Merge master into staging-nixos

2026-03-21 18:08:42 +00:00
parent ebff705c3e 5e40dc287b
commit 464ed8fb3b
95 changed files with 6339 additions and 701 deletions
@@ -91,8 +91,6 @@

 - `corepack_latest` has been removed, as Corepack is no longer distributed with Node.js.

- `nodePackages.browser-sync` has been removed, as it was unmaintained within nixpkgs.
-
 - `spoof` has been removed, as there are many issues upstream with it working on modern OS versions, and it appears to be unmaintained.

 - `duckstation` package has been removed, as it was requested by upstream and build source were changed to be incompatible with NixOS.
@@ -247,8 +247,6 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.

- `boot.initrd.secrets` is now deprecated in favour of `boot.initrd.secretPaths` and `boot.initrd.extraSecretsHook`.
-
 - The latest available version of Nextcloud is v33 (available as `pkgs.nextcloud33`). The installation logic is as follows:
  - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
  - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
@@ -14,6 +14,13 @@ in
  options = {
    testScript = mkOption {
      type = either str (functionTo str);
+      apply =
+        v:
+        if lib.isFunction v then
+          # Only pass args the testScript function expects.
+          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
+        else
+          v;
      description = ''
        A series of python declarations and statements that you write to perform
        the test.
@@ -86,7 +86,7 @@ in
      description = ''
        Append an additional file's contents to `/etc/iscsid.conf`. Use a non-store path
        and store passwords in this file. Note: the file specified here must be available
-        in the initrd, see: `boot.initrd.secretPaths`.
+        in the initrd, see: `boot.initrd.secrets`.
      '';
      default = null;
      type = nullOr str;
@@ -14,9 +14,7 @@ let
  children = lib.mapAttrs (
    childName: childConfig: childConfig.configuration.system.build.toplevel
  ) config.specialisation;
-  hasInitrdSecrets =
-    (lib.length (lib.attrNames config.boot.initrd.secretPaths) > 0)
-    || (config.boot.initrd.extraSecretsHook != "");
+  hasAtLeastOneInitrdSecret = lib.length (lib.attrNames config.boot.initrd.secrets) > 0;
  schemas = {
    v1 = rec {
      filename = "boot.json";
@@ -35,7 +33,7 @@ let
              // lib.optionalAttrs config.boot.initrd.enable {
                initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
              }
-              // lib.optionalAttrs hasInitrdSecrets {
+              // lib.optionalAttrs hasAtLeastOneInitrdSecret {
                initrdSecrets = "${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets";
              };
            }
@@ -99,8 +99,8 @@ in
        sed -i $out/bin/clevis-decrypt-tpm2 -e 's,tpm2_,tpm2 ,'
      '';

-      secretPaths = lib.mapAttrs' (
-        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" { source = value.secretFile; }
+      secrets = lib.mapAttrs' (
+        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" value.secretFile
      ) cfg.devices;

      systemd = {
@@ -29,7 +29,7 @@ in
    };

    boot.initrd.network.openvpn.configuration = mkOption {
-      type = types.path; # Same type as boot.initrd.secretPaths.*.source
+      type = types.path; # Same type as boot.initrd.secrets
      description = ''
        The configuration file for OpenVPN.

@@ -74,8 +74,8 @@ in
      "${pkgs.glibc}/lib/libnss_dns.so.2"
    ];

-    boot.initrd.secretPaths = {
-      "/etc/initrd.ovpn".source = cfg.configuration;
+    boot.initrd.secrets = {
+      "/etc/initrd.ovpn" = cfg.configuration;
    };

    # openvpn --version would exit with 1 instead of 0
@@ -302,8 +302,8 @@ in
        fi
      '';

-      boot.initrd.secretPaths = listToAttrs (
-        map (path: nameValuePair (initrdKeyPath path) { source = path; }) cfg.hostKeys
+      boot.initrd.secrets = listToAttrs (
+        map (path: nameValuePair (initrdKeyPath path) path) cfg.hostKeys
      );

      # Systemd initrd stuff
@@ -414,7 +414,7 @@ in

          ln -s ${initrdPath} $out/initrd

-          ${optionalString (config.boot.initrd.secretPaths != { }) ''
+          ${optionalString (config.boot.initrd.secrets != { }) ''
            ln -s ${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets $out
          ''}

@@ -935,21 +935,21 @@ in
    '')
    (mkRemovedOptionModule [ "boot" "loader" "grub" "extraInitrd" ] ''
      This option has been replaced with the bootloader agnostic
-      boot.initrd.secretPaths option. To migrate to the initrd secrets system,
+      boot.initrd.secrets option. To migrate to the initrd secrets system,
      extract the extraInitrd archive into your main filesystem:

        # zcat /boot/extra_initramfs.gz | cpio -idvmD /etc/secrets/initrd
        /path/to/secret1
        /path/to/secret2

-      then replace boot.loader.grub.extraInitrd with boot.initrd.secretPaths:
+      then replace boot.loader.grub.extraInitrd with boot.initrd.secrets:

-        boot.initrd.secretPaths = {
-          "/path/to/secret1".source = "/etc/secrets/initrd/path/to/secret1";
-          "/path/to/secret2".source = "/etc/secrets/initrd/path/to/secret2";
+        boot.initrd.secrets = {
+          "/path/to/secret1" = "/etc/secrets/initrd/path/to/secret1";
+          "/path/to/secret2" = "/etc/secrets/initrd/path/to/secret2";
        };

-      See the boot.initrd.secretPaths option documentation for more information.
+      See the boot.initrd.secrets option documentation for more information.
    '')
  ];

@@ -482,7 +482,7 @@ sub addEntry {
              die "failed to create initrd secrets $!\n";
          } else {
              say STDERR "warning: failed to create initrd secrets for \"$name\", an older generation";
-              say STDERR "note: this is normal after having modified or removed an entry in `boot.initrd.secretPaths`";
+              say STDERR "note: this is normal after having removed or renamed a file in `boot.initrd.secrets`";
          }
        }
        # Check whether any secrets were actually added
@@ -202,7 +202,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None
            print("warning: failed to create initrd secrets "
                  f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
            print("note: this is normal after having removed "
-                  "or modified an entry in `boot.initrd.secretPaths`", file=sys.stderr)
+                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
    entry_file = BOOT_MOUNT_POINT / "loader/entries" / generation_conf_filename(profile, generation, specialisation)
    tmp_path = entry_file.with_suffix(".tmp")
    kernel_params = "init=%s " % bootspec.init
@@ -148,22 +148,23 @@ let
        # Copy secrets if needed.
        #
        # TODO: move out to a separate script; see #85000.
-        ${optionalString (!config.boot.loader.supportsInitrdSecrets) ''
-          ${concatStringsSep "\n" (
-            mapAttrsToList (_: scfg: ''
-              mkdir -p $(dirname "$out/secrets${scfg.path}")
-              # Some programs (e.g. ssh) doesn't like secrets to be
-              # symlinks, so we use `cp -L` here to match the
-              # behaviour when secrets are natively supported.
-              # The assertion further up in this file (stage-1.nix)
-              # checks that all secretPaths are Nix store paths set via
-              # boot.initrd.secretPaths.*.source if the bootloader doesn't
-              # support initrd secrets.
-              cp -Lr ${scfg.source} "$out/secrets${scfg.path}"
-            '') config.boot.initrd.secretPaths
-          )}
-          ${config.boot.initrd.extraSecretsHook}
-        ''}
+        ${optionalString (!config.boot.loader.supportsInitrdSecrets) (
+          concatStringsSep "\n" (
+            mapAttrsToList (
+              dest: source:
+              let
+                source' = if source == null then dest else source;
+              in
+              ''
+                mkdir -p $(dirname "$out/secrets/${dest}")
+                # Some programs (e.g. ssh) doesn't like secrets to be
+                # symlinks, so we use `cp -L` here to match the
+                # behaviour when secrets are natively supported.
+                cp -Lr ${source'} "$out/secrets/${dest}"
+              ''
+            ) config.boot.initrd.secrets
+          )
+        )}

        ${config.boot.initrd.extraUtilsCommands}

@@ -435,9 +436,7 @@ let
        exit 0
      fi

-      ${lib.optionalString (
-        config.boot.initrd.secretPaths == { } && config.boot.initrd.extraSecretsHook == ""
-      ) "exit 0"}
+      ${lib.optionalString (config.boot.initrd.secrets == { }) "exit 0"}

      export PATH=${pkgs.coreutils}/bin:${pkgs.cpio}/bin:${pkgs.gzip}/bin:${pkgs.findutils}/bin

@@ -452,25 +451,17 @@ let

      ${lib.concatStringsSep "\n" (
        mapAttrsToList (
-          _: scfg:
+          dest: source:
          let
-            prefix = lib.optionalString scfg.intermediateSecretsDir "/.initrd-secrets";
+            source' = if source == null then dest else toString source;
          in
          ''
-            mkdir -p $(dirname "$tmp${prefix}${scfg.path}")
-            (
-              export out="$tmp${prefix}${scfg.path}"
-              ${scfg.generateSecretCommand}
-            )
+            mkdir -p $(dirname "$tmp/.initrd-secrets/${dest}")
+            cp -a ${source'} "$tmp/.initrd-secrets/${dest}"
          ''
-        ) config.boot.initrd.secretPaths
+        ) config.boot.initrd.secrets
      )}

-      (
-        cd "$tmp"
-        ${config.boot.initrd.extraSecretsHook}
-      )
-
      # mindepth 1 so that we don't change the mode of /
      (cd "$tmp" && find . -mindepth 1 | xargs touch -amt 197001010000 && find . -mindepth 1 -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null) | \
        ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1"
@@ -659,113 +650,21 @@ in
    boot.initrd.secrets = mkOption {
      default = { };
      type = types.attrsOf (types.nullOr types.path);
-      visible = false;
      description = ''
-        Secrets to append to the initrd. This option has been deprecated in
-        favour of `boot.initrd.secretPaths`.
-      '';
-      example = literalExpression ''
-        { "/etc/dropbear/dropbear_rsa_host_key" =
-            ./secret-dropbear-key;
-        }
-      '';
-    };
-
-    boot.initrd.secretPaths = mkOption {
-      default = { };
-      type = types.attrsOf (
-        types.submodule (
-          { config, name, ... }:
-          {
-            options = {
-              path = mkOption {
-                type = types.path;
-                default = name;
-                description = ''
-                  The path the secret should be placed at in the initrd. Defaults
-                  to the attribute name.
-                '';
-              };
-
-              intermediateSecretsDir = mkOption {
-                type = types.bool;
-                default = true;
-                description = ''
-                  By default, the secrets will be copied over to the
-                  `/.initrd-secrets` dir at initrd generation time, and then copied
-                  over to their final location at boot time. This is because initrd secrets
-                  that are supposed to be placed in `/run` would be overridden by
-                  the tmpfs mount over `/run` otherwise.
-
-                  Set this option to `false` to skip this intermediate step and
-                  place the secret at its final location straightaway.
-                '';
-              };
-
-              source = mkOption {
-                type = types.nullOr types.path;
-                default = null;
-                description = ''
-                  The absolute path on the filesystem to copy the secret from.
-                '';
-                example = "/var/lib/secrets/initrd/ssh_host_ed25519_key";
-              };
-
-              generateSecretCommand = mkOption {
-                type = types.path;
-                description = ''
-                  The command to run to generate the secret. It should write
-                  the secret to `$out`.
-
-                  This is useful if you have a more advanced secrets provisioning
-                  mechanism.
-                '';
-                example = ''
-                  pkgs.writeShellScript "generate-secret" '''
-                    ''${lib.getExe pkgs.age} -d -i /etc/ssh/ssh_host_ed25519_key -o "$out" ''${./secret.age}
-                  '''
-                '';
-              };
-            };
-
-            config = {
-              generateSecretCommand = lib.mkIf (config.source != null) (
-                pkgs.writeShellScript "copy-secret" ''
-                  cp -Lr ${config.source} "$out"
-                ''
-              );
-            };
-          }
-        )
-      );
-      description = ''
-        Secret paths to append to the initrd. The attribute name is the
-        path the secret should have inside the initrd.
+        Secrets to append to the initrd. The attribute name is the
+        path the secret should have inside the initrd, the value
+        is the path it should be copied from (or null for the same
+        path inside and out).

