Merge 2b62399653 into haskell-updates

doc/languages-frameworks/index.md

@@ -17,7 +17,7 @@ Each supported language or software ecosystem has its own package set named `<la
   # Navigate Java compiler variants in `javaPackages` with `nix repl`
 
   ```shell-session
-  $ nix repl '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable
+  $ nix repl -f '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable
   nix-repl> javaPackages.<tab>
   javaPackages.compiler               javaPackages.openjfx15              javaPackages.openjfx21              javaPackages.recurseForDerivations
   javaPackages.jogl_2_4_0             javaPackages.openjfx17              javaPackages.openjfx25

doc/release-notes/rl-2605.section.md

@@ -139,6 +139,8 @@
 
 - `mozc` and `mozc-ut` no longer contains the IBus front-end, which are now provided by `ibus-engines.mozc` and `ibus-engines.mozc-ut`.
 
+- `nemorosa` has been updated from `0.4.3` to `0.5.0`. Version [0.5.0](https://github.com/KyokoMiki/nemorosa/releases/tag/0.5.0) introduced breaking changes to the package configuration.
+
 - `n8n` has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.
 
 - The default NVIDIA drivers no longer support Maxwell (GTX 1xxx) or older GPUs. Pin the nvidia package to ` config.boot.kernelPackages.nvidiaPackages.legacy_580` for continued support.

doc/stdenv/cross-compilation.chapter.md

@@ -235,13 +235,24 @@ One would think that `localSystem` and `crossSystem` overlap horribly with the t
 
 ### Implementation of dependencies {#ssec-cross-dependency-implementation}
 
-The categories of dependencies developed in [](#ssec-cross-dependency-categorization) are specified as lists of derivations given to `mkDerivation`, as documented in [](#ssec-stdenv-dependencies). In short, each list of dependencies for `host → target` is called `deps<host><target>` (where `host`, and `target` values are either `build`, `host`, or `target`), with exceptions for backwards compatibility that `depsBuildHost` is instead called `nativeBuildInputs` and `depsHostTarget` is instead called `buildInputs`. Nixpkgs is now structured so that each `deps<host><target>` is automatically taken from `pkgs<host><target>`. (These `pkgs<host><target>`s are quite new, so there is no special case for `nativeBuildInputs` and `buildInputs`.) For example, `pkgsBuildHost.gcc` should be used at build-time, while `pkgsHostTarget.gcc` should be used at run-time.
+The categories of dependencies developed in [](#ssec-cross-dependency-categorization) are specified as lists of derivations given to `mkDerivation`, as documented in [](#ssec-stdenv-dependencies). In short, each list of dependencies for `host → target` is called `deps<theirHost><theirTarget>` (where `theirHost`, and `theirTarget` values are either `build`, `host`, or `target`), with exceptions for backwards compatibility that `depsBuildHost` is instead called `nativeBuildInputs` and `depsHostTarget` is instead called `buildInputs`. Nixpkgs is now structured so that each `deps<theirHost><theirTarget>` is automatically taken from `pkgs<theirHost><theirTarget>`. (These `pkgs<theirHost><theirTarget>`s are quite new, so there is no special case for `nativeBuildInputs` and `buildInputs`.) For example, `pkgsBuildHost.gcc` should be used at build-time, while `pkgsHostTarget.openssl` should be used at run-time.
 
-Now, for most of Nixpkgs's history, there were no `pkgs<host><target>` attributes, and most packages have not been refactored to use it explicitly. Prior to those, there were just `buildPackages`, `pkgs`, and `targetPackages`. Those are now redefined as aliases to `pkgsBuildHost`, `pkgsHostTarget`, and `pkgsTargetTarget`. It is acceptable, even recommended, to use them for libraries to show that the host platform is irrelevant.
+Adjacent package sets are defined as `pkgs<theirHost><theirTarget>` attributes, where "their" represents the new attribute set, and "our" represents the "current" package set. Below is a table of adjacent stages and their aliases. See [](#variables-specifying-dependencies) for usage examples.
 
-But before that, there was just `pkgs`, even though both `buildInputs` and `nativeBuildInputs` existed. \[Cross barely worked, and those were implemented with some hacks on `mkDerivation` to override dependencies.\] What this means is the vast majority of packages do not use any explicit package set to populate their dependencies, just using whatever `callPackage` gives them even if they do correctly sort their dependencies into the multiple lists described above. And indeed, asking that users both sort their dependencies, _and_ take them from the right attribute set, is both too onerous and redundant, so the recommended approach (for now) is to continue just categorizing by list and not using an explicit package set.
+| Adjacent package set                   | Their host platform | Their target platform |
+|----------------------------------------|---------------------|-----------------------|
+| `pkgsBuildBuild`                       | Our build platform  | Our build platform    |
+| `pkgsBuildHost` or `buildPackages`     | Our build platform  | Our host platform     |
+| `pkgsBuildTarget`                      | Our build platform  | Our target platform   |
+| `pkgsHostHost`                         | Our host platform   | Our host platform     |
+| `pkgsHostTarget` or `pkgs`             | Our host platform   | Our target platform   |
+| `pkgsTargetTarget` or `targetPackages` | Our target platform | Our target platform   |
 
-To make this work, we "splice" together the six `pkgsFooBar` package sets and have `callPackage` actually take its arguments from that. This is currently implemented in `pkgs/top-level/splice.nix`. `mkDerivation` then, for each dependency attribute, pulls the right derivation out from the splice. This splicing can be skipped when not cross-compiling as the package sets are the same, but still is a bit slow for cross-compiling. We'd like to do something better, but haven't come up with anything yet.
+Now, for most of Nixpkgs's history, there were no `pkgs<theirHost><theirTarget>` attributes, and most packages have not been refactored to use it explicitly. Prior to those, there were just `buildPackages`, `pkgs`, and `targetPackages`. Those are now redefined as aliases to `pkgsBuildHost`, `pkgsHostTarget`, and `pkgsTargetTarget`. It is acceptable, even recommended, to use them to show that only their host platform matters. That is, use `buildPackages` where any of `pkgsBuild*` would do, and `targetPackages` when any of `pkgsTarget*` would do (if we had more than just `pkgsTargetTarget`).
+
+But before that, there was just `pkgs`, even though both `buildInputs` and `nativeBuildInputs` existed. (Cross barely worked, and those were implemented with some hacks on `mkDerivation` to override dependencies.) What this means is the vast majority of packages do not use any explicit package set to populate their dependencies, just using whatever `callPackage` gives them even if they do correctly sort their dependencies into the multiple lists described above. And indeed, asking that users both sort their dependencies, _and_ take them from the right attribute set, is both too onerous and redundant, so the recommended approach (for now) is to continue just categorizing by list and not using an explicit package set.
+
+To make this work, we "splice" together the six `pkgs<theirHost><theirTarget>` package sets and have `callPackage` actually take its arguments from that. This is currently implemented in `pkgs/top-level/splice.nix`. `mkDerivation` then, for each dependency attribute, pulls the right derivation out from the splice. This splicing can be skipped when not cross-compiling as the package sets are the same, but still is a bit slow for cross-compiling. We'd like to do something better, but haven't come up with anything yet.
 
 ### Bootstrapping {#ssec-bootstrapping}
 

doc/stdenv/stdenv.chapter.md

@@ -431,7 +431,7 @@ Overall, the unifying theme here is that propagation shouldn’t be introducing
 
 ##### `depsBuildBuild` {#var-stdenv-depsBuildBuild}
 
-A list of dependencies whose host and target platforms are the new derivation’s build platform. These are programs and libraries used at build time that produce programs and libraries also used at build time. If the dependency doesn’t care about the target platform (i.e. isn’t a compiler or similar tool), put it in `nativeBuildInputs` instead. The most common use of this `buildPackages.stdenv.cc`, the default C compiler for this role. That example crops up more than one might think in old commonly used C libraries.
+A list of dependencies whose host and target platforms are the new derivation’s build platform. These are programs and libraries used at build time that produce programs and libraries also used at build time. If the dependency doesn’t care about the target platform (i.e. isn’t a compiler or similar tool), put it in `nativeBuildInputs` instead. The most common use of this `buildPackages.stdenv.cc` (the compiler for `buildPackages`, which means that it's from the package set `buildPackages.buildPackages = pkgsBuildBuild`), the default C compiler for this role. That example crops up more than one might think in old commonly used C libraries.
 
 Since these packages are able to be run at build-time, they are always added to the `PATH`, as described above. But since these packages are only guaranteed to be able to run then, they shouldn’t persist as run-time dependencies. This isn’t currently enforced, but could be in the future.
 

flake.nix

@@ -144,6 +144,7 @@
                         nixpkgs.hostPlatform = "x86_64-linux";
                         boot.loader.grub.enable = false;
                         fileSystems."/".device = "nodev";
+                        fileSystems."/".fsType = "none";
                         # See https://search.nixos.org/options?show=system.stateVersion&query=stateversion
                         system.stateVersion = lib.trivial.release; # DON'T do this in real configs!
                       }

lib/systems/default.nix

@@ -3,11 +3,11 @@
 let
   inherit (lib)
     any
-    filterAttrs
+    attrNames
+    filter
     foldl
     hasInfix
     isAttrs
-    isFunction
     isList
     mapAttrs
     optional
@@ -43,9 +43,8 @@ let
   */
   equals =
     let
-      # perf: avoid lib.isFunction because system attrs are never __functor-style attrsets.
-      removeFunctions =
-        a: removeAttrs a (builtins.filter (n: builtins.isFunction a.${n}) (builtins.attrNames a));
+      # System attrs are never __functor-style attrsets, so builtins.isFunction suffices.
+      removeFunctions = a: removeAttrs a (filter (n: builtins.isFunction a.${n}) (attrNames a));
     in
     a: b: removeFunctions a == removeFunctions b;
 

maintainers/maintainer-list.nix

@@ -2992,6 +2992,12 @@
     githubId = 127523;
     name = "Herman Fries";
   };
+  barrettruth = {
+    email = "br@barrettruth.com";
+    github = "barrettruth";
+    githubId = 62671086;
+    name = "Barrett Ruth";
+  };
   BarrOff = {
     name = "BarrOff";
     github = "BarrOff";
@@ -3495,6 +3501,11 @@
     githubId = 30630233;
     name = "Timo Triebensky";
   };
+  BIOS9 = {
+    name = "NightFish";
+    github = "BIOS9";
+    githubId = 15035908;
+  };
   birdee = {
     name = "birdee";
     github = "BirdeeHub";
@@ -16166,6 +16177,11 @@
     githubId = 8094643;
     keys = [ { fingerprint = "BAA9 7711 58CA D457 B4AE  8B06 8188 423D 2FA2 0A65"; } ];
   };
+  m7medvision = {
+    name = "Mohammed";
+    github = "m7medVision";
+    githubId = 88824957;
+  };
   ma27 = {
     email = "maximilian@mbosch.me";
     matrix = "@ma27:nicht-so.sexy";
@@ -29226,6 +29242,12 @@
     githubId = 42300264;
     name = "wishfort36";
   };
+  wishstudio = {
+    email = "wishstudio@gmail.com";
+    github = "wishstudio";
+    githubId = 946459;
+    name = "Xiangyan Sun";
+  };
   witchof0x20 = {
     name = "Jade";
     email = "jade@witchof.space";
@@ -29521,13 +29543,6 @@
     github = "xdHampus";
     githubId = 16954508;
   };
-  xe = {
-    email = "me@christine.website";
-    matrix = "@withoutwithin:matrix.org";
-    github = "Xe";
-    githubId = 529003;
-    name = "Christine Dodrill";
-  };
   xeals = {
     email = "dev@xeal.me";
     github = "xeals";

nixos/doc/manual/configuration/modularity.section.md

@@ -113,7 +113,7 @@ Interactive exploration of the configuration is possible using `nix
   repl`, a read-eval-print loop for Nix expressions. A typical use:
 
 ```ShellSession
-$ nix repl '<nixpkgs/nixos>'
+$ nix repl -f '<nixpkgs/nixos>'
 
 nix-repl> config.networking.hostName
 "mandark"

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -145,6 +145,8 @@
 
 - The packages `iw` and `wirelesstools` (`iwconfig`, `iwlist`, etc.) are no longer installed implicitly if wireless networking has been enabled.
 
