+      environment.etc."slurm.conf".source = "${config.services.slurm.etcSlurm}/slurm.conf";
+      systemd.services.sshd.environment.SLURM_CONF = slurmConf;
+      users.groups.submitter = { };
+      users.users.submitter = {
+        isNormalUser = true;
+        createHome = true;
+        initialPassword = "submitter";
+        group = "submitter";
+        openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+    };
+
+in
+{
+  name = "slurm-pam";
+
+  meta.maintainers = [ lib.maintainers.edwtjo ];
+
+  nodes =
+    let
+      computeNode =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            client.enable = true;
+          };
+        };
+      computePAMNode =
+        { ... }:
+        {
+          imports = [ computeNode ];
+          security.pam.services.sshd.slurm.enable = true;
+          services.openssh.settings = {
+            KbdInteractiveAuthentication = false;
+            PasswordAuthentication = lib.mkForce false;
+            PubkeyAuthentication = true;
+          };
+        };
+      computePAMAdoptNode =
+        { ... }:
+        {
+          imports = [ computeNode ];
+          # NOTE: Prolog, Epilog needed for more advanced tests.
+          #       This is an upstream recommended workaround for removing pam_systemd
+          services.slurm.extraConfig = ''
+            LaunchParameters=ulimit_pam_adopt
+            SrunProlog=${pkgs.writers.writeBash "slurm-prolog" ''
+              loginctl enable-linger $SLURM_JOB_USER
+              exit 0
+            ''}
+            TaskProlog=${pkgs.writers.writeBash "slurm-taskprolog" ''
+              echo "export XDG_RUNTIME_DIR=/run/user/$SLURM_JOB_UID"
+              echo "export XDG_SESSION_ID=$(</proc/self/sessionid)"
+              echo "export XDG_SESSION_TYPE=tty"
+              echo "export XDG_SESSION_CLASS=user"
+            ''}
+            SrunEpilog=${pkgs.writers.writeBash "slurm-epilog" ''
+              #Only disable linger if this is the last job running for this user.
+              O_P=0
+              for pid in $(scontrol listpids | awk -v jid=$SLURM_JOB_ID 'NR!=1 { if ($2 != jid && $1 != "-1"){print $1} }'); do
+                      ps --noheader -o euser p $pid | grep -q $SLURM_JOB_USER && O_P=1
+              done
+              if [ $O_P -eq 0 ]; then
+                      loginctl disable-linger $SLURM_JOB_USER
+              fi
+              exit 0
+            ''}
+          '';
+          security.pam.services.sshd.slurm.adopt.enable = true;
+          # disable `pam_systemd` on adopt node
+          security.pam.services.sshd.startSession = lib.mkForce false;
+          security.pam.services.sshd.slurm.adopt.settings.action_adopt_failure = "allow";
+        };
+    in
+    {
+
+      control =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            server.enable = true;
+          };
+        };
+
+      submit =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            enableStools = true;
+          };
+        };
+
+      regular = computeNode;
+      pamslurm = computePAMNode;
+      pamslurmadopt = computePAMAdoptNode;
+    };
+
+  testScript = ''
+    start_all()
+
+    # Make sure cluster state is ready before testing PAM behavior.
+    #
+    # This shows that the controller is up, all compute nodes have registered,
+    # and Slurm sees every test node as schedulable (`idle`). Without this,
+    # later SSH failures would be ambiguous: they could come from PAM policy,
+    # missing node registration, or startup races.
+    with subtest("cluster_is_ready"):
+        control.wait_for_unit("slurmctld.service")
+        for node in [regular, pamslurm, pamslurmadopt]:
+            node.wait_for_unit("slurmd")
+        submit.wait_for_unit("multi-user.target")
+        submit.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'regular idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'pamslurm idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'pamslurmadopt idle'"
+        )
+
+    # Sanity-check the Slurm cluster itself before layering PAM expectations on
+    # top of it. This ensures the scheduler can place a job across all three
+    # nodes, so later PAM-specific failures are not caused by a broken cluster.
+    with subtest("run_distributed_command"):
+        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
+
+    # Verify that the generated PAM stacks match the intended integration:
+    #
+    # - `pamslurm` should include the legacy `pam_slurm.so`.
+    # - `pamslurmadopt` should include `pam_slurm_adopt.so`.
+    # - `pam_slurm_adopt.so` must be the last account module.
+    # - `pam_systemd.so` must be absent because it conflicts with
+    #   `pam_slurm_adopt`.
+    #
+    # This hopefully catches regressions before trying any live login.
+    with subtest("pam_files_are_as_expected"):
+        # `pam_systemd` conflicts with `pam_slurm_adopt`
+        pamslurm.succeed("grep -q '${pkgs.slurm}/lib/security/pam_slurm.so' /etc/pam.d/sshd")
+        pamslurmadopt.succeed("grep -q '${pkgs.slurm}/lib/security/pam_slurm_adopt.so' /etc/pam.d/sshd")
+        pamslurmadopt.succeed(
+            "awk '$1 == \"account\" { print $3 }' /etc/pam.d/sshd | tail -n1 | "
+            "grep -Fx '${pkgs.slurm}/lib/security/pam_slurm_adopt.so'"
+        )
+        pamslurmadopt.fail("grep -q pam_systemd.so /etc/pam.d/sshd")
+
+    # Install the test SSH private key on the submit host once so all later SSH
+    # checks use the same credential and client configuration.
+    with subtest("prepare_ssh_key"):
+         submit.succeed(
+           "install -m 0600 ${snakeOilPrivateKey} /root/privkey.snakeoil"
+         )
+
+    # Regression check: a normal node with no Slurm PAM restrictions
+    # must still allow ordinary public-key SSH login for the test user.
+    with subtest("regular_node_allows_pubkey_ssh"):
+         submit.succeed(
+            "ssh ${sshOpts} submitter@regular true",
+             timeout=30
+         )
+
+    # Regression check: ordinary password SSH must also still work on
+    # the regular node. This guards against accidentally breaking plain
+    # `pam_unix` behavior while adding Slurm-specific PAM hooks elsewhere.
+    with subtest("regular_node_allows_password_ssh"):
+        submit.succeed(
+            "sshpass -p submitter ssh ${sshPassOpts} submitter@regular true",
+            timeout=30
+        )
+
+    # Negative companion to the previous test: wrong passwords must still be
+    # rejected on the regular node, proving that the password path is actually
+    # authenticating and not silently bypassed.
+    with subtest("regular_node_rejects_wrong_password_ssh"):
+        submit.fail(
+            "sshpass -p wrong-password ssh ${sshPassOpts} submitter@regular true",
+            timeout=30
+        )
+
+    # Direct PAM regression check on the regular node. This bypasses SSH and
+    # exercises the local PAM service stack itself, confirming that correct
+    # `pam_unix` authentication still succeeds.
+    with subtest("regular_node_pam_unix_accepts_correct_password"):
+        regular.succeed(
+            "printf 'submitter\\n' | pamtester login submitter authenticate acct_mgmt"
+        )
+
+    # Negative companion to the previous test: wrong passwords must still be
+    # rejected on the regular node, proving that the password path is actually
+    # authenticating and not silently bypassed.
+    with subtest("regular_node_pam_unix_rejects_wrong_password"):
+        regular.fail(
+            "printf 'wrong-password\\n' | pamtester login submitter authenticate"
+        )
+
+    # Core policy check for both Slurm-protected nodes: without any active job
+    # owned by the user on the target node, SSH must be denied.
+    #
+    # This is the main negative regression test for the Slurm PAM integration.
+    with subtest("deny_ssh_without_job"):
+        submit.fail(
+           "ssh ${sshOpts} submitter@pamslurm true",
+            timeout=30
+        )
+        submit.fail(
+           "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+
+    # Verify node-local visibility for the legacy `pam_slurm` integration.
+    #
+    # We start a long-running allocation specifically on `pamslurm` as the
+    # `submitter` user, then confirm Slurm reports that exact node/user/job
+    # combination. The important negative assertion is that this job must NOT
+    # grant access to a different node (`pamslurmadopt`).
+    #
+    # We intentionally keep this as a visibility/isolation test rather than a
+    # positive SSH-success test, since `pam_slurm` module is less
+    # deterministicly to assert positive here than `pam_slurm_adopt`.
+    with subtest("pam_slurm_job_visibility_is_node_local"):
+        submit.succeed(
+            "runuser -u submitter -- sh -lc "
+            "\"srun --job-name=wait-pamslurm --nodelist=pamslurm sleep 300 "
+            ">/tmp/wait-pamslurm.out 2>/tmp/wait-pamslurm.err &\""
+        )
+        submit.wait_until_succeeds(
+            "squeue -h -u submitter -o '%N %u %T %j' | "
+            "grep -Fx 'pamslurm submitter RUNNING wait-pamslurm'"
+        )
+        submit.fail(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+        submit.succeed("runuser -u submitter -- scancel -n wait-pamslurm")
+        submit.wait_until_succeeds(
+            "! squeue -h -u submitter -o '%j' | grep -Fx wait-pamslurm"
+        )
+
+    # Positive integration tests for `pam_slurm_adopt`.
+    #
+    # This subtest checks the following:
+    #
+    # 1. a job can be created specifically on `pamslurmadopt`;
+    # 2. Slurm reports that the job is running on that node;
+    # 3. the node has local Slurm state for that job (`scontrol listpids`);
+    # 4. SSH login is allowed while the job is active;
+    # 5. a long-lived SSH session is adopted into Slurm's job tracking;
+    # 6. cancelling the job tears down the adopted process;
+    # 7. SSH access is denied again once the job is gone.
+    #
+    # Validates both policy enforcement and process adoption/cleanup.
+    with subtest("pam_slurm_adopt_adopts_connection"):
+        pamslurmadopt_job = submit.succeed(
+            "runuser -u submitter -- sbatch --parsable ${mkWaitJob "pamslurmadopt" "wait-pamslurmadopt"}"
+        ).strip()
+
+        submit.wait_until_succeeds(
+            f"test \"$(squeue -h -j {pamslurmadopt_job} -o %T)\" = RUNNING"
+        )
+        submit.wait_until_succeeds(
+            f"squeue -h -j {pamslurmadopt_job} -o %N | grep -Fx pamslurmadopt"
+        )
+        pamslurmadopt.wait_until_succeeds(
+            f"scontrol listpids | awk -v jid='{pamslurmadopt_job}' 'NR > 1 && $2 == jid {{ found = 1 }} END {{ exit !found }}'"
+        )
+
+        # Short SSH probe: verifies that login is allowed at all while the job
+        # is active, before we move on to the stronger adoption assertions.
+        submit.succeed(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+
+        # Start a persistent SSH session whose remote process records its PID.
+        # We later use that PID to prove the session was adopted into Slurm's
+        # accounting/control path and then cleaned up when the job is cancelled.
+        submit.succeed(
+            "sh -lc '"
+            "ssh ${sshOpts} submitter@pamslurmadopt ${adoptRemoteScript}"
+            ">/tmp/adopt-ssh.log 2>&1 & "
+            "echo -n \\$! > /tmp/adopt-ssh.clientpid'"
+        )
+
+        # Wait until the remote helper has started and published its PID.
+        pamslurmadopt.wait_until_succeeds("test -s /home/submitter/ssh.pid")
+
+        # Prove that the SSH-spawned remote process is visible through Slurm's
+        # local process listing, i.e. that the session was adopted into the job.
+        pamslurmadopt.wait_until_succeeds(
+            "pid=$(cat /home/submitter/ssh.pid); "
+            "scontrol listpids | awk 'NR > 1 { print $1 }' | grep -Fx \"$pid\""
+        )
+        remote_pid = pamslurmadopt.succeed("cat /home/submitter/ssh.pid").strip()
+
+        # Cancel the allocation and verify the entire chain is torn down:
+        # the Slurm job disappears, the adopted remote process exits, and the
+        # local SSH client exits as well.
+        submit.succeed(f"runuser -u submitter -- scancel {pamslurmadopt_job}")
+        submit.wait_until_succeeds(
+            f"test -z \"$(squeue -h -j {pamslurmadopt_job})\"",
+            timeout=60,
+        )
+        pamslurmadopt.wait_until_succeeds(
+            f"! test -e /proc/{remote_pid}",
+            timeout=60,
+        )
+        submit.wait_until_succeeds(
+            "! kill -0 $(cat /tmp/adopt-ssh.clientpid)",
+            timeout=60,
+        )
+
+        # Once the job is gone, SSH must be denied
+        # again on the adopt-protected node.
+        submit.fail(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+             timeout=30
+        )
+  '';
+}

