Merge df1c5949df into haskell-updates

ci/OWNERS

@@ -247,7 +247,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/applications/networking/browsers/firefox/update.nix
 /pkgs/applications/networking/browsers/firefox/packages/firefox.nix @mweinelt
 /pkgs/applications/networking/browsers/firefox/packages/firefox-esr-*.nix @mweinelt
-/pkgs/applications/networking/browsers/librewolf @squalus @DominicWrege @fpletz
 /pkgs/applications/networking/browsers/chromium @emilylange @networkException
 /nixos/tests/chromium.nix @emilylange @networkException
 

ci/github-script/check-target-branch.js

@@ -122,7 +122,11 @@ async function checkTargetBranch({ github, context, core, dry }) {
     ].join('\n'),
   )
 
-  if (maxRebuildCount >= 1000 && !isExemptHomeAssistantUpdate) {
+  if (
+    maxRebuildCount >= 1000 &&
+    !isExemptHomeAssistantUpdate &&
+    !isExemptKernelUpdate
+  ) {
     const desiredBranch =
       base === 'master' ? 'staging' : `staging-${split(base).version}`
     const body = [

doc/languages-frameworks/ocaml.section.md

@@ -116,14 +116,14 @@ Here is a second example, this time using a source archive generated with `dune-
   buildDunePackage,
 }:
 
-buildDunePackage (finalAtts: {
+buildDunePackage (finalAttrs: {
   pname = "wtf8";
   version = "1.0.2";
 
   minimalOCamlVersion = "4.02";
 
   src = fetchurl {
-    url = "https://github.com/flowtype/ocaml-wtf8/releases/download/v${finalAtts.version}/wtf8-v${finalAtts.version}.tbz";
+    url = "https://github.com/flowtype/ocaml-wtf8/releases/download/v${finalAttrs.version}/wtf8-v${finalAttrs.version}.tbz";
     hash = "sha256-d5/3KUBAWRj8tntr4RkJ74KWW7wvn/B/m1nx0npnzyc=";
   };
 

maintainers/maintainer-list.nix

@@ -9556,6 +9556,12 @@
     githubId = 127353;
     name = "Geoffrey Huntley";
   };
+  gibbert = {
+    email = "gbjgms@gmail.com";
+    github = "zgibberish";
+    githubId = 67570424;
+    name = "gibbert";
+  };
   gigahawk = {
     email = "Jasper Chan";
     name = "jasperchan515@gmail.com";
@@ -11780,6 +11786,12 @@
     githubId = 1358764;
     name = "Jamie Magee";
   };
+  janhencic = {
+    name = "Jan Hencic";
+    email = "jan@hencic.com";
+    github = "janhencic";
+    githubId = 61284133;
+  };
   jankaifer = {
     name = "Jan Kaifer";
     email = "jan@kaifer.cz";
@@ -18651,6 +18663,11 @@
     githubId = 50854675;
     name = "Nelson Jeppesen";
   };
+  nemin = {
+    name = "Nemin";
+    github = "Nemin32";
+    githubId = 2953293;
+  };
   neosimsim = {
     email = "me@abn.sh";
     github = "neosimsim";

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -105,7 +105,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device.
 
-- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer)
+- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.server.enable) (renamed to `services.kanidm.server.enable` in 26.05).
 
 - [Maddy](https://maddy.email/), a free an open source mail server. Available as [services.maddy](#opt-services.maddy.enable).
 

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -149,6 +149,11 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
 
+- `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
+  For each component `enableComponent` and `componentSettings` are now `component.enable` and
+  `component.settings`. The unix module now supports using SSH keys from Kanidm via
+  `services.kanidm.unix.sshIntegration = true`.
+
 - `glibc` has been updated to version 2.42.
 
   This version no longer makes the stack executable when a shared library requires this. A symptom

nixos/modules/security/pam.nix

@@ -772,7 +772,7 @@ let
               }
               {
                 name = "kanidm";
-                enable = config.services.kanidm.enablePam;
+                enable = config.services.kanidm.unix.enable;
                 control = "sufficient";
                 modulePath = "${config.services.kanidm.package}/lib/pam_kanidm.so";
                 settings = {
@@ -1139,7 +1139,7 @@ let
                 }
                 {
                   name = "kanidm";
-                  enable = config.services.kanidm.enablePam;
+                  enable = config.services.kanidm.unix.enable;
                   control = "sufficient";
                   modulePath = "${config.services.kanidm.package}/lib/pam_kanidm.so";
                   settings = {
@@ -1248,7 +1248,7 @@ let
               }
               {
                 name = "kanidm";
-                enable = config.services.kanidm.enablePam;
+                enable = config.services.kanidm.unix.enable;
                 control = "sufficient";
                 modulePath = "${config.services.kanidm.package}/lib/pam_kanidm.so";
               }
@@ -1412,7 +1412,7 @@ let
               }
               {
                 name = "kanidm";
-                enable = config.services.kanidm.enablePam;
+                enable = config.services.kanidm.unix.enable;
                 control = "optional";
                 modulePath = "${config.services.kanidm.package}/lib/pam_kanidm.so";
               }
@@ -2339,7 +2339,7 @@ in
       # Include the PAM modules in the system path mostly for the manpages.
       [ package ]
       ++ lib.optional config.users.ldap.enable pam_ldap
-      ++ lib.optional config.services.kanidm.enablePam config.services.kanidm.package
+      ++ lib.optional config.services.kanidm.unix.enable config.services.kanidm.package
       ++ lib.optional config.services.sssd.enable pkgs.sssd
       ++ lib.optionals config.security.pam.krb5.enable [
         pam_krb5

nixos/modules/services/misc/gitlab.nix

@@ -1626,7 +1626,8 @@ in
         nodejs
         gnupg
 
-        "${cfg.packages.gitlab}/share/gitlab/vendor/gems/sidekiq-${cfg.packages.gitlab.rubyEnv.gems.sidekiq.version}"
+        # We currently use the bundled sidekiq, if we use upstream sidekiq again, this needs to include the version
+        "${cfg.packages.gitlab}/share/gitlab/vendor/gems/sidekiq"
 
         # Needed for GitLab project imports
         gnutar

nixos/modules/services/security/crowdsec.nix

@@ -602,7 +602,7 @@ in
       ++ lib.optionals (cfg.settings.console.tokenFile != null) [
         ''
           if [ ! -e "${cfg.settings.console.tokenFile}" ]; then
-            ${lib.getExe cscli} console enroll "$(cat ${cfg.settings.console.tokenFile})" --name ${cfg.name}
+            ${lib.getExe cscli} console enroll "$(${lib.getExe' pkgs.coreutils "cat"} ${cfg.settings.console.tokenFile})" --name ${cfg.name}
           fi
         ''
       ];

nixos/modules/services/security/kanidm.nix

@@ -31,6 +31,7 @@ let
     mkOption
     mkOrder
     mkPackageOption
+    mkRenamedOptionModule
     optional
     optionals
     optionalString
@@ -44,9 +45,9 @@ let
   settingsFormat = pkgs.formats.toml { };
   # Remove null values, so we can document optional values that don't end up in the generated TOML file.
   filterConfig = converge (filterAttrsRecursive (_: v: v != null));
-  serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
-  clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
-  unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
+  serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.server.settings);
+  clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.client.settings);
+  unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unix.settings);
   provisionSecretFiles = filter (x: x != null) (
     [
       cfg.provision.idmAdminPasswordFile
@@ -56,11 +57,11 @@ let
     ++ mapAttrsToList (_: x: x.basicSecretFile) cfg.provision.systems.oauth2
   );
   secretPaths = [
-    cfg.serverSettings.tls_chain
-    cfg.serverSettings.tls_key
+    cfg.server.settings.tls_chain
+    cfg.server.settings.tls_key
   ]
   ++ optionals cfg.provision.enable provisionSecretFiles;
-  enableServerBackup = cfg.enableServer && (cfg.serverSettings.online_backup.versions != 0);
+  enableServerBackup = cfg.server.enable && (cfg.server.settings.online_backup.versions != 0);
 
   # Merge bind mount paths and remove paths where a prefix is already mounted.
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
@@ -218,7 +219,7 @@ let
 
   serverPort =
     let
-      address = cfg.serverSettings.bindaddress;
+      address = cfg.server.settings.bindaddress;
     in
     # ipv6:
     if hasInfix "]:" address then
@@ -230,19 +231,42 @@ let
     # default is 8443
     else
       throw "Address not parseable as IPv4 nor IPv6.";
+
+  addKaniSshKeys = cfg.unix.enable && cfg.unix.sshIntegration;
 in
 {
-  options.services.kanidm = {
-    enableClient = mkEnableOption "the Kanidm client";
-    enableServer = mkEnableOption "the Kanidm server";
-    enablePam = mkEnableOption "the Kanidm PAM and NSS integration";
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "kanidm" "enableServer" ]
+      [ "services" "kanidm" "server" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "kanidm" "serverSettings" ]
+      [ "services" "kanidm" "server" "settings" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "kanidm" "enableClient" ]
+      [ "services" "kanidm" "client" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "kanidm" "clientSettings" ]
+      [ "services" "kanidm" "client" "settings" ]
+    )
+    (mkRenamedOptionModule [ "services" "kanidm" "enablePam" ] [ "services" "kanidm" "unix" "enable" ])
+    (mkRenamedOptionModule
+      [ "services" "kanidm" "unixSettings" ]
+      [ "services" "kanidm" "unix" "settings" ]
+    )
+  ];
 
+  options.services.kanidm = {
     package = mkPackageOption pkgs "kanidm" {
       example = "kanidm_1_8";
       extraDescription = "Must be set to an explicit version.";
     };
 
-    serverSettings = mkOption {
+    server.enable = mkEnableOption "the Kanidm server";
+    server.settings = mkOption {
       type = types.submodule {
         freeformType = settingsFormat.type;
 
@@ -270,7 +294,7 @@ in
           domain = mkOption {
             description = ''
               The `domain` that Kanidm manages. Must be below or equal to the domain
-              specified in `serverSettings.origin`.
+              specified in `server.settings.origin`.
               This can be left at `null`, only if your instance has the role `ReadOnlyReplica`.
               While it is possible to change the domain later on, it requires extra steps!
               Please consider the warnings and execute the steps described
@@ -345,7 +369,8 @@ in
       '';
     };
 
-    clientSettings = mkOption {
+    client.enable = mkEnableOption "the Kanidm client";
+    client.settings = mkOption {
       type = types.submodule {
         freeformType = settingsFormat.type;
 
@@ -363,7 +388,11 @@ in
       '';
     };
 
-    unixSettings = mkOption {
+    unix = {
+      enable = mkEnableOption "the Kanidm PAM and NSS integration";
+      sshIntegration = mkEnableOption "Kanidm SSH keys login";
+    };
+    unix.settings = mkOption {
       type = types.submodule {
         freeformType = settingsFormat.type;
 
@@ -394,7 +423,7 @@ in
       instanceUrl = mkOption {
         description = "The instance url to which the provisioning tool should connect.";
         default = "https://localhost:${serverPort}";
-        defaultText = "https://localhost:<port from serverSettings.bindaddress>";
+        defaultText = "https://localhost:<port from server.settings.bindaddress>";
         type = types.str;
       };
 
@@ -671,11 +700,11 @@ in
     };
   };
 
-  config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
+  config = mkIf (cfg.client.enable || cfg.server.enable || cfg.unix.enable) {
     warnings = lib.optionals (cfg.package.eolMessage != "") [ cfg.package.eolMessage ];
     services.kanidm = {
-      unixSettings.version = "2";
-      serverSettings.version = "2";
+      unix.settings.version = "2";
+      server.settings.version = "2";
     };
 
     assertions =
@@ -699,7 +728,7 @@ in
             unknownGroups = subtractLists knownGroups groups;
           in
           {
-            assertion = (cfg.enableServer && cfg.provision.enable) -> unknownGroups == [ ];
+            assertion = (cfg.server.enable && cfg.provision.enable) -> unknownGroups == [ ];
             message = "${opt} refers to unknown groups: ${toString unknownGroups}";
           };
 