        Note that `nixos-rebuild switch` will generate the initrd
        also for past generations, so if secrets are moved or deleted
        you will also have to garbage collect the generations that
        use those secrets.
      '';
-      example = {
-        "/etc/ssh/ssh_host_ed25519_key".source = "/var/lib/secrets/initrd/ssh_host_ed25519_key";
-      };
-    };
-
-    boot.initrd.extraSecretsHook = mkOption {
-      default = "";
-      type = types.lines;
-      description = ''
-        Extra commands to be executed after the initrd secrets generation phase.
-
-        This script should place files into the current workdir. These files
-        will then be copied over to the initrd to the corresponding absolute
-        paths, e.g. `etc/ssh/ssh_host_ed25519_key` will be copied over to
-        `/etc/ssh/ssh_host_ed25519_key`.
-      '';
-      example = ''
-        # Generate a new SSH host key for every generation.
-        ssh-keygen -f etc/ssh/ssh_host_ed25519_key
+      example = literalExpression ''
+        { "/etc/dropbear/dropbear_rsa_host_key" =
+            ./secret-dropbear-key;
+        }
      '';
    };

@@ -847,18 +746,15 @@ in
        assertion =
          !config.boot.loader.supportsInitrdSecrets
          -> all (
-            scfg:
-            builtins.isPath scfg.source
-            || (builtins.isString scfg.source && hasPrefix builtins.storeDir scfg.source)
-          ) (attrValues config.boot.initrd.secretPaths);
+            source: builtins.isPath source || (builtins.isString source && hasPrefix builtins.storeDir source)
+          ) (attrValues config.boot.initrd.secrets);
        message = ''
-          When using a bootloader that doesn't natively support initrd secrets,
-          all `boot.initrd.secretPaths` values must be defined via
-          `boot.initrd.secretsPaths.*.source`, and the `source` values must be
-          unquoted paths, e.g.
+          boot.initrd.secrets values must be unquoted paths when
+          using a bootloader that doesn't natively support initrd
+          secrets, e.g.:

-            boot.initrd.secretPaths = {
-              "/etc/secret".source = /path/to/secret;
+            boot.initrd.secrets = {
+              "/etc/secret" = /path/to/secret;
            };

          Note that this will result in all secrets being stored
@@ -867,18 +763,6 @@ in
      }
    ];

-    warnings = lib.optional (config.boot.initrd.secrets != { }) ''
-      The option `boot.initrd.secrets` has been deprecated in favour of `boot.initrd.secretPaths`.
-    '';
-
-    # Backwards compatibility to the legacy `boot.initrd.secrets` option.
-    boot.initrd.secretPaths = lib.mapAttrs' (dest: source: {
-      # The legacy boot.initrd.secrets option didn't type-check the attr
-      # names, so we need to optionally prepend a slash.
-      name = "${lib.optionalString (!lib.hasPrefix "/" dest) "/"}${dest}";
-      value.source = if dest != null then source else dest;
-    }) config.boot.initrd.secrets;
-
    system.build = mkMerge [
      {
        inherit
@@ -10,21 +10,14 @@
    # Copy secrets into the initrd if they cannot be appended
    boot.initrd.systemd.contents = lib.mkIf (!config.boot.loader.supportsInitrdSecrets) (
      lib.mapAttrs' (
-        _: scfg:
-        let
-          prefix = lib.optionalString scfg.intermediateSecretsDir "/.initrd-secrets";
-        in
-        lib.nameValuePair "${prefix}${scfg.path}" { inherit (scfg) source; }
-      ) config.boot.initrd.secretPaths
+        dest: source:
+        lib.nameValuePair "/.initrd-secrets/${dest}" { source = if source == null then dest else source; }
+      ) config.boot.initrd.secrets
    );

    # Copy secrets to their respective locations
    boot.initrd.systemd.services.initrd-nixos-copy-secrets =
-      lib.mkIf
-        (
-          (builtins.any (x: x.intermediateSecretsDir) (builtins.attrValues config.boot.initrd.secretPaths))
-          || config.boot.initrd.extraSecretsHook != ""
-        )
+      lib.mkIf (config.boot.initrd.secrets != { })
        {
          description = "Copy secrets into place";
          # Run as early as possible
@@ -41,12 +34,10 @@
          # drop this service, we'd mount the /run tmpfs over the secret, making it
          # invisible in stage 2.
          script = ''
-            if [ -d /.initrd-secrets ]; then
-              for secret in $(cd /.initrd-secrets; find . -type f -o -type l); do
-                mkdir -p "$(dirname "/$secret")"
-                cp "/.initrd-secrets/$secret" "/$secret"
-              done
-            fi
+            for secret in $(cd /.initrd-secrets; find . -type f -o -type l); do
+              mkdir -p "$(dirname "/$secret")"
+              cp "/.initrd-secrets/$secret" "/$secret"
+            done
          '';

          serviceConfig = {
@@ -128,7 +128,7 @@ in
      environment.systemPackages = [ pkgs.jq ];
      # It's probably the case, but we want to make it explicit here.
      boot.initrd.enable = true;
-      boot.initrd.secretPaths."/some/example".source = pkgs.writeText "example-secret" "test";
+      boot.initrd.secrets."/some/example" = pkgs.writeText "example-secret" "test";
    };

    testScript = ''
@@ -165,7 +165,7 @@ in
    };

  testScript =
-    { nodes }:
+    { nodes, ... }:
    let
      request = builtins.toJSON {
        title = "Private message";
@@ -54,38 +54,36 @@ in
  nodes.drbd1 = drbdConfig;
  nodes.drbd2 = drbdConfig;

-  testScript =
-    { nodes }:
-    ''
-      drbd1.start()
-      drbd2.start()
+  testScript = ''
+    drbd1.start()
+    drbd2.start()

-      drbd1.wait_for_unit("network.target")
-      drbd2.wait_for_unit("network.target")
+    drbd1.wait_for_unit("network.target")
+    drbd2.wait_for_unit("network.target")

-      drbd1.succeed(
-          "drbdadm create-md r0",
-          "drbdadm up r0",
-          "drbdadm primary r0 --force",
-      )
+    drbd1.succeed(
+        "drbdadm create-md r0",
+        "drbdadm up r0",
+        "drbdadm primary r0 --force",
+    )

-      drbd2.succeed("drbdadm create-md r0", "drbdadm up r0")
+    drbd2.succeed("drbdadm create-md r0", "drbdadm up r0")

-      drbd1.succeed(
-          "mkfs.ext4 /dev/drbd0",
-          "mkdir -p /mnt/drbd",
-          "mount /dev/drbd0 /mnt/drbd",
-          "touch /mnt/drbd/hello",
-          "umount /mnt/drbd",
-          "drbdadm secondary r0",
-      )
-      drbd1.sleep(1)
+    drbd1.succeed(
+        "mkfs.ext4 /dev/drbd0",
+        "mkdir -p /mnt/drbd",
+        "mount /dev/drbd0 /mnt/drbd",
+        "touch /mnt/drbd/hello",
+        "umount /mnt/drbd",
+        "drbdadm secondary r0",
+    )
+    drbd1.sleep(1)

-      drbd2.succeed(
-          "drbdadm primary r0",
-          "mkdir -p /mnt/drbd",
-          "mount /dev/drbd0 /mnt/drbd",
-          "ls /mnt/drbd/hello",
-      )
-    '';
+    drbd2.succeed(
+        "drbdadm primary r0",
+        "mkdir -p /mnt/drbd",
+        "mount /dev/drbd0 /mnt/drbd",
+        "ls /mnt/drbd/hello",
+    )
+  '';
 }
@@ -47,7 +47,7 @@ in
          };
        };
        virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        boot.initrd.secretPaths."/etc/cryptroot.key".source = keyfile;
+        boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
      };

      specialisation.boot-luks-missing-keyfile.configuration = {
@@ -21,16 +21,16 @@ testing.makeTest {

      boot.loader.grub.device = "/dev/vda";

-      boot.initrd.secretPaths = {
-        "/test".source = secret1InStore;
-        "/run/keys/test".source = secret1InStore;
+      boot.initrd.secrets = {
+        "/test" = secret1InStore;
+        "/run/keys/test" = secret1InStore;
      };
      boot.initrd.postMountCommands = "cp /test /mnt-root/secret-from-initramfs";

      specialisation.secrets2System.configuration = {
-        boot.initrd.secretPaths = lib.mkForce {
-          "/test".source = secret2InStore;
-          "/run/keys/test".source = secret2InStore;
+        boot.initrd.secrets = lib.mkForce {
+          "/test" = secret2InStore;
+          "/run/keys/test" = secret2InStore;
        };
      };
    };
@@ -21,26 +21,14 @@ let
        { ... }:
        {
          virtualisation.useBootLoader = true;
-          boot.initrd.secretPaths = {
-            "/test" = {
-              source = secretInStore;
-              intermediateSecretsDir = false;
-            };
+          boot.initrd.secrets = {
+            "/test" = secretInStore;

            # This should *not* need to be copied in postMountCommands
-            "/run/keys/test1".source = secretInStore;
-
-            "/run/keys/test2".generateSecretCommand = pkgs.writeShellScript "copy-secret" ''
-              cp ${secretInStore} "$out"
-            '';
+            "/run/keys/test" = secretInStore;
          };
-          boot.initrd.extraSecretsHook = ''
-            mkdir -p etc/secrets
-            cp ${secretInStore} etc/secrets/test2
-          '';
          boot.initrd.postMountCommands = ''
-            cp /test /mnt-root/secret-from-initramfs-1
-            cp /etc/secrets/test2 /mnt-root/secret-from-initramfs-2
+            cp /test /mnt-root/secret-from-initramfs
          '';
          boot.initrd.compressor = compressor;
          # zstd compression is only supported from 5.9 onwards. Remove when 5.10 becomes default.
@@ -51,10 +39,8 @@ let
        start_all()
        machine.wait_for_unit("multi-user.target")
        machine.succeed(
-            "cmp ${secretInStore} /secret-from-initramfs-1",
-            "cmp ${secretInStore} /secret-from-initramfs-2",
-            "cmp ${secretInStore} /run/keys/test1",
-            "cmp ${secretInStore} /run/keys/test2",
+            "cmp ${secretInStore} /secret-from-initramfs",
+            "cmp ${secretInStore} /run/keys/test",
        )
      '';
    };
@@ -67,7 +67,7 @@ let
          boot.loader.systemd-boot.enable = true;
        ''}

-        boot.initrd.secretPaths."/etc/secret".source = "/etc/nixos/secret";
+        boot.initrd.secrets."/etc/secret" = "/etc/nixos/secret";

        ${optionalString clevisTest ''
          boot.kernelParams = [ "console=tty0" "ip=192.168.1.1:::255.255.255.0::eth1:none" ];
@@ -1385,7 +1385,7 @@ in
  };

  # Full disk encryption (root, kernel and initrd encrypted) using GRUB, GPT/UEFI,
-  # LVM-on-LUKS and a keyfile in initrd.secretPaths to enter the passphrase once
+  # LVM-on-LUKS and a keyfile in initrd.secrets to enter the passphrase once
  fullDiskEncryption = makeInstallerTest "fullDiskEncryption" {
    createPartitions = ''
      installer.succeed(
@@ -1419,7 +1419,7 @@ in
      boot.loader.grub.enableCryptodisk = true;
      boot.loader.efi.efiSysMountPoint = "/boot/efi";

-      boot.initrd.secretPaths."/luks.key" = "/etc/nixos/luks.key";
+      boot.initrd.secrets."/luks.key" = "/etc/nixos/luks.key";
      boot.initrd.luks.devices.crypt =
        { device  = "/dev/vda2";
          keyFile = "/luks.key";
@@ -59,16 +59,22 @@
        virthost.succeed("virsh vol-create-as zfs_storagepool disk1 25MB")

      with subtest("check if nixos install iso boots, network and autostart works"):
+        # The guest runs sshd on port 22. We use passt-based networking to
+        # forward guest port 22 to host port 2222 and `nc -z` to assert that
+        # the host port can only be connected to once the guest is running.
+        virthost.fail("nc -z localhost 2222")
        virthost.succeed(
-          "virt-install -n nixos --osinfo nixos-unstable --memory 1024 --graphics none --disk `find ${nixosInstallISO}/iso -type f | head -n1`,readonly=on --import --noautoconsole --autostart"
+          "virt-install -n nixos --osinfo nixos-unstable --memory 1024 --graphics none --network default --network passt,portForward=2222:22 --disk `find ${nixosInstallISO}/iso -type f | head -n1`,readonly=on --import --noautoconsole --autostart"
        )
        virthost.succeed("virsh domstate nixos | grep running")
        virthost.wait_until_succeeds("ping -c 1 nixos")
+        virthost.succeed("nc -z localhost 2222")
        virthost.succeed("virsh ${virshShutdownCmd} nixos")
        virthost.wait_until_succeeds("virsh domstate nixos | grep 'shut off'")
        virthost.shutdown()
        virthost.wait_for_unit("multi-user.target")
        virthost.wait_until_succeeds("ping -c 1 nixos")
+        virthost.succeed("nc -z localhost 2222")

      with subtest("test if hooks are linked and run"):
        virthost.succeed("ls /var/lib/libvirt/hooks/qemu.d/is_working")
@@ -12,7 +12,7 @@
    };

  testScript =
-    { nodes }:
+    { nodes, ... }:
    let
      aliceUid = toString nodes.machine.users.users.alice.uid;
    in
@@ -57,7 +57,7 @@ let
      };

      testScript =
-        { nodes }:
+        { nodes, ... }:
        let
          deployerSetup = pkgs.writeScript "deployerSetup" ''
            #!${pkgs.runtimeShell}
@@ -91,7 +91,7 @@ in
      };

    testScript =
-      { nodes }:
+      { nodes, ... }:
      let
        esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
        valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
@@ -202,7 +202,7 @@ in
      };

      testScript =
-        { nodes }:
+        { nodes, ... }:
        let
          esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
          valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
@@ -136,31 +136,29 @@ in

