From eaef97894cd897b910ee18aae69b5d4bacdc8919 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 22 Feb 2026 12:41:50 +0000
Subject: [PATCH 001/110] tree-sitter-grammars.tree-sitter-fish: 3.6.0 -> 3.7.0

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index d034b612a02d..526ef37bb341 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -689,9 +689,9 @@
   };
 
   fish = rec {
-    version = "3.6.0";
+    version = "3.7.0";
     url = "github:ram02z/tree-sitter-fish?ref=${version}";
-    hash = "sha256-ZQj6XR7pHGoCOBS6GOHiRW9LWNoNPlwVcZe5F2mtGNE=";
+    hash = "sha256-n6eGMdbW1Rsn5XbszLSSSG3F8jh+loYnPEiabNY+jfk=";
     meta = {
       license = lib.licenses.unlicense;
     };

From 85ffea0ee6db05b4c3dc8b8b4332064d5f574f82 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 26 Feb 2026 08:20:59 +0000
Subject: [PATCH 002/110] tree-sitter-grammars.tree-sitter-powershell: 0.25.10
 -> 0.26.3

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..3a748c14630d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1966,9 +1966,9 @@
   };
 
   powershell = {
-    version = "0.25.10";
+    version = "0.26.3";
     url = "github:airbus-cert/tree-sitter-powershell";
-    hash = "sha256-xzDM1CdBY95XgLsEjqKWrwuIf/s6/2Q0XbxJRvOuL2o=";
+    hash = "sha256-ETuZcVSvHF5ILN6+xjWlQM5IiT/+dtxdSckrHJSJSWk=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [

From 4e238b2cee17969d9a27d8dc5d8a48156b3a3dd9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 26 Feb 2026 18:44:15 +0000
Subject: [PATCH 003/110] tree-sitter-grammars.tree-sitter-markdown-inline:
 0.5.2 -> 0.5.3

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..d6f6c43afeaf 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1533,7 +1533,7 @@
   markdown = {
     version = "0.5.2";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
+    hash = "sha256-WUVN7+lzDI+VC5PuJjhHiS4JpVr1x0Ic30i2tVrI6W8=";
     location = "tree-sitter-markdown";
     meta = {
       license = lib.licenses.mit;
@@ -1542,9 +1542,9 @@
 
   markdown-inline = {
     language = "markdown_inline";
-    version = "0.5.2";
+    version = "0.5.3";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
+    hash = "sha256-WUVN7+lzDI+VC5PuJjhHiS4JpVr1x0Ic30i2tVrI6W8=";
     location = "tree-sitter-markdown-inline";
     meta = {
       license = lib.licenses.mit;

From fa06f7fc8366c8231c1b104008b9f21ebd9691e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 26 Feb 2026 18:44:32 +0000
Subject: [PATCH 004/110] tree-sitter-grammars.tree-sitter-markdown: 0.5.2 ->
 0.5.3

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..3ef02366f8ab 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1531,9 +1531,9 @@
   };
 
   markdown = {
-    version = "0.5.2";
+    version = "0.5.3";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
+    hash = "sha256-WUVN7+lzDI+VC5PuJjhHiS4JpVr1x0Ic30i2tVrI6W8=";
     location = "tree-sitter-markdown";
     meta = {
       license = lib.licenses.mit;
@@ -1544,7 +1544,7 @@
     language = "markdown_inline";
     version = "0.5.2";
     url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
+    hash = "sha256-WUVN7+lzDI+VC5PuJjhHiS4JpVr1x0Ic30i2tVrI6W8=";
     location = "tree-sitter-markdown-inline";
     meta = {
       license = lib.licenses.mit;

From 41997d49dae6aec5b29a14b6e9b850835f52d911 Mon Sep 17 00:00:00 2001
From: Oliver Schmidt <os@flyingcircus.io>
Date: Mon, 23 Feb 2026 17:13:40 +0100
Subject: [PATCH 005/110] nixos/grub: re-install grub on package change

Trigger re-installation of grub files when the store path of the grub
package changes.
This is consistent with how side-effects are executed in other parts of
NixOS, e.g. systemd service management, and ensures that the actually
running grub stays in sync with the grub package in the Nix store that
is part of the system closure.
In particular, this causes security patches or dependency changes to be
taken into effect without the need to bump the package version.

Impact:
This change causes a re-installation of grub for all systems,
due to the lack of a persisted grub store path in existing state files.

Background:
So far we only re-installed grub outside of the store when its its
version, the package name, or some flags changed.
This leads to the various security patches only fixing new installations
of grub and not existing ones. This has been like this for over a decade,
but it remains unclear why the implementation decision had been to
be overly cautious with modifying boot loader side effects.

Fixes #486315

PL-135147
---
 .../system/boot/loader/grub/install-grub.pl   | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index f5ae844da21f..f61c91f02db8 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -685,12 +685,14 @@ struct(GrubState => {
     efi => '$',
     devices => '$',
     efiMountPoint => '$',
+    grub => '$',
+    grubEfi => '$',
     extraGrubInstallArgs => '@',
 });
 # If you add something to the state file, only add it to the end
 # because it is read line-by-line.
 sub readGrubState {
-    my $defaultGrubState = GrubState->new(name => "", version => "", efi => "", devices => "", efiMountPoint => "", extraGrubInstallArgs => () );
+    my $defaultGrubState = GrubState->new(name => "", version => "", efi => "", devices => "", efiMountPoint => "", grub => "", grubEfi => "", extraGrubInstallArgs => () );
     open my $fh, "<", "$bootPath/grub/state" or return $defaultGrubState;
     local $/ = "\n";
     my $name = <$fh>;
@@ -721,8 +723,10 @@ sub readGrubState {
     }
     my %jsonState = %{decode_json($jsonStateLine)};
     my @extraGrubInstallArgs = exists($jsonState{'extraGrubInstallArgs'}) ? @{$jsonState{'extraGrubInstallArgs'}} : ();
+    my $grubValue = exists($jsonState{'grub'}) ? $jsonState{'grub'} : "";
+    my $grubEfiValue = exists($jsonState{'grubEfi'}) ? $jsonState{'grubEfi'} : "";
     close $fh;
-    my $grubState = GrubState->new(name => $name, version => $version, efi => $efi, devices => $devices, efiMountPoint => $efiMountPoint, extraGrubInstallArgs => \@extraGrubInstallArgs );
+    my $grubState = GrubState->new(name => $name, version => $version, efi => $efi, devices => $devices, efiMountPoint => $efiMountPoint, extraGrubInstallArgs => \@extraGrubInstallArgs, grub => $grubValue, grubEfi => $grubEfiValue );
     return $grubState
 }
 
@@ -734,15 +738,16 @@ my @prevExtraGrubInstallArgs = @{$prevGrubState->extraGrubInstallArgs};
 
 my $devicesDiffer = scalar (List::Compare->new( '-u', '-a', \@deviceTargets, \@prevDeviceTargets)->get_symmetric_difference());
 my $extraGrubInstallArgsDiffer = scalar (List::Compare->new( '-u', '-a', \@extraGrubInstallArgs, \@prevExtraGrubInstallArgs)->get_symmetric_difference());
-my $nameDiffer = get("fullName") ne $prevGrubState->name;
-my $versionDiffer = get("fullVersion") ne $prevGrubState->version;
 my $efiDiffer = $efiTarget ne $prevGrubState->efi;
 my $efiMountPointDiffer = $efiSysMountPoint ne $prevGrubState->efiMountPoint;
+# re-installing grub once the package store path changes is necessary, because
+# introducing patches or adjusting builds does not always bump the version number
+my $grubStorePathsDiffer = ($grub ne $prevGrubState->grub) || ($grubEfi ne $prevGrubState->grubEfi);
 if (($ENV{'NIXOS_INSTALL_GRUB'} // "") eq "1") {
     warn "NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER";
     $ENV{'NIXOS_INSTALL_BOOTLOADER'} = "1";
 }
-my $requireNewInstall = $devicesDiffer || $extraGrubInstallArgsDiffer || $nameDiffer || $versionDiffer || $efiDiffer || $efiMountPointDiffer || (($ENV{'NIXOS_INSTALL_BOOTLOADER'} // "") eq "1");
+my $requireNewInstall = $devicesDiffer || $extraGrubInstallArgsDiffer || $efiDiffer || $efiMountPointDiffer || $grubStorePathsDiffer || (($ENV{'NIXOS_INSTALL_BOOTLOADER'} // "") eq "1");
 
 # install a symlink so that grub can detect the boot drive
 my $tmpDir = File::Temp::tempdir(CLEANUP => 1) or die "Failed to create temporary space: $!";
@@ -795,7 +800,9 @@ if ($requireNewInstall != 0) {
     print $fh join( ",", @deviceTargets ), "\n" or die;
     print $fh $efiSysMountPoint, "\n" or die;
     my %jsonState = (
-        extraGrubInstallArgs => \@extraGrubInstallArgs
+        extraGrubInstallArgs => \@extraGrubInstallArgs,
+        grub => $grub,
+        grubEfi => $grubEfi
     );
     my $jsonStateLine = encode_json(\%jsonState);
     print $fh $jsonStateLine, "\n" or die;

From 8cd473775fae255de46c8d599e4b1efa95a304cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 2 Mar 2026 15:42:57 +0000
Subject: [PATCH 006/110] tree-sitter-grammars.tree-sitter-elixir: 0.3.4 ->
 0.3.5

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..9dc0b16338da 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -575,9 +575,9 @@
   };
 
   elixir = {
-    version = "0.3.4";
+    version = "0.3.5";
     url = "github:elixir-lang/tree-sitter-elixir";
-    hash = "sha256-9M/DpqpGivDtgGt3ojU/kHR51sla59+KtZ/95hT6IIo=";
+    hash = "sha256-C5/+t49pcFh45GqLZRjRs/sH8Ej+dklR/brad+snsyQ=";
     meta = {
       license = lib.licenses.asl20;
     };

From bdf8fbf3b7442e0d0565bbe874d2633851146b64 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Mar 2026 23:59:41 +0000
Subject: [PATCH 007/110] tree-sitter-grammars.tree-sitter-unison:
 0-unstable-2025-03-06 -> 2.1.3-unstable-2026-02-27

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..57e844fa6b03 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2757,10 +2757,10 @@
   };
 
   unison = {
-    version = "0-unstable-2025-03-06";
+    version = "2.1.3-unstable-2026-02-27";
     url = "github:kylegoetz/tree-sitter-unison";
-    rev = "169e7f748a540ec360c0cb086b448faad012caa4";
-    hash = "sha256-0HOLtLh1zRdaGQqchT5zFegWKJHkQe9r7DGKL6sSkPo=";
+    rev = "10365cc70ab2b2de85ea7ab35cf6b7636c36ce8b";
+    hash = "sha256-l6X2x5lGlUhyf6Pr6lWd4aWacz7vmvtHVyM4qqPO8zg=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [

From c362c105dccd635a92a6b0a39ed80de71730190f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 03:27:46 +0000
Subject: [PATCH 008/110] tree-sitter-grammars.tree-sitter-robot: 1.1.2 ->
 1.3.0

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..7d4936eb9195 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2192,9 +2192,9 @@
   };
 
   robot = {
-    version = "1.1.2";
+    version = "1.3.0";
     url = "github:Hubro/tree-sitter-robot";
-    hash = "sha256-M0Um0JYvxQDYC3kqIENCiEIdEPOPNa05/2idih/fWas=";
+    hash = "sha256-GJTZMIOrEXsfVzVigF2XKKDxchkOGv0zEya5o9k5ZnY=";
     meta = {
       license = lib.licenses.isc;
       maintainers = with lib.maintainers; [

From 9579e1b4d3be9961fe2c0c6fdf037daebc727e64 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 9 Mar 2026 19:09:55 +0000
Subject: [PATCH 009/110] tree-sitter-grammars.tree-sitter-gitcommit: 0.4.0 ->
 0.5.0

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 87b94bfa0e78..f773a605e48f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -823,9 +823,9 @@
   };
 
   gitcommit = {
-    version = "0.4.0";
+    version = "0.5.0";
     url = "github:gbprod/tree-sitter-gitcommit";
-    hash = "sha256-KYfcs99p03b0RiPYnZeKJf677fmVf658FLZcFk2v2Ws=";
+    hash = "sha256-ttULjFU9slnPcT4bCjOozGkaKAOxMW5Oa2/caVNeEsA=";
     meta = {
       license = lib.licenses.wtfpl;
       maintainers = with lib.maintainers; [

From 6923f19a69f47a475608d558c146d69a6a66464a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Mar 2026 11:24:56 +0000
Subject: [PATCH 010/110] tree-sitter-grammars.tree-sitter-scala: 0.24.0 ->
 0.25.0

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index d3dc2d7673a5..5355e03da91d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2257,9 +2257,9 @@
   };
 
   scala = {
-    version = "0.24.0";
+    version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-scala";
-    hash = "sha256-ZE+zjpb52hvehJjNchJYK81XZbGAudeTRxlczuoix5g=";
+    hash = "sha256-xDp1+i0QLnY18EtiwurW1B4bbeS1qZKNJRxS6Qeb3pw=";
     meta = {
       license = lib.licenses.mit;
     };

From 05e36fdccadd2113c56e4c9caadf9a7072baa110 Mon Sep 17 00:00:00 2001
From: Seong Yong-ju <sei40kr@gmail.com>
Date: Sat, 14 Mar 2026 12:55:23 +0900
Subject: [PATCH 011/110] tree-sitter-grammars.tree-sitter-fstar: init at
 0-unstable-2026-03-14

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../tree-sitter/grammars/grammar-sources.nix        | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index d3dc2d7673a5..c7d8c9094116 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -726,6 +726,19 @@
     };
   };
 
+  fstar = {
+    version = "0-unstable-2026-03-14";
+    url = "github:sei40kr/tree-sitter-fstar";
+    rev = "cdb06d462e0ee727c313f3e07c71bc2d288e0f89";
+    hash = "sha256-kGFP+MbZ10qS13n8pcI6YhIS6xWjDtuqZSeIiPSO7pM=";
+    meta = {
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [
+        sei40kr
+      ];
+    };
+  };
+
   gas = {
     version = "0.0.1-unstable-2023-09-15";
     url = "github:sirius94/tree-sitter-gas";

From 3acd000d3477748ba18a1555eafeb65e2635d1ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edward=20Tj=C3=B6rnhammar?= <ed@cflags.cc>
Date: Sat, 14 Mar 2026 17:20:34 +0100
Subject: [PATCH 012/110] slurm: add pam support

---
 pkgs/by-name/sl/slurm/package.nix | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 974657f170e0..ea06a5f93d88 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -34,6 +34,7 @@
   http-parser,
   # enable internal X11 support via libssh2
   enableX11 ? true,
+  enablePAM ? true,
   enableNVML ? config.cudaSupport,
   cudaPackages,
   symlinkJoin,
@@ -144,17 +145,36 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-rpath" # Required for configure to pick up the right dlopen path
   ]
   ++ (lib.optional (!enableX11) "--disable-x11")
-  ++ (lib.optional enableNVML "--with-nvml");
+  ++ (lib.optional enableNVML "--with-nvml")
+  ++ (lib.optional enablePAM "--enable-pam --with-pam_dir=${placeholder "out"}/lib/security");
 
   preConfigure = ''
     patchShebangs ./doc/html/shtml2html.py
     patchShebangs ./doc/man/man2html.py
+  ''
+  + (lib.optionalString enablePAM ''
+    mkdir -p $out/lib/security
+  '');
+  postConfigure = lib.optionalString enablePAM ''
+    rm -rf $out
   '';
 
-  postInstall = ''
-    rm -f $out/lib/*.la $out/lib/slurm/*.la
+  postBuild = lib.optionalString enablePAM ''
+    make -C contribs/pam
+    make -C contribs/pam_slurm_adopt
   '';
 
+  postInstall =
+    (lib.optionalString enablePAM ''
+      export LIBRARY_PATH="$PWD/src/api/.libs:''${LIBRARY_PATH:+:$LIBRARY_PATH}"
+      mkdir -p $out/lib/security
+      make -C contribs/pam install
+      make -C contribs/pam_slurm_adopt install
+    '')
+    + ''
+      rm -f $out/lib/*.la $out/lib/slurm/*.la $out/lib/security/*.la
+    '';
+
   enableParallelBuilding = true;
 
   passthru.tests.slurm = nixosTests.slurm;
@@ -166,6 +186,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       markuskowa
+      edwtjo
     ];
   };
 })

From 72ec3724b52991ec16aebab26ae8955c105abfc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edward=20Tj=C3=B6rnhammar?= <ed@cflags.cc>
Date: Sat, 14 Mar 2026 17:20:35 +0100
Subject: [PATCH 013/110] nixos/pam: add slurm_pam(_adopt) support

---
 nixos/modules/security/pam.nix | 146 +++++++++++++++++++++++++++++++++
 1 file changed, 146 insertions(+)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 9f5ad83e0746..d568b32a45a3 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -666,6 +666,137 @@ let
           };
         };
 
+        slurm = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = ''
+              If set, ONLY prevents users from logging into nodes if they have no
+              jobs in the node. This module is a legacy implementation with
+              functionality limited to login restrictions.
+            '';
+          };
+
+          adopt = {
+            enable = lib.mkOption {
+              default = false;
+              type = lib.types.bool;
+              description = ''
+                If set, it prevents users from logging into nodes if they have no jobs
+                in the node. It also tracks any other spawned processes for accounting
+                and ensures complete job cleanup when a job is completed for any
+                successful connection. Spawned processes get "adopted" as external
+                steps into the current job. As such, those steps get integrated with
+                Slurm accounting and control group facilities.
+              '';
+            };
+
+            settings = lib.mkOption {
+              type = lib.types.submodule {
+                freeformType = moduleSettingsType;
+                options = {
+
+                  action_no_jobs = lib.mkOption {
+                    type = lib.types.enum [
+                      "ignore"
+                      "deny"
+                    ];
+                    default = "deny";
+                    description = ''
+                      What to do if no jobs from the user are found, deny or ignore
+                      (pass along to next PAM module).
+                    '';
+                  };
+
+                  action_unknown = lib.mkOption {
+                    type = lib.types.enum [
+                      "newest"
+                      "allow"
+                      "deny"
+                    ];
+                    default = "newest";
+                    description = ''
+                      If the user has jobs, attach them to the newest job. Allow
+                      the connection through without adoption.
+                    '';
+                  };
+
+                  action_adopt_failure = lib.mkOption {
+                    type = lib.types.enum [
+                      "allow"
+                      "deny"
+                    ];
+                    default = "deny";
+                    description = ''
+                      What to do if the process is unable to be adopted into a job.
+                      `allow` matches the upstream default which is only really
+                      suitable for testing; production systems will want `deny`
+                      as a default.
+                    '';
+                  };
+
+                  action_generic_failure = lib.mkOption {
+                    type = lib.types.enum [
+                      "ignore"
+                      "allow"
+                      "deny"
+                    ];
+                    default = "ignore";
+                    description = ''
+                      Catch all for failures related to kernel issues or slurmd
+                      access. Ignore falls through to the next PAM module, allowing
+                      the connection to go through without adoption.
+                    '';
+                  };
+
+                  disable_x11 = lib.mkOption {
+                    type = lib.types.enum [
+                      "0"
+                      "1"
+                    ];
+                    default = "0";
+                    description = ''
+                      Disable or enable x11 sessions. '0' means the adopted connection
+                      has Slurm X11 forwarding with DISPLAY overwritten using X11
+                      tunnel endpoint details.
+                    '';
+                  };
+
+                  nodename = lib.mkOption {
+                    type = with lib.types; nullOr nonEmptyStr;
+                    default = null;
+                    example = "compute-a-01";
+                    description = ''
+                      Set this only when the Slurm `NodeName` for this machine
+                      differs from `hostname -s`. If unset, `pam_slurm_adopt`
+                      uses the host short name.
+                    '';
+                  };
+
+                  join_container = lib.mkOption {
+                    type = lib.types.enum [
+                      "true"
+                      "false"
+                    ];
+                    default = "true";
+                    description = ''
+                      Attach to a container created by job_container/tmpfs
+                    '';
+                  };
+                };
+              };
+
+              default = {
+                service = name;
+              };
+              description = ''
+                Slurm Adopt Settings. More information is available at:
+                  - https://slurm.schedmd.com/pam_slurm_adopt.html
+              '';
+            };
+          };
+        };
+
         zfs = lib.mkOption {
           default = config.security.pam.zfs.enable;
           defaultText = lib.literalExpression "config.security.pam.zfs.enable";
@@ -810,6 +941,12 @@ let
                 control = "sufficient";
                 modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so";
               }
+              {
+                name = "slurm";
+                enable = cfg.slurm.enable;
+                control = "required";
+                modulePath = "${pkgs.slurm}/lib/security/pam_slurm.so";
+              }
               # The required pam_unix.so module has to come after all the sufficient modules
               # because otherwise, the account lookup will fail if the user does not exist
               # locally, for example with MySQL- or LDAP-auth.
@@ -818,6 +955,15 @@ let
                 control = "required";
                 modulePath = "${package}/lib/security/pam_unix.so";
               }
+              # pam_slurm_adopt must be the last module in the account stack.
+              {
+                name = "slurm_adopt";
+                enable = cfg.slurm.adopt.enable;
+                control = "required";
+                modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
+                settings = cfg.slurm.adopt.settings;
+              }
+
             ];
 
             auth = autoOrderRules (

From 1680dd9de56adbe7c639cbf286f81b5230ddf72a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edward=20Tj=C3=B6rnhammar?= <ed@cflags.cc>
Date: Sat, 14 Mar 2026 17:20:36 +0100
Subject: [PATCH 014/110] nixosTests.slurm-pam: add PAM integration testing for
 Slurm

---
 nixos/tests/all-tests.nix |   1 +
 nixos/tests/slurm-pam.nix | 411 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 412 insertions(+)
 create mode 100644 nixos/tests/slurm-pam.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 672331ab645d..fde1852208be 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1492,6 +1492,7 @@ in
   slimserver = runTest ./slimserver.nix;
   slipshow = runTest ./slipshow.nix;
   slurm = runTest ./slurm.nix;
+  slurm-pam = runTest ./slurm-pam.nix;
   smokeping = runTest ./smokeping.nix;
   snapcast = runTest ./snapcast.nix;
   snapper = runTest ./snapper.nix;
diff --git a/nixos/tests/slurm-pam.nix b/nixos/tests/slurm-pam.nix
new file mode 100644
index 000000000000..1bb613af38a0
--- /dev/null
+++ b/nixos/tests/slurm-pam.nix
@@ -0,0 +1,411 @@
+{ lib, pkgs, ... }:
+
+let
+
+  slurmConf = "/etc/slurm.conf";
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
+  sshConf = ''
+    UserKnownHostsFile /dev/null
+    StrictHostKeyChecking no
+  '';
+  sshConfigPubkey = pkgs.writeText "ssh_config_pubkey" (
+    sshConf
+    + ''
+
+      BatchMode yes
+      PreferredAuthentications publickey
+      KbdInteractiveAuthentication no
+      PasswordAuthentication no
+      IdentityFile /root/privkey.snakeoil
+    ''
+  );
+  sshConfigPassword = pkgs.writeText "ssh_config_password" (
+    sshConf
+    + ''
+      BatchMode no
+      PreferredAuthentications password
+      PubkeyAuthentication no
+      KbdInteractiveAuthentication no
+      PasswordAuthentication yes
+    ''
+  );
+  sshOpts = "-F " + sshConfigPubkey;
+  sshPassOpts = "-F " + sshConfigPassword;
+  adoptRemoteScript = pkgs.writeShellScript "slurm-pam-adopt-remote" ''
+    echo $$ > /home/submitter/ssh.pid
+    trap : TERM INT
+    while true; do
+      sleep 1
+    done
+  '';
+  mkWaitJob =
+    node: name:
+    pkgs.writeText "${name}.sbatch" ''
+      #!${pkgs.runtimeShell}
+      #SBATCH --job-name=${name}
+      #SBATCH --nodes=1
+      #SBATCH --nodelist=${node}
+      while true; do sleep 60; done
+    '';
+
+  slurmconfig =
+    { config, ... }:
+    {
+      services.slurm = {
+        controlMachine = "control";
+        nodeName = map (n: n + " CPUs=1 State=UNKNOWN") [
+          "regular"
+          "pamslurm"
+          "pamslurmadopt"
+        ];
+        partitionName = [ "debug Nodes=ALL Default=YES MaxTime=INFINITE State=UP" ];
+        extraConfig = ''
+          PrologFlags=contain
+          ProctrackType=proctrack/cgroup
+          TaskPlugin=task/cgroup,task/affinity
+          SlurmdDebug=debug
+        '';
+      };
+
+      services.openssh = {
+        enable = true;
+        settings = {
+          AllowUsers = [ "submitter" ];
+          PubkeyAuthentication = true;
+          # leave password auth available on the regular node for
+          # regression testing plain pam_unix behavior
+          KbdInteractiveAuthentication = false;
+          PasswordAuthentication = true;
+        };
+      };
+
+      environment.systemPackages = [
+        pkgs.pamtester
+        pkgs.sshpass
+      ];
+
+      networking.firewall.enable = false;
+      systemd.tmpfiles.rules = [
+        "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
+      ];
+      environment.etc."slurm.conf".source = "${config.services.slurm.etcSlurm}/slurm.conf";
+      systemd.services.sshd.environment.SLURM_CONF = slurmConf;
+      users.groups.submitter = { };
+      users.users.submitter = {
+        isNormalUser = true;
+        createHome = true;
+        initialPassword = "submitter";
+        group = "submitter";
+        openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+    };
+
+in
+{
+  name = "slurm-pam";
+
+  meta.maintainers = [ lib.maintainers.edwtjo ];
+
+  nodes =
+    let
+      computeNode =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            client.enable = true;
+          };
+        };
+      computePAMNode =
+        { ... }:
+        {
+          imports = [ computeNode ];
+          security.pam.services.sshd.slurm.enable = true;
+          services.openssh.settings = {
+            KbdInteractiveAuthentication = false;
+            PasswordAuthentication = lib.mkForce false;
+            PubkeyAuthentication = true;
+          };
+        };
+      computePAMAdoptNode =
+        { ... }:
+        {
+          imports = [ computeNode ];
+          # NOTE: Prolog, Epilog needed for more advanced tests.
+          #       This is an upstream recommended workaround for removing pam_systemd
+          services.slurm.extraConfig = ''
+            LaunchParameters=ulimit_pam_adopt
+            SrunProlog=${pkgs.writers.writeBash "slurm-prolog" ''
+              loginctl enable-linger $SLURM_JOB_USER
+              exit 0
+            ''}
+            TaskProlog=${pkgs.writers.writeBash "slurm-taskprolog" ''
+              echo "export XDG_RUNTIME_DIR=/run/user/$SLURM_JOB_UID"
+              echo "export XDG_SESSION_ID=$(</proc/self/sessionid)"
+              echo "export XDG_SESSION_TYPE=tty"
+              echo "export XDG_SESSION_CLASS=user"
+            ''}
+            SrunEpilog=${pkgs.writers.writeBash "slurm-epilog" ''
+              #Only disable linger if this is the last job running for this user.
+              O_P=0
+              for pid in $(scontrol listpids | awk -v jid=$SLURM_JOB_ID 'NR!=1 { if ($2 != jid && $1 != "-1"){print $1} }'); do
+                      ps --noheader -o euser p $pid | grep -q $SLURM_JOB_USER && O_P=1
+              done
+              if [ $O_P -eq 0 ]; then
+                      loginctl disable-linger $SLURM_JOB_USER
+              fi
+              exit 0
+            ''}
+          '';
+          security.pam.services.sshd.slurm.adopt.enable = true;
+          # disable `pam_systemd` on adopt node
+          security.pam.services.sshd.startSession = lib.mkForce false;
+          security.pam.services.sshd.slurm.adopt.settings.action_adopt_failure = "allow";
+        };
+    in
+    {
+
+      control =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            server.enable = true;
+          };
+        };
+
+      submit =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            enableStools = true;
+          };
+        };
+
+      regular = computeNode;
+      pamslurm = computePAMNode;
+      pamslurmadopt = computePAMAdoptNode;
+    };
+
+  testScript = ''
+    start_all()
+
+    # Make sure cluster state is ready before testing PAM behavior.
+    #
+    # This shows that the controller is up, all compute nodes have registered,
+    # and Slurm sees every test node as schedulable (`idle`). Without this,
+    # later SSH failures would be ambiguous: they could come from PAM policy,
+    # missing node registration, or startup races.
+    with subtest("cluster_is_ready"):
+        control.wait_for_unit("slurmctld.service")
+        for node in [regular, pamslurm, pamslurmadopt]:
+            node.wait_for_unit("slurmd")
+        submit.wait_for_unit("multi-user.target")
+        submit.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'regular idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'pamslurm idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'pamslurmadopt idle'"
+        )
+
+    # Sanity-check the Slurm cluster itself before layering PAM expectations on
+    # top of it. This ensures the scheduler can place a job across all three
+    # nodes, so later PAM-specific failures are not caused by a broken cluster.
+    with subtest("run_distributed_command"):
+        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
+
+    # Verify that the generated PAM stacks match the intended integration:
+    #
+    # - `pamslurm` should include the legacy `pam_slurm.so`.
+    # - `pamslurmadopt` should include `pam_slurm_adopt.so`.
+    # - `pam_slurm_adopt.so` must be the last account module.
+    # - `pam_systemd.so` must be absent because it conflicts with
+    #   `pam_slurm_adopt`.
+    #
+    # This hopefully catches regressions before trying any live login.
+    with subtest("pam_files_are_as_expected"):
+        # `pam_systemd` conflicts with `pam_slurm_adopt`
+        pamslurm.succeed("grep -q '${pkgs.slurm}/lib/security/pam_slurm.so' /etc/pam.d/sshd")
+        pamslurmadopt.succeed("grep -q '${pkgs.slurm}/lib/security/pam_slurm_adopt.so' /etc/pam.d/sshd")
+        pamslurmadopt.succeed(
+            "awk '$1 == \"account\" { print $3 }' /etc/pam.d/sshd | tail -n1 | "
+            "grep -Fx '${pkgs.slurm}/lib/security/pam_slurm_adopt.so'"
+        )
+        pamslurmadopt.fail("grep -q pam_systemd.so /etc/pam.d/sshd")
+
+    # Install the test SSH private key on the submit host once so all later SSH
+    # checks use the same credential and client configuration.
+    with subtest("prepare_ssh_key"):
+         submit.succeed(
+           "install -m 0600 ${snakeOilPrivateKey} /root/privkey.snakeoil"
+         )
+
+    # Regression check: a normal node with no Slurm PAM restrictions
+    # must still allow ordinary public-key SSH login for the test user.
+    with subtest("regular_node_allows_pubkey_ssh"):
+         submit.succeed(
+            "ssh ${sshOpts} submitter@regular true",
+             timeout=30
+         )
+
+    # Regression check: ordinary password SSH must also still work on
+    # the regular node. This guards against accidentally breaking plain
+    # `pam_unix` behavior while adding Slurm-specific PAM hooks elsewhere.
+    with subtest("regular_node_allows_password_ssh"):
+        submit.succeed(
+            "sshpass -p submitter ssh ${sshPassOpts} submitter@regular true",
+            timeout=30
+        )
+
+    # Negative companion to the previous test: wrong passwords must still be
+    # rejected on the regular node, proving that the password path is actually
+    # authenticating and not silently bypassed.
+    with subtest("regular_node_rejects_wrong_password_ssh"):
+        submit.fail(
+            "sshpass -p wrong-password ssh ${sshPassOpts} submitter@regular true",
+            timeout=30
+        )
+
+    # Direct PAM regression check on the regular node. This bypasses SSH and
+    # exercises the local PAM service stack itself, confirming that correct
+    # `pam_unix` authentication still succeeds.
+    with subtest("regular_node_pam_unix_accepts_correct_password"):
+        regular.succeed(
+            "printf 'submitter\\n' | pamtester login submitter authenticate acct_mgmt"
+        )
+
+    # Negative companion to the previous test: wrong passwords must still be
+    # rejected on the regular node, proving that the password path is actually
+    # authenticating and not silently bypassed.
+    with subtest("regular_node_pam_unix_rejects_wrong_password"):
+        regular.fail(
+            "printf 'wrong-password\\n' | pamtester login submitter authenticate"
+        )
+
+    # Core policy check for both Slurm-protected nodes: without any active job
+    # owned by the user on the target node, SSH must be denied.
+    #
+    # This is the main negative regression test for the Slurm PAM integration.
+    with subtest("deny_ssh_without_job"):
+        submit.fail(
+           "ssh ${sshOpts} submitter@pamslurm true",
+            timeout=30
+        )
+        submit.fail(
+           "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+
+    # Verify node-local visibility for the legacy `pam_slurm` integration.
+    #
+    # We start a long-running allocation specifically on `pamslurm` as the
+    # `submitter` user, then confirm Slurm reports that exact node/user/job
+    # combination. The important negative assertion is that this job must NOT
+    # grant access to a different node (`pamslurmadopt`).
+    #
+    # We intentionally keep this as a visibility/isolation test rather than a
+    # positive SSH-success test, since `pam_slurm` module is less
+    # deterministicly to assert positive here than `pam_slurm_adopt`.
+    with subtest("pam_slurm_job_visibility_is_node_local"):
+        submit.succeed(
+            "runuser -u submitter -- sh -lc "
+            "\"srun --job-name=wait-pamslurm --nodelist=pamslurm sleep 300 "
+            ">/tmp/wait-pamslurm.out 2>/tmp/wait-pamslurm.err &\""
+        )
+        submit.wait_until_succeeds(
+            "squeue -h -u submitter -o '%N %u %T %j' | "
+            "grep -Fx 'pamslurm submitter RUNNING wait-pamslurm'"
+        )
+        submit.fail(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+        submit.succeed("runuser -u submitter -- scancel -n wait-pamslurm")
+        submit.wait_until_succeeds(
+            "! squeue -h -u submitter -o '%j' | grep -Fx wait-pamslurm"
+        )
+
+    # Positive integration tests for `pam_slurm_adopt`.
+    #
+    # This subtest checks the following:
+    #
+    # 1. a job can be created specifically on `pamslurmadopt`;
+    # 2. Slurm reports that the job is running on that node;
+    # 3. the node has local Slurm state for that job (`scontrol listpids`);
+    # 4. SSH login is allowed while the job is active;
+    # 5. a long-lived SSH session is adopted into Slurm's job tracking;
+    # 6. cancelling the job tears down the adopted process;
+    # 7. SSH access is denied again once the job is gone.
+    #
+    # Validates both policy enforcement and process adoption/cleanup.
+    with subtest("pam_slurm_adopt_adopts_connection"):
+        pamslurmadopt_job = submit.succeed(
+            "runuser -u submitter -- sbatch --parsable ${mkWaitJob "pamslurmadopt" "wait-pamslurmadopt"}"
+        ).strip()
+
+        submit.wait_until_succeeds(
+            f"test \"$(squeue -h -j {pamslurmadopt_job} -o %T)\" = RUNNING"
+        )
+        submit.wait_until_succeeds(
+            f"squeue -h -j {pamslurmadopt_job} -o %N | grep -Fx pamslurmadopt"
+        )
+        pamslurmadopt.wait_until_succeeds(
+            f"scontrol listpids | awk -v jid='{pamslurmadopt_job}' 'NR > 1 && $2 == jid {{ found = 1 }} END {{ exit !found }}'"
+        )
+
+        # Short SSH probe: verifies that login is allowed at all while the job
+        # is active, before we move on to the stronger adoption assertions.
+        submit.succeed(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+            timeout=30
+        )
+
+        # Start a persistent SSH session whose remote process records its PID.
+        # We later use that PID to prove the session was adopted into Slurm's
+        # accounting/control path and then cleaned up when the job is cancelled.
+        submit.succeed(
+            "sh -lc '"
+            "ssh ${sshOpts} submitter@pamslurmadopt ${adoptRemoteScript}"
+            ">/tmp/adopt-ssh.log 2>&1 & "
+            "echo -n \\$! > /tmp/adopt-ssh.clientpid'"
+        )
+
+        # Wait until the remote helper has started and published its PID.
+        pamslurmadopt.wait_until_succeeds("test -s /home/submitter/ssh.pid")
+
+        # Prove that the SSH-spawned remote process is visible through Slurm's
+        # local process listing, i.e. that the session was adopted into the job.
+        pamslurmadopt.wait_until_succeeds(
+            "pid=$(cat /home/submitter/ssh.pid); "
+            "scontrol listpids | awk 'NR > 1 { print $1 }' | grep -Fx \"$pid\""
+        )
+        remote_pid = pamslurmadopt.succeed("cat /home/submitter/ssh.pid").strip()
+
+        # Cancel the allocation and verify the entire chain is torn down:
+        # the Slurm job disappears, the adopted remote process exits, and the
+        # local SSH client exits as well.
+        submit.succeed(f"runuser -u submitter -- scancel {pamslurmadopt_job}")
+        submit.wait_until_succeeds(
+            f"test -z \"$(squeue -h -j {pamslurmadopt_job})\"",
+            timeout=60,
+        )
+        pamslurmadopt.wait_until_succeeds(
+            f"! test -e /proc/{remote_pid}",
+            timeout=60,
+        )
+        submit.wait_until_succeeds(
+            "! kill -0 $(cat /tmp/adopt-ssh.clientpid)",
+            timeout=60,
+        )
+
+        # Once the job is gone, SSH must be denied
+        # again on the adopt-protected node.
+        submit.fail(
+            "ssh ${sshOpts} submitter@pamslurmadopt true",
+             timeout=30
+        )
+  '';
+}

From 80d9b9cc39ab85e505aa7ebc8f0c9a85633d1b53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edward=20Tj=C3=B6rnhammar?= <ed@cflags.cc>
Date: Sat, 14 Mar 2026 17:20:37 +0100
Subject: [PATCH 015/110] nixosTests.slurm: test cluster and job state

---
 nixos/tests/slurm.nix | 80 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 64 insertions(+), 16 deletions(-)

diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index b468e32e45e0..06b622739852 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -148,6 +148,8 @@ in
     };
 
   testScript = ''
+    start_all()
+
     with subtest("can_start_slurmdbd"):
         dbd.wait_for_unit("slurmdbd.service")
         dbd.wait_for_open_port(6819)
@@ -155,36 +157,82 @@ in
     with subtest("cluster_is_initialized"):
         control.wait_for_unit("multi-user.target")
         control.wait_for_unit("slurmctld.service")
-        control.wait_until_succeeds("sacctmgr list cluster | awk '{ print $1 }' | grep default")
+        control.wait_for_open_port(6817)
 
-    start_all()
-
-    with subtest("can_start_slurmd"):
         for node in [node1, node2, node3]:
-            node.wait_for_unit("slurmd")
+            node.wait_for_unit("slurmd.service")
+            node.wait_for_open_port(6818)
 
-    # Test that the cluster works and can distribute jobs;
-    submit.wait_for_unit("multi-user.target")
+        submit.wait_for_unit("multi-user.target")
+
+        control.wait_until_succeeds(
+            "sacctmgr -nP list cluster format=cluster | grep -qx default"
+        )
+
+        # Test that the cluster works and can distribute jobs;
+        control.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node1 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node2 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node3 idle'"
+        )
 
     with subtest("run_distributed_command"):
         # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
         # The output must contain the 3 different names
-        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
+        submit.succeed(
+            "test \"$(srun -J distributed-hostname-check -N 3 hostname | sort -u | tr '\n' ' ')\" = 'node1 node2 node3 '"
+        )
 
-        with subtest("check_slurm_dbd_job"):
-            # find the srun job from above in the database
-            control.wait_until_succeeds("sacct | grep hostname")
+    with subtest("check_slurm_dbd_job_for_srun"):
+        # find the srun job from above in the database
+        submit.wait_until_succeeds(
+            "sacct -X -P -n --name=distributed-hostname-check -o JobName,State | "
+            "grep -Eq '^distributed-hostname-check\\|COMPLETED(\\+.*)?$'"
+    )
 
     with subtest("run_PMIx_mpitest"):
-        submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
+        submit.succeed(
+            "out=$(srun -N 3 --mpi=pmix mpitest); "
+            "echo \"$out\"; "
+            "echo \"$out\" | grep -Fx 'size=3'; "
+            "test \"$(echo \"$out\" | grep -c 'hello world from process')\" -eq 3"
+        )
 
     with subtest("run_sbatch"):
-        submit.succeed("sbatch --wait ${sbatchScript}")
-        submit.succeed("grep 'sbatch success' ${sbatchOutput}")
+        submit.succeed(
+            "jobid=$(sbatch --parsable --wait ${sbatchScript}); "
+            "echo \"$jobid\" > /tmp/sbatch.jobid"
+        )
+        submit.succeed("grep -Fx 'sbatch success' ${sbatchOutput}")
+        submit.wait_until_succeeds(
+            "sacct -X -j $(cat /tmp/sbatch.jobid) -n -o State | grep -Eq 'COMPLETED|COMPLETED\\+'"
+        )
+        submit.succeed("test -z \"$(squeue -h)\"")
+
+    with subtest("cluster_returns_to_idle"):
+        control.wait_until_succeeds(
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node1 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node2 idle' && "
+            "sinfo -Nh -o '%N %T' | grep -Fx 'node3 idle'"
+        )
 
     with subtest("rest"):
         rest.wait_for_unit("slurmrestd.service")
-        token = control.succeed("scontrol token").split('=')[1].rstrip()
-        rest.succeed("${pkgs.curl}/bin/curl -sk -H X-SLURM-USER-TOKEN:%s -X GET 'http://localhost:6820/slurm/v0.0.43/diag'" % token)
+        rest.wait_for_open_port(6820)
+
+        token = control.succeed("scontrol token").split('=', 1)[1].strip()
+
+        rest.succeed(
+            "${pkgs.curl}/bin/curl -fsS "
+            "-H X-SLURM-USER-TOKEN:%s "
+            "http://localhost:6820/slurm/v0.0.43/diag | grep -q 'meta'" % token
+        )
+
+    with subtest("rest_rejects_invalid_token"):
+        rest.fail(
+            "${pkgs.curl}/bin/curl -fsS "
+            "-H X-SLURM-USER-TOKEN:not-a-real-token "
+            "http://localhost:6820/slurm/v0.0.43/diag"
+        )
   '';
 }

From 355908755a54d1f0c7311284185fcc5b60fb5f68 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 5 Jan 2026 09:57:43 +0100
Subject: [PATCH 016/110] nixos/network-interfaces: remove network-setup

This change solves some big design flaws in the scripted networking
backend.