@@ -709,71 +738,71 @@ in
             unknownEntities = subtractLists (attrNames entitiesByName) entities;
           in
           {
-            assertion = (cfg.enableServer && cfg.provision.enable) -> unknownEntities == [ ];
+            assertion = (cfg.server.enable && cfg.provision.enable) -> unknownEntities == [ ];
             message = "${opt} refers to unknown entities: ${toString unknownEntities}";
           };
       in
       [
         {
-          assertion = cfg.enablePam -> !(cfg.unixSettings ? pam_allowed_login_groups);
+          assertion = cfg.unix.enable -> !(cfg.unix.settings ? pam_allowed_login_groups);
           message = ''
-            <option>services.kanidm.unixSettings.pam_allowed_login_groups</option> has been renamed
-            to <option>services.kanidm.unixSettings.kanidm.pam_allowed_login_groups</option>.
+            <option>services.kanidm.unix.settings.pam_allowed_login_groups</option> has been renamed
+            to <option>services.kanidm.unix.settings.kanidm.pam_allowed_login_groups</option>.
             Please change your usage.
           '';
         }
         {
           assertion =
-            !cfg.enableServer
-            || ((cfg.serverSettings.tls_chain or null) == null)
-            || (!isStorePath cfg.serverSettings.tls_chain);
+            !cfg.server.enable
+            || ((cfg.server.settings.tls_chain or null) == null)
+            || (!isStorePath cfg.server.settings.tls_chain);
           message = ''
-            <option>services.kanidm.serverSettings.tls_chain</option> points to
+            <option>services.kanidm.server.settings.tls_chain</option> points to
             a file in the Nix store. You should use a quoted absolute path to
             prevent this.
           '';
         }
         {
           assertion =
-            !cfg.enableServer
-            || ((cfg.serverSettings.tls_key or null) == null)
-            || (!isStorePath cfg.serverSettings.tls_key);
+            !cfg.server.enable
+            || ((cfg.server.settings.tls_key or null) == null)
+            || (!isStorePath cfg.server.settings.tls_key);
           message = ''
-            <option>services.kanidm.serverSettings.tls_key</option> points to
+            <option>services.kanidm.server.settings.tls_key</option> points to
             a file in the Nix store. You should use a quoted absolute path to
             prevent this.
           '';
         }
         {
-          assertion = !cfg.enableClient || options.services.kanidm.clientSettings.isDefined;
+          assertion = !cfg.client.enable || options.services.kanidm.client.settings.isDefined;
           message = ''
-            <option>services.kanidm.clientSettings</option> needs to be configured
+            <option>services.kanidm.client.settings</option> needs to be configured
             if the client is enabled.
           '';
         }
         {
-          assertion = !cfg.enablePam || options.services.kanidm.clientSettings.isDefined;
+          assertion = !cfg.unix.enable || options.services.kanidm.client.settings.isDefined;
           message = ''
-            <option>services.kanidm.clientSettings</option> needs to be configured
+            <option>services.kanidm.client.settings</option> needs to be configured
             for the PAM daemon to connect to the Kanidm server.
           '';
         }
         {
           assertion =
-            !cfg.enableServer
+            !cfg.server.enable
             || (
-              cfg.serverSettings.domain == null
-              -> cfg.serverSettings.role == "WriteReplica" || cfg.serverSettings.role == "WriteReplicaNoUI"
+              cfg.server.settings.domain == null
+              -> cfg.server.settings.role == "WriteReplica" || cfg.server.settings.role == "WriteReplicaNoUI"
             );
           message = ''
-            <option>services.kanidm.serverSettings.domain</option> can only be set if this instance
+            <option>services.kanidm.server.settings.domain</option> can only be set if this instance
             is not a ReadOnlyReplica. Otherwise the db would inherit it from
             the instance it follows.
           '';
         }
         {
-          assertion = cfg.provision.enable -> cfg.enableServer;
-          message = "<option>services.kanidm.provision</option> requires <option>services.kanidm.enableServer</option> to be true";
+          assertion = cfg.provision.enable -> cfg.server.enable;
+          message = "<option>services.kanidm.provision</option> requires <option>services.kanidm.server.enable</option> to be true";
         }
         # If any secret is provisioned, the kanidm package must have some required patches applied to it
         {
@@ -844,27 +873,28 @@ in
                 # At least one group must map to a value in each claim map
                 (mkIf (cfg.provision.extraJsonFile == null) {
                   assertion =
-                    (cfg.provision.enable && cfg.enableServer)
+                    (cfg.provision.enable && cfg.server.enable)
                     -> any (xs: xs != [ ]) (attrValues claimCfg.valuesByGroup);
                   message = "services.kanidm.provision.systems.oauth2.${oauth2}.claimMaps.${claim} does not specify any values for any group";
                 })
                 # Public clients cannot define a basic secret
                 {
                   assertion =
-                    (cfg.provision.enable && cfg.enableServer && oauth2Cfg.public) -> oauth2Cfg.basicSecretFile == null;
+                    (cfg.provision.enable && cfg.server.enable && oauth2Cfg.public)
+                    -> oauth2Cfg.basicSecretFile == null;
                   message = "services.kanidm.provision.systems.oauth2.${oauth2} is a public client and thus cannot specify a basic secret";
                 }
                 # Public clients cannot disable PKCE
                 {
                   assertion =
-                    (cfg.provision.enable && cfg.enableServer && oauth2Cfg.public)
+                    (cfg.provision.enable && cfg.server.enable && oauth2Cfg.public)
                     -> !oauth2Cfg.allowInsecureClientDisablePkce;
                   message = "services.kanidm.provision.systems.oauth2.${oauth2} is a public client and thus cannot disable PKCE";
                 }
                 # Non-public clients cannot enable localhost redirects
                 {
                   assertion =
-                    (cfg.provision.enable && cfg.enableServer && !oauth2Cfg.public)
+                    (cfg.provision.enable && cfg.server.enable && !oauth2Cfg.public)
                     -> !oauth2Cfg.enableLocalhostRedirects;
                   message = "services.kanidm.provision.systems.oauth2.${oauth2} is a non-public client and thus cannot enable localhost redirects";
                 }
@@ -874,17 +904,17 @@ in
         )
       );
 
-    environment.systemPackages = mkIf cfg.enableClient [ cfg.package ];
+    environment.systemPackages = mkIf cfg.client.enable [ cfg.package ];
 
     systemd.tmpfiles.settings."10-kanidm" = mkIf enableServerBackup {
-      ${cfg.serverSettings.online_backup.path}.d = {
+      ${cfg.server.settings.online_backup.path}.d = {
         mode = "0700";
         user = "kanidm";
         group = "kanidm";
       };
     };
 
-    systemd.services.kanidm = mkIf cfg.enableServer {
+    systemd.services.kanidm = mkIf cfg.server.enable {
       description = "kanidm identity management daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
@@ -915,10 +945,10 @@ in
           BindPaths =
             [ ]
             # To store backups
-            ++ optional enableServerBackup cfg.serverSettings.online_backup.path
+            ++ optional enableServerBackup cfg.server.settings.online_backup.path
             ++ optional (
-              cfg.enablePam && cfg.unixSettings ? home_mount_prefix
-            ) cfg.unixSettings.home_mount_prefix;
+              cfg.unix.enable && cfg.unix.settings ? home_mount_prefix
+            ) cfg.unix.settings.home_mount_prefix;
 
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
@@ -936,7 +966,7 @@ in
       ];
     };
 
-    systemd.services.kanidm-unixd = mkIf cfg.enablePam {
+    systemd.services.kanidm-unixd = mkIf cfg.unix.enable {
       description = "Kanidm PAM daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
@@ -979,7 +1009,7 @@ in
       environment.RUST_LOG = "info";
     };
 
-    systemd.services.kanidm-unixd-tasks = mkIf cfg.enablePam {
+    systemd.services.kanidm-unixd-tasks = mkIf cfg.unix.enable {
       description = "Kanidm PAM home management daemon";
       wantedBy = [ "multi-user.target" ];
       after = [
@@ -1033,25 +1063,26 @@ in
 
     # These paths are hardcoded
     environment.etc = mkMerge [
-      (mkIf cfg.enableServer { "kanidm/server.toml".source = serverConfigFile; })
-      (mkIf options.services.kanidm.clientSettings.isDefined {
+      (mkIf cfg.server.enable { "kanidm/server.toml".source = serverConfigFile; })
+      (mkIf options.services.kanidm.client.settings.isDefined {
         "kanidm/config".source = clientConfigFile;
       })
-      (mkIf cfg.enablePam { "kanidm/unixd".source = unixConfigFile; })
+      (mkIf cfg.unix.enable { "kanidm/unixd".source = unixConfigFile; })
     ];
 
-    system.nssModules = mkIf cfg.enablePam [ cfg.package ];
+    system.nssModules = mkIf cfg.unix.enable [ cfg.package ];
 
     # Needs to be before "files" which is `mkBefore`
-    system.nssDatabases.group = mkOrder 490 (optional cfg.enablePam "kanidm");
-    system.nssDatabases.passwd = mkOrder 490 (optional cfg.enablePam "kanidm");
+    system.nssDatabases.group = mkOrder 490 (optional cfg.unix.enable "kanidm");
+    system.nssDatabases.passwd = mkOrder 490 (optional cfg.unix.enable "kanidm");
 
     users.groups = mkMerge [
-      (mkIf cfg.enableServer { kanidm = { }; })
-      (mkIf cfg.enablePam { kanidm-unixd = { }; })
+      (mkIf cfg.server.enable { kanidm = { }; })
+      (mkIf cfg.unix.enable { kanidm-unixd = { }; })
+      (mkIf addKaniSshKeys { kanidm-authorized-keys = { }; })
     ];
     users.users = mkMerge [
-      (mkIf cfg.enableServer {
+      (mkIf cfg.server.enable {
         kanidm = {
           description = "Kanidm server";
           isSystemUser = true;
@@ -1059,14 +1090,34 @@ in
           packages = [ cfg.package ];
         };
       })
-      (mkIf cfg.enablePam {
+      (mkIf cfg.unix.enable {
         kanidm-unixd = {
           description = "Kanidm PAM daemon";
           isSystemUser = true;
           group = "kanidm-unixd";
         };
       })
+      (mkIf addKaniSshKeys {
+        kanidm-authorized-keys = {
+          description = "Kanidm authorized keys delegate";
+          isSystemUser = true;
+          group = "kanidm-authorized-keys";
+        };
+      })
     ];
+
+    # AuthorizedKeysCommand is displeased with `/nix/store` permissions
+    services.openssh.settings = mkIf addKaniSshKeys {
+      AuthorizedKeysCommand = "${config.security.wrapperDir}/kanidm_ssh_authorizedkeys %u";
+      AuthorizedKeysCommandUser = "kanidm-authorized-keys";
+    };
+
+    security.wrappers.kanidm_ssh_authorizedkeys = mkIf addKaniSshKeys {
+      owner = "root";
+      group = "root";
+      permissions = "a+rx";
+      source = "${cfg.package}/bin/kanidm_ssh_authorizedkeys";
+    };
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/web-apps/nextcloud.nix

@@ -293,9 +293,6 @@ let
         ) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
         ${lib.optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
         'dbtype' => '${c.dbtype}',
-        ${lib.concatStringsSep "\n" (
-          lib.mapAttrsToList (name: credential: "'${name}' => nix_read_secret('${name}'),") cfg.secrets
-        )}
         ${objectstoreConfig}
       ];
 
@@ -304,6 +301,12 @@ let
         "impossible: this should never happen (decoding generated settings file %s failed)"
       ));
 
+      $CONFIG = array_replace_recursive($CONFIG, [
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (name: credential: "'${name}' => nix_read_secret('${name}'),") cfg.secrets
+        )}
+      ]);
+
       ${lib.optionalString (cfg.secretFile != null) ''
         $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
       ''}

nixos/modules/services/web-apps/vikunja.nix

@@ -45,6 +45,11 @@ in
       type = types.str;
       description = "The Hostname under which the frontend is running.";
     };
+    address = mkOption {
+      type = types.str;
+      default = "";
+      description = "The IP address to bind to.";
+    };
     port = mkOption {
       type = types.port;
       default = 3456;
@@ -105,7 +110,7 @@ in
           ;
       };
       service = {
-        interface = ":${toString cfg.port}";
+        interface = "${cfg.address}:${toString cfg.port}";
         frontendurl = "${cfg.frontendScheme}://${cfg.frontendHostname}/";
       };
       files = {

nixos/modules/virtualisation/oci-containers.nix

@@ -536,7 +536,7 @@ let
         ExecStartPre = [ "${preStartScript}/bin/pre-start" ];
         TimeoutStartSec = 0;
         TimeoutStopSec = 120;
-        Restart = "always";
+        Restart = "on-failure";
       }
       // optionalAttrs (cfg.backend == "podman") {
         Environment = "PODMAN_SYSTEMD_UNIT=%n";

nixos/tests/all-tests.nix

@@ -837,6 +837,7 @@ in
   kimai = runTest ./kimai.nix;
   kismet = runTest ./kismet.nix;
   kmonad = runTest ./kmonad.nix;
+  kmscon = runTest ./kmscon.nix;
   knot = runTest ./knot.nix;
   komga = runTest ./komga.nix;
   komodo-periphery = runTest ./komodo-periphery.nix;

nixos/tests/kanidm-provisioning.nix

@@ -25,21 +25,25 @@ in
     {
       services.kanidm = {
         package = kanidmPackage;
-        enableServer = true;
-        serverSettings = {
-          origin = "https://${serverDomain}";
-          domain = serverDomain;
-          bindaddress = "[::]:443";
-          ldapbindaddress = "[::1]:636";
-          tls_chain = "${certsPath}/snakeoil.crt";
-          tls_key = "${certsPath}/snakeoil.key";
+        server = {
+          enable = true;
+          settings = {
+            origin = "https://${serverDomain}";
+            domain = serverDomain;
+            bindaddress = "[::]:443";
+            ldapbindaddress = "[::1]:636";
+            tls_chain = "${certsPath}/snakeoil.crt";
+            tls_key = "${certsPath}/snakeoil.key";
+          };
         };
         # So we can check whether provisioning did what we wanted
-        enableClient = true;
-        clientSettings = {
-          uri = "https://${serverDomain}";
-          verify_ca = true;
-          verify_hostnames = true;
+        client = {
+          enable = true;
+          settings = {
+            uri = "https://${serverDomain}";
+            verify_ca = true;
+            verify_hostnames = true;
+          };
         };
       };
 
@@ -289,7 +293,7 @@ in
       # We need access to the config file in the test script.
       filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
         _: v: v != null
-      )) nodes.provision.services.kanidm.serverSettings;
+      )) nodes.provision.services.kanidm.server.settings;
       serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
 
       specialisations = "${nodes.provision.system.build.toplevel}/specialisation";

nixos/tests/kanidm.nix

@@ -29,14 +29,16 @@ in
     {
       services.kanidm = {
         package = kanidmPackage;
-        enableServer = true;
-        serverSettings = {
-          origin = "https://${serverDomain}";
-          domain = serverDomain;
-          bindaddress = "[::]:443";
-          ldapbindaddress = "[::1]:636";
-          tls_chain = "${certsPath}/snakeoil.crt";
-          tls_key = "${certsPath}/snakeoil.key";
+        server = {
+          enable = true;
+          settings = {
+            origin = "https://${serverDomain}";
+            domain = serverDomain;
+            bindaddress = "[::]:443";
+            ldapbindaddress = "[::1]:636";
+            tls_chain = "${certsPath}/snakeoil.crt";
+            tls_key = "${certsPath}/snakeoil.key";
+          };
         };
       };
 