  };

-  testScript =
-    { nodes }:
-    ''
-      start_all()
-      machine.wait_for_unit("maddy.service")
-      machine.wait_for_open_port(143)
-      machine.wait_for_open_port(993)
-      machine.wait_for_open_port(587)
-      machine.wait_for_open_port(465)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("maddy.service")
+    machine.wait_for_open_port(143)
+    machine.wait_for_open_port(993)
+    machine.wait_for_open_port(587)
+    machine.wait_for_open_port(465)

-      # Send test mail to spam@domain
-      machine.succeed("send-testmail")
+    # Send test mail to spam@domain
+    machine.succeed("send-testmail")

-      # Create mail directories required for rspamd-trainer and copy mail from
-      # INBOX into INBOX/report_ham
-      machine.succeed("create-mail-dirs")
+    # Create mail directories required for rspamd-trainer and copy mail from
+    # INBOX into INBOX/report_ham
+    machine.succeed("create-mail-dirs")

-      # Start rspamd-trainer. It should read mail from INBOX/report_ham
-      machine.wait_for_unit("rspamd.service")
-      machine.wait_for_unit("redis-rspamd.service")
-      machine.wait_for_file("/run/rspamd/rspamd.sock")
-      machine.succeed("systemctl start rspamd-trainer.service")
+    # Start rspamd-trainer. It should read mail from INBOX/report_ham
+    machine.wait_for_unit("rspamd.service")
+    machine.wait_for_unit("redis-rspamd.service")
+    machine.wait_for_file("/run/rspamd/rspamd.sock")
+    machine.succeed("systemctl start rspamd-trainer.service")

-      # Check if mail got processed by rspamd-trainer successfully and check for
-      # it in INBOX/learned_ham
-      machine.succeed("test-imap")
-    '';
+    # Check if mail got processed by rspamd-trainer successfully and check for
+    # it in INBOX/learned_ham
+    machine.succeed("test-imap")
+  '';
 }
@@ -59,7 +59,7 @@ in
  };

  testScript =
-    { nodes }:
+    { nodes, ... }:
    let
      adminSocket = nodes.server.services.spire.server.settings.server.socket_path;
      workloadSocket = nodes.agent.services.spire.agent.settings.agent.socket_path;
@@ -38,7 +38,7 @@ in
          };
        };
        virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        boot.initrd.secretPaths."/etc/cryptroot.key".source = keyfile;
+        boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
      };
    };

@@ -18,7 +18,7 @@
    };

  testScript =
-    { nodes }:
+    { nodes, ... }:
    ''
      machine.start()
      machine.wait_for_unit("peering-manager.target")
@@ -44,7 +44,7 @@ in
  };

  testScript =
-    { nodes }:
+    { nodes, ... }:
    let
      backupPath = "${nodes.snipeit.services.snipe-it.dataDir}/storage/app/backups";

@@ -28,14 +28,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "tiled";
-  # nixpkgs-update: no auto update
-  version = "1.11.2";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "mapeditor";
    repo = "tiled";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
+    sha256 = "sha256-SDsz7IAxCJde21CIL9DrZMJkEim6syHD5kn9/dwpZXs=";
  };

  nativeBuildInputs = [
@@ -9,7 +9,7 @@

 let
  appName = "AeroSpace.app";
-  version = "0.20.2-Beta";
+  version = "0.20.3-Beta";
 in
 stdenv.mkDerivation {
  pname = "aerospace";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {

  src = fetchzip {
    url = "https://github.com/nikitabobko/AeroSpace/releases/download/v${version}/AeroSpace-v${version}.zip";
-    sha256 = "sha256-PyWHtM38XPNkkEZ0kACPia0doR46FRpmSoNdsOhU4uw=";
+    sha256 = "sha256-wrBcslp1W/lOmudMcW+SREL9LZY+wTwidh6Hot5ShGE=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -17,14 +17,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apk-tools";
-  version = "3.0.4";
+  version = "3.0.5";

  src = fetchFromGitLab {
    domain = "gitlab.alpinelinux.org";
    owner = "alpine";
    repo = "apk-tools";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-51lBWcUSILCJZNP6LaOGyERCosNWTuEne/+xX8xHLf0=";
+    sha256 = "sha256-iuJFgsn4yfQYqichMVhnOHFYj+5xPZYnXaCW0ZkKbRU=";
  };

  nativeBuildInputs = [
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "betteralign";
-  version = "0.8.3";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "dkorunic";
    repo = "betteralign";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1YAuIdSLibCmiWNRMjVJJHv64Rx8jzO5AyJg+I05Vu0=";
+    hash = "sha256-NZBGcgI2SLkCUb4v7Tdm6QQd5dqtDmp+dhCTZEovU2Y=";

    # Trick for getting accurate commit, source date and timestamp for ldflags
    # Required by upstream https://github.com/dkorunic/betteralign/blob/346baa9c9dd024bfe55302c9d7d0ca46b2734c1c/.goreleaser.yml
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-9jhlshLzS+fNri8eax8SrX1X0KqzQ4clgSyVgXqcx04=";
+  vendorHash = "sha256-F9SCMJNu8XnkvYPYfuMGFLgbn9sFDn63ao7ExYXSOaM=";

  env.CGO_ENABLED = 0;

@@ -0,0 +1,36 @@
+{
+  lib,
+  nodejs_22,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "browser-sync";
+  version = "3.0.3";
+
+  src = fetchFromGitHub {
+    owner = "BrowserSync";
+    repo = "browser-sync";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AQZfSdzAGsLnZf7q5YWy5v4W4Iv3f0s4eOV1tC7yhXw=";
+  };
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
+
+  sourceRoot = "source/packages/browser-sync";
+
+  nodejs = nodejs_22;
+
+  npmDepsHash = "sha256-HvV7zaD8EZiXR7S7fZRT3zDpUxa3B9Gza9fl8zEurLA=";
+
+  meta = {
+    description = "Keep multiple browsers & devices in sync when building websites";
+    homepage = "https://github.com/BrowserSync/browser-sync";
+    maintainers = with lib.maintainers; [ wrvsrx ];
+    license = lib.licenses.asl20;
+    mainProgram = "browser-sync";
+  };
+})
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "butane";
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "coreos";
    repo = "butane";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-htD/FecmBVUp0bmzDJpUNw8rVr9mheFwagUISFu8lJM=";
+    hash = "sha256-RNK6G9/mNUTeRA0oWZoOdOUmc1F85Q3xmXUhtpgPymc=";
  };

  vendorHash = null;
@@ -60,8 +60,8 @@ cfgbootnone = """  # Disable bootloader.
 """

 cfgbootgrubcrypt = """  # Setup keyfile
-  boot.initrd.secretPaths = {
-    "/boot/crypto_keyfile.bin".source = null;
+  boot.initrd.secrets = {
+    "/boot/crypto_keyfile.bin" = null;
  };

  boot.loader.grub.enableCryptodisk = true;
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-binstall";
-  version = "1.17.7";
+  version = "1.17.8";

  src = fetchFromGitHub {
    owner = "cargo-bins";
    repo = "cargo-binstall";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sqPuToU8c5/88AkGeVkFiNmgblk4D1O07kQNlDqYP3g=";
+    hash = "sha256-VQ7+NNKlT/Jrt7e3PW+rvkoo0ketw7KV9PptA0hkp9A=";
  };

-  cargoHash = "sha256-wXkyP3zlVltwDHLwzh+E9QbpMS0p2Y3si5mRZrItauM=";
+  cargoHash = "sha256-0KHPiO+cgAVrhPtr2CtOaqiA+q9xtrIHZvPfHKbD8Cw=";

  nativeBuildInputs = [
    pkg-config
@@ -2,9 +2,10 @@
  lib,
  fetchFromGitHub,
  rustPlatform,
+  nix-update-script,
 }:
 let
-  version = "2.5.1";
+  version = "2.9.0";
 in
 rustPlatform.buildRustPackage {
  pname = "catppuccin-whiskers";
@@ -14,16 +15,21 @@ rustPlatform.buildRustPackage {
    owner = "catppuccin";
    repo = "whiskers";
    tag = "v${version}";
-    hash = "sha256-OLEXy9MCrPQu1KWICsYhe/ayVqxkYIFwyJoJhgiNDz4=";
+    hash = "sha256-KU2cHBtz9rdfhulINRaQm+YZ7n8OBULrSHSSxmoitnk=";
  };

-  cargoHash = "sha256-CVg7kcOTRa8KfDwiJHQhTPQfK6g3jOMa4h/BCUo3ehw=";
+  cargoHash = "sha256-40IPDdxKTWYxsCfsECsXDGwfxXiTEIelxIGAFv3xlU4=";
+
+  passthru.updateScript = nix-update-script { };

  meta = {
    homepage = "https://github.com/catppuccin/whiskers";
    description = "Templating tool to simplify the creation of Catppuccin ports";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Name ];
+    maintainers = with lib.maintainers; [
+      Name
+      isabelroses
+    ];
    mainProgram = "whiskers";
  };
 }
@@ -0,0 +1,13 @@
+diff --git a/pom.xml b/pom.xml
+index fdaf9b328..2dbc69fb8 100644
+--- a/pom.xml
+++ b/pom.xml
+@@ -39,7 +39,7 @@
+ 		<cryptomator.integrations.win.version>1.6.0</cryptomator.integrations.win.version>
+ 		<cryptomator.integrations.mac.version>1.5.0</cryptomator.integrations.mac.version>
+ 		<cryptomator.integrations.linux.version>1.7.0</cryptomator.integrations.linux.version>
+-		<cryptomator.fuse.version>6.0.1</cryptomator.fuse.version>
+		<cryptomator.fuse.version>5.1.0</cryptomator.fuse.version>
+ 		<cryptomator.webdav.version>3.0.1</cryptomator.webdav.version>
+ 		<cryptomator.webdav-servlet.version>1.2.12</cryptomator.webdav-servlet.version>
+ 
@@ -17,18 +17,30 @@ let
 in
 maven.buildMavenPackage rec {
  pname = "cryptomator";
-  version = "1.18.1";
+  version = "1.19.2";

  src = fetchFromGitHub {
    owner = "cryptomator";
    repo = "cryptomator";
    tag = version;
-    hash = "sha256-C2pvToxIK8gPzmqcRKYCu4B2FBrOGcH2Uzpjdt3nZZs=";
+    hash = "sha256-9JWZaTsL2sfnGQAZI56T2iQnTNhERsFNFFCeLMB7WC0=";
  };