1. When the module was reworked in 072c1dcc4a31 to use the new systemd
  targets, network-setup.service was used to:

  a. order the services and link network.target to the boot sequence

  b. perform some perform final network configuration, specifically
     setting the default gateways and nameservers (/etc/resolv.conf).

  Later (ec00b4bb1186) however, network-setup.service was made
  optional: if resolvconf is not used and a default gateway is not set,
  the service is not be defined (because it would result in an empty
  script). Doing so, however, has the unintended effect of unlinking
  network.target from multi-uset.target, meaning no network
  configuration at all is performed.

  Note: this can be easily seen by adding `networking.resolvconf.enable
  = false` to the nixosTests.networking.scripted.static test.

2. The network-addresses-*.service are linked to network.target, which,
   in turn, is linked to multi-uset.target. This means that if a
   hardware interface is not found, the boot will hang until this
   service times out (issue #154737).

To solve issue 1. this change removes network-target entirely while

  - moving the default gateway setup into the relative
    network-addresses-*.service unit;

  - moving the nameservers setup into networking.localCommands;
    (incidentally, this also fixes issue #445496)

  - directly linking network.target to multi-user.target.

To solve issue 2. this removes the Wants=network.target dependency of
network-addresses-*.service and solely relies on the underlying
interface unit (*-netdev.service for virtual, *.device for physical) to
start the service.

Note: for NixOS containers, the dependency is kept, because the .device
unit are not available in this case.

Finally, if an interface is the default gateway, network-online.target
is added as an extra dependency, so the target is not reached until the
interface has been plugged in and configured.
---
 .../tasks/network-interfaces-scripted.nix     | 290 +++++++++---------
 nixos/modules/tasks/network-interfaces.nix    |  21 +-
 .../networking/networkd-and-scripted.nix      |  47 ++-
 3 files changed, 212 insertions(+), 146 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 4b457e078e77..fe6f6e5a1cb8 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -51,6 +51,71 @@ let
       (lib.concatStringsSep " ")
     ];
 
+  # Converts an IPv4 address literal to a list of bits
+  parseAddr.ipv4 =
+    addr:
+    let
+      pad = b: lib.replicate (8 - builtins.length b) 0 ++ b;
+      toBin = n: pad (lib.toBaseDigits 2 (lib.toInt n));
+    in
+    lib.concatMap toBin (builtins.splitVersion addr);
+
+  # Converts an IPv6 address literal to a list of bits
+  parseAddr.ipv6 =
+    addr:
+    let
+      pad = b: lib.replicate (16 - builtins.length b) 0 ++ b;
+      fromHex = n: (builtins.fromTOML "n = 0x${n}").n;
+      toBin = n: pad (lib.toBaseDigits 2 (fromHex n));
+      normal = (lib.network.ipv6.fromString addr).address;
+    in
+    lib.concatMap toBin (lib.splitString ":" normal);
+
+  # Checks if `addr` is part of the `net` subnet
+  inSubnet =
+    v: net: addr:
+    let
+      prefix = lib.take net.prefixLength (parseAddr.${v} net.address);
+      match = lib.zipListsWith (a: b: a == b) prefix (parseAddr.${v} addr);
+    in
+    lib.all lib.id match;
+
+  # Checks if the netmask of all addresses on interface `iface` includes
+  # the IP address of `gateway`
+  #
+  # Note: this is used to check whether networking.defaultGateway relies on
+  # the given interface, either explicitly, via the `interface` (optional),
+  # or explicitly, by using an address in a subnet of this interface.
+  #
+  # Configuration of the default gateway is then performed as part of that
+  # interface setup in `configureAddrs`, below.
+  isGateway =
+    v: gateway: iface:
+    lib.any lib.id (
+      [ (iface.name == gateway.interface) ]
+      ++ map (net: inSubnet v net gateway.address) iface.${v}.addresses
+    );
+
+  # Checks if `gateway` uses an address from `iface` as default source
+  #
+  # Note: this is needed to delay the configuration of the gateway and default
+  # source until the right interfaces and address have been set up, otherwise
+  # the commands will fail.
+  hasSource =
+    v: gateway: iface:
+    builtins.elem gateway.source (map (i: i.address) iface.${v}.addresses);
+
+  # Interfaces corresponding to the default gateways
+  gateway4Iface = builtins.filter (isGateway "ipv4" cfg.defaultGateway) interfaces;
+  gateway6Iface = builtins.filter (isGateway "ipv6" cfg.defaultGateway6) interfaces;
+
+  # Interfaces corresponding to the default source addresses
+  #
+  # Note: the use of `head` here is safe because these expressions
+  # are evaluated only when `needsSourceIface`, see `configureAddrs` below.
+  source4Iface = builtins.head (builtins.filter (hasSource "ipv4" cfg.defaultGateway) interfaces);
+  source6Iface = builtins.head (builtins.filter (hasSource "ipv6" cfg.defaultGateway6) interfaces);
+
   # warn that these attributes are deprecated (2017-2-2)
   # Should be removed in the release after next
   bondDeprecation = rec {
@@ -118,121 +183,70 @@ let
           else
             optional (!config.boot.isContainer) (subsystemDevice dev);
 
-        hasDefaultGatewaySet =
-          (cfg.defaultGateway != null && cfg.defaultGateway.address != "")
-          || (cfg.enableIPv6 && cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "");
-
-        needNetworkSetup =
-          cfg.resolvconf.enable || cfg.defaultGateway != null || cfg.defaultGateway6 != null;
-
-        networkLocalCommands = lib.mkIf needNetworkSetup {
-          after = [ "network-setup.service" ];
-          bindsTo = [ "network-setup.service" ];
-        };
-
-        networkSetup = lib.mkIf needNetworkSetup {
-          description = "Networking Setup";
-
-          after = [ "network-pre.target" ];
-          before = [
-            "network.target"
-            "shutdown.target"
-          ];
-          wants = [ "network.target" ];
-          # exclude bridges from the partOf relationship to fix container networking bug #47210
-          partOf = map (i: "network-addresses-${i.name}.service") (
-            filter (i: !(hasAttr i.name cfg.bridges)) interfaces
-          );
-          conflicts = [ "shutdown.target" ];
-          wantedBy = [ "multi-user.target" ] ++ optional hasDefaultGatewaySet "network-online.target";
-
-          unitConfig.ConditionCapability = "CAP_NET_ADMIN";
-
-          path = [ pkgs.iproute2 ];
-
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-          };
-
-          unitConfig.DefaultDependencies = false;
-
-          script = ''
-            ${optionalString config.networking.resolvconf.enable ''
-              # Set the static DNS configuration, if given.
-              ${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
-              ${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
-                domain ${cfg.domain}
-              ''}
-              ${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
-              ${flip concatMapStrings cfg.nameservers (ns: ''
-                nameserver ${ns}
-              '')}
-              EOF
-            ''}
-
-            # Set the default gateway
-            ${flip concatMapStrings
-              [
-                {
-                  version = "-4";
-                  gateway = cfg.defaultGateway;
-                }
-                {
-                  version = "-6";
-                  gateway = cfg.defaultGateway6;
-                }
-              ]
-              (
-                { version, gateway }:
-                optionalString (gateway != null && gateway.address != "") ''
-                  ${optionalString (gateway.interface != null) ''
-                    ip ${version} route replace ${gateway.address} proto static ${
-                      formatIpArgs {
-                        metric = gateway.metric;
-                        dev = gateway.interface;
-                      }
-                    }
-                  ''}
-                  ip ${version} route replace default proto static ${
-                    formatIpArgs {
-                      metric = gateway.metric;
-                      via = gateway.address;
-                      window = cfg.defaultGatewayWindowSize;
-                      dev = gateway.interface;
-                      src = gateway.source;
-                    }
-                  }
-                ''
-              )
-            }
-          '';
-        };
-
-        # For each interface <foo>, create a job ‘network-addresses-<foo>.service"
-        # that performs static address configuration.  It has a "wants"
-        # dependency on ‘<foo>.service’, which is supposed to create
-        # the interface and need not exist (i.e. for hardware
-        # interfaces).  It has a binds-to dependency on the actual
-        # network device, so it only gets started after the interface
-        # has appeared, and it's stopped when the interface
-        # disappears.
+        # For each interface <foo>, creates a network-addresses-<foo>.service
+        # job that performs static address configuration.
+        #
+        # It has a Wants dependency on <foo>-netdev.service, which creates
+        # create the interface, or on a device unit (for hardware interfaces).
+        # It also has a BindsTo dependency on the device unit: so, it only gets
+        # started after the interface has appeared and it's stopped when the
+        # interface disappears.
+        #
+        # Unless in a container, the job is not made part of network.target, so
+        # if an interface is not found (e.g. a USB interface not plugged in) it
+        # will not hang the boot sequence.
+        #
+        # If the interface is the default gateway, the job will also set the
+        # default gateway and delay network-online.target.
         configureAddrs =
           i:
           let
             ips = interfaceIps i;
+            isDefaultGateway4 = cfg.defaultGateway != null && builtins.elem i gateway4Iface;
+            isDefaultGateway6 = cfg.defaultGateway6 != null && builtins.elem i gateway6Iface;
+            needsSourceIface4 =
+              isDefaultGateway4 && cfg.defaultGateway.source != null && i.name != source4Iface.name;
+            needsSourceIface6 =
+              isDefaultGateway6 && cfg.defaultGateway6.source != null && i.name != source6Iface.name;
+
+            configureGateway =
+              version: gateway:
+              optionalString (gateway.address != "") ''
+                echo -n "setting ${i.name} as default IPv${version} gateway... "
+                ${optionalString (gateway.interface != null) ''
+                  ip -${version} route replace ${gateway.address} proto static ${
+                    formatIpArgs {
+                      metric = gateway.metric;
+                      dev = gateway.interface;
+                    }
+                  }
+                ''}
+                ip -${version} route replace default proto static ${
+                  formatIpArgs {
+                    metric = gateway.metric;
+                    via = gateway.address;
+                    window = cfg.defaultGatewayWindowSize;
+                    dev = gateway.interface;
+                    src = gateway.source;
+                  }
+                }
+                echo "done"
+              '';
           in
           nameValuePair "network-addresses-${i.name}" {
             description = "Address configuration of ${i.name}";
-            wantedBy = [
-              "network-setup.service"
-              "network.target"
-            ];
-            # order before network-setup because the routes that are configured
-            # there may need ip addresses configured
-            before = [ "network-setup.service" ];
+
+            wantedBy =
+              deviceDependency i.name
+              ++ optional config.boot.isContainer "network.target"
+              ++ optional (isDefaultGateway4 || isDefaultGateway6) "network-online.target";
             bindsTo = deviceDependency i.name;
-            after = [ "network-pre.target" ] ++ (deviceDependency i.name);
+            after = [
+              "network-pre.target"
+            ]
+            ++ optional needsSourceIface4 "network-addresses-${source4Iface.name}.service"
+            ++ optional needsSourceIface6 "network-addresses-${source6Iface.name}.service"
+            ++ deviceDependency i.name;
             serviceConfig.Type = "oneshot";
             serviceConfig.RemainAfterExit = true;
             # Restart rather than stop+start this unit to prevent the
@@ -284,6 +298,10 @@ let
                   fi
                 ''
               )}
+
+              # Set the default gateway
+              ${optionalString isDefaultGateway4 (configureGateway "4" cfg.defaultGateway)}
+              ${optionalString isDefaultGateway6 (configureGateway "6" cfg.defaultGateway6)}
             '';
             preStop = ''
               state="/run/nixos/network/routes/${i.name}"
@@ -314,10 +332,9 @@ let
             after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
             wantedBy = [
               "network.target"
-              "network-setup.service"
               (subsystemDevice i.name)
             ];
-            before = [ "network-setup.service" ];
+            before = [ "network.target" ];
             path = [ pkgs.iproute2 ];
             serviceConfig = {
               Type = "oneshot";
@@ -343,18 +360,18 @@ let
               description = "Bridge Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps ++ optional v.rstp "mstpd.service";
-              partOf = [ "network-setup.service" ] ++ optional v.rstp "mstpd.service";
+              partOf = [ "network.target" ]
+              ++ optional v.rstp "mstpd.service";
               after = [
                 "network-pre.target"
               ]
               ++ deps
               ++ optional v.rstp "mstpd.service"
               ++ map (i: "network-addresses-${i}.service") v.interfaces;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -448,15 +465,11 @@ let
               description = "Open vSwitch Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ]
               ++ internalConfigs;
-              # before = [ "network-setup.service" ];
-              # should work without internalConfigs dependencies because address/link configuration depends
-              # on the device, which is created by ovs-vswitchd with type=internal, but it does not...
-              before = [ "network-setup.service" ] ++ internalConfigs;
-              partOf = [ "network-setup.service" ]; # shutdown the bridge when network is shutdown
+              before = [ "network.target" ] ++ internalConfigs;
+              partOf = [ "network.target" ]; # shutdown the bridge when network is shutdown
               bindsTo = [ "ovs-vswitchd.service" ]; # requires ovs-vswitchd to be alive at all times
               after = [
                 "network-pre.target"
@@ -521,12 +534,11 @@ let
               description = "Bond Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps ++ map (i: "network-addresses-${i}.service") v.interfaces;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [
@@ -570,12 +582,11 @@ let
               description = "MACVLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -602,12 +613,12 @@ let
               description = "IPVLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -647,12 +658,11 @@ let
               description = "FOU endpoint ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -677,12 +687,11 @@ let
               description = "IPv6 in IPv4 Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -720,12 +729,11 @@ let
               description = "IP in IP Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -768,12 +776,11 @@ let
               description = "GRE Tunnel Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -803,13 +810,12 @@ let
               description = "VLAN Interface ${n}";
               wantedBy = [
                 "network.target"
-                "network-setup.service"
                 (subsystemDevice n)
               ];
               bindsTo = deps;
-              partOf = [ "network-setup.service" ];
+              partOf = [ "network.target" ];
               after = [ "network-pre.target" ] ++ deps;
-              before = [ "network-setup.service" ];
+              before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
               serviceConfig.RemainAfterExit = true;
               path = [ pkgs.iproute2 ];
@@ -845,10 +851,20 @@ let
       // mapAttrs' createGreDevice cfg.greTunnels
       // mapAttrs' createVlanDevice cfg.vlans
       // {
-        network-setup = networkSetup;
-        network-local-commands = networkLocalCommands;
+        network-local-commands = {
+          after = [ "network-pre.target" ];
+          wantedBy = [ "network.target" ];
+        };
       };
 
+    # Note: the scripted networking backend consistent of many
+    # independent services that are linked to the network.target.
+    # Since there is no daemon (e.g systemd-networkd) that is
+    # started as part of the system and pulls in network.target.
+    # Thus, to start these services we link network.target directly
+    # to multi-user.target, this has the same result.
+    systemd.targets.network.wantedBy = [ "multi-user.target" ];
+
     services.udev.extraRules = ''
       KERNEL=="tun", TAG+="systemd"
     '';
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 83d60ba80e40..d0fe0ed8443f 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -747,10 +747,9 @@ in
       default = "";
       example = "text=anything; echo You can put $text here.";
       description = ''
-        Shell commands to be executed at the end of the
-        `network-setup` systemd service.  Note that if
-        you are using DHCP to obtain the network configuration,
-        interfaces may not be fully configured yet.
+        Shell commands to be executed after all the network
+        interfaces have been created, but not necessarily
+        fully configured.
       '';
     };
 
@@ -1851,6 +1850,20 @@ in
         '';
       };
     };
+
+    networking.localCommands = lib.mkIf config.networking.resolvconf.enable ''
+      # Set the static DNS configuration, if given.
+      ${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
+      ${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
+        domain ${cfg.domain}
+      ''}
+      ${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
+      ${flip concatMapStrings cfg.nameservers (ns: ''
+        nameserver ${ns}
+      '')}
+      EOF
+    '';
+
     services.mstpd = mkIf needsMstpd { enable = true; };
 
     virtualisation.vswitch = mkIf (cfg.vswitches != { }) { enable = true; };
diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index 99e67649ceb3..d620e9b230fb 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -44,17 +44,13 @@ let
           defaultGateway6 = {
             address = "fd00:1234:5678:1::1";
             interface = "enp1s0";
-            source = "fd00:1234:5678:1::3";
+            source = "fd00:1234:5678:1::3"; # implicit dependency on enp2s0
           };
           interfaces.enp1s0.ipv6.addresses = [
             {
               address = "fd00:1234:5678:1::2";
               prefixLength = 64;
             }
-            {
-              address = "fd00:1234:5678:1::3";
-              prefixLength = 128;
-            }
           ];
           interfaces.enp1s0.ipv4.addresses = [
             {
@@ -76,6 +72,12 @@ let
               prefixLength = 24;
             }
           ];
+          interfaces.enp2s0.ipv6.addresses = [
+            {
+              address = "fd00:1234:5678:1::3";
+              prefixLength = 128;
+            }
+          ];
         };
       };
       testScript = ''
@@ -108,6 +110,41 @@ let
             client.succeed("ip -6 route show default | grep -q 'src fd00:1234:5678:1::3'")
       '';
     };
+    dynamicInterface = {
+      name = "dynamicInterface";
+      nodes.machine = clientConfig {
+        networking.interfaces.usb0 = {
+          ipv6.addresses = lib.singleton {
+            address = "fd::1";
+            prefixLength = 127;
+          };
+        };
+        networking.defaultGateway6 = {
+          address = "fd::";
+          interface = "usb0";
+          source = "fd::1";
+        };
+      };
+      testScript = ''
+        with subtest("Network comes up without usb0"):
+          machine.wait_for_unit("network.target")
+
+        with subtest("multi-user.target does not hang"):
+          machine.require_unit_state("multi-user.target", "active")
+
+        with subtest("usb0 is configured when plugged in"):
+          machine.succeed("ip link add usb0 type sit local 1.2.3.4")
+          machine.wait_until_succeeds("ip addr show dev usb0 | grep -q fd::1")
+
+        with subtest("Network is now online"):
+          machine.systemctl("start network-online.target")
+          machine.require_unit_state("network-online.target", "active")
+
+        with subtest("Default gateway is now set"):
+          machine.succeed("ip -6 route show default | grep -q 'via fd::'")
+          machine.succeed("ip -6 route show default | grep -q 'src fd::1'")
+      '';
+    };
     routeType = {
       name = "RouteType";
       nodes.client = clientConfig {

From 65c1c008f252bc3ac4c233262c30d3cf5f000034 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 21 Jan 2026 00:49:00 +0100
Subject: [PATCH 017/110] nixos/networking-interfaces: add
 networking-scripted.target

This adds a target that groups together all the services of the
scripted backend. It has no role during the boot, but provides
a quick way to reset the network configuration.

For example, if addresses/routes are added/removed or an interface has
been stopped manually, running

  systemctl restart networking-scripted.target

will undo all the changes.
---
 .../tasks/network-interfaces-scripted.nix     | 29 +++++++++++++++++--
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index fe6f6e5a1cb8..4bf274d4157f 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -241,6 +241,7 @@ let
               ++ optional config.boot.isContainer "network.target"
               ++ optional (isDefaultGateway4 || isDefaultGateway6) "network-online.target";
             bindsTo = deviceDependency i.name;
+            partOf = [ "networking-scripted.target" ];
             after = [
               "network-pre.target"
             ]
@@ -329,6 +330,7 @@ let
           nameValuePair "${i.name}-netdev" {
             description = "Virtual Network Interface ${i.name}";
             bindsTo = optional (!config.boot.isContainer) "dev-net-tun.device";
+            partOf = [ "networking-scripted.target" ];
             after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
             wantedBy = [
               "network.target"
@@ -363,7 +365,10 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps ++ optional v.rstp "mstpd.service";
-              partOf = [ "network.target" ]
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ]
               ++ optional v.rstp "mstpd.service";
               after = [
                 "network-pre.target"
@@ -469,7 +474,10 @@ let
               ]
               ++ internalConfigs;
               before = [ "network.target" ] ++ internalConfigs;
-              partOf = [ "network.target" ]; # shutdown the bridge when network is shutdown
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ]; # shutdown the bridge when network is shutdown
               bindsTo = [ "ovs-vswitchd.service" ]; # requires ovs-vswitchd to be alive at all times
               after = [
                 "network-pre.target"
@@ -537,6 +545,7 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps ++ map (i: "network-addresses-${i}.service") v.interfaces;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -585,6 +594,7 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -661,6 +671,7 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -732,6 +743,7 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -779,6 +791,7 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
+              partOf = [ "networking-scripted.target" ];
               after = [ "network-pre.target" ] ++ deps;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -813,7 +826,10 @@ let
                 (subsystemDevice n)
               ];
               bindsTo = deps;
-              partOf = [ "network.target" ];
+              partOf = [
+                "network.target"
+                "networking-scripted.target"
+              ];
               after = [ "network-pre.target" ] ++ deps;
               before = [ "network.target" ];
               serviceConfig.Type = "oneshot";
@@ -865,6 +881,13 @@ let
     # to multi-user.target, this has the same result.
     systemd.targets.network.wantedBy = [ "multi-user.target" ];
 
+    # This target serves no purpose during the boot, but can be
+    # used to quickly reset the network configuration by running
+    # systemctl restart networking-scripted.target
+    systemd.targets.networking-scripted = {
+      description = "NixOS scripted networking setup";
+    };
+
     services.udev.extraRules = ''
       KERNEL=="tun", TAG+="systemd"
     '';

From 8bc8c596ead9703f76af1f65a62f3e31560b0f1e Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Tue, 6 Jan 2026 00:47:45 +0100
Subject: [PATCH 018/110] nixos/doc: update networking chapter

---
 .../ad-hoc-network-config.section.md          | 20 ++++++++++++++-----
 .../configuration/ipv4-config.section.md      | 13 +++++++++---
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/nixos/doc/manual/configuration/ad-hoc-network-config.section.md b/nixos/doc/manual/configuration/ad-hoc-network-config.section.md
index 7ef24825526d..611f3e3956ee 100644
--- a/nixos/doc/manual/configuration/ad-hoc-network-config.section.md
+++ b/nixos/doc/manual/configuration/ad-hoc-network-config.section.md
@@ -1,14 +1,24 @@
 # Ad-Hoc Configuration {#ad-hoc-network-config}
 
