Merge commit 1c8355b14e into haskell-updates

2026-04-26 17:00:16 +02:00
parent d0a2ca9b6d 1c8355b14e
commit a08415941d
951 changed files with 49934 additions and 30520 deletions
@@ -49,7 +49,7 @@ jobs:

      - name: Create backport PRs
        id: backport
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
+        uses: korthout/backport-action@ad30f01dbe543be4a24431001c38f3617af8c745 # v4.4.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          add_author_as_reviewer: true
@@ -62,7 +62,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
@@ -120,7 +120,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -132,7 +132,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Load supported versions
        id: versions
@@ -180,7 +180,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Combine all output paths and eval stats
        run: |
@@ -465,7 +465,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -475,8 +475,9 @@ nixos/tests/incus/                      @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens

-# Flutter
+# ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy

 # GNU Tar & Zip
 /pkgs/by-name/gn/gnutar        @RossComputerGuy
@@ -188,12 +188,7 @@ let
            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
          ) rebuildsByKernel
          // {
-            "10.rebuild-nixos-tests" =
-              lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds)
-              &&
-                # Only set this label when no other label with indication for staging has been set.
-                # This avoids confusion whether to target staging or batch this with kernel updates.
-                lib.last (lib.sort lib.lessThan (lib.attrValues rebuildCountByKernel)) <= 500;
+            "10.rebuild-nixos-tests" = lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds);
          };
      }
    );
@@ -66,8 +66,9 @@ function runChecklist({
    if (allByName) {
      // We can only determine the below, if all packages are in by-name, since
      // we can't reliably relate changed files to packages outside by-name.
-      checklist[`${user.login} is a maintainer of all touched packages.`] =
-        eligible.has(user.id)
+      checklist[
+        `${user.login} is a maintainer of all touched packages on the ${pull_request.base.ref} branch.`
+      ] = eligible.has(user.id)
    }
  } else {
    // This is only used when no user is passed, i.e. for labeling.
@@ -920,14 +920,14 @@ respectively. Otherwise, the fetcher uses `fetchzip`.

 This is used with Radicle repositories. The arguments expected are similar to `fetchgit`.

-Requires a `seed` argument (e.g. `seed.radicle.xyz` or `rosa.radicle.xyz`) and a `repo` argument
+Requires a `seed` argument (e.g. `seed.radicle.dev` or `rosa.radicle.network`) and a `repo` argument
 (the repository id *without* the `rad:` prefix). Also accepts an optional `node` argument which
 contains the id of the node from which to fetch the specified ref. If `node` is `null` (the
 default), a canonical ref is fetched instead.

 ```nix
 fetchFromRadicle {
-  seed = "seed.radicle.xyz";
+  seed = "seed.radicle.dev";
  repo = "z3gqcJUoA1n9HaHKufZs5FCSGazv5"; # heartwood
  tag = "releases/1.3.0";
  hash = "sha256-4o88BWKGGOjCIQy7anvzbA/kPOO+ZsLMzXJhE61odjw=";
@@ -942,7 +942,7 @@ contains the full revision id of the Radicle patch to fetch.

 ```nix
 fetchRadiclePatch {
-  seed = "rosa.radicle.xyz";
+  seed = "rosa.radicle.network";
  repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"; # radicle-explorer
  revision = "d97d872386c70607beda2fb3fc2e60449e0f4ce4"; # patch: d77e064
  hash = "sha256-ttnNqj0lhlSP6BGzEhhUOejKkkPruM9yMwA5p9Di4bk=";
@@ -93,7 +93,7 @@ there are 3 steps: frontend dependencies (javascript), backend dependencies (eli

 ##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}

-For phoenix projects, inside of Nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+For phoenix projects, inside of Nixpkgs you can either use `fetchYarnDeps` or `buildNpmPackage`. An example with `fetchYarnDeps` can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix). An example with `fetchYarnDeps` will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)

 ##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}

@@ -45,17 +45,14 @@ If a particular lock file is present, it is a strong indication of which package

 It's better to try to use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
-An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629).
-Upstream use npm, but this is an attempt to package it with `yarn2nix` (that uses yarn.lock).

 Using a different tool forces you to commit a lock file to the repository.
 These files are fairly large, so when packaging for nixpkgs, this approach does not scale well.

 Exceptions to this rule are:

- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs. In general `yarn2nix` has fewer known problems, and so a simple search in Nixpkgs will reveal many `yarn.lock` files committed.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
 - Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is `yarn2nix`. If upstream has workspaces you should try `yarn2nix`.

 ### Try to use upstream package.json {#javascript-upstream-package-json}

@@ -92,7 +89,7 @@ Exceptions to this rule are:
 Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
 The node_modules abstraction can be also used to build some web framework frontends.
-For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. `mkYarnModules` to make the derivation containing node_modules.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
 Then when building the frontend you can just symlink the node_modules directory.

 ## Tool-specific instructions {#javascript-tool-specific}
@@ -598,139 +595,6 @@ To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup p

 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.

-#### yarn2nix {#javascript-yarn2nix}
-
-> [!WARNING]
-> The `yarn2nix` functions have been deprecated in favor of `yarnConfigHook`, `yarnBuildHook` and `yarnInstallHook` (for Yarn v1) and `yarn-berry_*.*` tooling (Yarn v3 and v4). Documentation for `yarn2nix` functions still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
-##### Preparation {#javascript-yarn2nix-preparation}
-
-You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.
-
-If the downloaded files contain the `package.json` and `yarn.lock` files they can be used like this:
-
-```nix
-{
-  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "....";
-  };
-}
-```
-
-##### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
-
-> [!WARNING]
-> The `mkYarnPackage` functions have been deprecated in favor of `yarnConfigHook`, `yarnBuildHook` and `yarnInstallHook` (for Yarn v1) and `yarn-berry_*.*` tooling (Yarn v3 and v4). Documentation for `mkYarnPackage` functions still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
-`mkYarnPackage` will by default try to generate a binary. For packages only generating static assets (Svelte, Vue, React, Webpack, ...), you will need to explicitly override the build step with your instructions.
-
-It's important to use the `--offline` flag. For example if you script is `"build": "something"` in `package.json` use:
-
-```nix
-{
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    yarn --offline build
-
-    runHook postBuild
-  '';
-}
-```
-
-The `distPhase` is packing the package's dependencies in a tarball using `yarn pack`. You can disable it using:
-
-```nix
-{ doDist = false; }
-```
-
-The configure phase can sometimes fail because it makes many assumptions that may not always apply. One common override is:
-
-```nix
-{
-  configurePhase = ''
-    runHook preConfigure
-
-    ln -s $node_modules node_modules
-
-    runHook postConfigure
-  '';
-}
-```
-
-or if you need a writeable node_modules directory:
-
-```nix
-{
-  configurePhase = ''
-    runHook preConfigure
-
-    cp -r $node_modules node_modules
-    chmod +w node_modules
-
-    runHook postConfigure
-  '';
-}
-```
-
-##### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
-
-This will generate a derivation including the `node_modules` directory.
-If you have to build a derivation for an integrated web framework (Rails, Phoenix, etc.), this is probably the easiest way.
-
-#### Overriding dependency behavior {#javascript-mkYarnPackage-overriding-dependencies}
-
-In the `mkYarnPackage` record the property `pkgConfig` can be used to override packages when you encounter problems building.
-
-For instance, say your package is throwing errors when trying to invoke node-sass:
-
-```
-ENOENT: no such file or directory, scandir '/build/source/node_modules/node-sass/vendor'
-```
-
-To fix this we will specify different versions of build inputs to use, as well as some post install steps to get the software built the way we want:
-
-```nix
-mkYarnPackage rec {
-  pkgConfig = {
-    node-sass = {
-      buildInputs = with final; [
-        python
-        libsass
-        pkg-config
-      ];
-      postInstall = ''
-        LIBSASS_EXT=auto yarn --offline run build
-        rm build/config.gypi
-      '';
-    };
-  };
-}
-```
-
-##### Pitfalls {#javascript-yarn2nix-pitfalls}
-
- If version is missing from upstream package.json, yarn will silently install nothing. In that case, you will need to override package.json as shown in the [package.json section](#javascript-upstream-package-json)
- Having trouble with `node-gyp`? Try adding these lines to the `yarnPreBuild` steps:
-
-  ```nix
-  {
-    yarnPreBuild = ''
-      mkdir -p $HOME/.node-gyp/${nodejs.version}
-      echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
-      ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
-      export npm_config_nodedir=${nodejs}
-    '';
-  }
-  ```
-
-  - The `echo 9` steps comes from this answer: <https://stackoverflow.com/a/49139496>
-  - Exporting the headers in `npm_config_nodedir` comes from this issue: <https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919>
- `offlineCache` (described [above](#javascript-yarn2nix-preparation)) must be specified to avoid [Import From Derivation](#ssec-import-from-derivation) (IFD) when used inside Nixpkgs.
-
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
 Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:

@@ -21,12 +21,12 @@ Here is a simple package example to be called with `tclPackages.callPackage`.
 ```
 { lib, fetchzip, mkTclDerivation, openssl }:

-mkTclDerivation rec {
+mkTclDerivation (finalAttrs: {
  pname = "tcltls";
  version = "1.7.22";

  src = fetchzip {
-    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${version}.tar.gz";
+    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${finalAttrs.version}.tar.gz";
    hash = "sha256-TOouWcQc3MNyJtaAGUGbaQoaCWVe6g3BPERct/V65vk=";
  };

@@ -43,7 +43,7 @@ mkTclDerivation rec {
    license = lib.licenses.tcltk;
    platforms = lib.platforms.unix;
  };
-}
+})
 ```

 All Tcl libraries are declared in `pkgs/top-level/tcl-packages.nix` and are defined in `pkgs/development/tcl-modules/`.
@@ -448,7 +448,13 @@
    "index.html#overriding-the-generator",
    "index.html#javascript-node2nix",
    "index.html#javascript-node2nix-preparation",
-    "index.html#javascript-node2nix-pitfalls"
+    "index.html#javascript-node2nix-pitfalls",
+    "index.html#javascript-yarn2nix-mkYarnPackage",
+    "index.html#javascript-yarn2nix",
+    "index.html#javascript-yarn2nix-preparation",
+    "index.html#javascript-yarn2nix-mkYarnModules",
+    "index.html#javascript-mkYarnPackage-overriding-dependencies",
+    "index.html#javascript-yarn2nix-pitfalls"
  ],
  "sec-nixpkgs-release-26.05-lib": [
    "release-notes.html#sec-nixpkgs-release-26.05-lib"
@@ -3720,24 +3726,6 @@
  "javascript-yarninstallhook": [
    "index.html#javascript-yarninstallhook"
  ],
-  "javascript-yarn2nix": [
-    "index.html#javascript-yarn2nix"
-  ],
-  "javascript-yarn2nix-preparation": [
-    "index.html#javascript-yarn2nix-preparation"
-  ],
-  "javascript-yarn2nix-mkYarnPackage": [
-    "index.html#javascript-yarn2nix-mkYarnPackage"
-  ],
-  "javascript-yarn2nix-mkYarnModules": [
-    "index.html#javascript-yarn2nix-mkYarnModules"
-  ],
-  "javascript-mkYarnPackage-overriding-dependencies": [
-    "index.html#javascript-mkYarnPackage-overriding-dependencies"
-  ],
-  "javascript-yarn2nix-pitfalls": [
-    "index.html#javascript-yarn2nix-pitfalls"
-  ],
  "javascript-yarnBerry-missing-hashes": [
    "index.html#javascript-yarnBerry-missing-hashes"
  ],
@@ -87,6 +87,8 @@
  adding `pkg-config`, `xfce4-dev-tools`, and `wrapGAppsHook3` to your `nativeBuildInputs` and
  `--enable-maintainer-mode` to your `configureFlags`.

+- `yarn2nix`/`yarn2nix-moretea` and its tooling(`mkYarnPackage`, `mkYarnModules`, and `fixup_yarn_lock`) have been removed as they were unmaintainable in nixpkgs. If you want to build with Yarn V1 going forward, use the hooks instead(`yarnBuildHook`, `yarnConfigHook`, and `yarnInstallHook`). See the yarn v1 documentation in the nixpkgs manual for more details.
+
 - `albert` has been updated to the version 34.0.5. This release redesigns the query system to support stateful asynchronous handlers and infinite scrolling, and adds internationalized tokenization.
  This update introduces several breaking changes: the Python plugin interface is now v5.0, the `PATH` plugin has been renamed to `Commandline`, and the QStylesheets-based widgets box model frontend has been removed.
  For more information read the [changelog for 34.0.0](https://albertlauncher.github.io/2026/01/19/albert-v34.0.0-released/).
@@ -135,6 +137,8 @@

 - `pulsar` has finally migrated from electron v12 to v30, backup `~/.pulsar` before upgrading. See [Pulsar on Electron 30: what it means for you](https://blog.pulsar-edit.dev/posts/20251202-savetheclocktower-pulsar-on-electron-30/).

+- `mactracker` has been updated to major version 8, which now [requires macOS 11 Big Sur or later](https://mactracker.ca/releasenotes-mac.html#:~:text=System%20requirements%20updated%20to%20macOS%2011%20Big%20Sur%20and%20later). The previous version supported Mac OS X 10.6.8 or later.
+
 - `bartender` has been updated to major version 6. This removes support for MacOS Sonoma (and adds support for Tahoe). For more information, see [the release notes](https://www.macbartender.com/Bartender6/release_notes/) or [the Bartender 6 support page](https://www.macbartender.com/Bartender6/support/).

 - `lima` has been updated from `1.x` to `2.x`. This major update includes several breaking changes, such as `/tmp/lima` no longer being mounted by default.
@@ -282,6 +286,8 @@

 - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.

+- The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
+
 - Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows to avoid switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.

 - GNU Taler has been updated to version 1.3.
@@ -37,17 +37,63 @@ rec {
  );

  /**
-    This is the entrypoint for the portable part of modular services.
+    Entrypoint for integrating modular services into a containing module system.

-    It provides the various options that are consumed by service manager implementations.
+    Each containing system (NixOS, ...) calls `configure` to
+    obtain a `serviceSubmodule` type for its services option. The returned submodule
+    includes the portable service base and any service-manager-specific modules
+    passed via `extraRootModules`.
+
+    **Implementing for a new system** (e.g. home-manager, nix-darwin):
+
+    ```nix
+    # darwin/modules/services/system.nix
+    { lib, config, pkgs, ... }:
+    let
+      portable-lib = import <nixpkgs/lib/services/lib.nix> { inherit lib; };
+
+      modularServiceConfiguration = portable-lib.configure {
+        serviceManagerPkgs = pkgs;
+        extraRootModules = [
+          ./launchd-service.nix    # launchd-specific options (plist generation, etc.)
+        ];
+      };
+    in
+    {
+      options.services = lib.mkOption {
+        type = lib.types.attrsOf modularServiceConfiguration.serviceSubmodule;
+        default = { };
+      };
+
+      config = {
+        # Convert service tree -> launchd plists, assertions, etc.
+        # (analogous to how NixOS converts to systemd units)
+        launchd.agents = ...;
+        assertions = ...;
+        warnings = ...;
+      };
+    }
+    ```
+
+    lib.services.configure :: AttrSet -> { serviceSubmodule :: SubmoduleType }

    # Inputs

-    `serviceManagerPkgs`: A Nixpkgs instance which will be used for built-in logic such as converting `configData.<path>.text` to a store path.
+    `serviceManagerPkgs`

-    `extraRootModules`: Modules to be loaded into the "root" service submodule, but not into its sub-`services`. That's the modules' own responsibility.
+    : 1\. A Nixpkgs instance used for built-in logic such as converting
+    `configData.<path>.text` to a store path.

-    `extraRootSpecialArgs`: Fixed module arguments that are provided in a similar manner to `extraRootModules`.
+    `extraRootModules`
+
+    : 2\. Modules to be loaded into the "root" service submodule, but not
+    into its sub-`services`. That's the modules' own responsibility.
+    Typically contains service-manager-specific option modules
+    (e.g. systemd unit options, launchd plist options).
+
+    `extraRootSpecialArgs`
+
+    : 3\. Fixed module arguments provided alongside `extraRootModules`.

    # Output

@@ -145,6 +145,12 @@
    githubId = 67933444;
    keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
  };
+  _0xgsvs = {
+    email = "venkat.subrahmanyam.34@gmail.com";
+    name = "0xgsvs";
+    github = "0xgsvs";
+    githubId = 161702876;
+  };
  _0xMillyByte = {
    email = "emilia.daelman@gmail.com";
    name = "Emilia Daelman";
@@ -4849,6 +4855,12 @@
    github = "CHN-beta";
    githubId = 35858462;
  };
+  choco98 = {
+    name = "Conor Boyle";
+    email = "conorboyle07@protonmail.com";
+    github = "chocoblocko9";
+    githubId = 91826251;
+  };
  ChocolateLoverRaj = {
    email = "paranjperajas@gmail.com";
    github = "ChocolateLoverRaj";
@@ -5449,6 +5461,12 @@
    name = "Simon Hauser";
    githubId = 15233006;
  };
+  connor-grady = {
+    email = "connor.grady@gmail.com";
+    github = "connor-grady";
+    githubId = 50903811;
+    name = "Connor Grady";
+  };
  connorbaker = {
    email = "ConnorBaker01@gmail.com";
    matrix = "@connorbaker:matrix.org";
@@ -11662,6 +11680,11 @@
    github = "IsotoxalDev";
    githubId = 62714538;
  };
+  issai = {
+    name = "Issai";
+    github = "TheLimifiedLime";
+    githubId = 69121493;
+  };
  istoph = {
    email = "chr@istoph.de";
    name = "Christoph Hüffelmann";
@@ -14460,6 +14483,12 @@
    githubId = 913109;
    name = "Emil Fresk";
  };
+  korkutkardes7 = {
+    email = "korkutkardes7@hotmail.com";
+    github = "KorkutKardes7";
+    githubId = 148012191;
+    name = "Korkut Kardeşseven";
+  };
  kornholi = {
    email = "kornholijo@gmail.com";
    github = "kornholi";
@@ -24646,6 +24675,7 @@
    name = "Greg Pfeil";
  };
  sempiternal-aurora = {
+    email = "myrialsarvay@gmail.com";
    github = "sempiternal-aurora";
    githubId = 78790545;
    name = "Myria Sarvay";
@@ -139,7 +139,7 @@

 - [`pay-respects`](https://codeberg.org/iff/pay-respects), a terminal command correction program, alternative to `thefuck`, written in Rust. Available as [programs.pay-respects](options.html#opt-programs.pay-respects).

- [Radicle](https://radicle.xyz), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).
+- [Radicle](https://radicle.dev), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).

 - [Ordinal](https://github.com/snu-sf/Ordinal), A library for ordinal numbers in the Coq proof assistant.

@@ -149,9 +149,9 @@

 - [qBittorrent](https://www.qbittorrent.org/), a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable).

- [radicle-ci-broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), a tool for running CI for repositories in the local [Radicle](https://radicle.xyz/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).
+- [radicle-ci-broker](https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), a tool for running CI for repositories in the local [Radicle](https://radicle.dev/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).

- [radicle-native-ci](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE), an adapter for the [Radicle CI broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), for performing CI runs locally. Available as [services.radicle.ci.adapters.native](#opt-services.radicle.ci.adapters.native.instances).
+- [radicle-native-ci](https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE), an adapter for the [Radicle CI broker](https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), for performing CI runs locally. Available as [services.radicle.ci.adapters.native](#opt-services.radicle.ci.adapters.native.instances).