+  patches = [
+    # fix for "java.lang.IllegalStateException: No fuse library found at expected path"
+    ./downgrade-fuse.patch
+  ];
+
  mvnJdk = jdk;
  mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-dOpvojr6gVtDFE52eghOVZWGspRLQrTDotOMkVGaG9k=";
+  mvnHash = "sha256-IVOcDFW5YKgUHJKX3ZXYVnOevwmOwN5yEU8jfPtCY1I=";
+  mvnFetchExtraArgs.env = {
+    inherit SOURCE_DATE_EPOCH;
+  };
+
+  # fix for "date 1980-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z"
+  # this should be in env, but looks like buildMavenPackage doesn't support that
+  SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z

  preBuild = ''
    VERSION=${version}
@@ -9,26 +9,26 @@ let
  inherit (stdenv) hostPlatform;
  sources = {
    x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.02.27-e7d2ef6/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-QdNrUbDdA6dBUXa7iqumKsxrK4boySCWxCJ3FR9csqw=";
+      url = "https://downloads.cursor.com/lab/2026.03.18-f6873f7/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-O0dcGKyTryFBiSCIoUtsBoWKBCdgj3Rc178nbaxFu64=";
    };
    aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.02.27-e7d2ef6/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-sG+kYYcXlbXMKaJIG4C6rqRECph31Ol6ah2gCxj1gaE=";
+      url = "https://downloads.cursor.com/lab/2026.03.18-f6873f7/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-JpSeyfrpX9vcAu3ymn4hBlomuRGnowVFXQ58NaCoSz8=";
    };
    x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.02.27-e7d2ef6/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-0GvOg1y7O27PFdwz+QDhMnNeDWbFFzmbk3me1oHsJJ4=";
+      url = "https://downloads.cursor.com/lab/2026.03.18-f6873f7/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-ubEakI8t3/BJ9eVcYueGEg7RWhvTjWbJMGNweyF9V0E=";
    };
    aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.02.27-e7d2ef6/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-IZEE+ckKRTDi3sDLqKqJkmyM3UH9FH0trRBcfSqAVeg=";
+      url = "https://downloads.cursor.com/lab/2026.03.18-f6873f7/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-KHybHgQrIOBHbiJZSEbFVG0Fp1+TRPvK75JXPcSTMKk=";
    };
  };
 in
 stdenv.mkDerivation {
  pname = "cursor-cli";
-  version = "0-unstable-2026-02-27";
+  version = "0-unstable-2026-03-18";

  src = sources.${hostPlatform.system};

@@ -3,99 +3,99 @@
    "alpha": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.73.tar.xz"
+          "factorio_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.73.tar.xz",
+        "name": "factorio_alpha_x64-2.0.76.tar.xz",
        "needsAuth": true,
-        "sha256": "68280b39bd01d7647df0cfa0e291d82c8123ffc2d522c8565860f6d52a7673eb",
+        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/alpha/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
+        "version": "2.0.76"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.73.tar.xz"
+          "factorio_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.73.tar.xz",
+        "name": "factorio_alpha_x64-2.0.76.tar.xz",
        "needsAuth": true,
-        "sha256": "68280b39bd01d7647df0cfa0e291d82c8123ffc2d522c8565860f6d52a7673eb",
+        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/alpha/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
+        "version": "2.0.76"
      }
    },
    "demo": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.73.tar.xz"
+          "factorio-demo_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_demo_x64-2.0.73.tar.xz",
+        "name": "factorio_demo_x64-2.0.76.tar.xz",
        "needsAuth": false,
-        "sha256": "1c04ab58fe5e47eb83ba984014e355e8edbc7f941f655bad0b1ff0c5e68bd0f2",
+        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/demo/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
+        "version": "2.0.76"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.73.tar.xz"
+          "factorio-demo_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_demo_x64-2.0.73.tar.xz",
+        "name": "factorio_demo_x64-2.0.76.tar.xz",
        "needsAuth": false,
-        "sha256": "1c04ab58fe5e47eb83ba984014e355e8edbc7f941f655bad0b1ff0c5e68bd0f2",
+        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/demo/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
+        "version": "2.0.76"
      }
    },
    "expansion": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.73.tar.xz"
+          "factorio-space-age_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.73.tar.xz",
+        "name": "factorio_expansion_x64-2.0.76.tar.xz",
        "needsAuth": true,
-        "sha256": "85d7223258f0001cd943004f30cb4d4f4c1a05d1f0fd3d19e05bc42c42b0d7a4",
+        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/expansion/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
+        "version": "2.0.76"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.73.tar.xz"
+          "factorio-space-age_linux_2.0.76.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.73.tar.xz",
+        "name": "factorio_expansion_x64-2.0.76.tar.xz",
        "needsAuth": true,
-        "sha256": "85d7223258f0001cd943004f30cb4d4f4c1a05d1f0fd3d19e05bc42c42b0d7a4",
+        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/expansion/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
+        "version": "2.0.76"
      }
    },
    "headless": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.73.tar.xz",
-          "factorio_headless_x64_2.0.73.tar.xz"
+          "factorio-headless_linux_2.0.76.tar.xz",
+          "factorio_headless_x64_2.0.76.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.73.tar.xz",
+        "name": "factorio_headless_x64-2.0.76.tar.xz",
        "needsAuth": false,
-        "sha256": "752025f81b5ec1229919edc869f9c8773db4bb548a90d370f85938236c857d9a",
+        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/headless/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
+        "version": "2.0.76"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.73.tar.xz",
-          "factorio_headless_x64_2.0.73.tar.xz"
+          "factorio-headless_linux_2.0.76.tar.xz",
+          "factorio_headless_x64_2.0.76.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.73.tar.xz",
+        "name": "factorio_headless_x64-2.0.76.tar.xz",
        "needsAuth": false,
-        "sha256": "752025f81b5ec1229919edc869f9c8773db4bb548a90d370f85938236c857d9a",
+        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.73/headless/linux64",
-        "version": "2.0.73"
+        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
+        "version": "2.0.76"
      }
    }
  }
@@ -5,108 +5,84 @@
  buildGoModule,
  nodejs,
  npmHooks,
-  unstableGitUpdater,
-  applyPatches,
-  fetchpatch,
  pkg-config,
  libheif,
 }:

-buildGoModule (
-  finalAttrs:
-  let
-    rev = "5b3942a75ccf3dcf244d0e7e5f8e02896b86bbda";
+buildGoModule (finalAttrs: {
+  pname = "gomuks-web";
+  version = "26.03";

-  in
-  {
-    pname = "gomuks-web";
-    version = "0.2602.0";
+  src = fetchFromGitHub {
+    owner = "gomuks";
+    repo = "gomuks";
+    tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
+    hash = "sha256-lWuZ1UkazG31qfZsRUb4eTc34qazCQlI7k+i9H1cdb4=";
+  };

-    proxyVendor = true;
-    vendorHash = "sha256-VjcKxZ9hYxmha5KCuJ5ms7eclAOlsNTWZMmpNhmzX8U=";
+  proxyVendor = true;
+  vendorHash = "sha256-0h0/pNCd6g3aknDdKmVgojXKHzbtvWK/NVNToVJP0fU=";

-    src = applyPatches {
-      src = fetchFromGitHub {
-        owner = "gomuks";
-        repo = "gomuks";
-        inherit rev;
-        hash = "sha256-IpxTlirZCXjUHaZbvDew3WWlt0kuKffJQ4BFix2iQjg=";
-      };
-      patches = [
-        # required patch to use libheif instead of goheif which won't build
-        (fetchpatch {
-          url = "https://github.com/gomuks/gomuks/commit/c794a3e9034d76dc1a8c1598f1ff957ecda9e22d.patch";
-          sha256 = "sha256-QyPX2bLuGHqdv/17Pf+N/f1gq/tAbSQKVagN+6S3rJ8=";
-        })
-      ];
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    libheif
+  ];
+
+  env = {
+    npmRoot = "web";
+    npmDeps = fetchNpmDeps {
+      src = "${finalAttrs.src}/web";
+      hash = "sha256-9kGKUF+t4miz+uXZVifNhLkwYTK8ZAhFfrAfWF8Rxck=";
    };
+  };

-    nativeBuildInputs = [
-      nodejs
-      npmHooks.npmConfigHook
-      pkg-config
-    ];
+  postPatch = ''
+    substituteInPlace ./web/build-wasm.sh \
+      --replace-fail 'go.mau.fi/gomuks/version.Tag=$(git describe --exact-match --tags 2>/dev/null)' "go.mau.fi/gomuks/version.Tag=${finalAttrs.src.tag}" \
+      --replace-fail 'go.mau.fi/gomuks/version.Commit=$(git rev-parse HEAD)' "go.mau.fi/gomuks/version.Commit=unknown"
+  '';

-    buildInputs = [
-      libheif
-    ];
+  doCheck = false;

-    env = {
-      npmRoot = "web";
-      npmDeps = fetchNpmDeps {
-        src = "${finalAttrs.src}/web";
-        hash = "sha256-ob85fZDC3Qcos53MGvf+c1eGEO/SvfUTdnjA3T/y6/A=";
-      };
-    };
+  tags = [
+    "goolm"
+    "libheif"
+  ];

-    postPatch = ''
-      substituteInPlace ./web/build-wasm.sh \
-        --replace-fail 'go.mau.fi/gomuks/version.Tag=$(git describe --exact-match --tags 2>/dev/null)' "go.mau.fi/gomuks/version.Tag=v${finalAttrs.version}" \
-        --replace-fail 'go.mau.fi/gomuks/version.Commit=$(git rev-parse HEAD)' "go.mau.fi/gomuks/version.Commit=${rev}"
-    '';
+  ldflags = [
+    "-X 'go.mau.fi/gomuks/version.Tag=${finalAttrs.src.tag}'"
+    "-X 'go.mau.fi/gomuks/version.Commit=unknown'"
+    "-X \"go.mau.fi/gomuks/version.BuildTime=$(date -Iseconds)\""
+    "-X \"maunium.net/go/mautrix.GoModVersion=$(cat go.mod | grep 'maunium.net/go/mautrix ' | head -n1 | awk '{ print $2 })\""
+  ];

-    doCheck = false;
+  subPackages = [
+    "cmd/gomuks"
+    "cmd/gomuks-terminal"
+    "cmd/archivemuks"
+  ];

-    tags = [
-      "goolm"
-      "libheif"
-    ];
+  preBuild = ''
+    CGO_ENABLED=0 go generate ./web
+  '';

-    ldflags = [
-      "-X 'go.mau.fi/gomuks/version.Tag=v${finalAttrs.version}'"
-      "-X 'go.mau.fi/gomuks/version.Commit=${rev}'"
-      "-X \"go.mau.fi/gomuks/version.BuildTime=$(date -Iseconds)\""
-      "-X \"maunium.net/go/mautrix.GoModVersion=$(cat go.mod | grep 'maunium.net/go/mautrix ' | head -n1 | awk '{ print $2 })\""
-    ];
+  postInstall = ''
+    mv $out/bin/gomuks $out/bin/gomuks-web
+  '';

-    subPackages = [
-      "cmd/gomuks"
-      "cmd/gomuks-terminal"
-      "cmd/archivemuks"
-    ];
+  passthru.updateScript = ./update.sh;

-    preBuild = ''
-      CGO_ENABLED=0 go generate ./web
-    '';
-
-    postInstall = ''
-      mv $out/bin/gomuks $out/bin/gomuks-web
-    '';
-
-    passthru.updateScript = {
-      inherit (finalAttrs) frontend;
-      updateScript = unstableGitUpdater {
-        branch = "main";
-      };
-    };
-
-    meta = {
-      mainProgram = "gomuks-web";
-      description = "Matrix client written in Go";
-      homepage = "https://github.com/tulir/gomuks";
-      license = lib.licenses.agpl3Only;
-      maintainers = [ lib.maintainers.zaphyra ];
-      platforms = lib.platforms.unix;
-    };
-  }
-)
+  meta = {
+    mainProgram = "gomuks-web";
+    description = "Matrix client written in Go";
+    homepage = "https://github.com/tulir/gomuks";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.zaphyra ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-update
+
+set -euo pipefail
+
+# Fetch latest release infor
+RELEASE=$(curl -sSL https://api.github.com/repos/tulir/gomuks/releases/latest | jq -r .name)
+
+if [ -z "$RELEASE" ]; then
+    echo "Failed to fetch latest release"
+    exit 1
+fi
+
+# Strip leading v from version
+VERSION="${RELEASE#v}"
+
+# Debug
+echo "Release ${RELEASE} -> Version ${VERSION}"
+
+nix-update --build --commit --version "${VERSION}" gomuks-web
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libdeltachat";
-  version = "2.45.0";
+  version = "2.46.0";

  src = fetchFromGitHub {
    owner = "chatmail";
    repo = "core";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q3nFTofALHtBgbZiuRfri6LlSlQimQZcj9JCfCv4JeQ=";
+    hash = "sha256-oghFI9DMqSoTBMt/kMPj1ETkzDZUX187SKR9mHEK4VA=";
  };

  patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "chatmail-core";
    inherit (finalAttrs) version src;
-    hash = "sha256-8l+tZt+IlrI2NkW0o1ecC71L0yKMUzTqpPWM0lpkNbM=";
+    hash = "sha256-6YW1HqiSXpmEQ8jJiklIqrr70sawvPK0g1UX7Nvmdxk=";
  };

