From e6d4e167569fb2350809bc04a18b3bd20df216bf Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Wed, 7 Jan 2026 19:03:26 +0400
Subject: [PATCH 01/28] ossim: init at 2.12.0

---
 pkgs/by-name/os/ossim/package.nix | 80 +++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 pkgs/by-name/os/ossim/package.nix

diff --git a/pkgs/by-name/os/ossim/package.nix b/pkgs/by-name/os/ossim/package.nix
new file mode 100644
index 000000000000..961515c2bff7
--- /dev/null
+++ b/pkgs/by-name/os/ossim/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  makeWrapper,
+  curl,
+  freetype,
+  geos,
+  jsoncpp,
+  libgeotiff,
+  libjpeg,
+  libtiff,
+  proj,
+  sqlite,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ossim";
+  version = "2.12.0";
+
+  src = fetchFromGitHub {
+    owner = "ossimlabs";
+    repo = "ossim";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nVQN+XnCYpVQSkgKsolqbR3KtPGTkvpym4cDl7IqjUc=";
+  };
+
+  patches = [
+    # Fixed build error gcc version 15.0.1
+    (fetchpatch {
+      url = "https://github.com/ossimlabs/ossim/commit/13b9fa9ae54f79a7e7728408de6246e00d38f399.patch";
+      hash = "sha256-AKzOT+JurB/54gvzn2a5amw+uIupaNxssnEhc8CSfPM=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'GET_GIT_REVISION()' "" \
+      --replace-fail 'OSSIM_GIT_REVISION_NUMBER "UNKNOWN"' 'OSSIM_GIT_REVISION_NUMBER "${finalAttrs.version}"'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+
+  buildInputs = [
+    curl
+    freetype
+    geos
+    jsoncpp
+    libgeotiff
+    libjpeg
+    libtiff
+    proj
+    sqlite
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_OSSIM_TESTS" false)
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
+  ];
+
+  postInstall = ''
+    for binary in $out/bin/ossim-*; do
+      wrapProgram $binary \
+        --prefix LD_LIBRARY_PATH ":" $out/lib
+    done
+  '';
+
+  meta = {
+    description = "Open Source Software Image Map library";
+    homepage = "https://github.com/ossimlabs/ossim";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.geospatial ];
+    platforms = lib.platforms.unix;
+  };
+})

From f854b9a0553ac0f13e9ea5f04db9a6763eec4570 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Thu, 15 Jan 2026 10:41:22 -0500
Subject: [PATCH 02/28] omnom: add changelog, downloadPage

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/om/omnom/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/om/omnom/package.nix b/pkgs/by-name/om/omnom/package.nix
index 77df852fc292..11cb12a4f0c1 100644
--- a/pkgs/by-name/om/omnom/package.nix
+++ b/pkgs/by-name/om/omnom/package.nix
@@ -85,7 +85,9 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Webpage bookmarking and snapshotting service";
-    homepage = "https://github.com/asciimoo/omnom";
+    homepage = "https://omnom.zone/";
+    downloadPage = "https://github.com/asciimoo/omnom";
+    changelog = "https://github.com/asciimoo/omnom/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     teams = [ lib.teams.ngi ];
     mainProgram = "omnom";

From 013a105c8318ba769c3e3eb2fad5a92925da03ba Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Thu, 15 Jan 2026 10:36:58 -0500
Subject: [PATCH 03/28] omnom: 0.7.0 -> 0.8.0

Changelog: https://github.com/asciimoo/omnom/releases/tag/v0.8.0

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/om/omnom/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/om/omnom/package.nix b/pkgs/by-name/om/omnom/package.nix
index 11cb12a4f0c1..633ed7189977 100644
--- a/pkgs/by-name/om/omnom/package.nix
+++ b/pkgs/by-name/om/omnom/package.nix
@@ -13,17 +13,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "omnom";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "asciimoo";
     repo = "omnom";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-auujlRG3RKJYYTi/iptx0Y3Yzqmt6i9AlfjVcqn5YPc=";
+    hash = "sha256-Txqla3fivQdM8oQYGlyaYhSQhBLJRykWkftdmkHxlu8=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-0usbfvGz+9chLGyHHUUStUh7x91ZGfr/+gAXXVA5iNc=";
+  vendorHash = "sha256-meToyr93nmKLZ//h8Gc0rp2hc4vOV9ULU+FbBXmbDv8=";
 
   passthru.updateScript = nix-update-script { };
 
@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {
       pname = "omnom-addons";
       inherit (finalAttrs) version src;
 
-      npmDepsHash = "sha256-sUn5IvcHWJ/yaqeGz9SGvGx9HHAlrcnS0lJxIxUVS6M=";
+      npmDepsHash = "sha256-CIzp6/mBTuSaEFv0lk3d/GZyq1VRDvCSoqrujz4AG/E=";
       sourceRoot = "${finalAttrs'.src.name}/ext";
       npmPackFlags = [ "--ignore-scripts" ];
 

From 47b4216f78242cdc93c225cb7bd7f03528ca5997 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 28 Jan 2026 10:26:28 +0100
Subject: [PATCH 04/28] omnom: 0.8.0 -> 0.9.0

Changelog: https://github.com/asciimoo/omnom/releases/tag/v0.9.0
---
 pkgs/by-name/om/omnom/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/om/omnom/package.nix b/pkgs/by-name/om/omnom/package.nix
index 633ed7189977..bd2ff886101f 100644
--- a/pkgs/by-name/om/omnom/package.nix
+++ b/pkgs/by-name/om/omnom/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "omnom";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "asciimoo";
     repo = "omnom";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Txqla3fivQdM8oQYGlyaYhSQhBLJRykWkftdmkHxlu8=";
+    hash = "sha256-cG+cAsarbDqi3BLrIiSnH4VQS0fdfyMgkvbQvzKUXNw=";
     fetchSubmodules = true;
   };
 

From a94e91b5513a4e078d977654d96ef156b73c6c9c Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 28 Jan 2026 10:24:00 +0100
Subject: [PATCH 05/28] nixos/modules: add option for omnom's base_url setting

which became mandatory starting from version `0.8.0`.
---
 nixos/modules/services/misc/omnom.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/services/misc/omnom.nix b/nixos/modules/services/misc/omnom.nix
index 6e157ca3b014..48d7a326d3ac 100644
--- a/nixos/modules/services/misc/omnom.nix
+++ b/nixos/modules/services/misc/omnom.nix
@@ -92,6 +92,18 @@ in
                   "127.0.0.1:''${config.services.omnom.port}"
                 '';
               };
+              # NOTE: this can't be empty, because it will be overwritten by
+              # Omnom's internal default config.
+              base_url = lib.mkOption {
+                type = lib.types.str;
+                internal = true;
+                default = "http://127.0.0.1:${toString cfg.port}/";
+                description = "Full server URL.";
+                example = "https://local.omnom/xy/";
+                defaultText = lib.literalExpression ''
+                  "http://''${config.services.omnom.settings.server.address}/"
+                '';
+              };
               secure_cookie = lib.mkOption {
                 type = lib.types.bool;
                 default = true;

From cfc02bae23b2bc2bdc30d9c26c7695fbf2ad6d0d Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 28 Jan 2026 14:56:47 +0100
Subject: [PATCH 06/28] nixos/tests: fix omnom xdotool coordinates

---
 nixos/tests/omnom/default.nix | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/nixos/tests/omnom/default.nix b/nixos/tests/omnom/default.nix
index 6f115037aca5..c90e6cfff595 100644
--- a/nixos/tests/omnom/default.nix
+++ b/nixos/tests/omnom/default.nix
@@ -28,18 +28,18 @@
 
       def open_omnom():
         # Add-ons Manager
-        server.succeed("xdotool mousemove --sync 960 90 click 1")
+        server.succeed("xdotool mousemove --sync 1221 83 click 1")
         server.sleep(10)
         # omnom
-        server.succeed("xdotool mousemove --sync 700 190 click 1")
+        server.succeed("xdotool mousemove --sync 877 184 click 1")
         server.sleep(10)
 
 
-      service_url = "http://127.0.0.1:${toString port}"
+      service_url = "http://127.0.0.1:${port}/"
 
       server.start()
       server.wait_for_unit("omnom.service")
-      server.wait_for_open_port(${toString port})
+      server.wait_for_open_port(${port})
       server.succeed(f"curl -sf '{service_url}'")
 
       output = server.succeed("omnom create-user user user@example.com")
@@ -59,23 +59,23 @@
       open_omnom()
 
       # token
-      server.succeed("xdotool mousemove --sync 700 350 click 1")
+      server.succeed("xdotool mousemove --sync 943 345 click 1")
       server.succeed(f"xdotool type {token}")
       server.sleep(10)
 
