From ea143853351c6401a18087d9595269e7fd31d9df Mon Sep 17 00:00:00 2001
From: wellWINeo <stepan@uspenskiy.su>
Date: Fri, 16 May 2025 13:51:50 +0300
Subject: [PATCH 01/48] nixos/shadowsocks: add `package` option

Closes: https://github.com/NixOS/nixpkgs/issues/384226

- add `package` option to services.shadowsocks and
related changes
- add tests for `pkgs.shadowsocks-rust`
- add postfix 'libev' to original tests
---
 .../services/networking/shadowsocks.nix       | 37 ++++++++++++++++---
 nixos/tests/shadowsocks/common.nix            |  7 +++-
 nixos/tests/shadowsocks/default.nix           | 22 +++++++++--
 3 files changed, 54 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/networking/shadowsocks.nix b/nixos/modules/services/networking/shadowsocks.nix
index 79d749abb9d5..79a0b66d260c 100644
--- a/nixos/modules/services/networking/shadowsocks.nix
+++ b/nixos/modules/services/networking/shadowsocks.nix
@@ -29,8 +29,15 @@ let
 
   configFile = pkgs.writeText "shadowsocks.json" (builtins.toJSON opts);
 
+  executablesMap = {
+    "${getName pkgs.shadowsocks-libev}" = {
+      server = "ss-server";
+    };
+    "${getName pkgs.shadowsocks-rust}" = {
+      server = "ssserver";
+    };
+  };
 in
-
 {
 
   ###### interface
@@ -47,14 +54,25 @@ in
         '';
       };
 
+      package = mkPackageOption pkgs "Shadowsocks" {
+        default = "shadowsocks-libev";
+      };
+
       localAddress = mkOption {
-        type = types.coercedTo types.str singleton (types.listOf types.str);
+        type =
+          with types;
+          oneOf [
+            str
+            (listOf str)
+          ];
+        # Keeped for compatibility
         default = [
           "[::0]"
           "0.0.0.0"
         ];
         description = ''
           Local addresses to which the server binds.
+          Note: shadowsocks-rust accepts only string parameter.
         '';
       };
 
@@ -163,14 +181,19 @@ in
           (noPasswd && !noPasswdFile) || (!noPasswd && noPasswdFile);
         message = "Option `password` or `passwordFile` must be set and cannot be set simultaneously";
       }
+      {
+        # Ensure localAddress is a string if package is shadowsocks-rust
+        assertion = !(getName cfg.package == "shadowsocks-rust" && !lib.strings.isString cfg.localAddress);
+        message = "Option `localAddress` must be a string when using shadowsocks-rust.";
+      }
     ];
 
-    systemd.services.shadowsocks-libev = {
-      description = "shadowsocks-libev Daemon";
+    systemd.services.${getName cfg.package} = {
+      description = "${getName cfg.package} Daemon";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       path = [
-        pkgs.shadowsocks-libev
+        cfg.package
       ]
       ++ optional (cfg.plugin != null) cfg.plugin
       ++ optional (cfg.passwordFile != null) pkgs.jq;
@@ -179,7 +202,9 @@ in
         ${optionalString (cfg.passwordFile != null) ''
           cat ${configFile} | jq --arg password "$(cat "${cfg.passwordFile}")" '. + { password: $password }' > /tmp/shadowsocks.json
         ''}
-        exec ss-server -c ${if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile}
+        exec ${(executablesMap.${getName cfg.package}).server} -c ${
+          if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile
+        }
       '';
     };
   };
diff --git a/nixos/tests/shadowsocks/common.nix b/nixos/tests/shadowsocks/common.nix
index 298483f36b8f..1ce54101a8be 100644
--- a/nixos/tests/shadowsocks/common.nix
+++ b/nixos/tests/shadowsocks/common.nix
@@ -1,11 +1,13 @@
 {
   name,
+  package,
   plugin ? null,
   pluginOpts ? "",
 }:
 
 import ../make-test-python.nix (
   { pkgs, lib, ... }:
+
   {
     inherit name;
     meta = {
@@ -27,9 +29,10 @@ import ../make-test-python.nix (
         networking.firewall.allowedUDPPorts = [ 8488 ];
         services.shadowsocks = {
           enable = true;
+          package = package;
           encryptionMethod = "chacha20-ietf-poly1305";
           password = "pa$$w0rd";
-          localAddress = [ "0.0.0.0" ];
+          localAddress = "0.0.0.0";
           port = 8488;
           fastOpen = false;
           mode = "tcp_and_udp";
@@ -78,7 +81,7 @@ import ../make-test-python.nix (
     testScript = ''
       start_all()
 
-      server.wait_for_unit("shadowsocks-libev.service")
+      server.wait_for_unit("${lib.getName package}.service")
       server.wait_for_unit("nginx.service")
       client.wait_for_unit("shadowsocks-client.service")
 
diff --git a/nixos/tests/shadowsocks/default.nix b/nixos/tests/shadowsocks/default.nix
index 3587ffb0edc5..62e67d59afd6 100644
--- a/nixos/tests/shadowsocks/default.nix
+++ b/nixos/tests/shadowsocks/default.nix
@@ -5,12 +5,26 @@
 }:
 
 {
-  "basic" = import ./common.nix {
-    name = "basic";
+  "basic-libev" = import ./common.nix {
+    name = "basic-libev";
+    package = pkgs.shadowsocks-libev;
   };
 
-  "v2ray-plugin" = import ./common.nix {
-    name = "v2ray-plugin";
+  "basic-rust" = import ./common.nix {
+    name = "basic-rust";
+    package = pkgs.shadowsocks-rust;
+  };
+
+  "v2ray-plugin-libev" = import ./common.nix {
+    name = "v2ray-plugin-libev";
+    package = pkgs.shadowsocks-libev;
+    plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
+    pluginOpts = "host=nixos.org";
+  };
+
+  "v2ray-plugin-rust" = import ./common.nix {
+    name = "v2ray-plugin-rust";
+    package = pkgs.shadowsocks-rust;
     plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
     pluginOpts = "host=nixos.org";
   };

From 0e48f6098cc2213ec697609d77fdd3aa53778680 Mon Sep 17 00:00:00 2001
From: Haylin Moore <me@haylinmoore.com>
Date: Thu, 11 Sep 2025 15:50:56 -0700
Subject: [PATCH 02/48] goarista: add passthru.updateScript

---
 pkgs/by-name/go/goarista/package.nix |  2 ++
 pkgs/by-name/go/goarista/update.sh   | 11 +++++++++++
 2 files changed, 13 insertions(+)
 create mode 100755 pkgs/by-name/go/goarista/update.sh

diff --git a/pkgs/by-name/go/goarista/package.nix b/pkgs/by-name/go/goarista/package.nix
index fbb9ba440143..cb5de911aad4 100644
--- a/pkgs/by-name/go/goarista/package.nix
+++ b/pkgs/by-name/go/goarista/package.nix
@@ -18,6 +18,8 @@ buildGoModule {
 
   vendorHash = "sha256-n+P3L3dT2kYuTyI2qX/nrLRgFIUsP3kkwNZmRQ8EFRs=";
 
+  passthru.updateScript = ./update.sh;
+
   checkFlags =
     let
       skippedTests = [
diff --git a/pkgs/by-name/go/goarista/update.sh b/pkgs/by-name/go/goarista/update.sh
new file mode 100755
index 000000000000..900cb5dc9643
--- /dev/null
+++ b/pkgs/by-name/go/goarista/update.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update gnused
+
+set -eou pipefail
+
+nix-update pkgs.goarista --version branch
+
+# The last github release in 2020 was named ockafka-v0.0.5.
+# I don't want this in the version name, it's from when Arista
+# was doing per-package releases in the repo, and not just trunk
+sed -i 's/ockafka-v0\.0\.5-/0-/' pkgs/by-name/go/goarista/package.nix

From 1a05178b43c63b23d4ba8bfdc170e41ab54a931b Mon Sep 17 00:00:00 2001
From: Ashley Hooper <ashleyghooper@gmail.com>
Date: Thu, 1 Jan 2026 11:34:00 +1300
Subject: [PATCH 03/48] nixos/redis: add support for more auth options

- Add Redis auth options that are important for running a
secure Redis infrastructure
- `masteruser` and `masterauth` for authentication between
replicas and master
- `sentinel auth-user` and `sentinel auth-pass` to provide
credentials that a Sentinel instance should use to
authenticate to the Redis instance it is monitoring
- Add assertions to catch configuration issues before
build/deployment

Signed-off-by: Ashley Hooper <ashleyghooper@gmail.com>
---
 nixos/modules/services/databases/redis.nix | 94 +++++++++++++++++++---
 1 file changed, 81 insertions(+), 13 deletions(-)

diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 157a6c6b84e3..c9aa42557a11 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -335,7 +335,23 @@ in
                       If the master is password protected (using the requirePass configuration)
                       it is possible to tell the slave to authenticate before starting the replication synchronization
                       process, otherwise the master will refuse the slave request.
-                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
+                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
+                    '';
+                  };
+
+                  masterAuthFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for the master user.";
+                    example = "/run/keys/redis-master-password";
+                  };
+
+                  masterUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = ''
+                      If the master is password protected via ACLs this option can be used to specify
+                      the Redis user that is used by replicas.'';
                   };
 
                   requirePass = lib.mkOption {
@@ -355,6 +371,25 @@ in
                     example = "/run/keys/redis-password";
                   };
 
+                  sentinelAuthUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The username to use to monitor a master from Sentinel.";
+                  };
+
+                  sentinelAuthPassFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for connecting to other Sentinel instances.";
+                    example = "/run/keys/sentinel-password";
+                  };
+
+                  sentinelMasterName = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The master name of the Redis master that Sentinel will monitor.";
+                  };
+
                   appendOnly = lib.mkOption {
                     type = types.bool;
                     default = false;
@@ -452,14 +487,38 @@ in
 
   config = lib.mkIf (enabledServers != { }) {
 
-    assertions = lib.attrValues (
-      lib.mapAttrs (name: conf: {
-        assertion = conf.requirePass != null -> conf.requirePassFile == null;
-        message = ''
-          You can only set one services.redis.servers.${name}.requirePass
-          or services.redis.servers.${name}.requirePassFile
-        '';
-      }) enabledServers
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (name: conf: [
+        {
+          assertion = conf.requirePass != null -> conf.requirePassFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.requirePass
+            or services.redis.servers.${name}.requirePassFile
+          '';
+        }
+        {
+          assertion = conf.masterAuth != null -> conf.masterAuthFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.masterAuth
+            or services.redis.servers.${name}.masterAuthFile
+          '';
+        }
+        {
+          assertion = conf.masterUser != null -> (conf.masterAuth != null || conf.masterAuthFile != null);
+          message = ''
+            If using services.redis.servers.${name}.masterUser, either
+            services.redis.servers.${name}.masterAuthFile or
+            services.redis.servers.${name}.masterAuth must be provided
+          '';
+        }
+        {
+          assertion = conf.sentinelAuthPassFile != null -> conf.sentinelMasterName != null;
+          message = ''
+            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName
+            must be specified
+          '';
+        }
+      ]) enabledServers
     );
 
     boot.kernel.sysctl = lib.mkIf cfg.vmOverCommit {
@@ -515,10 +574,19 @@ in
                 fi
                 echo 'include "${redisConfStore}"' > "${redisConfRun}"
                 ${lib.optionalString (conf.requirePassFile != null) ''
-                  {
-                    echo -n "requirepass "
-                    cat ${lib.escapeShellArg conf.requirePassFile}
-                  } >> "${redisConfRun}"
+                  echo "requirepass $(cat ${lib.escapeShellArg conf.requirePassFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterUser != null) ''
+                  echo "masteruser ${conf.masterUser}" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterAuthFile != null) ''
+                  echo "masterauth $(cat ${lib.escapeShellArg conf.masterAuthFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.sentinelAuthUser != null) ''
+                  echo "sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.sentinelAuthPassFile != null) ''
+                  echo "sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})" >> "${redisConfRun}"
                 ''}
               ''
             );

From b7d39def1141bca9fdc81e1f80067a010150142e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Mon, 19 Jan 2026 11:50:28 +0100
Subject: [PATCH 04/48] nixos/meilisearch: add instructions for generating
 masterKeyFile

---
 nixos/modules/services/search/meilisearch.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 17b6931fcc87..80aca66daf17 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -121,6 +121,9 @@ in
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
         If no master key is provided, all routes can be accessed without requiring any key.
+
+        You can generate a master key by running `openssl rand -base64 36`.
+        Alternatively, you can start Meilisearch without a master key and use the pre-generated key from the service's logs that can be obtained by `journalctl -u meilisearch | grep -- --master-key`.
       '';
       default = null;
       type = lib.types.nullOr lib.types.path;

From a81e104c674d45506a620f9c6ef550b1b7dfbc6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Mon, 19 Jan 2026 00:23:05 +0100
Subject: [PATCH 05/48] nixos/librechat: add meilisearch support

---
 nixos/modules/services/web-apps/librechat.nix | 35 ++++++++++++++++++-
 nixos/tests/librechat.nix                     |  7 ++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/librechat.nix b/nixos/modules/services/web-apps/librechat.nix
index 95f684a491f6..120d6d092268 100644
--- a/nixos/modules/services/web-apps/librechat.nix
+++ b/nixos/modules/services/web-apps/librechat.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.librechat;
+  meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
   exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
@@ -155,6 +156,26 @@ in
     };
 
     enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+
+    meilisearch = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Whether to enable and configure Meilisearch locally for Librechat.
+              You will manually need to set `services.meilisearch.masterKeyFile`.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        See [LibreChat search feature](https://www.librechat.ai/docs/features/search).
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -178,6 +199,12 @@ in
           You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
         '';
       }
+      {
+        assertion = cfg.meilisearch.enable -> meiliCfg.masterKeyFile != null;
+        message = ''
+          LibreChat's Meilisearch integration requires `services.meilisearch.masterKeyFile` to be set.
+        '';
+      }
     ];
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
@@ -192,7 +219,8 @@ in
       after = [
         "tmpfiles.target"
       ]
-      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      ++ lib.optional cfg.meilisearch.enable "meilisearch.service";
+      wants = lib.optional cfg.meilisearch.enable "meilisearch.service";
       description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
       environment = cfg.env;
       script = # sh
@@ -249,6 +277,11 @@ in
 
     services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
     services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+
+    services.meilisearch.enable = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.SEARCH = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.MEILI_HOST = lib.mkIf cfg.meilisearch.enable "http://${meiliCfg.settings.http_addr}";
+    services.librechat.credentials.MEILI_MASTER_KEY = lib.mkIf cfg.meilisearch.enable meiliCfg.masterKeyFile;
   };
 
   meta.maintainers = with lib.maintainers; [
diff --git a/nixos/tests/librechat.nix b/nixos/tests/librechat.nix
index e737c139844f..28f0ab7ac3af 100644
--- a/nixos/tests/librechat.nix
+++ b/nixos/tests/librechat.nix
@@ -17,6 +17,7 @@
       credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
       jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
       jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+      meilisearchMasterKeyFile = pkgs.writeText "meilisearch-master-key" "xHkP3Bzcf98fw7FiSCR82g5ULLGrXc4frK1qkEfN8St/3kJZ";
     in
     {
       services.librechat = {
@@ -32,13 +33,19 @@
           JWT_REFRESH_SECRET = jwtRefreshSecret;
         };
         enableLocalDB = true;
+        meilisearch.enable = true;
       };
+
+      services.meilisearch.masterKeyFile = meilisearchMasterKeyFile;
     };
 
   testScript = ''
     machine.start()
 
     machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'SEARCH=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'MEILI_HOST=http://localhost:7700' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qG 'MEILI_MASTER_KEY_FILE:/nix/store/.*meilisearch-master-key' /etc/systemd/system/librechat.service")
 
     machine.wait_for_unit("librechat.service")
     machine.wait_for_open_port(3080)

From 21a5656772f35292c98af4960e8c022a8c94ca2d Mon Sep 17 00:00:00 2001
From: Ashley Hooper <ashleyghooper@gmail.com>
Date: Mon, 26 Jan 2026 17:36:40 +1300
Subject: [PATCH 06/48] nixos/redis: rework Sentinel options

- Add sentinelMasterHost, sentinelMasterPort, sentinelMasterQuorum
  options
- Add special handling for mutable state in /var/lib/redis-xxx

Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
configuration file at runtime. This behaviour cannot be disabled.

Add conditional preStart logic to avoid overwriting Sentinel-owned
configuration while preserving NixOS-managed defaults. This introduces
a necessary, documented deviation from strict declarative semantics.
---
 nixos/modules/services/databases/redis.nix | 87 +++++++++++++++++++---
 1 file changed, 77 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index c9aa42557a11..d55658bb25b2 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -371,12 +371,6 @@ in
                     example = "/run/keys/redis-password";
                   };
 
-                  sentinelAuthUser = lib.mkOption {
-                    type = with types; nullOr str;
-                    default = null;
-                    description = "The username to use to monitor a master from Sentinel.";
-                  };
-
                   sentinelAuthPassFile = lib.mkOption {
                     type = with types; nullOr path;
                     default = null;
@@ -384,12 +378,36 @@ in
                     example = "/run/keys/sentinel-password";
                   };
 
+                  sentinelAuthUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The username to use to monitor a master from Sentinel.";
+                  };
+
+                  sentinelMasterHost = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The IP address (recommended) or hostname of the Redis master that Sentinel will monitor.";
+                  };
+
                   sentinelMasterName = lib.mkOption {
                     type = with types; nullOr str;
                     default = null;
                     description = "The master name of the Redis master that Sentinel will monitor.";
                   };
 
+                  sentinelMasterPort = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The TCP port of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterQuorum = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The Sentinel quorum (minimum number of Sentinel nodes online for failover)";
+                  };
+
                   appendOnly = lib.mkOption {
                     type = types.bool;
                     default = false;
@@ -511,11 +529,28 @@ in
             services.redis.servers.${name}.masterAuth must be provided
           '';
         }
+        {
+          assertion =
+            conf.sentinelMasterName != null
+            -> (
+              conf.sentinelMasterHost != null
+              && conf.sentinelMasterPort != null
+              && conf.sentinelMasterQuorum != null
+            );
+          message = ''
+            For Sentinel,
+            services.redis.servers.${name}.sentinelMasterName,
+            services.redis.servers.${name}.sentinelMasterHost,
+            services.redis.servers.${name}.sentinelMasterPort,
+            and services.redis.servers.${name}.sentinelMasterQuorum
+            must all be provided
+          '';
+        }
         {
           assertion = conf.sentinelAuthPassFile != null -> conf.sentinelMasterName != null;
           message = ''
-            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName
-            must be specified
+            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName,
+            must be provided
           '';
         }
       ]) enabledServers
@@ -557,6 +592,17 @@ in
           ExecStart = "${cfg.package}/bin/${
             cfg.package.serverBin or "redis-server"
           } /var/lib/${redisName name}/redis.conf ${lib.escapeShellArgs conf.extraParams}";
+
+          # NOTE: Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
+          # configuration file at runtime (redis.conf). This includes monitors,
+          # authentication credentials, and failover metadata, and this behaviour
+          # cannot be disabled.
+          # As a result, a fully declarative configuration is not possible for
+          # Sentinel-managed options. The preStart logic below appends sentinel
+          # configuration only if it is not already present, in order to avoid
+          # overwriting state that is owned and maintained by Sentinel itself.
+          # This is an intentional deviation from strict declarative semantics and
+          # is required for correct Sentinel operation.
           ExecStartPre =
             "+"
             + pkgs.writeShellScript "${redisName name}-prep-conf" (
@@ -582,11 +628,32 @@ in
                 ${lib.optionalString (conf.masterAuthFile != null) ''
                   echo "masterauth $(cat ${lib.escapeShellArg conf.masterAuthFile})" >> "${redisConfRun}"
                 ''}
+                ${lib.optionalString (conf.sentinelMasterHost != null) ''
+                  sentinel_monitor_line="sentinel monitor ${conf.sentinelMasterName} ${conf.sentinelMasterHost} ${toString conf.sentinelMasterPort} ${toString conf.sentinelMasterQuorum}"
+                  if grep -qE "^sentinel monitor ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel monitor ${conf.sentinelMasterName}\b.*|$sentinel_monitor_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_monitor_line" >> "${redisConfVar}"
+                  fi
+                ''}
                 ${lib.optionalString (conf.sentinelAuthUser != null) ''
-                  echo "sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}" >> "${redisConfRun}"
+                  sentinel_auth_user_line="sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}"
+                  if grep -qE "^sentinel auth-user ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-user ${conf.sentinelMasterName}\b.*|$sentinel_auth_user_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_user_line" >> "${redisConfVar}"
+                  fi
                 ''}
                 ${lib.optionalString (conf.sentinelAuthPassFile != null) ''
-                  echo "sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})" >> "${redisConfRun}"
+                  sentinel_auth_pass_line="sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})"
+                  if grep -qE "^sentinel auth-pass ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-pass ${conf.sentinelMasterName}\b.*|$sentinel_auth_pass_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_pass_line" >> "${redisConfVar}"
+                  fi
                 ''}
               ''
             );

From c001304d6a50e87daf4e4edef9da3e39cda5de6d Mon Sep 17 00:00:00 2001
From: Ferran Aran <ferran@ferranaran.com>
Date: Wed, 28 Jan 2026 18:05:50 +0100
Subject: [PATCH 07/48] reqable: add wrapGAppsHook