  nativeBuildInputs = [
@@ -25,6 +25,7 @@
  nftables,
  ninja,
  openssh,
+  passt,
  perl,
  perlPackages,
  polkit,
@@ -98,6 +99,7 @@ let
      numactl
      numad
      openssh
+      passt
      pmutils
      systemd
    ]
@@ -0,0 +1,61 @@
+{
+  fetchzip,
+  lib,
+  stdenv,
+  gmp,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "llr";
+  version = "4.0.7b3";
+
+  src = fetchzip {
+    url = "http://jpenne.free.fr/llr4/llr${
+      builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version
+    }src.zip";
+    hash = "sha256-U6Mjpcq5Kdkx2f6tVQNBldsN4JiKXZqbil1Lg3Q5Asw=";
+  };
+
+  enableParallelBuilding = true;
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu11";
+
+  # Disable _chdir in lprime.c to prevent segmentation fault when fopen returns NULL
+  postPatch = ''
+    substituteInPlace lprime.c \
+      --replace-fail "_chdir (buf)" "0/* _chdir (buf) */"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    make -f make64
+
+    cd linux64llr
+
+    make llr64 \
+      LFLAGS="-L${gmp}/lib -lgmp -lm -lpthread"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 llr64 $out/bin/llr
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Primality proving program for numbers of the form N = k*b^n +/- 1, (k < b^n)";
+    homepage = "http://jpenne.free.fr/index2.html";
+    maintainers = with lib.maintainers; [ dstremur ];
+    license = lib.licenses.unfree;
+    # LLR links against gwnum.a which is part of the proprietary gwnum library,
+    # making the resulting binary unfree even though the LLR source code itself
+    # may have different licensing terms.
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "llr";
+  };
+})
@@ -1,5 +1,18 @@
+diff --git a/resources/package.json b/resources/package.json
+index de39ccc..d42b7fb 100644
+--- a/resources/package.json
+++ b/resources/package.json
+@@ -25,7 +25,7 @@
+     "@logseq/rsapi": "0.0.92",
+     "@sentry/electron": "2.5.1",
+     "abort-controller": "3.0.0",
+-    "better-sqlite3": "12.4.1",
+    "better-sqlite3": "12.8.0",
+     "chokidar": "^3.5.1",
+     "command-exists": "1.2.9",
+     "diff-match-patch": "1.0.5",
 diff --git a/static/yarn.lock b/static/yarn.lock
-index 36b4476..0e7c5ee 100644
+index 36b4476..4738ef9 100644
 --- a/static/yarn.lock
 +++ b/static/yarn.lock
@@ -1444,11 +1444,6 @@ ansi-regex@^5.0.1:
@@ -26,6 +39,21 @@ index 36b4476..0e7c5ee 100644
 anymatch@~3.1.2:
   version "3.1.3"
   resolved "https://registry.yarnpkg.com/anymatch/-/anymatch-3.1.3.tgz#790c58b19ba1720a84205b57c618d5ad8524973e"
+@@ -1653,10 +1643,10 @@ baseline-browser-mapping@^2.8.25:
+   resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.8.28.tgz#9ef511f5a7c19d74a94cafcbf951608398e9bdb3"
+   integrity sha512-gYjt7OIqdM0PcttNYP2aVrr2G0bMALkBaoehD4BuRGjAOtipg0b6wHg1yNL+s5zSnLZZrGHOw4IrND8CD+3oIQ==
+ 
+-better-sqlite3@12.4.1:
+-  version "12.4.1"
+-  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.4.1.tgz#f78df6c80530d1a0b750b538033e6199b7d30d26"
+-  integrity sha512-3yVdyZhklTiNrtg+4WqHpJpFDd+WHTg2oM7UcR80GqL05AOV0xEJzc6qNvFYoEtE+hRp1n9MpN6/+4yhlGkDXQ==
+better-sqlite3@12.8.0:
+  version "12.8.0"
+  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.8.0.tgz#ec9ccd4a426a35f3b9355c147af6c92a6ddd6862"
+  integrity sha512-RxD2Vd96sQDjQr20kdP+F+dK/1OUNiVOl200vKBZY8u0vTwysfolF6Hq+3ZK2+h8My9YvZhHsF+RSGZW2VYrPQ==
+   dependencies:
+     bindings "^1.5.0"
+     prebuild-install "^7.1.1"
@@ -3081,11 +3071,6 @@ get-caller-file@^2.0.5:
   resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
@@ -54,7 +54,10 @@ stdenv.mkDerivation (finalAttrs: {

    ./electron-forge-package-instead-of-make.patch
    ./electron-forge-disable-signing.patch
-    ./fix-yarn-lock.patch
+
+    # bumps better-sqlite3 to work with electron 39+
+    # also fixes outdated yarn.lock
+    ./bump-better-sqlite3.patch
  ];

  mavenRepo = stdenv.mkDerivation {
@@ -109,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
    name = "logseq-${finalAttrs.version}-yarn-deps-static-resources";
    inherit (finalAttrs) src patches;
    postPatch = "cd ./static";
-    hash = "sha256-zAGEQlOqKfPDrIoZQUnjBifgdYDYRsiHH7PUNrd0u+8=";
+    hash = "sha256-5DBVlCWlUXYvo0bJWQwvSNMW4P9E8kjE9RQe9/ViJM0=";
  };

  yarnOfflineCacheAmplify = fetchYarnDeps {
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minutor";
-  version = "2.21.0";
+  version = "26.1";

  src = fetchFromGitHub {
    owner = "mrkite";
    repo = "minutor";
    tag = finalAttrs.version;
-    sha256 = "0ldjnrk429ywf8cxdpjkam5k73s6fq7lvksandfn3xn7gl9np5rk";
+    sha256 = "sha256-jz+3G1/4+QlUTRBOFKaTWPSBbJRcWDzFWsG+dqVFMBg=";
  };

  preConfigure = ''
@@ -24,17 +24,17 @@ in

 maven.buildMavenPackage rec {
  pname = "mvnd";
-  version = "1.0.3";
+  version = "1.0.5";
  src = fetchFromGitHub {
    owner = "apache";
    repo = "maven-mvnd";
    rev = version;
-    sha256 = "sha256-vlJG2uDY93iri1X7SYPRufAIN4fhAjCd8gCeCdz/QDE=";
+    sha256 = "sha256-/ODRS6xaxkn7okUh8phN1GUNG7tDAKjmAIQn8NrC+ag=";
  };

  # need graalvm at build-time for the `native-image` tool
  mvnJdk = graalvmPackages.graalvm-ce;
-  mvnHash = "sha256-n6ZKEXDzyzMfUZt3WHkwCDB68gm30UGrFecffFy7ytA=";
+  mvnHash = "sha256-flA72bE6on3KolJ/tQT1ad92GQnybyykPbWG4Yn88rU=";

  nativeBuildInputs = [
    graalvmPackages.graalvm-ce
@@ -252,7 +252,7 @@ if [[ -z $noBootLoader ]]; then
      # system. This preserves the validity of their absolute paths after changing
      # the root with `nixos-enter`.
      # Without this the bootloader installation may fail due to options that
-      # contain paths referenced during evaluation, like initrd.secretPaths.
+      # contain paths referenced during evaluation, like initrd.secrets.
      # when not root, re-execute the script in an unshared namespace
      mount --rbind --mkdir / "$mountPoint"
      mount --make-rslave "$mountPoint"
@@ -29,6 +29,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    installShellFiles
  ];

+  __darwinAllowLocalNetworking = true;
+
  # These fail based on timestamp issues with bundled certificates
  # See https://github.com/NixOS/nixpkgs/issues/497682 & https://github.com/pendulum-project/ntpd-rs/pull/2133
  checkFlags = [
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_desktop_notifications";
-  version = "0.110.0";
+  version = "0.111.0";

  src = fetchFromGitHub {
    owner = "FMotalleb";
    repo = "nu_plugin_desktop_notifications";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jd4T0+id/1rpjOWuzqbqxnyvmoe4LCiYux/dJlO3F6c=";
+    hash = "sha256-hcjJa+Y0N7QgVpxc/OJYCpYaZ6FLQiabvk7RLUjhZAI=";
  };

-  cargoHash = "sha256-7ZiQr8RBQCNQK3/tLasilZcu+HWp066iDFI67L8iZMg=";
+  cargoHash = "sha256-nDRu9gaJGfuCKMgBptZPS5ANaPwKJ7BGAe10QI8skRM=";

  passthru.updateScript = nix-update-script { };

@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_hcl";
-  version = "0.110.0";
+  version = "0.111.0";

  src = fetchFromGitHub {
    owner = "Yethal";
    repo = "nu_plugin_hcl";
    tag = finalAttrs.version;
-    hash = "sha256-8P0gNLe8OjB3NoDxHtDUp859O1O4WwmDeACJe5u8GPg=";
+    hash = "sha256-OeMDlzioXt4Hn3VUP7YaMHF0c8BhRDrHdrQRC595Ypc=";
  };

-  cargoHash = "sha256-ACtnklcypc2gjWujPSLUgwGbah2G+QHLD7fr7S7QNAg=";
+  cargoHash = "sha256-8ycqhuVQGyT4DabOLJIsSXY324h91zH/nUw/2XrAxwc=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];

@@ -5,8 +5,8 @@
 }:
 let
  pname = "oathkeeper";
-  version = "25.4.0";
-  commit = "2020997ed914fbc8c4b048effbe28841c34ac23d";
+  version = "26.2.0";
+  commit = "c84dbe07ecbf6f10154f04ec49b137a115155289";
 in
 buildGoModule {
  inherit pname version commit;
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "ory";
    repo = "oathkeeper";
    rev = "v${version}";
-    hash = "sha256-J+76oQbm/CulzfJOhXVzlXWNtpl7PaEJPM96p1ko3Cg=";
+    hash = "sha256-Dux9g5AWnbj9kXoIogVneOYywgg9TnyXqP41YT/1C8k=";
  };

-  vendorHash = "sha256-YNpWjDOcjELCpNcxmd8eatMvPUTHos52yvDg4jsHAQk=";
+  vendorHash = "sha256-/Qgdes8EAxP9FDKbahQdCpAD7PSe4iCkUvL1+poqaWc=";

  tags = [
    "sqlite"
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pageedit";
-  version = "2.7.5";
+  version = "2.7.6";

  src = fetchFromGitHub {
    owner = "Sigil-Ebook";
    repo = "pageedit";
    tag = finalAttrs.version;
-    hash = "sha256-8qR7oucNeQoRHZSLg1cvJo/eEdFmMV+m7Pjr7rdWVYY=";
+    hash = "sha256-i/y0I6DV6MTuq1gLx8+lDGlhMHlUSi/VqJAUK52JhYA=";
  };

  nativeBuildInputs = with qt6Packages; [
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "panache";
-  version = "2.19.0";
+  version = "2.25.0";

  src = fetchFromGitHub {
    owner = "jolars";
    repo = "panache";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OhFAbufoQ869i3BGTc7uWs3DzA4rR5lZCTmVpkaTRyg=";
+    hash = "sha256-hlzg4BFivmicON4llXDzBT2c0B8ic/orSi7MXFZ6sDg=";
  };

