Merge 769af1cc90 into haskell-updates

ci/OWNERS

@@ -83,8 +83,9 @@
 # @raitobezarius is not "code owner", but is listed here to be notified of changes
 # pertaining to the Nix package manager.
 # i.e. no authority over those files.
-pkgs/tools/package-management/nix/                    @NixOS/nix-team @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobezarius
+# Otherwise keep in-sync with lib.teams.nix.
+pkgs/tools/package-management/nix/                    @Artturin @Ericson2314 @lovesegfault @Mic92 @philiptaron @roberth @tomberek @xokdvium @raitobezarius
+nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lovesegfault @Mic92 @philiptaron @roberth @tomberek @xokdvium @raitobezarius
 
 # Nixpkgs documentation
 /maintainers/scripts/db-to-md.sh @jtojnar @ryantm

doc/release-notes/rl-2605.section.md

@@ -94,6 +94,8 @@
   - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`.
   - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`.
 
+- `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
+
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
   two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
   retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
@@ -140,6 +142,9 @@
 
 - Added `dell-bios-fan-control` package and service.
 
+- `openrgb` was updated to 1.0rc2, which now uses Plugin API version 4.
+  Some existing OpenRGB plugins may be incompatible or require updates.
+
 - We now use the upstream wrapper script for Gradle, supporting both the `JAVA_HOME` and `GRADLE_OPTS` environment variables.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}

maintainers/github-teams.json

@@ -171,6 +171,7 @@
     },
     "members": {
       "reckenrode": 7413633,
+      "Samasaur1": 30577766,
       "toonn": 1486805
     },
     "name": "darwin-core"

maintainers/maintainer-list.nix

@@ -2325,6 +2325,12 @@
     githubId = 29058;
     name = "Mikalai Seva";
   };
+  asamonik = {
+    email = "signup-nixpkgs@asamonik.at";
+    github = "asamonik";
+    githubId = 49288593;
+    name = "Andreas Samonik";
+  };
   asappia = {
     email = "asappia@gmail.com";
     github = "asappia";
@@ -5349,6 +5355,11 @@
     name = "Connor Baker";
     githubId = 3880346;
   };
+  connornelson = {
+    github = "ConnorNelson";
+    githubId = 5953003;
+    name = "Connor Nelson";
+  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -7533,12 +7544,6 @@
     githubId = 8173116;
     name = "Dean Eckert";
   };
-  eelco = {
-    email = "edolstra+nixpkgs@gmail.com";
-    github = "edolstra";
-    githubId = 1148549;
-    name = "Eelco Dolstra";
-  };
   ehegnes = {
     email = "eric.hegnes@gmail.com";
     github = "ehegnes";
@@ -18234,7 +18239,7 @@
   nadiaholmquist = {
     name = "Nadia Holmquist Pedersen";
     email = "nadia@nhp.sh";
-    matrix = "@nhp:matrix.org";
+    matrix = "@nadia:nhp.sh";
     github = "nadiaholmquist";
     githubId = 893884;
   };
@@ -18323,10 +18328,13 @@
   };
   nanoyaki = {
     name = "Hana Kretzer";
-    email = "hanakretzer@gmail.com";
+    email = "hanakretzer@nanoyaki.space";
     github = "nanoyaki";
     githubId = 144328493;
-    keys = [ { fingerprint = "D89F 440C 6CD7 4753 090F  EC7A 4682 C5CB 4D9D EA3C"; } ];
+    keys = [
+      { fingerprint = "D89F 440C 6CD7 4753 090F  EC7A 4682 C5CB 4D9D EA3C"; }
+      { fingerprint = "5A1D C7CE 51DC 0A85 6DEA  41F7 31A8 CE0D 2E7D 30C3"; }
+    ];
   };
   naora = {
     name = "Joris Gundermann";
@@ -29009,7 +29017,7 @@
     githubId = 102890144;
   };
   yiyu = {
-    email = "yiyuzhou19@gmail.com";
+    email = "yiyu@yiyuzhou.io";
     name = "Yiyu Zhou";
     github = "yzhou216";
     githubId = 50000936;

maintainers/scripts/luarocks-packages.csv

@@ -25,7 +25,7 @@ fluent,,,,,,alerque
 funnyfiles.nvim,,,,,,mrcjkb
 fzf-lua,,,,,,mrcjkb
 fzy,,,,,,mrcjkb
-gitsigns.nvim,https://raw.githubusercontent.com/lewis6991/gitsigns.nvim/main/gitsigns.nvim-scm-1.rockspec,,,,5.1,
+gitsigns.nvim,,,,,5.1,
 grug-far.nvim,,,,,,teto
 haskell-tools.nvim,,,,,,mrcjkb
 http,,,,0.4-0,,vcunat

maintainers/scripts/nix-generate-from-cpan.nix

@@ -29,7 +29,6 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    maintainers = with lib.maintainers; [ eelco ];
     description = "Utility to generate a Nix expression for a Perl package from CPAN";
     mainProgram = "nix-generate-from-cpan";
     platforms = lib.platforms.unix;

maintainers/scripts/nixpkgs-lint.nix

@@ -29,7 +29,6 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    maintainers = [ lib.maintainers.eelco ];
     description = "A utility for Nixpkgs contributors to check Nixpkgs for common errors";
     mainProgram = "nixpkgs-lint";
     platforms = lib.platforms.unix;

maintainers/team-list.nix

@@ -154,16 +154,6 @@ with lib.maintainers;
     shortName = "c3d2";
   };
 
-  cachix = {
-    # Verify additions to this team with at least one existing member of the team.
-    members = [
-      domenkozar
-      sandydoo
-    ];
-    scope = "Group registration for packages maintained by Cachix.";
-    shortName = "Cachix employees";
-  };
-
   categorization = {
     github = "categorization";
   };
@@ -742,17 +732,20 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  # same as https://github.com/orgs/NixOS/teams/nix-team
+  # keep in-sync with ci/OWNERS
   nix = {
     members = [
-      eelco
-      mic92
-      tomberek
-      roberth
+      artturin
       ericson2314
+      lovesegfault
+      mic92
+      philiptaron
+      roberth
+      tomberek
+      xokdvium
     ];
-    scope = "Maintain the Nix package manager.";
-    shortName = "Nix/nix-cli ecosystem";
+    scope = "Maintain the packaging for the Nix package manager itself.";
+    shortName = "Nix packaging";
     enableFeatureFreezePing = true;
   };
 
@@ -892,22 +885,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  secshell = {
-    members = [
-      felbinger
-      juli0604
-    ];
-    scope = "Maintain packages and modules created by members of Secure Shell Networks.";
-    shortName = "secshell";
-  };
-
-  serokell = {
-    # Verify additions by approval of an already existing member of the team.
-    members = [ balsoft ];
-    scope = "Group registration for Serokell employees who collectively maintain packages.";
-    shortName = "Serokell employees";
-  };
-
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";
@@ -923,15 +900,6 @@ with lib.maintainers;
     shortName = "Steam";
   };
 
-  stridtech = {
-    # Verify additions by approval of an already existing member of the team
-    members = [
-      ulrikstrid
-    ];
-    scope = "Group registration for Strid Tech AB team members who collectively maintain packages";
-    shortName = "StridTech";
-  };
-
   swift = {
     members = [
       dduan
@@ -961,17 +929,6 @@ with lib.maintainers;
     shortName = "coqui-ai TTS";
   };
 
-  uzinfocom = {
-    members = [
-      orzklv
-      bahrom04
-      bemeritus
-      shakhzodkudratov
-    ];
-    scope = "Maintain Uzbek Linux state & community packages and modules.";
-    shortName = "Uzinfocom Open Source";
-  };
-
   wdz = {
     members = [
       n0emis

modules/generic/meta-maintainers/test.nix

@@ -6,6 +6,13 @@
 #
 # Debugging:
 #   drop .test from the end of this file, then use nix repl on it
+let
+  ghost = {
+    github = "ghost";
+    githubId = 0;
+    name = "ghost";
+  };
+in
 rec {
   lib = import ../../../lib;
 
@@ -13,8 +20,8 @@ rec {
     modules = [
       ../meta-maintainers.nix
       {
-        _file = "eelco.nix";
-        meta.maintainers = [ lib.maintainers.eelco ];
+        _file = "ghost.nix";
+        meta.maintainers = [ ghost ];
       }
     ];
   };
@@ -26,7 +33,7 @@ rec {
           lib.maintainers.pierron
           lib.maintainers.roberth
         ];
-        "eelco.nix" = [ lib.maintainers.eelco ];
+        "ghost.nix" = [ ghost ];
       };
     { };
 

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -11,7 +11,6 @@ let
     mkOption
     optionalString
     types
-    versionAtLeast
     ;
   inherit (lib.options) literalExpression;
   cfg = config.amazonImage;
@@ -46,16 +45,6 @@ in
     })
   ];
 
-  # Amazon recommends setting this to the highest possible value for a good EBS
-  # experience, which prior to 4.15 was 255.
-  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
-  config.boot.kernelParams =
-    let
-      timeout =
-        if versionAtLeast config.boot.kernelPackages.kernel.version "4.15" then "4294967295" else "255";
-    in
-    [ "nvme_core.io_timeout=${timeout}" ];
-
   options.amazonImage = {
     contents = mkOption {
       example = literalExpression ''

nixos/modules/hardware/tuxedo-drivers.nix

@@ -1,7 +1,25 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.hardware.tuxedo-drivers;
   tuxedo-drivers = config.boot.kernelPackages.tuxedo-drivers;
+  udevRule =
+    attr: val:
+    let
+      # Workaround to evaluate true to "1" and false to "0".
+      # Otherwise, true evaluates to "1" and false to "".
+      newVal = if lib.isBool val then (if val then "1" else "0") else val;
+    in
+    lib.concatStringsSep ", " [
+      ''SUBSYSTEM=="platform"''
+      ''DRIVER=="tuxedo_keyboard"''
+      ''ATTR{${attr}}="${newVal}"''
+    ];
+  optUdevRule = attr: val: lib.optional (val != null) (udevRule attr val);
 in
 {
   imports = [
@@ -26,11 +44,66 @@ in
 
       For more inforation it is best to check at the source code description: <https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers>
     '';
+    settings = {
+      charging-profile = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "high_capacity"
+            "balanced"
+            "stationary"
+          ]
+        );
+        default = null;
+        description = ''
+          The maximum charge level to help reduce battery wear:
+          - `high_capacity` charges to 100% (driver default)
+          - `balanced` charges to 90%
+          - `stationary` charges to 80% (maximum lifespan)
+
+          **Note:** Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.
+        '';
+      };
+      charging-priority = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "charge_battery"
+            "performance"
+          ]
+        );
+        default = null;
+        description = ''
+          These options manage the trade-off between battery charging and CPU performance when the USB-C power supply cannot provide sufficient power for both simultaneously:
+          - `charge_battery` prioritizes battery charging (driver default)
+          - `performance` prioritizes maximum CPU performance
+        '';
+      };
+      fn-lock = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Enables or disables the laptop keyboard's Function (Fn) lock at boot.
+
+          When set to `true`, the Fn lock is enabled, allowing the function keys (F1–F12) to control brightness, volume etc.
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
     boot.kernelModules = [ "tuxedo_keyboard" ];
     boot.extraModulePackages = [ tuxedo-drivers ];
-    services.udev.packages = [ tuxedo-drivers ];
+    services.udev.packages = [
+      tuxedo-drivers
+      lib.mkIf
+      (lib.any (v: v != null) cfg.settings)
+      (pkgs.writeTextDir "etc/udev/rules.d/90-tuxedo.rules" (
+        lib.concatLines (
+          [ "# Custom rules for TUXEDO laptops" ]
+          ++ (optUdevRule "charging_profile/charging_profile" cfg.settings.charging-profile)
+          ++ (optUdevRule "charging_priority/charging_prio" cfg.settings.charging-priority)
+          ++ (optUdevRule "fn_lock" cfg.settings.fn-lock)
+        )
+      ))
+    ];
   };
 }

nixos/modules/security/pam.nix

@@ -583,6 +583,13 @@ let
           '';
         };
 
+        enableUMask = lib.mkOption {
+          default = config.security.pam.enableUMask;
+          defaultText = lib.literalExpression "config.security.pam.enableUMask";
+          type = lib.types.bool;
+          description = "If enabled, the pam_umask module will be loaded.";
+        };
+
         failDelay = {
           enable = lib.mkOption {
             type = lib.types.bool;
@@ -1292,6 +1299,12 @@ let
                   disable = cfg.ttyAudit.disablePattern;
                 };
               }
+              {
+                name = "umask";
+                enable = cfg.enableUMask;
+                control = "optional";
+                modulePath = "${package}/lib/security/pam_umask.so";
+              }
               {
                 name = "systemd_home";
                 enable = config.services.homed.enable;
@@ -2208,6 +2221,8 @@ in
       };
     };
 
