Merge remote-tracking branch 'origin/master' into staging-nixos

2026-04-02 10:10:52 +03:00
parent 2cf3f9e6da fcac81bd6f
commit 7ca0184c7b
166 changed files with 1219 additions and 1207 deletions
@@ -26,10 +26,10 @@

 # Libraries
 /lib                        @infinisil @hsjobeki
-/lib/generators.nix         @infinisil @hsjobeki @Profpatsch
-/lib/cli.nix                @infinisil @hsjobeki @Profpatsch
-/lib/debug.nix              @infinisil @hsjobeki @Profpatsch
-/lib/asserts.nix            @infinisil @hsjobeki @Profpatsch
+/lib/generators.nix         @infinisil @hsjobeki
+/lib/cli.nix                @infinisil @hsjobeki
+/lib/debug.nix              @infinisil @hsjobeki
+/lib/asserts.nix            @infinisil @hsjobeki
 /lib/path/*                 @infinisil @hsjobeki
 /lib/fileset                @infinisil @hsjobeki
 /maintainers/github-teams.json @infinisil
@@ -75,7 +75,7 @@
 /pkgs/pkgs-lib                                   @Stunkymonkey @h7x4

 # Nixpkgs build-support
-/pkgs/build-support/writers @lassulus @Profpatsch
+/pkgs/build-support/writers @lassulus

 # Nixpkgs make-disk-image
 /doc/build-helpers/images/makediskimage.section.md  @raitobezarius
@@ -335,8 +335,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/dlang @jtbx @TomaSajt

 # Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
+/pkgs/development/dhall-modules      @Gabriella439
+/pkgs/development/interpreters/dhall @Gabriella439

 # Agda
 /pkgs/build-support/agda                  @NixOS/agda
@@ -349,9 +349,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/idris-modules @Infinisil
 /pkgs/development/compilers/idris2 @mattpolzin

-# Bazel
-/pkgs/by-name/ba/bazel_7 @Profpatsch
-
 # NixOS modules for e-mail and dns services
 /nixos/modules/services/mail/mailman.nix    @peti
 /nixos/modules/services/mail/postfix.nix    @peti
@@ -41,7 +41,6 @@
    "description": "Maintenance of https://bazel.build/ and related packages",
    "id": 5468470,
    "maintainers": {
-      "Profpatsch": 3153638
    },
    "members": {
      "aherrmann": 732652,
@@ -164,7 +164,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro

 - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).

- [pyLoad](https://pyload.net/), a FOSS download manager written in Python. Available as [services.pyload](#opt-services.pyload.enable).
+- [pyLoad](https://pyload.net/), a FOSS download manager written in Python. Available as `services.pyload`.

 - [Python Matter Server](https://github.com/home-assistant-libs/python-matter-server), a
  Matter Controller Server exposing websocket connections for use with other services, notably Home Assistant.
@@ -129,6 +129,8 @@

 - `services.statsd` has been removed because the packages it relies on do not exist anymore in nixpkgs.

+- `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.
+
 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).

 - `rustic` was upgraded to `0.11.x`, which contains breaking [changes to command-line parameters and configuration file](https://rustic.cli.rs/docs/breaking_changes.html#0110).
@@ -1347,7 +1347,6 @@
  ./services/networking/pptpd.nix
  ./services/networking/privoxy.nix
  ./services/networking/prosody.nix
-  ./services/networking/pyload.nix
  ./services/networking/quassel.nix
  ./services/networking/quicktun.nix
  ./services/networking/r53-ddns.nix
@@ -486,6 +486,9 @@ in
    (mkRemovedOptionModule [ "programs" "spacefm" ] ''
      spacefm has been removed since it was unmaintained upstream.
    '')
+    (mkRemovedOptionModule [ "services" "pyload" ] ''
+      services.pyload has been removed since the pyload-ng package had vulnerabilities and was unmaintained in nixpkgs.
+    '')
    # Do NOT add any option renames here, see top of the file
  ];
 }
@@ -80,6 +80,28 @@ in

    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];

+    systemd.services."polkit-agent-helper@".serviceConfig = lib.mkMerge [
+      # The upstream unit inherits stderr to the polkit agent, which causes
+      # agent processes to misinterpret diagnostic output from PAM modules
+      # as protocol errors, resulting in tight re-execution loops.
+      { StandardError = "journal"; }
+
+      # The upstream unit uses PrivateDevices=yes and ProtectHome=yes,
+      # which prevents PAM modules from accessing hardware (e.g. FIDO
+      # tokens via /dev/hidraw*) or reading key files from home directories.
+      (lib.mkIf config.security.pam.u2f.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/urandom r"
+          "char-hidraw rw"
+        ];
+        # Override upstream ProtectHome=yes so pam_u2f can read
+        # ~/.config/Yubico/u2f_keys (the default key file location)
+        ProtectHome = "read-only";
+      })
+    ];
+
    # The polkit daemon reads action/rule files
    environment.pathsToLink = [ "/share/polkit-1" ];

@@ -1,176 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.pyload;
-
-  stateDir = "/var/lib/pyload";
-in
-{
-  meta.maintainers = with lib.maintainers; [ ambroisie ];
-
-  options = with lib; {
-    services.pyload = {
-      enable = mkEnableOption "pyLoad download manager";
-
-      package = mkPackageOption pkgs "pyLoad" { default = [ "pyload-ng" ]; };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "localhost";
-        example = "0.0.0.0";
-        description = "Address to listen on for the web UI.";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 8000;
-        example = 9876;
-        description = "Port to listen on for the web UI.";
-      };
-
-      downloadDirectory = mkOption {
-        type = types.path;
-        default = "${stateDir}/downloads";
-        example = "/mnt/downloads";
-        description = "Directory to store downloads.";
-      };
-
-      user = mkOption {
-        type = types.str;
-        default = "pyload";
-        description = "User under which pyLoad runs, and which owns the download directory.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "pyload";
-        description = "Group under which pyLoad runs, and which owns the download directory.";
-      };
-
-      credentialsFile = mkOption {
-        type = with types; nullOr path;
-        default = null;
-        example = "/run/secrets/pyload-credentials.env";
-        description = ''
-          File containing {env}`PYLOAD_DEFAULT_USERNAME` and
-          {env}`PYLOAD_DEFAULT_PASSWORD` in the format of an `EnvironmentFile=`,
-          as described by {manpage}`systemd.exec(5)`.
-
-          If not given, they default to the username/password combo of
-          pyload/pyload.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.tmpfiles.settings.pyload = {
-      ${cfg.downloadDirectory}.d = { inherit (cfg) user group; };
-    };
-
-    systemd.services.pyload = {
-      description = "pyLoad download manager";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      # NOTE: unlike what the documentation says, it looks like `HOME` is not
-      # defined with this service definition...
-      # Since pyload tries to do the equivalent of `cd ~`, it needs to be able
-      # to resolve $HOME, which fails when `RootDirectory` is set.
-      # FIXME: check if `SetLoginEnvironment` fixes this issue in version 255
-      environment = {
-        HOME = stateDir;
-        PYLOAD__WEBUI__HOST = cfg.listenAddress;
-        PYLOAD__WEBUI__PORT = toString cfg.port;
-      };
-
-      serviceConfig = {
-        ExecStart = utils.escapeSystemdExecArgs [
-          (lib.getExe cfg.package)
-          "--userdir"
-          "${stateDir}/config"
-          "--storagedir"
-          cfg.downloadDirectory
-        ];
-
-        User = cfg.user;
-        Group = cfg.group;
-
-        EnvironmentFile = lib.optional (cfg.credentialsFile != null) cfg.credentialsFile;
-
-        StateDirectory = "pyload";
-        WorkingDirectory = stateDir;
-        RuntimeDirectory = "pyload";
-        RuntimeDirectoryMode = "0700";
-        RootDirectory = "/run/pyload";
-        BindReadOnlyPaths = [
-          builtins.storeDir # Needed to run the python interpreter
-        ];
-        BindPaths = [
-          cfg.downloadDirectory
-        ];
-
-        # Hardening options
-        LockPersonality = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@resources"
-          "~@privileged"
-        ];
-        UMask = "0002";
-        CapabilityBoundingSet = [
-          "~CAP_BLOCK_SUSPEND"
-          "~CAP_BPF"
-          "~CAP_CHOWN"
-          "~CAP_IPC_LOCK"
-          "~CAP_KILL"
-          "~CAP_LEASE"
-          "~CAP_LINUX_IMMUTABLE"
-          "~CAP_NET_ADMIN"
-          "~CAP_SYS_ADMIN"
-          "~CAP_SYS_BOOT"
-          "~CAP_SYS_CHROOT"
-          "~CAP_SYS_NICE"
-          "~CAP_SYS_PACCT"
-          "~CAP_SYS_PTRACE"
-          "~CAP_SYS_RESOURCE"
-          "~CAP_SYS_TTY_CONFIG"
-        ];
-      };
-    };
-
-    users.users.pyload = lib.mkIf (cfg.user == "pyload") {
-      isSystemUser = true;
-      group = cfg.group;
-      home = stateDir;
-    };
-
-    users.groups.pyload = lib.mkIf (cfg.group == "pyload") { };
-  };
-}
@@ -157,6 +157,7 @@ let
            --uid=nextcloud \
            --same-dir \
            --pty \
+            --pipe \
            --wait \
            --collect \
            --service-type=exec \
@@ -57,7 +57,6 @@ in
    boot.extraModulePackages = [
      config.boot.kernelPackages.ena
    ];
-    boot.initrd.kernelModules = [ "xen-blkfront" ];
    boot.initrd.availableKernelModules = [ "nvme" ];
    boot.kernelParams =
      let
@@ -87,6 +87,7 @@ rec {
        (onFullSupported "nixos.tests.containers-ip")
        (onSystems [ "x86_64-linux" ] "nixos.tests.docker")
        (onFullSupported "nixos.tests.env")
+        (onSystems [ "x86_64-linux" "aarch64-linux" ] "nixos.tests.ec2-userdata")

        # Way too many manual retries required on Hydra.
        #  Apparently it's hard to track down the cause.
@@ -489,9 +489,8 @@ in
  early-mount-options = runTest ./early-mount-options.nix;
  earlyoom = runTestOn [ "x86_64-linux" ] ./earlyoom.nix;
  easytier = runTest ./easytier.nix;
-  ec2-config = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-config or { };
  ec2-image = runTest ./ec2-image.nix;
-  ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
+  ec2-userdata = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).ec2-userdata or { };
  echoip = runTest ./echoip.nix;
  ejabberd = runTest ./xmpp/ejabberd.nix;
  elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
@@ -1221,6 +1220,7 @@ in
  pam-oath-login = runTest ./pam/pam-oath-login.nix;
  pam-pgsql = runTest ./pam/pam-pgsql.nix;
  pam-u2f = runTest ./pam/pam-u2f.nix;
+  pam-u2f-polkit = runTest ./pam/pam-u2f-polkit.nix;
  pam-ussh = runTest ./pam/pam-ussh.nix;
  pam-zfs-key = runTest ./pam/zfs-key.nix;
  pangolin = runTest ./pangolin.nix;
@@ -1348,7 +1348,6 @@ in
  pulseaudio = discoverTests (import ./pulseaudio.nix);
  pulseaudio-tcp = runTest ./pulseaudio-tcp.nix;
  pykms = runTest ./pykms.nix;
-  pyload = runTest ./pyload.nix;
  qbittorrent = runTest ./qbittorrent.nix;
  qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { };
  qemu-vm-credentials-fwcfg = runTest {
@@ -18,12 +18,6 @@ let
        ../modules/testing/test-instrumentation.nix
        ../modules/profiles/qemu-guest.nix
        {
-          # Hack to make the partition resizing work in QEMU.
-          boot.initrd.postDeviceCommands = mkBefore ''
-            ln -s vda /dev/xvda
-            ln -s vda1 /dev/xvda1
-          '';
-
          amazonImage.format = "qcow2";

