From f8b767bfe779ca0f05b1194f62daec734240008e Mon Sep 17 00:00:00 2001
From: kittyandrew <andrew@kittymail.me>
Date: Wed, 25 Mar 2026 13:28:43 +0200
Subject: [PATCH 01/33] maintainers: add kittyandrew

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c79cba377258..a007b4f1a128 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14136,6 +14136,13 @@
     githubId = 10689811;
     name = "Torben Schweren";
   };
+  kittyandrew = {
+    email = "alias.nixpkgs.maintainer@kittymail.me";
+    github = "kittyandrew";
+    githubId = 45767571;
+    matrix = "@kittyandrew:ndrew.me";
+    name = "kittyandrew";
+  };
   kittywitch = {
     email = "kat@inskip.me";
     github = "kittywitch";

From 7607d8e18daea714a52cbe18f364a2fc77a64d00 Mon Sep 17 00:00:00 2001
From: kittyandrew <andrew@kittymail.me>
Date: Wed, 25 Mar 2026 13:28:50 +0200
Subject: [PATCH 02/33] grafana-to-ntfy: 0-unstable-2025-01-25 -> 2026.3.15

https://github.com/kittyandrew/grafana-to-ntfy/releases/tag/v2026.3.15
---
 pkgs/by-name/gr/grafana-to-ntfy/package.nix | 29 ++++++++++++++-------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/gr/grafana-to-ntfy/package.nix b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
index ebeb5534d5b0..95718926ed28 100644
--- a/pkgs/by-name/gr/grafana-to-ntfy/package.nix
+++ b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
@@ -1,28 +1,39 @@
 {
   lib,
-  rustPlatform,
   fetchFromGitHub,
+  rustPlatform,
+  nixosTests,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grafana-to-ntfy";
-  version = "0-unstable-2025-01-25";
+  version = "2026.3.15";
 
   src = fetchFromGitHub {
     owner = "kittyandrew";
     repo = "grafana-to-ntfy";
-    rev = "64d11f553776bbf7695d9febd74da1bad659352d";
-    hash = "sha256-GO9VE9wymRk+QKGFyDpd0wS9GCY3pjpFUe37KIcnKxc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jK/UTgazDlVaIAD0AM61i0dAVX41LCPJFGf1tfMhNk0=";
   };
 
-  cargoHash = "sha256-w4HSxdihElPz0q05vWjajQ9arZjAzd82L0kEKk1Uk8s=";
+  cargoHash = "sha256-/e9dDcoablMSLb8q0DPUqNExPny13fm/xBhUT46hkXQ=";
+
+  # No unit tests; all testing is NixOS VM-based integration tests
+  doCheck = false;
+
+  passthru = {
+    tests.grafana-to-ntfy = nixosTests.grafana-to-ntfy;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
-    description = "Bridge to forward Grafana alerts to ntfy.sh notification service";
+    description = "Bridge to forward Grafana and Prometheus Alertmanager alerts to ntfy.sh";
     homepage = "https://github.com/kittyandrew/grafana-to-ntfy";
+    changelog = "https://github.com/kittyandrew/grafana-to-ntfy/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ kittyandrew ];
     mainProgram = "grafana-to-ntfy";
   };
-}
+})

From bae09060c2c1fa11e3bd92290e097524f66c6f73 Mon Sep 17 00:00:00 2001
From: kittyandrew <andrew@kittymail.me>
Date: Wed, 25 Mar 2026 13:29:06 +0200
Subject: [PATCH 03/33] nixos/grafana-to-ntfy: fix type bugs, add missing
 options, add NixOS test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes:
- ntfyBAuthPass: type was `path` with `default = null` — eval crash (supersedes #399155, #423598)
- bauthPass: was required with no default — blocked unauthenticated use
- bauthUser: defaulted to "admin", silently forcing auth even when not configured
- systemd-creds: quote command substitution to handle passwords with special characters
- BAUTH_USER env var leaked when auth was not configured

New options: markdown, port, address

Reliability: network-online.target ordering, Restart=always, RestrictSUIDSGID,
ProtectSystem=strict, and other hardening aligned with alertmanager-ntfy module.

Adds NixOS VM test covering health endpoint, Alertmanager webhook path, and
Grafana receiver test API path with field assertions on ntfy notifications.
---
 .../services/monitoring/grafana-to-ntfy.nix   | 131 ++++++++++----
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/grafana-to-ntfy.nix               | 166 ++++++++++++++++++
 3 files changed, 265 insertions(+), 33 deletions(-)
 create mode 100644 nixos/tests/grafana-to-ntfy.nix

diff --git a/nixos/modules/services/monitoring/grafana-to-ntfy.nix b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
index db35792363b8..09512e1a37e0 100644
--- a/nixos/modules/services/monitoring/grafana-to-ntfy.nix
+++ b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
@@ -9,9 +9,11 @@ let
   cfg = config.services.grafana-to-ntfy;
 in
 {
+  meta.maintainers = with lib.maintainers; [ kittyandrew ];
+
   options = {
     services.grafana-to-ntfy = {
-      enable = lib.mkEnableOption "Grafana-to-ntfy (ntfy.sh) alerts channel";
+      enable = lib.mkEnableOption "grafana-to-ntfy, a Grafana/Alertmanager to ntfy.sh bridge";
 
       package = lib.mkPackageOption pkgs "grafana-to-ntfy" { };
 
@@ -33,64 +35,124 @@ in
         };
 
         ntfyBAuthPass = lib.mkOption {
-          type = lib.types.path;
+          type = lib.types.nullOr lib.types.path;
           description = ''
             The path to the password for the specified ntfy-sh user.
             Setting this option is required when using a ntfy-sh instance with access control enabled.
           '';
           default = null;
+          example = "/run/secrets/grafana-to-ntfy-ntfy-pass";
         };
 
         bauthUser = lib.mkOption {
-          type = lib.types.str;
+          type = lib.types.nullOr lib.types.str;
           description = ''
-            The user that you will authenticate with in the Grafana webhook settings.
-            You can set this to whatever you like, as this is not the same as the ntfy-sh user.
+            The user for Basic Auth on incoming webhook requests from Grafana or Alertmanager.
+            When set together with {option}`bauthPass`, incoming requests require Basic Auth.
+            When both are null, the endpoint is open (unauthenticated).
           '';
-          default = "admin";
+          default = null;
+          example = "admin";
         };
 