---
 pkgs/by-name/re/reqable/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/re/reqable/package.nix b/pkgs/by-name/re/reqable/package.nix
index 66b6eedce418..eacced666f2a 100644
--- a/pkgs/by-name/re/reqable/package.nix
+++ b/pkgs/by-name/re/reqable/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
   dpkg,
   autoPatchelfHook,
-  makeBinaryWrapper,
+  wrapGAppsHook3,
   fontconfig,
   atk,
   cairo,
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     dpkg
     autoPatchelfHook
-    makeBinaryWrapper
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -72,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  dontWrapGApps = true;
+
   preFixup = ''
-    mkdir $out/bin
     makeWrapper $out/share/reqable/reqable $out/bin/reqable \
-      --prefix LD_LIBRARY_PATH : $out/share/reqable/lib \
-      --set GIO_MODULE_DIR "${glib.out}/lib/gio/modules"
+     --prefix LD_LIBRARY_PATH : $out/share/reqable/lib \
+     ''${gappsWrapperArgs[@]}
   '';
 
   passthru.updateScript = nix-update-script { };

From 9da6c0881b4f2c708dcc616a4c2065e6df9c5c94 Mon Sep 17 00:00:00 2001
From: Parthiv Krishna <nixpkgs@parthiv.cc>
Date: Tue, 17 Feb 2026 07:04:20 +0000
Subject: [PATCH 08/48] librechat: patch publicPath to match
 uploads/imageOutput

---
 pkgs/by-name/li/librechat/0003-upload-paths.patch | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/librechat/0003-upload-paths.patch b/pkgs/by-name/li/librechat/0003-upload-paths.patch
index 50ec5380c545..cbba178f2bf9 100644
--- a/pkgs/by-name/li/librechat/0003-upload-paths.patch
+++ b/pkgs/by-name/li/librechat/0003-upload-paths.patch
@@ -10,7 +10,8 @@ index 165e9e6..fc85083 100644
 +  uploads: path.resolve('.', 'uploads'),
    clientPath: path.resolve(__dirname, '..', '..', 'client'),
    dist: path.resolve(__dirname, '..', '..', 'client', 'dist'),
-   publicPath: path.resolve(__dirname, '..', '..', 'client', 'public'),
+-  publicPath: path.resolve(__dirname, '..', '..', 'client', 'public'),
++  publicPath: path.resolve('.'),
    fonts: path.resolve(__dirname, '..', '..', 'client', 'public', 'fonts'),
    assets: path.resolve(__dirname, '..', '..', 'client', 'public', 'assets'),
 -  imageOutput: path.resolve(__dirname, '..', '..', 'client', 'public', 'images'),

From 8a0debedb2cc83786fbf0c9d92d68f119eccd9d8 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 7 Dec 2025 16:50:19 +0100
Subject: [PATCH 09/48] stremio-linux-shell: init at 1.0.0-beta.13

Co-authored-by: Fazzi <faaris.ansari@proton.me>
---
 .../allow-local-network-access.patch          |  15 ++
 .../better-server-path.patch                  |  13 ++
 .../fix-getshaderinfolog-call.patch           |  21 +++
 .../st/stremio-linux-shell/package.nix        | 142 ++++++++++++++++++
 4 files changed, 191 insertions(+)
 create mode 100644 pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch
 create mode 100644 pkgs/by-name/st/stremio-linux-shell/better-server-path.patch
 create mode 100644 pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch
 create mode 100644 pkgs/by-name/st/stremio-linux-shell/package.nix

diff --git a/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch b/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch
new file mode 100644
index 000000000000..524d20502b3b
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch
@@ -0,0 +1,15 @@
+diff --git a/src/webview/app/mod.rs b/src/webview/app/mod.rs
+index 2c6125e..26ab73f 100644
+--- a/src/webview/app/mod.rs
++++ b/src/webview/app/mod.rs
+@@ -23,6 +23,10 @@ cef_impl!(
+                 CMD_SWITCHES.iter().for_each(|switch| {
+                     line.append_switch(Some(&CefString::from(switch.to_owned())));
+                 });
++                line.append_switch_with_value(
++                    Some(&CefString::from("disable-features")),
++                    Some(&CefString::from("LocalNetworkAccessChecks")),
++                );
+             }
+         }
+ 
diff --git a/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch b/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch
new file mode 100644
index 000000000000..8e7cb8d1370b
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch
@@ -0,0 +1,13 @@
+diff --git a/src/config.rs b/src/config.rs
+index 4eda395..679699f 100644
+--- a/src/config.rs
++++ b/src/config.rs
+@@ -70,7 +70,7 @@ pub struct ServerConfig {
+ 
+ impl ServerConfig {
+     pub fn new(current_dir: &Path) -> Self {
+-        let file = current_dir.join(SERVER_FILE);
++        let file = Path::new("@serverjs@").to_path_buf();
+ 
+         Self { file }
+     }
diff --git a/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch b/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch
new file mode 100644
index 000000000000..6a0af3cb1953
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch
@@ -0,0 +1,21 @@
+diff --git a/src/shared/renderer/utils.rs b/src/shared/renderer/utils.rs
+index be4a65d..1b944ad 100644
+--- a/src/shared/renderer/utils.rs
++++ b/src/shared/renderer/utils.rs
+@@ -1,6 +1,6 @@
+ use std::{mem, ptr};
+ 
+-use gl::types::{GLenum, GLfloat, GLint, GLsizei, GLsizeiptr, GLuint};
++use gl::types::{GLchar, GLenum, GLfloat, GLint, GLsizei, GLsizeiptr, GLuint};
+ 
+ use super::constants::BYTES_PER_PIXEL;
+ 
+@@ -139,7 +139,7 @@ pub fn compile_shader(kind: GLenum, src: &str) -> GLuint {
+             gl::GetShaderiv(shader, gl::INFO_LOG_LENGTH, &mut len);
+ 
+             let mut buffer = vec![0u8; len as usize];
+-            gl::GetShaderInfoLog(shader, len, ptr::null_mut(), buffer.as_mut_ptr() as *mut i8);
++            gl::GetShaderInfoLog(shader, len, ptr::null_mut(), buffer.as_mut_ptr() as *mut GLchar);
+ 
+             panic!(
+                 "Shader compile error: {}",
diff --git a/pkgs/by-name/st/stremio-linux-shell/package.nix b/pkgs/by-name/st/stremio-linux-shell/package.nix
new file mode 100644
index 000000000000..f22d7e6bfc23
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -0,0 +1,142 @@
+{
+  lib,
+  symlinkJoin,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  gitUpdater,
+
+  # buildInputs
+  atk,
+  cef-binary,
+  gtk3,
+  libayatana-appindicator,
+  libxkbcommon,
+  mpv,
+  openssl,
+
+  # nativeBuildInputs
+  makeBinaryWrapper,
+  pkg-config,
+  wrapGAppsHook4,
+
+  # Wrapper
+  addDriverRunpath,
+  libGL,
+  nodejs,
+}:
+
+let
+  # Stremio expects CEF files in a specific layout
+  cef = symlinkJoin {
+    name = "stremio-linux-shell-cef";
+    paths = [
+      "${cef-binary}/Resources"
+      "${cef-binary}/Release"
+    ];
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stremio-linux-shell";
+  version = "1.0.0-beta.13";
+
+  src = fetchFromGitHub {
+    owner = "Stremio";
+    repo = "stremio-linux-shell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1f9IBNo5gxpSqTSIf8QuQOlf+sfRhohOmQTLRbX/OU8=";
+  };
+
+  cargoHash = "sha256-wx5oF4uF9UMtKzfGxZKsy6mVjYaRD40dLuvaRtz8yE4=";
+
+  patches = [
+    # Chromium 142 stopped allowing local network access by default, which
+    # breaks the app's ability to communicate with the Stremio server.
+    ./allow-local-network-access.patch
+
+    # GLchar is u8 on aarch64
+    # Upstream PR: https://github.com/Stremio/stremio-linux-shell/pull/40
+    ./fix-getshaderinfolog-call.patch
+
+    # Patch server.js path so that we don't have to install it in $out/bin
+    ./better-server-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/config.rs \
+      --replace-fail "@serverjs@" "${placeholder "out"}/share/stremio/server.js"
+
+    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    substituteInPlace $cargoDepsCopy/xkbcommon-dl-*/src/lib.rs \
+      --replace-fail "libxkbcommon.so.0" "${libxkbcommon}/lib/libxkbcommon.so.0"
+    substituteInPlace $cargoDepsCopy/xkbcommon-dl-*/src/x11.rs \
+      --replace-fail "libxkbcommon-x11.so.0" "${libxkbcommon}/lib/libxkbcommon-x11.so.0"
+  '';
+
+  # Don't download CEF during build
+  buildFeatures = [ "offline-build" ];
+
+  buildInputs = [
+    atk
+    cef
+    gtk3
+    libayatana-appindicator
+    libxkbcommon
+    mpv
+    openssl
+  ];
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  env.CEF_PATH = "${cef}";
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    cp data/com.stremio.Stremio.desktop $out/share/applications/com.stremio.Stremio.desktop
+
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp data/icons/com.stremio.Stremio.svg $out/share/icons/hicolor/scalable/apps/com.stremio.Stremio.svg
+
+    mkdir -p $out/share/stremio
+    cp data/server.js $out/share/stremio/server.js
+
+    mv $out/bin/stremio-linux-shell $out/bin/stremio
+  '';
+
+  # Node.js is required to run `server.js`
+  # Add to `gappsWrapperArgs` to avoid two layers of wrapping.
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${addDriverRunpath.driverLink}/lib" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
+      --prefix PATH : "${lib.makeBinPath [ nodejs ]}"
+    )
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    inherit cef;
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
+  meta = {
+    description = "Modern media center that gives you the freedom to watch everything you want";
+    homepage = "https://www.stremio.com/";
+    license = with lib.licenses; [
+      gpl3Only
+      # server.js is unfree
+      unfree
+    ];
+    maintainers = with lib.maintainers; [ thunze ];
+    platforms = lib.platforms.linux;
+    mainProgram = "stremio";
+  };
+})

From 98f80aec881674ba02ea1a026a5c61b2af33d354 Mon Sep 17 00:00:00 2001
From: Tiago Ferreira <me@tiferrei.com>
Date: Sun, 22 Feb 2026 22:27:48 +0000
Subject: [PATCH 10/48] bagels: 0.3.9 -> 0.3.12

---
 pkgs/by-name/ba/bagels/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ba/bagels/package.nix b/pkgs/by-name/ba/bagels/package.nix
index ef4d5aa3adc6..b924959fdfbe 100644
--- a/pkgs/by-name/ba/bagels/package.nix
+++ b/pkgs/by-name/ba/bagels/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bagels";
-  version = "0.3.9";
+  version = "0.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnhancedJax";
     repo = "bagels";
     tag = finalAttrs.version;
-    hash = "sha256-LlEQ0by6Si37e8FvC4agjLy8eanizSA1iq44BaQ8D5o=";
+    hash = "sha256-w7Q7yCKffya2SyuHUaTWOugkeyTZbL9JNj/Ir3tnafE=";
   };
 
   build-system = with python3Packages; [
@@ -80,13 +80,23 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # AttributeError: 'NoneType' object has no attribute 'defaults'
     "test_basic_balance_calculation"
     "test_combined_balance_calculation"
+    "test_create_template"
+    "test_create_multiple_templates"
+    "test_delete_template"
+    "test_get_adjacent_template"
+    "test_get_all_templates"
     "test_get_days_in_period"
     "test_get_period_average"
     "test_get_period_figures"
     "test_get_start_end_of_period"
     "test_get_start_end_of_week"
+    "test_get_template_by_id"
     "test_split_balance_calculation"
+    "test_swap_template_order"
+    "test_swap_template_order_edge_cases"
+    "test_template_validation"
     "test_transfer_balance_calculation"
+    "test_update_template"
   ];
 
   meta = {

From 1d9a649ed174279bcaf77d1827d3f8d06a61acbe Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 24 Feb 2026 13:39:25 +0100
Subject: [PATCH 11/48] speedtest-tracker: init at 1.13.10

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/sp/speedtest-tracker/package.nix | 71 +++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 pkgs/by-name/sp/speedtest-tracker/package.nix

diff --git a/pkgs/by-name/sp/speedtest-tracker/package.nix b/pkgs/by-name/sp/speedtest-tracker/package.nix
new file mode 100644
index 000000000000..e27192d78402
--- /dev/null
+++ b/pkgs/by-name/sp/speedtest-tracker/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nodejs,
+  fetchNpmDeps,
+  buildPackages,
+  php84,
+  nixosTests,
+  dataDir ? "/var/lib/speedtest-tracker",
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "speedtest-tracker";
+  version = "1.13.10";
+
+  src = fetchFromGitHub {
+    owner = "alexjustesen";
+    repo = "speedtest-tracker";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X/ShdTGAb7qPqYlZ71rxGzAetPRexlaDQ4AYvwouddc=";
+  };
+
+  buildInputs = [ php84 ];
+
+  nativeBuildInputs = [
+    nodejs
+    buildPackages.npmHooks.npmConfigHook
+    php84.packages.composer
+    php84.composerHooks2.composerInstallHook
+  ];
+
+  composerVendor = php84.mkComposerVendor {
+    inherit (finalAttrs) pname src version;
+    composerNoScripts = true;
+    composerStrictValidation = false;
+    strictDeps = true;
+    vendorHash = "sha256-fS0Wstv6uHOE5WaDWSL4nbgpHCLM442zmPoER7ZRhfg=";
+  };
+
+  npmDeps = fetchNpmDeps {
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-npm-deps";
+    hash = "sha256-qWBVonPKqyB6OrDkR1ihtVac/b0Qd++Q/W4nk/VPm9E=";
+  };
+
+  preInstall = ''
+    npm run build
+  '';
+
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/speedtest-tracker/* $out/
+    rm -R $out/share $out/storage $out/bootstrap/cache $out/node_modules
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/cache $out/bootstrap/cache
+  '';
+
+  passthru = {
+    phpPackage = php84;
+    tests = nixosTests.speedtest-tracker;
+  };
+
+  meta = {
+    description = "Speedtest Tracker is a self-hosted application that monitors the performance and uptime of your internet connection";
+    homepage = "https://github.com/alexjustesen/speedtest-tracker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ katexochen ];
+    platforms = lib.platforms.linux;
+  };
+})

From 6f3ce14a020f7f7feaa01d00c2b3d37de8cbc6b6 Mon Sep 17 00:00:00 2001
From: nix-julia <nix-julia@proton.me>
Date: Sat, 21 Feb 2026 18:13:05 +0330
Subject: [PATCH 12/48] mtproxy: init at 1-unstable-2025-11-04

---
 pkgs/by-name/mt/mtproxy/package.nix | 35 +++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/mt/mtproxy/package.nix

diff --git a/pkgs/by-name/mt/mtproxy/package.nix b/pkgs/by-name/mt/mtproxy/package.nix
new file mode 100644
index 000000000000..aea7ba1d370f
--- /dev/null
+++ b/pkgs/by-name/mt/mtproxy/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  openssl,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mtproxy";
+  version = "1-unstable-2025-11-04";
+  src = fetchFromGitHub {
+    owner = "TelegramMessenger";
+    repo = "MTProxy";
+    rev = "cafc3380a81671579ce366d0594b9a8e450827e9";
+    hash = "sha256-tY2iwNAQIL8sCUuddy9Lm/d/W1notL27HhRtOa25VsE=";
+  };
+  buildInputs = [
+    openssl
+    zlib
+  ];
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp objs/bin/mtproto-proxy $out/bin/
+    runHook postInstall
+  '';
+  meta = {
+    description = "Simple MT-Proto proxy";
+    mainProgram = "mtproto-proxy";
+    homepage = "https://github.com/TelegramMessenger/MTProxy";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ nix-julia ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

From 49305054805a50e9d1e815f63cfefcf20aed8fe1 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 24 Feb 2026 13:39:48 +0100
Subject: [PATCH 13/48] nixos/speedtest-tracker: init module