+    security.pam.enableUMask = lib.mkEnableOption "umask PAM module";
+
     security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
     security.pam.enableFscrypt = lib.mkEnableOption ''
       fscrypt, to automatically unlock directories with the user's login password.

nixos/modules/services/hardware/openrgb.nix

@@ -59,16 +59,28 @@ in
     ++ lib.optionals (cfg.motherboard == "intel") [ "i2c-i801" ];
 
     systemd.services.openrgb = {
-      description = "OpenRGB server daemon";
-      after = [ "network.target" ];
+      description = "OpenRGB SDK Server";
+      after = [
+        "network.target"
+        "lm_sensors.service"
+      ];
       wants = [ "dev-usb.device" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         StateDirectory = "OpenRGB";
         WorkingDirectory = "/var/lib/OpenRGB";
-        ExecStart =
-          "${cfg.package}/bin/openrgb --server --server-port ${toString cfg.server.port}"
-          + lib.optionalString (builtins.isString cfg.startupProfile) " --profile ${lib.escapeShellArg cfg.startupProfile}";
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "--server"
+            "--server-port"
+            cfg.server.port
+          ]
+          ++ lib.optionals (lib.isString cfg.startupProfile) [
+            "--profile"
+            cfg.startupProfile
+          ]
+        );
         Restart = "always";
       };
     };

nixos/modules/services/misc/shoko.nix

@@ -16,6 +16,13 @@ let
     ;
 
   cfg = config.services.shoko;
+
+  shokoPlugins = pkgs.linkFarm "shoko-plugins" (
+    map (pkg: {
+      inherit (pkg) name;
+      path = "${pkg}/lib/${pkg.pname}";
+    }) cfg.plugins
+  );
 in
 {
   options = {
@@ -67,7 +74,7 @@ in
         ''
         + optionalString (cfg.plugins != [ ]) ''
           rm -rf "$STATE_DIRECTORY/plugins"
-          ln -s '${pkgs.linkFarmFromDrvs cfg.plugins}' "$STATE_DIRECTORY/plugins"
+          ln -s '${shokoPlugins}' "$STATE_DIRECTORY/plugins"
         '';
 
       serviceConfig = {

nixos/modules/services/networking/suricata/default.nix

@@ -22,7 +22,7 @@ let
     ;
 in
 {
-  meta.maintainers = lib.teams.secshell.members;
+  meta.maintainers = with lib.maintainers; [ felbinger ];
 
   options.services.suricata = {
     enable = mkEnableOption "Suricata";

nixos/modules/services/security/e-imzo.nix

@@ -46,5 +46,10 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.uzinfocom.members;
+  meta.maintainers = with lib.maintainers; [
+    orzklv
+    shakhzodkudratov
+    bahrom04
+    bemeritus
+  ];
 }

nixos/modules/services/security/kanidm.nix

@@ -29,6 +29,7 @@ let
     mkIf
     mkMerge
     mkOption
+    mkOrder
     mkPackageOption
     optional
     optionals
@@ -368,7 +369,7 @@ in
         freeformType = settingsFormat.type;
 
         options = {
-          pam_allowed_login_groups = mkOption {
+          kanidm.pam_allowed_login_groups = mkOption {
             description = "Kanidm groups that are allowed to login using PAM.";
             example = "my_pam_group";
             type = types.listOf types.str;
@@ -673,6 +674,10 @@ in
 
   config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
     warnings = lib.optionals (cfg.package.eolMessage != "") [ cfg.package.eolMessage ];
+    services.kanidm = {
+      unixSettings.version = "2";
+      serverSettings.version = "2";
+    };
 
     assertions =
       let
@@ -710,6 +715,14 @@ in
           };
       in
       [
+        {
+          assertion = cfg.enablePam -> !(cfg.unixSettings ? pam_allowed_login_groups);
+          message = ''
+            <option>services.kanidm.unixSettings.pam_allowed_login_groups</option> has been renamed
+            to <option>services.kanidm.unixSettings.kanidm.pam_allowed_login_groups</option>.
+            Please change your usage.
+          '';
+        }
         {
           assertion =
             !cfg.enableServer
@@ -1040,8 +1053,9 @@ in
 
     system.nssModules = mkIf cfg.enablePam [ cfg.package ];
 
-    system.nssDatabases.group = optional cfg.enablePam "kanidm";
-    system.nssDatabases.passwd = optional cfg.enablePam "kanidm";
+    # Needs to be before "files" which is `mkBefore`
+    system.nssDatabases.group = mkOrder 490 (optional cfg.enablePam "kanidm");
+    system.nssDatabases.passwd = mkOrder 490 (optional cfg.enablePam "kanidm");
 
     users.groups = mkMerge [
       (mkIf cfg.enableServer { kanidm = { }; })

nixos/modules/services/security/pocket-id.nix

@@ -19,6 +19,7 @@ let
     optionalAttrs
     ;
   inherit (lib.types)
+    attrsOf
     bool
     path
     str
@@ -29,6 +30,10 @@ let
 
   format = pkgs.formats.keyValue { };
   settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
+
+  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
+  getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
 {
   meta.maintainers = with maintainers; [
@@ -44,17 +49,36 @@ in
     environmentFile = mkOption {
       type = path;
       description = ''
-        Path to an environment file loaded for the Pocket ID service.
-
+        Path to an environment file to be loaded.
         This can be used to securely store tokens and secrets outside of the world-readable Nix store.
 
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+
         Example contents of the file:
         MAXMIND_LICENSE_KEY=your-license-key
+
+        Alternatively you can use `services.pocket-id.credentials` to define each variable in separate files.
       '';
       default = "/dev/null";
       example = "/var/lib/secrets/pocket-id";
     };
 
+    credentials = mkOption {
+      type = attrsOf path;
+      default = { };
+      example = {
+        ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key";
+      };
+      description = ''
+        Environment variables which are loaded from the contents of the specified file paths.
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+
+        Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file.
+      '';
+    };
+
     settings = mkOption {
       type = submodule {
         freeformType = format.type;
@@ -81,7 +105,7 @@ in
             description = ''
               Whether to disable analytics.
 
-              See [docs page](https://pocket-id.org/docs/configuration/analytics/).
+              See the [analytics documentation](https://pocket-id.org/docs/configuration/analytics/).
             '';
             default = false;
           };
@@ -91,9 +115,9 @@ in
       default = { };
 
       description = ''
-        Environment variables that will be passed to Pocket ID, see
-        [configuration options](https://pocket-id.org/docs/configuration/environment-variables)
-        for supported values.
+        Environment variables to be passed.
+
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
       '';
     };
 
@@ -101,7 +125,7 @@ in
       type = path;
       default = "/var/lib/pocket-id";
       description = ''
-        The directory where Pocket ID will store its data, such as the database.
+        The directory where Pocket ID will store its data, such as the database when using SQLite.
       '';
     };
 
@@ -119,29 +143,60 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = (
+      map
+        (
+          # Converted to assert 2026-01-08
+          setting: {
+            assertion = !(cfg.settings ? "${setting}");
+            message = ''
+              `services.pocket-id.settings.${setting}` is deprecated.
+              See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1).
+            '';
+          })
+        [
+          "PUBLIC_APP_URL"
+          "PUBLIC_UI_CONFIG_DISABLED"
+          "CADDY_DISABLED"
+          "CADDY_PORT"
+          "BACKEND_PORT"
+          "POSTGRES_CONNECTION_STRING"
+          "SQLITE_DB_PATH"
+          "INTERNAL_BACKEND_URL"
+        ]
+    );
+
     warnings =
-      optional (cfg.settings ? MAXMIND_LICENSE_KEY)
-        "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead."
-      ++
-        concatMap
-          (
-            # Added 2025-05-27
-            setting:
-            optional (cfg.settings ? "${setting}") ''
-              config.services.pocket-id.settings.${setting} is deprecated.
-              See https://pocket-id.org/docs/setup/migrate-to-v1/ for migration instructions.
-            ''
-          )
-          [
-            "PUBLIC_APP_URL"
-            "PUBLIC_UI_CONFIG_DISABLED"
-            "CADDY_DISABLED"
-            "CADDY_PORT"
-            "BACKEND_PORT"
-            "POSTGRES_CONNECTION_STRING"
-            "SQLITE_DB_PATH"
-            "INTERNAL_BACKEND_URL"
-          ];
+      (concatMap
+        (
+          setting:
+          optional (cfg.settings ? "${setting}") ''
+            `services.pocket-id.settings.${setting}` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.${setting}` or `services.pocket-id.environmentFile` instead.
+          ''
+        )
+        [
+          "ENCRYPTION_KEY"
+          "MAXMIND_LICENSE_KEY"
+          "SMTP_PASSWORD"
+          "LDAP_BIND_PASSWORD"
+        ]
+      )
+      ++ (concatMap
+        (
+          # Added 2026-01-08
+          setting:
+          optional (cfg.settings ? "${setting}") ''
+            `services.pocket-id.settings.${setting}` is deprecated.
+            See [v2 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
+          ''
+        )
+        [
+          "DB_PROVIDER"
+          "KEYS_PATH"
+          "KEYS_STORAGE"
+          "LDAP_ATTRIBUTE_ADMIN_GROUP"
+        ]
+      );
 
     systemd.tmpfiles.rules = [
       "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}"
@@ -163,12 +218,16 @@ in
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.dataDir;
-          ExecStart = getExe cfg.package;
+          ExecStart = pkgs.writeShellScript "pocket-id-start" ''
+            ${exportAllCredentials cfg.credentials}
+            ${getExe cfg.package}
+          '';
           Restart = "always";
           EnvironmentFile = [
             cfg.environmentFile
             settingsFile
           ];
+          LoadCredential = getLoadCredentialList;
 
           # Hardening
           AmbientCapabilities = "";

nixos/modules/services/system/cachix-agent/default.nix

@@ -8,7 +8,10 @@ let
   cfg = config.services.cachix-agent;
 in
 {
-  meta.maintainers = lib.teams.cachix.members;
+  meta.maintainers = with lib.maintainers; [
+    domenkozar
+    sandydoo
+  ];
 
   options.services.cachix-agent = {
     enable = lib.mkEnableOption "Cachix Deploy Agent: <https://docs.cachix.org/deploy/>";

nixos/modules/services/system/cachix-watch-store.nix

@@ -9,7 +9,11 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.cachix.members ++ [ lib.maintainers.jfroche ];
+    maintainers = with lib.maintainers; [
+      domenkozar
+      jfroche
+      sandydoo
+    ];
   };
 
   options.services.cachix-watch-store = {

nixos/modules/services/web-apps/discourse.nix

@@ -846,7 +846,6 @@ in
         RuntimeDirectory = map (p: "discourse/" + p) [
           "config"
           "home"
-          "assets/javascripts/plugins"
           "public"
           "sockets"
           "assets-generated"

nixos/modules/services/web-apps/part-db.nix

@@ -17,7 +17,7 @@ let
     ;
 in
 {
-  meta.maintainers = lib.teams.secshell.members;
+  meta.maintainers = with lib.maintainers; [ felbinger ];
 
   options.services.part-db = {
     enable = mkEnableOption "PartDB";

nixos/modules/virtualisation/amazon-image.nix

@@ -59,10 +59,19 @@ in
     ];
     boot.initrd.kernelModules = [ "xen-blkfront" ];
     boot.initrd.availableKernelModules = [ "nvme" ];
-    boot.kernelParams = [
-      "console=ttyS0,115200n8"
-      "random.trust_cpu=on"
-    ];
+    boot.kernelParams =
+      let
+        # Amazon recommends setting this to the highest possible value for a good EBS
+        # experience, which prior to 4.15 was 255.
+        # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
+        nvmeTimeout =
+          if lib.versionAtLeast config.boot.kernelPackages.kernel.version "4.15" then "4294967295" else "255";
+      in
+      [
+        "console=ttyS0,115200n8"
+        "random.trust_cpu=on"
+        "nvme_core.io_timeout=${nvmeTimeout}"
+      ];
 
     # Prevent the nouveau kernel module from being loaded, as it
     # interferes with the nvidia/nvidia-uvm modules needed for CUDA.

nixos/tests/kanidm.nix

@@ -66,7 +66,7 @@ in
         };
         enablePam = true;
         unixSettings = {
-          pam_allowed_login_groups = [ "shell" ];
+          kanidm.pam_allowed_login_groups = [ "shell" ];
         };
       };
 

nixos/tests/misc.nix

@@ -6,7 +6,6 @@ let
 in
 {
   name = "misc";
-  meta.maintainers = with lib.maintainers; [ eelco ];
 
   nodes.machine =
     { lib, ... }:

nixos/tests/oci-containers.nix

@@ -16,7 +16,7 @@ let
     makeTest {
       name = "oci-containers-${backend}";
 
-      meta.maintainers = lib.teams.serokell.members ++ (with lib.maintainers; [ benley ]);
+      meta.maintainers = with lib.maintainers; [ benley ];
 
       nodes = {
         ${backend} =

nixos/tests/pocket-id.nix

@@ -1,5 +1,9 @@
-{ lib, ... }:
+{ pkgs, lib, ... }:
 
