From f7178499152850ae70bc119f3e549f952646ec44 Mon Sep 17 00:00:00 2001
From: kulczwoj <kulczwoj.git@gmail.com>
Date: Tue, 20 Jan 2026 14:12:49 +0200
Subject: [PATCH 01/60] maintainers: add kulczwoj

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fd5ff092fcc1..f8a490ed9c8e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14345,6 +14345,11 @@
     githubId = 629430;
     keys = [ { fingerprint = "2843 750C B1AB E256 94BE  40E2 D843 D30B 42CA 0E2D"; } ];
   };
+  kulczwoj = {
+    name = "Wojciech Kulczycki";
+    github = "kulczwoj";
+    githubId = 58049191;
+  };
   KunyaKud = {
     name = "KunyaKud";
     email = "wafuu@posteo.net";

From c1e6f51410c8cd2e27e874f33b8ae59d5f97d61b Mon Sep 17 00:00:00 2001
From: kulczwoj <kulczwoj.git@gmail.com>
Date: Tue, 20 Jan 2026 14:12:49 +0200
Subject: [PATCH 02/60] pixinsight: rewrite

Rewrite to provide main missing functionality out-of-the-box

- Add mutable deployment to support native self-updates and plugin
  management (togglable via `enableUpdates` flag); on unwrapped
  derivation change clear and redeploy
- Add CUDA support (use custom `libtensorflow-gpu` package, as variant
  shipped with `tensorflow-bin` is incompatible with PixInsight)
- Fix desktop integration (add missing files)
- Provide upstream-compatible CLI command `PixInsight`

Following patterns from `steam`, `davinci-resolve`, `zoom-us`
---
 pkgs/by-name/pi/pixinsight/default.nix        |  89 +++++
 .../pi/pixinsight/libtensorflow-gpu.nix       |  56 +++
 pkgs/by-name/pi/pixinsight/package.nix        | 323 +++++++++---------
 3 files changed, 302 insertions(+), 166 deletions(-)
 create mode 100644 pkgs/by-name/pi/pixinsight/default.nix
 create mode 100644 pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix

diff --git a/pkgs/by-name/pi/pixinsight/default.nix b/pkgs/by-name/pi/pixinsight/default.nix
new file mode 100644
index 000000000000..06cb980f0fdc
--- /dev/null
+++ b/pkgs/by-name/pi/pixinsight/default.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  requireFile,
+  bubblewrap,
+  fakeroot,
+  unixtools,
+  cudaSupport,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pixinsight";
+  version = "1.9.3-20250402";
+
+  src = requireFile {
+    name = "PI-linux-x64-${finalAttrs.version}-c.tar.xz";
+    url = "http://pixinsight.com";
+    hash = "sha256-MOAWH64A13vVLeNiBC9nO78P0ELmXXHR5ilh5uUhWhs=";
+  };
+
+  nativeBuildInputs = [
+    bubblewrap
+    fakeroot
+    unixtools.script
+  ];
+
+  sourceRoot = ".";
+
+  # Patch installer binary with correct interpreter and rpath
+  postPatch = ''
+    patchelf ./installer \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath ${lib.getLib stdenv.cc.cc}/lib
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    # Prepare output directories
+    mkdir -p $out/opt
+    mkdir -p $out/share/{applications,mime/packages}
+    for i in 16 24 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$i"x"$i"/apps
+    done
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+
+    # Install using proper bind-mounts
+    bwrap \
+      --bind /build /build \
+      --bind $out/opt /opt \
+      --bind /nix /nix \
+      --dev /dev \
+      fakeroot script -ec "./installer \
+        --yes \
+        --install-desktop-dir=$out/share/applications \
+        --install-mime-dir=$out/share/mime \
+        --install-icons-dir=$out/share/icons/hicolor \
+        --no-bin-launcher"
+  ''
+  + lib.optionalString cudaSupport ''
+    # Remove bundled libtensorflow-cpu files
+    rm -f $out/opt/PixInsight/bin/lib/libtensorflow*
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # Patch desktop entry for downstream compatibility
+    substituteInPlace $out/share/applications/PixInsight.desktop \
+      --replace-fail "Exec=/opt/PixInsight/bin/PixInsight.sh" "Exec=pixinsight"
+  '';
+
+  meta = {
+    description = "Scientific image processing program for astrophotography";
+    homepage = "https://pixinsight.com/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      sheepforce
+      kulczwoj
+    ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    hydraPlatforms = [ ];
+  };
+})
diff --git a/pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix b/pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix
new file mode 100644
index 000000000000..50c9505fe19e
--- /dev/null
+++ b/pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  cudaPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libtensorflow-gpu";
+  version = "2.18.1";
+
+  src = fetchurl {
+    url = "https://storage.googleapis.com/tensorflow/versions/${finalAttrs.version}/${finalAttrs.pname}-linux-x86_64.tar.gz";
+    hash = "sha256-9k7DA53E/hh9zzMhX0D6BZOZWwOoiNEi/tdYHONIFeU=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = with cudaPackages; [
+    cudatoolkit
+    cudnn
+  ];
+
+  sourceRoot = ".";
+
+  # Unpack tarball to subdir, preventing copying `env-vars` to $out in `installPhase`
+  preUnpack = ''
+    mkdir source
+    cd source
+  '';
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -pr --reflink=auto -- . $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Computation using data flow graphs for scalable machine learning";
+    homepage = "http://tensorflow.org";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kulczwoj ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/pi/pixinsight/package.nix b/pkgs/by-name/pi/pixinsight/package.nix
index d7900f55fdee..a228e528d164 100644
--- a/pkgs/by-name/pi/pixinsight/package.nix
+++ b/pkgs/by-name/pi/pixinsight/package.nix
@@ -1,182 +1,173 @@
 {
-  stdenv,
   lib,
-  requireFile,
-  autoPatchelfHook,
-  unixtools,
-  fakeroot,
-  mailcap,
-  libGL,
-  libpulseaudio,
-  alsa-lib,
-  nss,
-  gd,
-  gst_all_1,
-  nspr,
-  expat,
-  fontconfig,
-  dbus,
-  glib,
-  zlib,
-  openssl,
-  libdrm,
-  cups,
-  avahi-compat,
-  libidn2,
-  libdeflate,
-  brotli,
-  libxkbcommon,
-  libxcb,
-  libxtst,
-  libxrandr,
-  libxfixes,
-  libxext,
-  libxdamage,
-  libxcomposite,
-  libx11,
-  xrandr,
-  libxkbfile,
-  wayland,
-  libudev0-shim,
-  bubblewrap,
-  libjpeg8,
-  gdk-pixbuf,
-  gtk3,
-  pango,
+  callPackage,
   buildFHSEnv,
+  cudaPackages,
+  config,
+  cudaSupport ? config.cudaSupport,
+
+  # Provide support for built-in self-updates and plugin management
+  #
+  # PixInsight installs updates and plugins in its main installation location,
+  # which is incompatible with running it from immutable Nix store.
+  #
+  # `true`:
+  # - configure mutable copy of PixInsight installation under
+  #   `~/.local/share/pixinsight`, and run PixInsight using it
+  # - whenever immutable installation changes, on launch clear and reinstall
+  #   mutable files to keep synced with Nix store
+  # - `PixInsightUpdater` is fully functional
+  #
+  # `false`:
+  # - run PixInsight using immutable installation from Nix store
+  # - `PixInsightUpdater` returns `Read-only file system` error on update
+  #   installation attempt
+  #
+  # Enabled by default, as this is part of core functionality, expected from upstream
+  enableUpdates ? true,
 }:
 
 let
-  meta = {
-    description = "Scientific image processing program for astrophotography";
-    homepage = "https://pixinsight.com/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ lib.maintainers.sheepforce ];
-    hydraPlatforms = [ ];
-    mainProgram = "PixInsight";
-  };
+  pixinsight = callPackage ./. { inherit cudaSupport; };
 
-  pname = "pixinsight";
-  version = "1.9.3-20250402";
+  # For CUDA support (PixInsight ships with `libtensorflow-cpu`)
+  #
+  # PixInsight uses C API `libtensorflow`, which differs from library shipped
+  # with `tensorflow-bin`: in particular it contains `VERS_1.0` embedded.
+  # Variants from `tensorflow-bin` don't embed it and are rejected as
+  # incompatible, when PixInsight installs plugins to its internal runtime
+  # environment and loads their dependencies.
+  libtensorflow-gpu = callPackage ./libtensorflow-gpu.nix { };
 
-  installPkg = stdenv.mkDerivation (finalAttrs: {
-    inherit meta pname version;
+  deployPath = "$HOME/.local/share/pixinsight";
+  storePathFile = "${deployPath}/opt/PixInsight/.store-path";
+in
+buildFHSEnv {
+  inherit (pixinsight) pname version;
 
-    src = requireFile rec {
-      name = "PI-linux-x64-${finalAttrs.version}-c.tar.xz";
-      url = "https://pixinsight.com/";
-      hash = "sha256-MOAWH64A13vVLeNiBC9nO78P0ELmXXHR5ilh5uUhWhs=";
-      message = ''
-        PixInsight is available from ${url} and requires a commercial (or trial) license.
-        After a license has been obtained, PixInsight can be downloaded from the software distribution
-        (choose Linux 64bit).
-        The PixInsight tarball must be added to the nix-store, i.e. via
-          nix-prefetch-url --type sha256 file:///path/to/${name}
-      '';
-    };
-    sourceRoot = ".";
+  targetPkgs =
+    pkgs:
+    (with pkgs; [
+      expat
+      glib
+      zlib
+      udev
+      dbus
+      nspr
+      nss
+      openssl
 
-    nativeBuildInputs = [
-      unixtools.script
-      fakeroot
-      mailcap
-      libudev0-shim
-      bubblewrap
+      alsa-lib
+      libxkbcommon
+
+      libGL
+      libdrm
+      qt6Packages.qtbase
+      gtk3
+      fontconfig
+      libjpeg8
+      gd
+
+      libssh2
+      libpsl
+      libidn2
+
+      brotli
+      libdeflate
+
+      avahi-compat
+      cups
+
+      libx11
+      libxcomposite
+      libxdamage
+      libxext
+      libxfixes
+      libxinerama
+      libxrandr
+      libxrender
+      libxtst
+
+      libsm
+      libice
+
+      libxcb
+      libxkbfile
+      libxcb-util
+      libxcb-image
+      libxcb-keysyms
+      libxcb-render-util
+      libxcb-wm
+      # libxcb-cursor # Bundled by PixInsight
+    ])
+    ++ lib.optionals cudaSupport (
+      [
+        libtensorflow-gpu
+      ]
+      ++ (with pkgs.cudaPackages; [
+        cudatoolkit
+        cudnn
+      ])
+    );
+
+  extraInstallCommands = ''
+    # Provide second binary matching upstream CLI command (`PixInsight`)
+    ln -s $out/bin/{pixinsight,PixInsight}
+
+    # Provide desktop integration files
+    ln -s {${pixinsight},$out}/share
+  '';
+
+  # Prepare mutable opt/ for self-update and plugin support
+  # Clear and redeploy whenever `pixinsight` store path changes
+  extraPreBwrapCmds = lib.optionalString enableUpdates ''
+    set -e
+
+    read -r DEPLOYED_PATH < "${storePathFile}" 2>/dev/null || DEPLOYED_PATH=""
+
+    if [ "$DEPLOYED_PATH" != "${pixinsight}" ]; then
+      echo "pixinsight: new PixInsight installation detected"
+      echo "pixinsight: deploying ${pixinsight}/opt/PixInsight to ${deployPath}/opt/PixInsight..."
+
+      mkdir -p "${deployPath}"/opt
+      rm -rf "${deployPath}"/opt/PixInsight
+      cp -R ${pixinsight}/opt/PixInsight "${deployPath}"/opt
+      chmod -R u+w "${deployPath}"/opt/PixInsight
+
+      echo "${pixinsight}" > "${storePathFile}"
+
+      echo "pixinsight: deployed successfully"
+    fi
+  '';
+
+  extraBwrapArgs =
+    lib.optionals enableUpdates [
+      # Bind-mount mutable opt/ to /opt
+      ''--bind "${deployPath}"/opt /opt''
+    ]
+    ++ lib.optionals (!enableUpdates) [
+      # Bind-mount immutable opt/ to /opt
+      ''--ro-bind "${pixinsight}"/opt /opt''
     ];
 