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 nixos/modules/module-list.nix                 |   1 +
 .../services/web-apps/speedtest-tracker.nix   | 429 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/speedtest-tracker.nix             |  33 ++
 4 files changed, 464 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/speedtest-tracker.nix
 create mode 100644 nixos/tests/speedtest-tracker.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5903916b62a7..2b3b8fcc1a16 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1755,6 +1755,7 @@
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/snips-sh.nix
   ./services/web-apps/sogo.nix
+  ./services/web-apps/speedtest-tracker.nix
   ./services/web-apps/sshwifty.nix
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix
diff --git a/nixos/modules/services/web-apps/speedtest-tracker.nix b/nixos/modules/services/web-apps/speedtest-tracker.nix
new file mode 100644
index 000000000000..310fbb52012b
--- /dev/null
+++ b/nixos/modules/services/web-apps/speedtest-tracker.nix
@@ -0,0 +1,429 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.speedtest-tracker;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "speedtest-tracker";
+  defaultGroup = "speedtest-tracker";
+
+  artisan = "${cfg.package}/artisan";
+
+  env-file-values = lib.mapAttrs' (n: v: {
+    name = lib.removeSuffix "_FILE" n;
+    value = v;
+  }) (lib.filterAttrs (n: v: v != null && lib.match ".+_FILE" n != null) cfg.settings);
+
+  env-nonfile-values = lib.filterAttrs (n: v: lib.match ".+_FILE" n == null) cfg.settings;
+
+  speedtest-tracker-maintenance = pkgs.writeShellScript "speedtest-tracker-maintenance.sh" ''
+    set -a
+    ${lib.toShellVars env-nonfile-values}
+    ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+    set +a
+    ${lib.optionalString (
+      cfg.settings.DB_CONNECTION == "sqlite"
+    ) "touch ${cfg.dataDir}/storage/database/database.sqlite"}
+    rm -f ${cfg.dataDir}/cache/*.php
+    ${artisan} package:discover
+    ${artisan} migrate --force
+    ${artisan} optimize:clear
+    ${artisan} view:cache
+    ${artisan} config:cache
+  '';
+
+  speedtest-tracker-env-script =
+    command:
+    pkgs.writeShellScript "speedtest-tracker-${builtins.replaceStrings [ ":" " " ] [ "-" "-" ] command}.sh" ''
+      set -a
+      ${lib.toShellVars env-nonfile-values}
+      ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+      set +a
+      exec ${artisan} ${command}
+    '';
+
+  commonServiceConfig = {
+    Type = "oneshot";
+    User = user;
+    Group = group;
+    StateDirectory = "speedtest-tracker";
+    ReadWritePaths = [ cfg.dataDir ];
+    WorkingDirectory = cfg.package;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    CapabilityBoundingSet = "";
+    AmbientCapabilities = "";
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectHome = "tmpfs";
+    ProtectKernelLogs = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    PrivateNetwork = false;
+    RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service @resources"
+      "~@obsolete @privileged"
+    ];
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    NoNewPrivileges = true;
+    RestrictRealtime = true;
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    PrivateUsers = true;
+  };
+
+in
+{
+  options.services.speedtest-tracker = {
+
+    enable = lib.mkEnableOption "Speedtest Tracker: A self-hosted internet performance tracking application";
+
+    package =
+      lib.mkPackageOption pkgs "speedtest-tracker" { }
+      // lib.mkOption {
+        apply =
+          speedtest-tracker:
+          speedtest-tracker.override (prev: {
+            dataDir = cfg.dataDir;
+          });
+      };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which Speedtest Tracker runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.speedtest-tracker.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which Speedtest Tracker runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/speedtest-tracker";
+      description = ''
+        The place where Speedtest Tracker stores its state.
+      '';
+    };
+
+    enableNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to Speedtest Tracker. If not enabled, then you may use
+        `''${config.services.speedtest-tracker.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      description = ''
+        The hostname at which you wish Speedtest Tracker to be served. If you have
+        enabled nginx using `services.speedtest-tracker.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+          lib.types.bool
+        ]
+      );
+      default = { };
+      defaultText = ''
+        {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        }
+      '';
+      description = ''
+        Options for the Speedtest Tracker PHP pool. See the documentation on `php-fpm.conf`
+        for details on configuration directives.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for Speedtest Tracker configuration. Refer to
+        <https://github.com/alexjustesen/speedtest-tracker> for
+        details on supported values. All `_FILE` values are supported:
+        append `_FILE` to the setting name to provide a path to a file
+        containing the secret value.
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_KEY_FILE = "/var/secrets/speedtest-tracker-app-key.txt";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "db";
+          DB_PORT = 3306;
+          DB_DATABASE = "speedtest-tracker";
+          DB_USERNAME = "speedtest-tracker";
+          DB_PASSWORD_FILE = "/var/secrets/speedtest-tracker-mysql-password.txt";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+            lib.types.bool
+          ]
+        );
+        options = {
+          APP_KEY_FILE = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              The path to your appkey. The file should contain a 32 character
+              random app key. This may be set using `echo "base64:$(head -c 32
+              /dev/urandom | base64)" > /path/to/key-file`.
+            '';
+          };
+          APP_URL = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.virtualHost == "localhost" then
+                "http://${cfg.virtualHost}"
+              else
+                "https://${cfg.virtualHost}";
+            defaultText = ''
+              http(s)://''${config.services.speedtest-tracker.virtualHost}
+            '';
+            description = ''
+              The APP_URL used by Speedtest Tracker internally. Please make sure this
+              URL matches the external URL of your installation. It is used to
+              validate specific requests and to generate URLs in notifications.
+            '';
+          };
+          DB_CONNECTION = lib.mkOption {
+            type = lib.types.enum [
+              "sqlite"
+              "mysql"
+              "mariadb"
+              "pgsql"
+            ];
+            default = "sqlite";
+            example = "pgsql";
+            description = ''
+              The type of database you wish to use. Can be one of "sqlite",
+              "mysql", "mariadb" or "pgsql".
+            '';
+          };
+          DB_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = ''
+              The IP or hostname which hosts your database.
+            '';
+          };
+          DB_PORT = lib.mkOption {
+            type = lib.types.nullOr lib.types.int;
+            default =
+              if cfg.settings.DB_CONNECTION == "pgsql" then
+                5432
+              else if cfg.settings.DB_CONNECTION == "mysql" || cfg.settings.DB_CONNECTION == "mariadb" then
+                3306
+              else
+                null;
+            defaultText = ''
+              `null` if DB_CONNECTION is "sqlite", `3306` if "mysql" or "mariadb", `5432` if "pgsql"
+            '';
+            description = ''
+              The port your database is listening at. sqlite does not require
+              this value to be filled.
+            '';
+          };
+          DB_DATABASE = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.settings.DB_CONNECTION == "sqlite" then
+                "${cfg.dataDir}/storage/database/database.sqlite"
+              else
+                "speedtest-tracker";
+            defaultText = ''
+              "''${config.services.speedtest-tracker.dataDir}/storage/database/database.sqlite" if DB_CONNECTION is "sqlite", "speedtest-tracker" otherwise
+            '';
+            description = ''
+              The name of the database, or path to the sqlite file.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    services.phpfpm.pools.speedtest-tracker = {
+      inherit user group;
+      phpPackage = cfg.package.phpPackage;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = lib.mkDefault "0660";
+        "listen.owner" = lib.mkDefault user;
+        "listen.group" = lib.mkDefault group;
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 32;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 2;
+        "pm.max_spare_servers" = lib.mkDefault 4;
+        "pm.max_requests" = lib.mkDefault 500;
+      }
+      // cfg.poolConfig;
+    };
+
+    systemd.services.speedtest-tracker-setup = {
+      after = [
+        "postgresql.target"
+        "mysql.service"
+      ];
+      requiredBy = [ "phpfpm-speedtest-tracker.service" ];
+      before = [ "phpfpm-speedtest-tracker.service" ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-maintenance;
+        RemainAfterExit = true;
+      }
+      // commonServiceConfig;
+      unitConfig.JoinsNamespaceOf = "phpfpm-speedtest-tracker.service";
+      restartTriggers = [ cfg.package ];
+      partOf = [ "phpfpm-speedtest-tracker.service" ];
+    };
+
+    systemd.services.speedtest-tracker-scheduler = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      description = "Speedtest Tracker scheduler";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-env-script "schedule:run";
+      }
+      // commonServiceConfig;
+    };
+
+    systemd.timers.speedtest-tracker-scheduler = {
+      description = "Speedtest Tracker scheduler timer";
+      timerConfig = {
+        OnCalendar = "minutely";
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+      restartTriggers = [ cfg.package ];
+    };
+
+    systemd.services.speedtest-tracker-queue-worker = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Speedtest Tracker queue worker";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = commonServiceConfig // {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = speedtest-tracker-env-script "queue:work --sleep=3 --tries=3";
+      };
+    };
+
+    services.nginx = lib.mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}/public";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \\.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_pass unix:${config.services.phpfpm.pools.speedtest-tracker.socket};
+            '';
+          };
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-speedtest-tracker" =
+      lib.genAttrs
+        [
+          "${cfg.dataDir}/storage"
+          "${cfg.dataDir}/storage/app"
+          "${cfg.dataDir}/storage/database"
+          "${cfg.dataDir}/storage/framework"
+          "${cfg.dataDir}/storage/framework/cache"
+          "${cfg.dataDir}/storage/framework/sessions"
+          "${cfg.dataDir}/storage/framework/views"
+          "${cfg.dataDir}/storage/logs"
+          "${cfg.dataDir}/cache"
+        ]
+        (n: {
+          d = {
+            inherit group;
+            mode = "0700";
+            inherit user;
+          };
+        })
+      // {
+        "${cfg.dataDir}".d = {
+          inherit group;
+          mode = "0710";
+          inherit user;
+        };
+      };
+
+    users = {
+      users = lib.mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
+    };
+  };
+
+  meta.maintainers = pkgs.speedtest-tracker.meta.maintainers;
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 2296234b1b3c..21638790bfb1 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1484,6 +1484,7 @@ in
   sonic-server = runTest ./sonic-server.nix;
   spacecookie = runTest ./spacecookie.nix;
   spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark { };
+  speedtest-tracker = runTest ./speedtest-tracker.nix;
   spiped = runTest ./spiped.nix;
   sqlite3-to-mysql = runTest ./sqlite3-to-mysql.nix;
   squid = runTest ./squid.nix;
diff --git a/nixos/tests/speedtest-tracker.nix b/nixos/tests/speedtest-tracker.nix
new file mode 100644
index 000000000000..5d5c42957300
--- /dev/null
+++ b/nixos/tests/speedtest-tracker.nix
@@ -0,0 +1,33 @@
+{ lib, pkgs, ... }:
+
+let
+  app-key = "base64:VGVzdFRlc3RUZXN0VGVzdFRlc3RUZXN0VGVzdFRlc3Q=";
+in
+{
+  name = "speedtest-tracker";
+  meta = {
+    maintainers = pkgs.speedtest-tracker.meta.maintainers;
+    platforms = lib.platforms.linux;
+  };
+
+  nodes.sqlite = {
+    environment.etc."speedtest-tracker-appkey".text = app-key;
+    services.speedtest-tracker = {
+      enable = true;
+      enableNginx = true;
+      settings = {
+        APP_KEY_FILE = "/etc/speedtest-tracker-appkey";
+      };
+    };
+  };
+
+  testScript = ''
+    sqlite.wait_for_unit("phpfpm-speedtest-tracker.service")
+    sqlite.wait_for_unit("nginx.service")
+    sqlite.wait_for_unit("speedtest-tracker-queue-worker.service")
+
+    sqlite.succeed("curl -Ls -o /dev/null -w '%{http_code}' http://localhost/admin/login | grep '200'")
+    sqlite.succeed("curl -Ls http://localhost/admin/login | grep -i 'login'")
+    sqlite.succeed("systemctl start speedtest-tracker-scheduler.service")
+  '';
+}

From cea1b086f08ed2d8df14be0d00e0cd907a0cd095 Mon Sep 17 00:00:00 2001
From: Nicolas Benes <nbenes.gh@xandea.de>
Date: Fri, 27 Feb 2026 20:00:31 +0100
Subject: [PATCH 14/48] dataexplorer: 3.9.3 -> 4.0.2

---
 pkgs/by-name/da/dataexplorer/package.nix | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/da/dataexplorer/package.nix b/pkgs/by-name/da/dataexplorer/package.nix
index f9c8890fc3f9..14cf687bcc53 100644
--- a/pkgs/by-name/da/dataexplorer/package.nix
+++ b/pkgs/by-name/da/dataexplorer/package.nix
@@ -3,33 +3,34 @@
   stdenv,
   fetchurl,
   ant,
-  # executable fails to start for jdk > 17
-  jdk17,
+  openjdk25,
   swt,
   makeWrapper,
   strip-nondeterminism,
   udevCheckHook,
 }:
 let
-  swt-jdk17 = swt.override { jdk = jdk17; };
+  swt-jdk = swt.override { jdk = openjdk25; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dataexplorer";
-  version = "3.9.3";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "mirror://savannah/dataexplorer/dataexplorer-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-NfbhamhRx78MW5H4BpKMDfrV2d082UkaIBFfbemOSOY=";
+    hash = "sha256-HaupE8tCbmlUVMd0ZFt7QwY1AKEx+op21fUeGBpR+UY=";
   };
 
   nativeBuildInputs = [
     ant
-    jdk17
+    openjdk25
     makeWrapper
     strip-nondeterminism
     udevCheckHook
   ];
 
+  dontConfigure = true;
+
   buildPhase = ''
     runHook preBuild
     ant -f build/build.xml dist
@@ -49,18 +50,18 @@ stdenv.mkDerivation (finalAttrs: {
 
     ant -Dprefix=$out/share/ -f build/build.xml install
     # Use SWT from nixpkgs
-    ln -sf '${swt-jdk17}/jars/swt.jar' "$out/share/DataExplorer/java/ext/swt.jar"
+    ln -sf '${swt-jdk}/jars/swt.jar' "$out/share/DataExplorer/java/ext/swt.jar"
 
     # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
     # but it hardcodes bash shebang and does not pin the java path.
     # So we create our own wrapper, using similar cmdline args as upstream.
     mkdir -p $out/bin
-    makeWrapper ${jdk17}/bin/java $out/bin/DataExplorer \
-      --prefix LD_LIBRARY_PATH : '${swt-jdk17}/lib' \
+    makeWrapper ${openjdk25}/bin/java $out/bin/DataExplorer \
+      --prefix LD_LIBRARY_PATH : '${swt-jdk}/lib' \
       --add-flags "-Xms64m -Xmx3092m -jar $out/share/DataExplorer/DataExplorer.jar" \
       --set SWT_GTK3 0
 
-    makeWrapper ${jdk17}/bin/java $out/bin/DevicePropertiesEditor \
+    makeWrapper ${openjdk25}/bin/java $out/bin/DevicePropertiesEditor \
       --add-flags "-Xms32m -Xmx512m -classpath $out/share/DataExplorer/DataExplorer.jar gde.ui.dialog.edit.DevicePropertiesEditor" \
       --set SWT_GTK3 0 \
       --set LIBOVERLAY_SCROLLBAR 0

From 08823f7bd20809de6210056643f3f6fed45b29d5 Mon Sep 17 00:00:00 2001
From: loner <2788892716@qq.com>
Date: Sat, 28 Feb 2026 15:48:29 +0800
Subject: [PATCH 15/48] conan: 2.22.2 -> 2.26.1

https://github.com/conan-io/conan/releases/tag/2.26.1
---
 pkgs/by-name/co/conan/package.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/co/conan/package.nix b/pkgs/by-name/co/conan/package.nix
index 47c7bc473609..56147185caed 100644
--- a/pkgs/by-name/co/conan/package.nix
+++ b/pkgs/by-name/co/conan/package.nix
@@ -12,18 +12,19 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "conan";
-  version = "2.22.2";
+  version = "2.26.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "conan-io";
     repo = "conan";
     tag = finalAttrs.version;
-    hash = "sha256-4OKrAfhHgtAS606P88JFYCjgYYlSAH8RReqFs6N2V5s=";
+    hash = "sha256-PBrVt8SM3AFdi/w18c4ZExzNnfTANtAdTUHIquk1At0=";
   };
 
   pythonRelaxDeps = [
     "distro"
+    "patch-ng"
     "urllib3"
   ];
 
@@ -82,6 +83,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_shared_windows_find_libraries"
     # 'cmake' tool version 'Any' is not available
     "test_build"
+    "test_conan_new"
     "test_conan_new_compiles"
     # 'cmake' tool version '3.27' is not available
     "test_metabuild"
@@ -104,6 +106,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # Requires cmake, meson, autotools, apt-get, etc.
     "test/functional/command/runner_test.py"
     "test/functional/command/test_install_deploy.py"
+    "test/functional/command/test_new.py"
     "test/functional/layout/test_editable_cmake.py"
     "test/functional/layout/test_editable_cmake_components.py"
     "test/functional/layout/test_in_subfolder.py"
@@ -113,12 +116,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test/functional/toolchains/"
     "test/functional/tools/scm/test_git.py"
     "test/functional/tools/system/package_manager_test.py"
+    "test/functional/sbom/test_cyclonedx.py"
+    "test/functional/workspace/test_workspace.py"
     "test/functional/tools_versions_test.py"
     "test/functional/util/test_cmd_args_to_string.py"
-    "test/performance/test_large_graph.py"
+
+    # Requires network access to PyPI
+    "test/functional/tools/system/python_manager_test.py"
+
+    # Test failure
     "test/unittests/tools/env/test_env_files.py"
-    # pipenv will attempt to access the network.
-    "test/functional/tools/system/pip_manager_test.py"
   ];
 
   meta = {

From 5f7c43320c6559972104f74c5ba495cdbf91f608 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Feb 2026 21:28:35 +0000
Subject: [PATCH 16/48] python3Packages.tempest: 46.0.0 -> 46.1.1

---
 pkgs/development/python-modules/tempest/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index b5050fa94bb6..c3fe3ad2cfbd 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -32,12 +32,12 @@
 
 buildPythonPackage rec {
   pname = "tempest";
-  version = "46.0.0";
+  version = "46.1.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ddm1OE7BDwDM4T9GIB0+qK8WvU/+aC+FBIGWDm3ObHM=";
+    hash = "sha256-E61jqj0Wy1f81ackoFnnEZI2UCw70YIGYxQA1ME++xU=";
   };
 
   postPatch = ''
@@ -88,6 +88,11 @@ buildPythonPackage rec {
     chmod +x bin/*
 
     stestr --test-path tempest/tests run -e <(echo "
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_dict_return_values
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_multiple_workers
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_single_process
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_success
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_with_exception
       tempest.tests.lib.cli.test_execute.TestExecute.test_execute_with_prefix
     ")
   '';

From 3a3b88407b01ba8bdb1ccba529b0dacfccf08693 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 1 Mar 2026 00:57:17 +0100
Subject: [PATCH 17/48] python313Packages.dogpile-cache: speed up test
 execution, ignore more flaky tests

Following upstream https://github.com/sqlalchemy/dogpile.cache/blob/rel_1_5_0/pyproject.toml#L68
---
 .../python-modules/dogpile-cache/default.nix          | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/dogpile-cache/default.nix b/pkgs/development/python-modules/dogpile-cache/default.nix
index a68fcad4bdb3..ebea5ee74068 100644
--- a/pkgs/development/python-modules/dogpile-cache/default.nix
+++ b/pkgs/development/python-modules/dogpile-cache/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
+  pytest-xdist,
   pytestCheckHook,
   mako,
   decorator,
@@ -31,8 +32,14 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     mako
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isLinux [
+    # flaky
+    "tests/cache/test_dbm_backend.py"
   ];
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -44,6 +51,8 @@ buildPythonPackage rec {
     "test_get_value_plus_created_registry_safe_cache_slow"
     "test_get_value_plus_created_registry_unsafe_cache"
     "test_quick"
+    "test_region_set_get_value"
+    "test_region_set_multiple_values"
     "test_return_while_in_progress"
     "test_slow"
   ];

From 516a14cd33a4665fbc89ad25846e49f9a53ab0da Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Sat, 7 Feb 2026 16:27:07 +0100
Subject: [PATCH 18/48] modules/generic/meta-maintainers.nix: Simplify

There was no need for it to be this complicated.

Notably the maintainer check was never used anyways, because only its
merge function was used, which doesn't do a check

There is a minor functional change with this commit, which is that even
if explicitly `meta.maintainers = []`, that module will be in the result
when it wasn't before. I deem this insignificant.
---
 modules/generic/meta-maintainers.nix | 35 ++++------------------------
 1 file changed, 4 insertions(+), 31 deletions(-)

diff --git a/modules/generic/meta-maintainers.nix b/modules/generic/meta-maintainers.nix
index f9e8a19aea82..75365d07ce7a 100644
--- a/modules/generic/meta-maintainers.nix
+++ b/modules/generic/meta-maintainers.nix
@@ -4,39 +4,12 @@
 let
   inherit (lib)
     mkOption
-    mkOptionType
     types
     ;
 
-  maintainer = mkOptionType {
-    name = "maintainer";
-    check = email: lib.elem email (lib.attrValues lib.maintainers);
-    merge = loc: defs: {
-      # lib.last: Perhaps this could be merged instead, if "at most once per module"
-      # is a problem (see option description).
-      ${(lib.last defs).file} = (lib.last defs).value;
-    };
-  };
-
-  listOfMaintainers = types.listOf maintainer // {
-    merge =
-      loc: defs:
-      lib.zipAttrs (
-        lib.flatten (
-          lib.imap1 (
-            n: def:
-            lib.imap1 (
-              m: def':
-              maintainer.merge (loc ++ [ "[${toString n}-${toString m}]" ]) [
-                {
-                  inherit (def) file;
-                  value = def';
-                }
-              ]
-            ) def.value
-          ) defs
-        )
-      );
+  # The resulting value of this type shows where all values were defined
+  sourceList = types.listOf types.raw // {
+    merge = loc: defs: lib.listToAttrs (lib.map ({ file, value }: lib.nameValuePair file value) defs);
   };
 in
 {
@@ -44,7 +17,7 @@ in
   options = {
     meta = {
       maintainers = mkOption {
-        type = listOfMaintainers;
+        type = sourceList;
         default = [ ];
         example = lib.literalExpression "[ lib.maintainers.alice lib.maintainers.bob ]";
         description = ''

From 3dc5545d5178ada55859f9897fd0ffda8f5b0cbe Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Sat, 7 Feb 2026 16:41:58 +0100
Subject: [PATCH 19/48] modules/generic/meta-maintainers.nix: Check validity of
 meta.maintainers

And fix a case where it wasn't valid
---
 modules/generic/meta-maintainers.nix            |  9 ++++++++-
 modules/generic/meta-maintainers/test.nix       | 10 +++++++++-
 nixos/modules/services/databases/clickhouse.nix |  2 +-
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/modules/generic/meta-maintainers.nix b/modules/generic/meta-maintainers.nix
index 75365d07ce7a..ff8ce87b004b 100644
--- a/modules/generic/meta-maintainers.nix
+++ b/modules/generic/meta-maintainers.nix
@@ -17,7 +17,14 @@ in
   options = {
     meta = {
       maintainers = mkOption {
-        type = sourceList;
+        type =
+          let
+            allMaintainers = lib.attrValues lib.maintainers;
+          in
+          lib.types.addCheck sourceList (lib.all (v: lib.elem v allMaintainers))
+          // {
+            description = "list of lib.maintainers";
+          };
         default = [ ];
         example = lib.literalExpression "[ lib.maintainers.alice lib.maintainers.bob ]";
         description = ''
diff --git a/modules/generic/meta-maintainers/test.nix b/modules/generic/meta-maintainers/test.nix
index e4b37780ca83..a9859a6ee2dc 100644
--- a/modules/generic/meta-maintainers/test.nix
+++ b/modules/generic/meta-maintainers/test.nix
@@ -14,9 +14,17 @@ let
   };
 in
 rec {
-  lib = import ../../../lib;
+  # Inject ghost into lib.maintainers so it passes the addCheck validation
+  lib = (import ../../../lib).extend (
+    final: prev: {
+      maintainers = prev.maintainers // {
+        inherit ghost;
+      };
+    }
+  );
 
   example = lib.evalModules {
+    specialArgs.lib = lib;
     modules = [
       ../meta-maintainers.nix
       {
diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix
index de9371de513a..50c291a10be6 100644
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@@ -13,7 +13,7 @@ let
 in
 {
 
-  meta.maintainers = [ "thevar1able" ];
+  meta.maintainers = with lib.maintainers; [ thevar1able ];
 
   ###### interface
 

From b486dfb1ab003e95746b68e1d904f82b1dd27e7e Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Sat, 7 Feb 2026 16:28:10 +0100
Subject: [PATCH 20/48] modules/generic/meta-maintainers.nix: Remove Nixpkgs
 prefix from module path

This is a functional change, but there's no known consumer of this
interface, and if we want to trigger review request for PRs it's
convenient for these paths to be absolute

ci: Trigger review requests for module maintainers
---
 ci/eval/compare/maintainers.nix | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index daecc1c154da..e202e47ae118 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -13,6 +13,14 @@ let
     config.allowAliases = false;
   };
 
+  nixpkgsRoot = toString ../../.. + "/";
+
+  fileMaintainers =
+    # Currently just nixos module maintainers, but in the future we can use this for code owners too
+    lib.mapAttrs' (
+      file: maintainers: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) maintainers
+    ) (pkgs.nixos { }).config.meta.maintainers;
+
   changedpaths = lib.importJSON changedpathsjson;
 
   # Extract attributes that changed from by-name paths.
@@ -94,39 +102,42 @@ let
   attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
 
   userPings =
-    pkg:
+    context:
     map (maintainer: {
       type = "user";
       userId = maintainer.githubId;
-      packageName = pkg.name;
+      inherit context;
     });
 
   teamPings =
-    pkg: team:
+    context: team:
     if team ? github then
       [
         {
           type = "team";
           teamId = team.githubId;
-          packageName = pkg.name;
+          inherit context;
         }
       ]
     else
-      userPings pkg team.members;
+      userPings context team.members;
 
-  maintainersToPing = lib.concatMap (
-    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
-  ) attrsWithModifiedFiles;
+  maintainersToPing =
+    lib.concatMap (
+      pkg:
+      userPings { attr = pkg.name; } pkg.users ++ lib.concatMap (teamPings { pkg = pkg.name; }) pkg.teams
+    ) attrsWithModifiedFiles
+    ++ lib.concatMap (path: userPings { file = path; } (fileMaintainers.${path} or [ ])) changedpaths;
 
   byType = lib.groupBy (ping: ping.type) maintainersToPing;
 
   byUser = lib.pipe (byType.user or [ ]) [
     (lib.groupBy (ping: toString ping.userId))
-    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
+    (lib.mapAttrs (_user: lib.map (pkg: pkg.context)))
   ];
   byTeam = lib.pipe (byType.team or [ ]) [
     (lib.groupBy (ping: toString ping.teamId))
-    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
+    (lib.mapAttrs (_team: lib.map (pkg: pkg.context)))
   ];
 in
 {

