Merge 055fdf03b0 into haskell-updates

2026-01-24 21:26:30 +00:00
parent 0aa332c7e2 055fdf03b0
commit 6299d7eaae
328 changed files with 5901 additions and 4287 deletions
@@ -65,5 +65,5 @@ jobs:
        with:
          issue-number: 105153
          body: |
-            Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+            Periodic merge from `${{ inputs.from }}` into `[${{ inputs.into }}](https://github.com/NixOS/nixpkgs/tree/${{ inputs.into }})` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
          token: ${{ steps.app-token.outputs.token }}
@@ -20,7 +20,7 @@ let
  # Extract attributes that changed from by-name paths.
  # This allows pinging reviewers for pure refactors.
  touchedattrs = lib.pipe changedpaths [
-    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed))
+    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed && changed != "pkgs/by-name/README.md"))
    (map (lib.splitString "/"))
    (map (path: lib.elemAt path 3))
    lib.unique
@@ -74,6 +74,8 @@

 - `lima` has been updated from `1.x` to `2.x`. This major update includes several breaking changes, such as `/tmp/lima` no longer being mounted by default.

+- `mercure` has been update to `0.21.4` (or later). Version [0.21.0](https://github.com/dunglas/mercure/releases/v0.21.0) and [0.21.2](https://github.com/dunglas/mercure/releases/tag/v0.21.2) introduce breaking changes to the package.
+
 - `n8n` has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.

 - `gurk-rs` has been updated from `0.6.4` to `0.8.0`. Version `0.8.0` includes breaking changes. For more information read the [release notes for 0.8.0](https://github.com/boxdot/gurk-rs/releases/tag/v0.8.0).
@@ -105,12 +105,14 @@ let
      # network
      network = callLibs ./network;

+      # flakes
+      flakes = callLibs ./flakes.nix;
+
      inherit (builtins)
        getContext
        hasContext
        convertHash
        hashString
-        hasFile
        parseDrvName
        placeholder
        fromJSON
@@ -391,6 +393,8 @@ let
        toInt
        toIntBase10
        fileContents
+        appendContext
+        unsafeDiscardStringContext
        ;
      inherit (self.stringsWithDeps)
        textClosureList
@@ -415,7 +419,13 @@ let
        renameCrossIndexTo
        mapCrossIndex
        ;
-      inherit (self.derivations) lazyDerivation optionalDrvAttr warnOnInstantiate;
+      inherit (self.derivations)
+        lazyDerivation
+        optionalDrvAttr
+        warnOnInstantiate
+        addDrvOutputDependencies
+        unsafeDiscardOutputDependency
+        ;
      inherit (self.generators) mkLuaInline;
      inherit (self.meta)
        addMetaAttrs
@@ -443,6 +453,9 @@ let
        dirOf
        isPath
        packagesFromDirectoryRecursive
+        hashFile
+        readDir
+        readFileType
        ;
      inherit (self.sources)
        cleanSourceFilter
@@ -593,6 +606,10 @@ let
      inherit (self.network.ipv6)
        mkEUI64Suffix
        ;
+      inherit (self.flakes)
+        parseFlakeRef
+        flakeRefToString
+        ;
    }
  );
 in
@@ -21,6 +21,11 @@ let
    if pkg ? meta.position && isString pkg.meta.position then "${prefix}${pkg.meta.position}" else "";
 in
 {
+  inherit (builtins)
+    addDrvOutputDependencies
+    unsafeDiscardOutputDependency
+    ;
+
  /**
    Restrict a derivation to a predictable set of attribute names, so
    that the returned attrset is not strict in the actual derivation,
@@ -31,6 +31,12 @@ in
    isPath
    ;

+  inherit (builtins)
+    readDir
+    readFileType
+    hashFile
+    ;
+
  /**
    The type of a path. The path needs to exist and be accessible.
    The result is either `"directory"` for a directory, `"regular"` for a
@@ -0,0 +1,12 @@
+/**
+  Flake operations.
+*/
+{ lib }:
+{
+
+  inherit (builtins)
+    parseFlakeRef
+    flakeRefToString
+    ;
+
+}
@@ -39,6 +39,7 @@ rec {
    toJSON
    typeOf
    unsafeDiscardStringContext
+    appendContext
    ;

  /**
@@ -15919,6 +15919,12 @@
      { fingerprint = "9C68 989F ECF9 8993 3225  96DD 970A 6794 990C 52AE"; }
    ];
  };
+  maj0e = {
+    email = "contact@markusjoerg.com";
+    github = "maj0e";
+    githubId = 57637846;
+    name = "Markus Jörg";
+  };
  majesticmullet = {
    email = "hoccthomas@gmail.com.au";
    github = "MajesticMullet";
@@ -18149,6 +18155,13 @@
    githubId = 9636071;
    name = "Myrl Hex";
  };
+  MysteryBlokHed = {
+    name = "Adam Thompson-Sharpe";
+    email = "hi@adamts.me";
+    github = "MysteryBlokHed";
+    githubId = 13910387;
+    keys = [ { fingerprint = "086E EF20 D54E D348 E5BA  6263 16E9 43E6 596F FB4E"; } ];
+  };
  myypo = {
    email = "nikirsmcgl@gmail.com";
    github = "myypo";
@@ -20745,6 +20758,12 @@
    githubId = 20472367;
    name = "Peter Hebden";
  };
+  pixel-87 = {
+    email = "edwardoliverthomas@gmail.com";
+    github = "pixel-87";
+    githubId = 149434768;
+    name = "Ed Thomas";
+  };
  pixelsergey = {
    email = "sergey.ichtchenko@gmail.com";
    github = "PixelSergey";
@@ -20,6 +20,8 @@

 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).

+- [rqbit](https://github.com/ikatson/rqbit), a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as [services.rqbit](#opt-services.rqbit.enable).
+
 - [Tailscale Serve](https://tailscale.com/kb/1552/tailscale-services), configure Tailscale Serve for exposing local services to your tailnet. Available as [services.tailscale.serve](#opt-services.tailscale.serve.enable).

 - [qui](https://github.com/autobrr/qui), a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as [services.qui](#opt-services.qui.enable).
@@ -128,6 +130,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - [services.resolved](#opt-services.resolved.enable) module was converted to RFC42-style settings. The moved options have also been renamed to match the upstream names. Aliases mean current configs will continue to function, but users should move to the new options as convenient.

+- Support for Bluetooth audio based on `bluez-alsa` has been added to the `hardware.alsa` module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option.
+
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.

 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
@@ -611,6 +611,7 @@
  ./services/display-managers/default.nix
  ./services/display-managers/dms-greeter.nix
  ./services/display-managers/gdm.nix
+  ./services/display-managers/generic.nix
  ./services/display-managers/greetd.nix
  ./services/display-managers/lemurs.nix
  ./services/display-managers/ly.nix
@@ -1555,6 +1556,7 @@
  ./services/torrent/peerflix.nix
  ./services/torrent/qbittorrent.nix
  ./services/torrent/qui.nix
+  ./services/torrent/rqbit.nix
  ./services/torrent/rtorrent.nix
  ./services/torrent/torrentstream.nix
  ./services/torrent/transmission.nix
@@ -38,7 +38,7 @@ in
        Whether interactive shells should show which Nix package (if
        any) provides a missing command.

-        Requires nix-channels to be set and downloaded (sudo nix-channels --update.)
+        Requires nix-channels to be set and downloaded (sudo nix-channel --update.)

        See also nix-index and nix-index-database as an alternative for flakes-based systems.

@@ -19,7 +19,7 @@ if (! -e $dbPath) {
    print STDERR "This tool requires nix-channels to generate the database for the `nixos` channel.\n";
    print STDERR "\n";
    print STDERR "If you are using nix-channels you can run:\n";
-    print STDERR "    sudo nix-channels --update\n";
+    print STDERR "    sudo nix-channel --update\n";
    print STDERR "\n";
    print STDERR "If you are using flakes, see nix-index and nix-index-database.\n";
    print STDERR "\n";
@@ -44,9 +44,15 @@ let
    in
    lib.forEach options (i: "options ${i.driver} index=${toList i.ids} id=${toList i.names}");

-  defaultDeviceVars = {
+  pluginsPath = pkgs.symlinkJoin {
+    name = "alsa-with-plugins";
+    paths = cfg.plugins;
+  };
+
+  alsaVariables = {
    "ALSA_AUDIO_OUT" = cfg.defaultDevice.playback;
    "ALSA_AUDIO_IN" = cfg.defaultDevice.capture;
+    "ALSA_PLUGIN_DIR" = lib.mkIf (cfg.plugins != [ ]) "${pluginsPath}/lib/alsa-lib";
  };

 in
@@ -106,6 +112,8 @@ in

    enableOSSEmulation = lib.mkEnableOption "the OSS emulation";

+    enableBluetooth = lib.mkEnableOption "Bluetooth audio support via BlueALSA";
+
    enableRecorder = lib.mkOption {
      type = lib.types.bool;
      default = false;
@@ -125,6 +133,15 @@ in
      '';
    };

+    plugins = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.bluez-alsa ]";
+      description = ''
+        List of ALSA plugins to be added to the search path.
+      '';
+    };
+
    defaultDevice.playback = lib.mkOption {
      type = lib.types.str;
      default = "";
@@ -392,8 +409,8 @@ in
      };

      # Set default PCM devices
-      environment.sessionVariables = defaultDeviceVars;
-      systemd.globalEnvironment = defaultDeviceVars;
+      environment.sessionVariables = alsaVariables;
+      systemd.globalEnvironment = alsaVariables;

      environment.etc."asound.conf".text = cfg.config;

@@ -412,6 +429,33 @@ in
      environment.systemPackages = [ pkgs.alsa-utils ];
    })

+    (lib.mkIf (cfg.enable && cfg.enableBluetooth) {
+
+      users.users.bluealsa = {
+        description = "BlueALSA daemons user";
+        isSystemUser = true;
+        group = "audio";
+      };
+
+      # Link ALSA configuration
+      environment.etc."alsa/conf.d/20-bluealsa.conf".source =
+        "${pkgs.bluez-alsa}/etc/alsa/conf.d/20-bluealsa.conf";
+
+      # Install plugin
+      hardware.alsa.plugins = [ pkgs.bluez-alsa ];
+
+      # Install CLI tools and systemd units
+      environment.systemPackages = [ pkgs.bluez-alsa ];
+      systemd.packages = [ pkgs.bluez-alsa ];
+
+      # See Nixpkgs issue #81138
+      systemd.services."bluealsa".wantedBy = [ "bluetooth.target" ];
+
+      # Note: bluealsa-aplay is available but we don't start it
+      # by default, it's only needed to make the machine act as
+      # bluetooth speaker
+    })
+
    (lib.mkIf config.hardware.alsa.enablePersistence {

      # Install udev rules for restoring card settings on boot
@@ -40,26 +40,7 @@ in
 {
  options = {
    services.displayManager = {
-      enable = lib.mkEnableOption "systemd's display-manager service";
-
-      preStart = lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        example = "rm -f /var/log/my-display-manager.log";
-        description = "Script executed before the display manager is started.";
-      };
-
-      execCmd = lib.mkOption {
-        type = lib.types.str;
-        example = lib.literalExpression ''"''${pkgs.lightdm}/bin/lightdm"'';
-        description = "Command to start the display manager.";
-      };
-
-      environment = lib.mkOption {
-        type = with lib.types; attrsOf unspecified;
-        default = { };
-        description = "Additional environment variables needed by the display manager.";
-      };
+      enable = lib.mkEnableOption "shared display manager integration";

      hiddenUsers = lib.mkOption {
        type = with lib.types; listOf str;
@@ -250,50 +231,5 @@ in
        else
          null;
    };
-
-    # so that the service won't be enabled when only startx is used
-    systemd.services.display-manager.enable =
-      let
-        dmConf = config.services.xserver.displayManager;
-        noDmUsed =
-          !(
-            cfg.gdm.enable
-            || cfg.sddm.enable
-            || dmConf.xpra.enable
-            || dmConf.lightdm.enable
-            || cfg.ly.enable
-            || cfg.lemurs.enable
-          );
-      in
-      lib.mkIf noDmUsed (lib.mkDefault false);
-
-    systemd.services.display-manager = {
-      description = "Display Manager";
-      after = [
-        "acpid.service"
-        "systemd-logind.service"
-        "systemd-user-sessions.service"
-        "autovt@tty1.service"
-      ];
-      conflicts = [
-        "autovt@tty1.service"
-      ];
-      restartIfChanged = false;
-
-      environment = cfg.environment;
-
-      preStart = cfg.preStart;
-      script = lib.mkIf (config.systemd.services.display-manager.enable == true) cfg.execCmd;
-
-      # Stop restarting if the display manager stops (crashes) 2 times
-      # in one minute. Starting X typically takes 3-4s.
-      startLimitIntervalSec = 30;
-      startLimitBurst = 3;
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "200ms";
-        SyslogIdentifier = "display-manager";
-      };
-    };
  };
 }
@@ -217,27 +217,30 @@ in
      # Enable desktop session data
      enable = true;