-    postPatch = ''
-      patchelf ./installer \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath ${lib.getLib stdenv.cc.cc}/lib
-    '';
+  profile = lib.optionalString cudaSupport ''
+    export XLA_FLAGS=--xla_gpu_cuda_data_dir=${cudaPackages.cudatoolkit}
+  '';
 
-    dontConfigure = true;
-    dontBuild = true;
+  runScript = "/opt/PixInsight/bin/PixInsight.sh";
 
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/bin $out/opt/PixInsight $out/share/{applications,mime/packages,icons/hicolor}
-
-      bwrap --bind /build /build --bind $out/opt /opt --bind /nix /nix --dev /dev fakeroot script -ec "./installer \
-        --yes \
-        --install-desktop-dir=$out/share/applications \
-        --install-mime-dir=$out/share/mime \
-        --install-icons-dir=$out/share/icons/hicolor \
-        --no-bin-launcher \
-        --no-remove"
-
-      rm -rf $out/opt/PixInsight-old-0
-      ln -s $out/opt/PixInsight/bin/PixInsight $out/bin/.
-      ln -s $out/opt/PixInsight/bin/lib $out/lib
-
-      runHook postInstall
-    '';
-
-  });
-
-  runPkg = buildFHSEnv {
-    inherit meta pname version;
-
-    targetPkgs =
-      pkgs:
-
-      [
-        # PI itself
-        installPkg
-        # runtime deps
-        mailcap
-        libudev0-shim
-        (lib.getLib stdenv.cc.cc)
-        stdenv.cc
-        libGL
-        libpulseaudio
-        alsa-lib
-        nss
-        gd
-        gst_all_1.gstreamer
-        gst_all_1.gst-plugins-base
-        nspr
-        expat
-        fontconfig
-        dbus
-        glib
-        zlib
-        openssl
-        libdrm
-        wayland
-        cups
-        avahi-compat
-        libjpeg8
-        gdk-pixbuf
-        gtk3
-        pango
-        libidn2
-        libdeflate
-        brotli
-        libxkbcommon
-        libxcb
-        libx11
-        libxdamage
-        xrandr
-        libxtst
-        libxcomposite
-        libxext
-        libxfixes
-        libxrandr
-        libxkbfile
-      ];
-
-    profile = ''
-      export QT_QPA_PLATFORM_PLUGIN_PATH=/opt/PixInsight/bin/lib/qt-plugins/platforms
-      export QT_PLUGIN_PATH=/opt/PixInsight/bin/lib/qt-plugins
-      export LD_LIBRARY_PATH=${libudev0-shim}/lib
-    '';
-
-    runScript = "${installPkg}/bin/PixInsight";
+  passthru = {
+    inherit libtensorflow-gpu;
+    unwrapped = pixinsight;
   };
 
-in
-runPkg
+  inherit (pixinsight.meta)
+    description
+    homepage
+    license
+    maintainers
+    platforms
+    sourceProvenance
+    hydraPlatforms
+    ;
+}

From dcc36d1e746d187e6d2f3e057fcd653508c02b33 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:33:33 +0200
Subject: [PATCH 03/60] nixos/power-management: use sleep.target instead of
 listing all individual sleep targets

See https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html#sleep.target
---
 nixos/modules/config/power-management.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index 6b2253068c0b..b061bbe6b707 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -83,12 +83,8 @@ in
 
     systemd.services.post-resume = {
       description = "Post-Resume Actions";
-      after = [
-        "suspend.target"
-        "hibernate.target"
-        "hybrid-sleep.target"
-        "suspend-then-hibernate.target"
-      ];
+      # Pulled in by post-resume.service above
+      after = [ "sleep.target" ];
       script = ''
         /run/current-system/systemd/bin/systemctl try-restart --no-block post-resume.target
         ${cfg.resumeCommands}

From 34fd3fe6a21e7564416eff18ca57d9df3a5f7f99 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:34:37 +0200
Subject: [PATCH 04/60] nixos/power-management: run postBootCommands in a
 systemd service instead of stage2-init.sh

This reduces our initrd script slightly, and we never made any clear
ordering guarantees about when these commands run anyway.
It also removes this as a blocker for nixos-init.
---
 nixos/modules/config/power-management.nix      | 15 +++++++++++++++
 nixos/modules/system/activation/nixos-init.nix |  4 ----
 nixos/modules/system/boot/stage-2.nix          |  1 -
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index b061bbe6b707..5dcfe5bf013c 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -81,6 +81,21 @@ in
       serviceConfig.Type = "oneshot";
     };
 
+    systemd.services.post-boot = {
+      description = "Post-boot Actions";
+      # It's not well defined at what point in the bootup sequence this should run
+      # we should eventually just remove this.
+      after = [ "multi-user.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        ${cfg.powerUpCommands}
+      '';
+    };
+
     systemd.services.post-resume = {
       description = "Post-Resume Actions";
       # Pulled in by post-resume.service above
diff --git a/nixos/modules/system/activation/nixos-init.nix b/nixos/modules/system/activation/nixos-init.nix
index 9d5094017c0b..1ab2e546d40a 100644
--- a/nixos/modules/system/activation/nixos-init.nix
+++ b/nixos/modules/system/activation/nixos-init.nix
@@ -58,10 +58,6 @@ in
           assertion = config.boot.postBootCommands == "";
           message = "nixos-init cannot be used with boot.postBootCommands";
         }
-        {
-          assertion = config.powerManagement.powerUpCommands == "";
-          message = "nixos-init cannot be used with powerManagement.powerUpCommands";
-        }
       ];
     })
   ];
diff --git a/nixos/modules/system/boot/stage-2.nix b/nixos/modules/system/boot/stage-2.nix
index 680f5eed55c0..9b72391c20ac 100644
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@@ -30,7 +30,6 @@ let
       );
       postBootCommands = pkgs.writeText "local-cmds" ''
         ${config.boot.postBootCommands}
-        ${config.powerManagement.powerUpCommands}
       '';
     };
   };

From 27088a483935159ffb0c07c99804bdd7480ef000 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Sun, 8 Feb 2026 19:15:16 -0800
Subject: [PATCH 05/60] llvmPackages_git: 23.0.0-unstable-2026-02-01 ->
 23.0.0-unstable-2026-02-08

---
 pkgs/development/compilers/llvm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 3547aee2af9d..f0c186d87aae 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.0-rc2".officialRelease.sha256 = "sha256-j0KSuTANrwLh/siEcztSqCYQQDYHmdBCgVCsPsDCQ+I=";
     "23.0.0-git".gitRelease = {
-      rev = "dc152f0d2d085dcfb7542d0e71e19ebfa1aa3794";
-      rev-version = "23.0.0-unstable-2026-02-01";
-      sha256 = "sha256-F0NXNZLTlMnZlWuAqpoBxrr1DCavQz00WdobKbuwarU=";
+      rev = "80f627e6d5f1adedd5747b265f79e2304a200367";
+      rev-version = "23.0.0-unstable-2026-02-08";
+      sha256 = "sha256-4p43Y/yM5nevL9qIJexkMA0QeFrYKcl2mzJqVneaWhQ=";
     };
   }
   // llvmVersions;

From c12ba2de5b7ee4212cc0826c4d8ad4ae20afea29 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Feb 2026 00:28:43 +0000
Subject: [PATCH 06/60] capstone: 5.0.6 -> 5.0.7

---
 pkgs/by-name/ca/capstone/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/capstone/package.nix b/pkgs/by-name/ca/capstone/package.nix
index e774c10f4372..2f0bb919d37c 100644
--- a/pkgs/by-name/ca/capstone/package.nix
+++ b/pkgs/by-name/ca/capstone/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "capstone";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "capstone-engine";
     repo = "capstone";
     rev = finalAttrs.version;
-    hash = "sha256-ovIvsxVq+/q5UUMzP4WpxzaE0898uayNc1g2Coignnc=";
+    hash = "sha256-+6QReHZK+iIXspizy6Kvk7cj016HOKgiaKSaP4h7mao=";
   };
 
   cmakeFlags = [

From df0b0d2f147e1cad7683aba0545ac8291c2827d1 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:36:13 +0200
Subject: [PATCH 07/60] nixos/power-management: deprecate powerUpCommands

Their ordering is ill-defined. Users are better off using an explicit systemd service.
---
 nixos/modules/config/power-management.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index 5dcfe5bf013c..b5ae488697a2 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -62,6 +62,19 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    warnings = lib.optional (cfg.powerUpCommands != "") ''
+      powerManagement.powerUpCommands is deprecated due to it having unclear ordering semantics.
+      It will be removed in NixOS 26.11.
+      It is recommended to create an explicit systemd oneshot service instead,
+      that is pulled in at the right time during the boot process.
+      See https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html
+      for more information on possible targets that can be used for this.
+
+      If you also want to run this service upon waking up from resume, the recommended
+      method to do so is described here:
+      https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html#sleep.target
+    '';
+
     systemd.targets.post-resume = {
       description = "Post-Resume Actions";
       requires = [ "post-resume.service" ];
@@ -85,8 +98,8 @@ in
       description = "Post-boot Actions";
       # It's not well defined at what point in the bootup sequence this should run
       # we should eventually just remove this.
-      after = [ "multi-user.target" ];
       wantedBy = [ "multi-user.target" ];
+      restartIfChanged = false;
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;

From 30cb9399cc7e42e31bc2db104a49ac9d5e0544a7 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Tue, 10 Feb 2026 11:49:28 -0800
Subject: [PATCH 08/60] nixos-rebuild-ng: add --diff argument

This displays the package updates, additions, and removals to the user.
---
 .../ni/nixos-rebuild-ng/nixos-rebuild.8.scd        |  8 ++++++++
 .../nixos-rebuild-ng/src/nixos_rebuild/__init__.py | 14 ++++++++++++++
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py   | 12 ++++++++++++
 .../nixos-rebuild-ng/src/nixos_rebuild/services.py |  8 ++++++++
 4 files changed, 42 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index 43b8c233e290..b2298ce10639 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -308,6 +308,14 @@ It must be one of the following:
 	option, it is possible to build non-flake NixOS configurations even if
 	the current NixOS systems uses flakes.
 