          # In a NixOS test the serial console is occupied by the "backdoor"
@@ -31,30 +25,6 @@ let
          # the configuration in virtualisation/amazon-image.nix.
          systemd.services."serial-getty@ttyS0".enable = mkForce false;

-          # Needed by nixos-rebuild due to the lack of network
-          # access. Determined by trial and error.
-          system.extraDependencies = with pkgs; [
-            # Needed for a nixos-rebuild.
-            busybox
-            cloud-utils
-            desktop-file-utils
-            libxslt.bin
-            mkinitcpio-nfs-utils
-            stdenv
-            stdenvNoCC
-            texinfo
-            unionfs-fuse
-            lndir
-
-            # These are used in the configure-from-userdata tests
-            # for EC2. Httpd and valgrind are requested by the
-            # configuration.
-            apacheHttpd
-            apacheHttpd.doc
-            apacheHttpd.man
-            valgrind.doc
-          ];
-
          nixpkgs.pkgs = pkgs;
        }
      ];
@@ -68,8 +38,8 @@ let

 in
 {
-  boot-ec2-nixops = makeEc2Test {
-    name = "nixops-userdata";
+  ec2-userdata = makeEc2Test {
+    name = "ec2-userdata";
    meta.timeout = 600;
    inherit image;
    sshPublicKey = snakeOilPublicKey; # That's right folks! My user's key is also the host key!
@@ -116,49 +86,4 @@ in
      machine.wait_for_file("/etc/ec2-metadata/user-data")
    '';
  };
-
-  boot-ec2-config = makeEc2Test {
-    name = "config-userdata";
-    meta.broken = true; # amazon-init wants to download from the internet while building the system
-    inherit image;
-    sshPublicKey = snakeOilPublicKey;
-
-    # ### https://channels.nixos.org/nixos-unstable nixos
-    userData = ''
-      { pkgs, ... }:
-
-      {
-        imports = [
-          <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
-          <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
-          <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-        ];
-        environment.etc.testFile = {
-          text = "whoa";
-        };
-
-        networking.hostName = "ec2-test-vm"; # required by services.httpd
-
-        services.httpd = {
-          enable = true;
-          adminAddr = "test@example.org";
-          virtualHosts.localhost.documentRoot = "''${pkgs.valgrind.doc}/share/doc/valgrind/html";
-        };
-        networking.firewall.allowedTCPPorts = [ 80 ];
-      }
-    '';
-    script = ''
-      machine.start()
-
-      # amazon-init must succeed. if it fails, make the test fail
-      # immediately instead of timing out in wait_for_file.
-      machine.wait_for_unit("amazon-init.service")
-
-      machine.wait_for_file("/etc/testFile")
-      assert "whoa" in machine.succeed("cat /etc/testFile")
-
-      machine.wait_for_unit("httpd.service")
-      assert "Valgrind" in machine.succeed("curl http://localhost")
-    '';
-  };
 }
@@ -0,0 +1,90 @@
+{ hostPkgs, ... }:
+
+{
+  name = "pam-u2f-polkit";
+
+  qemu.package = hostPkgs.qemu_test.override { u2fEmuSupport = true; };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device u2f-emulated"
+      ];
+
+      security.polkit.enable = true;
+      security.pam.u2f.enable = true;
+
+      environment.systemPackages = with pkgs; [
+        libfido2
+        pam_u2f
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # The upstream polkit-agent-helper@.service has PrivateDevices=yes and
+    # DevicePolicy=strict with only /dev/null allowed. This blocks hidraw.
+    # Verify that: run a command under the upstream defaults and show it fails.
+    machine.fail(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=yes "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "test -c /dev/hidraw0"
+    )
+
+    # The PR overrides PrivateDevices=no and adds DeviceAllow for hidraw.
+    # Verify that the actual polkit-agent-helper@ unit got these overrides.
+    props = machine.succeed("systemctl show polkit-agent-helper@dummy.service")
+    assert "PrivateDevices=no" in props, f"Expected PrivateDevices=no, got: {props}"
+    assert "ProtectHome=read-only" in props, f"Expected ProtectHome=read-only, got: {props}"
+
+    # Run fido2-token under the same constraints as the fixed service.
+    # This proves the device is not just visible but actually usable
+    # inside the polkit-agent-helper@ sandbox.
+    machine.succeed(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=no "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "--property='DeviceAllow=/dev/urandom r' "
+        "--property='DeviceAllow=char-hidraw rw' "
+        "--property=ProtectHome=read-only "
+        "--property=PrivateNetwork=yes "
+        "--property=ProtectSystem=strict "
+        "--property=ProtectKernelModules=yes "
+        "--property=ProtectKernelLogs=yes "
+        "--property=ProtectKernelTunables=yes "
+        "--property=ProtectControlGroups=yes "
+        "--property=ProtectClock=yes "
+        "--property=ProtectHostname=yes "
+        "--property=LockPersonality=yes "
+        "--property=MemoryDenyWriteExecute=yes "
+        "--property=NoNewPrivileges=yes "
+        "--property=PrivateTmp=yes "
+        "--property=RemoveIPC=yes "
+        "--property='RestrictAddressFamilies=AF_UNIX' "
+        "--property=RestrictNamespaces=yes "
+        "--property=RestrictRealtime=yes "
+        "--property=RestrictSUIDSGID=yes "
+        "--property=SystemCallArchitectures=native "
+        "fido2-token -I /dev/hidraw0"
+    )
+
+    # Also verify that pamu2fcfg can register a credential inside the sandbox
+    # (needs hidraw + urandom access)
+    machine.succeed(
+        "systemd-run --wait --pipe "
+        "--property=PrivateDevices=no "
+        "--property=DevicePolicy=strict "
+        "--property='DeviceAllow=/dev/null rw' "
+        "--property='DeviceAllow=/dev/urandom r' "
+        "--property='DeviceAllow=char-hidraw rw' "
+        "--property=ProtectHome=read-only "
+        "pamu2fcfg"
+    )
+  '';
+}
@@ -1,29 +1,70 @@
-{ ... }:
+{ hostPkgs, ... }:

 {
  name = "pam-u2f";

+  qemu.package = hostPkgs.qemu_test.override { u2fEmuSupport = true; };
+
  nodes.machine =
-    { ... }:
+    { pkgs, ... }:
    {
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device u2f-emulated"
+      ];
+
      security.pam.u2f = {
        enable = true;
-        control = "required";
+        control = "sufficient";
        settings = {
-          cue = true;
          debug = true;
-          interactive = true;
-          origin = "nixos-test";
-          # Freeform option
-          userpresence = 1;
+          origin = "pam://nixos-test";
        };
      };
+
+      users.users.alice = {
+        isNormalUser = true;
+        uid = 1000;
+      };
+
+      environment.systemPackages = with pkgs; [
+        libfido2
+        pam_u2f
+      ];
+
+      # Allow non-root users to access the virtual U2F device
+      services.udev.extraRules = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0666"
+      '';
    };

  testScript = ''
    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+    # The virtual U2F device should be recognized
+    machine.succeed("fido2-token -L | grep -q hidraw")
+
+    # Register a U2F credential for alice
+    machine.succeed("mkdir -p /home/alice/.config/Yubico")
    machine.succeed(
-        'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test.*userpresence=1" /etc/pam.d/ -R'
+        "pamu2fcfg -u alice -o pam://nixos-test"
+        " > /home/alice/.config/Yubico/u2f_keys"
    )
+    machine.succeed("chown -R alice:users /home/alice/.config")
+
+    # Log in as alice on tty2. With control=sufficient, pam_u2f runs
+    # before pam_unix. The emulated device auto-approves user presence,
+    # so alice is authenticated by her U2F key — no password needed.
+    machine.send_key("alt-f2")
+    machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+    machine.wait_for_unit("getty@tty2.service")
+    machine.wait_until_tty_matches("2", "login: ")
+    machine.send_chars("alice\n")
+
+    # alice should get a shell without being asked for a password
+    machine.wait_until_succeeds("pgrep -u alice bash")
+    machine.send_chars("touch /tmp/u2f-login-success\n")
+    machine.wait_for_file("/tmp/u2f-login-success")
  '';
 }
@@ -1,36 +0,0 @@
-{ lib, ... }:
-{
-  name = "pyload";
-  meta.maintainers = with lib.maintainers; [ ambroisie ];
-
-  nodes = {
-    machine =
-      { ... }:
-      {
-        services.pyload = {
-          enable = true;
-
-          listenAddress = "0.0.0.0";
-          port = 9876;
-        };
-
-        networking.firewall.allowedTCPPorts = [ 9876 ];
-      };
-
-    client = { };
-  };
-
-  testScript = ''
-    start_all()
-
-    machine.wait_for_unit("pyload.service")
-
-    with subtest("Web interface accessible locally"):
-        machine.wait_until_succeeds("curl -fs localhost:9876")
-
-    client.wait_for_unit("network.target")
-
-    with subtest("Web interface accessible from a different machine"):
-        client.wait_until_succeeds("curl -fs machine:9876")
-  '';
-}
@@ -11,18 +11,18 @@
  vimUtils,
 }:
 let
-  version = "0.4.3-nightly.0a18692-unstable-2026-03-24";
+  version = "0.5.1-nightly.538c593-unstable-2026-04-01";
  src = fetchFromGitHub {
    owner = "dmtrKovalenko";
    repo = "fff.nvim";
-    rev = "eb577ea4f39f7b9296ff8c6b4bf2b2899d017ded";
-    hash = "sha256-m/KykUyhE3xUVmmE84xUaqW0T4fbuRp6iAVBbCioiCI=";
+    rev = "538c593b7ba173b08beec15e6bce66fccb8f6ab0";
+    hash = "sha256-e+x1ELa2m60j2cQ9g99XSrAMMvmF3WtlMF5HWYrrJps=";
  };
  fff-nvim-lib = rustPlatform.buildRustPackage {
    pname = "fff-nvim-lib";
    inherit version src;