+let
+  # !!! Don't do this with real keys. The /nix store is world-readable!
+  ENCRYPTION_KEY = pkgs.writeText "pocket-id-encryption-key" "SUeAyRRFZ1uf03ClOE+o++BVENSE/Ptb9YFRF2Sk+zM=";
+in
 {
   name = "pocket-id";
   meta.maintainers = with lib.maintainers; [
@@ -16,6 +20,9 @@
           settings = {
             PORT = 10001;
           };
+          credentials = {
+            inherit ENCRYPTION_KEY;
+          };
         };
       };
 
@@ -29,9 +36,11 @@
           enable = true;
           settings = {
             PORT = 10001;
-            DB_PROVIDER = "postgres";
             DB_CONNECTION_STRING = "host=/run/postgresql user=${username} database=${username}";
           };
+          credentials = {
+            inherit ENCRYPTION_KEY;
+          };
         };
 
         services.postgresql = {

nixos/tests/rancher/airgap-images.nix

@@ -1,40 +0,0 @@
-# A test that imports k3s airgapped images and verifies that all expected images are present
-{
-  pkgs,
-  lib,
-  rancherDistro,
-  rancherPackage,
-  serviceName,
-  disabledComponents,
-  coreImages,
-  vmResources,
-  ...
-}:
-{
-  name = "${rancherPackage.name}-airgap-images";
-
-  nodes.machine = _: {
-    virtualisation = vmResources;
-
-    services.${rancherDistro} = {
-      enable = true;
-      role = "server";
-      package = rancherPackage;
-      disable = disabledComponents;
-      images =
-        coreImages
-        ++ {
-          k3s = [ rancherPackage.airgap-images ];
-          rke2 = [ ]; # RKE2 already includes its airgap-images in coreImages
-        }
-        .${rancherDistro};
-    };
-  };
-
-  testScript = ''
-    machine.wait_for_unit("${serviceName}")
-    machine.wait_until_succeeds("journalctl -r --no-pager -u ${serviceName} | grep \"Imported images from /var/lib/rancher/${rancherDistro}/agent/images/\"")
-  '';
-
-  meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;
-}

nixos/tests/rancher/auto-deploy-charts.nix

@@ -1,230 +0,0 @@
-# Tests whether container images are imported and auto deploying Helm charts,
-# including the bundled traefik or ingress-nginx, work
-{
-  pkgs,
-  lib,
-  rancherDistro,
-  rancherPackage,
-  serviceName,
-  disabledComponents,
-  coreImages,
-  vmResources,
-  ...
-}:
-let
-  testImageEnv = pkgs.buildEnv {
-    name = "${rancherDistro}-pause-image-env";
-    paths = with pkgs; [
-      busybox
-      hello
-    ];
-  };
-  testImage = pkgs.dockerTools.buildImage {
-    name = "test.local/test";
-    tag = "local";
-    # Slightly reduces the time needed to import image
-    compressor = "zstd";
-    copyToRoot = testImageEnv;
-  };
-  # pack the test helm chart as a .tgz archive
-  package =
-    pkgs.runCommand "${rancherDistro}-test-chart.tgz"
-      {
-        nativeBuildInputs = [ pkgs.kubernetes-helm ];
-        chart = builtins.toJSON {
-          name = "${rancherDistro}-test-chart";
-          version = "0.1.0";
-        };
-        values = builtins.toJSON {
-          restartPolicy = "Never";
-          runCommand = "";
-          image = {
-            repository = "foo";
-            tag = "1.0.0";
-          };
-        };
-        job = builtins.toJSON {
-          apiVersion = "batch/v1";
-          kind = "Job";
-          metadata = {
-            name = "{{ .Release.Name }}";
-            namespace = "{{ .Release.Namespace }}";
-          };
-          spec = {
-            template = {
-              spec = {
-                containers = [
-                  {
-                    name = "test";
-                    image = "{{ .Values.image.repository }}:{{ .Values.image.tag }}";
-                    command = [ "sh" ];
-                    args = [
-                      "-c"
-                      "{{ .Values.runCommand }}"
-                    ];
-                  }
-                ];
-                restartPolicy = "{{ .Values.restartPolicy }}";
-              };
-            };
-          };
-        };
-        passAsFile = [
-          "values"
-          "chart"
-          "job"
-        ];
-      }
-      ''
-        mkdir -p chart/templates
-        cp "$chartPath" chart/Chart.yaml
-        cp "$valuesPath" chart/values.yaml
-        cp "$jobPath" chart/templates/job.json
-
-        helm package chart
-        mv ./*.tgz $out
-      '';
-  # The common Helm chart that is used in this test
-  testChart = {
-    inherit package;
-    values = {
-      runCommand = "hello";
-      image = {
-        repository = testImage.imageName;
-        tag = testImage.imageTag;
-      };
-    };
-  };
-in
-{
-  name = "${rancherPackage.name}-auto-deploy-helm";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        kubectl
-        yq-go
-      ];
-      environment.sessionVariables.KUBECONFIG = "/etc/rancher/${rancherDistro}/${rancherDistro}.yaml";
-
-      virtualisation = vmResources;
-
-      services.${rancherDistro} = {
-        enable = true;
-        package = rancherPackage;
-        disable =
-          {
-            k3s = lib.remove "traefik" disabledComponents;
-            rke2 = lib.remove "rke2-ingress-nginx" disabledComponents;
-          }
-          .${rancherDistro};
-        images =
-          coreImages
-          # Provides the k3s Helm controller
-          ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images
-          ++ [
-            testImage
-          ];
-        autoDeployCharts = {
-          # regular test chart that should get installed
-          hello = testChart;
-          # disabled chart that should not get installed
-          disabled = testChart // {
-            enable = false;
-          };
-          # chart with values set via YAML file
-          values-file = testChart // {
-            # Remove unsafeDiscardStringContext workaround when Nix can convert a string to a path
-            # https://github.com/NixOS/nix/issues/12407
-            values =
-              /.
-              + builtins.unsafeDiscardStringContext (
-                builtins.toFile "${rancherDistro}-test-chart-values.yaml" ''
-                  runCommand: "echo 'Hello, file!'"
-                  image:
-                    repository: test.local/test
-                    tag: local
-                ''
-              );
-          };
-          # advanced chart that should get installed in the "test" namespace with a custom
-          # timeout and overridden values
-          advanced = testChart // {
-            # create the "test" namespace via extraDeploy for testing
-            extraDeploy = [
-              {
-                apiVersion = "v1";
-                kind = "Namespace";
-                metadata.name = "test";
-              }
-            ];
-            extraFieldDefinitions = {
-              spec = {
-                # overwrite chart values
-                valuesContent = ''
-                  runCommand: "echo 'advanced hello'"
-                  image:
-                    repository: ${testImage.imageName}
-                    tag: ${testImage.imageTag}
-                '';
-                # overwrite the chart namespace
-                targetNamespace = "test";
-                # set a custom timeout
-                timeout = "69s";
-              };
-            };
-          };
-        };
-      };
-    };
-
-  testScript = # python
-    let
-      manifestFormat =
-        {
-          k3s = "yaml";
-          rke2 = "json";
-        }
-        .${rancherDistro};
-    in
-    ''
-      import json
-
-      machine.wait_for_unit("${serviceName}")
-      # check existence/absence of chart manifest files
-      machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/hello.${manifestFormat}")
-      machine.succeed("test ! -e /var/lib/rancher/${rancherDistro}/server/manifests/disabled.${manifestFormat}")
-      machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/values-file.${manifestFormat}")
-      machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/advanced.${manifestFormat}")
-      # check that the timeout is set correctly, select only the first item in advanced.yaml
-      advancedManifest = json.loads(machine.succeed("yq -o json '.items[0]' /var/lib/rancher/${rancherDistro}/server/manifests/advanced.${manifestFormat}"))
-      t.assertEqual(advancedManifest["spec"]["timeout"], "69s", "unexpected value for spec.timeout")
-      # wait for test jobs to complete
-      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello", timeout=180)
-      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/values-file", timeout=180)
-      machine.wait_until_succeeds("kubectl -n test wait --for=condition=complete job/advanced", timeout=180)
-      # check output of test jobs
-      hello_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=hello")
-      values_file_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=values-file")
-      advanced_output = machine.succeed("kubectl -n test logs -l batch.kubernetes.io/job-name=advanced")
-      # strip the output to remove trailing whitespaces
-      t.assertEqual(hello_output.rstrip(), "Hello, world!", "unexpected output of hello job")
-      t.assertEqual(values_file_output.rstrip(), "Hello, file!", "unexpected output of values file job")
-      t.assertEqual(advanced_output.rstrip(), "advanced hello", "unexpected output of advanced job")
-      # wait for bundled ingress deployment
-      ${
-        {
-          k3s = ''
-            machine.wait_until_succeeds("kubectl -n kube-system rollout status deployment traefik", timeout=180)
-          '';
-          rke2 = ''
-            machine.wait_until_succeeds("kubectl -n kube-system rollout status daemonset rke2-ingress-nginx-controller", timeout=180)
-          '';
-        }
-        .${rancherDistro}
-      }
-    '';
-
-  meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;
-}

nixos/tests/rancher/auto-deploy.nix

@@ -1,4 +1,6 @@
-# Tests whether container images are imported and auto deploying manifests work
+# Tests whether container images are imported and auto deploy (manifests and charts) work.
+# Additionally, imports airgap images and verifies deployment of the bundled reverse
+# proxy (traefik or ingress-nginx)
 {
   pkgs,
   lib,
@@ -11,38 +13,94 @@
   ...
 }:
 let
-  pauseImageEnv = pkgs.buildEnv {
-    name = "${rancherDistro}-pause-image-env";
+  testImageEnv = pkgs.buildEnv {
+    name = "${rancherDistro}-test-image-env";
     paths = with pkgs; [
-      tini
-      (lib.hiPrio coreutils)
       busybox
+      hello
     ];
   };
-  pauseImage = pkgs.dockerTools.buildImage {
-    name = "test.local/pause";
+  testImage = pkgs.dockerTools.buildImage {
+    name = "test.local/test";
     tag = "local";
-    copyToRoot = pauseImageEnv;
-    config.Entrypoint = [
-      "/bin/tini"
-      "--"
-      "/bin/sleep"
-      "inf"
-    ];
+    compressor = "zstd";
+    copyToRoot = testImageEnv;
   };
-  helloImage = pkgs.dockerTools.buildImage {
-    name = "test.local/hello";
-    tag = "local";
-    copyToRoot = pkgs.hello;
-    config.Entrypoint = [ "${pkgs.hello}/bin/hello" ];
-  };
-
   manifestFormat =
     {
       k3s = "yaml";
       rke2 = "json";
     }
     .${rancherDistro};
+  # pack the test helm chart as a .tgz archive
+  testChartPackage =
+    pkgs.runCommand "${rancherDistro}-test-chart.tgz"
+      {
+        nativeBuildInputs = [ pkgs.kubernetes-helm ];
+        chart = builtins.toJSON {
+          name = "${rancherDistro}-test-chart";
+          version = "0.1.0";
+        };
+        values = builtins.toJSON {
+          restartPolicy = "Never";
+          runCommand = "";
+          image = {
+            repository = "foo";
+            tag = "1.0.0";
+          };
+        };
+        job = builtins.toJSON {
+          apiVersion = "batch/v1";
+          kind = "Job";
+          metadata = {
+            name = "{{ .Release.Name }}";
+            namespace = "{{ .Release.Namespace }}";
+          };
+          spec = {
+            template = {
+              spec = {
+                containers = [
+                  {
+                    name = "test";
+                    image = "{{ .Values.image.repository }}:{{ .Values.image.tag }}";
+                    command = [ "sh" ];
+                    args = [
+                      "-c"
+                      "{{ .Values.runCommand }}"
+                    ];
+                  }
+                ];
+                restartPolicy = "{{ .Values.restartPolicy }}";
+              };
+            };
+          };
+        };
+        passAsFile = [
+          "values"
+          "chart"
+          "job"
+        ];
+      }
+      ''
+        mkdir -p chart/templates
+        cp "$chartPath" chart/Chart.yaml
+        cp "$valuesPath" chart/values.yaml
+        cp "$jobPath" chart/templates/job.json
+
+        helm package chart
+        mv ./*.tgz $out
+      '';
+  # The Helm chart that is used in this test
+  testChart = {
+    package = testChartPackage;
+    values = {
+      runCommand = "hello";
+      image = {
+        repository = testImage.imageName;
+        tag = testImage.imageTag;
+      };
+    };
+  };
 in
 {
   name = "${rancherPackage.name}-auto-deploy";
@@ -53,6 +111,7 @@ in
       environment.systemPackages = with pkgs; [
         kubectl
         cri-tools
+        yq-go
       ];
       environment.sessionVariables.KUBECONFIG = "/etc/rancher/${rancherDistro}/${rancherDistro}.yaml";
 