+*--diff*
+	show the diff between the system closure in /run/current-system
+	and the newly built system closure.
+	(avaliable for actions: build, boot, test, switch)
+
+	This is similar to running:
+	"nix store diff-closures /run/current-system result" after build
+
 In addition, *nixos-rebuild* accepts following options from nix commands that
 the tool calls:
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index ad0f45b3971b..29e05617d60d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -197,6 +197,12 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
         help="Selects an image variant to build from the "
         "config.system.build.images attribute of the given configuration",
     )
+    main_parser.add_argument(
+        "--diff",
+        action="store_true",
+        help="prints out the diff between the current system "
+        "and the newly built one using nix store diff-closures"
+    )
     main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
     return main_parser, sub_parsers
@@ -259,6 +265,14 @@ def parse_args(
     if args.no_build_nix:
         parser_warn("--no-build-nix is deprecated, we do not build nix anymore")
 
+    if args.diff and args.action not in (
+        Action.SWITCH.value,
+        Action.BOOT.value,
+        Action.BUILD.value,
+        Action.TEST.value
+    ):
+        parser_warn(f"--diff is a no-op with '{args.action}'")
+
     if args.action == Action.EDIT.value and (args.file or args.attr):
         parser.error("--file and --attr are not supported with 'edit'")
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index d2c5ceace95c..9ac72d824ba1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -537,6 +537,18 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             reverse=True,
         )
 
+def diff_closures(path_to_config: Path):
+    run_wrapper(
+        [
+            "nix",
+            *FLAKE_FLAGS,
+            "store",
+            "diff-closures",
+            "/run/current-system",
+            path_to_config
+        ]
+    )
+
 
 def repl(build_attr: BuildAttr, nix_flags: Args | None = None) -> None:
     run_args = ["nix", "repl", "--file", build_attr.path]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 735be1680013..95ff0bede090 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,6 +321,14 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
+    if args.diff and args.action in (
+        Action.SWITCH.value,
+        Action.BOOT.value,
+        Action.BUILD.value,
+        Action.TEST.value
+    ):
+        nix.diff_closures(path_to_config)
+
     _activate_system(
         path_to_config=path_to_config,
         action=action,

From 9662a5007289c8d73d0d7a93344373b43c223616 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 11 Feb 2026 05:04:03 +0000
Subject: [PATCH 09/60] python3Packages.ubelt: 1.4.0 -> 1.4.1

---
 pkgs/development/python-modules/ubelt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ubelt/default.nix b/pkgs/development/python-modules/ubelt/default.nix
index c0d5e324e22e..70f4fd7a4293 100644
--- a/pkgs/development/python-modules/ubelt/default.nix
+++ b/pkgs/development/python-modules/ubelt/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "ubelt";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Erotemic";
     repo = "ubelt";
     tag = "v${version}";
-    hash = "sha256-9f22hNi/YrxAVoEOGojdziogUN/YNCrpUuOfib9nqfQ=";
+    hash = "sha256-iEKwJaOWiotyGcz1orc8z3Iqq5Va7p639ebStOA1bCo=";
   };
 
   nativeBuildInputs = [

From aaae02bd2aa4c99f6d3224ae099c7d20cac65038 Mon Sep 17 00:00:00 2001
From: Electria <117232210+Elec3137@users.noreply.github.com>
Date: Wed, 11 Feb 2026 06:59:04 -0800
Subject: [PATCH 10/60] nixos-rebuild-ng: generalize diff_closures

also adds support for remote hosts

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 9ac72d824ba1..5726853dd8ba 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -537,16 +537,17 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             reverse=True,
         )
 
-def diff_closures(path_to_config: Path):
+def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
     run_wrapper(
         [
             "nix",
             *FLAKE_FLAGS,
             "store",
             "diff-closures",
-            "/run/current-system",
-            path_to_config
-        ]
+            current_config,
+            new_config,
+        ],
+        remote=target_host,
     )
 
 

From c1e16f898e73574891eecab69537a864fbc56ac1 Mon Sep 17 00:00:00 2001
From: Electria <117232210+Elec3137@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:12:27 -0800
Subject: [PATCH 11/60] nixos-rebuild-ng: adapt to general diff_closures

also adds a check and warning for if the current_config is missing

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../nixos-rebuild-ng/src/nixos_rebuild/services.py  | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 95ff0bede090..2a49084c6f85 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,13 +321,12 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    if args.diff and args.action in (
-        Action.SWITCH.value,
-        Action.BOOT.value,
-        Action.BUILD.value,
-        Action.TEST.value
-    ):
-        nix.diff_closures(path_to_config)
+    current_config = Path("/run/current-system")
+    if args.diff:
+        if current_config.exists():
+            nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
+        else:
+            logger.warn(f"missing '{str(current_config)}', skipping configuration diff...")
 
     _activate_system(
         path_to_config=path_to_config,

From 388d8d23cd7ccb08f6b365ca39d806c678281fe2 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 07:21:30 -0800
Subject: [PATCH 12/60] nixos-rebuild-ng: align condition for no-op warning
 with relaxed diff_closures call

---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py     | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 29e05617d60d..814d6c481c2f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -266,10 +266,16 @@ def parse_args(
         parser_warn("--no-build-nix is deprecated, we do not build nix anymore")
 
     if args.diff and args.action not in (
+        # case for calling build_and_activate_system
+        # except excluding DRY_BUILD and DRY_ACTIVATE,
+        # in which --diff is uniquely a no-op
         Action.SWITCH.value,
         Action.BOOT.value,
+        Action.TEST.value,
         Action.BUILD.value,
-        Action.TEST.value
+        Action.BUILD_IMAGE.value,
+        Action.BUILD_VM.value,
+        Action.BUILD_VM_WITH_BOOTLOADER.value,
     ):
         parser_warn(f"--diff is a no-op with '{args.action}'")
 

From 6ac558781e71c75d65c0f19f9501eebcfbcd60ba Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 08:44:51 -0800
Subject: [PATCH 13/60] nixos-rebuild-ng: print out diffed closures

---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py   | 6 ++++++
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/services.py       | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 5726853dd8ba..b42af896d3c1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,3 +1,4 @@
+import sys
 import json
 import logging
 import os
@@ -538,6 +539,11 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
         )
 
 def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
+    print(
+        f"<<< {current_config}"
+        f">>> {new_config}",
+        file=sys.stderr
+    )
     run_wrapper(
         [
             "nix",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 2a49084c6f85..ba8effa134a1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,12 +321,12 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    current_config = Path("/run/current-system")
+    current_config = Path("/run/current-system").readlink()
     if args.diff:
         if current_config.exists():
             nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
         else:
-            logger.warn(f"missing '{str(current_config)}', skipping configuration diff...")
+            logger.warning(f"missing '{str(current_config)}', skipping configuration diff...")
 
     _activate_system(
         path_to_config=path_to_config,

From e3a7e3dcf53699e8b13f7e6007f51ce736ae376e Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 09:58:19 -0800
Subject: [PATCH 14/60] nixos-rebuild-ng: fix test failures due to early
 readlink()

---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index ba8effa134a1..933c2f8de10e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,10 +321,10 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    current_config = Path("/run/current-system").readlink()
+    current_config = Path("/run/current-system")
     if args.diff:
         if current_config.exists():
-            nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
+            nix.diff_closures(current_config=current_config.readlink(), new_config=path_to_config, target_host=target_host)
         else:
             logger.warning(f"missing '{str(current_config)}', skipping configuration diff...")
 

From 5d230871220a27b8ee7c5b18d9a285c4d0789779 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 10:24:04 -0800
Subject: [PATCH 15/60] nixos-rebuild-ng: add unit test for diff_closures

---
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index c4b37bf0c32f..bcdefee20f77 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -550,6 +550,28 @@ def test_list_generations(mock_get_generations: Mock, tmp_path: Path) -> None:
     ]
 
 
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_diff_closures(mock_run: Mock) -> None:
+
+    assert n.diff_closures(
+        Path("/run/current-system"),
+        Path("/nix/var/nix/profiles/system"),
+        None
+    ) == None
+    mock_run.assert_called_with(
+        [
+            "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "store",
+            "diff-closures",
+            Path("/run/current-system"),
+            Path("/nix/var/nix/profiles/system"),
+        ],
+        remote=None
+    )
+
+
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl(mock_run: Mock) -> None:
     n.repl(m.BuildAttr("<nixpkgs/nixos>", None), {"nix_flag": True})

From 5bcffa5447893666ff2cfe8daecd412e5dbac9d6 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 11:17:31 -0800
Subject: [PATCH 16/60] nixos-rebuild-ng: fix printing

print user info (diffs) into stderr, add back missing newline
---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 3 ++-
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py    | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index b42af896d3c1..2804ea94a7b2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -540,7 +540,7 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
 
 def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
     print(
-        f"<<< {current_config}"
+        f"<<< {current_config}\n"
         f">>> {new_config}",
         file=sys.stderr
     )
@@ -554,6 +554,7 @@ def diff_closures(current_config: Path, new_config: Path, target_host: Remote |
             new_config,
         ],
         remote=target_host,
+        stdout=sys.stderr
     )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index bcdefee20f77..69d29422337a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -1,3 +1,4 @@
+import sys
 import textwrap
 import uuid
 from pathlib import Path
@@ -568,7 +569,8 @@ def test_diff_closures(mock_run: Mock) -> None:
             Path("/run/current-system"),
             Path("/nix/var/nix/profiles/system"),
         ],
-        remote=None
+        remote=None,
+        stdout=sys.stderr
     )
 
 

From 030ba3ca5fc683fda1f9db6235a6277a5a8408a7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 11 Feb 2026 21:28:16 +0000
Subject: [PATCH 17/60] strace: 6.18 -> 6.19

Changes: https://github.com/strace/strace/releases/tag/v6.19
---
 pkgs/by-name/st/strace/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 7fc77c29599a..9820ae631ab2 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "strace";
-  version = "6.18";
+  version = "6.19";
 
   src = fetchurl {
     url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz";
-    hash = "sha256-CtXcupc6aed5ZQ7xyzNbEu5gcW/HMmYJiVvTPm0qcyU=";
+    hash = "sha256-4HbIUe7AlySG7IQhZP3FRUf50Xq9PRRJ3osSD10pkUM=";
   };
 
   separateDebugInfo = true;

From 8446dfc3c92c82dbd13f39e3ede2b9be8b4890fb Mon Sep 17 00:00:00 2001
From: mlyxshi <mlyxdev@gmail.com>
Date: Wed, 11 Feb 2026 09:12:25 +0800
Subject: [PATCH 18/60] pkgs/build-support/kernel/make-initrd-ng.nix:
 unsafeDiscardReferences.out = true

---
 pkgs/build-support/kernel/make-initrd-ng.nix | 67 +++++++++++---------
 1 file changed, 36 insertions(+), 31 deletions(-)

diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index 0b1db74f0449..768af8f5c48d 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -16,7 +16,6 @@ in
   pkgsBuildHost,
   makeInitrdNGTool,
   binutils,
-  runCommand,
   # Name of the derivation (not of the resulting file!)
   name ? "initrd",
 
@@ -74,47 +73,53 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-runCommand name
-  {
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    inherit
-      extension
-      makeUInitrd
-      uInitrdArch
-      prepend
-      ;
-    ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    passAsFile = [ "contents" ];
-    contents = builtins.toJSON contents;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    nativeBuildInputs = [
-      makeInitrdNGTool
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
-  }
-  ''
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  contentsJSON = builtins.toJSON contents;
+
+  nativeBuildInputs = [
+    makeInitrdNGTool
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
+
+  buildCommand = ''
     mkdir -p ./root/{run,tmp,var/empty}
     ln -s ../run ./root/var/run
-    make-initrd-ng "$contentsPath" ./root
+    make-initrd-ng <(echo "$contentsJSON") ./root
     mkdir "$out"
     (cd root && find . -exec touch -h -d '@1' '{}' +)
-    for PREP in $prepend; do
+    for PREP in ''${prepend[@]}; do
       cat $PREP >> $out/initrd
     done
     (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
     if [ -n "$makeUInitrd" ]; then
-        mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-        # Compatibility symlink
-        ln -sf "initrd.img" "$out/initrd"
+      mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+      # Compatibility symlink
+      ln -sf "initrd.img" "$out/initrd"
     else
-        ln -s "initrd" "$out/initrd$extension"
+      ln -s "initrd" "$out/initrd$extension"
     fi
-  ''
+  '';
+
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})

From de5cb839e4774dace86c102860cdd1d8bdf2300d Mon Sep 17 00:00:00 2001
From: mlyxshi <mlyxdev@gmail.com>
Date: Thu, 12 Feb 2026 15:24:53 +0800
Subject: [PATCH 19/60] pkgs/build-support/kernel/make-initrd.nix:
 unsafeDiscardReferences.out = true

---
 pkgs/build-support/kernel/make-initrd.nix | 68 ++++++++++++-----------
 pkgs/build-support/kernel/make-initrd.sh  | 28 ++++------
 2 files changed, 47 insertions(+), 49 deletions(-)

diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix
index 6f300369aa50..364507ba8e7e 100644
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@@ -81,42 +81,44 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-stdenvNoCC.mkDerivation (
-  rec {
-    inherit
-      name
-      makeUInitrd
-      extension
-      uInitrdArch
-      prepend
-      ;
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    builder = ./make-initrd.sh;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    nativeBuildInputs = [
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  builder = ./make-initrd.sh;
 