From 5991eab94f05841f55bb364fade93878f2d0ea7a Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Sat, 7 Feb 2026 16:56:42 +0100
Subject: [PATCH 21/48] modules/generic/meta-maintainers.nix: Introduce
 meta.teams

And trigger review requests for it
---
 ci/eval/compare/maintainers.nix      | 19 +++++++++++++------
 modules/generic/meta-maintainers.nix | 16 ++++++++++++++++
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index e202e47ae118..73c36c7f9196 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -14,12 +14,15 @@ let
   };
 
   nixpkgsRoot = toString ../../.. + "/";
+  stripNixpkgsRootFromKeys = lib.mapAttrs' (
+    file: value: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) value
+  );
 
-  fileMaintainers =
-    # Currently just nixos module maintainers, but in the future we can use this for code owners too
-    lib.mapAttrs' (
-      file: maintainers: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) maintainers
-    ) (pkgs.nixos { }).config.meta.maintainers;
+  moduleMeta = (pkgs.nixos { }).config.meta;
+
+  # Currently just nixos module maintainers, but in the future we can use this for code owners too
+  fileMaintainers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
+  fileTeams = stripNixpkgsRootFromKeys moduleMeta.teams;
 
   changedpaths = lib.importJSON changedpathsjson;
 
@@ -127,7 +130,11 @@ let
       pkg:
       userPings { attr = pkg.name; } pkg.users ++ lib.concatMap (teamPings { pkg = pkg.name; }) pkg.teams
     ) attrsWithModifiedFiles
-    ++ lib.concatMap (path: userPings { file = path; } (fileMaintainers.${path} or [ ])) changedpaths;
+    ++ lib.concatMap (
+      path:
+      userPings { file = path; } (fileMaintainers.${path} or [ ])
+      ++ lib.concatMap (teamPings { file = path; }) (fileTeams.${path} or [ ])
+    ) changedpaths;
 
   byType = lib.groupBy (ping: ping.type) maintainersToPing;
 
diff --git a/modules/generic/meta-maintainers.nix b/modules/generic/meta-maintainers.nix
index ff8ce87b004b..ce37dae03db6 100644
--- a/modules/generic/meta-maintainers.nix
+++ b/modules/generic/meta-maintainers.nix
@@ -34,6 +34,22 @@ in
           The option value is not a list of maintainers, but an attribute set that maps module file names to lists of maintainers.
         '';
       };
+      teams = mkOption {
+        type =
+          let
+            allTeams = lib.attrValues lib.teams;
+          in
+          lib.types.addCheck sourceList (lib.all (v: lib.elem v allTeams))
+          // {
+            description = "list of lib.teams";
+          };
+        default = [ ];
+        example = lib.literalExpression "[ lib.teams.acme lib.teams.haskell ]";
+        description = ''
+          List of team maintainers of each module.
+          This option should be defined at most once per module.
+        '';
+      };
     };
   };
   meta.maintainers = with lib.maintainers; [

From dbb164c7590ebbf7e997322e155273aeac1c98ba Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Sat, 7 Feb 2026 17:12:21 +0100
Subject: [PATCH 22/48] nixos/modules: Use meta.teams over meta.maintainers =
 lib.teams.*.members

This allows getting the team itself requested for a review instead of
the individual members
---
 nixos/modules/config/vte.nix                           |  2 +-
 nixos/modules/config/xdg/autostart.nix                 |  2 +-
 nixos/modules/config/xdg/icons.nix                     |  2 +-
 nixos/modules/config/xdg/menus.nix                     |  2 +-
 nixos/modules/config/xdg/mime.nix                      |  2 +-
 nixos/modules/config/xdg/portal.nix                    |  2 +-
 nixos/modules/config/xdg/portals/lxqt.nix              |  2 +-
 nixos/modules/config/xdg/sounds.nix                    |  2 +-
 nixos/modules/programs/dsearch.nix                     |  2 +-
 nixos/modules/programs/geary.nix                       |  2 +-
 nixos/modules/programs/gnome-disks.nix                 |  2 +-
 nixos/modules/programs/gnome-terminal.nix              |  2 +-
 nixos/modules/programs/nm-applet.nix                   |  2 +-
 nixos/modules/programs/steam.nix                       |  2 +-
 nixos/modules/programs/thunar.nix                      |  2 +-
 nixos/modules/programs/wayland/dms-shell.nix           |  2 +-
 nixos/modules/programs/wayland/hyprland.nix            |  2 +-
 nixos/modules/programs/wayland/hyprlock.nix            |  2 +-
 nixos/modules/programs/xfconf.nix                      |  2 +-
 nixos/modules/security/acme/default.nix                |  2 +-
 nixos/modules/security/apparmor.nix                    |  2 +-
 nixos/modules/services/cluster/rancher/default.nix     |  3 ++-
 .../continuous-integration/buildbot/master.nix         |  2 +-
 .../continuous-integration/buildbot/worker.nix         |  2 +-
 .../continuous-integration/gitlab-runner/runner.nix    |  2 +-
 nixos/modules/services/desktop-managers/budgie.nix     |  2 +-
 nixos/modules/services/desktop-managers/cosmic.nix     |  2 +-
 nixos/modules/services/desktop-managers/gnome.nix      |  2 +-
 nixos/modules/services/desktop-managers/lomiri.nix     |  2 +-
 nixos/modules/services/desktop-managers/pantheon.nix   |  2 +-
 nixos/modules/services/desktops/accountsservice.nix    |  2 +-
 nixos/modules/services/desktops/geoclue2.nix           |  2 +-
 nixos/modules/services/desktops/gnome/at-spi2-core.nix |  2 +-
 .../services/desktops/gnome/evolution-data-server.nix  |  2 +-
 .../modules/services/desktops/gnome/gcr-ssh-agent.nix  |  2 +-
 .../services/desktops/gnome/glib-networking.nix        |  2 +-
 .../desktops/gnome/gnome-browser-connector.nix         |  2 +-
 .../services/desktops/gnome/gnome-initial-setup.nix    |  2 +-
 .../modules/services/desktops/gnome/gnome-keyring.nix  |  2 +-
 .../services/desktops/gnome/gnome-online-accounts.nix  |  2 +-
 .../services/desktops/gnome/gnome-remote-desktop.nix   |  2 +-
 .../services/desktops/gnome/gnome-settings-daemon.nix  |  2 +-
 .../modules/services/desktops/gnome/gnome-software.nix |  2 +-
 .../services/desktops/gnome/gnome-user-share.nix       |  2 +-
 nixos/modules/services/desktops/gnome/localsearch.nix  |  2 +-
 nixos/modules/services/desktops/gnome/rygel.nix        |  2 +-
 nixos/modules/services/desktops/gnome/sushi.nix        |  2 +-
 nixos/modules/services/desktops/gnome/tinysparql.nix   |  2 +-
 nixos/modules/services/desktops/gvfs.nix               |  2 +-
 nixos/modules/services/desktops/pipewire/pipewire.nix  |  3 ++-
 nixos/modules/services/desktops/tumbler.nix            |  2 +-
 nixos/modules/services/desktops/zeitgeist.nix          |  2 +-
 .../services/display-managers/cosmic-greeter.nix       |  2 +-
 .../modules/services/display-managers/dms-greeter.nix  |  2 +-
 nixos/modules/services/display-managers/gdm.nix        |  2 +-
 .../services/home-automation/home-assistant.nix        |  2 +-
 nixos/modules/services/matrix/dendrite.nix             |  2 +-
 nixos/modules/services/misc/forgejo.nix                |  2 +-
 nixos/modules/services/misc/gitlab.nix                 |  2 +-
 nixos/modules/services/networking/epmd.nix             |  2 +-
 nixos/modules/services/networking/jibri/default.nix    |  2 +-
 nixos/modules/services/networking/jicofo.nix           |  2 +-
 nixos/modules/services/networking/jigasi.nix           |  2 +-
 .../modules/services/networking/jitsi-videobridge.nix  |  2 +-
 nixos/modules/services/networking/modemmanager.nix     |  2 +-
 nixos/modules/services/networking/networkmanager.nix   |  5 ++---
 nixos/modules/services/security/reaction.nix           | 10 ++++------
 nixos/modules/services/wayland/hypridle.nix            |  2 +-
 nixos/modules/services/web-apps/jitsi-meet.nix         |  2 +-
 nixos/modules/services/web-apps/nextcloud.nix          |  2 +-
 nixos/modules/services/web-apps/peertube-runner.nix    |  2 +-
 .../services/x11/desktop-managers/enlightenment.nix    |  2 +-
 nixos/modules/services/x11/desktop-managers/lumina.nix |  2 +-
 nixos/modules/services/x11/desktop-managers/lxqt.nix   |  2 +-
 nixos/modules/services/x11/desktop-managers/xfce.nix   |  2 +-
 .../x11/display-managers/account-service-util.nix      |  2 +-
 .../x11/display-managers/lightdm-greeters/lomiri.nix   |  2 +-
 .../x11/display-managers/lightdm-greeters/pantheon.nix |  2 +-
 .../modules/services/x11/display-managers/lightdm.nix  |  2 +-
 nixos/modules/services/x11/touchegg.nix                |  2 +-
 nixos/modules/virtualisation/containers.nix            |  2 +-
 nixos/modules/virtualisation/cri-o.nix                 |  2 +-
 nixos/modules/virtualisation/incus-agent.nix           |  2 +-
 nixos/modules/virtualisation/incus-virtual-machine.nix |  2 +-
 nixos/modules/virtualisation/incus.nix                 |  2 +-
 nixos/modules/virtualisation/lxc-container.nix         |  2 +-
 nixos/modules/virtualisation/lxc-image-metadata.nix    |  2 +-
 nixos/modules/virtualisation/lxc-instance-common.nix   |  2 +-
 nixos/modules/virtualisation/lxc.nix                   |  2 +-
 nixos/modules/virtualisation/lxcfs.nix                 |  2 +-
 nixos/modules/virtualisation/podman/default.nix        |  2 +-
 .../podman/network-socket-ghostunnel.nix               |  3 ++-
 nixos/modules/virtualisation/podman/network-socket.nix |  3 ++-
 nixos/modules/virtualisation/xen-dom0.nix              |  2 +-
 94 files changed, 102 insertions(+), 101 deletions(-)

diff --git a/nixos/modules/config/vte.nix b/nixos/modules/config/vte.nix
index 8ed746d4966d..f3ec58012b0d 100644
--- a/nixos/modules/config/vte.nix
+++ b/nixos/modules/config/vte.nix
@@ -22,7 +22,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix
index 8fc3cb9920fa..8310c377d43b 100644
--- a/nixos/modules/config/xdg/autostart.nix
+++ b/nixos/modules/config/xdg/autostart.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/icons.nix b/nixos/modules/config/xdg/icons.nix
index 7810c57ef386..41eee42767f4 100644
--- a/nixos/modules/config/xdg/icons.nix
+++ b/nixos/modules/config/xdg/icons.nix
@@ -6,7 +6,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/menus.nix b/nixos/modules/config/xdg/menus.nix
index 6c05d49189ad..efbfdc5f2383 100644
--- a/nixos/modules/config/xdg/menus.nix
+++ b/nixos/modules/config/xdg/menus.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/mime.nix b/nixos/modules/config/xdg/mime.nix
index 79955a03ef2f..59d62a32010b 100644
--- a/nixos/modules/config/xdg/mime.nix
+++ b/nixos/modules/config/xdg/mime.nix
@@ -13,7 +13,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members ++ [ ];
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix
index 5fd9d7fdd1bb..6bc6ce5e33e7 100644
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -32,7 +32,7 @@ in
   ];
 
   meta = {
-    maintainers = teams.freedesktop.members;
+    teams = [ teams.freedesktop ];
   };
 
   options.xdg.portal = {
diff --git a/nixos/modules/config/xdg/portals/lxqt.nix b/nixos/modules/config/xdg/portals/lxqt.nix
index 77a5f144730d..423fcae1b2b1 100644
--- a/nixos/modules/config/xdg/portals/lxqt.nix
+++ b/nixos/modules/config/xdg/portals/lxqt.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxqt.members;
+    teams = [ lib.teams.lxqt ];
   };
 
   options.xdg.portal.lxqt = {
diff --git a/nixos/modules/config/xdg/sounds.nix b/nixos/modules/config/xdg/sounds.nix
index 8b5bb67e4109..e23ced7f76dd 100644
--- a/nixos/modules/config/xdg/sounds.nix
+++ b/nixos/modules/config/xdg/sounds.nix
@@ -6,7 +6,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/programs/dsearch.nix b/nixos/modules/programs/dsearch.nix
index f1597189fa38..5e99478054d3 100644
--- a/nixos/modules/programs/dsearch.nix
+++ b/nixos/modules/programs/dsearch.nix
@@ -49,5 +49,5 @@ in
     systemd.user.services.dsearch.wantedBy = mkIf cfg.systemd.enable [ cfg.systemd.target ];
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/programs/geary.nix b/nixos/modules/programs/geary.nix
index 0cbfe5b0605c..6c881dc8ccaf 100644
--- a/nixos/modules/programs/geary.nix
+++ b/nixos/modules/programs/geary.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/programs/gnome-disks.nix b/nixos/modules/programs/gnome-disks.nix
index e6f93c6fdfe6..c6de53d844f3 100644
--- a/nixos/modules/programs/gnome-disks.nix
+++ b/nixos/modules/programs/gnome-disks.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/programs/gnome-terminal.nix b/nixos/modules/programs/gnome-terminal.nix
index aea0e97c3634..f7ade6a184c4 100644
--- a/nixos/modules/programs/gnome-terminal.nix
+++ b/nixos/modules/programs/gnome-terminal.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/programs/nm-applet.nix b/nixos/modules/programs/nm-applet.nix
index 7aecbadd2ebf..a1c69f52f624 100644
--- a/nixos/modules/programs/nm-applet.nix
+++ b/nixos/modules/programs/nm-applet.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options.programs.nm-applet = {
diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index 6fa66f681457..2ae30243c432 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -285,5 +285,5 @@ in
     ];
   };
 
-  meta.maintainers = lib.teams.steam.members;
+  meta.teams = [ lib.teams.steam ];
 }
diff --git a/nixos/modules/programs/thunar.nix b/nixos/modules/programs/thunar.nix
index 76da7d94c67c..c565f3ef1cec 100644
--- a/nixos/modules/programs/thunar.nix
+++ b/nixos/modules/programs/thunar.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.xfce.members;
+    teams = [ lib.teams.xfce ];
   };
 
   options = {
diff --git a/nixos/modules/programs/wayland/dms-shell.nix b/nixos/modules/programs/wayland/dms-shell.nix
index 53f84c1a41b1..b24253b57c23 100644
--- a/nixos/modules/programs/wayland/dms-shell.nix
+++ b/nixos/modules/programs/wayland/dms-shell.nix
@@ -226,5 +226,5 @@ in
     hardware.graphics.enable = lib.mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/programs/wayland/hyprland.nix b/nixos/modules/programs/wayland/hyprland.nix
index 44aedc3d248e..744f7af70fe5 100644
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@@ -130,5 +130,5 @@ in
     ] "Nvidia patches are no longer needed")
   ];
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/programs/wayland/hyprlock.nix b/nixos/modules/programs/wayland/hyprlock.nix
index e05d8f826a4c..c1ba14ddf771 100644
--- a/nixos/modules/programs/wayland/hyprlock.nix
+++ b/nixos/modules/programs/wayland/hyprlock.nix
@@ -26,5 +26,5 @@ in
     security.pam.services.hyprlock = { };
   };
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/programs/xfconf.nix b/nixos/modules/programs/xfconf.nix
index cc9b6ddf7ac7..74a05cc1a798 100644
--- a/nixos/modules/programs/xfconf.nix
+++ b/nixos/modules/programs/xfconf.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.xfce.members;
+    teams = [ lib.teams.xfce ];
   };
 
   options = {
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 1b262e285e19..cb3a0010a758 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -1218,7 +1218,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.acme.members;
+    teams = [ lib.teams.acme ];
     doc = ./default.md;
   };
 }
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index 6b059c2bd522..d446bb37a722 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -272,5 +272,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.apparmor.members;
+  meta.teams = [ lib.teams.apparmor ];
 }
diff --git a/nixos/modules/services/cluster/rancher/default.nix b/nixos/modules/services/cluster/rancher/default.nix
index 3ed0f75d081e..c511da5a62f5 100644
--- a/nixos/modules/services/cluster/rancher/default.nix
+++ b/nixos/modules/services/cluster/rancher/default.nix
@@ -962,5 +962,6 @@ in
       (import ./rke2.nix args)
     ];
 
-  meta.maintainers = pkgs.rke2.meta.maintainers ++ lib.teams.k3s.members;
+  meta.teams = [ lib.teams.k3s ];
+  meta.maintainers = pkgs.rke2.meta.maintainers;
 }
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index 42e88e9ddbe3..1cf585604b5e 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -313,5 +313,5 @@ in
     '')
   ];
 
-  meta.maintainers = lib.teams.buildbot.members;
+  meta.teams = [ lib.teams.buildbot ];
 }
diff --git a/nixos/modules/services/continuous-integration/buildbot/worker.nix b/nixos/modules/services/continuous-integration/buildbot/worker.nix
index b1e1e7e254b5..c16720b0bf67 100644
--- a/nixos/modules/services/continuous-integration/buildbot/worker.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix
@@ -196,6 +196,6 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.buildbot.members;
+  meta.teams = [ lib.teams.buildbot ];
 
 }
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
index b95d30ceea4a..693229b87d97 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@@ -893,5 +893,5 @@ in
     )
   ];
 
-  meta.maintainers = teams.gitlab.members;
+  meta.teams = [ teams.gitlab ];
 }
diff --git a/nixos/modules/services/desktop-managers/budgie.nix b/nixos/modules/services/desktop-managers/budgie.nix
index 160ac04ecd6d..36f2946970bd 100644
--- a/nixos/modules/services/desktop-managers/budgie.nix
+++ b/nixos/modules/services/desktop-managers/budgie.nix
@@ -61,7 +61,7 @@ let
   notExcluded = pkg: utils.disablePackageByName pkg config.environment.budgie.excludePackages;
 in
 {
-  meta.maintainers = lib.teams.budgie.members;
+  meta.teams = [ lib.teams.budgie ];
 
   imports = [
     (lib.mkRenamedOptionModule
diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index 26b185cc7742..c780a5164922 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -44,7 +44,7 @@ let
     ];
 in
 {
-  meta.maintainers = lib.teams.cosmic.members;
+  meta.teams = [ lib.teams.cosmic ];
 
   options = {
     services.desktopManager.cosmic = {
diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
index 5c11388eb97b..ddd13354612e 100644
--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -82,7 +82,7 @@ in
 {
   meta = {
     doc = ./gnome.md;
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktop-managers/lomiri.nix b/nixos/modules/services/desktop-managers/lomiri.nix
index b82c194be92c..1f40afb3732a 100644
--- a/nixos/modules/services/desktop-managers/lomiri.nix
+++ b/nixos/modules/services/desktop-managers/lomiri.nix
@@ -292,5 +292,5 @@ in
     })
   ];
 
-  meta.maintainers = lib.teams.lomiri.members;
+  meta.teams = [ lib.teams.lomiri ];
 }
diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index 1fe99c0f66ac..b9498a0adb83 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -25,7 +25,7 @@ in
 
   meta = {
     doc = ./pantheon.md;
-    maintainers = teams.pantheon.members;
+    teams = [ teams.pantheon ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/accountsservice.nix b/nixos/modules/services/desktops/accountsservice.nix
index 758f7383ca63..fd328e357ce2 100644
--- a/nixos/modules/services/desktops/accountsservice.nix
+++ b/nixos/modules/services/desktops/accountsservice.nix
@@ -7,7 +7,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index ffc48d6b9435..e44816cf2542 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -373,6 +373,6 @@ in
   };
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 }
diff --git a/nixos/modules/services/desktops/gnome/at-spi2-core.nix b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
index 293a3166b187..77070843e04e 100644
--- a/nixos/modules/services/desktops/gnome/at-spi2-core.nix
+++ b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/evolution-data-server.nix b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
index 539fcf25342e..4437be835604 100644
--- a/nixos/modules/services/desktops/gnome/evolution-data-server.nix
+++ b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
index d88f1a618049..eb1bad3b15c4 100644
--- a/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
+++ b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/glib-networking.nix b/nixos/modules/services/desktops/gnome/glib-networking.nix
index 558abca0aa31..048db8cf54a3 100644
--- a/nixos/modules/services/desktops/gnome/glib-networking.nix
+++ b/nixos/modules/services/desktops/gnome/glib-networking.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
index 335ebc9a144d..17c1dd9045e8 100644
--- a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
@@ -16,7 +16,7 @@ in
 