-      environment = {
-        GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") xdmcfg.xserverArgs);
-        XDG_DATA_DIRS = lib.makeSearchPath "share" [
-          gdm # for gnome-login.session
-          config.services.displayManager.sessionData.desktops
-          pkgs.gnome-control-center # for accessibility icon
-          pkgs.adwaita-icon-theme
-          pkgs.hicolor-icon-theme # empty icon theme as a base
-        ];
-      }
-      // lib.optionalAttrs (xSessionWrapper != null) {
-        # Make GDM use this wrapper before running the session, which runs the
-        # configured setupCommands. This relies on a patched GDM which supports
-        # this environment variable.
-        GDM_X_SESSION_WRAPPER = "${xSessionWrapper}";
+      generic = {
+        enable = true;
+        environment = {
+          GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") xdmcfg.xserverArgs);
+          XDG_DATA_DIRS = lib.makeSearchPath "share" [
+            gdm # for gnome-login.session
+            config.services.displayManager.sessionData.desktops
+            pkgs.gnome-control-center # for accessibility icon
+            pkgs.adwaita-icon-theme
+            pkgs.hicolor-icon-theme # empty icon theme as a base
+          ];
+        }
+        // lib.optionalAttrs (xSessionWrapper != null) {
+          # Make GDM use this wrapper before running the session, which runs the
+          # configured setupCommands. This relies on a patched GDM which supports
+          # this environment variable.
+          GDM_X_SESSION_WRAPPER = "${xSessionWrapper}";
+        };
+        execCmd = "exec ${gdm}/bin/gdm";
+        preStart = lib.optionalString (defaultSessionName != null) ''
+          # Set default session in session chooser to a specified values – basically ignore session history.
+          ${setSessionScript}/bin/set-session ${config.services.displayManager.sessionData.autologinSession}
+        '';
      };
-      execCmd = "exec ${gdm}/bin/gdm";
-      preStart = lib.optionalString (defaultSessionName != null) ''
-        # Set default session in session chooser to a specified values – basically ignore session history.
-        ${setSessionScript}/bin/set-session ${config.services.displayManager.sessionData.autologinSession}
-      '';
    };

    systemd.tmpfiles.rules = [
@@ -0,0 +1,83 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.displayManager.generic;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "preStart" ]
+      [ "services" "displayManager" "generic" "preStart" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "execCmd" ]
+      [ "services" "displayManager" "generic" "execCmd" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "environment" ]
+      [ "services" "displayManager" "generic" "environment" ]
+    )
+  ];
+
+  options = {
+    services.displayManager.generic = {
+      enable = lib.mkEnableOption "generic display manager integration - deprecated";
+
+      preStart = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        example = "rm -f /var/log/my-display-manager.log";
+        description = "Script executed before the display manager is started.";
+      };
+
+      execCmd = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = lib.literalExpression ''"''${pkgs.lightdm}/bin/lightdm"'';
+        description = "Command to start the display manager.";
+      };
+
+      environment = lib.mkOption {
+        type = with lib.types; attrsOf unspecified;
+        default = { };
+        description = "Additional environment variables needed by the display manager.";
+      };
+    };
+  };
+  config = lib.mkIf (cfg.enable || cfg.execCmd != null) {
+    warnings = [
+      (lib.mkIf (!cfg.enable) ''
+        Enabling display-manager.service implicitly due to `services.displayManager.generic.execCmd` being set; this will be removed eventually.
+        Please set `services.displayManager.generic.enable` explicitly, or switch your display manager to use upstream systemd units (preferred).
+      '')
+    ];
+
+    systemd.services.display-manager = {
+      description = "Display Manager";
+      after = [
+        "acpid.service"
+        "systemd-logind.service"
+        "systemd-user-sessions.service"
+        "autovt@tty1.service"
+      ];
+      conflicts = [
+        "autovt@tty1.service"
+      ];
+      restartIfChanged = false;
+
+      environment = cfg.environment;
+
+      preStart = cfg.preStart;
+      script = cfg.execCmd;
+
+      # Stop restarting if the display manager stops (crashes) 2 times
+      # in one minute. Starting X typically takes 3-4s.
+      startLimitIntervalSec = 30;
+      startLimitBurst = 3;
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = "200ms";
+        SyslogIdentifier = "display-manager";
+      };
+    };
+  };
+}
@@ -76,7 +76,10 @@ in
      };
      displayManager = {
        enable = true;
-        execCmd = "exec ${lib.getExe cfg.package} --config ${settingsFormat.generate "config.toml" cfg.settings}";
+        generic = {
+          enable = true;
+          execCmd = "exec ${lib.getExe cfg.package} --config ${settingsFormat.generate "config.toml" cfg.settings}";
+        };
        # set default settings
        lemurs.settings =
          let
@@ -109,7 +109,10 @@ in

      displayManager = {
        enable = true;
-        execCmd = "exec /run/current-system/sw/bin/ly";
+        generic = {
+          enable = true;
+          execCmd = "exec /run/current-system/sw/bin/ly";
+        };

        # Set this here instead of 'defaultConfig' so users get eval
        # errors when they change it.
@@ -361,7 +361,10 @@ in

    services.displayManager = {
      enable = true;
-      execCmd = "exec /run/current-system/sw/bin/sddm";
+      generic = {
+        enable = true;
+        execCmd = "exec /run/current-system/sw/bin/sddm";
+      };
    };

    security.pam.services = {
@@ -406,15 +406,14 @@ in
            http = {
              # https://www.home-assistant.io/integrations/http/
              server_host = mkOption {
-                type = types.nullOr (types.either types.str (types.listOf types.str));
-                default = null;
-                example = [
-                  "::1"
-                  "127.0.0.1"
+                type = types.either types.str (types.listOf types.str);
+                default = [
+                  "0.0.0.0"
+                  "::"
                ];
+                example = "::1";
                description = ''
-                  Only listen to incoming requests on specific IP/host.
-                  The option is unset by default, meaning that Home Assistant listens on all available addresses.
+                  Only listen to incoming requests on specific IP/host. The default listed assumes support for IPv4 and IPv6.
                '';
              };

@@ -356,16 +356,6 @@ in
      "d '${cfg.stateDir}/public/plugin_assets' 0750 ${cfg.user} ${cfg.group} - -"
      "d '${cfg.stateDir}/themes' 0750 ${cfg.user} ${cfg.group} - -"
      "d '${cfg.stateDir}/tmp' 0750 ${cfg.user} ${cfg.group} - -"
-
-      "d /run/redmine/public - - - - -"
-      "L+ /run/redmine/config - - - - ${cfg.stateDir}/config"
-      "L+ /run/redmine/files - - - - ${cfg.stateDir}/files"
-      "L+ /run/redmine/log - - - - ${cfg.stateDir}/log"
-      "L+ /run/redmine/plugins - - - - ${cfg.stateDir}/plugins"
-      "L+ /run/redmine/public/assets - - - - ${cfg.stateDir}/public/assets"
-      "L+ /run/redmine/public/plugin_assets - - - - ${cfg.stateDir}/public/plugin_assets"
-      "L+ /run/redmine/themes - - - - ${cfg.stateDir}/themes"
-      "L+ /run/redmine/tmp - - - - ${cfg.stateDir}/tmp"
    ];

    systemd.services.redmine = {
@@ -392,6 +382,19 @@ in
        ++ lib.optional cfg.components.ghostscript ghostscript;

      preStart = ''
+        # Create symlinks for the basic directory layout the redmine package
+        # expects. This part must be done in preStart rather than tmpfiles,
+        # because /run/redmine is re-created when the service is restarted
+        mkdir /run/redmine/public
+        ln -s "${cfg.stateDir}/config" /run/redmine/config
+        ln -s "${cfg.stateDir}/files" /run/redmine/files
+        ln -s "${cfg.stateDir}/log" /run/redmine/log
+        ln -s "${cfg.stateDir}/plugins" /run/redmine/plugins
+        ln -s "${cfg.stateDir}/public/assets" /run/redmine/public/assets
+        ln -s "${cfg.stateDir}/public/plugin_assets" /run/redmine/public/plugin_assets
+        ln -s "${cfg.stateDir}/themes" /run/redmine/themes
+        ln -s "${cfg.stateDir}/tmp" /run/redmine/tmp
+
        rm -rf "${cfg.stateDir}/plugins/"*
        rm -rf "${cfg.stateDir}/themes/"*

@@ -625,7 +625,6 @@ in

      services.crowdsec.settings.general = {
        common = {
-          daemonize = false;
          log_media = "stdout";
        };
        config_paths = {
@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkPackageOption
+    mkIf
+    ;
+
+  cfg = config.services.rqbit;
+  stateDir = "/var/lib/rqbit";
+  defaultDownloadDir = "${stateDir}/downloads";
+in
+{
+  options.services.rqbit = {
+    enable = mkEnableOption "rqbit BitTorrent daemon";
+
+    package = mkPackageOption pkgs "rqbit" { };
+
+    user = mkOption {
+      type = types.str;
+      default = "rqbit";
+      description = "User account under which rqbit runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "rqbit";
+      description = "Group account under which rqbit runs.";
+    };
+
+    downloadDir = mkOption {
+      type = types.path;
+      default = defaultDownloadDir;
+      example = "/mnt/storage/torrents";
+      description = "Directory where to download torrents.";
+    };
+
+    httpPort = mkOption {
+      type = types.port;
+      default = 3030;
+      description = "The listen port for the HTTP API.";
+    };
+
+    httpHost = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "The listen host for the HTTP API.";
+    };
+
+    peerPort = mkOption {
+      type = types.port;
+      default = 4240;
+      description = "The port to listen for incoming BitTorrent peer connections (TCP and uTP).";
+    };
+
+    openFirewall = mkEnableOption "opening of the HTTP and Peer ports in the firewall";
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.rqbit = {
+      description = "rqbit BitTorrent Service";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        HOME = stateDir;
+        RQBIT_HTTP_API_LISTEN_ADDR = "${
+          if (lib.hasInfix ":" cfg.httpHost) then "[${cfg.httpHost}]" else cfg.httpHost
+        }:${toString cfg.httpPort}";
+        RQBIT_LISTEN_PORT = toString cfg.peerPort;
+        RQBIT_SESSION_PERSISTENCE_LOCATION = stateDir;
+      };
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} server start ${cfg.downloadDir}";
+        User = cfg.user;
+        Group = cfg.group;
+
+        StateDirectory = "rqbit";
+        StateDirectoryMode = "0750";
+
+        # systemd-analyze security rqbit
+        ReadWritePaths = mkIf (cfg.downloadDir != defaultDownloadDir) [ cfg.downloadDir ];
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        RemoveIPC = true;
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        RestrictNamespaces = true;
+        SystemCallFilter = [
+          "@system-service"
+          "@network-io"
+          "@file-system"
+          "~@privileged"
+          "~@resources"
+        ];
+        SystemCallArchitectures = "native";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        UMask = "0027";
+      };
+    };
+
+    users = {
+      users = mkIf (cfg.user == "rqbit") {
+        rqbit = {
+          inherit (cfg) group;
+          isSystemUser = true;
+        };
+      };
+      groups = mkIf (cfg.group == "rqbit") { rqbit = { }; };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [
+        cfg.httpPort
+        cfg.peerPort
+      ];
+      allowedUDPPorts = [ cfg.peerPort ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ CodedNil ];
+}
@@ -151,11 +151,9 @@ in
    # We can't just rely on 'Conflicts=autovt@tty1.service' because
    # 'switch-to-configuration switch' will start 'autovt@tty1.service'
    # and kill the display manager.
-    systemd.targets.getty.wants =
-      lib.mkIf (!(config.systemd.services.display-manager.enable or false))
-        [
-          "autovt@tty1.service"
-        ];
+    systemd.targets.getty.wants = lib.mkIf (!config.services.displayManager.enable) [
+      "autovt@tty1.service"
+    ];

    systemd.services."getty@" = {
      serviceConfig.ExecStart = [
@@ -215,22 +215,24 @@ in

    # Set default session in session chooser to a specified values – basically ignore session history.
    # Auto-login is already covered by a config value.
-    services.displayManager.preStart =
+    services.displayManager.generic.preStart =
      optionalString (!dmcfg.autoLogin.enable && dmcfg.defaultSession != null)
        ''
          ${setSessionScript}/bin/set-session ${dmcfg.defaultSession}
        '';

    # setSessionScript needs session-files in XDG_DATA_DIRS
-    services.displayManager.environment.XDG_DATA_DIRS = "${dmcfg.sessionData.desktops}/share/";
+    services.displayManager.generic.environment.XDG_DATA_DIRS = "${dmcfg.sessionData.desktops}/share/";

    # setSessionScript wants AccountsService
    systemd.services.display-manager.wants = [
      "accounts-daemon.service"
    ];

+    services.displayManager.generic.enable = true;
+
    # lightdm relaunches itself via just `lightdm`, so needs to be on the PATH
-    services.displayManager.execCmd = ''
+    services.displayManager.generic.execCmd = ''
      export PATH=${lightdm}/sbin:$PATH
      exec ${lightdm}/sbin/lightdm
    '';
@@ -300,7 +300,8 @@ in
      VideoRam 192000
    '';