-    # Pass the function through, for reuse in append-initrd-secrets. The
-    # function is used instead of the string, in order to support
-    # cross-compilation (append-initrd-secrets running on a different
-    # architecture than what the main initramfs is built on).
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+  nativeBuildInputs = [
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
 
-    # !!! should use XML.
-    objects = map (x: x.object) contents;
-    symlinks = map (x: x.symlink) contents;
-    suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
 
-    closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}";
-  }
-  // lib.optionalAttrs makeUInitrd {
-    uInitrdCompression = uInitrdCompression;
-  }
-)
+  # !!! should use XML.
+  objects = map (x: x.object) contents;
+  symlinks = map (x: x.symlink) contents;
+  suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+
+  closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = finalAttrs.objects; }}";
+
+  # Pass the function through, for reuse in append-initrd-secrets. The
+  # function is used instead of the string, in order to support
+  # cross-compilation (append-initrd-secrets running on a different
+  # architecture than what the main initramfs is built on).
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})
diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh
index cc67c14a6a50..f3bc977279b5 100644
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@@ -1,9 +1,5 @@
 set -o pipefail
 
-objects=($objects)
-symlinks=($symlinks)
-suffices=($suffices)
-
 mkdir root
 
 # Needed for splash_helper, which gets run before init.
@@ -12,14 +8,14 @@ mkdir root/sys
 mkdir root/proc
 
 
-for ((n = 0; n < ${#objects[*]}; n++)); do
-    object=${objects[$n]}
-    symlink=${symlinks[$n]}
-    suffix=${suffices[$n]}
-    if test "$suffix" = none; then suffix=; fi
+for ((n = 0; n < ${#objects[@]}; n++)); do
+  object=${objects[n]}
+  symlink=${symlinks[n]}
+  suffix=${suffices[n]}
+  if test "$suffix" = none; then suffix=; fi
 
-    mkdir -p $(dirname root/$symlink)
-    ln -s $object$suffix root/$symlink
+  mkdir -p $(dirname root/$symlink)
+  ln -s $object$suffix root/$symlink
 done
 
 
@@ -34,16 +30,16 @@ storePaths="$(cat $closureInfo/store-paths)"
 
 # Put the closure in a gzipped cpio archive.
 mkdir -p $out
-for PREP in $prepend; do
+for PREP in ${prepend[@]}; do
   cat $PREP >> $out/initrd
 done
 (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
 (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
 if [ -n "$makeUInitrd" ]; then
-    mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-    # Compatibility symlink
-    ln -sf "initrd.img" "$out/initrd"
+  mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+  # Compatibility symlink
+  ln -sf "initrd.img" "$out/initrd"
 else
-    ln -s "initrd" "$out/initrd$extension"
+  ln -s "initrd" "$out/initrd$extension"
 fi

From b13891782fdec1b72e1e9ab4f86fce1638f20203 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 2 Feb 2026 23:49:00 +0100
Subject: [PATCH 20/60] nixos/tests: fix luks tests to not rely on autoFormat

This was testing something very odd where we created an empty luks
volume and only created a fs inside the luks volume on first boot when
opening it. This in fact is not possible without patching systemd and
indeed it shouldn't be.

This change makes the creation of the luks volumes more "normal" by also
opening them and creating an fs inside.

This will allow us to drop systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
---
 nixos/tests/initrd-luks-empty-passphrase.nix | 5 ++---
 nixos/tests/luks.nix                         | 6 +++++-
 nixos/tests/systemd-initrd-luks-keyfile.nix  | 3 ++-
 nixos/tests/systemd-initrd-luks-password.nix | 5 ++++-
 nixos/tests/systemd-initrd-luks-tpm2.nix     | 3 ++-
 nixos/tests/systemd-initrd-luks-unl0kr.nix   | 5 ++++-
 6 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/nixos/tests/initrd-luks-empty-passphrase.nix b/nixos/tests/initrd-luks-empty-passphrase.nix
index 47215c4bc998..3a906685f0ca 100644
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@@ -19,8 +19,6 @@ in
   nodes.machine =
     { pkgs, ... }:
     {
-      imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ];
-
       virtualisation = {
         emptyDiskImages = [ 512 ];
         useBootLoader = true;
@@ -30,7 +28,6 @@ in
         # the new root device is /dev/vdb
         # an empty 512MiB drive, containing no Nix store.
         mountHostNixStore = true;
-        fileSystems."/".autoFormat = lib.mkIf systemdStage1 true;
       };
 
       boot.loader.systemd-boot.enable = true;
@@ -90,6 +87,8 @@ in
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
+    machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
     machine.succeed("sync")
     machine.crash()
diff --git a/nixos/tests/luks.nix b/nixos/tests/luks.nix
index 685643c4c9dc..7440d110ad28 100644
--- a/nixos/tests/luks.nix
+++ b/nixos/tests/luks.nix
@@ -5,7 +5,6 @@
   nodes.machine =
     { pkgs, ... }:
     {
-      imports = [ ./common/auto-format-root-device.nix ];
 
       # Use systemd-boot
       virtualisation = {
@@ -48,7 +47,12 @@
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
     # Boot from the encrypted disk
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
diff --git a/nixos/tests/systemd-initrd-luks-keyfile.nix b/nixos/tests/systemd-initrd-luks-keyfile.nix
index 3723307946dd..8b7f28947f72 100644
--- a/nixos/tests/systemd-initrd-luks-keyfile.nix
+++ b/nixos/tests/systemd-initrd-luks-keyfile.nix
@@ -38,7 +38,6 @@ in
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
       };
     };
@@ -47,6 +46,8 @@ in
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
+    machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
     # Boot from the encrypted disk
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
diff --git a/nixos/tests/systemd-initrd-luks-password.nix b/nixos/tests/systemd-initrd-luks-password.nix
index 0f7c2f51a034..4e059f514257 100644
--- a/nixos/tests/systemd-initrd-luks-password.nix
+++ b/nixos/tests/systemd-initrd-luks-password.nix
@@ -31,7 +31,6 @@
           cryptroot2.device = "/dev/vdc";
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         # test mounting device unlocked in initrd after switching root
         virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
       };
@@ -40,7 +39,11 @@
   testScript = ''
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
     machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
     machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 6cc42bbbda73..931959f05464 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -32,7 +32,6 @@
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
       };
     };
 
@@ -40,6 +39,8 @@
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
     machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
 
     # Boot from the encrypted disk
diff --git a/nixos/tests/systemd-initrd-luks-unl0kr.nix b/nixos/tests/systemd-initrd-luks-unl0kr.nix
index 875e1beb7187..f9dbce1ccdd8 100644
--- a/nixos/tests/systemd-initrd-luks-unl0kr.nix
+++ b/nixos/tests/systemd-initrd-luks-unl0kr.nix
@@ -79,9 +79,12 @@ in
     };
 
   testScript = ''
-    # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
+
     machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
     machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
     machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")

From b9f2fa1c7dc9ae378c5bff43f45fc5c3fd149ae9 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 3 Feb 2026 00:49:58 +0100
Subject: [PATCH 21/60] nixos/nixos-containers: create load bearing /usr/bin

/usr/bin is load bearing and needs to be inside a root before nspawn
will pivot to it.

This will allow us to drop systemd/0003-Fix-NixOS-containers.patch
---
 nixos/modules/virtualisation/nixos-containers.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 9f67f937c2f1..ad0121a48498 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -92,6 +92,7 @@ let
     # Declare root explicitly to avoid shellcheck warnings, it comes from the env
     declare root
 
+    mkdir -p "$root/usr/bin"
     mkdir -p "$root/etc" "$root/var/lib"
     chmod 0755 "$root/etc" "$root/var/lib"
     mkdir -p "$root/var/lib/private" "$root/root" /run/nixos-containers

From 4aae99b7d791c4db7a7db534cba10714054c5fdc Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Thu, 5 Feb 2026 01:45:10 +0100
Subject: [PATCH 22/60] nixos-init: init env-generator

The env generator allows us to declaratively set environment variables
via the module system for all systemd generators.

This will allow us to drop systemd/0013-inherit-systemd-environment-when-calling-generators.patch
---
 .../modules/services/networking/ssh/sshd.nix  |  2 +
 nixos/modules/system/boot/systemd.nix         | 49 ++++++++++++++---
 nixos/tests/systemd-ssh-proxy.nix             |  5 ++
 pkgs/by-name/ni/nixos-init/package.nix        |  1 +
 .../ni/nixos-init/src/env_generator.rs        | 53 +++++++++++++++++++
 pkgs/by-name/ni/nixos-init/src/lib.rs         |  2 +
 pkgs/by-name/ni/nixos-init/src/main.rs        |  3 +-
 7 files changed, 108 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/by-name/ni/nixos-init/src/env_generator.rs

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index c289d1961205..b87e5ccad65f 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -742,6 +742,8 @@ in
       };
 
       systemd = {
+        generatorPath = [ cfg.package ];
+
         sockets.sshd = lib.mkIf cfg.startWhenNeeded {
           description = "SSH Socket";
           wantedBy = [ "sockets.target" ];
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2d81b1bb3d44..9a187e86d76b 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -233,6 +233,8 @@ let
 
   proxy_env = config.networking.proxy.envVars;
 
+  json = pkgs.formats.json { };
+
 in
 
 {
@@ -356,6 +358,30 @@ in
       '';
     };
 
+    generatorEnvironment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        MY_VAR = "my-value";
+      };
+      description = ''
+        Environment variables for systemd generators.
+
+        The `PATH` environment variable is populated via `systemd.generatorPath`.
+      '';
+    };
+
+    generatorPath = mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      example = [
+        pkgs.hello
+      ];
+      description = ''
+        Packages added to the `PATH` environment variable of all systemd generators.
+      '';
+    };
+
     shutdown = mkOption {
       type = types.attrsOf types.path;
       default = { };
@@ -636,6 +662,12 @@ in
         "systemd/user-preset/00-nixos.preset".text = ''
           ignore *
         '';
+
+        "systemd/generator-environment.json".source =
+          json.generate "systemd-generator-environment.json" cfg.generatorEnvironment;
+
+        "systemd/system-environment-generators/env-generator".source =
+          "${config.system.nixos-init.package}/bin/env-generator";
       };
 
     services.dbus.enable = true;
@@ -683,12 +715,7 @@ in
     systemd.managerEnvironment = {
       # Doesn't contain systemd itself - everything works so it seems to use the compiled-in value for its tools
       # util-linux is needed for the main fsck utility wrapping the fs-specific ones
-      PATH = lib.makeBinPath (
-        config.system.fsPackages
-        ++ [ cfg.package.util-linux ]
-        # systemd-ssh-generator needs sshd in PATH
-        ++ lib.optional config.services.openssh.enable config.services.openssh.package
-      );
+      PATH = lib.makeBinPath (config.system.fsPackages ++ [ cfg.package.util-linux ]);
       LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
       TZDIR = "/etc/zoneinfo";
       # If SYSTEMD_UNIT_PATH ends with an empty component (":"), the usual unit load path will be appended to the contents of the variable
@@ -704,6 +731,16 @@ in
       DefaultIPAccounting = lib.mkDefault true;
     };
 