 - [rauc](https://rauc.io/) (the Robust Auto-Update Controller), a daemon that allows reliable and secure software updates in embedded Linux systems. Available at [services.rauc](#opt-services.rauc.enable).

@@ -57,6 +57,8 @@

 - [OpenThread Border Router](https://openthread.io/), a Thread border router for POSIX-based platforms that bridges Thread mesh networks to IP networks. Available as [services.openthread-border-router](#opt-services.openthread-border-router.enable).

+- [Atuin](https://atuin.sh), magical shell history — sync, search and backup your terminal history. Available as [programs.atuin](#opt-programs.atuin.enable).
+
 - [Meshtastic](https://meshtastic.org), an open-source, off-grid, decentralised mesh network
  designed to run on affordable, low-power devices. Available as [services.meshtasticd]
  (#opt-services.meshtasticd.enable).
@@ -127,6 +129,8 @@

 - [RSSHub](https://github.com/DIYgod/RSSHub), a service to convert many sources into rss. Available as `services.rsshub`.

+- [ReFrame](https://github.com/AlynxZhou/reframe), a DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login.
+
 - [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).

 - [Shoko](https://shokoanime.com), an anime management system. Available as [services.shoko](#opt-services.shoko.enable).
@@ -278,6 +278,21 @@ rec {
      attr ? ${name} && !(hasPrefix "@" attr.${name})
    ) "Systemd ${group} field `${name}' is not a systemd credential";

+  assertRouteMetricOrTriple =
+    name: group: attr:
+    let
+      isMetric = n: 0 <= n && 4294967295 >= n;
+
+      parts = splitString ":" attr.${name};
+      partsValid =
+        length parts == 3 && all (p: (match "[0-9]+" p) != null && isMetric (toIntBase10 p)) parts;
+      valid = (isInt attr.${name} && isMetric attr.${name}) || partsValid;
+    in
+    optional (attr ? ${name} && !valid) (
+      "Systemd ${group} field `${name}' must either be an integer in the range [0,4294967295]"
+      + " or a string containing three integers separated with `:`"
+    );
+
  checkUnitConfig =
    group: checks: attrs:
    let
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,

  buildPythonApplication,
  colorama,
@@ -59,6 +60,8 @@ buildPythonApplication {
    socat
    util-linux
    vde2
+  ]
+  ++ lib.optionals stdenv.isLinux [
    vhost-device-vsock
  ]
  ++ lib.optionals enableNspawn [
@@ -1,7 +1,7 @@
 {
  config,
  lib,
-  pkgs,
+  hostPkgs,
  ...
 }:
 let
@@ -75,9 +75,9 @@ in
        ) (lib.attrValues config.nodes ++ lib.attrValues config.containers)
      );
      global_timeout = config.globalTimeout;
-      test_script = pkgs.writeText "test-script" config.testScriptString;
+      test_script = hostPkgs.writeText "test-script" config.testScriptString;
      enable_ssh_backdoor = config.sshBackdoor.enable;
    };
-    driverConfigurationFile = pkgs.writers.writeJSON "driverConfiguration.json" config.driverConfiguration;
+    driverConfigurationFile = hostPkgs.writers.writeJSON "driverConfiguration.json" config.driverConfiguration;
  };
 }
@@ -9,6 +9,8 @@ let

  inherit (config) sshBackdoor;

+  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+
  # Reifies and correctly wraps the python test driver for
  # the respective qemu version and with or without ocr support
  testDriver = config.pythonTestDriverPackage.override {
@@ -251,7 +253,7 @@ in
        # depending on whether debugging is enabled.
        #
        # If needed, this can still be turned off.
-        virtualisation.qemu.enableSharedMemory = lib.mkDefault true;
+        virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;

        assertions = [
          {
@@ -0,0 +1,24 @@
+{ lib, config, ... }:
+let
+  facterLib = import ./lib.nix lib;
+
+  inherit (config.hardware.facter) report;
+  isBaremetal = config.hardware.facter.detected.virtualisation.none.enable;
+  hasAmdCpu = facterLib.hasAmdCpu report;
+
+  kver = config.boot.kernelPackages.kernel.version;
+in
+lib.mkIf (config.hardware.facter.enable && isBaremetal && hasAmdCpu) {
+  boot = lib.mkMerge [
+    (lib.mkIf ((lib.versionAtLeast kver "5.17") && (lib.versionOlder kver "6.1")) {
+      kernelParams = [ "initcall_blacklist=acpi_cpufreq_init" ];
+      kernelModules = [ "amd-pstate" ];
+    })
+    (lib.mkIf ((lib.versionAtLeast kver "6.1") && (lib.versionOlder kver "6.3")) {
+      kernelParams = [ "amd_pstate=passive" ];
+    })
+    (lib.mkIf (lib.versionAtLeast kver "6.3") {
+      kernelParams = [ "amd_pstate=active" ];
+    })
+  ];
+}
@@ -5,6 +5,7 @@
 }:
 {
  imports = [
+    ./amd-cpu.nix
    ./boot.nix
    ./bluetooth.nix
    ./camera
@@ -6,11 +6,10 @@
 }:
 let
  cfg = config.hardware.openrazer;
-  kernelPackages = config.boot.kernelPackages;

  toPyBoolStr = b: if b then "True" else "False";

-  daemonExe = "${pkgs.openrazer-daemon}/bin/openrazer-daemon --config ${daemonConfFile}";
+  daemonExe = "${cfg.packages.daemon}/bin/openrazer-daemon --config ${daemonConfFile}";

  daemonConfFile = pkgs.writeTextFile {
    name = "razer.conf";
@@ -132,6 +131,14 @@ in
          can start and interact with the OpenRazer userspace daemon.
        '';
      };
+
+      packages = {
+        kernel = lib.mkPackageOption pkgs "openrazer kernel" { } // {
+          default = config.boot.kernelPackages.openrazer;
+          defaultText = lib.literalExpression "config.boot.kernelPackages.openrazer";
+        };
+        daemon = lib.mkPackageOption pkgs [ "python3Packages" "openrazer-daemon" ] { };
+      };
    };
  };

@@ -143,14 +150,16 @@ in
  ];

  config = lib.mkIf cfg.enable {
-    boot.extraModulePackages = [ kernelPackages.openrazer ];
+    boot.extraModulePackages = [ cfg.packages.kernel ];
    boot.kernelModules = drivers;

    # Makes the man pages available so you can successfully run
    # > systemctl --user help openrazer-daemon
-    environment.systemPackages = [ pkgs.python3Packages.openrazer-daemon.man ];
+    environment.systemPackages = lib.mkIf (cfg.packages.daemon ? man) [
+      cfg.packages.daemon.man
+    ];

-    services.udev.packages = [ kernelPackages.openrazer ];
+    services.udev.packages = [ cfg.packages.kernel ];
    services.dbus.packages = [ dbusServiceFile ];

    # A user must be a member of the openrazer group in order to start
@@ -92,7 +92,7 @@ in
            -i ${channelSources} --quiet --option build-use-substitutes false \
            ${lib.optionalString config.boot.initrd.systemd.enable "--option sandbox false"} # There's an issue with pivot_root
          mkdir -m 0700 -p /root/.nix-defexpr
-          ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
+          ln -sfvT /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
          mkdir -m 0755 -p /var/lib/nixos
          touch /var/lib/nixos/did-channel-init
        fi
@@ -168,6 +168,7 @@
  ./programs/appimage.nix
  ./programs/arp-scan.nix
  ./programs/atop.nix
+  ./programs/atuin.nix
  ./programs/ausweisapp.nix
  ./programs/autoenv.nix
  ./programs/autojump.nix
@@ -691,6 +692,7 @@
  ./services/hardware/nvidia-optimus.nix
  ./services/hardware/openrgb.nix
  ./services/hardware/pcscd.nix
+  ./services/hardware/pdudaemon.nix
  ./services/hardware/pid-fan-controller.nix
  ./services/hardware/pommed.nix
  ./services/hardware/power-profiles-daemon.nix
@@ -0,0 +1,195 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) escapeShellArgs;
+
+  cfg = config.programs.atuin;
+
+  tomlFormat = pkgs.formats.toml { };
+
+  settingsFile = tomlFormat.generate "atuin-config" cfg.settings;
+in
+{
+  options.programs.atuin = {
+    enable = lib.mkEnableOption "atuin";
+
+    package = lib.mkPackageOption pkgs "atuin" { };
+
+    enableBashIntegration = lib.mkEnableOption "Bash integration" // {
+      default = config.programs.bash.enable;
+      defaultText = lib.literalExpression "config.programs.bash.enable";
+    };
+
+    enableZshIntegration = lib.mkEnableOption "Zsh integration" // {
+      default = config.programs.zsh.enable;
+      defaultText = lib.literalExpression "config.programs.zsh.enable";
+    };
+
+    enableFishIntegration = lib.mkEnableOption "Fish integration" // {
+      default = config.programs.fish.enable;
+      defaultText = lib.literalExpression "config.programs.fish.enable";
+    };
+
+    flags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "--disable-up-arrow"
+        "--disable-ctrl-r"
+      ];
+      description = ''
+        Flags to append to the shell hook.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = tomlFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          auto_sync = true;
+          sync_frequency = "5m";
+          sync_address = "https://api.atuin.sh";
+          search_mode = "prefix";
+        }
+      '';
+      description = ''
+        Configuration written to {file}`/etc/atuin/config.toml`.
+
+        See <https://docs.atuin.sh/configuration/config/> for the full list
+        of options.
+      '';
+    };
+
+    daemon = {
+      enable = lib.mkEnableOption "the Atuin daemon" // {
+        default = pkgs.stdenv.hostPlatform.isLinux;
+        defaultText = lib.literalExpression "pkgs.stdenv.hostPlatform.isLinux";
+      };
+
+      logLevel = lib.mkOption {
+        type = lib.types.enum [
+          "trace"
+          "debug"
+          "info"
+          "warn"
+          "error"
+        ];
+        default = "info";
+        description = ''
+          Log level for the Atuin daemon.
+        '';
+      };
+    };
+
+    themes = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          tomlFormat.type
+          lib.types.path
+          lib.types.lines
+        ]
+      );
+      description = ''
+        Each theme is written to
+        {file}`/etc/atuin/themes/theme-name.toml`
+        where the name of each attribute is the theme-name
+
+        See <https://docs.atuin.sh/guide/theming/> for the full list
+        of options.
+      '';
+      default = { };
+      example = lib.literalExpression ''
+        {
+          "my-theme" = {
+            theme.name = "My Theme";
+            colors = {
+              Base = "#000000";
+              Title = "#FFFFFF";
+            };
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # Atuin only reads from ATUIN_CONFIG_DIR or XDG_CONFIG_HOME, not XDG_CONFIG_DIRS,
+    # so we must set ATUIN_CONFIG_DIR to point to the system-wide config location.
+    environment.variables.ATUIN_CONFIG_DIR = "/etc/atuin";
+
+    environment.etc = lib.mkMerge [
+      (lib.mkIf (cfg.settings != { }) {
+        "atuin/config.toml".source = settingsFile;
+      })
+
+      (lib.mkIf (cfg.themes != { }) (
+        builtins.mapAttrs' (
+          name: theme:
+          lib.nameValuePair "atuin/themes/${name}.toml" {
+            source =
+              if builtins.isString theme then
+                pkgs.writeText "atuin-theme-${name}" theme
+              else if builtins.isPath theme || lib.isStorePath theme then
+                theme
+              else
+                tomlFormat.generate "atuin-theme-${name}" theme;
+          }
+        ) cfg.themes
+      ))
+    ];
+
+    programs.bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
+      if [[ :$SHELLOPTS: =~ :(vi|emacs): ]]; then
+        eval "$(${lib.getExe cfg.package} init bash ${escapeShellArgs cfg.flags})"
+      fi
+    '';
+
+    programs.zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
+      if [[ $options[zle] = on ]]; then
+        eval "$(${lib.getExe cfg.package} init zsh ${escapeShellArgs cfg.flags})"
+      fi
+    '';
+
+    programs.fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
+      ${lib.getExe cfg.package} init fish ${escapeShellArgs cfg.flags} | source
+    '';
+
+    systemd = lib.mkIf (cfg.daemon.enable && pkgs.stdenv.hostPlatform.isLinux) {
+      user.services.atuin-daemon = {
+        unitConfig = {
+          Description = "Atuin daemon";
+          Requires = [ "atuin-daemon.socket" ];
+        };
+        serviceConfig = {
+          ExecStart = "${lib.getExe cfg.package} daemon start";
+          Environment = [ "ATUIN_LOG=${cfg.daemon.logLevel}" ];
+          Restart = "on-failure";
+          RestartSteps = 3;
+          RestartMaxDelaySec = 6;
+        };
+      };
+
+      user.sockets.atuin-daemon = {
+        unitConfig = {
+          Description = "Atuin daemon socket";
+        };
+        socketConfig = {
+          ListenStream = "%t/atuin/atuin.sock";
+          SocketMode = "0640";
+          DirectoryMode = "0740";
+          RemoveOnStop = true;
+        };
+        wantedBy = [ "sockets.target" ];
+      };
+    };
+  };
+
+  meta.maintainers = cfg.package.meta.maintainers;
+}
@@ -143,68 +143,81 @@ in
    };
  };

-  config = lib.mkIf (cfg.enable && cfg.stateful) {
-    systemd.services = {
-      dhparams-init = {
-        description = "Clean Up Old Diffie-Hellman Parameters";
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      warnings = [
+        ''
+          The `security.dhparam` module is deprecated and scheduled for removal in NixOS 26.11.
+          Generating your own params has been shown to be problematic in RFC 7919 (2016).

-        # Clean up even when no DH params is set
-        wantedBy = [ "multi-user.target" ];
+          Remove any uses of DHE and migrate to ECDHE (RFC 8422, 2018) and
+          Hybrid PQ (draft-ietf-tls-ecdhe-mlkem, 2026) key exchange algorithms.
+        ''
+      ];
+    })
+    (lib.mkIf (cfg.enable && cfg.stateful) {
+      systemd.services = {
+        dhparams-init = {
+          description = "Clean Up Old Diffie-Hellman Parameters";

-        serviceConfig.RemainAfterExit = true;
-        serviceConfig.Type = "oneshot";
+          # Clean up even when no DH params is set
+          wantedBy = [ "multi-user.target" ];

-        script = ''
-          if [ ! -d ${cfg.path} ]; then
-            mkdir -p ${cfg.path}
-          fi
+          serviceConfig.RemainAfterExit = true;
+          serviceConfig.Type = "oneshot";

-          # Remove old dhparams
-          for file in ${cfg.path}/*; do
-            if [ ! -f "$file" ]; then
-              continue
+          script = ''
+            if [ ! -d ${cfg.path} ]; then
+              mkdir -p ${cfg.path}
            fi
-            ${lib.concatStrings (
-              lib.mapAttrsToList (
-                name:
-                { bits, path, ... }:
-                ''
-                  if [ "$file" = ${lib.escapeShellArg path} ] && \
-                     ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
-                     | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
-                    continue
-                  fi
-                ''
-              ) cfg.params
-            )}
-            rm "$file"
-          done

-          # TODO: Ideally this would be removing the *former* cfg.path, though
-          # this does not seem really important as changes to it are quite
-          # unlikely
-          rmdir --ignore-fail-on-non-empty ${cfg.path}
-        '';
-      };
-    }
-    // lib.mapAttrs' (
-      name:
-      { bits, path, ... }:
-      lib.nameValuePair "dhparams-gen-${name}" {
-        description = "Generate Diffie-Hellman Parameters for ${name}";
-        after = [ "dhparams-init.service" ];
-        before = [ "${name}.service" ];
-        requiredBy = [ "${name}.service" ];
-        wantedBy = [ "multi-user.target" ];
-        unitConfig.ConditionPathExists = "!${path}";
-        serviceConfig.Type = "oneshot";
-        script = ''
-          mkdir -p ${lib.escapeShellArg cfg.path}
-          ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
-            ${toString bits}
-        '';
+            # Remove old dhparams
+            for file in ${cfg.path}/*; do
+              if [ ! -f "$file" ]; then
+                continue
+              fi
+              ${lib.concatStrings (
+                lib.mapAttrsToList (
+                  name:
+                  { bits, path, ... }:
+                  ''
+                    if [ "$file" = ${lib.escapeShellArg path} ] && \
+                       ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
+                       | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
+                      continue
+                    fi
+                  ''
+                ) cfg.params
+              )}
+              rm "$file"
+            done
+
+            # TODO: Ideally this would be removing the *former* cfg.path, though
+            # this does not seem really important as changes to it are quite
+            # unlikely
+            rmdir --ignore-fail-on-non-empty ${cfg.path}
+          '';
+        };
      }
-    ) cfg.params;
-  };
+      // lib.mapAttrs' (
+        name:
+        { bits, path, ... }:
+        lib.nameValuePair "dhparams-gen-${name}" {
+          description = "Generate Diffie-Hellman Parameters for ${name}";
+          after = [ "dhparams-init.service" ];
+          before = [ "${name}.service" ];
+          requiredBy = [ "${name}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          unitConfig.ConditionPathExists = "!${path}";
+          serviceConfig.Type = "oneshot";
+          script = ''
+            mkdir -p ${lib.escapeShellArg cfg.path}
+            ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
+              ${toString bits}
+          '';
+        }
+      ) cfg.params;
+    })
+  ];

 }
@@ -47,7 +47,7 @@ in
    includeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to include into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -58,7 +58,7 @@ in
    excludeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to exclude into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -360,7 +360,7 @@ in
        ${lib.optionalString haveLocalDB ''
          if ! [ -e ${baseDir}/.db-created ]; then
            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
-            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -- -O hydra hydra
+            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
            touch ${baseDir}/.db-created
          fi
          echo "create extension if not exists pg_trgm" | runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
@@ -81,7 +81,7 @@ in
                };
                description = ''
                  Configuration of radicle-native-ci.
-                  See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE#configuration> for more information.
+                  See <https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE#configuration> for more information.
                '';
                default = { };
              };
@@ -135,7 +135,7 @@ in
      };
      description = ''
        Configuration of radicle-ci-broker.
-        See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/doc/userguide.md#configuration> for more information.
+        See <https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/doc/userguide.md#configuration> for more information.
      '';
      default = { };
      example = lib.literalExpression ''
@@ -73,7 +73,9 @@ in
      extraGroups = [ "video" ];
    };
    # Required for authentication
-    security.pam.services.cosmic-greeter = { };
+    security.pam.services.cosmic-greeter = {
+      allowNullPassword = true;
+    };

    hardware.graphics.enable = true;
    services.accounts-daemon.enable = true;
@@ -0,0 +1,146 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.pdudaemon;
+  configFile = pkgs.writeText "pdudaemon.conf" (
+    lib.generators.toJSON { } {
+      daemon = {
+        hostname = cfg.bindAddress;
+        port = cfg.port;
+        logging_level = cfg.logLevel;
+        listener = cfg.listener;
+      };
+      pdus = cfg.pdus;
+    }
+  );
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.pdudaemon = {
+      enable = lib.mkEnableOption "PDUDaemon";
+
+      package = lib.mkPackageOption pkgs "pdudaemon" { };
+
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the PDUDaemon.";
+      };
+
+      port = lib.mkOption {
+        default = 16421;
+        type = lib.types.port;
+        description = "Port to bind to.";
+      };
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to automatically open the PDUDaemon listen port in the firewall.
+        '';
+      };
+
+      listener = lib.mkOption {
+        default = "http";
+        type = lib.types.enum [
+          "http"
+          "tcp"
+        ];
+        description = "Which kind of listener to provide.";
+      };
+
+      logLevel = lib.mkOption {
+        default = "error";
+        type = lib.types.enum [
+          "debug"
+          "info"
+          "warning"
+          "error"
+        ];
+        description = "PDUDaemon log level.";
+      };
+
+      pdus = lib.mkOption {
+        type = with lib.types; attrsOf anything;
+        default = { };
+        description = ''
+          Structural pdus section of PDUDaemon's pdudaemon.conf.
+          Refer to <https://github.com/pdudaemon/pdudaemon/blob/main/share/pdudaemon.conf>
+          for more examples.
+        '';
+        example = lib.literalExpression ''
+          {
+            cbs350-poe-switch = {
+              driver = "snmpv1";
+              community = "private";
+              oid = ".1.3.6.1.2.1.105.1.1.1.3.1.*;
+              onsetting = 1;
+              offsetting = 2;
+            };
+            energenie = {
+              driver = "EG-PMS";
+              device = "aa:bb:cc:xx:yy";
+            };
+            local = {
+              driver = "localcmdline";
+            };
+          };
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.pdudaemon = {
+      after = [ "network-online.target" ];
+      description = "Control and Queueing daemon for PDUs";
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --conf ${configFile}";
+        Type = "simple";
+        DynamicUser = "yes";
+        StateDirectory = "pdudaemon";
+        ProtectHome = true;
+        Restart = "on-failure";
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
+        RestrictNamespaces = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictRealtime = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
@@ -41,7 +41,7 @@ in
    environmentFile = mkOption {
      type = nullOr path;
      default = null;
-      example = /run/keys/evcc;
+      example = "/run/keys/evcc";
      description = ''
        File with environment variables to pass into the runtime environment.