@@ -59,15 +61,17 @@ in
     {
       services.kanidm = {
         package = kanidmPackage;
-        enableClient = true;
-        clientSettings = {
-          uri = "https://${serverDomain}";
-          verify_ca = true;
-          verify_hostnames = true;
-        };
-        enablePam = true;
-        unixSettings = {
-          kanidm.pam_allowed_login_groups = [ "shell" ];
+        client = {
+          enable = true;
+          settings = {
+            uri = "https://${serverDomain}";
+            verify_ca = true;
+            verify_hostnames = true;
+          };
+          unix = {
+            enable = true;
+            kanidm.pam_allowed_login_groups = [ "shell" ];
+          };
         };
       };
 
@@ -86,7 +90,7 @@ in
       # We need access to the config file in the test script.
       filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
         _: v: v != null
-      )) nodes.server.services.kanidm.serverSettings;
+      )) nodes.server.services.kanidm.server.settings;
       serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
     in
     ''

nixos/tests/kmscon.nix

@@ -0,0 +1,43 @@
+{ ... }:
+{
+  name = "kmscon";
+
+  nodes.machine =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
+
+      services.kmscon = {
+        enable = true;
+        hwRender = true;
+        fonts = [
+          {
+            name = "JetBrainsMono Nerd Font";
+            package = pkgs.nerd-fonts.jetbrains-mono;
+          }
+        ];
+        package = pkgs.kmscon;
+      };
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.succeed(":")
+    # ^ this create a screen
+
+    with subtest("ensure we can open a tty"):
+      machine.wait_for_text("machine login:")
+      machine.send_chars("alice\n")
+      machine.wait_for_text("Password:")
+      machine.send_chars("foobar\n")
+      machine.wait_for_text("alice@machine")
+      machine.screenshot("tty.png")
+  '';
+}

nixos/tests/networking/networkmanager.nix

@@ -8,10 +8,34 @@ with import ../../lib/testing-python.nix { inherit system pkgs; };
 
 let
   lib = pkgs.lib;
+
+  # Generate EAP certificates on the fly (CA, server, and client certs)
+  eapCerts = pkgs.runCommand "eap-certs" { buildInputs = [ pkgs.openssl ]; } ''
+    mkdir -p $out
+
+    # Create CA certificate
+    openssl req -x509 -newkey rsa:2048 -days 365000 -nodes \
+      -keyout $out/ca.key -out $out/ca.cert \
+      -subj "/CN=ExampleCA"
+
+    # Create server certificate
+    openssl req -newkey rsa:2048 -nodes \
+      -keyout $out/server.key -out server.csr \
+      -subj "/CN=server.example.com"
+    openssl x509 -req -in server.csr -CA $out/ca.cert -CAkey $out/ca.key \
+      -days 365000 -set_serial 100 -out $out/server.cert
+
+    # Create client certificate
+    openssl req -newkey rsa:2048 -nodes \
+      -keyout $out/client1.key -out client1.csr \
+      -subj "/CN=client1.example.com"
+    openssl x509 -req -in client1.csr -CA $out/ca.cert -CAkey $out/ca.key \
+      -days 365000 -set_serial 101 -out $out/client1.cert
+  '';
+
   # this is intended as a client test since you shouldn't use NetworkManager for a router or server
   # so using systemd-networkd for the router vm is fine in these tests.
   router = import ./router.nix { networkd = true; };
-  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib pkgs; };
   clientConfig =
     extraConfig:
     lib.recursiveUpdate {
@@ -180,6 +204,100 @@ let
         client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::23")
       '';
     };
+    eap =
+      let
+        toBase64Blob =
+          file:
+          "data:;base64,"
+          + builtins.readFile (
+            pkgs.runCommand "base64" { } ''
+              ${pkgs.coreutils}/bin/base64 -w0 ${file} > $out
+            ''
+          );
+      in
+      {
+        name = "eap / 802.1x with secrets in blob encoding";
+        nodes = {
+          router = import ./router-eap.nix { inherit eapCerts; };
+          client = clientConfig {
+            networking.networkmanager.ensureProfiles.profiles.default = {
+              ipv4.method = "auto";
+              "802-1x" = {
+                eap = "tls";
+                identity = "client1.example.com";
+                ca-cert = toBase64Blob "${eapCerts}/ca.cert";
+                client-cert = toBase64Blob "${eapCerts}/client1.cert";
+                private-key = toBase64Blob "${eapCerts}/client1.key";
+                private-key-password-flags = "4";
+              };
+            };
+            networking.wireless = {
+              # it is a bit unfortunate that wpa-supplicant is equated with
+              # `wireless` when it also works for wired connections
+              enable = lib.mkOverride 9 true;
+              driver = "wired";
+            };
+          };
+        };
+
+        testScript = ''
+          start_all()
+          client.wait_for_unit("NetworkManager.service")
+          router.wait_for_unit("freeradius.service")
+          router.wait_for_unit("hostapd.service")
+          router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"")
+          router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"")
+        '';
+      };
+    eapFiles = {
+      name = "eap / 802.1x with secrets in stored in files";
+      nodes = {
+        router = import ./router-eap.nix { inherit eapCerts; };
+        client = clientConfig {
+          environment.etc = {
+            "wpa_supplicant/ca.cert" = {
+              source = "${eapCerts}/ca.cert";
+              user = "wpa_supplicant";
+              mode = "0400";
+            };
+            "wpa_supplicant/client1.cert" = {
+              source = "${eapCerts}/client1.cert";
+              user = "wpa_supplicant";
+              mode = "0400";
+            };
+            "wpa_supplicant/client1.key" = {
+              source = "${eapCerts}/client1.key";
+              user = "wpa_supplicant";
+              mode = "0400";
+            };
+          };
+          networking.networkmanager.ensureProfiles.profiles.default = {
+            ipv4.method = "auto";
+            "802-1x" = {
+              eap = "tls";
+              identity = "client1.example.com";
+              ca-cert = "/etc/wpa_supplicant/ca.cert";
+              client-cert = "/etc/wpa_supplicant/client1.cert";
+              private-key = "/etc/wpa_supplicant/client1.key";
+              private-key-password-flags = "4";
+            };
+          };
+          networking.wireless = {
+            enable = lib.mkOverride 9 true;
+            driver = "wired";
+          };
+        };
+      };
+
+      testScript = ''
+        start_all()
+        client.wait_for_unit("NetworkManager.service")
+        router.wait_for_unit("freeradius.service")
+        router.wait_for_unit("hostapd.service")
+        router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"")
+        router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"")
+      '';
+    };
   };
 in
 lib.mapAttrs (lib.const (

nixos/tests/networking/router-eap.nix

@@ -0,0 +1,146 @@
+{ eapCerts }:
+{ config, pkgs, ... }:
+let
+  radiusDir =
+    let
+      eapConfig = builtins.toFile "eap.conf" ''
+        eap {
+            default_eap_type = tls
+            timer_expire = 60
+            ignore_unknown_eap_types = no
+
+            tls {
+                # Path to CA certificate
+                ca_file = ''${certdir}/ca.cert
+
+                # Path to server certificate and private key
+                certificate_file = ''${certdir}/server.cert
+                private_key_file = ''${certdir}/server.key
+
+                # Enable mutual authentication
+                require_client_cert = yes
+
+                # Cipher suite (example)
+                ciphers = "DEFAULT"
+            }
+        }
+      '';
+      clientsConfig = builtins.toFile "client.conf" ''
+        client localhost {
+          ipaddr = 127.0.0.1
+          secret = insecure
+          require_message_authenticator = no
+        }
+      '';
+
+      # sample users file, not used for eap-tls, only for e.g. eap-ttls
+      usersConfig = builtins.toFile "users.conf" ''
+        testuser	Cleartext-Password := "supersecret"
+      '';
+
+      # this constructs the freeradius config directory
+      # it starts with the upstream config, then overwrites certain files
+      # and uses the generated certs from eapCerts
+      buildScript = pkgs.writeShellApplication {
+        name = "builder";
+
+        runtimeInputs = [ pkgs.coreutils ];
+
+        # https://www.shellcheck.net/wiki/SC2154 -- out is referenced but not assigned.
+        excludeShellChecks = [ "SC2154" ];
+
+        text = ''
+          cp --recursive  ${pkgs.freeradius}/etc/* "$out"
+          chmod +w -R "$out"
+          cp --force ${eapCerts}/ca.cert "$out/certs/ca.cert"
+          cp --force ${eapCerts}/ca.key "$out/certs/ca.key"
+          cp --force ${eapCerts}/server.cert "$out/certs/server.cert"
+          cp --force ${eapCerts}/server.key "$out/certs/server.key"
+          cp --force ${eapConfig} "$out/mods-enabled/eap"
+          cp --force ${usersConfig} "$out/users"
+          cp --force ${clientsConfig} "$out/clients.conf"
+        '';
+      };
+    in
+    derivation {
+      name = "radius_dir";
+      builder = "${pkgs.bash}/bin/bash";
+      args = [ "${buildScript}/bin/builder" ];
+      inherit (pkgs) system;
+    };
+  inherit (pkgs) lib;
+  vlanIfs = lib.range 1 (lib.length config.virtualisation.vlans);
+in
+{
+  virtualisation.vlans = [
+    1
+    2
+    3
+  ];
+  boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+  networking = {
+    useDHCP = false;
+    useNetworkd = true;
+    firewall.checkReversePath = true;
+    firewall.allowedUDPPorts = [ 547 ];
+    interfaces = lib.mkOverride 0 (
+      lib.listToAttrs (
+        lib.forEach vlanIfs (
+          n:
+          lib.nameValuePair "eth${toString n}" {
+            ipv4.addresses = [
+              {
+                address = "192.168.${toString n}.1";
+                prefixLength = 24;
+              }
+            ];
+            ipv6.addresses = [
+              {
+                address = "fd00:1234:5678:${toString n}::1";
+                prefixLength = 64;
+              }
+            ];
+          }
+        )
+      )
+    );
+  };
+
+  services.freeradius = {
+    enable = true;
+    configDir = radiusDir;
+    debug = true;
+  };
+
+  # upstream nixpkgs hostapd is focused on Wifi
+  systemd.services.hostapd =
+    let
+      hostapdConfig = builtins.toFile "hostapd.conf" ''
+        interface=eth1
+        driver=wired
+        logger_stdout=-1
+        logger_stdout_level=1
+        debug=2
+        dump_file=/tmp/hostapd.dump
+        ieee8021x=1
+        eap_reauth_period=3600
+        use_pae_group_addr=1
+        ##### RADIUS configuration ####################################################
+        own_ip_addr=127.0.0.1
+        nas_identifier=ap.example.com
+        auth_server_addr=127.0.0.1
+        auth_server_port=1812
+        auth_server_shared_secret=insecure
+      '';
+    in
+    {
+      description = "IEEE 802.11 Host Access-Point Daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.hostapd}/bin/hostapd ${hostapdConfig}";
+        Restart = "always";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        RuntimeDirectory = "hostapd";
+      };
+    };
+}

pkgs/applications/audio/mmlgui/default.nix

@@ -6,9 +6,9 @@
   pkg-config,
   glfw,
   libvgm,
-  libX11,
-  libXau,
-  libXdmcp,
+  libx11,
+  libxau,
+  libxdmcp,
   cppunit,
 }:
 
@@ -55,9 +55,9 @@ stdenv.mkDerivation {
     libvgm
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libX11
-    libXau
-    libXdmcp
+    libx11
+    libxau
+    libxdmcp
   ];
 
   checkInputs = [

pkgs/applications/audio/open-music-kontrollers/generic.nix

@@ -7,8 +7,8 @@
   ninja,
   lv2,
   sord,
-  libX11,
-  libXext,
+  libx11,
+  libxext,
   glew,
   lv2lint,
   pname,
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
   buildInputs = [
     lv2
     sord
-    libX11
-    libXext
+    libx11
+    libxext
     glew
     lv2lint
   ]

pkgs/applications/audio/rakarrack/default.nix

@@ -6,8 +6,8 @@
   alsa-utils,
   fltk,
   libjack2,
-  libXft,
-  libXpm,
+  libxft,
+  libxpm,
   libjpeg,
   libpng,
   libsamplerate,
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
     alsa-utils
     fltk
     libjack2
-    libXft
-    libXpm
+    libxft
+    libxpm
     libjpeg
     libpng
     libsamplerate

pkgs/applications/audio/zynaddsubfx/default.nix

@@ -36,8 +36,8 @@
   fltk,
   libGL,
   libjpeg,
-  libX11,
-  libXpm,
+  libx11,
+  libxpm,
   ntk,
 
   # Test dependencies
@@ -116,16 +116,16 @@ stdenv.mkDerivation rec {
   ++ lib.optionals (guiModule == "fltk") [
     fltk
     libjpeg
-    libXpm
+    libxpm
   ]
   ++ lib.optionals (guiModule == "ntk") [
     ntk
     cairo
-    libXpm
+    libxpm
   ]
   ++ lib.optionals (guiModule == "zest") [
     libGL
-    libX11
+    libx11
   ];
 
   cmakeFlags = [

pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix

@@ -8,7 +8,7 @@
   ruby,
   libGL,
   libuv,
-  libX11,
+  libx11,
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libGL
     libuv
-    libX11
+    libx11
   ];
 
   # Force optimization to fix:

pkgs/applications/display-managers/sddm/unwrapped.nix

@@ -7,7 +7,7 @@
   pkg-config,
   qttools,
   libxcb,
-  libXau,
+  libxau,
   pam,
   qtbase,
   qtdeclarative,
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libxcb
-    libXau
+    libxau
     pam
     qtbase
     qtdeclarative

pkgs/applications/editors/android-studio-for-platform/common.nix

@@ -25,12 +25,12 @@
   fontsConf,
   fontconfig,
   freetype,
-  libX11,
-  libXext,
-  libXi,
-  libXrandr,
-  libXrender,
-  libXtst,
+  libx11,
+  libxext,
+  libxi,
+  libxrandr,
+  libxrender,
+  libxtst,
   makeFontsConf,
   makeWrapper,
   ncurses5,
@@ -107,14 +107,14 @@ let
             # Crash at startup without these
             fontconfig
             freetype
-            libXext
-            libXi
-            libXrender
-            libXtst
-            libX11
+            libxext
+            libxi
+            libxrender
+            libxtst
+            libx11
 