-    cargoHash = "sha256-hMwPyPc4V0pTxpn1U3ay31KttFeoU54h6Z4HGv8nFYQ=";
+    cargoHash = "sha256-K6xAzx6YqzrDUalZ1rE4eOBRc1xvXVhac14krskl87M=";

    nativeBuildInputs = [
      pkg-config
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.89";
-    hash = "sha256-9GASgI7ifhxAj4L6Xf1MGyGsiFcC5NZb2ICCjLUf5Qw=";
+    version = "2.1.90";
+    hash = "sha256-8xHAEqxxCA0bw/4eNFL2PutMquD2H7FO1o2yycAJ4ME=";
  };

  postInstall = ''
@@ -3828,8 +3828,8 @@ let
        mktplcRef = {
          name = "ansible";
          publisher = "redhat";
-          version = "26.3.0";
-          hash = "sha256-c6NcQsJe2sjJH/nBhStHYWKNSfJtU3CLHpv+2qPlyqM=";
+          version = "26.3.5";
+          hash = "sha256-IKSozGy4S04pSsbhpXVgsqQvJNzaxVkoSrLwhFb4Ag4=";
        };
        meta = {
          description = "Ansible language support";
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore rec {
  core = "fbalpha2012";
-  version = "0-unstable-2025-12-12";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbalpha2012";
-    rev = "c547d8cf3f7748f4094cee658a5d31ec1b79ece4";
-    hash = "sha256-owy8IuJ/dAEbUH7hGCR3oLiI4tYuwsNfRYRl6LmyYfc=";
+    rev = "15af60bf24e3dc2267a38e3c8532450ebec86317";
+    hash = "sha256-7QfDk/j7akaORSekdx96mcDgsFp+kAq1/Cxtu3uPe4A=";
  };

  sourceRoot = "${src.name}/svn-current/trunk";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fmsx";
-  version = "0-unstable-2025-07-31";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fmsx-libretro";
-    rev = "fbe4dfc4c3e3f7eb27089def3d663a905b181845";
-    hash = "sha256-1hZQO16SDB8n1wdTP67Kpns3izg/nPGl5M7wjFDBjGc=";
+    rev = "6b807c588d63677770f7f2ed8b94ca0e9da256ce";
+    hash = "sha256-vA9ODUtmmrDPbZjmRJ9IIFELLTD8g8aHmQdo/B/d1fQ=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mgba";
-  version = "0-unstable-2025-10-13";
+  version = "0-unstable-2026-03-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mgba";
-    rev = "c758314a639aa0066e7b65a8341448181b73c804";
-    hash = "sha256-ev0vzLqZzOr5RW/jf07vXtBmYkcB2m+afADHFBH5zbQ=";
+    rev = "6ab29fed1b5139f19ac98c523fd4a6a7f0b30e38";
+    hash = "sha256-6cCd2tuj2kXTL1w0DUPodaLU0ivNjPyKGytgxrjlwb0=";
  };

  meta = {
@@ -26,6 +26,11 @@ stdenv.mkDerivation {
      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/apngasm/files/apngasm-3.1.10-static.patch?id=45fd0cde71ca2ae0e7e38ab67400d84b86b593d7";
      sha256 = "sha256-eKthgInWxXEqN5PupvVf9wVQDElxsPYRFXT7pMc6vIU=";
    })
+    # Boost 1.89+ removed the boost_system CMake component
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/apngasm/files/apngasm-3.1.10-boost-1.89.patch?id=87e57d47db8c7c68acb2dec534e70015d8b1d61e";
+      sha256 = "sha256-92oie9owUYP8a1hrJsFCRk8QI4AjTzMXTe+frlmbIuE=";
+    })
  ];

  nativeBuildInputs = [ cmake ];
@@ -823,7 +823,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "146.0.7680.164",
+    "version": "146.0.7680.177",
    "deps": {
      "depot_tools": {
        "rev": "42786f6e46c25c30dd58f69283ab6fcd0c959f58",
@@ -835,16 +835,16 @@
        "hash": "sha256-wFCuu4GR0N7QZCwT8UAhqH5moicYQjZ4ZLI58AM4pJ0="
      },
      "ungoogled-patches": {
-        "rev": "146.0.7680.164-1",
-        "hash": "sha256-mqgmG+1TefLshc3QUQrGN2XB99FXJyexE6QI7uD3IXQ="
+        "rev": "146.0.7680.177-1",
+        "hash": "sha256-OMGjomgLuwO0KkqwW3IxLmSbpHM7ZbVUVOiPkQs/N6s="
      },
      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "bbd8c5dd25fb2f569d98e626a9517cf2171abdff",
-        "hash": "sha256-hwZehtGUyuMdHisIaztsYlu0MEftbmmAqN/X+ias4nI=",
+        "rev": "ae03f7fb2cf1215853896d6a4c15fdceee2badb7",
+        "hash": "sha256-WVJ6dtDpXnp+Q8N/KEFJZWU9/4xEmpEYcu53MA94PZ8=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "e05753c6d05b17b23d514038957469c70b75475c",
-        "hash": "sha256-SMym7PN2acfw84Z95xWSbN/QV5UIDIOztWxFeTCfBsk="
+        "rev": "1c0f91aaa60a1f87725840495cbfd9717e7c77c8",
+        "hash": "sha256-9Me/9kdDgcDLGP/0lLWpj294IoUp0hDD5hfFjSZbTOc="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "a655251a59c4af3fbf8058bb2572d6a457f896d2",
-        "hash": "sha256-UKoDytne6QD2d6ojy4mYPjLbo9GB4xy1fUf9C1pLKaE="
+        "rev": "10fb89e3179bb7443e66911eb3c795c7aaf022e5",
+        "hash": "sha256-ATTNb61RG7hS1mapDw0o4ZyBeny4ONI8ZjJLpmbQaKU="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1474,8 +1474,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6a75afe9792764f6faa76ad50125781899ca05e8",
-        "hash": "sha256-S4AAmNw50ToTZIuHl41Pc+Z1MZfUVf0/ZGGIiEr5cXo="
+        "rev": "30d129c8800b5626c46fb83fa62db10b9b22b319",
+        "hash": "sha256-2/Deen9OwDgDRrm5j7Rw27Z2JUX1thX7mnKWRLJbEvM="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "b2a90ac0037ee7187102ce2c40e5007216ca9a58",
-        "hash": "sha256-rX6NEN0RbfHPRqJqkGhypwWt/NcREvPaanL+CDxwhA8="
+        "rev": "6733aa5ba16e1e1087f339d1151c80c924a6fbf8",
+        "hash": "sha256-g2GYFVTK8f296v7lUcYPqkI4qDoladsTpnKWb6SGRmw="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "0e999a528db40a3ef6fa917adf96370a18b87d70",
-        "hash": "sha256-rkSuZBdFUHJyYmqp2oN3mLjNtKjk569MocyvnICo+uw="
+        "rev": "0ad812d268a7820dba9bf848b416aeda4dd1b2e5",
+        "hash": "sha256-nG4goqqVAAWPMkq8296wCYhnwL93oAL+pF1oaMXyqZI="
      }
    }
  }
@@ -191,13 +191,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "cloudamqp_cloudamqp": {
-    "hash": "sha256-PAH7Avc6WQFQ7fXs7A//SxIEP88uSrN9sWlEYe9Zr+I=",
+    "hash": "sha256-WVEGtD5Hfb8xu/GymHMknK8n2KgOMW2EzBMvRmbKJug=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.43.1",
+    "rev": "v1.44.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SrGNzwSdkMTyNuVgjUj0tID/Qu6BBusVn+NsgTk4RJI="
+    "vendorHash": "sha256-sagrygtfsZWQUuIuGTUldZYYR5OhQfpZDxDKZAaIR4Y="
  },
  "cloudflare_cloudflare": {
    "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=",
@@ -1310,11 +1310,11 @@
    "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-iUbbxwnRgYtNq8a8qMYB/6HQ7QS/hrvlzL5MMS08rn0=",
+    "hash": "sha256-xsYh5gDneL3nQDUIHe3fRjObFTGp3ssPq8wlqPWsq7Y=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.77",
+    "rev": "v1.82.82",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1499,12 +1499,12 @@
    "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
  },
  "yandex-cloud_yandex": {
-    "hash": "sha256-ajA9ktS9TIwB/HexEHZCNkkBKtH6BDxjwq4BxLQB82M=",
+    "hash": "sha256-F2nbu/MImDXHSYPjo3O6K0tsZJ4PTrmB14Ghfvnp5sc=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "repo": "terraform-provider-yandex",
-    "rev": "v0.193.0",
+    "rev": "v0.195.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wD6KGxlNxZZm0lNtzFjfLhitkpxaEgTdcTS4YlOqMqA="
+    "vendorHash": "sha256-lSpDmhzCed9NUJkQ35tsrUbMIzx6wnEJ20UFMPbwhWE="
  }
 }
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
    description = "Mini Web server that let others upload files to your computer";
    homepage = "http://stackp.online.fr/droopy";
    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    mainProgram = "droopy";
  };

@@ -0,0 +1,74 @@
+diff --git a/src/api/video/nv12_buffer.cc b/src/api/video/nv12_buffer.cc
+index ca9dcd867..89d28f23c 100644
+--- a/src/api/video/nv12_buffer.cc
+++ b/src/api/video/nv12_buffer.cc
+@@ -16,6 +16,8 @@
+ #include "third_party/libyuv/include/libyuv/convert.h"
+ #include "third_party/libyuv/include/libyuv/scale.h"
+
+#include <cstring>
+
+ namespace webrtc {
+
+ namespace {
+diff --git a/src/audio/utility/channel_mixer.cc b/src/audio/utility/channel_mixer.cc
+index 0f1e66387..33b771b0c 100644
+--- a/src/audio/utility/channel_mixer.cc
+++ b/src/audio/utility/channel_mixer.cc
+@@ -15,6 +15,8 @@
+ #include "rtc_base/logging.h"
+ #include "rtc_base/numerics/safe_conversions.h"
+
+#include <cstring>
+
+ namespace webrtc {
+
+ ChannelMixer::ChannelMixer(ChannelLayout input_layout,
+diff --git a/src/modules/audio_processing/aec3/alignment_mixer.cc b/src/modules/audio_processing/aec3/alignment_mixer.cc
+index 7f076dea8..ffd7242b5 100644
+--- a/src/modules/audio_processing/aec3/alignment_mixer.cc
+++ b/src/modules/audio_processing/aec3/alignment_mixer.cc
+@@ -10,6 +10,7 @@
+ #include "modules/audio_processing/aec3/alignment_mixer.h"
+
+ #include <algorithm>
+#include <cstring>
+
+ #include "rtc_base/checks.h"
+
+diff --git a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+index 7ef1a030e..5b9ab7137 100644
+--- a/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+++ b/src/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+@@ -18,6 +18,7 @@
+ #include <spa/param/video/format-utils.h>
+ #include <sys/mman.h>
+
+#include <cstring>
+ #include <vector>
+
+ #include "absl/memory/memory.h"
+diff --git a/src/modules/video_coding/utility/ivf_file_reader.cc b/src/modules/video_coding/utility/ivf_file_reader.cc
+index 4c08ca613..f82f2bfcb 100644
+--- a/src/modules/video_coding/utility/ivf_file_reader.cc
+++ b/src/modules/video_coding/utility/ivf_file_reader.cc
+@@ -10,6 +10,7 @@
+
+ #include "modules/video_coding/utility/ivf_file_reader.h"
+
+#include <cstring>
+ #include <string>
+ #include <vector>
+
+diff --git a/src/net/dcsctp/packet/bounded_byte_writer.h b/src/net/dcsctp/packet/bounded_byte_writer.h
+index d754549e4..bf5e3ed42 100644
+--- a/src/net/dcsctp/packet/bounded_byte_writer.h
+++ b/src/net/dcsctp/packet/bounded_byte_writer.h
+@@ -12,6 +12,7 @@
+ #define NET_DCSCTP_PACKET_BOUNDED_BYTE_WRITER_H_
+
+ #include <algorithm>
+#include <cstring>
+
+ #include "api/array_view.h"
+ 
@@ -31,6 +31,9 @@ let
    };

    patches = [
+      # fix build with latest glibc
+      # upstream PR: https://github.com/desktop-app/tg_owt/pull/172
+      ./cstring-includes.patch
      (fetchpatch {
        url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
        decode = "base64 -d";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ab-av1";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "alexheretic";
    repo = "ab-av1";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UiBgtA6i5rpXAtiPwihg7sUbmD6lou6IOsb//DWNWwU=";
+    hash = "sha256-kT0BJr4xoYigKObD6vZNRieslaJj/MWuqQmhYLWNwvs=";
  };