-    services.displayManager.execCmd = ''
+    services.displayManager.generic.enable = true;
+    services.displayManager.generic.execCmd = ''
      ${optionalString (cfg.pulseaudio) "export PULSE_COOKIE=/run/pulse/.config/pulse/cookie"}
      exec ${pkgs.xpra}/bin/xpra ${
        if cfg.desktop == null then "start" else "start-desktop --start=${cfg.desktop}"
@@ -849,35 +849,10 @@ in

    environment.pathsToLink = [ "/share/X11" ];

-    systemd.services.display-manager = {
-      description = "Display Manager";
-
-      after = [
-        "acpid.service"
-        "systemd-logind.service"
-        "systemd-user-sessions.service"
-      ];
-
-      restartIfChanged = false;
-
-      environment = config.services.displayManager.environment;
-
-      preStart = ''
-        ${config.services.displayManager.preStart}
-
-        rm -f /tmp/.X0-lock
-      '';
-
-      # Stop restarting if the display manager stops (crashes) 2 times
-      # in one minute. Starting X typically takes 3-4s.
-      startLimitIntervalSec = 30;
-      startLimitBurst = 3;
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "200ms";
-        SyslogIdentifier = "display-manager";
-      };
-    };
+    # FIXME: what
+    services.displayManager.generic.preStart = ''
+      rm -f /tmp/.X0-lock
+    '';

    services.xserver.displayManager.xserverArgs = [
      "-config ${configFile}"
@@ -542,7 +542,7 @@ let
        Environment = "PODMAN_SYSTEMD_UNIT=%n";
        Type = "notify";
        NotifyAccess = "all";
-        Delegate = mkIf (container.podman.sdnotify == "healthy") true;
+        Delegate = true;
        User = effectiveUser;
        RuntimeDirectory = escapedName;
      };
@@ -630,13 +630,9 @@ in
              inherit (config.users.users.${podman.user}) linger;
            in
            warnings
-            ++ lib.optional (podman.user != "root" && linger && podman.sdnotify == "conmon") ''
-              Podman container ${name} is configured as rootless (user ${podman.user})
-              with `--sdnotify=conmon`, but lingering for this user is turned on.
-            ''
-            ++ lib.optional (podman.user != "root" && !linger && podman.sdnotify == "healthy") ''
-              Podman container ${name} is configured as rootless (user ${podman.user})
-              with `--sdnotify=healthy`, but lingering for this user is turned off.
+            ++ lib.optional (podman.user != "root" && !linger) ''
+              Podman container ${name} is configured as rootless (user ${podman.user}),
+              but lingering for this user is turned off.
            ''
          ) [ ] cfg.containers
        );
@@ -45,28 +45,9 @@ for gen in "${gens[@]}"; do
    bootspecFile="$(sed -nr 's/^options init=(.*)\/init.*$/\1/p' "$gen")/boot.json"
    [ "$1" = "debug" ] && echo -e "\e[1;34mxenBootBuilder:\e[0m processing bootspec file $bootspecFile"

-    # We do nothing if the Bootspec for the current $gen does not contain the Xen
-    # extension, which is added as a configuration attribute below.
-    # We determine this by checking for the v1 or v2 bootspec extension,
-    # and setting the appropriate attributes based on version
-    xenSpecVer=""
-    xenParamVar=""
-    xenEfiPath=""
-    if grep -sq '"org.xenproject.bootspec.v1"' "$bootspecFile"; then
-        xenSpecVer="v1"
-        xenParamVar="xenParams"
-        xenEfiPath="xen"
-    fi
-    # We prefer the v2 extension, so if both are present somehow,
-    # we will use the v2 attributes
+    # Check for a valid Xen v2 spec being detected
    if grep -sq '"org.xenproject.bootspec.v2"' "$bootspecFile"; then
-        xenSpecVer="v2"
-        xenParamVar="params"
-        xenEfiPath="efiPath"
-    fi
-    # Check for a valid Xen spec being detected
-    if [ -n "$xenSpecVer" ]; then
-        [ "$1" = "debug" ] && echo -e "                \e[1;32msuccess:\e[0m found $xenSpecVer Xen entries in $gen."
+        [ "$1" = "debug" ] && echo -e "                \e[1;32msuccess:\e[0m found v2 Xen entries in $gen."

        # TODO: Support DeviceTree booting. Xen has some special handling for DeviceTree
        # attributes, which will need to be translated in a boot script similar to this
@@ -82,7 +63,7 @@ for gen in "${gens[@]}"; do
        # the corresponding nixos generation, substituting `nixos` with `xen`:
        # `xen-$profile-generation-$number-specialisation-$specialisation.{cfg,conf}`
        xenGen=$(echo "$gen" | sed 's_/loader/entries/nixos_/loader/entries/xen_g;s_^.*/xen_xen_g;s_.conf$__g')
-        bootParams=$(jq -re ".\"org.xenproject.bootspec.$xenSpecVer\".$xenParamVar | join(\" \")" "$bootspecFile")
+        bootParams=$(jq -re ".\"org.xenproject.bootspec.v2\".params | join(\" \")" "$bootspecFile")
        kernel=$(jq -re '."org.nixos.bootspec.v1".kernel | sub("^/nix/store/"; "") | sub("/bzImage"; "-bzImage.efi")' "$bootspecFile")
        kernelParams=$(jq -re '."org.nixos.bootspec.v1".kernelParams | join(" ")' "$bootspecFile")
        initrd=$(jq -re '."org.nixos.bootspec.v1".initrd | sub("^/nix/store/"; "") | sub("/initrd"; "-initrd.efi")' "$bootspecFile")
@@ -109,7 +90,7 @@ EOF
        # Create Xen UKI for $generation. Most of this is lifted from
        # https://xenbits.xenproject.org/docs/unstable/misc/efi.html.
        [ "$1" = "debug" ] && echo -e "\e[1;34mxenBootBuilder:\e[0m making Xen UKI..."
-        xenEfi=$(jq -re ".\"org.xenproject.bootspec.$xenSpecVer\".$xenEfiPath" "$bootspecFile")
+        xenEfi=$(jq -re ".\"org.xenproject.bootspec.v2\".efiPath" "$bootspecFile")
        finalSection=$(objdump --header --wide "$xenEfi" | tail -n +6 | sort --key="4,4" | tail -n 1 | grep -Eo '\.[a-z]*')
        padding=$(objdump --header --section="$finalSection" "$xenEfi" | awk -v section="$finalSection" '$0 ~ section { printf("0x%016x\n", and(strtonum("0x"$3) + strtonum("0x"$4) + 0xfff, compl(0xfff)))};')
        [ "$1" = "debug" ] && echo "               - padding: $padding"
@@ -132,13 +113,16 @@ sort-key $sortKey
 EOF
        [ "$1" = "debug" ] && echo -e "done."

-    # Sometimes, garbage collection weirdness causes a generation to still exist in
-    # the loader entries, but its Bootspec file was deleted. We consider such a
-    # generation to be invalid, but we don't write extra code to handle this
-    # situation, as supressing grep's error messages above is quite enough, and the
-    # error message below is still technically correct, as no Xen can be found in
-    # something that does not exist.
+        # Since NixOS 26.05, org.xenproject.bootspec.v1 is unsupported.
+    elif grep -sq '"org.xenproject.bootspec.v1"' "$bootspecFile"; then
+        [ "$1" = "debug" ] && echo -e "\n\e[1;33mwarning:\e[0m $gen has a \e[1;34morg.xenproject.bootspec.v1\e[0m Bootspec entry. This boot builder only supports v2 entries, so this generation will be ignored, and will \e[1;31mfail to boot\e[0m."
    else
+        # Sometimes, garbage collection weirdness causes a generation to still exist in
+        # the loader entries, but its Bootspec file was deleted. We consider such a
+        # generation to be invalid, but we don't write extra code to handle this
+        # situation, as supressing grep's error messages above is quite enough, and the
+        # error message below is still technically correct, as no Xen can be found in
+        # something that does not exist.
        [ "$1" = "debug" ] && echo -e "                \e[1;33mwarning:\e[0m \e[1;31mno Xen found\e[0m in $gen."
    fi
 done
@@ -153,7 +137,7 @@ mapfile -t postGenerations < <(find "$efiMountPoint"/loader/entries -type f -nam
 if ((${#postGenerations[@]} == 0)); then
    case "$1" in
        "default" | "info") echo "none found." && echo -e "If you believe this is an error, set the \e[1;34mvirtualisation.xen.boot.builderVerbosity\e[0m option to \e[1;34m\"debug\"\e[0m and rebuild to print debug logs." ;;
-        "debug") echo -e "\e[1;34mxenBootBuilder:\e[0m wrote \e[1;31mno generations\e[0m. Most likely, there were no generations with a valid \e[1;34morg.xenproject.bootspec.v1\e[0m or \e[1;34morg.xenproject.bootspec.v2\e[0m entry." ;;
+        "debug") echo -e "\e[1;34mxenBootBuilder:\e[0m wrote \e[1;31mno generations\e[0m. Most likely, there were no generations with a valid \e[1;34morg.xenproject.bootspec.v2\e[0m entry." ;;
    esac

 # If the script is successful, change the default boot, say "done.", write a
@@ -741,22 +741,14 @@ in

      # Xen Bootspec extension. This extension allows NixOS bootloaders to
      # fetch the dom0 kernel paths and access the `cfg.boot.params` option.
-      bootspec.extensions = {
-        # Bootspec extension v1 is deprecated, and will be removed in 26.05
-        # It is present for backwards compatibility
-        "org.xenproject.bootspec.v1" = {
-          xen = cfg.boot.efi.path;
-          xenParams = cfg.boot.params;
-        };
-        # Bootspec extension v2 includes more detail,
-        # including supporting multiboot, and is the current supported
-        # bootspec extension
-        "org.xenproject.bootspec.v2" = {
-          efiPath = cfg.boot.efi.path;
-          multibootPath = cfg.boot.bios.path;
-          version = cfg.package.version;
-          params = cfg.boot.params;
-        };
+      # Bootspec extension v2 includes more detail,
+      # including supporting multiboot, and is the current supported
+      # bootspec extension
+      bootspec.extensions."org.xenproject.bootspec.v2" = {
+        efiPath = cfg.boot.efi.path;
+        multibootPath = cfg.boot.bios.path;
+        version = cfg.package.version;
+        params = cfg.boot.params;
      };

      # See the `xenBootBuilder` script in the main `let...in` statement of this file.
@@ -1388,6 +1388,7 @@ in
  rosenpass = runTest ./rosenpass.nix;
  roundcube = runTest ./roundcube.nix;
  routinator = handleTest ./routinator.nix { };
+  rqbit = handleTest ./rqbit.nix { };
  rshim = handleTest ./rshim.nix { };
  rspamd = handleTest ./rspamd.nix { };
  rspamd-trainer = runTest ./rspamd-trainer.nix;
@@ -4,7 +4,6 @@
  meta = with pkgs.lib.maintainers; {
    maintainers = [
      diogotcorreia
-      ma27
    ];
  };

@@ -201,18 +201,33 @@ in
              server.succeed("systemctl --no-pager -l status apparmor.service")
              server.wait_for_unit("apparmor.service")
        ''
-    +
-      lib.optionalString cfg.feature.user # python
-        ''
-          with subtest("incus-user allows restricted access for users"):
-              server.fail("incus project show user-1000")
-              server.succeed("su - testuser bash -c 'incus list'")
-              # a project is created dynamically for the user
-              server.succeed("incus project show user-1000")
-              # users shouldn't be able to list storage pools
-              server.fail("su - testuser bash -c 'incus storage list'")
-              # user can create an instance
-              server.succeed("su - testuser bash -c 'incus create --empty'")
-        ''
+    + lib.optionalString cfg.feature.user (
+      # python
+      ''
+        with subtest("incus-user allows restricted access for users"):
+            server.fail("incus project show user-1000")
+            server.succeed("su - testuser bash -c 'incus list'")
+            # a project is created dynamically for the user
+            server.succeed("incus project show user-1000")
+            # user can create an instance
+            server.succeed("su - testuser bash -c 'incus create --empty'")
+      ''
+      + lib.optionalString (lib.versionOlder cfg.package.version "6.21") ''
+        # users shouldn't be able to list storage pools
+        server.fail("su - testuser bash -c 'incus storage list'")
+      ''
+      + lib.optionalString (lib.versionAtLeast cfg.package.version "6.21") ''
+        # users shouldn't be able to read storage pools
+        server.succeed("su - testuser bash -c 'incus storage list'")
+
+        # pre-check that there is a pool source
+        pool_source = server.succeed("incus storage get default source").strip()
+        assert pool_source == "/var/lib/incus/storage-pools/default", f"Expected pool source /var/lib/incus/storage-pools/default, got {pool_source}"
+
+        # users shouldn't be able to read storage pool config
+        code, pool_source = server.execute("su - testuser bash -c 'incus storage get default source'")
+        assert pool_source.strip() == "", f"Expected empty string, got {pool_source}"
+      ''
+    )
    + instanceScript;
 }
@@ -88,7 +88,7 @@ let
              isSystemUser = true;
              group = "redis";
              home = "/var/lib/redis";
-              linger = type == "healthy";
+              linger = true;
              createHome = true;
              uid = 2342;
              subUidRanges = [
@@ -46,4 +46,30 @@ in
    name = "pgsql";
    type = "postgresql";
  };
+
+  restart = makeTest {
+    name = "redmine-restart";
+    nodes.machine =
+      { config, pkgs, ... }:
+      {
+        services.redmine = {
+          enable = true;
+          package = pkgs.redmine;
+        };
+      };
+
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("redmine.service")
+      machine.wait_for_open_port(3000)
+      machine.succeed("curl --fail http://localhost:3000/")
+
+      machine.systemctl("stop redmine.service")
+      machine.systemctl("start redmine.service")
+
+      machine.wait_for_unit("redmine.service")
+      machine.wait_for_open_port(3000)
+      machine.succeed("curl --fail http://localhost:3000/")
+    '';
+  };
 }
@@ -0,0 +1,30 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  let
+    port = 3030;
+  in
+  {
+    name = "rqbit";
+    meta = {
+      maintainers = with pkgs.lib.maintainers; [ CodedNil ];
+    };
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.rqbit = {
+          httpPort = port;
+          enable = true;
+          openFirewall = true;
+        };
+      };
+
+    testScript = /* python */ ''
+      machine.start()
+      machine.wait_for_unit("rqbit.service")
+      machine.wait_for_open_port(${toString port})
+
+      machine.succeed("curl --fail http://localhost:${toString port}")
+    '';
+  }
+)
@@ -60,6 +60,9 @@ in
      services.victoriatraces = {
        enable = true;
        retentionPeriod = "1d";
+        extraOptions = [
+          "-search.latencyOffset=0s"
+        ];
      };

      environment.systemPackages = with pkgs; [
@@ -82,10 +85,10 @@ in
    """, timeout=10)