-You can use [](#opt-networking.localCommands) to
-specify shell commands to be run at the end of `network-setup.service`. This
-is useful for doing network configuration not covered by the existing NixOS
-modules. For instance, to statically configure an IPv6 address:
+You can use [](#opt-networking.localCommands) to specify shell commands to be
+run after the network interfaces have been created, but not necessarily fully
+configured.
+This is useful for doing network configuration not covered by the existing
+NixOS modules. For example, you can create a network namespace and a pair
+of virtual ethernet devices like this:
 
 ```nix
 {
   networking.localCommands = ''
-    ip -6 addr add 2001:610:685:1::1/64 dev eth0
+    ip netns add mynet
+    ip link add name veth-in type veth peer name veth-out
+    ip link set dev veth-out netns mynet
   '';
 }
 ```
+
+::: {.note}
+The commands should ideally be idempotent, so it's recommended to perform
+cleanups of the state you create (e.g. virtual interfaces), or at least make
+sure possible failures are handled.
+:::
diff --git a/nixos/doc/manual/configuration/ipv4-config.section.md b/nixos/doc/manual/configuration/ipv4-config.section.md
index ed0db9da8c3e..ceb9a350b680 100644
--- a/nixos/doc/manual/configuration/ipv4-config.section.md
+++ b/nixos/doc/manual/configuration/ipv4-config.section.md
@@ -26,9 +26,16 @@ servers:
 ```
 
 ::: {.note}
-Statically configured interfaces are set up by the systemd service
-`interface-name-cfg.service`. The default gateway and name server
-configuration is performed by `network-setup.service`.
+Addresses and routes for statically configured interfaces and the default
+gateway are set up by systemd services named
+`network-addresses-<interface>.service`. The name servers configuration,
+instead, is performed by `network-local-commands.service` using resolvconf.
+:::
+
+::: {.note}
+If needed, for example if addresses/routes were added/removed,
+you can reset the network configuration by running
+`systemctl restart networking-scripted.target`
 :::
 
 The host name is set using [](#opt-networking.hostName):

From 1623fe233169fc86917ee79b23710eaa6695d109 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sat, 14 Mar 2026 14:50:00 +0100
Subject: [PATCH 019/110] nixos/release-notes: explain network-interfaces
 changes

---
 nixos/doc/manual/release-notes/rl-2605.section.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index b6df37e26327..a98528159278 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -178,6 +178,13 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
   Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on `networking.wireless`. So, if you had `networking.wireless.enable = false` in your configuration, you should remove that line.
 
+- Some implementation details of the NixOS network-interfaces module have been changed:
+
+  - In the "scripted" backend, `network-setup.service` has been removed and the network configuration services are now part of `network.target`, which is now directly pulled into `multi-user.target`.
+  - Interface addresses, routes and default gateways are now configured asynchronously as soon as the underlying network devices become available (fixes issue [#154737](https://github.com/NixOS/nixpkgs/issues/154737)).
+  - In both "networkd" and "scripted" backends, the configuration of name servers is now part of `network-local-commands.service` (fixes issue [#445496](https://github.com/NixOS/nixpkgs/issues/445496)).
+  - The issue that resulted in a completely unconfigured network if both `resolvconf` was disabled and no default gateway configured, has also been fixed.
+
 - `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
 
   - The `migrate sql` CLI command is now `migrate sql up`

From 63cf11f9969f798e7dd9ad0ab2f7593c129e3d7b Mon Sep 17 00:00:00 2001
From: znaniye <zn4niye@proton.me>
Date: Tue, 18 Nov 2025 12:48:48 -0300
Subject: [PATCH 020/110] openfreebuds: relax all deps, add tests

- Set pythonRelaxDeps to true
- Add upstream test suite (battery, config, gestures, low_latency, event_bus)
---
 pkgs/by-name/op/openfreebuds/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openfreebuds/package.nix b/pkgs/by-name/op/openfreebuds/package.nix
index 54ef895ed4dc..f8c259042295 100644
--- a/pkgs/by-name/op/openfreebuds/package.nix
+++ b/pkgs/by-name/op/openfreebuds/package.nix
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   pyproject = true;
 
-  pythonRelaxDeps = [ "psutil" ];
+  pythonRelaxDeps = true;
 
   build-system = with python3Packages; [
     pdm-backend
@@ -33,6 +33,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   buildInputs = [ qt6.qtbase ];
 
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "openfreebuds/driver/huawei/test/"
+    "openfreebuds/test/test_event_bus.py"
+  ];
+
   dependencies = with python3Packages; [
     aiocmd
     aiohttp

From c9994406a8c9fbca30203bb29a22917dc23c97ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment?= <git@drawbu.dev>
Date: Fri, 20 Mar 2026 10:54:45 -0700
Subject: [PATCH 021/110] python3Packages.podcats: fix build failure

the package has been updated to v0.6.x in e007b522b8e9b2770289b501b5c5b5f6ecc1964e.

the patch should have been updated to substitute in podcats/__init__.py,
as it was interacting with a moved file, and the dependency `humanize`
was also missing.

i am not sure why the patch was even needed, so I just removed it.
---
 pkgs/development/python-modules/podcats/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/podcats/default.nix b/pkgs/development/python-modules/podcats/default.nix
index 6f2ed525f0e5..30a68cafde42 100644
--- a/pkgs/development/python-modules/podcats/default.nix
+++ b/pkgs/development/python-modules/podcats/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   setuptools,
   flask,
+  humanize,
   mutagen,
 }:
 
@@ -19,15 +20,11 @@ buildPythonPackage rec {
     sha256 = "sha256-1Jg9bR/3qMim3q5qVwUVbxeLNaXaCU6SplBUaRXeLpo=";
   };
 
-  postPatch = ''
-    substituteInPlace podcats.py \
-      --replace-fail 'debug=True' 'debug=True, use_reloader=False'
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [
     flask
+    humanize
     mutagen
   ];
 

From a57bd118815002792c2c9cd54ac811b17af6c0c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment?= <git@drawbu.dev>
Date: Fri, 20 Mar 2026 11:00:33 -0700
Subject: [PATCH 022/110] python3Packages.podcats: adopt

---
 pkgs/development/python-modules/podcats/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/podcats/default.nix b/pkgs/development/python-modules/podcats/default.nix
index 30a68cafde42..64e9c11c9859 100644
--- a/pkgs/development/python-modules/podcats/default.nix
+++ b/pkgs/development/python-modules/podcats/default.nix
@@ -33,5 +33,6 @@ buildPythonPackage rec {
     mainProgram = "podcats";
     homepage = "https://github.com/jakubroztocil/podcats";
     license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ drawbu ];
   };
 }

From 10183441d061a972f33975746fc78f49d439eaa6 Mon Sep 17 00:00:00 2001
From: Nicolas Dumazet <nicdumz.commits@gmail.com>
Date: Tue, 17 Mar 2026 21:27:53 +0100
Subject: [PATCH 023/110] nixos/grocy: enforce data directory presence

In the case of mounted directories, systemd needs to know that this
script depends on this path to add the adequate dependency.
---
 nixos/modules/services/web-apps/grocy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index d6095b50fa8a..8106cc06fd2b 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -216,6 +216,7 @@ in
     systemd.services.grocy-setup = {
       wantedBy = [ "multi-user.target" ];
       before = [ "phpfpm-grocy.service" ];
+      unitConfig.RequiresMountsFor = [ cfg.dataDir ];
       script = ''
         rm -rf ${cfg.dataDir}/viewcache/*
       '';

From 5779cdd617242f29d5a2c2a02290660451df5656 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Mon, 23 Mar 2026 13:27:30 +0100
Subject: [PATCH 024/110] lomiri.geonames: 0.3.1 -> 0.3.2

---
 .../1001-geonames-cmake4-compat.patch         | 37 -------------------
 .../lomiri/development/geonames/default.nix   | 20 +++++-----
 2 files changed, 9 insertions(+), 48 deletions(-)
 delete mode 100644 pkgs/desktops/lomiri/development/geonames/1001-geonames-cmake4-compat.patch

diff --git a/pkgs/desktops/lomiri/development/geonames/1001-geonames-cmake4-compat.patch b/pkgs/desktops/lomiri/development/geonames/1001-geonames-cmake4-compat.patch
deleted file mode 100644
index e338b8824a9d..000000000000
--- a/pkgs/desktops/lomiri/development/geonames/1001-geonames-cmake4-compat.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 3dea0cc91b579de5e2c9db811f2e9e34079d3733 Mon Sep 17 00:00:00 2001
-From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
-Date: Mon, 1 Sep 2025 13:22:26 +0200
-Subject: [PATCH] {CMakeLists.txt,cmake/GtkDocScanGObjWrapper.cmake}: Bump
- cmake_minimum_required() to version 3.10.
-
----
- CMakeLists.txt                    | 2 +-
- cmake/GtkDocScanGObjWrapper.cmake | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 5fbff8a..e7b863e 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,4 +1,4 @@
--cmake_minimum_required(VERSION 3.0)
-+cmake_minimum_required(VERSION 3.10)
- project(geonames VERSION 0.3.1 LANGUAGES C)
- 
- include(GNUInstallDirs)
-diff --git a/cmake/GtkDocScanGObjWrapper.cmake b/cmake/GtkDocScanGObjWrapper.cmake
-index b187ebb..b026ed0 100644
---- a/cmake/GtkDocScanGObjWrapper.cmake
-+++ b/cmake/GtkDocScanGObjWrapper.cmake
-@@ -20,7 +20,7 @@
- 
- # This is needed for find_package(PkgConfig) to work correctly --
- # CMAKE_MINIMUM_REQUIRED_VERSION needs to be defined.
--cmake_minimum_required(VERSION 3.2)
-+cmake_minimum_required(VERSION 3.10)
- 
- if(NOT APPLE)
-     # We use pkg-config to find glib et al
--- 
-GitLab
-
diff --git a/pkgs/desktops/lomiri/development/geonames/default.nix b/pkgs/desktops/lomiri/development/geonames/default.nix
index 879cfdcd5230..fee15718c8a8 100644
--- a/pkgs/desktops/lomiri/development/geonames/default.nix
+++ b/pkgs/desktops/lomiri/development/geonames/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geonames";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/geonames";
-    rev = finalAttrs.version;
-    hash = "sha256-AhRnUoku17kVY0UciHQXFDa6eCH6HQ4ZGIOobCaGTKQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-jXjhhCrY0tURd4N4D5weCJEckS5cctUfBgpGLTkC2cI=";
   };
 
   outputs = [
@@ -42,12 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     "devdoc"
   ];
 
-  patches = [
-    # Fix compat with CMake 4
-    # Remove when https://gitlab.com/ubports/development/core/geonames/-/merge_requests/4 merged & in release
-    ./1001-geonames-cmake4-compat.patch
-  ];
-
   postPatch = ''
     patchShebangs src/generate-locales.sh tests/setup-test-env.sh
   '';
@@ -105,7 +99,10 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   passthru = {
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
     updateScript = gitUpdater { };
   };
 
@@ -120,7 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Cross requires hostPlatform emulation during build
     # https://gitlab.com/ubports/development/core/geonames/-/issues/1
     broken =
-      stdenv.buildPlatform != stdenv.hostPlatform && !stdenv.hostPlatform.emulatorAvailable buildPackages;
+      !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
+      && !stdenv.hostPlatform.emulatorAvailable buildPackages;
     pkgConfigModules = [
       "geonames"
     ];

From 6ffb2e7e2015d681d4457cda0a267121ab5ce2b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 15:09:05 +0000
Subject: [PATCH 025/110] libiscsi: 1.20.0 -> 1.20.3

---
 pkgs/by-name/li/libiscsi/package.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libiscsi/package.nix b/pkgs/by-name/li/libiscsi/package.nix
index 7b8f5d74aea0..b6d93ee53bb2 100644
--- a/pkgs/by-name/li/libiscsi/package.nix
+++ b/pkgs/by-name/li/libiscsi/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libiscsi";
-  version = "1.20.0";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "sahlberg";
     repo = "libiscsi";
     rev = finalAttrs.version;
-    sha256 = "sha256-idiK9JowKhGAk5F5qJ57X14Q2Y0TbIKRI02onzLPkas=";
+    sha256 = "sha256-ARajWZ5/LIfFNCdp3HvQiyhR455+sJNzUPbBrz/pZ7E=";
   };
 
   postPatch = ''
@@ -24,8 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ autoreconfHook ];
 
   env = lib.optionalAttrs (stdenv.hostPlatform.is32bit || stdenv.hostPlatform.isDarwin) {
-    # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
-    NIX_CFLAGS_COMPILE = "-Wno-error=format";
+    NIX_CFLAGS_COMPILE = toString [
+      # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
+      "-Wno-error=format"
+      # multithreading.c:257:16: error: 'sem_init' is deprecated [-Werror,-Wdeprecated-declarations]
+      "-Wno-error=deprecated-declarations"
+      # scsi-lowlevel.c:1244:11: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'uint16_t *' (aka 'unsigned short *') increases required alignment from 1 to 2 [-Werror,-Wcast-align]
+      "-Wno-error=cast-align"
+    ];
   };
 
   meta = {

From 5e054878a16186c1a7bb10815efca72ce68f1c93 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 23 Mar 2026 18:45:45 +0000
Subject: [PATCH 026/110] tree-sitter-grammars.tree-sitter-heex: 0.8.0 -> 0.9.0

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 8d1e6f580439..de9c84ff8ea7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1052,9 +1052,9 @@
   };
 
   heex = {
-    version = "0.8.0";
+    version = "0.9.0";
     url = "github:phoenixframework/tree-sitter-heex";
-    hash = "sha256-rifYGyIpB14VfcEZrmRwYSz+ZcajQcB4mCjXnXuVFDQ=";
+    hash = "sha256-1p2drpkA+5o+WSH5cv+zPVx30lNhQ9bqX5JHA0YSS2Y=";
     meta = {
       license = lib.licenses.mit;
     };

From 8dbcb7f0b532bf0c875d2dafb1ac46f4ed8cb69f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 24 Mar 2026 09:00:29 +0000
Subject: [PATCH 027/110] klipper: 0.13.0-unstable-2026-03-09 ->
 0.13.0-unstable-2026-03-21

---
 pkgs/servers/klipper/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index a8bdd12a4cc8..a0af8d52230e 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "0.13.0-unstable-2026-03-09";
+  version = "0.13.0-unstable-2026-03-21";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "644cda5ecaa39d0dcf797624c19d5425cb8121ec";
-    sha256 = "sha256-ono0+6pyjJDexaDOH/vYNFNyh636iNfjBMxmWNbgVik=";
+    rev = "594ec7e1205450ff0753d19f0724bbe8b380465d";
+    sha256 = "sha256-a496Ayas2IsP3K320EXc/7VDAtrqUzF8OaKNKBWf8lQ=";
   };
 
   sourceRoot = "${src.name}/klippy";

From ccdcdd7cb6d70c998805f7bf0841328c6b346902 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Tue, 24 Mar 2026 14:56:56 +0100
Subject: [PATCH 028/110] nixos/test-driver: provide machines, machines_qemu,
 machines_nspawn to testScript

---
 nixos/lib/test-driver/src/test_driver/driver.py | 1 +
 nixos/lib/test-script-prepend.py                | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index 8cbcb052be49..a457f7ed1be3 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -228,6 +228,7 @@ class Driver:
         general_symbols = dict(
             start_all=self.start_all,
             test_script=self.test_script,
+            machines=self.machines,
             machines_qemu=self.machines_qemu,
             machines_nspawn=self.machines_nspawn,
             vlans=self.vlans,
diff --git a/nixos/lib/test-script-prepend.py b/nixos/lib/test-script-prepend.py
index b9a12d5f2f54..d4b6d612e410 100644
--- a/nixos/lib/test-script-prepend.py
+++ b/nixos/lib/test-script-prepend.py
@@ -45,6 +45,8 @@ subtest: Callable[[str], ContextManager[None]]
 retry: RetryProtocol
 test_script: Callable[[], None]
 machines: List[BaseMachine]
+machines_qemu: List[QemuMachine]
+machines_nspawn: List[NspawnMachine]
 vlans: List[VLan]
 driver: Driver
 log: AbstractLogger

From fd2eb432697f3cbb1aed941ca821753a1778584b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Tue, 24 Mar 2026 15:11:23 +0100
Subject: [PATCH 029/110] nixos/test-driver: provide QemuMachine, NspawnMachine
 types to testScript

---
 nixos/lib/test-driver/src/test_driver/driver.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index a457f7ed1be3..67c0172c3f5d 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -244,6 +244,8 @@ class Driver:
             serial_stdout_on=self.serial_stdout_on,
             polling_condition=self.polling_condition,
             BaseMachine=BaseMachine,  # for typing
+            QemuMachine=QemuMachine,  # for typing
+            NspawnMachine=NspawnMachine,  # for typing
             t=AssertionTester(),
             debug=self.debug,
         )

From 84fe17e86953dfb45b7b20b6eddc842fda562080 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Tue, 24 Mar 2026 15:37:39 +0100
Subject: [PATCH 030/110] nixos/tests: fix machine type hints

With the addition of test driver machines based on systemd-nspawn, the
`Machine` class was superseded by an abstract base class `BaseMachine`
and a subclass `QemuMachine` for conventional QEMU-based test nodes.

This commit fixes the usage of the `Machine` class in type annotations
across our tests. It also makes the tests use the more specific
`machines_qemu` variable if QEMU-specific features are required from the
machines. (`machines` provides only the methods shared by both
`NspawnMachine` and `Qemumachine`.)
---
 nixos/tests/garage/common.nix                    | 12 ++++++------
 nixos/tests/incus/incus_machine.py               |  2 +-
 nixos/tests/networking-proxy.nix                 |  2 +-
 nixos/tests/pacemaker.nix                        |  6 +++---
 .../tests/password-option-override-ordering.nix  | 16 ++++++++--------
 nixos/tests/rtkit.nix                            |  8 ++++----
 nixos/tests/systemd-journal-upload.nix           |  2 +-
 7 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/nixos/tests/garage/common.nix b/nixos/tests/garage/common.nix
index c8392eee6dba..5928cc3c55a6 100644
--- a/nixos/tests/garage/common.nix
+++ b/nixos/tests/garage/common.nix
@@ -21,14 +21,14 @@
          node_id: str
          host: str
 
-      def get_node_fqn(machine: Machine) -> GarageNode:
+      def get_node_fqn(machine: BaseMachine) -> GarageNode:
         node_id, host = machine.succeed("garage node id").split('@')
         return GarageNode(node_id=node_id, host=host)
 
-      def get_node_id(machine: Machine) -> str:
+      def get_node_id(machine: BaseMachine) -> str:
         return get_node_fqn(machine).node_id
 
-      def get_layout_version(machine: Machine) -> int:
+      def get_layout_version(machine: BaseMachine) -> int:
         version_data = machine.succeed("garage layout show")
         m = cur_version_regex.search(version_data)
         if m and m.group('ver') is not None:
@@ -36,17 +36,17 @@
         else:
           raise ValueError('Cannot find current layout version')
 
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
+      def apply_garage_layout(machine: BaseMachine, layouts: List[str]):
          for layout in layouts:
             machine.succeed(f"garage layout assign {layout}")
          version = get_layout_version(machine)
          machine.succeed(f"garage layout apply --version {version}")
 
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
+      def create_api_key(machine: BaseMachine, key_name: str) -> S3Key:
          output = machine.succeed(f"garage key create {key_name}")
          return parse_api_key_data(output)
 
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
+      def get_api_key(machine: BaseMachine, key_pattern: str) -> S3Key:
          output = machine.succeed(f"garage key info {key_pattern}")
          return parse_api_key_data(output)
 
diff --git a/nixos/tests/incus/incus_machine.py b/nixos/tests/incus/incus_machine.py
index c25a7804b871..eeeb0bdecf4c 100644
--- a/nixos/tests/incus/incus_machine.py
+++ b/nixos/tests/incus/incus_machine.py
@@ -1,7 +1,7 @@
 import json
 
 
-class IncusHost(Machine):
+class IncusHost(QemuMachine):
     def __init__(self, base):
         with subtest("Wait for startup"):
             base.wait_for_unit("incus.service")
diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix
index 2f8a64b5affa..ec784f2bd657 100644
--- a/nixos/tests/networking-proxy.nix
+++ b/nixos/tests/networking-proxy.nix
@@ -72,7 +72,7 @@ in
     from typing import Dict, Optional
 
 
-    def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
+    def get_machine_env(machine: BaseMachine, user: Optional[str] = None) -> Dict[str, str]:
         """
         Gets the environment from a given machine, and returns it as a
         dictionary in the form:
diff --git a/nixos/tests/pacemaker.nix b/nixos/tests/pacemaker.nix
index 826c4be7df14..8023d6f14bc8 100644
--- a/nixos/tests/pacemaker.nix
+++ b/nixos/tests/pacemaker.nix
@@ -86,7 +86,7 @@ rec {
         output = node1.succeed("crm_resource -r cat --locate")
         match = re.search("is running on: (.+)", output)
         if match:
-          for machine in machines:
+          for machine in machines_qemu:
             if machine.name == match.group(1):
               current_node = machine
           break
@@ -96,7 +96,7 @@ rec {
       current_node.crash()
 
       # pick another node that's still up
-      for machine in machines:
+      for machine in machines_qemu:
         if machine.booted:
           check_node = machine
       # find where the service has been started next
@@ -105,7 +105,7 @@ rec {
         match = re.search("is running on: (.+)", output)
         # output will remain the old current_node until the crash is detected by pacemaker
         if match and match.group(1) != current_node.name:
-          for machine in machines:
+          for machine in machines_qemu:
             if machine.name == match.group(1):
               next_node = machine
           break
diff --git a/nixos/tests/password-option-override-ordering.nix b/nixos/tests/password-option-override-ordering.nix
index caa0246735ca..71c449064a0b 100644
--- a/nixos/tests/password-option-override-ordering.nix
+++ b/nixos/tests/password-option-override-ordering.nix
@@ -112,22 +112,22 @@ in
       assert stored_hash == pass_hash, f"{username} user password does not match"
 
     with subtest("alice user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         assert_password_sha512crypt_match(machine, "alice", "${password1}")
         assert "${hashed_sha512crypt}" not in machine.succeed("getent shadow alice"), f"{machine}: alice user password is not correct"
 
     with subtest("bob user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow bob"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow bob"), f"{machine}: bob user password is not correct"
 
     with subtest("cat user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow cat"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow cat"), f"{machine}: cat user password is not correct"
 
     with subtest("dan user has correct password"):
-      for machine in machines:
+      for machine in machines_qemu:
         print(machine.succeed("getent shadow dan"))
         assert "${hashed_bcrypt}" in machine.succeed("getent shadow dan"), f"{machine}: dan user password is not correct"
 
@@ -138,11 +138,11 @@ in
       assert_password_sha512crypt_match(immutable, "greg", "${password1}")
       assert "${hashed_sha512crypt}" not in immutable.succeed("getent shadow greg"), "greg user password is not correct"
 
-    for machine in machines:
+    for machine in machines_qemu:
       machine.wait_for_unit("multi-user.target")
       machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-    def check_login(machine: Machine, tty_number: str, username: str, password: str):
+    def check_login(machine: QemuMachine, tty_number: str, username: str, password: str):
       machine.send_key(f"alt-f{tty_number}")
       machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
       machine.wait_for_unit(f"getty@tty{tty_number}.service")
@@ -158,11 +158,11 @@ in
       assert username in machine.succeed(f"cat /tmp/{tty_number}"), f"{machine}: {username} password is not correct"
 
     with subtest("Test initialPassword override"):
-      for machine in machines:
+      for machine in machines_qemu:
         check_login(machine, "2", "egon", "${password1}")
 
     with subtest("Test initialHashedPassword override"):
-      for machine in machines:
+      for machine in machines_qemu:
         check_login(machine, "3", "fran", "meow")
   '';
 }
diff --git a/nixos/tests/rtkit.nix b/nixos/tests/rtkit.nix
index d884a588a16e..74bf69e02a83 100644
--- a/nixos/tests/rtkit.nix
+++ b/nixos/tests/rtkit.nix
@@ -103,7 +103,7 @@
       Result = namedtuple("Result", ["command", "machine", "status", "out", "value"])
       Value = namedtuple("Value", ["type", "data"])
 
-      def busctl(node: Machine, *args: Any, user: Optional[str] = None) -> Result:
+      def busctl(node: BaseMachine, *args: Any, user: Optional[str] = None) -> Result:
           command = f"busctl --json=short {shlex.join(map(str, args))}"
           if user is not None:
               command = f"su - {user} -c {shlex.quote(command)}"
@@ -121,7 +121,7 @@
           if result.status == 0:
               raise Exception(f"command `{result.command}` unexpectedly succeeded")
 
-      def rtkit_make_process_realtime(node: Machine, pid: int, priority: int, user: Optional[str] = None) -> Result:
+      def rtkit_make_process_realtime(node: BaseMachine, pid: int, priority: int, user: Optional[str] = None) -> Result:
           return busctl(node, "call", "org.freedesktop.RealtimeKit1", "/org/freedesktop/RealtimeKit1", "org.freedesktop.RealtimeKit1", "MakeThreadRealtimeWithPID", "ttu", pid, 0, priority, user=user)
 
       def get_max_realtime_priority() -> int:
@@ -133,7 +133,7 @@
       def parse_chrt(out: str, field: str) -> str:
           return next(map(lambda l: l.split(": ")[1], filter(lambda l: field in l, out.splitlines())))
 
-      def get_pid(node: Machine, unit: str, user: Optional[str] = None) -> int:
+      def get_pid(node: BaseMachine, unit: str, user: Optional[str] = None) -> int:
           node.wait_for_unit(unit, user=user)
           (status, out) = node.systemctl(f"show -P MainPID {unit}", user=user)
           if status == 0:
@@ -142,7 +142,7 @@
               node.log(out)
               raise Exception(f"unable to determine MainPID of {unit} (systemctl exit code {status})")
 
-      def assert_sched(node: Machine, pid: int, policy: Optional[str] = None, priority: Optional[int] = None):
+      def assert_sched(node: BaseMachine, pid: int, policy: Optional[str] = None, priority: Optional[int] = None):
           out = node.succeed(f"chrt -p {pid}")
           node.log(out)
           if policy is not None:
diff --git a/nixos/tests/systemd-journal-upload.nix b/nixos/tests/systemd-journal-upload.nix
index 00dbba82b88b..af7817bd97d8 100644
--- a/nixos/tests/systemd-journal-upload.nix
+++ b/nixos/tests/systemd-journal-upload.nix
@@ -72,7 +72,7 @@
     server.wait_for_unit("multi-user.target")
     client.wait_for_unit("multi-user.target")
 
-    def copy_pems(machine: Machine, domain: str):
+    def copy_pems(machine: BaseMachine, domain: str):
       machine.succeed("mkdir /run/secrets")
       machine.copy_from_host(
         source=f"{tmpdir}/{domain}/cert.pem",

From 1c81794ebd04810568aa3fa81e1e5972ad67f4bb Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 25 Mar 2026 13:41:20 +0700
Subject: [PATCH 031/110] glances: use finalAttrs

---
 pkgs/applications/system/glances/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/system/glances/default.nix b/pkgs/applications/system/glances/default.nix
index bb99cc419eb7..91d300b13f91 100644
--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@@ -26,7 +26,7 @@
   shtab,
 }:
 
-buildPythonApplication rec {
+buildPythonApplication (finalAttrs: {
   pname = "glances";
   version = "4.5.0.5";
   pyproject = true;
@@ -36,7 +36,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-IHgMZw+X7C/72w4vXaP37GgnhLVg7EF5/sd9QlmE0NM=";
   };
 
@@ -106,10 +106,10 @@ buildPythonApplication rec {
     homepage = "https://nicolargo.github.io/glances/";
     description = "Cross-platform curses-based monitoring tool";
     mainProgram = "glances";
-    changelog = "https://github.com/nicolargo/glances/blob/${src.tag}/NEWS.rst";
+    changelog = "https://github.com/nicolargo/glances/blob/${finalAttrs.src.tag}/NEWS.rst";
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [
       koral
     ];
   };
-}
+})

From 5633be819b3662d500d7f1eb2e2b60df34f23f95 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 25 Mar 2026 14:03:56 +0700
Subject: [PATCH 032/110] glances: 4.5.0.5 -> 4.5.2

---
 pkgs/applications/system/glances/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/system/glances/default.nix b/pkgs/applications/system/glances/default.nix
index 91d300b13f91..3feb79caab1a 100644
--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   isPyPy,
   lib,
+  chevron,
   defusedxml,
   packaging,
   psutil,
@@ -28,7 +29,7 @@
 
 buildPythonApplication (finalAttrs: {
   pname = "glances";
-  version = "4.5.0.5";
+  version = "4.5.2";
   pyproject = true;
 
   disabled = isPyPy;
@@ -37,7 +38,7 @@ buildPythonApplication (finalAttrs: {
     owner = "nicolargo";
     repo = "glances";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IHgMZw+X7C/72w4vXaP37GgnhLVg7EF5/sd9QlmE0NM=";
+    hash = "sha256-o/q/zW7lRKQg+u4XblwNIswCVIroMdeUaPTNkN8QKwo=";
   };
 
   build-system = [ setuptools ];
@@ -77,6 +78,7 @@ buildPythonApplication (finalAttrs: {
   };
 
   nativeCheckInputs = [
+    chevron
     which
     pytestCheckHook
     selenium
@@ -100,6 +102,8 @@ buildPythonApplication (finalAttrs: {
     # Test always returns 3 plugin updates, but needs >=5 to not fail
     # May be an upstream bug, see: https://github.com/nicolargo/glances/issues/3430
     "test_perf_update"
+    # Upstream pipe handling currently fails under the new 4.5.2 sanitization coverage
+    "test_pipe"
   ];
 
   meta = {
@@ -110,6 +114,7 @@ buildPythonApplication (finalAttrs: {
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [
       koral
+      miniharinn
     ];
   };
 })

From ed182b540c16582c6d094f9a92fd8c09ac96d129 Mon Sep 17 00:00:00 2001
From: Adrian Pistol <vifino@posteo.net>
Date: Mon, 23 Mar 2026 14:15:26 +0100
Subject: [PATCH 033/110] wolfssl: 5.8.4 -> 5.9.0

---
 pkgs/by-name/wo/wolfssl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index e904c4dfefcc..52c0d752dc0a 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.8.4";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
+    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
   };
 
   postPatch = ''

From b4bb9c85250fe78dee0aadbc727a3e4dec803bd8 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Thu, 26 Mar 2026 12:24:37 +0100
Subject: [PATCH 034/110] nixos-rebuild-ng: redirect switch-to-configuration
 stdout to stderr

nixos-rebuild-ng intentionally prints only the resulting store path to
stdout so callers can script against it (see the print_result comment
in services.py). However, switch-to-configuration's stdout was inherited
unredirected, so any output from it or its children leaked into ours.

See #503032 which accidentaly broke this contract.
---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py       |  6 ++++++
 .../by-name/ni/nixos-rebuild-ng/src/tests/test_main.py | 10 ++++++++++
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py |  4 ++++
 3 files changed, 20 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 95ebb3c9c0c2..0e89656ec7aa 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -717,6 +717,12 @@ def switch_to_configuration(
         },
         remote=target_host,
         sudo=sudo,
+        # switch-to-configuration is not expected to produce meaningful
+        # stdout, but if it (or any of its children) does, it would leak
+        # into our stdout and break the "only the store path on stdout"
+        # contract documented in services.py (see print_result). Redirect
+        # its stdout to our stderr defensively.
+        stdout=sys.stderr,
     )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 456a41f46eac..3ebba4edc5b6 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -249,6 +249,7 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
                     "boot",
                 ],
                 check=True,
+                stdout=ANY,
                 **(
                     DEFAULT_RUN_KWARGS
                     | {
@@ -547,6 +548,7 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -795,6 +797,7 @@ def test_execute_nix_switch_build_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -920,6 +923,7 @@ def test_execute_nix_switch_flake_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1047,6 +1051,7 @@ def test_execute_nix_switch_flake_build_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1132,6 +1137,7 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1307,6 +1313,7 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
             call(
                 [config_path / "bin/switch-to-configuration", "test"],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1372,6 +1379,7 @@ def test_execute_test_rollback(
                     "test",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
@@ -1433,6 +1441,7 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **(
                     DEFAULT_RUN_KWARGS
                     | {
@@ -1551,6 +1560,7 @@ def test_execute_switch_store_path_target_host(
                     "switch",
                 ],
                 check=True,
+                stdout=ANY,
                 **DEFAULT_RUN_KWARGS,
             ),
         ]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 28948d1eaaff..f8c6d75c5290 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -770,6 +770,7 @@ def test_switch_to_configuration_without_systemd_run(
         },
         sudo=False,
         remote=None,
+        stdout=sys.stderr,
     )
 
     with pytest.raises(m.NixOSRebuildError) as e:
@@ -811,6 +812,7 @@ def test_switch_to_configuration_without_systemd_run(
         },
         sudo=True,
         remote=target_host,
+        stdout=sys.stderr,
     )
 
 
@@ -846,6 +848,7 @@ def test_switch_to_configuration_with_systemd_run(
         },
         sudo=False,
         remote=None,
+        stdout=sys.stderr,
     )
 
     target_host = m.Remote("user@localhost", [], None, "ssh")
@@ -875,6 +878,7 @@ def test_switch_to_configuration_with_systemd_run(
         },
         sudo=True,
         remote=target_host,
+        stdout=sys.stderr,
     )
 
 

From 98b37f726dcab9347ba1203ea0597d44942b80d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Mar 2026 03:33:36 +0000
Subject: [PATCH 035/110] bind: 9.20.18 -> 9.20.21

---
 pkgs/by-name/bi/bind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index c49ae029d7fa..0c4a7dd86461 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.18";
+  version = "9.20.21";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-38VGyZCsRRVSnNRcTdmVhisYrootDLKSCOiJal0yUzE=";
+    hash = "sha256-FeG1oifSiQ98ToI6bqAY3nDuLzoOhZy/89gqrYWQ3gM=";
   };
 
   outputs = [

From 81b7eb12a42f9b924a7d3665fb3c265b95a1fafb Mon Sep 17 00:00:00 2001
From: Nadja Yang <nadja@njy.dev>
Date: Fri, 27 Mar 2026 18:04:40 -0400
Subject: [PATCH 036/110] maintainers: update nadja-y email

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 79912e3c2ab9..456d9adf0e11 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18707,7 +18707,7 @@
     name = "nadir-ishiguro";
   };
   nadja-y = {
-    email = "git@njy.dev";
+    email = "nadja@njy.dev";
     github = "nadja-y";
     githubId = 255079535;
     name = "Nadja Yang";

From aec201db7d4723504781e57dc023d87e75252122 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sat, 28 Mar 2026 23:21:02 +0300
Subject: [PATCH 037/110] python3Packages.beets: 2.6.2 -> 2.8.0

Diff: https://github.com/beetbox/beets/compare/v2.6.2...v2.8.0
---
 pkgs/development/python-modules/beets/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/beets/default.nix b/pkgs/development/python-modules/beets/default.nix
index fa41be45ee56..0206b6e48488 100644
--- a/pkgs/development/python-modules/beets/default.nix
+++ b/pkgs/development/python-modules/beets/default.nix
@@ -113,12 +113,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beets";
-  version = "2.6.2";
+  version = "2.8.0";
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1euYkoM66gnElCbgCgIpj1waq1QvHApUgioJTbSQJ0U=";
+    hash = "sha256-8sYoy11eocn7UDeTuaPqOxXZLdUqkabU4DMNLBD5Xp4=";
   };
   pyproject = true;
   # Waiting for https://github.com/beetbox/beets/pull/6267

From 1dea2bb8fd89cbf40b1cfb9356345b6a504c400a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Mar 2026 21:25:44 +0000
Subject: [PATCH 038/110] tree-sitter-grammars.tree-sitter-rust: 0.24.0 ->
 0.24.2

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 882525f8aa03..27a8ce70ee32 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2257,9 +2257,9 @@
   };
 
   rust = {
-    version = "0.24.0";
+    version = "0.24.2";
     url = "github:tree-sitter/tree-sitter-rust";
-    hash = "sha256-y3sJURlSTM7LRRN5WGIAeslsdRZU522Tfcu6dnXH/XQ=";
+    hash = "sha256-Ls6tB6IxXDQDWwx0BJ7RgbheelC4MH8z97E7wwhkDcY=";
     meta = {
       license = lib.licenses.mit;
     };

From 98180aead23d0551b2288d336c01235a456d9dda Mon Sep 17 00:00:00 2001
From: glyph <mail@apophenic.net>
Date: Sat, 28 Mar 2026 21:42:57 +0100
Subject: [PATCH 039/110] sabnzbd: ensure config file exists initially

---
 .../modules/services/networking/sabnzbd/default.nix  | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 4d16ddfd9a22..11221d393be5 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -514,10 +514,7 @@ in
     systemd.services.sabnzbd =
       let
         files =
-          if cfg.configFile != null then
-            [ sabnzbdIniPath ]
-          else
-            (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
+          (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
         iniPathQuoted = lib.escapeShellArg sabnzbdIniPath;
       in
       {
@@ -532,11 +529,18 @@ in
           StateDirectory = cfg.stateDir;
           ExecStart = "${lib.getExe cfg.package} -d -f ${iniPathQuoted}";
         };
+      }
+      // lib.optionalAttrs (cfg.configFile == null) {
         preStart = ''