-  cargoHash = "sha256-BoOOhKOjkVGs1YAm6TWOF9b6Zcgn7f8+j3fOScdorAc=";
+  cargoHash = "sha256-syCoLhxZduTLXjsKFoZulSrFUBjmP4HJwEIO/PpMIiw=";

  nativeBuildInputs = [
    installShellFiles
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.226.0";
+  version = "3.227.0";
  pulumiPkgs = {
    x86_64-linux = [
      {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.226.0-linux-x64.tar.gz";
-        sha256 = "1v60sszili8wxnhn1b9dp3fv0662shp6xa03l0ybnglwkz8fby3b";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.227.0-linux-x64.tar.gz";
+        sha256 = "10kz7zzh763z1aw36kz1wypl7vjz1c9c0w6h9p6h6wr9824apmxl";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.51.0-linux-amd64.tar.gz";
@@ -57,8 +57,8 @@
        sha256 = "0azr8k0c3nj0r9lihwwaxz9081xgrqnagnpmanxvmjvkjp88j4q8";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.61.0-linux-amd64.tar.gz";
-        sha256 = "182pn8ra0nhm4j6gkakdl5wik75wrhdqf7jpn52gyln6ai0nywri";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.62.0-linux-amd64.tar.gz";
+        sha256 = "1par00sz7fkkg1l18a9gk34pr0s60mfag25dv3y9ggacd87d0g4j";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.11.1-linux-amd64.tar.gz";
@@ -73,8 +73,8 @@
        sha256 = "09x25vfq2fbxcmkcjaj0yr2xhcplyj0w2z4c0lwcl368fnk9z9zy";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.15.0-linux-amd64.tar.gz";
-        sha256 = "0x1lplrp26a4qnsf49q6x11midpgnkfp3ryg16w7cpyq18bf2xqa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.16.0-linux-amd64.tar.gz";
+        sha256 = "0jfbhy16z988y9afma5dccvqf7xq0lbmkl2dgnizpyr5klwg60nb";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.12.1-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
    ];
    x86_64-darwin = [
      {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.226.0-darwin-x64.tar.gz";
-        sha256 = "0sw8yan7g7s7j8816i382j3l8mk5dkk34ppqcavdnlp5j3y331v7";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.227.0-darwin-x64.tar.gz";
+        sha256 = "0n4pxc61b63ilwadcza5y6lkc8bblv0kmlr6kcmha7vr79w1bdjj";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.51.0-darwin-amd64.tar.gz";
@@ -215,8 +215,8 @@
        sha256 = "1vi0pry8si8qv44i1dr4756grpmd4l0wrcdysam1y2rcfszy6597";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.61.0-darwin-amd64.tar.gz";
-        sha256 = "1limkhwc7phij44z20bvikgf0sd3cd1n28av6phw02g7c2gph04l";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.62.0-darwin-amd64.tar.gz";
+        sha256 = "0az4vxm9gd1q91zxf4l3qj8yysvz9zndf9bycx307cpp1a41kahp";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.11.1-darwin-amd64.tar.gz";
@@ -231,8 +231,8 @@
        sha256 = "1jyi9mp8dc5hkb493kz4mkhcn9rvz1whj42vfbml5zdnywhq346f";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.15.0-darwin-amd64.tar.gz";
-        sha256 = "1f0jnrgnw0kma86a7d1hijh41prp7c7630gnp3sff7489caxhphm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.16.0-darwin-amd64.tar.gz";
+        sha256 = "0qz08sa43ih47j2hxbrkchynf4i6095w704krgg51ghqjljj7rda";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.12.1-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
    ];
    aarch64-linux = [
      {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.226.0-linux-arm64.tar.gz";
-        sha256 = "0hlyw7lybph57bhvr6hmwqsnzfwdssh426blfhsbjdasrc4vapl7";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.227.0-linux-arm64.tar.gz";
+        sha256 = "1nsm4qc290k7f8dnkw8n4505lyrrpmrxin8b3cbanx93wh3rdhv6";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.51.0-linux-arm64.tar.gz";
@@ -373,8 +373,8 @@
        sha256 = "05gd0awsw0f6agz4i6nv17lssp4q3p97bwlqnzrcbmlrcg4v2v8v";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.61.0-linux-arm64.tar.gz";
-        sha256 = "1y66c9mc9521gdpi6kc54ri1drg07kvdxi73rfw8kpx7sv75gvk8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.62.0-linux-arm64.tar.gz";
+        sha256 = "0zp097kygxn0vwsgvwxvq2sasp4i6c6zmsf88ay9a4685rzd1lak";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.11.1-linux-arm64.tar.gz";
@@ -389,8 +389,8 @@
        sha256 = "1a9fwnf15l3ld0a17v2p66jxqav4rawhixy6rgs5065nbrf29vys";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.15.0-linux-arm64.tar.gz";
-        sha256 = "0fb3zpyf2b519ipc7jvp6x366zpympqfcg4h3ah4mkh094a61ljp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.16.0-linux-arm64.tar.gz";
+        sha256 = "04gp3pngf5sg8s936sadj1agqbvd8n94cwsj4357wnqnk2di6jds";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.12.1-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
    ];
    aarch64-darwin = [
      {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.226.0-darwin-arm64.tar.gz";
-        sha256 = "162b38755w4f71ixcjza31k5hsygvf682rk51g3kiclc2gq3k7yk";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.227.0-darwin-arm64.tar.gz";
+        sha256 = "0fcf93j2b05brdpjszflkd63ldyv5rkclwj6hs5byf8nqcc6zyqq";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.51.0-darwin-arm64.tar.gz";
@@ -531,8 +531,8 @@
        sha256 = "06gmag24my89yi995akp45hrhlqv8jj16g9mlzn1mznl1p0qmm74";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.61.0-darwin-arm64.tar.gz";
-        sha256 = "0fifd3n6z0wjr600sd4011l4fds2hhljymzl38zpjq4qfz262pqh";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.62.0-darwin-arm64.tar.gz";
+        sha256 = "09g83vy7bx4i5b3rnppwwy3n33f0rbvz1i12dnlpn588hffcpl20";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.11.1-darwin-arm64.tar.gz";
@@ -547,8 +547,8 @@
        sha256 = "1msppdp4navjhkp7lzngmp056y6x3fqb30r6wq5a53kyvi43x0ik";
      }
      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.15.0-darwin-arm64.tar.gz";
-        sha256 = "182xxaz0hsg2mg2r80hip73aqfhlnz8z96jjq0xrl74jmwn4pgzl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.16.0-darwin-arm64.tar.gz";
+        sha256 = "0da15hm5qsh3kk7c37fg4sk1196ra7cz8ksng7cbh150qqq4zmxv";
      }
      {
        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.12.1-darwin-arm64.tar.gz";
@@ -0,0 +1,25 @@
+{
+  lib,
+  mkPulumiPackage,
+}:
+mkPulumiPackage rec {
+  owner = "pulumi";
+  repo = "pulumi-linode";
+  version = "5.4.0";
+  rev = "v${version}";
+  hash = "sha256-XfZKiGODCncvbHRc4EuwItMWuJyliFxud5GO2X4h1qg=";
+  vendorHash = "sha256-dabWCYvIvPeHgbDGlgULAyLAARO5IYqYnSkUs5p6/PM=";
+  cmdGen = "pulumi-tfgen-linode";
+  cmdRes = "pulumi-resource-linode";
+  extraLdflags = [
+    "-X=github.com/pulumi/${repo}/provider/v5/pkg/version.Version=v${version}"
+  ];
+  __darwinAllowLocalNetworking = true;
+  meta = {
+    description = "Linode Pulumi resource package, providing multi-language access to Linode";
+    mainProgram = "pulumi-resource-linode";
+    homepage = "https://github.com/pulumi/pulumi-linode";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ purcell ];
+  };
+}
@@ -10,7 +10,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "silverbullet";
-  version = "2.4.1";
+  version = "2.5.2";

  src =
    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@@ -31,22 +31,22 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    sources = {
      "x86_64-linux" = fetchzip {
        url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet-server-linux-x86_64.zip";
-        hash = "sha256-1jUN22T7BABBEiXp1LwMUaw/ELR7CZS2iKLaoiYKeLk=";
+        hash = "sha256-OvwFYPxR6N/njtaaNX0TolgRxZnhX3qBIvT2okoy2cQ=";
        stripRoot = false;
      };
      "aarch64-linux" = fetchzip {
        url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet-server-linux-aarch64.zip";
-        hash = "sha256-F0CTVbVK2xaqNlHX1If8EhlDRqb+XIZlWmzkEYFGS3M=";
+        hash = "sha256-+VhgiAvDApb7Xi3Ob+fDpq1LrhmqAANZGjLsyhbmfNQ=";
        stripRoot = false;
      };
      "x86_64-darwin" = fetchzip {
        url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet-server-darwin-x86_64.zip";
-        hash = "sha256-lWUTNGt5u7q5cs7xoNP/k7GYUq/A3xHI6rza8HYOK5Y=";
+        hash = "sha256-jC39IZlFRnZ86I6JMXaaEyET4jwmOI0XKohxxr4VvZc=";
        stripRoot = false;
      };
      "aarch64-darwin" = fetchzip {
        url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet-server-darwin-aarch64.zip";
-        hash = "sha256-1lPGipv6jW0Awjy7V9HORK5oh5RDpBBrT4zZk0oSVWY=";
+        hash = "sha256-7njnFI3Ui7+6/kmbdCeEZ4f4gXKfzIx3YCfyB99k/f4=";
        stripRoot = false;
      };
    };
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "simple-http-server";
-  version = "0.6.14";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "TheWaWaR";
    repo = "simple-http-server";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Ka6PU2Mbu7wIyj5hbAhUa8ncK61wcM+huSKYh/kiH7M=";
+    sha256 = "sha256-JG9dqc8E8rUjSG3pBypamjNqFpM87r7cK+zP+PSyMCQ=";
  };

-  cargoHash = "sha256-0dODUHXeIVltwMn4U9Y4/NCOTuxkfVxpRYzXIHSTfQQ=";
+  cargoHash = "sha256-3DelxN2oTFZzoSke7uLbSKYJnF2Bq4MWDvfnKTIsbGk=";

  nativeBuildInputs = [ pkg-config ];

@@ -6,7 +6,7 @@
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
-  electron,
+  electron_39,
  rustPlatform,
  cargo,
  rustc,
@@ -19,6 +19,10 @@
  nix-update-script,
  removeReferencesTo,
 }:
+let
+  electron = electron_39;
+  pnpm = pnpm_10_29_2;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "splayer";
  version = "3.0.0";
@@ -37,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
      version
      src
      ;
-    pnpm = pnpm_10_29_2;
+    inherit pnpm;
    fetcherVersion = 2;
    hash = "sha256-PTfZopse+9RS7qh0miLu3duYlWDfifZS254tZKqgxKk=";
  };
@@ -53,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    pnpmConfigHook
-    pnpm_10_29_2
+    pnpm
    nodejs
    rustPlatform.cargoSetupHook
    cargo
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "squashfs";
-  version = "4.7.4";
+  version = "4.7.5";

  src = fetchFromGitHub {
    owner = "plougher";
    repo = "squashfs-tools";
    rev = finalAttrs.version;
-    hash = "sha256-xvTSGVwtzJjoAIF6GClASUIB5eIk+uquQNNzHIuwkuY=";
+    hash = "sha256-rQ69sXvi6wY8yRyuQzcJZ6MvVGBbIw7vG+kYVHvfQQ8=";
  };

  strictDeps = true;
@@ -0,0 +1,25 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "telemt";
+  version = "3.3.15";
+
+  src = fetchFromGitHub {
+    owner = "telemt";
+    repo = "telemt";
+    tag = version;
+    hash = "sha256-pydVq+6ggg11UOJaHu1/YSsTkPwfm0DkD5y7VCmC0E8=";
+  };
+
+  cargoHash = "sha256-JfG4lFeQDekw0taNQknEQyw5sMyNZrtcL2qvz5K9u20=";
+
+  meta = {
+    mainProgram = "telemt";
+    description = "MTProxy for Telegram on Rust + Tokio";
+    homepage = "https://github.com/telemt/telemt";
+    maintainers = with lib.maintainers; [ r4v3n6101 ];
+  };
+}
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "tkey-ssh-agent";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "tillitis";
    repo = "tkey-ssh-agent";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Uf3VJJfZn4UYX1q79JdaOfrore+L/Mic3whzpP32JV0=";
+    hash = "sha256-VwhWIQ+ZTwYD3NwxCImrtK49+i31Cc7xBjx5Cxvm+PA=";
  };

-  vendorHash = "sha256-SFyp1UB6+m7/YllRyY56SwweJ3X175bChXQYiG2M7zM=";
+  vendorHash = "sha256-/lSC2+TjG2Ps9t8BbcgXIFWeFykszJM3hr2DqSrnkO8=";

  subPackages = [
    "cmd/tkey-ssh-agent"
@@ -8,16 +8,16 @@

 buildGo125Module (finalAttrs: {
  pname = "traefik";
-  version = "3.6.10";
+  version = "3.7.0-ea.1";

  # Archive with static assets for webui
  src = fetchzip {
    url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-WYHHpS721dlkWdOEj+jwJkQ/vsiP2PnmFI50M9I8sbs=";
+    hash = "sha256-WrePvE9zzeUgVCK3zUdETFFJJRNLAONhjf05jg7Ogx0=";
    stripRoot = false;
  };

-  vendorHash = "sha256-q2uy0YrE1D8V0EopKWJLbq2hFcjn3oyanwNJ27yyC+k=";
+  vendorHash = "sha256-pCk2ujaUW5K7AiwHYO9Q29pQSptLHWG2j6XSeqTABR4=";

  proxyVendor = true;