       # url
-      server.succeed("xdotool mousemove --sync 700 470 click 1")
+      server.succeed("xdotool mousemove --sync 943 452 click 1")
       server.succeed(f"xdotool type '{service_url}'")
       server.sleep(10)
 
       # submit
-      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.succeed("xdotool mousemove --sync 1156 485 click 1")
       server.sleep(10)
 
       open_omnom()
 
       # save
-      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.succeed("xdotool mousemove --sync 1151 459 click 1")
       server.sleep(10)
 
       # refresh
@@ -85,19 +85,19 @@
       server.screenshot("home.png")
 
       # view bookmarks
-      server.succeed("xdotool mousemove --sync 300 130 click 1")
+      server.succeed("xdotool mousemove --sync 377 133 click 1")
       server.sleep(10)
 
       # view snapshot
-      server.succeed("xdotool mousemove --sync 970 230 click 1")
+      server.succeed("xdotool mousemove --sync 414 307 click 1")
       server.sleep(10)
-      server.succeed("xdotool mousemove --sync 160 340 click 1")
+      server.succeed("xdotool mousemove --sync 993 510 click 1")
       server.sleep(10)
 
       server.screenshot("screenshot.png")
 
       # view details
-      server.succeed("xdotool mousemove --sync 290 200 click 1")
+      server.succeed("xdotool mousemove --sync 400 230 click 1")
       server.sleep(10)
 
       server.screenshot("snapshot_details.png")

From dbc4a70daa7ea4755493db7a7d60b929fb3dca7b Mon Sep 17 00:00:00 2001
From: Justin Restivo <justin@restivo.me>
Date: Sat, 3 Jan 2026 22:48:43 -0500
Subject: [PATCH 07/28] zipperposition: init at 2.1-unstable-2024-02-08

---
 pkgs/by-name/zi/zipperposition/package.nix | 66 ++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 pkgs/by-name/zi/zipperposition/package.nix

diff --git a/pkgs/by-name/zi/zipperposition/package.nix b/pkgs/by-name/zi/zipperposition/package.nix
new file mode 100644
index 000000000000..7096bead775e
--- /dev/null
+++ b/pkgs/by-name/zi/zipperposition/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  fetchFromGitHub,
+  ocamlPackages,
+}:
+
+ocamlPackages.buildDunePackage {
+  pname = "zipperposition";
+  version = "2.1-unstable-2024-02-08";
+
+  src = fetchFromGitHub {
+    owner = "sneeuwballen";
+    repo = "zipperposition";
+    rev = "050072e01d8539f9126993482b595e09f921f66a";
+    hash = "sha256-GoZO2hRZgh1qydlR+Uq4TprcPG9s7ge1N0Z2ilQ5x/w=";
+  };
+
+  nativeBuildInputs = with ocamlPackages; [
+    menhir
+  ];
+
+  propagatedBuildInputs = with ocamlPackages; [
+    zarith
+    containers
+    containers-data
+    msat
+    iter
+    mtime
+    oseq
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    dune build -p logtk,libzipperposition,zipperposition,zipperposition-tools ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR logtk libzipperposition zipperposition zipperposition-tools
+    runHook postInstall
+  '';
+
+  doCheck = true;
+
+  checkInputs = with ocamlPackages; [
+    alcotest
+    qcheck-core
+    qcheck-alcotest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    dune runtest -p logtk,libzipperposition,zipperposition,zipperposition-tools ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Superposition prover for full first order logic";
+    homepage = "https://github.com/sneeuwballen/zipperposition";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.DieracDelta ];
+    mainProgram = "zipperposition";
+    platforms = lib.platforms.all;
+  };
+}

From 3f656ac643696dc3af7a550e829da46193f594f1 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 9 Feb 2026 06:53:56 +0100
Subject: [PATCH 08/28] =?UTF-8?q?ocamlPackages.jingoo:=201.4.4=20=E2=86=92?=
 =?UTF-8?q?=201.5.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/jingoo/default.nix | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/ocaml-modules/jingoo/default.nix b/pkgs/development/ocaml-modules/jingoo/default.nix
index ac56e2b44bb0..fdf296aa94b2 100644
--- a/pkgs/development/ocaml-modules/jingoo/default.nix
+++ b/pkgs/development/ocaml-modules/jingoo/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildDunePackage,
   fetchFromGitHub,
-  ocaml,
   menhir,
   ppxlib,
   ppx_deriving,
@@ -12,17 +11,15 @@
   ounit2,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "jingoo";
-  version = "1.4.4";
-
-  minimalOCamlVersion = "4.05";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "tategakibunko";
     repo = "jingoo";
-    rev = "v${version}";
-    sha256 = "sha256-qIw69OE7wYyZYKnIc9QrmF8MzY5Fg5pBFyIpexmaYxA=";
+    tag = finalAttrs.version;
+    hash = "sha256-1357XOYZseItCrIm/qNP46aL8tQyX8CFh77CBycL1ew=";
   };
 
   nativeBuildInputs = [ menhir ];
@@ -34,7 +31,7 @@ buildDunePackage rec {
     uucp
   ];
   checkInputs = [ ounit2 ];
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = {
     homepage = "https://github.com/tategakibunko/jingoo";
@@ -43,4 +40,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ericbmerritt ];
   };
-}
+})

From da16f44b1268fa0157f4cc16633efa899029b009 Mon Sep 17 00:00:00 2001
From: Moraxyc <i@qaq.li>
Date: Wed, 11 Feb 2026 10:51:43 +0800
Subject: [PATCH 09/28] hmcl: 3.10.2 -> 3.10.3

Diff: https://github.com/HMCL-dev/HMCL/compare/v3.10.2...v3.10.3

Changelog: https://docs.hmcl.net/changelog/stable.html
---
 pkgs/by-name/hm/hmcl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 1679c8df3e08..e239b24c6f27 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.10.2";
+  version = "3.10.3";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-tmQN0kSjm8oU36ENHhgA649IohdG4ZDHyEaMPscd3nQ=";
+    hash = "sha256-+xxDACa2ECbWaCUzK0b/rcRS49Hex4GZDcNNK/aEURs=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for

From da17580c63722d4349a60815a42adfd1867e5115 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 12 Feb 2026 04:50:35 +0000
Subject: [PATCH 10/28] postgresqlPackages.postgis: 3.6.1 -> 3.6.2

---
 pkgs/servers/sql/postgresql/ext/postgis.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 69f78ce536fb..8d5239aee2fa 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -35,7 +35,7 @@ let
 in
 postgresqlBuildExtension (finalAttrs: {
   pname = "postgis";
-  version = "3.6.1";
+  version = "3.6.2";
 
   outputs = [
     "out"
@@ -46,7 +46,7 @@ postgresqlBuildExtension (finalAttrs: {
     owner = "postgis";
     repo = "postgis";
     tag = finalAttrs.version;
-    hash = "sha256-WVS2TWKishTnCWJ87Vvdcb0i3VR+g/qSjcTDO1cx1s0=";
+    hash = "sha256-zdwfk2cWUF3l6Rao3kzXdMWFs12F5545Dxkjd/DyPcQ=";
   };
 
   buildInputs = [

From a28722247c2e036bd2b642cd14573eb5e90b198b Mon Sep 17 00:00:00 2001
From: Yujonpradhananga <yujonpradhan123@gmail.com>
Date: Sat, 14 Feb 2026 11:08:04 +0545
Subject: [PATCH 11/28] maintainers: add yujonpradhananga

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 38c0a30d311a..08e32b27f969 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -29382,6 +29382,12 @@
     githubId = 8006928;
     name = "Yuannan (Brandon) Lin";
   };
+  yujonpradhananga = {
+    email = "yujonpradhan123@gmail.com";
+    github = "Yujonpradhananga";
+    githubId = 139200034;
+    name = "Yujon Pradhananga";
+  };
   yuka = {
     email = "yuka@yuka.dev";
     matrix = "@yuka:yuka.dev";

From 065f20904fee4ee00f59b2738e2a7b32505e1c40 Mon Sep 17 00:00:00 2001
From: Yujonpradhananga <yujonpradhan123@gmail.com>
Date: Sat, 14 Feb 2026 11:09:23 +0545
Subject: [PATCH 12/28] lnreader: init at 1.0