+    # These are needed for systemd-fstab-generator to schedule systemd-fsck@
+    # units.
+    systemd.generatorPath = config.system.fsPackages ++ [
+      cfg.package.util-linux
+    ];
+
+    systemd.generatorEnvironment = {
+      PATH = lib.makeBinPath cfg.generatorPath;
+    };
+
     system.requiredKernelConfig = map config.lib.kernelConfig.isEnabled [
       "DEVTMPFS"
       "CGROUPS"
diff --git a/nixos/tests/systemd-ssh-proxy.nix b/nixos/tests/systemd-ssh-proxy.nix
index 6ccdc0012b4f..38ae79ba9c1c 100644
--- a/nixos/tests/systemd-ssh-proxy.nix
+++ b/nixos/tests/systemd-ssh-proxy.nix
@@ -19,6 +19,7 @@ in
 
   nodes = {
     virthost = {
+      environment.systemPackages = [ pkgs.jq ];
       services.openssh = {
         enable = true;
         settings.PermitRootLogin = "prohibit-password";
@@ -48,6 +49,10 @@ in
     virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519")
     virthost.succeed("chmod 600 ~/.ssh/id_ed25519")
 
+    with subtest("Check the environment generator"):
+      print(virthost.succeed("jq '.' /etc/systemd/generator-environment.json"))
+      print(virthost.succeed("/etc/systemd/system-environment-generators/env-generator"))
+
     with subtest("ssh into a container with AF_UNIX"):
       virthost.wait_for_unit("container@guest.service")
       virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 unix/run/systemd/nspawn/unix-export/guest/ssh echo meow | grep meow")
diff --git a/pkgs/by-name/ni/nixos-init/package.nix b/pkgs/by-name/ni/nixos-init/package.nix
index 0e4c26cb2dd3..c84c711c7599 100644
--- a/pkgs/by-name/ni/nixos-init/package.nix
+++ b/pkgs/by-name/ni/nixos-init/package.nix
@@ -48,6 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "initrd-init"
     "find-etc"
     "resolve-in-root"
+    "env-generator"
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ni/nixos-init/src/env_generator.rs b/pkgs/by-name/ni/nixos-init/src/env_generator.rs
new file mode 100644
index 000000000000..69995b601e59
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-init/src/env_generator.rs
@@ -0,0 +1,53 @@
+use std::{
+    collections::HashMap,
+    fs,
+    io::{self, Write},
+};
+
+use anyhow::{Context, Result};
+use serde::Deserialize;
+
+const CONFIG_PATH: &str = "/etc/systemd/generator-environment.json";
+const KMSG_PATH: &str = "/dev/kmsg";
+
+#[derive(Deserialize)]
+struct Config(HashMap<String, String>);
+
+/// Implementation for the entrypoint of the `env-generator` binary.
+///
+/// Reads the JSON config for the systemd generator environment and prints it in KEY=VALUE format
+/// to stdout. This makes the configured environment variables available for all systemd
+/// generators.
+fn env_generator_impl() -> Result<()> {
+    let content = fs::read(CONFIG_PATH).with_context(|| format!("Failed to read {CONFIG_PATH}"))?;
+    let config: Config = serde_json::from_slice(&content).context("Failed to parse config")?;
+
+    let mut buffer = Vec::new();
+    for (key, value) in config.0 {
+        writeln!(&mut buffer, "{key}=\"{value}\"").context("Failed to write to buffer")?;
+    }
+
+    let stdout = io::stdout();
+    let mut locked = stdout.lock();
+    locked
+        .write_all(&buffer)
+        .context("Failed to write to stdout")?;
+
+    Ok(())
+}
+
+/// Entrypoint for the `env-generator` binary.
+///
+/// Generators cannot use normal logging but have to write to /dev/kmsg.
+///
+/// The return value is just here so that we can use the `main.rs` entrypoint for this binary.
+/// Errors returned from this function will not be logged and thus are meaningless.
+pub fn env_generator() -> Result<()> {
+    if let Err(err) = env_generator_impl() {
+        // Sometimes we do not have /dev/kmsg, e.g. inside a container
+        if let Ok(mut kmsg) = fs::OpenOptions::new().write(true).open(KMSG_PATH) {
+            let _ = write!(kmsg, "<3>env-generator: {err:#}");
+        }
+    }
+    Ok(())
+}
diff --git a/pkgs/by-name/ni/nixos-init/src/lib.rs b/pkgs/by-name/ni/nixos-init/src/lib.rs
index 2ee90c6f8228..e9a716724051 100644
--- a/pkgs/by-name/ni/nixos-init/src/lib.rs
+++ b/pkgs/by-name/ni/nixos-init/src/lib.rs
@@ -1,5 +1,6 @@
 mod activate;
 mod config;
+mod env_generator;
 mod find_etc;
 mod fs;
 mod init;
@@ -14,6 +15,7 @@ use anyhow::{Context, Result, bail};
 
 pub use crate::{
     activate::activate,
+    env_generator::env_generator,
     find_etc::find_etc,
     init::init,
     initrd_init::initrd_init,
diff --git a/pkgs/by-name/ni/nixos-init/src/main.rs b/pkgs/by-name/ni/nixos-init/src/main.rs
index a051af590be3..4f74415b8d36 100644
--- a/pkgs/by-name/ni/nixos-init/src/main.rs
+++ b/pkgs/by-name/ni/nixos-init/src/main.rs
@@ -2,7 +2,7 @@ use std::{env, io::Write, process::ExitCode};
 
 use log::Level;
 
-use nixos_init::{find_etc, initrd_init, resolve_in_root};
+use nixos_init::{env_generator, find_etc, initrd_init, resolve_in_root};
 
 fn main() -> ExitCode {
     let arg0 = env::args()
@@ -15,6 +15,7 @@ fn main() -> ExitCode {
         "find-etc" => find_etc,
         "resolve-in-root" => resolve_in_root,
         "initrd-init" => initrd_init,
+        "env-generator" => env_generator,
         _ => {
             log::error!("Command {arg0} unknown");
             return ExitCode::FAILURE;

From e02832a96171fa8d76f3bbc4a15350f00d893191 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 13 Feb 2026 06:49:36 +0000
Subject: [PATCH 23/60] crc: 2.57.0 -> 2.58.0

---
 pkgs/by-name/cr/crc/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/cr/crc/package.nix b/pkgs/by-name/cr/crc/package.nix
index 7227629645d0..425afb4db9f3 100644
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -8,16 +8,16 @@
 }:
 
 let
-  openShiftVersion = "4.20.5";
+  openShiftVersion = "4.21.0";
   okdVersion = "4.20.0-okd-scos.11";
-  microshiftVersion = "4.20.0";
+  microshiftVersion = "4.21.0";
   writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "ae41f68e34a463bfb6a72dc06c51f2b809c99724";
-  gitHash = "sha256-O8O3O+RoBieOdsAqLAomZ2lPIHEta6j2yhNOfXwtrVA=";
+  gitCommit = "275f36851d44a1dba8407f960f763b546ba8fc32";
+  gitHash = "sha256-M622rTWsz35EVmMm/EyIAYbRFFBvpXYjcNp4HrcFl3o=";
 in
 buildGoModule (finalAttrs: {
   pname = "crc";
-  version = "2.57.0";
+  version = "2.58.0";
 
   src = fetchFromGitHub {
     owner = "crc-org";

From 21f7ea4ed2b9916ddecc8bbd167d5ee9edf59087 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 13 Feb 2026 12:03:42 +0100
Subject: [PATCH 24/60] ruff: 0.15.0 -> 0.15.1

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.1
Diff: https://github.com/astral-sh/ruff/compare/0.15.0...0.15.1
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index d4f1aca0b200..70a260c75721 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Q3xujVNv5i3mgdsjnvgTiPoKmK9aeSgz+2IoVrNur4k=";
+    hash = "sha256-Bj4ATRVYrKqigISNiDvgjUw4MLMwfgdID8MqaiVxz0g=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-JMMDOANg+nqrCoxiuIXTcdqm7UZ61pIJwUTJB20TjUM=";
+  cargoHash = "sha256-IF60aGv56Kh+wDYyN7XzLBywepvAxv2HMqSOz+Su2b4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From c7e66d558d185948dde22baaed12f31d55978396 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 13 Feb 2026 21:30:48 +0000
Subject: [PATCH 25/60] qemu: 10.2.0 -> 10.2.1

---
 .../virtualization/qemu/default.nix           | 48 +------------------
 1 file changed, 2 insertions(+), 46 deletions(-)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 9fd672be28de..eab01e012993 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -136,11 +136,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.2.0";
+  version = "10.2.1";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-njCtG4ufe0RjABWC0aspfznPzOpdCFQMDKbWZyeFiDo=";
+    hash = "sha256-o3F0d9jiyE1jC//7wg9s0yk+tFqh5trG0MwnaJmRyeE=";
   };
 
   depsBuildBuild = [
@@ -267,50 +267,6 @@ stdenv.mkDerivation (finalAttrs: {
       sha256 = "sha256-oC+bRjEHixv1QEFO9XAm4HHOwoiT+NkhknKGPydnZ5E=";
       revert = true;
     })
-
-    # Implement termios2 (TCGETS2 etc) for glibc 2.42 compatibility. Should be in the next release.
-    # https://gitlab.com/qemu-project/qemu/-/issues/3065
-    # https://lore.kernel.org/qemu-devel/20260103153239.15787-1-dilfridge@gentoo.org/t/#u
-    (fetchpatch {
-      name = "0001-Add-termios2-support-to-linux-user.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/e9a8a10e84c1bf6e2e8be000e4dd5c83ba0d8470.patch";
-      hash = "sha256-Zc+ZjiSug3uT/F7+mmoYc2VXqw2MV6UubYqB+pr2dNY=";
-    })
-    (fetchpatch {
-      name = "0002-Add-termios2-support-to-alpha-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/8d8c6aeee8599a099e49ec4411f3d1e087ae40ad.patch";
-      hash = "sha256-5e5vUp9nr96ZmVA98W/ETReLbkofayysJXlx1Ck9gDs=";
-    })
-    (fetchpatch {
-      name = "0003-Add-termios2-support-to-hppa-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/edc741710acedd61011f937967b960d154794258.patch";
-      hash = "sha256-nls6eTOB06eqACjQ/r1sQvb9YaYmrpJcegsDGqKAOaI=";
-    })
-    (fetchpatch {
-      name = "0004-Add-termios2-support-to-mips-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/edf9184f4feb691b0f70dc544443db2380891598.patch";
-      hash = "sha256-GrBhyMq2QiCc+WlUwaB9j4G8vB3ipxJRV5Hvyab/5Fk=";
-    })
-    (fetchpatch {
-      name = "0005-Add-termios2-support-to-sh4-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/afbe0ff81c29d674b9c18a588bcaab34ddcb8a7b.patch";
-      hash = "sha256-h+9eC6H8/GJ85Lt1Y0ggdJbbgTIvDfIJkPQfX/FgO4c=";
-    })
-    (fetchpatch {
-      name = "0006-Add-termios2-support-to-sparc-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/947b971cad90375040f399899909a3f1f32b483f.patch";
-      hash = "sha256-/JvF25aSR2mBSvkpqupDySMJYZI+lv7L0YwhqiaDk3A=";
-    })
-    (fetchpatch {
-      name = "0007-linux-user-Add-missing-termios-baud-rates.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/4f22fcb5c67f40a36e6654f6cfaee23f9f9e93d1.patch";
-      hash = "sha256-CM81yL0/i+fmQe8qzemre13N3A74J1HIC7ilCbb7ESQ=";
-    })
-    (fetchpatch {
-      name = "0008-linux-user-fixup-termios2-related-things-on-PowerPC.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/d68f0e2e906939bef076d0cd52f902d433c8c3da.patch";
-      hash = "sha256-vF47CKqg0wBBOUkHeJ3hv3nUHCftl2OwD3Nh0dL1PNk=";
-    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 

From e6f66c57b3f9bf49fde3a92300d82f33b8f4bdfd Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sat, 14 Feb 2026 13:05:59 +0100
Subject: [PATCH 26/60] readest: 0.9.99 -> 0.9.100