@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ttl";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "lance0";
    repo = "ttl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1E6Y4HYJmOj/9j4llA0iwIWW7pSofIDCWvg9Aka9URI=";
+    hash = "sha256-btzKLVPI86AidhLT60ct58pqoH9K/Hh4D4zvQ45F0Hg=";
  };

-  cargoHash = "sha256-3N9pJUU0dmzE5v7wz8eypVbxrLGrKQUyBhSLQgi9yJ0=";
+  cargoHash = "sha256-76H20FE7Sy39NrwKajtKym4nb6aFNEOcrcWn5Cxhgjo=";

  nativeBuildInputs = [
    installShellFiles
@@ -92,9 +92,16 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace $out/opt/UltimateDoomBuilder/builder --replace-fail mono ${mono}/bin/mono
    substituteInPlace $out/opt/UltimateDoomBuilder/builder --replace-fail Builder.exe $out/opt/UltimateDoomBuilder/Builder.exe

-    # GTK is loaded dynamically by Mono at runtime
+    # GTK, OpenGL, and other libraries are loaded dynamically by Mono at runtime
    wrapProgram $out/opt/UltimateDoomBuilder/builder \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gtk2-x11 ]}"
+      --prefix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          gtk2-x11
+          libGL
+          libpng
+          libx11
+        ]
+      }"

    ln -s $out/opt/UltimateDoomBuilder/builder $out/bin/ultimate-doom-builder

@@ -1,6 +1,7 @@
 {
  android-tools,
  clang,
+  dbus,
  expat,
  fetchFromGitHub,
  fontconfig,
@@ -56,6 +57,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    wrapProgram $out/bin/uad-ng --prefix LD_LIBRARY_PATH : ${
      lib.makeLibraryPath (
        [
+          dbus
          fontconfig
          freetype
          libglvnd
@@ -7,15 +7,15 @@

 buildNpmPackage rec {
  pname = "zwave-js-ui";
-  version = "11.14.0";
+  version = "11.15.0";

  src = fetchFromGitHub {
    owner = "zwave-js";
    repo = "zwave-js-ui";
    tag = "v${version}";
-    hash = "sha256-D1aZt4rdLdFrnd9kwr0SdodKWZU4fcE+XLnn3GxGjKg=";
+    hash = "sha256-L5kalrF7TB3ywE9ArvOWoDIGAPs17KwUWzjH5U9CE7E=";
  };
-  npmDepsHash = "sha256-khAy5TzaZzKzBlEvW5MiyS07yJxv2xxhZns3GfVs5YU=";
+  npmDepsHash = "sha256-KeC1vFVGsywEwPSgmnMqfvZee0UavkfBbAmn+3QeDlY=";

  passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;

@@ -1,10 +1,4 @@
-{
-  lib,
-  stdenv,
-  callPackage,
-  fetchurl,
-  ...
-}@args:
+{ callPackage, fetchurl, ... }@args:

 callPackage ./generic.nix (
  args
@@ -21,7 +15,5 @@ callPackage ./generic.nix (
      # SHA256 from http://www.boost.org/users/history/version_1_87_0.html
      sha256 = "af57be25cb4c4f4b413ed692fe378affb4352ea50fbe294a11ef548f4d527d89";
    };
-
-    patches = lib.optional stdenv.hostPlatform.isCygwin ./Fix-cygwin-build-187.patch;
  }
 )
@@ -1,10 +1,4 @@
-{
-  lib,
-  stdenv,
-  callPackage,
-  fetchurl,
-  ...
-}@args:
+{ callPackage, fetchurl, ... }@args:

 callPackage ./generic.nix (
  args
@@ -21,7 +15,5 @@ callPackage ./generic.nix (
      # SHA256 from http://www.boost.org/users/history/version_1_89_0.html
      sha256 = "85a33fa22621b4f314f8e85e1a5e2a9363d22e4f4992925d4bb3bc631b5a0c7a";
    };
-
-    patches = lib.optional stdenv.hostPlatform.isCygwin ./Fix-cygwin-build-189.patch;
  }
 )
@@ -255,7 +255,13 @@ stdenv.mkDerivation {
        extraPrefix = "libs/context/";
        hash = "sha256-Z8uw2+4IEybqVcU25i/0XJKS16hi/+3MXUxs53ghjL0=";
      })
-    ];
+    ]
+    ++ lib.optional (
+      stdenv.hostPlatform.isCygwin && lib.versionAtLeast version "1.87" && lib.versionOlder version "1.88"
+    ) ./Fix-cygwin-build-187.patch
+    ++ lib.optional (
+      stdenv.hostPlatform.isCygwin && lib.versionAtLeast version "1.89" && lib.versionOlder version "1.90"
+    ) ./Fix-cygwin-build-189.patch;

  meta = {
    homepage = "http://boost.org/";
@@ -94,7 +94,7 @@ mapAliases {
  bower = throw "bower was removed because it was deprecated"; # added 2025-09-17
  inherit (pkgs) bower2nix; # added 2024-08-23
  browserify = throw "browserify has been removed because it was unmaintained in nixpkgs"; # Added 2026-03-01
-  browser-sync = throw "'browser-sync' has been removed because it was unmaintained in nixpkgs"; # Added 2026-01-26
+  inherit (pkgs) browser-sync; # Added 2026-03-10
  inherit (pkgs) btc-rpc-explorer; # added 2023-08-17
  inherit (pkgs) carbon-now-cli; # added 2023-08-17
  inherit (pkgs) carto; # added 2023-08-17
@@ -10,7 +10,7 @@
  numpy,

  # tests
-  pytest-cov,
+  pytest-cov-stub,
  pytest-xdist,
  pytestCheckHook,
 }:
@@ -27,12 +27,17 @@ buildPythonPackage rec {
    hash = "sha256-k4rcalwznKS2QvmyTLra+ciWFifnILW/DDdB8D+clxQ=";
  };

+  postPatch = ''
+    # don't require pytest-cov
+    sed -i "/required_plugins/d" pyproject.toml
+  '';
+
  build-system = [ hatchling ];

  dependencies = [ numpy ];

  nativeCheckInputs = [
-    pytest-cov
+    pytest-cov-stub
    pytest-xdist
    pytestCheckHook
  ];
@@ -89,16 +89,22 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-H+kXxA/6rKzYA19v7Zlx2HbIg/DGicD5FDIs0noVGSk=";
  };

-  postPatch = ''
+  postPatch =
    # Nixpkgs is taking the version from `chromadb_rust_bindings` which is versioned independently
-    substituteInPlace pyproject.toml \
-      --replace-fail "dynamic = [\"version\"]" "version = \"${finalAttrs.version}\""
-
+    ''
+      substituteInPlace pyproject.toml \
+        --replace-fail "dynamic = [\"version\"]" "version = \"${finalAttrs.version}\""
+    ''
    # Flip anonymized telemetry to opt in versus current opt-in out for privacy
-    substituteInPlace chromadb/config.py \
-      --replace-fail "anonymized_telemetry: bool = True" \
-                     "anonymized_telemetry: bool = False"
-  '';
+    + ''
+      substituteInPlace chromadb/config.py \
+        --replace-fail "anonymized_telemetry: bool = True" \
+                       "anonymized_telemetry: bool = False"
+    ''
+    # error: queries overflow the depth limit!
+    + ''
+      sed -i '1i #![recursion_limit = "256"]' rust/segment/src/lib.rs
+    '';

  pythonRelaxDeps = [
    "fastapi"
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ckzg";
-  version = "2.1.5";
+  version = "2.1.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = "c-kzg-4844";
    tag = "v${version}";
-    hash = "sha256-Sv22Cj1PRMUi9k+0Yj6yi8vCsOr+bVF7QdmQOqJIkBY=";
+    hash = "sha256-T2EdLKEyyTM3/Ro5UfdGu3mNZKz0nk15pmBSGZplA+M=";
  };

  build-system = [ setuptools ];
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "lizard";
-  version = "1.20.0";
+  version = "1.21.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "terryyin";
    repo = "lizard";
    tag = version;
-    hash = "sha256-HNpCg/ScD0aDdpVXA9Nb9QU+4ww6Kp2qIeu9Lj0O7A4=";
+    hash = "sha256-tWjX3QSVUB2YhsW3010aKPN3iJDr6aejAp0RkC/CcNE=";
  };

  propagatedBuildInputs = [
@@ -11,14 +11,14 @@
 buildPythonPackage rec {
  pname = "pulumi-aws";
  # Version is independent of pulumi's.
-  version = "7.16.0";
+  version = "7.23.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pulumi";
    repo = "pulumi-aws";
    tag = "v${version}";
-    hash = "sha256-Vy6Azt3rRQliskt26Jjeos/Tj4MEz26owtyfhRPzSP0=";
+    hash = "sha256-yD6VJ51AWJk4jlHJUtoHXGPtQvAyS0EuItbS1Obq6lc=";
  };

  sourceRoot = "${src.name}/sdk/python";
@@ -1,46 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pyaes,
-  pysocks,
-  pytestCheckHook,
-  pytest-asyncio,
-}:
-
-buildPythonPackage rec {
-  pname = "pyrogram";
-  version = "2.0.106";
-
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pyrogram";
-    repo = "pyrogram";
-    rev = "v${version}";
-    hash = "sha256-W/t3v5q0s+ba0Uly+JUaJl75uDQGeFaj2zDKGRMIMow=";
-  };
-
-  propagatedBuildInputs = [
-    pyaes
-    pysocks
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-asyncio
-  ];
-
-  pythonImportsCheck = [
-    "pyrogram"
-    "pyrogram.errors"
-    "pyrogram.types"
-  ];
-
-  meta = {
-    description = "Telegram MTProto API Client Library and Framework for Python";
-    homepage = "https://github.com/pyrogram/pyrogram";
-    license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
@@ -11,18 +11,19 @@
  mashumaro,
  pytest-asyncio,
  pytestCheckHook,
+  syrupy,
 }:

 buildPythonPackage rec {
  pname = "pysmlight";
-  version = "0.2.16";
+  version = "0.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "smlight-tech";
    repo = "pysmlight";
    tag = "v${version}";
-    hash = "sha256-SYMblXe0fkhLTzs42qrB+MwivYXhpgjLaO9c0zcCwmo=";
+    hash = "sha256-WT7fGHa2vD7BlIqV3BOR1C4cFJDzMm5/cJ7ihOg2aAs=";
  };

  build-system = [
@@ -43,6 +44,7 @@ buildPythonPackage rec {
    aresponses
    pytest-asyncio
    pytestCheckHook
+    syrupy
  ];

  __darwinAllowLocalNetworking = true;
@@ -1,34 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "tgcrypto";
-  version = "1.2.5";
-
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "pyrogram";
-    repo = "tgcrypto";
-    tag = "v${version}";
-    hash = "sha256-u+mXzkmM79NBi4oHnb32RbN9WPnba/cm1q2Ko0uNEZg=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "tgcrypto" ];
-
-  meta = {
-    description = "Fast and Portable Telegram Crypto Library for Python";
-    homepage = "https://github.com/pyrogram/tgcrypto";
-    license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "troposphere";
-  version = "4.9.6";
+  version = "4.10.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "cloudtools";
    repo = "troposphere";
    tag = version;
-    hash = "sha256-eiwz1rpEhlCIvI7hrZrknbkEhDkG2SMZkN3Mk6pfuLA=";
+    hash = "sha256-Pna5L2uO8KRN0L1XXRdFNWlPwNW9lAfcGwKiyK3ihgE=";
  };

  propagatedBuildInputs = [ cfn-flip ];
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2026.3.2";
+  version = "2026.3.3";
  components = {
    "3_day_blinds" =
      ps: with ps; [
@@ -263,7 +263,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.3.2";
+  hassVersion = "2026.3.3";

 in
 python.pkgs.buildPythonApplication rec {
@@ -274,7 +274,7 @@ python.pkgs.buildPythonApplication rec {
  pyproject = true;

  # check REQUIRED_PYTHON_VER in homeassistant/const.py
-  disabled = python.pythonOlder "3.13";
+  disabled = python.pythonOlder "3.14";

  # don't try and fail to strip 6600+ python files, it takes minutes!
  dontStrip = true;
@@ -284,13 +284,13 @@ python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    tag = version;
-    hash = "sha256-ehvHw+/JZkQEYf4m+BbFc/2izomLsm7T4IPGzB8ehWk=";
+    hash = "sha256-NCrrG2jlbt879qo6peoBqtbU+d/lmbKqswEJbfvVUUI=";
  };

