Merge commit '825a8a4f4670b6d8cea42b0e294dd237ddff22bc' into haskell-updates

.editorconfig

@@ -64,6 +64,9 @@ insert_final_newline = unset
 end_of_line = unset
 trim_trailing_whitespace = unset
 
+[*.json]
+insert_final_newline = unset
+
 [*.lock]
 indent_size = unset
 

doc/languages-frameworks/coq.section.md

@@ -10,6 +10,25 @@ The Coq derivation is overridable through the `coq.override overrides`, where ov
 
 The associated package set can be obtained using `mkCoqPackages coq`, where `coq` is the derivation to use.
 
+## Creating custom Coq environments with `coq.withPackages` {#coq-withPackages}
+
+The `coq.withPackages` function provides a convenient way to create a Coq environment that includes additional Coq packages. This is similar to how `python.withPackages` works for Python environments.
+
+The function takes a function that receives the Coq package set and returns a list of packages. It returns a wrapped Coq environment where all Coq binaries (`coqtop`, `coqc`, `coqdep`, `coqchk`, `coqide`, etc.) are configured with the appropriate environment variables to find the packages.
+
+### Usage {#coq-withPackages-usage}
+
+Here is an example of creating a Coq environment with specific packages.
+
+```nix
+coq.withPackages (
+  ps: with ps; [
+    mathcomp
+    bignums
+  ]
+)
+```
+
 ## Coq packages attribute sets: `coqPackages` {#coq-packages-attribute-sets-coqpackages}
 
 The recommended way of defining a derivation for a Coq library, is to use the `coqPackages.mkCoqDerivation` function, which is essentially a specialization of `mkDerivation` taking into account most of the specifics of Coq libraries. The following attributes are supported:

doc/redirects.json

@@ -20,6 +20,12 @@
   "cmake-ctest-variables": [
     "index.html#cmake-ctest-variables"
   ],
+  "coq-withPackages": [
+    "index.html#coq-withPackages"
+  ],
+  "coq-withPackages-usage": [
+    "index.html#coq-withPackages-usage"
+  ],
   "cuda": [
     "index.html#cuda"
   ],

doc/release-notes/rl-2605.section.md

@@ -68,6 +68,8 @@
 
 - `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.
 
+- `forgejo` has been updated to major version 14. For more information, see the [release blog post](https://forgejo.org/2026-01-release-v14-0/) and [full release notes](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/14.0.0.md)
+
 - `n8n` has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.
 
 - `gurk-rs` has been updated from `0.6.4` to `0.8.0`. Version `0.8.0` includes breaking changes. For more information read the [release notes for 0.8.0](https://github.com/boxdot/gurk-rs/releases/tag/v0.8.0).

maintainers/maintainer-list.nix

@@ -5263,12 +5263,6 @@
     githubId = 244239;
     name = "Mauricio Collares";
   };
-  coloquinte = {
-    email = "gabriel.gouvine_nix@m4x.org";
-    github = "Coloquinte";
-    githubId = 4102525;
-    name = "Gabriel Gouvine";
-  };
   commandodev = {
     email = "ben@perurbis.com";
     github = "commandodev";
@@ -10801,6 +10795,12 @@
     githubId = 51334444;
     name = "Akshat Agarwal";
   };
+  humemm = {
+    email = "nixpkgs.scabbed988@passinbox.com";
+    github = "humemm";
+    githubId = 75555696;
+    name = "humemm";
+  };
   hummeltech = {
     email = "hummeltech@sherpaguru.com";
     github = "hummeltech";
@@ -16952,6 +16952,11 @@
     github = "mevatron";
     githubId = 714585;
   };
+  mfairley = {
+    name = "Michael Fairley";
+    github = "mfairley";
+    githubId = 4374785;
+  };
   mfossen = {
     email = "msfossen@gmail.com";
     github = "mfossen";
@@ -18203,6 +18208,12 @@
     matrix = "@neoney:matrix.org";
     keys = [ { fingerprint = "9E6A 25F2 C1F2 9D76 ED00  1932 1261 173A 01E1 0298"; } ];
   };
+  n3tshift = {
+    email = "n3tshift@tilde.pink";
+    github = "n3tshift";
+    githubId = 254145391;
+    name = "n3tshift";
+  };
   n8henrie = {
     name = "Nathan Henrie";
     email = "nate@n8henrie.com";
@@ -22263,6 +22274,13 @@
     githubId = 44014925;
     name = "Rexx Larsson";
   };
+  reylak = {
+    name = "Joaquin Lopez";
+    email = "elreylak@proton.me";
+    github = "Reylak-dev";
+    githubId = 178049808;
+    matrix = "@reylak:unredacted.org";
+  };
   rgnns = {
     email = "jglievano@gmail.com";
     github = "rgnns";

maintainers/scripts/update-octave-packages

@@ -351,20 +351,20 @@ def _update_package(path, target):
         text = _replace_value('hash', sri_hash, text)
 
     if fetcher == 'fetchFromGitHub':
-        # in the case of fetchFromGitHub, it's common to see `rev = version;` or `rev = "v${version}";`
+        # in the case of fetchFromGitHub, it's common to see `tag = version;` or `tag = "v${version}";`
         # in which no string value is meant to be substituted. However, we can just overwrite the previous value.
-        regex = '(rev\s+=\s+[^;]*;)'
+        regex = '(tag\s+=\s+[^;]*;)'
         regex = re.compile(regex)
         matches = regex.findall(text)
         n = len(matches)
 
         if n == 0:
-            raise ValueError("Unable to find rev value for {}.".format(pname))
+            raise ValueError("Unable to find tag value for {}.".format(pname))
         else:
-            # forcefully rewrite rev, incase tagging conventions changed for a release
+            # forcefully rewrite tag, incase tagging conventions changed for a release
             match = matches[0]
-            text = text.replace(match, f'rev = "refs/tags/{prefix}${{version}}";')
-            # incase there's no prefix, just rewrite without interpolation
+            text = text.replace(match, f'tag = "{prefix}${{version}}";')
+            # in case there's no prefix, just rewrite without interpolation
             text = text.replace('"${version}";', 'version;')
 
     with open(path, 'w') as f:

maintainers/team-list.nix

@@ -181,17 +181,6 @@ with lib.maintainers;
     github = "cuda-maintainers";
   };
 
-  cyberus = {
-    # Verify additions by approval of an already existing member of the team.
-    members = [
-      xanderio
-      snu
-      e1mo
-    ];
-    scope = "Team for Cyberus Technology employees who collectively maintain packages.";
-    shortName = "Cyberus Technology employees";
-  };
-
   danklinux = {
     members = [
       luckshiba

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -20,6 +20,8 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
+- [qui](https://github.com/autobrr/qui), a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as [services.qui](#opt-services.qui.enable).
+
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
 
 - [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)

nixos/modules/module-list.nix

@@ -1551,6 +1551,7 @@
   ./services/torrent/opentracker.nix
   ./services/torrent/peerflix.nix
   ./services/torrent/qbittorrent.nix
+  ./services/torrent/qui.nix
   ./services/torrent/rtorrent.nix
   ./services/torrent/torrentstream.nix
   ./services/torrent/transmission.nix

nixos/modules/security/acme/default.nix

@@ -51,6 +51,12 @@ let
     ''
     + script;
 
+  # We need to collect all the ACME webroots to grant them write
+  # access in the systemd service.
+  webroots = lib.remove null (
+    lib.unique (map (certAttrs: certAttrs.webroot) (lib.attrValues config.security.acme.certs))
+  );
+
   # There are many services required to make cert renewals work.
   # They all follow a common structure:
   #   - They inherit this commonServiceConfig
@@ -69,7 +75,9 @@ let
     ReadWritePaths = [
       "/var/lib/acme"
       lockdir
-    ];
+    ]
+    # Prevent runtime breakage by only adding non-overlapping paths.
+    ++ (lib.filter (x: !(lib.strings.hasPrefix "/var/lib/acme/" x)) webroots);
     PrivateTmp = true;
 
     WorkingDirectory = "/tmp";
@@ -299,12 +307,6 @@ let
         ++ data.extraLegoRenewFlags
       );
 
-      # We need to collect all the ACME webroots to grant them write
-      # access in the systemd service.
-      webroots = lib.remove null (
-        lib.unique (map (certAttrs: certAttrs.webroot) (lib.attrValues config.security.acme.certs))
-      );
-
       certificateKey = if data.csrKey != null then "${data.csrKey}" else "certificates/${keyName}.key";
     in
     {
@@ -469,8 +471,6 @@ let
               "acme/.lego/accounts/${accountHash}"
             ];
 
-            ReadWritePaths = commonServiceConfig.ReadWritePaths ++ webroots;
-
             # Needs to be space separated, but can't use a multiline string because that'll include newlines
             BindPaths = [
               "${accountDir}:/tmp/accounts"

nixos/modules/services/networking/tayga.nix

@@ -167,7 +167,7 @@ in
     networking.interfaces."${cfg.tunDevice}" = {
       virtual = true;
       virtualType = "tun";
-      virtualOwner = mkIf config.networking.useNetworkd "";
+      virtualOwner = null;
       ipv4 = {
         addresses = [
           {
@@ -205,9 +205,7 @@ in
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
         Restart = "always";
 