@@ -62,16 +121,16 @@ in
         enable = true;
         role = "server";
         package = rancherPackage;
-        disable = disabledComponents;
-        extraFlags = [
-          "--pause-image test.local/pause:local"
-        ];
-        images = coreImages ++ [
-          pauseImage
-          helloImage
-        ];
+        disable =
+          {
+            k3s = lib.remove "traefik" disabledComponents;
+            rke2 = lib.remove "rke2-ingress-nginx" disabledComponents;
+          }
+          .${rancherDistro};
+        images =
+          coreImages ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images ++ [ testImage ];
         manifests = {
-          absent = {
+          manifest-absent = {
             enable = false;
             content = {
               apiVersion = "v1";
@@ -80,7 +139,7 @@ in
             };
           };
 
-          present = {
+          manifest-present = {
             target = "foo-namespace.${manifestFormat}";
             content = {
               apiVersion = "v1";
@@ -89,16 +148,17 @@ in
             };
           };
 
-          hello.content = {
+          manifest-hello.content = {
             apiVersion = "batch/v1";
             kind = "Job";
-            metadata.name = "hello";
+            metadata.name = "manifest-hello";
             spec = {
               template.spec = {
                 containers = [
                   {
                     name = "hello";
-                    image = "test.local/hello:local";
+                    image = "${testImage.imageName}:${testImage.imageTag}";
+                    command = [ "hello" ];
                   }
                 ];
                 restartPolicy = "OnFailure";
@@ -106,28 +166,121 @@ in
             };
           };
         };
+        autoDeployCharts = {
+          # regular test chart that should get installed
+          chart-hello = testChart;
+          # disabled chart that should not get installed
+          chart-disabled = testChart // {
+            enable = false;
+          };
+          # chart with values set via YAML file
+          chart-values-file = testChart // {
+            # Remove unsafeDiscardStringContext workaround when Nix can convert a string to a path
+            # https://github.com/NixOS/nix/issues/12407
+            values =
+              /.
+              + builtins.unsafeDiscardStringContext (
+                builtins.toFile "${rancherDistro}-test-chart-values.yaml" ''
+                  runCommand: "echo 'Hello, file!'"
+                  image:
+                    repository: test.local/test
+                    tag: local
+                ''
+              );
+          };
+          # advanced chart that should get installed in the "test" namespace with a custom
+          # timeout and overridden values
+          chart-advanced = testChart // {
+            # create the "test" namespace via extraDeploy for testing
+            extraDeploy = [
+              {
+                apiVersion = "v1";
+                kind = "Namespace";
+                metadata.name = "test";
+              }
+            ];
+            extraFieldDefinitions = {
+              spec = {
+                # overwrite chart values
+                valuesContent = ''
+                  runCommand: "echo 'advanced hello'"
+                  image:
+                    repository: ${testImage.imageName}
+                    tag: ${testImage.imageTag}
+                '';
+                # overwrite the chart namespace
+                targetNamespace = "test";
+                # set a custom timeout
+                timeout = "69s";
+              };
+            };
+          };
+        };
       };
     };
 
   testScript = # python
     ''
-      start_all()
+      import json
 
       machine.wait_for_unit("${serviceName}")
-      # check existence of the manifest files
-      machine.fail("ls /var/lib/rancher/${rancherDistro}/server/manifests/absent.${manifestFormat}")
-      machine.succeed("ls /var/lib/rancher/${rancherDistro}/server/manifests/foo-namespace.${manifestFormat}")
-      machine.succeed("ls /var/lib/rancher/${rancherDistro}/server/manifests/hello.${manifestFormat}")
 
-      # check if container images got imported
-      # for some reason, RKE2 also uses /run/k3s
-      machine.wait_until_succeeds("crictl -r /run/k3s/containerd/containerd.sock img | grep 'test\.local/pause'")
-      machine.wait_until_succeeds("crictl -r /run/k3s/containerd/containerd.sock img | grep 'test\.local/hello'")
+      with subtest("Generation of manifest files"):
+        machine.succeed("test ! -e /var/lib/rancher/${rancherDistro}/server/manifests/manifest-absent.${manifestFormat}")
+        machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/foo-namespace.${manifestFormat}")
+        machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/manifest-hello.${manifestFormat}")
 
-      # check if resources of manifests got created
-      machine.wait_until_succeeds("kubectl get ns foo")
-      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
-      machine.fail("kubectl get ns absent")
+      with subtest("Generation of chart manifest files"):
+        machine.succeed("test ! -e /var/lib/rancher/${rancherDistro}/server/manifests/chart-disabled.${manifestFormat}")
+        machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/chart-hello.${manifestFormat}")
+        machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/chart-values-file.${manifestFormat}")
+        machine.succeed("test -e /var/lib/rancher/${rancherDistro}/server/manifests/chart-advanced.${manifestFormat}")
+
+      with subtest("Timeout of advanced chart"):
+        # select only the first item in advanced.yaml
+        advancedManifest = json.loads(machine.succeed("yq -o json '.items[0]' /var/lib/rancher/${rancherDistro}/server/manifests/chart-advanced.${manifestFormat}"))
+        t.assertEqual(advancedManifest["spec"]["timeout"], "69s", "unexpected value for spec.timeout")
+
+      with subtest("Container image import"):
+        # for some reason, RKE2 also uses /run/k3s
+        machine.wait_until_succeeds("crictl -r /run/k3s/containerd/containerd.sock img | grep 'test\.local/test'")
+        machine.wait_until_succeeds("crictl -r /run/k3s/containerd/containerd.sock img | grep '^docker.io/rancher/mirrored-'")
+
+      with subtest("Creation of manifest resource"):
+        machine.wait_until_succeeds("kubectl get ns foo")
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/manifest-hello")
+        machine.fail("kubectl get ns absent")
+
+      with subtest("Completion of chart test jobs"):
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/chart-hello")
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/chart-values-file")
+        machine.wait_until_succeeds("kubectl -n test wait --for=condition=complete job/chart-advanced")
+
+      with subtest("Output of manifest test job"):
+        hello_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=manifest-hello")
+        t.assertEqual(hello_output.rstrip(), "Hello, world!", "unexpected output of manifest-hello job")
+
+      with subtest("Output of chart test jobs"):
+        hello_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=chart-hello")
+        values_file_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=chart-values-file")
+        advanced_output = machine.succeed("kubectl -n test logs -l batch.kubernetes.io/job-name=chart-advanced")
+        # strip to remove trailing whitespaces
+        t.assertEqual(hello_output.rstrip(), "Hello, world!", "unexpected output of chart hello job")
+        t.assertEqual(values_file_output.rstrip(), "Hello, file!", "unexpected output of chart values file job")
+        t.assertEqual(advanced_output.rstrip(), "advanced hello", "unexpected output of advanced chart job")
+
+      with subtest("Deployment of bundled reverse proxy"):
+        ${
+          {
+            k3s = ''
+              machine.wait_until_succeeds("kubectl -n kube-system rollout status deployment traefik")
+            '';
+            rke2 = ''
+              machine.wait_until_succeeds("kubectl -n kube-system rollout status daemonset rke2-ingress-nginx-controller")
+            '';
+          }
+          .${rancherDistro}
+        }
     '';
 
   meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;

nixos/tests/rancher/configuration.nix

@@ -1,4 +1,5 @@
-# A test that sets extra kubelet configuration and enables graceful node shutdown
+# Tests that containerd configuration, kubelet configuration, and graceful node shutdown are
+# configured correctly
 {
   pkgs,
   lib,
@@ -19,9 +20,9 @@ let
   containerLogMaxSize = "5Mi";
 in
 {
-  name = "${rancherPackage.name}-kubelet-config";
+  name = "${rancherPackage.name}-configuration";
   nodes.machine =
-    { pkgs, ... }:
+    { ... }:
     {
       environment.systemPackages = with pkgs; [
         kubectl
@@ -37,6 +38,12 @@ in
         disable = disabledComponents;
         images = coreImages;
         inherit nodeName;
+        containerdConfigTemplate = ''
+          # Base ${rancherDistro} config
+          {{ template "base" . }}
+
+          # MAGIC COMMENT
+        '';
         gracefulNodeShutdown = {
           enable = true;
           inherit shutdownGracePeriod shutdownGracePeriodCriticalPods;
@@ -51,19 +58,26 @@ in
     ''
       import json
 
-      start_all()
       machine.wait_for_unit("${serviceName}")
       # wait until the node is ready
       machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the kubelet registered an inhibitor lock
-      machine.succeed("systemd-inhibit --list --no-legend | grep \"^kubelet.*shutdown\"")
+
+      with subtest("Inhibitor lock is registered"):
+        machine.succeed("systemd-inhibit --list --no-legend | grep \"^kubelet.*shutdown\"")
+
+      with subtest("Containerd config contains magic comment"):
+        out=machine.succeed("cat /var/lib/rancher/${rancherDistro}/agent/etc/containerd/config.toml.tmpl")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config template does not contain the magic comment")
+        # config file contains the magic comment
+        out=machine.succeed("cat /var/lib/rancher/${rancherDistro}/agent/etc/containerd/config.toml")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config does not contain the magic comment")
+
       # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
       machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
       machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
-      # get the kubeletconfig
-      kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
 
       with subtest("Kubelet config values are set correctly"):
+        kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
         t.assertEqual(kubelet_config["shutdownGracePeriod"], "${shutdownGracePeriod}")
         t.assertEqual(kubelet_config["shutdownGracePeriodCriticalPods"], "${shutdownGracePeriodCriticalPods}")
         t.assertEqual(kubelet_config["podsPerCore"], ${toString podsPerCore})

nixos/tests/rancher/containerd-config.nix

@@ -1,59 +0,0 @@
-# A test that containerdConfigTemplate settings get written to containerd/config.toml
-{
-  pkgs,
-  lib,
-  rancherDistro,
-  rancherPackage,
-  serviceName,
-  disabledComponents,
-  coreImages,
-  vmResources,
-  ...
-}:
-let
-  nodeName = "test";
-in
-{
-  name = "${rancherPackage.name}-containerd-config";
-  nodes.machine =
-    { ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        kubectl
-        jq
-      ];
-      environment.sessionVariables.KUBECONFIG = "/etc/rancher/${rancherDistro}/${rancherDistro}.yaml";
-
-      virtualisation = vmResources;
-
-      services.${rancherDistro} = {
-        enable = true;
-        package = rancherPackage;
-        disable = disabledComponents;
-        images = coreImages;
-        inherit nodeName;
-        containerdConfigTemplate = ''
-          # Base ${rancherDistro} config
-          {{ template "base" . }}
-
-          # MAGIC COMMENT
-        '';
-      };
-    };
-
-  testScript = # python
-    ''
-      start_all()
-      machine.wait_for_unit("${serviceName}")
-      # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the config template file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/${rancherDistro}/agent/etc/containerd/config.toml.tmpl")
-      t.assertIn("MAGIC COMMENT", out, "the containerd config template does not contain the magic comment")
-      # test whether the config file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/${rancherDistro}/agent/etc/containerd/config.toml")
-      t.assertIn("MAGIC COMMENT", out, "the containerd config does not contain the magic comment")
-    '';
-
-  meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;
-}

nixos/tests/rancher/default.nix

@@ -97,12 +97,9 @@ let
         ) allPackages;
     in
     {
-      airgap-images = mkTests ./airgap-images.nix;
       auto-deploy = mkTests ./auto-deploy.nix;
-      auto-deploy-charts = mkTests ./auto-deploy-charts.nix;
-      containerd-config = mkTests ./containerd-config.nix;
+      configuration = mkTests ./configuration.nix;
       etcd = mkTests ./etcd.nix;
-      kubelet-config = mkTests ./kubelet-config.nix;
       multi-node = mkTests ./multi-node.nix;
       single-node = mkTests ./single-node.nix;
     };

nixos/tests/suricata.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 {
   name = "suricata";
-  meta.maintainers = lib.teams.secshell.members;
+  meta.maintainers = with lib.maintainers; [ felbinger ];
 
   nodes = {
     ids = {

pkgs/applications/audio/mmlgui/default.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation {
   pname = "mmlgui";
-  version = "210420-preview-unstable-2024-04-15";
+  version = "210420-preview-unstable-2026-01-09";
 
   src = fetchFromGitHub {
     owner = "superctr";
     repo = "mmlgui";
-    rev = "e49f225ac2b2d46056b2c45a5d31c544227c4968";
+    rev = "9803a154c5fdbe6e88956e391ea0d5c4eae18cdc";
     fetchSubmodules = true;
-    hash = "sha256-hj2k1BrE8AA2HTBEO03RammlZV2U4KW0gLJmFNiaSvI=";
+    hash = "sha256-3HMSVSgqusIhFf7jheyC2ytoJqSsJA8yYUnhxvdteq0=";
   };
 
   postPatch = ''

pkgs/applications/blockchains/bitcoin/default.nix

@@ -30,10 +30,10 @@
   builderKeys ? [
     "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
     "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
-    # "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg (not signed 30.1)
+    # "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg (not signed 30.2)
     "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
-    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
-    "67AA5B46E7AF78053167FE343B8F814A784218F8" # willcl-ark.gpg
+    # "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg (not signed 30.2)
+    # "67AA5B46E7AF78053167FE343B8F814A784218F8" # willcl-ark.gpg (not signed 30.2)
   ],
 }:
 