nixos/tests/slurm.nix

@@ -148,6 +148,8 @@ in
     };
 
   testScript = ''
+    start_all()
+
     with subtest("can_start_slurmdbd"):
         dbd.wait_for_unit("slurmdbd.service")
         dbd.wait_for_open_port(6819)
@@ -155,36 +157,82 @@ in
     with subtest("cluster_is_initialized"):
         control.wait_for_unit("multi-user.target")
         control.wait_for_unit("slurmctld.service")
-        control.wait_until_succeeds("sacctmgr list cluster | awk '{ print $1 }' | grep default")
+        control.wait_for_open_port(6817)
 
-    start_all()
-
-    with subtest("can_start_slurmd"):
         for node in [node1, node2, node3]:
-            node.wait_for_unit("slurmd")
+            node.wait_for_unit("slurmd.service")
+            node.wait_for_open_port(6818)
 
-    # Test that the cluster works and can distribute jobs;
-    submit.wait_for_unit("multi-user.target")
+        submit.wait_for_unit("multi-user.target")
+
+        control.wait_until_succeeds(
+            "sacctmgr -nP list cluster format=cluster | grep -qx default"
+        )
+
+        # Test that the cluster works and can distribute jobs;
+        control.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node1 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node2 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node3 idle'"
+        )
 
     with subtest("run_distributed_command"):
         # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
         # The output must contain the 3 different names
-        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
+        submit.succeed(
+            "test \"$(srun -J distributed-hostname-check -N 3 hostname | sort -u | tr '\n' ' ')\" = 'node1 node2 node3 '"
+        )
 
-        with subtest("check_slurm_dbd_job"):
-            # find the srun job from above in the database
-            control.wait_until_succeeds("sacct | grep hostname")
+    with subtest("check_slurm_dbd_job_for_srun"):
+        # find the srun job from above in the database
+        submit.wait_until_succeeds(
+            "sacct -X -P -n --name=distributed-hostname-check -o JobName,State | "
+            "grep -Eq '^distributed-hostname-check\\|COMPLETED(\\+.*)?$'"
+    )
 
     with subtest("run_PMIx_mpitest"):
-        submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
+        submit.succeed(
+            "out=$(srun -N 3 --mpi=pmix mpitest); "
+            "echo \"$out\"; "
+            "echo \"$out\" | grep -Fx 'size=3'; "
+            "test \"$(echo \"$out\" | grep -c 'hello world from process')\" -eq 3"
+        )
 
     with subtest("run_sbatch"):
-        submit.succeed("sbatch --wait ${sbatchScript}")
-        submit.succeed("grep 'sbatch success' ${sbatchOutput}")
+        submit.succeed(
+            "jobid=$(sbatch --parsable --wait ${sbatchScript}); "
+            "echo \"$jobid\" > /tmp/sbatch.jobid"
+        )
+        submit.succeed("grep -Fx 'sbatch success' ${sbatchOutput}")
+        submit.wait_until_succeeds(
+            "sacct -X -j $(cat /tmp/sbatch.jobid) -n -o State | grep -Eq 'COMPLETED|COMPLETED\\+'"
+        )
+        submit.succeed("test -z \"$(squeue -h)\"")
+
+    with subtest("cluster_returns_to_idle"):
+        control.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node1 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node2 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node3 idle'"
+        )
 
     with subtest("rest"):
         rest.wait_for_unit("slurmrestd.service")
-        token = control.succeed("scontrol token").split('=')[1].rstrip()
-        rest.succeed("${pkgs.curl}/bin/curl -sk -H X-SLURM-USER-TOKEN:%s -X GET 'http://localhost:6820/slurm/v0.0.43/diag'" % token)
+        rest.wait_for_open_port(6820)
+
+        token = control.succeed("scontrol token").split('=', 1)[1].strip()
+
+        rest.succeed(
+            "${pkgs.curl}/bin/curl -fsS "
+            "-H X-SLURM-USER-TOKEN:%s "
+            "http://localhost:6820/slurm/v0.0.43/diag | grep -q 'meta'" % token
+        )
+
+    with subtest("rest_rejects_invalid_token"):
+        rest.fail(
+            "${pkgs.curl}/bin/curl -fsS "
+            "-H X-SLURM-USER-TOKEN:not-a-real-token "
+            "http://localhost:6820/slurm/v0.0.43/diag"
+        )
   '';
 }

nixos/tests/systemd-journal-upload.nix

@@ -72,7 +72,7 @@
     server.wait_for_unit("multi-user.target")
     client.wait_for_unit("multi-user.target")
 
-    def copy_pems(machine: Machine, domain: str):
+    def copy_pems(machine: BaseMachine, domain: str):
       machine.succeed("mkdir /run/secrets")
       machine.copy_from_host(
         source=f"{tmpdir}/{domain}/cert.pem",

pkgs/applications/system/glances/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   isPyPy,
   lib,
+  chevron,
   defusedxml,
   packaging,
   psutil,
@@ -26,9 +27,9 @@
   shtab,
 }:
 
-buildPythonApplication rec {
+buildPythonApplication (finalAttrs: {
   pname = "glances";
-  version = "4.5.0.5";
+  version = "4.5.2";
   pyproject = true;
 
   disabled = isPyPy;
@@ -36,8 +37,8 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
-    tag = "v${version}";
-    hash = "sha256-IHgMZw+X7C/72w4vXaP37GgnhLVg7EF5/sd9QlmE0NM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-o/q/zW7lRKQg+u4XblwNIswCVIroMdeUaPTNkN8QKwo=";
   };
 
   build-system = [ setuptools ];
@@ -77,6 +78,7 @@ buildPythonApplication rec {
   };
 
   nativeCheckInputs = [
+    chevron
     which
     pytestCheckHook
     selenium
@@ -100,16 +102,19 @@ buildPythonApplication rec {
     # Test always returns 3 plugin updates, but needs >=5 to not fail
     # May be an upstream bug, see: https://github.com/nicolargo/glances/issues/3430
     "test_perf_update"
+    # Upstream pipe handling currently fails under the new 4.5.2 sanitization coverage
+    "test_pipe"
   ];
 
   meta = {
     homepage = "https://nicolargo.github.io/glances/";
     description = "Cross-platform curses-based monitoring tool";
     mainProgram = "glances";
-    changelog = "https://github.com/nicolargo/glances/blob/${src.tag}/NEWS.rst";
+    changelog = "https://github.com/nicolargo/glances/blob/${finalAttrs.src.tag}/NEWS.rst";
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [
       koral
+      miniharinn
     ];
   };
-}
+})

pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix

@@ -44,6 +44,7 @@ let
     { hyprspace = import ./hyprspace.nix; }
     { hyprsplit = import ./hyprsplit.nix; }
     (import ./hyprland-plugins.nix)
+    { imgborders = import ./imgborders.nix; }
     (lib.optionalAttrs config.allowAliases {
       hycov = throw "hyprlandPlugins.hycov has been removed because it has been marked as broken since September 2024."; # Added 2025-10-12
       hyprscroller = throw "hyprlandPlugins.hyprscroller has been removed as the upstream project is deprecated. Consider using `hyprlandPlugins.hyprscrolling`."; # Added 2025-05-09

pkgs/applications/window-managers/hyprwm/hyprland-plugins/imgborders.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromCodeberg,
+  mkHyprlandPlugin,
+  cmake,
+  nix-update-script,
+}:
+mkHyprlandPlugin (finalAttrs: {
+  pluginName = "imgborders";
+  version = "1.0.1";
+
+  src = fetchFromCodeberg {
+    owner = "zacoons";
+    repo = "imgborders";
+    tag = finalAttrs.version;
+    hash = "sha256-fCzz4gh8pd7J6KQJB/avYcS0Z7NYpxjznPMtOwypPSQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv imgborders.so $out/lib/libimgborders.so
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://codeberg.org/zacoons/imgborders";
+    description = "Add tiling image borders to windows!";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [
+      mrdev023
+    ];
+  };
+})

pkgs/build-support/lake/default.nix

@@ -1,20 +1,11 @@
 # buildLakePackage: build Lean 4 projects that use the Lake build system.
 #
 # Dependencies can be provided in two ways:
-#   - `leanDeps`: already-packaged Lean libraries from leanPackages.
-#     These are injected into LEAN_PATH via setup hooks and propagated
-#     transitively, similar to Haskell's libraryHaskellDepends.
+#   - `leanDeps`: nix-packaged Lean libraries, injected via
+#     `lake --packages` and propagated transitively via LEAN_PATH.
 #   - `lakeHash`: SRI hash for a fetchLakeDeps FOD that clones git
 #     dependencies listed in lake-manifest.json (like buildGoModule's
 #     vendorHash).  Not needed when all deps are in `leanDeps`.
-#
-# Library output layout:
-#   $out/                         Package root (source + build artifacts)
-#   $out/lakefile.{lean,toml}     Lake package configuration
-#   $out/lean-toolchain           Lean version pin
-#   $out/.lake/build/lib/lean/    Compiled .olean/.ilean files
-#   $out/.lake/build/ir/          Compiled C/object files
-#   $out/nix-support/setup-hook   LEAN_PATH propagation hook
 {
   lib,
   stdenv,
@@ -22,7 +13,7 @@
   gitMinimal,
   cacert,
   jq,
-  lndir,
+  writeText,
   stdenvNoCC,
 }:
 
@@ -55,32 +46,19 @@ lib.extendMkDerivation {
       nativeBuildInputs ? [ ],
       passthru ? { },
 