             # Support multiple monitors
-            libXrandr
+            libxrandr
 
             # For GTKLookAndFeel
             gtk2

pkgs/applications/editors/android-studio/common.nix

@@ -34,7 +34,7 @@
   libpng,
   libuuid,
   libsecret,
-  libX11,
+  libx11,
   libxcb,
   libxkbcommon,
   mesa-demos,
@@ -44,15 +44,15 @@
   libxcb-image,
   libxcb-cursor,
   libxkbfile,
-  libXcomposite,
-  libXcursor,
-  libXdamage,
-  libXext,
-  libXfixes,
-  libXi,
-  libXrandr,
-  libXrender,
-  libXtst,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxi,
+  libxrandr,
+  libxrender,
+  libxtst,
   makeWrapper,
   ncurses5,
   nspr,
@@ -141,10 +141,10 @@ let
             # Crash at startup without these
             fontconfig
             freetype
-            libXext
-            libXi
-            libXrender
-            libXtst
+            libxext
+            libxi
+            libxrender
+            libxtst
             libsecret
 
             # No crash, but attempted to load at startup
@@ -159,7 +159,7 @@ let
             zlib
             pkgsi686Linux.zlib
             # Support multiple monitors
-            libXrandr
+            libxrandr
 
             # For Android emulator
             alsa-lib
@@ -168,7 +168,7 @@ let
             libbsd
             libpulseaudio
             libuuid
-            libX11
+            libx11
             libxcb
             libxkbcommon
             libxcb-wm
@@ -179,10 +179,10 @@ let
             libice
             libsm
             libxkbfile
-            libXcomposite
-            libXcursor
-            libXdamage
-            libXfixes
+            libxcomposite
+            libxcursor
+            libxdamage
+            libxfixes
             libGL
             libdrm
             libpng

pkgs/applications/editors/cudatext/default.nix

@@ -5,7 +5,7 @@
   coreutils,
   lazarus,
   fpc,
-  libX11,
+  libx11,
 
   # GTK2/3
   pango,
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional (widgetset == "qt5") libsForQt5.wrapQtAppsHook;
 
   buildInputs = [
-    libX11
+    libx11
   ]
   ++ lib.optionals (lib.hasPrefix "gtk" widgetset) [
     pango

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -4,14 +4,14 @@
   makeDesktopItem,
   freetype,
   fontconfig,
-  libX11,
-  libXrender,
+  libx11,
+  libxrender,
   zlib,
   jdk,
   glib,
   glib-networking,
   gtk,
-  libXtst,
+  libxtst,
   libsecret,
   gsettings-desktop-schemas,
   webkitgtk_4_1,
@@ -52,9 +52,9 @@ stdenv.mkDerivation rec {
     gsettings-desktop-schemas
     gtk
     jdk
-    libX11
-    libXrender
-    libXtst
+    libx11
+    libxrender
+    libxtst
     libsecret
     zlib
   ]
@@ -73,8 +73,8 @@ stdenv.mkDerivation rec {
       lib.makeLibraryPath [
         freetype
         fontconfig
-        libX11
-        libXrender
+        libx11
+        libxrender
         zlib
       ]
     } $libCairo
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
           [
             glib
             gtk
-            libXtst
+            libxtst
             libsecret
           ]
           ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1

pkgs/applications/editors/eclipse/default.nix

@@ -6,12 +6,12 @@
   makeWrapper,
   freetype,
   fontconfig,
-  libX11,
-  libXrender,
+  libx11,
+  libxrender,
   zlib,
   glib,
   gtk3,
-  libXtst,
+  libxtst,
   jdk,
   gsettings-desktop-schemas,
   webkitgtk_4_1 ? null, # for internal web browser
@@ -56,13 +56,13 @@ let
       makeDesktopItem
       freetype
       fontconfig
-      libX11
-      libXrender
+      libx11
+      libxrender
       zlib
       jdk
       glib
       gtk
-      libXtst
+      libxtst
       gsettings-desktop-schemas
       webkitgtk_4_1
       makeWrapper

pkgs/applications/editors/emacs/make-emacs.nix

@@ -30,12 +30,12 @@
   harfbuzz,
   imagemagick,
   jansson,
-  libXaw,
-  libXcursor,
-  libXft,
-  libXi,
-  libXpm,
-  libXrandr,
+  libxaw,
+  libxcursor,
+  libxft,
+  libxi,
+  libxpm,
+  libxrandr,
   libgccjit,
   libjpeg,
   libotf,
@@ -314,7 +314,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withPgtk [
     giflib
     gtk3
-    libXpm
+    libxpm
     libjpeg
     libpng
     librsvg
@@ -335,9 +335,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withX [
     Xaw3d
     giflib
-    libXaw
-    libXpm
-    libXrandr
+    libxaw
+    libxpm
+    libxrandr
     libjpeg
     libpng
     librsvg
@@ -347,10 +347,10 @@ stdenv.mkDerivation (finalAttrs: {
     cairo
   ]
   ++ lib.optionals (withX && !withCairo) [
-    libXft
+    libxft
   ]
   ++ lib.optionals withXinput2 [
-    libXi
+    libxi
   ]
   ++ lib.optionals withWebkitgtk [
     webkitgtk_4_1
@@ -485,7 +485,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withX && toolkit == "lucid") ''
-    patchelf --add-rpath ${lib.makeLibraryPath [ libXcursor ]} $out/bin/emacs
+    patchelf --add-rpath ${lib.makeLibraryPath [ libxcursor ]} $out/bin/emacs
     patchelf --add-needed "libXcursor.so.1" "$out/bin/emacs"
   '';
 

pkgs/applications/editors/jetbrains/builder/linux.nix

@@ -21,7 +21,7 @@
   glibcLocales,
   fontconfig,
   libGL,
-  libX11,
+  libx11,
 
   jdk,
   vmopts ? null,
@@ -85,7 +85,7 @@ lib.extendMkDerivation {
         stdenv.cc.cc
         fontconfig
         libGL
-        libX11
+        libx11
       ];
 
       nativeBuildInputs = nativeBuildInputs ++ [

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -12,7 +12,7 @@
   musl,
   libice,
   libsm,
-  libX11,
+  libx11,
   dotnetCorePackages,
   libxcb-keysyms,
   expat,
@@ -75,7 +75,7 @@ in
     # Avalonia dependencies needed for dotMemory
     libice
     libsm
-    libX11
+    libx11
   ];
 
   # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed

pkgs/applications/editors/vim/full.nix

@@ -16,14 +16,14 @@
   perl,
   tcl,
   ruby,
-  libX11,
-  libXext,
+  libx11,
+  libxext,
   libsm,
-  libXpm,
-  libXt,
-  libXaw,
-  libXau,
-  libXmu,
+  libxpm,
+  libxt,
+  libxaw,
+  libxau,
+  libxmu,
   libsodium,
   libice,
   wayland-scanner,
@@ -179,13 +179,13 @@ stdenv.mkDerivation {
   ++ lib.optionals (guiSupport == "gtk2" || guiSupport == "gtk3") [
     libsm
     libice
-    libX11
-    libXext
-    libXpm
-    libXt
-    libXaw
-    libXau
-    libXmu
+    libx11
+    libxext
+    libxpm
+    libxt
+    libxaw
+    libxau
+    libxmu
   ]
   ++ lib.optional (guiSupport == "gtk2") gtk2-x11
   ++ lib.optional (guiSupport == "gtk3") gtk3-x11

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15188,6 +15188,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  telescope-ast-grep-nvim = buildVimPlugin {
+    pname = "telescope-ast-grep.nvim";
+    version = "0-unstable-2023-11-05";
+    src = fetchFromGitHub {
+      owner = "ray-x";
+      repo = "telescope-ast-grep.nvim";
+      rev = "fa7d7fa5c723b57bba333429224e99fde2a63632";
+      hash = "sha256-WPzFG8gdf0XzxsFkxgseOy6GQBu9C2KDOXeasdct0F8=";
+    };
+    meta.homepage = "https://github.com/ray-x/telescope-ast-grep.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   telescope-asynctasks-nvim = buildVimPlugin {
     pname = "telescope-asynctasks.nvim";
     version = "0-unstable-2022-04-09";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1166,6 +1166,7 @@ https://github.com/wellle/targets.vim/,,
 https://github.com/tbabej/taskwiki/,,
 https://github.com/tomtom/tcomment_vim/,,
 https://github.com/nvim-telekasten/telekasten.nvim/,,
+https://github.com/ray-x/telescope-ast-grep.nvim/,HEAD,
 https://github.com/GustavoKatel/telescope-asynctasks.nvim/,,
 https://github.com/nvim-telescope/telescope-cheat.nvim/,,
 https://github.com/fannheyward/telescope-coc.nvim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.25";
-    hash = "sha256-9x9wDngiHfjUHTsUEraF7pUjbHlmcT7VotiPV9bPwIo=";
+    version = "2.1.34";
+    hash = "sha256-qCvgb2fs0t3hlI36egvlZYem8CzUKIAipaEZOumDtWk=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/default.nix

@@ -481,8 +481,8 @@ let
         mktplcRef = {
           publisher = "ban";
           name = "spellright";
-          version = "3.0.146";
-          hash = "sha256-gvj5vWA8VAy5Ohtkn9vsx7MswgVAcxYOLm+ifKhjLz0=";
+          version = "3.0.148";
+          hash = "sha256-h1xKEpKg4j7mGw3EQQDPZBDBDY/xjk2lsGk0ktd2ems=";
         };
         meta = {
           description = "Visual Studio Code extension for Spellchecker";
@@ -675,8 +675,8 @@ let
         mktplcRef = {
           name = "markdown-mermaid";
           publisher = "bierner";
-          version = "1.31.0";
-          hash = "sha256-7KpyUXR3a7ZD9bcdJ4t5HRjSAlUww8q6XSOcxHCN4Cw=";
+          version = "1.31.1";
+          hash = "sha256-K3UXNT3MpGlhyHcx0AYAkCPEJIbYIu3e/ucIAQLwoEQ=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/bierner.markdown-mermaid/changelog";
@@ -727,8 +727,8 @@ let
         mktplcRef = {
           name = "vscode-intelephense-client";
           publisher = "bmewburn";
-          version = "1.16.1";
-          hash = "sha256-dcfFtVnk5qyCeiM0nZwscKQZDhUXIkg1TJxVUuzA69Q=";
+          version = "1.16.5";
+          hash = "sha256-ppWHZFQfC2bje1rNZh8Pu+BKQdAI60kpxRwUg8EfD8M=";
         };
         meta = {
           description = "PHP code intelligence for Visual Studio Code";
@@ -1727,8 +1727,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.29.1";
-          hash = "sha256-U5DkTMNLoE9TDCa+Womml9ilv162FqVsnkyGsJ80+Ag=";
+          version = "0.29.2";
+          hash = "sha256-6Bga51DCHaVn+UV5RPCE7uFsAei/F0xN4Mk4dm52FWs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -1965,8 +1965,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.67.5";
-          hash = "sha256-xttk9mP5XIeeymE0l0TI+JsC862yOaEuwb6HscDyRMU=";
+          version = "6.68.1";
+          hash = "sha256-ZNdtaVo3KFGhGX99fGv/aSUcjy636W5e4DctPCMrRtY=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4840,8 +4840,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.67";
-          hash = "sha256-Q/wJZ+ObCU+hRpZZKQGQtdt99/I6QHkSuHlNy7oe5Pk=";
+          version = "0.0.68";
+          hash = "sha256-5qzMT7aue8PO4mpMsoBc/18J7yhxrmKwA+KE+LeK0mU=";
         };
         meta = {
           description = "VSCode language extension for Uiua";
@@ -5215,8 +5215,8 @@ let
         mktplcRef = {
           name = "csharp-ls";
           publisher = "vytautassurvila";
-          version = "0.0.29";
-          hash = "sha256-0gh7q/F69OD/soRuZHHxC9PRtOXJmjZjei6IbV82Rgs=";
+          version = "0.0.30";
+          hash = "sha256-BVSazrQxVm4yYBVdtFP3Aojl06xI2msFXIGw64LeePY=";
         };
         meta = {
           changelog = "https://github.com/vytautassurvila/vscode-csharp-ls/blob/master/CHANGELOG.md";