+- The `fileSystems.<name>.fsType` option no longer has a default value and must be specified by the user. The value `"auto"` still works as before, though its use is generally discouraged.
+
 - `services.uptime` has been removed because the package it relies on does not exist anymore in nixpkgs.
 
 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
@@ -202,6 +204,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - `rocmPackages_6` has been removed. `rocmPackages` has been updated to ROCm 7.x. Out of tree packages may rely on obsolete hipblas APIs or compile time constant warp size and need to be updated.
 
+- `services.prometheus.exporters.rspamd` has been removed. It relied on the Rspamd /stat endpoint via the JSON exporter. You can use the Rspamd [/metrics](https://docs.rspamd.com/developers/protocol#controller-http-endpoints) endpoint directly instead.
+
 - The Bash implementation of the `nixos-rebuild` program is removed. All switchable systems now use the Python rewrite. Any prior usage of `system.rebuild.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.
 
 - `services.desktopManager.gnome` no longer installs the Geary e-mail client since it is not part of the GNOME [core applications](https://apps.gnome.org/) list. Geary's position in the default favorite apps section has been replaced by GNOME Text Editor. To keep it installed, add `programs.geary.enable = true;` to your configuration.

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -796,6 +796,7 @@ in
           "/dev/disk/by-label/${config.isoImage.volumeID}"
         else
           "/dev/root";
+      fsType = "iso9660";
       neededForBoot = true;
       noCheck = true;
     };

nixos/modules/module-list.nix

@@ -1204,6 +1204,7 @@
   ./services/networking/frr.nix
   ./services/networking/g3proxy.nix
   ./services/networking/gdomap.nix
+  ./services/networking/geph.nix
   ./services/networking/ghostunnel.nix
   ./services/networking/git-daemon.nix
   ./services/networking/globalprotect-vpn.nix

nixos/modules/security/polkit.nix

@@ -100,6 +100,12 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
+      (lib.mkIf config.security.pam.zfs.enable {
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/zfs rw"
+        ];
+      })
     ];
 
     # The polkit daemon reads action/rule files

nixos/modules/services/audio/squeezelite.nix

@@ -6,53 +6,142 @@
 }:
 
 let
-  inherit (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    optionalString
-    types
-    ;
-
-  dataDir = "/var/lib/squeezelite";
   cfg = config.services.squeezelite;
-  pkg = if cfg.pulseAudio then pkgs.squeezelite-pulse else pkgs.squeezelite;
-  bin = "${pkg}/bin/${pkg.pname}";
+
+  serviceDeps = [
+    "network.target"
+    "sound.target"
+  ]
+  ++ lib.optionals cfg.pulseaudio.enable (
+    if config.services.pulseaudio.systemWide then
+      [ "pulseaudio.service" ]
+    else
+      [
+        "pipewire.service"
+        "pipewire-pulse.socket"
+      ]
+  );
 
 in
 {
-
-  ###### interface
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "squeezelite" "pulseAudio" ]
+      [ "services" "squeezelite" "pulseaudio" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "squeezelite" "extraArguments" ]
+      [ "services" "squeezelite" "extraArgs" ]
+    )
+  ];
 
   options.services.squeezelite = {
-    enable = mkEnableOption "Squeezelite, a software Squeezebox emulator";
+    enable = lib.mkEnableOption "Squeezelite, a software Squeezebox emulator";
 
-    pulseAudio = mkEnableOption "pulseaudio support";
+    package = lib.mkPackageOption pkgs "squeezelite" { } // {
+      default = if cfg.pulseaudio.enable then pkgs.squeezelite-pulse else pkgs.squeezelite;
+      defaultText = lib.literalExpression "if config.services.squeezelite.pulseaudio.enable then pkgs.squeezelite-pulse else pkgs.squeezelite";
+    };
 
-    extraArguments = mkOption {
+    name = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = "name to report to server";
+      default = null;
+    };
+
+    mutableName = lib.mkOption {
+      type = lib.types.bool;
+      description = "store name in file, controllable by server";
+      default = cfg.name == null;
+      defaultText = lib.literalExpression "config.services.squeezelite.name == null";
+    };
+
+    pulseaudio = {
+      enable = lib.mkEnableOption "pulseaudio support";
+      group = lib.mkOption {
+        type = lib.types.str;
+        description = "group for accessing to pulseaudio socket";
+        default = if config.services.pulseaudio.systemWide then "pulse-access" else "pipewire";
+        defaultText = lib.literalExpression ''if config.services.pulseaudio.systemWide then "pulse-access" else "pipewire"'';
+      };
+    };
+
+    extraArgs = lib.mkOption {
       default = "";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         Additional command line arguments to pass to Squeezelite.
       '';
     };
   };
 
-  ###### implementation
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.name == null || !cfg.mutableName;
+        message = "'services.squeezelite.name' and 'services.squeezelite.mutableName' are mutually exclusive";
+      }
+      {
+        assertion =
+          !cfg.pulseaudio.enable
+          || (
+            (config.services.pulseaudio.enable && config.services.pulseaudio.systemWide)
+            || (
+              config.services.pipewire.enable
+              && config.services.pipewire.pulse.enable
+              && config.services.pipewire.systemWide
+            )
+          );
+        message = ''
+          `services.squeezelite.pulseaudio.enable = true' requires a system-wide Pulseaudio server. Either:
+          - `services.pulseaudio.enable = true' and `services.pulseaudio.systemWide = true'
+          or
+          - `services.pipewire.enable = true', `services.pipewire.pulse.enable = true', and `services.pipewire.systemWide = true'
+          should be set.
+        '';
+      }
+    ];
 
-  config = mkIf cfg.enable {
     systemd.services.squeezelite = {
-      wantedBy = [ "multi-user.target" ];
-      after = [
-        "network.target"
+      wantedBy = [
+        "multi-user.target"
+        # try and start squeezelite if it isn't already, e.g. a sound card plugged in
         "sound.target"
       ];
+      after = serviceDeps;
+      requires = serviceDeps;
       description = "Software Squeezebox emulator";
+
+      environment = {
+        XDG_CONFIG_HOME = "%S/squeezelite/.config";
+        XDG_RUNTIME_DIR = "%t/squeezelite";
+      };
+
       serviceConfig = {
+        ExecStartPre = [
+          # print available interfaces
+          "${lib.getExe cfg.package} -l"
+        ]
+        ++ lib.optionals (!cfg.pulseaudio.enable) [
+          # print available alsa controls
+          "${lib.getExe cfg.package} -L"
+        ];
+        ExecStart = "${lib.getExe cfg.package} ${
+          lib.optionalString (cfg.name != null) "-n ${cfg.name} "
+        }${lib.optionalString cfg.mutableName "-N %S/squeezelite/player-name "}${cfg.extraArgs}";
+
         DynamicUser = true;
-        ExecStart = "${bin} -N ${dataDir}/player-name ${cfg.extraArguments}";
-        StateDirectory = baseNameOf dataDir;
-        SupplementaryGroups = "audio";
+        RuntimeDirectory = "squeezelite";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = "squeezelite";
+        StateDirectoryMode = "0700";
+        SupplementaryGroups = [
+          "audio"
+        ]
+        ++ lib.optionals cfg.pulseaudio.enable [
+          cfg.pulseaudio.group
+        ];
+        TimeoutStopSec = "5";
       };
     };
   };

nixos/modules/services/cluster/rancher/default.nix

@@ -518,6 +518,12 @@ let
           default = null;
         };
 
+        nodeExternalIP = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "IPv4/IPv6 external addresses to advertise for node.";
+          default = null;
+        };
+
         selinux = lib.mkOption {
           type = lib.types.bool;
           description = "Enable SELinux in containerd.";
@@ -826,8 +832,8 @@ let
             "${name}: token, tokenFile or configPath (with 'token' or 'token-file' keys) should be set if role is 'agent'"
           )
           ++ (lib.optional (
-            cfg.role == "agent" && !(cfg.agentTokenFile != null || cfg.agentToken != "")
-          ) "${name}: agentToken and agentToken should not be set if role is 'agent'");
+            cfg.role == "agent" && (cfg.agentTokenFile != null || cfg.agentToken != "")
+          ) "${name}: agentToken and agentTokenFile should not be set if role is 'agent'");
 
         environment.systemPackages = [ config.services.${name}.package ];
 
@@ -936,6 +942,7 @@ let
                 ++ (lib.optionals (cfg.nodeLabel != [ ]) (map (l: "--node-label=${l}") cfg.nodeLabel))
                 ++ (lib.optionals (cfg.nodeTaint != [ ]) (map (t: "--node-taint=${t}") cfg.nodeTaint))
                 ++ (lib.optional (cfg.nodeIP != null) "--node-ip=${cfg.nodeIP}")
+                ++ (lib.optional (cfg.nodeExternalIP != null) "--node-external-ip=${cfg.nodeExternalIP}")
                 ++ (lib.optional cfg.selinux "--selinux")
                 ++ (lib.optional (kubeletParams != { }) "--kubelet-arg=config=${kubeletConfig}")
                 ++ (lib.optional (cfg.extraKubeProxyConfig != { }) "--kube-proxy-arg=config=${kubeProxyConfig}")

nixos/modules/services/cluster/rancher/k3s.nix

@@ -115,23 +115,24 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
-          cfg.disableAgent && cfg.images != [ ]
-        ) "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node."
-      );
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings =
+          lib.optional (cfg.disableAgent && cfg.images != [ ])
+            "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node.";
 
-      assertions = [
-        {
-          assertion = cfg.role == "agent" -> !cfg.disableAgent;
-          message = "k3s: disableAgent must be false if role is 'agent'";
-        }
-        {
-          assertion = cfg.role == "agent" -> !cfg.clusterInit;
-          message = "k3s: clusterInit must be false if role is 'agent'";
-        }
-      ];
-    }
+        assertions = [
+          {
+            assertion = cfg.role == "agent" -> !cfg.disableAgent;
+            message = "k3s: disableAgent must be false if role is 'agent'";
+          }
+          {
+            assertion = cfg.role == "agent" -> !cfg.clusterInit;
+            message = "k3s: clusterInit must be false if role is 'agent'";
+          }
+        ];
+      }
+    ]
   );
 }

nixos/modules/services/cluster/rancher/rke2.nix

@@ -121,40 +121,41 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings = lib.optional (
           cfg.role == "agent" && cfg.cni != null
-        ) "rke2: cni should not be set if role is 'agent'"
-      );
+        ) "rke2: cni should not be set if role is 'agent'";
 