@@ -329,8 +329,8 @@ in
          This option does not delete accounts which are not (anymore) listed.
        '';
        example = {
-          "user1@localhost".passwordFile = /secrets/user1-localhost;
-          "user2@localhost".passwordFile = /secrets/user2-localhost;
+          "user1@localhost".passwordFile = "/secrets/user1-localhost";
+          "user2@localhost".passwordFile = "/secrets/user2-localhost";
        };
        type = lib.types.attrsOf (
          lib.types.submodule {
@@ -81,7 +81,6 @@ in
            description = ''
              Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
              If set to `null`, tuwunel will listen on IPv4 and IPv6 localhost.
-              Must be `null` if `unix_socket_path` is set.
            '';
          };
          global.port = lib.mkOption {
@@ -167,14 +166,6 @@ in

  config = lib.mkIf cfg.enable {
    assertions = [
-      {
-        assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
-        message = ''
-          In `services.matrix-tuwunel.settings.global`, `unix_socket_path` and `address` cannot be set at the
-          same time.
-          Leave one of the two options unset or explicitly set them to `null`.
-        '';
-      }
      {
        assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
        message = "If `services.matrix-tuwunel.user` is changed, the configured user must already exist.";
@@ -56,7 +56,7 @@ in
        '';
        description = ''
          Extra environment variables for Open-WebUI.
-          For more details see <https://docs.openwebui.com/getting-started/env-configuration>
+          For more details see <https://docs.openwebui.com/getting-started>
        '';
      };

@@ -41,7 +41,7 @@ let
      pkgs.gitMinimal
    ];
    documentation = [
-      "https://docs.radicle.xyz/guides/seeder"
+      "https://radicle.dev/guides/seeder"
    ];
    after = [
      "network.target"
@@ -225,7 +225,7 @@ in
        };
      settings = lib.mkOption {
        description = ''
-          See <https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275>
+          See <https://radicle.network/nodes/iris.radicle.network/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275>
        '';
        default = { };
        example = lib.literalExpression ''
@@ -2091,7 +2091,7 @@ in
        set -o errexit -o pipefail -o nounset -o errtrace
        shopt -s inherit_errexit

-        exec ${cfg.package}/bin/grafana server -homepath ${cfg.dataDir} -config ${configFile}
+        exec ${lib.getExe cfg.package} server -homepath ${cfg.dataDir} -config ${configFile}
      '';
      serviceConfig = {
        WorkingDirectory = cfg.dataDir;
@@ -374,7 +374,7 @@ let
          after = [ "network.target" ];
          serviceConfig.Restart = mkDefault "always";
          serviceConfig.PrivateTmp = mkDefault true;
-          serviceConfig.WorkingDirectory = mkDefault /tmp;
+          serviceConfig.WorkingDirectory = mkDefault "/tmp";
          serviceConfig.DynamicUser = mkDefault enableDynamicUser;
          serviceConfig.User = mkDefault conf.user;
          serviceConfig.Group = conf.group;
@@ -23,13 +23,10 @@ let
    if (builtins.isPath file) || (lib.isStorePath file) then
      file
    else
-      (
-        lib.warn ''
-          ${logPrefix}: configuration file "${file}" is being copied to the nix-store.
-          If you would like to avoid that, please set enableConfigCheck to false.
-        '' /.
-        + file
-      );
+      (lib.warn ''
+        ${logPrefix}: configuration file "${file}" is being copied to the nix-store.
+        If you would like to avoid that, please set enableConfigCheck to false.
+      '' (builtins.toFile (builtins.baseNameOf file) (builtins.readFile file)));
  checkConfigLocation =
    file:
    if lib.hasPrefix "/tmp/" file then
@@ -27,7 +27,7 @@ in
    };
    ecoflowAccessKeyFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-access-key;
+      default = "/etc/ecoflow-access-key";
      description = ''
        Path to the file with your personal api access string from the Ecoflow development website <https://developer-eu.ecoflow.com>.
        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
@@ -35,7 +35,7 @@ in
    };
    ecoflowSecretKeyFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-secret-key;
+      default = "/etc/ecoflow-secret-key";
      description = ''
        Path to the file with your personal api secret string from the Ecoflow development website <https://developer-eu.ecoflow.com>.
        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
@@ -43,7 +43,7 @@ in
    };
    ecoflowEmailFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-email;
+      default = "/etc/ecoflow-email";
      description = ''
        Path to the file with your personal ecoflow app login email address.
        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
@@ -51,7 +51,7 @@ in
    };
    ecoflowPasswordFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-password;
+      default = "/etc/ecoflow-password";
      description = ''
        Path to the file with your personal ecoflow app login email password.
        Do to share or commit your plaintext passwords to a public repo use: agenix or soaps here!
@@ -59,7 +59,7 @@ in
    };
    ecoflowDevicesFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-devices;
+      default = "/etc/ecoflow-devices";
      description = ''
        File must contain one line, example: R3300000,R3400000,NC430000,....
        The list of devices serial numbers separated by comma. For instance: SN1,SN2,SN3.
@@ -69,7 +69,7 @@ in
    };
    ecoflowDevicesPrettyNamesFile = mkOption {
      type = types.path;
-      default = /etc/ecoflow-devices-pretty-names;
+      default = "/etc/ecoflow-devices-pretty-names";
      description = ''
        File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
        The key/value map of custom names for your devices. Key is a serial number, value is a device name you want
@@ -24,13 +24,10 @@ let
    if (builtins.isPath file) || (lib.isStorePath file) then
      file
    else
-      (
-        lib.warn ''
-          ${logPrefix}: configuration file "${file}" is being copied to the nix-store.
-          If you would like to avoid that, please set enableConfigCheck to false.
-        '' /.
-        + file
-      );
+      (lib.warn ''
+        ${logPrefix}: configuration file "${file}" is being copied to the nix-store.
+        If you would like to avoid that, please set enableConfigCheck to false.
+      '' (builtins.toFile (builtins.baseNameOf file) (builtins.readFile file)));

  checkConfig =
    file:
@@ -93,6 +93,8 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];

+    services.epmd.enable = true;
+
    users.users = lib.optionalAttrs (cfg.user == "ejabberd") {
      ejabberd = {
        group = cfg.group;
@@ -109,7 +111,11 @@ in
    systemd.services.ejabberd = {
      description = "ejabberd server";
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [
+        "network.target"
+        "epmd.socket"
+      ];
+      wants = [ "epmd.socket" ];
      path = [
        pkgs.findutils
        pkgs.coreutils
@@ -5,6 +5,8 @@
  ...
 }:
 let
+  inherit (lib.types) listOf oneOf str;
+
  cfg = config.services.epmd;
 in
 {
@@ -21,7 +23,10 @@ in
    };
    package = lib.mkPackageOption pkgs "erlang" { };
    listenStream = lib.mkOption {
-      type = lib.types.str;
+      type = oneOf [
+        str
+        (listOf str)
+      ];
      default = "[::]:4369";
      description = ''
        the listenStream used by the systemd socket.
@@ -10,6 +10,20 @@ let
  format = pkgs.formats.yaml { };
  settings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;

+  optionalPort = (lib.types.ints.between (-1) 65535);
+
+  normalisePort =
+    defaultPort: configValue:
+    if configValue == -1 then
+      null
+    else if configValue == 0 then
+      defaultPort
+    else
+      configValue;
+
+  actualRTMPPort = normalisePort 1935 cfg.settings.rtmp_port;
+  actualWHIPPort = normalisePort 8080 cfg.settings.whip_port;
+
  isLocallyDistributed = config.services.livekit.enable;
 in
 {
@@ -43,15 +57,15 @@ in
        freeformType = format.type;
        options = {
          rtmp_port = lib.mkOption {
-            type = lib.types.port;
+            type = optionalPort;
            default = 1935;
-            description = "TCP port for RTMP connections";
+            description = "TCP port for RTMP connections. -1 to disable";
          };

          whip_port = lib.mkOption {
-            type = lib.types.port;
+            type = optionalPort;
            default = 8080;
-            description = "TCP port for WHIP connections";
+            description = "TCP port for WHIP connections. -1 to disable";
          };

          redis = {
@@ -120,10 +134,21 @@ in
  };

  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.openFirewall.rtmp -> actualRTMPPort != null;
+        message = "services.livekit-ingress: configured to open RTMP port, but the RTMP service is disabled";
+      }
+      {
+        assertion = cfg.openFirewall.whip -> actualWHIPPort != null;
+        message = "services.livekit-ingress: configured to open WHIP port, but the WHIP service is disabled";
+      }
+    ];
+
    networking.firewall = {
      allowedTCPPorts = lib.mkMerge [
-        (lib.mkIf cfg.openFirewall.rtmp [ cfg.settings.rtmp_port ])
-        (lib.mkIf cfg.openFirewall.whip [ cfg.settings.whip_port ])
+        (lib.mkIf cfg.openFirewall.rtmp [ actualRTMPPort ])
+        (lib.mkIf cfg.openFirewall.whip [ actualWHIPPort ])
      ];
      allowedUDPPortRanges = lib.mkIf cfg.openFirewall.rtc [
        {
@@ -0,0 +1,190 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.reframe;
+  iniFmt = pkgs.formats.ini { };
+in
+{
+  options.programs.reframe = {
+    enable = lib.mkEnableOption "DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login…";
+    package = lib.mkPackageOption pkgs "reframe" { };
+    configs = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            reframe = {
+              card = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+                description = "Select monitor via DRM card. All available cards and connectors can be found in `/sys/class/drm/`.";
+                example = "card0";
+              };
+              connector = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+                description = "Select monitor via connector. All available cards and connectors can be found in `/sys/class/drm/`.";
+                example = "eDP-1";
+              };
+              rotation = lib.mkOption {
+                type = lib.types.enum [
+                  0
+                  90
+                  180
+                  270
+                ];
+                default = 0;
+                description = ''
+                  This is the angle you rotate the monitor, not the angle of display content relative to the monitor!
+                  Valid angles are clockwise `0`, `90`, `180`, `270`.
+                '';
+              };
+              desktop-width = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If you have more than 1 monitor, set those values to the logical size of the whole virtual desktop.
+                  You can get those value by finding the pointer position of the right most and bottom most border of your monitors.
+                '';
+              };
+              desktop-height = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If you have more than 1 monitor, set those values to the logical size of the whole virtual desktop.
+                  You can get those value by finding the pointer position of the right most and bottom most border of your monitors.
+                '';
+              };
+              monitor-x = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If you have more than 1 monitor, set those values to the logical position of the top left corner of your selected monitor.
+                '';
+              };
+              monitor-y = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If you have more than 1 monitor, set those values to the logical position of the top left corner of your selected monitor.
+                '';
+              };
+              default-width = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If your client does not support resizing, use those to force a size. Empty or `0` means monitor size.
+                '';
+              };
+              default-height = lib.mkOption {
+                type = lib.types.int;
+                default = 0;
+                description = ''
+                  If your client does not support resizing, use those to force a size. Empty or `0` means monitor size.
+                '';
+              };
+              resize = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = ''
+                  Set to `false` to prohibit client resizing.
+                '';
+              };
+              cursor = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = ''
+                  Set to `false` to ignore DRM cursor plane.
+                '';
+              };
+              wakeup = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = ''
+                  Set to `false` if you already disabled automatic screen blank.
+                '';
+              };
+              damage = lib.mkOption {
+                type = lib.types.enum [
+                  ""
+                  "cpu"
+                  "gpu"
+                ];
+                default = true;
+                description = ''
+                  Set to `gpu` to use GPU damage region detection, which may be more efficiency but may cause artifacts depending on GPU vendors.
+                  Set to `cpu` to use CPU damage region detection if you get bugs with `gpu`.
+                  Empty to disable damage region detection, which may require higher network bandwidth.
+                '';
+              };
+              fps = lib.mkOption {
+                type = lib.types.int;
+                default = 30;
+              };
+            };
+            vnc = {
+              ip = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+                description = ''
+                  Empty means accept all incoming connections.
+                '';
+              };
+              port = lib.mkOption {
+                type = lib.types.port;
+                default = 5933;
+              };
+              password = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+                description = ''
+                  Empty means no password.
+                '';
+              };
+              type = lib.mkOption {
+                type = lib.types.enum [
+                  "libvncserver"
+                  "neatvnc"
+                ];
+                default = "libvncserver";
+                description = ''
+                  Set to `neatvnc` to prefer neatvnc, which provides more efficient encoding methods but maybe more unstable.
+                '';
+              };
+            };
+          };
+        }
+      );
+      default = { };
+      description = "Configurations for ReFrame";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+    systemd.tmpfiles.packages = [ cfg.package ];
+    users.users.reframe = {
+      isSystemUser = true;
+      group = "reframe";
+      description = "ReFrame Remote Desktop";
+    };
+    users.groups.reframe = { };
+    environment.etc = builtins.mapAttrs' (
+      name: value:
+      lib.nameValuePair "reframe/${name}.conf" {
+        mode = "0644";
+        user = "root";
+        group = "root";
+        source = iniFmt.generate "${name}.conf" value;
+      }
+    ) cfg.configs;
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    bitbloxhub
+  ];
+}
@@ -112,6 +112,8 @@ in
    systemd.services.thelounge = {
      description = "The Lounge web IRC client";
      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
      preStart = "ln -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
      environment.THELOUNGE_PACKAGES = mkIf (cfg.plugins != [ ]) "${plugins}";
      serviceConfig = {
@@ -10,9 +10,11 @@ let

  format = pkgs.formats.yaml { };

+  autheliaName = name: "authelia" + lib.optionalString (name != "") "-${name}";
+
  autheliaOpts =
    with lib;
-    { name, ... }:
+    { name, config, ... }:
    {
      options = {
        enable = mkEnableOption "Authelia instance";
@@ -23,21 +25,28 @@ let
          description = ''
            Name is used as a suffix for the service name, user, and group.
            By default it takes the value you use for `<instance>` in:
-            {option}`services.authelia.<instance>`
+            {option}`services.authelia.instances.<instance>`
+
+            When set to the empty string `""`, the service name, user, and group
+            will be just `authelia` without a suffix.
          '';
        };

        package = mkPackageOption pkgs "authelia" { };

        user = mkOption {
-          default = "authelia-${name}";
          type = types.str;
+          defaultText = lib.literalExpression ''
+            if name == "" then "authelia" else "authelia-''${name}"
+          '';
          description = "The name of the user for this authelia instance.";
        };

        group = mkOption {
-          default = "authelia-${name}";
          type = types.str;
+          defaultText = lib.literalExpression ''
+            if name == "" then "authelia" else "authelia-''${name}"
+          '';
          description = "The name of the group for this authelia instance.";
        };

@@ -252,6 +261,11 @@ let
          '';
        };
      };
+
+      config = {
+        user = mkDefault (autheliaName config.name);
+        group = mkDefault (autheliaName config.name);
+      };
    };

  writeOidcJwksConfigFile =
@@ -382,7 +396,7 @@ in
            ExecStart = "${execCommand} ${configArg}";
            Restart = "always";
            RestartSec = "5s";
-            StateDirectory = "authelia-${instance.name}";
+            StateDirectory = autheliaName instance.name;
            StateDirectoryMode = "0700";

            # Security options:
@@ -431,11 +445,8 @@ in
          };
        };
      mkInstanceUsersConfig = instance: {
-        groups."authelia-${instance.name}" = lib.mkIf (instance.group == "authelia-${instance.name}") {
-          name = "authelia-${instance.name}";
-        };
-        users."authelia-${instance.name}" = lib.mkIf (instance.user == "authelia-${instance.name}") {
-          name = "authelia-${instance.name}";
+        groups.${autheliaName instance.name} = lib.mkIf (instance.group == autheliaName instance.name) { };
+        users.${autheliaName instance.name} = lib.mkIf (instance.user == autheliaName instance.name) {
          isSystemUser = true;
          group = instance.group;
        };
@@ -468,7 +479,7 @@ in
        map (
          instance:
          lib.mkIf instance.enable {
-            "authelia-${instance.name}" = mkInstanceServiceConfig instance;
+            ${autheliaName instance.name} = mkInstanceServiceConfig instance;
          }
        ) instances
      );
@@ -481,5 +492,6 @@ in
    jk
    dit7ya
    nicomem
+    connor-grady
  ];
 }
@@ -25,50 +25,28 @@ let
    text = cfg.extraConfig;
  };

-  baseLoginOptions = "-p -- \\u";
+  baseLoginOptions = "-p";

-  agettyCmd =
+  loginCmd =
    enableAutologin:
-    "${lib.getExe' pkgs.util-linux "agetty"} ${
-      lib.escapeShellArgs (
-        [
-          "--login-program"
-          (toString gettyCfg.loginProgram)
-          "--login-options"
-          # these options are passed as a single parameter
-          "${lib.optionalString enableAutologin "-f "}${baseLoginOptions}"
-        ]
-        ++ lib.optionals enableAutologin [
-          "--autologin"
-          gettyCfg.autologinUser
-        ]
-        ++ gettyCfg.extraArgs
-        ++ [
-          "--8bits"
-          "--noclear"
-          "--"
-          "-"
-        ]
-      )
-    } $TERM";
+    "${gettyCfg.loginProgram} ${baseLoginOptions}${lib.optionalString enableAutologin " -f -- ${gettyCfg.autologinUser}"}";