pkgs/applications/editors/vscode/extensions/language-packs.nix

@@ -13,7 +13,7 @@ let
   buildVscodeLanguagePack =
     {
       language,
-      version ? "1.105.2025100809",
+      version ? "1.108.2026012809",
       hash,
     }:
     buildVscodeMarketplaceExtension {
@@ -41,71 +41,71 @@ in
   # French
   vscode-language-pack-fr = buildVscodeLanguagePack {
     language = "fr";
-    hash = "sha256-HFpkXUYz7//5KlKe1NjiT/KBFBar9H5ivpltqGOTHJo=";
+    hash = "sha256-1+aWgvoXR/FqhnIn3OrLOC11jLXVWlO2yecpzr2Waww=";
   };
   # Italian
   vscode-language-pack-it = buildVscodeLanguagePack {
     language = "it";
-    hash = "sha256-YD1jTB9VzWF51QaFPRsEBC1pMkgrs2cl0HFA/PFz3ro=";
+    hash = "sha256-t6jN3qok7B4/G/IjEXD6THO6c+8X+1gxny6W7qdh5mI=";
   };
   # German
   vscode-language-pack-de = buildVscodeLanguagePack {
     language = "de";
-    hash = "sha256-hIw0nFdYgcyOuJW8k7HRS0sKc0Gsuh7YWyLwQ3Z1FkU=";
+    hash = "sha256-rZM/T1gbYrtcHNLW0itNdhKcRR938PwK5VBN0xLDIWg=";
   };
   # Spanish
   vscode-language-pack-es = buildVscodeLanguagePack {
     language = "es";
-    hash = "sha256-iO+1Lq/vXkMCGNnj9CovBhLPtbuJtGHSfQnjXypRBcw=";
+    hash = "sha256-PG3oOCjWRgh1ox6GAPRdZdf8QNP1JsJZznJnM+2Ihl0=";
   };
   # Russian
   vscode-language-pack-ru = buildVscodeLanguagePack {
     language = "ru";
-    hash = "sha256-HxTStM+g/XKJH1twNYMu/V7IM7vBlYF4mfcemV+oOQI=";
+    hash = "sha256-RPpNet015xGnOszcKfehP9VxnfDAnQJ2A62rVtNBDew=";
   };
   # Chinese (Simplified)
   vscode-language-pack-zh-hans = buildVscodeLanguagePack {
     language = "zh-hans";
-    hash = "sha256-nCPu7pEXpM22M+2IMtuPgxzyEF3R6MPm2CVZAccPdAU=";
+    hash = "sha256-pm1dCoK4YM8XBM/O6p42R4PYy5f95sLcECHJMAKFt9Q=";
   };
   # Chinese (Traditional)
   vscode-language-pack-zh-hant = buildVscodeLanguagePack {
     language = "zh-hant";
-    hash = "sha256-JKKqrwGn/EMDMot1cIgLpekUVQf4IY+snENeKoE5jYU=";
+    hash = "sha256-cSM+2W5aCUA77kxgV7vyk7KAoSlkeT+y56ziIPjP9II=";
   };
   # Japanese
   vscode-language-pack-ja = buildVscodeLanguagePack {
     language = "ja";
-    hash = "sha256-6OWcr/XnJsOvRFho+P5Z+ppuAC8d08I3s0YWnLhH874=";
+    hash = "sha256-UfMMLKHi48Qhgm8PXFAfGFQFX6e8vQsl/RYqha42TOc=";
   };
   # Korean
   vscode-language-pack-ko = buildVscodeLanguagePack {
     language = "ko";
-    hash = "sha256-VqlAaS679KF0ZKlzDT55FIu5GKyzU41y1ptX7t88UHc=";
+    hash = "sha256-gneZF4CIEDy88juFZBiB9/o/rzTnu2du4aiZ+NH+XlE=";
   };
   # Czech
   vscode-language-pack-cs = buildVscodeLanguagePack {
     language = "cs";
-    hash = "sha256-yFtp+XK7Y2Fi/uYqsh88d3hCRcQJhJOLWvs2pQ05ddo=";
+    hash = "sha256-ojh2KBEpTTJsAgM2RilGO58kkcWgaFf5nkiiZ4gYNtg=";
   };
   # Portuguese (Brazil)
   vscode-language-pack-pt-br = buildVscodeLanguagePack {
     language = "pt-BR";
-    hash = "sha256-2zM8E832ioa6fqnWzPq+PA/eiEAo8FDNNH/4HJPZIcI=";
+    hash = "sha256-n55nI9gCxNpr6Pq70qJnmgp2rs0Gcblirg4SaeXAXtE=";
   };
   # Turkish
   vscode-language-pack-tr = buildVscodeLanguagePack {
     language = "tr";
-    hash = "sha256-7ghSb/sQM64wfsRRtS+quAqJEvUdIXAcPCQKJbsDXKc=";
+    hash = "sha256-S6orhrfCaA4aeLhW3+rdaJb4X8h7IUjfBC9A+QgiQgk=";
   };
   # Polish
   vscode-language-pack-pl = buildVscodeLanguagePack {
     language = "pl";
-    hash = "sha256-/joZpsIAY9Ut67wAbzNTraBgBgtjDAeRoq8PUbP3rSc=";
+    hash = "sha256-YoNl44f2jEYXIhDKz+xU5fzt/JD6l86dtbqXFKOzHrk=";
   };
   # Pseudo Language
   vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
     language = "qps-ploc";
-    hash = "sha256-xERSh5N5Mbyc977ji0n91ra0RV9ZldJKBzc3IWYWYyo=";
+    hash = "sha256-onc+lk6itrWP5J17eVLIMcpG1gDM/rpTzKci8m2uBcY=";
   };
 }

pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "debugpy";
     publisher = "ms-python";
-    version = "2025.16.0";
-    hash = "sha256-QPIDUzzwIfzyicsCwqU2u6hVSjCJMInHhHMBqvL8tYs=";
+    version = "2025.18.0";
+    hash = "sha256-UegvlhgIjbwv9SgZIdtzX8FDOL9qjBLOFm0jaTexNrQ=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ndonfris";
     name = "fish-lsp";
-    version = "0.1.18";
-    hash = "sha256-skNFNiVx7g/lpsxegTync9yEjt+h/Eb+5TnByeLXSPY=";
+    version = "0.1.19";
+    hash = "sha256-xvt8pI+Esqm4klOzSa2GPd4y00lTED5uN+VFCHTY56w=";
   };
 
   meta = {

pkgs/applications/emulators/kega-fusion/default.nix

@@ -10,10 +10,10 @@
   gtk2,
   alsa-lib,
   libsm,
-  libX11,
+  libx11,
   gdk-pixbuf,
   pango,
-  libXinerama,
+  libxinerama,
   mpg123,
   runtimeShell,
 }:
@@ -27,10 +27,10 @@ let
     gtk2
     alsa-lib
     libsm
-    libX11
+    libx11
     gdk-pixbuf
     pango
-    libXinerama
+    libxinerama
   ];
 
 in

pkgs/applications/emulators/libretro/cores/citra.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libGL,
   libGLU,
-  libX11,
+  libx11,
   mkLibretroCore,
 }:
 mkLibretroCore {
@@ -29,7 +29,7 @@ mkLibretroCore {
   extraBuildInputs = [
     libGL
     libGLU
-    libX11
+    libx11
   ];
 
   extraNativeBuildInputs = [ cmake ];

pkgs/applications/emulators/libretro/cores/snes9x.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2026-01-26";
+  version = "0-unstable-2026-02-03";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "830d8552551d7a71e9d084f727dc15cf15d9796c";
-    hash = "sha256-Xu3s1z4Pab71D2orv7HyL8b3E59AnQEAil0XeWKfKdw=";
+    rev = "02f642cdadfaa8f9fa7ec674382d6c70a8b534d6";
+    hash = "sha256-4BqWxchxdq8pbWw3Iql786Iu/OY5VMT1pF8wowI26h0=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/mame/default.nix

@@ -12,8 +12,8 @@
   fontconfig,
   glm,
   installShellFiles,
-  libXi,
-  libXinerama,
+  libxi,
+  libxinerama,
   libjpeg,
   libpcap,
   libpulseaudio,
@@ -93,8 +93,8 @@ stdenv.mkDerivation rec {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
     libpulseaudio
-    libXinerama
-    libXi
+    libxinerama
+    libxi
     fontconfig
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/applications/emulators/wine/base.nix

@@ -18,7 +18,7 @@
   pkg-config,
   nixosTests,
   supportFlags,
-  wineRelease,
+  pnameSuffix ? "",
   patches,
   moltenvk,
   buildScript ? null,
@@ -95,9 +95,7 @@ stdenv.mkDerivation (
   // {
     inherit version src;
 
-    pname =
-      prevName
-      + lib.optionalString (wineRelease != "stable" && wineRelease != "unstable") "-${wineRelease}";
+    pname = prevName + pnameSuffix;
 
     # Fixes "Compiler cannot create executables" building wineWow with mingwSupport
     strictDeps = true;
@@ -267,7 +265,8 @@ stdenv.mkDerivation (
         )
       )
     );
-    env.NIX_CFLAGS_COMPILE = lib.optionalString (wineRelease == "yabridge") "-std=gnu17";
+    # Just here to avoid rebuilds for now.
+    env.NIX_CFLAGS_COMPILE = "";
 
     # Don't shrink the ELF RPATHs in order to keep the extra RPATH
     # elements specified above.

pkgs/applications/emulators/wine/default.nix

@@ -48,11 +48,38 @@
 }:
 
 let
-  wine-build =
-    build:
-    lib.getAttr build (
-      callPackage ./packages.nix {
-        inherit wineRelease;
+  sources = callPackage ./sources.nix { };
+
+  # Map user-facing release names to sources, pname suffix, and staging flag
+  releaseInfo = {
+    stable = {
+      src = sources.stable;
+      useStaging = false;
+    };
+    unstable = {
+      src = sources.unstable;
+      useStaging = false;
+    };
+    # Many versions have a "staging" variant, but when we say "staging",
+    # the version we want to use is "unstable".
+    staging = {
+      src = sources.unstable;
+      pnameSuffix = "-staging";
+      useStaging = true;
+    };
+    # "yabridge" enables staging too --- we are not interested in
+    # yabridge without the staging patches applied.
+    yabridge = {
+      src = sources.yabridge;
+      pnameSuffix = "-yabridge";
+      useStaging = true;
+    };
+  };
+
+  baseWine = lib.getAttr wineBuild (
+    callPackage ./packages.nix (
+      releaseInfo.${wineRelease}
+      // {
         supportFlags = {
           inherit
             alsaSupport
@@ -90,6 +117,14 @@ let
         };
         inherit moltenvk;
       }
-    );
+    )
+  );
 in
-wine-build wineBuild
+if wineRelease == "yabridge" then
+  baseWine.overrideAttrs (old: {
+    env = old.env // {
+      NIX_CFLAGS_COMPILE = "-std=gnu17";
+    };
+  })
+else
+  baseWine

pkgs/applications/emulators/wine/packages.nix

@@ -7,7 +7,9 @@
   callPackage,
   replaceVars,
   moltenvk,
-  wineRelease ? "stable",
+  src,
+  pnameSuffix ? "",
+  useStaging ? false,
   supportFlags,
   # Staging native build deps
   autoconf,
@@ -18,19 +20,6 @@
 }:
 
 let
-  sources = callPackage ./sources.nix { };
-
-  # "staging" of course enables staging, but for "yabridge" we do too
-  # --- we are not interested in yabridge without the staging patches
-  # applied.
-  useStaging = wineRelease == "staging" || wineRelease == "yabridge";
-
-  # Map wineRelease to actual source. Many versions have a "staging"
-  # variant, but when we say "staging", the version we want to use is
-  # "unstable".
-  baseRelease = if wineRelease == "staging" then "unstable" else wineRelease;
-
-  src = lib.getAttr baseRelease (callPackage ./sources.nix { });
   inherit (src)
     version
     patches
@@ -48,7 +37,7 @@ in
       supportFlags
       patches
       moltenvk
-      wineRelease
+      pnameSuffix
       useStaging
       # Forcing these `nativeBuildInputs` used in the `staging` to come
       # from ambient `pkgs`, rather than being provided by
@@ -76,7 +65,7 @@ in
       supportFlags
       patches
       moltenvk
-      wineRelease
+      pnameSuffix
       useStaging
       ;
     pkgArches = [ pkgs ];
@@ -98,7 +87,7 @@ in
       supportFlags
       patches
       moltenvk
-      wineRelease
+      pnameSuffix
       useStaging
       ;
     stdenv = stdenv_32bit;
@@ -132,7 +121,7 @@ in
       version
       patches
       moltenvk
-      wineRelease
+      pnameSuffix
       useStaging
       ;
     supportFlags = supportFlags // {

pkgs/applications/emulators/wine/sources.nix

@@ -254,8 +254,8 @@ rec {
 
   winetricks = fetchFromGitHub rec {
     # https://github.com/Winetricks/winetricks/releases
-    version = "20250102";
-    hash = "sha256-Km2vVTYsLs091cjmNTW8Kqku3vdsEA0imTtZfqZWDQo=";
+    version = "20260125";
+    hash = "sha256-uIBVESebsH7rXnxWd/qlrZxcG7Y486PctHzcLz29HDk=";
     owner = "Winetricks";
     repo = "winetricks";
     rev = version;

pkgs/applications/emulators/wine/winetricks.nix

@@ -2,20 +2,23 @@
   lib,
   stdenv,
   callPackage,
-  perl,
-  which,
-  coreutils,
-  zenity,
-  curl,
-  cabextract,
-  unzip,
-  p7zip,
-  gnused,
-  gnugrep,
+  makeWrapper,
   bash,
+  cabextract,
+  coreutils,
+  curl,
   gawk,
+  gnugrep,
+  gnused,
   gnutar,
   gzip,
+  p7zip,
+  perl,
+  unzip,
+  which,
+  zenity,
+  unrar-free,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,36 +30,49 @@ stdenv.mkDerivation rec {
   buildInputs = [
     perl
     which
-  ];
-
-  # coreutils is for sha1sum
-  pathAdd = lib.makeBinPath [
-    perl
-    which
-    coreutils
-    zenity
-    curl
-    cabextract
-    unzip
-    p7zip
-    gnused
-    gnugrep
-    bash
-    gawk
-    gnutar
-    gzip
+    makeWrapper
   ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
   doCheck = false; # requires "bashate"
 
-  postInstall = ''
-    sed -i \
-      -e '2i PATH="${pathAdd}:$PATH"' \
-      "$out/bin/winetricks"
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  postPatch = ''
+    patchShebangs src/winetricks
+    substituteInPlace src/winetricks \
+      --replace-fail 'command -v unrar' 'command -v unrar-free' \
+      --replace-fail 'w_try unrar' 'w_try unrar-free'
   '';
 