           set -euo pipefail
 
           ${lib.toShellVar "files" files}
 
+          # We overwrite this immediately, but the merge script requires that
+          # all files exist
+          # See also: nixpkgs #504224
+          (touch ${iniPathQuoted} 2>/dev/null || true)
+
           tmpfile=$(mktemp)
 
           ${lib.getExe (pkgs.python3.withPackages (py: [ py.configobj ]))} \

From dcefbcbc0d7a63b6bedaa7c3f265f8f19eb6d225 Mon Sep 17 00:00:00 2001
From: glyph <mail@apophenic.net>
Date: Sat, 28 Mar 2026 21:51:29 +0100
Subject: [PATCH 040/110] sabnzbd: regression test for #504224

---
 nixos/tests/sabnzbd-module.nix | 77 ++++++++++++++++++++++++++++++----
 1 file changed, 68 insertions(+), 9 deletions(-)

diff --git a/nixos/tests/sabnzbd-module.nix b/nixos/tests/sabnzbd-module.nix
index fd9f48ae35d0..1918bf965091 100644
--- a/nixos/tests/sabnzbd-module.nix
+++ b/nixos/tests/sabnzbd-module.nix
@@ -1,12 +1,7 @@
 { lib, ... }:
-{
-  name = "sabnzbd";
-  meta.maintainers = with lib.maintainers; [ jojosch ];
-
-  node.pkgsReadOnly = false;
-
-  nodes.machine =
-    { pkgs, lib, ... }:
+let
+  common-config =
+    { pkgs, ... }:
     {
       services.sabnzbd = {
         enable = true;
@@ -62,14 +57,78 @@
       # unrar is unfree
       nixpkgs.config.allowUnfreePackages = [ "unrar" ];
     };
+in
+{
+  name = "sabnzbd";
+  meta.maintainers = with lib.maintainers; [ jojosch ];
+
+  node.pkgsReadOnly = false;
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ common-config ];
+    };
+  nodes.with_writeable_config =
+    { ... }:
+    {
+      imports = [ common-config ];
+      config.services.sabnzbd.allowConfigWrite = true;
+    };
+  nodes.with_raw_config_file =
+    { pkgs, ... }:
+    {
+      imports = [ common-config ];
+      config = {
+        services.sabnzbd = {
+          configFile = builtins.toFile "config.ini" ''
+            [misc]
+            inet_exposure = 2
+            html_login = 0
+            api_key = abcdef
+            log_dir = /var/lib/sabnzbd
+            admin_dir = /var/lib/sabnzbd
+          '';
+        };
+
+        environment.systemPackages = [
+          pkgs.jq
+          (pkgs.writeScriptBin "do_test_2" ''
+            set -euxo pipefail
+
+            misc_url="http://127.0.0.1:8080/api?mode=get_config&section=misc&output=json&apikey=abcdef"
+
+            [[ $(curl $misc_url | jq .config.misc.inet_exposure) == 2 ]]
+            [[ $(curl $misc_url | jq .config.misc.html_login) == "false" ]]
+          '')
+        ];
+      };
+    };
 
   testScript = ''
-
     machine.wait_for_unit("sabnzbd.service")
     machine.wait_until_succeeds(
         "curl --fail -L http://localhost:8080/"
     )
 
     machine.succeed("do_test")
+
+
+
+    with_writeable_config.wait_for_unit("sabnzbd.service")
+    with_writeable_config.wait_until_succeeds(
+        "curl --fail -L http://localhost:8080/"
+    )
+
+    with_writeable_config.succeed("do_test")
+
+
+
+    with_raw_config_file.wait_for_unit("sabnzbd.service")
+    with_raw_config_file.wait_until_succeeds(
+        "curl --fail -L http://localhost:8080/"
+    )
+
+    with_raw_config_file.succeed("do_test_2")
   '';
 }

From ecf281d03f8d008eb42b177d512f0f641a802fee Mon Sep 17 00:00:00 2001
From: glyph <mail@apophenic.net>
Date: Sun, 29 Mar 2026 00:11:19 +0100
Subject: [PATCH 041/110] ids: fix incorrect comment

---
 nixos/modules/misc/ids.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index ecc3b3c355dc..346fe03471eb 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -84,7 +84,7 @@ in
       tor = 35;
       cups = 36;
       foldingathome = 37;
-      #sabnzbd = 38; # dropped in 25.11
+      #sabnzbd = 38; # dropped in 26.05
       #kdm = 39; # dropped in 17.03
       #ghostone = 40; # dropped in 18.03
       git = 41;
@@ -570,7 +570,7 @@ in
       lambdabot = 191;
       asterisk = 192;
       plex = 193;
-      #sabnzbd = 194; # dropped in 25.11
+      #sabnzbd = 194; # dropped in 26.05
       #grafana = 196; #unused
       #skydns = 197; #unused
       # ripple-rest = 198; # unused, removed 2017-08-12

From 345604f0137dd7ffa536e8e5db91165897b3e728 Mon Sep 17 00:00:00 2001
From: glyph <mail@apophenic.net>
Date: Sun, 29 Mar 2026 00:18:25 +0100
Subject: [PATCH 042/110] sabnzbd: allow overriding of config schema version
 and encoding

---
 nixos/modules/services/networking/sabnzbd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 11221d393be5..d4a894faf96f 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -33,7 +33,7 @@ let
     "__version__" = 19;
     "__encoding__" = "utf-8";
   };
-  allSettings = cfg.settings // mandatoryGlobalSettings;
+  allSettings = mandatoryGlobalSettings // cfg.settings;
 
   # sabnzbd uses configobj type inis, which support
   # nested sections specified by increasing numbers

From 9289207b5a63fe0ecb2bbae7cf67a4abcd10b1b0 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Sat, 28 Mar 2026 17:17:34 -0700
Subject: [PATCH 043/110] tree-sitter-grammar.tree-sitter-just:
 0-unstable-2026-03-15 -> 0.2.0

Upstream is now tagging releases, so we can move away from unstable
versions. The only change in this new release is to update all the metadata
to point to the new repo.
---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 882525f8aa03..35302782c41a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1329,10 +1329,10 @@
   };
 
   just = {
-    version = "0-unstable-2026-03-15";
+    version = "0.2.0";
     url = "github:casey/tree-sitter-just";
-    rev = "d9da862c156020c1a83d3c6ccdda32be6d8a5d4a";
-    hash = "sha256-YV+vab/QqGHVPV1e3wjd0w1nFskJEIU4ukq/yIlojk0=";
+    rev = "5685543a6e64f66335e25518c9ae8ffa1dae3d01";
+    hash = "sha256-lrW5E+HIqrDSWZ4+KOjIc80/wYm/WV9ZOfdLXxPIbX4=";
     meta = {
       license = lib.licenses.asl20;
       maintainers = with lib.maintainers; [

From 85cb4f8ce57fa34b765c06beb24cbd327ad6510a Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Sun, 29 Mar 2026 03:21:57 +0200
Subject: [PATCH 044/110] libtorrent-rasterbar: 2.0.11 -> 2.0.12

---
 .../distutils.patch                           | 20 -------------------
 .../li/libtorrent-rasterbar-2_0_x/package.nix |  7 +++----
 .../python-destdir.patch                      | 13 ++++++++++++
 3 files changed, 16 insertions(+), 24 deletions(-)
 delete mode 100644 pkgs/by-name/li/libtorrent-rasterbar-2_0_x/distutils.patch
 create mode 100644 pkgs/by-name/li/libtorrent-rasterbar-2_0_x/python-destdir.patch

diff --git a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/distutils.patch b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/distutils.patch
deleted file mode 100644
index 57c90b69808c..000000000000
--- a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/distutils.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
-index 2f4de4854..a68d547e6 100644
---- a/bindings/python/CMakeLists.txt
-+++ b/bindings/python/CMakeLists.txt
-@@ -95,8 +95,13 @@ if (python-install-system-dir)
- else()
- 	execute_process(
- 		COMMAND "${Python3_EXECUTABLE}" -c [=[
--import distutils.sysconfig
--print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
-+try:
-+	import distutils.sysconfig
-+	print(distutils.sysconfig.get_python_lib(prefix='', plat_specific=True))
-+except ModuleNotFoundError:
-+	import os, sys
-+	version = f"{sys.version_info.major}.{sys.version_info.minor}"
-+	print(os.sep.join(["lib", f"python{version}", "site-packages"]))
- ]=]
- 		OUTPUT_VARIABLE _PYTHON3_SITE_ARCH
- 		OUTPUT_STRIP_TRAILING_WHITESPACE
diff --git a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
index f9c578dca6f9..82626adf9740 100644
--- a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
+++ b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
@@ -17,14 +17,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtorrent-rasterbar";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "arvidn";
     repo = "libtorrent";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-iph42iFEwP+lCWNPiOJJOejISFF6iwkGLY9Qg8J4tyo=";
+    hash = "sha256-JbNOKzB830VQkZjC8ZAmzbu/7nkAgyD8cOr22uYbIGQ=";
   };
 
   nativeBuildInputs = [
@@ -40,8 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   patches = [
-    # provide distutils alternative for python 3.12
-    ./distutils.patch
+    ./python-destdir.patch
   ];
 
   # https://github.com/arvidn/libtorrent/issues/6865
diff --git a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/python-destdir.patch b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/python-destdir.patch
new file mode 100644
index 000000000000..d1965bd1fa7a
--- /dev/null
+++ b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/python-destdir.patch
@@ -0,0 +1,13 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 4e8ee816b..ff1981d84 100644
+--- a/bindings/python/CMakeLists.txt
++++ b/bindings/python/CMakeLists.txt
+@@ -106,7 +106,7 @@ endif()
+ message(STATUS "Python 3 site packages: ${_PYTHON3_SITE_ARCH}")
+ message(STATUS "Python 3 extension suffix: ${Python3_SOABI}")
+ 
+-install(TARGETS python-libtorrent DESTINATION "${_PYTHON3_SITE_ARCH}")
++install(TARGETS python-libtorrent DESTINATION "\$ENV{DESTDIR}${_PYTHON3_SITE_ARCH}")
+ 
+ if (python-egg-info)
+ 	set(SETUP_PY_IN "${CMAKE_CURRENT_SOURCE_DIR}/setup.py.cmake.in")

From 5fd1a7194edef843c2df3b3451c41169326dcaf1 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 29 Mar 2026 09:33:54 +0200
Subject: [PATCH 045/110] nixos/test-driver: fix create_machine return type

This always returns a QemuMachine, which may need to have
QEMU-specific methods called on it.

Fixes: 23f1e6370d1e ("nixos/test-driver: add support for nspawn containers")
Fixes: 799cafcc2338 ("nixos/test-driver: refactor Machine to BaseMachine and QemuMachine")
---
 nixos/lib/test-driver/src/test_driver/driver.py | 2 +-
 nixos/lib/test-script-prepend.py                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index 8cbcb052be49..dacdfd015e10 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -369,7 +369,7 @@ class Driver:
         *,
         name: str | None = None,
         keep_machine_state: bool = False,
-    ) -> BaseMachine:
+    ) -> QemuMachine:
         """
         Create a `QemuMachine`. This currently only supports qemu "nodes", not containers.
         """
diff --git a/nixos/lib/test-script-prepend.py b/nixos/lib/test-script-prepend.py
index b9a12d5f2f54..dd9861f04441 100644
--- a/nixos/lib/test-script-prepend.py
+++ b/nixos/lib/test-script-prepend.py
@@ -36,7 +36,7 @@ class CreateMachineProtocol(Protocol):
         name: Optional[str] = None,
         keep_machine_state: bool = False,
         **kwargs: Any, # to allow usage of deprecated keep_vm_state
-    ) -> BaseMachine:
+    ) -> QemuMachine:
         raise Exception("This is just type information for the Nix test driver")
 
 

From 4c3f8b7bb9d8dba42efefa9854a744fe811e420d Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 29 Mar 2026 13:27:57 +0200
Subject: [PATCH 046/110] busybox: fix potential build-time buffer overflow

d8bcd4850391 ("fortify-headers: 1.1 -> 3.0.1") (currently on staging)
breaks the musl build by identifying this issue.
---
 .../build-system-buffer-overflow.patch        | 27 +++++++++++++++++++
 pkgs/os-specific/linux/busybox/default.nix    |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/os-specific/linux/busybox/build-system-buffer-overflow.patch

diff --git a/pkgs/os-specific/linux/busybox/build-system-buffer-overflow.patch b/pkgs/os-specific/linux/busybox/build-system-buffer-overflow.patch
new file mode 100644
index 000000000000..7fdb83a1596d
--- /dev/null
+++ b/pkgs/os-specific/linux/busybox/build-system-buffer-overflow.patch
@@ -0,0 +1,27 @@
+From 3cf1ca7491bd5b6680e80355d76442ae14db681e Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Sun, 29 Mar 2026 13:18:09 +0200
+Subject: [PATCH] build system: fix potential buffer overflow
+
+This could potentially write one byte past the end of line.
+Identified by fortify-headers.
+---
+ scripts/basic/split-include.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/basic/split-include.c b/scripts/basic/split-include.c
+index 6ef29195e..93011d511 100644
+--- a/scripts/basic/split-include.c
++++ b/scripts/basic/split-include.c
+@@ -195,7 +195,7 @@ int main(int argc, const char * argv [])
+ 	ERROR_EXIT( "find" );
+ 
+     line[0] = '\n';
+-    while (fgets(line+1, buffer_size, fp_find))
++    while (fgets(line+1, buffer_size-1, fp_find))
+     {
+ 	if (strstr(list_target, line) == NULL)
+ 	{
+-- 
+2.53.0
+
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 8402337be16d..677b884d1c6d 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -90,6 +90,8 @@ stdenv.mkDerivation rec {
       excludes = [ "networking/httpd_ratelimit_cgi.c" ]; # New since release.
       hash = "sha256-Msm9sDZrVx7ofunnvnTS73SPKUUpR3Tv5xZ/wBd+rts=";
     })
+    # https://lists.busybox.net/pipermail/busybox/2026-March/092010.html
+    ./build-system-buffer-overflow.patch
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 

From 7edc697b0c80911dbdcc579550a90dcd27930485 Mon Sep 17 00:00:00 2001
From: Alex Epelde <alex@epelde.net>
Date: Sun, 29 Mar 2026 11:52:32 -0400
Subject: [PATCH 047/110] fflas-ffpack: fix OpenMP detection

see
https://github.com/linbox-team/fflas-ffpack/commit/833bb2fa4e87e51e3f7fa1d97f3b4372c1ee4200
---
 pkgs/by-name/ff/fflas-ffpack/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/ff/fflas-ffpack/package.nix b/pkgs/by-name/ff/fflas-ffpack/package.nix
index 44a6371b9c0e..78633811a2a3 100644
--- a/pkgs/by-name/ff/fflas-ffpack/package.nix
+++ b/pkgs/by-name/ff/fflas-ffpack/package.nix
@@ -8,6 +8,7 @@
   blas,
   lapack,
   gmpxx,
+  fetchpatch2,
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -23,6 +24,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Eztc2jUyKRVUiZkYEh+IFHkDuPIy+Gx3ZW/MsuOVaMc=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "detect-openmp.patch";
+      url = "https://github.com/linbox-team/fflas-ffpack/commit/833bb2fa4e87e51e3f7fa1d97f3b4372c1ee4200.patch?full_index=1";
+      hash = "sha256-COJxb1Y47rLBogJuXzznKHOSs9gAX1BtN+j8pEqOhLY=";
+      excludes = [ "benchmarks/*" ];
+    })
+  ];
+
   nativeCheckInputs = [
     gmpxx
   ];

From 55bca99b03d741d2c6f6c573a271cec74427d331 Mon Sep 17 00:00:00 2001
From: Alex Epelde <alex@epelde.net>
Date: Sun, 29 Mar 2026 11:53:02 -0400
Subject: [PATCH 048/110] fflas-ffpack: remove unneeded SIMD instruction flags

--without-archnative is now enough
see https://github.com/linbox-team/fflas-ffpack/pull/293
---
 pkgs/by-name/ff/fflas-ffpack/package.nix | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/pkgs/by-name/ff/fflas-ffpack/package.nix b/pkgs/by-name/ff/fflas-ffpack/package.nix
index 78633811a2a3..07c425bb387d 100644
--- a/pkgs/by-name/ff/fflas-ffpack/package.nix
+++ b/pkgs/by-name/ff/fflas-ffpack/package.nix
@@ -55,21 +55,6 @@ stdenv.mkDerivation rec {
     "--with-blas-libs=-lcblas"
     "--with-lapack-libs=-llapacke"
     "--without-archnative"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    # disable SIMD instructions (which are enabled *when available* by default)
-    # for now we need to be careful to disable *all* relevant versions of an instruction set explicitly (https://github.com/linbox-team/fflas-ffpack/issues/284)
-    "--${if stdenv.hostPlatform.sse3Support then "enable" else "disable"}-sse3"
-    "--${if stdenv.hostPlatform.ssse3Support then "enable" else "disable"}-ssse3"
-    "--${if stdenv.hostPlatform.sse4_1Support then "enable" else "disable"}-sse41"
-    "--${if stdenv.hostPlatform.sse4_2Support then "enable" else "disable"}-sse42"
-    "--${if stdenv.hostPlatform.avxSupport then "enable" else "disable"}-avx"
-    "--${if stdenv.hostPlatform.avx2Support then "enable" else "disable"}-avx2"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512f"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512dq"
-    "--${if stdenv.hostPlatform.avx512Support then "enable" else "disable"}-avx512vl"
-    "--${if stdenv.hostPlatform.fmaSupport then "enable" else "disable"}-fma"
-    "--${if stdenv.hostPlatform.fma4Support then "enable" else "disable"}-fma4"
   ];
   doCheck = true;
 

From d2115b639f38f0208753d0c651d055b68220d638 Mon Sep 17 00:00:00 2001
From: Alex Epelde <alex@epelde.net>
Date: Sun, 29 Mar 2026 15:09:16 -0400
Subject: [PATCH 049/110] fflas-ffpack: do not use _mm_permute_ps for
 simd128_float

---
 pkgs/by-name/ff/fflas-ffpack/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ff/fflas-ffpack/package.nix b/pkgs/by-name/ff/fflas-ffpack/package.nix
index 07c425bb387d..6bd573e884b0 100644
--- a/pkgs/by-name/ff/fflas-ffpack/package.nix
+++ b/pkgs/by-name/ff/fflas-ffpack/package.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
       hash = "sha256-COJxb1Y47rLBogJuXzznKHOSs9gAX1BtN+j8pEqOhLY=";
       excludes = [ "benchmarks/*" ];
     })
+    (fetchpatch2 {
+      name = "do-not-use-_mm_permute_ps-for-simd128_float.patch";
+      url = "https://github.com/linbox-team/fflas-ffpack/commit/be33b602ecdef543a30ea494899b08610c7e0a74.patch?full_index=1";
+      hash = "sha256-YWUFnPViXwyyHLXuewX6KQsgUiwgl6vfYnZX2JzgkE4=";
+    })
   ];
 
   nativeCheckInputs = [

From 9449884f4b0a660ffa8bc0d157b68fd407f9c3d7 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Wed, 18 Mar 2026 23:43:59 +0100
Subject: [PATCH 050/110] lixPackageSets.git.lix: 2.95.0-pre-20260317 ->
 2.96.0-pre-20260318

---
 pkgs/tools/package-management/lix/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 1d95ef9a66ee..ecc3dc6c342e 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -283,14 +283,14 @@ lib.makeExtensible (
       attrName = "git";
 
       lix-args = rec {
-        version = "2.96.0-pre-20260317_${builtins.substring 0 12 src.rev}";
+        version = "2.96.0-pre-20260318_${builtins.substring 0 12 src.rev}";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
-          rev = "96db7c79cf2a9a06725360b0d12e5de583bef07d";
-          hash = "sha256-Ixwk38HArs7MZXxdWRkSZFzUhUdlCro+8+M/sO+fE/Y=";
+          rev = "8294cd534b2f01ee967b28aa73fcab1535d62b3d";
+          hash = "sha256-BFijbNDCrfzpDdW+gNauP25QsTvEZ39dygWEI/RYeyY=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {

From b428932fc61d6d4b932fedf749bfcc0c5455f606 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Wed, 18 Mar 2026 23:33:55 +0100
Subject: [PATCH 051/110] nixVersions.*: patch for compatibility with lowdown
 >= 3.0

---
 pkgs/tools/package-management/nix/default.nix | 47 ++++++++++++++-----
 .../lowdown-3.0-compat-2.28-2.30.patch        | 27 +++++++++++
 2 files changed, 61 insertions(+), 13 deletions(-)
 create mode 100644 pkgs/tools/package-management/nix/patches/lowdown-3.0-compat-2.28-2.30.patch

diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 8772d9df0b1e..1eb7c5699b06 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -134,6 +134,21 @@ let
   patches_common = lib.optional (
     stdenv.system == "aarch64-darwin"
   ) ./patches/skip-flaky-darwin-tests.patch;
+
+  # Lowdown 3.0 compatibility patch for nix 2.31–2.33; fetched from the
+  # upstream backport (same diff on every maintenance branch after
+  # fetchpatch strips metadata).  Nix 2.34.4+ and the git snapshot
+  # already include the fix in their tagged source.
+  lowdown30Patch = pkgs.fetchpatch {
+    name = "nix-lowdown-3.0-support.patch";
+    url = "https://github.com/NixOS/nix/commit/472c35c561bd9e8db1465e0677f1efe2cb88c568.patch";
+    hash = "sha256-ZCQgI/euBN8t9rgdCsGRgrcEWG3T5MUc+bQc4tIcHuI=";
+  };
+
+  # Lowdown 3.0 compatibility patch for nix 2.28 and 2.30, which have a
+  # different markdown.cc layout (no LOWDOWN_TERM_NORELLINK branch) and
+  # never received an upstream backport.
+  lowdown30PatchOld = ./patches/lowdown-3.0-compat-2.28-2.30.patch;
 in
 lib.makeExtensible (
   self:
@@ -149,6 +164,7 @@ lib.makeExtensible (
             url = "https://github.com/NixOS/nix/commit/5a64138e862fe364e751c5c286e8db8c466aaee7.patch?full_index=1";
             hash = "sha256-vFv/D08x9urtoIE9wiC7Lln4Eq3sgNBwU7TBE1iyrfI=";
           })
+          lowdown30PatchOld
         ];
       };
 
@@ -172,22 +188,27 @@ lib.makeExtensible (
                 url = "https://github.com/NixOS/nix/commit/5cbd7856de0a9c13351f98e32a1e26d0854d87fd.patch?full_index=1";
                 hash = "sha256-r2ZF1zBZDKMvyX6X4VsaTMrg0zdjn59Jf6Hqg56r29E=";
               })
+              lowdown30PatchOld
             ]
           );
 
       nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
 
-      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
-        version = "2.31.3";
-        inherit (self.nix_2_30.meta) teams;
-        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
-        src = fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix";
-          tag = version;
-          hash = "sha256-oe0YWe8f+pwQH4aYD2XXLW5iEHyXNUddurqJ5CUVCIk=";
-        };
-      };
+      nixComponents_2_31 =
+        (nixDependencies.callPackage ./modular/packages.nix rec {
+          version = "2.31.3";
+          inherit (self.nix_2_30.meta) teams;
+          otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
+          src = fetchFromGitHub {
+            owner = "NixOS";
+            repo = "nix";
+            tag = version;
+            hash = "sha256-oe0YWe8f+pwQH4aYD2XXLW5iEHyXNUddurqJ5CUVCIk=";
+          };
+        }).appendPatches
+          [
+            lowdown30Patch
+          ];
 
       nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
 
@@ -203,7 +224,7 @@ lib.makeExtensible (
             hash = "sha256-5aH3xppfBs8j6P7A2wq8WQ05yJvlL7x0gQbWk4RN5eY=";
           };
         }).appendPatches
-          patches_common;
+          (patches_common ++ [ lowdown30Patch ]);
 
       nix_2_32 = addTests "nix_2_32" self.nixComponents_2_32.nix-everything;
 
@@ -219,7 +240,7 @@ lib.makeExtensible (
             hash = "sha256-2Mga4e9ZtOPLwYqF4+hcjdsTImcA7TKUvDDfaF7jqEo=";
           };
         }).appendPatches
-          patches_common;
+          (patches_common ++ [ lowdown30Patch ]);
 
       nix_2_33 = addTests "nix_2_33" self.nixComponents_2_33.nix-everything;
 
diff --git a/pkgs/tools/package-management/nix/patches/lowdown-3.0-compat-2.28-2.30.patch b/pkgs/tools/package-management/nix/patches/lowdown-3.0-compat-2.28-2.30.patch
new file mode 100644
index 000000000000..dd527f7f1cd6
--- /dev/null
+++ b/pkgs/tools/package-management/nix/patches/lowdown-3.0-compat-2.28-2.30.patch
@@ -0,0 +1,27 @@
+--- a/src/libcmd/markdown.cc
++++ b/src/libcmd/markdown.cc
+@@ -37,7 +37,13 @@
+         .vmargin = 0,
+ #  endif
+         .feat = LOWDOWN_COMMONMARK | LOWDOWN_FENCED | LOWDOWN_DEFLIST | LOWDOWN_TABLES,
+-        .oflags = LOWDOWN_TERM_NOLINK,
++        .oflags =
++#  if HAVE_LOWDOWN_3
++            LOWDOWN_NOLINK
++#  else
++            LOWDOWN_TERM_NOLINK
++#  endif
++        ,
+     };
+
+     auto doc = lowdown_doc_new(&opts);
+--- a/src/libcmd/meson.build
++++ b/src/libcmd/meson.build
+@@ -36,6 +36,7 @@
+ configdata.set('HAVE_LOWDOWN', lowdown.found().to_int())
+ # The API changed slightly around terminal initialization.
+ configdata.set('HAVE_LOWDOWN_1_4', lowdown.version().version_compare('>= 1.4.0').to_int())
++configdata.set('HAVE_LOWDOWN_3', lowdown.version().version_compare('>= 3.0.0').to_int())
+
+ readline_flavor = get_option('readline-flavor')
+ if readline_flavor == 'editline'

From bd8d2815089a0a6d4efdce39463b64ff95a56c6f Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Wed, 18 Mar 2026 23:34:41 +0100
Subject: [PATCH 052/110] lixPackageSets.lix_2_93.lix: patch for compat with
 lowdown 3

---
 pkgs/tools/package-management/lix/default.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index ecc3dc6c342e..8ebcd187f4a3 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -41,6 +41,13 @@ let
     hash = "sha256-uu/SIG8fgVVWhsGxmszTPHwe4SQtLgbxdShOMKbeg2w=";
   };
 
+  lixLowdown30Patch = fetchpatch {
+    name = "lix-lowdown-3.0-support.patch";
+    url = "https://git.lix.systems/lix-project/lix/commit/af0390c27bdc401ece8f8192cb3024f0ff08e977.patch";
+    excludes = [ "flake.nix" ];
+    hash = "sha256-ZBkbgeZ/D7H2teX8bPy5NEG1aXbQVksTDV3aVBZdRPM=";
+  };
+
   makeLixScope =
     {
       attrName,
@@ -229,6 +236,8 @@ lib.makeExtensible (
           })
 
           lixMdbookPatch
+
+          lixLowdown30Patch
         ];
       };
     };
@@ -253,7 +262,10 @@ lib.makeExtensible (
           hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
         };
 
-        patches = [ lixMdbookPatch ];
+        patches = [
+          lixMdbookPatch
+          lixLowdown30Patch
+        ];
       };
     };
 

From bfe44e60b5737b2dd63bfa873d93eb3fe96403c9 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 14 Mar 2026 11:31:51 +0100
Subject: [PATCH 053/110] lowdown: 2.0.4 -> 3.0.0

https://github.com/kristapsdz/lowdown/releases/tag/VERSION_3_0_0
---
 pkgs/by-name/lo/lowdown/package.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/lo/lowdown/package.nix b/pkgs/by-name/lo/lowdown/package.nix
index d74416a0cba6..e754e0e09fdb 100644
--- a/pkgs/by-name/lo/lowdown/package.nix
+++ b/pkgs/by-name/lo/lowdown/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   pname = "lowdown${
     lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) "-unsandboxed"
   }";
-  version = "2.0.4";
+  version = "3.0.0";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-    sha512 = "649a508b7727df6e7e1203abb3853e05f167b64832fd5e1271f142ccf782e600b1de73c72dc02673d7b175effdc54f2c0f60318208a968af9f9763d09cf4f9ef";
+    sha512 = "94e97234d598382c3c3dc27f9bfdb3a3a2fcf7dbb6a8df3c85ee09f27f792449034a41d49d9cfd3d8450d2de01b8562c20c3d120e65c81af4d7d6c9454119e93";
   };
 
   # https://github.com/kristapsdz/lowdown/pull/171
@@ -42,12 +42,6 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
-  postPatch = ''
-    # fails test, some column width mismatch
-    rm regress/table-footnotes.md
-    rm regress/table-styles.md
-  '';
-
   # The Darwin sandbox calls fail inside Nix builds, presumably due to
   # being nested inside another sandbox.
   preConfigure = lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) ''

From f7803b4ebfb6addf6307250aa26af05e751880ed Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 14 Mar 2026 11:32:22 +0100
Subject: [PATCH 054/110] lowdown: also test lix

---
 pkgs/by-name/lo/lowdown/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/lo/lowdown/package.nix b/pkgs/by-name/lo/lowdown/package.nix
index e754e0e09fdb..6a4cadc42939 100644
--- a/pkgs/by-name/lo/lowdown/package.nix
+++ b/pkgs/by-name/lo/lowdown/package.nix
@@ -11,6 +11,7 @@
   enableDarwinSandbox ? true,
   # for passthru.tests
   nix,
+  lix,
   lowdown-unsandboxed,
 }:
 
@@ -107,7 +108,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     # most important consumers in nixpkgs
-    inherit nix lowdown-unsandboxed;
+    inherit nix lix lowdown-unsandboxed;
   };
 
   meta = {

From 995f419d84f8693960dec300899b95e67010fcc2 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 14 Mar 2026 11:32:34 +0100
Subject: [PATCH 055/110] lowdown: sanity check output in installCheckPhase

---
 pkgs/by-name/lo/lowdown/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/lo/lowdown/package.nix b/pkgs/by-name/lo/lowdown/package.nix
index 6a4cadc42939..ba2e5c7c505a 100644
--- a/pkgs/by-name/lo/lowdown/package.nix
+++ b/pkgs/by-name/lo/lowdown/package.nix
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
     runHook preInstallCheck
 
     echo '# TEST' > test.md
-    $out/bin/lowdown test.md
+    $out/bin/lowdown test.md | grep '[hH]1'
 
     runHook postInstallCheck
   '';

From 58ed53d264d4756c31d0f9559552d8be216645ab Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Wed, 18 Mar 2026 23:15:36 +0100
Subject: [PATCH 056/110] lowdown: 3.0.0 -> 3.0.1

https://github.com/kristapsdz/lowdown/releases/tag/VERSION_3_0_1
---
 pkgs/by-name/lo/lowdown/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lo/lowdown/package.nix b/pkgs/by-name/lo/lowdown/package.nix
index ba2e5c7c505a..ad56e0e6991d 100644
--- a/pkgs/by-name/lo/lowdown/package.nix
+++ b/pkgs/by-name/lo/lowdown/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   pname = "lowdown${
     lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) "-unsandboxed"
   }";
-  version = "3.0.0";
+  version = "3.0.1";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-    sha512 = "94e97234d598382c3c3dc27f9bfdb3a3a2fcf7dbb6a8df3c85ee09f27f792449034a41d49d9cfd3d8450d2de01b8562c20c3d120e65c81af4d7d6c9454119e93";
+    sha512 = "fe68e1b7ff23f3992398356d7aa9a330dfd7b72e22bea9a91eeef74182b209ecea0c9f3e2b2216e1a07b2358da2b746238ec9cbbdeebdd3551cef14dd2d79f46";
   };
 
   # https://github.com/kristapsdz/lowdown/pull/171

From 94f41998acf1c602223fb480c69841beb60e0046 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 30 Mar 2026 22:19:47 +0100
Subject: [PATCH 057/110] ruff: 0.15.7 -> 0.15.8

Changes: https://github.com/astral-sh/ruff/releases/tag/0.15.8
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 4eb1a03897a4..fbb2d76bb659 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.7";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-aDRFNJKvxuHPYaZtoM+93DxJGsTPMLKGBH5QhIiTh0Y=";
+    hash = "sha256-hjllQ7lw2hecrwhPQlcq97LLxFYR28vCY14Ty6eBox4=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-m3VkHXhjemXVOFFVSUOVz0xD2Rc2pMsP+dnMYQD29uI=";
+  cargoHash = "sha256-iQKX+TqfP9r5P+UJKLqNysHYJm8N6qCCDfs8KYSb1vY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From e5933639498775596fb31b6f51182daab3008a74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A1szl=C3=B3=20Vask=C3=B3?=
 <1771332+vlaci@users.noreply.github.com>
Date: Thu, 26 Mar 2026 10:51:31 +0100
Subject: [PATCH 058/110] unblob: use the default nix-updates-script to handle
 cargoDeps hash update

---
 pkgs/by-name/un/unblob/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 557e1b934800..0cd69d87a4bf 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -3,7 +3,6 @@
   libiconv,
   python3,
   fetchFromGitHub,
-  gitUpdater,
   makeWrapper,
   rustPlatform,
   stdenvNoCC,
@@ -131,7 +130,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   passthru = {
-    updateScript = gitUpdater { };
     # helpful to easily add these to a nix-shell environment
     inherit runtimeDeps;
   };

From f260d101a4cec126dc51fb2c308310b9fd109c86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A1szl=C3=B3=20Vask=C3=B3?=
 <1771332+vlaci@users.noreply.github.com>
Date: Thu, 26 Mar 2026 11:08:28 +0100
Subject: [PATCH 059/110] unblob: 25.5.26 -> 26.3.30

---
 pkgs/by-name/un/unblob/package.nix | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 0cd69d87a4bf..af6967c337d5 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -46,27 +46,25 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
-  version = "25.5.26";
+  version = "26.3.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "onekey-sec";
     repo = "unblob";
     tag = version;
-    hash = "sha256-vTakXZFAcD3cmd+y4CwYg3X4O4NmtOzuqMLWLMX2Duk=";
+    hash = "sha256-wYWuKvxAagctlmdO5Fi9/WzfJ4zkDgfXejgDTJPHsTI=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-NirDPuAcKuNquMs9mBZoEkQf+QJ+cMd7JXjj1anB9Zw=";
+    hash = "sha256-wjN4QPOUYFWWYMWL9aAgGqEucM7q+H6YyoS9Mv2dpp4=";
   };
 
   strictDeps = true;
 
-  build-system = with python3.pkgs; [ poetry-core ];
-
   buildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libiconv ];
 
   dependencies = with python3.pkgs; [
@@ -77,10 +75,13 @@ python3.pkgs.buildPythonApplication rec {
     dissect-cstruct
     lark
     lief.py
+    lzallright
     python3.pkgs.lz4 # shadowed by pkgs.lz4
     plotext
     pluggy
+    pydantic
     pyfatfs
+    pymdown-extensions
     pyperscan
     python-magic
     pyzstd
@@ -103,8 +104,6 @@ python3.pkgs.buildPythonApplication rec {
     "ubi-reader"
   ];
 
-  pythonRelaxDeps = [ "lz4" ];
-
   pythonImportsCheck = [ "unblob" ];
 
   makeWrapperArgs = [
@@ -114,19 +113,23 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs =
     with python3.pkgs;
     [
+      pexpect
+      psutil
+      pytest-cov-stub
       pytestCheckHook
-      pytest-cov # cannot use stub
       versionCheckHook
     ]
     ++ runtimeDeps;
 
   pytestFlags = [
-    "--no-cov"
+    "--with-e2e" # Not that slow: increases test time by ~5s
   ];
 
   disabledTests = [
     # https://github.com/tytso/e2fsprogs/issues/152
     "test_all_handlers[filesystem.extfs]"
+    # regression in erofs-utils 1.9 https://github.com/onekey-sec/unblob/commit/c7c9f20dd871a5694d41a95ca3041eb0c98e257a
+    "test_all_handlers[filesystem.android.erofs]"
   ];
 
   passthru = {

From 8717b642a9ce3a76a5b10bf7d85634da13a6d6cb Mon Sep 17 00:00:00 2001
From: glyph <mail@apophenic.net>
Date: Sun, 29 Mar 2026 12:51:09 +0200
Subject: [PATCH 060/110] sabnzbd: clean up test script

---
 nixos/tests/sabnzbd-module.nix | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)

diff --git a/nixos/tests/sabnzbd-module.nix b/nixos/tests/sabnzbd-module.nix
index 1918bf965091..3eb9bd21e2ff 100644
--- a/nixos/tests/sabnzbd-module.nix
+++ b/nixos/tests/sabnzbd-module.nix
@@ -106,29 +106,16 @@ in
     };
 
   testScript = ''
-    machine.wait_for_unit("sabnzbd.service")
-    machine.wait_until_succeeds(
-        "curl --fail -L http://localhost:8080/"
-    )
+    def wait_for_up(m):
+      m.wait_for_unit("sabnzbd.service")
+      m.wait_until_succeeds("curl --fail -L http://localhost:8080")
+
+    wait_for_up(machine)
+    wait_for_up(with_writeable_config)
+    wait_for_up(with_raw_config_file)
 
     machine.succeed("do_test")
-
-
-
-    with_writeable_config.wait_for_unit("sabnzbd.service")
-    with_writeable_config.wait_until_succeeds(
-        "curl --fail -L http://localhost:8080/"
-    )
-
     with_writeable_config.succeed("do_test")
-
-
-
-    with_raw_config_file.wait_for_unit("sabnzbd.service")
-    with_raw_config_file.wait_until_succeeds(
-        "curl --fail -L http://localhost:8080/"
-    )
-
     with_raw_config_file.succeed("do_test_2")
   '';
 }

From d105a30b8c597a1a4725a08ffbf96dd1a24c8a2f Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 31 Mar 2026 16:54:16 +0200
Subject: [PATCH 061/110] coqPackages.aac-tactics: enable for Coq > 9.0

---
 pkgs/development/coq-modules/aac-tactics/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/aac-tactics/default.nix b/pkgs/development/coq-modules/aac-tactics/default.nix
index 46e8948abab1..3eef4aefd59c 100644
--- a/pkgs/development/coq-modules/aac-tactics/default.nix
+++ b/pkgs/development/coq-modules/aac-tactics/default.nix
@@ -36,7 +36,7 @@ mkCoqDerivation {
 
     lib.switch coq.coq-version [
       {
-        case = "9.0";
+        case = lib.versions.isGe "9.0";
         out = "9.0.0";
       }
       {

From 2ceb79316e98ddc6ba345e8cf93a00048f578e44 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 31 Mar 2026 16:54:26 +0200
Subject: [PATCH 062/110] coqPackages.rewriter: enable for Coq > 9.0

---
 pkgs/development/coq-modules/rewriter/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/rewriter/default.nix b/pkgs/development/coq-modules/rewriter/default.nix
index 42cc8f777125..3e3e05cd516e 100644
--- a/pkgs/development/coq-modules/rewriter/default.nix
+++ b/pkgs/development/coq-modules/rewriter/default.nix
@@ -16,7 +16,7 @@ mkCoqDerivation {
     in
     lib.switch coq.coq-version [
       {
-        case = range "8.17" "9.0";
+        case = range "8.17" "9.2";
         out = "0.0.15";
       }
     ] null;

From c041078e3b68bf1c06a33c5c6fa74b11cd91951f Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 31 Mar 2026 17:06:53 +0200
Subject: [PATCH 063/110] =?UTF-8?q?coqPackages.unicoq:=20enable=20for=20Co?=
 =?UTF-8?q?q=20=E2=89=A5=209.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/coq-modules/unicoq/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/coq-modules/unicoq/default.nix b/pkgs/development/coq-modules/unicoq/default.nix
index 401015b89dec..744a6d24bb4a 100644
--- a/pkgs/development/coq-modules/unicoq/default.nix
+++ b/pkgs/development/coq-modules/unicoq/default.nix
@@ -12,6 +12,10 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = isGe "9.1";
+        out = "1.6-9.1";
+      }
       {
         case = range "8.20" "9.0";
         out = "1.6-8.20";
@@ -21,6 +25,8 @@ mkCoqDerivation {
         out = "1.6-8.19";
       }
     ] null;
+  release."1.6-9.1".rev = "0cf37ef7e638bfaad6e804e17bd80e7bb0e1b717";
+  release."1.6-9.1".hash = "sha256-1EKDkj33pg3AsEpckZYqWppPUZV2OkxM2xLq2zvZGMQ=";
   release."1.6-8.20".sha256 = "sha256-zne9LB0lGdqUfrBe8cDK8fwuxfBDFU4PqNlt9nl7rNI=";
   release."1.6-8.19".sha256 = "sha256-fDk60B8AzJwiemxHGgWjNu6PTu6NcJoI9uK7Ww2AT14=";
   releaseRev = v: "v${v}";

From b8d1c0987ec116743c863777dbcd00988a74cf29 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 31 Mar 2026 17:07:08 +0200
Subject: [PATCH 064/110] coqPackages.mtac2: enable for Coq 9.1

---
 pkgs/development/coq-modules/mtac2/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/coq-modules/mtac2/default.nix b/pkgs/development/coq-modules/mtac2/default.nix
index ef06e17f2d7f..75ad9aec33a7 100644
--- a/pkgs/development/coq-modules/mtac2/default.nix
+++ b/pkgs/development/coq-modules/mtac2/default.nix
@@ -14,11 +14,16 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
+      {
+        case = isEq "9.1";
+        out = "1.4-rocq${coq.coq-version}";
+      }
       {
         case = range "8.19" "9.0";
         out = "1.4-coq${coq.coq-version}";
       }
     ] null;
+  release."1.4-rocq9.1".hash = "sha256-A+ac84ZfDMW2NhS/NrGIfdairXmzXxZIYGNmJIz0ReM=";
   release."1.4-coq9.0".sha256 = "sha256-pAPBRCW7M46UZPJ+v/0xAT8mpQURN8czMmlrfYz/MVU=";
   release."1.4-coq8.20".sha256 = "sha256-3nu/8zDvdnl6WzGtw46mVcdqgkRgc6Xy8/I+lUOrSIY=";
   release."1.4-coq8.19".sha256 = "sha256-G9eK0eLyECdT20/yf8yyz7M8Xq2WnHHaHpxVGP0yTtU=";

From dbb5048e3d22ae73d346ebc0634ffd50ddb385b2 Mon Sep 17 00:00:00 2001
From: Samuel Silva <samuel@ossystems.com.br>
Date: Tue, 31 Mar 2026 13:02:52 -0300
Subject: [PATCH 065/110] renode: fix update script

Signed-off-by: Samuel Silva <samuel@ossystems.com.br>
---
 pkgs/by-name/re/renode/package.nix |  3 +--
 pkgs/by-name/re/renode/update.sh   | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100755 pkgs/by-name/re/renode/update.sh

diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
index 42255102d626..acaab3a39f64 100644
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@@ -11,7 +11,6 @@
   gtk3,
   lib,
   mono,