-        # Hardening Score:
-        #  - nixos-scripts: 2.1
-        #  - systemd-networkd: 1.6
+        # Hardening Score: 1.5
         ProtectHome = true;
         SystemCallFilter = [
           "@network-io"
@@ -216,9 +214,6 @@ in
           "~@resources"
         ];
         ProtectKernelLogs = true;
-        AmbientCapabilities = [
-          "CAP_NET_ADMIN"
-        ];
         CapabilityBoundingSet = "";
         RestrictAddressFamilies = [
           "AF_INET"
@@ -226,7 +221,7 @@ in
           "AF_NETLINK"
         ];
         StateDirectory = "tayga";
-        DynamicUser = mkIf config.networking.useNetworkd true;
+        DynamicUser = true;
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;

nixos/modules/services/torrent/qui.nix

@@ -0,0 +1,191 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe
+    maintainers
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+  inherit (lib.types)
+    bool
+    path
+    port
+    str
+    submodule
+    ;
+  cfg = config.services.qui;
+
+  stateDir = "/var/lib/qui";
+  configFormat = pkgs.formats.toml { };
+  configFile = configFormat.generate "qui.toml" cfg.settings;
+in
+{
+  options = {
+    services.qui = {
+      enable = mkEnableOption "qui";
+
+      package = mkPackageOption pkgs "qui" { };
+
+      user = mkOption {
+        type = str;
+        default = "qui";
+        description = "User to run qui as.";
+      };
+
+      group = mkOption {
+        type = str;
+        default = "qui";
+        example = "torrents";
+        description = "Group to run qui as.";
+      };
+
+      openFirewall = mkOption {
+        type = bool;
+        default = false;
+        description = "Whether or not to open ports in the firewall for qui.";
+      };
+
+      secretFile = mkOption {
+        type = path;
+        example = "/run/secrets/qui-session.txt";
+        description = ''
+          Path to a file that contains the session secret. The session secret
+          can be generated with `openssl rand -hex 32`.
+        '';
+      };
+
+      settings = mkOption {
+        default = { };
+        example = {
+          port = 7777;
+          logLevel = "DEBUG";
+          metricsEnabled = true;
+        };
+        type = submodule {
+          freeformType = configFormat.type;
+          options = {
+            host = mkOption {
+              type = str;
+              default = "127.0.0.1";
+              description = "The host address qui listens on.";
+            };
+
+            port = mkOption {
+              type = port;
+              default = 7476;
+              description = "The port qui listens on.";
+            };
+          };
+        };
+        description = ''
+          qui configuration options.
+
+          Refer to the [template config](https://github.com/autobrr/qui/blob/main/internal/config/config.go)
+          in the source code for the available options.
+          The documentation contains the available [environment variables](https://getqui.com/docs/configuration/environment/),
+          this can be used to get an overview.
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? sessionSecret);
+        message = ''
+          Session secrets should not be passed via settings, as
+          these are stored in the world-readable nix store.
+
+          Use the secretFile option instead.'';
+      }
+    ];
+
+    systemd.services.qui = {
+      description = "qui: alternative qBittorrent webUI";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+
+        LoadCredential = "sessionSecret:${cfg.secretFile}";
+        Environment = [ "QUI__SESSION_SECRET_FILE=%d/sessionSecret" ];
+        StateDirectory = "qui";
+
+        ExecStartPre = ''
+          ${pkgs.coreutils}/bin/install -m 600 '${configFile}' '%S/qui/config.toml'
+        '';
+        ExecStart = "${getExe cfg.package} serve --config-dir %S/qui";
+        Restart = "on-failure";
+
+        # Based on qbittorrent and nemorosa hardening settings
+        # Similar to what systemd hardening helper suggests
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateNetwork = false;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = "yes";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        # This should allow for hardlinking to torrent client files
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.port ];
+    };
+
+    users = {
+      users = mkIf (cfg.user == "qui") {
+        qui = {
+          group = cfg.group;
+          description = "qui user";
+          isSystemUser = true;
+          home = stateDir;
+        };
+      };
+
+      groups = mkIf (cfg.group == "qui") {
+        qui = { };
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ undefined-landmark ];
+}

nixos/modules/services/web-apps/dependency-track.nix

@@ -629,6 +629,9 @@ in
   };
 
   meta = {
-    maintainers = lib.teams.cyberus.members;
+    maintainers = with lib.maintainers; [
+      e1mo
+      xanderio
+    ];
   };
 }

nixos/modules/services/web-apps/plausible.nix

@@ -330,6 +330,9 @@ in
     ];
   };
 
-  meta.maintainers = teams.cyberus.members;
+  meta.maintainers = with lib.maintainers; [
+    e1mo
+    xanderio
+  ];
   meta.doc = ./plausible.md;
 }

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -322,7 +322,9 @@ let
               RemainAfterExit = true;
             };
             script = ''
-              ip tuntap add dev "${i.name}" mode "${i.virtualType}" user "${i.virtualOwner}"
+              ip tuntap add dev "${i.name}" mode "${i.virtualType}" ${
+                lib.optionalString (i.virtualOwner != null) ''user "${i.virtualOwner}"''
+              }
             '';
             postStop = ''
               ip link del dev ${i.name} || true

nixos/modules/tasks/network-interfaces.nix

@@ -348,9 +348,10 @@ let
 
         virtualOwner = mkOption {
           default = "root";
-          type = types.str;
+          type = types.nullOr types.str;
           description = ''
             In case of a virtual device, the user who owns it.
+            `null` will not set owner, allowing access to any user.
           '';
         };
 

nixos/tests/all-tests.nix

@@ -1174,7 +1174,7 @@ in
   opentelemetry-collector = runTest ./opentelemetry-collector.nix;
   openvscode-server = runTest ./openvscode-server.nix;
   openvswitch = runTest ./openvswitch.nix;
-  optee = handleTestOn [ "aarch64-linux" ] ./optee.nix { };
+  optee = runTestOn [ "aarch64-linux" ] ./optee.nix;
   orangefs = runTest ./orangefs.nix;
   orthanc = runTest ./orthanc.nix;
   os-prober = handleTestOn [ "x86_64-linux" ] ./os-prober.nix { };
@@ -1332,6 +1332,7 @@ in
   qtile = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile/default.nix;
   qtile-extras = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile-extras/default.nix;
   quake3 = runTest ./quake3.nix;
+  qui = runTest ./qui.nix;
   quicktun = runTest ./quicktun.nix;
   quickwit = runTest ./quickwit.nix;
   rabbitmq = runTest ./rabbitmq.nix;
@@ -1418,7 +1419,7 @@ in
   sharkey = runTest ./web-apps/sharkey.nix;
   shattered-pixel-dungeon = runTest ./shattered-pixel-dungeon.nix;
   shiori = runTest ./shiori.nix;
-  shoko = runTest ./shoko.nix;
+  shoko = import ./shoko.nix { inherit runTest; };
   signal-desktop = runTest ./signal-desktop.nix;
   silverbullet = runTest ./silverbullet.nix;
   simple = runTest ./simple.nix;

nixos/tests/dependency-track.nix

@@ -5,7 +5,10 @@ in
 {
   name = "dependency-track";
   meta = {
-    maintainers = pkgs.lib.teams.cyberus.members;
+    maintainers = with pkgs.lib.maintainers; [
+      e1mo
+      xanderio
+    ];
   };
 
   nodes = {

nixos/tests/fcitx5/default.nix

@@ -30,7 +30,7 @@
         enable = true;
         type = "fcitx5";
         fcitx5.addons = [
-          pkgs.fcitx5-chinese-addons
+          pkgs.qt6Packages.fcitx5-chinese-addons
           pkgs.fcitx5-hangul
           pkgs.fcitx5-m17n
           pkgs.fcitx5-mozc
@@ -81,7 +81,7 @@
       user = nodes.machine.users.users.alice;
       xauth = "${user.home}/.Xauthority";
     in
-    ''
+    /* python */ ''
       start_all()
 
       machine.wait_for_x()

nixos/tests/networking/networkd-and-scripted.nix

@@ -1053,6 +1053,7 @@ let
             }
           ];
           virtual = true;
+          virtualOwner = null;
           mtu = 1342;
           macAddress = "02:de:ad:be:ef:01";
         };
@@ -1070,13 +1071,14 @@ let
             }
           ];
           virtual = true;
+          virtualOwner = "root";
           mtu = 1343;
         };
       };
 
       testScript = ''
         targetList = """
-        tap0: tap persist user 0
+        tap0: tap persist
         tun0: tun persist user 0
         """.strip()
 
@@ -1101,6 +1103,10 @@ let
             machine.wait_until_succeeds("ip link show dev tap0 | grep 'mtu 1342'")
             machine.wait_until_succeeds("ip link show dev tun0 | grep 'mtu 1343'")
             assert "02:de:ad:be:ef:01" in machine.succeed("ip link show dev tap0")
+        with subtest("Test virtualOwner are configured"):
+            for interface, expected_owner in [("tap0", "-1"), ("tun0", "0")]:
+                actual_owner = machine.succeed(f"cat /sys/class/net/{interface}/owner").strip()
+                assert expected_owner == actual_owner, f"{interface} owner: expect {expected_owner}, got {actual_owner}"
       '' # network-addresses-* only exist in scripted networking
       + lib.optionalString (!networkd) ''
         with subtest("Test interfaces' addresses clean up"):

nixos/tests/optee.nix

@@ -1,70 +1,68 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "optee";
+{ pkgs, lib, ... }:
+{
+  name = "optee";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jmbaur ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jmbaur ];
+  };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      let
-        inherit (pkgs) armTrustedFirmwareQemu opteeQemuAarch64 ubootQemuAarch64;
+  nodes.machine =
+    { config, pkgs, ... }:
+    let
+      inherit (pkgs) armTrustedFirmwareQemu opteeQemuAarch64 ubootQemuAarch64;
 