@@ -46,14 +46,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin" else "bitcoind";
-  version = "30.1";
+  version = "30.2";
 
   src = fetchurl {
     urls = [
       "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
-    sha256 = "5d5518782c3000f64717ec1b4291e7e609a1f900d9729ee83c982243779c3f43";
+    sha256 = "6fd00b8c42883d5c963901ad4109a35be1e5ec5c2dc763018c166c21a06c84cb";
   };
 
   nativeBuildInputs = [
@@ -93,12 +93,12 @@ stdenv.mkDerivation (finalAttrs: {
 
       checksums = fetchurl {
         url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-WdOYSEbxmpecFpThNwxKTNXbbwQvqlUuCxmCbhfhW6k";
+        hash = "sha256-ERE/QO2elj++mON3UYGJKaLdU86gWIRS/AufuyS/JAU=";
       };
 
       signatures = fetchurl {
         url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-yFPhf/tyotBtpx1lZAQR+C2YdZaAyaWCq/0OVdP2wR4=";
+        hash = "sha256-69TMNzKJQRDC+2YU6bKI23c8Jx44m5B1zz823SQtiyg=";
       };
 
       verifyBuilderKeys =

pkgs/applications/editors/vim/plugins/generated.nix

@@ -5398,6 +5398,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  fluent-vim = buildVimPlugin {
+    pname = "fluent.vim";
+    version = "0-unstable-2025-04-26";
+    src = fetchFromGitHub {
+      owner = "projectfluent";
+      repo = "fluent.vim";
+      rev = "94c1ef622187032778f546d2f8ad821661475172";
+      hash = "sha256-tOYxOUKa6Zn2Yq5peqGDEdCkpl+b+VKkSmZx7+kHZJ0=";
+    };
+    meta.homepage = "https://github.com/projectfluent/fluent.vim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
     version = "2.1.0-unstable-2026-01-08";

pkgs/applications/editors/vim/plugins/non-generated/jupyter-api-nvim/default.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  vimUtils,
+  nix-update-script,
+  gitMinimal,
+}:
+let
+  version = "0-unstable-2026-01-10";
+  src = fetchFromGitHub {
+    owner = "bitbloxhub";
+    repo = "jupyter-api.nvim";
+    rev = "5dd157fd8cd9ef6d20075c0809f54c9f7af23e43";
+    hash = "sha256-N9Z7SaWeT8b2N3EtwwRLW7DCiQk0+tCd9e573DSq7SQ=";
+  };
+  jupyter-api-nvim-lib = rustPlatform.buildRustPackage {
+    inherit version src;
+    pname = "jupyter-api-nvim-lib";
+
+    cargoHash = "sha256-Oe6NnnNBY2nzYkNYucPpR6iV/8a6/9ZUytKpdHWY+So=";
+
+    env = {
+      # Allow undefined symbols on Darwin - they will be provided by Neovim's LuaJIT runtime
+      RUSTFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-C link-arg=-undefined -C link-arg=dynamic_lookup";
+    };
+  };
+in
+vimUtils.buildVimPlugin {
+  pname = "jupyter-api.nvim";
+  inherit version src;
+  preInstall =
+    let
+      ext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      mkdir -p target/release
+      ln -s ${jupyter-api-nvim-lib}/lib/libjupyter_api_nvim${ext} target/release/libjupyter_api_nvim${ext}
+    '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "vimPlugins.jupyter-api-nvim.jupyter-api-nvim-lib";
+    };
+
+    # needed for the update script
+    inherit jupyter-api-nvim-lib;
+  };
+
+  meta = {
+    description = "Library for interacting with Jupyter kernels from Neovim Lua";
+    homepage = "https://github.com/bitbloxhub/jupyter-api.nvim/";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [
+      bitbloxhub
+    ];
+  };
+}

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -2788,10 +2788,6 @@ assertNoAdditions {
     nvimSkipModules = [ "install_parsers" ];
   };
 
-  nvim-treesitter-endwise = super.nvim-treesitter-endwise.overrideAttrs {
-    dependencies = [ self.nvim-treesitter-legacy ];
-  };
-
   nvim-treesitter-pairs = super.nvim-treesitter-pairs.overrideAttrs {
     dependencies = [ self.nvim-treesitter-legacy ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -414,6 +414,7 @@ https://github.com/ncm2/float-preview.nvim/,,
 https://github.com/nvzone/floaterm/,HEAD,
 https://github.com/liangxianzhe/floating-input.nvim/,HEAD,
 https://github.com/floobits/floobits-neovim/,,
+https://github.com/projectfluent/fluent.vim/,HEAD,
 https://github.com/nvim-flutter/flutter-tools.nvim/,HEAD,
 https://github.com/nvim-focus/focus.nvim/,HEAD,
 https://github.com/anuvyklack/fold-preview.nvim/,HEAD,

pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.12.0";
-    hash = "sha256-UrQ7Sp4hklKP+rF8Yke7qay/vSIb+B5mza2fmfcN6l8=";
+    version = "10.12.2";
+    hash = "sha256-6VXlsMtAPFROYlmYJdHj54fo1J0LC4UJbzI00cuuwhk=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-bicep/default.nix

@@ -25,7 +25,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-bicep";
     homepage = "https://github.com/Azure/bicep/tree/main/src/vscode-bicep";
     license = lib.licenses.mit;
-    teams = [ lib.teams.stridtech ];
   };
 }
 

pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix

@@ -6,7 +6,6 @@
   poetry-core,
   nixops,
   python-digitalocean,
-  pythonOlder,
 }:
 
 buildPythonPackage {
@@ -14,8 +13,6 @@ buildPythonPackage {
   version = "0.1.0-unstable-2022-08-14";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixops-digitalocean";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-RVhClLMaoCtMhh+4NL8aOj/sK2WtFA/LNjkscKmxIiU=",
+    "hash": "sha256-d0v0a4t0sPkGQ9LGK7p5XZmuZBuBeLcWHBoslFu9Qs8=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.91.0",
+    "rev": "v0.92.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/kRacnH+zVEm0u091euV0UIyadAcYnykn2tJiYY19I8="
+    "vendorHash": "sha256-+UWPbNHoV3TdeMZdY0ZOLBe1/Dej37hHORatC9Kol58="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -715,11 +715,11 @@
     "vendorHash": "sha256-8gBaOdoUjmeomi8+H2gMypKnJdkXGzgzu8K0ATqMfxE="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-8GsGyWBkeHy+7MOrjn6r8Q67EDBycU0FEFILabJvkWA=",
+    "hash": "sha256-B7THs+KpB9j72Jklzpw9GmjM/U5rqvZG9kxNbU/YkFY=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.83.0",
+    "rev": "v1.84.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1175,13 +1175,13 @@
     "vendorHash": "sha256-f3b4NULINH8XworCn46fiz4GmBM31ROdAJy1j4GKkx4="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-LR1e8gAF8htYpxfj/m/Ge266sFRFc8tijaE/9uKYYBw=",
+    "hash": "sha256-TekcGTYzpqFUVv0NYRGi71rgMD0okQpMPiPI8869cog=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.65.1",
+    "rev": "v2.66.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HWAaBgKD/viiFaxvyHE4BuWdsY0tCSQFaf8YJq4PS/0="
+    "vendorHash": "sha256-2uqoiUdU8hVHm8Mc0dkS/qAuqZkhVVTKwf++CobRGtw="
   },
   "scottwinkler_shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",

pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix

@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.32.5";
+  version = "1.32.6";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-MoOakwxyDlhB4YFXWR5Q2jLb0k3wuj87tOO5f0Xy5Vg=";
+    hash = "sha256-BQnu7zRk1zOsEqFjmRrOeK/jE+rmnsB1ktW+OfH+L3I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ac/acme-sh/package.nix

@@ -74,7 +74,6 @@ stdenv.mkDerivation rec {
       - Cron job notifications for renewal or error etc.
     '';
     license = lib.licenses.gpl3Only;
-    teams = [ lib.teams.serokell ];
     inherit (coreutils.meta) platforms;
     mainProgram = "acme.sh";
   };

pkgs/by-name/an/angr-management/package.nix

@@ -0,0 +1,75 @@
+{
+  lib,
+  fetchFromGitHub,
+  python312,
+  xorg,
+}:
+
+python312.pkgs.buildPythonApplication rec {
+  pname = "angr-management";
+  version = "9.2.154";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "angr";
+    repo = "angr-management";
+    tag = "v${version}";
+    hash = "sha256-ZaQRXCt6u5FGApiXTToJdIXBnBLv3emo13YG5ip0lJA=";
+  };
+
+  pythonRelaxDeps = [
+    "angr"
+    "binsync"
+    "qtawesome"
+  ];
+
+  buildInputs = [ xorg.xcbutilcursor ];
+
+  build-system = with python312.pkgs; [ setuptools ];
+
+  dependencies =
+    with python312.pkgs;
+    (
+      [
+        # requirements from setup.cfg
+        angr
+        bidict
+        binsync
+        ipython
+        pyqodeng-angr
+        pyside6
+        pyside6-qtads
+        qtawesome
+        qtpy
+        requests
+        rpyc
+        thefuzz
+        tomlkit
+        # requirements from setup.cfg -- vendorized qtconsole package
+        ipykernel
+        jupyter-client
+        jupyter-core
+        packaging
+        pygments
+        pyzmq
+        traitlets
+      ]
+      ++ angr.optional-dependencies.angrdb
+      ++ requests.optional-dependencies.socks
+      ++ thefuzz.optional-dependencies.speedup
+    );
+
+  pythonImportsCheck = [ "angrmanagement" ];
+
+  meta = {
+    description = "Graphical binary analysis tool powered by the angr binary analysis platform";
+    homepage = "https://github.com/angr/angr-management";
+    changelog = "https://github.com/angr/angr-management/releases/tag/${src.tag}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      connornelson
+      scoder12
+    ];
+    mainProgram = "angr-management";
+  };
+}

pkgs/by-name/ar/ares/package.nix

@@ -119,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://ares-emu.net";
     description = "Open-source multi-system emulator with a focus on accuracy and preservation";
     license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ nadiaholmquist ];
     mainProgram = "ares";
     platforms = lib.platforms.unix;
   };

pkgs/by-name/av/avalonia/0003-disable-hard-links.patch

@@ -0,0 +1,14 @@
+diff --git a/Directory.Build.props b/Directory.Build.props
+index f124456..117c096 100644
+--- a/Directory.Build.props
++++ b/Directory.Build.props
+@@ -9,9 +9,5 @@
+       <AddSyntheticProjectReferencesForSolutionDependencies>false</AddSyntheticProjectReferencesForSolutionDependencies>
+       <RunApiCompat>False</RunApiCompat>
+       <LangVersion>12</LangVersion>
+-      <CreateHardLinksForCopyAdditionalFilesIfPossible>true</CreateHardLinksForCopyAdditionalFilesIfPossible>
+-      <CreateHardLinksForCopyFilesToOutputDirectoryIfPossible>true</CreateHardLinksForCopyFilesToOutputDirectoryIfPossible>
+-      <CreateHardLinksForCopyLocalIfPossible>true</CreateHardLinksForCopyLocalIfPossible>
+-      <CreateHardLinksForPublishFilesIfPossible>true</CreateHardLinksForPublishFilesIfPossible>
+   </PropertyGroup>
+ </Project>

pkgs/by-name/av/avalonia/package.nix

@@ -62,6 +62,9 @@ stdenvNoCC.mkDerivation (
         # [ERR] Compile: [...]/Microsoft.NET.Sdk.targets(148,5): error MSB4018: The "GenerateDepsFile" task failed unexpectedly. [/build/source/src/tools/DevAnalyzers/DevAnalyzers.csproj]
         # [ERR] Compile: [...]/Microsoft.NET.Sdk.targets(148,5): error MSB4018: System.IO.IOException: The process cannot access the file '/build/source/src/tools/DevAnalyzers/bin/Release/netstandard2.0/DevAnalyzers.deps.json' because it is being used by another process. [/build/source/src/tools/DevAnalyzers/DevAnalyzers.csproj]
         ./0002-disable-parallel-compile.patch
+        # Microsoft.Common.CurrentVersion.targets(5034,5): error MSB3021: Unable to copy file "[...]/JetBrains.Annotations.dll" to "bin/Debug/JetBrains.Annotations.dll". Access to the path '/build/source/nukebuild/bin/Debug/JetBrains.Annotations.dll' is denied. [/build/source/nukebuild/_build.csproj]
+        # This happens because the source packages have symlinks due to linkNuGetPackagesAndSources.
+        ./0003-disable-hard-links.patch
       ];
 