---
 pkgs/by-name/ln/lnreader/package.nix | 43 ++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/ln/lnreader/package.nix

diff --git a/pkgs/by-name/ln/lnreader/package.nix b/pkgs/by-name/ln/lnreader/package.nix
new file mode 100644
index 000000000000..06cf04be4fb1
--- /dev/null
+++ b/pkgs/by-name/ln/lnreader/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  mupdf,
+  pkg-config,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "lnreader";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "Yujonpradhananga";
+    repo = "CLI-PDF-EPUB-reader";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-JeVS0wnShlD4+UfnMsuHMYi6R7pse4Gvh0PdREwmG6k=";
+  };
+
+  vendorHash = "sha256-66rqTJeV6u4aVciifp41n2onx81w9KE0PGYHlVwsl54=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    mupdf
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Lightweight, fast and responsive terminal PDF/EPUB viewer with image support";
+    homepage = "https://github.com/Yujonpradhananga/CLI-PDF-EPUB-reader";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ yujonpradhananga ];
+    mainProgram = "lnreader";
+    platforms = lib.platforms.unix;
+  };
+})

From 01caeac2e39743ce22c66a3afcf0b49611f5a3ee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 14 Feb 2026 16:09:06 +0000
Subject: [PATCH 13/28] pkgsite: 0-unstable-2026-02-06 -> 0-unstable-2026-02-12

---
 pkgs/by-name/pk/pkgsite/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index 491be34eebc4..0c85d00ab733 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2026-02-06";
+  version = "0-unstable-2026-02-12";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "2a8da3345a36148f4dca0cfb2b99cbe84ba9a50b";
-    hash = "sha256-693eUnNtuagCwfXq+FYAVHHHgHDT0CDXu7kaYK2ru9Q=";
+    rev = "ce44214c045bc223217f4e969a2b2d3f249b7c21";
+    hash = "sha256-8GPeedY0CKjJ/HJmRZj91FIVuMPNmEKamWnKV6hFrk8=";
   };
 
-  vendorHash = "sha256-udLOOjBMLZ38jrX/7r+hmiUr/k6gxU0Sypo6S0ezep0=";
+  vendorHash = "sha256-G/XTWobysyzONctabYDIfAQ/zaAA9w2Ky7Hn6cj9l/c=";
 
   subPackages = [ "cmd/pkgsite" ];
 

From 36d0736c908d8d33e32375faebc8bcf5c3676cf1 Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Sun, 15 Feb 2026 18:27:13 +1100
Subject: [PATCH 14/28] xen: rollback minimum supported version to 4.17

The Xen Project has decided to support verison 4.17 of the hypervisor once more, as all Xen versions will now be supported for five years after release.

https://lists.xenproject.org/archives/html/xen-devel/2026-02/msg00630.html

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/xe/xen/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 934a9af7caa7..08e60651d81c 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -89,7 +89,7 @@ let
     ;
 
   # Mark versions older than minSupportedVersion as EOL.
-  minSupportedVersion = "4.18";
+  minSupportedVersion = "4.17";
 
   scriptDeps =
     let

From 48a4d43c3aadaf9cbdc5d1c3ff84d566b6147917 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 15 Feb 2026 14:12:46 +0100
Subject: [PATCH 15/28] ncps: add update script

---
 pkgs/by-name/nc/ncps/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index 3b4ca8918f1f..4b44ae3ff073 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -13,6 +13,7 @@
   python3,
   redis,
   writeShellScriptBin,
+  nix-update-script,
 }:
 
 let
@@ -94,6 +95,10 @@ let
       source $src/nix/packages/ncps/pre-check-redis.sh
     '';
 
+    passthru = {
+      updateScript = nix-update-script { };
+    };
+
     meta = {
       description = "Nix binary cache proxy service";
       homepage = "https://github.com/kalbasit/ncps";

From e4cb026384ab34e539f5a94973a87369f41fee37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 15 Feb 2026 13:13:24 +0000
Subject: [PATCH 16/28] ncps: 0.8.4 -> 0.8.5

---
 pkgs/by-name/nc/ncps/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index 4b44ae3ff073..2df3f7148bb8 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -34,13 +34,13 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.8.4";
+    version = "0.8.5";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-GJnWVhn8SZY5IJbBSuq1j8qV06/kdHhcVu6QhnTsk0Y=";
+      hash = "sha256-0kQ2DTnBil7eSP/eSwLVqw/UyIwBMFtmKAeLCi64Fr8=";
     };
 
     vendorHash = "sha256-AcgC+zTS3eVsbcs0jim4zDBGc3lIjwPbdVT7/KQ9Lkc=";

From 2951072c8c57190d11447084d6792a1fe88e66a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 15 Feb 2026 14:27:30 +0100
Subject: [PATCH 17/28] ncps: move dbmate-wrapped into passthru

---
 pkgs/by-name/nc/ncps/package.nix | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index 2df3f7148bb8..c364f89ddd84 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -21,17 +21,6 @@ let
     exec ${dbmate}/bin/dbmate "$@"
   '';
 
-  dbmate-wrapper = buildGoModule {
-    pname = "ncps-dbmate-wrapper";
-    inherit (finalAttrs) version;
-
-    src = "${finalAttrs.src}/nix/dbmate-wrapper/src";
-
-    vendorHash = null;
-
-    subPackages = [ "." ];
-  };
-
   finalAttrs = {
     pname = "ncps";
     version = "0.8.5";
@@ -68,7 +57,7 @@ let
       mkdir -p $out/share/ncps
       cp -r db $out/share/ncps/db
 
-      makeWrapper ${dbmate-wrapper}/bin/dbmate-wrapper \
+      makeWrapper ${finalAttrs.passthru.dbmate-wrapper}/bin/dbmate-wrapper \
         $out/bin/dbmate-ncps \
         --prefix PATH : ${dbmate-real}/bin \
         --set NCPS_DB_MIGRATIONS_DIR $out/share/ncps/db/migrations
@@ -96,6 +85,17 @@ let
     '';
 
     passthru = {
+      dbmate-wrapper = buildGoModule {
+        pname = "ncps-dbmate-wrapper";
+        inherit (finalAttrs) version;
+
+        src = "${finalAttrs.src}/nix/dbmate-wrapper/src";
+
+        vendorHash = null;
+
+        subPackages = [ "." ];
+      };
+
       updateScript = nix-update-script { };
     };
 

From c0ef87b7042a2839ba6bd3652bd94b1d4e17e272 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 15 Feb 2026 14:32:22 +0100
Subject: [PATCH 18/28] ncps: use standard finalAttrs pattern