-        # Default environment for qemu-arm64 uboot does not work well with
-        # large nixos kernel/initrds.
-        uboot = ubootQemuAarch64.overrideAttrs (old: {
-          postPatch = (old.postPatch or "") + ''
-            substituteInPlace board/emulation/qemu-arm/qemu-arm.env \
-              --replace-fail "ramdisk_addr_r=0x44000000" "ramdisk_addr_r=0x46000000"
-          '';
-        });
+      # Default environment for qemu-arm64 uboot does not work well with
+      # large nixos kernel/initrds.
+      uboot = ubootQemuAarch64.overrideAttrs (old: {
+        postPatch = (old.postPatch or "") + ''
+          substituteInPlace board/emulation/qemu-arm/qemu-arm.env \
+            --replace-fail "ramdisk_addr_r=0x44000000" "ramdisk_addr_r=0x46000000"
+        '';
+      });
 
-        bios = armTrustedFirmwareQemu.override {
-          extraMakeFlags = [
-            "SPD=opteed"
-            "BL32=${opteeQemuAarch64}/tee-header_v2.bin"
-            "BL32_EXTRA1=${opteeQemuAarch64}/tee-pager_v2.bin"
-            "BL32_EXTRA2=${opteeQemuAarch64}/tee-pageable_v2.bin"
-            "BL33=${uboot}/u-boot.bin"
-            "all"
-            "fip"
-          ];
-          filesToInstall = [
-            "build/qemu/release/bl1.bin"
-            "build/qemu/release/fip.bin"
-          ];
-          postInstall = ''
-            dd if=$out/bl1.bin of=$out/bios.bin bs=4096 conv=notrunc
-            dd if=$out/fip.bin of=$out/bios.bin seek=64 bs=4096 conv=notrunc
-          '';
-        };
-      in
-      {
-        virtualisation = {
-          inherit bios;
-          cores = 2;
-          qemu.options = [
-            "-machine virt,secure=on,accel=tcg,gic-version=2"
-            "-cpu cortex-a57"
-          ];
-        };
-
-        # VM boots up via qfw
-        boot.loader.grub.enable = false;
-
-        services.tee-supplicant = {
-          enable = true;
-          # pkcs11 trusted application
-          trustedApplications = [ "${opteeQemuAarch64.devkit}/ta/fd02c9da-306c-48c7-a49c-bbd827ae86ee.ta" ];
-        };
+      bios = armTrustedFirmwareQemu.override {
+        extraMakeFlags = [
+          "SPD=opteed"
+          "BL32=${opteeQemuAarch64}/tee-header_v2.bin"
+          "BL32_EXTRA1=${opteeQemuAarch64}/tee-pager_v2.bin"
+          "BL32_EXTRA2=${opteeQemuAarch64}/tee-pageable_v2.bin"
+          "BL33=${uboot}/u-boot.bin"
+          "all"
+          "fip"
+        ];
+        filesToInstall = [
+          "build/qemu/release/bl1.bin"
+          "build/qemu/release/fip.bin"
+        ];
+        postInstall = ''
+          dd if=$out/bl1.bin of=$out/bios.bin bs=4096 conv=notrunc
+          dd if=$out/fip.bin of=$out/bios.bin seek=64 bs=4096 conv=notrunc
+        '';
       };
-    testScript = ''
-      machine.wait_for_unit("tee-supplicant.service")
-      out = machine.succeed("${pkgs.opensc}/bin/pkcs11-tool --module ${lib.getLib pkgs.optee-client}/lib/libckteec.so --list-token-slots")
-      if out.find("OP-TEE PKCS11 TA") < 0:
-          raise Exception("optee pkcs11 token not found")
-    '';
-  }
-)
+    in
+    {
+      virtualisation = {
+        inherit bios;
+        cores = 2;
+        qemu.options = [
+          "-machine virt,secure=on,accel=tcg,gic-version=2"
+          "-cpu cortex-a57"
+        ];
+      };
+
+      # VM boots up via qfw
+      boot.loader.grub.enable = false;
+
+      services.tee-supplicant = {
+        enable = true;
+        # pkcs11 trusted application
+        trustedApplications = [ "${opteeQemuAarch64.devkit}/ta/fd02c9da-306c-48c7-a49c-bbd827ae86ee.ta" ];
+      };
+    };
+  testScript = ''
+    machine.wait_for_unit("tee-supplicant.service")
+    out = machine.succeed("${pkgs.opensc}/bin/pkcs11-tool --module ${lib.getLib pkgs.optee-client}/lib/libckteec.so --list-token-slots")
+    if out.find("OP-TEE PKCS11 TA") < 0:
+        raise Exception("optee pkcs11 token not found")
+  '';
+}

nixos/tests/outline.nix

@@ -2,7 +2,10 @@
 {
   name = "outline";
 
-  meta.maintainers = lib.teams.cyberus.members;
+  meta.maintainers = with lib.maintainers; [
+    e1mo
+    xanderio
+  ];
 
   node.pkgsReadOnly = false;
 

nixos/tests/plausible.nix

@@ -2,7 +2,10 @@
 {
   name = "plausible";
   meta = {
-    maintainers = lib.teams.cyberus.members;
+    maintainers = with lib.maintainers; [
+      e1mo
+      xanderio
+    ];
   };
 
   nodes.machine =

nixos/tests/qui.nix

@@ -0,0 +1,47 @@
+{ lib, ... }:
+
+{
+  name = "qui";
+  meta.maintainers = with lib.maintainers; [ undefined-landmark ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      # We create this secret in the Nix store (making it readable by everyone).
+      # DO NOT DO THIS OUTSIDE OF TESTS!!
+      testSecretFile = pkgs.writeText "session_secret" "not-secret";
+    in
+    {
+      services.qui = {
+        enable = true;
+        secretFile = testSecretFile;
+      };
+
+      # Use port other than default to test if settings options work.
+      specialisation.settingsPort.configuration = {
+        services.qui = {
+          enable = true;
+          secretFile = testSecretFile;
+          settings.port = 7777;
+        };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      settingsPort = "${nodes.machine.system.build.toplevel}/specialisation/settingsPort";
+    in
+    # python
+    ''
+      def test_webui(port):
+        machine.wait_for_unit("qui.service")
+        machine.wait_for_open_port(port)
+        machine.wait_until_succeeds(f"curl --fail http://localhost:{port}")
+
+      test_webui(7476)
+
+      machine.succeed("${settingsPort}/bin/switch-to-configuration test")
+      test_webui(7777)
+    '';
+}

nixos/tests/shoko.nix

@@ -1,19 +1,49 @@
-{ lib, ... }:
+{ runTest }:
+
 {
-  name = "Shoko";
+  default = runTest (
+    { lib, ... }:
 
-  nodes.machine = {
-    services.shoko.enable = true;
-  };
+    {
+      name = "Shoko";
 
-  testScript = ''
-    machine.wait_for_unit("shoko.service")
-    machine.wait_for_open_port(8111)
-    machine.succeed("curl --fail http://localhost:8111")
-  '';
+      nodes.machine = {
+        services.shoko.enable = true;
+      };
 
-  meta.maintainers = with lib.maintainers; [
-    diniamo
-    nanoyaki
-  ];
+      testScript = ''
+        machine.wait_for_unit("shoko.service")
+        machine.wait_for_open_port(8111)
+        machine.succeed("curl --fail http://localhost:8111")
+      '';
+
+      meta.maintainers = with lib.maintainers; [
+        diniamo
+        nanoyaki
+      ];
+    }
+  );
+
+  withPlugins = runTest (
+    { pkgs, lib, ... }:
+
+    {
+      name = "Shoko with plugins";
+
+      nodes.machine = {
+        services.shoko = {
+          enable = true;
+          plugins = [ pkgs.luarenamer ];
+        };
+      };
+
+      testScript = ''
+        machine.wait_for_unit("shoko.service")
+        machine.wait_for_open_port(8111)
+        machine.succeed("curl --fail http://localhost:8111")
+      '';
+
+      meta.maintainers = with lib.maintainers; [ nanoyaki ];
+    }
+  );
 }

pkgs/applications/audio/mopidy/spotify.nix

@@ -14,7 +14,7 @@ pythonPackages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-pM+kqeWYiPXv9DZDBTgwiEwC6Sbqv6uz5vJ5odcixOw=";
   };
 

pkgs/applications/audio/reaper/default.nix

@@ -11,7 +11,7 @@
   curl,
   gtk3,
   lame,
-  libxml2,
+  libxml2_13,
   ffmpeg,
   vlc,
   xdg-utils,
@@ -110,13 +110,13 @@ stdenv.mkDerivation rec {
         # Setting the rpath of the plugin shared object files does not
         # seem to have an effect for some plugins.
         # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
-        # Note that libcurl and libxml2 are needed for ReaPack to run.
+        # Note that libcurl and libxml2_13 are needed for ReaPack to run.
         wrapProgram $out/opt/REAPER/reaper \
           --prefix LD_LIBRARY_PATH : "${
             lib.makeLibraryPath [
               curl
               lame
-              libxml2
+              libxml2_13
               ffmpeg
               vlc
               xdotool

pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = "${pname}-build";
-    rev = "refs/tags/${version}";
+    tag = version;
     fetchSubmodules = true;
     sha256 = "sha256-rIb6tQimwrUj+623IU5zDyKNWsNYYBElLQClOsP+5Dc=";
   };

pkgs/applications/editors/android-studio/default.nix

@@ -20,12 +20,12 @@ let
     sha256Hash = "sha256-xs9ABQ9f8/gtxcoiZkf/xEtmTOj6rb4Ty+w70/+C4Ss=";
   };
   betaVersion = {
-    version = "2025.2.3.7"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 RC 2"
-    sha256Hash = "sha256-d5BcAUkYV7O25wyoifiZxfUsANPxLa/QkuT9u1qqfP8=";
+    version = "2025.2.3.8"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 RC 3"
+    sha256Hash = "sha256-KHvWVIxNzwdgl9kdqXD5Cpvz58r8pWs2VRyPV3VrJH0=";
   };
   latestVersion = {
-    version = "2025.3.1.2"; # "Android Studio Panda 1 | 2025.3.1 Canary 2"
-    sha256Hash = "sha256-kgYPwMF/CypkCq4w/y+HnraNdPNHf53198x35S0i7OA=";
+    version = "2025.3.1.4"; # "Android Studio Panda 1 | 2025.3.1 Canary 4"
+    sha256Hash = "sha256-5ymB/HKSmi32AWV39+HYmfY11frkNxf2dq8Ld4f9qfA=";
   };
 in
 {

pkgs/applications/editors/emacs/sources.nix

@@ -45,7 +45,7 @@ let
         homepage =
           {
             "mainline" = "https://www.gnu.org/software/emacs/";
-            "macport" = "https://bitbucket.org/mituharu/emacs-mac/";
+            "macport" = "https://github.com/jdtsmith/emacs-mac";
           }
           .${variant};
         description =