-  loginScript = pkgs.writers.writeDash "kmscon-login" ''
-    kms_tty=
-    active_tty_file=/sys/class/tty/tty0/active
-    if [ -f "$active_tty_file" ]; then
-      read -r kms_tty < "$active_tty_file"
-    fi
+  loginScript = pkgs.writers.writeDash "kmscon-login" (
+    lib.optionalString (gettyCfg.autologinUser != null && gettyCfg.autologinOnce) ''
+      kms_tty=
+      active_tty_file=/sys/class/tty/tty0/active
+      if [ -f "$active_tty_file" ]; then
+        read -r kms_tty < "$active_tty_file"
+      fi

-    ${lib.optionalString (gettyCfg.autologinUser != null && gettyCfg.autologinOnce) ''
      autologged="/run/kmscon.autologged"
      if [ "$kms_tty" = tty1 ] && [ ! -f "$autologged" ]; then
        touch "$autologged"
-        exec ${agettyCmd true}
+        exec ${loginCmd true}
      fi
-    ''}
-
-    exec ${agettyCmd (gettyCfg.autologinUser != null && !gettyCfg.autologinOnce)}
-  '';
+    ''
+    + "exec ${loginCmd (gettyCfg.autologinUser != null && !gettyCfg.autologinOnce)}"
+  );
 in
 {
  imports = [
@@ -182,32 +160,28 @@ in

    systemd.suppressedSystemUnits = [ "getty@.service" ];

-    services.kmscon.extraConfig =
-      let
-        xkb = optionals cfg.useXkbConfig (
-          lib.mapAttrsToList (n: v: "xkb-${n}=${v}") (
-            lib.filterAttrs (
-              n: v:
-              builtins.elem n [
-                "layout"
-                "model"
-                "options"
-                "variant"
-              ]
-              && v != ""
-            ) config.services.xserver.xkb
-          )
-        );
-        render = optionals cfg.hwRender [
-          "drm"
-          "hwaccel"
-        ];
-        fonts =
-          optional (cfg.fonts != null)
-            "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}";
-        term = optional (cfg.term != null) "term=${cfg.term}";
-      in
-      lib.concatLines (xkb ++ render ++ fonts ++ term);
+    services.kmscon.extraConfig = lib.concatLines (
+      optionals cfg.useXkbConfig (
+        lib.mapAttrsToList (n: v: "xkb-${n}=${v}") (
+          lib.filterAttrs (
+            n: v:
+            builtins.elem n [
+              "layout"
+              "model"
+              "options"
+              "variant"
+            ]
+            && v != ""
+          ) config.services.xserver.xkb
+        )
+      )
+      ++ optionals cfg.hwRender [
+        "drm"
+        "hwaccel"
+      ]
+      ++ optional (cfg.fonts != null) "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}"
+      ++ optional (cfg.term != null) "term=${cfg.term}"
+    );

    hardware.graphics.enable = mkIf cfg.hwRender true;

@@ -240,11 +240,11 @@ in
      requires = [
        "network-online.target"
      ]
-      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
      after = [
        "network-online.target"
      ]
-      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
      wantedBy = [ "multi-user.target" ];
      environment = cfg.environment // {
        # Required, otherwise chrome dumps core
@@ -262,12 +262,12 @@ in
        "network-online.target"
        "linkwarden.service"
      ]
-      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
      after = [
        "network-online.target"
        "linkwarden.service"
      ]
-      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
      wantedBy = [ "multi-user.target" ];
      environment = cfg.environment // {
        # Required, otherwise chrome dumps core
@@ -455,6 +455,10 @@ in
          assertion = cfg.efiSupport;
          message = "Secure boot is only supported on EFI systems.";
        }
+        {
+          assertion = !cfg.enableEditor;
+          message = "Editor is unconditionally disabled by Limine.";
+        }
      ];

      boot.loader.limine.enrollConfig = true;
@@ -610,6 +610,17 @@ let
    )
  );

+  systemdStage1HardwareKeyAssertionMessage = opt: ''
+    ${opt} is deprecated, and it is unsupported with systemd stage 1. Support will be removed in 26.11 along with scripted stage 1. Hardware keys in systemd stage 1 are supported with systemd-cryptsetup(8). To migrate, enroll a key in a LUKS slot with systemd-cryptenroll(1). Usually, systemd will automatically detect the configuration at runtime, but if necessary, configure the corresponding crypttab(5) options with boot.initrd.luks.devices.<name>.crypttabExtraOpts.
+
+    Note: After migrating to a new LUKS slot, the old LUKS slot used for the scripted stage 1 implementation should be removed, otherwise it could interfere with falling back to a passphrase prompt in the event the hardware key fails.
+
+    See:
+    - https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup.html
+    - https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html
+    - https://www.freedesktop.org/software/systemd/man/crypttab.html
+  '';
+
 in
 {
  imports = [
@@ -1106,21 +1117,16 @@ in
      # TODO
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.gpgSupport;
-        message = "systemd stage 1 does not support GPG smartcards yet.";
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.gpgSupport";
      }
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.fido2Support;
-        message = ''
-          systemd stage 1 does not support configuring FIDO2 unlocking through `boot.initrd.luks.fido2Support`.
-          Use systemd-cryptenroll(1) to configure FIDO2 support, and set
-          `boot.initrd.luks.devices.''${DEVICE}.crypttabExtraOpts` as appropriate per crypttab(5)
-          (e.g. `fido2-device=auto`).
-        '';
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.fido2Support";
      }
      # TODO
      {
        assertion = config.boot.initrd.systemd.enable -> !luks.yubikeySupport;
-        message = "systemd stage 1 does not support Yubikeys yet.";
+        message = systemdStage1HardwareKeyAssertionMessage "boot.initrd.luks.yubikeySupport";
      }
    ];

@@ -1744,8 +1744,7 @@ let
        (assertValueOneOf "UseDNR" boolValues)
        (assertValueOneOf "UseDomains" (boolValues ++ [ "route" ]))
        (assertRange "RouteTable" 0 4294967295)
-        (assertInt "RouteMetric")
-        (assertRange "RouteMetric" 0 4294967295)
+        (assertRouteMetricOrTriple "RouteMetric")
        (assertValueOneOf "QuickAck" boolValues)
        (assertValueOneOf "UseMTU" boolValues)
        (assertValueOneOf "UseHopLimit" boolValues)
@@ -132,8 +132,8 @@ let
          default = [ ];
          description = "Environment files for this container.";
          example = [
-            /path/to/.env
-            /path/to/.env.secret
+            "/path/to/.env"
+            "/path/to/.env.secret"
          ];
        };

@@ -1362,7 +1362,7 @@ in
            + "${guest.address}:${toString guest.port},"
          else
            "'guestfwd=${proto}:${guest.address}:${toString guest.port}-"
-            + "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"
+            + "cmd:${hostPkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"
        );
        restrictNetworkOption = lib.optionalString cfg.restrictNetwork "restrict=on,";
      in
@@ -236,6 +236,7 @@ in
  atticd = runTest ./atticd.nix;
  attr = pkgs.callPackage ./attr.nix { };
  atuin = runTest ./atuin.nix;
+  atuin-programs = runTest ./atuin-programs.nix;
  audiobookshelf = runTest ./audiobookshelf.nix;
  audit = runTest ./audit.nix;
  audit-testsuite = runTest ./audit-testsuite.nix;
@@ -1251,6 +1252,7 @@ in
    inherit runTest;
  };
  pdns-recursor = runTest ./pdns-recursor.nix;
+  pdudaemon = runTest ./pdudaemon.nix;
  peerflix = runTest ./peerflix.nix;
  peering-manager = runTest ./web-apps/peering-manager.nix;
  peertube = handleTestOn [ "x86_64-linux" ] ./web-apps/peertube.nix { };
@@ -1377,6 +1379,7 @@ in
  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
  qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
  qgis-ltr = handleTest ./qgis.nix { package = pkgs.qgis-ltr; };
+  qlever = runTest ./qlever.nix;
  qownnotes = runTest ./qownnotes.nix;
  qtile = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile/default.nix;
  qtile-extras = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile-extras/default.nix;
@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+{
+  name = "atuin";
+  meta.maintainers = pkgs.atuin.meta.maintainers;
+
+  nodes.machine = {
+    programs = {
+      bash.enable = true;
+      fish.enable = true;
+      zsh.enable = true;
+
+      atuin = {
+        enable = true;
+        settings = {
+          auto_sync = false;
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+
+    # Check atuin is installed
+    machine.succeed("atuin --version")
+
+    # Check shell integration - verify the init scripts can be sourced without error
+    machine.succeed("bash -c 'eval \"$(atuin init bash)\"'")
+    machine.succeed("zsh -c 'eval \"$(atuin init zsh)\"'")
+    machine.succeed("fish -c 'atuin init fish | source'")
+
+    # Verify config file was created
+    machine.succeed("grep -q 'auto_sync = false' /etc/atuin/config.toml")
+
+    # Verify daemon socket unit is enabled
+    machine.succeed("systemctl --user --machine=root@ is-enabled atuin-daemon.socket")
+  '';
+}
@@ -45,6 +45,15 @@ in
    };
  };

+  channel = incusRunTest {
+    name = "channel";
+
+    instances.c1 = {
+      type = "container";
+      copyChannel = true;
+    };
+  };
+
  # used in lxc tests to verify container functionality
  container = incusRunTest {
    name = "container";
@@ -60,6 +60,11 @@ in
                default = { };
              };

+              copyChannel = lib.mkEnableOption ''
+                copy channel in test image. disabled by default as it forces image
+                rebuilds excessively. enable to validate channel things.
+              '';
+
              testScript = lib.mkOption {
                type = lib.types.str;
                description = "final script provided to test runner";
@@ -104,7 +109,7 @@ in
                  documentation.enable = lib.mkForce false;
                  documentation.nixos.enable = lib.mkForce false;
                  # including a channel forces images to be rebuilt on any changes
-                  system.installer.channel.enable = lib.mkForce false;
+                  system.installer.channel.enable = lib.mkForce config.copyChannel;

                  environment.etc."nix/registry.json".text = lib.mkForce "{}";

@@ -170,64 +175,67 @@ in
                #
                # container specific
                #
-                +
-                  lib.optionalString (config.type == "container")
-                    # python
-                    ''
-                      with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
-                          # Remove /sbin/init so we can verify installBootLoader recreates it
-                          server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
-                          server.fail(f"incus exec {instance_name} -- test -e /sbin/init")
+                + lib.optionalString (config.type == "container") (
+                  # python
+                  ''
+                    with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
+                        # Remove /sbin/init so we can verify installBootLoader recreates it
+                        server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
+                        server.fail(f"incus exec {instance_name} -- test -e /sbin/init")

-                          server.succeed(
-                              f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
-                          )
+                        server.succeed(
+                            f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
+                        )

-                          # Verify installBootLoader recreated /sbin/init pointing to the system's init
-                          server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
-                          target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
-                          current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
-                          assert target == current, f"/sbin/init -> {target}, expected {current}"
+                        # Verify installBootLoader recreated /sbin/init pointing to the system's init
+                        server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
+                        target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
+                        current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
+                        assert target == current, f"/sbin/init -> {target}, expected {current}"

-                      # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
-                      with subtest("[${image_id}] memory limits can be hotplug changed"):
-                          server.set_instance_config(instance_name, "limits.memory 512MB")
-                          # can't use lsmem since it sees the host's memory size
-                          server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)
+                    # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
+                    with subtest("[${image_id}] memory limits can be hotplug changed"):
+                        server.set_instance_config(instance_name, "limits.memory 512MB")
+                        # can't use lsmem since it sees the host's memory size
+                        server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)

-                      # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
-                      with subtest("[${image_id}] lxc-generator compatibility"):
-                          with subtest("[${image_id}] lxc-container generator configures plain container"):
-                              # default container is plain
-                              server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                    # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
+                    with subtest("[${image_id}] lxc-generator compatibility"):
+                        with subtest("[${image_id}] lxc-container generator configures plain container"):
+                            # default container is plain
+                            server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")

-                              server.check_instance_sysctl(instance_name)
+                            server.check_instance_sysctl(instance_name)

-                          with subtest("[${image_id}] lxc-container generator configures nested container"):
-                              server.set_instance_config(instance_name, "security.nesting=true", restart=True)
+                        with subtest("[${image_id}] lxc-container generator configures nested container"):
+                            server.set_instance_config(instance_name, "security.nesting=true", restart=True)

-                              server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
-                              target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
-                              assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
+                            server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                            target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
+                            assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"

-                              server.check_instance_sysctl(instance_name)
+                            server.check_instance_sysctl(instance_name)

-                      with subtest("[${image_id}] lxcfs"):
-                          with subtest("[${image_id}] mounts lxcfs overlays"):
-                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
-                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
+                    with subtest("[${image_id}] lxcfs"):
+                        with subtest("[${image_id}] mounts lxcfs overlays"):
+                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
+                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")

-                          with subtest("[${image_id}] supports per-instance lxcfs"):
-                              server.succeed(f"incus stop {instance_name}")
-                              server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                        with subtest("[${image_id}] supports per-instance lxcfs"):
+                            server.succeed(f"incus stop {instance_name}")
+                            server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")

-                              server.succeed("incus config set instances.lxcfs.per_instance=true")
-
-                              server.succeed(f"incus start {instance_name}")
-                              server.wait_for_instance(instance_name)
-                              server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
-                    ''
+                            server.succeed("incus config set instances.lxcfs.per_instance=true")

+                            server.succeed(f"incus start {instance_name}")
+                            server.wait_for_instance(instance_name)
+                            server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                  ''
+                  + lib.optionalString (config.copyChannel) ''
+                    with subtest("[${image_id}] channel copied correctly"):
+                        server.succeed(f"incus exec {instance_name} -- systemctl status nix-channel-init.service")
+                  ''
+                )
                #
                # virtual-machine specific
                #
@@ -31,7 +31,7 @@
  enableOCR = true;

  testScript = ''
-    machine.start()
+    machine.wait_for_unit("default.target")

    with subtest("ensure we can open a tty"):
      machine.wait_for_text("alice@machine")
@@ -0,0 +1,50 @@
+{ pkgs, ... }:
+{
+  name = "PDUDaemon";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    aiyion
+    emantor
+  ];
+
+  nodes.pdudaemonhost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.pdudaemon.enable = true;
+      services.pdudaemon.openFirewall = true;
+      services.pdudaemon.pdus = {
+        testpduhost = {
+          driver = "localcmdline";
+          cmd_on = "echo '%s on' >> /tmp/pdu";
+          cmd_off = "echo '%s off' >> /tmp/pdu";
+        };
+      };
+    };
+
+  nodes.clienthost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    #python
+    ''
+      with subtest("Wait for pdudaemon startup"):
+          pdudaemonhost.start()
+          pdudaemonhost.wait_for_unit("pdudaemon.service")
+          pdudaemonhost.wait_for_open_port(16421)
+          print(pdudaemonhost.succeed("curl 'http://localhost:16421/power/control/on?hostname=testpduhost&port=1'"))
+
+      with subtest("Connect from client"):
+          clienthost.start()
+          clienthost.wait_until_succeeds("curl 'http://pdudaemonhost:16421/power/control/off?hostname=testpduhost&port=1'")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 15
+          service_name = "pdudaemon"
+          pdudaemonhost.fail(f"systemd-analyze security {service_name}.service --threshold={exact_threshold-1}")
+          pdudaemonhost.succeed(f"systemd-analyze security {service_name}.service --threshold={exact_threshold}")
+    '';
+}
@@ -0,0 +1,52 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  olympics-qleverfile = "${pkgs.qlever-control.src}/src/qlever/Qleverfiles/Qleverfile.olympics";
+
+  olympics-dataset = pkgs.fetchurl {
+    url = "https://github.com/wallscope/olympics-rdf/raw/54483d539082641d48e1d49873662b3af628ca4d/data/olympics-nt-nodup.zip";
+    hash = "sha256-dY28CQKaMDUUw/pw+p9yX0EtJOnbAAplodMFaedL1B8=";
+  };
+in
+
+{
+  name = "Basic QLever test";
+  meta.maintainers = lib.teams.ngi.members;
+
+  nodes = {
+    machine =
+      {
+        pkgs,
+        ...
+      }:
+      {
+        environment.systemPackages = with pkgs; [
+          qlever
+          qlever-control
+          unzip
+        ];
+      };
+  };
+
+  testScript =
+    # python
+    ''
+      machine.succeed("cp ${olympics-dataset} /tmp/olympics.zip")
+      machine.succeed("cp ${olympics-qleverfile} /tmp/Qleverfile")
+      machine.succeed("unzip -q olympics.zip")
+
+      # use qlever binary instead of docker
+      machine.succeed("sed -i 's/SYSTEM = docker/SYSTEM = native/' /tmp/Qleverfile")
+
+      machine.succeed("qlever index")
+
+      machine.succeed("qlever start")
+      machine.wait_for_open_port(7019) # default server port
+
+      machine.succeed("qlever query")
+    '';
+}
@@ -3,17 +3,50 @@
  name = "dawarich-nixos";

  nodes.machine =
-    { pkgs, ... }:
+    { lib, pkgs, ... }:
    {
      services.dawarich = {
        enable = true;
        localDomain = "localhost";
      };

-      environment.etc.geojson.source = pkgs.fetchurl {
-        url = "https://github.com/Freika/dawarich/raw/8c24764aa56a084e980e21bc2ffd13a72fd611db/spec/fixtures/files/geojson/export.json";
-        hash = "sha256-qI00E5ixKTRJduAD+qB3JzvrpoJmC55llNtSiPVyxz4=";
-      };
+      environment.etc.geojson.text =
+        let
+          # based on https://github.com/Freika/dawarich/raw/8c24764aa56a084e980e21bc2ffd13a72fd611db/spec/fixtures/files/geojson/export.json
+          # but with different timestamps to avoid points being flagged as anomalies
+          points = map (i: {
+            lat = i / 10.0;
+            lon = i / 10.0;
+            timestamp = 1609459200 + i * 1000;
+          }) (lib.range 1 10);
+
+          mkGeoJsonPoint =
+            {
+              lat,
+              lon,
+              timestamp,
+            }:
+            {
+              type = "Feature";
+              geometry = {
+                type = "Point";
+                coordinates = [
+                  lon
+                  lat
+                ];
+              };
+              properties = {
+                altitude = 1;
+                vertical_accuracy = 1;
+                accuracy = 1;
+                inherit timestamp;
+              };
+            };
+        in
+        builtins.toJSON {
+          type = "FeatureCollection";
+          features = map mkGeoJsonPoint points;
+        };
    };

  testScript = ''
@@ -75,7 +75,7 @@ Because entries in the Nix store are inert and do nothing by themselves, package

 This section describes a general framework of understanding and exceptions might apply.