-      # SRI hash for the Lake dependencies FOD.
-      # Set to null if the project has no external dependencies
-      # (or all deps are provided via leanDeps).
+      # SRI hash for the Lake dependencies FOD (null = all deps nix-managed).
       lakeHash ? null,
-
       # Pre-built Lake dependencies derivation (overrides lakeHash).
       lakeDeps ? null,
-
-      # Already-packaged Lean libraries from nixpkgs.
-      # These are added to LEAN_PATH (via setup hook) and propagated
-      # transitively.  Each must be a buildLakePackage output with
-      # .olean files under $out/.lake/build/lib/lean/.
+      # Nix-packaged Lean libraries, injected via lake --packages.
       leanDeps ? [ ],
-
-      # Lean package name as declared in lakefile.lean/toml.
-      # Defaults to pname.
+      # Lake package name as declared in lakefile (defaults to pname).
       leanPackageName ? finalAttrs.pname,
-
-      # Lake build targets.  Empty list means the default target.
+      # Lake build targets (empty = default targets).
       buildTargets ? [ ],
-
-      # Whether this is a library (install full package tree with
-      # .olean/.ilean files) or an executable (install binaries only).
+      # Library (install .olean tree) or executable (install binaries only).
       isLibrary ? true,
-
-      # Override attributes of the lakeDeps derivation.
+      # Override the FOD derivation attrs.
       overrideLakeDepsAttrs ? (finalAttrs: previousAttrs: { }),
 
       meta ? { },
@@ -96,6 +74,10 @@ lib.extendMkDerivation {
       isLibrary = args.isLibrary or true;
       leanPackageName = args.leanPackageName or finalAttrs.pname;
 
+      allLeanDeps = lib.unique (
+        builtins.concatMap (dep: [ dep ] ++ (dep.passthru.allLeanDeps or [ ])) leanDeps
+      );
+
       computedLakeDeps =
         if lakeDeps' != null then
           lakeDeps'
@@ -114,11 +96,18 @@ lib.extendMkDerivation {
           }).overrideAttrs
             (lib.toExtension overrideLakeDepsAttrs);
 
-      # Transitively collect all Lean dependencies.  Each buildLakePackage
-      # library stores its own transitive closure in passthru.allLeanDeps,
-      # so this flattens the entire dependency DAG.
-      allLeanDeps = lib.unique (
-        builtins.concatMap (dep: [ dep ] ++ (dep.passthru.allLeanDeps or [ ])) leanDeps
+      # Nix-managed dep overrides, generated at eval time.
+      # --packages takes precedence over .lake/package-overrides.json.
+      overridesFile = writeText "lake-overrides.json" (
+        builtins.toJSON {
+          schemaVersion = "1.2.0";
+          packages = map (dep: {
+            type = "path";
+            name = dep.passthru.lakePackageName or dep.pname;
+            inherited = false;
+            dir = "${dep}";
+          }) allLeanDeps;
+        }
       );
     in
     {
@@ -128,14 +117,9 @@ lib.extendMkDerivation {
         lean4
         gitMinimal
         jq
-        lndir
       ];
 
-      # Propagate so downstream packages get transitive LEAN_PATH entries
-      # via each dependency's nix-support/setup-hook.
       propagatedBuildInputs = lib.optionals isLibrary leanDeps;
-
-      # Executables only need deps at build time.
       buildInputs = lib.optionals (!isLibrary) leanDeps;
 
       configurePhase =
@@ -144,106 +128,34 @@ lib.extendMkDerivation {
 
           export HOME="$TMPDIR"
 
-          # Disable Lake cloud caching and Reservoir lookups
+          # Disable cloud caching and Reservoir lookups.
           export LAKE_NO_CACHE=1
           export RESERVOIR_API_URL=""
-
-          # Point leanc at the nix-provided C compiler
           export LEAN_CC="${stdenv.cc}/bin/cc"
 
-          # Validate that the lean-toolchain file (if present) matches the
-          # Lean toolchain we are building against.  Mismatches between the
-          # toolchain version and the compiler produce confusing errors, so
-          # fail early with a clear message.
-          leanVersion="${lean4.version}"
-          if [ -f lean-toolchain ]; then
-            toolchainVersion=$(sed -n 's/^.*:v\([0-9][0-9.]*\).*/\1/p' lean-toolchain)
-            if [ -n "$toolchainVersion" ] && [ "$toolchainVersion" != "$leanVersion" ]; then
-              echo "buildLakePackage: lean-toolchain requests v$toolchainVersion but lean4 is v$leanVersion" >&2
-              echo "buildLakePackage: update the package or use a matching lean4 version" >&2
-              exit 1
-            fi
-          fi
-
-          ${lib.concatStringsSep "\n" (
-            builtins.map (
-              dep:
-              let
-                name = dep.passthru.lakePackageName or dep.pname;
-              in
-              ''
-                # Fail fast if nix-packaged dep "${name}" was built against a
-                # different Lean version.  This avoids wasting build time when
-                # the package set is mid-update (e.g. lean4 bumped but a dep
-                # has not been updated yet).
-                if [ -f "${dep}/lean-toolchain" ]; then
-                  depToolchain=$(sed -n 's/^.*:v\([0-9][0-9.]*\).*/\1/p' "${dep}/lean-toolchain")
-                  if [ -n "$depToolchain" ] && [ "$depToolchain" != "$leanVersion" ]; then
-                    echo "buildLakePackage: dependency ${name} was built with Lean v$depToolchain but lean4 is v$leanVersion" >&2
-                    echo "buildLakePackage: update ${name} first, or override lean4 in leanPackages" >&2
-                    exit 1
-                  fi
-                fi
-              ''
-            ) allLeanDeps
-          )}
-
           if [ -n "''${LEAN_PATH:-}" ]; then
             echo "buildLakePackage: LEAN_PATH=$LEAN_PATH"
           fi
 
-          mkdir -p .lake/packages
-
-          # Create a minimal empty manifest if none exists.  Lake requires
-          # this file, but when all deps come from leanDeps (nix-managed),
-          # the actual dependency entries come from package-overrides.json.
-          if [ ! -f lake-manifest.json ]; then
-            echo '{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}' \
-              > lake-manifest.json
-          fi
-
           ${lib.optionalString (computedLakeDeps != null) ''
-            # Copy fetched (not yet nix-packaged) deps into .lake/packages/
+            mkdir -p .lake/packages
             for dep in ${computedLakeDeps}/*; do
               depName="$(basename "$dep")"
               cp -r "$dep" ".lake/packages/$depName"
               chmod -R u+w ".lake/packages/$depName"
             done
-          ''}
 
-          ${lib.concatStringsSep "\n" (
-            builtins.map (
-              dep:
-              let
-                name = dep.passthru.lakePackageName or dep.pname;
-              in
-              ''
-                # Install nix-packaged dep "${name}" into .lake/packages/.
-                # lndir creates a symlink tree so artifacts remain as
-                # zero-copy references to the store; writable dirs let Lake
-                # create metadata during workspace initialization.
-                rm -rf ".lake/packages/${name}"
-                mkdir -p ".lake/packages/${name}"
-                lndir -silent "${dep}" ".lake/packages/${name}"
-              ''
-            ) allLeanDeps
-          )}
-
-          # Generate package-overrides.json redirecting deps to local
-          # paths.  Scans .lake/packages/ so that nix-managed deps work
-          # even without a lake-manifest.json (like Haskell's package DB
-          # approach — nix is the sole dependency provider, Lake just
-          # validates against lakefile.lean at build time).
-          if [ -d .lake/packages ] && [ -n "$(ls -A .lake/packages/ 2>/dev/null)" ]; then
+            # FOD deps use package-overrides.json (the on-disk mechanism).
+            # Nix-managed deps use --packages (the CLI mechanism, takes precedence).
             jq -n --argjson pkgs "$(
               for dep in .lake/packages/*/; do
                 [ -d "$dep" ] || continue
                 depName="$(basename "$dep")"
-                printf '{"type":"path","name":"%s","inherited":false,"configFile":"lakefile","dir":".lake/packages/%s"}\n' \
-                  "$depName" "$depName"
+                jq -n --arg name "$depName" --arg dir ".lake/packages/$depName" \
+                  '{type: "path", name: $name, inherited: false, dir: $dir}'
               done | jq -s '.'
-            )" '{schemaVersion: "1.1.0", packages: $pkgs}' > .lake/package-overrides.json
-          fi
+            )" '{schemaVersion: "1.2.0", packages: $pkgs}' > .lake/package-overrides.json
+          ''}
 
           runHook postConfigure
         '';
@@ -255,7 +167,7 @@ lib.extendMkDerivation {
           local targets="${lib.concatStringsSep " " buildTargets}"
           echo "buildLakePackage: building ''${targets:-default targets}"
 
-          lake build --no-ansi $targets
+          lake build --no-ansi --packages=${overridesFile} $targets
 
           runHook postBuild
         '';
@@ -266,25 +178,22 @@ lib.extendMkDerivation {
             ''
               runHook preInstall
 
-              # Install the complete Lake package tree.  $out/ IS the
-              # package directory — source, lakefile, and pre-built
-              # artifacts under .lake/build/.
+              # Install the complete Lake package tree.
               cp -rT . "$out"
 
-              # Remove build-environment artifacts that reference the
-              # build sandbox or dependency store paths.
+              # Remove build-time artifacts.
               rm -rf "$out/.lake/packages"
               rm -f "$out/.lake/package-overrides.json"
 
-              # Install the setup hook so that downstream derivations
-              # (and `nix develop` shells) automatically get this
-              # package's oleans in LEAN_PATH.
+              # Reconcile config trace directory naming.
+              if [ -d "$out/.lake/config/[anonymous]" ]; then
+                mv "$out/.lake/config/[anonymous]" "$out/.lake/config/${leanPackageName}"
+              fi
+
+              # Setup hook propagates LEAN_PATH to downstream packages.
               mkdir -p "$out/nix-support"
               cp ${./setup-hook.sh} "$out/nix-support/setup-hook"
 
-              # Symlink any built executables into $out/bin/ for
-              # discoverability (e.g. packages that are both libraries
-              # and executables).
               if [ -d "$out/.lake/build/bin" ]; then
                 mkdir -p "$out/bin"
                 for exe in "$out/.lake/build/bin"/*; do
@@ -300,7 +209,6 @@ lib.extendMkDerivation {
             ''
               runHook preInstall
 
-              # Install executables only.
               if [ -d .lake/build/bin ]; then
                 mkdir -p "$out/bin"
                 find .lake/build/bin -type f -executable \
@@ -314,8 +222,6 @@ lib.extendMkDerivation {
       passthru = passthru // {
         inherit computedLakeDeps lean4 allLeanDeps;
         lakePackageName = leanPackageName;
-        # Canonicalize overrideLakeDepsAttrs as an attribute overlay,
-        # following the same pattern as buildGoModule's overrideModAttrs.
         overrideLakeDepsAttrs = lib.toExtension overrideLakeDepsAttrs;
       };
 

pkgs/build-support/lake/test/weak-minimax/Main.lean

@@ -1,4 +0,0 @@
-import WeakMinimax
-
-def main : IO Unit := do
-  IO.println "weak_minimax: verified (maximin <= minimax)"

pkgs/build-support/lake/test/weak-minimax/lake-manifest.json

@@ -0,0 +1 @@
+{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}

pkgs/build-support/lake/test/weak-minimax/lakefile.lean

@@ -6,7 +6,3 @@ package weakMinimax
 require "leanprover-community" / "mathlib" @ git "main"
 