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.7";
-    hash = "sha256-Bj9VNhwgM0nO3b/Iptb70hkO2TjKxbEpxdYGyzFt3iA=";
+    version = "2.1.9";
+    hash = "sha256-1zrXLaTilKY11FVBGnP4ezRT5LAefGH1UKwqz+E/sFY=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/augment.vscode-augment/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-augment";
     publisher = "augment";
-    version = "0.731.1";
-    hash = "sha256-Kv47LVomNt/u0fJKos/R7Q0hhBesOGXGPu5QHaaOKEQ=";
+    version = "0.747.1";
+    hash = "sha256-QQty7jtBHSUHR/BIPCjKMlIuCnn5dbVCqSsXv4LVfdE=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1711,8 +1711,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.84";
-          hash = "sha256-x4CaSa/CRZgs7vGthFcn8UXYrbQhQXkULPBbGnj3zpw=";
+          version = "0.4.86";
+          hash = "sha256-QLa8+WAghGJlToGCx7/R68D0GRgCbA0jkEtlA5EnEGA=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2982,8 +2982,8 @@ let
         mktplcRef = {
           name = "rainbow-csv";
           publisher = "mechatroner";
-          version = "3.23.0";
-          hash = "sha256-HEbx7vjuVFjAG0koFI/JRehivRiLBF0cgx24LhdwCBc=";
+          version = "3.24.0";
+          hash = "sha256-g9xY6JDx8RZyl4KFgIAVvQKydbwcEHLaUJPinUR89zM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mechatroner.rainbow-csv/changelog";
@@ -3840,8 +3840,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "25.12.3";
-          hash = "sha256-6G/CpzSSrRzwtay4+t46gz8aBF7qgu79NUhBypTJMrc=";
+          version = "26.1.0";
+          hash = "sha256-xehZZ11C2Bjee1glpnPZaJ25DpbXSCsZONWWy4YNlRo=";
         };
         meta = {
           description = "Ansible language support";

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.37.0";
-    hash = "sha256-tp72kIpG1NcvHLIDKcKo7OmQ/sQdxz/yb7QhGSWsFzc=";
+    version = "1.37.1";
+    hash = "sha256-xucPJrYqKM+uCxHktfx0o4c0btpluIBMyNigr7d1FJU=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.14.2";
-    hash = "sha256-dgerxoVeLv9J2oIrfPJcb+ncqIrq5aaf4Rog0EQszvA=";
+    version = "1.14.6";
+    hash = "sha256-MACP/IvSk4JwD9DUWRD6pGYbgVQVzuCz8FvXdfHcphs=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/nestopia.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2025-11-08";
+  version = "0-unstable-2026-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "5deada54077fae87e2873f5ad9ef77e3ab7af5e1";
-    hash = "sha256-3/e0wrJOaEdQ4Uz17r9KyLdCsyY7dqOpIyC0MPhqhdA=";
+    rev = "473d3072be67fa2542ca833c274ef6682cf0f0bc";
+    hash = "sha256-He60RyFhTL7A+juTPbr032tsXoOEOzK4JzCmF03l7gU=";
   };
 
   makefile = "Makefile";

pkgs/applications/misc/electrum/grs.nix

@@ -39,7 +39,7 @@ python3.pkgs.buildPythonApplication {
   src = fetchFromGitHub {
     owner = "Groestlcoin";
     repo = "electrum-grs";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "1k078jg3bw4n3kcxy917m30x1skxm679w8hcw8mlxb94ikrjc66h";
   };
 

pkgs/applications/misc/mkgmap/default.nix

@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4923";
+  version = "4924";
 
   src = fetchsvn {
     url = "https://svn.mkgmap.org.uk/mkgmap/mkgmap/trunk";
     rev = version;
-    sha256 = "sha256-tB/0VFLn/ch7XWPz1sJ3kqy/1U5Hk1yV9+wq7ohTRWw=";
+    sha256 = "sha256-4DGGAWgyIvK5pcopwlO4YDGDc73lOsL0Ljy/kFUY2As=";
   };
 
   patches = [

pkgs/applications/misc/stag/default.nix

@@ -30,6 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail \
+      ' -Werror ' ' '
+  '';
+
   buildInputs = [ curses ];
 
   installPhase = ''

pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "146.0.1-1",
+  "packageVersion": "147.0-1",
   "source": {
-    "rev": "146.0.1-1",
-    "hash": "sha256-MYp0PEAbUSJwrvaXYaie7eXj3XRw/EyGrQvsFdVT/Y0="
+    "rev": "147.0-1",
+    "hash": "sha256-LZE4d1z4djtGSrnFsh1i9GXvFbK55RQMcqyID9ui0Ng="
   },
   "firefox": {
-    "version": "146.0.1",
-    "hash": "sha512-rpW4bkg/6/jf7INHdI3ZBI7X1/hFJQ4HqoBI4rNR2mH288X4O7DQxy4adexhtg5Zu+aWOfDzNTKRD/i/XKBzlA=="
+    "version": "147.0",
+    "hash": "sha512-rJAXsaLaey8Tk5LDlMNjQf00duPU6ho8fl578QDcMNGFEy75JWvn5rD52/xpI0rFceofxtudhFQ7FXcvTshRYQ=="
   }
 }

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -10,7 +10,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-/fU56Dw7tvUnby4S78tyH/dasg4n3rb0hMlIkzvrv4M=";
   };
 