 {
   meta = {
-    maintainers = teams.gnome.members;
+    teams = [ teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
index 3df01b59738d..e72574795e65 100644
--- a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
@@ -48,7 +48,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-keyring.nix b/nixos/modules/services/desktops/gnome/gnome-keyring.nix
index 550c6ba8eff5..9140d261a770 100644
--- a/nixos/modules/services/desktops/gnome/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-keyring.nix
@@ -12,7 +12,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix b/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
index 920c4cf8133e..7ec9c7e06296 100644
--- a/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
index 6e685557ecf0..958fbb546dc3 100644
--- a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
@@ -8,7 +8,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
index 06d001ab8134..7d6f7f7f3478 100644
--- a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-software.nix b/nixos/modules/services/desktops/gnome/gnome-software.nix
index ced2549a9e21..6bbe4d5487ab 100644
--- a/nixos/modules/services/desktops/gnome/gnome-software.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-software.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-user-share.nix b/nixos/modules/services/desktops/gnome/gnome-user-share.nix
index c6d0f723c047..eb869106c818 100644
--- a/nixos/modules/services/desktops/gnome/gnome-user-share.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-user-share.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/localsearch.nix b/nixos/modules/services/desktops/gnome/localsearch.nix
index 9160d1f06431..90018c557ec1 100644
--- a/nixos/modules/services/desktops/gnome/localsearch.nix
+++ b/nixos/modules/services/desktops/gnome/localsearch.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/gnome/rygel.nix b/nixos/modules/services/desktops/gnome/rygel.nix
index e8a147ed6e76..410550b8990c 100644
--- a/nixos/modules/services/desktops/gnome/rygel.nix
+++ b/nixos/modules/services/desktops/gnome/rygel.nix
@@ -14,7 +14,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/sushi.nix b/nixos/modules/services/desktops/gnome/sushi.nix
index ea99c7ce30f0..d8aff2a7a0bd 100644
--- a/nixos/modules/services/desktops/gnome/sushi.nix
+++ b/nixos/modules/services/desktops/gnome/sushi.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/tinysparql.nix b/nixos/modules/services/desktops/gnome/tinysparql.nix
index 551b5800e84c..3811780ddbc4 100644
--- a/nixos/modules/services/desktops/gnome/tinysparql.nix
+++ b/nixos/modules/services/desktops/gnome/tinysparql.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix
index 315141705546..004810327798 100644
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 3f4cf2af05b2..77cdfa9a573e 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -85,7 +85,8 @@ let
   };
 in
 {
-  meta.maintainers = teams.freedesktop.members ++ [ maintainers.k900 ];
+  meta.teams = [ teams.freedesktop ];
+  meta.maintainers = [ maintainers.k900 ];
 
   ###### interface
   options = {
diff --git a/nixos/modules/services/desktops/tumbler.nix b/nixos/modules/services/desktops/tumbler.nix
index 12b0184d42c9..9143466fafef 100644
--- a/nixos/modules/services/desktops/tumbler.nix
+++ b/nixos/modules/services/desktops/tumbler.nix
@@ -18,7 +18,7 @@ in
   ];
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/zeitgeist.nix b/nixos/modules/services/desktops/zeitgeist.nix
index 227287dd2377..fe065c4a4d7a 100644
--- a/nixos/modules/services/desktops/zeitgeist.nix
+++ b/nixos/modules/services/desktops/zeitgeist.nix
@@ -8,7 +8,7 @@
 {
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/display-managers/cosmic-greeter.nix b/nixos/modules/services/display-managers/cosmic-greeter.nix
index 8886a4766e4e..93320b9be90a 100644
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@@ -16,7 +16,7 @@ let
 in
 
 {
-  meta.maintainers = lib.teams.cosmic.members;
+  meta.teams = [ lib.teams.cosmic ];
 
   options.services.displayManager.cosmic-greeter = {
     enable = lib.mkEnableOption "COSMIC greeter";
diff --git a/nixos/modules/services/display-managers/dms-greeter.nix b/nixos/modules/services/display-managers/dms-greeter.nix
index d049daa9b24f..abdd6e2ddf3b 100644
--- a/nixos/modules/services/display-managers/dms-greeter.nix
+++ b/nixos/modules/services/display-managers/dms-greeter.nix
@@ -321,5 +321,5 @@ in
     services.libinput.enable = mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix
index e46c8cf72fe7..9fc92e91018c 100644
--- a/nixos/modules/services/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@@ -105,7 +105,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index dc1900f52c1e..eb4b475d4187 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -171,7 +171,7 @@ in
 
   meta = {
     buildDocsInSandbox = false;
-    maintainers = lib.teams.home-assistant.members;
+    teams = [ lib.teams.home-assistant ];
   };
 
   options.services.home-assistant = {
diff --git a/nixos/modules/services/matrix/dendrite.nix b/nixos/modules/services/matrix/dendrite.nix
index 2c31266457df..302bd42b5e37 100644
--- a/nixos/modules/services/matrix/dendrite.nix
+++ b/nixos/modules/services/matrix/dendrite.nix
@@ -341,5 +341,5 @@ in
       };
     };
   };
-  meta.maintainers = lib.teams.matrix.members;
+  meta.teams = [ lib.teams.matrix ];
 }
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 9b85fc8dc133..6834ca2008ea 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -849,5 +849,5 @@ in
   };
 
   meta.doc = ./forgejo.md;
-  meta.maintainers = lib.teams.forgejo.members;
+  meta.teams = [ lib.teams.forgejo ];
 }
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index c353caed9e03..0601454e9b2e 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1911,5 +1911,5 @@ in
   };
 
   meta.doc = ./gitlab.md;
-  meta.maintainers = teams.gitlab.members;
+  meta.teams = [ teams.gitlab ];
 }
diff --git a/nixos/modules/services/networking/epmd.nix b/nixos/modules/services/networking/epmd.nix
index c17a7c974fa7..d2aceb5a9bb1 100644
--- a/nixos/modules/services/networking/epmd.nix
+++ b/nixos/modules/services/networking/epmd.nix
@@ -63,5 +63,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.beam.members;
+  meta.teams = [ lib.teams.beam ];
 }
diff --git a/nixos/modules/services/networking/jibri/default.nix b/nixos/modules/services/networking/jibri/default.nix
index e07bf5131a92..861a6713b017 100644
--- a/nixos/modules/services/networking/jibri/default.nix
+++ b/nixos/modules/services/networking/jibri/default.nix
@@ -444,5 +444,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jicofo.nix b/nixos/modules/services/networking/jicofo.nix
index 9d0fbfd74081..9c2139eff1ab 100644
--- a/nixos/modules/services/networking/jicofo.nix
+++ b/nixos/modules/services/networking/jicofo.nix
@@ -166,5 +166,5 @@ in
       lib.mkDefault "${pkgs.jicofo}/etc/jitsi/jicofo/logging.properties-journal";
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jigasi.nix b/nixos/modules/services/networking/jigasi.nix
index 54b2f36685f6..c6bcbd28dead 100644
--- a/nixos/modules/services/networking/jigasi.nix
+++ b/nixos/modules/services/networking/jigasi.nix
@@ -243,5 +243,5 @@ in
       lib.mkDefault "${stateDir}/logging.properties-journal";
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jitsi-videobridge.nix b/nixos/modules/services/networking/jitsi-videobridge.nix
index a55760d5cae2..bd9692e6338a 100644
--- a/nixos/modules/services/networking/jitsi-videobridge.nix
+++ b/nixos/modules/services/networking/jitsi-videobridge.nix
@@ -331,5 +331,5 @@ in
     ];
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/modemmanager.nix b/nixos/modules/services/networking/modemmanager.nix
index fefee7a448eb..604340fd0748 100644
--- a/nixos/modules/services/networking/modemmanager.nix
+++ b/nixos/modules/services/networking/modemmanager.nix
@@ -9,7 +9,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = with lib; {
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 1f3773c70b00..2cb3532471c8 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -142,9 +142,8 @@ in
 {
 
   meta = {
-    maintainers = teams.freedesktop.members ++ [
-      lib.maintainers.frontear
-    ];
+    teams = [ lib.teams.freedesktop ];
+    maintainers = [ lib.maintainers.frontear ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/security/reaction.nix b/nixos/modules/services/security/reaction.nix
index 039e507ae57f..ba0cc6581dbc 100644
--- a/nixos/modules/services/security/reaction.nix
+++ b/nixos/modules/services/security/reaction.nix
@@ -299,10 +299,8 @@ in
       environment.systemPackages = [ cfg.package ];
     };
 
-  meta.maintainers =
-    with lib.maintainers;
-    [
-      ppom
-    ]
-    ++ lib.teams.ngi.members;
+  meta.teams = [ lib.teams.ngi ];
+  meta.maintainers = with lib.maintainers; [
+    ppom
+  ];
 }
diff --git a/nixos/modules/services/wayland/hypridle.nix b/nixos/modules/services/wayland/hypridle.nix
index 4ccb126b56f2..29e77c6be34f 100644
--- a/nixos/modules/services/wayland/hypridle.nix
+++ b/nixos/modules/services/wayland/hypridle.nix
@@ -28,5 +28,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index b7993cfc46dc..18da068fa5c6 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -756,5 +756,5 @@ in
   };
 
   meta.doc = ./jitsi-meet.md;
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index cff0f6ff1872..d069480f3d70 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1774,5 +1774,5 @@ in
   );
 
   meta.doc = ./nextcloud.md;
-  meta.maintainers = lib.teams.nextcloud.members;
+  meta.teams = [ lib.teams.nextcloud ];
 }
diff --git a/nixos/modules/services/web-apps/peertube-runner.nix b/nixos/modules/services/web-apps/peertube-runner.nix
index 9b126b7fa97c..4756569d9d9c 100644
--- a/nixos/modules/services/web-apps/peertube-runner.nix
+++ b/nixos/modules/services/web-apps/peertube-runner.nix
@@ -252,5 +252,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.ngi.members;
+  meta.teams = [ lib.teams.ngi ];
 }
diff --git a/nixos/modules/services/x11/desktop-managers/enlightenment.nix b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
index bc5c2b0273e7..df132f95e95c 100644
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@@ -25,7 +25,7 @@ in
 
 {
   meta = {
-    maintainers = teams.enlightenment.members;
+    teams = [ teams.enlightenment ];
   };
 
   imports = [
diff --git a/nixos/modules/services/x11/desktop-managers/lumina.nix b/nixos/modules/services/x11/desktop-managers/lumina.nix
index 74fabced3af3..a0cd79f7aae7 100644
--- a/nixos/modules/services/x11/desktop-managers/lumina.nix
+++ b/nixos/modules/services/x11/desktop-managers/lumina.nix
@@ -16,7 +16,7 @@ in
 
 {
   meta = {
-    maintainers = teams.lumina.members;
+    teams = [ teams.lumina ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/desktop-managers/lxqt.nix b/nixos/modules/services/x11/desktop-managers/lxqt.nix
index 1ccaa28f8642..8948eff23d46 100644
--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@@ -15,7 +15,7 @@ in
 
 {
   meta = {
-    maintainers = teams.lxqt.members;
+    teams = [ teams.lxqt ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/desktop-managers/xfce.nix b/nixos/modules/services/x11/desktop-managers/xfce.nix
index 941f06ae6edf..9c5b1d0d0fee 100644
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@@ -15,7 +15,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.xfce.members;
+    teams = [ teams.xfce ];
   };
 
   imports = [
diff --git a/nixos/modules/services/x11/display-managers/account-service-util.nix b/nixos/modules/services/x11/display-managers/account-service-util.nix
index 0f4d1c0729ad..697d5b9e940d 100644
--- a/nixos/modules/services/x11/display-managers/account-service-util.nix
+++ b/nixos/modules/services/x11/display-managers/account-service-util.nix
@@ -40,6 +40,6 @@ python3.pkgs.buildPythonApplication {
   '';
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 }
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
index 387f485e2fea..d8db7706d89f 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
@@ -13,7 +13,7 @@ let
 
 in
 {
-  meta.maintainers = lib.teams.lomiri.members;
+  meta.teams = [ lib.teams.lomiri ];
 
   options = {
     services.xserver.displayManager.lightdm.greeters.lomiri = {
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
index 05e03befdad6..3c61ba1556c8 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
@@ -16,7 +16,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index 1ace9c1b8c1f..467207ecd92b 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -73,7 +73,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   # Note: the order in which lightdm greeter modules are imported
diff --git a/nixos/modules/services/x11/touchegg.nix b/nixos/modules/services/x11/touchegg.nix
index def3dac738e0..cb1b9eb4adc8 100644
--- a/nixos/modules/services/x11/touchegg.nix
+++ b/nixos/modules/services/x11/touchegg.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.pantheon.members;
+    teams = [ teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index a0c7e826223d..6386a57079f2 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.podman.members;
+    teams = [ lib.teams.podman ];
   };
 
   options.virtualisation.containers = {
diff --git a/nixos/modules/virtualisation/cri-o.nix b/nixos/modules/virtualisation/cri-o.nix
index ddaccf8199a1..68cfc2ccaad9 100644
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@@ -21,7 +21,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.podman.members;
+    teams = [ teams.podman ];
   };
 
   options.virtualisation.cri-o = {
diff --git a/nixos/modules/virtualisation/incus-agent.nix b/nixos/modules/virtualisation/incus-agent.nix
index bfb9eeb75d33..34c08e8ee014 100644
--- a/nixos/modules/virtualisation/incus-agent.nix
+++ b/nixos/modules/virtualisation/incus-agent.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/incus-virtual-machine.nix b/nixos/modules/virtualisation/incus-virtual-machine.nix
index 8899fc34bb85..d714b7fdc36c 100644
--- a/nixos/modules/virtualisation/incus-virtual-machine.nix
+++ b/nixos/modules/virtualisation/incus-virtual-machine.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 7101407fb5bc..1b8908d0d3d6 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -176,7 +176,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index a6964b8b2c9a..ec206d6a5ece 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/lxc-image-metadata.nix b/nixos/modules/virtualisation/lxc-image-metadata.nix
index d27f476a59b8..1ac1bd2e4e5e 100644
--- a/nixos/modules/virtualisation/lxc-image-metadata.nix
+++ b/nixos/modules/virtualisation/lxc-image-metadata.nix
@@ -71,7 +71,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/lxc-instance-common.nix b/nixos/modules/virtualisation/lxc-instance-common.nix
index ff27b1931f8b..d3056be46fe3 100644
--- a/nixos/modules/virtualisation/lxc-instance-common.nix
+++ b/nixos/modules/virtualisation/lxc-instance-common.nix
@@ -2,7 +2,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/lxc.nix b/nixos/modules/virtualisation/lxc.nix
index 903006a6dabf..eca2eb8115ab 100644
--- a/nixos/modules/virtualisation/lxc.nix
+++ b/nixos/modules/virtualisation/lxc.nix
@@ -13,7 +13,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options.virtualisation.lxc = {
diff --git a/nixos/modules/virtualisation/lxcfs.nix b/nixos/modules/virtualisation/lxcfs.nix
index f7347af19148..711bcf655d22 100644
--- a/nixos/modules/virtualisation/lxcfs.nix
+++ b/nixos/modules/virtualisation/lxcfs.nix
@@ -12,7 +12,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   ###### interface
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 63cc4c5e3f63..c0acbe4cac3d 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -63,7 +63,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.podman.members;
+    teams = [ lib.teams.podman ];
   };
 
   options.virtualisation.podman = {
diff --git a/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix b/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
index d5b4bef5f0d9..962ca39b1598 100644
--- a/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
+++ b/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
@@ -35,5 +35,6 @@ in
 
   };
 
-  meta.maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
+  meta.teams = [ lib.teams.podman ];
+  meta.maintainers = [ lib.maintainers.roberth ];
 }
diff --git a/nixos/modules/virtualisation/podman/network-socket.nix b/nixos/modules/virtualisation/podman/network-socket.nix
index 39434216d780..d3a49d204f8a 100644
--- a/nixos/modules/virtualisation/podman/network-socket.nix
+++ b/nixos/modules/virtualisation/podman/network-socket.nix
@@ -95,5 +95,6 @@ in
     networking.firewall.allowedTCPPorts = lib.optional (cfg.enable && cfg.openFirewall) cfg.port;
   };
 
-  meta.maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
+  meta.teams = [ lib.teams.podman ];
+  meta.maintainers = [ lib.maintainers.roberth ];
 }
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index bbd6bfb57751..2cc939631f84 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -937,6 +937,6 @@ in
   };
   meta = {
     doc = ./xen.md;
-    maintainers = teams.xen.members;
+    teams = [ teams.xen ];
   };
 }

From c0d434bf4025fc81b6adb873e8e666d0a4c66d5a Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 24 Feb 2026 10:54:26 +0100
Subject: [PATCH 23/48] ci/eval/compare/maintainers.nix: Improve interface and
 document

---
 ci/eval/compare/default.nix     | 11 ++++---
 ci/eval/compare/maintainers.nix | 52 ++++++++++++++++++++-------------
 2 files changed, 36 insertions(+), 27 deletions(-)

diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index f1473367a7d9..ed1129d75f2e 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -123,9 +123,7 @@ let
   # - values: lists of `packagePlatformPath`s
   diffAttrs = builtins.fromJSON (builtins.readFile "${combined}/combined-diff.json");
 
-  changedPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.changed;
   rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.rebuilds;
-  removedPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.removed;
 
   changed-paths =
     let
@@ -162,9 +160,10 @@ let
 
   inherit
     (callPackage ./maintainers.nix {
-      changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
-      changedpathsjson = touchedFilesJson;
-      removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
+      affectedAttrPaths = map (a: a.packagePath) (
+        convertToPackagePlatformAttrs (diffAttrs.changed ++ diffAttrs.removed)
+      );
+      changedFiles = lib.importJSON touchedFilesJson;
     })
     users
     teams
@@ -181,7 +180,7 @@ runCommand "compare"
     ];
     users = builtins.toJSON users;
     teams = builtins.toJSON teams;
-    packages = builtins.toJSON packages;
+    packages = builtins.toJSON (lib.map (lib.concatStringsSep ".") packages);
     passAsFile = [
       "users"
       "teams"
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 73c36c7f9196..1d83ecfd4258 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,18 +1,29 @@
+# Figure out which maintainers (users/teams) are relevant for a PR:
+# - All maintainers that can be linked directly to changedFiles
+# - Maintainers of affectedAttrPaths if a file directly related to the attribute is in changedFiles
+#
+# Files and attributes are linked in various ways:
+# - pkgs/by-name/<attr>/* is linked to pkgs.<attr>
+# - The file position of various attributes of pkgs.<attr>
+# - Explicitly specified file positions in derivations
 {
-  lib,
-  changedattrs,
-  changedpathsjson,
-  removedattrs,
-}:
-let
-  pkgs = import ../../.. {
+  # Files that were changed
+  # Type: ListOf (Nixpkgs-root-relative path)
+  changedFiles,
+  # Attributes whose value was affected by the change
+  # Type: ListOf (ListOf String)
+  affectedAttrPaths,
+
+  pkgs ? import ../../.. {
     system = "x86_64-linux";
     # We should never try to ping maintainers through package aliases, this can only lead to errors.
     # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
     # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
     config.allowAliases = false;
-  };
-
+  },
+  lib,
+}:
+let
   nixpkgsRoot = toString ../../.. + "/";
   stripNixpkgsRootFromKeys = lib.mapAttrs' (
     file: value: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) value
@@ -24,37 +35,35 @@ let
   fileMaintainers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
   fileTeams = stripNixpkgsRootFromKeys moduleMeta.teams;
 
-  changedpaths = lib.importJSON changedpathsjson;
-
   # Extract attributes that changed from by-name paths.
   # This allows pinging reviewers for pure refactors.
-  touchedattrs = lib.pipe changedpaths [
+  touchedattrs = lib.pipe changedFiles [
     (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed && changed != "pkgs/by-name/README.md"))
     (map (lib.splitString "/"))
     (map (path: lib.elemAt path 3))
+    (map lib.singleton)
     lib.unique
   ];
 
-  anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedpaths;
+  anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedFiles;
 
   anyMatchingFiles = files: lib.any anyMatchingFile files;
 
   sharded = name: "${lib.substring 0 2 name}/${name}";
 
-  attrsWithMaintainers = lib.pipe (changedattrs ++ removedattrs ++ touchedattrs) [
+  attrsWithMaintainers = lib.pipe (affectedAttrPaths ++ touchedattrs) [
     # An attribute can appear in changed/removed *and* touched
     lib.unique
     (map (
-      name:
+      path:
       let
-        path = lib.splitString "." name;
         # Some packages might be reported as changed on a different platform, but
         # not even have an attribute on the platform the maintainers are requested on.
         # Fallback to `null` for these to filter them out below.
         package = lib.attrByPath path null pkgs;
       in
       {
-        inherit name package;
+        inherit path package;
         # Adds all files in by-name to each package, no matter whether they are discoverable
         # via meta attributes below. For example, this allows pinging maintainers for
         # updates to .json files.
@@ -114,7 +123,7 @@ let
 
   teamPings =
     context: team:
-    if team ? github then
+    if team ? githubId then
       [
         {
           type = "team";
@@ -128,13 +137,14 @@ let
   maintainersToPing =
     lib.concatMap (
       pkg:
-      userPings { attr = pkg.name; } pkg.users ++ lib.concatMap (teamPings { pkg = pkg.name; }) pkg.teams
+      userPings { attrPath = pkg.path; } pkg.users
+      ++ lib.concatMap (teamPings { attrPath = pkg.path; }) pkg.teams
     ) attrsWithModifiedFiles
     ++ lib.concatMap (
       path:
       userPings { file = path; } (fileMaintainers.${path} or [ ])
       ++ lib.concatMap (teamPings { file = path; }) (fileTeams.${path} or [ ])
-    ) changedpaths;
+    ) changedFiles;
 
   byType = lib.groupBy (ping: ping.type) maintainersToPing;
 
@@ -150,5 +160,5 @@ in
 {
   users = byUser;
   teams = byTeam;
-  packages = lib.catAttrs "name" attrsWithModifiedFiles;
+  packages = lib.catAttrs "path" attrsWithModifiedFiles;
 }