 @[default_target] lean_lib WeakMinimax
-
-@[default_target]
-lean_exe weakMinimax.run where
-  root := `Main

pkgs/build-support/lake/test/weak-minimax/package.nix

@@ -1,12 +1,5 @@
 # Test that buildLakePackage works with nix-only deps (no lake-manifest.json).
 # Builds a Lean proof of the weak minimax inequality using mathlib.
-#
-# Note: building the executable recompiles .c → .c.o for all transitive
-# dependency modules because library packages only ship .olean/.ilean/.c
-# artifacts (the default Lake library facet).  Lake's trace system would
-# reuse pre-built object files if present, but since Lean 4 is rarely
-# used for application code, we defer shipping .o files in library
-# packages to keep store footprint minimal.
 {
   leanPackages,
   runCommand,
@@ -24,17 +17,10 @@ let
   };
 in
 
-runCommand "buildLakePackage-weak-minimax"
-  {
-    nativeBuildInputs = [ testPackage ];
-  }
-  ''
-    mkdir -p $out
+runCommand "buildLakePackage-weak-minimax" { } ''
+  mkdir -p $out
 
-    # Verify the executable runs (proof was verified at build time).
-    weakMinimax-run | tee $out/result
-    grep -q "weak_minimax" $out/result
-
-    # Verify library output has compiled oleans.
-    test -d "${testPackage}/.lake/build/lib/lean"
-  ''
+  # Verify library output has compiled oleans.
+  test -d "${testPackage}/.lake/build/lib/lean"
+  touch $out/success
+''

pkgs/by-name/al/aleo-fonts/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -15,13 +16,7 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-HSxP5/sLHQTujBVt1u93625EXEc42lxpt8W1//6ngWM=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 fonts/variable/*.ttf -t $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "Slab serif typeface designed by Alessio Laiso";

pkgs/by-name/as/asusctl/package.nix

@@ -18,16 +18,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asusctl";
-  version = "6.3.5";
+  version = "6.3.6";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     tag = finalAttrs.version;
-    hash = "sha256-99SLaDJm+stakrUmlyWznAeYKeD5SXeLAqakrmpalbc=";
+    hash = "sha256-HkqVNhxbz/JBVmGBeYvdWRttvAcvP05iSfp2VZPR+x8=";
   };
 
-  cargoHash = "sha256-f6Zut4oknNCKmd5Igt08se2EpCLLmmIQjD02wj2lMQg=";
+  cargoHash = "sha256-PTktA8e5pR+vl0trH0MhBXhcsxU+d/WtBMSKeSztgSY=";
 
   postPatch = ''
     files="

pkgs/by-name/bi/bind/package.nix

@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.18";
+  version = "9.20.21";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-38VGyZCsRRVSnNRcTdmVhisYrootDLKSCOiJal0yUzE=";
+    hash = "sha256-FeG1oifSiQ98ToI6bqAY3nDuLzoOhZy/89gqrYWQ3gM=";
   };
 
   outputs = [

pkgs/by-name/bo/boringssl/package.nix

@@ -11,12 +11,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20260211.0";
+  version = "0.20260327.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-sN0tqnS19ltXeAd3xUiLMc6kLtTYPh2xT1F1U1mPi/M=";
+    hash = "sha256-OMRJ4K9ETCitdEGmCYlBH8R7RjMkYno1hAX11bF8KH4=";
   };
 
   patches = [

pkgs/by-name/di/discordo/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "discordo";
-  version = "0-unstable-2026-02-26";
+  version = "0-unstable-2026-03-30";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = "discordo";
-    rev = "27dd6e09c8cde848261248a505a4efbabdcc9e09";
-    hash = "sha256-3rr7mbbPw5jrON7J80TaCZ7lBALKdtZ6vI2+uGJJaoI=";
+    rev = "48f3b5316c6a340da845c5d050b9de44d680184a";
+    hash = "sha256-1SOpy8XCdfsY/Fbp4NjDS9KFA/zcSIIjZHMjIEYB+8M=";
   };
 
-  vendorHash = "sha256-yzGKRrPPBjg/e9zkimCb99emLHBWM10FJvlL23HbTRU=";
+  vendorHash = "sha256-yQlx61R1Lx5fkctSkm64uYLqHeZZydVubpIaP00XA+U=";
 
   env.CGO_ENABLED = 1;
 

pkgs/by-name/et/etcd_3_5/package.nix

@@ -8,11 +8,11 @@
 }:
 
 let
-  version = "3.5.28";
-  etcdSrcHash = "sha256-D4c+YfNQATW8/9m/5edPKtG9qQa8MxpbpDTCZY6cvA4=";
-  etcdServerVendorHash = "sha256-IiGoG/5HJBZXhWhluK1uQVOXRk2I4VDokT7EcjhEnWU=";
-  etcdUtlVendorHash = "sha256-mUzwpxAsUhXdK70BwtjWJqjzLpDnNFNXW6tHP81c72w=";
-  etcdCtlVendorHash = "sha256-Bn3mirDqs9enpNTlp65YWiQRKpc+B6wD33b0xkaqSKE=";
+  version = "3.5.29";
+  etcdSrcHash = "sha256-riihCSd7QsH+G+//XcV+DYn7kBbXAbTjEBEXcP/mh1w=";
+  etcdServerVendorHash = "sha256-eJKgZ2kFNrWI+uKKv1xD7tGLkWaGqa/ODjA09SwDAzg=";
+  etcdUtlVendorHash = "sha256-+1/E/VGpszXEIID7tgSbiCpe4KQkUcSKJJRAUdTUklQ=";
+  etcdCtlVendorHash = "sha256-Xznj9HPx4BTUpipBmucbKjIcQpj+diyw0FtsdQVV61Y=";
 
   src = fetchFromGitHub {
     owner = "etcd-io";

pkgs/by-name/ff/fflas-ffpack/package.nix

@@ -8,6 +8,7 @@
   blas,
   lapack,
   gmpxx,
+  fetchpatch2,
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -23,6 +24,20 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Eztc2jUyKRVUiZkYEh+IFHkDuPIy+Gx3ZW/MsuOVaMc=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "detect-openmp.patch";
+      url = "https://github.com/linbox-team/fflas-ffpack/commit/833bb2fa4e87e51e3f7fa1d97f3b4372c1ee4200.patch?full_index=1";
+      hash = "sha256-COJxb1Y47rLBogJuXzznKHOSs9gAX1BtN+j8pEqOhLY=";
+      excludes = [ "benchmarks/*" ];
+    })
+    (fetchpatch2 {
+      name = "do-not-use-_mm_permute_ps-for-simd128_float.patch";
+      url = "https://github.com/linbox-team/fflas-ffpack/commit/be33b602ecdef543a30ea494899b08610c7e0a74.patch?full_index=1";
+      hash = "sha256-YWUFnPViXwyyHLXuewX6KQsgUiwgl6vfYnZX2JzgkE4=";
+    })
+  ];
+
   nativeCheckInputs = [
     gmpxx
   ];
@@ -45,21 +60,6 @@ stdenv.mkDerivation rec {
     "--with-blas-libs=-lcblas"
     "--with-lapack-libs=-llapacke"
     "--without-archnative"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    # disable SIMD instructions (which are enabled *when available* by default)
-    # for now we need to be careful to disable *all* relevant versions of an instruction set explicitly (https://github.com/linbox-team/fflas-ffpack/issues/284)
-    "--${if stdenv.hostPlatform.sse3Support then "enable" else "disable"}-sse3"
-    "--${if stdenv.hostPlatform.ssse3Support then "enable" else "disable"}-ssse3"
-    "--${if stdenv.hostPlatform.sse4_1Support then "enable" else "disable"}-sse41"
-    "--${if stdenv.hostPlatform.sse4_2Support then "enable" else "disable"}-sse42"
-    "--${if stdenv.hostPlatform.avxSupport then "enable" else "disable"}-avx"
-    "--${if stdenv.hostPlatform.avx2Support then "enable" else "disable"}-avx2"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512f"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512dq"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512vl"
-    "--${if stdenv.hostPlatform.fmaSupport then "enable" else "disable"}-fma"
-    "--${if stdenv.hostPlatform.fma4Support then "enable" else "disable"}-fma4"
   ];
   doCheck = true;
 

pkgs/by-name/ge/gedit/package.nix

@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gedit";
-  version = "49.0";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "gedit";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-IW3zBQOq/eeIjJbgJooHlOd+6/ZHOG6DUspHUlopG8A=";
+    hash = "sha256-UkKd1H7twf9r9Jf5Cx6br/8lVT2F2O9U5jR2Ihom0ZA=";
   };
 
   patches = [

pkgs/by-name/ku/kubernix/Cargo.toml.patch

@@ -1,14 +0,0 @@
-diff --git a/Cargo.toml b/Cargo.toml
-index 681e634..48cbc8e 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -19,7 +19,8 @@ path = "src/main.rs"
- [dependencies]
- anyhow = "1.0.43"
- base64 = "0.13.0"
--clap = { git = "https://github.com/clap-rs/clap", features = ["wrap_help"] }
-+clap = { version = "= 3.0.0-beta.2", features = ["wrap_help"] }
-+clap_derive = "= 3.0.0-beta.2"
- console = "0.14.1"
- crossbeam-channel = "0.5.1"
- getset = "0.1.1"

pkgs/by-name/ku/kubernix/fix-compile-error.patch

@@ -1,13 +0,0 @@
-diff --git a/src/crio.rs b/src/crio.rs
-index 36bf40b..97d5e57 100644
---- a/src/crio.rs
-+++ b/src/crio.rs
-@@ -34,7 +34,7 @@ impl Display for CriSocket {
- impl CriSocket {
-     pub fn new(path: PathBuf) -> Result<CriSocket> {
-         if path.display().to_string().len() > 100 {
--            bail!("Socket path '{}' is too long")
-+            bail!("Socket path '{}' is too long", path.display().to_string())
-         }
-         Ok(CriSocket(path))
-     }

pkgs/by-name/ku/kubernix/package.nix

@@ -4,38 +4,28 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kubernix";
-  version = "0.2.0-unstable-2021-11-16";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "saschagrunert";
     repo = "kubernix";
-    rev = "630087e023e403d461c4bb8b1c9368b26a2c0744";
-    sha256 = "sha256-IkfVpNxWOqQt/aXsN4iD9dkKKyOui3maKowVibuKbvM=";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-1cnh4h8rX6Uv/JlUy2uSpwgcjo2yTyTi+bHvWREZ7e0=";
   };
 