-      # Configure NetworkManager to ignore CNI network interfaces.
-      # See: https://docs.rke2.io/known_issues#networkmanager
-      environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
-        enable = config.networking.networkmanager.enable;
-        text = ''
-          [keyfile]
-          unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
-        '';
-      };
-
-      # CIS hardening
-      # https://docs.rke2.io/security/hardening_guide#kernel-parameters
-      # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
-      boot.kernel.sysctl = {
-        "vm.panic_on_oom" = 0;
-        "vm.overcommit_memory" = 1;
-        "kernel.panic" = 10;
-        "kernel.panic_on_oops" = 1;
-      };
-      # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
-      users = lib.mkIf cfg.cisHardening {
-        users.etcd = {
-          isSystemUser = true;
-          group = "etcd";
+        # Configure NetworkManager to ignore CNI network interfaces.
+        # See: https://docs.rke2.io/known_issues#networkmanager
+        environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
+          enable = config.networking.networkmanager.enable;
+          text = ''
+            [keyfile]
+            unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
+          '';
         };
-        groups.etcd = { };
-      };
-    }
+
+        # CIS hardening
+        # https://docs.rke2.io/security/hardening_guide#kernel-parameters
+        # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
+        boot.kernel.sysctl = {
+          "vm.panic_on_oom" = 0;
+          "vm.overcommit_memory" = 1;
+          "kernel.panic" = 10;
+          "kernel.panic_on_oops" = 1;
+        };
+        # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
+        users = lib.mkIf cfg.cisHardening {
+          users.etcd = {
+            isSystemUser = true;
+            group = "etcd";
+          };
+          groups.etcd = { };
+        };
+      }
+    ]
   );
 }

nixos/modules/services/databases/postgresql.md

@@ -285,7 +285,7 @@ A complete list of options for the PostgreSQL module may be found [here](#opt-se
 