-  nix-update-script,
   python3Packages,
 }:
 
@@ -180,7 +179,7 @@ buildDotnetModule rec {
 
   executables = [ "Renode" ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;
 
   meta = {
     changelog = "https://github.com/renode/renode/blob/${version}/CHANGELOG.rst";
diff --git a/pkgs/by-name/re/renode/update.sh b/pkgs/by-name/re/renode/update.sh
new file mode 100755
index 000000000000..8d7bd81babdf
--- /dev/null
+++ b/pkgs/by-name/re/renode/update.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts git nix
+
+set -euo pipefail
+
+latest_tag=$(curl -s https://api.github.com/repos/renode/renode/releases/latest | jq -r '.tag_name')
+latest_version="${latest_tag#v}"
+
+# Resolve tag to commit hash
+# Try dereferenced ref first (annotated tags), then direct ref (lightweight tags)
+commit=$(git ls-remote https://github.com/renode/renode "refs/tags/${latest_tag}^{}" | awk '{print $1}')
+if [[ -z "$commit" ]]; then
+    commit=$(git ls-remote https://github.com/renode/renode "refs/tags/${latest_tag}" | awk '{print $1}')
+fi
+
+update-source-version renode "$latest_version" --rev="$commit"
+
+# Regenerate nuget deps
+$(nix-build -A renode.passthru.fetch-deps --no-out-link)

From bfb8bb68c74aa8ce5395ad34262a12f5eaf8ca02 Mon Sep 17 00:00:00 2001
From: Samuel Silva <samuel@ossystems.com.br>
Date: Tue, 31 Mar 2026 13:06:10 -0300
Subject: [PATCH 066/110] renode: 1.16.0 -> 1.16.1

Signed-off-by: Samuel Silva <samuel@ossystems.com.br>
---
 pkgs/by-name/re/renode/deps.json   | 25 +++++++++++++++++++++++++
 pkgs/by-name/re/renode/package.nix |  6 +++---
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/renode/deps.json b/pkgs/by-name/re/renode/deps.json
index 3ec3cdaf13f6..7dd406f27405 100644
--- a/pkgs/by-name/re/renode/deps.json
+++ b/pkgs/by-name/re/renode/deps.json
@@ -39,6 +39,31 @@
     "version": "3.24.24.95",
     "hash": "sha256-5THx4af5PghPnQxXdnsC+wtVcoslh+0636WkB1FaPYg="
   },
+  {
+    "pname": "GirCore.GLib-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-u3jwn7fQONG4M4i4gX6glR1zKn2JNI05QieFf1Gsays="
+  },
+  {
+    "pname": "GirCore.GObject-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-bmCHh0NyjG8YumCCI2zR8lrb6lhD6uF3MsA9tE1aWIA="
+  },
+  {
+    "pname": "GirCore.Gst-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-XxUcFgzhtD1YKjP9vF1w/oloZOZRlBPH1AO0cAkoWvk="
+  },
+  {
+    "pname": "GirCore.GstApp-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-uKSgmjZ4WwGxptKZKofcXMPa99UO1VHRX7OZdgqEs04="
+  },
+  {
+    "pname": "GirCore.GstBase-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-WZC/W/zsRFixjoYb19PttEnKw422n7qZC+dnWLcgCb8="
+  },
   {
     "pname": "GLibSharp",
     "version": "3.24.24.95",
diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
index acaab3a39f64..8bf600a1dfd4 100644
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@@ -58,13 +58,13 @@ let
 in
 buildDotnetModule rec {
   pname = "renode";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "20ad06d9379997829df309c5724be94ba4effedd";
-    hash = "sha256-I/W3OAzHCN8rEIlDyBwI1ZDvKfHYYBDiqE9XkWHxo7o=";
+    rev = "d66b0c2aa3d420408eccecfd1d3bab0fd702a6db";
+    hash = "sha256-HQaMo3qsZvD4uBIsGzyKpTO7gaxjVvurI91pm1UXvjc=";
     fetchSubmodules = true;
   };
 

From 73aaaddf0fad7f4a0a5f3005e95dbdf0129f2a45 Mon Sep 17 00:00:00 2001
From: Samuel Silva <samuel@ossystems.com.br>
Date: Tue, 31 Mar 2026 14:00:10 -0300
Subject: [PATCH 067/110] renode-unstable: fix update script

Signed-off-by: Samuel Silva <samuel@ossystems.com.br>
---
 pkgs/by-name/re/renode-unstable/package.nix |  7 +------
 pkgs/by-name/re/renode-unstable/update.sh   | 23 +++++++++++++++++++++
 2 files changed, 24 insertions(+), 6 deletions(-)
 create mode 100755 pkgs/by-name/re/renode-unstable/update.sh

diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index a773f819cdb1..2a63f659bf63 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  nix-update-script,
   renode,
   lib,
 }:
@@ -32,10 +31,6 @@ renode.overrideAttrs (old: rec {
   '';
 
   passthru = old.passthru // {
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version=branch"
-      ];
-    };
+    updateScript = ./update.sh;
   };
 })
diff --git a/pkgs/by-name/re/renode-unstable/update.sh b/pkgs/by-name/re/renode-unstable/update.sh
new file mode 100755
index 000000000000..60b7782618e4
--- /dev/null
+++ b/pkgs/by-name/re/renode-unstable/update.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq git nix nix-prefetch-github
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+latest_rev=$(git ls-remote https://github.com/renode/renode refs/heads/master | awk '{print $1}')
+commit_date=$(curl -s "https://api.github.com/repos/renode/renode/commits/${latest_rev}" | jq -r '.commit.committer.date' | cut -dT -f1)
+
+latest_tag=$(curl -s https://api.github.com/repos/renode/renode/releases/latest | jq -r '.tag_name | ltrimstr("v")')
+
+new_version="${latest_tag}-unstable-${commit_date}"
+
+new_hash=$(nix-prefetch-github renode renode --rev "$latest_rev" --fetch-submodules | jq -r '.hash')
+
+sed -i "s|version = \".*\"|version = \"${new_version}\"|" "$PKG_FILE"
+sed -i "s|rev = \".*\"|rev = \"${latest_rev}\"|" "$PKG_FILE"
+sed -i "s|hash = \".*\"|hash = \"${new_hash}\"|" "$PKG_FILE"
+
+# Regenerate nuget deps in the correct location
+$(nix-build -A renode-unstable.passthru.fetch-deps --no-out-link) "$SCRIPT_DIR/deps.json"

From aa8ed2552a22d9ca75f9d73afd37074d05e0d1fc Mon Sep 17 00:00:00 2001
From: Samuel Silva <samuel@ossystems.com.br>
Date: Tue, 31 Mar 2026 14:14:11 -0300
Subject: [PATCH 068/110] renode-unstable: 1.16.0-unstable-2025-12-11 ->
 1.16.1-unstable-2026-03-31

Signed-off-by: Samuel Silva <samuel@ossystems.com.br>
---
 pkgs/by-name/re/renode-unstable/deps.json   | 1322 +++++++++++++++++++
 pkgs/by-name/re/renode-unstable/package.nix |    8 +-
 2 files changed, 1327 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/re/renode-unstable/deps.json

diff --git a/pkgs/by-name/re/renode-unstable/deps.json b/pkgs/by-name/re/renode-unstable/deps.json
new file mode 100644
index 000000000000..7dd406f27405
--- /dev/null
+++ b/pkgs/by-name/re/renode-unstable/deps.json
@@ -0,0 +1,1322 @@
+[
+  {
+    "pname": "AsyncIO",
+    "version": "0.1.69",
+    "hash": "sha256-JQKq/U71NQTfPuUqj7z5bALe+d7G1o3GcI8kvVDxy6o="
+  },
+  {
+    "pname": "AtkSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-NgdWbXToBHhEVbvPrFcwXeit5iaqbBmNPQiC0jPKlnQ="
+  },
+  {
+    "pname": "CairoSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-ycdgmQyQ1uSshI/9uMaqn5OBxRF8RADf4Tn/TptE2BU="
+  },
+  {
+    "pname": "Castle.Core",
+    "version": "5.0.0",
+    "hash": "sha256-o0dLsy0RfVOIggymFbUJMhfR3XDp6uFI3G1o4j9o2Lg="
+  },
+  {
+    "pname": "DynamicLanguageRuntime",
+    "version": "1.3.5",
+    "hash": "sha256-8spaocJ0jH4suK7EQKjMOH0+pdhapV44ZxBFUBKl3h0="
+  },
+  {
+    "pname": "Dynamitey",
+    "version": "2.0.10.189",
+    "hash": "sha256-Gk2sqTdAzX6JqIGm+qoVnQX0tuI1eV3Cn+eJMkcmnD0="
+  },
+  {
+    "pname": "GdkSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-NYjADgZG9TUQDIZiSSXDAxj5PyX/B7oKRo9f8Oyb4vI="
+  },
+  {
+    "pname": "GioSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-5THx4af5PghPnQxXdnsC+wtVcoslh+0636WkB1FaPYg="
+  },
+  {
+    "pname": "GirCore.GLib-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-u3jwn7fQONG4M4i4gX6glR1zKn2JNI05QieFf1Gsays="
+  },
+  {
+    "pname": "GirCore.GObject-2.0",
+    "version": "0.7.0",
+    "hash": "sha256-bmCHh0NyjG8YumCCI2zR8lrb6lhD6uF3MsA9tE1aWIA="
+  },
+  {
+    "pname": "GirCore.Gst-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-XxUcFgzhtD1YKjP9vF1w/oloZOZRlBPH1AO0cAkoWvk="
+  },
+  {
+    "pname": "GirCore.GstApp-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-uKSgmjZ4WwGxptKZKofcXMPa99UO1VHRX7OZdgqEs04="
+  },
+  {
+    "pname": "GirCore.GstBase-1.0",
+    "version": "0.7.0",
+    "hash": "sha256-WZC/W/zsRFixjoYb19PttEnKw422n7qZC+dnWLcgCb8="
+  },
+  {
+    "pname": "GLibSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-1pDRkKoUI9fLJBcTA2DBlpVccJl2GyAdL+VKjsFbttA="
+  },
+  {
+    "pname": "GtkSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-sBvk5Ecf2i6c2fYVjMBVoXz0I6IlucOWeE2czZH9QHg="
+  },
+  {
+    "pname": "Humanizer.Core",
+    "version": "2.2.0",
+    "hash": "sha256-5Q6oRaV8wHPONHreKvB74VjV2FW36mwC3n+05It5vyI="
+  },
+  {
+    "pname": "IronPython",
+    "version": "2.7.8",
+    "hash": "sha256-91NgTy3Q4MmD4GlhT+WjdVKQGRlIENdIJuyP9hE/iCs="
+  },
+  {
+    "pname": "IronPython.StdLib",
+    "version": "2.7.12",
+    "hash": "sha256-LfGg7EMJCVl2MiQjVD2dr8nOZKSqS/I42lO364YtzcA="
+  },
+  {
+    "pname": "K4os.Compression.LZ4",
+    "version": "1.3.8",
+    "hash": "sha256-OmT3JwO4qpkZDL7XqiFqZCyxySj64s9t+mXcN1T+IyA="
+  },
+  {
+    "pname": "Microsoft.Bcl.AsyncInterfaces",
+    "version": "5.0.0",
+    "hash": "sha256-bpJjcJSUSZH0GeOXoZI12xUQOf2SRtxG7sZV0dWS5TI="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Analyzers",
+    "version": "3.0.0",
+    "hash": "sha256-KDbCfsBWSJ5ohEXUKp1s1LX9xA2NPvXE/xVzj68EdC0="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Analyzers",
+    "version": "3.3.4",
+    "hash": "sha256-qDzTfZBSCvAUu9gzq2k+LOvh6/eRvJ9++VCNck/ZpnE="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Common",
+    "version": "3.9.0",
+    "hash": "sha256-M2LpVHr+UDFCVD7PtDSRD635+RO620JKmK/siOw01PQ="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Compilers",
+    "version": "3.9.0",
+    "hash": "sha256-l9P26Rz6pV1DZkz8L8HHE63+2qTK+IOGVEtEd7A//us="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.CSharp",
+    "version": "3.9.0",
+    "hash": "sha256-f3591/1mz/P3Asi9NTYU38bNukrKR7COR0pGmEtPKzM="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.CSharp.Workspaces",
+    "version": "3.9.0",
+    "hash": "sha256-/3J5wdymZZdsDOaKtkvda8o97T69EaTKk5aR4Rc1bzM="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.VisualBasic",
+    "version": "3.9.0",
+    "hash": "sha256-5p4UrCoOMdFZ65vkHlak1VDpvU6msBCM2dK3Kyn4k2c="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Workspaces.Common",
+    "version": "3.9.0",
+    "hash": "sha256-Zzi/rXQA8BDJbUn9kKR7GB8dB7iwA1qlPnEkh8NMecU="
+  },
+  {
+    "pname": "Microsoft.CodeCoverage",
+    "version": "16.9.1",
+    "hash": "sha256-Tnlv9n5qKipmc17lld4HHfL/KInIq4KhmdTySTjqOqI="
+  },
+  {
+    "pname": "Microsoft.CSharp",
+    "version": "4.0.1",
+    "hash": "sha256-0huoqR2CJ3Z9Q2peaKD09TV3E6saYSqDGZ290K8CrH8="
+  },
+  {
+    "pname": "Microsoft.CSharp",
+    "version": "4.5.0",
+    "hash": "sha256-dAhj/CgXG5VIy2dop1xplUsLje7uBPFjxasz9rdFIgY="
+  },
+  {
+    "pname": "Microsoft.CSharp",
+    "version": "4.6.0",
+    "hash": "sha256-16OdEKbPLxh+jLYS4cOiGRX/oU6nv3KMF4h5WnZAsHs="
+  },
+  {
+    "pname": "Microsoft.CSharp",
+    "version": "4.7.0",
+    "hash": "sha256-Enknv2RsFF68lEPdrf5M+BpV1kHoLTVRApKUwuk/pj0="
+  },
+  {
+    "pname": "Microsoft.DotNet.InternalAbstractions",
+    "version": "1.0.0",
+    "hash": "sha256-HX3iOXH75I1L7eNihCbMNDDpcotfZpfQUdqdRTGM6FY="
+  },
+  {
+    "pname": "Microsoft.Extensions.ObjectPool",
+    "version": "6.0.16",
+    "hash": "sha256-+b3/mTZkFXTAC+dLeCfN6B3XuTDT8e+/N6xkzwgZRi4="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Logging",
+    "version": "6.8.0",
+    "hash": "sha256-w3jP0TAD3D2HLWlY0meGDmbV7N5kc2Er2nfYmuq0TJo="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Protocols.WsTrust",
+    "version": "6.8.0",
+    "hash": "sha256-yBnJQC+1pYpScnb8w/EYrVB5VrD7S0FytiGNNnCXggk="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Tokens",
+    "version": "6.8.0",
+    "hash": "sha256-NJsIvWJwrVrQndhHDpXf7eS1Gr/+2ua9nkW5ivWQyFY="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Tokens.Saml",
+    "version": "6.8.0",
+    "hash": "sha256-K3EUlCtNP+w6woHkwGaWhMJmIhlfOD5x4gl4qwo3rHU="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Xml",
+    "version": "6.8.0",
+    "hash": "sha256-Fd7vRbOmJb0VwdO4RzF94GWBVNncDD5vC8FNPunayWw="
+  },
+  {
+    "pname": "Microsoft.NET.Test.Sdk",
+    "version": "16.9.1",
+    "hash": "sha256-hefOxUAdu2CRsz+9Avq+fS9PIGxfbQdK4JDXcueuwZw="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "1.0.1",
+    "hash": "sha256-mZotlGZqtrqDSoBrZhsxFe6fuOv5/BIo0w2Z2x0zVAU="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "1.1.0",
+    "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "2.0.0",
+    "hash": "sha256-IEvBk6wUXSdyCnkj6tHahOJv290tVVT8tyemYcR0Yro="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "2.1.2",
+    "hash": "sha256-gYQQO7zsqG+OtN4ywYQyfsiggS2zmxw4+cPXlK+FB5Q="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "3.1.0",
+    "hash": "sha256-cnygditsEaU86bnYtIthNMymAHqaT/sf9Gjykhzqgb0="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "5.0.0",
+    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
+  },
+  {
+    "pname": "Microsoft.NETCore.Targets",
+    "version": "1.0.1",
+    "hash": "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="
+  },
+  {
+    "pname": "Microsoft.NETCore.Targets",
+    "version": "1.1.0",
+    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.ObjectModel",
+    "version": "16.9.1",
+    "hash": "sha256-LZJLTWU2DOnuBiN/g+S+rwG2/BJtKrjydKnj3ujp98U="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.TestHost",
+    "version": "16.9.1",
+    "hash": "sha256-92/trlM66kPR7ASpg6x7kk43glZYaOKrkaNJQE8uPbs="
+  },
+  {
+    "pname": "Microsoft.Win32.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "4.3.0",
+    "hash": "sha256-50XwFbyRfZkTD/bBn76WV/NIpOy/mzXD3MMEVFX/vr8="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "4.4.0",
+    "hash": "sha256-ZumsykAAIYKmVtP4QI5kZ0J10n2zcOZZ69PmAK0SEiE="
+  },
+  {
+    "pname": "Microsoft.Win32.SystemEvents",
+    "version": "5.0.0",
+    "hash": "sha256-mGUKg+bmB5sE/DCwsTwCsbe00MCwpgxsVW3nCtQiSmo="
+  },
+  {
+    "pname": "Mono.Cecil",
+    "version": "0.11.3",
+    "hash": "sha256-QxJcRt3eYy7R0mc25F/hM5n4qVqBAlZChsEKn+Y9nXU="
+  },
+  {
+    "pname": "Mono.Posix",
+    "version": "7.1.0-final.1.21458.1",
+    "hash": "sha256-kbpbruyWKfWfRg9IX0wR8UirykgJdLZl2d5PqUgFxz4="
+  },
+  {
+    "pname": "Mono.Unix",
+    "version": "7.1.0-final.1.21458.1",
+    "hash": "sha256-tm3niOm4OFCe/kL5M5zwCZgfHEaPtmDqsOLN6GExYHs="
+  },
+  {
+    "pname": "Moq",
+    "version": "4.18.1",
+    "hash": "sha256-Qe3wOHdnTAKRUiqj9BeqOUOiFC6L9lCTCSkvkXrEnEM="
+  },
+  {
+    "pname": "NaCl.Net",
+    "version": "0.1.13",
+    "hash": "sha256-Zy9ckPxrBcKy31g2pKc5uxF22jayw3ZmbrvDBW3MIlk="
+  },
+  {
+    "pname": "NetMQ",
+    "version": "4.0.1.12",
+    "hash": "sha256-O38SQuMRpTCz3YScEu0T9jw9DrVeQW5pAeHexYyooH8="
+  },
+  {
+    "pname": "NETStandard.Library",
+    "version": "1.6.1",
+    "hash": "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="
+  },
+  {
+    "pname": "NETStandard.Library",
+    "version": "2.0.0",
+    "hash": "sha256-Pp7fRylai8JrE1O+9TGfIEJrAOmnWTJRLWE+qJBahK0="
+  },
+  {
+    "pname": "Newtonsoft.Json",
+    "version": "9.0.1",
+    "hash": "sha256-mYCBrgUhIJFzRuLLV9SIiIFHovzfR8Uuqfg6e08EnlU="
+  },
+  {
+    "pname": "NuGet.Frameworks",
+    "version": "5.0.0",
+    "hash": "sha256-WWLh+v9Y9as+WURW8tUPowQB8HWIiVJzbpKzEWTdMqI="
+  },
+  {
+    "pname": "NUnit",
+    "version": "3.13.1",
+    "hash": "sha256-qdbPWgCXueQdHpGdNQtdz16Zfg+XESI9xDlRD/IzJRw="
+  },
+  {
+    "pname": "NUnit3TestAdapter",
+    "version": "3.17.0",
+    "hash": "sha256-ZlpEM9IQlqsRPmYPMN6yCbICfakSoY89y40xtMY3rE8="
+  },
+  {
+    "pname": "PangoSharp",
+    "version": "3.24.24.95",
+    "hash": "sha256-YhltIz1jisJqR2ZxvbYy0ybi4oGw6qR2SkjF/2aWiBQ="
+  },
+  {
+    "pname": "runtime.any.System.Collections",
+    "version": "4.3.0",
+    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
+  },
+  {
+    "pname": "runtime.any.System.Diagnostics.Tools",
+    "version": "4.3.0",
+    "hash": "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="
+  },
+  {
+    "pname": "runtime.any.System.Diagnostics.Tracing",
+    "version": "4.3.0",
+    "hash": "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="
+  },
+  {
+    "pname": "runtime.any.System.Globalization",
+    "version": "4.3.0",
+    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
+  },
+  {
+    "pname": "runtime.any.System.Globalization.Calendars",
+    "version": "4.3.0",
+    "hash": "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="
+  },
+  {
+    "pname": "runtime.any.System.IO",
+    "version": "4.3.0",
+    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
+  },
+  {
+    "pname": "runtime.any.System.Reflection",
+    "version": "4.3.0",
+    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
+  },
+  {
+    "pname": "runtime.any.System.Reflection.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="
+  },
+  {
+    "pname": "runtime.any.System.Reflection.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
+  },
+  {
+    "pname": "runtime.any.System.Resources.ResourceManager",
+    "version": "4.3.0",
+    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
+  },
+  {
+    "pname": "runtime.any.System.Runtime",
+    "version": "4.3.0",
+    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
+  },
+  {
+    "pname": "runtime.any.System.Runtime.Handles",
+    "version": "4.3.0",
+    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
+  },
+  {
+    "pname": "runtime.any.System.Runtime.InteropServices",
+    "version": "4.3.0",
+    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
+  },
+  {
+    "pname": "runtime.any.System.Text.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
+  },
+  {
+    "pname": "runtime.any.System.Text.Encoding.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="
+  },
+  {
+    "pname": "runtime.any.System.Threading.Tasks",
+    "version": "4.3.0",
+    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
+  },
+  {
+    "pname": "runtime.any.System.Threading.Timer",
+    "version": "4.3.0",
+    "hash": "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="
+  },
+  {
+    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
+  },
+  {
+    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
+  },
+  {
+    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
+  },
+  {
+    "pname": "runtime.native.System",
+    "version": "4.3.0",
+    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
+  },
+  {
+    "pname": "runtime.native.System.IO.Compression",
+    "version": "4.3.0",
+    "hash": "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="
+  },
+  {
+    "pname": "runtime.native.System.Net.Http",
+    "version": "4.3.0",
+    "hash": "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="
+  },
+  {
+    "pname": "runtime.native.System.Security.Cryptography.Apple",
+    "version": "4.3.0",
+    "hash": "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="
+  },
+  {
+    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
+  },
+  {
+    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
+  },
+  {
+    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
+  },
+  {
+    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple",
+    "version": "4.3.0",
+    "hash": "sha256-serkd4A7F6eciPiPJtUyJyxzdAtupEcWIZQ9nptEzIM="
+  },
+  {
+    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
+  },
+  {
+    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
+  },
+  {
+    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
+  },
+  {
+    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
+  },
+  {
+    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
+  },
+  {
+    "pname": "runtime.unix.Microsoft.Win32.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="
+  },
+  {
+    "pname": "runtime.unix.System.Console",
+    "version": "4.3.0",
+    "hash": "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="
+  },
+  {
+    "pname": "runtime.unix.System.Diagnostics.Debug",
+    "version": "4.3.0",
+    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
+  },
+  {
+    "pname": "runtime.unix.System.IO.FileSystem",
+    "version": "4.3.0",
+    "hash": "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="
+  },
+  {
+    "pname": "runtime.unix.System.Net.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="
+  },
+  {
+    "pname": "runtime.unix.System.Net.Sockets",
+    "version": "4.3.0",
+    "hash": "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="
+  },
+  {
+    "pname": "runtime.unix.System.Private.Uri",
+    "version": "4.3.0",
+    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
+  },
+  {
+    "pname": "runtime.unix.System.Runtime.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
+  },
+  {
+    "pname": "StyleCop.Analyzers",
+    "version": "1.1.118",
+    "hash": "sha256-CjC1f5z0sP15F6FeXqIDOtZLHqgjmQTzpsIrRkxXREI="
+  },
+  {
+    "pname": "System.AppContext",
+    "version": "4.1.0",
+    "hash": "sha256-v6YfyfrKmhww+EYHUq6cwYUMj00MQ6SOfJtcGVRlYzs="
+  },
+  {
+    "pname": "System.AppContext",
+    "version": "4.3.0",
+    "hash": "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="
+  },
+  {
+    "pname": "System.Buffers",
+    "version": "4.3.0",
+    "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
+  },
+  {
+    "pname": "System.CodeDom",
+    "version": "8.0.0",
+    "hash": "sha256-uwVhi3xcvX7eiOGQi7dRETk3Qx1EfHsUfchZsEto338="
+  },
+  {
+    "pname": "System.Collections",
+    "version": "4.0.11",
+    "hash": "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="
+  },
+  {
+    "pname": "System.Collections",
+    "version": "4.3.0",
+    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
+  },
+  {
+    "pname": "System.Collections.Concurrent",
+    "version": "4.3.0",
+    "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
+  },
+  {
+    "pname": "System.Collections.Immutable",
+    "version": "5.0.0",
+    "hash": "sha256-GdwSIjLMM0uVfE56VUSLVNgpW0B//oCeSFj8/hSlbM8="
+  },
+  {
+    "pname": "System.Collections.NonGeneric",
+    "version": "4.3.0",
+    "hash": "sha256-8/yZmD4jjvq7m68SPkJZLBQ79jOTOyT5lyzX4SCYAx8="
+  },
+  {
+    "pname": "System.Collections.Specialized",
+    "version": "4.3.0",
+    "hash": "sha256-QNg0JJNx+zXMQ26MJRPzH7THdtqjrNtGLUgaR1SdvOk="
+  },
+  {
+    "pname": "System.ComponentModel",
+    "version": "4.3.0",
+    "hash": "sha256-i00uujMO4JEDIEPKLmdLY3QJ6vdSpw6Gh9oOzkFYBiU="
+  },
+  {
+    "pname": "System.ComponentModel.EventBasedAsync",
+    "version": "4.3.0",
+    "hash": "sha256-h7o4X3XojdRyJWQdUfZetLdqtrQlddMzxhh6j9Zcaec="
+  },
+  {
+    "pname": "System.ComponentModel.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-IOMJleuIBppmP4ECB3uftbdcgL7CCd56+oAD/Sqrbus="
+  },
+  {
+    "pname": "System.ComponentModel.TypeConverter",
+    "version": "4.3.0",
+    "hash": "sha256-PSDiPYt8PgTdTUBz+GH6lHCaM1YgfObneHnZsc8Fz54="
+  },
+  {
+    "pname": "System.Composition",
+    "version": "1.0.31",
+    "hash": "sha256-wcQEG6MCRa1S03s3Yb3E3tfsIBZid99M7WDhcb48Qik="
+  },
+  {
+    "pname": "System.Composition.AttributedModel",
+    "version": "1.0.31",
+    "hash": "sha256-u+XnXfj6LQ3OXwrb9KqHRW4a/a9yHzLrJOXwDQ1a/sY="
+  },
+  {
+    "pname": "System.Composition.Convention",
+    "version": "1.0.31",
+    "hash": "sha256-GQWo1YDyQ3r2OMcKW+GbR3BbZNIAdwK79XAfinNj+AE="
+  },
+  {
+    "pname": "System.Composition.Hosting",
+    "version": "1.0.31",
+    "hash": "sha256-fg9BIY+zWtiEBIJefYP2lKHDYa4r/vtPTr3ZI8e0K7g="
+  },
+  {
+    "pname": "System.Composition.Runtime",
+    "version": "1.0.31",
+    "hash": "sha256-mqfxjAnVyE1YCgXMOcV34IWhYFnvXVKjMo9Y/d3yDuo="
+  },
+  {
+    "pname": "System.Composition.TypedParts",
+    "version": "1.0.31",
+    "hash": "sha256-w9ApcUJr7jYP4Vf5+efIIqoWmr5v9R56W4uC0n8KktQ="
+  },
+  {
+    "pname": "System.Console",
+    "version": "4.3.0",
+    "hash": "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="
+  },
+  {
+    "pname": "System.Diagnostics.Debug",
+    "version": "4.0.11",
+    "hash": "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="
+  },
+  {
+    "pname": "System.Diagnostics.Debug",
+    "version": "4.3.0",
+    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
+  },
+  {
+    "pname": "System.Diagnostics.DiagnosticSource",
+    "version": "4.3.0",
+    "hash": "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="
+  },
+  {
+    "pname": "System.Diagnostics.EventLog",
+    "version": "6.0.0",
+    "hash": "sha256-zUXIQtAFKbiUMKCrXzO4mOTD5EUphZzghBYKXprowSM="
+  },
+  {
+    "pname": "System.Diagnostics.Process",
+    "version": "4.3.0",
+    "hash": "sha256-Rzo24qXhuJDDgrGNHr2eQRHhwLmsYmWDqAg/P5fOlzw="
+  },
+  {
+    "pname": "System.Diagnostics.Tools",
+    "version": "4.0.1",
+    "hash": "sha256-vSBqTbmWXylvRa37aWyktym+gOpsvH43mwr6A962k6U="
+  },
+  {
+    "pname": "System.Diagnostics.Tools",
+    "version": "4.3.0",
+    "hash": "sha256-gVOv1SK6Ape0FQhCVlNOd9cvQKBvMxRX9K0JPVi8w0Y="
+  },
+  {
+    "pname": "System.Diagnostics.Tracing",
+    "version": "4.3.0",
+    "hash": "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="
+  },
+  {
+    "pname": "System.Drawing.Common",
+    "version": "4.7.0",
+    "hash": "sha256-D3qG+xAe78lZHvlco9gHK2TEAM370k09c6+SQi873Hk="
+  },
+  {
+    "pname": "System.Drawing.Common",
+    "version": "5.0.3",
+    "hash": "sha256-nr1bSJoGA97IfrQQTyakVIx3r0bpoZfs6xtrDgvE2+Y="
+  },
+  {
+    "pname": "System.Dynamic.Runtime",
+    "version": "4.0.11",
+    "hash": "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="
+  },
+  {
+    "pname": "System.Formats.Asn1",
+    "version": "6.0.0",
+    "hash": "sha256-KaMHgIRBF7Nf3VwOo+gJS1DcD+41cJDPWFh+TDQ8ee8="
+  },
+  {
+    "pname": "System.Globalization",
+    "version": "4.0.11",
+    "hash": "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="
+  },
+  {
+    "pname": "System.Globalization",
+    "version": "4.3.0",
+    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
+  },
+  {
+    "pname": "System.Globalization.Calendars",
+    "version": "4.3.0",
+    "hash": "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="
+  },
+  {
+    "pname": "System.Globalization.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="
+  },
+  {
+    "pname": "System.IO",
+    "version": "4.1.0",
+    "hash": "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="
+  },
+  {
+    "pname": "System.IO",
+    "version": "4.3.0",
+    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
+  },
+  {
+    "pname": "System.IO.Compression",
+    "version": "4.3.0",
+    "hash": "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="
+  },
+  {
+    "pname": "System.IO.Compression.ZipFile",
+    "version": "4.3.0",
+    "hash": "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="
+  },
+  {
+    "pname": "System.IO.FileSystem",
+    "version": "4.0.1",
+    "hash": "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="
+  },
+  {
+    "pname": "System.IO.FileSystem",
+    "version": "4.3.0",
+    "hash": "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="
+  },
+  {
+    "pname": "System.IO.FileSystem.Primitives",
+    "version": "4.0.1",
+    "hash": "sha256-IpigKMomqb6pmYWkrlf0ZdpILtRluX2cX5sOKVW0Feg="
+  },
+  {
+    "pname": "System.IO.FileSystem.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
+  },
+  {
+    "pname": "System.IO.Pipelines",
+    "version": "5.0.0",
+    "hash": "sha256-o5ATaT13t/Q+ejEO70N9qOzb2dLrjYxCba1plPJfu80="
+  },
+  {
+    "pname": "System.Linq",
+    "version": "4.1.0",
+    "hash": "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="
+  },
+  {
+    "pname": "System.Linq",
+    "version": "4.3.0",
+    "hash": "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="
+  },
+  {
+    "pname": "System.Linq.Expressions",
+    "version": "4.1.0",
+    "hash": "sha256-7zqB+FXgkvhtlBzpcZyd81xczWP0D3uWssyAGw3t7b4="
+  },
+  {
+    "pname": "System.Linq.Expressions",
+    "version": "4.3.0",
+    "hash": "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="
+  },
+  {
+    "pname": "System.Memory",
+    "version": "4.5.4",
+    "hash": "sha256-3sCEfzO4gj5CYGctl9ZXQRRhwAraMQfse7yzKoRe65E="
+  },
+  {
+    "pname": "System.Net.Http",
+    "version": "4.3.0",
+    "hash": "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="
+  },
+  {
+    "pname": "System.Net.NameResolution",
+    "version": "4.3.0",
+    "hash": "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="
+  },
+  {
+    "pname": "System.Net.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="
+  },
+  {
+    "pname": "System.Net.Sockets",
+    "version": "4.3.0",
+    "hash": "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="
+  },
+  {
+    "pname": "System.Numerics.Vectors",
+    "version": "4.5.0",
+    "hash": "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="
+  },
+  {
+    "pname": "System.ObjectModel",
+    "version": "4.0.12",
+    "hash": "sha256-MudZ/KYcvYsn2cST3EE049mLikrNkmE7QoUoYKKby+s="
+  },
+  {
+    "pname": "System.ObjectModel",
+    "version": "4.3.0",
+    "hash": "sha256-gtmRkWP2Kwr3nHtDh0yYtce38z1wrGzb6fjm4v8wN6Q="
+  },
+  {
+    "pname": "System.Private.ServiceModel",
+    "version": "4.8.1",
+    "hash": "sha256-d/Mw1lVN0Gb2+pHltqM4qjBOO67vFGfI5zRK5MHa2rg="
+  },
+  {
+    "pname": "System.Private.ServiceModel",
+    "version": "4.9.0",
+    "hash": "sha256-AbJKAZzZDxKVXm5761XE+nhlkiDqX9eb6+Y9d4Hq+4Q="
+  },
+  {
+    "pname": "System.Private.Uri",
+    "version": "4.3.0",
+    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
+  },
+  {
+    "pname": "System.Reflection",
+    "version": "4.1.0",
+    "hash": "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="
+  },
+  {
+    "pname": "System.Reflection",
+    "version": "4.3.0",
+    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
+  },
+  {
+    "pname": "System.Reflection.DispatchProxy",
+    "version": "4.7.1",
+    "hash": "sha256-Oi+l32p73ZxwcB6GrSS2m25BccfpuwbY4eyFEwUe0IM="
+  },
+  {
+    "pname": "System.Reflection.Emit",
+    "version": "4.0.1",
+    "hash": "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="
+  },
+  {
+    "pname": "System.Reflection.Emit",
+    "version": "4.3.0",
+    "hash": "sha256-5LhkDmhy2FkSxulXR+bsTtMzdU3VyyuZzsxp7/DwyIU="
+  },
+  {
+    "pname": "System.Reflection.Emit.ILGeneration",
+    "version": "4.0.1",
+    "hash": "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="
+  },
+  {
+    "pname": "System.Reflection.Emit.ILGeneration",
+    "version": "4.3.0",
+    "hash": "sha256-mKRknEHNls4gkRwrEgi39B+vSaAz/Gt3IALtS98xNnA="
+  },
+  {
+    "pname": "System.Reflection.Emit.ILGeneration",
+    "version": "4.7.0",
+    "hash": "sha256-GUnQeGo/DtvZVQpFnESGq7lJcjB30/KnDY7Kd2G/ElE="
+  },
+  {
+    "pname": "System.Reflection.Emit.Lightweight",
+    "version": "4.0.1",
+    "hash": "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="
+  },
+  {
+    "pname": "System.Reflection.Emit.Lightweight",
+    "version": "4.3.0",
+    "hash": "sha256-rKx4a9yZKcajloSZHr4CKTVJ6Vjh95ni+zszPxWjh2I="
+  },
+  {
+    "pname": "System.Reflection.Emit.Lightweight",
+    "version": "4.7.0",
+    "hash": "sha256-V0Wz/UUoNIHdTGS9e1TR89u58zJjo/wPUWw6VaVyclU="
+  },
+  {
+    "pname": "System.Reflection.Extensions",
+    "version": "4.0.1",
+    "hash": "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="
+  },
+  {
+    "pname": "System.Reflection.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="
+  },
+  {
+    "pname": "System.Reflection.Metadata",
+    "version": "1.6.0",
+    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
+  },
+  {
+    "pname": "System.Reflection.Metadata",
+    "version": "5.0.0",
+    "hash": "sha256-Wo+MiqhcP9dQ6NuFGrQTw6hpbJORFwp+TBNTq2yhGp8="
+  },
+  {
+    "pname": "System.Reflection.Primitives",
+    "version": "4.0.1",
+    "hash": "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="
+  },
+  {
+    "pname": "System.Reflection.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
+  },
+  {
+    "pname": "System.Reflection.TypeExtensions",
+    "version": "4.1.0",
+    "hash": "sha256-R0YZowmFda+xzKNR4kKg7neFoE30KfZwp/IwfRSKVK4="
+  },
+  {
+    "pname": "System.Reflection.TypeExtensions",
+    "version": "4.3.0",
+    "hash": "sha256-4U4/XNQAnddgQIHIJq3P2T80hN0oPdU2uCeghsDTWng="
+  },
+  {
+    "pname": "System.Resources.ResourceManager",
+    "version": "4.0.1",
+    "hash": "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="
+  },
+  {
+    "pname": "System.Resources.ResourceManager",
+    "version": "4.3.0",
+    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
+  },
+  {
+    "pname": "System.Runtime",
+    "version": "4.1.0",
+    "hash": "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="
+  },
+  {
+    "pname": "System.Runtime",
+    "version": "4.3.0",
+    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
+  },
+  {
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "4.5.2",
+    "hash": "sha256-8eUXXGWO2LL7uATMZye2iCpQOETn2jCcjUhG6coR5O8="
+  },
+  {
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "5.0.0",
+    "hash": "sha256-neARSpLPUzPxEKhJRwoBzhPxK+cKIitLx7WBYncsYgo="
+  },
+  {
+    "pname": "System.Runtime.Extensions",
+    "version": "4.1.0",
+    "hash": "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="
+  },
+  {
+    "pname": "System.Runtime.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
+  },
+  {
+    "pname": "System.Runtime.Handles",
+    "version": "4.0.1",
+    "hash": "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="
+  },
+  {
+    "pname": "System.Runtime.Handles",
+    "version": "4.3.0",
+    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
+  },
+  {
+    "pname": "System.Runtime.InteropServices",
+    "version": "4.1.0",
+    "hash": "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="
+  },
+  {
+    "pname": "System.Runtime.InteropServices",
+    "version": "4.3.0",
+    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
+  },
+  {
+    "pname": "System.Runtime.InteropServices.RuntimeInformation",
+    "version": "4.0.0",
+    "hash": "sha256-5j53amb76A3SPiE3B0llT2XPx058+CgE7OXL4bLalT4="
+  },
+  {
+    "pname": "System.Runtime.InteropServices.RuntimeInformation",
+    "version": "4.3.0",
+    "hash": "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="
+  },
+  {
+    "pname": "System.Runtime.Numerics",
+    "version": "4.3.0",
+    "hash": "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="
+  },
+  {
+    "pname": "System.Runtime.Serialization.Primitives",
+    "version": "4.1.1",
+    "hash": "sha256-80B05oxJbPLGq2pGOSl6NlZvintX9A1CNpna2aN0WRA="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "4.4.0",
+    "hash": "sha256-J3T2ECVdL0JiBA999CUz77az545CVOYB11/NPA/huEc="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "4.7.0",
+    "hash": "sha256-/9ZCPIHLdhzq7OW4UKqTsR0O93jjHd6BRG1SRwgHE1g="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "6.0.0",
+    "hash": "sha256-qOyWEBbNr3EjyS+etFG8/zMbuPjA+O+di717JP9Cxyg="
+  },
+  {
+    "pname": "System.Security.Claims",
+    "version": "4.3.0",
+    "hash": "sha256-Fua/rDwAqq4UByRVomAxMPmDBGd5eImRqHVQIeSxbks="
+  },
+  {
+    "pname": "System.Security.Cryptography.Algorithms",
+    "version": "4.3.0",
+    "hash": "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="
+  },
+  {
+    "pname": "System.Security.Cryptography.Cng",
+    "version": "4.3.0",
+    "hash": "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="
+  },
+  {
+    "pname": "System.Security.Cryptography.Cng",
+    "version": "4.5.0",
+    "hash": "sha256-9llRbEcY1fHYuTn3vGZaCxsFxSAqXl4bDA6Rz9b0pN4="
+  },
+  {
+    "pname": "System.Security.Cryptography.Cng",
+    "version": "4.7.0",
+    "hash": "sha256-MvVSJhAojDIvrpuyFmcSVRSZPl3dRYOI9hSptbA+6QA="
+  },
+  {
+    "pname": "System.Security.Cryptography.Csp",
+    "version": "4.3.0",
+    "hash": "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="
+  },
+  {
+    "pname": "System.Security.Cryptography.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="
+  },
+  {
+    "pname": "System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="
+  },
+  {
+    "pname": "System.Security.Cryptography.Pkcs",
+    "version": "4.7.0",
+    "hash": "sha256-lZMmOxtg5d7Oyoof8p6awVALUsYQstc2mBNNrQr9m9c="
+  },
+  {
+    "pname": "System.Security.Cryptography.Pkcs",
+    "version": "6.0.1",
+    "hash": "sha256-OJ4NJ8E/8l86aR+Hsw+k/7II63Y/zPS+MgC+UfeCXHM="
+  },
+  {
+    "pname": "System.Security.Cryptography.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="
+  },
+  {
+    "pname": "System.Security.Cryptography.X509Certificates",
+    "version": "4.3.0",
+    "hash": "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="
+  },
+  {
+    "pname": "System.Security.Cryptography.Xml",
+    "version": "4.7.0",
+    "hash": "sha256-67k24CjNisMJUtnyWb08V/t7mBns+pxLyNhBG5YXiCE="
+  },
+  {
+    "pname": "System.Security.Cryptography.Xml",
+    "version": "6.0.1",
+    "hash": "sha256-spXV8cWZu0V3liek1936REtdpvS4fQwc98JvacO1oJU="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "4.4.0",
+    "hash": "sha256-P3U50uTv0HF5uOZVoVEARyBDTyG3+Ilm9t2Ko6KVf7w="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "4.7.0",
+    "hash": "sha256-BGgXMLUi5rxVmmChjIhcXUxisJjvlNToXlyaIbUxw40="
+  },
+  {
+    "pname": "System.Security.Principal",
+    "version": "4.3.0",
+    "hash": "sha256-rjudVUHdo8pNJg2EVEn0XxxwNo5h2EaYo+QboPkXlYk="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "4.3.0",
+    "hash": "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "4.4.0",
+    "hash": "sha256-lwNBM33EW45j6o8bM4hKWirEUZCvep0VYFchc50JOYc="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "4.7.0",
+    "hash": "sha256-rWBM2U8Kq3rEdaa1MPZSYOOkbtMGgWyB8iPrpIqmpqg="
+  },
+  {
+    "pname": "System.ServiceModel.Duplex",
+    "version": "4.8.1",
+    "hash": "sha256-WDwB7gEfvvbIF18NYPvSdI7GJhYn7vINWndgrh8wpsg="
+  },
+  {
+    "pname": "System.ServiceModel.Federation",
+    "version": "4.8.1",
+    "hash": "sha256-5PmzrNH8q+kHaVS1T1bcBcH4Kgh9eL350P0qm6frWVo="
+  },
+  {
+    "pname": "System.ServiceModel.Http",
+    "version": "4.8.1",
+    "hash": "sha256-pgLvBQk2FnJbTETUKZag2LeGSXDBK6WnPYsfDbcPhLk="
+  },
+  {
+    "pname": "System.ServiceModel.Http",
+    "version": "6.0.0",
+    "hash": "sha256-jy3bGKjvrQF5l3zn8/MiYwBqlkes6kWnNHUUJxPho/s="
+  },
+  {
+    "pname": "System.ServiceModel.NetTcp",
+    "version": "4.8.1",
+    "hash": "sha256-MQGtgKRV4XuIVPV4iABY+ABIx+C4I+J74p5ohclSj7Y="
+  },
+  {
+    "pname": "System.ServiceModel.Primitives",