-  cargoLock.lockFile = ./Cargo.lock;
-
-  patches = [
-    # Need a specific version of clap and clap_derive: fails with anything greater.
-    ./Cargo.toml.patch
-    # error: 1 positional argument in format string, but no arguments were given
-    ./fix-compile-error.patch
-  ];
-
-  postPatch = ''
-    cp ${./Cargo.lock} Cargo.lock
-  '';
+  cargoHash = "sha256-7Pyj+sLvkEOIYt7UYcpsS65gjNHxXZQS1RRQDagCW8Y=";
 
+  # Tests require network access
   doCheck = false;
 
   meta = {
     description = "Single dependency Kubernetes clusters for local testing, experimenting and development";
     mainProgram = "kubernix";
     homepage = "https://github.com/saschagrunert/kubernix";
-    license = with lib.licenses; [ mit ];
+    license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ saschagrunert ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/la/lasuite-meet-frontend/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
+    hash = "sha256-OCW/8JIysegeB0XKfOe6tbYi/TV0NHFvwybalg96maM=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-HobRnbl7fJJ2F0YuA3eyI0R0eW9FveGyqosj0F+Q73I=";
+    hash = "sha256-QL4D55uw80TUJbS+qD2RDgsLVU0kmxxvc+SUXryqno0=";
   };
 
   buildPhase = ''

pkgs/by-name/la/lasuite-meet/package.nix

@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "1.12.0";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
+    hash = "sha256-OCW/8JIysegeB0XKfOe6tbYi/TV0NHFvwybalg96maM=";
   };
 
   sourceRoot = "source/src/backend";

pkgs/by-name/li/libgedit-amtk/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-amtk";
-  version = "5.9.2";
+  version = "5.10.0";
 
   outputs = [
     "out"
@@ -31,8 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
     group = "World";
     owner = "gedit";
     repo = "libgedit-amtk";
-    rev = finalAttrs.version;
-    hash = "sha256-TpPiVIsHIBrRzDG2oBwtrIYB3CYEW6SRRVow9pe2XFs=";
+    tag = finalAttrs.version;
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-wA5KRA1qWJzw5JRXQL/kP2BgCQiNhf6aIe6RppBEH90=";
   };
 
   strictDeps = true;

pkgs/by-name/li/libgedit-gfls/package.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gfls";
-  version = "0.3.1";
+  version = "0.4.0";
 
   outputs = [
     "out"
@@ -30,7 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gedit";
     repo = "libgedit-gfls";
     tag = finalAttrs.version;
-    hash = "sha256-HBXOphDvFwXea0mlfPqPtaXgNpAZyHYwuHBn5f7hPso=";
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-VzQ58XD5Yfy+gv77yTVoYHhooz2pfAV0huJI023s8ew=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libgedit-gtksourceview/package.nix

@@ -8,6 +8,8 @@
   meson,
   ninja,
   pkg-config,
+  libgedit-amtk,
+  libgedit-gfls,
   libxml2,
   glib,
   gtk3,
@@ -17,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gtksourceview";
-  version = "299.6.0";
+  version = "299.7.0";
 
   outputs = [
     "out"
@@ -30,8 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     group = "World";
     owner = "gedit";
     repo = "libgedit-gtksourceview";
-    rev = finalAttrs.version;
-    hash = "sha256-PBayAXttEFB1nHXOFTHvc4/vSL8+VZjuuwyeMKHKd9I=";
+    tag = finalAttrs.version;
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-CU9EO0oHfkdWPyicmIG6eaN+wUvvkUhrb6wgNosnm2Q=";
   };
 
   patches = [
@@ -51,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libgedit-amtk
+    libgedit-gfls
     libxml2
   ];
 

pkgs/by-name/li/libiscsi/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libiscsi";
-  version = "1.20.0";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "sahlberg";
     repo = "libiscsi";
     rev = finalAttrs.version;
-    sha256 = "sha256-idiK9JowKhGAk5F5qJ57X14Q2Y0TbIKRI02onzLPkas=";
+    sha256 = "sha256-ARajWZ5/LIfFNCdp3HvQiyhR455+sJNzUPbBrz/pZ7E=";
   };
 
   postPatch = ''
@@ -24,8 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ autoreconfHook ];
 
   env = lib.optionalAttrs (stdenv.hostPlatform.is32bit || stdenv.hostPlatform.isDarwin) {
-    # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
-    NIX_CFLAGS_COMPILE = "-Wno-error=format";
+    NIX_CFLAGS_COMPILE = toString [
+      # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
+      "-Wno-error=format"
+      # multithreading.c:257:16: error: 'sem_init' is deprecated [-Werror,-Wdeprecated-declarations]
+      "-Wno-error=deprecated-declarations"
+      # scsi-lowlevel.c:1244:11: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'uint16_t *' (aka 'unsigned short *') increases required alignment from 1 to 2 [-Werror,-Wcast-align]
+      "-Wno-error=cast-align"
+    ];
   };
 
   meta = {

pkgs/by-name/li/libosmium/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libosmium";
-  version = "2.23.0";
+  version = "2.23.1";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "libosmium";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYNNp7czQgIvPhYxXlPaY/qlVxoZZ6CiJXWrHW+zAD8=";
+    hash = "sha256-ZGLA5E/Gpwi433faUB9xLS/AhFHtWaFj/9dTh3zBTAE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/li/libtorrent-rasterbar-2_0_x/distutils.patch

@@ -1,20 +0,0 @@
-diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
-index 2f4de4854..a68d547e6 100644
---- a/bindings/python/CMakeLists.txt
-+++ b/bindings/python/CMakeLists.txt
-@@ -95,8 +95,13 @@ if (python-install-system-dir)
- else()
- 	execute_process(
- 		COMMAND "${Python3_EXECUTABLE}" -c [=[
--import distutils.sysconfig
--print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
-+try:
-+	import distutils.sysconfig
-+	print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
-+except ModuleNotFoundError:
-+	import os, sys
-+	version = f"{sys.version_info.major}.{sys.version_info.minor}"
-+	print(os.sep.join(["lib", f"python{version}", "site-packages"]))
- ]=]
- 		OUTPUT_VARIABLE _PYTHON3_SITE_ARCH
- 		OUTPUT_STRIP_TRAILING_WHITESPACE

pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix

@@ -17,14 +17,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtorrent-rasterbar";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "arvidn";
     repo = "libtorrent";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-iph42iFEwP+lCWNPiOJJOejISFF6iwkGLY9Qg8J4tyo=";
+    hash = "sha256-JbNOKzB830VQkZjC8ZAmzbu/7nkAgyD8cOr22uYbIGQ=";
   };
 
   nativeBuildInputs = [
@@ -40,8 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   patches = [
-    # provide distutils alternative for python 3.12
-    ./distutils.patch
+    ./python-destdir.patch
   ];
 
   # https://github.com/arvidn/libtorrent/issues/6865

pkgs/by-name/li/libtorrent-rasterbar-2_0_x/python-destdir.patch

@@ -0,0 +1,13 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 4e8ee816b..ff1981d84 100644
+--- a/bindings/python/CMakeLists.txt
++++ b/bindings/python/CMakeLists.txt
+@@ -106,7 +106,7 @@ endif()
+ message(STATUS "Python 3 site packages: ${_PYTHON3_SITE_ARCH}")
+ message(STATUS "Python 3 extension suffix: ${Python3_SOABI}")
+ 
+-install(TARGETS python-libtorrent DESTINATION "${_PYTHON3_SITE_ARCH}")
++install(TARGETS python-libtorrent DESTINATION "\$ENV{DESTDIR}${_PYTHON3_SITE_ARCH}")
+ 
+ if (python-egg-info)
+ 	set(SETUP_PY_IN "${CMAKE_CURRENT_SOURCE_DIR}/setup.py.cmake.in")

pkgs/by-name/lo/lowdown/package.nix

@@ -11,6 +11,7 @@
   enableDarwinSandbox ? true,
   # for passthru.tests
   nix,
+  lix,
   lowdown-unsandboxed,
 }:
 
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
   pname = "lowdown${
     lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) "-unsandboxed"
   }";
-  version = "2.0.4";
+  version = "3.0.1";
 
   outputs = [
     "out"
@@ -29,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-    sha512 = "649a508b7727df6e7e1203abb3853e05f167b64832fd5e1271f142ccf782e600b1de73c72dc02673d7b175effdc54f2c0f60318208a968af9f9763d09cf4f9ef";
+    sha512 = "fe68e1b7ff23f3992398356d7aa9a330dfd7b72e22bea9a91eeef74182b209ecea0c9f3e2b2216e1a07b2358da2b746238ec9cbbdeebdd3551cef14dd2d79f46";
   };
 
   # https://github.com/kristapsdz/lowdown/pull/171
@@ -42,12 +43,6 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
-  postPatch = ''
-    # fails test, some column width mismatch
-    rm regress/table-footnotes.md
-    rm regress/table-styles.md
-  '';
-
   # The Darwin sandbox calls fail inside Nix builds, presumably due to
   # being nested inside another sandbox.
   preConfigure = lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) ''
@@ -103,7 +98,7 @@ stdenv.mkDerivation rec {
     runHook preInstallCheck
 
     echo '# TEST' > test.md
-    $out/bin/lowdown test.md
+    $out/bin/lowdown test.md | grep '[hH]1'
 
     runHook postInstallCheck
   '';
@@ -113,7 +108,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     # most important consumers in nixpkgs
-    inherit nix lowdown-unsandboxed;
+    inherit nix lix lowdown-unsandboxed;
   };
 
   meta = {

pkgs/by-name/mc/mcp-grafana/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rHUoHtJoZXDwXU7/fTAymmQGLwAFDRHwqMSbnZvsoUc=";
+    hash = "sha256-sOT4rS9lEKJmQM9roLJbbs/8Y7thEr3KvwChXrsRKr4=";
   };
 
-  vendorHash = "sha256-w4v1/RqnNfGFzapmWd96UTT4Sc18lSVX5HvsXWWmhSY=";
+  vendorHash = "sha256-EXjZjXwyeH7zTgYvtMbtWh1j6xk2ybbeqvbxLz5yA+I=";
 
   ldflags = [
     "-s"

pkgs/by-name/ne/neovide/package.nix

@@ -30,16 +30,16 @@
 
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
   pname = "neovide";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "neovide";
     repo = "neovide";
     tag = finalAttrs.version;
-    hash = "sha256-NJ4BuJLABIuB7We11QGoKZ3fgjDBdZDyZuBKq6LIWA8=";
+    hash = "sha256-i3HEdYZ1fTK8kHRMhGVY80kE6Sp/HhNV4vG2cVroDWo=";
   };
 