         bauthPass = lib.mkOption {
-          type = lib.types.path;
-          description = "The path to the password you will use in the Grafana webhook settings.";
+          type = lib.types.nullOr lib.types.path;
+          description = ''
+            Path to the password file for Basic Auth on incoming webhook requests.
+            When set together with {option}`bauthUser`, incoming requests require Basic Auth.
+            When both are null, the endpoint is open (unauthenticated).
+          '';
+          default = null;
+          example = "/run/secrets/grafana-to-ntfy-bauth-pass";
+        };
+
+        markdown = lib.mkOption {
+          type = lib.types.bool;
+          description = "Enable Markdown formatting in ntfy notifications. Sets the X-Markdown header.";
+          default = false;
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          description = "Port to listen on.";
+          default = 8080;
+        };
+
+        address = lib.mkOption {
+          type = lib.types.str;
+          description = "Address to listen on.";
+          default = "127.0.0.1";
+          example = "0.0.0.0";
         };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    systemd.services.grafana-to-ntfy = {
-      wantedBy = [ "multi-user.target" ];
-
-      script = ''
-        export BAUTH_PASS=$(${lib.getExe' config.systemd.package "systemd-creds"} cat BAUTH_PASS_FILE)
-        ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) ''
-          export NTFY_BAUTH_PASS=$(${lib.getExe' config.systemd.package "systemd-creds"} cat NTFY_BAUTH_PASS_FILE)
-        ''}
-        exec ${lib.getExe cfg.package}
-      '';
-
-      environment = {
-        NTFY_URL = cfg.settings.ntfyUrl;
-        BAUTH_USER = cfg.settings.bauthUser;
+    assertions = [
+      {
+        assertion = (cfg.settings.bauthUser == null) == (cfg.settings.bauthPass == null);
+        message = "services.grafana-to-ntfy: bauthUser and bauthPass must both be set or both be null";
       }
-      // lib.optionalAttrs (cfg.settings.ntfyBAuthUser != null) {
-        NTFY_BAUTH_USER = cfg.settings.ntfyBAuthUser;
-      };
+      {
+        assertion = (cfg.settings.ntfyBAuthUser == null) == (cfg.settings.ntfyBAuthPass == null);
+        message = "services.grafana-to-ntfy: ntfyBAuthUser and ntfyBAuthPass must both be set or both be null";
+      }
+    ];
+
+    systemd.services.grafana-to-ntfy = {
+      description = "Grafana/Alertmanager to ntfy.sh bridge";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      script =
+        let
+          optionalCred = name: envVar: ''
+            export ${envVar}="$(${lib.getExe' config.systemd.package "systemd-creds"} cat ${name})"
+          '';
+        in
+        ''
+          ${lib.optionalString (cfg.settings.bauthPass != null) (optionalCred "BAUTH_PASS_FILE" "BAUTH_PASS")}
+          ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) (optionalCred "NTFY_BAUTH_PASS_FILE" "NTFY_BAUTH_PASS")}
+          exec ${lib.getExe cfg.package}
+        '';
+
+      environment =
+        {
+          NTFY_URL = cfg.settings.ntfyUrl;
+          ROCKET_PORT = toString cfg.settings.port;
+          ROCKET_ADDRESS = cfg.settings.address;
+        }
+        // lib.optionalAttrs (cfg.settings.bauthUser != null) {
+          BAUTH_USER = cfg.settings.bauthUser;
+        }
+        // lib.optionalAttrs (cfg.settings.ntfyBAuthUser != null) {
+          NTFY_BAUTH_USER = cfg.settings.ntfyBAuthUser;
+        }
+        // lib.optionalAttrs cfg.settings.markdown {
+          MARKDOWN = "true";
+        };
 
       serviceConfig = {
-        LoadCredential = [
-          "BAUTH_PASS_FILE:${cfg.settings.bauthPass}"
-        ]
-        ++ lib.optional (
-          cfg.settings.ntfyBAuthPass != null
-        ) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
+        LoadCredential =
+          lib.optional (cfg.settings.bauthPass != null) "BAUTH_PASS_FILE:${cfg.settings.bauthPass}"
+          ++ lib.optional (cfg.settings.ntfyBAuthPass != null) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
 
         DynamicUser = true;
+
+        Restart = "always";
+        RestartSec = 5;
+
+        # Hardening
+        AmbientCapabilities = [ "" ];
         CapabilityBoundingSet = [ "" ];
-        DeviceAllow = "";
+        DevicePolicy = "closed";
         LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
         PrivateDevices = true;
+        PrivateTmp = true;
         PrivateUsers = true;
         ProcSubset = "pid";
         ProtectClock = true;
@@ -101,6 +163,8 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
@@ -108,11 +172,12 @@ in
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        MemoryDenyWriteExecute = true;
+        RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "~@resources"
         ];
         UMask = "0077";
       };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 638afcb5f721..0acdf3c6cddd 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -674,6 +674,7 @@ in
   gotosocial = runTest ./web-apps/gotosocial.nix;
   goupile = runTest ./web-apps/goupile;
   grafana = handleTest ./grafana { };
+  grafana-to-ntfy = runTest ./grafana-to-ntfy.nix;
   graphite = runTest ./graphite.nix;
   grav = runTest ./web-apps/grav.nix;
   graylog = runTest ./graylog.nix;
diff --git a/nixos/tests/grafana-to-ntfy.nix b/nixos/tests/grafana-to-ntfy.nix
new file mode 100644
index 000000000000..d7e942296e3a
--- /dev/null
+++ b/nixos/tests/grafana-to-ntfy.nix
@@ -0,0 +1,166 @@
+{ lib, ... }:
+
+let
+  ports = {
+    grafana-to-ntfy = 8080;
+    ntfy-sh = 8081;
+    grafana = 3000;
+    alertmanager = 9093;
+  };
+  ntfyTopic = "grafana-alerts";
+in
+
+{
+  name = "grafana-to-ntfy";
+  meta.maintainers = with lib.maintainers; [ kittyandrew ];
+
+  nodes.machine = {
+    services.grafana-to-ntfy = {
+      enable = true;
+      settings = {
+        ntfyUrl = "http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}";
+        port = ports.grafana-to-ntfy;
+        address = "127.0.0.1";
+      };
+    };
+
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        listen-http = "127.0.0.1:${toString ports.ntfy-sh}";
+        base-url = "http://127.0.0.1:${toString ports.ntfy-sh}";
+      };
+    };
+
+    services.grafana = {
+      enable = true;
+      settings = {
+        server.http_port = ports.grafana;
+        server.http_addr = "127.0.0.1";
+        security.admin_user = "admin";
+        security.admin_password = "admin";
+        security.secret_key = "test-only-dummy-key";
+      };
+      provision.alerting = {
+        contactPoints.settings = {
+          apiVersion = 1;
+          contactPoints = [
+            {
+              orgId = 1;
+              name = "grafana-to-ntfy";
+              receivers = [
+                {
+                  uid = "cp_webhook";
+                  type = "webhook";
+                  disableResolveMessage = false;
+                  settings = {
+                    url = "http://127.0.0.1:${toString ports.grafana-to-ntfy}";
+                    httpMethod = "POST";
+                  };
+                }
+              ];
+            }
+          ];
+        };
+        policies.settings = {
+          apiVersion = 1;
+          policies = [
+            {
+              orgId = 1;
+              receiver = "grafana-to-ntfy";
+              group_by = [ "..." ];
+              group_wait = "0s";
+              group_interval = "1s";
+              repeat_interval = "1h";
+            }
+          ];
+        };
+      };
+    };
+
+    services.prometheus.alertmanager = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = ports.alertmanager;
+      configuration = {
+        route = {
+          receiver = "grafana-to-ntfy";
+          group_by = [ "..." ];
+          group_wait = "0s";
+          group_interval = "1s";
+          repeat_interval = "2h";
+        };
+        receivers = [
+          {
+            name = "grafana-to-ntfy";
+            webhook_configs = [
+              { url = "http://127.0.0.1:${toString ports.grafana-to-ntfy}"; }
+            ];
+          }
+        ];
+      };
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.grafana-to-ntfy.settings.address = lib.mkForce "0.0.0.0";
+    services.grafana.settings.server.http_addr = lib.mkForce "0.0.0.0";
+    services.prometheus.alertmanager.listenAddress = lib.mkForce "0.0.0.0";
+    services.ntfy-sh.settings.listen-http = lib.mkForce "0.0.0.0:${toString ports.ntfy-sh}";
+    networking.firewall.enable = false;
+    virtualisation.forwardPorts = lib.mapAttrsToList (_: port: {
+      from = "host";
+      host = { inherit port; };
+      guest = { inherit port; };
+    }) ports;
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("grafana-to-ntfy.service")
+    machine.wait_for_unit("ntfy-sh.service")
+    machine.wait_for_unit("grafana.service")
+    machine.wait_for_unit("alertmanager.service")
+    machine.wait_for_open_port(${toString ports.grafana-to-ntfy})
+    machine.wait_for_open_port(${toString ports.ntfy-sh})
+    machine.wait_for_open_port(${toString ports.grafana})
+    machine.wait_for_open_port(${toString ports.alertmanager})
+
+    with subtest("Health endpoint returns 200"):
+      machine.succeed("curl -sf http://127.0.0.1:${toString ports.grafana-to-ntfy}/health")
+
+    with subtest("Alertmanager alert arrives at ntfy"):
+      machine.succeed(
+        "curl -sf http://127.0.0.1:${toString ports.alertmanager}/api/v2/alerts"
+        " -X POST -H 'Content-Type: application/json'"
+        " -d '[{\"labels\": {\"alertname\": \"TestAlertFromAM\"}}]'"
+      )
+      # grep makes wait_until_succeeds retry: ntfy returns 200 with empty body when no messages exist
+      resp = machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}/json?poll=1'"
+        " | grep '\"title\":\"Alertmanager\"'"
+      )
+      msg = json.loads(resp.strip())
+      assert msg["title"] == "Alertmanager", f"Expected title 'Alertmanager', got '{msg['title']}'"
+      assert "warning" in msg["tags"], f"Expected 'warning' in tags, got {msg['tags']}"
+      assert "firing" in msg["tags"], f"Expected 'firing' in tags, got {msg['tags']}"
+
+    with subtest("Grafana alert arrives at ntfy"):
+      machine.succeed(
+        "curl -sf http://127.0.0.1:${toString ports.grafana}/api/alertmanager/grafana/config/api/v1/receivers/test"
+        " -u admin:admin"
+        " -X POST -H 'Content-Type: application/json'"
+        """ -d '{"receivers": [{"name": "grafana-to-ntfy", "grafana_managed_receiver_configs": [{"uid": "cp_webhook", "name": "webhook", "type": "webhook", "disableResolveMessage": false, "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}]}]}'"""
+      )
+      # grep ensures we wait for the Grafana message specifically (see above)
+      resp = machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}/json?poll=1'"
+        " | grep 'FIRING'"
+      )
+      msg = json.loads(resp.strip())
+      assert "[FIRING:1]" in msg["title"], f"Expected Grafana title with '[FIRING:1]', got '{msg['title']}'"
+      assert "warning" in msg["tags"], f"Expected 'warning' in tags, got {msg['tags']}"
+      assert "firing" in msg["tags"], f"Expected 'firing' in tags, got {msg['tags']}"
+  '';
+}