Changelog: https://github.com/readest/readest/releases/tag/v0.9.100
Diff: https://github.com/readest/readest/compare/v0.9.99...v0.9.100
---
 pkgs/by-name/re/readest/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 49fad64f67e9..d443c523d059 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -25,13 +25,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.99";
+  version = "0.9.100";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fcil35siaGrooW8+R2WrZaR5qHPJXIYOU/Au1YKlb2M=";
+    hash = "sha256-GsIOMfNqjcdtVRZ0XwCkxpQoIonivLJVT4GmZyB86M0=";
     fetchSubmodules = true;
   };
 

From 3682e90ba2f98b39808ce6bba4c4038d588834dd Mon Sep 17 00:00:00 2001
From: Daniel Kilimnik <daniel@neodyme.io>
Date: Sat, 14 Feb 2026 20:04:20 +0100
Subject: [PATCH 27/60] arduino-create-agent: exclude design package

---
 pkgs/by-name/ar/arduino-create-agent/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/ar/arduino-create-agent/package.nix b/pkgs/by-name/ar/arduino-create-agent/package.nix
index 4b5883ffc5d6..e491c267835e 100644
--- a/pkgs/by-name/ar/arduino-create-agent/package.nix
+++ b/pkgs/by-name/ar/arduino-create-agent/package.nix
@@ -21,6 +21,10 @@ buildGo124Module rec {
     ./updater.patch
   ];
 
+  excludedPackages = [
+    "design"
+  ];
+
   vendorHash = "sha256-Nrw7l3nV1sMVWs1HECQJYohKiD0gPvWQOLD7eohEd1A=";
 
   ldflags = [

From cb36ad466903390c4b4b7923b6dad35b37a141d4 Mon Sep 17 00:00:00 2001
From: Daniel Kilimnik <daniel@neodyme.io>
Date: Sat, 14 Feb 2026 20:04:54 +0100
Subject: [PATCH 28/60] arduino-create-agent: use buildGoModule

---
 pkgs/by-name/ar/arduino-create-agent/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/arduino-create-agent/package.nix b/pkgs/by-name/ar/arduino-create-agent/package.nix
index e491c267835e..b0ead0ca3d5e 100644
--- a/pkgs/by-name/ar/arduino-create-agent/package.nix
+++ b/pkgs/by-name/ar/arduino-create-agent/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  buildGo124Module,
+  buildGoModule,
   fetchFromGitHub,
   go-task,
 }:
 
-buildGo124Module rec {
+buildGoModule rec {
   pname = "arduino-create-agent";
   version = "1.7.0";
 

From 8f6fe57c65b436cb143fb3c693e5526019ecc0ed Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 15:34:00 +0000
Subject: [PATCH 29/60] scalafmt: 3.10.6 -> 3.10.7

---
 pkgs/by-name/sc/scalafmt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sc/scalafmt/package.nix b/pkgs/by-name/sc/scalafmt/package.nix
index 146899b37255..5171aa58a73e 100644
--- a/pkgs/by-name/sc/scalafmt/package.nix
+++ b/pkgs/by-name/sc/scalafmt/package.nix
@@ -9,7 +9,7 @@
 
 let
   baseName = "scalafmt";
-  version = "3.10.6";
+  version = "3.10.7";
   deps = stdenv.mkDerivation {
     name = "${baseName}-deps-${version}";
     buildCommand = ''
@@ -19,7 +19,7 @@ let
       cp $(< deps) $out/share/java/
     '';
     outputHashMode = "recursive";
-    outputHash = "sha256-ZSVatzkY+6oiVL4MPf3oyFZiTYaXQ0PNfYvS3O/kU+A=";
+    outputHash = "sha256-egN5P6jH/xvWm/5TXE/QyIyLdJqu8YQwkfIA40geRXs=";
   };
 in
 stdenv.mkDerivation {

From 6161a2eedb8607df74101d4901ca6bf2887c634d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 16:42:45 +0000
Subject: [PATCH 30/60] rime-wanxiang: 14.6.10 -> 14.7.0

---
 pkgs/by-name/ri/rime-wanxiang/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ri/rime-wanxiang/package.nix b/pkgs/by-name/ri/rime-wanxiang/package.nix
index 35329e4bc680..83edc8289ba8 100644
--- a/pkgs/by-name/ri/rime-wanxiang/package.nix
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "14.6.10";
+  version = "14.7.0";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime_wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-GpR5G1vLExRIFcHYMgjmvO/6ZZrFr8EbWtaQIBrveA0=";
+    hash = "sha256-c4Wx0TJPNTMN6wqJCc9Nk76rc/0Tul/Hu6Kj8cZ75BI=";
   };
 
   installPhase = ''

From 91ebb9828e37d342b6af7ce7741ba99dcaeb86de Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 17:10:15 +0000
Subject: [PATCH 31/60] andi: 0.14 -> 1.15

---
 pkgs/by-name/an/andi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/an/andi/package.nix b/pkgs/by-name/an/andi/package.nix
index 17b89a5b4d6f..bd93f7411450 100644
--- a/pkgs/by-name/an/andi/package.nix
+++ b/pkgs/by-name/an/andi/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "andi";
-  version = "0.14";
+  version = "1.15";
 
   src = fetchFromGitHub {
     owner = "evolbioinf";
     repo = "andi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tjQ9exFyqu/xnbUGpF6k0kE5C1D93kISjRErwHfjW9E=";
+    hash = "sha256-199CjhOdC0BnNyhhTSn/DWmqn/0vSziV+aW2shE1Vuo=";
   };
 
   nativeBuildInputs = [

From e176f25e6c0dae778e3f52ee7ba3f18759071d16 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sun, 15 Feb 2026 18:13:04 +0100
Subject: [PATCH 32/60] haskell.compiler.ghc9123: apply patch for incorrect
 subword division
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a simple revert, so easy to apply. Unfortunately, it seems
like it'll be some time until 9.12.4 is released…

Debian and Fedora seem to have opted for patching this issue, too.
---
 pkgs/development/compilers/ghc/common-hadrian.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index 669e4841618a..a9ed3e75e7ea 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -291,6 +291,14 @@
               hash = "sha256-Vr5wkiSE1S5e+cJ8pWUvG9KFpxtmvQ8wAy08ElGNp5E=";
             })
           ]
+      # Fix subword division regression in 9.12.3 https://gitlab.haskell.org/ghc/ghc/-/merge_requests/15264
+      ++ lib.optionals (version == "9.12.3") [
+        (fetchpatch {
+          name = "ghc-9.12.3-fix-subword-division.patch";
+          url = "https://gitlab.haskell.org/ghc/ghc/-/commit/65370007e2d9f1976fbcfbb514917fb111117148.patch";
+          hash = "sha256-GMnD0StBTRynl2Lels1L0u1bo7HscLGPUAv+rTJ98QQ=";
+        })
+      ]
       # Fixes stack overrun in rts which crashes an process whenever
       # freeHaskellFunPtr is called with nixpkgs' hardening flags.
       # https://gitlab.haskell.org/ghc/ghc/-/issues/25485 krank:ignore-line

From 41118bea901607bdf97fcf31ae81f085320ca8a4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 18:02:36 +0000
Subject: [PATCH 33/60] lakectl: 1.65.2 -> 1.77.0

---
 pkgs/by-name/la/lakectl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lakectl/package.nix b/pkgs/by-name/la/lakectl/package.nix
index 63d31dc98fc4..9b3e6a8aee35 100644
--- a/pkgs/by-name/la/lakectl/package.nix
+++ b/pkgs/by-name/la/lakectl/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "lakectl";
-  version = "1.65.2";
+  version = "1.77.0";
 
   src = fetchFromGitHub {
     owner = "treeverse";
     repo = "lakeFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X7cjNa9PQFUuvCN8/i8p9kqsvHqc3IGFWL++Mj0KdfY=";
+    hash = "sha256-PGOCDWyocj91po7vL6IOwUGNzWERv0rwEAYp6LK2E30=";
   };
 
   subPackages = [ "cmd/lakectl" ];
   proxyVendor = true;
-  vendorHash = "sha256-JEAVAXWscq/u+ABvYThlWkpaVRQd2e2gtmYoLDjVx/s=";
+  vendorHash = "sha256-a37Cv7Wcf74hscMxVvZ7g6zZgBTqz/0wmSNamExM/Tc=";
 
   ldflags = [
     "-s"

From b7b202fd1c16bf2cb1f7a5f7391d3c5cd8b9934e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 19:27:22 +0000
Subject: [PATCH 34/60] nono: 0.4.1 -> 0.5.0

---
 pkgs/by-name/no/nono/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index eb95be89a79b..6d626bfe9e95 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "always-further";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-siZK9ELU5RsX2Dc1T8LpOFNVR0Qo3xJ2LfIrqb6abSk=";
+    hash = "sha256-32PiM84dwZ3dPIAIak1DL3iencguXCzehFCDsulDyhI=";
   };
 
-  cargoHash = "sha256-3xuZMXX9YTHY4HsFuOdzbykqOVH/PWuFyLhPbl7baqY=";
+  cargoHash = "sha256-nE0vVBThXnqo8VnFCkOyqhpZZ40MIkXSqUoJUZcDVhE=";
 
   nativeBuildInputs = [
     pkg-config

From 817bf92e737499b08e89c0ade17b65ba185510bc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 20:06:47 +0000
Subject: [PATCH 35/60] yq-go: 4.52.2 -> 4.52.4

---
 pkgs/by-name/yq/yq-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/yq/yq-go/package.nix b/pkgs/by-name/yq/yq-go/package.nix
index e0536634d4de..d5384dcabb48 100644
--- a/pkgs/by-name/yq/yq-go/package.nix
+++ b/pkgs/by-name/yq/yq-go/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "yq-go";
-  version = "4.52.2";
+  version = "4.52.4";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AWWSuMrAwv+J8PK/VXyYDwJGSdv2F0/pvNRouK4slM0=";
+    hash = "sha256-vbvqjcov0ceFeQ81tIaXHbAFjrJ2dCkRfkw/MA0qCr4=";
   };
 
-  vendorHash = "sha256-rl7AhOJKjVRyfcu7uofniSYJMjBkaO+kCqLRmz2MsiE=";
+  vendorHash = "sha256-WQDuMVBlmomxdaMQ/nVNki8o++dPdwDSj6jQqbsQNQw=";
 
   nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     installShellFiles

From b39d126c75cdb7ac7141acf68be3f75fdb3130a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 21:44:57 +0000
Subject: [PATCH 36/60] azure-cli-extensions.containerapp: 1.3.0b1 -> 1.3.0b2

---
 pkgs/by-name/az/azure-cli/extensions-manual.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index faaf8d7ee14a..d1d7010b021f 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -213,9 +213,9 @@
 
   containerapp = mkAzExtension rec {
     pname = "containerapp";
-    version = "1.3.0b1";
+    version = "1.3.0b2";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
-    hash = "sha256-gEFo2qBqQ19SSIMx1BWPoc19xv7lCUkuZMSUz9qPqrE=";
+    hash = "sha256-Br/cfKFTkqcjGRCXAbHqfwTe4g49F3zbj/tzp/O+giI=";
     description = "Microsoft Azure Command-Line Tools Containerapp Extension";
     propagatedBuildInputs = with python3Packages; [
       docker

From 9577d06a6ad3287a0a555e3bba2c3b7bf4bf0e4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 23:39:51 +0000
Subject: [PATCH 37/60] python3Packages.specfile: 0.39.0 -> 0.39.1

---
 pkgs/development/python-modules/specfile/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/specfile/default.nix b/pkgs/development/python-modules/specfile/default.nix
index 552cefcc5f11..9c9c349f9d2d 100644
--- a/pkgs/development/python-modules/specfile/default.nix
+++ b/pkgs/development/python-modules/specfile/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "specfile";
-  version = "0.39.0";
+  version = "0.39.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
       # export-subst prevents reproducibility
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-apGGUVBFNRknQvyBCVZerw0/MctWDTDcz4y/7tRp46s=";
+    hash = "sha256-z9HGnBLdtJ4uzm1DJFD0QN/DZNTdBbZcPx/kefCYnkc=";
   };
 
   build-system = [

From b22b6e573ef40766c2bf2d891618881123422a28 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart.oos.2006@gmail.com>
Date: Sun, 15 Feb 2026 22:15:52 +0100
Subject: [PATCH 38/60] matrix-continuwuity: 0.5.4 -> 0.5.5