---
 pkgs/by-name/nc/ncps/package.nix | 180 +++++++++++++++----------------
 1 file changed, 89 insertions(+), 91 deletions(-)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index c364f89ddd84..c258b2dcb0e3 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -20,95 +20,93 @@ let
   dbmate-real = writeShellScriptBin "dbmate.real" ''
     exec ${dbmate}/bin/dbmate "$@"
   '';
-
-  finalAttrs = {
-    pname = "ncps";
-    version = "0.8.5";
-
-    src = fetchFromGitHub {
-      owner = "kalbasit";
-      repo = "ncps";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-0kQ2DTnBil7eSP/eSwLVqw/UyIwBMFtmKAeLCi64Fr8=";
-    };
-
-    vendorHash = "sha256-AcgC+zTS3eVsbcs0jim4zDBGc3lIjwPbdVT7/KQ9Lkc=";
-
-    ldflags = [
-      "-X github.com/kalbasit/ncps/pkg/ncps.Version=v${finalAttrs.version}"
-    ];
-
-    subPackages = [ "." ];
-
-    nativeBuildInputs = [
-      curl # used for checking MinIO health check
-      dbmate # used for testing
-      jq # used for testing by the init-minio
-      mariadb # MySQL/MariaDB for integration tests
-      minio # S3-compatible storage for integration tests
-      minio-client # mc CLI for MinIO setup
-      postgresql # PostgreSQL for integration tests
-      python3 # used for generating the ports
-      redis # Redis for distributed locking integration tests
-      makeWrapper # For wrapping dbmate.
-    ];
-
-    postInstall = ''
-      mkdir -p $out/share/ncps
-      cp -r db $out/share/ncps/db
-
-      makeWrapper ${finalAttrs.passthru.dbmate-wrapper}/bin/dbmate-wrapper \
-        $out/bin/dbmate-ncps \
-        --prefix PATH : ${dbmate-real}/bin \
-        --set NCPS_DB_MIGRATIONS_DIR $out/share/ncps/db/migrations
-    '';
-
-    doCheck = true;
-
-    checkFlags = [ "-race" ];
-
-    # pre and post checks
-    preCheck = ''
-      # Set up cleanup trap to ensure background processes are killed even if tests fail
-      cleanup() {
-        source $src/nix/packages/ncps/post-check-minio.sh
-        source $src/nix/packages/ncps/post-check-mysql.sh
-        source $src/nix/packages/ncps/post-check-postgres.sh
-        source $src/nix/packages/ncps/post-check-redis.sh
-      }
-      trap cleanup EXIT
-
-      source $src/nix/packages/ncps/pre-check-minio.sh
-      source $src/nix/packages/ncps/pre-check-mysql.sh
-      source $src/nix/packages/ncps/pre-check-postgres.sh
-      source $src/nix/packages/ncps/pre-check-redis.sh
-    '';
-
-    passthru = {
-      dbmate-wrapper = buildGoModule {
-        pname = "ncps-dbmate-wrapper";
-        inherit (finalAttrs) version;
-
-        src = "${finalAttrs.src}/nix/dbmate-wrapper/src";
-
-        vendorHash = null;
-
-        subPackages = [ "." ];
-      };
-
-      updateScript = nix-update-script { };
-    };
-
-    meta = {
-      description = "Nix binary cache proxy service";
-      homepage = "https://github.com/kalbasit/ncps";
-      license = lib.licenses.mit;
-      mainProgram = "ncps";
-      maintainers = with lib.maintainers; [
-        kalbasit
-        aciceri
-      ];
-    };
-  };
 in
-buildGoModule finalAttrs
+buildGoModule (finalAttrs: {
+  pname = "ncps";
+  version = "0.8.5";
+
+  src = fetchFromGitHub {
+    owner = "kalbasit";
+    repo = "ncps";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0kQ2DTnBil7eSP/eSwLVqw/UyIwBMFtmKAeLCi64Fr8=";
+  };
+
+  vendorHash = "sha256-AcgC+zTS3eVsbcs0jim4zDBGc3lIjwPbdVT7/KQ9Lkc=";
+
+  ldflags = [
+    "-X github.com/kalbasit/ncps/pkg/ncps.Version=v${finalAttrs.version}"
+  ];
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    curl # used for checking MinIO health check
+    dbmate # used for testing
+    jq # used for testing by the init-minio
+    mariadb # MySQL/MariaDB for integration tests
+    minio # S3-compatible storage for integration tests
+    minio-client # mc CLI for MinIO setup
+    postgresql # PostgreSQL for integration tests
+    python3 # used for generating the ports
+    redis # Redis for distributed locking integration tests
+    makeWrapper # For wrapping dbmate.
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/ncps
+    cp -r db $out/share/ncps/db
+
+    makeWrapper ${finalAttrs.passthru.dbmate-wrapper}/bin/dbmate-wrapper \
+      $out/bin/dbmate-ncps \
+      --prefix PATH : ${dbmate-real}/bin \
+      --set NCPS_DB_MIGRATIONS_DIR $out/share/ncps/db/migrations
+  '';
+
+  doCheck = true;
+
+  checkFlags = [ "-race" ];
+
+  # pre and post checks
+  preCheck = ''
+    # Set up cleanup trap to ensure background processes are killed even if tests fail
+    cleanup() {
+      source $src/nix/packages/ncps/post-check-minio.sh
+      source $src/nix/packages/ncps/post-check-mysql.sh
+      source $src/nix/packages/ncps/post-check-postgres.sh
+      source $src/nix/packages/ncps/post-check-redis.sh
+    }
+    trap cleanup EXIT
+
+    source $src/nix/packages/ncps/pre-check-minio.sh
+    source $src/nix/packages/ncps/pre-check-mysql.sh
+    source $src/nix/packages/ncps/pre-check-postgres.sh
+    source $src/nix/packages/ncps/pre-check-redis.sh
+  '';
+
+  passthru = {
+    dbmate-wrapper = buildGoModule {
+      pname = "ncps-dbmate-wrapper";
+      inherit (finalAttrs) version;
+
+      src = "${finalAttrs.src}/nix/dbmate-wrapper/src";
+
+      vendorHash = null;
+
+      subPackages = [ "." ];
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Nix binary cache proxy service";
+    homepage = "https://github.com/kalbasit/ncps";
+    license = lib.licenses.mit;
+    mainProgram = "ncps";
+    maintainers = with lib.maintainers; [
+      kalbasit
+      aciceri
+    ];
+  };
+})

From fba69cbec5393f188b7c2b4cf3e5802a9858c29b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 15 Feb 2026 14:35:48 +0100
Subject: [PATCH 19/28] ncps: reference existing NixOS tests

---
 pkgs/by-name/nc/ncps/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index c258b2dcb0e3..99734c0b3bb3 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -13,6 +13,7 @@
   python3,
   redis,
   writeShellScriptBin,
+  nixosTests,
   nix-update-script,
 }:
 
@@ -96,6 +97,16 @@ buildGoModule (finalAttrs: {
       subPackages = [ "." ];
     };
 
+    tests = {
+      inherit (nixosTests)
+        ncps
+        ncps-custom-sqlite-directory
+        ncps-custom-storage-local
+        ncps-ha-pg
+        ncps-ha-pg-redis
+        ;
+    };
+
     updateScript = nix-update-script { };
   };
 

From 696ede1b432f77abf54f9c1a79663a3e5cc58cb7 Mon Sep 17 00:00:00 2001
From: Daniel Nagy <danielnagy@posteo.de>
Date: Sat, 22 Feb 2025 13:00:00 +0100
Subject: [PATCH 20/28] nixos/starship: skip one program invocation on each
 shell init

The code that is being evaled without the `--print-full-init` flag is
this:

```
eval -- "$(/nix/store/...-starship-1.24.2/bin/starship init bash --print-full-init)"
```

We can skip one program invocation and directly call `starship init
bash --print-full-init`.

This is a replication of my other PR in home-manager:

- https://github.com/nix-community/home-manager/pull/2862
---
 nixos/modules/programs/starship.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/programs/starship.nix b/nixos/modules/programs/starship.nix
index a8941ce7a18f..1a10b0a8780f 100644
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@@ -118,7 +118,7 @@ in
         if [[ ! -f "$HOME/.config/starship.toml" ]]; then
           export STARSHIP_CONFIG=${settingsFile}
         fi
-        eval "$(${cfg.package}/bin/starship init bash)"
+        eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
       fi
     '';
 

From 0aecf39750f28fce101a845ba67f687cff0f3122 Mon Sep 17 00:00:00 2001
From: Diego <diego@strebel.com>
Date: Sat, 14 Feb 2026 15:24:42 +0100
Subject: [PATCH 21/28] bear: 3.1.6 -> 4.0.3

---
 .../be/bear/0001-exclude-tests-from-all.patch |  23 ----
 pkgs/by-name/be/bear/package.nix              | 109 ++++--------------
 2 files changed, 21 insertions(+), 111 deletions(-)
 delete mode 100644 pkgs/by-name/be/bear/0001-exclude-tests-from-all.patch

diff --git a/pkgs/by-name/be/bear/0001-exclude-tests-from-all.patch b/pkgs/by-name/be/bear/0001-exclude-tests-from-all.patch
deleted file mode 100644
index 4a72bb41bbed..000000000000
--- a/pkgs/by-name/be/bear/0001-exclude-tests-from-all.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -85,8 +85,9 @@
-             ${CMAKE_CACHE_ARGS_EXTRA}
-         BUILD_ALWAYS
-             1
--        TEST_BEFORE_INSTALL
-+        TEST_EXCLUDE_FROM_MAIN
-             1
-+        STEP_TARGETS test
-         TEST_COMMAND
-             ctest # or `ctest -T memcheck`
-         )
-@@ -102,7 +103,8 @@
-                 -DCMAKE_INSTALL_LIBDIR:PATH=${CMAKE_INSTALL_LIBDIR}
-                 -DCMAKE_INSTALL_BINDIR:PATH=${CMAKE_INSTALL_BINDIR}
-                 -DSTAGED_INSTALL_PREFIX:PATH=${STAGED_INSTALL_PREFIX}
--            TEST_BEFORE_INSTALL
-+            TEST_EXCLUDE_FROM_MAIN
-+            STEP_TARGETS test
-                 1
-             INSTALL_COMMAND
-                 ""
diff --git a/pkgs/by-name/be/bear/package.nix b/pkgs/by-name/be/bear/package.nix
index 5ace2224e728..ea69998aa5c3 100644
--- a/pkgs/by-name/be/bear/package.nix
+++ b/pkgs/by-name/be/bear/package.nix
@@ -1,110 +1,43 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
-  cmake,
-  ninja,
-  pkg-config,
-  grpc,
-  protobuf,
-  openssl,
-  nlohmann_json,
-  gtest,
-  spdlog,
-  c-ares,
-  zlib,
-  sqlite,
-  re2,
-  lit,
-  python3,
-  coreutils,
+  rustPlatform,
+  installShellFiles,
+  lld,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bear";
-  version = "3.1.6";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "rizsotto";
     repo = "bear";
     rev = finalAttrs.version;
-    hash = "sha256-fWNMjqF5PCjGfFGReKIUiJ5lv8z6j7HeBn5hvbnV2V4=";
+    hash = "sha256-VZNrWfeeOJ5+qLg6hby4vR5rKKO7+mVOKp2p+lvwGOc=";
   };
 