From 0425adbd92bab1b02597f727d1b73631b2f9b54b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Apr 2026 18:03:50 +0000
Subject: [PATCH 04/33] questdb: 9.3.2 -> 9.3.5

---
 pkgs/by-name/qu/questdb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qu/questdb/package.nix b/pkgs/by-name/qu/questdb/package.nix
index e1e2ca5491d0..6ee0f8055619 100644
--- a/pkgs/by-name/qu/questdb/package.nix
+++ b/pkgs/by-name/qu/questdb/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "questdb";
-  version = "9.3.2";
+  version = "9.3.5";
 
   src = fetchurl {
     url = "https://github.com/questdb/questdb/releases/download/${finalAttrs.version}/questdb-${finalAttrs.version}-no-jre-bin.tar.gz";
-    hash = "sha256-64ffNDBbaPoKGOeidCnqXT8NkWIq+UAOrfRkh8sSQp4=";
+    hash = "sha256-TvymN030Q9k9qPbBvrtHcOjT9KILw0tzCle1pdI7Bj8=";
   };
 
   nativeBuildInputs = [

From e32534fb1901caea1ef2c27dbc913eb20b116adc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 24 Apr 2026 11:32:27 +0000
Subject: [PATCH 05/33] halo: 2.23.1 -> 2.24.0

---
 pkgs/by-name/ha/halo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index 38fc1693b4cf..f44341085fd3 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "halo";
-  version = "2.23.1";
+  version = "2.24.0";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${finalAttrs.version}/halo-${finalAttrs.version}.jar";
-    hash = "sha256-oU3MdmHnpf0TOwdEJb8UD2LIqEJ2BQ0puMIs1BBmA2M=";
+    hash = "sha256-71br2gG8vl3EyvC+AYzqJOtgHnhdEmcRAjXSXXXqI5s=";
   };
 
   nativeBuildInputs = [

From b53e4966a10a396578f16ac8e3ec3f7dd7bbfdfe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Apr 2026 23:12:05 +0000
Subject: [PATCH 06/33] pyspread: 2.4 -> 2.4.5

---
 pkgs/by-name/py/pyspread/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix
index b1fb839f95df..ab6706468ad8 100644
--- a/pkgs/by-name/py/pyspread/package.nix
+++ b/pkgs/by-name/py/pyspread/package.nix
@@ -9,12 +9,12 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyspread";
-  version = "2.4";
+  version = "2.4.5";
 
   src = fetchPypi {
     pname = "pyspread";
     inherit (finalAttrs) version;
-    hash = "sha256-MZlR2Rap5oMRfCmswg9W//FYFkSEki7eyMNhLoGZgJM=";
+    hash = "sha256-7Nurn9OmK6LEz5TT543JUYKc/LjpkwfN/7r0ebS1PfY=";
   };
 
   pyproject = true;

From 269e7fc527937ce5173ba4d90ccd289d4f662259 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Apr 2026 23:13:23 +0000
Subject: [PATCH 07/33] mcp-grafana: 0.11.6 -> 0.12.0

---
 pkgs/by-name/mc/mcp-grafana/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 246785e68cf1..db5832f5ed50 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.6";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cJjapd2phI4NgMAPzsKrs74+sEK7ykfKHQx24FVpHoQ=";
+    hash = "sha256-JlTyTUm1gvOKsRu2dGAPWv0IyU2fVjrsO+6wHxMGFDg=";
   };
 
-  vendorHash = "sha256-a9VgfzJmbTudYSLqhBBnkpq37xghtxWTzpcd7rMlZmA=";
+  vendorHash = "sha256-dTCOD6/+o3ZHI2qAb97ZJaMyAg0dqIisrHhUkgXzw7w=";
 
   ldflags = [
     "-s"

From 7da09142deccd24473a93106921b4de580d5269c Mon Sep 17 00:00:00 2001
From: LuckShiba <luckshiba@protonmail.com>
Date: Mon, 27 Apr 2026 00:32:32 -0300
Subject: [PATCH 08/33] dgop: 0.2.0 -> 0.2.2

---
 pkgs/by-name/dg/dgop/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/dg/dgop/package.nix b/pkgs/by-name/dg/dgop/package.nix
index 88531c7831ae..33885162ae67 100644
--- a/pkgs/by-name/dg/dgop/package.nix
+++ b/pkgs/by-name/dg/dgop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dgop";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "AvengeMedia";
     repo = "dgop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CxTvTx7WYKj9usa1uZDUmCqS9+W0QoIeTGDlkhHLVho=";
+    hash = "sha256-kYEFJvJApcgVgFu6QpSoNk2t0hv7AlmBARc5HPe/n+s=";
   };
 
-  vendorHash = "sha256-4GslUKwUCO8oOqylsclJmAZL/ds0plenzcTAwAXKtrc=";
+  vendorHash = "sha256-OxcSnBIDwbPbsXRHDML/Yaxcc5caoKMIDVHLFXaoSsc=";
 
   ldflags = [
     "-w"
@@ -28,8 +28,6 @@ buildGoModule (finalAttrs: {
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
-    mv $out/bin/{cli,dgop}
-
     installShellCompletion --cmd dgop \
       --bash <($out/bin/dgop completion bash) \
       --fish <($out/bin/dgop completion fish) \

From ba513186c3bbf6825f44c23d11657374b926a1c7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 01:18:52 +0000
Subject: [PATCH 09/33] directx-shader-compiler: 1.9.2602 -> 1.10.2605.2