pkgs/applications/networking/cluster/helm/plugins/helm-git.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "helm-git";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "aslafy-z";
     repo = "helm-git";
     rev = "v${version}";
-    sha256 = "sha256-jgHFmANmxDS75k0JQIiT8DDw9nSppw1EZeEWM3jirsg=";
+    sha256 = "sha256-JSy6bI6XHW4JkXwffbfSFJj46BUqJvRG83sfOi8AcHM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,11 +45,11 @@
     "vendorHash": "sha256-weHY7ZV3HaFBYlDNhwAYN9vDItkI+wtk9UNlM0uuwfY="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-WDFoyj4DxHiS1xIu8bPKUzHaVsGn88rIBzx3KoE8lA0=",
+    "hash": "sha256-4Y6qItQx3gk4LsZb9OB2J2IQ4g6H5uDwy+FkWPCegrg=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.267.0",
+    "rev": "v1.268.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ogQLStDbsM0aRf4QIbITB8Z+L9DUtZwoAPK6T4xylXI="
   },
@@ -418,11 +418,11 @@
     "vendorHash": "sha256-ZbU2z7qUHPR7vDSflesSjgK7x3LYXVe/gnVsy19q6Bs="
   },
   "fortinetdev_fortios": {
-    "hash": "sha256-dQMDGaYG3TDK5FBH8ODAsDcdScoDWWrk1vsWmL7sIPc=",
+    "hash": "sha256-xXCOhF+FPJDSPl7ISaRTn3FpDRSNmy0+3xdGmjbddKU=",
     "homepage": "https://registry.terraform.io/providers/fortinetdev/fortios",
     "owner": "fortinetdev",
     "repo": "terraform-provider-fortios",
-    "rev": "1.23.0",
+    "rev": "1.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-V+D/D+i1xbPp9IAfrAds2rNv5t/aXQxPwH9vY09DsMo="
   },
@@ -436,13 +436,13 @@
     "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
   },
   "gitlabhq_gitlab": {
-    "hash": "sha256-9NYlkXiUbUtTbaa4K2Ft+khPx6NlSQs9ZnzUf3Ms0K8=",
+    "hash": "sha256-iBgACKVMJmfDLlIU6TZZiED+eEG7c4CMSkfEjU1Dmiw=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v18.7.0",
+    "rev": "v18.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TPyvNpTwTMcysG4kGeRuu+H5hR3/By69vyNuWodnKVg="
+    "vendorHash": "sha256-a2y8bnbQr8RNN3hJZFupUHvrIrV8HkAvZQn+7MIod0U="
   },
   "go-gandi_gandi": {
     "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -643,13 +643,13 @@
     "vendorHash": "sha256-ssmAveYUVI8z/1UWNeaMX0qdUewowCHNufJIFMirdVg="
   },
   "hashicorp_random": {
-    "hash": "sha256-tdTVqSJmQ6Ht3kdoYMxhoRN+XJqvu8BPVB0VQghcDVs=",
+    "hash": "sha256-pt36xl5drR1YtXZ6IRqvvO14iINwb/m7MEAAw7RwQTA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/random",
     "owner": "hashicorp",
     "repo": "terraform-provider-random",
-    "rev": "v3.7.2",
+    "rev": "v3.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jyfzk3vbgZwHlyiFFw1mhD+us/7WNatUQTGN4WsrfgE="
+    "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
   },
   "hashicorp_tfe": {
     "hash": "sha256-U58uWRmLMI9XfYT89wfNuwhok+PaWCanz23RjQYyL98=",
@@ -778,13 +778,13 @@
     "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
   },
   "jianyuan_sentry": {
-    "hash": "sha256-/OzoGlUaL7o4O5DejTdEeAJctB85udOCy4BntSTYJLo=",
+    "hash": "sha256-AH7Ef3G1C0jQX4Wprc8J9rP34u+xifzhclqtmVCQmAI=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.14.7",
+    "rev": "v0.14.8",
     "spdx": "MIT",
-    "vendorHash": "sha256-wbU9RTNvUVJbLkoTGMeGxh9ilZQMKc9tpBkldMdfReA="
+    "vendorHash": "sha256-owQrunW0X87DVdA/A/Pl5MWsVfx8kPL1L/xJYWS5ptI="
   },
   "joneshf_openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -896,13 +896,13 @@
     "vendorHash": "sha256-I8yMdS+yOk5doWGU9VPdl5ITGNrPhs5tGwluwXSrnI0="
   },
   "metio_migadu": {
-    "hash": "sha256-vkQANcTx4SNaQJj0QwC+jzFTa7XFo2mXoFDBaoIvaV0=",
+    "hash": "sha256-rAf+q/zNANhW8cFSJR3TtA0yYqiG5mjCStyBFG0U3tg=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.12.11",
+    "rev": "2026.1.15",
     "spdx": "0BSD",
-    "vendorHash": "sha256-4zPD20KNAsXf6tKwzN97rH9Dt+lKm+GGET/6YMf5hfY="
+    "vendorHash": "sha256-j9QQjoPh9bvrRCvNbItlN65kWaP5my5aed/YNFItAFI="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -968,13 +968,13 @@
     "vendorHash": "sha256-xTlalKIWvU2MDBvwNjl3cWFVH26EyDthwrnXVmbK+rc="
   },
   "ns1-terraform_ns1": {
-    "hash": "sha256-vSq6502jHjEQEgKmgMpUrid88jhsENOVF+3MA6Zm8lg=",
+    "hash": "sha256-pKdybFzTuuD6D76Uhuz+fLN+EmpDxUwjIWXYK6DRKOY=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.7.3",
+    "rev": "v2.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-VGGV5UYkb17X//cSy6+cbhTRCVljrrpXhM81orLomdQ="
+    "vendorHash": "sha256-QEzQogxM44Yc2iH6r+AtTYhv0p/T7jDwO5axNQE2sMY="
   },
   "numtide_linuxbox": {
     "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
@@ -1004,13 +1004,13 @@
     "vendorHash": "sha256-ucXmHK7jrahc78nE2cf5p5PPCSNV5DAQ53KM2SfJnjo="
   },
   "okta_okta": {
-    "hash": "sha256-844cF3pAIegwOBhCwLmEaKZCGjgPnJry1DduXNfL8mg=",
+    "hash": "sha256-tihXPwZUyR8vfYRxbmzwrpbcyDxBoW+Zq//rr6CzqRc=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.5.3",
+    "rev": "v6.5.4",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XW0D9lsSkLyVPZQW+LmXrDoAeeYw337fAmU6GEZcMt0="
+    "vendorHash": "sha256-V5eM87qIVpHofeM7uKEJREDPGSw7HIWja/JZOp5CnbA="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1076,11 +1076,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-K3Gr3ivLPMFqR10HSino/ZlsYWNpDzyJalx6orTVa4k=",
+    "hash": "sha256-dQaXwuT7BsgaC5PeFMqqQ1607E2/BYTA18RL8YycvNw=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.30.8",
+    "rev": "v3.30.9",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1130,13 +1130,13 @@
     "vendorHash": "sha256-33NOGIvqLpgndG68GxAeoiISjWV7ApR4jmvqyZHjPKo="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-v/CdJiEmMmmtQ0EhDxg6IT3FGWs3jeuZ/BKhmcHi9XM=",
+    "hash": "sha256-fXL/MwbXz1SVtro4hf5oy/1yvCkwH81Q58A9dxk7y0A=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.2.2",
+    "rev": "v5.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-H0ohTNvSeFYEhHFIJoY37asNWwe+s2RKsDzYbx1CkJw="
+    "vendorHash": "sha256-UyfCHBSdGKCulExhUdYfvEab8cVjaHGDfgslRS0d1Co="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",
@@ -1229,11 +1229,11 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-GSGKjV5tuwTyPvdwd/Z8t9g7LFkkg4gHKhI3FYt00gQ=",
+    "hash": "sha256-qQ8/y1KWHIc6WHEVXfiP6LKC44N8uK47x2Lv7TAMedE=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.42.0",
+    "rev": "v1.43.0",
     "spdx": "MIT",
     "vendorHash": "sha256-XNPXjqrrTIC3WrpvDBP7veAYgmYws9FdF4W3j6ewRPk="
   },
@@ -1499,12 +1499,12 @@
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-9mI2bGSiSuTzGBXHzpGjU6I3Vh04aEkCMkfNk6rQbTc=",
+    "hash": "sha256-nJzWN2OrRiXKLzM1awn68eTW4WFvLavA06+/2BmRPGA=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.177.0",
+    "rev": "v0.178.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wwZiY8WXGdpOCT+4EcnSQeemDMzKZcMFZQK8SSAUkkA="
+    "vendorHash": "sha256-bHsSBrfyUgUzuFOgFHXmPV12e4whsU5LTIzIXHeHlH0="
   }
 }

pkgs/applications/networking/gns3/gui.nix

@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
     inherit hash;
     owner = "GNS3";
     repo = "gns3-gui";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];

pkgs/applications/networking/gns3/server.nix

@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication {
     inherit hash;
     owner = "GNS3";
     repo = "gns3-server";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
   };
 
   # GNS3 2.3.26 requires a static BusyBox for the Docker integration

pkgs/applications/office/libreoffice/src-collabora/help.nix

@@ -1,6 +1,6 @@
 { fetchgit, ... }:
 fetchgit {
   url = "https://gerrit.libreoffice.org/help";
-  rev = "refs/tags/cp-25.04.1-1";
+  tag = "cp-25.04.1-1";
   hash = "sha256-jKcrkvdxpebCTeILrjA7bKfcsWw8VFjS7eimJI1dgFQ=";
 }

pkgs/applications/office/libreoffice/src-collabora/main.nix

@@ -1,7 +1,7 @@
 { fetchgit, ... }:
 fetchgit {
   url = "https://gerrit.libreoffice.org/core";
-  rev = "refs/tags/cp-25.04.1-1";
+  tag = "cp-25.04.1-1";
   hash = "sha256-WhNNKL1RC0hWi21wH5EJRZ8V8U7jk6z8h3E3mVR56zk=";
   fetchSubmodules = false;
 }

pkgs/applications/office/libreoffice/src-collabora/translations.nix

@@ -1,6 +1,6 @@
 { fetchgit, ... }:
 fetchgit {
   url = "https://gerrit.libreoffice.org/translations";
-  rev = "refs/tags/cp-25.04.1-1";
+  tag = "cp-25.04.1-1";
   hash = "sha256-kZ5LwhEMWYv9peYPjTL14wjYv4LHUMtaM7XGYSVw68U=";
 }

pkgs/applications/science/logic/coq/default.nix

@@ -320,7 +320,7 @@ let
         Zimmi48
       ];
       platforms = lib.platforms.unix;
-      mainProgram = "coqide";
+      mainProgram = if buildIde then "coqide" else "coqtop";
     };
   };
 in

pkgs/applications/science/logic/coq/with-packages.nix

@@ -0,0 +1,63 @@
+{
+  buildEnv,
+  coq,
+  lib,
+  makeBinaryWrapper,
+  runCommand,
+}:
+
+packages:
+
+let
+  # At version 9.0, Coq underwent a name change to Rocq.
+  # A couple paths and environment variables need to change at this point.
+  isRocq = lib.versionAtLeast coq.coq-version "9.0";
+
+  collectPropagated =
+    pkg:
+    [ pkg ]
+    ++ (pkg.propagatedBuildInputs or [ ])
+    ++ (lib.concatMap collectPropagated (pkg.propagatedBuildInputs or [ ]));
+
+  allPackages = lib.unique (lib.concatMap collectPropagated packages);
+
+  coqPath = lib.makeSearchPath "/lib/coq/${coq.coq-version}/user-contrib" allPackages;
+
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${coq.ocaml.version}/site-lib" (
+    [ coq.ocamlPackages.findlib ] ++ allPackages
+  );
+
+  pathEnvVar = if isRocq then "ROCQPATH" else "COQPATH";
+in
+
+buildEnv {
+  name = "${coq.pname}-with-packages-${coq.version}";
+
+  paths = [ coq ] ++ allPackages;
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postBuild = ''
+    mkdir -p $out/bin
+
+    # If coq is the only path that has a bin dir, buildEnv may decide to
+    # symlink $out/bin directly to that. So we do this step to make sure we get a
+    # writable bin dir
+    mv $out/bin $out/bin-orig
+
+    for binary in $out/bin-orig/*; do
+      if [ -f "$binary" ] && [ -x "$binary" ]; then
+        makeWrapper "$binary" "$out/bin/$(basename "$binary")" \
+          --prefix ${pathEnvVar} : "${coqPath}" \
+          --prefix OCAMLPATH : "${ocamlPath}"
+      fi
+    done
+  '';
+
+  passthru = coq.passthru // {
+    unwrapped = coq;
+    packages = allPackages;
+  };
+
+  meta = coq.meta;
+}