-  cargoHash = "sha256-1/vxKOlbXZ8HXnVFM9dXB9crobBx8djGDKsjnzc/KwQ=";
+  cargoHash = "sha256-o64GrmHvwF2VUKw+nIRK0jesSuelxNo0TFnyKaP/YlQ=";

  nativeBuildInputs = [ installShellFiles ];

@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alpine-make-vm-image";
-  version = "0.13.3";
+  version = "0.13.4";

  src = fetchFromGitHub {
    owner = "alpinelinux";
    repo = "alpine-make-vm-image";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AIwT2JAGnMeMXUXZ0FRJthf22FvFfTTw/2LtZKPSj6g=";
+    hash = "sha256-U3eJ9wOxxbC9gEDBMXanBmEy0x6YBSsXXf6U5nzVoZ8=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-03-21";
+  version = "0-unstable-2026-03-30";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "a0305dc2070306a1af52aad9b03096a51f4147e8";
-    hash = "sha256-WAbJATvx5dWfpB0PYVVlRCVEygDzUU+qeOmhzRKA8GY=";
+    rev = "7460ed8d375425f50517119b0df3a57b876b504e";
+    hash = "sha256-hFBQGmGKUw/LT1DiyfnTsYO5Lt2c7LBMLRVBMmjYakY=";
  };

  dontConfigure = true;
@@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ansible-doctor";
-  version = "8.2.2";
+  version = "8.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "thegeeklab";
    repo = "ansible-doctor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gezpY5iaFxNcngAyUnlVRPGo33zUgjdsm2zFlfWUWfA=";
+    hash = "sha256-lwN6pMKysycMOqVRNrK8+dgGfrsRF2B2EW1Kby0l/0I=";
  };

  build-system = with python3Packages; [
@@ -1,22 +1,22 @@
 {
-  "version": "1.20.6",
+  "version": "1.21.9",
  "vscodeVersion": "1.107.0",
  "sources": {
    "x86_64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/linux-x64/Antigravity.tar.gz",
-      "sha256": "ad382bf321a6216d07f95af1f613e03f5a07fdf6fc6632b769ce83d81afdd567"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/linux-x64/Antigravity.tar.gz",
+      "sha256": "85ea4d55f52d32fbbf9d92fddc747f10e8d04c1bd00a07721b571fa7f2ef5226"
    },
    "aarch64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/linux-arm/Antigravity.tar.gz",
-      "sha256": "6e17f33d8ccb5622affb3590efccb87c3c4dd505f1d3b0f8506f1c20c39c026a"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/linux-arm/Antigravity.tar.gz",
+      "sha256": "76d56462e0fad95a98efaf25d06be9c4789e3b8551fe5b936a6858b14c723364"
    },
    "x86_64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/darwin-x64/Antigravity.zip",
-      "sha256": "4e56f3ac83bc0e1803b4d811585d567f3795b14ad57ccec1fcfe8cb02f7cb719"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/darwin-x64/Antigravity.zip",
+      "sha256": "a8ebdbf3b18c75d39b876541904c95576422e281fd92e45f7f7f4e7231ac769c"
    },
    "aarch64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.20.6-5891862175809536/darwin-arm/Antigravity.zip",
-      "sha256": "c4392cc64a52b7b7066cb1c21c32918854b7cd7297b7efa3b14397fc7d05ad5a"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/1.21.9-4905428782546944/darwin-arm/Antigravity.zip",
+      "sha256": "f9ec42d0a791cc13cbb57a1f7c36b2421e67f180cd0bdfb01fd8fa23ad87440b"
    }
  }
 }
@@ -17,10 +17,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "archipelago";
-  version = "0.6.6";
+  version = "0.6.7";
  src = fetchurl {
    url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${finalAttrs.version}/Archipelago_${finalAttrs.version}_linux-x86_64.AppImage";
-    hash = "sha256-mJ0bPBBou3BRqEW5QierjD0ohDBQ9J0jnoV4TCf9XOM=";
+    hash = "sha256-a5UazzqGu7q4Zg1AYHnbQjCTQNdcNaL/gZUjYV3Rk5Q=";
  };

  dontUnpack = true;
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "asn";
-  version = "0.80.4";
+  version = "0.80.5";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o0gHHV0tQeKd/qIGAMhA/cwUuCF7VLVDzngoFU8fGhI=";
+    hash = "sha256-o+qyNxEV2lPRsCNkkcZbj07hKw4eV45qhB8G34OWmgg=";
  };

  nativeBuildInputs = [
@@ -2,26 +2,23 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
  gitUpdater,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "beedii";
  version = "1.0.0";

  src = fetchzip {
-    url = "https://github.com/webkul/beedii/releases/download/v${version}/beedii.zip";
+    url = "https://github.com/webkul/beedii/releases/download/v${finalAttrs.version}/beedii.zip";
    hash = "sha256-MefkmWl7LdhQiePpixKcatoIeOTlrRaO3QA9xWAxJ4Q=";
    stripRoot = false;
  };

-  installPhase = ''
-    runHook preInstall
+  sourceRoot = "${finalAttrs.src.name}/Fonts";

-    install -Dm444 Fonts/*.ttf -t $out/share/fonts/truetype/${pname}
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  passthru.updateScript = gitUpdater {
    url = "https://github.com/webkul/beedii";
@@ -41,4 +38,4 @@ stdenvNoCC.mkDerivation rec {
      kachick
    ];
  };
-}
+})
@@ -39,6 +39,6 @@ stdenv.mkDerivation {
    homepage = "https://beej.us/guide/bgnet/";
    license = lib.licenses.unfree;

-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
  };
 }
@@ -2,6 +2,7 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
  nix-update-script,
 }:

@@ -17,13 +18,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hash = "sha256-7PlIrQX1fnFHXm7mjfoOCVp3GSnLT2GlVZdSoZbh/s4=";
  };

-  installPhase = ''
-    runHook preInstall
+  sourceRoot = "${finalAttrs.src.name}/fonts";

-    install -Dm444 fonts/ttf/*.ttf -t "$out/share/fonts/truetype/"
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  passthru = {
    updateScript = nix-update-script { };
@@ -9,19 +9,19 @@
 }:

 let
-  version = "2.5.2";
+  version = "2.5.3";
  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-fuse";
    rev = "blobfuse2-${version}";
-    sha256 = "sha256-iTzVKb8z7lQh40iMZiwjeufColiwU2YrihBLNLjS6JI=";
+    sha256 = "sha256-PgpXlyFo+rE32wZfjx7h11YmNka4q/6Jbr03CsW0pZc=";
  };
 in
 buildGoModule {
  pname = "blobfuse";
  inherit version src;

-  vendorHash = "sha256-9sT+8o+esVYdqYqAfkvyggqPiIIkG78krv+uID9+UBw=";
+  vendorHash = "sha256-I2/0BzT9KiMBpzReSll0dKY0uzULRx49fcVGD/z4BPQ=";

  buildInputs = [ fuse3 ];

@@ -2,6 +2,7 @@
  lib,
  stdenvNoCC,
  fetchFromGitHub,
+  installFonts,
 }:
 stdenvNoCC.mkDerivation {
  pname = "bodoni-moda";
@@ -14,14 +15,7 @@ stdenvNoCC.mkDerivation {
    hash = "sha256-OQi+KKBM+BrmA2pDit6dib5krrQBba5dVCBd2/G5sIM=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp fonts/*/*.ttf $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://indestructibletype.com/Bodoni.html";
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-generate";
-  version = "0.23.7";
+  version = "0.23.8";

  src = fetchFromGitHub {
    owner = "cargo-generate";
    repo = "cargo-generate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1GMgVdRhgZPYCOxn6Y7q+1xgIJL7XSbY/F2tW1N9ckw=";
+    hash = "sha256-Me3hgG6Z+JSsCjLVxbFDY3/6dUi4KtV6ArugFPgnda0=";
  };

-  cargoHash = "sha256-zO8h567ptsIQmexmdfqC6++xjxxOTjVvJFDB3Hxgt78=";
+  cargoHash = "sha256-QhXHPnlU77ikaeTQLxBFYIc4j+tEZb0un3kVJanq7ZI=";

  nativeBuildInputs = [ pkg-config ];

@@ -16,14 +16,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-update";
-  version = "18.2.0";
+  version = "19.0.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-znDi45NpUVuIalgTh+jEOf4lFfI8MCLvSWgsdyv4gTk=";
+    hash = "sha256-XK5ky0t8IdQRVsDU6VDB+HzWzgn4uXhlvOS66GPCVn8=";
  };

-  cargoHash = "sha256-bdKmWqCJaJq1iq8pu7BIxrKCT9SdReTMcJIcmAuaqLA=";
+  cargoHash = "sha256-/teRXWO3alCU4i4WsQaojCNAXVm/DnpxbYysCEb/Ohg=";

  nativeBuildInputs = [
    cmake
@@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ciel";
-  version = "3.10.2";
+  version = "3.10.3";

  src = fetchFromGitHub {
    owner = "AOSC-Dev";
    repo = "ciel-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lYw1Dzh3zQ9V5TqZGVJ5LTHuAsnEYsJsShkiJcXMGfc=";
+    hash = "sha256-y6AM3tLACJscGSVh3WhEONSkDmXC2KFL3VKt8a7CdGU=";
  };