-  cargoHash = "sha256-DD2c63JHMdzwD1OmC7c9dMB59qjvdAYZ9drQf3f8xCs=";
+  cargoHash = "sha256-ybPKRgUZ2MRbzSFyevxSDtsNyU4iQwL4b7JIqBpbwk4=";
 
   env = {
     SKIA_SOURCE_DIR =
@@ -48,8 +48,8 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
           owner = "rust-skia";
           repo = "skia";
           # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-          tag = "m140-0.87.4";
-          hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
+          tag = "m145-0.92.0";
+          hash = "sha256-9N780AwheKBJRcZC4l/uWFNq+oOyoNp4M6dJAVVAFeo=";
         };
         # The externals for skia are taken from skia/DEPS
         externals = linkFarm "skia-externals" (

pkgs/by-name/ne/neovide/skia-externals.json

@@ -21,8 +21,8 @@
   },
   "harfbuzz": {
     "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-    "rev": "08b52ae2e44931eef163dbad71697f911fadc323",
-    "sha256": "sha256-sP9FQLUEgTZFlvfYqSZnzZqBMxVotzD0FKKsu3/OdUw="
+    "rev": "31695252eb6ed25096893aec7f848889dad874bc",
+    "sha256": "sha256-Csyz08JTNXfY2fo27x1Eg1CqO/tt8Rt9udr3KflojSg="
   },
   "wuffs": {
     "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -31,7 +31,7 @@
   },
   "libpng": {
     "url": "https://skia.googlesource.com/third_party/libpng.git",
-    "rev": "ed217e3e601d8e462f7fd1e04bed43ac42212429",
-    "sha256": "sha256-Mo1M8TuVaoSIb7Hy2u6zgjZ1DKgpmgNmGRP6dGg/aTs="
+    "rev": "4e3f57d50f552841550a36eabbb3fbcecacb7750",
+    "sha256": "sha256-tNRrA9RUp6Mi7dbIB/70a/4tn/JxAsTUb9EI9nlXLjM="
   }
 }

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

@@ -717,6 +717,12 @@ def switch_to_configuration(
         },
         remote=target_host,
         sudo=sudo,
+        # switch-to-configuration is not expected to produce meaningful
+        # stdout, but if it (or any of its children) does, it would leak
+        # into our stdout and break the "only the store path on stdout"
+        # contract documented in services.py (see print_result). Redirect
+        # its stdout to our stderr defensively.
+        stdout=sys.stderr,
     )
 
 

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py

@@ -249,6 +249,7 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
                     "boot",
                 ],
                 check=True,
+                stdout=ANY,
                 **(
                     DEFAULT_RUN_KWARGS
                     | {
@@ -547,6 +548,7 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -795,6 +797,7 @@ def test_execute_nix_switch_build_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -920,6 +923,7 @@ def test_execute_nix_switch_flake_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1047,6 +1051,7 @@ def test_execute_nix_switch_flake_build_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1132,6 +1137,7 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1307,6 +1313,7 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
             call(
                 [config_path / "bin/switch-to-configuration", "test"],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1372,6 +1379,7 @@ def test_execute_test_rollback(
                     "test",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1433,6 +1441,7 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **(
                     DEFAULT_RUN_KWARGS
                     | {
@@ -1551,6 +1560,7 @@ def test_execute_switch_store_path_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

@@ -770,6 +770,7 @@ def test_switch_to_configuration_without_systemd_run(
         },
         sudo=False,
         remote=None,
+        stdout=sys.stderr,
     )
 
     with pytest.raises(m.NixOSRebuildError) as e:
@@ -811,6 +812,7 @@ def test_switch_to_configuration_without_systemd_run(
         },
         sudo=True,
         remote=target_host,
+        stdout=sys.stderr,
     )
 
 
@@ -846,6 +848,7 @@ def test_switch_to_configuration_with_systemd_run(
         },
         sudo=False,
         remote=None,
+        stdout=sys.stderr,
     )
 
     target_host = m.Remote("user@localhost", [], None, "ssh")
@@ -875,6 +878,7 @@ def test_switch_to_configuration_with_systemd_run(
         },
         sudo=True,
         remote=target_host,
+        stdout=sys.stderr,
     )
 
 

pkgs/by-name/op/openfreebuds/package.nix

@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   pyproject = true;
 
-  pythonRelaxDeps = [ "psutil" ];
+  pythonRelaxDeps = true;
 
   build-system = with python3Packages; [
     pdm-backend
@@ -33,6 +33,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   buildInputs = [ qt6.qtbase ];
 
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "openfreebuds/driver/huawei/test/"
+    "openfreebuds/test/test_event_bus.py"
+  ];
+
   dependencies = with python3Packages; [
     aiocmd
     aiohttp

pkgs/by-name/os/osmium-tool/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   installShellFiles,
   pandoc,
@@ -26,6 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-x5qEW4DqOw/vA+IuZA7VC5WRn+uDOZ6dJhyJoi7UKOA=";
   };
 
+  patches = [
+    # Fix apply-changes-version-on-version-timestamp test
+    (fetchpatch {
+      url = "https://github.com/osmcode/osmium-tool/commit/e58501ed1570f19340173c668568790369214d46.patch";
+      hash = "sha256-VhdwY1DpfTQAx24Qck0a96GGnEGfg4T27wSeGO1zdng=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     installShellFiles

pkgs/by-name/re/renode-unstable/package.nix

@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  nix-update-script,
   renode,
   lib,
 }:
@@ -15,16 +14,18 @@ let
 in
 renode.overrideAttrs (old: rec {
   pname = "renode-unstable";
-  version = "1.16.0-unstable-2025-12-11";
+  version = "1.16.1-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "e61a4063ec362b099704e6d8f9734cdf792aeeb0";
-    hash = "sha256-ucQguZZSNKa0nEOTCdcLyDlaBnRgi/7Yb6VunNG/iSg=";
+    rev = "9a65fb18c4ebdf32795150b44daa949977c6c124";
+    hash = "sha256-Acx3kyk0vzB1df+8yvpj0fKgePtaolJ1c4nCicAD0Gs=";
     fetchSubmodules = true;
   };
 
+  nugetDeps = ./deps.json;
+
   prePatch = ''
     sed -i 's/AssemblyVersion("%VERSION%.*")/AssemblyVersion("${normalizedVersion version}.0")/g' src/Renode/Properties/AssemblyInfo.template
     sed -i 's/AssemblyInformationalVersion("%INFORMATIONAL_VERSION%")/AssemblyInformationalVersion("${src.rev}")/g' src/Renode/Properties/AssemblyInfo.template
@@ -32,10 +33,6 @@ renode.overrideAttrs (old: rec {
   '';
 
   passthru = old.passthru // {
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version=branch"
-      ];
-    };
+    updateScript = ./update.sh;
   };
 })

pkgs/by-name/re/renode-unstable/update.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq git nix nix-prefetch-github
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+latest_rev=$(git ls-remote https://github.com/renode/renode refs/heads/master | awk '{print $1}')
+commit_date=$(curl -s "https://api.github.com/repos/renode/renode/commits/${latest_rev}" | jq -r '.commit.committer.date' | cut -dT -f1)
+
+latest_tag=$(curl -s https://api.github.com/repos/renode/renode/releases/latest | jq -r '.tag_name | ltrimstr("v")')
+
+new_version="${latest_tag}-unstable-${commit_date}"
+
+new_hash=$(nix-prefetch-github renode renode --rev "$latest_rev" --fetch-submodules | jq -r '.hash')
+
+sed -i "s|version = \".*\"|version = \"${new_version}\"|" "$PKG_FILE"
+sed -i "s|rev = \".*\"|rev = \"${latest_rev}\"|" "$PKG_FILE"
+sed -i "s|hash = \".*\"|hash = \"${new_hash}\"|" "$PKG_FILE"
+
+# Regenerate nuget deps in the correct location
+$(nix-build -A renode-unstable.passthru.fetch-deps --no-out-link) "$SCRIPT_DIR/deps.json"

pkgs/by-name/re/renode/deps.json

@@ -39,6 +39,31 @@
     "version": "3.24.24.95",
     "hash": "sha256-5THx4af5PghPnQxXdnsC+wtVcoslh+0636WkB1FaPYg="
   },
+  {
+    "pname": "GirCore.GLib-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-u3jwn7fQONG4M4i4gX6glR1zKn2JNI05QieFf1Gsays="
+  },
+  {
+    "pname": "GirCore.GObject-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-bmCHh0NyjG8YumCCI2zR8lrb6lhD6uF3MsA9tE1aWIA="
+  },
+  {
+    "pname": "GirCore.Gst-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-XxUcFgzhtD1YKjP9vF1w/oloZOZRlBPH1AO0cAkoWvk="
+  },
+  {
+    "pname": "GirCore.GstApp-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-uKSgmjZ4WwGxptKZKofcXMPa99UO1VHRX7OZdgqEs04="
+  },
+  {
+    "pname": "GirCore.GstBase-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-WZC/W/zsRFixjoYb19PttEnKw422n7qZC+dnWLcgCb8="
+  },
   {
     "pname": "GLibSharp",
     "version": "3.24.24.95",

pkgs/by-name/re/renode/package.nix

@@ -11,7 +11,6 @@
   gtk3,
   lib,
   mono,
-  nix-update-script,
   python3Packages,
 }:
 
@@ -59,13 +58,13 @@ let
 in
 buildDotnetModule rec {
   pname = "renode";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "20ad06d9379997829df309c5724be94ba4effedd";
-    hash = "sha256-I/W3OAzHCN8rEIlDyBwI1ZDvKfHYYBDiqE9XkWHxo7o=";
+    rev = "d66b0c2aa3d420408eccecfd1d3bab0fd702a6db";
+    hash = "sha256-HQaMo3qsZvD4uBIsGzyKpTO7gaxjVvurI91pm1UXvjc=";
     fetchSubmodules = true;
   };
 