pkgs/applications/version-management/blackbox/default.nix

@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  expect,
-  which,
-  gnupg,
-  coreutils,
-  git,
-  pinentry,
-  gnutar,
-  procps,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "blackbox";
-  version = "1.20220610";
-
-  src = fetchFromGitHub {
-    owner = "stackexchange";
-    repo = "blackbox";
-    rev = "v${version}";
-    hash = "sha256-g0oNV7Nj7ZMmsVQFVTDwbKtF4a/Fb3WDB+NRx9IGSWA=";
-  };
-
-  buildInputs = [ gnupg ];
-
-  # https://github.com/NixOS/nixpkgs/issues/134445
-  doCheck = !stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
-
-  nativeCheckInputs = [
-    expect
-    which
-    coreutils
-    pinentry
-    git
-    gnutar
-    procps
-  ];
-
-  postPatch = ''
-    patchShebangs bin tools
-    substituteInPlace Makefile \
-      --replace "PREFIX?=/usr/local" "PREFIX=$out"
-
-    substituteInPlace tools/confidence_test.sh \
-      --replace 'PATH="''${blackbox_home}:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/local/bin:/usr/pkg/bin:/usr/pkg/gnu/bin:/usr/local/MacGPG2/bin:/opt/homebrew/bin:''${blackbox_home}"' \
-        "PATH=/build/source/bin/:$PATH"
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    make copy-install
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Safely store secrets in a VCS repo";
-    homepage = "https://github.com/StackExchange/blackbox";
-    maintainers = [ ];
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-  };
-}

pkgs/applications/video/kodi/addons/jellycon/default.nix

@@ -17,13 +17,13 @@ in
 buildKodiAddon rec {
   pname = "jellycon";
   namespace = "plugin.video.jellycon";
-  version = "0.8.3";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellycon";
     rev = "v${version}";
-    sha256 = "sha256-dCPbPuUtiMhcECd3Aebs3ZGIM6jn6mmCd0rXS+1TQLs=";
+    sha256 = "sha256-bSAzd0nKD0S3hNEM0azmCNPw9wHQK5XH6lbfcz3sW9o=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-advanced-masks.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "FiniteSingularity";
     repo = "obs-advanced-masks";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-NtmOWKk3eZeRa3TvclZpg4sj8lbOoY8hUhxs1z6kEW4=";
   };
 

pkgs/applications/video/obs-studio/plugins/obs-dvd-screensaver.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "wimpysworld";
     repo = "obs-dvd-screensaver";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-eUfy3m0r/sLrGLbp3en1ofcVVWZ+t2rZ4knjwfrorhw=";
   };
   strictDeps = true;

pkgs/applications/video/obs-studio/plugins/obs-media-controls.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-media-controls";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-r9fqpg0G9rzGSqq5FUS8ul58rj0796aGZIND8PCJ9jk=";
   };
 

pkgs/applications/video/obs-studio/plugins/obs-recursion-effect.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-recursion-effect";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-PeWJy423QbX4NULuS15LJ/IR/W+tXCJD9TjZdJOGk6A=";
   };
 

pkgs/applications/video/obs-studio/plugins/obs-vnc.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "norihiro";
     repo = "obs-vnc";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-bveTfyhHH7RAM24Lp0mWlt52ao9Rn6vCuKjfQH+B8Rw=";
   };
 

pkgs/applications/virtualization/OVMF/default.nix

@@ -91,7 +91,7 @@ let
       "debian/PkKek-1-*.pem"
       "debian/patches/OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch"
     ];
-    rev = "refs/tags/debian/2025.02-8";
+    tag = "debian/2025.02-8";
     hash = "sha256-n/6T5UBwW8U49mYhITRZRgy2tNdipeU4ZgGGDu9OTkg=";
   };
 

pkgs/by-name/a2/a2jmidid/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     domain = "gitea.ladish.org";
     owner = "LADI";
     repo = "a2jmidid";
-    rev = "refs/tags/${version}";
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-PZKGhHmPMf0AucPruOLB9DniM5A3BKdghFCrd5pTzeM=";
   };

pkgs/by-name/ab/abiword/package.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "AbiWord";
-    rev = "refs/tags/release-${version}";
+    tag = "release-${version}";
     hash = "sha256-dYbJ726Zuxs7+VTTCWHYQLsVZ/86hRUBQRac6toO4UI=";
   };
 

pkgs/by-name/ai/airwindows/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-12-07";
+  version = "0-unstable-2026-01-11";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "bfff4df7e63a3f6fde744e890849b21895c94e78";
-    hash = "sha256-Ss91Ld2bNYD4HiO7Mgth5fwg3OVBYvZBaDQstBvvVKU=";
+    rev = "53a648baed26d12df3351b3301ea9cc741a35648";
+    hash = "sha256-GN6AuqrHfFItFe8s1xU3LpltnTKEhasrvyI+3H9z7rU=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

pkgs/by-name/al/alertmanager-ntfy/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "alertmanager-ntfy";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "alexbakker";
     repo = "alertmanager-ntfy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aVK8HCRXRprNoBhILLN7F/Fb3RePPzBW4vBMnQr9zRU=";
+    hash = "sha256-ELck6TDdRO32BWir0RKW2QLjqXmnKLGVxagUN5ujtV4=";
   };
 
-  vendorHash = "sha256-CpVGLM6ZtfYODhP6gzWGcnpEuDvKRiMWzoPNm2qtML4=";
+  vendorHash = "sha256-1M0H/d6aBA8sKhVp8U9VL7mb09+q1sMdoCI2eg9/F9U=";
 
   doInstallCheck = true;
   installCheckPhase = ''

pkgs/by-name/al/algia/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "algia";
-  version = "0.0.98";
+  version = "0.0.99";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "algia";
     tag = "v${version}";
-    hash = "sha256-Xd0WhXvEPt1VLIdsswk91hTb2UK6ikqhKMR3l/D0/jk=";
+    hash = "sha256-HT1JFCbC9FWJmbKs5H//OrgYaQEiJxhpuJwEu55WFoU=";
   };
 
   vendorHash = "sha256-JTTWVs0KwceiLy6tpyd48zORiXLc18zwgG1c+ceivKU=";

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2321";
+  version = "2.0.2328";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-wkgVhmzfI15GFZ1YDI0MYGdfFIzyfd3ob949kyWA8N4=";
+    hash = "sha256-6+rb7eNPkifuIMsFs2YO0v27CY6RNWnHrzHYoVhtYCw=";
   };
 
-  npmDepsHash = "sha256-mikgLEfjusRvmOMjdeENRtC+Vi+yV9zwBIqu3IbLY8A=";
+  npmDepsHash = "sha256-Q0vdon6Qbt5FOjKZJqB5ufiLcG18DPgL4EN9PSkoXDE=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/an/ansible-doctor/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ansible-doctor";
-  version = "8.1.1";
+  version = "8.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     tag = "v${version}";
-    hash = "sha256-izgSdHK+vVS0UcK32gYDwBn3b1yDCzp2ImjDXZbMrzs=";
+    hash = "sha256-eKUeQp4hvLqBkHDfclyR5dTt7jjcVMHneqXBPt1N8No=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/an/antibody/package.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule rec {
-  pname = "antibody";
-  version = "6.1.1";
-
-  src = fetchFromGitHub {
-    owner = "getantibody";
-    repo = "antibody";
-    tag = "v${version}";
-    hash = "sha256-If7XAwtg1WqkDkrJ6qYED+DjwHWloPu3P7X9rUd5ikU=";
-  };
-
-  vendorHash = "sha256-0m+yDo+AMX5tZfOsjsZgulyjB9mVEjy2RfA2sYeqDn0=";
-
-  doCheck = false;
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.version=${version}"
-  ];
-
-  meta = {
-    description = "Fastest shell plugin manager";
-    mainProgram = "antibody";
-    homepage = "https://github.com/getantibody/antibody";
-    license = lib.licenses.mit;
-
-    # golang.org/x/sys needs to be updated due to:
-    #
-    #   https://github.com/golang/go/issues/49219
-    #
-    # but this package is no longer maintained.
-    #
-    broken = stdenv.hostPlatform.isDarwin;
-  };
-}

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -71,7 +71,7 @@ let
   airflow-src = fetchFromGitHub {
     owner = "apache";
     repo = "airflow";
-    rev = "refs/tags/${version}";
+    tag = version;
     # Download using the git protocol rather than using tarballs, because the
     # GitHub archive tarballs don't appear to include tests
     forceFetchGit = true;

pkgs/by-name/ap/apbs/package.nix

@@ -19,7 +19,7 @@ let
     src = fetchFromGitHub {
       owner = "Electrostatics";
       repo = "fetk";
-      rev = "refs/tags/${finalAttrs.version}";
+      tag = finalAttrs.version;
       hash = "sha256-uFA1JRR05cNcUGaJj9IyGNONB2hU9IOBPzOj/HucNH4=";
     };
 
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Electrostatics";
     repo = "apbs";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-2DnHU9hMDl4OJBaTtcRiB+6R7gAeFcuOUy7aI63A3gQ=";
   };
 

pkgs/by-name/ap/apksigner/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchgit,
   jdk_headless,
+  jre_minimal,
   gradle_8,
   makeWrapper,
   bashNonInteractive,
@@ -10,6 +11,17 @@
 let
   # "Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0."
   gradle = gradle_8;
+  jre = jre_minimal.override {
+    modules = [
+      "java.base"
+      "java.compiler"
+      "java.logging"
+      "java.naming"
+      "java.security.jgss"
+      "java.sql"
+      "jdk.unsupported"
+    ];
+  };
 in
 stdenv.mkDerivation rec {
   pname = "apksigner";
@@ -22,7 +34,7 @@ stdenv.mkDerivation rec {
     # use pname here because the final jar uses this as the filename
     name = pname;
     url = "https://android.googlesource.com/platform/tools/apksig";
-    rev = "refs/tags/android-15.0.0_r30";
+    tag = "android-15.0.0_r30";
     hash = "sha256-f/PggxvBv8nYUyL9Ukd4YVpunpRWbLL5UYsYhsiDWRE=";
   };
 