 The collection of plugins for each PostgreSQL version can be accessed with `.pkgs`. For example, for the `pkgs.postgresql_15` package, its plugin collection is accessed by `pkgs.postgresql_15.pkgs`:
 ```ShellSession
-$ nix repl '<nixpkgs>'
+$ nix repl -f '<nixpkgs>'
 
 Loading '<nixpkgs>'...
 Added 10574 variables.

nixos/modules/services/mail/roundcube.nix

@@ -190,6 +190,7 @@ in
             priority = 1100;
             extraConfig = ''
               add_header Cache-Control 'public, max-age=604800, must-revalidate';
+              client_max_body_size ${toString cfg.maxAttachmentSize};
             '';
           };
           locations."~ ^/(SQL|bin|config|logs|temp|vendor)/" = {

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -110,7 +110,6 @@ let
         "rasdaemon"
         "redis"
         "restic"
-        "rspamd"
         "rtl_433"
         "sabnzbd"
         "scaphandre"
@@ -398,6 +397,10 @@ in
         (lib.mkRemovedOptionModule [ "tor" ] ''
           The Tor exporter has been removed, as it was broken and unmaintained.
         '')
+        (lib.mkRemovedOptionModule [ "rspamd" ] ''
+          The Rspamd exporter has been removed. You can use the Rspamd /metrics endpoint directly instead:
+          https://docs.rspamd.com/developers/protocol#controller-http-endpoints
+        '')
       ];
     };
     description = "Prometheus exporter configuration";

nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix

@@ -1,119 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  options,
-  ...
-}:
-
-let
-  cfg = config.services.prometheus.exporters.rspamd;
-  inherit (lib)
-    mkOption
-    types
-    replaceStrings
-    mkRemovedOptionModule
-    recursiveUpdate
-    concatStringsSep
-    literalExpression
-    ;
-
-  mkFile = conf: pkgs.writeText "rspamd-exporter-config.yml" (builtins.toJSON conf);
-
-  generateConfig = extraLabels: {
-    modules.default.metrics =
-      (map
-        (path: {
-          name = "rspamd_${replaceStrings [ "[" "." " " "]" "\\" "'" ] [ "_" "_" "_" "" "" "" ] path}";
-          path = "{ .${path} }";
-          labels = extraLabels;
-        })
-        [
-          "actions['add\\ header']"
-          "actions['no\\ action']"
-          "actions['rewrite\\ subject']"
-          "actions['soft\\ reject']"
-          "actions.greylist"
-          "actions.reject"
-          "bytes_allocated"
-          "chunks_allocated"
-          "chunks_freed"
-          "chunks_oversized"
-          "connections"
-          "control_connections"
-          "ham_count"
-          "learned"
-          "pools_allocated"
-          "pools_freed"
-          "read_only"
-          "scanned"
-          "shared_chunks_allocated"
-          "spam_count"
-          "total_learns"
-        ]
-      )
-      ++ [
-        {
-          name = "rspamd_statfiles";
-          type = "object";
-          path = "{.statfiles[*]}";
-          labels = recursiveUpdate {
-            symbol = "{.symbol}";
-            type = "{.type}";
-          } extraLabels;
-          values = {
-            revision = "{.revision}";
-            size = "{.size}";
-            total = "{.total}";
-            used = "{.used}";
-            languages = "{.languages}";
-            users = "{.users}";
-          };
-        }
-      ];
-  };
-in
-{
-  port = 7980;
-  extraOpts = {
-    extraLabels = mkOption {
-      type = types.attrsOf types.str;
-      default = {
-        host = config.networking.hostName;
-      };
-      defaultText = literalExpression "{ host = config.networking.hostName; }";
-      example = literalExpression ''
-        {
-          host = config.networking.hostName;
-          custom_label = "some_value";
-        }
-      '';
-      description = "Set of labels added to each metric.";
-    };
-  };
-  serviceOpts.serviceConfig.ExecStart = ''
-    ${pkgs.prometheus-json-exporter}/bin/json_exporter \
-      --config.file ${mkFile (generateConfig cfg.extraLabels)} \
-      --web.listen-address "${cfg.listenAddress}:${toString cfg.port}" \
-      ${concatStringsSep " \\\n  " cfg.extraFlags}
-  '';
-
-  imports = [
-    (mkRemovedOptionModule [ "url" ] ''
-      This option was removed. The URL of the rspamd metrics endpoint
-      must now be provided to the exporter by prometheus via the url
-      parameter `target'.
-
-      In prometheus a scrape URL would look like this:
-
-        http://some.rspamd-exporter.host:7980/probe?target=http://some.rspamd.host:11334/stat
-
-      For more information, take a look at the official documentation
-      (https://github.com/prometheus-community/json_exporter) of the json_exporter.
-    '')
-    {
-      options.warnings = options.warnings;
-      options.assertions = options.assertions;
-    }
-  ];
-}

nixos/modules/services/networking/cgit.nix

@@ -300,7 +300,7 @@ in
       lib.mapAttrsToList (name: cfg: {
         ${cfg.nginx.virtualHost} = {
           locations =
-            (genAttrs' [ "cgit.css" "cgit.png" "favicon.ico" "robots.txt" ] (
+            (genAttrs' [ "cgit.css" "cgit.js" "cgit.png" "favicon.ico" "robots.txt" ] (
               fileName:
               lib.nameValuePair "= ${stripLocation cfg}/${fileName}" {
                 alias = lib.mkDefault "${cfg.package}/cgit/${fileName}";

nixos/modules/services/networking/geph.nix

@@ -0,0 +1,101 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.geph;
+in
+{
+  options.services.geph = {
+    enable = lib.mkEnableOption "geph client daemon";
+
+    package = lib.mkPackageOption pkgs "geph" { };
+
+    configFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      description = ''
+        Path to the geph config file.
+
+        This file contain sensitive credentials, so it must not live in the Nix store.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelModules = [ "tun" ];
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.geph = {
+      description = "geph client daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
+      serviceConfig = {
+        DynamicUser = true;
+        LoadCredential = "geph-config:${cfg.configFile}";
+        ExecStart = "${lib.getExe cfg.package} --config %d/geph-config";
+
+        Restart = "on-failure";
+        RestartSec = 2;
+        LimitNOFILE = 65535;
+
+        StateDirectory = "geph";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/geph";
+
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        DeviceAllow = "/dev/net/tun rw";
+        DevicePolicy = "closed";
+        PrivateUsers = false;
+        PrivateDevices = false;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      MCSeekeri
+    ];
+  };
+}

nixos/modules/services/networking/unifi.nix

@@ -160,17 +160,14 @@ in
       serviceConfig = {
         Type = "notify";
         ExecStart = "${cmd} start";
-        ExecStop = "${cmd} stop";
+        ExecStop = [
+          "${cmd} stop"
+          "${lib.getExe' pkgs.util-linux "waitpid"} -t 30 -e $MAINPID"
+        ];
         Restart = "always";
-        TimeoutSec = "5min";
         User = "unifi";
         UMask = "0077";
         WorkingDirectory = "${stateDir}";
-        # the stop command exits while the main process is still running, and unifi
-        # wants to manage its own child processes. this means we have to set KillSignal
-        # to something the main process ignores, otherwise every stop will have unifi.service
-        # fail with SIGTERM status.
-        KillSignal = "SIGCONT";
 
         # Hardening
         AmbientCapabilities = "";

nixos/modules/services/security/crowdsec-firewall-bouncer.nix

@@ -301,17 +301,24 @@ in
               # Replace the api_key placeholder with the secret
               ${lib.getExe pkgs.replace-secret} '@API_KEY_FILE@' "$CREDENTIALS_DIRECTORY/API_KEY_FILE" ${final-config-file}
             '';
+
+            isIptables = (cfg.settings.mode == "iptables") || (cfg.settings.mode == "ipset");
+            isNftables = cfg.settings.mode == "nftables";
           in
           rec {
             description = "CrowdSec Firewall Bouncer";
             wantedBy = [ "multi-user.target" ];
-            after = [ "network.target" ] ++ (lib.optional config.services.crowdsec.enable "crowdsec.service");
+            partOf = lib.optional isNftables "nftables.service" ++ lib.optional isIptables "firewall.service";
+            after =
+              lib.optional isNftables "nftables.service"
+              ++ lib.optional isIptables "firewall.service"
+              ++ lib.optional config.services.crowdsec.enable "crowdsec.service";
             wants = after;
             requires = lib.optional cfg.registerBouncer.enable "crowdsec-firewall-bouncer-register.service";
 
             # When using iptables/ipset modes, the bouncer calls external binaries so they must be added to the path.
             # For nftables mode, it does not depend on external binaries.
-            path = lib.optionals ((cfg.settings.mode == "iptables") || (cfg.settings.mode == "ipset")) [
+            path = lib.optionals isIptables [
               pkgs.iptables
               pkgs.ipset
             ];
@@ -381,6 +388,9 @@ in
   };
 
   meta = {
-    maintainers = with lib.maintainers; [ nicomem ];
+    maintainers = with lib.maintainers; [
+      nicomem
+      tornax
+    ];
   };
 }

nixos/modules/services/web-servers/lighttpd/cgit.nix

@@ -13,6 +13,7 @@ let
   configFile = pkgs.writeText "cgitrc" ''
     # default paths to static assets
     css=${pathPrefix}/cgit.css
+    js=${pathPrefix}/cgit.js
     logo=${pathPrefix}/cgit.png
     favicon=${pathPrefix}/favicon.ico
 
@@ -82,6 +83,7 @@ in
           )
           alias.url = (
               "${pathPrefix}/cgit.css" => "${pkgs.cgit}/cgit/cgit.css",
+              "${pathPrefix}/cgit.js" => "${pkgs.cgit}/cgit/cgit.js",
               "${pathPrefix}/cgit.png" => "${pkgs.cgit}/cgit/cgit.png",
               "${pathPrefix}"          => "${pkgs.cgit}/cgit/cgit.cgi"
           )

nixos/modules/system/activation/test.nix

@@ -13,7 +13,10 @@ let
         text = "${expect.dev}";
       };
       documentation.enable = false;
-      fileSystems."/".device = "ignore-root-device";
+      fileSystems."/" = {
+        device = "ignore-root-device";
+        fsType = "none";
+      };
       boot.loader.grub.enable = false;
 
       # Don't do this in an actual config
@@ -26,7 +29,10 @@ let
       system.forbiddenDependenciesRegexes = [ "-dev$" ];
       system.extraDependencies = [ expect.dev ];
       documentation.enable = false;
-      fileSystems."/".device = "ignore-root-device";
+      fileSystems."/" = {
+        device = "ignore-root-device";
+        fsType = "none";
+      };
       boot.loader.grub.enable = false;
 
       # Don't do this in an actual config

nixos/modules/system/service/systemd/test.nix

@@ -93,7 +93,10 @@ let
 
       # irrelevant stuff
       system.stateVersion = "25.05";
-      fileSystems."/".device = "/test/dummy";
+      fileSystems."/" = {
+        device = "/test/dummy";
+        fsType = "auto";
+      };
       boot.loader.grub.enable = false;
     }
   );

nixos/modules/tasks/filesystems.nix

@@ -122,7 +122,6 @@ let
         };
 
         fsType = mkOption {
-          default = "auto";
           example = "ext3";
           type = nonEmptyStr;
           description = ''

nixos/modules/virtualisation/qemu-vm.nix

@@ -1453,6 +1453,7 @@ in
             else
               {
                 device = "/nix/.ro-store";
+                fsType = "none";
                 options = [ "bind" ];
               }
           );

nixos/release.nix

@@ -172,6 +172,7 @@ let
               { ... }:
               {
                 fileSystems."/".device = mkDefault "/dev/sda1";
+                fileSystems."/".fsType = mkDefault "auto";
                 boot.loader.grub.device = mkDefault "/dev/sda";
               }
             );
@@ -476,7 +477,10 @@ rec {
           modules = singleton (
             { ... }:
             {
-              fileSystems."/".device = mkDefault "/dev/sda1";
+              fileSystems."/" = {
+                device = mkDefault "/dev/sda1";
+                fsType = "ext4";
+              };
               boot.loader.grub.device = mkDefault "/dev/sda";
               system.stateVersion = mkDefault lib.trivial.release;
             }

nixos/tests/appliance-repart-image-verity-store.nix

@@ -32,6 +32,7 @@
         # bind-mount the store
         "/nix/store" = {
           device = "/usr/nix/store";
+          fsType = "none";
           options = [ "bind" ];
         };
       };

nixos/tests/early-mount-options.nix

@@ -4,6 +4,7 @@
 
   nodes.machine = {
     virtualisation.fileSystems."/var" = {
+      fsType = "none";
       options = [
         "bind"
         "nosuid"

nixos/tests/engelsystem.nix

@@ -2,7 +2,10 @@