+    "version": "4.8.1",
+    "hash": "sha256-sZEzX9vgwtckMrTPwNg8s+bZErDv5/Yakeg5c6nUWis="
+  },
+  {
+    "pname": "System.ServiceModel.Primitives",
+    "version": "4.9.0",
+    "hash": "sha256-DguxLLRrYNn99rYxCGIljZTdZqrVC+VxJNahkFUy9NM="
+  },
+  {
+    "pname": "System.ServiceModel.Primitives",
+    "version": "6.0.0",
+    "hash": "sha256-XKKDaDp32Igr+cSPviNjUVlSjgzuGBQNCiTZUBinawY="
+  },
+  {
+    "pname": "System.ServiceModel.Security",
+    "version": "4.8.1",
+    "hash": "sha256-4aEWyw9HudwzO0oRuKKrEQrQpnUvNvkRc0aLtCQ8NZI="
+  },
+  {
+    "pname": "System.Text.Encoding",
+    "version": "4.0.11",
+    "hash": "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="
+  },
+  {
+    "pname": "System.Text.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
+  },
+  {
+    "pname": "System.Text.Encoding.CodePages",
+    "version": "4.4.0",
+    "hash": "sha256-zD24blG8xhAcL9gC4UTGKetd8c3LO0nv22nKTp2Vfx0="
+  },
+  {
+    "pname": "System.Text.Encoding.CodePages",
+    "version": "4.5.1",
+    "hash": "sha256-PIhkv59IXjyiuefdhKxS9hQfEwO9YWRuNudpo53HQfw="
+  },
+  {
+    "pname": "System.Text.Encoding.Extensions",
+    "version": "4.0.11",
+    "hash": "sha256-+kf7J3dEhgCbnCM5vHYlsTm5/R/Ud0Jr6elpHm922iI="
+  },
+  {
+    "pname": "System.Text.Encoding.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
+  },
+  {
+    "pname": "System.Text.RegularExpressions",
+    "version": "4.1.0",
+    "hash": "sha256-x6OQN6MCN7S0fJ6EFTfv4rczdUWjwuWE9QQ0P6fbh9c="
+  },
+  {
+    "pname": "System.Text.RegularExpressions",
+    "version": "4.3.0",
+    "hash": "sha256-VLCk1D1kcN2wbAe3d0YQM/PqCsPHOuqlBY1yd2Yo+K0="
+  },
+  {
+    "pname": "System.Threading",
+    "version": "4.0.11",
+    "hash": "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="
+  },
+  {
+    "pname": "System.Threading",
+    "version": "4.3.0",
+    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
+  },
+  {
+    "pname": "System.Threading.Tasks",
+    "version": "4.0.11",
+    "hash": "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="
+  },
+  {
+    "pname": "System.Threading.Tasks",
+    "version": "4.3.0",
+    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
+  },
+  {
+    "pname": "System.Threading.Tasks.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-X2hQ5j+fxcmnm88Le/kSavjiGOmkcumBGTZKBLvorPc="
+  },
+  {
+    "pname": "System.Threading.Tasks.Extensions",
+    "version": "4.5.4",
+    "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
+  },
+  {
+    "pname": "System.Threading.Thread",
+    "version": "4.3.0",
+    "hash": "sha256-pMs6RNFC3nQOGz9EqIcyWmO8YLaqay+q/Qde5hqPXXg="
+  },
+  {
+    "pname": "System.Threading.ThreadPool",
+    "version": "4.3.0",
+    "hash": "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="
+  },
+  {
+    "pname": "System.Threading.Timer",
+    "version": "4.3.0",
+    "hash": "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="
+  },
+  {
+    "pname": "System.ValueTuple",
+    "version": "4.5.0",
+    "hash": "sha256-niH6l2fU52vAzuBlwdQMw0OEoRS/7E1w5smBFoqSaAI="
+  },
+  {
+    "pname": "System.Windows.Extensions",
+    "version": "4.7.0",
+    "hash": "sha256-yW+GvQranReaqPw5ZFv+mSjByQ5y1pRLl05JIEf3tYU="
+  },
+  {
+    "pname": "System.Xml.ReaderWriter",
+    "version": "4.0.11",
+    "hash": "sha256-haZAFFQ9Sl2DhfvEbdx2YRqKEoxNMU5STaqpMmXw0zA="
+  },
+  {
+    "pname": "System.Xml.ReaderWriter",
+    "version": "4.3.0",
+    "hash": "sha256-QQ8KgU0lu4F5Unh+TbechO//zaAGZ4MfgvW72Cn1hzA="
+  },
+  {
+    "pname": "System.Xml.XDocument",
+    "version": "4.0.11",
+    "hash": "sha256-KPz1kxe0RUBM+aoktJ/f9p51GudMERU8Pmwm//HdlFg="
+  },
+  {
+    "pname": "System.Xml.XDocument",
+    "version": "4.3.0",
+    "hash": "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="
+  },
+  {
+    "pname": "System.Xml.XmlDocument",
+    "version": "4.3.0",
+    "hash": "sha256-kbuV4Y7rVJkfMp2Kgoi8Zvdatm9CZNmlKB3GZgANvy4="
+  },
+  {
+    "pname": "System.Xml.XPath",
+    "version": "4.3.0",
+    "hash": "sha256-kd1JMqj6obhxzEPRJeYvcUyJqkOs/9A0UOQccC6oYrM="
+  },
+  {
+    "pname": "System.Xml.XPath.XmlDocument",
+    "version": "4.3.0",
+    "hash": "sha256-NWPne5KQuqUt7WvaRT1KX3kkpWv6EPTHcI6CO/GBNME="
+  }
+]
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 2a63f659bf63..b59fa4432d8f 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -14,16 +14,18 @@ let
 in
 renode.overrideAttrs (old: rec {
   pname = "renode-unstable";
-  version = "1.16.0-unstable-2025-12-11";
+  version = "1.16.1-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "e61a4063ec362b099704e6d8f9734cdf792aeeb0";
-    hash = "sha256-ucQguZZSNKa0nEOTCdcLyDlaBnRgi/7Yb6VunNG/iSg=";
+    rev = "9a65fb18c4ebdf32795150b44daa949977c6c124";
+    hash = "sha256-Acx3kyk0vzB1df+8yvpj0fKgePtaolJ1c4nCicAD0Gs=";
     fetchSubmodules = true;
   };
 
+  nugetDeps = ./deps.json;
+
   prePatch = ''
     sed -i 's/AssemblyVersion("%VERSION%.*")/AssemblyVersion("${normalizedVersion version}.0")/g' src/Renode/Properties/AssemblyInfo.template
     sed -i 's/AssemblyInformationalVersion("%INFORMATIONAL_VERSION%")/AssemblyInformationalVersion("${src.rev}")/g' src/Renode/Properties/AssemblyInfo.template

From cacc10837bb6cd0293fb391c7e9c1abcc6b29f78 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 21 Mar 2026 12:30:44 +0100
Subject: [PATCH 069/110] openexr_2: Disable IlmImf test on powerpc64

---
 pkgs/development/libraries/openexr/2.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/openexr/2.nix b/pkgs/development/libraries/openexr/2.nix
index aca401ee32c9..145cac6d717e 100644
--- a/pkgs/development/libraries/openexr/2.nix
+++ b/pkgs/development/libraries/openexr/2.nix
@@ -6,6 +6,7 @@
   ilmbase,
   fetchpatch,
   cmake,
+  ctestCheckHook,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,6 +62,9 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isStatic "-DCMAKE_SKIP_RPATH=ON";
 
   nativeBuildInputs = [ cmake ];
+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
   propagatedBuildInputs = [
     ilmbase
     zlib
@@ -70,6 +74,11 @@ stdenv.mkDerivation rec {
   # https://github.com/AcademySoftwareFoundation/openexr/issues/1281
   doCheck = !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isi686;
 
+  disabledTests = lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
+    # https://github.com/AcademySoftwareFoundation/openexr/issues/222
+    "OpenEXR.IlmImf"
+  ];
+
   meta = {
     description = "High dynamic-range (HDR) image file format";
     homepage = "https://www.openexr.com/";

From 2617b41b043dbeb7040bfc8bcd3557091a1e8519 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Apr 2026 02:54:43 +0000
Subject: [PATCH 070/110] discordo: 0-unstable-2026-02-26 ->
 0-unstable-2026-03-30

---
 pkgs/by-name/di/discordo/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/di/discordo/package.nix b/pkgs/by-name/di/discordo/package.nix
index 0a82eb3af3ef..5f3cc1d70dac 100644
--- a/pkgs/by-name/di/discordo/package.nix
+++ b/pkgs/by-name/di/discordo/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "discordo";
-  version = "0-unstable-2026-02-26";
+  version = "0-unstable-2026-03-30";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = "discordo";
-    rev = "27dd6e09c8cde848261248a505a4efbabdcc9e09";
-    hash = "sha256-3rr7mbbPw5jrON7J80TaCZ7lBALKdtZ6vI2+uGJJaoI=";
+    rev = "48f3b5316c6a340da845c5d050b9de44d680184a";
+    hash = "sha256-1SOpy8XCdfsY/Fbp4NjDS9KFA/zcSIIjZHMjIEYB+8M=";
   };
 
-  vendorHash = "sha256-yzGKRrPPBjg/e9zkimCb99emLHBWM10FJvlL23HbTRU=";
+  vendorHash = "sha256-yQlx61R1Lx5fkctSkm64uYLqHeZZydVubpIaP00XA+U=";
 
   env.CGO_ENABLED = 1;
 

From b98cec8825dda493c7ab41cc5b04e2a8db016df7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Apr 2026 04:35:22 +0000
Subject: [PATCH 071/110] tree-sitter-grammars.tree-sitter-pod:
 0-unstable-2024-08-23 -> 1.0.0-unstable-2026-03-23

---
 .../tools/parsing/tree-sitter/grammars/grammar-sources.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 7098d00718d2..9d5a6ad9662c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -1962,10 +1962,10 @@
   };
 
   pod = {
-    version = "0-unstable-2024-08-23";
+    version = "1.0.0-unstable-2026-03-23";
     url = "github:tree-sitter-perl/tree-sitter-pod/release";
-    rev = "0bf8387987c21bf2f8ed41d2575a8f22b139687f";
-    hash = "sha256-yV2kVAxWxdyIJ3g2oivDc01SAQF0lc7UMT2sfv9lKzI=";
+    rev = "3f15a3f11b422753fbf985190dceacb4bbf80ecf";
+    hash = "sha256-Yu6sK+tGtFVgAZUE3pfoMLzMNwxQQuQu/ZtrM45tNHs=";
 
     meta = {
       license = lib.licenses.artistic2;

From 7d3ff6a5b0242aa248680bba90ab1a7283bf036f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Apr 2026 06:41:06 +0000
Subject: [PATCH 072/110] sprite: 0.0.1-rc41 -> 0.0.1-rc42

---
 pkgs/by-name/sp/sprite/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sp/sprite/package.nix b/pkgs/by-name/sp/sprite/package.nix
index 36b1370f6526..c5550d7a4dfd 100644
--- a/pkgs/by-name/sp/sprite/package.nix
+++ b/pkgs/by-name/sp/sprite/package.nix
@@ -8,7 +8,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sprite";
-  version = "0.0.1-rc41";
+  version = "0.0.1-rc42";
 
   src = fetchurl {
     url = "https://sprites-binaries.t3.storage.dev/client/v${finalAttrs.version}/sprite-${
@@ -16,10 +16,10 @@ stdenv.mkDerivation (finalAttrs: {
     }-${if stdenv.hostPlatform.isx86_64 then "amd64" else "arm64"}.tar.gz";
     hash =
       {
-        aarch64-darwin = "sha256-WVEa0NjpoeHZtn8p8k5AJLifIZWgPchpyrj5ikRupoI=";
-        x86_64-darwin = "sha256-zwCgZSFeFFk49blOjzH5PEv5fuFUlnP/Bre0uJpz78c=";
-        aarch64-linux = "sha256-PjL4usgcx3ybLB7ZLPfKHaqygWVfiuCNrERbYrDRZYk=";
-        x86_64-linux = "sha256-PAnnP5M9lLwC3Qhydz3Bo0uLtX6uE5cJF4lDOGfsiDk=";
+        aarch64-darwin = "sha256-ih0RonsNu7ZHUWbQcMqHmm7RXg0VvekDvq6WpnKvSjY=";
+        x86_64-darwin = "sha256-p3Tpf2Mg0rfOaw/y7cKI2Q7SvEpm+a1ykYVrr/dzVLc=";
+        aarch64-linux = "sha256-vMhkzX9noNL8Aw6MWhEAYmufCRpLsY/FbveBP3PYrQQ=";
+        x86_64-linux = "sha256-Jmym6yg0Wl83KTn840jWF3md5+r4NBh8czQudY5Iomk=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

From e42880873517f923d7ab65fdc939880547f3a405 Mon Sep 17 00:00:00 2001
From: Cryolitia PukNgae <cryolitia@mercallure.com>
Date: Wed, 1 Apr 2026 15:06:05 +0800
Subject: [PATCH 073/110] linux-rpi: warn to drop in the future

Gradually deprecate the only vendor kernel exception in nixpkgs and move
it to nixos-hardware

The proposal was made at https://github.com/NixOS/nixpkgs/pull/284391

Signed-off-by: Cryolitia PukNgae <cryolitia@mercallure.com>
---
 pkgs/top-level/linux-kernels.nix | 82 +++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 32 deletions(-)

diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 68824bbc5eb8..a254981f65bd 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -92,38 +92,6 @@ in
         # New vendor kernels should go to nixos-hardware instead.
         # e.g. https://github.com/NixOS/nixos-hardware/tree/master/microsoft/surface/kernel
 
-        linux_rpi1 = callPackage ../os-specific/linux/kernel/linux-rpi.nix {
-          kernelPatches = with kernelPatches; [
-            bridge_stp_helper
-            request_key_helper
-          ];
-          rpiVersion = 1;
-        };
-
-        linux_rpi2 = callPackage ../os-specific/linux/kernel/linux-rpi.nix {
-          kernelPatches = with kernelPatches; [
-            bridge_stp_helper
-            request_key_helper
-          ];
-          rpiVersion = 2;
-        };
-
-        linux_rpi3 = callPackage ../os-specific/linux/kernel/linux-rpi.nix {
-          kernelPatches = with kernelPatches; [
-            bridge_stp_helper
-            request_key_helper
-          ];
-          rpiVersion = 3;
-        };
-
-        linux_rpi4 = callPackage ../os-specific/linux/kernel/linux-rpi.nix {
-          kernelPatches = with kernelPatches; [
-            bridge_stp_helper
-            request_key_helper
-          ];
-          rpiVersion = 4;
-        };
-
         linux_5_10 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "5.10";
           kernelPatches = [
@@ -300,6 +268,56 @@ in
         linux_rt_5_4 = throw "linux_rt 5.4 has been removed because it will reach its end of life within 25.11";
 
         linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages";
+
+        # Remove warning added on 2026-04-01
+        linux_rpi1 =
+          lib.warnOnInstantiate
+            "linux-rpi series will be removed in a future release. Please change to use nixos-hardware."
+            (
+              callPackage ../os-specific/linux/kernel/linux-rpi.nix {
+                kernelPatches = with kernelPatches; [
+                  bridge_stp_helper
+                  request_key_helper
+                ];
+                rpiVersion = 1;
+              }
+            );
+        linux_rpi2 =
+          lib.warnOnInstantiate
+            "linux-rpi series will be removed in a future release. Please change to use nixos-hardware."
+            (
+              callPackage ../os-specific/linux/kernel/linux-rpi.nix {
+                kernelPatches = with kernelPatches; [
+                  bridge_stp_helper
+                  request_key_helper
+                ];
+                rpiVersion = 2;
+              }
+            );
+        linux_rpi3 =
+          lib.warnOnInstantiate
+            "linux-rpi series will be removed in a future release. Please change to use nixos-hardware."
+            (
+              callPackage ../os-specific/linux/kernel/linux-rpi.nix {
+                kernelPatches = with kernelPatches; [
+                  bridge_stp_helper
+                  request_key_helper
+                ];
+                rpiVersion = 3;
+              }
+            );
+        linux_rpi4 =
+          lib.warnOnInstantiate
+            "linux-rpi series will be removed in a future release. Please change to use nixos-hardware."
+            (
+              callPackage ../os-specific/linux/kernel/linux-rpi.nix {
+                kernelPatches = with kernelPatches; [
+                  bridge_stp_helper
+                  request_key_helper
+                ];
+                rpiVersion = 4;
+              }
+            );
       }
     )
   );

From 1b99a60a6f511f0d0e6c1a9916ec151626f050e9 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 29 Mar 2026 15:07:22 +0300
Subject: [PATCH 074/110] python3Packages.beetcamp: use finalAttrs

---
 .../python-modules/beetcamp/default.nix            | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index 723a081fe014..f6153805f4ad 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -13,21 +13,17 @@
   filelock,
   writableTmpDirAsHomeHook,
   nix-update-script,
-  beetcamp ? null, # For `passthru.tests`.
 }:
 
-let
-  version = "0.23.0";
-in
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "beetcamp";
-  inherit version;
+  version = "0.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snejus";
     repo = "beetcamp";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-8FEDpobEGZ0Lw1+JRoFIEe3AuiuX7dwsRab+P3hC3W0=";
   };
 
@@ -69,7 +65,7 @@ buildPythonPackage {
         pluginOverrides = {
           beetcamp = {
             enable = true;
-            propagatedBuildInputs = [ beetcamp ];
+            propagatedBuildInputs = [ finalAttrs.finalPackage ];
           };
         };
       };
@@ -85,4 +81,4 @@ buildPythonPackage {
     ];
     mainProgram = "beetcamp";
   };
-}
+})

From a92259bf7a30c50476bc0fe21887ad115147195c Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 29 Mar 2026 13:17:52 +0300
Subject: [PATCH 075/110] python31{3,4}Packages.beetcamp: 0.23.0 -> 0.24.1

Diff: https://github.com/snejus/beetcamp/compare/0.23.0...0.24.1
---
 pkgs/development/python-modules/beetcamp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index f6153805f4ad..b279660c821c 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beetcamp";
-  version = "0.23.0";
+  version = "0.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snejus";
     repo = "beetcamp";
     tag = finalAttrs.version;
-    hash = "sha256-8FEDpobEGZ0Lw1+JRoFIEe3AuiuX7dwsRab+P3hC3W0=";
+    hash = "sha256-Oe5pZ4gYgqBHuzt9LBe4G14+RYXrNL+L5GIGMMflyMI=";
   };
 
   patches = [

From 2a0f4802a7420830f5c8aa6834a2ebc6a1f2b9cf Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Wed, 1 Apr 2026 09:45:15 -0400
Subject: [PATCH 076/110] aleo-fonts: use installFonts hook

---
 pkgs/by-name/al/aleo-fonts/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/al/aleo-fonts/package.nix b/pkgs/by-name/al/aleo-fonts/package.nix
index 0bcb4294fab2..d5bfadced1fa 100644
--- a/pkgs/by-name/al/aleo-fonts/package.nix
+++ b/pkgs/by-name/al/aleo-fonts/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -15,13 +16,7 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-HSxP5/sLHQTujBVt1u93625EXEc42lxpt8W1//6ngWM=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 fonts/variable/*.ttf -t $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "Slab serif typeface designed by Alessio Laiso";

From 3d078e0c9c00f2c041d57db67ecde46c05a769f2 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 1 Apr 2026 22:57:43 +0800
Subject: [PATCH 077/110] =?UTF-8?q?libgedit-amtk:=205.9.2=20=E2=86=92=205.?=
 =?UTF-8?q?10.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/World/gedit/libgedit-amtk/-/compare/5.9.2...5.10.0
---
 pkgs/by-name/li/libgedit-amtk/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libgedit-amtk/package.nix b/pkgs/by-name/li/libgedit-amtk/package.nix
index 4301fb3f186d..48239b0ef25b 100644
--- a/pkgs/by-name/li/libgedit-amtk/package.nix
+++ b/pkgs/by-name/li/libgedit-amtk/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-amtk";
-  version = "5.9.2";
+  version = "5.10.0";
 
   outputs = [
     "out"
@@ -31,8 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
     group = "World";
     owner = "gedit";
     repo = "libgedit-amtk";
-    rev = finalAttrs.version;
-    hash = "sha256-TpPiVIsHIBrRzDG2oBwtrIYB3CYEW6SRRVow9pe2XFs=";
+    tag = finalAttrs.version;
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-wA5KRA1qWJzw5JRXQL/kP2BgCQiNhf6aIe6RppBEH90=";
   };
 
   strictDeps = true;

From 6adfa79f0a333f139b7e0f29b518abde488065dc Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 1 Apr 2026 23:01:23 +0800
Subject: [PATCH 078/110] =?UTF-8?q?libgedit-gfls:=200.3.1=20=E2=86=92=200.?=
 =?UTF-8?q?4.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/World/gedit/libgedit-gfls/-/compare/0.3.1...0.4.0
---
 pkgs/by-name/li/libgedit-gfls/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libgedit-gfls/package.nix b/pkgs/by-name/li/libgedit-gfls/package.nix
index 2cc1093e87ac..f5962dc28250 100644
--- a/pkgs/by-name/li/libgedit-gfls/package.nix
+++ b/pkgs/by-name/li/libgedit-gfls/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gfls";
-  version = "0.3.1";
+  version = "0.4.0";
 
   outputs = [
     "out"
@@ -30,7 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gedit";
     repo = "libgedit-gfls";
     tag = finalAttrs.version;
-    hash = "sha256-HBXOphDvFwXea0mlfPqPtaXgNpAZyHYwuHBn5f7hPso=";
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-VzQ58XD5Yfy+gv77yTVoYHhooz2pfAV0huJI023s8ew=";
   };
 
   nativeBuildInputs = [

From 90966d37ba00225bd49817fb5c9d31243494f9c7 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 1 Apr 2026 23:10:15 +0800
Subject: [PATCH 079/110] =?UTF-8?q?libgedit-gtksourceview:=20299.6.0=20?=
 =?UTF-8?q?=E2=86=92=20299.7.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/World/gedit/libgedit-gtksourceview/-/compare/299.6.0...299.7.0
---
 pkgs/by-name/li/libgedit-gtksourceview/package.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libgedit-gtksourceview/package.nix b/pkgs/by-name/li/libgedit-gtksourceview/package.nix
index c1b7dfed6832..21cc59c282a7 100644
--- a/pkgs/by-name/li/libgedit-gtksourceview/package.nix
+++ b/pkgs/by-name/li/libgedit-gtksourceview/package.nix
@@ -8,6 +8,8 @@
   meson,
   ninja,
   pkg-config,
+  libgedit-amtk,
+  libgedit-gfls,
   libxml2,
   glib,
   gtk3,
@@ -17,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gtksourceview";
-  version = "299.6.0";
+  version = "299.7.0";
 
   outputs = [
     "out"
@@ -30,8 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     group = "World";
     owner = "gedit";
     repo = "libgedit-gtksourceview";
-    rev = finalAttrs.version;
-    hash = "sha256-PBayAXttEFB1nHXOFTHvc4/vSL8+VZjuuwyeMKHKd9I=";
+    tag = finalAttrs.version;
+    forceFetchGit = true; # To avoid occasional 501 failures.
+    hash = "sha256-CU9EO0oHfkdWPyicmIG6eaN+wUvvkUhrb6wgNosnm2Q=";
   };
 
   patches = [
@@ -51,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libgedit-amtk
+    libgedit-gfls
     libxml2
   ];
 

From 3c2a3b804d85fde7c4c00a2cdc2da85bd75743e5 Mon Sep 17 00:00:00 2001
From: Nadja Yang <nadja@njy.dev>
Date: Sat, 28 Mar 2026 13:53:22 -0400
Subject: [PATCH 080/110] =?UTF-8?q?leanPackages:=20structural=20reimaginin?=
 =?UTF-8?q?g=20=E2=80=94=20own=20toolchain,=20lake=20--packages,=20Hydra?=
 =?UTF-8?q?=20visibility?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Give leanPackages its own lean4, independent of pkgs.lean4. Binary-
patch the toolchain so the language server discovers the wrapped lake
despite lake serve deriving LAKE from IO.appPath unconditionally.
Supplant Lake's config trace validation for /nix/store/ dependencies,
deferring cache coherence to Nix.

Migrate Nix-managed dependency injection from package-overrides.json
to lake --packages. Patch Cli to pre-build static library for
downstream executables. Add recurseIntoAttrs for Hydra.

Upstream accepted FetchContent for mimalloc vendoring:
https://github.com/leanprover/lean4/commit/a145b9c11a0fe38fd4c921024a7376c99cc34bd2
---
 pkgs/build-support/lake/default.nix           | 178 +++++-------------
 .../lake/test/weak-minimax/Main.lean          |   4 -
 .../lake/test/weak-minimax/lake-manifest.json |   1 +
 .../lake/test/weak-minimax/lakefile.lean      |   4 -
 .../lake/test/weak-minimax/package.nix        |  26 +--
 pkgs/development/lean-modules/Cli/default.nix |  16 +-
 .../lean-modules/LeanSearchClient/default.nix |   6 -
 pkgs/development/lean-modules/Qq/default.nix  |   6 +-
 .../lean-modules/aesop/default.nix            |   6 +-
 .../lean-modules/batteries/default.nix        |   6 +-
 .../lean-modules/importGraph/default.nix      |   6 +-
 .../lean-modules/lean4/default.nix            | 138 ++++++++++++++
 .../lean-modules/mathlib/default.nix          |   8 +-
 .../lean-modules/plausible/default.nix        |   6 +-
 .../lean-modules/proofwidgets/default.nix     |  11 +-
 pkgs/development/lean-modules/update.sh       |  90 ++++-----
 pkgs/top-level/all-packages.nix               |   2 +-
 pkgs/top-level/lean-packages.nix              |  27 +--
 18 files changed, 274 insertions(+), 267 deletions(-)
 delete mode 100644 pkgs/build-support/lake/test/weak-minimax/Main.lean
 create mode 100644 pkgs/build-support/lake/test/weak-minimax/lake-manifest.json
 create mode 100644 pkgs/development/lean-modules/lean4/default.nix

diff --git a/pkgs/build-support/lake/default.nix b/pkgs/build-support/lake/default.nix
index 42344a7797ff..114a8354fa89 100644
--- a/pkgs/build-support/lake/default.nix
+++ b/pkgs/build-support/lake/default.nix
@@ -1,20 +1,11 @@
 # buildLakePackage: build Lean 4 projects that use the Lake build system.
 #
 # Dependencies can be provided in two ways:
-#   - `leanDeps`: already-packaged Lean libraries from leanPackages.
-#     These are injected into LEAN_PATH via setup hooks and propagated
-#     transitively, similar to Haskell's libraryHaskellDepends.
+#   - `leanDeps`: nix-packaged Lean libraries, injected via
+#     `lake --packages` and propagated transitively via LEAN_PATH.
 #   - `lakeHash`: SRI hash for a fetchLakeDeps FOD that clones git
 #     dependencies listed in lake-manifest.json (like buildGoModule's
 #     vendorHash).  Not needed when all deps are in `leanDeps`.
-#
-# Library output layout:
-#   $out/                         Package root (source + build artifacts)
-#   $out/lakefile.{lean,toml}     Lake package configuration
-#   $out/lean-toolchain           Lean version pin
-#   $out/.lake/build/lib/lean/    Compiled .olean/.ilean files
-#   $out/.lake/build/ir/          Compiled C/object files
-#   $out/nix-support/setup-hook   LEAN_PATH propagation hook
 {
   lib,
   stdenv,
@@ -22,7 +13,7 @@
   gitMinimal,
   cacert,
   jq,
-  lndir,
+  writeText,
   stdenvNoCC,
 }:
 
@@ -55,32 +46,19 @@ lib.extendMkDerivation {
       nativeBuildInputs ? [ ],
       passthru ? { },
 
-      # SRI hash for the Lake dependencies FOD.
-      # Set to null if the project has no external dependencies
-      # (or all deps are provided via leanDeps).
+      # SRI hash for the Lake dependencies FOD (null = all deps nix-managed).
       lakeHash ? null,
-
       # Pre-built Lake dependencies derivation (overrides lakeHash).
       lakeDeps ? null,
-
-      # Already-packaged Lean libraries from nixpkgs.
-      # These are added to LEAN_PATH (via setup hook) and propagated
-      # transitively.  Each must be a buildLakePackage output with
-      # .olean files under $out/.lake/build/lib/lean/.
+      # Nix-packaged Lean libraries, injected via lake --packages.
       leanDeps ? [ ],
-
-      # Lean package name as declared in lakefile.lean/toml.
-      # Defaults to pname.
+      # Lake package name as declared in lakefile (defaults to pname).
       leanPackageName ? finalAttrs.pname,
-
-      # Lake build targets.  Empty list means the default target.
+      # Lake build targets (empty = default targets).
       buildTargets ? [ ],
-
-      # Whether this is a library (install full package tree with
-      # .olean/.ilean files) or an executable (install binaries only).
+      # Library (install .olean tree) or executable (install binaries only).
       isLibrary ? true,
-
-      # Override attributes of the lakeDeps derivation.
+      # Override the FOD derivation attrs.
       overrideLakeDepsAttrs ? (finalAttrs: previousAttrs: { }),
 
       meta ? { },
@@ -96,6 +74,10 @@ lib.extendMkDerivation {
       isLibrary = args.isLibrary or true;
       leanPackageName = args.leanPackageName or finalAttrs.pname;
 
+      allLeanDeps = lib.unique (
+        builtins.concatMap (dep: [ dep ] ++ (dep.passthru.allLeanDeps or [ ])) leanDeps
+      );
+
       computedLakeDeps =
         if lakeDeps' != null then
           lakeDeps'
@@ -114,11 +96,18 @@ lib.extendMkDerivation {
           }).overrideAttrs
             (lib.toExtension overrideLakeDepsAttrs);
 
-      # Transitively collect all Lean dependencies.  Each buildLakePackage
-      # library stores its own transitive closure in passthru.allLeanDeps,
-      # so this flattens the entire dependency DAG.
-      allLeanDeps = lib.unique (
-        builtins.concatMap (dep: [ dep ] ++ (dep.passthru.allLeanDeps or [ ])) leanDeps
+      # Nix-managed dep overrides, generated at eval time.
+      # --packages takes precedence over .lake/package-overrides.json.
+      overridesFile = writeText "lake-overrides.json" (
+        builtins.toJSON {
+          schemaVersion = "1.2.0";
+          packages = map (dep: {
+            type = "path";
+            name = dep.passthru.lakePackageName or dep.pname;
+            inherited = false;
+            dir = "${dep}";
+          }) allLeanDeps;
+        }
       );
     in
     {
@@ -128,14 +117,9 @@ lib.extendMkDerivation {
         lean4
         gitMinimal
         jq
-        lndir
       ];
 
-      # Propagate so downstream packages get transitive LEAN_PATH entries
-      # via each dependency's nix-support/setup-hook.
       propagatedBuildInputs = lib.optionals isLibrary leanDeps;
-
-      # Executables only need deps at build time.
       buildInputs = lib.optionals (!isLibrary) leanDeps;
 
       configurePhase =
@@ -144,106 +128,34 @@ lib.extendMkDerivation {
 
           export HOME="$TMPDIR"
 
-          # Disable Lake cloud caching and Reservoir lookups
+          # Disable cloud caching and Reservoir lookups.
           export LAKE_NO_CACHE=1
           export RESERVOIR_API_URL=""
-
-          # Point leanc at the nix-provided C compiler
           export LEAN_CC="${stdenv.cc}/bin/cc"
 
-          # Validate that the lean-toolchain file (if present) matches the
-          # Lean toolchain we are building against.  Mismatches between the
-          # toolchain version and the compiler produce confusing errors, so
-          # fail early with a clear message.
-          leanVersion="${lean4.version}"
-          if [ -f lean-toolchain ]; then
-            toolchainVersion=$(sed -n 's/^.*:v\([0-9][0-9.]*\).*/\1/p' lean-toolchain)
-            if [ -n "$toolchainVersion" ] && [ "$toolchainVersion" != "$leanVersion" ]; then
-              echo "buildLakePackage: lean-toolchain requests v$toolchainVersion but lean4 is v$leanVersion" >&2
-              echo "buildLakePackage: update the package or use a matching lean4 version" >&2
-              exit 1
-            fi
-          fi
-
-          ${lib.concatStringsSep "\n" (
-            builtins.map (
-              dep:
-              let
-                name = dep.passthru.lakePackageName or dep.pname;
-              in
-              ''
-                # Fail fast if nix-packaged dep "${name}" was built against a
-                # different Lean version.  This avoids wasting build time when
-                # the package set is mid-update (e.g. lean4 bumped but a dep
-                # has not been updated yet).
-                if [ -f "${dep}/lean-toolchain" ]; then
-                  depToolchain=$(sed -n 's/^.*:v\([0-9][0-9.]*\).*/\1/p' "${dep}/lean-toolchain")
-                  if [ -n "$depToolchain" ] && [ "$depToolchain" != "$leanVersion" ]; then
-                    echo "buildLakePackage: dependency ${name} was built with Lean v$depToolchain but lean4 is v$leanVersion" >&2
-                    echo "buildLakePackage: update ${name} first, or override lean4 in leanPackages" >&2
-                    exit 1
-                  fi
-                fi
-              ''
-            ) allLeanDeps
-          )}
-
           if [ -n "''${LEAN_PATH:-}" ]; then
             echo "buildLakePackage: LEAN_PATH=$LEAN_PATH"
           fi
 
-          mkdir -p .lake/packages
-
-          # Create a minimal empty manifest if none exists.  Lake requires
-          # this file, but when all deps come from leanDeps (nix-managed),
-          # the actual dependency entries come from package-overrides.json.
-          if [ ! -f lake-manifest.json ]; then
-            echo '{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}' \
-              > lake-manifest.json
-          fi
-
           ${lib.optionalString (computedLakeDeps != null) ''
-            # Copy fetched (not yet nix-packaged) deps into .lake/packages/
+            mkdir -p .lake/packages
             for dep in ${computedLakeDeps}/*; do
               depName="$(basename "$dep")"
               cp -r "$dep" ".lake/packages/$depName"
               chmod -R u+w ".lake/packages/$depName"
             done
-          ''}
 
-          ${lib.concatStringsSep "\n" (
-            builtins.map (
-              dep:
-              let
-                name = dep.passthru.lakePackageName or dep.pname;
-              in
-              ''
-                # Install nix-packaged dep "${name}" into .lake/packages/.
-                # lndir creates a symlink tree so artifacts remain as
-                # zero-copy references to the store; writable dirs let Lake
-                # create metadata during workspace initialization.
-                rm -rf ".lake/packages/${name}"
-                mkdir -p ".lake/packages/${name}"
-                lndir -silent "${dep}" ".lake/packages/${name}"
-              ''
-            ) allLeanDeps
-          )}
-
-          # Generate package-overrides.json redirecting deps to local
-          # paths.  Scans .lake/packages/ so that nix-managed deps work
-          # even without a lake-manifest.json (like Haskell's package DB
-          # approach — nix is the sole dependency provider, Lake just
-          # validates against lakefile.lean at build time).
-          if [ -d .lake/packages ] && [ -n "$(ls -A .lake/packages/ 2>/dev/null)" ]; then
+            # FOD deps use package-overrides.json (the on-disk mechanism).
+            # Nix-managed deps use --packages (the CLI mechanism, takes precedence).
             jq -n --argjson pkgs "$(
               for dep in .lake/packages/*/; do
                 [ -d "$dep" ] || continue
                 depName="$(basename "$dep")"
-                printf '{"type":"path","name":"%s","inherited":false,"configFile":"lakefile","dir":".lake/packages/%s"}\n' \
-                  "$depName" "$depName"
+                jq -n --arg name "$depName" --arg dir ".lake/packages/$depName" \
+                  '{type: "path", name: $name, inherited: false, dir: $dir}'
               done | jq -s '.'
-            )" '{schemaVersion: "1.1.0", packages: $pkgs}' > .lake/package-overrides.json
-          fi
+            )" '{schemaVersion: "1.2.0", packages: $pkgs}' > .lake/package-overrides.json
+          ''}
 
           runHook postConfigure
         '';
@@ -255,7 +167,7 @@ lib.extendMkDerivation {
           local targets="${lib.concatStringsSep " " buildTargets}"
           echo "buildLakePackage: building ''${targets:-default targets}"
 
-          lake build --no-ansi $targets
+          lake build --no-ansi --packages=${overridesFile} $targets
 
           runHook postBuild
         '';
@@ -266,25 +178,22 @@ lib.extendMkDerivation {
             ''
               runHook preInstall
 
-              # Install the complete Lake package tree.  $out/ IS the
-              # package directory — source, lakefile, and pre-built
-              # artifacts under .lake/build/.
+              # Install the complete Lake package tree.
               cp -rT . "$out"
 
-              # Remove build-environment artifacts that reference the
-              # build sandbox or dependency store paths.
+              # Remove build-time artifacts.
               rm -rf "$out/.lake/packages"
               rm -f "$out/.lake/package-overrides.json"
 
-              # Install the setup hook so that downstream derivations
-              # (and `nix develop` shells) automatically get this
-              # package's oleans in LEAN_PATH.
+              # Reconcile config trace directory naming.
+              if [ -d "$out/.lake/config/[anonymous]" ]; then
+                mv "$out/.lake/config/[anonymous]" "$out/.lake/config/${leanPackageName}"
+              fi
+
+              # Setup hook propagates LEAN_PATH to downstream packages.
               mkdir -p "$out/nix-support"
               cp ${./setup-hook.sh} "$out/nix-support/setup-hook"
 
-              # Symlink any built executables into $out/bin/ for
-              # discoverability (e.g. packages that are both libraries
-              # and executables).
               if [ -d "$out/.lake/build/bin" ]; then
                 mkdir -p "$out/bin"
                 for exe in "$out/.lake/build/bin"/*; do
@@ -300,7 +209,6 @@ lib.extendMkDerivation {
             ''
               runHook preInstall
 
-              # Install executables only.
               if [ -d .lake/build/bin ]; then
                 mkdir -p "$out/bin"
                 find .lake/build/bin -type f -executable \
@@ -314,8 +222,6 @@ lib.extendMkDerivation {
       passthru = passthru // {
         inherit computedLakeDeps lean4 allLeanDeps;
         lakePackageName = leanPackageName;
-        # Canonicalize overrideLakeDepsAttrs as an attribute overlay,
-        # following the same pattern as buildGoModule's overrideModAttrs.
         overrideLakeDepsAttrs = lib.toExtension overrideLakeDepsAttrs;
       };
 
diff --git a/pkgs/build-support/lake/test/weak-minimax/Main.lean b/pkgs/build-support/lake/test/weak-minimax/Main.lean
deleted file mode 100644
index 490b95b07e82..000000000000
--- a/pkgs/build-support/lake/test/weak-minimax/Main.lean
+++ /dev/null
@@ -1,4 +0,0 @@
-import WeakMinimax
-
-def main : IO Unit := do
-  IO.println "weak_minimax: verified (maximin <= minimax)"
diff --git a/pkgs/build-support/lake/test/weak-minimax/lake-manifest.json b/pkgs/build-support/lake/test/weak-minimax/lake-manifest.json
new file mode 100644
index 000000000000..ef86e4de986a
--- /dev/null
+++ b/pkgs/build-support/lake/test/weak-minimax/lake-manifest.json
@@ -0,0 +1 @@
+{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}
diff --git a/pkgs/build-support/lake/test/weak-minimax/lakefile.lean b/pkgs/build-support/lake/test/weak-minimax/lakefile.lean
index 9937799396d1..670adcbf345c 100644
--- a/pkgs/build-support/lake/test/weak-minimax/lakefile.lean
+++ b/pkgs/build-support/lake/test/weak-minimax/lakefile.lean
@@ -6,7 +6,3 @@ package weakMinimax
 require "leanprover-community" / "mathlib" @ git "main"
 
 @[default_target] lean_lib WeakMinimax
-
-@[default_target]
-lean_exe weakMinimax.run where
-  root := `Main
diff --git a/pkgs/build-support/lake/test/weak-minimax/package.nix b/pkgs/build-support/lake/test/weak-minimax/package.nix
index 5e6114486792..19cecab89878 100644
--- a/pkgs/build-support/lake/test/weak-minimax/package.nix
+++ b/pkgs/build-support/lake/test/weak-minimax/package.nix
@@ -1,12 +1,5 @@
 # Test that buildLakePackage works with nix-only deps (no lake-manifest.json).
 # Builds a Lean proof of the weak minimax inequality using mathlib.
-#
-# Note: building the executable recompiles .c → .c.o for all transitive
-# dependency modules because library packages only ship .olean/.ilean/.c
-# artifacts (the default Lake library facet).  Lake's trace system would
-# reuse pre-built object files if present, but since Lean 4 is rarely
-# used for application code, we defer shipping .o files in library
-# packages to keep store footprint minimal.
 {
   leanPackages,
   runCommand,
@@ -24,17 +17,10 @@ let
   };
 in
 
-runCommand "buildLakePackage-weak-minimax"
-  {
-    nativeBuildInputs = [ testPackage ];
-  }
-  ''
-    mkdir -p $out
+runCommand "buildLakePackage-weak-minimax" { } ''
+  mkdir -p $out
 
-    # Verify the executable runs (proof was verified at build time).
-    weakMinimax-run | tee $out/result
-    grep -q "weak_minimax" $out/result
-
-    # Verify library output has compiled oleans.