From ee016757f578ffb2cc01832f9386dfda3188e5df Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 24 Feb 2026 10:54:43 +0100
Subject: [PATCH 24/48] ci/eval/compare/maintainers.nix: Add tests

---
 ci/eval/compare/maintainers.nix |   5 +
 ci/eval/compare/test.nix        | 228 ++++++++++++++++++++++++++++++++
 2 files changed, 233 insertions(+)
 create mode 100644 ci/eval/compare/test.nix

diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 1d83ecfd4258..8c594b9532df 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -6,6 +6,11 @@
 # - pkgs/by-name/<attr>/* is linked to pkgs.<attr>
 # - The file position of various attributes of pkgs.<attr>
 # - Explicitly specified file positions in derivations
+#
+# Test with
+#   nix-instantiate --eval --strict --json test.nix -A result | jq
+#
+# Empty list as an output means success
 {
   # Files that were changed
   # Type: ListOf (Nixpkgs-root-relative path)
diff --git a/ci/eval/compare/test.nix b/ci/eval/compare/test.nix
new file mode 100644
index 000000000000..323d71d87680
--- /dev/null
+++ b/ci/eval/compare/test.nix
@@ -0,0 +1,228 @@
+{
+  pkgs ? import ../../.. {
+    config = { };
+    overlays = [ ];
+  },
+  lib ? pkgs.lib,
+}:
+let
+  fun = import ./maintainers.nix;
+
+  mockPkgs =
+    {
+      packages ? [ ],
+      modules ? [ ],
+      githubTeams ? true,
+    }:
+    lib.updateManyAttrsByPath
+      (lib.imap0 (i: p: {
+        path = p;
+        update = _: {
+          meta.maintainersPosition.file = lib.concatStringsSep "/" p;
+          meta.nonTeamMaintainers = [ { githubId = i; } ];
+          meta.teams =
+            if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ];
+        };
+      }) packages)
+      {
+        nixos =
+          { }:
+          {
+            config.meta.maintainers = lib.listToAttrs (
+              lib.imap0 (i: m: lib.nameValuePair m [ { githubId = i; } ]) modules
+            );
+            config.meta.teams = lib.listToAttrs (
+              lib.imap0 (
+                i: m:
+                lib.nameValuePair m (
+                  if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ]
+                )
+              ) modules
+            );
+          };
+      };
+
+  tests = {
+    testEmpty = {
+      expr = fun {
+        pkgs = mockPkgs { };
+        inherit lib;
+        changedFiles = [ ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testNonExistentAffected = {
+      expr = fun {
+        pkgs = mockPkgs { };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testIrrelevantAffected = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testRelevantAffected = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+        };
+        inherit lib;
+        # Also tests that subpaths work
+        changedFiles = [ "b/c" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ [ "b" ] ];
+        teams."100" = [
+          { attrPath = [ "b" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "b" ]; }
+        ];
+      };
+    };
+    testRelevantAffectedNonGitHub = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+          githubTeams = false;
+        };
+        inherit lib;
+        changedFiles = [ "b/c" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ [ "b" ] ];
+        teams = { };
+        users."0" = [
+          { attrPath = [ "b" ]; }
+        ];
+        users."100" = [
+          { attrPath = [ "b" ]; }
+        ];
+      };
+    };
+    testByNameChanged = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "pkgs/by-name/he/hello/sources.json" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ [ "hello" ] ];
+        teams."100" = [
+          { attrPath = [ "hello" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "hello" ]; }
+        ];
+      };
+    };
+    testByNameReadmeChanged = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "pkgs/by-name/README.md" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testNoDuplicates = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [
+          "hello"
+          "pkgs/by-name/he/hello/sources.json"
+        ];
+        affectedAttrPaths = [ [ "hello" ] ];
+      };
+      expected = {
+        packages = [ [ "hello" ] ];
+        teams."100" = [
+          { attrPath = [ "hello" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "hello" ]; }
+        ];
+      };
+    };
+    testModuleMaintainers = {
+      expr = fun {
+        pkgs = mockPkgs {
+          modules = [ "a" ];
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams."100" = [
+          { file = "a"; }
+        ];
+        users."0" = [
+          { file = "a"; }
+        ];
+      };
+    };
+    testModuleMaintainersNonGithub = {
+      expr = fun {
+        pkgs = mockPkgs {
+          modules = [ "a" ];
+          githubTeams = false;
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users."100" = [
+          { file = "a"; }
+        ];
+        users."0" = [
+          { file = "a"; }
+        ];
+      };
+    };
+  };
+in
+{
+  result = lib.runTests tests;
+}

From 7fe44998ab73c1620e0410c22bd831ee13fcef80 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 24 Feb 2026 11:03:55 +0100
Subject: [PATCH 25/48] ci/eval/compare/maintainers.nix: Refactor

Was more complicated than needed.
Tests still succeed
---
 ci/eval/compare/maintainers.nix | 107 ++++++++++++++------------------
 1 file changed, 45 insertions(+), 62 deletions(-)

diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 8c594b9532df..903e42f733f6 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -25,6 +25,7 @@
     # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
     # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
     config.allowAliases = false;
+    overlays = [ ];
   },
   lib,
 }:
@@ -37,59 +38,17 @@ let
   moduleMeta = (pkgs.nixos { }).config.meta;
 
   # Currently just nixos module maintainers, but in the future we can use this for code owners too
-  fileMaintainers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
+  fileUsers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
   fileTeams = stripNixpkgsRootFromKeys moduleMeta.teams;
 
-  # Extract attributes that changed from by-name paths.
-  # This allows pinging reviewers for pure refactors.
-  touchedattrs = lib.pipe changedFiles [
-    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed && changed != "pkgs/by-name/README.md"))
-    (map (lib.splitString "/"))
-    (map (path: lib.elemAt path 3))
-    (map lib.singleton)
-    lib.unique
-  ];
-
   anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedFiles;
 
   anyMatchingFiles = files: lib.any anyMatchingFile files;
 
-  sharded = name: "${lib.substring 0 2 name}/${name}";
-
-  attrsWithMaintainers = lib.pipe (affectedAttrPaths ++ touchedattrs) [
-    # An attribute can appear in changed/removed *and* touched
-    lib.unique
-    (map (
-      path:
-      let
-        # Some packages might be reported as changed on a different platform, but
-        # not even have an attribute on the platform the maintainers are requested on.
-        # Fallback to `null` for these to filter them out below.
-        package = lib.attrByPath path null pkgs;
-      in
-      {
-        inherit path package;
-        # Adds all files in by-name to each package, no matter whether they are discoverable
-        # via meta attributes below. For example, this allows pinging maintainers for
-        # updates to .json files.
-        # TODO: Support by-name package sets.
-        filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # meta.maintainers also contains all individual team members.
-        # We only want to ping individuals if they're added individually as maintainers, not via teams.
-        users = package.meta.nonTeamMaintainers or [ ];
-        teams = package.meta.teams or [ ];
-      }
-    ))
-    # No need to match up packages without maintainers with their files.
-    # This also filters out attributes where `package = null`, which is the
-    # case for libintl, for example.
-    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
-  ];
-
   relevantFilenames =
     drv:
     (lib.unique (
-      map (pos: lib.removePrefix "${toString ../../..}/" pos.file) (
+      map (pos: lib.removePrefix nixpkgsRoot pos.file) (
         lib.filter (x: x != null) [
           (drv.meta.maintainersPosition or null)
           (drv.meta.teamsPosition or null)
@@ -112,11 +71,47 @@ let
       )
     ));
 
-  attrsWithFilenames = map (
-    pkg: pkg // { filenames = pkg.filenames ++ relevantFilenames pkg.package; }
-  ) attrsWithMaintainers;
+  relevantAffectedAttrPaths = lib.filter (
+    attrPath:
+    # Some packages might be reported as changed on a different platform, but
+    # not even have an attribute on the platform the maintainers are requested on.
+    # Fallback to `null` for these to filter them out
+    let
+      package = lib.attrByPath attrPath null pkgs;
+    in
+    package != null && anyMatchingFiles (relevantFilenames package)
+  ) affectedAttrPaths;
 
-  attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
+  # Extract attributes that changed from by-name paths.
+  # This allows pinging reviewers for pure refactors.
+  changedByNameAttrPaths = lib.pipe changedFiles [
+    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed))
+    (map (lib.splitString "/"))
+    # Filters out e.g. pkgs/by-name/README.md
+    (lib.filter (path: lib.length path > 3))
+    (map (path: lib.elemAt path 3))
+    (map lib.singleton)
+  ];
+
+  # An attribute can appear in affected *and* touched
+  attrPathsToGetMaintainersFor = lib.unique (relevantAffectedAttrPaths ++ changedByNameAttrPaths);
+
+  attrPathEntities = lib.concatMap (
+    attrPath:
+    let
+      package = lib.getAttrFromPath attrPath pkgs;
+    in
+    # meta.maintainers also contains all individual team members.
+    # We only want to ping individuals if they're added individually as maintainers, not via teams.
+    userPings { inherit attrPath; } (package.meta.nonTeamMaintainers or [ ])
+    ++ lib.concatMap (teamPings { inherit attrPath; }) (package.meta.teams or [ ])
+  ) attrPathsToGetMaintainersFor;
+
+  changedFileEntities = lib.concatMap (
+    file:
+    userPings { inherit file; } (fileUsers.${file} or [ ])
+    ++ lib.concatMap (teamPings { inherit file; }) (fileTeams.${file} or [ ])
+  ) changedFiles;
 
   userPings =
     context:
@@ -139,19 +134,7 @@ let
     else
       userPings context team.members;
 
-  maintainersToPing =
-    lib.concatMap (
-      pkg:
-      userPings { attrPath = pkg.path; } pkg.users
-      ++ lib.concatMap (teamPings { attrPath = pkg.path; }) pkg.teams
-    ) attrsWithModifiedFiles
-    ++ lib.concatMap (
-      path:
-      userPings { file = path; } (fileMaintainers.${path} or [ ])
-      ++ lib.concatMap (teamPings { file = path; }) (fileTeams.${path} or [ ])
-    ) changedFiles;
-
-  byType = lib.groupBy (ping: ping.type) maintainersToPing;
+  byType = lib.groupBy (ping: ping.type) (attrPathEntities ++ changedFileEntities);
 
   byUser = lib.pipe (byType.user or [ ]) [
     (lib.groupBy (ping: toString ping.userId))
@@ -165,5 +148,5 @@ in
 {
   users = byUser;
   teams = byTeam;
-  packages = lib.catAttrs "path" attrsWithModifiedFiles;
+  packages = attrPathsToGetMaintainersFor;
 }

From edb8f57fe4d5922d840fe07bb9fe799bb9ef5473 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 3 Mar 2026 05:01:37 +0000
Subject: [PATCH 26/48] sketchybar-app-font: 2.0.53 -> 2.0.55

---
 pkgs/by-name/sk/sketchybar-app-font/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 71a55def26b7..428e4c9a04d2 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "2.0.53";
+  version = "2.0.55";
 
   src = fetchFromGitHub {
     owner = "kvndrsslr";
     repo = "sketchybar-app-font";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ZiFJDNb/VyQhxCbvp1H/BZG0Kc0zffYc3xtUJ6W/IU=";
+    hash = "sha256-Gr0+wPvVeRF4GztRPIsdOhknoq5xjaj8lcLnClIzZ/U=";
   };
 
   pnpmDeps = fetchPnpmDeps {

From 20ad6d5364eb9e5ee7a3d3cf023c31350482ed4a Mon Sep 17 00:00:00 2001
From: Dom Rodriguez <shymega@shymega.org.uk>
Date: Sun, 23 Nov 2025 19:19:30 +0000
Subject: [PATCH 27/48] davmail: Various tweaks to Davmail package

- Remove verbosity flag for `cp` invocations.
- We only need ant to run the task `prepare-dist`, as per upstream's RPM
  spec.
- Revert change to copy files from `./dist` and reference directly.
---
 pkgs/by-name/da/davmail/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/da/davmail/package.nix b/pkgs/by-name/da/davmail/package.nix
index c4deac4af9bb..4f84ba6f1ab6 100644
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -35,9 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    ant compile prepare-dist
-    cp -Rv dist/{lib,davmail{,.jar}} .
-    sed -i -e '/^JAVA_OPTS/d' davmail
+    ant prepare-dist
+    sed -i -e '/^JAVA_OPTS/d' ./dist/davmail
 
     runHook postBuild
   '';
@@ -55,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/share/davmail
-    cp -vR ./{lib,davmail{,.jar}} $out/share/davmail
+    cp -R ./dist/{lib,davmail{,.jar}} $out/share/davmail
     chmod +x $out/share/davmail/davmail
     makeWrapper $out/share/davmail/davmail $out/bin/davmail \
       --set-default JAVA_OPTS "-Xmx512M -Dsun.net.inetaddr.ttl=60 -Djdk.gtk.version=${lib.versions.major gtk'.version}" \

From 1ccac2805fa1a786a8ccf5c0628304a2dde6d31d Mon Sep 17 00:00:00 2001
From: Dom Rodriguez <shymega@shymega.org.uk>
Date: Sun, 23 Nov 2025 12:46:03 +0000
Subject: [PATCH 28/48] hyprproxlock: init at 0.1.1

Add `hyprproxlock` to Nixpkgs for Hyprland Bluetooth-based proxmity
automatic locking.
---
 pkgs/by-name/hy/hyprproxlock/package.nix | 48 ++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 pkgs/by-name/hy/hyprproxlock/package.nix

diff --git a/pkgs/by-name/hy/hyprproxlock/package.nix b/pkgs/by-name/hy/hyprproxlock/package.nix
new file mode 100644
index 000000000000..6fb6c49d8d9c
--- /dev/null
+++ b/pkgs/by-name/hy/hyprproxlock/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
+  dbus,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hyprproxlock";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Da4ndo";
+    repo = "hyprproxlock";
+    tag = finalAttrs.version;
+    hash = "sha256-EoMxYMQBRP1fDfUorrkrgKDrVI88Ctusp2+1a7tnSU0=";
+  };
+
+  cargoHash = "sha256-rBZ3acHStmUzEU+lsFhNYvLVPeeZe6P+4OHyxHRe4CU=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/Da4ndo/hyprproxlock";
+    description = "Proximity-based daemon for Hyprland that triggers screen locking and unlocking through hyprlock based on Bluetooth device proximity";
+    longDescription = ''
+      A proximity-based daemon for Hyprland that triggers screen locking and unlocking through hyprlock based on Bluetooth device proximity.
+      It monitors connected devices' signal strength to automatically control your screen lock state.
+    '';
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ shymega ];
+    mainProgram = "hyprproxlock";
+  };
+})

From 1d7e7748a6c6c58ef3b9554fa2d71c836c14ecf8 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Tue, 3 Mar 2026 20:14:25 +0100
Subject: [PATCH 29/48] yazi: get correct position by inheriting meta attrs

Inheriting `yazi-unwrapped`'s meta means we also inherit its position,
which is not correct and could lead to confusions (e.g. in the NixOS
search).

Instead, we should inherit the individual attributes, thus giving us the
corrrect position.

```
# before
nix-repl> yazi.meta.position
"/path/to/nixpkgs/pkgs/by-name/ya/yazi-unwrapped/package.nix:63"
```

```
# after
nix-repl> yazi.meta.position
"/path/to/nixpkgs/pkgs/by-name/ya/yazi/package.nix:100"
```
---
 pkgs/by-name/ya/yazi/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ya/yazi/package.nix b/pkgs/by-name/ya/yazi/package.nix
index 2b08089ee729..917605f0bfc6 100644
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@@ -93,7 +93,17 @@ let
 in
 runCommand yazi-unwrapped.name
   {
-    inherit (yazi-unwrapped) pname version meta;
+    inherit (yazi-unwrapped) pname version;
+
+    meta = {
+      inherit (yazi-unwrapped.meta)
+        description
+        homepage
+        license
+        maintainers
+        mainProgram
+        ;
+    };
 
     nativeBuildInputs = [ makeWrapper ];
   }

From 9585e8547435be8d062e7aa7755a009fa244773b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 3 Mar 2026 21:28:40 +0000
Subject: [PATCH 30/48] unityhub: 3.16.2 -> 3.16.3

---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index e1e425c5f734..b63409e0f537 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.16.2";
+  version = "3.16.3";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA=";
+    hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU=";
   };
 
   nativeBuildInputs = [

From 643ec44ee8d16da813937b61b43f30de26a5a149 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 4 Mar 2026 09:20:50 +0100
Subject: [PATCH 31/48] nerva: init at 1.0.0

Fingerprinting CLI tool for various protocols

https://github.com/praetorian-inc/nerva
---
 pkgs/by-name/ne/nerva/package.nix | 39 +++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/ne/nerva/package.nix

diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
new file mode 100644
index 000000000000..55173202f9cb
--- /dev/null
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "nerva";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "praetorian-inc";
+    repo = "nerva";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EZQQLXN9eixL3BUSn6VAaKPe9uA3uW1l6zfzq3bG+vk=";
+  };
+
+  vendorHash = "sha256-h3pxl84P7dUmXJJ9t/Rnzx0oJcGnA+7ytGWhk401ecY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  # Tests require a docker setup
+  doCheck = false;
+
+  meta = {
+    description = "Fingerprinting CLI tool for various protocols";
+    homepage = "https://github.com/praetorian-inc/nerva";
+    changelog = "https://github.com/praetorian-inc/nerva/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "nerva";
+  };
+})

From a7aee8fae17a4ffb8a83d346b0b9c7c1ef629248 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 4 Mar 2026 08:30:14 +0000
Subject: [PATCH 32/48] ruffle: 0.2.0-nightly-2026-02-23 ->
 0.2.0-nightly-2026-03-04

---
 pkgs/by-name/ru/ruffle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index d49a2e6ead28..f0977cebb46b 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0.2.0-nightly-2026-02-23";
+  version = "0.2.0-nightly-2026-03-04";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-q7d4Nb967W0O42lr5T6AltlKumgmBZ8cHN0lIO5i6Xk=";
+    hash = "sha256-IEldR8Pze17scKkKAfLrAPyZW7aak/6EKHSaO2t5MxY=";
   };
 
   postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                        "OpenH264Version(${major}, ${minor}, ${patch})"
     '';
 
-  cargoHash = "sha256-ZZ5Utf2awzOLZP27fzGqKVChMwy1UesEkF5WAnXi1WE=";
+  cargoHash = "sha256-w2uzH9b/zuWPeRBpo/KgAXYUOC2OnFRSHGewsbfVVww=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =

From c4212e705ff2599f316ac9c6aaf1a222e883aeed Mon Sep 17 00:00:00 2001
From: Uriel <imurx@proton.me>
Date: Mon, 24 Nov 2025 17:12:09 -0300
Subject: [PATCH 33/48] pupdate: 3.20.0 -> 4.7.0