       # this needs to be match the version being patched above

pkgs/by-name/az/azure-cli/package.nix

@@ -480,7 +480,6 @@ py.pkgs.toPythonApplication (
       license = lib.licenses.mit;
       mainProgram = "az";
       maintainers = with lib.maintainers; [ katexochen ];
-      teams = [ lib.teams.stridtech ];
       platforms = lib.platforms.all;
     };
   }

pkgs/by-name/ba/bacon/package.nix

@@ -27,16 +27,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bacon";
-  version = "3.20.3";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UMSYXrD2lDJS2HYiCzm22r40Y4EzAjgEmNhV8hvarTo=";
+    hash = "sha256-mgSFnSnghJvaOrgg1AICNRUGNSrNijL9caDyN8kj8Dw=";
   };
 
-  cargoHash = "sha256-m+9Psm29zV4kOb2mpynR3S/EBajAqPU11iBO9kHlD9o=";
+  cargoHash = "sha256-aSLaPirkszoGnAyt9U0LsKXL2IuR6nSInb/KQBVQ69k=";
 
   buildFeatures = lib.optionals withSound [
     "sound"

pkgs/by-name/ba/balena-cli/package.nix

@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "23.2.14";
+  version = "23.2.16";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-sCzb6ZGpMwG6C66hMeuYmlnEj/ZNau8UieBTfCjdbXw=";
+    hash = "sha256-TqDcL3USt6HuYrQ0EqpYL3zB5hq19bgX0mT7+euYxaA=";
   };
 
-  npmDepsHash = "sha256-oq7Lcn9yrtOGbIkyWDsoqlOzt6Dj6EvKKhZKwFlSF1k=";
+  npmDepsHash = "sha256-ec5E2ttOTlQ/YYiawtmCsplArkmFS1aQOTdOGVGGxWI=";
 
   makeCacheWritable = true;
 

pkgs/by-name/ba/basalt/package.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "basalt";
-  version = "0.9.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "erikjuhani";
     repo = "basalt";
     tag = "basalt/v${finalAttrs.version}";
-    hash = "sha256-r34MlNSLZAHqNWlFMGNxT6zTSX+IKKQmJ4klEB4kjek=";
+    hash = "sha256-+bkONCG4PSa266r0am2sjtz2WJXdhwijfJ8Uz3iEk68=";
   };
 
-  cargoHash = "sha256-TpbJ1HCBocgLAXGb5dBbZNMlOYXR9IGBRtfShgwlMIo=";
+  cargoHash = "sha256-7jkeDZhGoufY1lHnhc2yKz2ulBf/nlV4ngY2XRSHF+4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/ba/basedpyright/package.nix

@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.36.2";
+  version = "1.37.1";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-fi1TGvlH6h9MHymCn0INc1lIqTyMnHEhxXJuAiYmkpo=";
+    hash = "sha256-lBCCd9t6E0lUHOKc+5G1Ab3FmD/zj6g6SPoJ0Lh6oDE=";
   };
 
-  npmDepsHash = "sha256-VHQOmRWirZYnoxk/JzGwFFV5QEIyHGg/isDvf/f7uro=";
+  npmDepsHash = "sha256-aZ9kfkW+S6Hjt59Z4Fc5joghs7OQ32354IYevFuKNeo=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''

pkgs/by-name/bi/bicep-lsp/package.nix

@@ -50,7 +50,6 @@ buildDotnetModule rec {
     homepage = "https://github.com/Azure/bicep/";
     changelog = "https://github.com/Azure/bicep/releases/tag/v${version}";
     license = lib.licenses.mit;
-    teams = [ lib.teams.stridtech ];
     platforms = lib.platforms.all;
     badPlatforms = [ "aarch64-linux" ];
   };

pkgs/by-name/bi/bicep/package.nix

@@ -57,7 +57,6 @@ buildDotnetModule rec {
     changelog = "https://github.com/Azure/bicep/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = [ ];
-    teams = [ lib.teams.stridtech ];
     mainProgram = "bicep";
   };
 }

pkgs/by-name/ca/carapace-bridge/package.nix

@@ -8,23 +8,26 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.2.10";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XQtbOQw2a2B5zhTgFiAuECtY/uM7AQnbwyRpzoKcF8I=";
+    hash = "sha256-6CCLSwbAYkMelaM5ac1I1kwOlWKPSOU9M9/2Dybt55I=";
   };
 
-  # buildGoModule try to run `go mod vendor` instead of `go work vendor` on the
-  # workspace if proxyVendor is off
+  # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on
+  # the workspace if proxyVendor is off
   proxyVendor = true;
-  vendorHash = "sha256-01WRJJiAqxmb1grvz9gWdYJ4i9pVUYmxFg9BGEuUhdA=";
+  vendorHash = "sha256-DyFOCx+pCChbQRGRDou0QU2YTQzrcAgwO5Mc918Xm8k=";
 
   postPatch = ''
     substituteInPlace cmd/carapace-bridge/main.go \
       --replace-fail "var version = \"develop\"" "var version = \"$version\""
+
+    # Remove docker examples
+    rm -r .docker
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/cd/cdncheck/package.nix

@@ -4,18 +4,18 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.2.17";
+  version = "1.2.18";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
-    tag = "v${version}";
-    hash = "sha256-9Xzmy5Q1VW32OYXkMwFyfhT5Tbm2SPn+STr9VFylWrw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RFA/5fCh9csa6nYoVmuZ5vs6JCaTVFUuEz0E8w7Rb/s=";
   };
 
-  vendorHash = "sha256-02/aSv5YYA62I3Wc27OJyPWO9YxFG4dKokgEswu9fzg=";
+  vendorHash = "sha256-Tc8qrML7u5qE0zVe7JCL1BM0KbhJSwnjhnd2gX5YUaA=";
 
   subPackages = [ "cmd/cdncheck/" ];
 
@@ -34,9 +34,9 @@ buildGoModule rec {
   meta = {
     description = "Tool to detect various technology for a given IP address";
     homepage = "https://github.com/projectdiscovery/cdncheck";
-    changelog = "https://github.com/projectdiscovery/cdncheck/releases/tag/v${version}";
+    changelog = "https://github.com/projectdiscovery/cdncheck/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "cdncheck";
   };
-}
+})

pkgs/by-name/ce/ceph/old-python-packages/cryptography.nix

@@ -34,7 +34,6 @@ buildPythonPackage rec {
   pname = "cryptography";
   version = "40.0.1"; # Also update the hash in vectors.nix
   format = "setuptools";
-  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;

pkgs/by-name/ce/ceph/old-python-packages/trustme.nix

@@ -7,7 +7,6 @@
   idna,
   pyopenssl,
   pytestCheckHook,
-  pythonOlder,
   service-identity,
 }:
 
@@ -16,8 +15,6 @@ buildPythonPackage rec {
   version = "1.1.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-U3Wtf7QnB0vslWWS4NTuKkz02miTThukvPQhcSa8ReY=";

pkgs/by-name/co/coc-rust-analyzer/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-01-01";
+  version = "0-unstable-2026-01-06";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "ffb3c8af18c7c86e05f335d2a614d1a88bd61a3e";
-    hash = "sha256-8d4GCWpVSwlGn2HSB56/Nll4U+YPx4aupRBxkOUUAr8=";
+    rev = "35615c7feafbc8005e160e7609888a97f5d3b031";
+    hash = "sha256-Kj3gUKFsfgUVVWuz7nuc7djRvfyvXc3wkHt1DxYIw30=";
   };
 
   npmDepsHash = "sha256-PgMgpVoKmhuqtSV73wSdqdQ5Bt5AeRwbn71mIulBh8Y=";

pkgs/by-name/co/code/package.nix

@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "code";
-  version = "0.6.5";
+  version = "0.6.45";
 
   src = fetchFromGitHub {
     owner = "just-every";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X+YwTXla6EePXLhMgokiZkgkm9P/rkl2+2XC27tqAEk=";
+    hash = "sha256-Ycl+r0fcopsWhT2QsRYPKWGRcXRyylgUalFBOgFF800=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/code-rs";
 
-  cargoHash = "sha256-oNrBwI0klqQtGTMhPzVvOqMqvdexEVkZpLD6ssXqQX8=";
+  cargoHash = "sha256-Yo8g9GavX9lrIHGoTs8YzMJkVyABflaRa3ni0xf7EvQ=";
 
   nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
     pkg-config
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     openssl
   ];
 
-  CODE_VERSION = finalAttrs.version;
+  env.CODE_VERSION = finalAttrs.version;
 
   cargoBuildFlags = [
     "--bin"

pkgs/by-name/co/complgen/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "complgen";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iwbU3DOzyPm3ZoyCRsgBZcSBSg48SsAMS/W4o5e3Gfs=";
+    hash = "sha256-fmnnRG3Vj7oFNJTsnK6KeFnimR9bJ0QDvrJI1Dg6V00=";
   };
 
-  cargoHash = "sha256-BGnTZxDv971s0h87RcOowoOpNdpwCx7FLcQNipPCTvc=";
+  cargoHash = "sha256-zueRWnIiANtlZvOwdh22zXumq4Bmq0/FN6vTU5w/XDk=";
 
   meta = {
     changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";

pkgs/by-name/co/coturn/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coturn";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "coturn";
     repo = "coturn";
     tag = version;
-    hash = "sha256-nvImelAvcbHpv6JTxX+sKpldVXG6u9Biu+VDt95r9I4=";
+    hash = "sha256-YeEyEGtlzzltEssPez7BIS3Wcfd+HgDgmrKyxOVu9PA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/da/daemontools/package.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
     cd daemontools-${version}
 
-    sed -i -e '1 s_$_ -include ${glibc.dev}/include/errno.h_' src/conf-cc
+    sed -i -e '1 s_$_ -include ${glibc.dev}/include/errno.h -std=gnu17_' src/conf-cc
 
     substituteInPlace src/Makefile \
       --replace-fail '/bin/sh' '${bash}/bin/bash -oxtrace'

pkgs/by-name/da/danger-gitlab/package.nix

@@ -15,7 +15,6 @@ bundlerApp {
     description = "Gem that exists to ensure all dependencies are set up for Danger with GitLab";
     homepage = "https://github.com/danger/danger-gitlab-gem";
     license = lib.licenses.mit;
-    teams = with lib.teams; [ serokell ];
     mainProgram = "danger";
   };
 }

pkgs/by-name/de/debian-devscripts/package.nix

@@ -30,14 +30,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "debian-devscripts";
-  version = "2.26.1";
+  version = "2.26.3";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "devscripts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aYzFBotRiw2di8T+4LSht+/ECIdkwpHadcfV2depWoU=";
+    hash = "sha256-LJZ1pt36KccnA/fimZsOzEjXvqVE2eSww1Wkq5+siJk=";
   };
 
   patches = [

pkgs/by-name/de/deja-dup/find-fusermount-setuid.patch

@@ -0,0 +1,13 @@
+diff --git a/libdeja/find-fusermount b/libdeja/find-fusermount
+index 1b3211bb..95b35cf5 100755
+--- a/libdeja/find-fusermount
++++ b/libdeja/find-fusermount
+@@ -20,6 +20,8 @@
+ if [ ! -f /.flatpak-info ]; then
+   if [ -n "@FUSERMOUNT_CMD@" ]; then
+     echo "@FUSERMOUNT_CMD@"
++  elif [ -f /run/wrappers/bin/fusermount3 ]; then
++    echo /run/wrappers/bin/fusermount3
+   elif command -pv fusermount3 > /dev/null; then
+     command -pv fusermount3
+   elif command -pv fusermount > /dev/null; then

pkgs/by-name/de/deja-dup/package.nix

@@ -21,7 +21,6 @@
   json-glib,
   borgbackup,
   duplicity,
-  fuse,
   rclone,
   restic,
   nix-update-script,
@@ -66,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Check https://gitlab.gnome.org/World/deja-dup/-/blob/main/meson.options
     (lib.mesonOption "borg_command" (lib.getExe borgbackup))
     (lib.mesonOption "duplicity_command" (lib.getExe duplicity))
-    (lib.mesonOption "fusermount_command" (lib.getExe' fuse "fusermount"))
     (lib.mesonOption "rclone_command" (lib.getExe rclone))
     (lib.mesonOption "restic_command" (lib.getExe restic))
     (lib.mesonEnable "packagekit" false) # packagekit-glib not packaged
@@ -79,6 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
+  patches = [ ./find-fusermount-setuid.patch ];
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/by-name/de/deploy-rs/package.nix