@@ -53,7 +65,7 @@ stdenv.mkDerivation rec {
     mv apksigner $out/opt
     mkdir -p $out/bin
     makeWrapper $out/opt/apksigner/bin/apksigner $out/bin/apksigner \
-      --set JAVA_HOME ${jdk_headless.home}
+      --set JAVA_HOME ${jre.home}
 
     runHook postInstall
   '';

pkgs/by-name/ap/apktool/package.nix

@@ -3,10 +3,20 @@
   stdenv,
   fetchurl,
   makeWrapper,
-  jdk_headless,
+  jre_minimal,
   aapt,
 }:
 
+let
+  jre = jre_minimal.override {
+    modules = [
+      "java.base"
+      "java.desktop"
+      "java.logging"
+      "java.xml"
+    ];
+  };
+in
 stdenv.mkDerivation rec {
   pname = "apktool";
   version = "2.12.1";
@@ -28,7 +38,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     install -D ${src} "$out/libexec/apktool/apktool.jar"
     mkdir -p "$out/bin"
-    makeWrapper "${jdk_headless}/bin/java" "$out/bin/apktool" \
+    makeWrapper "${jre}/bin/java" "$out/bin/apktool" \
         --add-flags "-jar $out/libexec/apktool/apktool.jar" \
         --prefix PATH : ${lib.getBin aapt}
   '';

pkgs/by-name/ap/apostrophe/package.nix

@@ -26,7 +26,7 @@ let
     owner = "World";
     repo = "apostrophe";
     domain = "gitlab.gnome.org";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-Sj5Y4QPMYavdXbU+iVv76qOFNhgBjAeX9+/TvQHZzeI=";
   };
 
@@ -36,7 +36,7 @@ let
 
     # keep in sync with upstream shipped version
     # in build-aux/flatpak/org.gnome.gitlab.somas.Apostrophe.json
-    rev = "refs/tags/5.1.0";
+    tag = "5.1.0";
     hash = "sha256-L6KVBw20K67lHT07Ws+ZC2DwdURahqyuyjAaK0kTgN0=";
   };
 in

pkgs/by-name/ar/arkade/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.62";
+  version = "0.11.63";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     tag = version;
-    hash = "sha256-Ost93sMmlbZI3l5duy0VDaWByREUIzWFtuVRGilZYFo=";
+    hash = "sha256-J4GC9b4r3ukBQsLIraFueznruVaaHWXcBvox+K+149g=";
   };
 
   env.CGO_ENABLED = 0;

pkgs/by-name/as/ascii/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitLab {
     owner = "esr";
     repo = "ascii";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-TE9YR5Va9tXaf2ZyNxz7d8lZRTgnD4Lz7FyqRDl1HNY=";
   };
 

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.10.0";
+  version = "18.11.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bfSa3RtVXxHt3usDqqpE/oXKKDUZOrf+tD9uL59fr6M=";
+    hash = "sha256-yjsCNN15E06te6cueSZksg7mcMyx2FiXKrbGAEcQWmg=";
   };
 
-  cargoHash = "sha256-67ffivZVCly1GWA3fJ9mT8nGv2EGd6eCthbaIu/IW3M=";
+  cargoHash = "sha256-xaALIVJpMek4nbSozxtOEWivRDlMmKdu6KqKiNMp0jk=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.

pkgs/by-name/au/auth0-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.25.1";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-Qtxn3VnqJOAIKI4jURFXnH5fHCWtZU419XtnjdqFlkY=";
+    hash = "sha256-ng+eIM8C557HY9kfAaidhwb/oT875qcPC7zTpXFn0c8=";
   };
 
-  vendorHash = "sha256-WN71xEU9GBNj0M5tnVthBdxh13UH78zUOaCEtczFDck=";
+  vendorHash = "sha256-fEoDvnHNQWwk++3n/4R1Q3YKwraxP8OBFLU0hZLcouc=";
 
   ldflags = [
     "-s"

pkgs/by-name/aw/aws-shell/package.nix

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-shell";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-m96XaaFDFQaD2YPjw8D1sGJ5lex4Is4LQ5RhGzVPvH4=";
   };
 

pkgs/by-name/az/azahar/fix-zstd-seekable-include.patch

@@ -1,33 +0,0 @@
-diff --git a/externals/CMakeLists.txt b/externals/CMakeLists.txt
-index 66cbbd52ed..a8b9d41e4e 100644
---- a/externals/CMakeLists.txt
-+++ b/externals/CMakeLists.txt
-@@ -230,13 +230,8 @@
-     )
-     target_link_libraries(zstd_seekable PUBLIC libzstd_static)
- 
--    target_link_libraries(libzstd_static INTERFACE zstd_seekable)
--
--    add_library(zstd ALIAS libzstd_static)
--
--    install(TARGETS zstd_seekable
--        EXPORT zstdExports
--    )
-+    add_library(zstd INTERFACE)
-+    target_link_libraries(zstd INTERFACE libzstd_static zstd_seekable)
- endif()
- 
- # ENet
-diff --git a/src/common/zstd_compression.cpp b/src/common/zstd_compression.cpp
-index 1e38877a1c..ac85ea1978 100644
---- a/src/common/zstd_compression.cpp
-+++ b/src/common/zstd_compression.cpp
-@@ -13,7 +13,7 @@
- #include <mutex>
- #include <sstream>
- #include <zstd.h>
--#include <zstd/contrib/seekable_format/zstd_seekable.h>
-+#include <zstd_seekable.h>
- 
- #include <boost/serialization/base_object.hpp>
- #include <boost/serialization/unique_ptr.hpp>

pkgs/by-name/az/azahar/package.nix

@@ -44,7 +44,6 @@
   gamemode,
   enableGamemode ? lib.meta.availableOn stdenv.hostPlatform gamemode,
   nix-update-script,
-  fetchpatch2,
 }:
 let
   inherit (lib)
@@ -56,24 +55,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2123.4.1";
+  version = "2124";
 
   src = fetchzip {
     url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-86i6GMnonQ8SeeDiOH1XSl3rHamnMTgPnkaeJOlAIuI=";
+    hash = "sha256-k/Rz7hiYtX0tVW2lrrEwiB8LanvAuhXHxPC79Dy4aUI=";
   };
 
-  patches = [
-    # https://github.com/azahar-emu/azahar/pull/1305
-    ./fix-zstd-seekable-include.patch
-
-    # TODO: Remove in next release
-    (fetchpatch2 {
-      url = "https://github.com/azahar-emu/azahar/commit/1f483e1d335374482845d0325ac8b13af3162c53.patch?full_index=1";
-      hash = "sha256-9rmRbv7VFMhHly5qTGaeBLpvtWMu6HkCGUUM+t78Meg=";
-    })
-  ];
-
   strictDeps = true;
   nativeBuildInputs = [
     cmake
@@ -111,8 +99,9 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-headers
     xbyak
 
-    # https://github.com/azahar-emu/azahar/pull/1281
+    # https://github.com/azahar-emu/azahar/issues/1283
     # spirv-tools
+    # spirv-headers
 
     # Azahar uses zstd_seekable which is not currently packaged in nixpkgs
     # zstd

pkgs/by-name/ba/barlow/package.nix

@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "jpt";
     repo = "barlow";
-    tag = "${version}";
+    tag = version;
     hash = "sha256-FG68o6qN/296RhSNDHFXYXbkhlXSZJgGhVjzlJqsksY=";
   };
 

pkgs/by-name/ba/bazelisk/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.27.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazelisk";
     rev = "v${version}";
-    sha256 = "sha256-RPatTc97xYs5lhVCOjInNrNrL1UBsocdHn0C5yUHIxY=";
+    sha256 = "sha256-wpbJc4qF7UF8HG4tkk7jnsurO2snFIpcfKyRY1Ohby4=";
   };
 
-  vendorHash = "sha256-gv5x0BbckeGkYa5rzCmyUkvmRsmI5YPy04HVN9Z1Rgc=";
+  vendorHash = "sha256-PWqKq/2DFopeiecUL0iWnut8Kd/52U32sNSVGj3Ae5g=";
 
   ldflags = [
     "-s"

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -28,18 +28,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.34.0";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u9RMI1EP+2yhoHtu0Lf1/4RZPrwSFsVc/DgdFJ9xZsA=";
+    hash = "sha256-mKyoV92+VJESHDRENXLFU+Ug2fFr+xJrleckvxfZ6sY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-v17x6/ojK4fGqgBBCKKARYOs/8ECT2FXp7ZgGGAUSss=";
+    hash = "sha256-5z86H/LGI5aSg3vBoXlvm0f2DmumsKu3EN7Bn5UHbr4=";
   };
 
   postPatch = ''

pkgs/by-name/be/beeper/package.nix

@@ -9,10 +9,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.2.455";
+  version = "4.2.482";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-3FHaPIJb40ta/+sguolz2QQBKkGgd1P3CgyEHHxX5xA=";
+    hash = "sha256-mxBE0U2ABiOdSNj8c3Lqgmy5iFtOulCCkQ+oC2xyENA=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;

pkgs/by-name/be/beszel/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "beszel";
-  version = "0.17.0";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     tag = "v${version}";
-    hash = "sha256-MY/rsWdIiYsqcw6gqDkfA8A/Ied3OSHfJI3KUBxoRKc=";
+    hash = "sha256-7jXhlstGuQc3EP4fm5k9FD22nge0ecXVZAk8mXdyKc0=";
   };
 
   webui = buildNpmPackage {
@@ -48,10 +48,10 @@ buildGoModule rec {
 
     sourceRoot = "${src.name}/internal/site";
 