-Luckily it's pretty easy to maintain your own package set with Nix, which can then be added to the [Nix User Repository](https://github.com/nix-community/nur) project.
+Luckily it's pretty easy to maintain your own package set with Nix, which can then be added to the [Nix User Repository](https://github.com/nix-community/nur) project or included in [search.nixos.org's list of indexed 3rd-party flakes](https://github.com/NixOS/nixos-search/blob/main/flakes/manual.toml)

 ---

@@ -1,99 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  pkg-config,
-  wrapQtAppsHook,
-  alsa-lib ? null,
-  carla ? null,
-  fftwFloat,
-  fltk_1_3,
-  fluidsynth ? null,
-  lame ? null,
-  libgig ? null,
-  libjack2 ? null,
-  libpulseaudio ? null,
-  libsamplerate,
-  libsoundio ? null,
-  libsndfile,
-  libvorbis ? null,
-  portaudio ? null,
-  qtbase,
-  qtx11extras,
-  qttools,
-  SDL ? null,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "lmms";
-  version = "1.2.2";
-
-  src = fetchFromGitHub {
-    owner = "LMMS";
-    repo = "lmms";
-    rev = "v${finalAttrs.version}";
-    sha256 = "006hwv1pbh3y5whsxkjk20hsbgwkzr4dawz43afq1gil69y7xpda";
-    fetchSubmodules = true;
-  };
-
-  nativeBuildInputs = [
-    cmake
-    qttools
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    carla
-    alsa-lib
-    fftwFloat
-    fltk_1_3
-    fluidsynth
-    lame
-    libgig
-    libjack2
-    libpulseaudio
-    libsamplerate
-    libsndfile
-    libsoundio
-    libvorbis
-    portaudio
-    qtbase
-    qtx11extras
-    SDL # TODO: switch to SDL2 in the next version
-  ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/cf64acc45e3264c6923885867e2dbf8b7586a36b/trunk/lmms-carla-export.patch";
-      sha256 = "sha256-wlSewo93DYBN2PvrcV58dC9kpoo9Y587eCeya5OX+j4=";
-    })
-  ];
-
-  prePatch = ''
-    # Update CMake minimum required version and policies
-    substituteInPlace CMakeLists.txt --replace 'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.7)' 'CMAKE_MINIMUM_REQUIRED(VERSION 3.10)'
-    substituteInPlace CMakeLists.txt --replace 'CMAKE_POLICY(SET CMP0026 OLD)' 'CMAKE_POLICY(SET CMP0026 NEW)'
-    substituteInPlace CMakeLists.txt --replace 'CMAKE_POLICY(SET CMP0050 OLD)' 'CMAKE_POLICY(SET CMP0050 NEW)'
-    substituteInPlace CMakeLists.txt --replace 'GET_TARGET_PROPERTY(BIN2RES bin2res LOCATION)' 'SET(BIN2RES $<TARGET_FILE:bin2res>)'
-  '';
-
-  cmakeFlags = [
-    "-DWANT_QT5=ON"
-  ]
-  ++ lib.optionals (lib.versionOlder finalAttrs.version "11.4") [
-    # Fix the build with CMake 4.
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
-  ];
-
-  meta = {
-    description = "DAW similar to FL Studio (music production software)";
-    mainProgram = "lmms";
-    homepage = "https://lmms.io";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-  };
-})
@@ -30,10 +30,10 @@
  builderKeys ? [
    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
-    # "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg (not signed 30.2)
+    # "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg (not signed 31.0)
    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
-    # "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg (not signed 30.2)
-    # "67AA5B46E7AF78053167FE343B8F814A784218F8" # willcl-ark.gpg (not signed 30.2)
+    # "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg (not signed 31.0)
+    "67AA5B46E7AF78053167FE343B8F814A784218F8"
  ],
 }:

@@ -46,14 +46,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = if withGui then "bitcoin" else "bitcoind";
-  version = "30.2";
+  version = "31.0";

  src = fetchurl {
    urls = [
      "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz"
    ];
    # hash retrieved from signed SHA256SUMS
-    sha256 = "6fd00b8c42883d5c963901ad4109a35be1e5ec5c2dc763018c166c21a06c84cb";
+    sha256 = "0ba0ef5eea3aefd96cc1774be274c3d594812cfac0988809d706738bb067b3e3";
  };

  nativeBuildInputs = [
@@ -93,12 +93,12 @@ stdenv.mkDerivation (finalAttrs: {

      checksums = fetchurl {
        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-ERE/QO2elj++mON3UYGJKaLdU86gWIRS/AufuyS/JAU=";
+        hash = "sha256-w/4sIOBYR1d/YzzMqwzH6wRHOPQnNg8x7yS96+eWk8g=";
      };

      signatures = fetchurl {
        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-69TMNzKJQRDC+2YU6bKI23c8Jx44m5B1zz823SQtiyg=";
+        hash = "sha256-hkztGd2fUel7JJbe9RGSfJXGozhb085XvmqPjks96l4=";
      };

      verifyBuilderKeys =
@@ -1194,6 +1194,13 @@ let
          # https://github.com/syl20bnr/flymake-elixir/issues/4
          flymake-elixir = addPackageRequires super.flymake-elixir [ self.flymake-easy ];

+          flymake-hadolint = super.flymake-hadolint.overrideAttrs (attrs: {
+            postPatch = attrs.postPatch or "" + ''
+              substituteInPlace flymake-hadolint.el \
+                --replace-fail 'flymake-hadolint-program "hadolint"' 'flymake-hadolint-program "${lib.getExe pkgs.hadolint}"'
+            '';
+          });
+
          flyparens = ignoreCompilationError super.flyparens; # elisp error

          fold-dwim-org = ignoreCompilationError super.fold-dwim-org; # elisp error
@@ -166,37 +166,29 @@ stdenv.mkDerivation (finalAttrs: {
  patches =
    patches fetchpatch
    ++ lib.optionals withNativeCompilation [
-      (replaceVars
-        (
-          if lib.versionOlder finalAttrs.version "30" then
-            ./native-comp-driver-options.patch
-          else
-            ./native-comp-driver-options-30.patch
-        )
-        {
-          backendPath = (
-            lib.concatStringsSep " " (
-              map (x: ''"-B${x}"'') (
-                [
-                  # Paths necessary so the JIT compiler finds its libraries:
-                  "${lib.getLib libgccjit}/lib"
-                ]
-                ++ libGccJitLibraryPaths
-                ++ [
-                  # Executable paths necessary for compilation (ld, as):
-                  "${lib.getBin stdenv.cc.cc}/bin"
-                  "${lib.getBin stdenv.cc.bintools}/bin"
-                  "${lib.getBin stdenv.cc.bintools.bintools}/bin"
-                ]
-                ++ lib.optionals stdenv.hostPlatform.isDarwin [
-                  # The linker needs to know where to find libSystem on Darwin.
-                  "${apple-sdk.sdkroot}/usr/lib"
-                ]
-              )
+      (replaceVars ./native-comp-driver-options-30.patch {
+        backendPath = (
+          lib.concatStringsSep " " (
+            map (x: ''"-B${x}"'') (
+              [
+                # Paths necessary so the JIT compiler finds its libraries:
+                "${lib.getLib libgccjit}/lib"
+              ]
+              ++ libGccJitLibraryPaths
+              ++ [
+                # Executable paths necessary for compilation (ld, as):
+                "${lib.getBin stdenv.cc.cc}/bin"
+                "${lib.getBin stdenv.cc.bintools}/bin"
+                "${lib.getBin stdenv.cc.bintools.bintools}/bin"
+              ]
+              ++ lib.optionals stdenv.hostPlatform.isDarwin [
+                # The linker needs to know where to find libSystem on Darwin.
+                "${apple-sdk.sdkroot}/usr/lib"
+              ]
            )
-          );
-        }
-      )
+          )
+        );
+      })
    ];

  postPatch = lib.concatStringsSep "\n" [
@@ -252,13 +244,10 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    pkg-config
-  ]
-  ++ lib.optionals (variant == "macport") [
    texinfo
  ]
  ++ lib.optionals srcRepo [
    autoreconfHook
-    texinfo
  ]
  ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ];

@@ -1,19 +0,0 @@
-diff --git a/lisp/emacs-lisp/comp.el b/lisp/emacs-lisp/comp.el
-index 2c9b79334b..50c6b5ac85 100644
--- a/lisp/emacs-lisp/comp.el
-+++ b/lisp/emacs-lisp/comp.el
-@@ -178,8 +178,9 @@ native-comp-compiler-options
-   :type '(repeat string)
-   :version "28.1")
- 
-(defcustom native-comp-driver-options (when (eq system-type 'darwin)
-                                        '("-Wl,-w"))
-+(defcustom native-comp-driver-options (append (when (eq system-type 'darwin)
-+                                                '("-Wl,-w"))
-+                                              '(@backendPath@))
-   "Options passed verbatim to the native compiler's back-end driver.
- Note that not all options are meaningful; typically only the options
- affecting the assembler and linker are likely to be useful.
-- 
-2.37.3
-
@@ -85,6 +85,7 @@ let
              AndersonTorres
              adisbladis
              jwiegley
+              linj
              panchoh
            ];
            "macport" = with lib.maintainers; [
@@ -111,13 +112,25 @@ in
    rev = "emacs-30.2";
    hash = "sha256-W2eZ+cNQhi/fMeRkwOqSKU7Vzvp43WUOpiwaLLNEXtg=";
    patches = fetchpatch: [
+      (fetchpatch {
+        name = "fix-off-by-one-mistake-80851-CVE-2026-6861.patch";
+        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8f535370b9efbc91673b20c6987a5cae4f6dc562";
+        hash = "sha256-ny44eIi8DUa9pQhVGzhGz4H6FXU4+ki86SITLXhkwpw=";
+      })
      (builtins.path {
        name = "inhibit-lexical-cookie-warning-67916.patch";
        path = ./inhibit-lexical-cookie-warning-67916-30.patch;
      })
-      # tree-sitter 0.26 compatibility fix, from FreeBSD
-      # https://cgit.freebsd.org/ports/plain/editors/emacs/files/patch-src_treesit.c
-      ./tree-sitter-0.26.patch
+      (fetchpatch {
+        # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/970856
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/01_all_treesit-0.26.patch?id=d0f47979806d9be5a190fdb4ffa1bde439b2d616";
+        hash = "sha256-3pWeRxjAhr3ntBR3xDhoDUZDjU6xICU23NUpb/Vl6R4=";
+      })
+      (fetchpatch {
+        # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/971731
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/02_all_ts-query-pred.patch?id=86190bf195b3e17108372d8ad89eb57037180dd2";
+        hash = "sha256-0GPyfKLSaB09a8hamrSf6lx4Qk8Big4AKMOivkN1wEM=";
+      })
    ];
  });

@@ -127,5 +140,22 @@ in
    variant = "macport";
    rev = "emacs-mac-30.2";
    hash = "sha256-i/W2Xa6Vk1+T1fs6fa4wJVMLLB6BK8QAPcdmPrU8NwM=";
+    patches = fetchpatch: [
+      (fetchpatch {
+        name = "fix-off-by-one-mistake-80851-CVE-2026-6861.patch";
+        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8f535370b9efbc91673b20c6987a5cae4f6dc562";
+        hash = "sha256-ny44eIi8DUa9pQhVGzhGz4H6FXU4+ki86SITLXhkwpw=";
+      })
+      (fetchpatch {
+        # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/970856
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/01_all_treesit-0.26.patch?id=d0f47979806d9be5a190fdb4ffa1bde439b2d616";
+        hash = "sha256-3pWeRxjAhr3ntBR3xDhoDUZDjU6xICU23NUpb/Vl6R4=";
+      })
+      (fetchpatch {
+        # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/971731
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/02_all_ts-query-pred.patch?id=86190bf195b3e17108372d8ad89eb57037180dd2";
+        hash = "sha256-0GPyfKLSaB09a8hamrSf6lx4Qk8Big4AKMOivkN1wEM=";
+      })
+    ];
  });
 }
@@ -1,56 +0,0 @@
--- a/src/treesit.c
-+++ b/src/treesit.c
-@@ -34,7 +34,7 @@ along with GNU Emacs.  If not, see <https://www.gnu.or
- # include "w32common.h"
- 
- /* In alphabetical order.  */
-#undef ts_language_version
-+#undef ts_language_abi_version
- #undef ts_node_child
- #undef ts_node_child_by_field_name
- #undef ts_node_child_count
-@@ -89,7 +89,7 @@ along with GNU Emacs.  If not, see <https://www.gnu.or
- #undef ts_tree_get_changed_ranges
- #undef ts_tree_root_node
- 
-DEF_DLL_FN (uint32_t, ts_language_version, (const TSLanguage *));
-+DEF_DLL_FN (uint32_t, ts_language_abi_version, (const TSLanguage *));
- DEF_DLL_FN (TSNode, ts_node_child, (TSNode, uint32_t));
- DEF_DLL_FN (TSNode, ts_node_child_by_field_name,
- 	    (TSNode, const char *, uint32_t));
-@@ -166,7 +166,7 @@ init_treesit_functions (void)
-   if (!library)
-     return false;
- 
-  LOAD_DLL_FN (library, ts_language_version);
-+  LOAD_DLL_FN (library, ts_language_abi_version);
-   LOAD_DLL_FN (library, ts_node_child);
-   LOAD_DLL_FN (library, ts_node_child_by_field_name);
-   LOAD_DLL_FN (library, ts_node_child_count);
-@@ -224,7 +224,7 @@ init_treesit_functions (void)
-   return true;
- }
- 
-#define ts_language_version fn_ts_language_version
-+#define ts_language_abi_version fn_ts_language_abi_version
- #define ts_node_child fn_ts_node_child
- #define ts_node_child_by_field_name fn_ts_node_child_by_field_name
- #define ts_node_child_count fn_ts_node_child_count
-@@ -746,7 +746,7 @@ treesit_load_language (Lisp_Object language_symbol,
-     {
-       *signal_symbol = Qtreesit_load_language_error;
-       *signal_data = list2 (Qversion_mismatch,
-			    make_fixnum (ts_language_version (lang)));
-+			    make_fixnum (ts_language_abi_version (lang)));
-       return NULL;
-     }
-   return lang;
-@@ -817,7 +817,7 @@ Return nil if a grammar library for LANGUAGE is not av
- 						       &signal_data);
-       if (ts_language == NULL)
- 	return Qnil;
-      uint32_t version =  ts_language_version (ts_language);
-+      uint32_t version =  ts_language_abi_version (ts_language);
-       return make_fixnum((ptrdiff_t) version);
-     }
- }
@@ -247,6 +247,15 @@ pkgs.lib.recurseIntoAttrs rec {
      };
    };

+  nvim_with_no_pname_plugin = neovim.override {
+    extraName = "-with-no-pname-plugin";
+    configure.packages.plugins = {
+      start = [
+        vimPlugins.corePlugins
+      ];
+    };
+  };
+
  # regression test that ftplugin files from plugins are loaded before the ftplugin
  # files from $VIMRUNTIME
  run_nvim_with_ftplugin = runTest nvim_with_ftplugin ''
@@ -260,6 +269,10 @@ pkgs.lib.recurseIntoAttrs rec {
    [ "$result" = 0 ]
  '';

+  run_nvim_with_no_pname_plugin = runTest nvim_with_no_pname_plugin ''
+    ${nvim_with_no_pname_plugin}/bin/nvim -i NONE -e --headless +quit
+  '';
+
  # Generate a neovim wrapper with only a init.lua and no init.vim file
  nvim_with_only_init_lua = wrapNeovim2 "-only-lua-init-file" {
    luaRcContent = "-- some text";
@@ -412,12 +412,12 @@ final: prev: {

  SchemaStore-nvim = buildVimPlugin {
    pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-04-17";
+    version = "0-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "250aed7415ddd6cb3ea321490c7b35094ed9148d";
-      hash = "sha256-UQ+6s4tMJ8z+UJ41ZX1HJTiDsbkYFEUSDb+N8jVBAeY=";
+      rev = "d09eb13366fe95deeecf3deba7a4639f0c82fcdc";
+      hash = "sha256-6JLdNKPtRpjS2XKc6gs2I51AUeyiaidYBj7bO3S4F0Y=";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
    meta.hydraPlatforms = [ ];
@@ -660,12 +660,12 @@ final: prev: {

  actions-preview-nvim = buildVimPlugin {
    pname = "actions-preview.nvim";
-    version = "0-unstable-2026-04-09";
+    version = "0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "aznhe21";
      repo = "actions-preview.nvim";
-      rev = "2b604b2e8e662c03b716436f6ffebcb19663e66a";
-      hash = "sha256-FG2QxBZTtyRyzK1T2rUtmyK+Z2kt/Ot/vSDQ6JEVwBs=";
+      rev = "0ac9c2aa3cfc8c885321c0862b50b6b1c3392405";
+      hash = "sha256-ibzfF/Ebm5+1EgZ05NQCTRDB+Q7ymyRy2fZpjvwv8EA=";
    };
    meta.homepage = "https://github.com/aznhe21/actions-preview.nvim/";
    meta.hydraPlatforms = [ ];
@@ -986,12 +986,12 @@ final: prev: {

  astrocore = buildVimPlugin {
    pname = "astrocore";
-    version = "3.0.2";
+    version = "3.0.3";
    src = fetchFromGitHub {
      owner = "AstroNvim";
      repo = "astrocore";
-      tag = "v3.0.2";
-      hash = "sha256-4yf49at22utcEVrLftI8X0iBrcbfVqlZpreXkM0q63E=";
+      tag = "v3.0.3";
+      hash = "sha256-EQG6jOH/US/0T4iIwPv58FC4P7k3W7jTBdfRVbqFQi8=";
    };
    meta.homepage = "https://github.com/AstroNvim/astrocore/";
    meta.hydraPlatforms = [ ];
@@ -1036,6 +1036,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  async-nvim = buildVimPlugin {
+    pname = "async.nvim";
+    version = "0-unstable-2026-04-18";
+    src = fetchFromGitHub {
+      owner = "lewis6991";
+      repo = "async.nvim";
+      rev = "7a1d7d49933fbe902b84b55f352a3b10fd587331";
+      hash = "sha256-uyUvZVN7L7SqPAE1woc1T8dlhpH24FBj3/WD4VMwWF8=";
+    };
+    meta.homepage = "https://github.com/lewis6991/async.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  async-vim = buildVimPlugin {
    pname = "async.vim";
    version = "0-unstable-2022-04-04";
@@ -1558,12 +1571,12 @@ final: prev: {

  better-escape-nvim = buildVimPlugin {
    pname = "better-escape.nvim";
-    version = "2.3.3-unstable-2025-04-29";
+    version = "2.3.3-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "max397574";
      repo = "better-escape.nvim";
-      rev = "19a38aab94961016430905ebec30d272a01e9742";
-      hash = "sha256-OmCZQN9qMSSEBmZaRR5QoJ+RRm13pnu+0uAUoz6X7oA=";
+      rev = "3f4bc0b326606264ff75967f59091b5ddada0554";
+      hash = "sha256-h7Xa8McjnCOOP8WbqbmmJn9jjBMvk89Tvh0Qt1stEVU=";
    };
    meta.homepage = "https://github.com/max397574/better-escape.nvim/";
    meta.hydraPlatforms = [ ];
@@ -1636,12 +1649,12 @@ final: prev: {

  blink-cmp-conventional-commits = buildVimPlugin {
    pname = "blink-cmp-conventional-commits";
-    version = "0-unstable-2026-02-04";
+    version = "0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "disrupted";
      repo = "blink-cmp-conventional-commits";
-      rev = "faa45344aab97aa33ece53938c4c3379760e61bd";
-      hash = "sha256-nbulCccWnugVodwm6C7Xlf9D/0cpKEBL3tmnH3S15WY=";
+      rev = "28f46593ef5e03ba7525bdf6075be0c56c6ceb55";
+      hash = "sha256-eRGq2bjr6kqFoT1s4P1MIA7nIEvRTYw4OFIJbS/JD60=";
    };
    meta.homepage = "https://github.com/disrupted/blink-cmp-conventional-commits/";
    meta.hydraPlatforms = [ ];
@@ -1896,12 +1909,12 @@ final: prev: {