 {
   name = "engelsystem";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ talyz ];
+    maintainers = [
+      talyz
+      tmarkus
+    ];
   };
 
   nodes.engelsystem =

nixos/tests/grow-partition.nix

@@ -30,6 +30,7 @@ let
 
       fileSystems = {
         "/".device = rootFsDevice;
+        "/".fsType = "ext4";
       };
 
       # Needed for installing bootloader

nixos/tests/home-assistant.nix

@@ -80,7 +80,6 @@ in
           # without these some components that are loaded anyway fail to find
           # their dependencies
           default_config = { };
-          infrared = { };
 
           # include some popular integrations, that absolutely shouldn't break
           knx = { };

nixos/tests/image-contents.nix

@@ -19,7 +19,10 @@ let
         ../modules/testing/test-instrumentation.nix
         ../modules/profiles/qemu-guest.nix
         {
-          fileSystems."/".device = "/dev/disk/by-label/nixos";
+          fileSystems."/" = {
+            device = "/dev/disk/by-label/nixos";
+            fsType = "ext4";
+          };
           boot.loader.grub.device = "/dev/vda";
           boot.loader.timeout = 0;
           nixpkgs.pkgs = pkgs;

nixos/tests/litestream.nix

@@ -1,4 +1,8 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
+let
+  dbPath = "/var/lib/grafana/data/grafana.db";
+  socketPath = "/run/litestream/litestream.sock";
+in
 {
   name = "litestream";
   meta = with pkgs.lib.maintainers; {
@@ -11,38 +15,53 @@
       services.litestream = {
         enable = true;
         settings = {
+          socket = {
+            enabled = true;
+            path = socketPath;
+          };
           dbs = [
             {
-              path = "/var/lib/grafana/data/grafana.db";
+              path = dbPath;
               replicas = [
                 {
                   url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
+                  auto-recover = true;
                 }
               ];
             }
           ];
         };
       };
-      systemd.services.grafana.serviceConfig.ExecStartPost =
-        "+"
-        + pkgs.writeShellScript "grant-grafana-permissions" ''
-          timeout=10
-
-          while [ ! -f /var/lib/grafana/data/grafana.db ];
-          do
-            if [ "$timeout" == 0 ]; then
-              echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
-              exit 1
-            fi
-
-            sleep 1
-
-            ((timeout--))
-          done
-
-          find /var/lib/grafana -type d -exec chmod -v 775 {} \;
-          find /var/lib/grafana -type f -exec chmod -v 660 {} \;
-        '';
+      # Litestream 0.5.x writes to the database (_litestream_seq table),
+      # so grafana's data directory must be group-writable.
+      systemd.tmpfiles.settings."10-litestream" = {
+        "/var/lib/grafana".d = {
+          mode = "0750";
+          user = "grafana";
+          group = "grafana";
+        };
+        "/var/lib/grafana/data".d = {
+          mode = "2770";
+          user = "grafana";
+          group = "grafana";
+        };
+      };
+      systemd.services.grafana.serviceConfig = {
+        ExecStartPre = lib.mkAfter "+${pkgs.sqlite}/bin/sqlite3 ${dbPath} 'PRAGMA journal_mode=WAL;'";
+        UMask = lib.mkForce "0007";
+      };
+      systemd.services.litestream = {
+        after = [
+          "grafana.service"
+          "sshd.service"
+        ];
+        requires = [ "grafana.service" ];
+        wants = [ "sshd.service" ];
+        serviceConfig = {
+          RuntimeDirectory = "litestream";
+          ExecStartPre = "+/bin/sh -c 'chmod g+rw ${dbPath}*'";
+        };
+      };
       services.openssh = {
         enable = true;
         allowSFTP = true;
@@ -59,6 +78,7 @@
           security = {
             admin_user = "admin";
             admin_password = "admin";
+            secret_key = "SW2YcwTIb9zpOOhoPsMm";
           };
 
           server = {
@@ -68,7 +88,7 @@
 
           database = {
             type = "sqlite3";
-            path = "/var/lib/grafana/data/grafana.db";
+            path = dbPath;
             wal = true;
           };
         };
@@ -78,35 +98,44 @@
         password = "bar";
       };
       users.users.litestream.extraGroups = [ "grafana" ];
+      environment.systemPackages = [ pkgs.sqlite ];
     };
 
   testScript = ''
     start_all()
-    machine.wait_until_succeeds("test -d /home/foo/grafana")
     machine.wait_for_open_port(3000)
-    machine.succeed("""
-        curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
-          "oldPassword": "admin",
-          "newPassword": "newpass",
-          "confirmNew": "newpass"
-        }' http://admin:admin@127.0.0.1:3000/api/user/password
-    """)
-    # https://litestream.io/guides/systemd/#simulating-a-disaster
-    machine.systemctl("stop litestream.service")
-    machine.succeed(
-        "rm -f /var/lib/grafana/data/grafana.db "
-        "/var/lib/grafana/data/grafana.db-shm "
-        "/var/lib/grafana/data/grafana.db-wal"
-    )
-    machine.succeed(
-        "litestream restore /var/lib/grafana/data/grafana.db "
-        "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
-        "&& chmod 660 /var/lib/grafana/data/grafana.db"
-    )
-    machine.systemctl("restart grafana.service")
-    machine.wait_for_open_port(3000)
-    machine.succeed(
-        "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
-    )
+    with subtest("Verify litestream replicates changes"):
+        machine.succeed("""
+            curl -sSfN -X PUT --json '{
+              "name": "LitestreamTest",
+              "login": "admin",
+              "email": "admin@localhost"
+            }' http://admin:admin@127.0.0.1:3000/api/user
+        """)
+        machine.succeed("litestream sync -wait -socket ${socketPath} ${dbPath}")
+        machine.succeed(
+            "litestream restore -o /tmp/restored.db ${dbPath} && "
+            "sqlite3 /tmp/restored.db '.dump' | grep -q LitestreamTest"
+        )
+
+    with subtest("Simulate disaster recovery"):
+        # https://litestream.io/guides/systemd/#simulating-a-disaster
+        machine.systemctl("stop litestream.service grafana.service")
+        machine.succeed(
+            "rm -f ${dbPath} "
+            "${dbPath}-shm "
+            "${dbPath}-wal"
+        )
+        machine.succeed(
+            "litestream restore ${dbPath} "
+            "&& chown grafana:grafana ${dbPath} "
+            "&& chmod 660 ${dbPath}"
+        )
+        machine.systemctl("restart grafana.service litestream.service")
+        machine.wait_for_open_port(3000)
+        machine.wait_for_unit("litestream.service")
+        machine.succeed(
+            "curl -sSfN -u admin:admin http://127.0.0.1:3000/api/user | grep LitestreamTest"
+        )
   '';
 }

nixos/tests/non-default-filesystems.nix

@@ -18,6 +18,7 @@ with pkgs.lib;
         virtualisation.fileSystems."/test-bind-dir/bind" = {
           device = "/";
           neededForBoot = true;
+          fsType = "none";
           options = [ "bind" ];
         };
 
@@ -25,6 +26,7 @@ with pkgs.lib;
           depends = [ "/nix/store" ];
           device = builtins.toFile "empty" "";
           neededForBoot = true;
+          fsType = "none";
           options = [ "bind" ];
         };
       };

nixos/tests/prometheus-exporters.nix

@@ -1540,26 +1540,6 @@ let
         '';
       };
 
-    rspamd =
-      { ... }:
-      {
-        exporterConfig = {
-          enable = true;
-        };
-        metricProvider = {
-          services.rspamd.enable = true;
-        };
-        exporterTest = ''
-          wait_for_unit("rspamd.service")
-          wait_for_unit("prometheus-rspamd-exporter.service")
-          wait_for_open_port(11334)
-          wait_for_open_port(7980)
-          wait_until_succeeds(
-              "curl -sSf 'localhost:7980/probe?target=http://localhost:11334/stat' | grep 'rspamd_scanned{host=\"rspamd\"} 0'"
-          )
-        '';
-      };
-
     rtl_433 =
       { ... }:
       {

nixos/tests/qemu-vm-external-disk-image.nix

@@ -23,6 +23,7 @@ let
 
       fileSystems = {
         "/".device = rootFsDevice;
+        "/".fsType = "ext4";
       };
 
       system.switch.enable = true;

nixos/tests/systemd-initrd-luks-password.nix

@@ -32,7 +32,10 @@
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
         # test mounting device unlocked in initrd after switching root
-        virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
+        virtualisation.fileSystems."/cryptroot2" = {
+          device = "/dev/mapper/cryptroot2";
+          fsType = "auto";
+        };
       };
     };
 

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -75,7 +75,10 @@ in
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
         virtualisation.fileSystems."/".autoFormat = true;
         # test mounting device unlocked in initrd after switching root
-        virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
+        virtualisation.fileSystems."/cryptroot2" = {
+          device = "/dev/mapper/cryptroot2";
+          fsType = "auto";
+        };
       };
     };
 

nixos/tests/unifi.nix

@@ -21,8 +21,19 @@
 
     machine.wait_for_unit("unifi.service")
     machine.wait_for_open_port(8880)
+    machine.succeed("systemctl show unifi.service | grep -q 'ActiveState=active'")
+    machine.succeed("pgrep mongod")
 
     status = json.loads(machine.succeed("curl --silent --show-error --fail-with-body http://localhost:8880/status"))
     assert status["meta"]["rc"] == "ok"
+
+    machine.succeed("systemctl stop unifi.service")
+    machine.succeed("systemctl show unifi.service | grep -q 'ActiveState=inactive'")
+    machine.fail("pgrep mongod")
+
+    machine.succeed("systemctl start unifi.service")
+    machine.wait_for_unit("unifi.service")
+    machine.succeed("systemctl show unifi.service | grep -q 'ActiveState=active'")
+    machine.succeed("pgrep mongod")
   '';
 }

nixos/tests/vm-variant.nix

@@ -10,7 +10,10 @@ let
     modules = [
       {
         system.stateVersion = "25.05";
-        fileSystems."/".device = "/dev/null";
+        fileSystems."/" = {
+          device = "/dev/null";
+          fsType = "none";
+        };
         boot.loader.grub.device = "nodev";
         nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system;
         virtualisation.vmVariant.networking.hostName = "vm";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -378,6 +378,10 @@ assertNoAdditions {
       "catppuccin.groups.integrations.noice"
       "catppuccin.groups.integrations.feline"
       "catppuccin.lib.vim.init"
+
+      # TODO(@mrcjkb): re-enable when https://github.com/catppuccin/nvim/pull/995
+      # has been merged and released.
+      "catppuccin.lib.detect_integrations"
     ];
   };
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4458,8 +4458,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "2.2.0";
-          hash = "sha256-N23nzAI0cBNeX7txsgxKXhSUrcOGM9rjnMIJNK4OYFY=";
+          version = "2.2.1";
+          hash = "sha256-VnJ2OZe2KPo/QfZquxDZ3SMQncRWnAHBTTtfdJVBlpo=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";

pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-supafaust";
-  version = "0-unstable-2024-09-30";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "supafaust";
-    rev = "e25f66765938d33f9ad5850e8d6cd597e55b7299";
-    hash = "sha256-ZgOXHhEHt54J2B1q6uA8v6uOK53g7idJlgoC4guTGow=";
+    rev = "584ef2c5571f1ece95f6117aa04b7e8fee213fb1";
+    hash = "sha256-aptn3igUIvU/ho+6iXAg0J7X5ymdWeTM+zL+BA06tG4=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-03-28";
+  version = "0-unstable-2026-04-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "7290e95232faacb0c31b0b12cb0884bb9f6e8cfc";
-    hash = "sha256-vYryEUrYauVGGjmePCUnGdCpOGKUFxSI4tkFCt7wKs8=";
+    rev = "f659af2c3bec122d3e628e1e1634e746e67005e4";
+    hash = "sha256-cK2c611fBEDcRK1I7VMLL+Ih76FMWlEGhmhg53KampU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/gpsp.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2026-01-27";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "602512d7c687acb84cd56265cbcf2d7b7c75fb37";
-    hash = "sha256-YloLG2anJJ1hcVltN+d8XsshgZoDBrFRgRoQA7mfhN8=";
+    rev = "6373ff347a07ac17c50a00f20aa63d29c080abcf";
+    hash = "sha256-1aLSJ0oB8WJnIfKHHdwBQ52uVPs1XiFZvgFgrF9zUoA=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/hatari.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "hatari";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "hatari";
-    rev = "7008194d3f951a157997f67a820578f56f7feee0";
-    hash = "sha256-ZPzwUBaxs2ivE9n9cb5XB5mhixY9b6qIlq7OiVSLbqg=";
+    rev = "00af13a379e7839399ff2939807f050b7fc49a0e";
+    hash = "sha256-mPe9+RX9DsrJkmydXqEBrR7EMwijhjj/yJPB2QlK3/U=";
   };
 