-  strictDeps = true;
+  cargoHash = "sha256-61hKYDPPQ79QF3BNCLn2LxiCsoll+MGAMZ8obOVuNZI=";
 
   nativeBuildInputs = [
-    cmake
-    ninja
-    pkg-config
-    grpc
-    protobuf
+    installShellFiles
+    lld
   ];
 
-  buildInputs = [
-    grpc
-    protobuf
-    openssl
-    nlohmann_json
-    spdlog
-    c-ares
-    zlib
-    sqlite
-    re2
-  ];
-
-  patches = [
-    # This patch is necessary to run tests in a separate phase. By default
-    # test targets are run with ALL, which is not what we want. This patch creates
-    # separate 'test' step targets for each cmake ExternalProject:
-    # - BearTest-test (functional lit tests)
-    # - BearSource-test (unit tests via gtest)
-    ./0001-exclude-tests-from-all.patch
-  ];
-
-  nativeCheckInputs = [
-    lit
-    python3
-  ];
-
-  checkInputs = [
-    gtest
-  ];
-
-  cmakeFlags = [
-    # Build system and generated files concatenate install prefix and
-    # CMAKE_INSTALL_{BIN,LIB}DIR, which breaks if these are absolute paths.
-    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
-    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
-    (lib.cmakeBool "ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "ENABLE_FUNC_TESTS" finalAttrs.finalPackage.doCheck)
-  ];
-
-  checkTarget = lib.concatStringsSep " " [
-    "BearTest-test"
-    "BearSource-test"
-  ];
-
-  doCheck = true;
-
-  env = {
-    # Disable failing tests. The cause is not immediately clear.
-    LIT_FILTER_OUT = lib.concatStringsSep "|" [
-      "cases/compilation/output/config/filter_compilers.sh"
-      "cases/intercept/preload/posix/execvpe/success_to_resolve.c"
-      "cases/intercept/preload/posix/popen/success.c"
-      "cases/intercept/preload/posix/posix_spawnp/success_to_resolve.c"
-      "cases/intercept/preload/posix/system/success.c"
-      "cases/intercept/preload/shell_commands_intercepted_without_shebang.sh"
-    ];
-  };
-
   postPatch = ''
-    patchShebangs test/bin
+    substituteInPlace bear/build.rs \
+      --replace-fail 'const DEFAULT_WRAPPER_PATH: &str = "/usr/local/libexec/bear";' \
+        "const DEFAULT_WRAPPER_PATH: &str = \"$out/libexec/bear\";" \
+      --replace-fail 'const DEFAULT_PRELOAD_PATH: &str = "/usr/local/libexec/bear/$LIB";' \
+        "const DEFAULT_PRELOAD_PATH: &str = \"$out/lib\";"
+  '';
 
-    # /usr/bin/env is used in test commands and embedded scripts.
-    find test -name '*.sh' \
-      -exec sed -i -e 's|/usr/bin/env|${coreutils}/bin/env|g' {} +
+  postInstall = ''
+    # wrapper should not end up on path
+    install -d $out/libexec/bear
+    mv $out/bin/wrapper $out/libexec/bear/wrapper
+
+    installManPage man/bear.1
   '';
 
   # Functional tests use loopback networking.

From 1215d4705afa639a7ca9fab48117472005ede9e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 15 Feb 2026 21:57:09 +0700
Subject: [PATCH 22/28] =?UTF-8?q?nixtamal:=201.0.0=20=E2=86=92=201.1.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/ni/nixtamal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index c358e2aa6cfc..2ad87f300a7d 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -17,7 +17,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.0.0";
+  version = "1.1.0";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -26,7 +26,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-PJ03psJhRHq0ud/mXuUZSzpQ9RhO3p4s+lrGcHek3Rc=";
+    hash = "sha256-Q8EZ8kOyujMxoRU+G0SpTUhT9xi/5MtWnZmQffZzV7s=";
   };
 
   nativeBuildInputs = [

From 96c3d255b1f0990f378c3c9d5c1197275f1ad26a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 21:42:32 +0000
Subject: [PATCH 23/28] python3Packages.aiogram: 3.24.0 -> 3.25.0

---
 pkgs/development/python-modules/aiogram/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 1351d0b3433d..da593f8d434b 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.24.0";
+  version = "3.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
     tag = "v${version}";
-    hash = "sha256-8+neei3GXb8vIb7EXUposWFo8oU1PA/zDLmC1drYKAA=";
+    hash = "sha256-HluYC1wkWeh1HI77JV0vtZ5FcL9/mHEz4/D/Cg/eVVw=";
   };
 
   build-system = [ hatchling ];

From 7d27015a0d68eb9c22cb09c298f494ec70b31876 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Feb 2026 22:44:39 +0000
Subject: [PATCH 24/28] windsurf: 1.9544.35 -> 1.9552.21

---
 pkgs/by-name/wi/windsurf/info.json | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 456b7e375b34..aa19c85857b4 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.9544.35",
-    "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/cb270b70c3a55fd43530de48988912a8d9cccb20/Windsurf-darwin-arm64-1.9544.35.zip",
-    "sha256": "84a0e84b5270e5f258ce968aa6bef1de649d90e35085109adb6aa30173dd74bd"
+    "version": "1.9552.21",
+    "vscodeVersion": "1.107.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/16cc024632923bc387171d59cf5638057d4c8918/Windsurf-darwin-arm64-1.9552.21.zip",
+    "sha256": "fdc5486c08a2885a5eb1ba7b633c8e95b415af469e1d674cde54b61a377ddee3"
   },
   "x86_64-darwin": {
-    "version": "1.9544.35",
-    "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/cb270b70c3a55fd43530de48988912a8d9cccb20/Windsurf-darwin-x64-1.9544.35.zip",
-    "sha256": "72d94091ea83b0c97ff7d8d372d096e4323c9fdadbd9276b6fc4b3f43d43fc96"
+    "version": "1.9552.21",
+    "vscodeVersion": "1.107.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/16cc024632923bc387171d59cf5638057d4c8918/Windsurf-darwin-x64-1.9552.21.zip",
+    "sha256": "eb59e754d4e8889b03011734485937e188eefe8fc231f1c8c5fc6403dc9a67b9"
   },
   "x86_64-linux": {
-    "version": "1.9544.35",
-    "vscodeVersion": "1.106.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/cb270b70c3a55fd43530de48988912a8d9cccb20/Windsurf-linux-x64-1.9544.35.tar.gz",
-    "sha256": "8e5a0e41e5caca80072db812b170ad3918923c10c0bdbce1fa851ae403034aa8"
+    "version": "1.9552.21",
+    "vscodeVersion": "1.107.0",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/16cc024632923bc387171d59cf5638057d4c8918/Windsurf-linux-x64-1.9552.21.tar.gz",
+    "sha256": "7aba685f16433b205d3cf11a2b548907c1666d4acbbbedd640dd3a3c77a3520b"
   }
 }

From e56fb7fd612fba13c9062e320e961cdb2ebdc035 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 16 Feb 2026 01:00:21 +0100
Subject: [PATCH 25/28] folly: fix aarch64-linux build