    # Query for traces from our test service
-    machine.succeed("""
+    machine.wait_until_succeeds("""
      curl -s 'http://localhost:10428/select/jaeger/api/traces?service=test-service' | \
      jq -e '.data[0].spans[0].operationName' | grep -q 'test-span'
-    """)
+    """, timeout=10)

    # Verify the trace has the expected attributes
    machine.succeed("""
@@ -8,11 +8,11 @@
 let
  src = mkJetBrainsSource {
    # update-script-start: source-args
-    version = "2025.3.1.1";
-    buildNumber = "253.29346.240";
+    version = "2025.3.2";
+    buildNumber = "253.30387.90";
    buildType = "idea";
-    ideaHash = "sha256-L5O6QjDY3SqSQ1DnQTjIez7pIvPAdtOXP/+B05bAV+Q=";
-    androidHash = "sha256-quMCzrjCKIo1pkzw4PWewAs5tz7A2aq7TI5zd+QaaUY=";
+    ideaHash = "sha256-0WuTG1wQThWQv4Pzfw+48LDm4dvlfii/B+bwWdeGNTI=";
+    androidHash = "sha256-USadXfyPu5boaCB+5rP+40Kd53LTRrrkRwgcbaxDgXg=";
    jpsHash = "sha256-iHpt926BDLNUwHRXvkqVgwlWiLo1qSZEaGeJcS0Fjmk=";
    restarterHash = "sha256-acCmC58URd6p9uKZrm0qWgdZkqu9yqCs23v8qgxV2Ag=";
    mvnDeps = ../source/idea_maven_artefacts.json;
@@ -50,14 +50,14 @@ let
  ideaSrc = fetchFromGitHub {
    owner = "jetbrains";
    repo = "intellij-community";
-    rev = "${buildType}/${buildNumber}";
+    rev = "${buildType}/${version}";
    hash = ideaHash;
  };

  androidSrc = fetchFromGitHub {
    owner = "jetbrains";
    repo = "android";
-    rev = "${buildType}/${buildNumber}";
+    rev = "${buildType}/${version}";
    hash = androidHash;
  };

@@ -70,7 +70,7 @@ def requested_kotlinc_version(root_path: Path) -> str:
        return version


-def prefetch_intellij_community(variant: str, build_number: str) -> tuple[str, Path]:
+def prefetch_intellij_community(variant: str, version: str) -> tuple[str, Path]:
    print("[*] Prefetching IntelliJ community source code...")
    prefetch = run_command(
        [
@@ -81,7 +81,7 @@ def prefetch_intellij_community(variant: str, build_number: str) -> tuple[str, P
            "source",
            "--type",
            "sha256",
-            f"https://github.com/jetbrains/intellij-community/archive/{variant}/{build_number}.tar.gz",
+            f"https://github.com/jetbrains/intellij-community/archive/{variant}/{version}.tar.gz",
        ]
    )
    parts = prefetch.split()
@@ -92,7 +92,7 @@ def prefetch_intellij_community(variant: str, build_number: str) -> tuple[str, P
    return (hash, Path(out_path))


-def prefetch_android(variant: str, build_number: str) -> str:
+def prefetch_android(variant: str, version: str) -> str:
    print("[*] Prefetching Android plugin source code...")
    prefetch = run_command(
        [
@@ -102,7 +102,7 @@ def prefetch_android(variant: str, build_number: str) -> str:
            "source",
            "--type",
            "sha256",
-            f"https://github.com/jetbrains/android/archive/{variant}/{build_number}.tar.gz",
+            f"https://github.com/jetbrains/android/archive/{variant}/{version}.tar.gz",
        ]
    )
    return convert_hash_to_sri(prefetch)
@@ -151,10 +151,8 @@ def maven_out_path(jb_root: Path, name: str) -> Path:

 def run_src_update(ide: Ide, info: VersionInfo, config: UpdaterConfig):
    variant = ide.name.removesuffix("-oss")
-    intellij_hash, intellij_outpath = prefetch_intellij_community(
-        variant, info.build_number
-    )
-    android_hash = prefetch_android(variant, info.build_number)
+    intellij_hash, intellij_outpath = prefetch_intellij_community(variant, info.version)
+    android_hash = prefetch_android(variant, info.version)
    jps_hash = generate_jps_hash(config, intellij_outpath)
    restarter_hash = generate_restarter_hash(config, intellij_outpath)
    repositories = jar_repositories(intellij_outpath)
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "tinymist";
    publisher = "myriad-dreamin";
-    version = "0.14.8";
-    hash = "sha256-m0qiur+hhWQ+PaL1JisSo9UHW0d0LsLF87YdnG6fQ18=";
+    version = "0.14.10";
+    hash = "sha256-ez7VRSVjPVDqXpscwB+PGSEXw34YHmAV14atnSYO0vg=";
  };

  nativeBuildInputs = [
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "3.51.0";
-    hash = "sha256-/WqW0hjerbNM9TtgpNV+usDUajIhRd3y+zeYxJi0COc=";
+    version = "3.53.1";
+    hash = "sha256-jMldzLsB4Wdwzzq0vyy1n89G6UaycGz+XReHrwfzpkc=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-pce-fast";
-  version = "0-unstable-2026-01-16";
+  version = "0-unstable-2026-01-23";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-pce-fast-libretro";
-    rev = "6d182b22f6b9430c76ea71579ffb2eee0e2e9521";
-    hash = "sha256-QHkG5CSZgaakblOgp5HxGvtWg8K4Nbag481nhG4UjoY=";
+    rev = "52675734da114a19b3705f03906b1455f3d76644";
+    hash = "sha256-hITofg0UB5sGNOKAijfORz3ZtHY5CCdqFmbT4nMkmG8=";
  };

  makefile = "Makefile";
@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
  core = "mupen64plus-next";
-  version = "0-unstable-2025-11-14";
+  version = "0-unstable-2026-01-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mupen64plus-libretro-nx";
-    rev = "680e033fc8ed1a49df7b156d97164e0050ee13bc";
-    hash = "sha256-oBsOC1YtHx+mTgi9rwucU7rVeFt6RbxKrxHyPDx0eXg=";
+    rev = "bc43bcedc276861254b48526f56799d63a30723b";
+    hash = "sha256-0dofQP35EmVY6i5muwIARuF1G4+92jhFjAiWcwyJDTs=";
  };

  # Fix for GCC 14
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
  core = "np2kai";
-  version = "0-unstable-2024-11-03";
+  version = "0-unstable-2026-01-19";

  src = fetchFromGitHub {
    owner = "AZO234";
    repo = "NP2kai";
-    rev = "4b109eaac4f79b04065ff5025319fce51537e04d";
-    hash = "sha256-tRFvK8d5Y/umy/b1BKN85ZSaDWyK95hII4RVng7A5uU=";
+    rev = "e2138c44ea539b36b2d1fc17b70c14fcedfd9784";
+    hash = "sha256-59u8UWk2KNtZNAUcMql0BaCY+VtDs7GssrQRbXbqB3c=";
    fetchSubmodules = true;
  };

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "pcsx-rearmed";
-  version = "0-unstable-2026-01-04";
+  version = "0-unstable-2026-01-19";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "pcsx_rearmed";
-    rev = "32e2193bcc9d937d9b1a16db43258aef51cddae8";
-    hash = "sha256-enq5RqeTiOLGqi+Hsj3wFZ6EUWSl0gX7u4ymznOffsQ=";
+    rev = "3a7850fdc6ac4ed0c323ade851b462504a3cbb79";
+    hash = "sha256-D2+Vbs+EIZykQRJK8GxDyPSh+0DlObw6IfXBOq1JnAw=";
  };

  dontConfigure = true;
@@ -128,11 +128,11 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-oQyhrDpxjCckqq+mtViswP1rPcgowEq4ZN5jHWa7UpY=",
+    "hash": "sha256-Wu70EyhLP1jC9Y3/RDOtGB8EMbeMvD+HwsSpNXAaMZI=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.28.0",
+    "rev": "v1.29.0",
    "spdx": "MIT",
    "vendorHash": "sha256-e9RWvfhn/jO44ljfzNjo2qCQZfVISg8DWQdvnTXbf8o="
  },
@@ -724,11 +724,11 @@
    "vendorHash": null
  },
  "ibm-cloud_ibm": {
-    "hash": "sha256-DvWlf3FHYDcNxUZUOoslQjhuwGvElAEu/duDsX4xbKs=",
+    "hash": "sha256-1GqI6cFy386osELaG474OeQX33wIAIEABb/bL5ezs6Q=",
    "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
    "owner": "IBM-Cloud",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.87.1",
+    "rev": "v1.87.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-vKu5ytMAhIYKoPNfuxpyBT9gRdSAR4wFI/7A9K+RiAo="
  },
@@ -1,127 +0,0 @@
-{
-  pname,
-  version,
-  src,
-  gitSrc,
-  buildInputs ? [ ],
-  homepage,
-  description,
-  maintainers,
-  passthru ? { },
-}:
-
-{
-  lib,
-  stdenv,
-  openssl,
-  zlib,
-  asciidoc,
-  libxml2,
-  libxslt,
-  docbook_xsl,
-  pkg-config,
-  coreutils,
-  gnused,
-  groff,
-  docutils,
-  gzip,
-  bzip2,
-  lzip,
-  xz,
-  zstd,
-  python3Packages,
-}:
-
-stdenv.mkDerivation {
-  inherit
-    pname
-    version
-    src
-    gitSrc
-    passthru
-    ;
-
-  separateDebugInfo = true;
-
-  nativeBuildInputs = [
-    pkg-config
-    asciidoc
-  ]
-  ++ (with python3Packages; [
-    python
-    wrapPython
-  ]);
-  buildInputs = buildInputs ++ [
-    openssl
-    zlib
-    libxml2
-    libxslt
-    docbook_xsl
-  ];
-  pythonPath = with python3Packages; [
-    pygments
-    markdown
-  ];
-
-  postPatch = ''
-    sed -e 's|"gzip"|"${gzip}/bin/gzip"|' \
-        -e 's|"bzip2"|"${bzip2.bin}/bin/bzip2"|' \
-        -e 's|"lzip"|"${lzip}/bin/lzip"|' \
-        -e 's|"xz"|"${xz.bin}/bin/xz"|' \
-        -e 's|"zstd"|"${zstd}/bin/zstd"|' \
-        -i ui-snapshot.c
-
-    substituteInPlace filters/html-converters/man2html \
-      --replace 'groff' '${groff}/bin/groff'
-
-    substituteInPlace filters/html-converters/rst2html \
-      --replace 'rst2html.py' '${docutils}/bin/rst2html.py'
-  '';
-
-  # Give cgit a git source tree and pass configuration parameters (as make
-  # variables).
-  preBuild = ''
-    mkdir -p git
-    tar --strip-components=1 -xf "$gitSrc" -C git
-  '';
-
-  makeFlags = [
-    "prefix=$(out)"
-    "CGIT_SCRIPT_PATH=$(out)/cgit/"
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "AR=${stdenv.cc.targetPrefix}ar"
-  ];
-
-  # Install manpage.
-  postInstall = ''
-    # xmllint fails:
-    #make install-man
-
-    # bypassing xmllint works:
-    a2x --no-xmllint -f manpage cgitrc.5.txt
-    mkdir -p "$out/share/man/man5"
-    cp cgitrc.5 "$out/share/man/man5"
-
-    wrapPythonProgramsIn "$out/lib/cgit/filters" "$out $pythonPath"
-
-    for script in $out/lib/cgit/filters/*.sh $out/lib/cgit/filters/html-converters/txt2html; do
-      wrapProgram $script --prefix PATH : '${
-        lib.makeBinPath [
-          coreutils
-          gnused
-        ]
-      }'
-    done
-  '';
-
-  stripDebugList = [ "cgit" ];
-
-  enableParallelBuilding = true;
-
-  meta = {
-    inherit homepage description;
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
-    maintainers = maintainers ++ (with lib.maintainers; [ qyliss ]);
-  };
-}
@@ -1,17 +1,34 @@
 {
  lib,
+  stdenv,
  fetchurl,
-  callPackage,
+  openssl,
+  zlib,
+  asciidoc,
+  libxml2,
+  libxslt,
  luajit,
+  docbook_xsl,
+  pkg-config,
+  coreutils,
+  gnused,
+  groff,
+  docutils,
+  gzip,
+  bzip2,
+  lzip,
+  xz,
+  zstd,
+  python3Packages,
  nixosTests,
 }:

-callPackage (import ./common.nix rec {
+stdenv.mkDerivation {
  pname = "cgit";
  version = "1.2.3";

  src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/${pname}-${version}.tar.xz";
+    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.2.3.tar.xz";
    sha256 = "193d990ym10qlslk0p8mjwp2j6rhqa7fq0y1iff65lvbyv914pss";
  };

@@ -23,11 +40,95 @@ callPackage (import ./common.nix rec {
    sha256 = "09lzwa183nblr6l8ib35g2xrjf9wm9yhk3szfvyzkwivdv69c9r2";
  };

-  buildInputs = [ luajit ];
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+  ]
+  ++ (with python3Packages; [
+    python
+    wrapPython
+  ]);
+  buildInputs = [
+    openssl
+    zlib
+    libxml2
+    libxslt
+    luajit
+    docbook_xsl
+  ];
+  pythonPath = with python3Packages; [
+    pygments
+    markdown
+  ];
+
+  postPatch = ''
+    sed -e 's|"gzip"|"${gzip}/bin/gzip"|' \
+        -e 's|"bzip2"|"${bzip2.bin}/bin/bzip2"|' \
+        -e 's|"lzip"|"${lzip}/bin/lzip"|' \
+        -e 's|"xz"|"${xz.bin}/bin/xz"|' \
+        -e 's|"zstd"|"${zstd}/bin/zstd"|' \
+        -i ui-snapshot.c
+
+    substituteInPlace filters/html-converters/man2html \
+      --replace 'groff' '${groff}/bin/groff'
+
+    substituteInPlace filters/html-converters/rst2html \
+      --replace 'rst2html.py' '${docutils}/bin/rst2html.py'
+  '';
+
+  # Give cgit a git source tree and pass configuration parameters (as make
+  # variables).
+  preBuild = ''
+    mkdir -p git
+    tar --strip-components=1 -xf "$gitSrc" -C git
+  '';
+
+  makeFlags = [
+    "prefix=$(out)"
+    "CGIT_SCRIPT_PATH=$(out)/cgit/"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
+
+  # Install manpage.
+  postInstall = ''
+    # xmllint fails:
+    #make install-man
+
+    # bypassing xmllint works:
+    a2x --no-xmllint -f manpage cgitrc.5.txt
+    mkdir -p "$out/share/man/man5"
+    cp cgitrc.5 "$out/share/man/man5"
+
+    wrapPythonProgramsIn "$out/lib/cgit/filters" "$out $pythonPath"
+
+    for script in $out/lib/cgit/filters/*.sh $out/lib/cgit/filters/html-converters/txt2html; do
+      wrapProgram $script --prefix PATH : '${
+        lib.makeBinPath [
+          coreutils
+          gnused
+        ]
+      }'
+    done
+  '';
+
+  stripDebugList = [ "cgit" ];
+
+  enableParallelBuilding = true;

  passthru.tests = { inherit (nixosTests) cgit; };

-  homepage = "https://git.zx2c4.com/cgit/about/";
-  description = "Web frontend for git repositories";
-  maintainers = with lib.maintainers; [ bjornfor ];
-}) { }
+  meta = {
+    homepage = "https://git.zx2c4.com/cgit/about/";
+    description = "Web frontend for git repositories";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      bjornfor
+      qyliss
+      sternenseemann
+    ];
+  };
+}
@@ -1,27 +0,0 @@
-{
-  lib,
-  fetchurl,
-  callPackage,
-}:
-
-callPackage (import ./common.nix rec {
-  pname = "cgit-pink";
-  version = "1.4.1";
-
-  src = fetchurl {
-    url = "https://git.causal.agency/cgit-pink/snapshot/cgit-pink-${version}.tar.gz";
-    sha256 = "1ma6j3r4ba5fhd47pc6xn5bmxaqr8ci2pvky9v100n1hh5n6q97i";
-  };
-
-  # cgit-pink is tightly coupled with git and needs a git source tree to build.
-  # IMPORTANT: Remember to check which git version cgit-pink needs on every
-  # version bump (look for "GIT_VER" in the top-level Makefile).
-  gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.36.1.tar.xz";
-    sha256 = "0w43a35mhc2qf2gjkxjlnkf2lq8g0snf34iy5gqx2678yq7llpa0";
-  };
-
-  homepage = "https://git.causal.agency/cgit-pink/about/";
-  description = "cgit fork aiming for better maintenance";
-  maintainers = with lib.maintainers; [ sternenseemann ];
-}) { }
@@ -92,6 +92,7 @@ let
  # TODO(@Ericson2314) Make unconditional, or optional but always true by
  # default.
  targetPrefix = optionalString (targetPlatform != hostPlatform) (targetPlatform.config + "-");
+  exeSuffix = stdenvNoCC.hostPlatform.extensions.executable;

  bintoolsVersion = getVersion bintools;
  bintoolsName = removePrefix targetPrefix (getName bintools);
@@ -257,17 +258,17 @@ stdenvNoCC.mkDerivation {
  + ''
    for binary in objdump objcopy size strings as ar nm gprof dwp c++filt addr2line \
        ranlib readelf elfedit dlltool dllwrap windmc windres; do
-      if [ -e $ldPath/${targetPrefix}''${binary} ]; then
-        ln -s $ldPath/${targetPrefix}''${binary} $out/bin/${targetPrefix}''${binary}
+      if [ -e $ldPath/${targetPrefix}''${binary}${exeSuffix} ]; then
+        ln -s $ldPath/${targetPrefix}''${binary}${exeSuffix} $out/bin/${targetPrefix}''${binary}${exeSuffix}
      fi
    done

-    if [ -e ''${ld:-$ldPath/${targetPrefix}ld} ]; then
-      wrap ${targetPrefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${targetPrefix}ld}
+    if [ -e ''${ld:-$ldPath/${targetPrefix}ld}${exeSuffix} ]; then
+      wrap ${targetPrefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${targetPrefix}ld}${exeSuffix}
    fi

-    for variant in $ldPath/${targetPrefix}ld.*; do
-      basename=$(basename "$variant")
+    for variant in $ldPath/${targetPrefix}ld.*${exeSuffix}; do
+      basename=$(basename "${if exeSuffix != "" then "\${variant%${exeSuffix}}" else "$variant"}")
      wrap $basename ${./ld-wrapper.sh} $variant
    done
  '';
@@ -118,6 +118,7 @@ let
  #
  # TODO(@Ericson2314) Make unconditional, or optional but always true by default.
  targetPrefix = optionalString (targetPlatform != hostPlatform) (targetPlatform.config + "-");
+  exeSuffix = stdenvNoCC.hostPlatform.extensions.executable;

  ccVersion = getVersion cc;
  ccName = removePrefix targetPrefix (getName cc);
@@ -524,34 +525,34 @@ stdenvNoCC.mkDerivation {
    export named_cc=${targetPrefix}cc
    export named_cxx=${targetPrefix}c++

-    if [ -e $ccPath/${targetPrefix}gcc ]; then
-      wrap ${targetPrefix}gcc $wrapper $ccPath/${targetPrefix}gcc
+    if [ -e $ccPath/${targetPrefix}gcc${exeSuffix} ]; then
+      wrap ${targetPrefix}gcc $wrapper $ccPath/${targetPrefix}gcc${exeSuffix}
      ln -s ${targetPrefix}gcc $out/bin/${targetPrefix}cc
      export named_cc=${targetPrefix}gcc
      export named_cxx=${targetPrefix}g++
-    elif [ -e $ccPath/clang ]; then
-      wrap ${targetPrefix}clang $wrapper $ccPath/clang
+    elif [ -e $ccPath/clang${exeSuffix} ]; then
+      wrap ${targetPrefix}clang $wrapper $ccPath/clang${exeSuffix}
      ln -s ${targetPrefix}clang $out/bin/${targetPrefix}cc
      export named_cc=${targetPrefix}clang
      export named_cxx=${targetPrefix}clang++
-    elif [ -e $ccPath/arocc ]; then
-      wrap ${targetPrefix}arocc $wrapper $ccPath/arocc
+    elif [ -e $ccPath/arocc${exeSuffix} ]; then
+      wrap ${targetPrefix}arocc $wrapper $ccPath/arocc${exeSuffix}
      ln -s ${targetPrefix}arocc $out/bin/${targetPrefix}cc
      export named_cc=${targetPrefix}arocc
    fi

-    if [ -e $ccPath/${targetPrefix}g++ ]; then
-      wrap ${targetPrefix}g++ $wrapper $ccPath/${targetPrefix}g++
+    if [ -e $ccPath/${targetPrefix}g++${exeSuffix} ]; then
+      wrap ${targetPrefix}g++ $wrapper $ccPath/${targetPrefix}g++${exeSuffix}
      ln -s ${targetPrefix}g++ $out/bin/${targetPrefix}c++
-    elif [ -e $ccPath/clang++ ]; then
-      wrap ${targetPrefix}clang++ $wrapper $ccPath/clang++
+    elif [ -e $ccPath/clang++${exeSuffix} ]; then
+      wrap ${targetPrefix}clang++ $wrapper $ccPath/clang++${exeSuffix}
      ln -s ${targetPrefix}clang++ $out/bin/${targetPrefix}c++
    fi

-    if [ -e $ccPath/${targetPrefix}cpp ]; then
-      wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
-    elif [ -e $ccPath/cpp ]; then
-      wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
+    if [ -e $ccPath/${targetPrefix}cpp${exeSuffix} ]; then
+      wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp${exeSuffix}
+    elif [ -e $ccPath/cpp${exeSuffix} ]; then
+      wrap ${targetPrefix}cpp $wrapper $ccPath/cpp${exeSuffix}
    fi
  ''

@@ -9,7 +9,7 @@

 let
  appName = "AeroSpace.app";
-  version = "0.20.0-Beta";
+  version = "0.20.2-Beta";
 in
 stdenv.mkDerivation {
  pname = "aerospace";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {

  src = fetchzip {
    url = "https://github.com/nikitabobko/AeroSpace/releases/download/v${version}/AeroSpace-v${version}.zip";
-    sha256 = "sha256-bPcVgTPvskit0/LeqmWoOOnlwwyzPoa48P8Vooaqlig=";
+    sha256 = "sha256-PyWHtM38XPNkkEZ0kACPia0doR46FRpmSoNdsOhU4uw=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -1,18 +1,18 @@
 --- a/src/argononed.c
 +++ b/src/argononed.c
-@@ -783,13 +783,13 @@
-     {
-         log_message(LOG_DEBUG, "EXEC REBOOT");
-         sync();
-        system("/sbin/reboot");
-+        system("/run/current-system/sw/bin/reboot");
-     }
-     if (count >= 39 && count <= 41)
-     {
-         log_message(LOG_DEBUG, "EXEC SHUTDOWN");
-         sync();
-        system("/sbin/poweroff");
-+        system("/run/current-system/sw/bin/poweroff");
-     }
- #else
-     log_message(LOG_INFO,"Daemon Ready");
+@@ -665,13 +665,13 @@
+         {
+             log_message(LOG_DEBUG, "EXEC REBOOT");
+             sync();
+-            system("/sbin/reboot");
+            system("reboot");
+         }
+         if (count >= 39 && count <= 41)
+         {
+             log_message(LOG_DEBUG, "EXEC SHUTDOWN");
+             sync();
+-            system("/sbin/poweroff");
+            system("poweroff");
+         }
+     } else {
+         log_message(LOG_INFO + LOG_BOLD,"Daemon Ready");
@@ -5,16 +5,15 @@
  dtc,
  installShellFiles,
 }:
-
 stdenv.mkDerivation {
  pname = "argononed";
-  version = "unstable-2022-03-26";
+  version = "0.4.1-unstable-2025-12-26";

  src = fetchFromGitLab {
    owner = "DarkElvenAngel";
    repo = "argononed";
-    rev = "97c4fa07fc2c09ffc3bd86e0f6319d50fa639578";
-    hash = "sha256-5/xUYbprRiwD+FN8V2cUpHxnTbBkEsFG2wfsEXrCrgQ=";
+    rev = "34d70b3bb1b2a8ba4b146ba7d9962dd0d925e67e";
+    hash = "sha256-f7YGoky4C5P/Iyez3kuLEKU/yWKZ4Dh6Cy//PAKMYuU=";
  };

  patches = [ ./fix-hardcoded-reboot-poweroff-paths.patch ];
@@ -11,6 +11,7 @@
  gitUpdater,
  glib,
  harfbuzzFull,
+  libicns,
  lib,
  libGL,
  libjpeg,
@@ -68,6 +69,9 @@ clangStdenv.mkDerivation (finalAttrs: {
    cmake
    ninja
    pkg-config
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isDarwin [
+    libicns
  ];

  buildInputs = [
@@ -108,10 +112,10 @@ clangStdenv.mkDerivation (finalAttrs: {
    substituteInPlace src/ver/CMakeLists.txt \
      --replace-fail '"1.x-dev"' '"${finalAttrs.version}"'