---
 pkgs/by-name/di/directx-shader-compiler/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/di/directx-shader-compiler/package.nix b/pkgs/by-name/di/directx-shader-compiler/package.nix
index 5eff273801cb..3a1b7114816b 100644
--- a/pkgs/by-name/di/directx-shader-compiler/package.nix
+++ b/pkgs/by-name/di/directx-shader-compiler/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "directx-shader-compiler";
-  version = "1.9.2602";
+  version = "1.10.2605.2";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S3ar1LTV/9fYU2B5y8x0ESB20lMnAx8XQw9n3G4z0nk=";
+    hash = "sha256-FzfXxfhAyJw7rouWJEyeVdikG5TBM81yC+9iRg5tK3c=";
     fetchSubmodules = true;
   };
 

From ee24e2013d9e55420900a3e4c1bfa940d054f04f Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Tue, 28 Apr 2026 06:11:18 +0000
Subject: [PATCH 10/33] linux_xanmod: 6.18.24 -> 6.18.25

- Changelog: https://dl.xanmod.org/changelog/6.18/ChangeLog-6.18.25-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/6.18.24-xanmod1..6.18.25-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index f901e7ebc5b5..90d62f700547 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,8 +15,8 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.24";
-      hash = "sha256-BYy5AzTDQIMBJNwWIZ4uGjPKvXGgei7PAOT5gCvlp1Q=";
+      version = "6.18.25";
+      hash = "sha256-MC2hFOGC7WL0mrD4JEeCgRCNBYBYDt63jIP+HCgnTAg=";
       isLTS = true;
     };
     # ./update-xanmod.sh main

From dcb5223722e7635dbcc8d2c4543e8f49be2d3fe5 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Tue, 28 Apr 2026 06:13:31 +0000
Subject: [PATCH 11/33] linux_xanmod_latest: 6.19.14 -> 7.0.2

- Changelog: https://dl.xanmod.org/changelog/7.0/ChangeLog-7.0.2-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/6.19.14-xanmod1..7.0.2-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 90d62f700547..935534ec2e3b 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -21,8 +21,8 @@ let
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.19.14";
-      hash = "sha256-xp5IBA4epb+3SCJIkbxqzymwvz4T9p7NOP9y6iy6DZk=";
+      version = "7.0.2";
+      hash = "sha256-RXdgP6jpy6GfZ70WG6k6rrryjHV2uUaqy4e+4jCgJek=";
     };
   };
 
@@ -58,7 +58,6 @@ let
 
             # Preemption
             PREEMPT = lib.mkOverride 60 yes;
-            PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
 
             # Google's BBRv3 TCP congestion Control
             TCP_CONG_BBR = yes;
@@ -90,6 +89,9 @@ let
             X86_FRED = yes;
             X86_POSTED_MSI = yes;
           }
+          // lib.optionalAttrs (lib.versionOlder (lib.versions.majorMinor version) "7.0") {
+            PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+          }
           // lib.optionalAttrs (lib.versionAtLeast (lib.versions.majorMinor version) "6.13") {
             # Lazy preemption
             PREEMPT = lib.mkOverride 70 no;

From be57faccf28fef1b0e2f4a7cd3a255dc05fb89be Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 22:54:48 +0200
Subject: [PATCH 12/33] xnlinkfinder: 6.0 -> 8.2

Changelog: https://github.com/xnl-h4ck3r/xnLinkFinder/blob/v8.2/CHANGELOG.md
---
 pkgs/by-name/xn/xnlinkfinder/package.nix | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/xn/xnlinkfinder/package.nix b/pkgs/by-name/xn/xnlinkfinder/package.nix
index e2e2bcdc7d45..2ea04ee16a96 100644
--- a/pkgs/by-name/xn/xnlinkfinder/package.nix
+++ b/pkgs/by-name/xn/xnlinkfinder/package.nix
@@ -1,41 +1,43 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   python3,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xnlinkfinder";
-  version = "6.0";
+  version = "8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "xnLinkFinder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UMHMWHLJOhEeR+vO4YE3aNzdsvMAXPpQHQgdFf1QeMY=";
+    hash = "sha256-xym8ruHPAseqmWLUtCPTlpr3REDrpbWor66aNvfASjA=";
   };
 
-  patches = [
-    # Clean-up setup.py
-    (fetchpatch {
-      name = "clean-up.patch";
-      url = "https://github.com/xnl-h4ck3r/xnLinkFinder/commit/8ef5e2ecf4c627b389cb7bb526f10fffe84acc13.patch";
-      hash = "sha256-14j3dFgehhPdqAe4e9FsB8sD66hKnNaPmDJRV1mQTDo=";
-    })
+  pythonRemoveDeps = [
+    # python already provides urllib.parse
+    "urlparse3"
   ];
 
   build-system = with python3.pkgs; [ setuptools ];
 
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
   dependencies = with python3.pkgs; [
     beautifulsoup4
     html5lib
+    inflect
     lxml
+    playwright
     psutil
+    pypdf
     pyyaml
     requests
     termcolor
+    tldextract
     urllib3
   ];
 
@@ -47,7 +49,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Tool to discover endpoints, potential parameters, and a target specific wordlist for a given target";
     homepage = "https://github.com/xnl-h4ck3r/xnLinkFinder";
-    changelog = "https://github.com/xnl-h4ck3r/xnLinkFinder/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/xnl-h4ck3r/xnLinkFinder/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "xnLinkFinder";

From ffcf64c60ef87f80ed3ed4e9e386d102257db2f2 Mon Sep 17 00:00:00 2001
From: ChaosAttractor <lostattractor@gmail.com>
Date: Wed, 29 Apr 2026 05:47:07 +0800
Subject: [PATCH 13/33] lact: 0.8.4 -> 0.9.0

Diff: https://github.com/ilya-zlobintsev/LACT/compare/v0.8.4...v0.9.0
---
 pkgs/by-name/la/lact/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lact/package.nix b/pkgs/by-name/la/lact/package.nix
index cdeb661187f2..83831a62c835 100644
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -9,6 +9,7 @@
   clinfo,
   gdk-pixbuf,
   gtk4,
+  libadwaita,
   libdrm,
   ocl-icd,
   vulkan-loader,
@@ -24,16 +25,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lact";
-  version = "0.8.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ilya-zlobintsev";
     repo = "LACT";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5z4IAiApUjlsSL0EX1PQH6rceeQxAD8f3CKmYO2x8gQ=";
+    hash = "sha256-c5GJf8AYgaAN3O6AVSEbJybEYb6lSHf7R24/1PKYhyM=";
   };
 
-  cargoHash = "sha256-mCmAj9yLei0ZNtsBh+YeVlCmbHyT69LIHFnwbAk+Ido=";
+  cargoHash = "sha256-Y+XdCmaDXdP7x22bYm//Ov7+IzlCr8GpFOgCXGFCfbA=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,6 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = [
     gdk-pixbuf
     gtk4
+    libadwaita
     libdrm
     ocl-icd
     vulkan-loader

From 53c0b4783745319846f928ac1f4f7ba52cb162e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 07:59:13 +0000
Subject: [PATCH 14/33] hysteria: 2.8.1 -> 2.8.2

---
 pkgs/by-name/hy/hysteria/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index 8469069a1a98..36cb48b7f6b8 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "hysteria";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${finalAttrs.version}";
-    hash = "sha256-KxCf9btvEbwP+oWL6A6rWpQsRJPifohFLDIdr+0XwzM=";
+    hash = "sha256-HgZVwaHL5q8aOxHhVt6RaHaBxoj83ujHaqLemQkLRUM=";
   };
 
-  vendorHash = "sha256-NXBxrKptXTZzEXZ5hYHtC3wbFIYgL9avJay6DJHRMLU=";
+  vendorHash = "sha256-oHxnawchsHU/M1PZ0zXR5luopso1FptXi+PL5pNgdj0=";
   proxyVendor = true;
 
   ldflags =

From f0582f18ffaa8afe1f03167c3d1272605a893634 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 08:32:24 +0000
Subject: [PATCH 15/33] python3Packages.llguidance: 1.7.2 -> 1.7.4