-    test -d "${testPackage}/.lake/build/lib/lean"
-  ''
+  # Verify library output has compiled oleans.
+  test -d "${testPackage}/.lake/build/lib/lean"
+  touch $out/success
+''
diff --git a/pkgs/development/lean-modules/Cli/default.nix b/pkgs/development/lean-modules/Cli/default.nix
index 0177c09973db..d3bc495ee9cf 100644
--- a/pkgs/development/lean-modules/Cli/default.nix
+++ b/pkgs/development/lean-modules/Cli/default.nix
@@ -6,17 +6,27 @@
 
 buildLakePackage {
   pname = "lean4-cli";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4-cli";
-    tag = "v4.28.0";
-    hash = "sha256-9nX+dozmDAaVb5uKWL14zbILr7aqbVerTyPcN12Niw4=";
+    tag = "v4.29.0";
+    hash = "sha256-jCUl4sXVmwtYPuQecEUFH6mwFzPaQY7au4624EOiWjk=";
   };
 
   leanPackageName = "Cli";
 
+  # Pre-build static library for downstream executables.
+  # TODO: upstream this to lean4-cli
+  postPatch = ''
+    substituteInPlace lakefile.toml \
+      --replace-fail '[[lean_lib]]
+    name = "Cli"' '[[lean_lib]]
+    name = "Cli"
+    defaultFacets = ["static"]'
+  '';
+
   meta = {
     description = "Command-line argument parser for Lean 4";
     homepage = "https://github.com/leanprover/lean4-cli";
diff --git a/pkgs/development/lean-modules/LeanSearchClient/default.nix b/pkgs/development/lean-modules/LeanSearchClient/default.nix
index bce5fe166814..b7e25b5ecbd0 100644
--- a/pkgs/development/lean-modules/LeanSearchClient/default.nix
+++ b/pkgs/development/lean-modules/LeanSearchClient/default.nix
@@ -18,12 +18,6 @@ buildLakePackage {
 
   leanPackageName = "LeanSearchClient";
 
-  # Upstream lean-toolchain lags behind; remove it so the
-  # buildLakePackage toolchain check does not reject this package.
-  postPatch = ''
-    rm -f lean-toolchain
-  '';
-
   meta = {
     description = "Lean 4 client for LeanSearch and Moogle proof search";
     homepage = "https://github.com/leanprover-community/LeanSearchClient";
diff --git a/pkgs/development/lean-modules/Qq/default.nix b/pkgs/development/lean-modules/Qq/default.nix
index 6939b121939c..6feb6fa51916 100644
--- a/pkgs/development/lean-modules/Qq/default.nix
+++ b/pkgs/development/lean-modules/Qq/default.nix
@@ -6,13 +6,13 @@
 
 buildLakePackage {
   pname = "lean4-Qq";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "quote4";
-    tag = "v4.28.0";
-    hash = "sha256-BRrSdDJQAsgM/NeSL2FODCez/8zEffjDRWUToGlKDNQ=";
+    tag = "v4.29.0";
+    hash = "sha256-pNY5hv1nJbreCfU4EewIHCpiryIBv1ghWibrUW8vnQ0=";
   };
 
   leanPackageName = "Qq";
diff --git a/pkgs/development/lean-modules/aesop/default.nix b/pkgs/development/lean-modules/aesop/default.nix
index e60651dbe2a0..7d8ad308741a 100644
--- a/pkgs/development/lean-modules/aesop/default.nix
+++ b/pkgs/development/lean-modules/aesop/default.nix
@@ -7,13 +7,13 @@
 
 buildLakePackage {
   pname = "lean4-aesop";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "aesop";
-    tag = "v4.28.0";
-    hash = "sha256-KeP46qtEf4/lgi4iCVuYIQbazufTR4luTbsuia9JkK4=";
+    tag = "v4.29.0";
+    hash = "sha256-CNwxNig8OWjtfQRYyRnM/HGBn2oaNX5qP9CVT2eWNlg=";
   };
 
   leanPackageName = "aesop";
diff --git a/pkgs/development/lean-modules/batteries/default.nix b/pkgs/development/lean-modules/batteries/default.nix
index af0b8623e1c6..9fdb1efd8686 100644
--- a/pkgs/development/lean-modules/batteries/default.nix
+++ b/pkgs/development/lean-modules/batteries/default.nix
@@ -6,13 +6,13 @@
 
 buildLakePackage {
   pname = "lean4-batteries";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "batteries";
-    tag = "v4.28.0";
-    hash = "sha256-3N1MCFsg5UiwBCMAhDK7WwIowMNnhjlFgAsm0UPtGKc=";
+    tag = "v4.29.0";
+    hash = "sha256-sEIDi2i2FaLTgKYWt/kzqPrjMdf+bFURfhw6ZZWBawQ=";
   };
 
   leanPackageName = "batteries";
diff --git a/pkgs/development/lean-modules/importGraph/default.nix b/pkgs/development/lean-modules/importGraph/default.nix
index 50a91b3c819f..4da481fd5a16 100644
--- a/pkgs/development/lean-modules/importGraph/default.nix
+++ b/pkgs/development/lean-modules/importGraph/default.nix
@@ -7,13 +7,13 @@
 
 buildLakePackage {
   pname = "lean4-importGraph";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "import-graph";
-    tag = "v4.28.0";
-    hash = "sha256-fZS8bFQjV7eLZCJwD+SVRzmCcCthrl+PO8vL8U8AOYs=";
+    tag = "v4.29.0";
+    hash = "sha256-tqdO2qyWiJzEbK0yuu4+tiOXTEg9XJfGnI7z6Jh/abg=";
   };
 
   leanPackageName = "importGraph";
diff --git a/pkgs/development/lean-modules/lean4/default.nix b/pkgs/development/lean-modules/lean4/default.nix
new file mode 100644
index 000000000000..e53d298db06f
--- /dev/null
+++ b/pkgs/development/lean-modules/lean4/default.nix
@@ -0,0 +1,138 @@
+# Lean 4 toolchain for the leanPackages set (independent of pkgs.lean4).
+{
+  lib,
+  stdenv,
+  symlinkJoin,
+  cmake,
+  fetchFromGitHub,
+  git,
+  gmp,
+  cadical,
+  pkg-config,
+  libuv,
+  perl,
+  testers,
+}:
+
+let
+  lean4 = stdenv.mkDerivation (finalAttrs: {
+    pname = "lean4";
+    version = "4.29.0";
+
+    mimalloc-src = fetchFromGitHub {
+      owner = "microsoft";
+      repo = "mimalloc";
+      tag = "v2.2.3";
+      hash = "sha256-B0gngv16WFLBtrtG5NqA2m5e95bYVcQraeITcOX9A74=";
+    };
+
+    src = fetchFromGitHub {
+      owner = "leanprover";
+      repo = "lean4";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-0v4OTrCLdHBbWJUq7hIjJonqget9SvsG3izGlOwhwyU=";
+    };
+
+    # Vendor mimalloc. Upstream has since partially adopted FetchContent:
+    # https://github.com/leanprover/lean4/commit/a145b9c11a0fe38fd4c921024a7376c99cc34bd2
+    #
+    # Dynamically adjust the source tree to maintain a healthy boundary
+    # with Nix and avoid overstepping on its jurisdiction over cache coherence.
+    postPatch =
+      let
+        pattern = "\${LEAN_BINARY_DIR}/../mimalloc/src/mimalloc";
+      in
+      ''
+        substituteInPlace src/CMakeLists.txt \
+          --replace-fail 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${finalAttrs.src.tag}")'
+
+        rm -rf src/lake/examples/git/
+
+        substituteInPlace CMakeLists.txt \
+          --replace-fail 'GIT_REPOSITORY https://github.com/microsoft/mimalloc' \
+                         'SOURCE_DIR "${finalAttrs.mimalloc-src}"' \
+          --replace-fail 'GIT_TAG ${finalAttrs.mimalloc-src.tag}' ""
+        for file in stage0/src/CMakeLists.txt stage0/src/runtime/CMakeLists.txt src/CMakeLists.txt src/runtime/CMakeLists.txt; do
+          substituteInPlace "$file" \
+            --replace-fail '${pattern}' '${finalAttrs.mimalloc-src}'
+        done
+
+        substituteInPlace src/lake/Lake/Load/Lean/Elab.lean \
+          --replace-fail \
+            'let upToDate := (← olean.pathExists) ∧' \
+            'let upToDate := cfg.pkgDir.toString.startsWith "/nix/store/" ∨ (← olean.pathExists) ∧'
+      '';
+
+    preConfigure = ''
+      patchShebangs stage0/src/bin/ src/bin/
+    '';
+
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+
+    buildInputs = [
+      gmp
+      libuv
+      cadical
+    ];
+
+    nativeCheckInputs = [
+      git
+      perl
+    ];
+
+    cmakeFlags = [
+      "-DUSE_GITHASH=OFF"
+      "-DINSTALL_LICENSE=OFF"
+      "-DUSE_MIMALLOC=ON"
+    ];
+
+    passthru.tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        version = "v${finalAttrs.version}";
+      };
+    };
+
+    meta = {
+      description = "Automatic and interactive theorem prover";
+      homepage = "https://leanprover.github.io/";
+      changelog = "https://github.com/leanprover/lean4/blob/${finalAttrs.src.tag}/RELEASES.md";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+      maintainers = with lib.maintainers; [ nadja-y ];
+      mainProgram = "lean";
+    };
+  });
+
+  oldStorePath = builtins.substring 0 43 (toString lean4);
+in
+# Binary-patched for correct runtime discovery in wrapped environments.
+symlinkJoin {
+  inherit (lean4) name pname;
+  paths = [ lean4 ];
+  nativeBuildInputs = [ perl ];
+  postBuild = ''
+    newStorePath=$(echo "$out" | head -c 43)
+
+    # Copy (not symlink) — IO.appPath resolves through symlinks.
+    rm $out/bin/lean $out/bin/lake
+    cp ${lean4}/bin/lean $out/bin/lean
+    cp ${lean4}/bin/lake $out/bin/lake
+
+    for bin in $out/bin/lean $out/bin/lake; do
+      cat "$bin" \
+        | perl -pe "s|\Q${oldStorePath}\E|$newStorePath|g" \
+        > "$bin.tmp"
+      chmod +x "$bin.tmp"
+      mv "$bin.tmp" "$bin"
+    done
+  '';
+
+  inherit (lean4) version src meta;
+  passthru = {
+    inherit (lean4) version src;
+  };
+}
diff --git a/pkgs/development/lean-modules/mathlib/default.nix b/pkgs/development/lean-modules/mathlib/default.nix
index 77d935a79a44..70a34dd9f333 100644
--- a/pkgs/development/lean-modules/mathlib/default.nix
+++ b/pkgs/development/lean-modules/mathlib/default.nix
@@ -14,13 +14,13 @@
 
 buildLakePackage {
   pname = "lean4-mathlib";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "mathlib4";
-    tag = "v4.28.0";
-    hash = "sha256-7kR0WvEDey5kEdqKKVEO/JgQd1VyB6a+zwPvIV5E5Pg=";
+    tag = "v4.29.0";
+    hash = "sha256-fe+qS7gNxdLnACX3/jqToa9m7r1gbskY6kDJbm1ZefE=";
   };
 
   leanPackageName = "mathlib";
@@ -34,6 +34,8 @@ buildLakePackage {
     importGraph
   ];
 
+  requiredSystemFeatures = [ "big-parallel" ];
+
   passthru.tests = {
     inherit (tests.lake) weak-minimax;
   };
diff --git a/pkgs/development/lean-modules/plausible/default.nix b/pkgs/development/lean-modules/plausible/default.nix
index dc61bca2c751..07b22b3ebe87 100644
--- a/pkgs/development/lean-modules/plausible/default.nix
+++ b/pkgs/development/lean-modules/plausible/default.nix
@@ -6,13 +6,13 @@
 
 buildLakePackage {
   pname = "lean4-plausible";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "plausible";
-    tag = "v4.28.0";
-    hash = "sha256-xuOfeoRPt5L0Rk4fEJPIi1A0aoNIkC1fsh5yeIx5bFI=";
+    tag = "v4.29.0";
+    hash = "sha256-08fNB2GK5AqDJ15n5Ol+HYqaSbsznyp4cerDo32bG50=";
   };
 
   leanPackageName = "plausible";
diff --git a/pkgs/development/lean-modules/proofwidgets/default.nix b/pkgs/development/lean-modules/proofwidgets/default.nix
index c026f0c62bcc..54998125b500 100644
--- a/pkgs/development/lean-modules/proofwidgets/default.nix
+++ b/pkgs/development/lean-modules/proofwidgets/default.nix
@@ -8,19 +8,18 @@
 }:
 
 let
+  version = "0.0.95";
   src = fetchFromGitHub {
     owner = "leanprover-community";
     repo = "ProofWidgets4";
-    tag = "v0.0.87";
-    hash = "sha256-qXEqNfwUBPnxAtLRkBZTBFhrM4JYl43gLo/PM6HOG7o=";
+    tag = "v${version}";
+    hash = "sha256-LETljr+QEU6CxprR3pB4hUzhgCD8PrIuiPOgTIdhHVM=";
   };
 in
 
 buildLakePackage {
   pname = "lean4-proofwidgets";
-  version = "0.0.87";
-
-  inherit src;
+  inherit version src;
 
   leanPackageName = "proofwidgets";
 
@@ -38,7 +37,7 @@ buildLakePackage {
     name = "lean4-proofwidgets-npm-deps";
     inherit src;
     sourceRoot = "source/widget";
-    hash = "sha256-CzBRrreOSytquZ/xFHPlY8r+lz5Bg9Zk9ienRhc8SiY=";
+    hash = "sha256-ShH6MDr76wzWQrJvhMWCnklaox/uRsfoe+aYVSo/eNA=";
   };
   npmRoot = "widget";
 
diff --git a/pkgs/development/lean-modules/update.sh b/pkgs/development/lean-modules/update.sh
index a02e52d6775f..fc05fe41b5c5 100755
--- a/pkgs/development/lean-modules/update.sh
+++ b/pkgs/development/lean-modules/update.sh
@@ -1,33 +1,33 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p nix-update common-updater-scripts curl jq
 
-# Update all leanPackages to match the lean4 version in nixpkgs.
-#
-# All mathlib-ecosystem packages (batteries, aesop, Qq, plausible,
-# importGraph, Cli, mathlib) release with the same version tag as
-# lean4 (lockstep versioning).  ProofWidgets and LeanSearchClient
-# have their own versioning; the correct versions are read from
-# mathlib's lake-manifest.json at the matching lean4 tag.
-#
-# This script only prefetches source hashes — it does not build
-# anything.  Output is a summary suitable for commit messages.
+# Update the leanPackages set.
 #
 # Usage:
-#   ./pkgs/development/lean-modules/update.sh
+#   ./pkgs/development/lean-modules/update.sh [version]
 
 set -euo pipefail
 
-lean4_version=$(nix eval --raw .#lean4.version)
+lean4_version="${1:-$(curl -sL https://api.github.com/repos/leanprover/lean4/releases/latest | jq -r '.tag_name' | sed 's/^v//')}"
 
-# Snapshot current versions for diffing.
+# Snapshot before any updates.
 old_lockstep=$(nix eval --raw .#leanPackages.mathlib.version 2>/dev/null || echo "")
 old_pw=$(nix eval --raw .#leanPackages.proofwidgets.version 2>/dev/null || echo "")
 old_lsc=$(nix eval --raw .#leanPackages.LeanSearchClient.version 2>/dev/null || echo "")
 
+run() { echo "  $*"; "$@"; }
+
+# --- lean4 toolchain ---
+
+run nix-update leanPackages.lean4 --version="$lean4_version"
+
+# --- mathlib dependency tree ---
+# Versions are derived from mathlib's lake-manifest.json at the
+# matching lean4 tag. Most packages release in lockstep with lean4;
+# ProofWidgets and LeanSearchClient have their own versioning.
+
 manifest=$(curl -sL "https://raw.githubusercontent.com/leanprover-community/mathlib4/v${lean4_version}/lake-manifest.json")
 
-# Verify that mathlib's dependency set matches what we package.
-# If mathlib adds or removes a dep, this script needs manual updating.
 known_deps="Cli LeanSearchClient Qq aesop batteries importGraph plausible proofwidgets"
 manifest_deps=$(echo "$manifest" | jq -r '[.packages[].name] | sort | join(" ")')
 if [ "$manifest_deps" != "$known_deps" ]; then
@@ -43,41 +43,41 @@ lsc_rev=$(echo "$manifest" | jq -r '.packages[] | select(.name == "LeanSearchCli
 lsc_date=$(curl -sL "https://api.github.com/repos/leanprover-community/LeanSearchClient/commits/$lsc_rev" | jq -r '.commit.committer.date[:10]')
 lsc_version="0-unstable-$lsc_date"
 
-# Leaf packages (no leanDeps).
-nix-update leanPackages.batteries        --version="$lean4_version"
-nix-update leanPackages.Qq               --version="$lean4_version"
-nix-update leanPackages.plausible        --version="$lean4_version"
-nix-update leanPackages.Cli              --version="$lean4_version"
-nix-update leanPackages.proofwidgets     --version="$pw_version"
+echo "--- mathlib tree ---"
 
-# LeanSearchClient has no lockstep tags; pin to the exact rev mathlib uses.
-update-source-version leanPackages.LeanSearchClient "$lsc_version" \
-  --rev="$lsc_rev"
+# Lockstep version synchronization.
+dir=pkgs/development/lean-modules
+for pkg in batteries aesop Qq plausible Cli importGraph mathlib; do
+  sed -i "s|tag = \"v${old_lockstep}\"|tag = \"v${lean4_version}\"|" "$dir/$pkg/default.nix"
+done
 
-# Packages with leanDeps.
-nix-update leanPackages.aesop            --version="$lean4_version"
-nix-update leanPackages.importGraph      --version="$lean4_version"
+run nix-update leanPackages.batteries    --version="$lean4_version"
+run nix-update leanPackages.Qq           --version="$lean4_version"
+run nix-update leanPackages.plausible    --version="$lean4_version"
+run nix-update leanPackages.Cli          --version="$lean4_version"
+run nix-update leanPackages.proofwidgets --version="$pw_version"
+run update-source-version leanPackages.LeanSearchClient "$lsc_version" --rev="$lsc_rev"
+run nix-update leanPackages.aesop        --version="$lean4_version"
+run nix-update leanPackages.importGraph  --version="$lean4_version"
+run nix-update leanPackages.mathlib      --version="$lean4_version"
 
-# mathlib (all deps are nix-packaged, no lakeHash needed).
-nix-update leanPackages.mathlib          --version="$lean4_version"
+# --- summary ---
 
-# Summary.
 changes=()
-if [ "$old_lockstep" != "$lean4_version" ]; then
-  changes+=("lockstep packages: $old_lockstep -> $lean4_version")
-fi
-if [ "$old_pw" != "$pw_version" ]; then
-  changes+=("proofwidgets: $old_pw -> $pw_version")
-fi
-if [ "$old_lsc" != "$lsc_version" ]; then
-  changes+=("LeanSearchClient: $old_lsc -> $lsc_version")
-fi
+[ "$old_lockstep" != "$lean4_version" ] && changes+=("mathlib tree: $old_lockstep -> $lean4_version")
+[ "$old_pw" != "$pw_version" ] && changes+=("proofwidgets: $old_pw -> $pw_version")
+[ "$old_lsc" != "$lsc_version" ] && changes+=("LeanSearchClient: $old_lsc -> $lsc_version")
 
 if [ ${#changes[@]} -eq 0 ]; then
-  echo "leanPackages: already up to date at lean4 $lean4_version"
-else
-  echo "leanPackages: update to lean4 $lean4_version"
-  for c in "${changes[@]}"; do
-    echo "  - $c"
-  done
+  echo "status: up-to-date"
+  exit 0
 fi
+
+echo "commit-title: leanPackages: lean4 $old_lockstep -> $lean4_version"
+echo "---"
+for c in "${changes[@]}"; do
+  echo "  - $c"
+done
+echo "---"
+echo "manifest-source: https://github.com/leanprover-community/mathlib4/blob/v${lean4_version}/lake-manifest.json"
+echo "lean4-release: https://github.com/leanprover/lean4/releases/tag/v${lean4_version}"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ff68d58a5eb7..8b8752d4a59c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2853,7 +2853,7 @@ with pkgs;
 
   leanblueprint = with python3Packages; toPythonApplication leanblueprint;
 
-  leanPackages = callPackage ../top-level/lean-packages.nix { };
+  leanPackages = recurseIntoAttrs (callPackage ../top-level/lean-packages.nix { });
 
   inherit (callPackage ../development/tools/lerna { })
     lerna_6
diff --git a/pkgs/top-level/lean-packages.nix b/pkgs/top-level/lean-packages.nix
index 64314343a910..7bdc715217cb 100644
--- a/pkgs/top-level/lean-packages.nix
+++ b/pkgs/top-level/lean-packages.nix
@@ -1,45 +1,24 @@
-# Lean 4 package set.
+# Lean 4 package set with its own toolchain (independent of pkgs.lean4).
 #
-# All packages are built against a single Lean toolchain version.
-# Dependencies between packages use `leanDeps` which propagates
-# .olean files via LEAN_PATH (through setup hooks), similar to how
-# Haskell propagates package.conf.d entries.
-#
-# Overriding lean4 propagates to all packages in the set:
+# Override the toolchain for the entire set:
 #   leanPackages.overrideScope (self: super: { lean4 = lean4-custom; })
-#
-# Usage:
-#   leanPackages.batteries
-#   leanPackages.mathlib
-#   leanPackages.callPackage ./my-package.nix { }
 {
   lib,
   newScope,
-  lean4,
 }:
 
 lib.makeScope newScope (self: {
-  inherit lean4;
+  lean4 = self.callPackage ../development/lean-modules/lean4 { };
 
-  # Resolve via self.callPackage so overriding lean4 in the scope
-  # propagates to the builder (same pattern as coqPackages).
   buildLakePackage = self.callPackage ../build-support/lake { };
 
   batteries = self.callPackage ../development/lean-modules/batteries { };
-
   aesop = self.callPackage ../development/lean-modules/aesop { };
-
   Qq = self.callPackage ../development/lean-modules/Qq { };
-
   proofwidgets = self.callPackage ../development/lean-modules/proofwidgets { };
-
   plausible = self.callPackage ../development/lean-modules/plausible { };
-
   LeanSearchClient = self.callPackage ../development/lean-modules/LeanSearchClient { };
-
   Cli = self.callPackage ../development/lean-modules/Cli { };
-
   importGraph = self.callPackage ../development/lean-modules/importGraph { };
-
   mathlib = self.callPackage ../development/lean-modules/mathlib { };
 })

From ce563acb77bcb85ae9c56a7627d2ea242ced9e70 Mon Sep 17 00:00:00 2001
From: Nadja Yang <nadja@njy.dev>
Date: Sat, 28 Mar 2026 18:09:54 -0400
Subject: [PATCH 081/110] doc: add Lean 4 section to languages-frameworks
 manual

---
 doc/languages-frameworks/index.md         |  1 +
 doc/languages-frameworks/lean4.section.md | 51 +++++++++++++++++++++++
 doc/redirects.json                        | 15 +++++++
 3 files changed, 67 insertions(+)
 create mode 100644 doc/languages-frameworks/lean4.section.md

diff --git a/doc/languages-frameworks/index.md b/doc/languages-frameworks/index.md
index 57c6d11ae6e0..bf2e46db0de7 100644
--- a/doc/languages-frameworks/index.md
+++ b/doc/languages-frameworks/index.md
@@ -79,6 +79,7 @@ ios.section.md
 java.section.md
 javascript.section.md
 julia.section.md
+lean4.section.md
 lisp.section.md
 lua.section.md
 maven.section.md
diff --git a/doc/languages-frameworks/lean4.section.md b/doc/languages-frameworks/lean4.section.md
new file mode 100644
index 000000000000..62f88bd0371f
--- /dev/null
+++ b/doc/languages-frameworks/lean4.section.md
@@ -0,0 +1,51 @@
+# Lean 4 {#sec-language-lean4}
+
+Lean 4 is a strict functional language with dependent types. `leanPackages` provides the toolchain and a curated set of libraries — including the full mathlib dependency tree — with its own Lean toolchain. A standalone compiler is also available as `pkgs.lean4` for use outside the package set.
+
+## Building Lean 4 projects with `buildLakePackage` {#lean4-buildLakePackage}
+
+```nix
+leanPackages.buildLakePackage {
+  pname = "my-project";
+  version = "0.1.0";
+  src = ./.;
+  leanDeps = with leanPackages; [ mathlib ];
+  lakeHash = null; # all deps nix-managed; set to lib.fakeHash for Lake-managed deps
+}
+```
+
+Dependencies are declared in the lakefile for Lake and in the Nix expression for Nix. `leanDeps` provides Nix-managed libraries whose `.olean` files — the default build artifact of the Lake library facet — are reused without recompilation. `buildLakePackage` injects them via `lake --packages`, which takes precedence over Lake's own dependency resolution, producing a hermetic build.
+
+Sui generis among nixpkgs builders, `buildLakePackage` supports heterogeneous dependency resolution, in that Nix transparently substitutes for upstream-managed dependencies at per-package granularity: Nix-managed dependencies via `leanDeps` and Lake-managed dependencies via `lakeHash` compose in the same derivation. Setting `lakeHash = lib.fakeHash` and building will report the expected hash for a fixed-output derivation that pins what Lake would normally fetch, less Nix-managed dependencies. Nix-managed dependencies take precedence by name — so moving a dependency from `lakeHash` to `leanDeps` will change the expected hash — providing an on-ramp for projects to incrementally adopt nix-managed libraries. Setting `lakeHash = null` (the default) declares that all dependencies are Nix-managed and no fixed-output fetch is performed during the build.
+
+A `lake-manifest.json` is required at the project root. If all dependencies are Nix-managed, an empty manifest suffices:
+
+```json
+{"version":"1.1.0","packagesDir":".lake/packages","packages":[]}
+```
+
+## Development shells {#lean4-dev-shells}
+
+In `nix develop`, the scoped `lean4` and `buildLakePackage` provide the same toolchain used for hermetic builds. Note that Lake's normal dependency resolution is available in the shell — Lake may fetch dependencies not covered by `leanDeps` from the network, as is standard for Nix development shells.
+
+## The `leanPackages` scope {#lean4-leanPackages}
+
+`leanPackages` is a `lib.makeScope` with its own `lean4`. Overriding it propagates to all packages and to `buildLakePackage`:
+
+```nix
+leanPackages.overrideScope (
+  self: super: {
+    lean4 = myCustomLean4;
+  }
+)
+```
+
+The `lean4` supplied by `leanPackages` is binary-patched to ensure that the Lean language server discovers the wrapped `lake` rather than an unwrapped one. This is necessary because Lake's `serve` subcommand has a vexing invocation pattern: it derives `LAKE` from `IO.appPath` and unconditionally sets it in the spawned environment, bypassing any wrapper. The binary patch rewrites store path references so that this discovery mechanism finds the correct binary, enabling LSP integration — including the InfoView, which requires Lean-specific protocol extensions — without improper mutation of the user's project directory.
+
+Note that `leanPackages.lean4` supplants Lake's built-in cache invalidation for dependencies in `/nix/store/`, deferring entirely to Nix's bespoke dependency model. Lake's trace validation — which checks compiler "hash," platform, and package identity — is gracefully subsumed by guarantees Nix already provides. Cache coherence responsibilities are delegated to the orchestrator of streamlined Nix integration.
+
+For Emacs, `emacsPackages.nael` and `emacsPackages.nael-lsp` (eglot-based and lsp-mode-based respectively, available via MELPA) provide Lean 4 support including proof state display via eldoc. For VSCode (unfree) / VSCodium, `vscode-extensions.leanprover.lean4` is available. Editor packages discover the toolchain from `PATH`.
+
+## Relationship to earlier Lean 4 Nix support {#lean4-history}
+
+Users familiar with the per-module derivation approach (2020–2025) should note that `buildLakePackage` follows a different architecture. The earlier integration discovered dependencies at evaluation time via import-from-derivation — an ambitious attempt to reconcile declarative package management with fine-grained build semantics, ultimately undermined by Nix's own evaluation model. It was [removed upstream](https://github.com/leanprover/lean4/commit/535435955b482176e8d62a54deebcacdec0827db). `buildLakePackage` treats Lake as a build driver and uses Nix for package-level boundaries, while `nix develop` and `nix-shell` achieve feature parity with the vanilla Lake development experience.
diff --git a/doc/redirects.json b/doc/redirects.json
index aa574709a71f..73353adbf72c 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -3576,6 +3576,9 @@
   "sec-language-java": [
     "index.html#sec-language-java"
   ],
+  "sec-language-lean4": [
+    "index.html#sec-language-lean4"
+  ],
   "language-javascript": [
     "index.html#language-javascript"
   ],
@@ -3744,6 +3747,18 @@
   "julia-withpackage-arguments": [
     "index.html#julia-withpackage-arguments"
   ],
+  "lean4-buildLakePackage": [
+    "index.html#lean4-buildLakePackage"
+  ],
+  "lean4-dev-shells": [
+    "index.html#lean4-dev-shells"
+  ],
+  "lean4-history": [
+    "index.html#lean4-history"
+  ],
+  "lean4-leanPackages": [
+    "index.html#lean4-leanPackages"
+  ],
   "lisp": [
     "index.html#lisp"
   ],

From 96de73520ae4edb4f4f5cb2efa338a8e76e766c5 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 1 Apr 2026 23:14:11 +0800
Subject: [PATCH 082/110] =?UTF-8?q?gedit:=2049.0=20=E2=86=92=2050.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/World/gedit/gedit/-/compare/49.0...50.0
---
 pkgs/by-name/ge/gedit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/gedit/package.nix b/pkgs/by-name/ge/gedit/package.nix
index df81fb5b2d06..e9902f20413a 100644
--- a/pkgs/by-name/ge/gedit/package.nix
+++ b/pkgs/by-name/ge/gedit/package.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gedit";
-  version = "49.0";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "gedit";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-IW3zBQOq/eeIjJbgJooHlOd+6/ZHOG6DUspHUlopG8A=";
+    hash = "sha256-UkKd1H7twf9r9Jf5Cx6br/8lVT2F2O9U5jR2Ihom0ZA=";
   };
 
   patches = [

From 5b8c4fc50997ab47e5dbd60fb6d8589fd3d50d29 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Wed, 1 Apr 2026 14:07:32 -0400
Subject: [PATCH 083/110] nixos/wivrn: Fix module option being removed without
 new error

---
 nixos/modules/services/video/wivrn.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 522a2dc174ea..0515d93d71cb 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -72,6 +72,11 @@ let
   );
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "wivrn" "defaultRuntime" ] ''
+      WiVRn now manages the active runtime itself, so this option has been removed.
+    '')
+  ];
   options = {
     services.wivrn = {
       enable = mkEnableOption "WiVRn, an OpenXR streaming application";

From 3c3df594d1b777343f1a4761c03ebe8649df066d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Apr 2026 20:26:55 +0000
Subject: [PATCH 084/110] libosmium: 2.23.0 -> 2.23.1

---
 pkgs/by-name/li/libosmium/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libosmium/package.nix b/pkgs/by-name/li/libosmium/package.nix
index f1d66a8fb58e..29f9d612616f 100644
--- a/pkgs/by-name/li/libosmium/package.nix
+++ b/pkgs/by-name/li/libosmium/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libosmium";
-  version = "2.23.0";
+  version = "2.23.1";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "libosmium";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYNNp7czQgIvPhYxXlPaY/qlVxoZZ6CiJXWrHW+zAD8=";
+    hash = "sha256-ZGLA5E/Gpwi433faUB9xLS/AhFHtWaFj/9dTh3zBTAE=";
   };
 
   nativeBuildInputs = [ cmake ];

From f0407d94328eec9c131d2cecb7ec0e2a3ab05309 Mon Sep 17 00:00:00 2001
From: Jhony Elmer Angulo Fabian <leohjaf@gmail.com>
Date: Wed, 1 Apr 2026 17:59:01 -0500
Subject: [PATCH 085/110] boringssl: 0.20260211.0 -> 0.20260327.0

---
 pkgs/by-name/bo/boringssl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bo/boringssl/package.nix b/pkgs/by-name/bo/boringssl/package.nix
index 3f367f4e549a..0e53ebf6ffa8 100644
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -11,12 +11,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20260211.0";
+  version = "0.20260327.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-sN0tqnS19ltXeAd3xUiLMc6kLtTYPh2xT1F1U1mPi/M=";
+    hash = "sha256-OMRJ4K9ETCitdEGmCYlBH8R7RjMkYno1hAX11bF8KH4=";
   };
 
   patches = [

From 15d91b0af91b5d071781c328113e3e550efbbfae Mon Sep 17 00:00:00 2001
From: Matt Leon <ml@mattleon.com>
Date: Sat, 21 Mar 2026 16:36:44 -0400
Subject: [PATCH 086/110] nixos/matter-server: fix fetching of PAA certificates
 from DCL

* Removes PAA certs patch, since that patch is no longer needed since matter-server no longer crashes when there are no certs present and network is unavailable.
* Saves fetched PAA certs to /var/cache/matter-server/certs
* Mounts /etc/resolv.conf for DNS lookups
* Specifies cacert bundle for SSL handshakes

Signed-off-by: Matt Leon <ml@mattleon.com>
---
 .../home-automation/matter-server.nix         | 75 +++++++++++--------
 nixos/tests/matter-server.nix                 |  2 +-
 .../python-matter-server/default.nix          | 24 ------
 .../link-paa-root-certs.patch                 | 57 --------------
 4 files changed, 44 insertions(+), 114 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-matter-server/link-paa-root-certs.patch

diff --git a/nixos/modules/services/home-automation/matter-server.nix b/nixos/modules/services/home-automation/matter-server.nix
index 8231d108d135..ac9058aeae7a 100644
--- a/nixos/modules/services/home-automation/matter-server.nix
+++ b/nixos/modules/services/home-automation/matter-server.nix
@@ -14,7 +14,7 @@ in
 {
   meta.maintainers = with lib.maintainers; [ leonm1 ];
 
-  options.services.matter-server = with lib.types; {
+  options.services.matter-server = {
     enable = lib.mkEnableOption "Matter-server";
 
     package = lib.mkPackageOption pkgs "python-matter-server" { };
@@ -44,10 +44,10 @@ in
     };
 
     extraArgs = lib.mkOption {
-      type = listOf str;
-      default = [ ];
+      type = lib.types.attrs;
+      default = { };
       description = ''
-        Extra arguments to pass to the matter-server executable.
+        Attribute set of extra arguments to pass to the matter-server executable.
         See <https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server> for options.
       '';
     };
@@ -62,41 +62,52 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       description = "Matter Server";
-      environment.HOME = storagePath;
+      environment = {
+        HOME = storagePath;
+        SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      };
+      script = ''
+        # `python-matter-server` writes to /data even when a storage-path is
+        # specified. This symlinks /data at the systemd-managed
+        # /var/lib/matter-server, so all files get dropped into the state
+        # directory.
+        ln -s $STATE_DIRECTORY $RUNTIME_DIRECTORY/data
+
+        # Create directories to hold certificates and OTA updates.
+        CERT_DIR="$CACHE_DIRECTORY/certs"
+        mkdir -p "$CERT_DIR"
+        OTA_UPDATE_DIR="$CACHE_DIRECTORY/updates"
+        mkdir -p "$OTA_UPDATE_DIR"
+
+        "${lib.getExe cfg.package}" ${
+          lib.concatStringsSep " " (
+            lib.cli.toCommandLineGNU { } (
+              {
+                port = cfg.port;
+                vendorid = vendorId;
+                storage-path = storagePath;
+                log-level = cfg.logLevel;
+                paa-root-cert-dir = "$CERT_DIR";
+                ota-provider-dir = "$OTA_UPDATE_DIR";
+              }
+              // cfg.extraArgs
+            )
+          )
+        }
+      '';
       serviceConfig = {
-        ExecStart = (
-          lib.concatStringsSep " " [
-            # `python-matter-server` writes to /data even when a storage-path
-            # is specified. This symlinks /data at the systemd-managed
-            # /var/lib/matter-server, so all files get dropped into the state
-            # directory.
-            "${pkgs.bash}/bin/sh"
-            "-c"
-            "'"
-            "${pkgs.coreutils}/bin/ln -s %S/matter-server/ %t/matter-server/root/data"
-            "&&"
-            "${cfg.package}/bin/matter-server"
-            "--port"
-            (toString cfg.port)
-            "--vendorid"
-            vendorId
-            "--storage-path"
-            storagePath
-            "--log-level"
-            "${cfg.logLevel}"
-            "${lib.escapeShellArgs cfg.extraArgs}"
-            "'"
-          ]
-        );
         # Start with a clean root filesystem, and allowlist what the container
         # is permitted to access.
         # See https://discourse.nixos.org/t/hardening-systemd-services/17147/14.
         RuntimeDirectory = [ "matter-server/root" ];
         RootDirectory = "%t/matter-server/root";
+        CacheDirectory = [ "matter-server" ];
 
-        # Allowlist /nix/store (to allow the binary to find its dependencies)
-        # and dbus.
-        BindReadOnlyPaths = "/nix/store /run/dbus";
+        BindReadOnlyPaths = [
+          "/nix/store" # To allow the binary to find its dependencies.
+          "/run/dbus"
+          "/etc/resolv.conf" # For DNS resolution.
+        ];
         # Let systemd manage `/var/lib/matter-server` for us inside the
         # ephemeral TemporaryFileSystem.
         StateDirectory = storageDir;
diff --git a/nixos/tests/matter-server.nix b/nixos/tests/matter-server.nix
index 6d919850f3ce..5aeffaa97b42 100644
--- a/nixos/tests/matter-server.nix
+++ b/nixos/tests/matter-server.nix
@@ -30,7 +30,7 @@ in
       start_all()
 
       machine.wait_for_unit("matter-server.service", timeout=20)
-      machine.wait_for_open_port(1234, timeout=20)
+      machine.wait_for_open_port(1234, timeout=100)
 
       with matter_server_running: # type: ignore[union-attr]
         with subtest("Check websocket server initialized"):
diff --git a/pkgs/development/python-modules/python-matter-server/default.nix b/pkgs/development/python-modules/python-matter-server/default.nix
index e7115136791b..b28b9ee66901 100644
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pythonOlder,
   stdenvNoCC,
-  replaceVars,
   buildNpmPackage,
   python,
   home-assistant-chip-wheels,
@@ -46,23 +45,6 @@ let
     hash = "sha256-vnI57h/aesnaDYorq1PzcMCLmV0z0ZBJvMg4Nzh1Dtc=";
   };
 
-  paaCerts = stdenvNoCC.mkDerivation {
-    pname = "matter-server-paa-certificates";
-    inherit (home-assistant-chip-wheels) version src;
-
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp connectedhomeip/credentials/development/paa-root-certs/* $out/
-
-      runHook postInstall
-    '';
-  };
-
   # Maintainer note: building the dashboard requires a python environment with a
   # built version of python-matter-server. To support bundling the dashboard
   # with the python-matter-server, the build is parameterized to build without
@@ -119,12 +101,6 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.12";
 
-  patches = [
-    (replaceVars ./link-paa-root-certs.patch {
-      paacerts = paaCerts;
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail 'version = "0.0.0"' 'version = "${version}"'
diff --git a/pkgs/development/python-modules/python-matter-server/link-paa-root-certs.patch b/pkgs/development/python-modules/python-matter-server/link-paa-root-certs.patch
deleted file mode 100644
index f7b09bb0aff6..000000000000
--- a/pkgs/development/python-modules/python-matter-server/link-paa-root-certs.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From f45cf9898f2e5a3a4c2b73a9ed84c4a037a85a1e Mon Sep 17 00:00:00 2001
-From: Matt Leon <ml@mattleon.com>
-Date: Sat, 1 Jun 2024 23:28:41 -0400
-Subject: [PATCH] Symlink PAA root certificates to nix store
-
----
- matter_server/server/const.py                    | 2 ++
- matter_server/server/helpers/paa_certificates.py | 6 ++++++
- 2 files changed, 8 insertions(+)
-
-diff --git a/matter_server/server/const.py b/matter_server/server/const.py
-index 8cca3cf..43f02f5 100644
---- a/matter_server/server/const.py
-+++ b/matter_server/server/const.py
-@@ -14,6 +14,8 @@ DATA_MODEL_SCHEMA_VERSION = 6
- # Keep default location inherited from early version of the Python
- # bindings.
- DEFAULT_PAA_ROOT_CERTS_DIR: Final[pathlib.Path] = (
-+    pathlib.Path("@paacerts@"))
-+(
-     pathlib.Path(__file__)
-     .parent.resolve()
-     .parent.resolve()
-diff --git a/matter_server/server/helpers/paa_certificates.py b/matter_server/server/helpers/paa_certificates.py
-index de60c78..185e54c 100644
---- a/matter_server/server/helpers/paa_certificates.py
-+++ b/matter_server/server/helpers/paa_certificates.py
-@@ -105,6 +105,8 @@ async def fetch_dcl_certificates(
-     base_url: str,
- ) -> int:
-     """Fetch DCL PAA Certificates."""
-+    return 0
-+
-     fetch_count: int = 0
- 
-     try:
-@@ -151,6 +153,8 @@ async def fetch_dcl_certificates(
- 
- async def fetch_git_certificates(paa_root_cert_dir: Path) -> int:
-     """Fetch Git PAA Certificates."""
-+    return 0
-+
-     fetch_count = 0
-     LOGGER.info("Fetching the latest PAA root certificates from Git.")
- 
-@@ -185,6 +189,8 @@ async def fetch_certificates(
-     fetch_production_certificates: bool = True,
- ) -> int:
-     """Fetch PAA Certificates."""
-+    return 0
-+
-     loop = asyncio.get_running_loop()
-     paa_root_cert_dir_version = paa_root_cert_dir / ".version"
- 
--- 
-2.44.1
-

From 381dab6ea41d25363de2acffd7b603bae036b934 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 02:04:21 +0000
Subject: [PATCH 087/110] src-cli: 7.0.1 -> 7.0.2

---