---
 pkgs/by-name/ma/matrix-continuwuity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix
index b690feadbf80..2f4802e8ecc7 100644
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -72,17 +72,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-continuwuity";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitea {
     domain = "forgejo.ellis.link";
     owner = "continuwuation";
     repo = "continuwuity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E2BJh0ynzUm3gHJXM0qKIgTyEEMD02PG+uPPdr/MKaQ=";
+    hash = "sha256-mEdhnyzuW2fTP/dBpJE6EnvTH2fbQXOOwZgjJ1trQmU=";
   };
 
-  cargoHash = "sha256-yPQxEZwMQv7HqlQzQxwGrUzZOL21cfNymkNdkOA4GIk=";
+  cargoHash = "sha256-giG4SZNh7uV7PIeHv0npfkgYi6lWn55YktKHOF7HGyM=";
 
   nativeBuildInputs = [
     pkg-config

From 1c2761e1dec8f02be1b64c3237511265824def3a Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart.oos.2006@gmail.com>
Date: Sun, 15 Feb 2026 23:24:48 +0100
Subject: [PATCH 39/60] nixos/tests/matrix-continuwuity: adapt to new oobe

The new out-of-box experience in continuwuity is such that you have to either
create a first (admin) user manually using `conduit --execute "users create
<name>"`, or using the temporary registration token that appears in the logs.
This needs to happen regardless of whether the server is open to registration
or if there is a pre-shared registration token. This commit makes it so that
the initial `alice` user is created in advance by the server itself. This
does not influence the quality of the nixos test in my opinion.
---
 nixos/tests/matrix/continuwuity.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/nixos/tests/matrix/continuwuity.nix b/nixos/tests/matrix/continuwuity.nix
index 308560421c79..cf07293b1ab0 100644
--- a/nixos/tests/matrix/continuwuity.nix
+++ b/nixos/tests/matrix/continuwuity.nix
@@ -1,6 +1,8 @@
 { lib, ... }:
 let
   name = "continuwuity";
+  user = "alice";
+  pass = "my-secret-password";
 in
 {
   inherit name;
@@ -12,8 +14,7 @@ in
         settings.global = {
           server_name = name;
           address = [ "0.0.0.0" ];
-          allow_registration = true;
-          yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true;
+          admin_execute = [ "users create ${user} ${pass}" ];
         };
         extraEnvironment.RUST_BACKTRACE = "yes";
       };
@@ -30,13 +31,10 @@ in
 
             async def main() -> None:
                 # Connect to continuwuity
-                client = nio.AsyncClient("http://continuwuity:6167", "alice")
-
-                # Register as user alice
-                response = await client.register("alice", "my-secret-password")
+                client = nio.AsyncClient("http://continuwuity:6167", "${user}")
 
                 # Log in as user alice
-                response = await client.login("my-secret-password")
+                response = await client.login("${pass}")
 
                 # Create a new room
                 response = await client.room_create(federate=False)

From 70e47bf41d95e35535d9898762b6d6353a4d04d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 00:49:45 +0000
Subject: [PATCH 40/60] chisel: 1.11.3 -> 1.11.4

---
 pkgs/by-name/ch/chisel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chisel/package.nix b/pkgs/by-name/ch/chisel/package.nix
index c63f18893e83..09063825acfe 100644
--- a/pkgs/by-name/ch/chisel/package.nix
+++ b/pkgs/by-name/ch/chisel/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chisel";
-  version = "1.11.3";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "jpillora";
     repo = "chisel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JrDRcp0gImG/5b/BC0KWM2IqJrS2mzO+ZX6kbTtQYlM=";
+    hash = "sha256-g0UjjzH22ri/tYMO8HDQ6zjis9z6ojRsQJIP5AGhjfM=";
   };
 
-  vendorHash = "sha256-2H+YHqYE1xm+7qDG3jfFpwS9FbYkbwJ6uso2At2BZcU=";
+  vendorHash = "sha256-hqHd+62csVjHY2oAvi5fwlI0LbjR/LSDg6b1SMwe8Fw=";
 
   ldflags = [
     "-s"

From 53c1086d69596d4f92432a0d574963cca9170266 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 02:04:45 +0000
Subject: [PATCH 41/60] postgresqlPackages.plpgsql_check: 2.8.8 -> 2.8.9

---
 pkgs/servers/sql/postgresql/ext/plpgsql_check.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index 7956c320c7e1..d2bf68e9f0ed 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "plpgsql-check";
-  version = "2.8.8";
+  version = "2.8.9";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jAcQ5gUWjyw4A+pJWKf06EayY/UKeSzlNmnTD4mV/c4=";
+    hash = "sha256-SqL+Rw1ICeTj2b5bfW+awOf0Kk4SrsvfC6HF6XNe6+I=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {

From 57591f48791a57092eee7249cc7136b82a2d2ed4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 02:26:52 +0000
Subject: [PATCH 42/60] codecrafters-cli: 46 -> 47

---
 pkgs/by-name/co/codecrafters-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/codecrafters-cli/package.nix b/pkgs/by-name/co/codecrafters-cli/package.nix
index e4c86534c8cb..0eb54e7caa12 100644
--- a/pkgs/by-name/co/codecrafters-cli/package.nix
+++ b/pkgs/by-name/co/codecrafters-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "codecrafters-cli";
-  version = "46";
+  version = "47";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XG85j9iay0+bQIoUeCrvO+rCch9ONXRAtoXjXI2Rt9s=";
+    hash = "sha256-X0pQouy/XHZMkPwBab2FsjjPhLrWIRglMJOTl/hzkcI=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed

From dcdc7f713968cd945f5b91b3f24f32387d350416 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 03:03:10 +0000
Subject: [PATCH 43/60] usage: 2.11.0 -> 2.16.2

---
 pkgs/by-name/us/usage/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/us/usage/package.nix b/pkgs/by-name/us/usage/package.nix
index 16ec3b452c15..97dc70aff4e4 100644
--- a/pkgs/by-name/us/usage/package.nix
+++ b/pkgs/by-name/us/usage/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usage";
-  version = "2.11.0";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "usage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AFfI843y1fKdw2f4alz7WoeMQR2IPWDJ3SofCCMJVpQ=";
+    hash = "sha256-1vcJKCtDZtbL0cRAEQ6MgWlESRpOchi6uYMyZi0U9zM=";
   };
 
-  cargoHash = "sha256-WC/q9yd1XJT/EtC9ES5fw6j45gyRo3k2eNEDwGmvDWo=";
+  cargoHash = "sha256-rhx09WclXiZtPGsmBCG9ShfWgo7YFKFSPHQpqy9wbtE=";
 
   postPatch = ''
     substituteInPlace ./examples/*.sh \

From c9d6c5c58281b09ac8fceffe7d936e23fc01ef5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ila=C3=AF=20Deutel?= <root@ilai.dev>
Date: Sun, 15 Feb 2026 22:16:55 -0500
Subject: [PATCH 44/60] maintainers: add ilai-deutel

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 31bec03afab1..6ec59e132d3f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11111,6 +11111,12 @@
     githubId = 7481521;
     name = "Balázs Lengyel";
   };
+  ilai-deutel = {
+    github = "ilai-deutel";
+    githubId = 10098207;
+    name = "Ilaï Deutel";
+    keys = [ { fingerprint = "1025 8841 8FF7 E165 6964  90A2 06E8 A973 4948 08A2"; } ];
+  };
   ilarvne = {
     email = "ilarvne@proton.me";
     github = "ilarvne";

From adb9e0461d704c4b264d9e2cb7dfdc7d3302f3b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ila=C3=AF=20Deutel?= <root@ilai.dev>
Date: Sun, 15 Feb 2026 22:23:49 -0500
Subject: [PATCH 45/60] vscode-extensions.jjk.jjk: init at 0.8.1

---
 .../editors/vscode/extensions/default.nix     |  2 ++
 .../vscode/extensions/jjk.jjk/default.nix     | 21 +++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/applications/editors/vscode/extensions/jjk.jjk/default.nix

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c809930bc583..7dedbb0b9259 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2516,6 +2516,8 @@ let
         };
       };
 
+      jjk.jjk = callPackage ./jjk.jjk { };
+
       jkillian.custom-local-formatters = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "jkillian";
diff --git a/pkgs/applications/editors/vscode/extensions/jjk.jjk/default.nix b/pkgs/applications/editors/vscode/extensions/jjk.jjk/default.nix
new file mode 100644
index 000000000000..dbd036dd9661
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/jjk.jjk/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "jjk";
+    publisher = "jjk";
+    version = "0.8.1";
+    hash = "sha256-2JUn6wkWgZKZzhitQy6v9R/rCNLrt7DBtt59707hp6c=";
+  };
+  meta = {
+    changelog = "https://github.com/keanemind/jjk/releases";
+    description = "Visual Studio Code extension for the Jujutsu (jj) version control system";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=jjk.jjk";
+    homepage = "https://github.com/keanemind/jjk";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ilai-deutel ];
+  };
+}

From 4a66d892ba559a06dac5b728be3796d551d6740a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ila=C3=AF=20Deutel?= <root@ilai.dev>
Date: Sun, 15 Feb 2026 22:27:40 -0500
Subject: [PATCH 46/60] vscode-extensions.claui.packaging: init at 0.2.5

---
 .../extensions/claui.packaging/default.nix    | 21 +++++++++++++++++++
 .../editors/vscode/extensions/default.nix     |  2 ++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/applications/editors/vscode/extensions/claui.packaging/default.nix

diff --git a/pkgs/applications/editors/vscode/extensions/claui.packaging/default.nix b/pkgs/applications/editors/vscode/extensions/claui.packaging/default.nix
new file mode 100644
index 000000000000..59e593f824a4
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/claui.packaging/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "packaging";
+    publisher = "claui";
+    version = "0.2.5";
+    hash = "sha256-WGs00Q1oa8Nz9dpKn3iZSjrhR0VKUwJWPGdm+wWtoxs=";
+  };
+  meta = {
+    changelog = "https://github.com/claui/vscode-packaging/releases";
+    description = "Visual Studio Code extension for PKGBUILDs in the Arch User Repository (AUR)";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=claui.packaging";
+    homepage = "https://github.com/claui/vscode-packaging";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ilai-deutel ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 7dedbb0b9259..cd13ad2fa55d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -989,6 +989,8 @@ let
         };
       };
 
+      claui.packaging = callPackage ./claui.packaging { };
+
       cmschuetz12.wal = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "wal";

From 16a4981de2b29859e43f673c1b124823d1bef7d1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 03:42:56 +0000
Subject: [PATCH 47/60] grafanactl: 0.1.8 -> 0.1.9

---
 pkgs/by-name/gr/grafanactl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/grafanactl/package.nix b/pkgs/by-name/gr/grafanactl/package.nix
index a89f975b67a1..bbe5e66d90d8 100644
--- a/pkgs/by-name/gr/grafanactl/package.nix
+++ b/pkgs/by-name/gr/grafanactl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafanactl";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafanactl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UaltfA3O9IkcWXCnxe0pOhYm3//5YZEvhVi3emCy1mM=";
+    hash = "sha256-TJoTxVKfG2mfV05pkAxUJR7NKZbD9VIqRW4H8lyP2As=";
   };
 
-  vendorHash = "sha256-wIp05nwc4MICkNFoEAjOd4kjs1RE7RpINcdYzIdq4YY=";
+  vendorHash = "sha256-zEE4iaZJBneYgo6avCOTG7tWZ88NDskPTYiCMb8pRR4=";
 
   ldflags = [
     "-X main.version=v${finalAttrs.version}"