---
 pkgs/development/python-modules/llguidance/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/llguidance/default.nix b/pkgs/development/python-modules/llguidance/default.nix
index 8e307699086d..4d0ff0db3ba0 100644
--- a/pkgs/development/python-modules/llguidance/default.nix
+++ b/pkgs/development/python-modules/llguidance/default.nix
@@ -23,19 +23,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llguidance";
-  version = "1.7.2";
+  version = "1.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "guidance-ai";
     repo = "llguidance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eu+hhYCVoZWMdwrjiHyvbGwjYKnbkBETZNMQ+SOb8AU=";
+    hash = "sha256-vEF9+nlYP8LnlROgDU0HPg8H+OmZCQARoE6ngGIw7NM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-oeFm9dPqlJWPnrA7//D31E1W2St+zIRd8pzR6gUhiTg=";
+    hash = "sha256-5dJkC0Iz0IBXxSq5ZeorLta7WEd81ajagSoXt1Zsq7Q=";
   };
 
   nativeBuildInputs = [

From dc66c44c9198335d6dccee82c58687b5b4188e77 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 09:58:09 +0000
Subject: [PATCH 16/33] oxlint: 1.60.0 -> 1.62.0

---
 pkgs/by-name/ox/oxlint/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index 036540e23212..c89a8f2caba1 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -23,25 +23,25 @@
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.60.0";
+  version = "1.62.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-RMADw7oEf407J7/KDmIma0k3JKALMBkLqp9pyE+uRkA=";
+    hash = "sha256-BsfLVHGSyje1GAEaRfe4qmv6lcOiJjTmnd0L8/xIp24=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Xla3mPOkBIfA4BMd+3/lO3mXy4V96DgyT+CzuhTTAd0=";
+    hash = "sha256-9DBME09qjjfypmj09Zuc8NdVTWC5/kAU83YAb+TeCPY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-fomJmm0GXIClng63wql3hCo1Pf4CbVUiEtbvAv9DPIo=";
+    hash = "sha256-rgrwA8xZcEkxoFofHBz+AbGXLLCcihPb3435HAaphHs=";
   };
 
   dontUseCmakeConfigure = true;

From 0297fd45f4baf6b60be329c6db376766556cf760 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 10:38:48 +0000
Subject: [PATCH 17/33] timr-tui: 1.8.0 -> 1.8.1

---
 pkgs/by-name/ti/timr-tui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ti/timr-tui/package.nix b/pkgs/by-name/ti/timr-tui/package.nix
index ecfaee84837a..de7e88f5bee3 100644
--- a/pkgs/by-name/ti/timr-tui/package.nix
+++ b/pkgs/by-name/ti/timr-tui/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "timr-tui";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "sectore";
     repo = "timr-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kxXAH8IUe1LOoS8ch9OL6sS0oeviSN6H7hBJ6ZY+oQw=";
+    hash = "sha256-9HaKBrW0MkNzDErEIINztLyGpN4mkGF5RpmXohgbK6A=";
   };
 
-  cargoHash = "sha256-zNbXxT0Z1TtqitD4P7m8TgEvg8C0AOslrVNKD/Nd9cQ=";
+  cargoHash = "sha256-J6Zi8oEAsbxMQe+oCk9T6Ic1hPdNXI9iFmn4Z0d0lFE=";
 
   # Enable upstream "sound" feature when requested
   buildFeatures = lib.optionals enableSound [ "sound" ];

From 5f515b403bbec6d52ba6409234c72316bb293e32 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 11:35:04 +0000
Subject: [PATCH 18/33] clightning: 26.04 -> 26.04.1

---
 pkgs/by-name/cl/clightning/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cl/clightning/package.nix b/pkgs/by-name/cl/clightning/package.nix
index b99d50a2d6b9..38f6c7d41000 100644
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clightning";
-  version = "26.04";
+  version = "26.04.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${finalAttrs.version}/clightning-v${finalAttrs.version}.zip";
-    hash = "sha256-6dxnhLkXIrfxqXi+UoBKsJw1YFIanOVGBYizJB0X3oU=";
+    hash = "sha256-MEsZ5GPCY6q/SNO+xcktfGiCZUVgl4p7pdMOiqIqFJM=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool

From 4919a520eebfdc0d821152a0ab03b4b8e6b303a7 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Wed, 29 Apr 2026 05:39:27 -0600
Subject: [PATCH 19/33] maintainers: add stealthybox

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 70f027e819dd..06a5837b6e06 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26050,6 +26050,13 @@
     githubId = 26052996;
     name = "Erik Parawell";
   };
+  stealthybox = {
+    email = "leigh@null.net";
+    github = "stealthybox";
+    githubId = 2754700;
+    name = "Leigh Capili";
+    keys = [ { fingerprint = "05E7 89C9 142C DD05 8261  4EF8 5943 2144 444F B382"; } ];
+  };
   steamwalker = {
     email = "steamwalker@xs4all.nl";
     github = "steamwalker";

From 054bcd40ada56e3b53e0b6e378774e6ca00e6334 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Wed, 29 Apr 2026 05:39:31 -0600
Subject: [PATCH 20/33] fluxcd: 2.8.5 -> 2.8.6

Release: https://github.com/fluxcd/flux2/releases/tag/v2.8.6
---
 pkgs/by-name/fl/fluxcd/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 1bcb6d082fd1..96eae97cadb1 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -9,10 +9,10 @@
 }:
 
 let
-  version = "2.8.5";
-  srcHash = "sha256-2Q6l+egcRntGjieXpXz/frGGw4GMhGXxQAUOAZfxBE4=";
-  vendorHash = "sha256-D92vOyTvlpOou/1WHS6xpb4e8igZMQhm4DP7SVSLKPI=";
-  manifestsHash = "sha256-X0Cf8UZufqUWKLxYVjblYNCz5IU/s+mI+h6TpTeks5k=";
+  version = "2.8.6";
+  srcHash = "sha256-pKP4g2pTMYtx/B/Y3ow7tvDdhCSuwbszzeLVXB0W7Bo=";
+  vendorHash = "sha256-VBafft9/AuXaHWvZymy7P9gaSuO8D6IZHfK68Ixp3mI=";
+  manifestsHash = "sha256-h/HR/rJwPWXiuoj9T+LajdsdT4Jo8/EuN+O1I7e9sjI=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
@@ -82,6 +82,7 @@ buildGoModule rec {
       jlesquembre
       ryan4yin
       SchahinRohani
+      stealthybox
       superherointj
     ];
     mainProgram = "flux";

From 1b2d45b6ac68d8943c9b371b4e04a5acd6b2813f Mon Sep 17 00:00:00 2001
From: David McFarland <corngood@gmail.com>
Date: Wed, 29 Apr 2026 09:05:01 -0300
Subject: [PATCH 21/33] nuget-to-json: don't add packages with only contentHash

Fixes: bfc94a6c9e64bffc75e3d936413209c42b3b7923
---
 pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh b/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
index c4c5a8d9456b..111899dac47f 100755
--- a/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
+++ b/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
@@ -61,9 +61,9 @@ done
                 continue
             fi
 
-            # packages in the nix store should have an empty metadata file
+            # packages in the nix store should have a metadata file without 'version' (see createNupkgMetadata)
             # packages installed with 'dotnet tool' may be missing 'source'
-            used_source="$(jq -r 'if has("source") then .source elif has("contentHash") then "__unknown" else "" end' "$version"/.nupkg.metadata)"
+            used_source="$(jq -r 'if has("source") then .source elif has("version") then "__unknown" else "" end' "$version"/.nupkg.metadata)"
             found=false
 
             if [[ -z "$used_source" || -d "$used_source" ]]; then

From 511d90e325a21ddc1a3557a193abaa861aacabcc Mon Sep 17 00:00:00 2001
From: Kiskae <Kiskae@users.noreply.github.com>
Date: Wed, 29 Apr 2026 14:28:25 +0200
Subject: [PATCH 22/33] linuxPackages.nvidia_x11.persistenced: remove
 unnecessary dependencies