  bluloco-nvim = buildVimPlugin {
    pname = "bluloco.nvim";
-    version = "1.4.0-unstable-2026-04-04";
+    version = "1.4.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "uloco";
      repo = "bluloco.nvim";
-      rev = "f1a6cb87e55cd377002f1648163f434fd9837ef5";
-      hash = "sha256-5atqaCBSn/pTjoCoi10L9MgpgozMqXb0qU3BME9UPpc=";
+      rev = "4daabf6a9e6b9ecdcb19e7c78e888be0bacd866c";
+      hash = "sha256-qmVneHlI7XKTyXrSJu+lWaX6YmGQero7nTKrWR/i99c=";
    };
    meta.homepage = "https://github.com/uloco/bluloco.nvim/";
    meta.hydraPlatforms = [ ];
@@ -3309,6 +3322,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  codex-nvim = buildVimPlugin {
+    pname = "codex.nvim";
+    version = "1.1.0";
+    src = fetchFromGitHub {
+      owner = "johnseth97";
+      repo = "codex.nvim";
+      tag = "v1.1.0";
+      hash = "sha256-rx5/Iso5rWYfRTnQyZ8g16FCxqjj4FgWmG+r09ebVJc=";
+    };
+    meta.homepage = "https://github.com/johnseth97/codex.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  codi-vim = buildVimPlugin {
    pname = "codi.vim";
    version = "0-unstable-2023-02-28";
@@ -3584,12 +3610,12 @@ final: prev: {

  conform-nvim = buildVimPlugin {
    pname = "conform.nvim";
-    version = "9.1.0-unstable-2026-03-10";
+    version = "9.1.0-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "stevearc";
      repo = "conform.nvim";
-      rev = "086a40dc7ed8242c03be9f47fbcee68699cc2395";
-      hash = "sha256-aJIUkAcFdaOWBQ3HNLLvhqALzch0BqPUZPtb2cmIeCE=";
+      rev = "dca1a190aa85f9065979ef35802fb77131911106";
+      hash = "sha256-pV7Yr2LSBDqKGeYoS4CWHGUSs8Yx4wsVXCXySt9yz0M=";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/stevearc/conform.nvim/";
@@ -4861,12 +4887,12 @@ final: prev: {

  dracula-vim = buildVimPlugin {
    pname = "dracula-vim";
-    version = "2.0.0-unstable-2026-04-13";
+    version = "2.0.0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "dracula";
      repo = "vim";
-      rev = "07b144414730cc4cf4405ab840bf46c5fa12704b";
-      hash = "sha256-RWavKi3KvQI7N+qNks3EVUSmwCY73QvGNTpZElCxdkE=";
+      rev = "e7b91facff94bdf3a248df9b683119b84672256a";
+      hash = "sha256-OkLtrd6Cq7ZwF5r5/SBc9Uyp26q/gIgHLrVKLxboLCA=";
    };
    meta.homepage = "https://github.com/dracula/vim/";
    meta.hydraPlatforms = [ ];
@@ -4926,12 +4952,12 @@ final: prev: {

  easy-dotnet-nvim = buildVimPlugin {
    pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-04-18";
+    version = "0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "GustavEikaas";
      repo = "easy-dotnet.nvim";
-      rev = "06cc3c7ffd02ef6c62dffea46d4f6e53f1962ef2";
-      hash = "sha256-+f1RvmFUWPpvw6EqOKmS0NBCwRgMX3mzPdF/DFUnEWM=";
+      rev = "1e6b569af3818a1665f14115aea7b0a920b179f6";
+      hash = "sha256-EkJoifIH8PtiXUSFpWQtQgP6a1LuWLbvwHBYH/80Qik=";
    };
    meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
    meta.hydraPlatforms = [ ];
@@ -5395,12 +5421,12 @@ final: prev: {

  firenvim = buildVimPlugin {
    pname = "firenvim";
-    version = "0.2.16-unstable-2026-04-16";
+    version = "0.2.16-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "glacambre";
      repo = "firenvim";
-      rev = "b68449b92dfea73a54e4c8f2307fc244a3a574bd";
-      hash = "sha256-XjpCYydSFSTw0sDwVHS7paDejaP2JafOWrupuurfFgE=";
+      rev = "69d3411d08d35bb9b3e84b9deaff4b9b078a30e3";
+      hash = "sha256-j1M41XD8gLMqXJK5Pk+yu6IbsUnRagyzlKM9nQ1ozp0=";
    };
    meta.homepage = "https://github.com/glacambre/firenvim/";
    meta.hydraPlatforms = [ ];
@@ -6371,12 +6397,12 @@ final: prev: {

  gruvbox-material-nvim = buildVimPlugin {
    pname = "gruvbox-material.nvim";
-    version = "1.8.1";
+    version = "1.8.2";
    src = fetchFromGitHub {
      owner = "f4z3r";
      repo = "gruvbox-material.nvim";
-      tag = "v1.8.1";
-      hash = "sha256-nNBV66GHG3Km92aWhFeo3HgjWQNdMQpIl4Kq08rEmPs=";
+      tag = "v1.8.2";
+      hash = "sha256-MTOAc4Z8wvAGz99dJy5181R/Uf7G/qToyPFYNDJHjB0=";
    };
    meta.homepage = "https://github.com/f4z3r/gruvbox-material.nvim/";
    meta.hydraPlatforms = [ ];
@@ -6566,12 +6592,12 @@ final: prev: {

  haskell-snippets-nvim = buildVimPlugin {
    pname = "haskell-snippets.nvim";
-    version = "1.5.0-unstable-2026-04-13";
+    version = "1.5.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "mrcjkb";
      repo = "haskell-snippets.nvim";
-      rev = "7a29db90a8803d937f2122efbff696d0f290b379";
-      hash = "sha256-OR7Fibl05kk6/2LsAoxya00TW0scgh3Uc4eSw5TaH58=";
+      rev = "11868addce601fdeed56097d48ff42abeec3dfe8";
+      hash = "sha256-Y4ZNYNb7shMQ8lTAx2/8De9KgbYq8Pf+6yQhHX6a4Ck=";
    };
    meta.homepage = "https://github.com/mrcjkb/haskell-snippets.nvim/";
    meta.hydraPlatforms = [ ];
@@ -7280,6 +7306,32 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  isabelle-lsp-nvim = buildVimPlugin {
+    pname = "isabelle-lsp.nvim";
+    version = "0-unstable-2025-12-02";
+    src = fetchFromGitHub {
+      owner = "Treeniks";
+      repo = "isabelle-lsp.nvim";
+      rev = "3601b59d77cc4998de29f966ded7d4d959318be2";
+      hash = "sha256-2SijIavooMFft9S/fMcH/YE77wctAP0Oneg/YAR9+LM=";
+    };
+    meta.homepage = "https://github.com/Treeniks/isabelle-lsp.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
+  isabelle-syn-nvim = buildVimPlugin {
+    pname = "isabelle-syn.nvim";
+    version = "0-unstable-2024-05-15";
+    src = fetchFromGitHub {
+      owner = "Treeniks";
+      repo = "isabelle-syn.nvim";
+      rev = "114b06dc34edf1707be7249b5a3815733e68d4c9";
+      hash = "sha256-f04jyExUwos9w89IeKbRdRMtWIsQYe0McAUoijq7mCA=";
+    };
+    meta.homepage = "https://github.com/Treeniks/isabelle-syn.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  iswap-nvim = buildVimPlugin {
    pname = "iswap.nvim";
    version = "0-unstable-2026-03-25";
@@ -7462,14 +7514,27 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  just-nvim = buildVimPlugin {
+    pname = "just.nvim";
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "nxuv";
+      repo = "just.nvim";
+      tag = "v1.0.0";
+      hash = "sha256-pwAlfwPFnWD2qfBAuhLxSoCQoOZD7gQHEy4Nnt0GOqE=";
+    };
+    meta.homepage = "https://github.com/nxuv/just.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  kanagawa-nvim = buildVimPlugin {
    pname = "kanagawa.nvim";
-    version = "0-unstable-2025-10-15";
+    version = "0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "rebelot";
      repo = "kanagawa.nvim";
-      rev = "aef7f5cec0a40dbe7f3304214850c472e2264b10";
-      hash = "sha256-nHcQWTX4x4ala6+fvh4EWRVcZMNk5jZiZAwWhw03ExE=";
+      rev = "8ad3b4cdcc804b332c32db8f9743667e1bb82b99";
+      hash = "sha256-vAq9ZiG3s4x/xFSKt9/o40pptj2y7S8DQqs1dJEdhVU=";
    };
    meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
    meta.hydraPlatforms = [ ];
@@ -7777,12 +7842,12 @@ final: prev: {

  lean-nvim = buildVimPlugin {
    pname = "lean.nvim";
-    version = "2025.10.1-unstable-2026-04-19";
+    version = "2026.4.1";
    src = fetchFromGitHub {
      owner = "Julian";
      repo = "lean.nvim";
-      rev = "1be79c2c60c24bc5e4ac31d4c25bbae533a8bc8f";
-      hash = "sha256-UwVXVulNayx9vJijgFQullXM9JUjUCXtNd7EKp1P9u4=";
+      tag = "v2026.4.1";
+      hash = "sha256-AYClc7+z+0h5QfVGPGr7ZrzPuaD+IAMtHT/3ZnbSVLE=";
    };
    meta.homepage = "https://github.com/Julian/lean.nvim/";
    meta.hydraPlatforms = [ ];
@@ -7816,11 +7881,11 @@ final: prev: {

  leap-nvim = buildVimPlugin {
    pname = "leap.nvim";
-    version = "0-unstable-2026-03-31";
+    version = "0-unstable-2026-04-20";
    src = fetchgit {
      url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "b960d5038c5c505c52e56a54490f9bbb1f0e6ef6";
-      hash = "sha256-3xL4cwZdrRX0pCu/oqk0hz8zOeg/VRwn5cB9I9cG4DI=";
+      rev = "ce3cf75200ae148d75563088f435389f9e4100fd";
+      hash = "sha256-f3LwrPetVujz/ji1kWwOGuYjNiii/+E68I6RPnzXAIY=";
    };
    meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
    meta.hydraPlatforms = [ ];
@@ -8062,12 +8127,12 @@ final: prev: {

  linediff-vim = buildVimPlugin {
    pname = "linediff.vim";
-    version = "0.3.0-unstable-2025-11-28";
+    version = "0.3.0-unstable-2026-04-17";
    src = fetchFromGitHub {
      owner = "AndrewRadev";
      repo = "linediff.vim";
-      rev = "29fa617fc10307a1e0ae82a8761114e465d17b06";
-      hash = "sha256-53WWr63+89BYsE8Tyj216msCCRiitcnp7aYH+hUvQyI=";
+      rev = "c3780609769a93f4f59421b6324355f37e0ee6c5";
+      hash = "sha256-27Lu2U+/XELoT7yV4r0wqsFW/w8Z1BA4UDQslq1dOg4=";
    };
    meta.homepage = "https://github.com/AndrewRadev/linediff.vim/";
    meta.hydraPlatforms = [ ];
@@ -8205,12 +8270,12 @@ final: prev: {

  live-share-nvim = buildVimPlugin {
    pname = "live-share.nvim";
-    version = "2.1.0";
+    version = "2.1.3";
    src = fetchFromGitHub {
      owner = "azratul";
      repo = "live-share.nvim";
-      tag = "v2.1.0";
-      hash = "sha256-TxjS68iaat+zgpF4L7Wp7y7PgW4mrc6MrvxxQBK3zsk=";
+      tag = "v2.1.3";
+      hash = "sha256-EXVnUcutSz3xfjTHjYr45nBWm6JP68PoGE07ooYsywA=";
    };
    meta.homepage = "https://github.com/azratul/live-share.nvim/";
    meta.hydraPlatforms = [ ];
@@ -8425,12 +8490,12 @@ final: prev: {

  lspsaga-nvim = buildVimPlugin {
    pname = "lspsaga.nvim";
-    version = "0-unstable-2026-03-03";
+    version = "0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "nvimdev";
      repo = "lspsaga.nvim";
-      rev = "562d9724e3869ffd1801c572dd149cc9f8d0cc36";
-      hash = "sha256-5jqMObzXwveN4+p4qf/kZJcUlM964rtS3yX8nndMQzk=";
+      rev = "c532fb86c3d211c5829ad58d2a0783012739bb65";
+      hash = "sha256-oFzbEkY/WKT7jbwGxeKnbQXgnY8kSmH/UsjljXozBWU=";
    };
    meta.homepage = "https://github.com/nvimdev/lspsaga.nvim/";
    meta.hydraPlatforms = [ ];
@@ -8686,12 +8751,12 @@ final: prev: {

  mason-nvim = buildVimPlugin {
    pname = "mason.nvim";
-    version = "2.2.1-unstable-2026-04-06";
+    version = "2.2.1-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "mason-org";
      repo = "mason.nvim";
-      rev = "b03fb0f20bc1d43daf558cda981a2be22e73ac42";
-      hash = "sha256-2R31RsqYChWW8nyu0ovryFd8sO9iWeqBnydL6NhRpQ0=";
+      rev = "12ddd182d9efbdc848b540f16484a583d52da0fb";
+      hash = "sha256-Oq93aLhK/fowReSAeg9nnXnLrpTpBek0j5uNX1FW1Vs=";
    };
    meta.homepage = "https://github.com/mason-org/mason.nvim/";
    meta.hydraPlatforms = [ ];
@@ -9037,12 +9102,12 @@ final: prev: {

  mini-completion = buildVimPlugin {
    pname = "mini.completion";
-    version = "0.17.0-unstable-2026-04-17";
+    version = "0.17.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "nvim-mini";
      repo = "mini.completion";
-      rev = "e934b46f6471a3bd0cd37fc06d0df198b9711882";
-      hash = "sha256-h7IUnYdqjVHldagQXCmC7UI8oO4+2fmtFfdCln1pa6A=";
+      rev = "667d94669be66043123cac44e7c5d65a31657732";
+      hash = "sha256-Y2cYv06QUvKWRoF/05+ajJ41z/4D6QZAuxjNCFAtu5E=";
    };
    meta.homepage = "https://github.com/nvim-mini/mini.completion/";
    meta.hydraPlatforms = [ ];
@@ -9297,12 +9362,12 @@ final: prev: {

  mini-nvim = buildVimPlugin {
    pname = "mini.nvim";
-    version = "0.17.0-unstable-2026-04-17";
+    version = "0.17.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "nvim-mini";
      repo = "mini.nvim";
-      rev = "418ef4930ddabe80f449c6f1323f8b6abb172d1c";
-      hash = "sha256-bHEFu4XZI9QHP41h11sSNgRG43PDSkdgTyzmJt64gLk=";
+      rev = "5849ef04c32a6a8e55957b946c0a275801d87530";
+      hash = "sha256-itvNBJwakDOeIUaEZS5qSeI3L//kve3ub7r16EUvgi0=";
    };
    meta.homepage = "https://github.com/nvim-mini/mini.nvim/";
    meta.hydraPlatforms = [ ];
@@ -9479,12 +9544,12 @@ final: prev: {

  minuet-ai-nvim = buildVimPlugin {
    pname = "minuet-ai.nvim";
-    version = "0.8.0-unstable-2026-04-18";
+    version = "0.8.0-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "milanglacier";
      repo = "minuet-ai.nvim";
-      rev = "ee03326381c93f6417fa66aeb2ca85a26c0706e7";
-      hash = "sha256-41vUpNnyKdc4MvOyFVSAgR1/EEjHgKNixAWXaLdMbsQ=";
+      rev = "173d8c9451504cdf93ce172f710487d3c6191ce8";
+      hash = "sha256-4tBdnziMUCL8Cgq5LFO5LSbWB8Kk5Brq9vKRgq38jOw=";
    };
    meta.homepage = "https://github.com/milanglacier/minuet-ai.nvim/";
    meta.hydraPlatforms = [ ];
@@ -9973,12 +10038,12 @@ final: prev: {

  neo-tree-nvim = buildVimPlugin {
    pname = "neo-tree.nvim";
-    version = "2.71";
+    version = "3.40.0";
    src = fetchFromGitHub {
      owner = "nvim-neo-tree";
      repo = "neo-tree.nvim";
-      tag = "v2.71";
-      hash = "sha256-w4D+iq1/su5LtCsknvGB6wDlohx2WVm0iRvKagL4H5E=";
+      tag = "3.40.0";
+      hash = "sha256-/TNl/IX81qr7Mcoy0dhF3bcsewXEnPSy2n+dm31eyyw=";
    };
    meta.homepage = "https://github.com/nvim-neo-tree/neo-tree.nvim/";
    meta.hydraPlatforms = [ ];
@@ -9999,12 +10064,12 @@ final: prev: {

  neoconf-nvim = buildVimPlugin {
    pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-04-15";
+    version = "1.4.0-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "neoconf.nvim";
-      rev = "ecdb0c9bc3f3373e11be4c97e461d16b52d532d0";
-      hash = "sha256-F3ui8hSN/UPt4UjDUziXyVYUEtFVaTVETjOn/xRm7nU=";
+      rev = "751c246c6c1780b94b063918759f352480e3db21";
+      hash = "sha256-XuWMVLu1FFmcGnmDuomKYSSBD/yOUa6Za5UE7O52y2w=";
    };
    meta.homepage = "https://github.com/folke/neoconf.nvim/";
    meta.hydraPlatforms = [ ];
@@ -10077,12 +10142,12 @@ final: prev: {

  neogit = buildVimPlugin {
    pname = "neogit";
-    version = "3.0.0-unstable-2026-04-17";
+    version = "3.0.0-unstable-2026-04-23";
    src = fetchFromGitHub {
      owner = "NeogitOrg";
      repo = "neogit";
-      rev = "e906fce7e44ae562f06345be99a7db02f8315236";
-      hash = "sha256-/uIp7X8drHFQT8DNuiSxFGga71HUY59PCSTguyJvaeo=";
+      rev = "2d94da0032e201865a5b65a6bc008dd6fce8f52e";
+      hash = "sha256-dCndB3pvCU7D80aU/5nOloxH2lYgGdC0Qtei8cRf7RU=";
    };
    meta.homepage = "https://github.com/NeogitOrg/neogit/";
    meta.hydraPlatforms = [ ];
@@ -10231,6 +10296,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  neotab-nvim = buildVimPlugin {
+    pname = "neotab.nvim";
+    version = "0-unstable-2025-08-04";
+    src = fetchFromGitHub {
+      owner = "kawre";
+      repo = "neotab.nvim";
+      rev = "e99d3e28c5a2066d2d368dfe4ef3827c8d75d337";
+      hash = "sha256-pSLvpKqfi1hQrFAYmXTOUOYERtnr79M23z5so2JOGhE=";
+    };
+    meta.homepage = "https://github.com/kawre/neotab.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  neoterm = buildVimPlugin {
    pname = "neoterm";
    version = "0-unstable-2023-03-09";
@@ -10392,12 +10470,12 @@ final: prev: {

  neotest-haskell = buildVimPlugin {
    pname = "neotest-haskell";
-    version = "3.0.1-unstable-2026-04-13";
+    version = "3.0.1-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "MrcJkb";
      repo = "neotest-haskell";
-      rev = "84650446b9207ef5e19d2ade50fcda278bdfbae7";
-      hash = "sha256-/GDhQhMCOUq0um9BPdDIfxIXUonV5DdyMKCn+JpaAAc=";
+      rev = "cf7816eb183c8333b58abb63fd4cc156401d9d31";
+      hash = "sha256-/rqau8v3CWaPjCMQjWB4bWCeqOaBHdAn05Nlw3w1WSc=";
    };
    meta.homepage = "https://github.com/MrcJkb/neotest-haskell/";
    meta.hydraPlatforms = [ ];
@@ -10405,12 +10483,12 @@ final: prev: {