Backports a patch that fixes memset/memcpy linking on aarch64-linux.
---
 .../fo/folly/memset-memcpy-aarch64.patch      | 57 +++++++++++++++++++
 pkgs/by-name/fo/folly/package.nix             |  3 +
 2 files changed, 60 insertions(+)
 create mode 100644 pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch

diff --git a/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch b/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
new file mode 100644
index 000000000000..fc254b2291d0
--- /dev/null
+++ b/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
@@ -0,0 +1,57 @@
+From 9acd1ec8e6890c7f5d86a0dd6941ae3b8692ac9c Mon Sep 17 00:00:00 2001
+From: Lukas Krenz <lkrenz@nvidia.com>
+Date: Tue, 20 Jan 2026 05:59:00 -0800
+Subject: [PATCH] Fix memset/memcpy linkage on aarch64
+
+Otherwise memcpy and memset benchmarks won't compile
+---
+ folly/CMakeLists.txt | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/folly/CMakeLists.txt b/folly/CMakeLists.txt
+index a1bcbdd6e92..51280821a24 100644
+--- a/folly/CMakeLists.txt
++++ b/folly/CMakeLists.txt
+@@ -879,6 +879,9 @@ folly_add_library(
+   NAME memset-impl
+   SRCS
+     FollyMemset.cpp
++    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
++  DEPS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64>
+ )
+ 
+ folly_add_library(
+@@ -894,12 +897,20 @@ folly_add_library(
+   EXCLUDE_FROM_MONOLITH
+   SRCS
+     FollyMemset.cpp
++    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
++  DEPS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64-use>
++  COMPILE_OPTIONS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMSET_IS_MEMSET>
+ )
+ 
+ folly_add_library(
+   NAME memcpy-impl
+   SRCS
+     FollyMemcpy.cpp
++    $<$<BOOL:${IS_AARCH64_ARCH}>:memcpy_select_aarch64.cpp>
++  DEPS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memcpy_aarch64>
+ )
+ 
+ folly_add_library(
+@@ -915,6 +926,11 @@ folly_add_library(
+   EXCLUDE_FROM_MONOLITH
+   SRCS
+     FollyMemcpy.cpp
++    $<$<BOOL:${IS_AARCH64_ARCH}>:memcpy_select_aarch64.cpp>
++  DEPS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memcpy_aarch64-use>
++  COMPILE_OPTIONS
++    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMCPY_IS_MEMCPY>
+ )
+ 
+ # x86 assembly memcpy implementation (not supported on MSVC)
diff --git a/pkgs/by-name/fo/folly/package.nix b/pkgs/by-name/fo/folly/package.nix
index 605559e58ce6..9a956c41eeb0 100644
--- a/pkgs/by-name/fo/folly/package.nix
+++ b/pkgs/by-name/fo/folly/package.nix
@@ -139,6 +139,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # <https://github.com/facebook/folly/issues/2171>
     ./folly-fix-glog-0.7.patch
+
+    # https://github.com/facebook/folly/pull/2561
+    ./memset-memcpy-aarch64.patch
   ];
 
   # https://github.com/NixOS/nixpkgs/issues/144170

From 68459927e972f4a712395e8abe34980a7a4cd0b9 Mon Sep 17 00:00:00 2001
From: Wael Nasreddine <wael.nasreddine@gmail.com>
Date: Sun, 15 Feb 2026 17:20:34 -0800
Subject: [PATCH 26/28] ncps: 0.8.5 -> 0.8.6

---
 pkgs/by-name/nc/ncps/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index 99734c0b3bb3..48c27d66d60b 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "ncps";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "kalbasit";
     repo = "ncps";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0kQ2DTnBil7eSP/eSwLVqw/UyIwBMFtmKAeLCi64Fr8=";
+    hash = "sha256-Ep83aGlwf8qq7fmSCCH9zUztlXf4D3vvs9jkBBoN6Yw=";
   };
 
   vendorHash = "sha256-AcgC+zTS3eVsbcs0jim4zDBGc3lIjwPbdVT7/KQ9Lkc=";

From b898b53e2c0ade92cfcaab4beb088b67bd66831a Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Mon, 16 Feb 2026 02:42:46 +0000
Subject: [PATCH 27/28] Revert "nixos/traefik: refactor"

---
 .../manual/release-notes/rl-2605.section.md   |   2 -
 .../modules/services/networking/pangolin.nix  |  17 +-
 .../modules/services/web-servers/traefik.nix  | 540 +++---------------
 3 files changed, 100 insertions(+), 459 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index fe4a2d3fd0f4..e203185e178e 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -68,8 +68,6 @@
 
 - The packages `iw` and `wirelesstools` (`iwconfig`, `iwlist`, etc.) are no longer installed implicitly if wireless networking has been enabled.
 
-- The Traefik module now features new ways to deploy the dynamic and static configuration files. Move your existing declarative static and dynamic configurations to `services.traefik.static.settings` and `services.traefik.dynamic.files."my-application".settings` respectively. The `services.traefik.dynamic.settings` option is available for a simpler migration without needing to define a filename like `my-application`, but this option will be removed in NixOS 26.11.
-
 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
 package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead
 of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set:
diff --git a/nixos/modules/services/networking/pangolin.nix b/nixos/modules/services/networking/pangolin.nix
index 6846d03dd9ac..1dce42fdb2ad 100644
--- a/nixos/modules/services/networking/pangolin.nix
+++ b/nixos/modules/services/networking/pangolin.nix
@@ -201,10 +201,13 @@ in
           isSystemUser = true;
         };
       };
-      groups.fossorial.members = [
-        "pangolin"
-        "gerbil"
-      ];
+      groups.fossorial = {
+        members = [
+          "pangolin"
+          "gerbil"
+          "traefik"
+        ];
+      };
     };
     # order is as follows
     # "pangolin.service"
@@ -428,9 +431,9 @@ in
 
     services.traefik = {
       enable = true;
-      supplementaryGroups = [ "fossorial" ];
+      group = "fossorial";
       dataDir = "${cfg.dataDir}/config/traefik";
-      static.settings = {
+      staticConfigOptions = {
         providers.http = {
           endpoint = "http://localhost:${toString finalSettings.server.internal_port}/api/v1/traefik-config";
           pollInterval = "5s";
@@ -468,7 +471,7 @@ in
           };
         };
       };
-      dynamic.files."pangolin".settings = {
+      dynamicConfigOptions = {
         http = {
           middlewares.redirect-to-https.redirectScheme.scheme = "https";
           routers = {
diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
index 2f7e6611c342..86534f291ee7 100644
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -1,528 +1,168 @@
 {
-  options,
   config,
   lib,
   pkgs,
   ...
 }:
 
+with lib;
+
 let
-  inherit (lib.types)
-    attrsOf
-    bool
-    listOf
-    nullOr
-    path
-    str
-    submodule
-    ;
-  inherit (lib)
-    concatMapStringsSep
-    concatStringsSep
-    filter
-    getExe
-    literalExpression
-    maintainers
-    mapAttrs'
-    mkDefault
-    mkEnableOption
-    mkIf
-    mkMerge
-    mkOption
-    mkPackageOption
-    mkRenamedOptionModule
-    nameValuePair
-    optional
-    optionalAttrs
-    remove
-    ;
-
   cfg = config.services.traefik;
-  opt = options.services.traefik;
 
-  # JSON is considered valid YAML by Traefik.
-  format = pkgs.formats.json { };
+  format = pkgs.formats.toml { };
 
-  staticFile =
-    if cfg.static.file == null then
-      format.generate "static_config.json" cfg.static.settings
+  dynamicConfigFile =
+    if cfg.dynamicConfigFile == null then
+      format.generate "config.toml" cfg.dynamicConfigOptions
     else
-      cfg.static.file;
+      cfg.dynamicConfigFile;
 
-  finalStaticFile = if cfg.useEnvSubst then "/run/traefik/config.json" else staticFile;
+  staticConfigFile =
+    if cfg.staticConfigFile == null then
+      format.generate "config.toml" (
+        recursiveUpdate cfg.staticConfigOptions {
+          providers.file.filename = "${dynamicConfigFile}";
+        }
+      )
+    else
+      cfg.staticConfigFile;
+
+  finalStaticConfigFile =
+    if cfg.environmentFiles == [ ] then staticConfigFile else "/run/traefik/config.toml";
 in
 {
-  imports = [
-    (mkRenamedOptionModule
-      [
-        "services"
-        "traefik"
-        "staticConfigFile"
-      ]
-      [
-        "services"
-        "traefik"
-        "static"
-        "file"
-      ]
-    )
-    (mkRenamedOptionModule
-      [
-        "services"
-        "traefik"
-        "staticConfigOptions"
-      ]
-      [
-        "services"
-        "traefik"
-        "static"
-        "settings"
-      ]
-    )
-    (mkRenamedOptionModule
-      [
-        "services"
-        "traefik"
-        "dynamicConfigFile"
-      ]
-      [
-        "services"
-        "traefik"
-        "dynamic"
-        "file"
-      ]
-    )
-    (mkRenamedOptionModule
-      [
-        "services"
-        "traefik"
-        "dynamicConfigOptions"
-      ]
-      [
-        "services"
-        "traefik"
-        "dynamic"
-        "settings"
-      ]
-    )
-  ];
   options.services.traefik = {
     enable = mkEnableOption "Traefik web server";
-    package = mkPackageOption pkgs "traefik" { };
 
-    static = {
-      file = mkOption {
-        default = null;
-        example = literalExpression "/path/to/static_config.toml";
-        type = nullOr path;
-        description = ''
-          Path to Traefik's static configuration file.
+    staticConfigFile = mkOption {
+      default = null;
+      example = literalExpression "/path/to/static_config.toml";
+      type = types.nullOr types.path;
+      description = ''
+        Path to traefik's static configuration to use.
+        (Using that option has precedence over `staticConfigOptions` and `dynamicConfigOptions`)
+      '';
+    };
 