-  cargoHash = "sha256-RSdJFjFO0ah2WXazc2QDFQzvNwOKxe0IKiNIjRHO0EQ=";
+  cargoHash = "sha256-rgflNUoAOKzqXKMoSDbAgqV1tKbFgJUeH0K7RCVC1ME=";

  nativeBuildInputs = [
    pkg-config
@@ -42,7 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace CMakeLists.txt \
      --replace-fail "CMAKE_MINIMUM_REQUIRED(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)" \
      --replace-fail "CMAKE_POLICY(VERSION 2.8.7)" "CMAKE_POLICY(VERSION 3.10)" \
-      --replace-fail "CMAKE_POLICY(SET CMP0045 OLD)" ""
+      --replace-fail "CMAKE_POLICY(SET CMP0045 OLD)" "" \
+      --replace-fail "FIND_PACKAGE(Boost REQUIRED COMPONENTS filesystem system)" \
+                     "FIND_PACKAGE(Boost REQUIRED COMPONENTS filesystem)"
  '';

  meta = {
@@ -1,46 +1,46 @@
 {
-  "version": "2.1.89",
-  "buildDate": "2026-03-31T23:01:10Z",
+  "version": "2.1.90",
+  "buildDate": "2026-04-01T22:59:02Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "f903a5e53f845b1ac5566296b713193827665f28da16300fdca7539cb0669a7f",
-      "size": 196886384
+      "checksum": "73c1a7570501ca743cd2d7467cb4699103534a2138052a4e6cab53c0e09d79c8",
+      "size": 197828752
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "1322c5eecec8047e9cd7114f7d547ef6a9596563d6bbc7e594167d0f8bc8b406",
-      "size": 198397008
+      "checksum": "9934675063ea4360665b7a43f649c92e6ba5cf93257324af7af1a6b490746395",
+      "size": 199326928
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "428301f56cf0139e6fbfa55e13be3f0f032ac1eb5ddb8849fbc703ee220c1cca",
-      "size": 228657728
+      "checksum": "15d5089ee7d9981faacf5463eabd427a012814d9fc02113883bb23a4f387ad4a",
+      "size": 230165056
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "903cb3c96b314d86856632c8702f5cdf971b804d0b19ef87446573bcd1d7df1c",
-      "size": 228473472
+      "checksum": "6074e3959989b2958a9abec60adf7b441a0f6f1c7e66401abff0fe54dad04fd6",
+      "size": 229902976
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "7cb5fd60f3d2366672857077f3bd0f93ab83dffebd8f93c70344afa58bdb91ec",
-      "size": 221776320
+      "checksum": "2508fa1c9c0575cf6fa26f2561ff7f0fd83be5fb4c6f9ec8281dfd5911d44371",
+      "size": 223218112
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "60941916f0a5656a5952a0f2f54228f574f8756ea503119f858724ad43c9b28d",
-      "size": 223099328
+      "checksum": "854746d04db11f543ed8d3836b5316366d965e6b6cfa2ac6312e6f7a5c4b5cb1",
+      "size": 224201152
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "2e312000b538f11d13f1dfc52d4131996895b9a07bd8897d8f9153635d4ea092",
-      "size": 238557856
+      "checksum": "f6be38fbdcadc373e93f751d1286845f58b032690e32be8f64799380a295a79f",
+      "size": 239622816
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "5f1d597c542aac3a11f557e12c92d0c49220ab77e741014b0599a572d81ca679",
-      "size": 235014304
+      "checksum": "019f7210055cd7a884d13c4e6a0b6caf1a82348ee42950b7b5247a4b0484709c",
+      "size": 236335776
    }
  }
 }
@@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.1.89",
+  "version": "2.1.90",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.1.89",
+      "version": "2.1.90",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.1.89";
+  version = "2.1.90";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-FoTm6KDr+8Dzhk4ibZUlU1QLPFdPm/OriUUWqAaFswg=";
+    hash = "sha256-4/hqWrY2fncQ8p0TxwBAI+mNH98ZDhjvFqB9us7GJK0=";
  };

-  npmDepsHash = "sha256-NI4F5bq0lEuMjLUdkGrml2aOzGbGkdyUckgfeVFEe8o=";
+  npmDepsHash = "sha256-kWbbIAoNAQ/BtsICmsabkfnS/1Nta5MQ4iX9+oH7WRw=";

  strictDeps = true;

@@ -84,5 +84,6 @@ buildNpmPackage (finalAttrs: {
      xiaoxiangmoe
    ];
    mainProgram = "claude";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
  };
 })
@@ -47,6 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_package(Boost COMPONENTS system filesystem regex REQUIRED)' \
+                     'find_package(Boost COMPONENTS filesystem regex REQUIRED)'
+  '';
+
  nativeBuildInputs = [
    cmake
    xmlstarlet
@@ -0,0 +1,49 @@
+diff --git a/src/compress_pptx/__main__.py b/src/compress_pptx/__main__.py
+index 433b6d8..f86c2e2 100644
+--- a/src/compress_pptx/__main__.py
+++ b/src/compress_pptx/__main__.py
+@@ -101,7 +101,7 @@ def main():
+         "--ffmpeg-path",
+         type=str,
+         help="Path to ffmpeg executable",
+-        default="ffmpeg",
+        default="@ffmpeg@",
+     )
+     cli_args = parser.parse_args()
+ 
+diff --git a/src/compress_pptx/compress_pptx.py b/src/compress_pptx/compress_pptx.py
+index 0cb5b42..0845aef 100644
+--- a/src/compress_pptx/compress_pptx.py
+++ b/src/compress_pptx/compress_pptx.py
+@@ -131,7 +131,7 @@ class CompressPptx:
+         ffmpeg_video_codec: Optional[str] = None,
+         ffmpeg_audio_codec: Optional[str] = None,
+         ffmpeg_extra_options: Optional[str] = None,
+-        ffmpeg_path: str = "ffmpeg",
+        ffmpeg_path: str = "@ffmpeg@",
+     ) -> None:
+         """
+         Compress images in a PowerPoint file or extract media.
+@@ -187,19 +187,9 @@ class CompressPptx:
+ 
+         self.file_list: List[FileObj] = []
+ 
+-        # Check for ImageMagick - prefer 'magick' but fall back to 'convert'/'identify'
+-        if which("magick") is not None:
+-            self.magick_cmd = "magick"
+-            self.convert_cmd = ["magick", "convert"]
+-            self.identify_cmd = ["magick", "identify"]
+-        elif which("convert") is not None and which("identify") is not None:
+-            self.magick_cmd = "convert"
+-            self.convert_cmd = ["convert"]
+-            self.identify_cmd = ["identify"]
+-        else:
+-            raise CompressPptxError(
+-                "ImageMagick not found in PATH. Make sure you have installed ImageMagick and that either 'magick' or 'convert'/'identify' commands are available."
+-            )
+        self.magick_cmd = "@magick@"
+        self.convert_cmd = ["@magick@", "convert"]
+        self.identify_cmd = ["@magick@", "identify"]
+ 
+         required_executables = []
+         # add ffmpeg to required executables if user wants media files to be compressed
@@ -0,0 +1,54 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+
+  # patches
+  replaceVars,
+  ffmpeg,
+  imagemagick,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "compress-pptx";
+  version = "1.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "slhck";
+    repo = "compress-pptx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+67EdAEWsRY11Pkie6AOz7Sl7MSTMGxZoQYS+M2x07Y=";
+  };
+
+  patches = [
+    (replaceVars ./inject-dependency-paths.patch {
+      ffmpeg = lib.getExe ffmpeg;
+      magick = lib.getExe imagemagick;
+    })
+  ];
+
+  build-system = with python3Packages; [ uv-build ];
+
+  dependencies = with python3Packages; [
+    ffmpeg-progress-yield
+    tqdm
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+  ];
+
+  meta = {
+    description = "Compress PPTX files";
+    longDescription = ''
+      Compress a PPTX or POTX file, converting all PNG/TIFF images to lossy
+      JPEGs.
+    '';
+    homepage = "https://github.com/slhck/compress-pptx";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/slhck/compress-pptx/releases/tag/${finalAttrs.src.tag}";
+    mainProgram = "compress-pptx";
+    maintainers = with lib.maintainers; [ artur-sannikov ];
+  };
+})
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "ctlptl";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "tilt-dev";
    repo = "ctlptl";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y957JaHg2SnDC6yvwI/0fBFjbEKOfKFsNqOOrqQe+TU=";
+    hash = "sha256-vbg3gaVCFkQ6jKguNq6ClstEKpTrk9ryUG572emEY4U=";
  };

-  vendorHash = "sha256-gJiarW1uYr5vl9nt+JN6/yRyYr9J0sfDVZcNLLcwPJY=";
+  vendorHash = "sha256-b9lzCNjO0rrK/kJlw5dssuQD/cyf/Wu/LJ2YNQ645LE=";

  nativeBuildInputs = [ installShellFiles ];

@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cyclonedx-python";
-  version = "7.2.2";
+  version = "7.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = "cyclonedx-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nTQ0y2zn4idg6x8qVjK8DeZVCMnlXLEJg89ISYabp68=";
+    hash = "sha256-mBOkSgHGKc77zhcMmdsrlZLXsK2t00VFiGW5eSN2lxc=";
  };

  build-system = with python3Packages; [ poetry-core ];
@@ -8,15 +8,15 @@
 }:

 let
-  version = "7.1.110";
+  version = "7.1.120";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-g8HAAp36l0GrAg/bJOjlvNT13Z9p/geDbA5XQCk3QvM=";
+      hash = "sha256-RrsM8Rx/uYJpH9+w/XX0RoPw+N/+nzJCC+KFdbYzSdc=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-W6br5bvRwgrfSiwwO5OMwfReev7t3mvI6L0zTIIDiwI=";
+      hash = "sha256-WgCfX7Av8YoCHmhACyyVtxut0FUfAdgTAXaIBydWTRI=";
    };
  };

@@ -1,7 +1,7 @@
 {
  lib,
  copyDesktopItems,
-  electron_40,
+  electron_41,
  fetchFromGitHub,
  deltachat-rpc-server,
  makeDesktopItem,
@@ -21,37 +21,37 @@

 let
  deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.43.0";
+    version = "2.48.0";
    src = fetchFromGitHub {
      owner = "chatmail";
      repo = "core";
      tag = "v${version}";
-      hash = "sha256-3hpsc/IMBTVHH6Lun9R8Dx3s53sJOb9J1fU1O56MpIc=";
+      hash = "sha256-9qrxzAoBdCzDaMWZnCPxKy9bISd19aI4U1kRcK85Mzg=";
    };
    cargoDeps = rustPlatform.fetchCargoVendor {
      pname = "chatmail-core";
      inherit version src;
-      hash = "sha256-kDYWu8QrVv1fAyNsPN5xY7QqExbdiM7C+Af0l9HVRDQ=";
+      hash = "sha256-UcQoY2NvnvWmGjHn1xwi0deyPZjtnbfQJJo32K7TX38=";
    };
  };
-  electron = electron_40;
+  electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "deltachat-desktop";
-  version = "2.43.0";
+  version = "2.48.0";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OIRfh0/E0fg0LepWRREmpcLbUKRSdJA+RWO3vkOu6so=";
+    hash = "sha256-7LCaZOI9fBzVMyT0RqgGykDvN0eSTz2h6fRXK2kyRDk=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_9;
    fetcherVersion = 2;
-    hash = "sha256-auvoo1YhHptbhTfeRbOQjc8vADCJhByb9efQFyskZPM=";
+    hash = "sha256-1R8vCGQlT3pvybrcPc2SKbmezprgvrIt0J+BsZHPJ7c=";
  };

  nativeBuildInputs = [
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "djhtml";
-  version = "3.0.10";
+  version = "3.0.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rtts";
    repo = "djhtml";
    tag = finalAttrs.version;
-    hash = "sha256-7K7/Zm6ORfza9AD+Jyl+0Q5zlxgF+WpH3a1O18VpT5k=";
+    hash = "sha256-l3qxPwnEyJ0sZWquaol0bOX7QvImLc8IRTfyE2yqXCo=";
  };

  build-system = [ python3Packages.setuptools ];
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "emmylua_doc_cli";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "EmmyLuaLs";
    repo = "emmylua-analyzer-rust";
    tag = finalAttrs.version;
-    hash = "sha256-2H/8ILVk5QnLe099a25pzMEqJLRFDxMG/fQ3f5UwgmI=";
+    hash = "sha256-Zj5nLeTH/4sVElYP+erg6bSTX8jFqF7sqiXfaMam8pE=";
  };

  buildAndTestSubdir = "crates/emmylua_doc_cli";