@@ -25,7 +25,6 @@ rustPlatform.buildRustPackage {
       teutat3s
       jk
     ];
-    teams = [ lib.teams.serokell ];
     mainProgram = "deploy";
   };
 }

pkgs/by-name/de/devenv/package.nix

@@ -128,6 +128,9 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/cachix/devenv";
     license = lib.licenses.asl20;
     mainProgram = "devenv";
-    teams = [ lib.teams.cachix ];
+    maintainers = with lib.maintainers; [
+      domenkozar
+      sandydoo
+    ];
   };
 }

pkgs/by-name/df/dfmt/package.nix

@@ -14,7 +14,6 @@ buildPythonApplication rec {
   pname = "dfmt";
   version = "1.2.0";
   format = "setuptools";
-  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;

pkgs/by-name/di/direwolf-unstable/package.nix

@@ -12,13 +12,13 @@
   inherit hamlibSupport gpsdSupport extraScripts;
 }).overrideAttrs
   (oldAttrs: {
-    version = "1.8.1-unstable-2026-01-03";
+    version = "1.8.1-unstable-2026-01-08";
 
     src = fetchFromGitHub {
       owner = "wb2osz";
       repo = "direwolf";
-      rev = "9aba4b386f841e5c9c9068a2259f7f5058a5dee5";
-      hash = "sha256-MHzPwx4N+LLETEZMQz4hmM+1qbwNJjHSISvTWROg+3o=";
+      rev = "041f396de0ab2111b9ccc07960f8f083a81f9ad0";
+      hash = "sha256-W0MTS4UgbtIybhEHXm2ie50TnkvRLc23WB0FR0FGT2s=";
     };
 
     # drop upstreamed cmake-4 patch

pkgs/by-name/dj/djbdns/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation {
   ];
 
   postPatch = ''
-    echo gcc -O2 -include ${glibc.dev}/include/errno.h > conf-cc
+    echo gcc -O2 -include ${glibc.dev}/include/errno.h -std=gnu17 > conf-cc
     echo $out > conf-home
     # djbdns ships with an outdated list of root servers
     awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${dns-root-data}/root.hints > dnsroots.global

pkgs/by-name/dn/dns-collector/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "1.14.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J6h/td5vCZwVruamZziIxRhAOdLdlv3Aupz9m0bExU4=";
+    hash = "sha256-d6FFxVGolXfZF4Ulklxg8u26DdV9yHeDUf2IEEryELw=";
   };
   subPackages = [ "." ];
 
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-BQLlEY9CJDwJRbzB5kflBwwxcWMLbaqgWUtz2p3CJsE=";
+  vendorHash = "sha256-4gk7LwRDrTiMCrR6JJpdSvCmNa7wQ5Hk06OGd6/SACc=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/do/docker-credential-env/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "docker-credential-env";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "isometry";
+    repo = "docker-credential-env";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PnLylYDuDg+FSZ4CUSoQ5gMk4p08FP4OKBxkeIMa+tY=";
+  };
+
+  vendorHash = "sha256-uALgz1TXTIk8UlxTaqYOXvCg9121hMIFfJoYC0jxohk=";
+
+  ldflags =
+    let
+      c = "github.com/docker/docker-credential-helpers/credentials";
+    in
+    [
+      "-s"
+      "-X=${c}.Name=docker-credential-env"
+      "-X=${c}.Package=github.com/isometry/docker-credential-env"
+      "-X=${c}.Version=${finalAttrs.version}"
+      "-X=${c}.Revision=${finalAttrs.src.tag}"
+    ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    changelog = "https://github.com/isometry/docker-credential-env/releases/tag/${finalAttrs.src.tag}";
+    description = "Environment-driven docker credential helper";
+    homepage = "https://github.com/isometry/docker-credential-env";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zowoq ];
+    mainProgram = "docker-credential-env";
+  };
+})

pkgs/by-name/e-/e-imzo-manager/package.nix

@@ -77,6 +77,11 @@ stdenv.mkDerivation (finalAttrs: {
     description = "GTK application for managing E-IMZO keys";
     license = with lib.licenses; [ agpl3Plus ];
     platforms = lib.platforms.linux;
-    teams = [ lib.teams.uzinfocom ];
+    maintainers = with lib.maintainers; [
+      orzklv
+      shakhzodkudratov
+      bahrom04
+      bemeritus
+    ];
   };
 })

pkgs/by-name/e-/e-imzo/package.nix

@@ -49,6 +49,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://e-imzo.soliq.uz";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    teams = [ lib.teams.uzinfocom ];
+    maintainers = with lib.maintainers; [
+      orzklv
+      shakhzodkudratov
+      bahrom04
+      bemeritus
+    ];
   };
 })

pkgs/by-name/ei/eid-mw/package.nix

@@ -23,13 +23,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "eid-mw";
   # NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
-  version = "5.1.26";
+  version = "5.1.28";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "eid-mw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1dswXwXNTN3006KHnqlVntg6uHMxNe7NQ4BdKAB2FXM=";
+    hash = "sha256-xXzrJWQEZ5mxnv6lG+rkG1P6TSzUDELccSwUizzhEek=";
   };
 
   postPatch = ''

pkgs/by-name/ev/evcc/package.nix

@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.211.1";
+  version = "0.300.3";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-taDgpuM3GbqD+v9sNXvJYiJLE1wvXzS/ILZgAGFUuw4=";
+    hash = "sha256-SGTsM4zZAuh/OGpMXvphHdlcCl1hOOYTn0R1k0/2qQo=";
   };
 
-  vendorHash = "sha256-VG1/6KadRC4jLBIOL39M6l8ZED1KLb+wKGHNQowAV1g=";
+  vendorHash = "sha256-S23rTyg+QClky0vWfRl5nnd+2cYnHMGXmxZwLoTxUu0=";
 
   commonMeta = {
     license = lib.licenses.mit;
@@ -52,7 +52,7 @@ buildGo125Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-vDMDyMEf6kWn1UFHvzmIxnY/ofh6YwwVFlCeKExfEy4=";
+    hash = "sha256-AXsF0rkaf6giDhJT2f/MMyCd6Ozgepx8do7fpl/CyNs=";
   };
 
   nativeBuildInputs = [
@@ -72,7 +72,7 @@ buildGo125Module rec {
     ];
 
     preBuild = ''
-      make assets
+      GOFLAGS="-mod=mod" make assets
     '';
   };
 

pkgs/by-name/ex/expresslrs-configurator/package.nix

@@ -0,0 +1,87 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  makeWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  electron,
+  asar,
+  git,
+}:
+
+let
+  pname = "expresslrs-configurator";
+  version = "1.7.11";
+  installPath = "share/${pname}";
+  resourcesPath = "${installPath}/resources";
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchzip {
+    url = "https://github.com/ExpressLRS/ExpressLRS-Configurator/releases/download/v${version}/${pname}-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-BIbJzNWjYFbbwCEWoym3g6XBpQGi2owbf2XsQiXwHmw=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+    asar
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = pname;
+      icon = pname;
+      desktopName = "ExpressLRS Configurator";
+      comment = "Configuration tool for ExpressLRS";
+      categories = [
+        "Utility"
+        "Development"
+      ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/${installPath} $out/bin $out/share/icons/hicolor/512x512/apps
+    cp -r $src/locales $src/resources $out/${installPath}/
+    chmod -R u+w $out/${resourcesPath}
+
+    # broken symlink
+    rm -f $out/${resourcesPath}/app.asar.unpacked/node_modules/@serialport/bindings-cpp/build/node_gyp_bins/python3
+    touch $out/${resourcesPath}/app.asar.unpacked/node_modules/@serialport/bindings-cpp/build/node_gyp_bins/python3
+
+    # patch asar absolute paths
+    asar extract $out/${resourcesPath}/app.asar $TMPDIR/app
+    substituteInPlace $TMPDIR/app/dist/main/main.js \
+      --replace-fail 'process.resourcesPath' "'$out/${resourcesPath}'" \
+      --replace-fail '__dirname,"../../devices"' "'$out/${resourcesPath}/devices'" \
+      --replace-fail '__dirname,"../../assets"' "'$out/${resourcesPath}/assets'" \
+      --replace-fail '__dirname,"../../dependencies"' "'$out/${resourcesPath}/dependencies'" \
+      --replace-fail '__dirname,"../","i18n","locales"' "'$out/${resourcesPath}/i18n/locales'" \
+      --replace-fail '__dirname,"../../.erb/dll/preload.js"' '__dirname,"preload.js"'
+    asar pack $TMPDIR/app $out/${resourcesPath}/app.asar
+
+    makeWrapper '${lib.getExe electron}' "$out/bin/${pname}" \
+      --add-flags "$out/${resourcesPath}/app.asar" \
+      --prefix PATH : ${lib.makeBinPath [ git ]} \
+      --set ELECTRON_OVERRIDE_DIST_PATH "${electron}/lib/electron" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Cross-platform build & configuration tool for ExpressLRS";
+    homepage = "https://github.com/ExpressLRS/ExpressLRS-Configurator";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ asamonik ];
+    mainProgram = pname;
+  };
+}

pkgs/by-name/fa/factoriolab/package.nix

@@ -10,13 +10,13 @@
 }:
 buildNpmPackage rec {
   pname = "factoriolab";
-  version = "3.17.5";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "factoriolab";
     repo = "factoriolab";
     tag = "v${version}";
-    hash = "sha256-Ra3xnOCIzx5oCeMU8kARcup+wsxknePBO/w1xGbwgT8=";
+    hash = "sha256-Id0o+Wxt0oNtik3lMHuvdm99HkuPY1XhE5yPCdkR8L4=";
     fetchLFS = true;
   };
   buildInputs = [ vips ];

pkgs/by-name/fa/faust2sndfile/package.nix

@@ -0,0 +1,26 @@
+{
+  faust,
+  flac,
+  lame,
+  libmpg123,
+  libogg,
+  libopus,
+  libsndfile,
+  libvorbis,
+}:
+
+faust.wrapWithBuildEnv {
+
+  baseName = "faust2sndfile";
+
+  propagatedBuildInputs = [
+    flac
+    lame
+    libmpg123
+    libogg
+    libopus
+    libsndfile
+    libvorbis
+  ];
+
+}

pkgs/by-name/fi/firezone-headless-client/package.nix

@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "firezone-headless-client";
-  version = "1.5.4";
+  version = "1.5.5";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "headless-client-${version}";
-    hash = "sha256-dVqZs5Xie9lc3F6wVMdxRHeoM7y/e9TvwjzfikenQ6w=";
+    hash = "sha256-Lo5iUXlpAecglr0uohOdsefeaDQZor2YoF0O99CxvEo=";
   };
 
-  cargoHash = "sha256-J2IqqFBuoTkbO0nMJbY680G2HTAtC1To/nMra2PCopY=";
+  cargoHash = "sha256-1e2uqxZFDbtcQREB0s2jxfSFgs/hnPxTlUGFeK5L9yw=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "headless-client";
   env.RUSTFLAGS = "--cfg system_certs";

pkgs/by-name/fm/fmd-server/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitLab,
+  nix-update-script,
+  versionCheckHook,
+}:
+let
+  version = "0.13.0";
+in
+buildGoModule {
+  pname = "fmd-server";
+  inherit version;
+  src = fetchFromGitLab {
+    owner = "fmd-foss";
+    repo = "fmd-server";
+    tag = "v${version}";
+    hash = "sha256-pIVsdoen45YWG/V8qW/DE/yet4o+8MqpVHgHh70Fty8=";
+  };
+
+  vendorHash = "sha256-d8QP6k7vEX0jBcpIMZymgOFYyKqGhND4Xa+mANg172s=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Server to communicate with the FindMyDevice app and save the latest (encrypted) location";
+    homepage = "https://fmd-foss.org/";
+    downloadPage = "https://gitlab.com/fmd-foss/fmd-server";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ j0hax ];
+    teams = [ lib.teams.ngi ];
+    mainProgram = "fmd-server";
+  };
+}

pkgs/by-name/fo/forgejo-runner/package.nix

@@ -22,6 +22,7 @@ let
     # Requires running Docker daemon
     "TestDocker"
     "TestJobExecutor"
+    "TestRunExec"
     "TestRunner"
     "Test_validateCmd"
 
@@ -48,14 +49,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "12.4.0";
+  version = "12.5.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-e7IDkeeEz8uAZ8WbRnBjSGq3SXVt5NY5li/3s/kf6dY=";
+    hash = "sha256-WagacsKhYN+KodDZqXg39RGeJtEGrtqppf1JJpTSBsQ=";
   };
 
   vendorHash = "sha256-oCSAehLC5NiL0Ttp+FeHQyTQYNh/59I1i0UfbwWPeRE=";

pkgs/by-name/fr/fresh-editor/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.1.70";
+  version = "0.1.75";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Lr5tMzEuUJJjsixji3H1Ms9of7JZD47kH8bJoOt2niw=";
+    hash = "sha256-c/zpPvPOlbZvmSGb+DqPV9HA+ic8/9TYv9MgI8d4Bgs=";
   };
 