---
 pkgs/by-name/pu/pupdate/deps.json   | 915 +---------------------------
 pkgs/by-name/pu/pupdate/package.nix |  10 +-
 2 files changed, 20 insertions(+), 905 deletions(-)

diff --git a/pkgs/by-name/pu/pupdate/deps.json b/pkgs/by-name/pu/pupdate/deps.json
index ddcb1a19d8bd..2fc7ef863962 100644
--- a/pkgs/by-name/pu/pupdate/deps.json
+++ b/pkgs/by-name/pu/pupdate/deps.json
@@ -1,4 +1,9 @@
 [
+  {
+    "pname": "Aspose.Zip",
+    "version": "24.11.0",
+    "hash": "sha256-wPxD7K7bc0K1BqJweWgEaXJOX4F/hgRjrFSXLs+UnMs="
+  },
   {
     "pname": "CommandLineParser",
     "version": "2.9.1",
@@ -14,165 +19,15 @@
     "version": "1.2.0",
     "hash": "sha256-sMQNIppJXHU2mULn5b//uRbbPMyguH9QlG6HKVIYUmE="
   },
-  {
-    "pname": "Libuv",
-    "version": "1.9.1",
-    "hash": "sha256-bQdVn50eId1GzSQa9CFth0meKAQMYCFQ98zLN9pqL0k="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Ref",
-    "version": "7.0.20",
-    "hash": "sha256-OEDXXjQ1HDRPiA4Y1zPr1xUeH6wlzTCJpts+DZL61wI="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Runtime.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-ewal9R6o20GV0R02ylSijVFdWZAbdN8TK1PCc/ltHBQ="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Runtime.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-vq59xMfrET8InzUhkAsbs2xp3ML+SO9POsbwAiYKzkA="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.Analyzers",
-    "version": "1.1.0",
-    "hash": "sha256-7KrZfK3kUbmeT82eVadvHurZcaFq3FDj4qkIIeExJiM="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.Common",
-    "version": "1.3.0",
-    "hash": "sha256-Jcw54WWyfPKdkeqRAG4xjihiGP/djjAkvpR6KM2I+CQ="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.CSharp",
-    "version": "1.3.0",
-    "hash": "sha256-OqqvMHNj9Xql4YTEPMlzoGXXELoLC7JkRGjS0pil+m4="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.VisualBasic",
-    "version": "1.3.0",
-    "hash": "sha256-lIKN1dG59aY8zeYgkY8Kdnv4UBgSwVbghz5ngPyEzKA="
-  },
-  {
-    "pname": "Microsoft.CSharp",
-    "version": "4.0.1",
-    "hash": "sha256-0huoqR2CJ3Z9Q2peaKD09TV3E6saYSqDGZ290K8CrH8="
-  },
-  {
-    "pname": "Microsoft.NET.ILLink.Analyzers",
-    "version": "7.0.100-1.23401.1",
-    "hash": "sha256-jGyhmj7DZxTv9Hir6YonkpL+SDsRore8Ph4RNN+2q94="
-  },
-  {
-    "pname": "Microsoft.NET.ILLink.Tasks",
-    "version": "7.0.100-1.23401.1",
-    "hash": "sha256-n95rHugj0BOtCBvv5209zJ5ttPX0A2+RWLjEwwtxgRA="
-  },
-  {
-    "pname": "Microsoft.NETCore.App",
-    "version": "1.0.4",
-    "hash": "sha256-NqJEOTW98eO0UlbiZcIVrsZCY4MUa+CkSmtAx3e2g3k="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Host.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-/20dMbO1Ft0WVhl+Lv1916Thvr4kPP9LuuX4bKE+czE="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Host.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-Y1Dg8Sqhya86xD+9aJOuznT4mJUyFmoF/YZc0+5LBdc="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Ref",
-    "version": "7.0.20",
-    "hash": "sha256-W9RU3bja4BQLAbsaIhANQPJJh6DycDiBR+WZ3mK6Zrs="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Runtime.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-TemMvbNrDzJVHWwxVgnNN2CnTyI6TcvvZDpF4ts6IAw="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Runtime.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-L+WaGvoXVMT3tZ7R5xFE06zaLcC3SI7LEf4ATBkUAGQ="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHost",
-    "version": "1.0.1",
-    "hash": "sha256-yiyZ4KGVRDZRgAuoSl4ZNWnRR3ityniyRPvzS799JOM="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHostPolicy",
-    "version": "1.0.3",
-    "hash": "sha256-doP+2c5SFVldt/EzgWW3nqKK+NNZKvBnanJbn2SKr2Q="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHostResolver",
-    "version": "1.0.1",
-    "hash": "sha256-hGJLA8Q6R+up9zHzk+Up2KF1a+fXZeEWrAZ+iNfQP4E="
-  },
-  {
-    "pname": "Microsoft.NETCore.Jit",
-    "version": "1.0.6",
-    "hash": "sha256-MuphzrzUdSpgyB3ZU2Ly3DwaGSRuLUvonovIzBasB6o="
-  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "1.0.2",
-    "hash": "sha256-YLJ2+BONtCWb0lY4Rttdqzbcm4z+5N5uNr3byRWQOZ8="
-  },
   {
     "pname": "Microsoft.NETCore.Platforms",
     "version": "1.1.0",
     "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
   },
   {
-    "pname": "Microsoft.NETCore.Runtime.CoreCLR",
-    "version": "1.0.6",
-    "hash": "sha256-iZnxpUpUJDoEE/NjktTFfOYmi25RwC32NMu/OKXG3gA="
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.0.1",
-    "hash": "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.1.0",
-    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
-  },
-  {
-    "pname": "Microsoft.NETCore.Windows.ApiSets",
-    "version": "1.0.1",
-    "hash": "sha256-6PR4o/wQxBaJ5eRdt/awSO80EP3QqpWIk0XkCR9kaJo="
-  },
-  {
-    "pname": "Microsoft.VisualBasic",
-    "version": "10.0.1",
-    "hash": "sha256-7HHzZcWLVTTQ1K1rCIyoB+UxLHMvOIz+O5av6XDa22A="
-  },
-  {
-    "pname": "Microsoft.Win32.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-B4t5El/ViBdxALMcpZulewc4j/3SIXf71HhJWhm4Ctk="
-  },
-  {
-    "pname": "Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="
-  },
-  {
-    "pname": "Microsoft.Win32.Registry",
-    "version": "4.0.0",
-    "hash": "sha256-M/06F/Z2wTHCh4pZOgtCjUGLD1FJXEJKCmzOeFMl7uo="
-  },
-  {
-    "pname": "NETStandard.Library",
-    "version": "1.6.0",
-    "hash": "sha256-ExWI1EKDCRishcfAeHVS/RoJphqSqohmJIC/wz3ZtVo="
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "2.0.0",
+    "hash": "sha256-IEvBk6wUXSdyCnkj6tHahOJv290tVVT8tyemYcR0Yro="
   },
   {
     "pname": "NETStandard.Library",
@@ -184,759 +39,19 @@
     "version": "13.0.3",
     "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
   },
-  {
-    "pname": "runtime.any.System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tools",
-    "version": "4.3.0",
-    "hash": "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="
-  },
-  {
-    "pname": "runtime.any.System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
-  },
-  {
-    "pname": "runtime.any.System.Globalization.Calendars",
-    "version": "4.3.0",
-    "hash": "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="
-  },
-  {
-    "pname": "runtime.any.System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
-  },
-  {
-    "pname": "runtime.any.System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
-  },
-  {
-    "pname": "runtime.any.System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Timer",
-    "version": "4.3.0",
-    "hash": "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="
-  },
-  {
-    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
-  },
-  {
-    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
-  },
-  {
-    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.0.0",
-    "hash": "sha256-bmaM0ovT4X4aqDJOR255Yda/u3fmHZskU++lMnsy894="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.3.0",
-    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
-  },
-  {
-    "pname": "runtime.native.System.IO.Compression",
-    "version": "4.1.0",
-    "hash": "sha256-085JrZxNEwIHdBWKKKFsh1JzpF0AblvrUsz5T8kH4jQ="
-  },
-  {
-    "pname": "runtime.native.System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="
-  },
-  {
-    "pname": "runtime.native.System.Net.Http",
-    "version": "4.0.1",
-    "hash": "sha256-5nWnTQrA1T6t9r8MqIiV4yTNu+IH0of2OX1qteoS+8E="
-  },
-  {
-    "pname": "runtime.native.System.Net.Security",
-    "version": "4.0.1",
-    "hash": "sha256-E64W+qCHZGYbhzQOEeToCob/4K8cTg3uOO7ltZG7ZNo="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography",
-    "version": "4.0.0",
-    "hash": "sha256-6Q8eYzC32BbGIiTHoQaE6B3cD81vYQcH5SCswYRSp0w="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
-  },
-  {
-    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
-  },
-  {
-    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
-  },
-  {
-    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
-  },
-  {
-    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
-  },
-  {
-    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
-  },
-  {
-    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
-  },
-  {
-    "pname": "runtime.unix.Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="
-  },
-  {
-    "pname": "runtime.unix.System.Console",
-    "version": "4.3.0",
-    "hash": "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="
-  },
-  {
-    "pname": "runtime.unix.System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
-  },
-  {
-    "pname": "runtime.unix.System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Sockets",
-    "version": "4.3.0",
-    "hash": "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="
-  },
-  {
-    "pname": "runtime.unix.System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
-  },
-  {
-    "pname": "runtime.unix.System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
-  },
-  {
-    "pname": "System.AppContext",
-    "version": "4.1.0",
-    "hash": "sha256-v6YfyfrKmhww+EYHUq6cwYUMj00MQ6SOfJtcGVRlYzs="
-  },
   {
     "pname": "System.Buffers",
-    "version": "4.0.0",
-    "hash": "sha256-+YUymoyS0O+xVyF2+LiAdZlMww8nofPN4ja9ylYqRo8="
+    "version": "4.5.1",
+    "hash": "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="
   },
   {
-    "pname": "System.Buffers",
-    "version": "4.3.0",
-    "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
-  },
-  {
-    "pname": "System.Collections",
-    "version": "4.0.11",
-    "hash": "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="
-  },
-  {
-    "pname": "System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
-  },
-  {
-    "pname": "System.Collections.Concurrent",
-    "version": "4.0.12",
-    "hash": "sha256-zIEM7AB4SyE9u6G8+o+gCLLwkgi6+3rHQVPdn/dEwB8="
-  },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "1.2.0",
-    "hash": "sha256-FQ3l+ulbLSPhQ0JcQCC4D4SzjTnHsRqcOj56Ywy7pMo="
-  },
-  {
-    "pname": "System.ComponentModel",
-    "version": "4.0.1",
-    "hash": "sha256-X5T36S49q1odsn6wAET6EGNlsxOyd66naMr5T3G9mGw="
-  },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "4.1.0",
-    "hash": "sha256-jhvr6zS+iC4OXBkdXr+S8rPy/5nfhZtDVVJiAc0f1VA="
-  },
-  {
-    "pname": "System.Console",
-    "version": "4.0.0",
-    "hash": "sha256-jtZfT/TpJtLisV/y5Mk3IfCpE79zwhBYXtyGP9jC3Xo="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.0.11",
-    "hash": "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
-  },
-  {
-    "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "4.0.0",
-    "hash": "sha256-dYh9UoFesuGcHY+ewsI+z2WnNy+bwHPsHQ3t85cbzNg="
-  },
-  {
-    "pname": "System.Diagnostics.FileVersionInfo",
-    "version": "4.0.0",
-    "hash": "sha256-Yy94jPhDXF2QHOF7qTmqKkn1048K9xkKryuBeDzsu+g="
-  },
-  {
-    "pname": "System.Diagnostics.Process",
-    "version": "4.1.0",
-    "hash": "sha256-OgW6ogQ+oYADYS0PHmwXdhrOKQJpqXlwzSvmfjTLNBg="
-  },
-  {
-    "pname": "System.Diagnostics.StackTrace",
-    "version": "4.0.1",
-    "hash": "sha256-gqqCAwpDsca242nli+fejgqwPAuwROv3NoNeOnFXSWA="
-  },
-  {
-    "pname": "System.Diagnostics.Tools",
-    "version": "4.0.1",
-    "hash": "sha256-vSBqTbmWXylvRa37aWyktym+gOpsvH43mwr6A962k6U="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.1.0",
-    "hash": "sha256-JA0jJcLbU3zh52ub3zweob2EVHvxOqiC6SCYHrY5WbQ="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="
-  },
-  {
-    "pname": "System.Dynamic.Runtime",
-    "version": "4.0.11",
-    "hash": "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.0.11",
-    "hash": "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
-  },
-  {
-    "pname": "System.Globalization.Calendars",
-    "version": "4.0.1",
-    "hash": "sha256-EJN3LbN+b0O9Dr2eg7kfThCYpne0iJ/H/GIyUTNVYC8="
-  },
-  {
-    "pname": "System.Globalization.Extensions",
-    "version": "4.0.1",
-    "hash": "sha256-zLtkPryJwqTGcJqMC6zoMMvMrT+aAL5GoumjmMtqUEI="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.1.0",
-    "hash": "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
-  },
-  {
-    "pname": "System.IO.Compression",
-    "version": "4.1.0",
-    "hash": "sha256-UT4KEfJNZOk7b4X0AqLFUsqfHu6myVH/BhbRKYc+1Uc="
-  },
-  {
-    "pname": "System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="
-  },
-  {
-    "pname": "System.IO.Compression.ZipFile",
-    "version": "4.3.0",
-    "hash": "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="
-  },
-  {
-    "pname": "System.IO.FileSystem",
-    "version": "4.0.1",
-    "hash": "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="
-  },
-  {
-    "pname": "System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="
-  },
-  {
-    "pname": "System.IO.FileSystem.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-IpigKMomqb6pmYWkrlf0ZdpILtRluX2cX5sOKVW0Feg="
-  },
-  {
-    "pname": "System.IO.FileSystem.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
-  },
-  {
-    "pname": "System.IO.FileSystem.Watcher",
-    "version": "4.0.0",
-    "hash": "sha256-OcLhbiHvn453sJsZBHe6RmtDlCaaarcqRB439HGU7mU="
-  },
-  {
-    "pname": "System.IO.MemoryMappedFiles",
-    "version": "4.0.0",
-    "hash": "sha256-1VQa8FoMUNAsja31OvOn7ungif+IPusAe9YcR+kRF6o="
-  },
-  {
-    "pname": "System.IO.UnmanagedMemoryStream",
-    "version": "4.0.1",
-    "hash": "sha256-Sx60QjHjvXQMAL7O4aN81321gu13LE0XzCRtt7hFTwQ="
-  },
-  {
-    "pname": "System.Linq",
-    "version": "4.1.0",
-    "hash": "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="
-  },
-  {
-    "pname": "System.Linq.Expressions",
-    "version": "4.1.1",
-    "hash": "sha256-nwRmq03bvyYhohaDJtCYj4Z6hHsp0AlhjFJzuw7fsdk="
-  },
-  {
-    "pname": "System.Linq.Parallel",
-    "version": "4.0.1",
-    "hash": "sha256-TV1F3KYFipPmPnWFjX6hOZQNFsG2m729EdgPSFzqY0Q="
-  },
-  {
-    "pname": "System.Linq.Queryable",
-    "version": "4.0.1",
-    "hash": "sha256-XOFRO+lyoxsWtIUJfg5JCqv9Gx35ASOc94WIR8ZMVoY="
-  },
-  {
-    "pname": "System.Net.Http",
-    "version": "4.1.1",
-    "hash": "sha256-+JTAbEt2BicpnP3ooKXludoS5nClzBOnUyI9C/XxyyM="
-  },
-  {
-    "pname": "System.Net.NameResolution",
-    "version": "4.0.0",
-    "hash": "sha256-EAO67qEDqrtxEa+J3xccA5/lgCJ0PiRU9DYZsO++QzY="
-  },
-  {
-    "pname": "System.Net.Primitives",
-    "version": "4.0.11",
-    "hash": "sha256-2YSijNhCdw/ZU2yfH7vE+ReA8pgxRCXPnWr+ab36v4M="
-  },
-  {
-    "pname": "System.Net.Requests",
-    "version": "4.0.11",
-    "hash": "sha256-MLXxaUhHQC3pId/6r4q0EF37CIExt0+4Na8ZpUtRs44="
-  },
-  {
-    "pname": "System.Net.Security",
-    "version": "4.0.0",
-    "hash": "sha256-65Vqr/B5B336KEW69aM95+f7s5u2Q7/OiJmBarV2fnk="
-  },
-  {
-    "pname": "System.Net.Sockets",
-    "version": "4.1.0",
-    "hash": "sha256-muK7oXIX7ykqhXskuUt0KX6Hzg5VogJhUS0JiOB2BY0="
-  },
-  {
-    "pname": "System.Net.WebHeaderCollection",
-    "version": "4.0.1",
-    "hash": "sha256-uJSV6kmL+V/9/ot1LhHXGCd8Ndcu6zk+AJ8wgGS/fYE="
-  },
-  {
-    "pname": "System.Numerics.Vectors",
-    "version": "4.1.1",
-    "hash": "sha256-Kv4FrStml5+X7hGDCLhJJaIwJDvdJdYMBfcCcOjNf/Y="
-  },
-  {
-    "pname": "System.ObjectModel",
-    "version": "4.0.12",
-    "hash": "sha256-MudZ/KYcvYsn2cST3EE049mLikrNkmE7QoUoYKKby+s="
-  },
-  {
-    "pname": "System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.1.0",
-    "hash": "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
-  },
-  {
-    "pname": "System.Reflection.DispatchProxy",
-    "version": "4.0.1",
-    "hash": "sha256-GdjA81UywW1yeAyNi+MR5agmOXl859GrWwiOui2jT9U="
-  },
-  {
-    "pname": "System.Reflection.Emit",
-    "version": "4.0.1",
-    "hash": "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="
-  },
-  {
-    "pname": "System.Reflection.Emit.ILGeneration",
-    "version": "4.0.1",
-    "hash": "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="
-  },
-  {
-    "pname": "System.Reflection.Emit.Lightweight",
-    "version": "4.0.1",
-    "hash": "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="
-  },
-  {
-    "pname": "System.Reflection.Extensions",
-    "version": "4.0.1",
-    "hash": "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="
-  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "1.3.0",
-    "hash": "sha256-a/RQr++mSsziWaOTknicfIQX/zJrwPFExfhK6PM0tfg="
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
-  },
-  {
-    "pname": "System.Reflection.TypeExtensions",
-    "version": "4.1.0",
-    "hash": "sha256-R0YZowmFda+xzKNR4kKg7neFoE30KfZwp/IwfRSKVK4="
-  },
-  {
-    "pname": "System.Resources.Reader",
-    "version": "4.0.0",
-    "hash": "sha256-NOax26EYc/L4bfedL2a33fg4sFXVkBwzVTQ41saJTsk="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.0.1",
-    "hash": "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.1.0",
-    "hash": "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
-  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.1.0",
-    "hash": "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="
-  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.0.1",
-    "hash": "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.1.0",
-    "hash": "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
-  },
-  {
-    "pname": "System.Runtime.InteropServices.RuntimeInformation",
-    "version": "4.0.0",
-    "hash": "sha256-5j53amb76A3SPiE3B0llT2XPx058+CgE7OXL4bLalT4="
-  },
-  {
-    "pname": "System.Runtime.Loader",
-    "version": "4.0.0",
-    "hash": "sha256-gE5/ehU3Qq5phhSxGuPmSv1DFVQeiyl1/+YyrO+I7lI="
-  },
-  {
-    "pname": "System.Runtime.Numerics",
-    "version": "4.0.1",
-    "hash": "sha256-1pJt5ZGxLPTX1mjOi8qZPXyyOMkYV0NstoUCv91HYPg="
-  },
-  {
-    "pname": "System.Security.Claims",
-    "version": "4.0.1",
-    "hash": "sha256-xqI0HHahNAd9g3jqgnLKH4P/pIueef6cy3qvRDQFvA0="
-  },
-  {
-    "pname": "System.Security.Cryptography.Algorithms",
-    "version": "4.2.0",
-    "hash": "sha256-BelNIpEyToEp/VYKnje/q1P7KNEpQNtOzGPU18pLGpE="
-  },
-  {
-    "pname": "System.Security.Cryptography.Cng",
-    "version": "4.2.0",
-    "hash": "sha256-7F+m3HnmBsgE4xWF8FeCGlaEgQM3drqA6HEaQr6MEoU="
-  },
-  {
-    "pname": "System.Security.Cryptography.Csp",
-    "version": "4.0.0",
-    "hash": "sha256-WHyR6vVK3zaT4De7jgQFUar1P5fiX9ECwiVkJDFFm7M="
-  },
-  {
-    "pname": "System.Security.Cryptography.Encoding",
-    "version": "4.0.0",
-    "hash": "sha256-ZO7ha39J5uHkIF2RoEKv/bW/bLbVvYMO4+rWyYsKHik="
-  },
-  {
-    "pname": "System.Security.Cryptography.OpenSsl",
-    "version": "4.0.0",
-    "hash": "sha256-mLijAozynzjiOMyh2P5BHcfVq3Ovd0T/phG08SIbXZs="
-  },
-  {
-    "pname": "System.Security.Cryptography.Primitives",
-    "version": "4.0.0",
-    "hash": "sha256-sEdPftfTxQd/8DpdpqUZC2XWC0SjVCPqAkEleLl17EQ="
-  },
-  {
-    "pname": "System.Security.Cryptography.X509Certificates",
-    "version": "4.1.0",
-    "hash": "sha256-sBUUhJP+yYDXvcjNMKqNpn8yzGUpVABwK9vVUvYKjzI="
-  },
-  {
-    "pname": "System.Security.Principal",
-    "version": "4.0.1",
-    "hash": "sha256-9wBgPnJfFOtrhKZ7wDXZ4q12GklQ49Ka02/9v7Frf9k="
-  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "4.0.0",
-    "hash": "sha256-38wEUCB889Mpm4WgRFEQBB+4HtE0X0wu+knrDyJie7Q="
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.0.11",
-    "hash": "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "4.5.0",
+    "hash": "sha256-g9jIdQtXSAhY+ezQtYNgHEUoQR3HzznHs3JMzD9bip4="
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "4.0.1",
-    "hash": "sha256-wxtwWQSTv5tuFP79KhUAhaL6bL4d8lSzSWkCn9aolwM="
-  },
-  {
-    "pname": "System.Text.Encoding.Extensions",
-    "version": "4.0.11",
-    "hash": "sha256-+kf7J3dEhgCbnCM5vHYlsTm5/R/Ud0Jr6elpHm922iI="
-  },
-  {
-    "pname": "System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
-  },
-  {
-    "pname": "System.Text.RegularExpressions",
-    "version": "4.1.0",
-    "hash": "sha256-x6OQN6MCN7S0fJ6EFTfv4rczdUWjwuWE9QQ0P6fbh9c="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.0.11",
-    "hash": "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.3.0",
-    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
-  },
-  {
-    "pname": "System.Threading.Overlapped",
-    "version": "4.0.1",
-    "hash": "sha256-CAWZlavcuBQHs+kaSX9CmkpHF7wC8rFrug3XPb5KJzo="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.0.11",
-    "hash": "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
-  },
-  {
-    "pname": "System.Threading.Tasks.Dataflow",
-    "version": "4.6.0",
-    "hash": "sha256-YYrT3GRzVBdendxt8FUDCnOBJi0nw/CJ9VrzcPJWLSg="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.0.0",
-    "hash": "sha256-+YdcPkMhZhRbMZHnfsDwpNbUkr31X7pQFGxXYcAPZbE="
-  },
-  {
-    "pname": "System.Threading.Tasks.Parallel",
-    "version": "4.0.1",
-    "hash": "sha256-5VyRZ97Fug4reK/cQ6wsCrJ5jH53aGu1a4ZkKMZrnIQ="
-  },
-  {
-    "pname": "System.Threading.Thread",
-    "version": "4.0.0",
-    "hash": "sha256-7EtSJuKqcW107FYA5Ko9NFXEWUPIzNDtlfKaQV2pvb8="
-  },
-  {
-    "pname": "System.Threading.ThreadPool",
-    "version": "4.0.10",
-    "hash": "sha256-/fowWjM/0ZZFC1Rwu0i5N71iRxV2JOd3jQV2Jn0wuTk="
-  },
-  {
-    "pname": "System.Threading.Timer",
-    "version": "4.0.1",
-    "hash": "sha256-5lU6zt1O9JDSPr2KAHw4BYgysHnt0yyZrMNa5IIjxZY="
-  },
-  {
-    "pname": "System.Xml.ReaderWriter",
-    "version": "4.0.11",
-    "hash": "sha256-haZAFFQ9Sl2DhfvEbdx2YRqKEoxNMU5STaqpMmXw0zA="
-  },
-  {
-    "pname": "System.Xml.XDocument",
-    "version": "4.0.11",
-    "hash": "sha256-KPz1kxe0RUBM+aoktJ/f9p51GudMERU8Pmwm//HdlFg="
-  },
-  {
-    "pname": "System.Xml.XmlDocument",
-    "version": "4.0.1",
-    "hash": "sha256-gdoFrPo54v1LjkBF79f8EvtltVVjHz9ZI9kc5ve0GkY="
-  },
-  {
-    "pname": "System.Xml.XPath",
-    "version": "4.0.1",
-    "hash": "sha256-lQCoK2M51SGRuGjfiuIW26Y2goABY2RLE6cZ4816WDo="
-  },
-  {
-    "pname": "System.Xml.XPath.XDocument",
-    "version": "4.0.1",
-    "hash": "sha256-H/zyMMB1YB8vd+StYJr99KLqWmSHhaP7RHDLRcFhzbo="
-  },
-  {
-    "pname": "UrlCombine",
-    "version": "2.0.0",
-    "hash": "sha256-yvBqXgZsqre+JIyxY/e8y+oBs2+K7PtJkITR3YEtHlU="
+    "version": "4.5.0",
+    "hash": "sha256-Q+7R7EVSOtsXIzKjjfCnvfNul6AE1NxzJZirG0JCo6c="
   }
 ]
diff --git a/pkgs/by-name/pu/pupdate/package.nix b/pkgs/by-name/pu/pupdate/package.nix
index 66ac56b52271..2bf3f5415414 100644
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.20.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "pupdate";
     rev = "${version}";
-    hash = "sha256-kdxqG1Vw6jRT/YyRLi60APpayYyLG73KqAFga8N9G2A=";
+    hash = "sha256-KodDuTVw06IFfwVOgbVwgNp74czjEcgu/T9rgYXlASQ=";
   };
 
   buildInputs = [
@@ -30,7 +30,7 @@ buildDotnetModule rec {
   patches = [ ./add-runtime-identifier.patch ];
   postPatch = ''
     substituteInPlace pupdate.csproj \
-      --replace @RuntimeIdentifier@ "${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
+      --replace-fail @RuntimeIdentifier@ "${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
   '';
 
   projectFile = "pupdate.csproj";
@@ -45,8 +45,8 @@ buildDotnetModule rec {
     "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system} -p:TrimMode=partial"
   ];
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
   passthru = {
     updateScript = nix-update-script { };

From ae147f005a143b438b7f16192985e80c6d8add94 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Thu, 5 Mar 2026 10:51:56 +0200
Subject: [PATCH 34/48] pkgsi686Linux.pkgsMusl.gzip: Fix build

Set -no-pie for gzip on this specific platform.