  neotest-java = buildVimPlugin {
    pname = "neotest-java";
-    version = "0.37.0";
+    version = "0.37.1";
    src = fetchFromGitHub {
      owner = "rcasia";
      repo = "neotest-java";
-      tag = "v0.37.0";
-      hash = "sha256-PuXYAKkg+KM9dkSk/br7GDjXzmgqhteJepjbt9ZJGO8=";
+      tag = "v0.37.1";
+      hash = "sha256-t+nqylLLHITU8li1cOl97jFKkZRmvmDbSAwvmv1yk+M=";
    };
    meta.homepage = "https://github.com/rcasia/neotest-java/";
    meta.hydraPlatforms = [ ];
@@ -10833,12 +10911,12 @@ final: prev: {

  nightfly = buildVimPlugin {
    pname = "nightfly";
-    version = "0-unstable-2026-04-02";
+    version = "0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "bluz71";
      repo = "vim-nightfly-colors";
-      rev = "250ee0eb4975e59a277f50cc03c980eef27fb483";
-      hash = "sha256-FkyUVuOydxBWRqBUb2JZrHmFL5epDG2U3BSqd865wcE=";
+      rev = "caaba387a4a50cf08791395acc4a5b7363367cff";
+      hash = "sha256-zHT0Py7dePXfZ8duOfLxh/3K0ZaCrrB60uJ+asC/rII=";
    };
    meta.homepage = "https://github.com/bluz71/vim-nightfly-colors/";
    meta.hydraPlatforms = [ ];
@@ -11789,6 +11867,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-justice = buildVimPlugin {
+    pname = "nvim-justice";
+    version = "0-unstable-2026-04-13";
+    src = fetchFromGitHub {
+      owner = "chrisgrieser";
+      repo = "nvim-justice";
+      rev = "a3e0d2d73d1748d1bed45e6b1797fbc73961e53f";
+      hash = "sha256-gT+vPt9BWe1AylFqbZsoEXL8cXSpMjRdiY44Cxalwcg=";
+    };
+    meta.homepage = "https://github.com/chrisgrieser/nvim-justice/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-k8s-crd = buildVimPlugin {
    pname = "nvim-k8s-crd";
    version = "0-unstable-2026-02-16";
@@ -11972,12 +12063,12 @@ final: prev: {

  nvim-metals = buildVimPlugin {
    pname = "nvim-metals";
-    version = "0.10.x-unstable-2026-04-10";
+    version = "0.10.x-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "scalameta";
      repo = "nvim-metals";
-      rev = "6970d6036218db6545f3c295d0106cc8de6d7161";
-      hash = "sha256-RY+UhnwIjWuMU9WOG4a1JvBiJ9RWZ2fUxFDnuzDR+jw=";
+      rev = "3c6ef5114fd46127c517e58d7e8e4dfc1f78dac3";
+      hash = "sha256-9ZernsWN0j185b2KeMvV+CAaN4+NgUfocUG8Ot1fo/4=";
    };
    meta.homepage = "https://github.com/scalameta/nvim-metals/";
    meta.hydraPlatforms = [ ];
@@ -12295,6 +12386,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-sioyek-highlights = buildVimPlugin {
+    pname = "nvim-sioyek-highlights";
+    version = "0-unstable-2026-02-06";
+    src = fetchFromGitHub {
+      owner = "jbuck95";
+      repo = "nvim-sioyek-highlights";
+      rev = "b8ab0a71b24c052cebaed97afe376b01fba19bf0";
+      hash = "sha256-x2Q+96/YEky8fdy4CZ/QPwcLjaOLmwmtpWiYMnS657A=";
+    };
+    meta.homepage = "https://github.com/jbuck95/nvim-sioyek-highlights/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-snippets = buildVimPlugin {
    pname = "nvim-snippets";
    version = "1.0.0-unstable-2024-07-10";
@@ -12414,12 +12518,12 @@ final: prev: {

  nvim-tinygit = buildVimPlugin {
    pname = "nvim-tinygit";
-    version = "1.0-unstable-2026-04-13";
+    version = "1.0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "chrisgrieser";
      repo = "nvim-tinygit";
-      rev = "59b9a750a7a0710552829d2a1dfcaa5304433359";
-      hash = "sha256-/1NCsig8s554HtcSAdsfmPj+KkNNnIVNu7iBN8Vm04Q=";
+      rev = "f12990601dfa63c623049b470dc306ca905064c8";
+      hash = "sha256-NNdwBJjVlCwR3VzN7JRMhRRNHENRO9SXNnUUr4zZ8Eg=";
    };
    meta.homepage = "https://github.com/chrisgrieser/nvim-tinygit/";
    meta.hydraPlatforms = [ ];
@@ -12817,12 +12921,12 @@ final: prev: {

  obsidian-nvim = buildVimPlugin {
    pname = "obsidian.nvim";
-    version = "3.16.2-unstable-2026-04-18";
+    version = "3.16.2-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "obsidian-nvim";
      repo = "obsidian.nvim";
-      rev = "d6c0e5bc30937df0657c9953d135d0ebb3af7e00";
-      hash = "sha256-ZFFtVH/NswfManJ+o5x3oLhy/foQzmVj29O7UEBVkMs=";
+      rev = "af9857e4993e0adddb897f09c2805b44a0d913ea";
+      hash = "sha256-zajt8vt/bLMCqgSgjMj/MiUFTU3TNAnr25YM+J+qg2M=";
    };
    meta.homepage = "https://github.com/obsidian-nvim/obsidian.nvim/";
    meta.hydraPlatforms = [ ];
@@ -12869,12 +12973,12 @@ final: prev: {

  octo-nvim = buildVimPlugin {
    pname = "octo.nvim";
-    version = "0-unstable-2026-04-16";
+    version = "0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "pwntester";
      repo = "octo.nvim";
-      rev = "65550fa020775fb18e6eacab86b80145560bfd9c";
-      hash = "sha256-VUm7BQ5g4VyKWAZTOhxt19JAea+DLrMltt01jbO6LUg=";
+      rev = "a8ad0646e6f9d01ad0a6fbd3ddca0fd715067d34";
+      hash = "sha256-oEiQyABAJhF6vgOU2PPPILqioaVF95gMJaQlxCtYEXM=";
    };
    meta.homepage = "https://github.com/pwntester/octo.nvim/";
    meta.hydraPlatforms = [ ];
@@ -13507,12 +13611,12 @@ final: prev: {

  pi-nvim = buildVimPlugin {
    pname = "pi.nvim";
-    version = "0-unstable-2026-03-26";
+    version = "0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "pablopunk";
      repo = "pi.nvim";
-      rev = "cc2377f88c99871bc44b45490ef9d91a5d1c31e1";
-      hash = "sha256-xguHPNrQ16ddWbnxR38Zm6gtDP63b93pxR4bsbN9YZE=";
+      rev = "9a4425e3e601e7387b32065d78b812bc7d5603ad";
+      hash = "sha256-e5LLscgEBuZHIfi+clojp9vfiofvXdU5C7BuhQB7vfw=";
    };
    meta.homepage = "https://github.com/pablopunk/pi.nvim/";
    meta.hydraPlatforms = [ ];
@@ -13716,12 +13820,12 @@ final: prev: {

  project-nvim = buildVimPlugin {
    pname = "project.nvim";
-    version = "3.1.0-1";
+    version = "3.2.1-1";
    src = fetchFromGitHub {
      owner = "DrKJeff16";
      repo = "project.nvim";
-      tag = "v3.1.0-1";
-      hash = "sha256-i3nGUb/tULq28MmiYk3C4P+FoVFSZaaO5XWx4kuTa0I=";
+      tag = "v3.2.1-1";
+      hash = "sha256-vZWOH2fFmwdlU/rdnLWywx+XsuuH+X5x0DN8OHjZd6c=";
    };
    meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
    meta.hydraPlatforms = [ ];
@@ -13860,12 +13964,12 @@ final: prev: {

  quarto-nvim = buildVimPlugin {
    pname = "quarto-nvim";
-    version = "2.0.1-unstable-2026-01-29";
+    version = "2.1.0";
    src = fetchFromGitHub {
      owner = "quarto-dev";
      repo = "quarto-nvim";
-      rev = "d923bb7cfc2bde41143e1c531c28190f0fade3a2";
-      hash = "sha256-UGrbQtmJIQsOb37/IcrFxGnAfIiCHGsmMFFSkitNK9o=";
+      tag = "v2.1.0";
+      hash = "sha256-YgRiUnZ1MH5uuwNC3V9ZntphuKH3rIOlcdp+5C4zonk=";
    };
    meta.homepage = "https://github.com/quarto-dev/quarto-nvim/";
    meta.hydraPlatforms = [ ];
@@ -14067,12 +14171,12 @@ final: prev: {

  refactoring-nvim = buildVimPlugin {
    pname = "refactoring.nvim";
-    version = "0-unstable-2025-10-21";
+    version = "0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "theprimeagen";
      repo = "refactoring.nvim";
-      rev = "6784b54587e6d8a6b9ea199318512170ffb9e418";
-      hash = "sha256-KFn1f0Va6eFbeOYxc40lN1iWL8WAwnm/H5l46o4JgvI=";
+      rev = "f06ac3d457128f9d512103399b367c4be49a2421";
+      hash = "sha256-mZC2N8Udvep75/FeSRn2ZmEmE2/SNxFHw+W5QJHduLw=";
    };
    meta.homepage = "https://github.com/theprimeagen/refactoring.nvim/";
    meta.hydraPlatforms = [ ];
@@ -14158,12 +14262,12 @@ final: prev: {

  render-markdown-nvim = buildVimPlugin {
    pname = "render-markdown.nvim";
-    version = "8.12.0-unstable-2026-04-12";
+    version = "8.12.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "MeanderingProgrammer";
      repo = "render-markdown.nvim";
-      rev = "0fd43fb4b1f073931c4b481f5f3b7cea3749e190";
-      hash = "sha256-wCzOiTKJ8F2Fj82LYRSoG1Ix0KDBSdQokzNGVmbu2oo=";
+      rev = "d67113f11384c0dad96fced2f7b91f1fc811e97f";
+      hash = "sha256-c+2KzCACUnb/RkkLsI9uxvJNLP0PDgmuPSUlO/XgGBw=";
    };
    meta.homepage = "https://github.com/MeanderingProgrammer/render-markdown.nvim/";
    meta.hydraPlatforms = [ ];
@@ -14289,12 +14393,12 @@ final: prev: {

  roslyn-nvim = buildVimPlugin {
    pname = "roslyn.nvim";
-    version = "0-unstable-2026-04-16";
+    version = "0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "seblyng";
      repo = "roslyn.nvim";
-      rev = "6a5e60a7c25d9ce0835aa9c69379f1c92e0a9d56";
-      hash = "sha256-Zoi5RxWJY96C4D3k9iwU2XJb8LKUFCdq5SDHWrfa5vw=";
+      rev = "b62d1a588765f0aa1b46ed260252c9e456408835";
+      hash = "sha256-j5+Kg4B1flk4TwkZKRDW7tHbaoUyE5dKGypXsd9+qSw=";
    };
    meta.homepage = "https://github.com/seblyng/roslyn.nvim/";
    meta.hydraPlatforms = [ ];
@@ -14445,12 +14549,12 @@ final: prev: {

  scnvim = buildVimPlugin {
    pname = "scnvim";
-    version = "0-unstable-2026-04-13";
+    version = "0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "davidgranstrom";
      repo = "scnvim";
-      rev = "7e0ff9ed57c58dfde0341d1e695fe54a0904e2d8";
-      hash = "sha256-PaIYXaPtwen/SWdLADsJDx7NI/OoTAjUa24AZYJyNBA=";
+      rev = "ec347b24168ac922de4dcddc181efd2fcdcfa0d0";
+      hash = "sha256-cqZF3b+DkOQUOSU502vGQx8RNzH4b97B9zqHO9v8IBI=";
    };
    meta.homepage = "https://github.com/davidgranstrom/scnvim/";
    meta.hydraPlatforms = [ ];
@@ -14640,12 +14744,12 @@ final: prev: {

  sidekick-nvim = buildVimPlugin {
    pname = "sidekick.nvim";
-    version = "2.3.0-unstable-2026-03-24";
+    version = "2.3.0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "sidekick.nvim";
-      rev = "17447a05f9385e5f8372b61530f6f9329cb82421";
-      hash = "sha256-scCYymquGaT9/e7nU2kuyiwFutKfAq8pGQQsOWK+7rM=";
+      rev = "208e1c5b8170c01fd1d07df0139322a76479b235";
+      hash = "sha256-I1YuIXJHP7JfETwOer6B7QDLMZGG/X59zXopb4nPel4=";
    };
    meta.homepage = "https://github.com/folke/sidekick.nvim/";
    meta.hydraPlatforms = [ ];
@@ -14849,12 +14953,12 @@ final: prev: {

  solarized-osaka-nvim = buildVimPlugin {
    pname = "solarized-osaka.nvim";
-    version = "0-unstable-2026-02-04";
+    version = "0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "craftzdog";
      repo = "solarized-osaka.nvim";
-      rev = "f0c2f0ba0bd56108d53c9bfae4bb28ff6c67bbdb";
-      hash = "sha256-0AB2+ZuhlpuBFF5xmYXr1sIOIctY4b8jgcghqXZSc70=";
+      rev = "a261ee90fb3e5e82660567e4874d384e996afa4f";
+      hash = "sha256-b8gZM9/HFi4q+mWpEijO8fCBuu1eslGSNPgZOyjXMmc=";
    };
    meta.homepage = "https://github.com/craftzdog/solarized-osaka.nvim/";
    meta.hydraPlatforms = [ ];
@@ -16362,12 +16466,12 @@ final: prev: {

  tiny-inline-diagnostic-nvim = buildVimPlugin {
    pname = "tiny-inline-diagnostic.nvim";
-    version = "0-unstable-2026-04-17";
+    version = "0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "rachartier";
      repo = "tiny-inline-diagnostic.nvim";
-      rev = "b3b91e086795c036ecfe70429b72b26bcb302c91";
-      hash = "sha256-yYxwyXuOIb+Ac5f8OonwsJny00bqfL7cWDtcjsVtP5o=";
+      rev = "147af4e49f51dd48f41972de26552872b8ba7b25";
+      hash = "sha256-LpZuRNGSK8AHLTIPIWoQlGot89qubFRL/RZ+EMs4bnQ=";
    };
    meta.homepage = "https://github.com/rachartier/tiny-inline-diagnostic.nvim/";
    meta.hydraPlatforms = [ ];
@@ -16899,12 +17003,12 @@ final: prev: {

  ultisnips = buildVimPlugin {
    pname = "ultisnips";
-    version = "3.2-unstable-2026-04-18";
+    version = "3.2-unstable-2026-04-19";
    src = fetchFromGitHub {
      owner = "SirVer";
      repo = "ultisnips";
-      rev = "724e506c6c852ea9bd60720d878a09a55eb3eb74";
-      hash = "sha256-HhTFCWpE5ljk2M4z9/XHBobLMIW6DO9mpVF5BEfY624=";
+      rev = "10fc6cb2a48aa24d72894f71fceaa43a0432f287";
+      hash = "sha256-mSifyCvjefyl0snph+NAdI8alU2MeB5BozWHvmgpqVo=";
    };
    meta.homepage = "https://github.com/SirVer/ultisnips/";
    meta.hydraPlatforms = [ ];
@@ -17094,12 +17198,12 @@ final: prev: {

  vague-nvim = buildVimPlugin {
    pname = "vague.nvim";
-    version = "2.0.0-unstable-2026-04-09";
+    version = "2.0.0-unstable-2026-04-21";
    src = fetchFromGitHub {
      owner = "vague-theme";
      repo = "vague.nvim";
-      rev = "8751181a1aa431b4e8983b0a183afef5cbc08381";
-      hash = "sha256-89Z6MzAFcZeUhMfU1amR4sxakcpsxlJxT3s6XateaBo=";
+      rev = "fd58046b9d64259d9785e4aeb6d6f494c6943cad";
+      hash = "sha256-wAjzCkTMoxEP6Xc38I5lY3tSwEgU67w/bYPYxmaGaZA=";
    };
    meta.homepage = "https://github.com/vague-theme/vague.nvim/";
    meta.hydraPlatforms = [ ];
@@ -17549,12 +17653,12 @@ final: prev: {

  vim-airline = buildVimPlugin {
    pname = "vim-airline";
-    version = "0.11-unstable-2026-04-13";
+    version = "0.11-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "vim-airline";
      repo = "vim-airline";
-      rev = "609e5c0ee171c370ad727b0b833e66fd34772aeb";
-      hash = "sha256-PgS2m3vqncalNNSeXpYb0x2MfEdM7eUh6uGWyM6yHsA=";
+      rev = "f6d9cc6b4a1f0a4f7a1c33bc7997cf446b6d77ba";
+      hash = "sha256-gHdp2+Vd0AITx/0LSrwPRM6zOhhCyl0uMe8hS2IHnRc=";
    };
    meta.homepage = "https://github.com/vim-airline/vim-airline/";
    meta.hydraPlatforms = [ ];
@@ -20372,11 +20476,11 @@ final: prev: {

  vim-markbar = buildVimPlugin {
    pname = "vim-markbar";
-    version = "0-unstable-2024-05-10";
+    version = "0-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "Yilin-Yang";
      repo = "vim-markbar";
-      rev = "9f5a948d44652074bf2b90d3da6a400d8a369ba5";
+      rev = "54cd772352b4da4506ce23e971f46f78446f0b6c";
      hash = "sha256-dGMO0vbi4LMQeMvA/NI98S/CsDT7LKDPrLP9NFkMZOQ=";
    };
    meta.homepage = "https://github.com/Yilin-Yang/vim-markbar/";
@@ -20554,12 +20658,12 @@ final: prev: {

  vim-moonfly-colors = buildVimPlugin {
    pname = "vim-moonfly-colors";
-    version = "0-unstable-2026-04-02";
+    version = "0-unstable-2026-04-20";
    src = fetchFromGitHub {
      owner = "bluz71";
      repo = "vim-moonfly-colors";
-      rev = "43d8eb9dd2a1154dd8259ee3ce37cbbdb28c405c";
-      hash = "sha256-jyZKY2N0ix53x5xhYo+B31G02fKcxhYkSGlJ3VFA2Ng=";
+      rev = "ed33cb0e0edfced6e86e782d51f23e67232ad4a9";
+      hash = "sha256-xFEI7cn5X3E90X3Z7njTg5/nFXXECJxPYmitfr+29VA=";
    };
    meta.homepage = "https://github.com/bluz71/vim-moonfly-colors/";
    meta.hydraPlatforms = [ ];
@@ -23727,12 +23831,12 @@ final: prev: {

  yazi-nvim = buildVimPlugin {
    pname = "yazi.nvim";
-    version = "13.1.5-unstable-2026-04-19";
+    version = "13.1.5-unstable-2026-04-22";
    src = fetchFromGitHub {
      owner = "mikavilpas";
      repo = "yazi.nvim";
-      rev = "bb69f7fc634a9566edba5fc0da3a2025d7ffbae0";
-      hash = "sha256-WHp/HM4AN2kZiPs7sOIAlBWM1H7KUgFGPEEioWlxFQE=";
+      rev = "d34b366517a21fb2366e8ac393fc903008345173";
+      hash = "sha256-SjWgNlb8raCDQ7E3lgHnTwl0wFTibxxKV4YcCeX0qPE=";
    };
    meta.homepage = "https://github.com/mikavilpas/yazi.nvim/";
    meta.hydraPlatforms = [ ];
@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
  pname = "codediff.nvim";
-  version = "2.43.10";
+  version = "2.43.15";

  src = fetchFromGitHub {
    owner = "esmuellert";
    repo = "codediff.nvim";
    tag = "v${version}";
-    hash = "sha256-iiDf5rbRHJePlv8kBtAID8qVGNBCKi1iipQ9nmMXI18=";
+    hash = "sha256-gaPLjH33+nBgpSZJ8b/4aneodt8wg+Jy44yXAjemToA=";
  };

  dependencies = [ vimPlugins.nui-nvim ];
@@ -227,6 +227,12 @@ assertNoAdditions {
    checkInputs = [ self.astrocore ];
  };