-    # Using substituteInPlace because no upstream patch for GCC 15 was found for this bundled library.
-    substituteInPlace third_party/json11/json11.cpp \
-      --replace-fail "#include <cmath>" "#include <cmath>
-    #include <cstdint>"
+    # Fix build on Darwin with `-Werror=format-security`
+    # (NSLog requires a string-literal format)
+    substituteInPlace laf/os/osx/logger.mm \
+      --replace-fail 'NSLog([NSString stringWithUTF8String:error]);' 'NSLog(@"%@", [NSString stringWithUTF8String:error]);'
  '';

  cmakeFlags = [
@@ -139,6 +143,10 @@ clangStdenv.mkDerivation (finalAttrs: {
    "-DSKIA_LIBRARY_DIR=${skia-aseprite}/lib"
  ];

+  # `libskia.a` is static, so its deps must be linked explicitly on Darwin
+  # (otherwise we hit undefined `_jpeg_*`/`_WebP*` symbols, e.g. in the thumbnailer).
+  env.NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isDarwin "-ljpeg -lwebp -lwebpdemux -lwebpmux";
+
  postInstall = ''
    # Install desktop icons.
    src="$out/share/aseprite/data/icons"
@@ -149,6 +157,30 @@ clangStdenv.mkDerivation (finalAttrs: {
    done
    # Delete unneeded artifacts of bundled libraries.
    rm -rf "$out"/{include,lib,man}
+  ''
+  + lib.optionalString clangStdenv.hostPlatform.isDarwin ''
+    install -d "$out/Applications"
+    if [ -d "$out/bin/aseprite.app" ]; then
+      rm -rf "$out/Applications/Aseprite.app"
+      mv "$out/bin/aseprite.app" "$out/Applications/Aseprite.app"
+    fi
+    # Generate the `.icns` files referenced by Info.plist from the shipped PNGs.
+    res="$out/Applications/Aseprite.app/Contents/Resources"
+    icons="$res/data/icons"
+    if [ -d "$icons" ] && command -v png2icns >/dev/null; then
+      for spec in "Aseprite ase" "Document doc" "Extension ext"; do
+        set -- $spec
+        name="$1"
+        prefix="$2"
+        png2icns "$res/$name.icns" \
+          "$icons/''${prefix}16.png" \
+          "$icons/''${prefix}32.png" \
+          "$icons/''${prefix}128.png" \
+          "$icons/''${prefix}256.png"
+      done
+    fi
+    # Keep $out/bin clean on Darwin; the bundle lives under $out/Applications.
+    rmdir "$out/bin" 2>/dev/null || true
  '';

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
@@ -159,20 +191,19 @@ clangStdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.unfree;
    longDescription = ''
      Aseprite is a program to create animated sprites. Its main features are:
-
-                - Sprites are composed by layers & frames (as separated concepts).
-                - Supported color modes: RGBA, Indexed (palettes up to 256 colors), and Grayscale.
-                - Load/save sequence of PNG files and GIF animations (and FLC, FLI, JPG, BMP, PCX, TGA).
-                - Export/import animations to/from Sprite Sheets.
-                - Tiled drawing mode, useful to draw patterns and textures.
-                - Undo/Redo for every operation.
-                - Real-time animation preview.
-                - Multiple editors support.
-                - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
-                - Onion skinning.
+        - Sprites are composed by layers & frames (as separated concepts).
+        - Supported color modes: RGBA, Indexed (palettes up to 256 colors), and Grayscale.
+        - Load/save sequence of PNG files and GIF animations (and FLC, FLI, JPG, BMP, PCX, TGA).
+        - Export/import animations to/from Sprite Sheets.
+        - Tiled drawing mode, useful to draw patterns and textures.
+        - Undo/Redo for every operation.
+        - Real-time animation preview.
+        - Multiple editors support.
+        - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
+        - Onion skinning.
    '';
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.iamanaws ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "aseprite";
  };
 })
@@ -9,20 +9,20 @@

 python3Packages.buildPythonApplication rec {
  pname = "audible-cli";
-  version = "0.3.2";
+  version = "0.3.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mkb79";
    repo = "audible-cli";
    tag = "v${version}";
-    hash = "sha256-DGOOMjP6dxIwbIhzRKf0+oy/2Cs+00tpwHkcmrukatw=";
+    hash = "sha256-ckI6nZUggIMvjJtN1zWXvTlVdiog0uJy6YR110A+JxM=";
  };

  nativeBuildInputs =
    with python3Packages;
    [
-      setuptools
+      hatchling
    ]
    ++ [
      addBinToPathHook
@@ -37,7 +37,6 @@ python3Packages.buildPythonApplication rec {
    packaging
    pillow
    questionary
-    setuptools
    tabulate
    toml
    tqdm
@@ -50,7 +49,6 @@ python3Packages.buildPythonApplication rec {
  postInstall = ''
    installShellCompletion --cmd audible \
      --bash <(source utils/code_completion/audible-complete-bash.sh) \
-      --fish <(source utils/code_completion/audible-complete-zsh-fish.sh) \
      --zsh <(source utils/code_completion/audible-complete-zsh-fish.sh)
  '';

@@ -29,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bazaar";
-  version = "0.7.3";
+  version = "0.7.5";

  src = fetchFromGitHub {
    owner = "kolunmi";
    repo = "bazaar";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T0HQ1bjH2nd9+BJAvhSNcpYp25Jt0sNZxKeTY7EfsSw=";
+    hash = "sha256-c6mAWnX0iKXJqOxe/kgUqmXXVKO7ZEI+vKoYLKOuNos=";
  };

  nativeBuildInputs = [
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "biome";
-  version = "2.3.11";
+  version = "2.3.12";

  src = fetchFromGitHub {
    owner = "biomejs";
    repo = "biome";
    rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-AWVFrzIDg+mVnUYTMLr10o8IOSvewVhVMcYd2wvT5y0=";
+    hash = "sha256-v/m7yS9bE3/WpfuqZoW+tgIEm1ARsXze/0PRUWi+mHA=";
  };

-  cargoHash = "sha256-N2TauXj1pRrYnVD0qPtruy7qwdWBGJaa47++AaY8TMQ=";
+  cargoHash = "sha256-ldxw6znHscxfgg91BpaexsEvy3Dw2UMjcvI72VLUKG0=";

  nativeBuildInputs = [ pkg-config ];

@@ -16,6 +16,8 @@
  readline,
  sbc,
  python3,
+  systemdSupport ? true,
+  systemdLibs,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
    autoreconfHook
    pkg-config
    python3
-  ];
+  ]
+  ++ lib.optional systemdSupport systemdLibs;

  buildInputs = [
    alsa-lib
@@ -49,9 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
    libbsd
    ncurses
  ]
-  ++ lib.optionals aacSupport [
-    fdk_aac
-  ];
+  ++ lib.optional aacSupport fdk_aac;

  configureFlags = [
    (lib.enableFeature aacSupport "aac")
@@ -59,6 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.enableFeature true "rfcomm")
    (lib.withFeatureAs true "alsaplugindir" "${placeholder "out"}/lib/alsa-lib")
    (lib.withFeatureAs true "dbusconfdir" "${placeholder "out"}/share/dbus-1/system.d")
+    (lib.enableFeature systemdSupport "systemd")
+    (lib.withFeatureAs systemdSupport "systemdsystemunitdir" "${placeholder "out"}/lib/systemd/system")
+    (lib.withFeatureAs systemdSupport "bluealsauser" "bluealsa")
+    (lib.withFeatureAs systemdSupport "bluealsaaplayuser" "bluealsa")
  ];

  passthru.updateScript = gitUpdater { };
@@ -3,32 +3,39 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  makeWrapper,
  sdl2-compat,
+  vulkan-loader,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bstone";
-  version = "1.2.16";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "bibendovsky";
    repo = "bstone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6BNIMBbLBcQoVx5lnUz14viAvBcFjoZLY8c30EgcvKQ=";
+    hash = "sha256-D0f4DmVv2Bo3cwCUuo3LsXNWFR16rirpvSnAS2C6YEY=";
  };

  nativeBuildInputs = [
    cmake
+    makeWrapper
  ];

  buildInputs = [
    sdl2-compat
+    vulkan-loader
  ];

  postInstall = ''
    mkdir -p $out/{bin,share/bibendovsky/bstone}
    mv $out/bstone $out/bin
    mv $out/*.txt $out/share/bibendovsky/bstone
+
+    wrapProgram $out/bin/bstone \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}
  '';

  meta = {
@@ -1,34 +1,35 @@
 {
  lib,
-  rustPlatform,
  fetchFromGitHub,
-  pkg-config,
-  libunwind,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bugstalker";
-  version = "0.3.1";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "godzie44";
    repo = "BugStalker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-c3NyYDz+Ha5jHTpXLw9xsY+h0NjW9Uvpyn2PStmahKA=";
+    hash = "sha256-9l6IVQBjZkpSS28ai/d27JUPBWj2Q17RVhsFrrI45TM=";
  };

-  cargoHash = "sha256-/FSV/avsg7kbgtinmKBb0+gemLFZdSE+A+tfLvtfNas=";
-
-  buildInputs = [ libunwind ];
-
-  nativeBuildInputs = [ pkg-config ];
+  cargoHash = "sha256-+VvKWY9CqUUkDKzG2nLG9ibkE6xwP3StTzlovBZH8O8=";

  # Tests require rustup.
  doCheck = false;

+  nativeInstallCheckHook = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Rust debugger for Linux x86-64";
    homepage = "https://github.com/godzie44/BugStalker";
+    changelog = "https://github.com/godzie44/BugStalker/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jacg ];
    mainProgram = "bs";
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "cantus";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "CodedNil";
    repo = "cantus";
    tag = version;
-    hash = "sha256-/gwZqr66rpD7w9EuN03vKRWVH/DYDLUvijEkmrN2E+c=";
+    hash = "sha256-dAMphU+voDUwFzlPuV6nCUg0RaVVyRJLoM6IwjUtvA4=";
  };

-  cargoHash = "sha256-vC/07gvVMH/UATFl7NvJTRLzIOSjrelzINmQ6zUBSos=";
+  cargoHash = "sha256-0RVjHKg2msoxY+0WZHOPOAXK2nNne7CA9owmNUf8x6I=";

  nativeBuildInputs = [
    pkg-config
@@ -7,11 +7,11 @@
 }:
 let
  pname = "capacities";
-  version = "1.52.6";
+  version = "1.57.24";

  src = fetchurl {
-    url = "https://web.archive.org/web/20250519011655/https://capacities-desktop-app.fra1.cdn.digitaloceanspaces.com/capacities-${version}.AppImage";
-    hash = "sha256-M5K2TxrB2Ut/wYKasl8EqbzLjFJrqjWfPIJTZV4fi4s=";
+    url = "https://web.archive.org/web/20260110164323/https://capacities-desktop-app.fra1.cdn.digitaloceanspaces.com/Capacities-1.57.24.AppImage";
+    hash = "sha256-BWan10ItF/hKEMGG/m32QgjySLReqJnrtq5z0k9oYcA=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -32,7 +32,7 @@ appimageTools.wrapType2 {
  extraInstallCommands = ''
    source "${makeWrapper}/nix-support/setup-hook"
    wrapProgram $out/bin/capacities \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "--ozone-platform-hint=auto"

    # Check for required desktop file
    if [ ! -f ${appimageContents}/capacities.desktop ]; then
@@ -41,6 +41,8 @@ appimageTools.wrapType2 {
    else
      # Install and modify the desktop file
      install -m 444 -D ${appimageContents}/capacities.desktop $out/share/applications/capacities.desktop
+      substituteInPlace $out/share/applications/capacities.desktop \
+        --replace-fail "Exec=AppRun" "Exec=capacities"
    fi

    # Check for required icon file
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-flamegraph";
-  version = "0.6.10";
+  version = "0.6.11";

  src = fetchFromGitHub {
    owner = "flamegraph-rs";
    repo = "flamegraph";
    rev = "v${version}";
-    sha256 = "sha256-WBJS+0RzFg8dgmxYuHOguJROPONdlkIfllpeCKxaSHY=";
+    sha256 = "sha256-WPWS3NX6t8RNNALqYF2JMLI5HWVhsVmhg9ULZKt972I=";
  };