The ASM fast-path makes object references without going through PLT,
which would need to be relocated. Then musl ldd tries to apply
relocations to an R-X .text section and crashes.
---
 pkgs/tools/compression/gzip/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 85b452f2260b..446e5fab0af8 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -48,6 +48,10 @@ stdenv.mkDerivation (finalAttrs: {
     "ZLESS_PROG=zless"
   ];
 
+  env = lib.optionalAttrs (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_32) {
+    NIX_CFLAGS_LINK = "-no-pie";
+  };
+
   nativeCheckInputs = [
     less
     perl

From 5c501951d553acd041de076f49d3f2dd979e93ac Mon Sep 17 00:00:00 2001
From: Dom Rodriguez <shymega@shymega.org.uk>
Date: Mon, 23 Feb 2026 23:47:48 +0000
Subject: [PATCH 35/48] buildstream: ignore Git tags containing `*dev*`

Tags containing `*dev*` on official BuildStream projects are for
pre-releases, and should not be included in the passthru updateScript.

This is needed after https://github.com/NixOS/nixpkgs/pull/493236 showed
a issue with the updateScript.
---
 pkgs/by-name/bu/buildstream/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bu/buildstream/package.nix b/pkgs/by-name/bu/buildstream/package.nix
index 116e151c3b9b..134d77e4c660 100644
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -2,7 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
-  nix-update-script,
+  gitUpdater,
 
   # buildInputs
   buildbox,
@@ -119,7 +119,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   versionCheckProgram = "${placeholder "out"}/bin/bst";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "dev";
+  };
 
   meta = {
     description = "Powerful software integration tool";

From f8a58eb351b3ffae4721896cd7f0113c7bda529d Mon Sep 17 00:00:00 2001
From: Dom Rodriguez <shymega@shymega.org.uk>
Date: Fri, 27 Feb 2026 17:17:10 +0000
Subject: [PATCH 36/48] buildstream-plugins: ignore Git tags containing `*dev*`

Tags containing `*dev*` on official BuildStream projects are for
pre-releases, and should not be included in the passthru updateScript.

This is needed after https://github.com/NixOS/nixpkgs/pull/493236 showed
a issue with the updateScript.
---
 .../python-modules/buildstream-plugins/default.nix           | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/buildstream-plugins/default.nix b/pkgs/development/python-modules/buildstream-plugins/default.nix
index 201db0932bab..1159c4cafab5 100644
--- a/pkgs/development/python-modules/buildstream-plugins/default.nix
+++ b/pkgs/development/python-modules/buildstream-plugins/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   setuptools,
   cython,
 }:
@@ -29,6 +30,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "buildstream_plugins" ];
 
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "dev";
+  };
+
   meta = {
     description = "BuildStream plugins";
     homepage = "https://github.com/apache/buildstream-plugins";

From e624b2f653b97ddbe7e797860aa06e1640a24dc4 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Thu, 5 Mar 2026 10:56:39 -0800
Subject: [PATCH 37/48] python3Packages.opentelemetry-resourcedetector-gcp:
 init at 1.11.0a0

---
 .../default.nix                               | 55 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 59 insertions(+)
 create mode 100644 pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix

diff --git a/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
new file mode 100644
index 000000000000..02b3917a0cfa
--- /dev/null
+++ b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  requests,
+  typing-extensions,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "opentelemetry-resourcedetector-gcp";
+  version = "1.11.0a0";
+  pyproject = true;
+
+  # Use PyPi instead of GitHub because the GitHub tags are inaccurate
+  # (GitHub tags lack the alpha suffix)
+  src = fetchPypi {
+    pname = "opentelemetry_resourcedetector_gcp";
+    inherit (finalAttrs) version;
+    hash = "sha256-kVodb9FdrKnu3T/FKw9wU3UFTy7xQOLnprTMqVpHzbE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-sdk
+    requests
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "opentelemetry.resourcedetector.gcp_resource_detector"
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [
+    # These require a 4-year-old syrupy version
+    "tests/test_mapping.py"
+    "tests/test_gcp_resource_detector.py"
+  ];
+
+  meta = {
+    description = "Google Cloud resource detector for OpenTelemetry";
+    homepage = "https://pypi.org/project/opentelemetry-resourcedetector-gcp";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      sarahec
+    ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2582a02d0743..2fbe8311b730 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11676,6 +11676,10 @@ self: super: with self; {
 
   opentelemetry-proto = callPackage ../development/python-modules/opentelemetry-proto { };
 
+  opentelemetry-resourcedetector-gcp =
+    callPackage ../development/python-modules/opentelemetry-resourcedetector-gcp
+      { };
+
   opentelemetry-sdk = callPackage ../development/python-modules/opentelemetry-sdk { };
 
   opentelemetry-semantic-conventions =

From 12fc8f53c7f2afe5a1d2304f4715d8c1463e8bb7 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Thu, 5 Mar 2026 11:03:45 -0800
Subject: [PATCH 38/48] python3Packages.google-cloud-spanner: 3.58.0 -> 3.63.0

---
 .../google-cloud-spanner/default.nix          | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index b8ada5017686..3981cb83c107 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -13,6 +13,7 @@
   google-cloud-testutils,
   grpc-google-iam-v1,
   grpc-interceptor,
+  opentelemetry-resourcedetector-gcp,
   proto-plus,
   protobuf,
   sqlparse,
@@ -31,16 +32,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-spanner";
-  version = "3.58.0";
+  version = "3.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-spanner";
-    tag = "v${version}";
-    hash = "sha256-bIagQjQv+oatIo8mkA8t5wP9igMnorkiudgyWkVnJcg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QWBl7X/cKGds617IrHKaIteOnqgwB83jgfi8j/ESUws=";
   };
 
   build-system = [ setuptools ];
@@ -51,6 +52,7 @@ buildPythonPackage rec {
     google-cloud-core
     grpc-google-iam-v1
     grpc-interceptor
+    opentelemetry-resourcedetector-gcp
     proto-plus
     protobuf
     sqlparse
@@ -79,7 +81,7 @@ buildPythonPackage rec {
     pytest-asyncio
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   preCheck = ''
     # prevent google directory from shadowing google imports
@@ -97,6 +99,9 @@ buildPythonPackage rec {
     "test_snapshot_read_concurrent"
     # Flaky, can retry too quickly and fail
     "test_retry_helper"
+    # Flaky, system speed sensitive
+    "test_transaction_for_concurrent_statement_should_begin_one_transaction_with_query"
+    "test_transaction_for_concurrent_statement_should_begin_one_transaction_with_read"
   ];
 
   disabledTestPaths = [
@@ -130,8 +135,8 @@ buildPythonPackage rec {
   meta = {
     description = "Cloud Spanner API client library";
     homepage = "https://github.com/googleapis/python-spanner";
-    changelog = "https://github.com/googleapis/python-spanner/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/python-spanner/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };
-}
+})

From 05ebca800717117e4037bd38b45b9da9846c426b Mon Sep 17 00:00:00 2001
From: pancaek <20342389+pancaek@users.noreply.github.com>
Date: Wed, 4 Mar 2026 13:20:31 -0800
Subject: [PATCH 39/48] reaper: fix xdg-open

We shouldn't rely on xdg-utils already existing on PATH
---
 pkgs/applications/audio/reaper/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index c1f1ae485654..793ecb7a443a 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -17,6 +17,7 @@
   xdg-utils,
   xdotool,
   which,
+  openssl,
 
   jackSupport ? stdenv.hostPlatform.isLinux,
   jackLibrary,
@@ -59,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     which
     autoPatchelfHook
-    xdg-utils # Required for desktop integration
+    xdg-utils # Required for install script
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     undmg
@@ -112,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
         # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
         # Note that libcurl and libxml2_13 are needed for ReaPack to run.
         wrapProgram $out/opt/REAPER/reaper \
+          --prefix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
           --prefix LD_LIBRARY_PATH : "${
             lib.makeLibraryPath [
               curl
@@ -121,6 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
               vlc
               xdotool
               stdenv.cc.cc
+              openssl
             ]
           }"
 

From f6d585aa20c5304535d147117058412ffc33c1e8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 5 Mar 2026 21:42:05 +0100
Subject: [PATCH 40/48] evcc: 0.301.2 -> 0.302.0

https://github.com/evcc-io/evcc/releases/tag/0.302.0
---
 pkgs/by-name/ev/evcc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 15d503b9e69d..c55c80dd44bd 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.301.2";
+  version = "0.302.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-14qIWgHLQCz+d0PlIavw4F7XEWpx9jJL43XbCpZb4XA=";
+    hash = "sha256-NW18HD6d7RD6a5DhyvI+eZIVmjBr3Q5g+F+O4N508Go=";
   };
 
   vendorHash = "sha256-t70o3VWfypvWOLMCqC4I8GXywzrDgNKUi5yAaB0NdZw=";

From 198bc4bb9f26f4f96fed5f0e1f9eaeccffb86ef8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 01:48:02 +0000
Subject: [PATCH 41/48] beam26Packages.elvis-erlang: 4.2.1 -> 4.2.3

---
 pkgs/development/beam-modules/elvis-erlang/default.nix    | 4 ++--
 pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/beam-modules/elvis-erlang/default.nix b/pkgs/development/beam-modules/elvis-erlang/default.nix
index 9de2d3cd2c2b..cb80d7e3b3ca 100644
--- a/pkgs/development/beam-modules/elvis-erlang/default.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/default.nix
@@ -11,12 +11,12 @@
 rebar3Relx rec {
   releaseType = "escript";
   pname = "elvis-erlang";
-  version = "4.2.1";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "inaka";
     repo = "elvis";
-    hash = "sha256-/a7wcST0CYVebX7XVZLaDXNJX6fsFCCoidhSqcs+mNI=";
+    hash = "sha256-4hStLm76HZmO3vk/RdeRGJPJ3gevUkjVO2jGpVff32Q=";
     tag = version;
   };
 
diff --git a/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix b/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
index 715e6ff43a51..43985a064e84 100644
--- a/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
@@ -44,11 +44,11 @@ let
     };
     elvis_core = builder {
       name = "elvis_core";
-      version = "4.2.1";
+      version = "4.2.3";
       src = fetchHex {
         pkg = "elvis_core";
-        version = "4.2.1";
-        sha256 = "sha256-D3dLiR5kqMuZSf9PVUhclgjBFEFIEDqDOhAUk7l8J7I=";
+        version = "4.2.3";
+        sha256 = "sha256-xy4xinPab51p3uDxh/h5dHH57kbPTdrO36LJ+byxjqA=";
       };
       beamDeps = [
         katana_code

From bace983e92179ea9ffde2450f8efcf0ba3e36906 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 14:10:48 +0000
Subject: [PATCH 42/48] python3Packages.oslo-utils: 9.2.0 -> 10.0.0

---
 pkgs/development/python-modules/oslo-utils/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 167fa70622d9..95c299a205b6 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -16,7 +16,6 @@
   psutil,
   pyparsing,
   pytz,
-  tzdata,
 
   # tests
   ddt,
@@ -31,17 +30,18 @@
   stdenv,
   stestr,
   testscenarios,
+  tzdata,
 }:
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "9.2.0";
+  version = "10.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_utils";
     inherit version;
-    hash = "sha256-H0IAbea5KRoDBQJfXM24kHEg2I7X68N4ShRyozKASKs=";
+    hash = "sha256-u0ZxPnYNlERqCE9elMHPJzk1NpMIrYjuW1OReSPZw5M=";
   };
 
   postPatch =
@@ -71,7 +71,6 @@ buildPythonPackage rec {
     psutil
     pyparsing
     pytz
-    tzdata
   ];
 
   nativeCheckInputs = [
@@ -84,6 +83,7 @@ buildPythonPackage rec {
     qemu-utils
     stestr
     testscenarios
+    tzdata
   ];
 
   # disabled tests:

From edc7876daad048a83a4bed823ff84e75a48a70a5 Mon Sep 17 00:00:00 2001
From: Haylin Moore <me@haylinmoore.com>
Date: Thu, 11 Sep 2025 21:19:25 -0700
Subject: [PATCH 43/48] uhttpd: init at 0-unstable-2025-12-24

---
 pkgs/by-name/uh/uhttpd/package.nix | 66 ++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 pkgs/by-name/uh/uhttpd/package.nix

diff --git a/pkgs/by-name/uh/uhttpd/package.nix b/pkgs/by-name/uh/uhttpd/package.nix
new file mode 100644
index 000000000000..1326eb93aabf
--- /dev/null
+++ b/pkgs/by-name/uh/uhttpd/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  pkg-config,
+  lua5_1,
+  json_c,
+  libubox-wolfssl,
+  ubus,
+  libxcrypt,
+  unstableGitUpdater,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uhttpd";
+  version = "0-unstable-2025-12-24";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uhttpd.git";
+    rev = "506e24987b97fbc866005bfb71316bd63601a1ef";
+    hash = "sha256-x5hbbEcyxWhCjjqiHvAxvI1eHewqRlXuAGqXNw+c4sA=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    lua5_1
+    json_c
+    libubox-wolfssl
+    ubus
+    libxcrypt
+  ];
+
+  cmakeFlags = [
+    "-DUCODE_SUPPORT=off"
+    "-DTLS_SUPPORT=on"
+    "-DLUA_SUPPORT=on"
+  ];
+
+  NIX_LDFLAGS = "-lcrypt";
+
+  postInstall = ''
+    wrapProgram $out/bin/uhttpd \
+      --prefix LD_LIBRARY_PATH : $out/lib/uhttpd
+  '';
+
+  passthru.updateScript = unstableGitUpdater {
+    branch = "master";
+    hardcodeZeroVersion = true;
+  };
+
+  meta = {
+    description = "Tiny HTTP server from OpenWrt project";
+    homepage = "https://openwrt.org/docs/guide-user/services/webserver/uhttpd";
+    license = lib.licenses.isc;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.haylin ];
+    mainProgram = "uhttpd";
+  };
+})

From 26ebf88a7d17851ed99880bb0406487d85fc7640 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 1 Mar 2026 16:42:52 -0500
Subject: [PATCH 44/48] workflows/test: run when more files are changed

---
 .github/workflows/test.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 26c8c8736f93..823aa493565c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -55,10 +55,14 @@ jobs:
             })).map(file => file.filename)
 
             if (files.some(file => [
+              '.github/workflows/build.yml',
+              '.github/workflows/check.yml',
               '.github/workflows/eval.yml',
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
+              'ci/github-script/supportedSystems.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('merge-group', true)
 
             if (files.some(file => [
@@ -71,8 +75,16 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
+              'ci/github-script/check-target-branch.js',
+              'ci/github-script/commits.js',
+              'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
+              'ci/github-script/prepare.js',
+              'ci/github-script/reviewers.js',
+              'ci/github-script/reviews.js',
+              'ci/github-script/supportedSystems.js',
               'ci/github-script/withRateLimit.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('pr', true)
 
   merge-group:

From 2fa73152464e09a05a4b4505b5d727b915ac476d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 02:35:58 +0000
Subject: [PATCH 45/48] ty: 0.0.20 -> 0.0.21

---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index d6049ce4f3c1..7be071bd5555 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.20";
+  version = "0.0.21";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-NJ2RA12NZDmYdrSK9p+KfYiE36KA1RkolSchMRU7pHQ=";
+    hash = "sha256-/R0nw9V0IhuTxRaZNydvk/xGC5V1gYHQxBkAU/Cjsmw=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-xUYjlSl9uKsk+Wk3xxK6wPrKhFHuqpJNgQ2TSkcGpYE=";
+  cargoHash = "sha256-NaWWX6EAVkEg/KQ+Up0t2fh/24fnTo6i5dDZoOWErjg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 477c1d80fc7a1110b4ca019c8d568d2b7ed5d2b0 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Fri, 6 Mar 2026 03:45:15 +0100
Subject: [PATCH 46/48] reqable: fix formatting

---
 pkgs/by-name/re/reqable/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/reqable/package.nix b/pkgs/by-name/re/reqable/package.nix
index eacced666f2a..ab612c501383 100644
--- a/pkgs/by-name/re/reqable/package.nix
+++ b/pkgs/by-name/re/reqable/package.nix
@@ -76,8 +76,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   preFixup = ''
     makeWrapper $out/share/reqable/reqable $out/bin/reqable \
-     --prefix LD_LIBRARY_PATH : $out/share/reqable/lib \
-     ''${gappsWrapperArgs[@]}
+      --prefix LD_LIBRARY_PATH : $out/share/reqable/lib \
+      ''${gappsWrapperArgs[@]}
   '';
 
   passthru.updateScript = nix-update-script { };

From d16d3b6677d8d777f78a46de18d90b09723ef4ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 03:37:48 +0000
Subject: [PATCH 47/48] terraform-providers.aiven_aiven: 4.51.0 -> 4.52.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index fead5d0e4b99..3b404d31ca30 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-lNDorhkIngyZ8S51lyuI3LRtnFtzVG01Nzo1vRPytbQ=",
+    "hash": "sha256-2kv5cBEogQXmWcN/fzg0Rxf/SuqLpeOr8O2NoOg57+c=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.51.0",
+    "rev": "v4.52.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-c4eCY/iQ8v/gBX55j22TRxWIeoevi5EJs4TtN9xXfKA="
+    "vendorHash": "sha256-mUBHjGpDE7aFiyUovi7/doOrrZelmNJC+QYF5+2dxt0="
   },
   "akamai_akamai": {
     "hash": "sha256-vC7hVV/p28y7cv9PONEfRVj5uKgumtbq4HpbOYq9vBQ=",

From dc19888f778af83143bf6f4ef523afd3117bc9ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 03:43:43 +0000
Subject: [PATCH 48/48] terraform-providers.hashicorp_google-beta: 7.21.0 ->
 7.22.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index fead5d0e4b99..3ff64e95983a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-v/XHGUEpAIpGHErv7GPqfosVLL3xaqBwZHbJKS8fkn4="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-ypC8av5GnFBlUp2eVDZWqnPGrZT8QihYnxsIHw8g+oA=",
+    "hash": "sha256-wIAgFDHBVErm2NMiQszhnwJ6nWJA4qqDY/a6JdUrmyA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.21.0",
+    "rev": "v7.22.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KnB6R5yrEeaf4Z+LzQjCeQJjAgHK0kJEJzT1rb3pimY="
+    "vendorHash": "sha256-YZQMUGScsYjBkhAQ4DXYlBpAw805iKgX/iXDMTpRr6c="
   },
   "hashicorp_helm": {
     "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",