From 0b58f209302895f4174d9a3a815dbc11e8ce9369 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Mon, 16 Feb 2026 06:20:33 +0000
Subject: [PATCH 48/60] transmission_4: fix apparmor profile by adding crc32c

the upgrade to 4.1.0 (commit d3f0b664a1) added crc32c to buildInputs,
but not to the apparmor closure. however, `transmission-daemon` links
against crc32c dynamically, so crc32c needs to be in the closure else
the binary will fail under apparmor:

> transmission-daemon: error while loading shared libraries: libcrc32c.so.1
---
 pkgs/applications/networking/p2p/transmission/4.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index 98594f6bc78a..518bce1933be 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -48,6 +48,7 @@ let
 
   apparmorRules = apparmorRulesFromClosure { name = "transmission-daemon"; } (
     [
+      crc32c
       curl
       libdeflate
       libevent

From 4467a2111e59611e836eca028cd2865a624d1a75 Mon Sep 17 00:00:00 2001
From: pancaek <20342389+pancaek@users.noreply.github.com>
Date: Sun, 15 Feb 2026 15:46:39 -0800
Subject: [PATCH 49/60] apache-directory-studio: move icon to spec-compliant
 location

---
 pkgs/by-name/ap/apache-directory-studio/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ap/apache-directory-studio/package.nix b/pkgs/by-name/ap/apache-directory-studio/package.nix
index 4f49cb7ddda0..ab19595bfce3 100644
--- a/pkgs/by-name/ap/apache-directory-studio/package.nix
+++ b/pkgs/by-name/ap/apache-directory-studio/package.nix
@@ -9,6 +9,7 @@
   glib,
   libsecret,
   webkitgtk_4_1,
+  imagemagick,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     autoPatchelfHook
+    imagemagick
   ];
 
   installPhase = ''
@@ -70,7 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
           ]
         } \
         --run "mkdir -p /tmp/SWT-GDBusServer"
-    install -D icon.xpm "$out/share/pixmaps/apache-directory-studio.xpm"
+    mkdir -p $out/share/icons/hicolor/48x48/apps
+    magick icon.xpm $out/share/icons/hicolor/48x48/apps/apache-directory-studio.png
     install -D -t "$out/share/applications" ${finalAttrs.desktopItem}/share/applications/*
   '';
 

From 0c1bd101f4cbfa4141d1a9557282188fb8c48524 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 07:17:51 +0000
Subject: [PATCH 50/60] libretro.fbneo: 0-unstable-2026-02-08 ->
 0-unstable-2026-02-15

---
 pkgs/applications/emulators/libretro/cores/fbneo.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/fbneo.nix b/pkgs/applications/emulators/libretro/cores/fbneo.nix
index 3196325c3b35..108f885bb917 100644
--- a/pkgs/applications/emulators/libretro/cores/fbneo.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-02-08";
+  version = "0-unstable-2026-02-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "e21e3f3c40eb4422b93b8984ef46fe04cdaee9db";
-    hash = "sha256-7hZ2TJwHtgyHd+CZahazXZnKhfNpWZqfev9jtTHlmag=";
+    rev = "946de34101cd59701d66a8d2ec38394a6057740f";
+    hash = "sha256-Alzl84MAkSAr8CkqursthVc1eWn7McsNangjxFAaAQA=";
   };
 
   makefile = "Makefile";

From 1504a30022b71480f9cdaadba4fb2f3a77b7062b Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Sun, 15 Feb 2026 23:30:16 -0800
Subject: [PATCH 51/60] llvmPackages_git: 23.0.0-unstable-2026-02-08 ->
 23.0.0-unstable-2026-02-15

---
 pkgs/development/compilers/llvm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index f0c186d87aae..8f8f9ba037c0 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.0-rc2".officialRelease.sha256 = "sha256-j0KSuTANrwLh/siEcztSqCYQQDYHmdBCgVCsPsDCQ+I=";
     "23.0.0-git".gitRelease = {
-      rev = "80f627e6d5f1adedd5747b265f79e2304a200367";
-      rev-version = "23.0.0-unstable-2026-02-08";
-      sha256 = "sha256-4p43Y/yM5nevL9qIJexkMA0QeFrYKcl2mzJqVneaWhQ=";
+      rev = "23374f95ed1362cfcabcb1a1a95bc81fc58b70b9";
+      rev-version = "23.0.0-unstable-2026-02-15";
+      sha256 = "sha256-CbB+5bFRwbz/k7USBD+h3d0FFGMt58lW7lG3tyeEEyQ=";
     };
   }
   // llvmVersions;

From 4ee9ab391e470d3e5f3ce0a313a774a9d60f3b4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 07:38:54 +0000
Subject: [PATCH 52/60] vscode-extensions.sourcegraph.amp: 0.0.1770596843 ->
 0.0.1771217285

---
 .../editors/vscode/extensions/sourcegraph.amp/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
index e3423c6ed5af..9ece7f287317 100644
--- a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1770596843";
-    hash = "sha256-FLajygfJM+EPOXSU7g5I7Yo1YU7zYvTuw2cfY3B17BE=";
+    version = "0.0.1771217285";
+    hash = "sha256-eTvkYFir8ZNNjWCaQ20WiJe/pJ8Gbtqvx74dq9S9Llw=";
   };
 
   meta = {

From b624485bbcf560975f60c4793e5857965c375de1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 07:40:47 +0000
Subject: [PATCH 53/60] gitlogue: 0.7.0 -> 0.8.0

---
 pkgs/by-name/gi/gitlogue/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitlogue/package.nix b/pkgs/by-name/gi/gitlogue/package.nix
index 3c615d5082f3..c8ba34d49a80 100644
--- a/pkgs/by-name/gi/gitlogue/package.nix
+++ b/pkgs/by-name/gi/gitlogue/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitlogue";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "unhappychoice";
     repo = "gitlogue";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mZ2A6274Ujpo5rTewFaMUslZhLCKJ2iw43J8X3vuBBI=";
+    hash = "sha256-T9QhPWT6w6Ezdl33mPb24UB38ApZdY/JlFMWYJZw+gA=";
   };
 
-  cargoHash = "sha256-MueaRVomOiQsPSOnHpB/k9a8fNpKpFRilAXgIkVxZ94=";
+  cargoHash = "sha256-7MQOf/BQ5dDR7iIOKjyKah7CJuZN4OZm+CcHso7FecI=";
 
   nativeBuildInputs = [ pkg-config ];
 

From afc438d015bf37eeadd4c136ca8f842111e05194 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 07:55:52 +0000
Subject: [PATCH 54/60] sysdig-cli-scanner: 1.24.2 -> 1.25.1

---
 .../sysdig-cli-scanner.versions.nix            | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index d339395ad234..5c7857afa5a0 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.24.2";
+  version = "1.25.1";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.24.2/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-HrkgmdIEgq5fBttZCO2Y0LcgitmTylwBjEUCA0MvqDs=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.25.1/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-Qg00JIeYpGPcgd9jlbyfOrklWVrseMMLwv5hw87RP/0=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.24.2/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-AsyM2scsKtQqFygZbrhXQkz1dE7PX1+nT1+gkmfmZcs=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.25.1/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-GBoNTdSod/IOfsCzYCqU9DLzj2LEjXUwig6gjMbCrYs=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.24.2/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-zCS8X3wLKwowlDhNamXN04hhHy6/SNaq3rFu6oOjbBg=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.25.1/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-MtCtWY3/dIIzL3f4IyZzHQPXNuR+OQFR318jQNO5r78=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.24.2/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-+KjOhNRGIXl+B0k8rnQNtbYphKqxvuSHz/R31mOHapY=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.25.1/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-vjbpPx8swNwuhperEnDP9sQe+Q1vJU4ZfvLloE2gbh4=";
   };
 }

From 4a37c33e290eb3ad133d65738b874f728ba60776 Mon Sep 17 00:00:00 2001
From: Thomas FitzGerald <tomrfitz@gmail.com>
Date: Mon, 16 Feb 2026 04:04:27 -0500
Subject: [PATCH 55/60] zed-editor: fix darwin build by appending buildFeatures
 to checkFeatures

For the same reason runtime_shaders is passed to buildFeatures, it must also be
passed to checkFeatures to avoid fallback to proprietary Metal shaders not
available in Nix sandbox.

Co-authored-by: Niklas Korz <niklas@niklaskorz.de>
---
 pkgs/by-name/ze/zed-editor/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 3a1aa5284eb8..3da7c6df7cdb 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -196,7 +196,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Some crates define extra types or enum values in test configuration which then lead
   # to type checking errors in other crates unless this feature is enabled.
-  checkFeatures = [ "visual-tests" ];
+  # gpui/runtime_shaders is required on darwin for the same reason as buildFeatures above:
+  # without it, build.rs invokes the proprietary Metal shader compiler.
+  checkFeatures = [
+    "visual-tests"
+  ]
+  ++ finalAttrs.buildFeatures;
 
   env = {
     ALLOW_MISSING_LICENSES = true;

From d94e6683f5df6f1d6b565c989d2dad99b24ef20f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:19 +0300
Subject: [PATCH 56/60] linux_6_19: 6.19 -> 6.19.1

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 121b8e175905..455c42aa8d0e 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": false
     },
     "6.19": {
-        "version": "6.19",
-        "hash": "sha256:0mqka8ii7bvmx9hvfjdiyva9ib0j7m390gxhh8gki3qb4nl7jc1h",
+        "version": "6.19.1",
+        "hash": "sha256:1vlki73j7m2khjl39hq4fy42qql9als18nmnjg00a8yklhqzb0qb",
         "lts": false
     }
 }

From c8dabc8cef0978f1365cce98a3be290a627a0120 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:23 +0300
Subject: [PATCH 57/60] linux_6_18: 6.18.10 -> 6.18.11

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 455c42aa8d0e..3311b92c569d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.10",
-        "hash": "sha256:1plfwknqh5831kjq6f2yxcm4lqvp68a6kvcfnbxa5ba12wb7glyn",
+        "version": "6.18.11",
+        "hash": "sha256:1xrsc7s3kh7mipfs0v33n97gfi55ll83x4hxvwi969qh8293ibrq",
         "lts": false
     },
     "6.19": {

From 3ede227389ee870f0b114e32e968c23b9b3967d1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:27 +0300
Subject: [PATCH 58/60] linux_6_12: 6.12.70 -> 6.12.72

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 3311b92c569d..17e440704d6f 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.70",
-        "hash": "sha256:1w1flq4phr3i51c85bz8d9a8cg780vn7dr29y4j4izyfv33wwk4v",
+        "version": "6.12.72",
+        "hash": "sha256:0ybijkw2zadhlg49r0wvnvy3s2czj5jnb149cz8ybvzvp90qgxdi",
         "lts": true
     },
     "6.18": {

From 3cc252124c1744d69efacdba64b3ab78d713de5c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:30 +0300
Subject: [PATCH 59/60] linux_6_6: 6.6.124 -> 6.6.125

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 17e440704d6f..140c3ecc04d0 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.124",
-        "hash": "sha256:0kkri7y9g5c7hylwsdc2wq2drhniay171nnccr533qlvisgzpbm7",
+        "version": "6.6.125",
+        "hash": "sha256:0g88r1v5q0m1n1ii2f16awc8w9m471m6hqx7r5whad4a8dpkpqwf",
         "lts": true
     },
     "6.12": {

From db02377418e30440ecef8e6cee479e97e1456bda Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 13:28:45 +0300
Subject: [PATCH 60/60] nixos/boot/systemd: fix doc build

---
 nixos/modules/system/boot/systemd.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 9a187e86d76b..467a5d04516f 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -374,9 +374,7 @@ in
     generatorPath = mkOption {
       type = types.listOf types.package;
       default = [ ];
-      example = [
-        pkgs.hello
-      ];
+      example = lib.literalExpression "[ pkgs.hello ]";
       description = ''
         Packages added to the `PATH` environment variable of all systemd generators.
       '';