-    npmDepsHash = "sha256-1au4kSxyjdwFExIoUBSPf/At0jQsfbzlEXuigygBTRM=";
+    npmDepsHash = "sha256-Ks78fCJeHoLCImkyEHo1fSRJqIOEEvL6Zyydpy5LlTw=";
   };
 
-  vendorHash = "sha256-gfQU3jGwTGmMJIy9KTjk/Ncwpk886vMo4CJvm5Y5xpA=";
+  vendorHash = "sha256-OnCX/0DGtkcACuWxGfIreS6SSx9dKq+feWKSymtkABs=";
 
   preBuild = ''
     mkdir -p internal/site/dist

pkgs/by-name/be/better-commits/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "better-commits";
-  version = "1.18.1";
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     owner = "Everduin94";
     repo = "better-commits";
     tag = "v${version}";
-    hash = "sha256-tkGLlvOldKKpoFswo1UzUhNJHstKISRpCDGFrL/W7ZI=";
+    hash = "sha256-2g9sYTy34estLBLAaHNbjNzv6+rzyocgqMBlVlJUyT4=";
   };
 
-  npmDepsHash = "sha256-lPJ50DYnANJZ3IowE3kOCyAx9peq7Donh72jk1eQnBs=";
+  npmDepsHash = "sha256-vtUtdgOJEQk9PzxOz7AlwOxWS6PTjAtrjAugXRXo89c=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bi/binsider/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "binsider";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "binsider";
     rev = "v${version}";
-    hash = "sha256-k40mnDRbvwWJmcT02aVWdwwEiDCuL4hQnvnPitrW8qA=";
+    hash = "sha256-ZfLFZXLnH5nBg/5ufOfwMG8c8n+BDex3j7da+Hvh1fw=";
   };
 
-  cargoHash = "sha256-hysp7AeYJ153AC0ERcrRzf4ujmM+V9pgAxOvOlG/2aE=";
+  cargoHash = "sha256-HnJBeqZhzDT0XfZ5UDg+lWMaX8tP7Q4iXrAz84XM3QE=";
 
   buildNoDefaultFeatures = !stdenv.hostPlatform.isLinux;
 

pkgs/by-name/bl/bloop/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bloop";
-  version = "2.0.17";
+  version = "2.0.18";
 
   platform =
     if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
     sha256 =
       if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
-        "sha256-pvqIotxcKVtrCQlMdbMGNkPvrMcNyw8CmtnUkQjAF8Y="
+        "sha256-18cI2w2HXq1BechxLi1GzljWRYAp2IDO5SAaZHnJy6c="
       else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        "sha256-W54MoUGEQ48ju+h1PVUxlJZ0RxV2NLjYhlq6QacBEto="
+        "sha256-pVGxaEAatqRTIwTHpTEt7XwzLqgFf67ztgjTtIEnBa8="
       else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-        "sha256-7FtS1dlDK5v/zlwFA5rPSkyLaEVbKhAaKdOhZkZcFPg="
+        "sha256-AjI1YKarVSGJHuRJ/86BaeD4XkGcbI7XzjAg5swgNM0="
       else
         throw "unsupported platform";
   };

pkgs/by-name/br/brlcad/package.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "BRL-CAD";
     repo = "brlcad";
-    rev = "refs/tags/rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    tag = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
     hash = "sha256-23UTeH4gY2x/QGYZ64glAkf6LmsXBAppIOHgoUdxgpo=";
   };
 

pkgs/by-name/bu/buildpack/package.nix

@@ -16,7 +16,7 @@ buildGoModule {
   src = fetchFromGitHub {
     owner = "buildpacks";
     repo = "pack";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-QCN0UvWa5u9XX5LvY3yD8Xz2s1XzZUg/WXnAfWwZnY0=";
   };
 

pkgs/by-name/bu/bulletty/package.nix

@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bulletty";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "CrociDB";
     repo = "bulletty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HX5J00Y7nkBwLIOEoc9jRtv9xObeWrWpHhYBQUOUVKA=";
+    hash = "sha256-J4ljTQuEWwGvxDbwBaP7z0TPqpLKQCmd4YSaIpcVYvg=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./remove-rustfmt-exec.patch
   ];
 
-  cargoHash = "sha256-WIEbZIWdIGWiwi6918MVFu++aZ2oWJTF4AUSTpKRZvQ=";
+  cargoHash = "sha256-yL7qYE60TBtEoj+0/ykhbEv6XBfk9JA0y8JLvRzaAHI=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cached-nix-shell/package.nix

@@ -10,7 +10,7 @@ let
   blake3-src = fetchFromGitHub {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
-    rev = "refs/tags/1.5.1";
+    tag = "1.5.1";
     hash = "sha256-STWAnJjKrtb2Xyj6i1ACwxX/gTkQo5jUHilcqcgJYxc=";
   };
 in
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "xzfc";
     repo = "cached-nix-shell";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-LI/hecqeRg3eCzU2bASJA8VoG4nvrSeHSeaGYn7M/UI=";
   };
 

pkgs/by-name/ca/caddyfile-language-server/package.nix

@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpm_8,
+  nodejs,
+  pnpmConfigHook,
+  makeBinaryWrapper,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "caddyfile-language-server";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "caddyserver";
+    repo = "vscode-caddyfile";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IusP9Z3e8mQ0mEhI1o1zIqPDB/i0pqlMfnt6M8bzb2w=";
+  };
+
+  pnpmWorkspaces = [ "@caddyserver/caddyfile-language-server" ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      pnpmWorkspaces
+      ;
+    pnpm = pnpm_8;
+    fetcherVersion = 3;
+    hash = "sha256-D9kYFkmFlvg4r6vR9PHHAwF0qglHsTuRae0Z7CzDq1M=";
+  };
+
+  nativeBuildInputs = [
+    pnpm_8
+    pnpmConfigHook
+    nodejs
+    makeBinaryWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter=@caddyserver/caddyfile-language-server run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf node_modules packages/server/node_modules
+    pnpm install --production --offline --force --filter=@caddyserver/caddyfile-language-server
+    mkdir -p $out/lib/node_modules/caddyfile-language-server/
+    mv packages/server/dist/* $out/lib/node_modules/caddyfile-language-server/
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/caddyfile-language-server \
+      --add-flags "$out/lib/node_modules/caddyfile-language-server/index.js"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/caddyserver/vscode-caddyfile/releases/tag/v${finalAttrs.version}";
+    description = "Basic language server for caddyfile";
+    homepage = "https://github.com/caddyserver/vscode-caddyfile";
+    mainProgram = "caddyfile-language-server";
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ca/cadical/package.nix

@@ -96,7 +96,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Simplified Satisfiability Solver";
-    maintainers = with lib.maintainers; [ shnarazk ];
+    maintainers = with lib.maintainers; [
+      shnarazk
+      chrjabs
+    ];
     platforms = lib.platforms.unix;
     license = lib.licenses.mit;
     homepage = "https://fmv.jku.at/cadical/";

pkgs/by-name/ca/camunda-modeler/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.43.0";
+  version = "5.43.1";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-NR1UXnIU0Wf2WeiagqijEXz9qUShFbM1umenFFETOJI=";
+    hash = "sha256-ruYpMFL/7UK4AF7Zp4OhopClfUqEuWPIMA+cM3PJ9FI=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 

pkgs/by-name/ca/canaille/package.nix

@@ -20,7 +20,7 @@ python.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     owner = "yaal";
     repo = "canaille";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-FL02ADM7rUU43XR71UWr4FLr/NeUau7zRwTMOSFm1T4=";
   };
 

pkgs/by-name/ca/cargo-deny/package.nix

@@ -46,6 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       matthiasbeyer
       jk
+      chrjabs
     ];
   };
 })

pkgs/by-name/ca/cargo-llvm-cov/package.nix

@@ -91,6 +91,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       wucke13
       matthiasbeyer
       CobaltCause
+      chrjabs
     ];
 
     broken = stdenv.targetPlatform.isRedox;

pkgs/by-name/ca/cargo-machete/package.nix

@@ -28,6 +28,7 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer
+      chrjabs
     ];
   };
 }

pkgs/by-name/ca/cargo-mobile2/package.nix

@@ -10,7 +10,7 @@
 
 let
   pname = "cargo-mobile2";
-  version = "0.22.1";
+  version = "0.22.2";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -18,14 +18,14 @@ rustPlatform.buildRustPackage {
     owner = "tauri-apps";
     repo = "cargo-mobile2";
     rev = "cargo-mobile2-v${version}";
-    hash = "sha256-+U/uTbTGa3NPK5WpyvR5C5L1ozl+fa15pNNWYZJXgnk=";
+    hash = "sha256-pSp7w823Jjjg0PEnCc7jVLBbOgvR7JAjtD8OK5voC0A=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-fMtFvPrWMLHE4N9WJv6J4pqHbHPnNKhQWz5qEvB8jKQ=";
+  cargoHash = "sha256-aci1QF/O2J6Yix4UkxPCVW+c+xoqm7AvdhlkF7y1GqA=";
 
   preBuild = ''
     mkdir -p $out/share/

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -46,6 +46,7 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
+      chrjabs
     ];
   };
 }

pkgs/by-name/ca/cargo-rdme/package.nix

@@ -21,6 +21,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/orium/cargo-rdme";
     changelog = "https://github.com/orium/cargo-rdme/blob/v${version}/release-notes.md";
     license = with lib.licenses; [ mpl20 ];
-    maintainers = with lib.maintainers; [ GoldsteinE ];
+    maintainers = with lib.maintainers; [
+      GoldsteinE
+      chrjabs
+    ];
   };
 }