-  cargoHash = "sha256-QdL4KtQ4sJUaviqMzxmC1KW4Qy5wO7c5koy0Pl8Eua0=";
+  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -15,13 +15,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "eww";
-  version = "0.6.0-unstable-2025-06-30";
+  version = "0.6.0-unstable-2026-03-05";

  src = fetchFromGitHub {
    owner = "elkowar";
    repo = "eww";
-    rev = "fddb4a09b107237819e661151e007b99b5cab36d";
-    hash = "sha256-PJW4LvW9FmkG9HyUtgXOq7MDjYtBc/iJuOxyf29nD0Y=";
+    rev = "865cf631d5bbb5f9fccc99b3f4cc80b9eeada18c";
+    hash = "sha256-fL12XFMsf/efSlbzQc7cCI366CwETkM6sWpEfcF9s6A=";
  };

  cargoHash = "sha256-Kf99eojqXvdbZ3eRS8GBgyLYNpZKJGIJtsOsvhhSVDk=";
@@ -18,18 +18,18 @@
  nix-update-script,
 }:
 let
-  version = "1.0.68";
+  version = "1.0.69";
  src = fetchFromGitHub {
    name = "exo";
    owner = "exo-explore";
    repo = "exo";
    tag = "v${version}";
-    hash = "sha256-ryaz68vXS/SjPxGsWxtUSlzZrLBxV1tbBmJVraZu3RI=";
+    hash = "sha256-xHEvjztTSDMwfxdNt16Yo/hX1Fhpwz/zF7mnQsIOteY=";
  };

  python = python3.override {
    packageOverrides = _final: prev: {
-      # https://github.com/exo-explore/exo/blob/ba611f9cd0e21d3e63e2327b18fbc888fd085269/pyproject.toml#L67
+      # https://github.com/exo-explore/exo/blob/v1.0.69/pyproject.toml#L63
      mlx = prev.mlx.overridePythonAttrs (old: {
        version = "custom";

@@ -39,6 +39,27 @@ let
          rev = "address-rdma-gpu-locks";
          hash = "sha256-GosFIWxIB48Egb1MqJrR3xhsUsQeWdRk5rV93USY6wQ=";
        };
+
+        # mlx.meta.changelog fails to evaluate as it depends on mlx.src.tag which is not defined in
+        # this override
+        meta = old.meta // {
+          changelog = "";
+        };
+      });
+
+      # https://github.com/exo-explore/exo/blob/v1.0.69/pyproject.toml#L64
+      mlx-lm = prev.mlx-lm.overridePythonAttrs (old: {
+        version = "custom";
+
+        src = fetchFromGitHub {
+          owner = "rltakashige";
+          repo = "mlx-lm";
+          rev = "leo/fix-deepseek-v32-indexer";
+          hash = "sha256-sRMykX0hd15VF8tdO5MCjuVxkQvpjeluaS8U+wQvP4Q=";
+        };
+
+        # mlx-lm.meta.changelog fails to evaluate as it depends on mlx-lm.src.tag which is not
+        # defined in this override
        meta = old.meta // {
          changelog = "";
        };
@@ -56,7 +77,7 @@ let

    cargoDeps = rustPlatform.fetchCargoVendor {
      inherit (finalAttrs) pname src version;
-      hash = "sha256-Ga3/Yhg2Wn2w8cnNtq11/AN7K4nht4chSEIVOkYEI/U=";
+      hash = "sha256-gwOdA2sHz8n4GfNjK+OYmttXUTle4WYmAE2Y0KXYrwg=";
    };

    # Bypass rust nightly features not being available on rust stable
@@ -200,6 +221,7 @@ python3Packages.buildPythonApplication (finalAttrs: {

    # Require internet access:
    # openai_harmony.HarmonyError: error downloading or loading vocab file: failed to download or load vocab file
+    "TestParseGptOssMaxTokensTruncation"
    "test_both_formats_produce_identical_tool_calls"
    "test_format_a_yields_tool_call"
    "test_format_b_yields_tool_call"
@@ -2,23 +2,31 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fantasque-sans-mono";
  version = "1.8.0";

+  outputs = [
+    "out"
+    "webfont"
+    "doc"
+  ];
+
  src = fetchzip {
-    url = "https://github.com/belluzj/fantasque-sans/releases/download/v${version}/FantasqueSansMono-Normal.zip";
+    url = "https://github.com/belluzj/fantasque-sans/releases/download/v${finalAttrs.version}/FantasqueSansMono-Normal.zip";
    stripRoot = false;
    hash = "sha256-MNXZoDPi24xXHXGVADH16a3vZmFhwX0Htz02+46hWFc=";
  };

+  nativeBuildInputs = [ installFonts ];
+
  installPhase = ''
    runHook preInstall

-    install -Dm644 OTF/*.otf -t $out/share/fonts/opentype
-    install -Dm644 README.md -t $out/share/doc/${pname}-${version}
+    install -m644 -Dt $doc/share/doc/${finalAttrs.pname}-${finalAttrs.version} {*.md,*.txt}

    runHook postInstall
  '';
@@ -30,4 +38,4 @@ stdenvNoCC.mkDerivation rec {
    platforms = lib.platforms.all;
    maintainers = [ lib.maintainers.rycee ];
  };
-}
+})
@@ -96,6 +96,6 @@ stdenv.mkDerivation {
    description = "Set of utilities for working with file descriptors";
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
  };
 }
@@ -67,7 +67,10 @@ stdenv.mkDerivation rec {
        - A81
        - A81H
        - C80
+        - C801
        - C80H
+        - C80S1
+        - C80Y1
        - D80
        - D80 Pro
        - Y8
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Extract the initial/default boot image from a CD image if existent";
    homepage = "https://userpages.uni-koblenz.de/~krienke/ftp/noarch/geteltorito/";
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    license = lib.licenses.gpl2Only;
    mainProgram = "geteltorito";
  };
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gh-token";
-  version = "2.0.9";
+  version = "2.0.10";

  src = fetchFromGitHub {
    owner = "Link-";
    repo = "gh-token";
    rev = "v${version}";
-    hash = "sha256-ff3Dzajh/7p0yNSKCHJzJcqkTpf09zuZ6Hp0ygDv6o0=";
+    hash = "sha256-pjOGEd2c2yRua3qOTEKuTg89YbVBTAIvvZ/Rd8NFesI=";
  };

  vendorHash = "sha256-brAFqWdvaJwURdWb9m8x21nhuXeRxIJX6FsUfGiFIWQ=";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "github-distributed-owners";
-  version = "0.1.11";
+  version = "0.1.12";

  src = fetchFromGitHub {
    owner = "andrewring";
    repo = "github-distributed-owners";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oLRcH1lgRxlYIlyk3bPWO5YmCIq462YUjBjMSPOF7Ic=";
+    hash = "sha256-Ry7l4hiVWtSm47DYG38N0L7V/z5wNfPm9tt+8Zs5tsI=";
  };

-  cargoHash = "sha256-pt/GoXF/uSU78pZqG8PgFe+tlbwZH2qpGQD7jgC52NM=";
+  cargoHash = "sha256-xLc9T2rS511/qWyZpqSNFVyfyf4+gzheOF95TpVlUfc=";
  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glaze";
-  version = "7.1.0";
+  version = "7.2.2";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-W48BDsxUrFjjqUFwBcBqHr5Y7h+BtGGWdioGukBqzbE=";
+    hash = "sha256-E92oxXOcmA4d3s2k0D+DppnHt0Ks900+3W0XoGbbcG4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -31,9 +31,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
+    homepage = "https://stephenberry.github.io/glaze/";
+    changelog = "https://github.com/stephenberry/glaze/releases/tag/v${finalAttrs.version}";
    description = "Extremely fast, in memory, JSON and interface library for modern C++";
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ moni ];
+    maintainers = with lib.maintainers; [
+      moni
+      miniharinn
+    ];
    license = lib.licenses.mit;
  };
 })
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "gojq";
-  version = "0.12.18";
+  version = "0.12.19";

  src = fetchFromGitHub {
    owner = "itchyny";
    repo = "gojq";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9oqyNG8kaM4LmMWOZ2aQqabx97xw6Bt1PgjhVuPU+YE=";
+    hash = "sha256-egaBNHKKzwDwaUN4GT+Xvt11Nz6ojNMSIrXbcEisyI4=";
  };

-  vendorHash = "sha256-NxhoCbDRduegRcBoZbNi2CB7QRXvqpLv7cAL2mEy9tM=";
+  vendorHash = "sha256-6UnX9YHh4RGcIFfqaJLxDPxuGQ6KO4UIOryXsoJUjFs=";

  ldflags = [
    "-s"
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "homepage-dashboard";
-  version = "1.11.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "gethomepage";
    repo = "homepage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jnv9PnClm/jIQ4uU6c4A1UiAmwoihG0l6k3fUbD47I4=";
+    hash = "sha256-+ssT+eV/w9mzY2QTbna/RKYLVkeRREt318sc/bVgW1k=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-X5j9XppbcasGuC7fUsj4XzbaQFM9WcRcXjgJHN/inR8=";
+    hash = "sha256-deKVLAmgQEld59PpuaWse+laPoe4L9Ck1IjmgiP26bg=";
  };

  nativeBuildInputs = [
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "hugo";
-  version = "0.159.0";
+  version = "0.159.2";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-R+XUgATk6KHaQ+hTIbFSHEzC0VIzaVLna0mMGDRZILw=";
+    hash = "sha256-86qlh4did365g75j3fk5gkBp3T3YH3zEnNhaOrPFVcI=";
  };

-  vendorHash = "sha256-qAZ+EnU1Yaom8QHjaMoAJSaN7HslNpwifmBMlgnmmAE=";
+  vendorHash = "sha256-w6wjKB4jQejxW7IqpZaujxlZSUxWYqHiPI6aqOOD2+0=";

  checkFlags =
    let
@@ -65,14 +65,14 @@ in

 py.pkgs.buildPythonPackage (finalAttrs: {
  pname = "irrd";
-  version = "4.5.1";
+  version = "4.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "irrdnet";
    repo = "irrd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-98DXooabwJtjI+m/HNMGBkZKT843bEbTaXJgflVdx/A=";
+    hash = "sha256-Lr2+3pG22l479mNrn1JFiea+zp+n9qWVX1yTp0Cj4Ds=";
  };

  pythonRelaxDeps = true;
@@ -8,29 +8,17 @@
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.2.2-pre";
+  version = "0.2.2";
  pname = "kdotool";

  src = fetchFromGitHub {
    owner = "jinliu";
    repo = "kdotool";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-qx4bWAFQcoLM/r4aNzmoZdjclw8ccAW8lKLda6ON1aQ=";
+    hash = "sha256-aJRqFcKyu4/aqI3WtH9NjzjNgiI6lq0VgCXNGaNdyvE=";
  };