  # Secondary source is pypi sdist for translations
  sdist = fetchPypi {
    inherit pname version;
-    hash = "sha256-MICjwxCNwb5XvSayN13gf4b7/iPT4dCFYvi+nec+ctk=";
+    hash = "sha256-/8yJBUNcMLx7ONLY5rvbWsVA1+OtTSpZd3dNgEsG+0I=";
  };

  build-system = with python.pkgs; [
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pytest-homeassistant-custom-component";
-  version = "0.13.318";
+  version = "0.13.319";
  pyproject = true;

  disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "MatthewFlamm";
    repo = "pytest-homeassistant-custom-component";
    tag = version;
-    hash = "sha256-U/EizfW6cUU0uWT7RgRDhXLBRGzE7YW7zpcdXec9MjA=";
+    hash = "sha256-dCmZaMyrBeOla+g43j4P9M3N1DQ0SN3HxqkKSamPlOQ=";
  };

  build-system = [ setuptools ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2026.3.2";
+  version = "2026.3.3";
  pyproject = true;

  disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    tag = version;
-    hash = "sha256-7nTKvRChvxGSDaQXnivd/6RKA466ygYMpezjS79Q0qE=";
+    hash = "sha256-J3arzNIBwmtvZBoot6niVWAQJitR4novo9qkREfpCu8=";
  };

  build-system = [
@@ -28,62 +28,68 @@ stdenv.mkDerivation {
  inherit src;

  patches = [
-    # Linux: Use struct kiocb * for aops write_begin/end
-    (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/a765a9ddd412c8d1e5cb0f5cf497a8606251811e.patch";
-      hash = "sha256-RkIAdXMvelnWs4YB3OMj6AIQlUbSqdKJpwc6wiSZzrM=";
-    })
-    # linux: remove implied def HAVE_LINUX_FILEMAP_GET_FOLIO
-    (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/c379ff006d8b7db425f7648321c549ab24919d92.patch";
-      hash = "sha256-fDtX3NhWIWupTArEauCM2rEaO3l8jWBVC5mAMil2+nU=";
-    })
-    # LINUX: Zero code on EEXIST in afs_linux_read_cache
-    (fetchpatch {
-      url = "https://github.com/openafs/openafs/commit/eb6753d93b930ad7d65772a9751117f6969a5e92.patch";
-      hash = "sha256-97/MdG9DrHEtOKCRLCTgl6ZEtqLUsaNs9LcAzcyrTF4=";
-    })
    # Linux: Use get_tree_nodev
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16646/revisions/d8202bcd24c90cfef138e54264355d242d8f2f2a/patch";
-      decode = "base64 -d";
-      hash = "sha256-lj7tRCrgWFPFsd5cMg9CQAFOx3VYUf3fS4JGNyAgnWk=";
+      url = "https://github.com/openafs/openafs/commit/c02a8f451b48766aa163e729abe40d145751b2dc.patch";
+      hash = "sha256-9okSQLV4tW1wjoffQXPneZbu6tTRqrqVPbEOwZmaD+E=";
+    })
+    # LINUX: Re-dirty folio on writepages recursion
+    (fetchpatch {
+      url = "https://github.com/openafs/openafs/commit/11849e96820eca64d91742a8c521614e1e99d9fa.patch";
+      hash = "sha256-F2MOqEDaj4e0Xj1mvs7v61cutZY3cO22p9iIp2bLiRQ=";
    })
    # Linux: Introduce LINUX_WRITE_CACHE_PAGES_USES_FOLIOS
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16650/revisions/cef9524c481520040dc93a02f5df9cd9eb8907a2/patch";
-      decode = "base64 -d";
-      hash = "sha256-SUJxhIL1vNDS8IO6GVGQ8aZOa6XabR3qFfTzWV6umao=";
+      url = "https://github.com/openafs/openafs/commit/63a3503240c06187fa87514e5ea421cece483422.patch";
+      hash = "sha256-ZWV8IZ8CeFQaEOamqKfkXuUccSxCRFNkZ7/kxKbEuis=";
    })
    # Linux: Avoid write_cache_pages() for ->writepages()
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16648/revisions/dd83364354692eaa323b246df17fec2a3f11057d/patch";
+      url = "https://gerrit.openafs.org/changes/16704/revisions/d465a07a98c2b0b2c23780571a8fe70c2584473a/patch";
      decode = "base64 -d";
-      hash = "sha256-3hPqwfkpRkS/XXmWjl+zy4KmVL8RkBuhmC+O0D/h85U=";
+      hash = "sha256-2FOf+o36gbTHm90RxtOI7iXcgb6rv9nh9rSjZzL5O7A=";
+    })
+    # LINUX: Log warning on recursive folio writeback
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16705/revisions/d66ca6372461840c6ecaaa46ec293640c8f22573/patch";
+      decode = "base64 -d";
+      hash = "sha256-A383wDMkwnGFatBDHUGV8FVqPMjzvhqUnIWrP2C+ym4=";
    })
    # Linux: Move afs_root()/afs_fill_super() in osi_vfsops
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16673/revisions/dfd3e87daf227884fa0da7bbab83db1b9de9b882/patch";
+      url = "https://gerrit.openafs.org/changes/16706/revisions/988c70859f1d402022e9342e28f0c5a954760a72/patch";
      decode = "base64 -d";
-      hash = "sha256-mWv/C5Yus4EZFrsQObCiOGA3nO2DAl1JWm8+YMHaabA=";
+      hash = "sha256-JsZwGGa7dRT43RIUUY3hYCbbqPObd5bkDOHl9QK/MhE=";
    })
    # Linux: Use sockaddr_unsized for socket->ops->bind
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16683/revisions/1a5864a5ff777142de3110a6e7848fd5769f933a/patch";
+      url = "https://gerrit.openafs.org/changes/16707/revisions/e6069d6c35e848b5b388f4c47a2ecf0d72420198/patch";
      decode = "base64 -d";
-      hash = "sha256-lHRxDUIyFZNAvJ8J+4SfP9ETU/wnjGh6s5E+bmrQG08=";
+      hash = "sha256-hTRaTqOc0njW/RIsNTrFZ5uWTrQq04Fuh/Sk7K2Q5e4=";
    })
    # Linux: Pass 3rd parameter to filemap_alloc_folio()
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16684/revisions/870e0aeb9d6f26a814ee38ce1becf12b562b7fa1/patch";
+      url = "https://gerrit.openafs.org/changes/16708/revisions/48d2184ec95418cada68b70919b0afd9888bb945/patch";
      decode = "base64 -d";
-      hash = "sha256-DZfi6OK9TYovwmYNrgI+WxGS13cQjdGODlSn3rQO/Gk=";
+      hash = "sha256-CSGlXYkkLSHQoWK2xLpUYJDOUP/mlsxkTru2qdmbeQo=";
    })
    # Linux: implement aops->migrate_folio
    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/16689/revisions/6d294581969039eea65c974c3a8c565917df9c6a/patch";
+      url = "https://gerrit.openafs.org/changes/16709/revisions/2c51471aea08cc495a5d59fee6e651ba58c9d772/patch";
      decode = "base64 -d";
-      hash = "sha256-XXzrDfoG4BbEDp6C4TElN0+3ytTu4VP5goDiZlq8DjU=";
+      hash = "sha256-TtcblVczSp8b1bfd0ajWjK2LffAkgYr2+KUL2nEe8hs=";
+    })
+    # Linux: Use set_default_d_op() to set dentry ops
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16729/revisions/6d0a2107fcab28fc4ba64d365133d171b75bd3dc/patch";
+      decode = "base64 -d";
+      hash = "sha256-OKxR5zzVKSXPzudPl5jc7koObisQMMqq/d9kfrMem/M=";
+    })
+    # Linux: Use __getname()/__putname() to alloc name
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16738/revisions/a1754489f382aabd087f14c325d13a36faa5bf5c/patch";
+      decode = "base64 -d";
+      hash = "sha256-JizLrwnujybCkcbDIltGfgVtCc5fL3ZxWvgVbI1kKto=";
    })
  ];

@@ -1,16 +1,16 @@
 { fetchurl }:
 rec {
-  version = "1.8.14";
+  version = "1.8.15";
  src = fetchurl {
    url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    hash = "sha256-q1NpK5de3Y7tqIC0vDvADN3TT9DzFam0Y/Z5fSDGNFY=";
+    hash = "sha256-MvEN0kG12LhG5CWrnL8nW1VroYgL9998RZzZ60kFg1U=";
  };

  srcs = [
    src
    (fetchurl {
      url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      hash = "sha256-iKa+hnZUllDJCYfj8VEgF+Cqold0ctiARp4p0LqBQlU=";
+      hash = "sha256-kAGRw3T0VdJ/XMqqFjV0Z7gzKbWeyZWEsMsBJ+7ijsE=";
    })
  ];
 }
@@ -5460,9 +5460,9 @@ with pkgs;
    electron_40
    electron_41
    ;
-  electron = electron_38;
-  electron-bin = electron_38-bin;
-  electron-chromedriver = electron-chromedriver_38;
+  electron = electron_41;
+  electron-bin = electron_41-bin;
+  electron-chromedriver = electron-chromedriver_41;

  autoconf = callPackage ../development/tools/misc/autoconf { };
  autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
@@ -415,6 +415,7 @@ mapAliases {
  pyRFC3339 = throw "'pyRFC3339' has been renamed to/replaced by 'pyrfc3339'"; # Converted to throw 2025-10-29
  Pyro4 = throw "'Pyro4' has been renamed to/replaced by 'pyro4'"; # Converted to throw 2025-10-29
  Pyro5 = throw "'Pyro5' has been renamed to/replaced by 'pyro5'"; # Converted to throw 2025-10-29
+  pyrogram = throw "'pyrogram' has been removed as it was archived upstream"; # Added 2026-03-21
  pyrr = throw "pyrr has been removed because it is incompatible with NumPy 2.0+"; # Added 2026-02-18
  PyRSS2Gen = throw "'PyRSS2Gen' has been renamed to/replaced by 'pyrss2gen'"; # Converted to throw 2025-10-29
  pyside6-fluent-widgets = throw "pyside6-fluent-widgets has been removed, since it is unmaintained"; # added 2025-08-20
@@ -548,6 +549,7 @@ mapAliases {
  tensorflow-tensorboard = throw "'tensorflow-tensorboard' has been renamed to/replaced by 'tensorboard'"; # Converted to throw 2025-10-29
  tensorflow-tensorboard_2 = throw "'tensorflow-tensorboard_2' has been renamed to/replaced by 'tensorflow-tensorboard'"; # Converted to throw 2025-10-29
  testing-postgresql = throw "testing-postgresql has been removed, since it is unmaintained since 2017"; # added 2025-05-25
+  tgcrypto = throw "'tgcrypto' has been removed as it was archived upstream"; # Added 2026-03-21
  Theano = throw "'Theano' has been renamed to/replaced by 'theano'"; # Converted to throw 2025-10-29
  TheanoWithCuda = throw "'TheanoWithCuda' has been renamed to/replaced by 'theanoWithCuda'"; # Converted to throw 2025-10-29
  TheanoWithoutCuda = throw "'TheanoWithoutCuda' has been renamed to/replaced by 'theanoWithoutCuda'"; # Converted to throw 2025-10-29
@@ -13011,8 +13011,14 @@ self: super: with self; {

  pulumi-hcloud = pkgs.pulumiPackages.pulumi-hcloud.sdks.python;

+  pulumi-kubernetes = pkgs.pulumiPackages.pulumi-kubernetes.sdks.python;
+
+  pulumi-linode = pkgs.pulumiPackages.pulumi-linode.sdks.python;
+
  pulumi-random = pkgs.pulumiPackages.pulumi-random.sdks.python;

+  pulumiverse-talos = pkgs.pulumiPackages.pulumiverse-talos.sdks.python;
+
  pure-cdb = callPackage ../development/python-modules/pure-cdb { };

  pure-eval = callPackage ../development/python-modules/pure-eval { };
@@ -14813,8 +14819,6 @@ self: super: with self; {

  pyroaring = callPackage ../development/python-modules/pyroaring { };

-  pyrogram = callPackage ../development/python-modules/pyrogram { };
-
  pyroma = callPackage ../development/python-modules/pyroma { };

  pyroute2 = callPackage ../development/python-modules/pyroute2 { };
@@ -19211,8 +19215,6 @@ self: super: with self; {

  tftpy = callPackage ../development/python-modules/tftpy { };

-  tgcrypto = callPackage ../development/python-modules/tgcrypto { };
-
  thefuzz = callPackage ../development/python-modules/thefuzz { };

  thelogrus = callPackage ../development/python-modules/thelogrus { };