+  postInstall =
+    let
+      runtimeDependencies = [
+        bash
+        cabextract
+        coreutils
+        curl
+        gawk
+        gnugrep
+        gnused
+        gnutar
+        gzip
+        p7zip
+        perl
+        unrar-free
+        unzip
+        which
+        zenity
+      ];
+    in
+    ''
+      wrapProgram $out/bin/winetricks \
+        --prefix PATH : "${lib.makeBinPath runtimeDependencies}" \
+        --set WINETRICKS_LATEST_VERSION_CHECK "disabled"
+    '';
+
   passthru = {
     inherit (src) updateScript;
   };

pkgs/applications/emulators/zsnes/2.x.nix

@@ -6,7 +6,7 @@
   libGL,
   libGLU,
   libpng,
-  libX11,
+  libx11,
   nasm,
   pkg-config,
   zlib,
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libGLU
     libpng
-    libX11
+    libx11
     zlib
   ];
 

pkgs/applications/graphics/ImageMagick/6.x.nix

@@ -9,9 +9,9 @@
   zlibSupport ? true,
   zlib,
   libX11Support ? !stdenv.hostPlatform.isMinGW,
-  libX11,
+  libx11,
   libXtSupport ? !stdenv.hostPlatform.isMinGW,
-  libXt,
+  libxt,
   fontconfigSupport ? true,
   fontconfig,
   freetypeSupport ? true,
@@ -130,8 +130,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional freetypeSupport freetype
   ++ lib.optional libjpegSupport libjpeg
   ++ lib.optional lcms2Support lcms2
-  ++ lib.optional libX11Support libX11
-  ++ lib.optional libXtSupport libXt
+  ++ lib.optional libX11Support libx11
+  ++ lib.optional libXtSupport libxt
   ++ lib.optional libwebpSupport libwebp;
 
   doCheck = false; # fails 2 out of 76 tests

pkgs/applications/graphics/ImageMagick/default.nix

@@ -9,9 +9,9 @@
   zlibSupport ? true,
   zlib,
   libX11Support ? !stdenv.hostPlatform.isMinGW,
-  libX11,
+  libx11,
   libXtSupport ? !stdenv.hostPlatform.isMinGW,
-  libXt,
+  libxt,
   fontconfigSupport ? true,
   fontconfig,
   freetypeSupport ? true,
@@ -158,8 +158,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional freetypeSupport freetype
   ++ lib.optional libjpegSupport libjpeg
   ++ lib.optional lcms2Support lcms2
-  ++ lib.optional libX11Support libX11
-  ++ lib.optional libXtSupport libXt
+  ++ lib.optional libX11Support libx11
+  ++ lib.optional libXtSupport libxt
   ++ lib.optional libwebpSupport libwebp
   ++ lib.optional fftwSupport fftw;
 

pkgs/applications/graphics/imlibsetroot/default.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  libX11,
+  libx11,
   libxinerama,
   imlib2,
 }:
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [
-    libX11
+    libx11
     imlib2
     libxinerama
   ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
     gcc -g imlibsetroot.c -o imlibsetroot              \
       -I${imlib2.dev}/include -L${imlib2}/lib -lImlib2 \
-      -I${libX11.dev}/include -lXinerama -lX11
+      -I${libx11.dev}/include -lXinerama -lX11
 
     runHook postBuild
   '';

pkgs/applications/graphics/inkscape/default.nix

@@ -32,7 +32,7 @@
   libsigcxx,
   libvisio,
   libwpg,
-  libXft,
+  libxft,
   libxml2,
   libxslt,
   readline,
@@ -160,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsigcxx
     libvisio
     libwpg
-    libXft
+    libxft
     libxml2
     libxslt
     readline

pkgs/applications/graphics/rawtherapee/default.nix

@@ -12,14 +12,14 @@
   libdatrie,
   libxkbcommon,
   libepoxy,
-  libXtst,
+  libxtst,
   wrapGAppsHook3,
   makeWrapper,
   pixman,
   libpthread-stubs,
   gtkmm3,
-  libXau,
-  libXdmcp,
+  libxau,
+  libxdmcp,
   lcms2,
   libiptcdata,
   fftw,
@@ -81,12 +81,12 @@ stdenv.mkDerivation rec {
     libdatrie
     libxkbcommon
     libepoxy
-    libXtst
+    libxtst
     pixman
     libpthread-stubs
     gtkmm3
-    libXau
-    libXdmcp
+    libxau
+    libxdmcp
     lcms2
     libiptcdata
     fftw

pkgs/applications/graphics/sane/frontends.nix

@@ -5,7 +5,7 @@
   fetchpatch,
   autoconf,
   sane-backends,
-  libX11,
+  libx11,
   gtk2,
   pkg-config,
   libusb-compat-0_1 ? null,
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     sane-backends
-    libX11
+    libx11
     gtk2
   ]
   ++ lib.optional (libusb-compat-0_1 != null) libusb-compat-0_1;

pkgs/applications/graphics/sxiv/default.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libXft,
+  libxft,
   imlib2,
   giflib,
   libexif,
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   preBuild = lib.optionalString (conf != null) "cp ${configFile} config.def.h";
 
   buildInputs = [
-    libXft
+    libxft
     imlib2
     giflib
     libexif

pkgs/applications/graphics/unigine-sanctuary/default.nix

@@ -4,10 +4,10 @@
   fetchurl,
   makeWrapper,
   autoPatchelfHook,
-  libX11,
-  libXext,
-  libXrandr,
-  libXinerama,
+  libx11,
+  libxext,
+  libxrandr,
+  libxinerama,
   libglvnd,
   openal,
   glibc,
@@ -80,10 +80,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     stdenv.cc.cc
-    libX11
-    libXext
-    libXrandr
-    libXinerama
+    libx11
+    libxext
+    libxrandr
+    libxinerama
   ];
 
   dontUnpack = true;

pkgs/applications/graphics/unigine-superposition/default.nix

@@ -7,17 +7,17 @@
   fontconfig,
   zlib,
   qtquickcontrols2,
-  libXinerama,
+  libxinerama,
   libxcb,
   libsm,
-  libXi,
+  libxi,
   libglvnd,
-  libXext,
-  libXrandr,
+  libxext,
+  libxrandr,
   mailspring,
-  libX11,
+  libx11,
   libice,
-  libXrender,
+  libxrender,
   autoPatchelfHook,
   makeWrapper,
   xkeyboard_config,
@@ -52,17 +52,17 @@ let
       fontconfig
       zlib
       qtquickcontrols2
-      libXinerama
+      libxinerama
       libxcb
       libsm
-      libXi
+      libxi
       libglvnd
-      libXext
-      libXrandr
+      libxext
+      libxrandr
       mailspring
-      libX11
+      libx11
       libice
-      libXrender
+      libxrender
     ];
 
     installPhase = ''
@@ -109,17 +109,17 @@ buildFHSEnv {
     fontconfig
     zlib
     qtquickcontrols2
-    libXinerama
+    libxinerama
     libxcb
     libsm
-    libXi
+    libxi
     libglvnd
-    libXext
-    libXrandr
+    libxext
+    libxrandr
     mailspring
-    libX11
+    libx11
     libice
-    libXrender
+    libxrender
     openal
   ];
   runScript = "superposition";

pkgs/applications/graphics/unigine-tropics/default.nix

@@ -4,10 +4,10 @@
   fetchurl,
   makeWrapper,
   autoPatchelfHook,
-  libX11,
-  libXext,
-  libXrandr,
-  libXinerama,
+  libx11,
+  libxext,
+  libxrandr,
+  libxinerama,
   libglvnd,
   openal,
   glibc,
@@ -78,10 +78,10 @@ stdenv.mkDerivation {
 
   buildInputs = [
     stdenv.cc.cc
-    libX11
-    libXext
-    libXrandr
-    libXinerama
+    libx11
+    libxext
+    libxrandr
+    libxinerama
   ];
 
   dontUnpack = true;

pkgs/applications/misc/avalonia-ilspy/default.nix

@@ -4,13 +4,13 @@
   fetchFromGitHub,
   buildDotnetModule,
   dotnetCorePackages,
-  libX11,
+  libx11,
   libice,
   libsm,
-  libXi,
-  libXcursor,
-  libXext,
-  libXrandr,
+  libxi,
+  libxcursor,
+  libxext,
+  libxrandr,
   fontconfig,
   glew,
   makeDesktopItem,
@@ -59,13 +59,13 @@ buildDotnetModule rec {
 
   runtimeDeps = [
     # Avalonia UI
-    libX11
+    libx11
     libice
     libsm
-    libXi
-    libXcursor
-    libXext
-    libXrandr
+    libxi
+    libxcursor
+    libxext
+    libxrandr
     fontconfig
     glew
   ];

pkgs/applications/misc/goldendict-ng/default.nix

@@ -16,7 +16,7 @@
   fmt,
   bzip2,
   libiconv,
-  libXtst,
+  libxtst,
   qtbase,
   qtsvg,
   qtwebengine,
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     hunspell
     xz
     lzo
-    libXtst
+    libxtst
     bzip2
     libiconv
     opencc

pkgs/applications/misc/goldendict/default.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   pkg-config,
-  libXtst,
+  libxtst,
   libvorbis,
   hunspell,
   lzo,
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     qtx11extras
-    libXtst
+    libxtst
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     bzip2

pkgs/applications/misc/googleearth-pro/default.nix

@@ -8,10 +8,10 @@
   libGLU,
   libsm,
 
-  libXcomposite,
-  libXi,
-  libXrender,
-  libX11,
+  libxcomposite,
+  libxi,
+  libxrender,
+  libx11,
 
   libxcb,
   sqlite,
@@ -65,10 +65,10 @@ stdenv.mkDerivation rec {
     libGL
     libGLU
     libsm
-    libX11
-    libXcomposite
-    libXi
-    libXrender
+    libx11
+    libxcomposite
+    libxi
+    libxrender
     libproxy
     libxcb
     libxml2_13

pkgs/applications/misc/inochi2d/generic.nix

@@ -16,7 +16,7 @@
   zenity,
   luajit_2_1,
   libGL,
-  libX11,
+  libx11,
 
   builderArgs,
 }:
@@ -58,7 +58,7 @@ buildDubPackage (
       freetype
       SDL2
       libGL
-      libX11
+      libx11
     ];
 
     dontUseCmakeConfigure = true;

pkgs/applications/misc/kemai/default.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
 
   # buildInputs
-  libXScrnSaver,
+  libxscrnsaver,
   magic-enum,
 
   # nativeBuildInputs
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildInputs = [
-    libXScrnSaver
+    libxscrnsaver
     magic-enum
     qtbase
     qtconnectivity

pkgs/applications/misc/parsec/bin.nix

@@ -10,11 +10,11 @@
   openssl,
   udev,
   libglvnd,
-  libX11,
-  libXcursor,
-  libXi,
-  libXrandr,
-  libXfixes,
+  libx11,
+  libxcursor,
+  libxi,
+  libxrandr,
+  libxfixes,
   libpulseaudio,
   libva,
   ffmpeg_7,
@@ -43,7 +43,7 @@ stdenvNoCC.mkDerivation {
   buildInputs = [
     stdenv.cc.cc # libstdc++
     libglvnd
-    libX11
+    libx11
   ];
 
   runtimeDependenciesPath = lib.makeLibraryPath [
@@ -58,11 +58,11 @@ stdenvNoCC.mkDerivation {
     libpng
     libjpeg8
     curl
-    libX11
-    libXcursor
-    libXi
-    libXrandr
-    libXfixes
+    libx11
+    libxcursor
+    libxi
+    libxrandr
+    libxfixes
     vulkan-loader
   ];
 

pkgs/applications/misc/qMasterPassword/default.nix

@@ -2,8 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libX11,
-  libXtst,
+  libx11,
+  libxtst,
   cmake,
   qtbase,
   qttools,
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
     libscrypt
   ]
   ++ lib.optionals x11Support [
-    libX11
-    libXtst
+    libx11
+    libxtst
   ];
   nativeBuildInputs = [
     cmake

pkgs/applications/misc/qtbitcointrader/default.nix

@@ -5,14 +5,14 @@
   libsForQt5,
 }:
 
-stdenv.mkDerivation (finalAttr: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qtbitcointrader";
   version = "1.42.21";
 
   src = fetchFromGitHub {
     owner = "JulyIGHOR";
     repo = "QtBitcoinTrader";
-    tag = "v${finalAttr.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-u3+Kwn8KunYUpWCd55TQuVVfoSp8hdti93d6hk7Uqx8=";
   };
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttr: {
     libsForQt5.qtscript
   ];
 
-  sourceRoot = "${finalAttr.src.name}/src";
+  sourceRoot = "${finalAttrs.src.name}/src";
 
   configurePhase = ''
     runHook preConfigure

pkgs/applications/misc/redshift/default.nix

@@ -24,7 +24,7 @@
   withDrm ? stdenv.hostPlatform.isLinux,
   libdrm,
   withVidmode ? stdenv.hostPlatform.isLinux,
-  libXxf86vm,
+  libxxf86vm,
 
   withGeolocation ? true,
   withCoreLocation ? withGeolocation && stdenv.hostPlatform.isDarwin,
@@ -88,7 +88,7 @@ let
       ++ lib.optional withRandr libxcb
       ++ lib.optional withGeoclue geoclue
       ++ lib.optional withDrm libdrm
-      ++ lib.optional withVidmode libXxf86vm
+      ++ lib.optional withVidmode libxxf86vm
       ++ lib.optional withAppIndicator (
         if (pname != "gammastep") then libappindicator else libayatana-appindicator
       );

pkgs/applications/misc/rescuetime/default.nix

@@ -6,10 +6,10 @@
   wrapQtAppsHook,
   patchelf,
   qt5,
-  libXtst,
-  libXext,
-  libX11,
-  libXScrnSaver,
+  libxtst,
+  libxext,
+  libx11,
+  libxscrnsaver,
   writeScript,
   common-updater-scripts,
   curl,
@@ -53,10 +53,10 @@ stdenv.mkDerivation rec {
       --set-rpath "${
         lib.makeLibraryPath [
           qt5.qtbase
-          libXtst
-          libXext
-          libX11
-          libXScrnSaver
+          libxtst
+          libxext
+          libx11
+          libxscrnsaver
         ]
       }" \
       $out/bin/rescuetime

pkgs/applications/misc/subsurface/default.nix

@@ -24,7 +24,7 @@
   qtsvg,
   qttools,
   qtpositioning,
-  libXcomposite,
+  libxcomposite,
   bluez,
   writeScript,
 }:
@@ -89,7 +89,7 @@ let
     buildInputs = [
       qtbase
       qtlocation
-      libXcomposite
+      libxcomposite
     ];
 
     dontWrapQtApps = true;

pkgs/applications/misc/sweethome3d/linux.nix

@@ -11,7 +11,7 @@
   gsettings-desktop-schemas,
   p7zip,
   autoPatchelfHook,
-  libXxf86vm,
+  libxxf86vm,
   libGL,
   copyDesktopItems,
 