   extraNativeBuildInputs = [ which ];

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-04-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "a10380b436c2103cad06826d64e10ca90692a08b";
-    hash = "sha256-M9/GTOiXcZc5J2SxSDzDEYDMBC1zMR/zAhvbgZEwBlk=";
+    rev = "4162ead798f816b4f08b1af9eafefe3d022331bf";
+    hash = "sha256-doujon1GCXrmgYRWf3aGIpOFyOtj2U1DoaClGpaS1L0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2026-03-10";
+  version = "0-unstable-2026-04-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "53453e57676ff31131441f08c0b734c9ad84e4f0";
-    hash = "sha256-IpVv/bpT7AHF8QaGFGgTWei5JKuy7H5/O70W2n88s1c=";
+    rev = "3da943f4bcf264c7af83a07b78617e98ce3822cd";
+    hash = "sha256-3hJj8BLePPdEEsQriHSWhIMhamr7pvpKswP5/RxtjcM=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/meteor.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "meteor";
-  version = "0-unstable-2020-12-28";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "meteor-libretro";
-    rev = "e533d300d0561564451bde55a2b73119c768453c";
-    hash = "sha256-zMkgzUz2rk0SD5ojY4AqaDlNM4k4QxuUxVBRBcn6TqQ=";
+    rev = "13ac21ccdb81c8a99fddebf5b29482f19194ec88";
+    hash = "sha256-AUn8gTtlFaosKTlcmJCmwdDeEvXwRjkkvht+JXkM36U=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/neocd.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "neocd";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "neocd_libretro";
-    rev = "5eca2c8fd567b5261251c65ecafa8cf5b179d1d2";
-    hash = "sha256-72tmPCb7AXsamaQsMAPiYpgDR8DER2GTz4hcbN8wy7g=";
+    rev = "9216ca226f24e01e77fc2670035e97da154f3de4";
+    hash = "sha256-Mq9UOuPwmG2Di68jWUgCbBvG3jUCEMON8Kfly/aCdH4=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/puae.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "puae";
-  version = "0-unstable-2026-03-24";
+  version = "0-unstable-2026-04-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-uae";
-    rev = "b26def5c5ab9ea35019a42b950e014a22907ea13";
-    hash = "sha256-DoNYpEqlrWueh/rwB4pkPYPdkSi+EVxP5T6BPgqv1nU=";
+    rev = "99145bf34993e21dac14973f784821d85729a91d";
+    hash = "sha256-VIg7e6St1qkQZafTmEMsIDZoWQLkqFZPRk4Cyr43wW8=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/quicknes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "quicknes";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "QuickNES_Core";
-    rev = "dbf19f73e3eb9701d1c7f5898f57c097e05c9fbd";
-    hash = "sha256-oFQUMp1imc8JCsQYCy1BtIUmTC+u0VcoYHpWzUpKNb4=";
+    rev = "71782569078f29214017a966b0f992b9e512bf19";
+    hash = "sha256-Bx1iZcrUG5B/wjeWf2hZEAIocM7dKgRwRPqpGzS2Cgc=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/smsplus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "smsplus";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "smsplus-gx";
-    rev = "c642bbd0680b5959180a420036108893d0aec961";
-    hash = "sha256-SHBrwzLyVZ4Tp/kVCnr4xj2B3pmdg+JUmZUM7hYao64=";
+    rev = "41212ee3309fcf84ef0c04317a0916f0e1252c00";
+    hash = "sha256-7IKnFdSYCVrwjvtP4cTxQCCKANYSVVR6IwrhnjzqPPg=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/snes9x2002.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x2002";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2002";
-    rev = "a0709ec7dcd6de2fbebb43106bd757b649e3b7cf";
-    hash = "sha256-rrMPhXIsQ48fVvjgZgC3xeqm9k9kwe43oZNzs2d/h1Q=";
+    rev = "15826a2afc1474b30c310502b5dbe25c639be59d";
+    hash = "sha256-LVTtpnmZzmKCohFwc74qLMR6cN4ntT/o/OUQOg6mdU0=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2010.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2024-11-19";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "f9ae8fd28b13070a945a829ccf41cbf90a21d0f7";
-    hash = "sha256-nsExAYnzDenPvXzeN60jGykRTrCGMi/mRPV+vgS8ZtE=";
+    rev = "693c0dd2a3004a6332a076a08d14c78086f26bc1";
+    hash = "sha256-/+VdaLY6JycN2o1/LOPFIOmcp6ZVAqpX1MVuHN3B/Nc=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];

pkgs/applications/emulators/libretro/cores/virtualjaguar.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "virtualjaguar";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "virtualjaguar-libretro";
-    rev = "48096c1f6f8b98cfff048a5cb4e6a86686631072";
-    hash = "sha256-DLBQQARHqupGGQS8YznDSSMuxQliyt5apGA4Ku2jlYo=";
+    rev = "68265f930f6120f8f05c1f71c9fc9e417dab0d28";
+    hash = "sha256-BWpOm0DECqTqbQ1FR9YgjxjsxU7LdB4MlYHzGatcrJk=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -73,13 +73,13 @@
     "vendorHash": "sha256-CO09y7rdbY27VFX85pV2ocnO0rvhGJg3hXfLWaF+HTI="
   },
   "auth0_auth0": {
-    "hash": "sha256-JQC8532P5+PXCzqzxl9YUjhuEbd07WzJv7tfhJWyk3c=",
+    "hash": "sha256-1gtBZPyzYk3UqLrRKHeyLt/2KPPP6QlJYo042XNDWkY=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.41.0",
+    "rev": "v1.42.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JPgRr5DcAOkzUy24aUAjqhW6VhpITKxDA+55dNKrGu4="
+    "vendorHash": "sha256-g1xtMHyQ1zD5dzfB2+MtVUo42RG95TX9uni3Hf8FiRQ="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -463,22 +463,22 @@
     "vendorHash": "sha256-/8h2bmesnFz3tav3+iDelZSjp1Z9lreexwcw0WdYekA="
   },
   "goharbor_harbor": {
-    "hash": "sha256-YrFGx/xHd2Z0G6ZidHnOCY9RtcsjReUWXfiLhdDGmWM=",
+    "hash": "sha256-+HhtRod8VNOE6KceWIviWDCPvPuLK9/WaKrgT27GUpw=",
     "homepage": "https://registry.terraform.io/providers/goharbor/harbor",
     "owner": "goharbor",
     "repo": "terraform-provider-harbor",
-    "rev": "v3.11.3",
+    "rev": "v3.11.5",
     "spdx": "MIT",
-    "vendorHash": "sha256-mzDFyk2oImRXt72kFV5Ln++ScgoecpJEJtzUKjvCaws="
+    "vendorHash": "sha256-yOM4JcQxAvYAFPyAFfjJn4FK8pEXF3I55ddMTkijn9c="
   },
   "grafana_grafana": {
-    "hash": "sha256-nt6C5pKvg1fCYUa9ptYGonV4fEu8mOySP2W4lUQbFe4=",
+    "hash": "sha256-eYVNiyD3hFxE9dqlyfsOZBaX6xVec0uPAuquOdxg78A=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v4.28.2",
+    "rev": "v4.29.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CkIb5zi4w7uZ+UvclOZcbCpu3R2bg5p9SdBk0x4qovY="
+    "vendorHash": "sha256-9fBGjh/kstnMHi9aWQoq0tqJfDWoKHESlQwBoRA+8oA="
   },
   "gridscale_gridscale": {
     "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-picwxtQOtsBX8SkA64+ekFNDC7zIpg0CG66kelO2THk="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-68SdqhF4RA/rjVm89yAZb8MRdDPrcqrQ6lc3tJTIeng=",
+    "hash": "sha256-tcDnXPoiwGcy4tW3r/YMM+eivGur90TeAZO5gWhT7DA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.77.0",
+    "rev": "v1.78.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tlxuUXJAAP/9hmyEJI9foMD+CeOosFrXfp/06fZVvSA="
+    "vendorHash": "sha256-z2KPnztWBOlKTIwloRGdT1GMjBewQ1FlJgZkoGFK7XY="
   },
   "hashicorp_azuread": {
     "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -959,13 +959,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-ZBxkDXXeYgvoOzDqJH6iy/yz7lXDt8fEsvEMnU+EgkQ=",
+    "hash": "sha256-W5eEK39KkKOTfZb6KOOTwvRD1nrZkY4FuZt+9Imu9nw=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.82.0",
+    "rev": "v3.84.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BjBzWdCU/gNZOsh5gp76LuGUgwiUc/TlOTJ6vjP8tyI="
+    "vendorHash": "sha256-CQVlU/V25pDz5shBpCztA3w/FVfGjLjLDHf7ky9LQHc="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",

pkgs/applications/version-management/cgit/default.nix

@@ -25,19 +25,19 @@
 
 stdenv.mkDerivation {
   pname = "cgit";
-  version = "1.2.3";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.2.3.tar.xz";
-    sha256 = "193d990ym10qlslk0p8mjwp2j6rhqa7fq0y1iff65lvbyv914pss";
+    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz";
+    sha256 = "836b6edbc7f99e11037a8b928d609ce346ed77a55545e17fff8cea59b5b7aa42";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
   # IMPORTANT: Remember to check which git version cgit needs on every version
   # bump (look for "GIT_VER" in the top-level Makefile).
   gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.25.1.tar.xz";
-    sha256 = "09lzwa183nblr6l8ib35g2xrjf9wm9yhk3szfvyzkwivdv69c9r2";
+    url = "mirror://kernel/software/scm/git/git-2.53.0.tar.xz";
+    hash = "sha256-WBi9fYCwYbu9/sikM9YJ3IgYoFmR9zH/xKVh4soYxlM=";
   };
 
   separateDebugInfo = true;
@@ -92,15 +92,9 @@ stdenv.mkDerivation {
     "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
-  # Install manpage.
   postInstall = ''
-    # xmllint fails:
-    #make install-man
-
-    # bypassing xmllint works:
-    a2x --no-xmllint -f manpage cgitrc.5.txt
-    mkdir -p "$out/share/man/man5"
-    cp cgitrc.5 "$out/share/man/man5"
+    # Install manpage.
+    make install-man $makeFlags
 
     wrapPythonProgramsIn "$out/lib/cgit/filters" "$out ''${pythonPath[*]}"
 

pkgs/applications/video/kodi/addons/youtube/default.nix

@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.4.1.1";
+  version = "7.4.2";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-fut9FTs87/EXpZ2PjIvhHL4001k3+i519m9ccMR1o+I=";
+    hash = "sha256-o+HaYVUvulHzthnP/PUJ0qTe0e901djw3l9sVpUcD08=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "3.1.5";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-MelIMAy+9LiSlYwDdS8mbgttyZ6rvGFS5TKMas8LzCM=";
+    sha256 = "sha256-YA66qSCchZbA5TowOqn1FNvAtPzxREIChVJleoaImxk=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/build-support/trivial-builders/default.nix

@@ -1045,7 +1045,7 @@ rec {
         passthru = extraPassthru // finalAttrs.src.passthru or { };
 
         # Carry (and merge) information from the underlying `src` if present.
-        meta = lib.optionalAttrs (src ? meta) (removeAttrs finalAttrs.src.meta [ "position" ]);
+        meta = lib.optionalAttrs (finalAttrs.src ? meta) (removeAttrs finalAttrs.src.meta [ "position" ]);
       };
   };
 

pkgs/by-name/ac/acli/sources.json

@@ -1,21 +1,21 @@
 {
-  "version": "1.3.14-stable",
+  "version": "1.3.17-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.14-stable/acli_1.3.14-stable_darwin_arm64.tar.gz",
-      "sha256": "1400b04908d4b099783dba261ba79ab6e09da67cf78d2ca35fb2456e99211634"
+      "url": "https://acli.atlassian.com/darwin/1.3.17-stable/acli_1.3.17-stable_darwin_arm64.tar.gz",
+      "sha256": "db630d0ce82777d47c5cb647a622cd30f38fedefa6b8e1e6f62c1ca3c0974d1f"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.14-stable/acli_1.3.14-stable_linux_arm64.tar.gz",
-      "sha256": "b8742f5c3d4f5e1d5f531c1e50bcc775f272b2909e481c43ddd615808c77f156"
+      "url": "https://acli.atlassian.com/linux/1.3.17-stable/acli_1.3.17-stable_linux_arm64.tar.gz",
+      "sha256": "59dc9405f6de0a70f8f82e328fdd6db3fc564d28aef38d14c08431a8b130ba36"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.14-stable/acli_1.3.14-stable_darwin_amd64.tar.gz",
-      "sha256": "0c66ff14f0db7a27a1d7e70ff03b8cbfde9bc019450539c0f6707de2dc908dd9"
+      "url": "https://acli.atlassian.com/darwin/1.3.17-stable/acli_1.3.17-stable_darwin_amd64.tar.gz",
+      "sha256": "043e3b80f08cf4fc09dd52f0432500f5de28902d8c85d848128c5931f766af45"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.14-stable/acli_1.3.14-stable_linux_amd64.tar.gz",
-      "sha256": "2c76293e9ba9ce6a233756b13e9c3eea1fc3fce992fc0ccefe8c32f6dbf36f29"
+      "url": "https://acli.atlassian.com/linux/1.3.17-stable/acli_1.3.17-stable_linux_amd64.tar.gz",
+      "sha256": "6177dd5950b0a27f14e8b2daf41e93cf30a306c2e2ee61b13a22f572cbf2f4ff"
     }
   }
 }

pkgs/by-name/ai/aider-chat/package.nix

@@ -37,6 +37,9 @@ let
 
     pythonRemoveDeps = [
       "importlib-resources"
+      "tree-sitter-c-sharp"
+      "tree-sitter-embedded-template"
+      "tree-sitter-yaml"
     ];
 
     build-system = with python3Packages; [ setuptools-scm ];
@@ -200,6 +203,10 @@ let
       "test_main_exit_calls_version_check"
       # AssertionError: assert 2 == 1
       "test_simple_send_non_retryable_error"
+      # Upstream tests incompatible with current litellm version
+      "test_max_context_tokens"
+      "test_cmd_tokens_output"
+      "test_cmd_read_only_with_image_file"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # Tests fails on darwin

pkgs/by-name/ai/airwindows/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2026-03-14";
+  version = "0-unstable-2026-04-01";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "36106b00885d81efa9ac9a8c387e3431abac0471";
-    hash = "sha256-xf+gRy8t3uXpGwsVhPyO8J4YQ806KDZ1muR6A/7AhGM=";
+    rev = "974a26ea5a96a3cd57c3f8f8d95745bb765a5a72";
+    hash = "sha256-Gin8I86TpLVG9SzfErVZobryW3rZQEidwLrUb7sd+rs=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.3";
+  version = "3.3.4";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v44QWIpFTfUD7gOaQGwJ12MvtO4rMS69rCZr4Hv/e3k=";
+    hash = "sha256-Ykq7UkpGy9w3VQ2LcGsdREN0na0F7Mj9RxVu8iLr96s=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/am/amber-secret/package.nix

@@ -7,16 +7,16 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   # Renaming it to amber-secret because another package named amber exists