-  cargoHash = "sha256-nDZHkF3RvKdrXhfD0NGRL/xjCxIP2zRe4w1LVxHkdi8=";
+  cargoHash = "sha256-U/Cs4HRNuxq7RaWHmmLoWbiZgqumSRFRLpe1N/63q+E=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ];

@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-pgo";
-  version = "0.2.9";
+  version = "0.2.10";

  src = fetchFromGitHub {
    owner = "kobzol";
    repo = "cargo-pgo";
    rev = "v${version}";
-    hash = "sha256-FmZllibhesZY/8kIMnx4VfQrYF6+/cai7Gozda/3bMY=";
+    hash = "sha256-kYdEFUifpBlbEcFnDELu8OwvS46eeJQSU/6VyLQD2mk=";
  };

-  cargoHash = "sha256-uOwWCSXxxnMCFS0+aFPUHSiSWSwNZPtL8NJVCCCDzAc=";
+  cargoHash = "sha256-sY4UUGbTzw5dlALzQ6Iyo3hxB3Qni4infZRexHcle3I=";

  # Integration tests do not run in Nix build environment due to needing to
  # create and build Cargo workspaces.
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-semver-checks";
-  version = "0.45.0";
+  version = "0.46.0";

  src = fetchFromGitHub {
    owner = "obi1kenobi";
    repo = "cargo-semver-checks";
    tag = "v${version}";
-    hash = "sha256-sDx449IXsFUeNL7rXbGC+HUshwqcbpjvGwl0WIJZmwo=";
+    hash = "sha256-y2tkTPctit5rx6OyohPPVo117sGICg6UEDg7RWFmtMA=";
  };

-  cargoHash = "sha256-meF1qnISB60JXKZyYfnwE2LywGqKEVgZbwzZQEZ1Cmc=";
+  cargoHash = "sha256-lP4yXCuJ89NqUBZR6zgGi5B570y+5IaabWyzd9qqa3o=";

  nativeBuildInputs = [
    cmake
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "cfv";
-  version = "3.1.0";
+  version = "3.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cfv-project";
    repo = "cfv";
    tag = "v${version}";
-    sha256 = "1wxf30gsijsdvhv5scgkq0bqi8qi4dgs9dwppdrca5wxgy7a8sn5";
+    sha256 = "sha256-vKlnW6Z0Rg2bptU5fxIKDaOY2b+WY/fgaYZQu5tBU44=";
  };

  build-system = with python3.pkgs; [
@@ -3,22 +3,23 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  nix-update-script,
  pandoc,
  go,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "checkmake";
-  version = "0.2.2";
+  version = "0.3.1";

  src = fetchFromGitHub {
-    owner = "mrtazz";
+    owner = "checkmake";
    repo = "checkmake";
-    tag = version;
-    hash = "sha256-Ql8XSQA/w7wT9GbmYOM2vG15GVqj9LxOGIu8Wqp9Wao=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-W+4bKERQL4nsPxrcCP19uYAwSw+tK9mAQp/fufzYcYg=";
  };

-  vendorHash = null;
+  vendorHash = "sha256-Iv3MFhHnwDLIuUH7G6NYyQUSAaivBYqYDWephHnBIho=";

  nativeBuildInputs = [
    installShellFiles
@@ -28,12 +29,14 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X=main.version=${version}"
+    "-X=main.version=${finalAttrs.version}"
    "-X=main.buildTime=1970-01-01T00:00:00Z"
    "-X=main.builder=nixpkgs"
    "-X=main.goversion=go${go.version}"
  ];

+  passthru.updateScript = nix-update-script { };
+
  postPatch = ''
    substituteInPlace man/man1/checkmake.1.md \
      --replace REPLACE_DATE 1970-01-01T00:00:00Z
@@ -48,14 +51,14 @@ buildGoModule rec {
  '';

  meta = {
-    description = "Experimental tool for linting and checking Makefiles";
+    description = "Linter and analyzer for Makefiles";
    mainProgram = "checkmake";
-    homepage = "https://github.com/mrtazz/checkmake";
-    changelog = "https://github.com/mrtazz/checkmake/releases/tag/${src.rev}";
+    homepage = "https://github.com/checkmake/checkmake";
+    changelog = "https://github.com/checkmake/checkmake/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    longDescription = ''
-      checkmake is an experimental tool for linting and checking
-      Makefiles. It may not do what you want it to.
+      checkmake is a linter for Makefiles. It scans Makefiles for potential issues based on configurable rules.
    '';
+    maintainers = with lib.maintainers; [ lafrenierejm ];
  };
-}
+})
@@ -94,6 +94,7 @@ stdenv.mkDerivation {

    for file in "$out"/bin/* "$lib"/lib/*.dylib; do
      if [ -L "$file" ]; then continue; fi
+      if [[ "$file" == *.py ]]; then continue; fi
      echo "$file: fixing dylib references"
      # note that -id does nothing on binaries
      install_name_tool -id "$file" "''${flags[@]}" "$file"
@@ -27,12 +27,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.138.0";
+  version = "1.139.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    hash = "sha256-yx6sk6FO7MHNuRFBMhOXTSjtDQ0B6XyhGHb4uHSXx/8=";
+    hash = "sha256-Yj9BqmmotIaTUHIUslaOmRXYC4ujQ9GNjEmaAfLgLgU=";
    fetchSubmodules = true;
  };

@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2025.11.1";
+  version = "2026.1.1";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflared";
    tag = version;
-    hash = "sha256-OspDwmh8rzGaHlLfQiUxQzDNxBdzkBJbPrmL1YN7BtM=";
+    hash = "sha256-9+WDVS2pZR5nbbpdGSi9jO8ccT0L5K7NLdobL8J+bYU=";
  };

  vendorHash = null;
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.8.5";
+  version = "2.8.6";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    hash = "sha256-SHul8plxCA8S1DT7ThYpEn2ce1DgexWJExoz7avRMtw=";
+    hash = "sha256-k+/KajRRKsfEFk8ApEJ154pT4cR54ZnavSrk8U4Azso=";
  };

  postPatch = ''
@@ -7,13 +7,13 @@

 buildNpmPackage {
  pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-01-06";
+  version = "0-unstable-2026-01-20";

  src = fetchFromGitHub {
    owner = "fannheyward";
    repo = "coc-rust-analyzer";
-    rev = "35615c7feafbc8005e160e7609888a97f5d3b031";
-    hash = "sha256-Kj3gUKFsfgUVVWuz7nuc7djRvfyvXc3wkHt1DxYIw30=";
+    rev = "edde4d30f76bb6ff2e0684be4da496ed5d8166c4";
+    hash = "sha256-cBpGhkpqAnzjUHyzuTWkUxMpFjGIdxrXu7TZRbomK9A=";
  };

  npmDepsHash = "sha256-PgMgpVoKmhuqtSV73wSdqdQ5Bt5AeRwbn71mIulBh8Y=";
@@ -1,22 +1,22 @@
 {
-  "version": "2.3.41",
+  "version": "2.4.21",
  "vscodeVersion": "1.105.1",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/linux/x64/Cursor-2.3.41-x86_64.AppImage",
-      "hash": "sha256-ItUgknMzSDeXxN3Yi/pz2wZoz7vVVqx9nGXuGmbHbXc="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/linux/x64/Cursor-2.4.21-x86_64.AppImage",
+      "hash": "sha256-OOjANfVHMlRN1uWq2jNmK/RqI4Q5NTlN/19Nl2jWiKI="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/linux/arm64/Cursor-2.3.41-aarch64.AppImage",
-      "hash": "sha256-0D0IbkUyvCyCbf8apO7WG3KrcCEgv2TLNRjFOD8mcgU="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/linux/arm64/Cursor-2.4.21-aarch64.AppImage",
+      "hash": "sha256-tk7TzkLy8oHtXp0UcMwhDXa9B2f2lanWYmPbF7OKfZ0="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-/GcQppfoBS9rIksQ/wYYH9Is7Sw2ZnjoW1Tk0hN8Y7g="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-uacRpz0HFRfmaNekSB5qLXpnhiQRvAw03W+9QfPl6ZY="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-ejhhXRhNTMh9n2cPkpNC0msk4Z1OFD2EzxwkJYw92XU="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-nCch/JXO1lzj0ibAa8e0OPlnBTOrIk/fvq9CO46Ev8w="
    }
  }
 }
@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.88.0";
+  version = "0.89.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-Ff6Ut1GwRPd2oB4/YojKgS/CYMG0TVizXOHKfpKClqY=";
+    hash = "sha256-VFbtxGOqX80qWqVo+BG+BnUr8DiLCfcJCrN9fwy7utY=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-eLao+Jaq7+Bu9QNHDJYD3zX2BQvlX/BSTYr4gpCD++Q=";
+  cargoHash = "sha256-gg7KPEMO2aiBcIN8TllaDQeTLyw+WLfmMrXBKV/L53M=";

  nativeBuildInputs = [
    installShellFiles
@@ -1,7 +1,6 @@
 {
  lib,
-  python3,
-  fetchPypi,
+  python3Packages,
  fetchFromGitHub,
  gitMinimal,
  stdenv,
@@ -10,41 +9,32 @@
  versionCheckHook,
  writableTmpDirAsHomeHook,
 }:
-let
-  # commitizen 4.9.1 is not compatible with version 3.0.52 of prompt-toolkit
-  python = python3.override {
-    packageOverrides = self: super: {
-      prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec {
-        version = "3.0.51";
-        pname = "prompt_toolkit";
-        src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-kxoWLjsn/JDIbxtIux+yxSjCdhR15XycBt4TMRx7VO0=";
-        };
-      });
-    };
-  };
-  python3Packages = python.pkgs;
-in
+
 python3Packages.buildPythonPackage rec {
  pname = "commitizen";
-  version = "4.10.1";
+  version = "4.11.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "commitizen-tools";
    repo = "commitizen";
    tag = "v${version}";
-    hash = "sha256-B4V2UPTEXQNASrwGRZbfFOqPuBIFzBM39a5rAC+Hk5Q=";
+    hash = "sha256-7KF7qzBWF8OQLHxXYWHI+zcjBWV7KogMr0FYhitPSTw=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build >= 0.9.17, <0.10.0" "uv-build"
+  '';
+
  pythonRelaxDeps = [
    "argcomplete"
    "decli"
+    "prompt-toolkit"
    "termcolor"
  ];

-  build-system = with python3Packages; [ poetry-core ];
+  build-system = with python3Packages; [ uv-build ];

  nativeBuildInputs = [ installShellFiles ];

@@ -75,7 +65,7 @@ python3Packages.buildPythonPackage rec {
    pytest-freezer
    pytest-mock
    pytest-regressions
-    pytest7CheckHook
+    pytestCheckHook
  ]);

  versionCheckProgramArg = "version";
@@ -5,18 +5,18 @@
  installShellFiles,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "crowdsec";
-  version = "1.7.2";
+  version = "1.7.6";

  src = fetchFromGitHub {
    owner = "crowdsecurity";
    repo = "crowdsec";
-    tag = "v${version}";
-    hash = "sha256-f0SxOXxXqKft3Nnf9y7itpPXJOjBrEpImbPANFNx4BM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Qd5EHn7G7bTV+S4bVXfHytoCI5L/gHxAKB9emeKoSLc=";
  };

-  vendorHash = "sha256-v1UECFfgx1zFCzSyazxFRWMP/0fayVnrC+pJHio5z+Q=";
+  vendorHash = "sha256-txiZmUd/GQQu7XiI4iE25aCmOLe2sC0uQ8Gne76cw+Q=";

  nativeBuildInputs = [ installShellFiles ];

@@ -28,9 +28,9 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/crowdsecurity/go-cs-lib/version.Version=v${version}"
+    "-X github.com/crowdsecurity/go-cs-lib/version.Version=v${finalAttrs.version}"
    "-X github.com/crowdsecurity/go-cs-lib/version.BuildDate=1970-01-01_00:00:00"
-    "-X github.com/crowdsecurity/go-cs-lib/version.Tag=v${version}"
+    "-X github.com/crowdsecurity/go-cs-lib/version.Tag=v${finalAttrs.version}"
    "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.Codename=alphaga"
    "-X github.com/crowdsecurity/crowdsec/pkg/csconfig.defaultConfigDir=/etc/crowdsec"
    "-X github.com/crowdsecurity/crowdsec/pkg/csconfig.defaultDataDir=/var/lib/crowdsec/data"
@@ -56,7 +56,7 @@ buildGoModule rec {
  preCheck = ''
    version=$($GOPATH/bin/cscli version 2>&1 | sed -nE 's/^version: (.*)/\1/p')

-    if [ "$version" != "v${version}" ]; then
+    if [ "$version" != "v${finalAttrs.version}" ]; then
        echo "Invalid version string: '$version'"
        exit 1
    fi
@@ -64,7 +64,7 @@ buildGoModule rec {

  meta = {
    homepage = "https://crowdsec.net/";
-    changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${version}";
+    changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${finalAttrs.version}";
    description = "Free, open-source and collaborative IPS";
    longDescription = ''
      CrowdSec is a free, modern & collaborative behavior detection engine,
@@ -82,4 +82,4 @@ buildGoModule rec {
      jk
    ];
  };
-}
+})
@@ -3,18 +3,18 @@
  stdenv,
  fetchFromGitHub,
  cmake,
-  sfml_2,
+  sfml,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "csfml";
-  version = "2.6.1";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "SFML";
    repo = "CSFML";
    tag = finalAttrs.version;
-    hash = "sha256-ECt0ySDpYWF0zuDBSnQzDwUm4Xj4z1+XSC55D6yivac=";
+    hash = "sha256-8CRS+dV/hVQNTmgkxyFKcyTj/HWRks5bie4n6N/RWYM=";
  };