-  patches = [
-    # Remove these two on next release.
-    (fetchpatch {
-      url = "https://github.com/jinliu/kdotool/commit/049e3f5620ad8c5484241d7d06d742bc17d423ed.patch";
-      hash = "sha256-VTpHlT6XMVRgJIeLjxZPHkzaYFZCYtS8IAD0mKZ8rzs=";
-    })
-    (fetchpatch {
-      url = "https://github.com/jinliu/kdotool/commit/e0a3bff3b5d9882033dd72836e5fcff572b64135.patch";
-      hash = "sha256-6IsV9O2h9N/FxGQRHS8qAbEqdr7282ziGza5K52vpPk=";
-    })
-  ];
-
-  cargoHash = "sha256-ASR2zMwVCKeEZPYQNoO54J00eZyTn1i6FE0NBCJWSCs=";
+  cargoHash = "sha256-QrJVN2O/pDCIpD1ioFPZyj7au3DQtU3l/I440WsyYWo=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
@@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lagrange";
-  version = "1.20.2";
+  version = "1.20.3";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Rin9frCxY7vMJQbErtR7pXss2GciL4LbXg+BFHFNjn4=";
+    hash = "sha256-i6W4618/r3Xc9dNNxkc9eHlgHK2amZ0FQtq/qtr5sE8=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  openssl,
+}:
+
+stdenv.mkDerivation {
+  pname = "libu2f-emu";
+  version = "0-unstable-2020-09-04";
+
+  src = fetchFromGitHub {
+    owner = "Agnoctopus";
+    repo = "libu2f-emu";
+    rev = "d1c4b9c2e1c42e8931033912c8b609521f2a7756";
+    hash = "sha256-kDAXA/v2nb/QAiJpGs0rTjm0t6CdbonTwHHoYhDQExE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  postPatch = ''
+    # Upstream meson.build uses error() instead of warning() for missing
+    # doxygen/dot, which fails the configure.
+    substituteInPlace meson.build \
+      --replace-fail "error('Skip doc:" "warning('Skip doc:" \
+      --replace-fail "error('Skip dot in doc:" "warning('Skip dot in doc:"
+
+    # Fix header guard typo: TRANSaCTION_H -> TRANSACTION_H
+    substituteInPlace src/usb/transaction.h \
+      --replace-fail "define TRANSaCTION_H" "define TRANSACTION_H"
+
+    # Install headers into a u2f-emu/ subdirectory so consumers can
+    # use #include <u2f-emu/u2f-emu.h> (expected by QEMU).
+    substituteInPlace src/meson.build \
+      --replace-fail "install_headers(u2f_emu_headers)" \
+                     "install_headers(u2f_emu_headers, subdir: 'u2f-emu')"
+  '';
+
+  # Disable -Werror: upstream uses OpenSSL EC_KEY APIs deprecated since 3.0.
+  mesonFlags = [ "--warnlevel=2" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  meta = {
+    description = "Universal 2nd Factor (U2F) Emulation C Library";
+    homepage = "https://github.com/Agnoctopus/libu2f-emu";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ philiptaron ];
+    platforms = lib.platforms.linux;
+  };
+}
@@ -3,6 +3,7 @@
  stdenvNoCC,
  fetchFromGitHub,
  nix-update-script,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -19,17 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  dontConfigure = true;
  dontBuild = true;

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp font/*.ttf $out/share/fonts/truetype
-
-    mkdir -p $out/share/fonts/opentype
-    cp font/*.otf $out/share/fonts/opentype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  passthru.updateScript = nix-update-script { };

@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "mihomo";
-  version = "1.19.21";
+  version = "1.19.22";

  src = fetchFromGitHub {
    owner = "MetaCubeX";
    repo = "mihomo";
    rev = "v${version}";
-    hash = "sha256-vNWnGLVbwsyD0DqOXe1dfUy/Mym+YhBzGlrZrgZ3RuE=";
+    hash = "sha256-HRFtKx9g7AsBPl3HlOf+2giDc6a7e4YmQZlg4hElfdI=";
  };

-  vendorHash = "sha256-yj+vCpwyyyw0++V1UHxzV8j1tZ+Jc65eilyef9UShZQ=";
+  vendorHash = "sha256-K5lC6bvetwaXvufa+FU+noXWXBem/IZ1pkl2eLo7vTc=";

  excludedPackages = [ "./test" ];

@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "minijinja";
-  version = "2.18.0";
+  version = "2.19.0";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "minijinja";
    rev = finalAttrs.version;
-    hash = "sha256-l/79Q/5enkhQ3KggSWQKtjlF+bxSzOz73dwDhewM6mo=";
+    hash = "sha256-aZBC2OypmrPNU/uuaCCjhcFTJn0jl3VPTJYHh0piTxo=";
  };

-  cargoHash = "sha256-WujWLLnz3xSR5H1IOsVYoB1o/R84a+BBdUTROMHz7xA=";
+  cargoHash = "sha256-TGqfng5SB2tTplZaFWC6BM/L385av6tYTQvcHsSk3h0=";

  # The tests relies on the presence of network connection
  doCheck = false;
@@ -33,7 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/pobrn/mktorrent/wiki";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
-      Profpatsch
      winter
    ];
    platforms = lib.platforms.all;
@@ -38,7 +38,7 @@ buildLua {
  meta = {
    description = "Convert parts of a video while you are watching it in mpv";
    homepage = "https://gist.github.com/Zehkul/25ea7ae77b30af959be0";
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    longDescription = ''
      When this script is loaded into mpv, you can hit Alt+W to mark the beginning
      and Alt+W again to mark the end of the clip. Then a settings window opens.
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {

    homepage = "http://mustache.github.io/";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
    platforms = lib.platforms.all;
  };
 })
@@ -52,16 +52,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "muvm";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "AsahiLinux";
    repo = "muvm";
    tag = "muvm-${finalAttrs.version}";
-    hash = "sha256-k3Jj/Tzu5ZfnADMiVG7pAPqosrkZvhmehi0NMbyudN0=";
+    hash = "sha256-eXsU2QRJ55gx5RhjT+m9F1KAFqGrd4WwnyR3eMpuIc4=";
  };

-  cargoHash = "sha256-jFNyQD2Hf1K5+wHDRD2WG70IJfZbL+hT/gtjeUnt5Mk=";
+  cargoHash = "sha256-OP44LRMN4Lp9LaXQ8Oa8B4LRTqlMyaTa0xKn4eoh1LQ=";

  postPatch = ''
    substituteInPlace crates/muvm/src/guest/bin/muvm-guest.rs \
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://sourceforge.net/projects/nettee";
    description = ''Network "tee" program'';
    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
    mainProgram = "nettee";
  };
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "nfpm";
-  version = "2.45.2";
+  version = "2.46.0";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = "nfpm";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-MzxN4oQFmhnuR8T5wa5AGKjL+LhlTSBd2tGVf9WsCBc=";
+    hash = "sha256-dzgC8SnGsKdW95xyq7pXacBvCTrte6QQCjYvo5R4D9I=";
  };

-  vendorHash = "sha256-cq0pcbC0T3klh3D9l0e0u5JPYv1kWYlpeNYyGczGX+A=";
+  vendorHash = "sha256-HfqPqGpwInTrGjTCA4qJjtngJTCmb+c/sJ1Uhi/CCZ0=";

  ldflags = [
    "-s"
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-ncffAF1gEsCMeUszgqZExTSYRPkZ6em85S9thM1U3Sc=";
+    hash = "sha256-IxPsm361gYdYWDy16vai5JsmJ5NWUSIRQ9k2Qnwi2K8=";
  };

  vendorHash = "sha256-snrOKwD4xbMTdjP13KLTVVB7ikXG+yHS8QT60/tHZ3I=";
@@ -4,28 +4,30 @@
  fetchFromGitHub,
  boost,
  cmake,
-  catch2,
+  catch2_3,
+  microsoft-gsl,
  pkg-config,
  replaceVars,
  yaml-cpp,
 }:

-stdenv.mkDerivation {
-  pname = "ebpf-verifier";
-  version = "unstable-2023-07-15";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prevail";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "vbpf";
-    repo = "ebpf-verifier";
-    rev = "de14d3aa3cd2845b621faf32b599766a66e158cf";
+    repo = "prevail";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-gnxB8ZLbTyIYpd61T57LPKFm1MHufeVEq/qN9pu2Vpk=";
+    hash = "sha256-qlQSoz9GE2Z2rzmrPIj+HnIQmNxiBSgvR40FR9psuDc=";
  };

  patches = [
    (replaceVars ./remove-fetchcontent-usage.patch {
      # We will download them instead of cmake's fetchContent
-      catch2Src = catch2.src;
+      catch2Src = catch2_3.src;
+      gslSrc = microsoft-gsl.src;
    })
  ];

@@ -39,21 +41,35 @@ stdenv.mkDerivation {
    yaml-cpp
  ];

+  cmakeFlags = [
+    (lib.cmakeBool "prevail_ENABLE_TESTS" finalAttrs.doCheck)
+  ];
+
  installPhase = ''
    runHook preInstall

    mkdir -p $out/bin
-    cp ../check $out/bin/ebpf-verifier
+    cp ../bin/prevail $out/bin/prevail

    runHook postInstall
  '';