-  cargoHash = "sha256-OJwyckBWBPBcQL3f0wTDrNeyhwEXCzQesEiwTxt9uco=";
+  cargoHash = "sha256-o6/ER521tpmn8hkMDEw1ykgYuFpG1DTkFbw95NGYqGo=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/gd/gdscript-formatter/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gdscript-formatter";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "GDQuest";
     repo = "GDScript-formatter";
     tag = finalAttrs.version;
-    hash = "sha256-16ASwYNnAtOVB0xxomjyuopya5rtmZriOE4H4W1v6nE=";
+    hash = "sha256-nnLVmd7wVHdDcAnyCHCVYckmbzMdSGIVL2iSgDC+9cs=";
     # Needed due to .gitattributes being used for the Godot addon and export-ignoring all files
     deepClone = true;
   };
 
-  cargoHash = "sha256-HWPSZFe78+NjIV79Un2e06S4AKpw1xJbJuX0fh1YJdo=";
+  cargoHash = "sha256-xqGmv/e1Ch/EqutIb2claiJ8fQGDDdOriOZdt8SR8mw=";
 
   cargoBuildFlags = [
     "--bin=gdscript-formatter"

pkgs/by-name/gr/graphite/package.nix

@@ -0,0 +1,220 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchurl,
+  fetchzip,
+  fetchNpmDeps,
+  symlinkJoin,
+  makeWrapper,
+  rustc,
+  cargo,
+  npmHooks,
+  writableTmpDirAsHomeHook,
+  lld,
+  binaryen,
+  wasm-pack,
+  cargo-about,
+  nodejs,
+  pkg-config,
+  wasm-bindgen-cli_0_2_100,
+  cef-binary,
+  wayland,
+  openssl,
+  vulkan-loader,
+  libGL,
+  libxkbcommon,
+  xorg,
+}:
+
+let
+  version = "0-unstable-2026-01-06";
+  rev = "e88db022afa0bae62e90ee834cc48eb3f32b6f52";
+
+  srcHash = "sha256-orVg/SPBjoBQ6HWcL4OPGT9H/ezRykvGd4CP2uf+6+Y=";
+  shaderHash = "sha256-uc6FU0df5Xqp6YXEwODULhgUjSQvjRFGvdk+uFB7II0=";
+  cargoHash = "sha256-sWVDd8i2gaDpO65tT8XRMvEQ39KNgGLqjM1Zw8QHaDU=";
+  npmHash = "sha256-D8VCNK+Ca3gxO+5wriBn8FszG8/x8n/zM6/MPo9E2j4=";
+
+  brandingRev = "f8b02e68c92f5bbd27626bdd7a51102303b70a40";
+  brandingHash = "sha256-Q/p04xtYjt8nEKEPcWRGjTvP54fAr3cLlEpZn61IGyQ=";
+
+  src = fetchFromGitHub {
+    owner = "GraphiteEditor";
+    repo = "Graphite";
+    inherit rev;
+    hash = srcHash;
+  };
+
+  shaders = fetchurl {
+    url = "https://raw.githubusercontent.com/timon-schelling/graphite-artifacts/refs/heads/main/rev/${rev}/raster_nodes_shaders_entrypoint.wgsl";
+    hash = shaderHash;
+  };
+
+  branding = fetchzip {
+    url = "https://github.com/Keavon/graphite-branded-assets/archive/${brandingRev}.tar.gz";
+    hash = brandingHash;
+  };
+
+  resources = stdenv.mkDerivation (finalAttrs: {
+    pname = "graphite-resources";
+    inherit version src;
+
+    cargoDeps = rustPlatform.fetchCargoVendor {
+      src = finalAttrs.src;
+      sourceRoot = finalAttrs.src.name;
+      hash = cargoHash;
+    };
+
+    npmDeps = fetchNpmDeps {
+      inherit (finalAttrs) pname version;
+      src = "${finalAttrs.src}/frontend";
+      hash = npmHash;
+    };
+
+    npmRoot = "frontend";
+    npmConfigScript = "setup";
+    makeCacheWritable = true;
+
+    nativeBuildInputs = [
+      rustPlatform.cargoSetupHook
+      rustc
+      cargo
+      npmHooks.npmConfigHook
+      lld
+      writableTmpDirAsHomeHook
+      binaryen
+      wasm-pack
+      nodejs
+      pkg-config
+      wasm-bindgen-cli_0_2_100
+      cargo-about
+      makeWrapper
+    ];
+
+    prePatch = ''
+      mkdir branding
+      cp -r ${branding}/* branding
+      cp $src/.branding branding/.branding
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      pushd frontend
+      npm run native:build-production
+      popd
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r frontend/dist/* $out/
+      runHook postInstall
+    '';
+  });
+
+  libraries = [
+    stdenv.cc.cc.lib
+    stdenv.cc.libc.out
+    vulkan-loader
+    libGL
+    wayland
+    openssl
+    libxkbcommon
+    xorg.libXcursor
+    xorg.libxcb
+    xorg.libX11
+  ];
+  cef = cef-binary.overrideAttrs {
+    postFixup = ''
+      strip $out/Release/*.so*
+    '';
+  };
+  cefPath = symlinkJoin {
+    name = "cef-path";
+    paths = [
+      "${cef}/Release"
+      "${cef}/Resources"
+    ];
+    postBuild = ''
+      ln -s ${cef}/include $out/include
+      echo '${
+        builtins.toJSON {
+          type = "minimal";
+          name = builtins.baseNameOf cef.src.url;
+          sha1 = "";
+        }
+      }' > $out/archive.json
+    '';
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "graphite";
+  inherit version src cargoHash;
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = libraries;
+
+  env.CEF_PATH = cefPath;
+  env.RASTER_NODES_SHADER_PATH = shaders;
+  env.EMBEDDED_RESOURCES = resources;
+  cargoBuildFlags = [
+    "-p"
+    "graphite-desktop"
+  ];
+
+  postUnpack = ''
+    mkdir ./branding
+    cp -r ${branding}/* ./branding
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    cp $src/desktop/assets/*.desktop $out/share/applications/
+
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp ${branding}/app-icons/graphite.svg $out/share/icons/hicolor/scalable/apps/art.graphite.Graphite.svg
+  '';
+
+  postFixup = ''
+    patchelf \
+      --set-rpath "${lib.makeLibraryPath libraries}:${cefPath}" \
+      --add-needed libGL.so \
+      $out/bin/graphite
+  '';
+
+  # There are currently no tests for the desktop application
+  doCheck = false;
+
+  meta = {
+    description = "Open source vector graphics editor and procedural design engine";
+    homepage = "https://graphite.art";
+    mainProgram = "graphite";
+    longDescription = ''
+      Graphite is an open source vector graphics editor and procedural design engine.
+      Create and animate with a nondestructive editing workflow that
+      combines layer-based compositing with node-based generative design.
+    '';
+
+    # All Graphite code is licensed under the Apache License 2.0.
+    # This derivation also bundles the official branding assets
+    # which are licensed under the separate Graphite Branding License.
+    license = with lib.licenses; [
+      asl20
+      {
+        fullName = "Graphite Branding License";
+        url = "https://graphite.art/license/#branding";
+        free = false;
+        redistributable = true;
+      }
+    ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ timon ];
+  };
+}

pkgs/by-name/hu/hunspell/dictionaries.nix

@@ -844,7 +844,12 @@ rec {
       license = with lib.licenses; [
         gpl3Plus
       ];
-      teams = [ lib.teams.uzinfocom ];
+      maintainers = with lib.maintainers; [
+        orzklv
+        shakhzodkudratov
+        bahrom04
+        bemeritus
+      ];
     };
   };
 

pkgs/by-name/in/intelli-shell/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "intelli-shell";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "lasantosr";
     repo = "intelli-shell";
     rev = "v${version}";
-    hash = "sha256-gahf7Ijaj2mf9cdE3C4IIyW5UJrs0IbOP3vado/0fXw=";
+    hash = "sha256-TrT2gMc23m4xZ/fxxHqEkGpq3VBeLfkPXC9H1sSSOaQ=";
   };
 
-  cargoHash = "sha256-skxgDsDicqkA92IaePwCndGuKHov4GNtwXkSbrDlG2A=";
+  cargoHash = "sha256-usALz3Wj3GyYjHjmEwFvjyDizXKQ66fkZ8Tb7GgT9BA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ip/ipxe/package.nix

@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-12-29";
+  version = "1.21.1-unstable-2026-01-10";
 
   nativeBuildInputs = [
     mtools
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "7c39c04a537ce29dccc6f2bae9749d1d371429c1";
-    hash = "sha256-tqOTv9f9teCQUgt52/cdAM9kE5678Bk9956cWDTDZAg=";
+    rev = "9c01c5a5dacb54167132d9a27259b23acdf091d6";
+    hash = "sha256-7Gsczc6jcUT0jDHNrgYWycqTs2/x3eqzbFwEwz8Z8kU=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/ka/kaidan/package.nix

@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaidan";
-  version = "0.13.0-unstable-2025-12-25";
+  version = "0.14.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
-    rev = "834d89c2115a48188e827089db05a88db5dc1f8f";
-    hash = "sha256-o7x6Ib9zL4akzjvz+mSACQHyj2xH6RzoCniumNjK1lw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lKJU8GIkubHLYsP7r+TA+1rg+TMGONwjEcys19f62/w=";
   };
 
   patches = [
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  passthru.updateScript = nix-update-script { };
   passthru.tests.kaidan = nixosTests.kaidan;
 
   meta = {

pkgs/by-name/ki/kikit/default.nix

@@ -5,7 +5,6 @@
   fetchFromGitHub,
   bats,
   buildPythonApplication,
-  pythonOlder,
   callPackage,
   kicad,
   numpy,
@@ -30,8 +29,6 @@ buildPythonApplication rec {
   version = "1.7.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "yaqwsx";
     repo = "KiKit";

pkgs/by-name/ku/kurve/package.nix

@@ -13,14 +13,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kurve";
-  version = "2.2.0";
+  version = "3.4.0";
   dontWrapQtApps = true;
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "kurve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TWNgQUgjrlzQs+cjzfoD13dHG3M93Akxyg5VNB9Rp9E=";
+    hash = "sha256-yLe8K4DbVqOKunWNxLXdvjBtJBj87NJtSw9Dul0CrMg=";
   };
 
   installPhase = ''

pkgs/by-name/le/lego/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "4.29.0";
+  version = "4.31.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = "lego";
     tag = "v${version}";
-    hash = "sha256-czCOrgC3Xy42KigAe+tsPRdWqxgdHFl0KN3Ei2zeyy8=";
+    hash = "sha256-YzslAEZVJDAa8Q7/YTWb2pH0MiWwgHipL11A/UD+nYg=";
   };
 
-  vendorHash = "sha256-OnCtobizqDrqZTQenRPBTlUHvNx/xX34PYw8K4rgxSk=";
+  vendorHash = "sha256-9ead3yA/fvNRP4uP2O6Wy6aRzVAig3iyin8UgMcA8mc=";
 
   doCheck = false;
 

pkgs/by-name/li/libmediainfo/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmediainfo";
-  version = "25.09";
+  version = "25.10";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-hWLo6gPir4veJ/ZteaD1c4WbjxMZPsEVq/EPc1sxOhI=";
+    hash = "sha256-rRPZeXsEbOOdDGWm+B0q7yQpc0whhlpqTFksfAHySd0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/librecad/package.nix

@@ -7,17 +7,18 @@
   muparser,
   pkg-config,
   qt5,
+  xcbuild,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librecad";
-  version = "2.2.1.2";
+  version = "2.2.1.3";
 
   src = fetchFromGitHub {
     owner = "LibreCAD";
     repo = "LibreCAD";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a/0prti7aFIzoHXyd6NsiKx4ugW/vRXURAHBrAqyp84=";
+    hash = "sha256-s9QA0YC91aziFxgnSeH4+XtQu18cSiRc0B15tyyF8b0=";
   };
 
   buildInputs = [
@@ -33,6 +34,9 @@ stdenv.mkDerivation (finalAttrs: {
     qt5.qmake
     qt5.qttools
     qt5.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
   ];
 
   qmakeFlags = [
@@ -45,7 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-warn __DATE__ 0
 
     substituteInPlace librecad/src/src.pro \
-      --replace-warn '$$[QT_INSTALL_BINS]' '${lib.getDev qt5.qttools}/bin'
+      --replace-warn '$$[QT_INSTALL_BINS]' '${lib.getDev qt5.qttools}/bin' \
+      --replace-warn '/usr/libexec/PlistBuddy' 'PlistBuddy'
     substituteInPlace librecad/src/muparser.pri \
       --replace-warn "macx|" ""
   '';

pkgs/by-name/li/libretro-shaders-slang/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-01-02";
+  version = "0-unstable-2026-01-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "bb2899e53c3d785efceae56be38503d1bcbe6359";
-    hash = "sha256-Ed3E4pMtw90iYwNVN/QOA7ICL1yAkGRPQOCGei2+BIQ=";
+    rev = "c2f3c5b0ce8c5e7e3ed9d885a924f85712cb38a0";
+    hash = "sha256-tQ/eUFNlzKYaP6eDiykCtooccEa2YP++iFXKSUVgwcw=";
   };
 
   dontConfigure = true;