+  async-nvim = super.async-nvim.overrideAttrs {
+    nvimSkipModules = [
+      "docgen"
+    ];
+  };
+
  asyncrun-vim = super.asyncrun-vim.overrideAttrs {
    # Optional toggleterm integration
    checkInputs = [ self.toggleterm-nvim ];
@@ -1581,6 +1587,17 @@ assertNoAdditions {
    passthru.python3Dependencies = ps: [ ps.jupytext ];
  };

+  just-nvim = super.just-nvim.overrideAttrs {
+    checkInputs = with self; [
+      fidget-nvim
+      nvim-notify
+      telescope-nvim
+    ];
+    dependencies = with self; [
+      plenary-nvim
+    ];
+  };
+
  kanagawa-paper-nvim = super.kanagawa-paper-nvim.overrideAttrs {
    nvimSkipModules = [
      # skipping wezterm theme switcher since it relies on a wezterm module
@@ -3228,7 +3245,7 @@ assertNoAdditions {

  refactoring-nvim = super.refactoring-nvim.overrideAttrs {
    dependencies = with self; [
-      plenary-nvim
+      async-nvim
    ];
  };

@@ -218,7 +218,7 @@ let
            paths = allGrammars;
          };

-          allAndOptPluginNames = map (plugin: plugin.pname) (allPlugins ++ opt);
+          allAndOptPluginNames = map (plugin: plugin.pname or null) (allPlugins ++ opt);

          packdirStart = vimFarm "pack/${packageName}/start" "packdir-start" (
            if allGrammars != [ ] then allPlugins ++ [ allGrammarsSymlinked ] else allPlugins
@@ -78,6 +78,7 @@ https://github.com/AstroNvim/astrocore/,,
 https://github.com/AstroNvim/astrolsp/,,
 https://github.com/AstroNvim/astrotheme/,,
 https://github.com/AstroNvim/astroui/,,
+https://github.com/lewis6991/async.nvim/,,
 https://github.com/prabirshrestha/async.vim/,,
 https://github.com/prabirshrestha/asyncomplete-buffer.vim/,,
 https://github.com/prabirshrestha/asyncomplete-file.vim/,,
@@ -253,6 +254,7 @@ https://github.com/franco-ruggeri/codecompanion-spinner.nvim/,,
 https://github.com/olimorris/codecompanion.nvim/,,
 https://github.com/mrjones2014/codesettings.nvim/,,
 https://github.com/gorbit99/codewindow.nvim/,,
+https://github.com/johnseth97/codex.nvim/,,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/archseer/colibri.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
@@ -558,6 +560,8 @@ https://github.com/ajbucci/ipynb.nvim/,,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,,
 https://github.com/haya14busa/is.vim/,,
+https://github.com/Treeniks/isabelle-lsp.nvim/,,
+https://github.com/Treeniks/isabelle-syn.nvim/,,
 https://github.com/mizlan/iswap.nvim/,,
 https://github.com/vim-scripts/jdaddy.vim/,,
 https://github.com/mahyarmirrashed/jdd.nvim/,,
@@ -572,6 +576,7 @@ https://git.myzel394.app/Myzel394/jsonfly.nvim,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,,
+https://github.com/nxuv/just.nvim/,,
 https://github.com/thesimonho/kanagawa-paper.nvim/,,
 https://github.com/rebelot/kanagawa.nvim/,,
 https://github.com/webhooked/kanso.nvim/,,
@@ -785,6 +790,7 @@ https://github.com/nvim-neorg/neorg-telescope/,,
 https://github.com/karb94/neoscroll.nvim/,,
 https://github.com/Shougo/neosnippet-snippets/,,
 https://github.com/Shougo/neosnippet.vim/,,
+https://github.com/kawre/neotab.nvim/,,
 https://github.com/kassio/neoterm/,,
 https://github.com/rcasia/neotest-bash/,,
 https://github.com/orjangj/neotest-ctest/,,
@@ -905,6 +911,7 @@ https://codeberg.org/mfussenegger/nvim-jdtls/,,
 https://github.com/gennaro-tedesco/nvim-jqx/,,
 https://gitlab.com/usmcamp0811/nvim-julia-autotest,,
 https://github.com/yorickpeterse/nvim-jump/,,
+https://github.com/chrisgrieser/nvim-justice/,,
 https://github.com/anasinnyk/nvim-k8s-crd/,,
 https://github.com/ethanholz/nvim-lastplace/,,
 https://github.com/kosayoda/nvim-lightbulb/,,
@@ -944,6 +951,7 @@ https://github.com/petertriho/nvim-scrollbar/,,
 https://github.com/dstein64/nvim-scrollview/,,
 https://github.com/s1n7ax/nvim-search-and-replace/,,
 https://github.com/michaelrommel/nvim-silicon/,,
+https://github.com/jbuck95/nvim-sioyek-highlights/,,
 https://github.com/garymjr/nvim-snippets/,,
 https://github.com/dcampos/nvim-snippy/,,
 https://github.com/ishan9299/nvim-solarized-lua/,,
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.114";
-    hash = "sha256-rcEbeYsyhbhh5wj6Mo3kz2+K3uZe5XMBKpwmSaB9Pgc=";
+    version = "2.1.119";
+    hash = "sha256-/KqOJ8dvv6PhQJyfuOFEgKx6U8hH/WoUnocmWxsLLUk=";
  };

  postInstall = ''
@@ -1346,8 +1346,8 @@ let
        mktplcRef = {
          publisher = "discloud";
          name = "discloud";
-          version = "2.28.5";
-          hash = "sha256-G5WgFSrmQOOtsDFfmJaJxvgbKfnpQSmMf+xAJeuhvhU=";
+          version = "2.28.7";
+          hash = "sha256-0RCuCZXDJ9svmI9Kc6vBE/l0f33aB3BXCFuHLFpa8nI=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1375,8 +1375,8 @@ let
        mktplcRef = {
          name = "competitive-programming-helper";
          publisher = "DivyanshuAgrawal";
-          version = "2025.12.1766739309";
-          hash = "sha256-innqhXTflK6yS9n3Sw1sbRKT4/BT+Aa6hsKrc1pOsZ4=";
+          version = "2026.4.1776958969";
+          hash = "sha256-Ng9Yw1Jq2lSLqczHj6tjhtINfzx1bOXlVN0K1pogIKw=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -1933,8 +1933,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "codespaces";
-          version = "1.18.12";
-          hash = "sha256-A/ORfMybSCm90SFg8hRx/N0Vq9XMtTjMPVzCIoG938g=";
+          version = "1.18.13";
+          hash = "sha256-tvs35GA3bZ4jExiAe0NeHx/vQV/+2zio2Q0813/MAMU=";
        };

        meta = {
@@ -1970,8 +1970,8 @@ let
        mktplcRef = {
          name = "vscode-github-actions";
          publisher = "github";
-          version = "0.31.3";
-          hash = "sha256-Do1z7ywF/0Do09chX0bFtkX+8Nux0fBCWfVpUagiioM=";
+          version = "0.31.5";
+          hash = "sha256-hGdcMAkzpJqX61Ki87ckFAhncOm6LmNCQh4imIg64oY=";
        };
        meta = {
          description = "Visual Studio Code extension for GitHub Actions workflows and runs for github.com hosted repositories";
@@ -1986,8 +1986,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "vscode-pull-request-github";
-          version = "0.136.0";
-          hash = "sha256-WUdA5aD3EC45gHBo4ctxVUog8QTEIq6IXlCOPZBBXmo=";
+          version = "0.138.0";
+          hash = "sha256-tOqBBgA6HxBc5TT4/A3OWKxDvaoqw8zXCtMa+K3Ku1E=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -2324,8 +2324,8 @@ let
        mktplcRef = {
          name = "vscode-vibrancy-continued";
          publisher = "illixion";
-          version = "1.1.75";
-          hash = "sha256-49svwafMoAErwX3K/37IJ8fKx+9FgSpOqj6QPc7jpKs=";
+          version = "1.1.76";
+          hash = "sha256-QMKEFoqOzlSduwjefou1ozt3WbSbeXfxEGj6KMqR3eY=";
        };
        meta = {
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -3861,8 +3861,8 @@ let
        mktplcRef = {
          name = "ansible";
          publisher = "redhat";
-          version = "26.4.2";
-          hash = "sha256-mSsCeUMEmLkEuxQIBQZaVzOpOwZ7b4SaiPwOJdVuIJk=";
+          version = "26.4.4";
+          hash = "sha256-fBwehxNmePQuM+kJ4cigVQCZ9UqBlBcT6+xD/gDCv64=";
        };
        meta = {
          description = "Ansible language support";
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "basedpyright";
    publisher = "detachhead";
-    version = "1.39.2";
-    hash = "sha256-iSjwEPSlPWmg3cYLSCp2YmHOR8EShGuPHzXMHGoa4iM=";
+    version = "1.39.3";
+    hash = "sha256-uuWkSxjsY7ZL1QUwqkiwPTN8oGUktfm7/Hgv3Enmgqc=";
  };
  meta = {
    changelog = "https://github.com/detachhead/basedpyright/releases";
@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-IoBA0fuy9XxZgswN1j9DfwDI218h2huapl1Bfs2AscI=";
+          hash = "sha256-YeF6LyQzVAXgZ5Iqr6YvNcACfiUukUsq7cybeCQdSYc=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-EfoRRJFTNr+0JAkqWJ2pXwhBtmAXs9cANLzXb4obOMs=";
+          hash = "sha256-SjirNvI83eh3Gt5rGsaiLT6TJMH6LRQAasOFNy9OMCY=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-p2AjXFqoptxAwOdsievcjD/WLm0J03Rx/sT4ejUd6xM=";
+          hash = "sha256-FjE3xTp5Mj1584bepVc4nZr3rxCR3CV+jplmA45VF44=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-C1nbQxL5YDWenLQ82tABuEWKWl/LoEizTWo/YnBQJFw=";
+          hash = "sha256-SAf3+0QSFUDq09AZQnw78ps55RM/RwoAeQuVly7vn10=";
        };
      };
    in
    {
      publisher = "kilocode";
      name = "Kilo-Code";
-      version = "7.2.0";
+      version = "7.2.20";
    }
    // sources.${stdenv.hostPlatform.system}
      or (throw "Unsupported system ${stdenv.hostPlatform.system}");
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ms-azuretools";
    name = "vscode-containers";
-    version = "2.4.1";
-    hash = "sha256-OwxJJVW15MivWVeSlbFQNQbrxjDgpXePrPf+r3qb+As=";
+    version = "2.4.2";
+    hash = "sha256-qkQAv53y+PVKJdReffjHwoJbvj20o4DF/c6omLIWB80=";
  };

  meta = {
@@ -42,15 +42,15 @@ let
  isDarwin = stdenv.hostPlatform.isDarwin;
  supported = {
    x86_64-linux = {
-      hash = "sha256-4EMCbRdPUNOmvW2c2BgdzvPLr7lWAzAKarUI9nBVBeI=";
+      hash = "sha256-5L4PrwcZ/Q3g6qlCsCebx3czLZVD2sDrDf99l9nooSo=";
      arch = "linux-x64";
    };
    aarch64-linux = {
-      hash = "sha256-bjs2xNhd/dTDlhRjC5TunV8jEV187dEduLGuuX/oUnI=";
+      hash = "sha256-nQNDPfk6BRHp7veyx18GMlEt3Xa8iDuqtHG7qzJcPS4=";
      arch = "linux-arm64";
    };
    aarch64-darwin = {
-      hash = "sha256-EZE9Vk1GRFNUiXCqohjNrNeZ/o5wl6tvamn6+tgoKGI=";
+      hash = "sha256-jhoa9UcYg2Uj8x9AZwAh68k7WCi6mpgNUUx2YsRIkjw=";
      arch = "darwin-arm64";
    };
  };
@@ -63,7 +63,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = base // {
    name = "cpptools";
    publisher = "ms-vscode";
-    version = "1.31.4";
+    version = "1.31.5";
  };

  nativeBuildInputs = [
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "windows-ai-studio";
    publisher = "ms-windows-ai-studio";
-    version = "0.34.0";
-    hash = "sha256-yOBUkFNE/6Gy675J3/PbrfkvKgJdgQVRcSEnd7rCtlU=";
+    version = "1.0.0";
+    hash = "sha256-bpq4q/ZEk75NBiwP1VUtTCV2xHed38+CiSKNkT/ClWk=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
  core = "atari800";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-atari800";
-    rev = "a9b9c433d8cb6c8e8eb08d14d3e95b430549723a";
-    hash = "sha256-vPv6D+y+n9gMgC78cLBVeNLg3nGEAsTeBGFv+SWgH0A=";
+    rev = "7f3456f16109c34915d0bad7393b6c4df66c3850";
+    hash = "sha256-7C/0i7LUGHY8bz5wp9ut+5EtvLrAUasn0xQzslQQ1fM=";
  };

  makefile = "Makefile";
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "4fdfd541e5dce6f08883883dd27289545825e0b4";
-    hash = "sha256-DtZIi9BRrskfHFLt/UqfZBJp96QmgqGgroxyF7UTRLU=";
+    rev = "48f2ceb50392a9c142f10312ba4461e60c6b91ff";
+    hash = "sha256-lrrmGAnBNXU871GGDhQfRSVrYv/jebaUKtyMeyWm7GY=";
  };

  extraBuildInputs = lib.optionals withHw [
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-wswan";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-wswan-libretro";
-    rev = "392db084316475411f3f24bd1ea54dba72ecbe51";
-    hash = "sha256-GbjE2PqfZGrP9tp4TgyIzdyyC1PatGiQRSscsmcIbPQ=";
+    rev = "da6d0d9acb8d4e9bd6725ab44225a275325d8352";
+    hash = "sha256-ky/8ywP7scg8VXpqwDISw3A0zKwWbh7zAdaLhM91+Rw=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bsnes";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bsnes-libretro";
-    rev = "399bdedb20f6e847e75e8425ca240560ea0940a6";
-    hash = "sha256-T3pmZ6WJOXyubiTzOIDipMdRDpB+RiNRnd76XbOIl84=";
+    rev = "d62d219ac22f1ed179738d107d8a4da2c4289845";
+    hash = "sha256-XYCzXAFkSFNMlRjzH4zR3lpRguOqvAJM4TBcL9Feog8=";
  };

  makefile = "Makefile";
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore rec {
  core = "fbalpha2012";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbalpha2012";
-    rev = "15af60bf24e3dc2267a38e3c8532450ebec86317";
-    hash = "sha256-7QfDk/j7akaORSekdx96mcDgsFp+kAq1/Cxtu3uPe4A=";
+    rev = "95fa35582b1ca7ce68de3313615794c8c9d8d7c0";
+    hash = "sha256-9F970HETDJsttoQOlqg2dFMzff/drR7G8MxXaSlWTHI=";
  };

  sourceRoot = "${src.name}/svn-current/trunk";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fbneo";
-  version = "0-unstable-2026-04-14";
+  version = "0-unstable-2026-04-21";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbneo";
-    rev = "e869c6a2033b135e7fcbea4a50695e97755feae1";
-    hash = "sha256-YIva50UWylsDmAaJZI85LCphrgjh7jDYQZkpAlQr1HM=";
+    rev = "5cd2221d04fef37ef2f99793acc100b445691612";
+    hash = "sha256-uv7MKLlHzTWSeGd0SRCfF+4S+SiJeZny0OerU1MbWOI=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "dbf1f2eb83ebde54a32fbe4f906b5ad89a863c0b";
-    hash = "sha256-UGssF6x/H5met7f2hC6str2urvCZRj/Oqp2R0rv2RUw=";
+    rev = "448a231618186b2af0bb9d6e37aeca05467e112f";
+    hash = "sha256-Kr3DEAk8dsFnUT73pOp5qwkCbcDItQwrRMI8hobrCuI=";
  };

  meta = {
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-04-17";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "321bdaf08b4b007a720f196ea072c1813b1b7efe";
-    hash = "sha256-9Ry5+krdhz2RCmZZh2l6DdcKTgMpcgHwOBG4c7fc/og=";
+    rev = "ae5416a5cb1df362382279172818ac4bb692dc97";
+    hash = "sha256-3eFkirJm3tBLvJrM0rcTX1tFnKnWag8s3eUL17nQc9w=";
    fetchSubmodules = true;
  };

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fmsx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fmsx-libretro";
-    rev = "6b807c588d63677770f7f2ed8b94ca0e9da256ce";
-    hash = "sha256-vA9ODUtmmrDPbZjmRJ9IIFELLTD8g8aHmQdo/B/d1fQ=";
+    rev = "3933db571485b7c6572968f154fa8621c5568357";
+    hash = "sha256-hKN/SEnUJW1F4d6unC5k5J95pq0rNMQzLFIfIQL+0v4=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "freeintv";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "freeintv";
-    rev = "9b66d2b3c3406659b2fdfaade7a80f3e62772815";
-    hash = "sha256-rJatbYyrS9vkGT8+jty80rPkcGGCV9enW5L40NeFwlE=";
+    rev = "428915baf2bfc032fc03e645f4f8f9c6c3144979";
+    hash = "sha256-S8sGHS56fQaSuoUllupYdieSLFzsUE3tmM7DUssA+NY=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fuse";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fuse-libretro";
-    rev = "b5f44e3a20a0f189e8fb999cd5cde223a0f588a6";
-    hash = "sha256-ZYk9qe+9yJmi+zsKT3IDvyiPCxivwghT68ku6WfaVa8=";
+    rev = "bce196fb774835fe65b3e5b821887a4ccf657167";
+    hash = "sha256-N66LaveZ4P66LRYpP1KwkLKT1dvG/s7JPfDyRraVkc8=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "gambatte";
-  version = "0-unstable-2026-04-11";
+  version = "0-unstable-2026-04-24";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "gambatte-libretro";
-    rev = "ac3d17d07a1119df5eb124494dfa90e47ae2e5ff";
-    hash = "sha256-5240slUbHUYb6Xp65xPvvCopdciyGK+Z8mdk7i0ALIQ=";
+    rev = "5ba6bd1ad745e04b7069d0eb2b44091364fc997a";
+    hash = "sha256-A9OQx0eXVgrGcmpMTtTe97rHCjrV3Ksi/ooLefsysbQ=";
  };

  meta = {
--- a/Show More
+++ b/Show More