@@ -180,7 +179,7 @@ buildDotnetModule rec {
 
   executables = [ "Renode" ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;
 
   meta = {
     changelog = "https://github.com/renode/renode/blob/${version}/CHANGELOG.rst";

pkgs/by-name/re/renode/update.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts git nix
+
+set -euo pipefail
+
+latest_tag=$(curl -s https://api.github.com/repos/renode/renode/releases/latest | jq -r '.tag_name')
+latest_version="${latest_tag#v}"
+
+# Resolve tag to commit hash
+# Try dereferenced ref first (annotated tags), then direct ref (lightweight tags)
+commit=$(git ls-remote https://github.com/renode/renode "refs/tags/${latest_tag}^{}" | awk '{print $1}')
+if [[ -z "$commit" ]]; then
+    commit=$(git ls-remote https://github.com/renode/renode "refs/tags/${latest_tag}" | awk '{print $1}')
+fi
+
+update-source-version renode "$latest_version" --rev="$commit"
+
+# Regenerate nuget deps
+$(nix-build -A renode.passthru.fetch-deps --no-out-link)

pkgs/by-name/ru/ruff/package.nix

@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.7";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-aDRFNJKvxuHPYaZtoM+93DxJGsTPMLKGBH5QhIiTh0Y=";
+    hash = "sha256-hjllQ7lw2hecrwhPQlcq97LLxFYR28vCY14Ty6eBox4=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-m3VkHXhjemXVOFFVSUOVz0xD2Rc2pMsP+dnMYQD29uI=";
+  cargoHash = "sha256-iQKX+TqfP9r5P+UJKLqNysHYJm8N6qCCDfs8KYSb1vY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ru/runme/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "runme";
-  version = "3.16.6";
+  version = "3.16.10";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bW4MlzBRC+Mf6Y1CmtTdMFaZbTBDqaPh3puFQpOl+hQ=";
+    hash = "sha256-ExgzuX3g8JHWKGmUbaIOR7H1eSI97GRtSREtyqU0riU=";
   };
 
   vendorHash = "sha256-yS87r9zYQpJ7G/opqBNJ6EgqO7/R1jL+mxPVX71rQhc=";

pkgs/by-name/se/session-desktop/package.nix

@@ -31,14 +31,14 @@ let
 
   libsession-util-nodejs = stdenv.mkDerivation (finalAttrs: {
     pname = "libsession-util-nodejs";
-    version = "0.6.16"; # find version in pnpm-lock.yaml
+    version = "0.6.17"; # find version in pnpm-lock.yaml
     src = fetchFromGitHub {
       owner = "session-foundation";
       repo = "libsession-util-nodejs";
       tag = "v${finalAttrs.version}";
       fetchSubmodules = true;
       deepClone = true; # need git rev for all submodules
-      hash = "sha256-xTaXPz5p+NBCdjCTErQVrG2gBA4oxHCvSqJTN8g9uE4=";
+      hash = "sha256-j7smb0Rgjdqs4l3ahUV2bFXyvieV6Mcoti6wjSRovLo=";
       # fetchgit is not reproducible with deepClone + fetchSubmodules:
       # https://github.com/NixOS/nixpkgs/issues/100498
       postFetch = ''
@@ -109,7 +109,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "session-desktop";
-  version = "1.17.15";
+  version = "1.17.17";
   src =
     (fetchFromGitHub {
       owner = "session-foundation";
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
         rm -rf .git
         popd
       '';
-      hash = "sha256-snQYyXwybXqDkCBHtIeSMTkQLIXrc8zET7kRiWjPwpI=";
+      hash = "sha256-YqDkL91PbgNlaDnfCpZn6oL2r4z0zClRb4OGys4o2Yw=";
     }).overrideAttrs
       (oldAttrs: {
         # https://github.com/NixOS/nixpkgs/issues/195117#issuecomment-1410398050
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-cinhhPTFSzrr/hc/+Tyv1IKRn84MYpycOQ1qxCMQuy8=";
+    hash = "sha256-8z4EDHpsvM0AFbJy2JXoE4vjiLaDshTihMQsrQzXdEs=";
   };
 
   buildPhase = ''

pkgs/by-name/sl/slurm/package.nix

@@ -34,6 +34,7 @@
   http-parser,
   # enable internal X11 support via libssh2
   enableX11 ? true,
+  enablePAM ? true,
   enableNVML ? config.cudaSupport,
   cudaPackages,
   symlinkJoin,
@@ -144,17 +145,36 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-rpath" # Required for configure to pick up the right dlopen path
   ]
   ++ (lib.optional (!enableX11) "--disable-x11")
-  ++ (lib.optional enableNVML "--with-nvml");
+  ++ (lib.optional enableNVML "--with-nvml")
+  ++ (lib.optional enablePAM "--enable-pam --with-pam_dir=${placeholder "out"}/lib/security");
 
   preConfigure = ''
     patchShebangs ./doc/html/shtml2html.py
     patchShebangs ./doc/man/man2html.py
+  ''
+  + (lib.optionalString enablePAM ''
+    mkdir -p $out/lib/security
+  '');
+  postConfigure = lib.optionalString enablePAM ''
+    rm -rf $out
   '';
 
-  postInstall = ''
-    rm -f $out/lib/*.la $out/lib/slurm/*.la
+  postBuild = lib.optionalString enablePAM ''
+    make -C contribs/pam
+    make -C contribs/pam_slurm_adopt
   '';
 
+  postInstall =
+    (lib.optionalString enablePAM ''
+      export LIBRARY_PATH="$PWD/src/api/.libs:''${LIBRARY_PATH:+:$LIBRARY_PATH}"
+      mkdir -p $out/lib/security
+      make -C contribs/pam install
+      make -C contribs/pam_slurm_adopt install
+    '')
+    + ''
+      rm -f $out/lib/*.la $out/lib/slurm/*.la $out/lib/security/*.la
+    '';
+
   enableParallelBuilding = true;
 
   passthru.tests.slurm = nixosTests.slurm;
@@ -166,6 +186,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       markuskowa
+      edwtjo
     ];
   };
 })

pkgs/by-name/sp/sprite/package.nix

@@ -8,7 +8,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sprite";
-  version = "0.0.1-rc41";
+  version = "0.0.1-rc42";
 
   src = fetchurl {
     url = "https://sprites-binaries.t3.storage.dev/client/v${finalAttrs.version}/sprite-${
@@ -16,10 +16,10 @@ stdenv.mkDerivation (finalAttrs: {
     }-${if stdenv.hostPlatform.isx86_64 then "amd64" else "arm64"}.tar.gz";
     hash =
       {
-        aarch64-darwin = "sha256-WVEa0NjpoeHZtn8p8k5AJLifIZWgPchpyrj5ikRupoI=";
-        x86_64-darwin = "sha256-zwCgZSFeFFk49blOjzH5PEv5fuFUlnP/Bre0uJpz78c=";
-        aarch64-linux = "sha256-PjL4usgcx3ybLB7ZLPfKHaqygWVfiuCNrERbYrDRZYk=";
-        x86_64-linux = "sha256-PAnnP5M9lLwC3Qhydz3Bo0uLtX6uE5cJF4lDOGfsiDk=";
+        aarch64-darwin = "sha256-ih0RonsNu7ZHUWbQcMqHmm7RXg0VvekDvq6WpnKvSjY=";
+        x86_64-darwin = "sha256-p3Tpf2Mg0rfOaw/y7cKI2Q7SvEpm+a1ykYVrr/dzVLc=";
+        aarch64-linux = "sha256-vMhkzX9noNL8Aw6MWhEAYmufCRpLsY/FbveBP3PYrQQ=";
+        x86_64-linux = "sha256-Jmym6yg0Wl83KTn840jWF3md5+r4NBh8czQudY5Iomk=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/sr/src-cli/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "src-cli";
-  version = "7.0.1";
+  version = "7.0.2";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "src-cli";
     rev = version;
-    hash = "sha256-nGWSTIkhO8Wcf1oXecUiE/i3bdEi5I/DXYdvBFfF2zU=";
+    hash = "sha256-RX3Fxa+AyzZQn68M5ZqeCqKjkNkp80ih0ECVvud1SSg=";
   };
 
   vendorHash = "sha256-lChxbgIa4w24uUG0SYBbzouKt+a0eVLLSn/BG6Q5P6o=";

pkgs/by-name/te/temporal_capi/package.nix

@@ -5,6 +5,7 @@
   fetchFromGitHub,
   nix-update-script,
   testers,
+  pkg-config,
   validatePkgConfig,
 }:
 
@@ -53,15 +54,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mkdir $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/temporal_capi.pc <<EOF
     prefix=$out
-    exec_prefix=''${prefix}
-    libdir=''${exec_prefix}/lib
-    includedir=''${prefix}/include
+    exec_prefix=\''${prefix}
+    libdir=\''${exec_prefix}/lib
+    includedir=\''${prefix}/include
 
     Name: temporal_capi
     Description: C API for temporal_rs
     Version: ${finalAttrs.version}
-    Libs: -L''${libdir} -ltemporal_capi
-    Cflags: -I''${includedir}
+    Libs: -L\''${libdir} -ltemporal_capi
+    Cflags: -I\''${includedir}
     EOF
   '';
   postFixup = lib.optional (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic) ''
@@ -71,13 +72,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # We don't want to run Rust checks, we only check the resulting lib using C/C++ in the installCheckPhase.
   doCheck = false;
   doInstallCheck = true;
-  nativeInstallCheckInputs = [ stdenv.cc ];
+  nativeInstallCheckInputs = [
+    stdenv.cc
+    pkg-config
+  ];
   installCheckPhase = ''
     runHook preInstallCheck
 
-    cc -L $out/lib -I $out/include temporal_capi/tests/c/simple.c -ltemporal_capi -lm -o c_test
+    FLAGS=$(PKG_CONFIG_PATH="$out/lib/pkgconfig" pkg-config --cflags --libs temporal_capi)
+    cc $FLAGS temporal_capi/tests/c/simple.c -o c_test
     ./c_test
-    c++ -L $out/lib -I $out/include temporal_capi/tests/cpp/simple.cpp -ltemporal_capi -lm -o cpp_test
+    c++ $FLAGS temporal_capi/tests/cpp/simple.cpp -o cpp_test
     ./cpp_test
 
     runHook postInstallCheck

pkgs/by-name/to/topgrade/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "topgrade";
-  version = "17.1.0";
+  version = "17.2.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-31+hiKYDzzXdb45elIlGVUKr6lYWMx7iWZBDvlXcERg=";
+    hash = "sha256-Q8Cji21uJy/Az8FQiSQJ4nv+HRsqIVTsYoO9q3jv/as=";
   };
 
-  cargoHash = "sha256-WIMpXL5jo9BF5GrAkflLdxoxigsJwpAMbKXV2gTrHAg=";
+  cargoHash = "sha256-/Ezf6ntvomhGsPpWPIA+ebkW+4i6BVvuIHNVbZSHow8=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/un/unblob/package.nix

@@ -3,7 +3,6 @@
   libiconv,
   python3,
   fetchFromGitHub,
-  gitUpdater,
   makeWrapper,
   rustPlatform,
   stdenvNoCC,
@@ -47,27 +46,25 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
-  version = "25.5.26";
+  version = "26.3.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "onekey-sec";
     repo = "unblob";
     tag = version;
-    hash = "sha256-vTakXZFAcD3cmd+y4CwYg3X4O4NmtOzuqMLWLMX2Duk=";
+    hash = "sha256-wYWuKvxAagctlmdO5Fi9/WzfJ4zkDgfXejgDTJPHsTI=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-NirDPuAcKuNquMs9mBZoEkQf+QJ+cMd7JXjj1anB9Zw=";
+    hash = "sha256-wjN4QPOUYFWWYMWL9aAgGqEucM7q+H6YyoS9Mv2dpp4=";
   };
 
   strictDeps = true;
 
-  build-system = with python3.pkgs; [ poetry-core ];
-
   buildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libiconv ];
 
   dependencies = with python3.pkgs; [
@@ -78,10 +75,13 @@ python3.pkgs.buildPythonApplication rec {
     dissect-cstruct
     lark
     lief.py
+    lzallright
     python3.pkgs.lz4 # shadowed by pkgs.lz4
     plotext
     pluggy
+    pydantic
     pyfatfs
+    pymdown-extensions
     pyperscan
     python-magic
     pyzstd
@@ -104,8 +104,6 @@ python3.pkgs.buildPythonApplication rec {
     "ubi-reader"
   ];
 