@@ -96,7 +96,7 @@ stdenv.mkDerivation {
     p7zip
     gtk3
     gsettings-desktop-schemas
-    libXxf86vm
+    libxxf86vm
   ];
 
   # upstream targets Java 7 by default

pkgs/applications/networking/browsers/chromium/common.nix

@@ -59,9 +59,9 @@
   glib,
   gtk3,
   dbus-glib,
-  libXScrnSaver,
-  libXcursor,
-  libXtst,
+  libxscrnsaver,
+  libxcursor,
+  libxtst,
   libxshmfence,
   libGLU,
   libGL,
@@ -70,7 +70,7 @@
   pciutils,
   protobuf,
   speechd-minimal,
-  libXdamage,
+  libxdamage,
   at-spi2-core,
   pipewire,
   libva,
@@ -365,9 +365,9 @@ let
       glib
       gtk3
       dbus-glib
-      libXScrnSaver
-      libXcursor
-      libXtst
+      libxscrnsaver
+      libxcursor
+      libxtst
       libxshmfence
       libGLU
       libGL
@@ -375,7 +375,7 @@ let
       pciutils
       protobuf
       speechd-minimal
-      libXdamage
+      libxdamage
       at-spi2-core
       pipewire
       libva
@@ -425,9 +425,9 @@ let
       glib
       gtk3
       dbus-glib
-      libXScrnSaver
-      libXcursor
-      libXtst
+      libxscrnsaver
+      libxcursor
+      libxtst
       libxshmfence
       libGLU
       libGL
@@ -436,7 +436,7 @@ let
       pciutils
       protobuf
       speechd-minimal
-      libXdamage
+      libxdamage
       at-spi2-core
       pipewire
       libva

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -9,7 +9,7 @@
   curl,
   dbus-glib,
   gtk3,
-  libXtst,
+  libxtst,
   libva,
   pciutils,
   pipewire,
@@ -92,7 +92,7 @@ stdenv.mkDerivation {
     adwaita-icon-theme
     alsa-lib
     dbus-glib
-    libXtst
+    libxtst
   ];
   runtimeDependencies = [
     curl

pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +0,0 @@
-{
-  "packageVersion": "147.0.1-3",
-  "source": {
-    "rev": "147.0.1-3",
-    "hash": "sha256-0BeC3zlL5cvnpTaPnKn26lT1XlvqBQuMc4rauNbeIIk="
-  },
-  "firefox": {
-    "version": "147.0.1",
-    "hash": "sha512-8eG8SGRRJU8zsAD7RRP9lIpaboSEGYDudnxC0ybhhW9EqEN8j9v/LLNNF3/qKxkH/Nct0zvOw/Bt242IFRhTqA=="
-  }
-}

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -13,7 +13,7 @@
   withGTK3 ? true,
   gtk3,
   libglvnd,
-  libXt,
+  libxt,
   libpulseaudio,
   makeDesktopItem,
   wrapGAppsHook3,
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     alsa-lib
     dbus-glib
     gtk2-x11
-    libXt
+    libxt
     (lib.getLib stdenv.cc.cc)
   ]
   ++ lib.optionals withGTK3 [

pkgs/applications/networking/cluster/k3s/1_32/chart-versions.nix

@@ -1,10 +1,10 @@
 {
   traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-37.1.1+up37.1.0.tgz";
-    sha256 = "0q568ffjhxmw87fzwafxlxrzx2lgcqlqbwj87pbc2xszh9pyakyd";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-38.0.201+up38.0.2.tgz";
+    sha256 = "1fxkdmk859nwn0x9iq0abdwb16njsang7257ppaj9s1if06fsncd";
   };
   traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-37.1.1+up37.1.0.tgz";
-    sha256 = "0gpcr6zfbncvp2sjjwzg732k4xfr5ba0pbc5x08lgwvibqpp4r27";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-38.0.201+up38.0.2.tgz";
+    sha256 = "16kzjy8dgswn4jfx62dn2ihmgpkzcfvjv6ync9zdi397fz32mqjv";
   };
 }

pkgs/applications/networking/cluster/k3s/1_32/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "6dfe83a7d8984a5fe6be63a429698ce3fc61761ce68e3f4f2c6f3ff96a349f37"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "572f512cc0bdf89213d2c532e6182d4a291663bb38a51beb57197bf3fb67dd47"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "9b6a7ea64b7b14a6c43613e4e170902e99c600857265875282f8d4b9dfefa6f4"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "a65a1ed1cf081285d4c32ed3989d95cb0a4d90209e99a8765b65d41b02ea059d"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "cbda428d59a8593267343fb32ad985bf2125f45860425f9b7b31bbea9d305046"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-arm.tar.gz",
+    "sha256": "ffaee35854e9bfa6f34fae0a7a2ff81e8909cfb2d5a5bd65df89c03a1ceb1b3a"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b1a253aab260beabea305517d8d57cce4594d2e071320d5700d389b29eb3c196"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-arm.tar.zst",
+    "sha256": "b92568a2fa8683a5abd29c151d12f2737bf7ac961dfa615a2fa891a66f2d23cf"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "0f6e598bf90b9ced4f1f758db6b0d7f8afbf9b5973d801d8a743c5b27ac3b748"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "cc99b0211110b8dc14c47cde0fe9b93b7e36c2ead64286412a896f6aa8a722cf"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "297beda34a0a2a7ff727fced94dba6f999636a4e9b2cdd6e30840cc0e746a4ee"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.11%2Bk3s3/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "a7ab99f7e2a6cf6ecc833c8ba67ba154b3ff186c58d574fa4bbda2e70dcb55f7"
   }
 }

pkgs/applications/networking/cluster/k3s/1_32/versions.nix

@@ -1,20 +1,20 @@
 {
-  k3sVersion = "1.32.11+k3s1";
-  k3sCommit = "8119508834f2503e3c7bace3125f5db6b038d377";
-  k3sRepoSha256 = "0fni4sh3a5flyrli7xxd9zxj9sh75kv79msy3zkfbgjxqz7rg4v9";
-  k3sVendorHash = "sha256-8gzvad5Cpkatc8158m9FBGnkGEbajn30alSPlzhor0E=";
+  k3sVersion = "1.32.11+k3s3";
+  k3sCommit = "c9aa1d2889a003715698542826c2af94160ac2e5";
+  k3sRepoSha256 = "0fi634dnsghjwnp07h6jhknccqlr9n5g3l34sipc41vvfmn4b0k8";
+  k3sVendorHash = "sha256-qbmqzsd8oMQSFCh7HvjDiYds5gLEIGjjcv4EJbgxfJI=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
   k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.8.0-k3s1";
-  k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
+  k3sCNIVersion = "1.9.0-k3s1";
+  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
   containerdVersion = "2.1.5-k3s1.32";
   containerdSha256 = "1fzld9q0ycfg9b3054qg70mif1p6i7xqikcbabrmxapk81fy83kn";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.31.0-k3s2";
-  flannelVersion = "v0.27.4";
-  flannelPluginVersion = "v1.8.0-flannel1";
+  flannelVersion = "v0.28.0";
+  flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s2.32";
   helmJobVersion = "v0.9.12-build20251215";

pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix

@@ -1,10 +1,10 @@
 {
   traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-37.1.1+up37.1.0.tgz";
-    sha256 = "0q568ffjhxmw87fzwafxlxrzx2lgcqlqbwj87pbc2xszh9pyakyd";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-38.0.201+up38.0.2.tgz";
+    sha256 = "1fxkdmk859nwn0x9iq0abdwb16njsang7257ppaj9s1if06fsncd";
   };
   traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-37.1.1+up37.1.0.tgz";
-    sha256 = "0gpcr6zfbncvp2sjjwzg732k4xfr5ba0pbc5x08lgwvibqpp4r27";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-38.0.201+up38.0.2.tgz";
+    sha256 = "16kzjy8dgswn4jfx62dn2ihmgpkzcfvjv6ync9zdi397fz32mqjv";
   };
 }

pkgs/applications/networking/cluster/k3s/1_33/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "47644f3141878535a1951fdaf03bc485001b50a58b8fb58d97c75c49ea38a1f0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "130a3b3e51947b7a0beffca422b85c2d3fbe78b1163a0fc069871877021123d3"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "9b6a7ea64b7b14a6c43613e4e170902e99c600857265875282f8d4b9dfefa6f4"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "b0d7062008fa7fcad9ad7c6b60f74ae1c561927dbb5a4105433f5afbd091361b"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "ee76f65f39a0ca12bbaa6bf9fdd5dc161b553b15a5746d47795cf0113916c063"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-arm.tar.gz",
+    "sha256": "6451f4bd29b4ab76dcbfa520d907425976a04e9d5044b969e81fa2dfdc085c20"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b1a253aab260beabea305517d8d57cce4594d2e071320d5700d389b29eb3c196"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-arm.tar.zst",
+    "sha256": "03a165ad40d022616281fbf329bcfa546b9245a9f431d1c362b86faff72d83dd"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "a2f534291abd4d6491dc669b46e437df1fe0cd7b573485ec30aa813510b22635"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "6243a503de28c17f4b1b16018237a5008bc99983dc3b3b87ed2a1fe790d9e211"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "87db88828e43179ef30a17ba66b416a3e398c4a00673908bd8d39ae4996ce300"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.7%2Bk3s3/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "74713adf726f6b407330b93e252b7a8e0a85204137c8a6f61b66f681b5761c42"
   }
 }

pkgs/applications/networking/cluster/k3s/1_33/versions.nix

@@ -1,20 +1,20 @@
 {
-  k3sVersion = "1.33.7+k3s1";
-  k3sCommit = "0b396d3f7f26e0c2ae5b6a114383830f533938c2";
-  k3sRepoSha256 = "0jkvm7c333zazabsxrjl6wkdsni1m5g5gamriyyf53lly9935wsf";
-  k3sVendorHash = "sha256-HpgcO/mUo64mkH38sAURnLOmXdXmHh3o6iDKtQeUt/E=";
+  k3sVersion = "1.33.7+k3s3";
+  k3sCommit = "1288e778af2a8ae295c47c213a3d13abd2969cde";
+  k3sRepoSha256 = "07274x0d0q7cn6x5g8d0zbyf67axrmchhngsjsp3plskyr313hcy";
+  k3sVendorHash = "sha256-XlZFYEGqoDGFlLJYRJDDoRPWuptFYkZT6axergChFN4=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
   k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.8.0-k3s1";
-  k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
+  k3sCNIVersion = "1.9.0-k3s1";
+  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
   containerdVersion = "2.1.5-k3s1.33";
   containerdSha256 = "15iw6px3710rlsx7j933i07qd4a2r7caagfjbhhfcp33m9k19v7h";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.33.0-k3s2";
-  flannelVersion = "v0.27.4";
-  flannelPluginVersion = "v1.8.0-flannel1";
+  flannelVersion = "v0.28.0";
+  flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s2";
   helmJobVersion = "v0.9.12-build20251215";

pkgs/applications/networking/cluster/k3s/1_34/chart-versions.nix

@@ -1,10 +1,10 @@
 {
   traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-37.1.1+up37.1.0.tgz";
-    sha256 = "0q568ffjhxmw87fzwafxlxrzx2lgcqlqbwj87pbc2xszh9pyakyd";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-38.0.201+up38.0.2.tgz";
+    sha256 = "1fxkdmk859nwn0x9iq0abdwb16njsang7257ppaj9s1if06fsncd";
   };
   traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-37.1.1+up37.1.0.tgz";
-    sha256 = "0gpcr6zfbncvp2sjjwzg732k4xfr5ba0pbc5x08lgwvibqpp4r27";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-38.0.201+up38.0.2.tgz";
+    sha256 = "16kzjy8dgswn4jfx62dn2ihmgpkzcfvjv6ync9zdi397fz32mqjv";
   };
 }

pkgs/applications/networking/cluster/k3s/1_34/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "499d7fb0b2eab200e9bf9b3935ce787a7fa0597933dce25ad091703933d6ecc8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "696c2e10f511295f5e0e6281a2f22eec60b33962d45bc9117703db1ac887e981"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "b8dff3265568e1be66ab72ac0ded68bd266fa37a32c010f1253dba6547a49ce8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "4805a6c4bfdfd20d3ad42bc14c79e00662739aca275e6a37cd8f3a406fae0f0a"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "170db25228c873741f895fced05f0e5bdbbddb8ffeb5e0342a5b8e44f3c28757"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-arm.tar.gz",
+    "sha256": "a4bc850fcf9b73bf0f45d4a1f50bd612e52d77daa5de5020589e7f99e5d1a3e6"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "27407fd1553c89b8ccd3b45ad0fbdcd483c1a010e7b28b60b24a8e73b58aa783"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-arm.tar.zst",
+    "sha256": "a1b0ac3a00f409fa51e196ea9db5f2282efff00a282ab797bf49b29453bb1379"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "e67cddf839571cd489aef44acb2aca82285a9789a170c1a44d51b7f8b6129883"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "ceea4427499fb39be0bff18f840cf80a091f63e88421bc89fdfceb8017aab59b"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "b6cb3c06f19859d3a5fba54b305097e89d2a86b5bce9e8360a46b9d2e67da565"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.3%2Bk3s3/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "e0cec00a1c19c8c6f7fde7005e325d285f23ff43752cce9ce0796ccb10e9582a"
   }
 }