-          ::: {.note}
-          Using this option has precedence over {option}`services.traefik.static.settings`.
-          :::
-        '';
+    staticConfigOptions = mkOption {
+      description = ''
+        Static configuration for Traefik.
+      '';
+      type = format.type;
+      default = {
+        entryPoints.http.address = ":80";
       };
-      settings = mkOption {
-        description = ''
-          Static configuration for Traefik, written in Nix.
+      example = {
+        entryPoints.web.address = ":8080";
+        entryPoints.http.address = ":80";
 
-          ::: {.note}
-          This will be serialized to JSON (which is considered valid YAML) at build, and passed to Traefik as `--configfile`.
-          :::
-        '';
-        type = format.type;
-        default = {
-          entryPoints.http.address = ":80";
-        };
-        example = {
-          entryPoints = {
-            "web" = {
-              address = ":80";
-              http.redirections.entryPoint = {
-                permanent = true;
-                scheme = "https";
-                to = "websecure";
-              };
-            };
-            "websecure" = {
-              address = ":443";
-              asDefault = true;
-            };
-          };
-        };
+        api = { };
       };
     };
 
-    dynamic = {
-      file = mkOption {
-        default = null;
-        example = literalExpression "/path/to/dynamic_config.toml";
-        type = nullOr path;
-        description = ''
-          Path to Traefik's dynamic configuration file.
+    dynamicConfigFile = mkOption {
+      default = null;
+      example = literalExpression "/path/to/dynamic_config.toml";
+      type = types.nullOr types.path;
+      description = ''
+        Path to traefik's dynamic configuration to use.
+        (Using that option has precedence over `dynamicConfigOptions`)
+      '';
+    };
 
-          ::: {.note}
-          You cannot use this option alongside the declarative configuration options.
-          :::
-        '';
-      };
-      dir = mkOption {
-        default = null;
-        example = literalExpression "/var/lib/traefik/dynamic";
-        type = nullOr path;
-        description = ''
-          Path to the directory Traefik should watch for configuration files.
-
-          ::: {.warning}
-          Files in this directory matching the glob `_nixos-*` (reserved for Nix-managed dynamic configurations) will be deleted as part of
-          `systemd-tmpfiles-resetup.service`, _**regardless of their origin.**_.
-          :::
-        '';
-      };
-      files = mkOption {
-        type = attrsOf (submodule {
-          options.settings = mkOption {
-            type = format.type;
-            description = ''
-              Dynamic configuration for Traefik, written in Nix.
-
-              ::: {.note}
-              This will be serialized to JSON (which is considered valid YAML) at build, and passed as part of the static file.
-              :::
-            '';
-            example = {
-              http.routers."api" = {
-                service = "api@internal";
-                rule = "Host(`localhost`)";
-              };
-            };
-          };
-        });
-        default = { };
-        example = {
-          "dashboard".settings = {
-            http.routers."api" = {
-              service = "api@internal";
-              rule = "Host(`198.51.100.1`)";
-            };
-          };
+    dynamicConfigOptions = mkOption {
+      description = ''
+        Dynamic configuration for Traefik.
+      '';
+      type = format.type;
+      default = { };
+      example = {
+        http.routers.router1 = {
+          rule = "Host(`localhost`)";
+          service = "service1";
         };
-        description = ''
-          Dynamic configuration files to write. These are symlinked in `services.traefik.dynamic.dir` upon activation,
-          allowing configuration to be upated without restarting the primary daemon.
 
-          ::: {.note}
-          Due to [a limitation in Traefik](https://github.com/traefik/traefik/issues/10890); any syntax error in a dynamic configuration will cause the _**entire file provider**_ to be ignored.
-          This may cause interuption in service, which may include access to the Traefik dashboard, if [enabled and configured](https://doc.traefik.io/traefik/operations/dashboard).
-          :::
-        '';
-      };
-      # TODO: Drop in 26.11.
-      settings = mkOption {
-        type = format.type;
-        description = ''
-          Dynamic configuration for Traefik, written in Nix.
-          This option is intended for easily migrating pre-26.05 Traefik configurations, and will be removed in NixOS 26.11.
-
-          ::: {.note}
-          Configurations added here will be translated into a file for {option}`services.traefik.dynamic.files`, named `custom-migrated`.
-          :::
-        '';
-        default = { };
-        example = {
-          http.routers."api" = {
-            service = "api@internal";
-            rule = "Host(`localhost`)";
-          };
-        };
+        http.services.service1.loadBalancer.servers = [ { url = "http://localhost:8080"; } ];
       };
     };
 
     dataDir = mkOption {
       default = "/var/lib/traefik";
-      type = path;
+      type = types.path;
       description = ''
-        Location for any persistent data Traefik creates, such as the ACME certificate store.
-
-        ::: {.note}
-        If left as the default value, this directory will automatically be created
-        before the Traefik server starts, otherwise you are responsible for ensuring
-        the directory exists with appropriate ownership and permissions.
-        :::
-      '';
-    };
-
-    user = mkOption {
-      default = "traefik";
-      example = "docker";
-      type = str;
-      description = ''
-        User under which Traefik runs.
-
-        ::: {.note}
-        If left as the default value this user will automatically be created
-        on system activation, otherwise you are responsible for
-        ensuring the user exists before the Traefik service starts.
-        :::
+        Location for any persistent data traefik creates, ie. acme
       '';
     };
 
     group = mkOption {
       default = "traefik";
-      type = str;
+      type = types.str;
+      example = "docker";
       description = ''
-        Primary group under which Traefik runs.
-        For the Docker backend, use {option}`services.traefik.supplementaryGroups` instead of overriding this option.
-
-        ::: {.note}
-        If left as the default value this group will automatically be created
-        on system activation, otherwise you are responsible for
-        ensuring the group exists before the Traefik service starts.
-        :::
+        Set the group that traefik runs under.
+        For the docker backend this needs to be set to `docker` instead.
       '';
     };
 
-    supplementaryGroups = mkOption {
-      default = [ ];
-      type = listOf str;
-      example = [ "docker" ];
-      description = ''
-        Additional groups under which Traefik runs.
-        This can be used to give additional permissions, such as the group required by the `docker` provider.
-
-        ::: {.note}
-        With the `docker` provider, Traefik manages connection to containers via the Docker socket,
-        which requires membership of the `docker` group for write access.
-        :::
-      '';
-    };
+    package = mkPackageOption pkgs "traefik" { };
 
     environmentFiles = mkOption {
       default = [ ];
-      type = listOf path;
+      type = types.listOf types.path;
       example = [ "/run/secrets/traefik.env" ];
       description = ''
-        Files to load as an environment file just before Traefik starts.
-        This can be used to pass secrets such as [DNS challenge API tokens](https://doc.traefik.io/traefik/https/acme/#providers) or [EAB credentials](https://doc.traefik.io/traefik/reference/static-configuration/env/).
-        ```
-        DESEC_TOKEN=
-        TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_EAB_HMACENCODED=
-        TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_EAB_KID=
-        ```
-        ::: {.warn}
-        The traefik static configuration methods (env, CLI, and file) are mutually exclusive.
-        :::
-
-        Rather than setting secret values with the traefik environment variable syntax,
-        it is recommended to set arbitrary environment variables, then reference them with `$VARNAME` in e.g.
-        {option}`services.traefik.static.settings`, like so:
-        ```nix
-        {
-          services.traefik = {
-            static.settings.somesecretvalue = "$SECRETNAME";
-            useEnvSubst = true; # Necessary in order to use environment variables in the Traefik config.
-            environmentFiles = [ /path/to/file/that/defines/SECRETNAME ];
-          };
-        }
-        ```
-      '';
-    };
-
-    useEnvSubst = mkOption {
-      default = cfg.environmentFiles != [ ];
-      defaultText = "config.services.traefik.environmentFiles != [ ]";
-      type = bool;
-      example = true;
-      description = ''
-        Whether to use `envSubst` in the `ExecStartPre` phase to augment the generated static config. See {option}`services.traefik.environmentFiles`.
-
-        ::: {.note}
-        If you use environment files with Traefik but *do not* utilise environment variables in the static config, this can safely be disabled to reduce startup time.
-        :::
+        Files to load as environment file. Environment variables from this file
+        will be substituted into the static configuration file using envsubst.
       '';
     };
   };
 