  # Fix incorrect path joining in cmake
@@ -27,9 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ sfml_2 ];
+  buildInputs = [ sfml ];
  cmakeFlags = [
-    (lib.cmakeFeature "CMAKE_MODULE_PATH" "${sfml_2}/share/SFML/cmake/Modules/")
+    (lib.cmakeFeature "CMAKE_MODULE_PATH" "${sfml}/share/SFML/cmake/Modules/")
  ];

  meta = {
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  sfml_2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "csfml";
+  version = "2.6.1";
+
+  src = fetchFromGitHub {
+    owner = "SFML";
+    repo = "CSFML";
+    tag = finalAttrs.version;
+    hash = "sha256-ECt0ySDpYWF0zuDBSnQzDwUm4Xj4z1+XSC55D6yivac=";
+  };
+
+  # Fix incorrect path joining in cmake
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    substituteInPlace tools/pkg-config/csfml-*.pc.in \
+      --replace-fail \
+        'libdir=''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@' \
+        "libdir=@CMAKE_INSTALL_FULL_LIBDIR@"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ sfml_2 ];
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_MODULE_PATH" "${sfml_2}/share/SFML/cmake/Modules/")
+  ];
+
+  meta = {
+    homepage = "https://www.sfml-dev.org/";
+    description = "Simple and fast multimedia library";
+    longDescription = ''
+      SFML is a simple, fast, cross-platform and object-oriented multimedia API.
+      It provides access to windowing, graphics, audio and network.
+      It is written in C++, and has bindings for various languages such as C, .Net, Ruby, Python.
+    '';
+    license = lib.licenses.zlib;
+    maintainers = [ lib.maintainers.jpdoyle ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -13,7 +13,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  inherit pname;
-  version = "25.1.5";
+  version = "25.2.6";

  src =
    let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
    in
    fetchurl {
      url = "https://www.dbvis.com/product_download/dbvis-${finalAttrs.version}/media/dbvis_linux_${underscoreVersion}.tar.gz";
-      hash = "sha256-PLYolzwQa9xj6z+r/8jS9tbiR8zVTQKOhtJJBN8dNhI=";
+      hash = "sha256-yiL0FFkSntwLy/oOkiDQKTvTOUrtbv/9kV+1nLZtMB0=";
    };

  strictDeps = true;
@@ -128,7 +128,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoTestFlags = [
    "--lib" # unit tests
-    "--test integration_tests"
+    "--test=integration_tests"
    # Test targets not included here:
    # - node_compat: there are tons of network access in them and it's not trivial to skip test cases.
    # - specs: this target uses a custom test harness that doesn't implement the --skip flag.
@@ -11,13 +11,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "distrobox";
-  version = "1.8.2.2";
+  version = "1.8.2.3";

  src = fetchFromGitHub {
    owner = "89luca89";
    repo = "distrobox";
    tag = finalAttrs.version;
-    hash = "sha256-g7GbMJeUfDf3FIM2K7rk0X9SNyUMV0A3fSP1J5F44oo=";
+    hash = "sha256-p/IQ6HWG01UPbiskp3u1UUm8YEnpY9jUGqqODrYS1Ck=";
  };

  dontConfigure = true;
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "dnsmonster";
-  version = "1.1.0";
+  version = "1.2.9";

  src = fetchFromGitHub {
    owner = "mosajjal";
    repo = "dnsmonster";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+GFkGUR3XKDgrxVAZ3MuPxGyI0oGROdhHKMBwMSvoBI=";
+    hash = "sha256-SDAD5OBactf0dynUmLgdrg+m0bZATh4wGW/NZ2gG+dI=";
  };

  vendorHash = "sha256-7rIBbaYr1dgC0ArcuwZelHKG5TLIQDV9JSBoYOcz+C0=";
@@ -9,13 +9,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "empire-compiler";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "bc-security";
    repo = "empire-compiler";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BuNg5RetGEV/YAZnZP7rkMHif9NczOx2e4OAVDjafuI=";
+    hash = "sha256-HNT1sELoyibXDoRcKkBZiJHIsNY7Hz2fZfHEM93UCBE=";
  };

  postPatch = ''
@@ -106,7 +106,6 @@ stdenv.mkDerivation {
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
      fpletz
-      ma27
    ];
    platforms = lib.platforms.linux;
  };
@@ -93,7 +93,7 @@ let
  };
 in
 symlinkJoin {
-  name = "etcd-${version}";
+  pname = "etcd";

  inherit meta version;

@@ -117,7 +117,7 @@ let
  };
 in
 symlinkJoin {
-  name = "etcd-${version}";
+  pname = "etcd";

  inherit meta version;

@@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "euphonica";
-  version = "0.98.0-beta";
+  version = "0.98.1-beta.1";

  src = fetchFromGitHub {
    owner = "htkhiem";
    repo = "euphonica";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pLs8aLm2CyT8eVtbB8UQj9xSqnjViRxKjuH3A6RErjA=";
+    hash = "sha256-QFwkHFE+6CcZWwSKIUyf1RVQwHMkVqc4P6NacNgXnH0=";
    fetchSubmodules = true;
  };

@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-w6xZQP8QTTPKQgPCX20IvoWErrgWVisEIJKkxwtQHho=";
+    hash = "sha256-qbbmi6qRrrzhMl/JJcnaTlV0gzasM5ssZRX3+exGh0o=";
  };

  mesonBuildType = "release";
@@ -17,13 +17,13 @@
 }:

 let
-  version = "0.300.4";
+  version = "0.300.5";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-f2whzEq0LOyvNVLjSNvA19azbtJnOMJqu5EJQXnzZyg=";
+    hash = "sha256-TRd7usz3+a9h8f/waLKqlu6RuF/GsU9LdCx1NRGWIDA=";
  };

  vendorHash = "sha256-IB3DqaUbdrqnYQpyHtnvY37xjbRvTvNOV39b8wciuTA=";
@@ -21,8 +21,8 @@ let
  };

  cygwin = fetchurl {
-    url = "https://mirrors.kernel.org/sourceware/cygwin/x86_64/release/cygwin/cygwin-3.6.1-1-x86_64.tar.xz";
-    sha256 = "45d1c76a15426209c20a8d4df813e94fbd17bd5d85ad4d742515ff432400143e";
+    url = "https://mirrors.kernel.org/sourceware/cygwin/x86_64/release/cygwin/cygwin-3.6.6-1-x86_64.tar.xz";
+    hash = "sha256-xcgYjfVB9dF0twGC1ww7r4NCPHT/+aEk1CMmS7ndJuA=";
  };

  patched_eac = stdenv.mkDerivation {
@@ -77,7 +77,7 @@ let
  };
 in
 symlinkJoin {
-  name = "${pname}-${version}";
+  inherit pname version;

  paths = [
    wrapper
@@ -11,20 +11,21 @@
  nix-update-script,
  python3Packages,
  umu-launcher,
+  lsfg-vk,
  wrapGAppsHook3,
  xdg-utils,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "faugus-launcher";
-  version = "1.11.8";
+  version = "1.13.9";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "Faugus";
    repo = "faugus-launcher";
    tag = version;
-    hash = "sha256-VgafXX8EuX0WOpG0cxBNlUdLL4HrrcpdblpCMxka2ms=";
+    hash = "sha256-tkCcKnRhIbBXinZsxe7A6UGdzrmcT9l1u4/aopOtA5E=";
  };

  nativeBuildInputs = [
@@ -52,11 +53,16 @@ python3Packages.buildPythonApplication rec {
      --replace-fail "PathManager.find_binary('faugus-run')" "'$out/bin/.faugus-run-wrapped'" \
      --replace-fail "PathManager.find_binary('faugus-proton-manager')" "'$out/bin/.faugus-proton-manager-wrapped'" \
      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'" \
+      --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
+      --replace-fail 'Path("/usr/lib/liblsfg-vk.so")' 'Path("${lsfg-vk}/lib/liblsfg-vk.so")' \
      --replace-fail 'Exec={faugus_run}' 'Exec=faugus-run'

    substituteInPlace faugus_run.py \
-      --replace-fail "PathManager.find_binary('faugus-components')" "'$out/bin/.faugus-components-wrapped'" \
      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'"
+
+    substituteInPlace faugus/shortcut.py \
+      --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
+      --replace-fail 'Path("/usr/lib/liblsfg-vk.so")' 'Path("${lsfg-vk}/lib/liblsfg-vk.so")'
  '';

  dontWrapGApps = true;
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  cmake,
  pkg-config,
  ffmpeg-headless,
@@ -12,23 +11,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ffmpegthumbnailer";
-  version = "2.2.3";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "dirkvdb";
    repo = "ffmpegthumbnailer";
-    tag = finalAttrs.version;
-    hash = "sha256-1hVPtCPwfovCtA6aagViUJkYTCFuiFkOqGEqMHIoZe8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-h8B12FItvSrYgy6t78A02DL96Az4BxtW8brFKkZLH9o=";
  };

-  patches = [
-    (fetchpatch {
-      name = "ffmpeg-8-fix.patch";
-      url = "https://github.com/dirkvdb/ffmpegthumbnailer/commit/df789ec326ae0f2c619f91c8f2fc8b5e45b50a70.patch";
-      hash = "sha256-PArrcKuaWWA6/H59MbdC36B57GSvvp5sHz24QLTBZYw=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -40,7 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
    libjpeg
  ];

-  cmakeFlags = [ "-DENABLE_THUMBNAILER=ON" ];
+  cmakeFlags = [
+    "-DENABLE_THUMBNAILER=ON"
+    "-DENABLE_AUDIO_THUMBNAILER=ON"
+  ];

  # https://github.com/dirkvdb/ffmpegthumbnailer/issues/215
  postPatch = ''
@@ -3,20 +3,21 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  nix-update-script,
 }:

-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
  pname = "flood-for-transmission";
-  version = "2025-07-19T10-51-22";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "johman10";
    repo = "flood-for-transmission";
-    tag = version;
-    hash = "sha256-2oHEVvZZcxH9RBKreaiwFKp7Iu5ijYdpXdgVknCxwKw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-c1K7ldraw9lzVtABz39B9569jHEuo6N3Iy8aCCfBOXE=";
  };

-  npmDepsHash = "sha256-IUdsUGsm6yAbXqf4UGkz1VPa366TnWsTakkbywbLeTU=";
+  npmDepsHash = "sha256-yD9VwnAqE+k2/Z60YdJD6F1f4Cn3fcROCTopDq+DUWU=";

  strictDeps = true;

@@ -28,12 +29,15 @@ buildNpmPackage rec {
    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Flood clone for Transmission";
    homepage = "https://github.com/johman10/flood-for-transmission";
    downloadPage = "https://github.com/johman10/flood-for-transmission/releases";
+    changelog = "https://github.com/johman10/flood-for-transmission/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ al3xtjames ];
    platforms = lib.platforms.all;
  };
-}
+})
@@ -49,14 +49,14 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "12.6.0";
+  version = "12.6.1";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-Otvv8NSGfze/WKN78nipVWkycqHh94ReHkVjYR8L0/E=";
+    hash = "sha256-RMrFuxcPDJ3LJgsPzZhs/Zd2A9m3uqgUbHpwQ6+ojys=";
  };

  vendorHash = "sha256-fvSiEIE4XSJ8Ot4Tcmt8chD11fHVsECD2/8xrgIKhJs=";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "olm";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "olm";
    tag = version;
-    hash = "sha256-HwmWwGs62Dy/65HTgApuXLv4YRrFzi37A4JoL7vdLdo=";
+    hash = "sha256-k5l8l8nLI52oox1qUHEax8l939NyDum/RbwEYOgCDIc=";
  };

-  vendorHash = "sha256-hLnoQof899zLnjbHrzvW2Y3Jj6fegxCVCRnz3XYKCeQ=";
+  vendorHash = "sha256-lqH/pMWeDsTJa39uJwHntCAUs0BwJiB0aMyFaI++5ms=";

  ldflags = [
    "-s"
@@ -14,9 +14,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "GDQuest";
    repo = "GDScript-formatter";
    tag = finalAttrs.version;
-    hash = "sha256-nnLVmd7wVHdDcAnyCHCVYckmbzMdSGIVL2iSgDC+9cs=";
+    hash = "sha256-V9zrL2Aku5e+9McXpXdXvsGJKjqVXIIaAsoAF2xHB4g=";
    # Needed due to .gitattributes being used for the Godot addon and export-ignoring all files
    deepClone = true;
+    # Avoid hash differences due to differences in .git
+    leaveDotGit = false;
  };

  cargoHash = "sha256-xqGmv/e1Ch/EqutIb2claiJ8fQGDDdOriOZdt8SR8mw=";
--- a/Show More
+++ b/Show More