pkgs/applications/networking/cluster/k3s/1_34/versions.nix

@@ -1,20 +1,20 @@
 {
-  k3sVersion = "1.34.3+k3s1";
-  k3sCommit = "48ffa7b6893f21b919b3029d54c9d9838ae426a1";
-  k3sRepoSha256 = "1177kzbhp6ihb7dzfdi1a0idgp69y1hwh6wnwvdx1fnivg2gj7aw";
-  k3sVendorHash = "sha256-dp8SU24nuy3WmG1Zln/J2nVHnVQmVyN78FBOSxNjbF8=";
+  k3sVersion = "1.34.3+k3s3";
+  k3sCommit = "2975fb0973ca47f54b1aa2a8c3a976a779f52349";
+  k3sRepoSha256 = "0bvccp573xihzbnkd3n6xldcxpnlwiz9b5p0fw6sxv69m7jaac2f";
+  k3sVendorHash = "sha256-R8QXwXmTKsONsbWaedFNDPdYZ82jaQ/T8S9sllqKPjk=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
   k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.8.0-k3s1";
-  k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
+  k3sCNIVersion = "1.9.0-k3s1";
+  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
   containerdVersion = "2.1.5-k3s1";
   containerdSha256 = "0n0g58d352i8wz0bqn87vgrd7z54j268cbmbp19fz68wmifm7fl8";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.34.0-k3s2";
-  flannelVersion = "v0.27.4";
-  flannelPluginVersion = "v1.8.0-flannel1";
+  flannelVersion = "v0.28.0";
+  flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s3";
   helmJobVersion = "v0.9.12-build20251215";

pkgs/applications/networking/cluster/k3s/1_35/chart-versions.nix

@@ -1,10 +1,10 @@
 {
   traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-37.1.1+up37.1.0.tgz";
-    sha256 = "0q568ffjhxmw87fzwafxlxrzx2lgcqlqbwj87pbc2xszh9pyakyd";
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-38.0.201+up38.0.2.tgz";
+    sha256 = "1fxkdmk859nwn0x9iq0abdwb16njsang7257ppaj9s1if06fsncd";
   };
   traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-37.1.1+up37.1.0.tgz";
-    sha256 = "0gpcr6zfbncvp2sjjwzg732k4xfr5ba0pbc5x08lgwvibqpp4r27";
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-38.0.201+up38.0.2.tgz";
+    sha256 = "16kzjy8dgswn4jfx62dn2ihmgpkzcfvjv6ync9zdi397fz32mqjv";
   };
 }

pkgs/applications/networking/cluster/k3s/1_35/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "af7ce67f0a8c457618a492ba995cc645d8ad13512008b88db97719941c39389a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "8a1c1f25d62d3395fbb2b37d55cf3d836ca4bc68e6358d21b6573f42d295c6f0"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "2e3d6d14bbbeb8c16f1849cca8da48887c5a7ddceb1cc2bf60be63e4fa8c63f3"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "4805a6c4bfdfd20d3ad42bc14c79e00662739aca275e6a37cd8f3a406fae0f0a"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "82cf1310db1bfac5733c5c16864034c6c7c7affc60c39be610ce7cf169631ef5"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-arm.tar.gz",
+    "sha256": "8659dda950ab0ddff37b2c8d59f527489e1accde30f652b6c3b434385825b8b5"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "27407fd1553c89b8ccd3b45ad0fbdcd483c1a010e7b28b60b24a8e73b58aa783"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-arm.tar.zst",
+    "sha256": "fab2006d48153f278332504c1aa8b03e5683c14924f66ecbd5eeb7db3a5dedd9"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "cb3d24f44c9f29da3421e99db0801f2a30b3e16c7032c423a9b631c0fc66a5fa"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "ec9a3d8b04445afe24093dd0f4e65a1da6b3a5d73f3c739746aaa8ec0aaa03cb"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "b6cb3c06f19859d3a5fba54b305097e89d2a86b5bce9e8360a46b9d2e67da565"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.0%2Bk3s3/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "4c6a31ffa5bc267986f47f36396c51232f55b5db22253630bf7e8b48ea41084f"
   }
 }

pkgs/applications/networking/cluster/k3s/1_35/versions.nix

@@ -1,20 +1,20 @@
 {
-  k3sVersion = "1.35.0+k3s1";
-  k3sCommit = "a6c6cd15c0c42ec9fce21f8ad5f42aa74fddb4f2";
-  k3sRepoSha256 = "0033m0vbysy2bcjfmam387580j1cmq6cys8diismgf8m5s64nivb";
-  k3sVendorHash = "sha256-S9GkT87C8qbuefH93Y6d0Y95NNuT6paNdDkmSDllFIY=";
+  k3sVersion = "1.35.0+k3s3";
+  k3sCommit = "323b95245012f0d56a863d8c23964399814191c2";
+  k3sRepoSha256 = "1h6az9xj074pj8s60p2yw9gbqz2dabrxvrq41igcw0nq7ymcwaaz";
+  k3sVendorHash = "sha256-4Qs03mrOJBxsyQe4RrDG9vvS23JwjUPhPec/TebS4Yw=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.0";
   k3sRootSha256 = "008n8xx7x36y9y4r24hx39xagf1dxbp3pqq2j53s9zkaiqc62hd0";
-  k3sCNIVersion = "1.8.0-k3s1";
-  k3sCNISha256 = "04xig5spp81l81781ixmk99ghiz8lk0p16zhcbja5mslfdjmc7vg";
+  k3sCNIVersion = "1.9.0-k3s1";
+  k3sCNISha256 = "0naqf3jkxz3rd9ljd40wbm8walgi2bx6d1l9wr6mcvrgj7d5g28c";
   containerdVersion = "2.1.5-k3s1";
   containerdSha256 = "0n0g58d352i8wz0bqn87vgrd7z54j268cbmbp19fz68wmifm7fl8";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.35.0-k3s2";
-  flannelVersion = "v0.27.4";
-  flannelPluginVersion = "v1.8.0-flannel1";
+  flannelVersion = "v0.28.0";
+  flannelPluginVersion = "v1.9.0-flannel1";
   kubeRouterVersion = "v2.6.3-k3s1";
   criDockerdVersion = "v0.3.19-k3s3";
   helmJobVersion = "v0.9.12-build20251215";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,13 +45,13 @@
     "vendorHash": "sha256-6sVapd0vqL4xGLqTQS4zQIlnMA8HRmjufDi1lOgldlU="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-JcNbhR9qeakHWTDu4tF3Sl2G5zfcohNEsK87znI5hiM=",
+    "hash": "sha256-NL2UmL4wLBbdT5DW7uGYOBQwPN0nQUP54gtFwc2PcB8=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.269.0",
+    "rev": "v1.270.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ogQLStDbsM0aRf4QIbITB8Z+L9DUtZwoAPK6T4xylXI="
+    "vendorHash": "sha256-Hvk2jckla1LcMankcdUTct8Kea0OznyxDxTJ+UrJHy0="
   },
   "aminueza_minio": {
     "hash": "sha256-rgrX08mO99cl95YTW0rqFH/jJhyxMr/DSIEL5Wg9R9s=",
@@ -526,11 +526,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-uAaWBctVH61wMz12hX3DnayVn6LK1e3aUM2SQBNx3QQ=",
+    "hash": "sha256-ZqR6UjG+3KUuqnru5CycUcjWxLwCiQdpsIPR2UiY3g8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.58.0",
+    "rev": "v4.59.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1409,11 +1409,11 @@
     "vendorHash": "sha256-l6EzevVL6YxLLq9QWcGZv9Go+0sUToLubHbMeNL1vJg="
   },
   "ucloud_ucloud": {
-    "hash": "sha256-mPTejWXREIBjEZVb660bUUnyj3z7hgfKPrUsSVvMx7A=",
+    "hash": "sha256-UOVnfWYhntmRHMApQgemjUBsyUIz0bexsc1gwDGGee4=",
     "homepage": "https://registry.terraform.io/providers/ucloud/ucloud",
     "owner": "ucloud",
     "repo": "terraform-provider-ucloud",
-    "rev": "v1.39.1",
+    "rev": "v1.39.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -32,17 +32,17 @@
   libpulseaudio,
   libuuid,
   libva,
-  libX11,
-  libXScrnSaver,
-  libXcomposite,
-  libXcursor,
-  libXdamage,
-  libXext,
-  libXfixes,
-  libXi,
-  libXrandr,
-  libXrender,
-  libXtst,
+  libx11,
+  libxscrnsaver,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxi,
+  libxrandr,
+  libxrender,
+  libxtst,
   libxcb,
   libxshmfence,
   libgbm,
@@ -116,10 +116,10 @@ stdenv.mkDerivation (finalAttrs: {
     cups
     libdrm
     libuuid
-    libXdamage
-    libX11
-    libXScrnSaver
-    libXtst
+    libxdamage
+    libx11
+    libxscrnsaver
+    libxtst
     libxcb
     libxshmfence
     libgbm
@@ -153,24 +153,24 @@ stdenv.mkDerivation (finalAttrs: {
       gtk3
       libglvnd
       libnotify
-      libX11
-      libXcomposite
+      libx11
+      libxcomposite
       libunity
       libuuid
       libva
-      libXcursor
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXrandr
-      libXrender
-      libXtst
+      libxcursor
+      libxdamage
+      libxext
+      libxfixes
+      libxi
+      libxrandr
+      libxrender
+      libxtst
       nspr
       libxcb
       pango
       pipewire
-      libXScrnSaver
+      libxscrnsaver
       libappindicator-gtk3
       libdbusmenu
       wayland

pkgs/applications/networking/instant-messengers/linphone/mediastreamer2/default.nix

@@ -5,8 +5,8 @@
   glew,
   gsm,
   lib,
-  libX11,
-  libXext,
+  libx11,
+  libxext,
   libopus,
   libpulseaudio,
   libsForQt5,
@@ -47,8 +47,8 @@ mkLinphoneDerivation (finalAttrs: {
 
     ffmpeg_4
     glew
-    libX11
-    libXext
+    libx11
+    libxext
     libpulseaudio
     libv4l
     speex

pkgs/applications/networking/instant-messengers/pidgin/default.nix

@@ -18,8 +18,8 @@
   lib,
   libice,
   libsm,
-  libXScrnSaver,
-  libXext,
+  libxscrnsaver,
+  libxext,
   libgcrypt,
   libgnt,
   libidn,
@@ -76,8 +76,8 @@ let
         gst_all_1.gstreamer
         libice
         libsm
-        libXScrnSaver
-        libXext
+        libxscrnsaver
+        libxext
         libgnt
         libidn
         libstartup_notification

pkgs/applications/networking/instant-messengers/profanity/default.nix

@@ -20,8 +20,8 @@
   readline,
   sqlite,
   autoAwaySupport ? true,
-  libXScrnSaver,
-  libX11,
+  libxscrnsaver,
+  libx11,
   notifySupport ? true,
   libnotify,
   gdk-pixbuf,
@@ -77,8 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
   ]
   ++ lib.optionals autoAwaySupport [
-    libXScrnSaver
-    libX11
+    libxscrnsaver
+    libx11
   ]
   ++ lib.optionals notifySupport [
     libnotify

pkgs/applications/networking/instant-messengers/psi-plus/default.nix

@@ -11,7 +11,7 @@
   qttools,
   libidn,
   qca-qt5,
-  libXScrnSaver,
+  libxscrnsaver,
   hunspell,
   libsecret,
   libgcrypt,
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     qtx11extras
     libidn
     qca-qt5
-    libXScrnSaver
+    libxscrnsaver
     hunspell
     libsecret
     libgcrypt

pkgs/applications/networking/instant-messengers/psi/default.nix

@@ -11,7 +11,7 @@
   qtwebengine,
   libidn,
   qca-qt5,
-  libXScrnSaver,
+  libxscrnsaver,
   hunspell,
 }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     qtwebengine
     libidn
     qca-qt5
-    libXScrnSaver
+    libxscrnsaver
     hunspell
   ];
 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix

@@ -13,14 +13,14 @@
   openh264,
   crc32c,
   libvpx,
-  libX11,
-  libXtst,
-  libXcomposite,
-  libXdamage,
-  libXext,
-  libXrender,
-  libXrandr,
-  libXi,
+  libx11,
+  libxtst,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxrender,
+  libxrandr,
+  libxi,
   glib,
   abseil-cpp,
   pipewire,
@@ -80,14 +80,14 @@ stdenv.mkDerivation {
     abseil-cpp
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libX11
-    libXtst
-    libXcomposite
-    libXdamage
-    libXext
-    libXrender
-    libXrandr
-    libXi
+    libx11
+    libxtst
+    libxcomposite
+    libxdamage
+    libxext
+    libxrender
+    libxrandr
+    libxi
     glib
     pipewire
     libgbm

pkgs/applications/networking/instant-messengers/vacuum/default.nix

@@ -11,8 +11,8 @@
   cmake,
   openssl,
   xorgproto,
-  libX11,
-  libXScrnSaver,
+  libx11,
+  libxscrnsaver,
   xz,
   zlib,
 }:
@@ -39,8 +39,8 @@ stdenv.mkDerivation {
     qtwebkit
     openssl
     xorgproto
-    libX11
-    libXScrnSaver
+    libx11
+    libxscrnsaver
     xz
     zlib
   ];

pkgs/applications/networking/p2p/eiskaltdcpp/default.nix

@@ -7,7 +7,7 @@
   pkg-config,
   wrapQtAppsHook,
   bzip2,
-  libX11,
+  libx11,
   qtbase,
   qttools,
   qtmultimedia,
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     qtmultimedia
     qtscript
     bzip2
-    libX11
+    libx11
     pcre-cpp
     libidn
     lua5