   config = mkIf cfg.enable {
-    assertions = [
-      {
-        assertion =
-          cfg.static.file != opt.static.file.default -> cfg.static.settings == opt.static.settings.default;
-        message = ''
-          The 'services.traefik.static.file' and 'services.traefik.static.settings'
-          options are mutually exclusive for the Traefik static config.
-          It is recommended to use 'settings'.
-        '';
-      }
-      {
-        assertion =
-          cfg.static.file != opt.static.file.default
-          -> (
-            cfg.dynamic.files == opt.dynamic.files.default
-            && cfg.dynamic.dir == opt.dynamic.dir.default
-            && cfg.dynamic.file == opt.dynamic.file.default
-          );
-        message = ''
-          None of the dynamic configuration options may be used if Traefik is being managed imperatively.
-          The following options have non-default values:
-            - ${
-              concatMapStringsSep "\n  - " (str: "'services.traefik.dynamic.${str}'") (
-                filter (attr: cfg.dynamic.${attr} != opt.dynamic.${attr}.default) [
-                  "files"
-                  "dir"
-                  "file"
-                  "settings" # TODO: Drop in 26.11.
-                ]
-              )
-            }
-        '';
-      }
-      {
-        assertion =
-          cfg.dynamic.file != opt.dynamic.file.default -> cfg.dynamic.dir == opt.dynamic.dir.default;
-        message = ''
-          The 'services.traefik.dynamic.file' and 'services.traefik.dynamic.dir' options
-          are mutually exclusive for the Traefik dynamic config. It is recommended to use
-          'services.traefik.dynamic.dir' with 'services.traefik.dynamic.files'.
-        '';
-      }
-      {
-        assertion =
-          cfg.dynamic.files != opt.dynamic.files.default -> cfg.dynamic.dir != opt.dynamic.dir.default;
-        message = ''
-          'services.traefik.dynamic.files' requires the dynamic file provider to be set
-          to a directory. Please set a path for 'services.traefik.dynamic.dir'.
-        '';
-      }
-      {
-        assertion = cfg.group != "docker";
-        message = ''
-          Setting the primary group to 'docker' will cause files, such as those generated
-          by 'services.traefik.dynamic.files', to be owned by the group 'docker', which
-          may be a security risk. Use 'services.traefik.supplementaryGroups' instead.
-        '';
-      }
-    ];
-
-    warnings =
-      optional (!(builtins.elem "docker" cfg.supplementaryGroups -> config.virtualisation.docker.enable))
-        "'services.traefik.supplementaryGroups' contains the 'docker' group, but 'services.docker' is not enabled."
-      ++ optional (cfg.dynamic.settings != opt.dynamic.settings.default) ''
-        'services.traefik.dynamic.settings' is in use, but that option is deprecated.
-        Please migrate your configuration to an explicit file instead.
-
-        You may do so by moving the value of 'services.traefik.dynamic.settings' to
-        'services.traefik.dynamic.files.<name>.settings', where <name> is an arbitrary
-        string that ideally identifies the configuration's purpose.
-
-        The following files define 'services.traefik.dynamic.settings' and should be migrated:
-          - ${
-            concatStringsSep "\n  - " (
-              remove ./traefik.nix (map (attr: attr.file) opt.dynamic.settings.definitionsWithLocations)
-            )
-          }
-      '';
-
-    # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
-    boot.kernel.sysctl = {
-      "net.core.rmem_max" = 2500000;
-      "net.core.wmem_max" = 2500000;
-    };
-
-    # If a dynamic file or directory has been set, add it as a provider in the static configuration
-    services.traefik = mkIf (cfg.static.file == opt.static.file.default) {
-      dynamic.files = mkIf (cfg.dynamic.settings != opt.dynamic.settings.default) {
-        "custom-migrated".settings = cfg.dynamic.settings;
-      };
-      static.settings =
-        mkIf (cfg.dynamic.dir != opt.dynamic.dir.default || cfg.dynamic.file != opt.dynamic.file.default)
-          {
-            providers.file = {
-              directory = mkIf (cfg.dynamic.dir != opt.dynamic.dir.default) cfg.dynamic.dir;
-              filename = mkIf (cfg.dynamic.file != opt.dynamic.file.default) cfg.dynamic.file;
-              watch = mkDefault true;
-            };
-          };
-    };
+    systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0700 traefik traefik - -" ];
 
     systemd.services.traefik = {
-      description = "Traefik reverse proxy";
+      description = "Traefik web server";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       startLimitIntervalSec = 86400;
       startLimitBurst = 5;
       serviceConfig = {
-        Documentation = "https://doc.traefik.io/traefik/";
         EnvironmentFile = cfg.environmentFiles;
-        ExecStartPre = optional cfg.useEnvSubst "${getExe pkgs.envsubst} -i '${staticFile}' > '${finalStaticFile}'";
-        ExecStart = "${getExe cfg.package} --configfile=${finalStaticFile}";
-        Type = "notify";
-        User = cfg.user;
+        ExecStartPre = lib.optional (cfg.environmentFiles != [ ]) (
+          pkgs.writeShellScript "pre-start" ''
+            umask 077
+            ${pkgs.envsubst}/bin/envsubst -i "${staticConfigFile}" > "${finalStaticConfigFile}"
+          ''
+        );
+        ExecStart = "${cfg.package}/bin/traefik --configfile=${finalStaticConfigFile}";
+        Type = "simple";
+        User = "traefik";
         Group = cfg.group;
-        SupplementaryGroups = mkIf (cfg.supplementaryGroups != [ ]) cfg.supplementaryGroups;
-        Restart = "always";
+        Restart = "on-failure";
         AmbientCapabilities = "cap_net_bind_service";
         CapabilityBoundingSet = "cap_net_bind_service";
         NoNewPrivileges = true;
-        TasksMax = 64;
+        LimitNPROC = 64;
         LimitNOFILE = 1048576;
         PrivateTmp = true;
         PrivateDevices = true;
         ProtectHome = true;
-        ProtectSystem = "strict";
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
+        ProtectSystem = "full";
         ReadWritePaths = [ cfg.dataDir ];
-        ReadOnlyPaths = optional (cfg.dynamic.dir != null) cfg.dynamic.dir;
-        RuntimeDirectoryMode = "0700";
         RuntimeDirectory = "traefik";
         WorkingDirectory = cfg.dataDir;
-        WatchdogSec = "1s";
       };
     };
 
-    systemd.tmpfiles.settings."10-traefik" = mkMerge [
-      (mkIf (cfg.user == "traefik") {
-        ${cfg.dataDir}.d = {
-          inherit (cfg) user group;
-          mode = "0700";
-        };
-      })
-      (mkIf (cfg.dynamic.dir != null) (
-        {
-          ${cfg.dynamic.dir}.d = {
-            inherit (cfg) user group;
-            mode = "0700";
-          };
-          "${cfg.dynamic.dir}/_nixos-*".r = { };
-        }
-        // (mapAttrs' (
-          name: value:
-          nameValuePair "${cfg.dynamic.dir}/_nixos-${name}.yml" {
-            "L+" = {
-              mode = "0444";
-              argument = toString (format.generate name value.settings);
-            };
-          }
-        ) cfg.dynamic.files)
-      ))
-    ];
-
-    users = {
-      users = optionalAttrs (cfg.user == "traefik") {
-        traefik = {
-          inherit (cfg) group;
-          isSystemUser = true;
-        };
-      };
-      groups = optionalAttrs (cfg.group == "traefik") { traefik = { }; };
+    users.users.traefik = {
+      group = "traefik";
+      home = cfg.dataDir;
+      createHome = true;
+      isSystemUser = true;
     };
+
+    users.groups.traefik = { };
   };
-
-  meta.maintainers = with maintainers; [
-    jackr
-    therealgramdalf
-  ];
 }

From 80bafe1be76e1058737ec9392181adf5d928a8fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 04:12:52 +0000
Subject: [PATCH 28/28] smfh: 1.3 -> 1.4

---
 pkgs/by-name/sm/smfh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sm/smfh/package.nix b/pkgs/by-name/sm/smfh/package.nix
index fa1838c4c1c3..7d94e7379e24 100644
--- a/pkgs/by-name/sm/smfh/package.nix
+++ b/pkgs/by-name/sm/smfh/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "smfh";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "feel-co";
     repo = "smfh";
     tag = finalAttrs.version;
-    hash = "sha256-Pjq/Q+W0bapu0EDRlDYQxLjKHA0OHdVn7hWfJumjWdM=";
+    hash = "sha256-6zMgOPzBbTSm8jzPqmGcotjvkN3HzxcnMM8pW64JpZQ=";
   };
 
-  cargoHash = "sha256-ULU2fMVTeHvFM374GwZlHO5/a9bcf8AmwbqvXp1YRAk=";
+  cargoHash = "sha256-FVTpH+scBCjgm3sf9sowRCI/X2jCS1wHtLLiOyKAD8U=";
 
   meta = {
     description = "Sleek Manifest File Handler";