---
 .../linux/nvidia-x11/persistenced.nix            | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 96cb8b08e1cc..3ec79049bd14 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -5,9 +5,9 @@ nvidia_x11: sha256:
   lib,
   fetchFromGitHub,
   m4,
-  glibc,
-  libtirpc,
   pkg-config,
+  addDriverRunpath,
+  libtirpc,
 }:
 
 stdenv.mkDerivation {
@@ -21,23 +21,22 @@ stdenv.mkDerivation {
     inherit sha256;
   };
 
-  env = {
-    LIBRARY_PATH = "${glibc}/lib";
+  env = lib.optionalAttrs (lib.versionOlder nvidia_x11.persistencedVersion "450.51") {
     NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+    NIX_LDFLAGS = toString [ "-ltirpc" ];
   };
-  NIX_LDFLAGS = [ "-ltirpc" ];
 
   nativeBuildInputs = [
     m4
     pkg-config
+    addDriverRunpath
   ];
 
   buildInputs = [
     libtirpc
-    stdenv.cc.cc.lib
   ];
 
-  makeFlags = nvidia_x11.passthru.mod.makeFlags ++ [ "DATE=true" ];
+  makeFlags = [ "DATE=true" ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
@@ -47,8 +46,7 @@ stdenv.mkDerivation {
     cp $out/{bin,origBin}/nvidia-persistenced
     patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 $out/origBin/nvidia-persistenced
 
-    patchelf --set-rpath "$(patchelf --print-rpath $out/bin/nvidia-persistenced):${nvidia_x11}/lib" \
-      $out/bin/nvidia-persistenced
+    addDriverRunpath $out/bin/nvidia-persistenced
   '';
 
   meta = {

From 7948f9d8ce611a76f212616ab920f4fdea3e2948 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 29 Apr 2026 12:33:01 +0000
Subject: [PATCH 23/33] python3Packages.pygame-ce: remove dead patch

---
 .../pygame-ce/skip-failing-tests.patch        | 43 -------------------
 1 file changed, 43 deletions(-)
 delete mode 100644 pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch

diff --git a/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch b/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch
deleted file mode 100644
index d85b591ab13a..000000000000
--- a/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/test/draw_test.py b/test/draw_test.py
-index ed99f0ce9..0484ef53d 100644
---- a/test/draw_test.py
-+++ b/test/draw_test.py
-@@ -7496,6 +7496,10 @@ class DrawModuleTest(unittest.TestCase):
-             with self.assertRaises(TypeError):
-                 draw.polygon(surf, col, points, 0)
- 
-+    @unittest.skipIf(
-+        True,
-+        "https://github.com/pygame-community/pygame-ce/pull/3680#issuecomment-3796052119",
-+    )
-     def test_aafunctions_depth_segfault(self):
-         """Ensure future commits don't break the segfault fixed by pull request
-         https://github.com/pygame-community/pygame-ce/pull/3008
-diff --git a/test/surface_test.py b/test/surface_test.py
-index c2c91f4f5..35b9e1aaf 100644
---- a/test/surface_test.py
-+++ b/test/surface_test.py
-@@ -286,6 +286,7 @@ class SurfaceTypeTest(unittest.TestCase):
-         for pt in test_utils.rect_outer_bounds(fill_rect):
-             self.assertNotEqual(s1.get_at(pt), color)
- 
-+    @unittest.skipIf(True, "https://github.com/libsdl-org/sdl2-compat/issues/575")
-     def test_fill_rle(self):
-         """Test RLEACCEL flag with fill()"""
-         color = (250, 25, 25, 255)
-diff --git a/test/window_test.py b/test/window_test.py
-index b8dd1f005..5b7939908 100644
---- a/test/window_test.py
-+++ b/test/window_test.py
-@@ -113,10 +113,7 @@ class WindowTypeTest(unittest.TestCase):
-         self.win.always_on_top = False
-         self.assertFalse(self.win.always_on_top)
- 
--    @unittest.skipIf(
--        SDL < (2, 0, 18),
--        "requires SDL 2.0.18+",
--    )
-+    @unittest.skipIf(True, "https://github.com/pygame-community/pygame-ce/pull/3680")
-     def test_mouse_rect(self):
-         self.win.mouse_rect = None
-         self.assertIsNone(self.win.mouse_rect)

From e2534bd7727f09c1183190708503dd520dae6afe Mon Sep 17 00:00:00 2001
From: kittyandrew <andrew@kittymail.me>
Date: Wed, 29 Apr 2026 15:38:22 +0300
Subject: [PATCH 24/33] nixos/grafana-to-ntfy: apply nixfmt

---
 .../services/monitoring/grafana-to-ntfy.nix   | 37 ++++++++++---------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/nixos/modules/services/monitoring/grafana-to-ntfy.nix b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
index 09512e1a37e0..e4b0bc2d09d9 100644
--- a/nixos/modules/services/monitoring/grafana-to-ntfy.nix
+++ b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
@@ -114,30 +114,33 @@ in
         in
         ''
           ${lib.optionalString (cfg.settings.bauthPass != null) (optionalCred "BAUTH_PASS_FILE" "BAUTH_PASS")}
-          ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) (optionalCred "NTFY_BAUTH_PASS_FILE" "NTFY_BAUTH_PASS")}
+          ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) (
+            optionalCred "NTFY_BAUTH_PASS_FILE" "NTFY_BAUTH_PASS"
+          )}
           exec ${lib.getExe cfg.package}
         '';
 
-      environment =
-        {
-          NTFY_URL = cfg.settings.ntfyUrl;
-          ROCKET_PORT = toString cfg.settings.port;
-          ROCKET_ADDRESS = cfg.settings.address;
-        }
-        // lib.optionalAttrs (cfg.settings.bauthUser != null) {
-          BAUTH_USER = cfg.settings.bauthUser;
-        }
-        // lib.optionalAttrs (cfg.settings.ntfyBAuthUser != null) {
-          NTFY_BAUTH_USER = cfg.settings.ntfyBAuthUser;
-        }
-        // lib.optionalAttrs cfg.settings.markdown {
-          MARKDOWN = "true";
-        };
+      environment = {
+        NTFY_URL = cfg.settings.ntfyUrl;
+        ROCKET_PORT = toString cfg.settings.port;
+        ROCKET_ADDRESS = cfg.settings.address;
+      }
+      // lib.optionalAttrs (cfg.settings.bauthUser != null) {
+        BAUTH_USER = cfg.settings.bauthUser;
+      }
+      // lib.optionalAttrs (cfg.settings.ntfyBAuthUser != null) {
+        NTFY_BAUTH_USER = cfg.settings.ntfyBAuthUser;
+      }
+      // lib.optionalAttrs cfg.settings.markdown {
+        MARKDOWN = "true";
+      };
 
       serviceConfig = {
         LoadCredential =
           lib.optional (cfg.settings.bauthPass != null) "BAUTH_PASS_FILE:${cfg.settings.bauthPass}"
-          ++ lib.optional (cfg.settings.ntfyBAuthPass != null) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
+          ++ lib.optional (
+            cfg.settings.ntfyBAuthPass != null
+          ) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
 
         DynamicUser = true;
 

From eec2e429eaa232fee4e032a1e6ebaf33617255b6 Mon Sep 17 00:00:00 2001
From: kittyandrew <andrew@kittymail.me>
Date: Wed, 29 Apr 2026 15:38:22 +0300
Subject: [PATCH 25/33] grafana-to-ntfy: 2026.3.15 -> 2026.4.29
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security advisory updates only — no code changes since 2026.3.15:

- rustls-webpki: 0.103.10 -> 0.103.13 (GHSA-82j2-j2ch-gfr8: DoS via
  panic on malformed CRL BIT STRING; also fixes name constraint bugs)
- rand: 0.8.5 -> 0.8.6 / 0.9.2 -> 0.9.4 (RUSTSEC-2026-0097)

NixOS test still passes; cargo audit reports 0 vulnerabilities.
---
 pkgs/by-name/gr/grafana-to-ntfy/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/grafana-to-ntfy/package.nix b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
index 95718926ed28..498ef0b25a47 100644
--- a/pkgs/by-name/gr/grafana-to-ntfy/package.nix
+++ b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grafana-to-ntfy";
-  version = "2026.3.15";
+  version = "2026.4.29";
 
   src = fetchFromGitHub {
     owner = "kittyandrew";
     repo = "grafana-to-ntfy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jK/UTgazDlVaIAD0AM61i0dAVX41LCPJFGf1tfMhNk0=";
+    hash = "sha256-ac0T8SNCDH9kQTKIfYn9KinnrSCYIBpNByO6NQ8UntA=";
   };
 
-  cargoHash = "sha256-/e9dDcoablMSLb8q0DPUqNExPny13fm/xBhUT46hkXQ=";
+  cargoHash = "sha256-RuWXlofcruR69sg+RO2v1DBgxaPEyu8TeZEiZP7rBV8=";
 
   # No unit tests; all testing is NixOS VM-based integration tests
   doCheck = false;

From b3408269f841f66e998907a2de45c2d6e083bd53 Mon Sep 17 00:00:00 2001
From: Kiskae <Kiskae@users.noreply.github.com>
Date: Wed, 29 Apr 2026 14:45:23 +0200
Subject: [PATCH 26/33] linuxPackages.nvidia_x11.persistenced: fix
 cross-compilation

---
 pkgs/os-specific/linux/nvidia-x11/persistenced.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 3ec79049bd14..556e53f937af 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -4,6 +4,7 @@ nvidia_x11: sha256:
   stdenv,
   lib,
   fetchFromGitHub,
+  buildPackages,
   m4,
   pkg-config,
   addDriverRunpath,
@@ -26,6 +27,8 @@ stdenv.mkDerivation {
     NIX_LDFLAGS = toString [ "-ltirpc" ];
   };
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   nativeBuildInputs = [
     m4
     pkg-config
@@ -36,7 +39,12 @@ stdenv.mkDerivation {
     libtirpc
   ];
 
-  makeFlags = [ "DATE=true" ];
+  makeFlags = [
+    "DATE=true"
+    "DO_STRIP="
+    "HOST_CC=\$(CC_FOR_BUILD)"
+    "HOST_LD=\$(LD_FOR_BUILD)"
+  ];
 
   installFlags = [ "PREFIX=$(out)" ];
 

From 2b3db51819de5888c973eb1f3d2e2ef572e1068e Mon Sep 17 00:00:00 2001
From: Yuriy Taraday <yuriy@taraday.nl>
Date: Wed, 29 Apr 2026 15:21:32 +0200
Subject: [PATCH 27/33] vimPlugins.vim-solarized8: migrate to codeberg

---
 pkgs/applications/editors/vim/plugins/generated.nix   | 11 +++++------
 .../applications/editors/vim/plugins/vim-plugin-names |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index a4866e35a4ae..e002cff784e5 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -23716,13 +23716,12 @@ final: prev: {
   vim-solarized8 = buildVimPlugin {
     pname = "vim-solarized8";
     version = "1.6.4-unstable-2026-03-11";
-    src = fetchFromGitHub {
-      owner = "lifepillar";
-      repo = "vim-solarized8";
-      rev = "4433b4411de92b2446a4d32f0d8bf1b25c476bf9";
-      hash = "sha256-Og6qmrSIfhtGgait/nwJg+uNrUtY/j83cUWZj2TwUFY=";
+    src = fetchgit {
+      url = "https://codeberg.org/lifepillar/vim-solarized8/";
+      rev = "5dfbfb00be8237619c680302fc9250e391b1686a";
+      hash = "sha256-qJLlHsXKcLC+bpirfcuBj3igK9dDk8L9oVGPzWhtkEI=";
     };
-    meta.homepage = "https://github.com/lifepillar/vim-solarized8/";
+    meta.homepage = "https://codeberg.org/lifepillar/vim-solarized8/";
     meta.license = lib.licenses.unfree;
     meta.hydraPlatforms = [ ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 201409414546..8a9309707e83 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1691,7 +1691,7 @@ https://github.com/bohlender/vim-smt2/,,
 https://github.com/justinmk/vim-sneak/,,
 https://github.com/garbas/vim-snipmate/,,
 https://github.com/honza/vim-snippets/,,
-https://github.com/lifepillar/vim-solarized8/,,
+https://codeberg.org/lifepillar/vim-solarized8/,,
 https://github.com/tomlion/vim-solidity/,,
 https://github.com/christoomey/vim-sort-motion/,,
 https://github.com/tpope/vim-speeddating/,,

From d4151238f29331fb7e8f11aec022244800547054 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Tue, 31 Mar 2026 14:57:07 -0500
Subject: [PATCH 28/33] 
 grub2,grub2_{efi,ieee1275,light,pvgrub_image,xen,xen_pvh}: migrate to
 by-name, fix failing grub2 tests

---
 .../gr/grub2}/add-hidden-menu-entries.patch   |  0
 .../gr/grub2}/fix-bash-completion.patch       |  0
 .../gr/grub2/package.nix}                     |  0
 pkgs/by-name/gr/grub2_efi/package.nix         | 11 ++++++++
 pkgs/by-name/gr/grub2_ieee1275/package.nix    | 11 ++++++++
 pkgs/by-name/gr/grub2_light/package.nix       | 11 ++++++++
 .../by-name/gr/grub2_pvgrub_image/package.nix | 11 ++++++++
 pkgs/by-name/gr/grub2_xen/package.nix         | 11 ++++++++
 pkgs/by-name/gr/grub2_xen_pvh/package.nix     | 11 ++++++++
 pkgs/top-level/all-packages.nix               | 26 -------------------
 10 files changed, 66 insertions(+), 26 deletions(-)
 rename pkgs/{tools/misc/grub => by-name/gr/grub2}/add-hidden-menu-entries.patch (100%)
 rename pkgs/{tools/misc/grub => by-name/gr/grub2}/fix-bash-completion.patch (100%)
 rename pkgs/{tools/misc/grub/default.nix => by-name/gr/grub2/package.nix} (100%)
 create mode 100644 pkgs/by-name/gr/grub2_efi/package.nix
 create mode 100644 pkgs/by-name/gr/grub2_ieee1275/package.nix
 create mode 100644 pkgs/by-name/gr/grub2_light/package.nix
 create mode 100644 pkgs/by-name/gr/grub2_pvgrub_image/package.nix
 create mode 100644 pkgs/by-name/gr/grub2_xen/package.nix
 create mode 100644 pkgs/by-name/gr/grub2_xen_pvh/package.nix