 pkgs/by-name/sr/src-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sr/src-cli/package.nix b/pkgs/by-name/sr/src-cli/package.nix
index a08dc83e805c..30eb9c0f52c5 100644
--- a/pkgs/by-name/sr/src-cli/package.nix
+++ b/pkgs/by-name/sr/src-cli/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "src-cli";
-  version = "7.0.1";
+  version = "7.0.2";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "src-cli";
     rev = version;
-    hash = "sha256-nGWSTIkhO8Wcf1oXecUiE/i3bdEi5I/DXYdvBFfF2zU=";
+    hash = "sha256-RX3Fxa+AyzZQn68M5ZqeCqKjkNkp80ih0ECVvud1SSg=";
   };
 
   vendorHash = "sha256-lChxbgIa4w24uUG0SYBbzouKt+a0eVLLSn/BG6Q5P6o=";

From 904c3778efd102ec5ecf31c353e91f9cf287de04 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 03:10:39 +0000
Subject: [PATCH 088/110] uv: 0.11.2 -> 0.11.3

---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 9fdf078b17ce..b5ede6fbd4d9 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-IkVFRyCGqfTqnn6IObgaH/pzOxll2Vd2YdmUaHfB/co=";
+    hash = "sha256-M/J666qGAsFPjA/x1xmGSuTYr1VCzkgMSy08vs9HydQ=";
   };
 
-  cargoHash = "sha256-J/PUOQPav0lVUSmGyjf2u5Im3QGOx0RljYaRUbj79h8=";
+  cargoHash = "sha256-mSfWJetk0c8omTSOih0GpSgyXpAa7gjLvR3G4GQYQLg=";
 
   buildInputs = [
     rust-jemalloc-sys

From 59b52db7591eb6797ce39a1e327e751bd303d120 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 1 Apr 2026 20:29:09 -0700
Subject: [PATCH 089/110] treewide: remove redundant name attrs and
 parseDrvName calls

---
 pkgs/development/beam-modules/rebar3-release.nix         | 1 -
 pkgs/development/idris-modules/build-builtin-package.nix | 6 ++----
 pkgs/development/ruby-modules/gem/default.nix            | 7 +------
 pkgs/games/xonotic/default.nix                           | 1 -
 pkgs/tools/security/bundler-audit/default.nix            | 1 -
 5 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/beam-modules/rebar3-release.nix b/pkgs/development/beam-modules/rebar3-release.nix
index e1af791cfa5a..27ce041c8797 100644
--- a/pkgs/development/beam-modules/rebar3-release.nix
+++ b/pkgs/development/beam-modules/rebar3-release.nix
@@ -57,7 +57,6 @@ let
       attrs
       // {
 
-        name = "${pname}-${version}";
         inherit version pname;
 
         buildInputs =
diff --git a/pkgs/development/idris-modules/build-builtin-package.nix b/pkgs/development/idris-modules/build-builtin-package.nix
index a5fd167e6a52..e8b49854443b 100644
--- a/pkgs/development/idris-modules/build-builtin-package.nix
+++ b/pkgs/development/idris-modules/build-builtin-package.nix
@@ -3,12 +3,10 @@
 # deps: The dependencies of the package
 { idris, build-idris-package }:
 pname: deps:
-let
-  inherit (builtins.parseDrvName idris.name) version;
-in
 build-idris-package {
 
-  inherit pname version;
+  inherit pname;
+  inherit (idris) version;
   inherit (idris) src;
 
   noPrelude = true;
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index bf792f83cd13..a759f10138f3 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -39,12 +39,7 @@ lib.makeOverridable (
     platform ? "ruby",
     ruby ? defs.ruby,
     stdenv ? ruby.stdenv,
-    namePrefix ? (
-      let
-        rubyName = builtins.parseDrvName ruby.name;
-      in
-      "${rubyName.name}${lib.versions.majorMinor rubyName.version}-"
-    ),
+    namePrefix ? "${ruby.pname}${lib.versions.majorMinor (toString ruby.version)}-",
     nativeBuildInputs ? [ ],
     buildInputs ? [ ],
     meta ? { },
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index a0de27407762..8c5f4a7f3975 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -38,7 +38,6 @@
 let
   pname = "xonotic";
   version = "0.8.6";
-  name = "${pname}-${version}";
   variant =
     if withSDL && withGLX then
       ""
diff --git a/pkgs/tools/security/bundler-audit/default.nix b/pkgs/tools/security/bundler-audit/default.nix
index 8db9959c2ad3..b56b9046849c 100644
--- a/pkgs/tools/security/bundler-audit/default.nix
+++ b/pkgs/tools/security/bundler-audit/default.nix
@@ -6,7 +6,6 @@
 }:
 
 bundlerEnv rec {
-  name = "${pname}-${version}";
   pname = "bundler-audit";
   version = (import ./gemset.nix).bundler-audit.version;
 

From 59c09fc771c7f653c09dd42703d32adb1dfa6009 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 06:56:23 +0000
Subject: [PATCH 090/110] etcd_3_5: 3.5.28 -> 3.5.29

---
 pkgs/by-name/et/etcd_3_5/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/et/etcd_3_5/package.nix b/pkgs/by-name/et/etcd_3_5/package.nix
index 6378c409d76d..d9a04b1fa372 100644
--- a/pkgs/by-name/et/etcd_3_5/package.nix
+++ b/pkgs/by-name/et/etcd_3_5/package.nix
@@ -8,11 +8,11 @@
 }:
 
 let
-  version = "3.5.28";
-  etcdSrcHash = "sha256-D4c+YfNQATW8/9m/5edPKtG9qQa8MxpbpDTCZY6cvA4=";
-  etcdServerVendorHash = "sha256-IiGoG/5HJBZXhWhluK1uQVOXRk2I4VDokT7EcjhEnWU=";
-  etcdUtlVendorHash = "sha256-mUzwpxAsUhXdK70BwtjWJqjzLpDnNFNXW6tHP81c72w=";
-  etcdCtlVendorHash = "sha256-Bn3mirDqs9enpNTlp65YWiQRKpc+B6wD33b0xkaqSKE=";
+  version = "3.5.29";
+  etcdSrcHash = "sha256-riihCSd7QsH+G+//XcV+DYn7kBbXAbTjEBEXcP/mh1w=";
+  etcdServerVendorHash = "sha256-eJKgZ2kFNrWI+uKKv1xD7tGLkWaGqa/ODjA09SwDAzg=";
+  etcdUtlVendorHash = "sha256-+1/E/VGpszXEIID7tgSbiCpe4KQkUcSKJJRAUdTUklQ=";
+  etcdCtlVendorHash = "sha256-Xznj9HPx4BTUpipBmucbKjIcQpj+diyw0FtsdQVV61Y=";
 
   src = fetchFromGitHub {
     owner = "etcd-io";

From 4abb5807bdfda20f46175e667edac9e1d34dc5e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 07:53:25 +0000
Subject: [PATCH 091/110] session-desktop: 1.17.15 -> 1.17.17

---
 pkgs/by-name/se/session-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/se/session-desktop/package.nix b/pkgs/by-name/se/session-desktop/package.nix
index 527d088f4975..9c0012015c7d 100644
--- a/pkgs/by-name/se/session-desktop/package.nix
+++ b/pkgs/by-name/se/session-desktop/package.nix
@@ -31,14 +31,14 @@ let
 
   libsession-util-nodejs = stdenv.mkDerivation (finalAttrs: {
     pname = "libsession-util-nodejs";
-    version = "0.6.16"; # find version in pnpm-lock.yaml
+    version = "0.6.17"; # find version in pnpm-lock.yaml
     src = fetchFromGitHub {
       owner = "session-foundation";
       repo = "libsession-util-nodejs";
       tag = "v${finalAttrs.version}";
       fetchSubmodules = true;
       deepClone = true; # need git rev for all submodules
-      hash = "sha256-xTaXPz5p+NBCdjCTErQVrG2gBA4oxHCvSqJTN8g9uE4=";
+      hash = "sha256-j7smb0Rgjdqs4l3ahUV2bFXyvieV6Mcoti6wjSRovLo=";
       # fetchgit is not reproducible with deepClone + fetchSubmodules:
       # https://github.com/NixOS/nixpkgs/issues/100498
       postFetch = ''
@@ -109,7 +109,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "session-desktop";
-  version = "1.17.15";
+  version = "1.17.17";
   src =
     (fetchFromGitHub {
       owner = "session-foundation";
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
         rm -rf .git
         popd
       '';
-      hash = "sha256-snQYyXwybXqDkCBHtIeSMTkQLIXrc8zET7kRiWjPwpI=";
+      hash = "sha256-YqDkL91PbgNlaDnfCpZn6oL2r4z0zClRb4OGys4o2Yw=";
     }).overrideAttrs
       (oldAttrs: {
         # https://github.com/NixOS/nixpkgs/issues/195117#issuecomment-1410398050
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-cinhhPTFSzrr/hc/+Tyv1IKRn84MYpycOQ1qxCMQuy8=";
+    hash = "sha256-8z4EDHpsvM0AFbJy2JXoE4vjiLaDshTihMQsrQzXdEs=";
   };
 
   buildPhase = ''

From befdc677c0bc695280657d2dbf09b1ef48715447 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 08:20:19 +0000
Subject: [PATCH 092/110] python3Packages.jupyter-docprovider: 2.2.1 -> 2.3.0

---
 .../python-modules/jupyter-docprovider/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-docprovider/default.nix b/pkgs/development/python-modules/jupyter-docprovider/default.nix
index 55eeef745a50..a3e63c27819b 100644
--- a/pkgs/development/python-modules/jupyter-docprovider/default.nix
+++ b/pkgs/development/python-modules/jupyter-docprovider/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-docprovider";
-  version = "2.2.1";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_docprovider";
     inherit (finalAttrs) version;
-    hash = "sha256-2Ko7XbO5tAHeBRWd+No24th0hebc31l6IOWMkh9wXdo=";
+    hash = "sha256-wJgI4V6T8upP8ZShjHqMj4PYEEn6kbCd4ksJrerJ1XI=";
   };
 
   postPatch = ''

From a3ada65cd4529f453b49cb8fa6693027a193a59d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 08:30:37 +0000
Subject: [PATCH 093/110] runme: 3.16.6 -> 3.16.10

---
 pkgs/by-name/ru/runme/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ru/runme/package.nix b/pkgs/by-name/ru/runme/package.nix
index e84df6db70fc..bb8a7a76669f 100644
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "runme";
-  version = "3.16.6";
+  version = "3.16.10";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bW4MlzBRC+Mf6Y1CmtTdMFaZbTBDqaPh3puFQpOl+hQ=";
+    hash = "sha256-ExgzuX3g8JHWKGmUbaIOR7H1eSI97GRtSREtyqU0riU=";
   };
 
   vendorHash = "sha256-yS87r9zYQpJ7G/opqBNJ6EgqO7/R1jL+mxPVX71rQhc=";

From c477cfbc582b2acc1111e2fdd8a45a24cbf99a78 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 11:34:41 +0000
Subject: [PATCH 094/110] python3Packages.pyjvcprojector: 2.0.3 -> 2.0.4

---
 pkgs/development/python-modules/pyjvcprojector/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyjvcprojector/default.nix b/pkgs/development/python-modules/pyjvcprojector/default.nix
index 3af5ddde1e5e..9d93d540b90e 100644
--- a/pkgs/development/python-modules/pyjvcprojector/default.nix
+++ b/pkgs/development/python-modules/pyjvcprojector/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyjvcprojector";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SteveEasley";
     repo = "pyjvcprojector";
     tag = "v${version}";
-    hash = "sha256-AXBayuGR8FxamyNMXzMO0sLaQNEmxkSbn/dcZxmLNG4=";
+    hash = "sha256-nmoPOZv5/nIypfFqjgkcQYYffUcjsCMgL6TXqGyBxcQ=";
   };
 
   build-system = [ setuptools ];

From cb7060e5a72071bee5aace4de99764bca1c10b05 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:51:52 +0000
Subject: [PATCH 095/110] linux_testing: 7.0-rc5 -> 7.0-rc6

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8eaa7261baa0..74f25ba7841d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.0-rc5",
-        "hash": "sha256:00q4scz3kyrbd8v23pjdzgmaz9scmxg10cqlfwrrd7xj0hxp3pah",
+        "version": "7.0-rc6",
+        "hash": "sha256:085bc06mbav64rmsm6a34j2y75nrqpqp4qd8ld8mb9acf1i4iw45",
         "lts": false
     },
     "6.1": {

From 8795f02446b0ab489fb1dbe2596f762917d078b9 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:51:56 +0000
Subject: [PATCH 096/110] linux_6_19: 6.19.10 -> 6.19.11

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 74f25ba7841d..354cb61beac5 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": true
     },
     "6.19": {
-        "version": "6.19.10",
-        "hash": "sha256:072s76238rnf87yhdy15nbxfyq7x3ch7p2v14dq4pq551qd48va6",
+        "version": "6.19.11",
+        "hash": "sha256:16ymkc5r3hw05z7l7ih3qw406qlszz1l7b4g5yz0hv15ddxrs0r0",
         "lts": false
     }
 }

From 8aef3ab2a02393e6b2b1543c04c14cb4602835e0 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:51:58 +0000
Subject: [PATCH 097/110] linux_6_18: 6.18.20 -> 6.18.21

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 354cb61beac5..bbb78a26f30d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.20",
-        "hash": "sha256:0lrm76rdlr92kjq3g410qdff9v49mpdf400lmsh7hq74k2ymlyl3",
+        "version": "6.18.21",
+        "hash": "sha256:0ks735y6jq4yy3jaicjsj4dn4n3kk2skf9dqh9dyifipn57j2f0w",
         "lts": true
     },
     "6.19": {

From f3191fe7cbbd9fa7a14d2f3abf05e36f87030d3e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:52:01 +0000
Subject: [PATCH 098/110] linux_6_12: 6.12.78 -> 6.12.80

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index bbb78a26f30d..431e2d87dcdc 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.78",
-        "hash": "sha256:0gdgykr4nqk1dzb5ms2m07saxx58zvacpfv8ynhfrv7snjs835vi",
+        "version": "6.12.80",
+        "hash": "sha256:0lrylj87bb8ky29pbplpncrfhmgqqbq3d49iqgdwv7p7jvc929f9",
         "lts": true
     },
     "6.18": {

From 8a7090a8f3cbf986649410ceda4d4ce425401bf9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 12:39:53 +0000
Subject: [PATCH 099/110] mcp-grafana: 0.11.3 -> 0.11.4

---
 pkgs/by-name/mc/mcp-grafana/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index b46bfb5e18ae..4d5892e30507 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rHUoHtJoZXDwXU7/fTAymmQGLwAFDRHwqMSbnZvsoUc=";
+    hash = "sha256-sOT4rS9lEKJmQM9roLJbbs/8Y7thEr3KvwChXrsRKr4=";
   };
 
-  vendorHash = "sha256-w4v1/RqnNfGFzapmWd96UTT4Sc18lSVX5HvsXWWmhSY=";
+  vendorHash = "sha256-EXjZjXwyeH7zTgYvtMbtWh1j6xk2ybbeqvbxLz5yA+I=";
 
   ldflags = [
     "-s"

From 838104fb57ae49cdb78d8bc542822a6222f4352e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:52:03 +0000
Subject: [PATCH 100/110] linux_6_6: 6.6.130 -> 6.6.132

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 431e2d87dcdc..adf23aea9dbc 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.130",
-        "hash": "sha256:139480lyi3if8pd2j3yld5a01lk7113kbcn2kxpzyk29p5kslq14",
+        "version": "6.6.132",
+        "hash": "sha256:1d1fdd5wpphlm68yb16csaaijv0lf38ynl3gpvvdspsg22xjpdn5",
         "lts": true
     },
     "6.12": {

From af5c65545ae5ad22b2d54faa300a46fd3f623377 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 12:43:58 +0000
Subject: [PATCH 101/110] topgrade: 17.1.0 -> 17.2.0

---
 pkgs/by-name/to/topgrade/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 4012d698a1cf..ee808d0214f7 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "topgrade";
-  version = "17.1.0";
+  version = "17.2.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-31+hiKYDzzXdb45elIlGVUKr6lYWMx7iWZBDvlXcERg=";
+    hash = "sha256-Q8Cji21uJy/Az8FQiSQJ4nv+HRsqIVTsYoO9q3jv/as=";
   };
 
-  cargoHash = "sha256-WIMpXL5jo9BF5GrAkflLdxoxigsJwpAMbKXV2gTrHAg=";
+  cargoHash = "sha256-/Ezf6ntvomhGsPpWPIA+ebkW+4i6BVvuIHNVbZSHow8=";
 
   nativeBuildInputs = [
     installShellFiles

From 7fa34755944a9fdaec48f24e49aa19f5c2117b66 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 12:55:41 +0000
Subject: [PATCH 102/110] asusctl: 6.3.5 -> 6.3.6

---
 pkgs/by-name/as/asusctl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/as/asusctl/package.nix b/pkgs/by-name/as/asusctl/package.nix
index 2424512c0cb7..bb313a8b44f8 100644
--- a/pkgs/by-name/as/asusctl/package.nix
+++ b/pkgs/by-name/as/asusctl/package.nix
@@ -18,16 +18,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asusctl";
-  version = "6.3.5";
+  version = "6.3.6";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     tag = finalAttrs.version;
-    hash = "sha256-99SLaDJm+stakrUmlyWznAeYKeD5SXeLAqakrmpalbc=";
+    hash = "sha256-HkqVNhxbz/JBVmGBeYvdWRttvAcvP05iSfp2VZPR+x8=";
   };
 
-  cargoHash = "sha256-f6Zut4oknNCKmd5Igt08se2EpCLLmmIQjD02wj2lMQg=";
+  cargoHash = "sha256-PTktA8e5pR+vl0trH0MhBXhcsxU+d/WtBMSKeSztgSY=";
 
   postPatch = ''
     files="

From 276ab1e033b0565ea329defe49e21e2ad7f8ca0d Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 2 Apr 2026 14:52:04 +0200
Subject: [PATCH 103/110] temporal_capi: fix pkg-config integration

---
 pkgs/by-name/te/temporal_capi/package.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/te/temporal_capi/package.nix b/pkgs/by-name/te/temporal_capi/package.nix
index 8add501dd8e2..a19ee4efe21f 100644
--- a/pkgs/by-name/te/temporal_capi/package.nix
+++ b/pkgs/by-name/te/temporal_capi/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   nix-update-script,
   testers,
+  pkg-config,
   validatePkgConfig,
 }:
 
@@ -53,15 +54,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mkdir $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/temporal_capi.pc <<EOF
     prefix=$out
-    exec_prefix=''${prefix}
-    libdir=''${exec_prefix}/lib
-    includedir=''${prefix}/include
+    exec_prefix=\''${prefix}
+    libdir=\''${exec_prefix}/lib
+    includedir=\''${prefix}/include
 
     Name: temporal_capi
     Description: C API for temporal_rs
     Version: ${finalAttrs.version}
-    Libs: -L''${libdir} -ltemporal_capi
-    Cflags: -I''${includedir}
+    Libs: -L\''${libdir} -ltemporal_capi
+    Cflags: -I\''${includedir}
     EOF
   '';
   postFixup = lib.optional (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic) ''
@@ -71,13 +72,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # We don't want to run Rust checks, we only check the resulting lib using C/C++ in the installCheckPhase.
   doCheck = false;
   doInstallCheck = true;
-  nativeInstallCheckInputs = [ stdenv.cc ];
+  nativeInstallCheckInputs = [
+    stdenv.cc
+    pkg-config
+  ];
   installCheckPhase = ''
     runHook preInstallCheck
 
-    cc -L $out/lib -I $out/include temporal_capi/tests/c/simple.c -ltemporal_capi -lm -o c_test
+    FLAGS=$(PKG_CONFIG_PATH="$out/lib/pkgconfig" pkg-config --cflags --libs temporal_capi)
+    cc $FLAGS temporal_capi/tests/c/simple.c -o c_test
     ./c_test
-    c++ -L $out/lib -I $out/include temporal_capi/tests/cpp/simple.cpp -ltemporal_capi -lm -o cpp_test
+    c++ $FLAGS temporal_capi/tests/cpp/simple.cpp -o cpp_test
     ./cpp_test
 
     runHook postInstallCheck

From 75b3a80c47cb4b84e8faa4e7901e40b9ecb17803 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Laurent=20Sava=C3=ABte?= <laurent@where.tf>
Date: Thu, 2 Apr 2026 14:46:40 +0200
Subject: [PATCH 104/110] lasuite-meet{,-frontend}: 1.12.0 -> 1.13.0

---
 pkgs/by-name/la/lasuite-meet-frontend/package.nix | 6 +++---
 pkgs/by-name/la/lasuite-meet/package.nix          | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index f48816866ab8..e490d6167a82 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
+    hash = "sha256-OCW/8JIysegeB0XKfOe6tbYi/TV0NHFvwybalg96maM=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-HobRnbl7fJJ2F0YuA3eyI0R0eW9FveGyqosj0F+Q73I=";
+    hash = "sha256-QL4D55uw80TUJbS+qD2RDgsLVU0kmxxvc+SUXryqno0=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index 6c66b61c6540..d81e3955403f 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "1.12.0";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
+    hash = "sha256-OCW/8JIysegeB0XKfOe6tbYi/TV0NHFvwybalg96maM=";
   };
 
   sourceRoot = "source/src/backend";

From a485d3ced220e7590e1cb7e1f9e8b6c304de7eee Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:44:17 +0200
Subject: [PATCH 105/110] neovide: 0.15.2 -> 0.16.0

https://github.com/neovide/neovide/releases/tag/0.16.0
---
 pkgs/by-name/ne/neovide/package.nix         | 10 +++++-----
 pkgs/by-name/ne/neovide/skia-externals.json |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ne/neovide/package.nix b/pkgs/by-name/ne/neovide/package.nix
index d08a34c08484..ff1927bf1be0 100644
--- a/pkgs/by-name/ne/neovide/package.nix
+++ b/pkgs/by-name/ne/neovide/package.nix
@@ -30,16 +30,16 @@
 
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
   pname = "neovide";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "neovide";
     repo = "neovide";
     tag = finalAttrs.version;
-    hash = "sha256-NJ4BuJLABIuB7We11QGoKZ3fgjDBdZDyZuBKq6LIWA8=";
+    hash = "sha256-i3HEdYZ1fTK8kHRMhGVY80kE6Sp/HhNV4vG2cVroDWo=";
   };
 
-  cargoHash = "sha256-DD2c63JHMdzwD1OmC7c9dMB59qjvdAYZ9drQf3f8xCs=";
+  cargoHash = "sha256-ybPKRgUZ2MRbzSFyevxSDtsNyU4iQwL4b7JIqBpbwk4=";
 
   env = {
     SKIA_SOURCE_DIR =
@@ -48,8 +48,8 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
           owner = "rust-skia";
           repo = "skia";
           # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-          tag = "m140-0.87.4";
-          hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
+          tag = "m145-0.92.0";
+          hash = "sha256-9N780AwheKBJRcZC4l/uWFNq+oOyoNp4M6dJAVVAFeo=";
         };
         # The externals for skia are taken from skia/DEPS
         externals = linkFarm "skia-externals" (
diff --git a/pkgs/by-name/ne/neovide/skia-externals.json b/pkgs/by-name/ne/neovide/skia-externals.json
index 191578bbb554..226e3f103ed4 100644
--- a/pkgs/by-name/ne/neovide/skia-externals.json
+++ b/pkgs/by-name/ne/neovide/skia-externals.json
@@ -21,8 +21,8 @@
   },
   "harfbuzz": {
     "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-    "rev": "08b52ae2e44931eef163dbad71697f911fadc323",
-    "sha256": "sha256-sP9FQLUEgTZFlvfYqSZnzZqBMxVotzD0FKKsu3/OdUw="
+    "rev": "31695252eb6ed25096893aec7f848889dad874bc",
+    "sha256": "sha256-Csyz08JTNXfY2fo27x1Eg1CqO/tt8Rt9udr3KflojSg="
   },
   "wuffs": {
     "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -31,7 +31,7 @@
   },
   "libpng": {
     "url": "https://skia.googlesource.com/third_party/libpng.git",
-    "rev": "ed217e3e601d8e462f7fd1e04bed43ac42212429",
-    "sha256": "sha256-Mo1M8TuVaoSIb7Hy2u6zgjZ1DKgpmgNmGRP6dGg/aTs="
+    "rev": "4e3f57d50f552841550a36eabbb3fbcecacb7750",
+    "sha256": "sha256-tNRrA9RUp6Mi7dbIB/70a/4tn/JxAsTUb9EI9nlXLjM="
   }
 }

From c5801aedf98e2968fc0d4e4db5a1d274e8578cb5 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Thu, 2 Apr 2026 18:49:10 +0400
Subject: [PATCH 106/110] osmium-tool: fix build

---
 pkgs/by-name/os/osmium-tool/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/os/osmium-tool/package.nix b/pkgs/by-name/os/osmium-tool/package.nix
index 2d812e1b956c..754c0ca07e3c 100644
--- a/pkgs/by-name/os/osmium-tool/package.nix
+++ b/pkgs/by-name/os/osmium-tool/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   installShellFiles,
   pandoc,
@@ -26,6 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-x5qEW4DqOw/vA+IuZA7VC5WRn+uDOZ6dJhyJoi7UKOA=";
   };
 
+  patches = [
+    # Fix apply-changes-version-on-version-timestamp test
+    (fetchpatch {
+      url = "https://github.com/osmcode/osmium-tool/commit/e58501ed1570f19340173c668568790369214d46.patch";
+      hash = "sha256-VhdwY1DpfTQAx24Qck0a96GGnEGfg4T27wSeGO1zdng=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     installShellFiles

From 0b7130eff3c3107cdf597a8d4026683c88a1ae5c Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Thu, 2 Apr 2026 11:44:45 -0400
Subject: [PATCH 107/110] kubernix: 0.2.0-unstable-2021-11-16 -> 0.3.1

License was changed to Apache 2.0, and no need for patches anymore
---
 pkgs/by-name/ku/kubernix/Cargo.lock           | 1131 -----------------
 pkgs/by-name/ku/kubernix/Cargo.toml.patch     |   14 -
 .../ku/kubernix/fix-compile-error.patch       |   13 -
 pkgs/by-name/ku/kubernix/package.nix          |   26 +-
 4 files changed, 8 insertions(+), 1176 deletions(-)
 delete mode 100644 pkgs/by-name/ku/kubernix/Cargo.lock
 delete mode 100644 pkgs/by-name/ku/kubernix/Cargo.toml.patch
 delete mode 100644 pkgs/by-name/ku/kubernix/fix-compile-error.patch

diff --git a/pkgs/by-name/ku/kubernix/Cargo.lock b/pkgs/by-name/ku/kubernix/Cargo.lock
deleted file mode 100644
index ad0889c807e7..000000000000
--- a/pkgs/by-name/ku/kubernix/Cargo.lock
+++ /dev/null
@@ -1,1131 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
-
-[[package]]
-name = "cc"
-version = "1.2.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c1599538de2394445747c8cf7935946e3cc27e9625f889d979bfb2aaf569362"
-dependencies = [
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
-
-[[package]]
-name = "clap"
-version = "3.0.0-beta.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bd1061998a501ee7d4b6d449020df3266ca3124b941ec56cf2005c3779ca142"
-dependencies = [
- "atty",
- "bitflags 1.3.2",
- "clap_derive",
- "indexmap",
- "lazy_static",
- "os_str_bytes",
- "strsim",
- "termcolor",
- "terminal_size",
- "textwrap",
- "unicode-width 0.1.14",
- "vec_map",
-]
-
-[[package]]
-name = "clap_derive"
-version = "3.0.0-beta.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "370f715b81112975b1b69db93e0b56ea4cd4e5002ac43b2da8474106a54096a1"
-dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "console"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3993e6445baa160675931ec041a5e03ca84b9c6e32a056150d3aa2bdda0a1f45"
-dependencies = [
- "encode_unicode 0.3.6",
- "lazy_static",
- "libc",
- "regex",
- "terminal_size",
- "unicode-width 0.1.14",
- "winapi",
-]
-
-[[package]]
-name = "console"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e09ced7ebbccb63b4c65413d821f2e00ce54c5ca4514ddc6b3c892fdbcbc69d"
-dependencies = [
- "encode_unicode 1.0.0",
- "libc",
- "once_cell",
- "unicode-width 0.2.1",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
-[[package]]
-name = "either"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
-[[package]]
-name = "encode_unicode"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
-
-[[package]]
-name = "encode_unicode"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
-
-[[package]]
-name = "err-derive"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22deed3a8124cff5fa835713fa105621e43bbdc46690c3a6b68328a012d350d4"
-dependencies = [
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "rustversion",
- "syn 1.0.109",
- "synstructure",
-]
-
-[[package]]
-name = "errno"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
-dependencies = [
- "libc",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
-
-[[package]]
-name = "getrandom"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
-]
-
-[[package]]
-name = "getset"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf0fc11e47561d47397154977bc219f4cf809b2974facc3ccb3b89e2436f912"
-dependencies = [
- "proc-macro-error2",
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hostname"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
-dependencies = [
- "libc",
- "match_cfg",
- "winapi",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown",
-]
-
-[[package]]
-name = "indicatif"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7baab56125e25686df467fe470785512329883aab42696d661247aca2a2896e4"
-dependencies = [
- "console 0.16.0",
- "lazy_static",
- "number_prefix",
- "regex",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "ipnetwork"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4088d739b183546b239688ddbc79891831df421773df95e236daf7867866d355"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
-
-[[package]]
-name = "kubernix"
-version = "0.2.0"
-dependencies = [
- "anyhow",
- "base64",
- "clap",
- "clap_derive",
- "console 0.14.1",
- "crossbeam-channel",
- "getset",
- "hostname",
- "indicatif",
- "ipnetwork",
- "lazy_static",
- "log",
- "nix",
- "parking_lot",
- "proc-mounts",
- "rand",
- "rayon",
- "serde",
- "serde_json",
- "serde_yaml",
- "signal-hook",
- "tempfile",
- "toml",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "libc"
-version = "0.2.174"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
-
-[[package]]
-name = "linked-hash-map"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
-
-[[package]]
-name = "lock_api"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "match_cfg"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
-
-[[package]]
-name = "memchr"
-version = "2.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
-
-[[package]]
-name = "memoffset"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "nix"
-version = "0.22.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4916f159ed8e5de0082076562152a76b7a1f64a01fd9d1e0fea002c37624faf"
-dependencies = [
- "bitflags 1.3.2",
- "cc",
- "cfg-if",
- "libc",
- "memoffset",
-]
-
-[[package]]
-name = "number_prefix"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b02fc0ff9a9e4b35b3342880f48e896ebf69f2967921fe8646bf5b7125956a"
-
-[[package]]
-name = "once_cell"
-version = "1.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-
-[[package]]
-name = "os_str_bytes"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afb2e1c3ee07430c2cf76151675e583e0f19985fa6efae47d6848a3e2c824f85"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "partition-identity"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec13ba9a0eec5c10a89f6ec1b6e9e2ef7d29b810d771355abbd1c43cae003ed6"
-dependencies = [
- "err-derive",
-]
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "proc-macro-error2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
-dependencies = [
- "proc-macro-error-attr2",
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.95"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "proc-mounts"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad7e9c8d1b8c20f16a84d61d7c4c0325a5837c1307a2491b509cd92fb4e4442"
-dependencies = [
- "lazy_static",
- "partition-identity",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "rand"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
-dependencies = [
- "libc",
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.16",
-]
-
-[[package]]
-name = "rayon"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "regex"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
-
-[[package]]
-name = "rustix"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
-dependencies = [
- "bitflags 2.9.1",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
-
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "serde"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.140"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
-dependencies = [
- "itoa",
- "memchr",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_yaml"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578a7433b776b56a35785ed5ce9a7e777ac0598aac5a6dd1b4b18a307c7fc71b"
-dependencies = [
- "indexmap",
- "ryu",
- "serde",
- "yaml-rust",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "signal-hook"
-version = "0.3.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
-dependencies = [
- "libc",
- "signal-hook-registry",
-]
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "unicode-xid",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
-dependencies = [
- "fastrand",
- "getrandom 0.3.3",
- "once_cell",
- "rustix",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "terminal_size"
-version = "0.1.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "633c1a546cee861a1a6d0dc69ebeca693bf4296661ba7852b9d21d159e0506df"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "203008d98caf094106cfaba70acfed15e18ed3ddb7d94e49baec153a2b462789"
-dependencies = [
- "terminal_size",
- "unicode-width 0.1.14",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1a07cc7db3810833284e8d372ccdc6da29741639ecc70c9ec107df0fa6154c"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
-
-[[package]]
-name = "vec_map"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
-dependencies = [
- "wit-bindgen-rt",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
-dependencies = [
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
-
-[[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags 2.9.1",
-]
-
-[[package]]
-name = "yaml-rust"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
-dependencies = [
- "linked-hash-map",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
diff --git a/pkgs/by-name/ku/kubernix/Cargo.toml.patch b/pkgs/by-name/ku/kubernix/Cargo.toml.patch
deleted file mode 100644
index b4c21e3e7292..000000000000
--- a/pkgs/by-name/ku/kubernix/Cargo.toml.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Cargo.toml b/Cargo.toml
-index 681e634..48cbc8e 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -19,7 +19,8 @@ path = "src/main.rs"
- [dependencies]
- anyhow = "1.0.43"
- base64 = "0.13.0"
--clap = { git = "https://github.com/clap-rs/clap", features = ["wrap_help"] }
-+clap = { version = "= 3.0.0-beta.2", features = ["wrap_help"] }
-+clap_derive = "= 3.0.0-beta.2"
- console = "0.14.1"
- crossbeam-channel = "0.5.1"
- getset = "0.1.1"
diff --git a/pkgs/by-name/ku/kubernix/fix-compile-error.patch b/pkgs/by-name/ku/kubernix/fix-compile-error.patch
deleted file mode 100644
index 9e550e46da7f..000000000000
--- a/pkgs/by-name/ku/kubernix/fix-compile-error.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/crio.rs b/src/crio.rs
-index 36bf40b..97d5e57 100644
---- a/src/crio.rs
-+++ b/src/crio.rs
-@@ -34,7 +34,7 @@ impl Display for CriSocket {
- impl CriSocket {
-     pub fn new(path: PathBuf) -> Result<CriSocket> {
-         if path.display().to_string().len() > 100 {
--            bail!("Socket path '{}' is too long")
-+            bail!("Socket path '{}' is too long", path.display().to_string())
-         }
-         Ok(CriSocket(path))
-     }
diff --git a/pkgs/by-name/ku/kubernix/package.nix b/pkgs/by-name/ku/kubernix/package.nix
index bfcd0442eb94..60a39ac41858 100644
--- a/pkgs/by-name/ku/kubernix/package.nix
+++ b/pkgs/by-name/ku/kubernix/package.nix
@@ -4,38 +4,28 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kubernix";
-  version = "0.2.0-unstable-2021-11-16";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "saschagrunert";
     repo = "kubernix";
-    rev = "630087e023e403d461c4bb8b1c9368b26a2c0744";
-    sha256 = "sha256-IkfVpNxWOqQt/aXsN4iD9dkKKyOui3maKowVibuKbvM=";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-1cnh4h8rX6Uv/JlUy2uSpwgcjo2yTyTi+bHvWREZ7e0=";
   };
 
-  cargoLock.lockFile = ./Cargo.lock;
-
-  patches = [
-    # Need a specific version of clap and clap_derive: fails with anything greater.
-    ./Cargo.toml.patch
-    # error: 1 positional argument in format string, but no arguments were given
-    ./fix-compile-error.patch
-  ];
-
-  postPatch = ''
-    cp ${./Cargo.lock} Cargo.lock
-  '';
+  cargoHash = "sha256-7Pyj+sLvkEOIYt7UYcpsS65gjNHxXZQS1RRQDagCW8Y=";
 
+  # Tests require network access
   doCheck = false;
 
   meta = {
     description = "Single dependency Kubernetes clusters for local testing, experimenting and development";
     mainProgram = "kubernix";
     homepage = "https://github.com/saschagrunert/kubernix";
-    license = with lib.licenses; [ mit ];
+    license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ saschagrunert ];
     platforms = lib.platforms.linux;
   };
-}
+})

From ef3cdd94d718983d7aa6df4b5878fa6beb7209c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Apr 2026 15:54:53 +0000
Subject: [PATCH 108/110] python3Packages.jupyter-server-ydoc: 2.2.1 -> 2.3.0

---
 .../python-modules/jupyter-server-ydoc/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-server-ydoc/default.nix b/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
index 6ed33d65441f..ceefafab68ef 100644
--- a/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-server-ydoc";
-  version = "2.2.1";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_server_ydoc";
     inherit (finalAttrs) version;
-    hash = "sha256-aVf2pmqHlMQmVJS7onBnpLCbKTavmRZ5LCDRN6cDvkY=";
+    hash = "sha256-NvMRSR6fKJ9GH83yavubcs3w6sPO7QwMvI7EOvyO/rw=";
   };
 
   build-system = [ hatchling ];

From 58e9cd46af3c2587ceb940c90c545510368e7761 Mon Sep 17 00:00:00 2001
From: Florian RICHER <florian.richer@protonmail.com>
Date: Thu, 2 Apr 2026 15:15:12 +0200
Subject: [PATCH 109/110] hyprlandPlugins.imgborders: init at 1.0.1

---
 .../hyprwm/hyprland-plugins/default.nix       |  1 +
 .../hyprwm/hyprland-plugins/imgborders.nix    | 42 +++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/applications/window-managers/hyprwm/hyprland-plugins/imgborders.nix

diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
index 5d4663fcc3ae..dda8a3b3a80e 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
@@ -44,6 +44,7 @@ let
     { hyprspace = import ./hyprspace.nix; }
     { hyprsplit = import ./hyprsplit.nix; }
     (import ./hyprland-plugins.nix)
+    { imgborders = import ./imgborders.nix; }
     (lib.optionalAttrs config.allowAliases {
       hycov = throw "hyprlandPlugins.hycov has been removed because it has been marked as broken since September 2024."; # Added 2025-10-12
       hyprscroller = throw "hyprlandPlugins.hyprscroller has been removed as the upstream project is deprecated. Consider using `hyprlandPlugins.hyprscrolling`."; # Added 2025-05-09
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/imgborders.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/imgborders.nix
new file mode 100644
index 000000000000..f7e387354ced
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/imgborders.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromCodeberg,
+  mkHyprlandPlugin,
+  cmake,
+  nix-update-script,
+}:
+mkHyprlandPlugin (finalAttrs: {
+  pluginName = "imgborders";
+  version = "1.0.1";
+
+  src = fetchFromCodeberg {
+    owner = "zacoons";
+    repo = "imgborders";
+    tag = finalAttrs.version;
+    hash = "sha256-fCzz4gh8pd7J6KQJB/avYcS0Z7NYpxjznPMtOwypPSQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv imgborders.so $out/lib/libimgborders.so
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://codeberg.org/zacoons/imgborders";
+    description = "Add tiling image borders to windows!";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [
+      mrdev023
+    ];
+  };
+})

From 509366436f9dc5acfb9c93a5d40256501e3cfd39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment?= <git@drawbu.dev>
Date: Fri, 20 Mar 2026 10:58:11 -0700
Subject: [PATCH 110/110] python3Packages.podcats: modernize

- replace `rec` with `finalAttrs`
- sort inputs
- change repository owner to `jkbrzt` since the repository was
  redirecting
---
 .../python-modules/podcats/default.nix        | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/podcats/default.nix b/pkgs/development/python-modules/podcats/default.nix
index 64e9c11c9859..279723394fb8 100644
--- a/pkgs/development/python-modules/podcats/default.nix
+++ b/pkgs/development/python-modules/podcats/default.nix
@@ -1,23 +1,23 @@
 {
-  lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
   flask,
   humanize,
+  lib,
   mutagen,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "podcats";
   version = "0.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "jakubroztocil";
+    owner = "jkbrzt";
     repo = "podcats";
-    tag = version;
-    sha256 = "sha256-1Jg9bR/3qMim3q5qVwUVbxeLNaXaCU6SplBUaRXeLpo=";
+    tag = finalAttrs.version;
+    hash = "sha256-1Jg9bR/3qMim3q5qVwUVbxeLNaXaCU6SplBUaRXeLpo=";
   };
 
   build-system = [ setuptools ];
@@ -28,11 +28,14 @@ buildPythonPackage rec {
     mutagen
   ];
 
+  pythonImportsCheck = [ "podcats" ];
+  doCheck = false;
+
   meta = {
-    description = "Application that generates RSS feeds for podcast episodes from local audio files";
+    description = "Generates RSS feeds for podcast episodes from local audio files";
     mainProgram = "podcats";
-    homepage = "https://github.com/jakubroztocil/podcats";
+    homepage = "https://github.com/jkbrzt/podcats";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ drawbu ];
   };
-}
+})