+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    pushd ..
+    bin/tests
+    popd
+    runHook postCheck
+  '';
+
  meta = {
    description = "eBPF verifier based on abstract interpretation";
-    homepage = "https://github.com/vbpf/ebpf-verifier";
+    homepage = "https://github.com/vbpf/prevail";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
    maintainers = [ ];
-    mainProgram = "ebpf-verifier";
+    mainProgram = "prevail";
  };
-}
+})
@@ -0,0 +1,25 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -75,9 +75,7 @@
+ endif ()
+ 
+ FetchContent_Declare(GSL
+-  GIT_REPOSITORY "https://github.com/microsoft/GSL"
+-  GIT_TAG "v4.2.0"
+-  GIT_SHALLOW ON
+  SOURCE_DIR "@gslSrc@"
+ )
+ set(GSL_INSTALL ON CACHE BOOL "Force GSL install to vendor it with prevail" FORCE)
+ set(GSL_TEST OFF CACHE BOOL "Skip GSL tests when building as a dependency" FORCE)
+@@ -196,9 +194,7 @@
+ # Tests
+ if (prevail_ENABLE_TESTS)
+   FetchContent_Declare(Catch2
+-    GIT_REPOSITORY "https://github.com/catchorg/Catch2.git"
+-    GIT_TAG "v3.13.0"
+-    GIT_SHALLOW ON
+    SOURCE_DIR "@catch2Src@"
+   )
+   FetchContent_MakeAvailable(Catch2)
+ 
@@ -1,15 +0,0 @@
-diff --git a/src/pyload/core/__init__.py b/src/pyload/core/__init__.py
-index 4324fc700..f7fcd66ec 100644
--- a/src/pyload/core/__init__.py
-+++ b/src/pyload/core/__init__.py
-@@ -46,8 +46,8 @@ class Exit(Exception):
- #  improve external scripts
- class Core:
-     LOCALE_DOMAIN = APPID
-    DEFAULT_USERNAME = APPID
-    DEFAULT_PASSWORD = APPID
-+    DEFAULT_USERNAME = os.getenv("PYLOAD_DEFAULT_USERNAME", APPID)
-+    DEFAULT_PASSWORD = os.getenv("PYLOAD_DEFAULT_PASSWORD", APPID)
-     DEFAULT_DATADIR = os.path.join(
-         os.getenv("APPDATA") or USERHOMEDIR, "pyLoad" if os.name == "nt" else ".pyload"
-     )
@@ -1,18 +0,0 @@
-diff --git a/src/pyload/core/__init__.py b/src/pyload/core/__init__.py
-index 4324fc700..5d915a85e 100644
--- a/src/pyload/core/__init__.py
-+++ b/src/pyload/core/__init__.py
-@@ -128,6 +128,13 @@ class Core:
-         else:
-             self._debug = max(0, int(debug))
-
-+        # Allow setting any option declaratively, for the NixOS module
-+        for env, value in os.environ.items():
-+            if not env.startswith("PYLOAD__"):
-+                continue
-+            section, opt = env.removeprefix("PYLOAD__").lower().split("__")
-+            self.config.set(section, opt, value)
-+
-         # If no argument set, read storage dir from config file,
-         # otherwise save setting to config dir
-         if storagedir is None:
@@ -1,72 +0,0 @@
-{
-  lib,
-  fetchPypi,
-  nixosTests,
-  python3,
-}:
-
-python3.pkgs.buildPythonApplication (finalAttrs: {
-  version = "0.5.0b3.dev88";
-  pname = "pyload-ng";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit (finalAttrs) version;
-    # The uploaded tarball uses an underscore in recent releases
-    pname = "pyload_ng";
-    hash = "sha256-6YVYXiYxUkpQmDG/aGEgBlJy2oUGCNDkIsUt0TRcaro=";
-  };
-
-  patches = [
-    # Makes it possible to change the default username/password in the module
-    ./declarative-default-user.patch
-    # Makes it possible to change the configuration through environment variables
-    # in the NixOS module (aimed mostly at listen address/port)
-    ./declarative-env-config.patch
-  ];
-
-  postPatch = ''
-    # relax version bounds
-    sed -i -E 's/([A-z0-9]*)~=[^;]*(.*)/\1\2/' setup.cfg
-  '';
-
-  dependencies = with python3.pkgs; [
-    bitmath
-    certifi
-    cheroot
-    cryptography
-    dukpy
-    filetype
-    flask
-    flask-babel
-    flask-caching
-    flask-compress
-    flask-session
-    flask-themes2
-    pycurl
-    semver
-    setuptools
-  ];
-
-  optional-dependencies = {
-    plugins = with python3.pkgs; [
-      beautifulsoup4 # for some plugins
-      colorlog # colorful console logging
-      pillow # for some CAPTCHA plugin
-      send2trash # send some files to trash instead of deleting them
-      slixmpp # XMPP plugin
-    ];
-  };
-
-  passthru.tests = {
-    inherit (nixosTests) pyload;
-  };
-
-  meta = {
-    description = "Free and open-source download manager with support for 1-click-hosting sites";
-    homepage = "https://github.com/pyload/pyload";
-    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ ruby0b ];
-    mainProgram = "pyload";
-  };
-})
@@ -92,6 +92,8 @@
  fuse3,
  canokeySupport ? false,
  canokey-qemu,
+  u2fEmuSupport ? false,
+  libu2f-emu,
  capstoneSupport ? !minimal,
  capstone,
  valgrindSupport ? false,
@@ -245,6 +247,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals uringSupport [ liburing ]
  ++ lib.optionals fuseSupport [ fuse3 ]
  ++ lib.optionals canokeySupport [ canokey-qemu ]
+  ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
  ++ lib.optionals capstoneSupport [ capstone ]
  ++ lib.optionals valgrindSupport [ valgrind-light ];

@@ -329,6 +332,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional uringSupport "--enable-linux-io-uring"
  ++ lib.optional fuseSupport "--enable-fuse"
  ++ lib.optional canokeySupport "--enable-canokey"
+  ++ lib.optional u2fEmuSupport "--enable-u2f"
  ++ lib.optional capstoneSupport "--enable-capstone"
  ++ lib.optional (!pluginsSupport) "--disable-plugins"
  ++ lib.optional (!enableBlobs) "--disable-install-blobs"
@@ -11,6 +11,7 @@
  wasm-bindgen-cli_0_2_108,
  binaryen,
  lld,
+  rust-jemalloc-sys-unprefixed,
 }:
 let
  version = "0.34.3";
@@ -98,6 +99,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    perl
  ];

+  buildInputs = [ rust-jemalloc-sys-unprefixed ];
+
  preBuild = ''
    cp -r ${frontend}/lib/node_modules/frontend/dist/templates/html/ templates/html
    cp -r ${frontend}/lib/node_modules/frontend/dist/static/ static
@@ -10,14 +10,14 @@

 stdenv.mkDerivation {
  pname = "sealcurses";
-  version = "0-unstable-2024-12-02"; # No release yet
+  version = "0-unstable-2026-03-22"; # No release yet

  src = fetchFromGitea {
    domain = "git.skyjake.fi";
    owner = "skyjake";
    repo = "sealcurses";
-    rev = "310348a6b88678a47d371c7edfcc1e8c76ca1677";
-    hash = "sha256-SEK3w6pVrYi+h2l5RuULpORYPnm8H78lEVR01cMkku0=";
+    rev = "35c2e0332301f7aa14d3a849b30a844d65fa81bd";
+    hash = "sha256-ILskZo5BNw4JK6n0ig2ULkUI7k9mdPjuk4VVEB7jx8c=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "secrethound";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "rafabd1";
    repo = "SecretHound";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-TyN7byX4rkRXrKzcx/u/LYNqVRBue2YNJRnkF+f34jQ=";
+    hash = "sha256-mZ2rZMjNKLJ+AQQlEGUwgSpIAhqbHG53wUNDIEtJXwI=";
  };

  vendorHash = "sha256-oTyI3/+evDTzyH+BjfSP0A1r2bYVAMxtWRsg0G1d2zQ=";
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "sem";
-  version = "0.33.0";
+  version = "0.33.1";

  src = fetchFromGitHub {
    owner = "semaphoreci";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-sWj0eenqZBanHO2E047Jd0MlphgzszvD+1ZsMFHiQ00=";
+    sha256 = "sha256-+MNl+JOpC3FgzWBVybTDqV6VE4cdBafQ77IYcXO4j48=";
  };

  vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
@@ -2,6 +2,7 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

 let
@@ -18,13 +19,7 @@ stdenvNoCC.mkDerivation {
    stripRoot = false;
  };

-  installPhase = ''
-    runHook preInstall
-
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://dotcolon.net/font/seshat/";
@@ -9,7 +9,7 @@ buildNpmPackage (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/src/frontend";

-  npmDepsHash = "sha256-RAzotFGj0FGpfF7iyB5f2fdKFvMLcpJx142yplRwboU=";
+  npmDepsHash = "sha256-VCnxEcaqWo31oIpF6X8Lid4I/aaQCQZ9l9rV6TTqXPI=";

  installPhase = ''
    runHook preInstall
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "shelfmark";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "calibrain";
    repo = "shelfmark";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-t4t7je7Y/aezx/EX7paJIcsCq5qyZeU/+mPLeZ8oTPg=";
+    hash = "sha256-Fe7zu51gFG2QgcBWcGkFi64CdZW4ohZg+7jdmeMFVLI=";
  };

  nativeBuildInputs = [
@@ -90,7 +90,10 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/calibrain/shelfmark";
    changelog = "https://github.com/calibrain/shelfmark/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
+    maintainers = with lib.maintainers; [
+      jamiemagee
+      pyrox0
+    ];
    mainProgram = "shelfmark";
  };
 })
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "signalbackup-tools";
-  version = "20260306";
+  version = "20260325";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    tag = finalAttrs.version;
-    hash = "sha256-mGJkkE+sT+FKd2tSAXcmDAmKbsE9H9k5IyQbzxJcvjY=";
+    hash = "sha256-5Tb9bY0sZvCUlYkGpmu6hVi7EOEMaygEH9x3tbyo2T4=";
  };

  nativeBuildInputs = [
@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "siyuan";
-  version = "3.6.1";
+  version = "3.6.2";

  src = fetchFromGitHub {
    owner = "siyuan-note";
    repo = "siyuan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Qsqg6WKfpPOZwvH6aFcDVjIAJcBckClqE/1g92JvR2M=";
+    hash = "sha256-2OBTX4Lh3dx7NbuWsvyB4FzXk6ywDcp6LswhlRlBjCI=";
  };

  kernel = buildGoModule {
    name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
    inherit (finalAttrs) src;
    sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-R+/njKBraRPgWLnhBXy969ILA/fn0wyq6OkYgJnS1WM=";
+    vendorHash = "sha256-EfGCeVsD4yYUBEkSCbRdmMitZfJmQffcbScKaAOX+0o=";

    patches = [
      (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm_9;
    fetcherVersion = 3;
-    hash = "sha256-N/LKkE0I6sIiO0+wGvPZMgaWKUPcq7Gjpsw5Oj9cvqI=";
+    hash = "sha256-HKAK0XwudDuMk/1l6FH1h/FS0xUhzE0s37tpXDdtMU4=";
  };

  sourceRoot = "${finalAttrs.src.name}/app";
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stevenblack-blocklist";
-  version = "3.16.69";
+  version = "3.16.72";

  src = fetchFromGitHub {
    owner = "StevenBlack";
    repo = "hosts";
    tag = finalAttrs.version;
-    hash = "sha256-OSN3K2lSag5aA58UmfI1JMvmksuEVwlT7TOeBOsEmX8=";
+    hash = "sha256-4jL8uNtLxjFObsp34uYAdPinNHZEcLk+wQ9Dg2wGxgk=";
  };

  outputs = [
@@ -81,7 +81,7 @@ stdenv.mkDerivation {
    '';
    homepage = "https://messymatters.com/tagtime/";
    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.Profpatsch ];
+    maintainers = [ ];
    mainProgram = "tagtimed";
  };
 }
@@ -2,25 +2,19 @@
  lib,
  stdenvNoCC,
  fetchurl,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "takao";
  version = "00303.01";

  src = fetchurl {
-    url = "mirror://ubuntu/pool/universe/f/fonts-takao/fonts-takao_${version}.orig.tar.gz";
+    url = "mirror://ubuntu/pool/universe/f/fonts-takao/fonts-takao_${finalAttrs.version}.orig.tar.gz";
    hash = "sha256-0wjHNv1yStp0q9D0WfwjgUYoUKcCrXA5jFO8PEVgq5k=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts
-    cp *.ttf $out/share/fonts
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "Japanese TrueType Gothic, P Gothic, Mincho, P Mincho fonts";
@@ -29,4 +23,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = with lib.maintainers; [ serge ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/Show More
+++ b/Show More