   pname = "amber-secret";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "fpco";
     repo = "amber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nduSnDhLvHpZD7Y1zeZC4nNL7P1qfLWc0yMpsdqrKHM=";
+    hash = "sha256-nBC/IJgad7/LaKfQ4d+aynKmzwd2t3VcPcUVlWHByzI=";
   };
 
-  cargoHash = "sha256-Gwj0rnbKWifja5NJwskcrFpPoK15HjSQHXolGbgV784=";
+  cargoHash = "sha256-svHEeCcudQ4fXxAcYkz8Y8NJ8ATQacXIWXF1c5shom0=";
 
   meta = {
     description = "Manage secret values in-repo via public key cryptography";

pkgs/by-name/an/anytone-emu/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "anytone-emu";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "dmr-tools";
     repo = "anytone-emu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kaXD4mIoEikl9HoS/FfIX0oRAKkZHiwIfNWj0CLazPc=";
+    hash = "sha256-RTYLtVCKP2TW7Ery51POEZuCtyRhkgKhoDhJPe18y80=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ar/argocd/package.nix

@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
   # set ldflag for kubectlVersion since it is needed for argo
   # Per https://github.com/search?q=repo%3Aargoproj%2Fargo-cd+%22KUBECTL_VERSION%3D%22+path%3AMakefile&type=code
   prePatch = ''
-    export KUBECTL_VERSION=$(grep 'k8s.io/kubectl v' go.mod | cut -f 2 -d " " | cut -f 1 -d "=" )
+    export KUBECTL_VERSION=$(go list -m -f '{{.Version}}' k8s.io/kubectl)
     echo using $KUBECTL_VERSION
     ldflags="''${ldflags} -X github.com/argoproj/argo-cd/v3/common.kubectlVersion=''${KUBECTL_VERSION}"
   '';

pkgs/by-name/ar/argonaut/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "argonaut";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "darksworm";
     repo = "argonaut";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LDw2/8l/jipCVIMYeco08LukIfx3Kk1ROXkvU69SK5g=";
+    hash = "sha256-F67DyH0aJ4SmlCIj1i65yB5rFXZB0j5BREssS3V3WZQ=";
   };
 
-  vendorHash = "sha256-xln/WmZbi0+rHqMMHRgt0ar/EaBDNscCsd/NckJZnMw=";
+  vendorHash = "sha256-4AmciHL4CGtEwDAs7eAtjfWlzjoCLXAN2HEatev8gZg=";
   proxyVendor = true;
   subPackages = [ "cmd/app" ];
   ldflags = [

pkgs/by-name/at/atlauncher/package.nix

@@ -27,13 +27,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.40.3";
+  version = "3.4.40.4";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QFPdEH3V9Krwy/cWCbY+IMtW0ydVCqKr/OZfttZGCss=";
+    hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/attyx/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "attyx";
-  version = "0.2.47";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "semos-labs";
     repo = "attyx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fREiPiBTzzJtFEPWOISiZ/BI5lZmPyn80oAXohEEGig=";
+    hash = "sha256-FfHU+XZnMN3HqQFtNEZtYu3YMvBk32QcEP71plDtvjY=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };

pkgs/by-name/au/automatic-timezoned/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "automatic-timezoned";
-  version = "2.0.124";
+  version = "2.0.125";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-B7cfrO3Kz1xS9htjZXXLQaFvbc0g4fowParTVvXdqA8=";
+    sha256 = "sha256-YYI0ISLaOcKZu2AFf08DmriApTLKdUUgLF5AhEhGf04=";
   };
 
-  cargoHash = "sha256-YQV5e9/iTvx76ch6D/iNGgWJaa3rAr6dN8mlEXtatDs=";
+  cargoHash = "sha256-jhsW33xDTDBDi2ySSwePjjNmIFKKm6ZnP5xklvB4+Iw=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/aw/aw-watcher-window-wayland/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "aw-watcher-window-wayland";
-  version = "0-unstable-2025-12-31";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "ActivityWatch";
     repo = "aw-watcher-window-wayland";
-    rev = "aea9aca029bd33d373bf53946a16dc05ef81e0b3";
-    hash = "sha256-3o3IVf2YeZ1qGokezPvuLnUaqiA/uzm4wCXvgNHIMW4=";
+    rev = "c14e6fbaf1b811a46ec6b5c27d8656f0976a1850";
+    hash = "sha256-U1tFdglzO5YcGPfzVAprol8bdQ1mO7OP1Q6gShG/fbk=";
   };
 
   cargoHash = "sha256-WWT8tOrHPf5x3bXsVPt32VKut4qK+K8gickBfEc0zmk=";

pkgs/by-name/aw/aws-lambda-rie/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.33";
+  version = "1.35";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-runtime-interface-emulator";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-p3Tw5wpMiFL46FyX6NKaKv47jjFnlS27/Q4pc2nzdzs=";
+    sha256 = "sha256-tO7ru3sdCWbdALcOmxQny7ak96utgABUvIaGThZRedw=";
   };
 
   vendorHash = "sha256-+7BuDaN1ns63cQOMKuRMjBo9GnLrmsubx/KppUsyheY=";

pkgs/by-name/aw/awscli2/package.nix

@@ -54,28 +54,29 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.33.2"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.34.24"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-dAtcYDdrZASrwBjQfnZ4DUR4F5WhY59/UX92QcILavs=";
+    hash = "sha256-PDoztQYKfH6FjdSyMQGsT8No3LB56naQ/AxTPN/dslQ=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'flit_core>=3.7.1,<3.9.1' 'flit_core>=3.7.1' \
+      --replace-fail 'flit_core>=3.7.1,<3.12.1' 'flit_core>=3.7.1' \
       --replace-fail 'awscrt==' 'awscrt>=' \
       --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \
       --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \
       --replace-fail 'prompt-toolkit>=3.0.24,<3.0.52' 'prompt-toolkit>=3.0.24' \
-      --replace-fail 'ruamel.yaml>=0.15.0,<=0.17.21' 'ruamel.yaml>=0.15.0' \
-      --replace-fail 'ruamel.yaml.clib>=0.2.0,<=0.2.12' 'ruamel.yaml.clib>=0.2.0'
+      --replace-fail 'ruamel_yaml>=0.15.0,<=0.19.1' 'ruamel_yaml>=0.15.0' \
+      --replace-fail 'ruamel_yaml_clib>=0.2.0,<=0.2.15' 'ruamel_yaml_clib>=0.2.0' \
+      --replace-fail 'wcwidth<0.3.0' 'wcwidth>=0.3.0'
 
     substituteInPlace requirements-base.txt \
-      --replace-fail "wheel==0.43.0" "wheel>=0.43.0"
+      --replace-fail "wheel==0.46.3" "wheel>=0.46.3"
 
     # Upstream needs pip to build and install dependencies and validates this
     # with a configure script, but we don't as we provide all of the packages

pkgs/by-name/ba/bazel-watcher/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-watcher";
-  version = "0.28.1";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4pM7z1GAhLxvCLwtHBcteRMQwtdvOFtRu8eF+H6UJBE=";
+    hash = "sha256-ssG2BFd2utB9xu9zYdcvZYLq+XF9ZOctxNGtpbrhLG8=";
   };
 
   vendorHash = "sha256-u1Zg/M9DSkwscy49qtPQygk1gyxKaPbhlFDYNtBQ9NY=";

pkgs/by-name/be/betterdisplay/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "betterdisplay";
-  version = "4.0.4";
+  version = "4.2.3";
 
   src = fetchurl {
     url = "https://github.com/waydabber/BetterDisplay/releases/download/v${finalAttrs.version}/BetterDisplay-v${finalAttrs.version}.dmg";
-    hash = "sha256-njk1epuekOiBN8Exkxs9J2OHVP4xu4on42F+TPlW75M=";
+    hash = "sha256-keJkdMDO213DUl2LAVqtx1joAmcUpU336Tj8AldCoKo=";
   };
 
   dontPatch = true;

pkgs/by-name/bo/bottles-unwrapped/package.nix

@@ -32,20 +32,19 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bottles-unwrapped";
-  version = "62.0";
+  version = "63.2";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = "bottles";
     tag = finalAttrs.version;
-    hash = "sha256-UqK5ULFgNPe9r2xFolU1R5LnlD3kLgBK0qGl48elEwM=";
+    hash = "sha256-cBqKUf96BLYyVD8onkvejL7pcxYrVCnhjhhT9FSwuNo=";
   };
 
   patches = [
     ./vulkan_icd.patch
     ./redirect-bugtracker.patch
     ./remove-flatpak-check.patch
-    ./terminal.patch # Needed for `Launch with Terminal`
   ]
   ++ (
     if removeWarningPopup then

pkgs/by-name/bo/bottles-unwrapped/terminal.patch

@@ -1,29 +0,0 @@
-diff --git a/bottles/backend/utils/terminal.py b/bottles/backend/utils/terminal.py
-index 943cface..1f67822e 100644
---- a/bottles/backend/utils/terminal.py
-+++ b/bottles/backend/utils/terminal.py
-@@ -132,21 +132,21 @@ class TerminalUtils:
-                 full_cmd = f"{template} {palette} {cmd_for_shell}"
- 
-         elif term_bin == "xfce4-terminal":
--            cmd_for_shell = shlex.quote(f"sh -c {command}")
-+            cmd_for_shell = f"sh -c {command}"
-             try:
-                 full_cmd = template % cmd_for_shell
-             except Exception:
-                 full_cmd = f"{template} {cmd_for_shell}"
- 
-         elif term_bin in ["kitty", "foot", "konsole", "gnome-terminal", "wezterm"]:
--            cmd_for_shell = shlex.quote(f"sh -c {command}")
-+            cmd_for_shell = f"sh -c {command}"
-             try:
-                 full_cmd = template % cmd_for_shell
-             except Exception:
-                 full_cmd = f"{template} {cmd_for_shell}"
- 
-         else:
--            cmd_for_shell = shlex.quote(f"bash -c {command}")
-+            cmd_for_shell = f"sh -c {command}"
-             try:
-                 full_cmd = template % cmd_for_shell
-             except Exception:

pkgs/by-name/br/brewtarget/package.nix

@@ -10,7 +10,8 @@
   pkg-config,
   xercesc,
   xalanc,
-  qt6Packages,
+  qt6,
+  wrapGAppsHook3,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,27 +41,37 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
-    qt6Packages.wrapQtAppsHook
+    qt6.wrapQtAppsHook
+    wrapGAppsHook3
     pandoc
   ];
+
   buildInputs = [
     boost
-    qt6Packages.qtbase
-    qt6Packages.qttools
-    qt6Packages.qtmultimedia
-    qt6Packages.qtsvg
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtsvg
+    qt6.qttools
     xercesc
     xalanc
   ];
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   meta = {
     description = "Open source beer recipe creation tool";
     mainProgram = "brewtarget";
-    homepage = "http://www.brewtarget.org/";
+    homepage = "https://www.brewtarget.beer";
     license = lib.licenses.gpl3;
+    platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
       avnik
       mmahut
+      ilkecan
     ];
   };
 })

pkgs/by-name/ca/camilladsp/Cargo.lock

@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "CamillaDSP"
-version = "4.0.0"
+version = "4.0.1"
 dependencies = [
  "alsa",
  "alsa-sys",
@@ -417,7 +417,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 2.1.1",
+ "rustc-hash 2.1.2",
  "shlex",
  "syn",
 ]
@@ -485,9 +485,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.58"
+version = "1.2.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
+checksum = "b7a4d3ec6524d28a329fc53654bbadc9bdd7b0431f5d65f1a56ffb28a1ee5283"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -971,9 +971,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "a043dc74da1e37d6afe657061213aa6f425f855399a11d3463c6ecccc4dfda1f"
 
 [[package]]
 name = "find-msvc-tools"
@@ -1300,9 +1300,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "45a8a2b9cb3e0b0c1803dbb0758ffac5de2f425b23c28f518faabd9d805342ff"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
@@ -1422,10 +1422,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.91"
+version = "0.3.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+checksum = "2e04e2ef80ce82e13552136fabeef8a5ed1f985a96805761cbb9a2c34e7664d9"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
@@ -1472,9 +1474,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.184"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
 
 [[package]]
 name = "libloading"
@@ -2137,7 +2139,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.8+spec-1.1.0",
+ "toml_edit 0.25.10+spec-1.1.0",
 ]
 
 [[package]]
@@ -2331,9 +2333,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
 [[package]]
 name = "rustfft"
@@ -2447,9 +2449,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "serde"
@@ -2524,7 +2526,7 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "schemars 0.9.0",
  "schemars 1.2.1",
  "serde_core",
@@ -2753,9 +2755,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.0+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97251a7c317e03ad83774a8752a7e81fb6067740609f75ea2b585b569a59198f"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
@@ -2766,7 +2768,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "serde",
  "serde_spanned",
  "toml_datetime 0.6.11",
@@ -2775,23 +2777,23 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.8+spec-1.1.0"
+version = "0.25.10+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16bff38f1d86c47f9ff0647e6838d7bb362522bdf44006c7068c2b1e606f1f3c"
+checksum = "a82418ca169e235e6c399a84e395ab6debeb3bc90edc959bf0f48647c6a32d1b"
 dependencies = [
- "indexmap 2.13.0",
- "toml_datetime 1.1.0+spec-1.1.0",
+ "indexmap 2.13.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 1.0.0",
+ "winnow 1.0.1",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.0+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2334f11ee363607eb04df9b8fc8a13ca1715a72ba8662a26ac285c98aabb4011"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow 1.0.0",
+ "winnow 1.0.1",
 ]
 
 [[package]]
@@ -2989,9 +2991,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.114"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+checksum = "0551fc1bb415591e3372d0bc4780db7e587d84e2a7e79da121051c5c4b89d0b0"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3002,23 +3004,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.64"