diff --git a/pkgs/tools/misc/grub/add-hidden-menu-entries.patch b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
similarity index 100%
rename from pkgs/tools/misc/grub/add-hidden-menu-entries.patch
rename to pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
diff --git a/pkgs/tools/misc/grub/fix-bash-completion.patch b/pkgs/by-name/gr/grub2/fix-bash-completion.patch
similarity index 100%
rename from pkgs/tools/misc/grub/fix-bash-completion.patch
rename to pkgs/by-name/gr/grub2/fix-bash-completion.patch
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/by-name/gr/grub2/package.nix
similarity index 100%
rename from pkgs/tools/misc/grub/default.nix
rename to pkgs/by-name/gr/grub2/package.nix
diff --git a/pkgs/by-name/gr/grub2_efi/package.nix b/pkgs/by-name/gr/grub2_efi/package.nix
new file mode 100644
index 000000000000..3e0d10fad501
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_efi/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    efiSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_ieee1275/package.nix b/pkgs/by-name/gr/grub2_ieee1275/package.nix
new file mode 100644
index 000000000000..19e5542b76e8
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_ieee1275/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    ieee1275Support = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_light/package.nix b/pkgs/by-name/gr/grub2_light/package.nix
new file mode 100644
index 000000000000..e33c3c4f481c
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_light/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    zfsSupport = false;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
new file mode 100644
index 000000000000..91e6eb469745
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2_pvhgrub_image,
+  ...
+}@args:
+
+grub2_pvhgrub_image.override (
+  {
+    grubPlatform = "xen";
+  }
+  // removeAttrs args [ "grub2_pvhgrub_image" ]
+)
diff --git a/pkgs/by-name/gr/grub2_xen/package.nix b/pkgs/by-name/gr/grub2_xen/package.nix
new file mode 100644
index 000000000000..2e0989d29f79
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_xen/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    xenSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_xen_pvh/package.nix b/pkgs/by-name/gr/grub2_xen_pvh/package.nix
new file mode 100644
index 000000000000..95a60b5acb7f
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_xen_pvh/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    xenPvhSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2780fed25c60..63c3b2417cf0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2471,32 +2471,6 @@ with pkgs;
     withXorg = false;
   };
 
-  grub2 = callPackage ../tools/misc/grub/default.nix { };
-
-  grub2_efi = grub2.override {
-    efiSupport = true;
-  };
-
-  grub2_ieee1275 = grub2.override {
-    ieee1275Support = true;
-  };
-
-  grub2_light = grub2.override {
-    zfsSupport = false;
-  };
-
-  grub2_xen = grub2.override {
-    xenSupport = true;
-  };
-
-  grub2_xen_pvh = grub2.override {
-    xenPvhSupport = true;
-  };
-
-  grub2_pvgrub_image = grub2_pvhgrub_image.override {
-    grubPlatform = "xen";
-  };
-
   gruut = with python3.pkgs; toPythonApplication gruut;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;

From 92f5a5ed9d6b0767541f005687e95a5ad0babb9d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Wed, 29 Apr 2026 16:32:39 +0200
Subject: [PATCH 29/33] perlPackages.TextCSV_XS: 1.52 -> 1.62

---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 586c53211817..d540e4e2f230 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -35965,10 +35965,10 @@ with self;
 
   TextCSV_XS = buildPerlPackage {
     pname = "Text-CSV_XS";
-    version = "1.52";
+    version = "1.62";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/Text-CSV_XS-1.52.tgz";
-      hash = "sha256-5BWqcFut+Es1ncTA8MmC8b9whIHaoUdW8xNufInA5B0=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/Text-CSV_XS-1.62.tgz";
+      hash = "sha256-FxBpPt2u/dVudNpCuqntZ25+rtKOvTA60jyYL+8rFBU=";
     };
     meta = {
       description = "Comma-Separated Values manipulation routines";

From cd79a66fa1eec5b70e6e5105e4aeb57f0d4b9660 Mon Sep 17 00:00:00 2001
From: Chris Moultrie <821688+tebriel@users.noreply.github.com>
Date: Wed, 29 Apr 2026 09:30:33 -0400
Subject: [PATCH 30/33] forgejo: 15.0.0 -> 15.0.1

---
 pkgs/by-name/fo/forgejo/generic.nix | 1 +
 pkgs/by-name/fo/forgejo/package.nix | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo/generic.nix b/pkgs/by-name/fo/forgejo/generic.nix
index 229f3483e3c9..413b070c3143 100644
--- a/pkgs/by-name/fo/forgejo/generic.nix
+++ b/pkgs/by-name/fo/forgejo/generic.nix
@@ -126,6 +126,7 @@ buildGoModule rec {
         "TestDNSUpdate" # requires network: release.forgejo.org
         "TestMigrateWhiteBlocklist" # requires network: gitlab.com (DNS)
         "TestURLAllowedSSH/Pushmirror_URL" # requires network git.gay (DNS)
+        "TestBleveDeleteIssue" # Known Flake-y https://github.com/NixOS/nixpkgs/issues/509878
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index 78da7be18911..45dd978fd3a5 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.0";
-  hash = "sha256-KAGHascGFj4X6b4BpRqQ8yCedNh0nvHfQgbzJh9fxAc=";
-  npmDepsHash = "sha256-AWvLcAS7EEy796kAQfiQ8sFSh/s+6zNCJEqe4qzQL3s=";
-  vendorHash = "sha256-bP7cykWKwNQrWm9jJT4YYAHRV66HaTwGkvhBqSHgWAA=";
+  version = "15.0.1";
+  hash = "sha256-40hyQ6MPskyty/LsMVczuDpbu2q3Syoj3c00HUS+pVE=";
+  npmDepsHash = "sha256-xWbnSX11RkLjtJ62qG6rD+xQAOnUuI99r9uEHakkZPY=";
+  vendorHash = "sha256-JUBAcRYgflrvoAK0OvaU/Xr6/BakgaUtYwtvBF9vyk0=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"

From c70f03c17ad40dbff429558a422a20c9f0148d76 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 16:00:33 +0000
Subject: [PATCH 31/33] chroma: 2.23.1 -> 2.24.0

---
 pkgs/by-name/ch/chroma/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chroma/package.nix b/pkgs/by-name/ch/chroma/package.nix
index 04b828b673ef..dd31926f9880 100644
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chroma";
-  version = "2.23.1";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
     repo = "chroma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Znmcds0ru9VyH/0qE7KnW7l0QeRDoh9PnUPHTYPAA6w=";
+    hash = "sha256-KfojHrRJjGT03WeBobvBO9pHsJP6I7fSxzcSlmCsaxE=";
   };
 
-  vendorHash = "sha256-3mmO5hjjIqVqKiSOrFFQH8OaQTviJVHrznMYsgHP82A=";
+  vendorHash = "sha256-Vq5k4Jz4r5iZs7Yy175Ubj92eSr4v1xCtbLYhfo3OAg=";
 
   modRoot = "./cmd/chroma";
 

From f0125a4c309dfe6911acf50918c59d2e5d8381bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 16:25:54 +0000
Subject: [PATCH 32/33] boulder: 0.20260413.0 -> 0.20260428.0

---
 pkgs/by-name/bo/boulder/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bo/boulder/package.nix b/pkgs/by-name/bo/boulder/package.nix
index 404168f329a6..7a3c851e7876 100644
--- a/pkgs/by-name/bo/boulder/package.nix
+++ b/pkgs/by-name/bo/boulder/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "boulder";
-  version = "0.20260413.0";
+  version = "0.20260428.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-8saRz7g0KsXNr5oR4a2qd4kKDR686J0TIFMzsX/zlV0=";
+    hash = "sha256-ky6geY8pIBhnpwQ4bbzQN0+EQgOfwlo8EQ0rTZdtNIA=";
   };
 
   vendorHash = null;

From e574eeff09dd3cdce5bb3128eaf8edac491fcf3d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 17:20:57 +0000
Subject: [PATCH 33/33] libretro.beetle-pce-fast: 0-unstable-2026-04-17 ->
 0-unstable-2026-04-20

---
 .../emulators/libretro/cores/beetle-pce-fast.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index f478d1532d4c..bf9550bb7c38 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-04-17";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "906b6465f1d4da2d04d8735b0d24ca0af0533590";
-    hash = "sha256-xg+irszrpUu689MyP2iJDl9a/YHR4RRqLJmRdu6/4Nw=";
+    rev = "95b5274dfeda36f7e77c70daa666a63302ad83cf";
+    hash = "sha256-BEt2g63jBOrgWk0tYp8DJVC65AbeSVRQz9rIMwjj2Sg=";
   };
 
   makefile = "Makefile";