-  pythonRelaxDeps = [ "lz4" ];
-
   pythonImportsCheck = [ "unblob" ];
 
   makeWrapperArgs = [
@@ -115,23 +113,26 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs =
     with python3.pkgs;
     [
+      pexpect
+      psutil
+      pytest-cov-stub
       pytestCheckHook
-      pytest-cov # cannot use stub
       versionCheckHook
     ]
     ++ runtimeDeps;
 
   pytestFlags = [
-    "--no-cov"
+    "--with-e2e" # Not that slow: increases test time by ~5s
   ];
 
   disabledTests = [
     # https://github.com/tytso/e2fsprogs/issues/152
     "test_all_handlers[filesystem.extfs]"
+    # regression in erofs-utils 1.9 https://github.com/onekey-sec/unblob/commit/c7c9f20dd871a5694d41a95ca3041eb0c98e257a
+    "test_all_handlers[filesystem.android.erofs]"
   ];
 
   passthru = {
-    updateScript = gitUpdater { };
     # helpful to easily add these to a nix-shell environment
     inherit runtimeDeps;
   };

pkgs/by-name/uv/uv/package.nix

@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-IkVFRyCGqfTqnn6IObgaH/pzOxll2Vd2YdmUaHfB/co=";
+    hash = "sha256-M/J666qGAsFPjA/x1xmGSuTYr1VCzkgMSy08vs9HydQ=";
   };
 
-  cargoHash = "sha256-J/PUOQPav0lVUSmGyjf2u5Im3QGOx0RljYaRUbj79h8=";
+  cargoHash = "sha256-mSfWJetk0c8omTSOih0GpSgyXpAa7gjLvR3G4GQYQLg=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/wo/wolfssl/package.nix

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.8.4";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
+    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
   };
 
   postPatch = ''

pkgs/desktops/lomiri/development/geonames/1001-geonames-cmake4-compat.patch

@@ -1,37 +0,0 @@
-From 3dea0cc91b579de5e2c9db811f2e9e34079d3733 Mon Sep 17 00:00:00 2001
-From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
-Date: Mon, 1 Sep 2025 13:22:26 +0200
-Subject: [PATCH] {CMakeLists.txt,cmake/GtkDocScanGObjWrapper.cmake}: Bump
- cmake_minimum_required() to version 3.10.
-
----
- CMakeLists.txt                    | 2 +-
- cmake/GtkDocScanGObjWrapper.cmake | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 5fbff8a..e7b863e 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,4 +1,4 @@
--cmake_minimum_required(VERSION 3.0)
-+cmake_minimum_required(VERSION 3.10)
- project(geonames VERSION 0.3.1 LANGUAGES C)
- 
- include(GNUInstallDirs)
-diff --git a/cmake/GtkDocScanGObjWrapper.cmake b/cmake/GtkDocScanGObjWrapper.cmake
-index b187ebb..b026ed0 100644
---- a/cmake/GtkDocScanGObjWrapper.cmake
-+++ b/cmake/GtkDocScanGObjWrapper.cmake
-@@ -20,7 +20,7 @@
- 
- # This is needed for find_package(PkgConfig) to work correctly --
- # CMAKE_MINIMUM_REQUIRED_VERSION needs to be defined.
--cmake_minimum_required(VERSION 3.2)
-+cmake_minimum_required(VERSION 3.10)
- 
- if(NOT APPLE)
-     # We use pkg-config to find glib et al
--- 
-GitLab
-

pkgs/desktops/lomiri/development/geonames/default.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geonames";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/geonames";
-    rev = finalAttrs.version;
-    hash = "sha256-AhRnUoku17kVY0UciHQXFDa6eCH6HQ4ZGIOobCaGTKQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-jXjhhCrY0tURd4N4D5weCJEckS5cctUfBgpGLTkC2cI=";
   };
 
   outputs = [
@@ -42,12 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     "devdoc"
   ];
 
-  patches = [
-    # Fix compat with CMake 4
-    # Remove when https://gitlab.com/ubports/development/core/geonames/-/merge_requests/4 merged & in release
-    ./1001-geonames-cmake4-compat.patch
-  ];
-
   postPatch = ''
     patchShebangs src/generate-locales.sh tests/setup-test-env.sh
   '';
@@ -105,7 +99,10 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   passthru = {
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
     updateScript = gitUpdater { };
   };
 
@@ -120,7 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Cross requires hostPlatform emulation during build
     # https://gitlab.com/ubports/development/core/geonames/-/issues/1
     broken =
-      stdenv.buildPlatform != stdenv.hostPlatform && !stdenv.hostPlatform.emulatorAvailable buildPackages;
+      !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
+      && !stdenv.hostPlatform.emulatorAvailable buildPackages;
     pkgConfigModules = [
       "geonames"
     ];

pkgs/development/beam-modules/rebar3-release.nix

@@ -57,7 +57,6 @@ let
       attrs
       // {
 
-        name = "${pname}-${version}";
         inherit version pname;
 
         buildInputs =

pkgs/development/coq-modules/aac-tactics/default.nix

@@ -36,7 +36,7 @@ mkCoqDerivation {
 
     lib.switch coq.coq-version [
       {
-        case = "9.0";
+        case = lib.versions.isGe "9.0";
         out = "9.0.0";
       }
       {

pkgs/development/coq-modules/mtac2/default.nix

@@ -14,11 +14,16 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = isEq "9.1";
+        out = "1.4-rocq${coq.coq-version}";
+      }
       {
         case = range "8.19" "9.0";
         out = "1.4-coq${coq.coq-version}";
       }
     ] null;
+  release."1.4-rocq9.1".hash = "sha256-A+ac84ZfDMW2NhS/NrGIfdairXmzXxZIYGNmJIz0ReM=";
   release."1.4-coq9.0".sha256 = "sha256-pAPBRCW7M46UZPJ+v/0xAT8mpQURN8czMmlrfYz/MVU=";
   release."1.4-coq8.20".sha256 = "sha256-3nu/8zDvdnl6WzGtw46mVcdqgkRgc6Xy8/I+lUOrSIY=";
   release."1.4-coq8.19".sha256 = "sha256-G9eK0eLyECdT20/yf8yyz7M8Xq2WnHHaHpxVGP0yTtU=";

pkgs/development/coq-modules/rewriter/default.nix

@@ -16,7 +16,7 @@ mkCoqDerivation {
     in
     lib.switch coq.coq-version [
       {
-        case = range "8.17" "9.0";
+        case = range "8.17" "9.2";
         out = "0.0.15";
       }
     ] null;

pkgs/development/coq-modules/unicoq/default.nix

@@ -12,6 +12,10 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = isGe "9.1";
+        out = "1.6-9.1";
+      }
       {
         case = range "8.20" "9.0";
         out = "1.6-8.20";
@@ -21,6 +25,8 @@ mkCoqDerivation {
         out = "1.6-8.19";
       }
     ] null;
+  release."1.6-9.1".rev = "0cf37ef7e638bfaad6e804e17bd80e7bb0e1b717";
+  release."1.6-9.1".hash = "sha256-1EKDkj33pg3AsEpckZYqWppPUZV2OkxM2xLq2zvZGMQ=";
   release."1.6-8.20".sha256 = "sha256-zne9LB0lGdqUfrBe8cDK8fwuxfBDFU4PqNlt9nl7rNI=";
   release."1.6-8.19".sha256 = "sha256-fDk60B8AzJwiemxHGgWjNu6PTu6NcJoI9uK7Ww2AT14=";
   releaseRev = v: "v${v}";

pkgs/development/idris-modules/build-builtin-package.nix

@@ -3,12 +3,10 @@
 # deps: The dependencies of the package
 { idris, build-idris-package }:
 pname: deps:
-let
-  inherit (builtins.parseDrvName idris.name) version;
-in
 build-idris-package {
 
-  inherit pname version;
+  inherit pname;
+  inherit (idris) version;
   inherit (idris) src;
 
   noPrelude = true;

pkgs/development/lean-modules/Cli/default.nix

@@ -6,17 +6,27 @@
 
 buildLakePackage {
   pname = "lean4-cli";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4-cli";
-    tag = "v4.28.0";
-    hash = "sha256-9nX+dozmDAaVb5uKWL14zbILr7aqbVerTyPcN12Niw4=";
+    tag = "v4.29.0";
+    hash = "sha256-jCUl4sXVmwtYPuQecEUFH6mwFzPaQY7au4624EOiWjk=";
   };
 
   leanPackageName = "Cli";
 
+  # Pre-build static library for downstream executables.
+  # TODO: upstream this to lean4-cli
+  postPatch = ''
+    substituteInPlace lakefile.toml \
+      --replace-fail '[[lean_lib]]
+    name = "Cli"' '[[lean_lib]]
+    name = "Cli"
+    defaultFacets = ["static"]'
+  '';
+
   meta = {
     description = "Command-line argument parser for Lean 4";
     homepage = "https://github.com/leanprover/lean4-cli";

pkgs/development/lean-modules/LeanSearchClient/default.nix

@@ -18,12 +18,6 @@ buildLakePackage {
 
   leanPackageName = "LeanSearchClient";
 
-  # Upstream lean-toolchain lags behind; remove it so the
-  # buildLakePackage toolchain check does not reject this package.
-  postPatch = ''
-    rm -f lean-toolchain
-  '';
-
   meta = {
     description = "Lean 4 client for LeanSearch and Moogle proof search";
     homepage = "https://github.com/leanprover-community/LeanSearchClient";

pkgs/development/lean-modules/Qq/default.nix

@@ -6,13 +6,13 @@
 
 buildLakePackage {
   pname = "lean4-Qq";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "quote4";
-    tag = "v4.28.0";
-    hash = "sha256-BRrSdDJQAsgM/NeSL2FODCez/8zEffjDRWUToGlKDNQ=";
+    tag = "v4.29.0";
+    hash = "sha256-pNY5hv1nJbreCfU4EewIHCpiryIBv1ghWibrUW8vnQ0=";
   };
 
   leanPackageName = "Qq";

pkgs/development/lean-modules/aesop/default.nix

@@ -7,13 +7,13 @@
 
 buildLakePackage {
   pname = "lean4-aesop";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "aesop";
-    tag = "v4.28.0";
-    hash = "sha256-KeP46qtEf4/lgi4iCVuYIQbazufTR4luTbsuia9JkK4=";
+    tag = "v4.29.0";
+    hash = "sha256-CNwxNig8OWjtfQRYyRnM/HGBn2oaNX5qP9CVT2eWNlg=";
   };
 
   leanPackageName = "aesop";

pkgs/development/lean-modules/batteries/default.nix

@@ -6,13 +6,13 @@
 
 buildLakePackage {
   pname = "lean4-batteries";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "batteries";
-    tag = "v4.28.0";
-    hash = "sha256-3N1MCFsg5UiwBCMAhDK7WwIowMNnhjlFgAsm0UPtGKc=";
+    tag = "v4.29.0";
+    hash = "sha256-sEIDi2i2FaLTgKYWt/kzqPrjMdf+bFURfhw6ZZWBawQ=";
   };
 
   leanPackageName = "batteries";