+version = "0.4.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9c5522b3a28661442748e09d40924dfb9ca614b21c00d3fd135720e48b67db8"
+checksum = "03623de6905b7206edd0a75f69f747f134b7f0a2323392d664448bf2d3c5d87e"
 dependencies = [
- "cfg-if",
- "futures-util",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.114"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+checksum = "7fbdf9a35adf44786aecd5ff89b4563a90325f9da0923236f6104e603c7e86be"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3026,9 +3024,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.114"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+checksum = "dca9693ef2bab6d4e6707234500350d8dad079eb508dca05530c85dc3a529ff2"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3039,9 +3037,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.114"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+checksum = "39129a682a6d2d841b6c429d0c51e5cb0ed1a03829d8b3d1e69a011e62cb3d3b"
 dependencies = [
  "unicode-ident",
 ]
@@ -3063,7 +3061,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
 dependencies = [
  "anyhow",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "wasm-encoder",
  "wasmparser",
 ]
@@ -3076,15 +3074,15 @@ checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
  "bitflags 2.11.0",
  "hashbrown 0.15.5",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "semver",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.91"
+version = "0.3.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854ba17bb104abfb26ba36da9729addc7ce7f06f5c0f90f3c391f8461cca21f9"
+checksum = "cd70027e39b12f0849461e08ffc50b9cd7688d942c1c8e3c7b22273236b4dd0a"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3428,9 +3426,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
+checksum = "09dac053f1cd375980747450bfc7250c264eaae0583872e845c0c7cd578872b5"
 dependencies = [
  "memchr",
 ]
@@ -3469,7 +3467,7 @@ checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
 dependencies = [
  "anyhow",
  "heck",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "prettyplease",
  "syn",
  "wasm-metadata",
@@ -3500,7 +3498,7 @@ checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
  "bitflags 2.11.0",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "log",
  "serde",
  "serde_derive",
@@ -3519,7 +3517,7 @@ checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "log",
  "semver",
  "serde",
@@ -3535,7 +3533,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08c7c1b1a6a7c8a6b2741a6c21a4f8918e51899b111cfa08d1288202656e3975"
 dependencies = [
- "indexmap 2.13.0",
+ "indexmap 2.13.1",
  "itoa",
  "libyaml-rs",
  "ryu",
@@ -3614,18 +3612,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.47"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.47"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
 dependencies = [
  "proc-macro2",
  "quote",

pkgs/by-name/ca/camilladsp/package.nix

@@ -12,13 +12,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "camilladsp";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "HEnquist";
     repo = "camilladsp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JBqjFpk+KVc2ajTqkC2ompbs7oQEsba+n2zNOwxL2Uo=";
+    hash = "sha256-PedaOmrvvE9Kxux0XwwDJfKq0fncsV/sUzZhnAp++DM=";
   };
 
   cargoLock = {

pkgs/by-name/ca/cargo-diet/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-diet";
-  version = "1.2.7";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "the-lean-crate";
     repo = "cargo-diet";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SuJ1H/2YfSVVigdgLUd9veMClI7ZT7xkkyQ4PfXoQdQ=";
+    hash = "sha256-YjUO8UUXWZvZZZ2Y0py5LQdVBpq8jjwvGimVAWC8Gr8=";
   };
 
-  cargoHash = "sha256-crdRRlRi3H8j/ojGH+oqmaeSS8ee8dUALorZPWE/j1Y=";
+  cargoHash = "sha256-CnaeS7mh+QDPcQgeKzNV5Vey3zsiD10NdlfdQ1kcDB8=";
 
   meta = {
     description = "Help computing optimal include directives for your Cargo.toml manifest";

pkgs/by-name/ca/cargo-tauri/hook.nix

@@ -41,6 +41,9 @@ makeSetupHook {
         --prefix WEBKIT_GST_ALLOWED_URI_PROTOCOLS : "asset"
         # Not picked up automatically by the wrappers from the propagatedBuildInputs.
         --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "${cargo-tauri.gst-plugin}/lib/gstreamer-1.0/"
+        # fix NVIDIA issues with Tauri
+        # https://github.com/tauri-apps/tauri/issues/9394#issuecomment-3795449374
+        --set-default __NV_DISABLE_EXPLICIT_SYNC 1
       )
     '';
 

pkgs/by-name/ca/cargo-vet/package.nix

@@ -2,26 +2,30 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-vet";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cargo-vet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSEhFCcdC79OA8MP73De+iLIjcr1XMHxfJ9a1Q3JJYI=";
+    hash = "sha256-sdjvCMLM8ThWXbotjRIsbLYucDzGvFOktqo6OKB//RI=";
   };
 
-  cargoHash = "sha256-+X6DLxWPWMcGzJMVZAj3C5P5MyywIb4ml0Jsyo9/uAE=";
+  cargoHash = "sha256-3pfOq2VfHbtohdgv73TT480bjCjdNKPJE+m4SHeXfGA=";
 
   # the test_project tests require internet access
   checkFlags = [ "--skip=test_project" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool to help projects ensure that third-party Rust dependencies have been audited by a trusted source";
+    changelog = "https://github.com/mozilla/cargo-vet/releases/tag/v${finalAttrs.version}";
     mainProgram = "cargo-vet";
     homepage = "https://mozilla.github.io/cargo-vet";
     license = with lib.licenses; [
@@ -31,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       jk
       matthiasbeyer
+      ilkecan
     ];
   };
 })

pkgs/by-name/cd/cdncheck/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.2.28";
+  version = "1.2.30";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G0h/0HEPE0kOPfCJIFCXZnqeyCYs7JdnlNjusk9+Nzw=";
+    hash = "sha256-CzTwax3XuUt5ZJsYXIbXHz3czev6natd1WsTQIrokEE=";
   };
 
-  vendorHash = "sha256-bYN119IyOkO9w+CWGwnCOXqpo4QHJV6iDuToMnTo0og=";
+  vendorHash = "sha256-z/wOCtd39ENUe8WQUst4uhl8R6RwCDdcUC4OZcRJWSs=";
 
   subPackages = [ "cmd/cdncheck/" ];
 

pkgs/by-name/ce/censor/package.nix

@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "censor";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "censor";
     repo = "Censor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r5GhPr7dFLVy8nyKWg0poZSjWVrLrpnUHhe4MdEThvM=";
+    hash = "sha256-ALWctGCV1ttocbjD+F1cV9kMnb/WfWXYzv96j+KAhmk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ce/certspotter/package.nix

@@ -7,20 +7,26 @@
 
 buildGoModule (finalAttrs: {
   pname = "certspotter";
-  version = "0.21.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "SSLMate";
     repo = "certspotter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cJIjJyWvy/prx97jUvVToJsEdMa0MpqATD9rO8G2biY=";
+    hash = "sha256-OmukbtHOvyfjRb7WdAc3A3I5FlWmQD515dNeJ5JiJ0k=";
   };
 
-  vendorHash = "sha256-CLq/QFnZ5OLv7wT+VYr5SkSgmwt1g6cBYcAlB4Z/3wE=";
+  vendorHash = "sha256-F7qNpvjWqywPPLTKw90bfy6V83/LMQcV+Gml2n1Wd2A=";
 
   ldflags = [
     "-s"
     "-w"
+    "-X main.Version=${finalAttrs.version}"
+    "-X main.Source=software.sslmate.com/src/certspotter"
+  ];
+
+  checkFlags = [
+    "-skip=TestParseFromURL" # requires network access
   ];
 
   nativeBuildInputs = [ lowdown-unsandboxed ];

pkgs/by-name/ch/chiaki-ng/package.nix

@@ -32,24 +32,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chiaki-ng";
-  version = "1.9.9";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = "chiaki-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7pDQnlElnBkW+Nr6R+NaylZbsGH8dB31nd7jxYD66yQ=";
+    hash = "sha256-se60wu1rwk/w5QG+pFvdtKD+zsJQdOmBole2WY2KCxw=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # fix for building with Qt >= 6.10 -- remove when updating past 1.9.9
-    (fetchpatch {
-      url = "https://github.com/streetpea/chiaki-ng/commit/fe5bfd87998c7ca67ade76436e31ab9924000c8b.patch";
-      hash = "sha256-7Eo5tcmhgbQszBrgtTGrnH34GewJXXAYSKqvqGN/viI=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/ch/chirpstack-gateway-mesh/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  protobuf,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "chirpstack-gateway-mesh";
+  version = "4.1.3";
+
+  src = fetchFromGitHub {
+    owner = "chirpstack";
+    repo = "chirpstack-gateway-mesh";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t4W2G8NzVvcGp6nmCn4Wt9OUR9c7yceKdhDFb/RAk20=";
+  };
+
+  cargoHash = "sha256-3292/Q9OCoxkIOgOwAle37Ltozt1CDGGeXw6lqT91kU=";
+
+  nativeBuildInputs = [ protobuf ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Turn LoRa gateways into relays for extending the range of LoRa networks";
+    homepage = "https://www.chirpstack.io";
+    changelog = "https://github.com/chirpstack/chirpstack-gateway-mesh/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.stv0g ];
+    platforms = lib.platforms.linux;
+    mainProgram = "chirpstack-gateway-mesh";
+  };
+})

pkgs/by-name/ch/chroma/package.nix

@@ -4,42 +4,33 @@
   fetchFromGitHub,
 }:
 
-let
-  srcInfo = lib.importJSON ./src.json;
-in
-
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "chroma";
-  version = "2.22.0";
+  version = "2.23.1";
 
-  # To update:
-  # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
   src = fetchFromGitHub {
     owner = "alecthomas";
     repo = "chroma";
-    rev = "v${version}";
-    inherit (srcInfo) sha256;
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Znmcds0ru9VyH/0qE7KnW7l0QeRDoh9PnUPHTYPAA6w=";
   };
 
-  vendorHash = "sha256-kzlXrIMSa5C4UFt+BiMh6NedelQG49OxYbreeWhCb80=";
+  vendorHash = "sha256-3mmO5hjjIqVqKiSOrFFQH8OaQTviJVHrznMYsgHP82A=";
 
   modRoot = "./cmd/chroma";
 
   # substitute version info as done in goreleaser builds
   ldflags = [
-    "-X"
-    "main.version=${version}"
-    "-X"
-    "main.commit=${srcInfo.rev}"
-    "-X"
-    "main.date=${srcInfo.date}"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.tag}"
+    "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
   meta = {
     homepage = "https://github.com/alecthomas/chroma";
     description = "General purpose syntax highlighter in pure Go";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.sternenseemann ];
+    maintainers = with lib.maintainers; [ miniharinn ];
     mainProgram = "chroma";
   };
-}
+})

pkgs/by-name/ch/chroma/src.json

@@ -1,14 +0,0 @@
-{
-  "url": "https://github.com/alecthomas/chroma.git",
-  "rev": "467c878aa553cdb4b0d486a534ea744f6ac7ef5e",
-  "date": "2026-01-10T09:37:30+11:00",
-  "path": "/nix/store/qkfgjvpw8j5rkfgh687kxzkv8ac9apba-chroma",
-  "sha256": "1wlvxxlbwaq963rkr9fwxc6qwa77m49icq2gdzf46w7wdc3cygpm",
-  "hash": "sha256-9T7PBmv8cEPcb09gFhOp5yiODevcpTzzMAkrvmjvm/I=",
-  "fetchLFS": false,
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "fetchTags": false,
-  "leaveDotGit": false,
-  "rootDir": ""
-}

pkgs/by-name/ci/cinny-desktop/package.nix

@@ -64,12 +64,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
         $out/share/applications/Cinny.desktop
     '';
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --set-default WEBKIT_DISABLE_DMABUF_RENDERER "1"
-    )
-  '';
-
   nativeBuildInputs = [
     cargo-tauri.hook
   ]

pkgs/by-name/cl/cloudflare-ddns/package.nix

@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-ddns";
-  version = "1.15.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "favonia";
     repo = "cloudflare-ddns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/806eUsuWhiCnvO1DasPW2xVFYYxnmki3KIDre7gjrg=";
+    hash = "sha256-oQNOYGn3BTVN2EI83cIVYKwtT/Fm8Nf2CXnP1oREVQ0=";
   };
 
-  vendorHash = "sha256-XIfPL1BNA8mcQH+w4AhThh80gh/1vUjKDtFN97O5zqw=";
+  vendorHash = "sha256-JSd5daOIWblugMq7zmeNEdBiX6cMgNyib4SkCus6yJQ=";
 
   subPackages = [
     "cmd/ddns"

pkgs/by-name/cn/cnspec/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.2.0";
+  version = "13.3.3";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z02BAKPPWqKUiCotgGr+kOIg8omXjyXnLze/RaNdWc0=";
+    hash = "sha256-yCxry1f5CEF51WSgrYN1m9F8YpVjtt+UNZG978nPXbY=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-EgSj4EL6s30u4p5tNOJMyH4h+DM1O8UMg8iveRi6hJA=";
+  vendorHash = "sha256-wgebRTa1ox+LUzxlYLb3pqcLEF/uUushZ1Oq2mvRGCk=";
 
   subPackages = [ "apps/cnspec" ];
 

pkgs/by-name/co/coc-markdownlint/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-markdownlint";
-  version = "0-unstable-2026-03-04";
+  version = "0-unstable-2026-04-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-markdownlint";
-    rev = "4f3410753308b8bf5c45518b6f39aee6d29a8bbd";
-    hash = "sha256-9S3mXE70PqBJIaRRycluwQ8rdQ+9KMUfY10170ek//w=";
+    rev = "9a92eef6adbd6ba7b1afe50bd9a3c82b94902c51";
+    hash = "sha256-5pfsaZFA1OYwREB3FqyUQY4D47dKH22pQV8dBgPiipo=";
   };
 
-  npmDepsHash = "sha256-XXOW5gekzDOl02JNuIQD71Ufm9W+zOIeUO1IrJ7fx5Y=";
+  npmDepsHash = "sha256-J6gYA3eP2PWK3kesJDL5tqHOY/j2PoC+uhVxpeYVnsk=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };