Merge master into staging-nixos

2026-04-05 18:11:49 +00:00
parent 769e2b0090 f7922f0cbc
commit a581678c55
108 changed files with 2883 additions and 844 deletions
@@ -101,6 +101,7 @@ If `true`, the intermediate fetcher downloads dependencies from the

 This is useful if your code depends on C code and `go mod tidy` does not include the needed sources to build or
 if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
+It may also be needed if the module targets language version 1.16 or earlier, since vendoring compiles all dependencies against language version 1.16 in this case.

 Defaults to `false`.

@@ -164,8 +164,13 @@ of pulling the upstream container image from Docker Hub. If you want the old beh

 - `services.stalwart-mail` has been renamed to `services.stalwart` to align with upstream re-brand as an e-mail and collaboration server. Other notable breaking changes to module:

+  - Addition of module-specific `stateVersion` option, which on existing installations of Stalwart must be set to the same as `system.stateVersion`.
+
+    This enables manually and carefully migrating Stalwart to a new `stateVersion` or newly enabling the Stalwart module with a newer `stateVersion` than `system.stateVersion`.
+
  - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`.
  - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.
+  - Default tracer name and type have changed to `journal`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `stdout`.

 - `services.eintopf` has been renamed to `services.lauti` to align with upstream re-brand as a community online calendar.

@@ -8,9 +8,10 @@ let
  cfg = config.services.stalwart;
  configFormat = pkgs.formats.toml { };
  configFile = configFormat.generate "stalwart.toml" cfg.settings;
-  useLegacyStorage = lib.versionOlder config.system.stateVersion "24.11";
-  useLegacyDefault = lib.versionOlder config.system.stateVersion "26.05";
-  default = if useLegacyDefault then "stalwart-mail" else "stalwart";
+  useLegacyStorage = lib.versionOlder cfg.stateVersion "24.11";
+  pre2605 = lib.versionOlder cfg.stateVersion "26.05";
+  stalwartIdentifier = if pre2605 then "stalwart-mail" else "stalwart";
+  stalwartIdentifierText = ''if lib.versionOlder config.services.stalwart.stateVersion "26.05" then "stalwart-mail" else "stalwart"'';

  parsePorts =
    listeners:
@@ -31,6 +32,15 @@ in
  options.services.stalwart = {
    enable = lib.mkEnableOption "the all-in-one collaboration and mail server, Stalwart";

+    stateVersion = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The version of this module (=version of NixOS) when this module was first enabled on this particular machine, used to maintain compatibility with application data created on older versions of this module.
+
+        See {option}`system.stateVersion` for details on the NixOS-global equivalent to this option.
+      '';
+    };
+
    package = lib.mkPackageOption pkgs "stalwart" { };

    openFirewall = lib.mkOption {
@@ -55,7 +65,8 @@ in

    dataDir = lib.mkOption {
      type = lib.types.path;
-      default = if useLegacyDefault then "/var/lib/stalwart-mail" else "/var/lib/stalwart";
+      default = "/var/lib/${stalwartIdentifier}";
+      defaultText = lib.literalExpression "/var/lib/\${${stalwartIdentifierText}}";
      description = ''
        Data directory for stalwart
      '';
@@ -63,7 +74,8 @@ in

    user = lib.mkOption {
      type = lib.types.str;
-      inherit default;
+      default = stalwartIdentifier;
+      defaultText = lib.literalExpression stalwartIdentifierText;
      description = ''
        User ownership of service
      '';
@@ -71,7 +83,8 @@ in

    group = lib.mkOption {
      type = lib.types.str;
-      inherit default;
+      default = stalwartIdentifier;
+      defaultText = lib.literalExpression stalwartIdentifierText;
      description = ''
        Group ownership of service
      '';
@@ -114,12 +127,24 @@ in

    # Default config: all local
    services.stalwart.settings = {
-      tracer.stdout = {
-        type = lib.mkDefault "stdout";
-        level = lib.mkDefault "info";
-        ansi = lib.mkDefault false; # no colour markers to journald
-        enable = lib.mkDefault true;
-      };
+      tracer =
+        if pre2605 then
+          {
+            stdout = {
+              type = lib.mkDefault "stdout";
+              level = lib.mkDefault "info";
+              ansi = lib.mkDefault false; # no colour markers to journald
+              enable = lib.mkDefault true;
+            };
+          }
+        else
+          {
+            journal = {
+              type = lib.mkDefault "journal";
+              level = lib.mkDefault "info";
+              enable = lib.mkDefault true;
+            };
+          };
      store =
        if useLegacyStorage then
          {
@@ -155,7 +180,7 @@ in
          );
        in
        {
-          path = "/var/cache/${default}";
+          path = "/var/cache/${stalwartIdentifier}";
          resource = lib.mkIf hasHttpListener (lib.mkDefault "file://${cfg.package.webadmin}/webadmin.zip");
        };
    };
@@ -165,10 +190,10 @@ in
    # service is restarted on a potentially large number of files.
    # That would cause unnecessary and unwanted delays.
    users = {
-      groups = lib.mkIf (cfg.group == default) {
+      groups = lib.mkIf (cfg.group == stalwartIdentifier) {
        ${cfg.group} = { };
      };
-      users = lib.mkIf (cfg.user == default) {
+      users = lib.mkIf (cfg.user == stalwartIdentifier) {
        ${cfg.user} = {
          isSystemUser = true;
          inherit (cfg) group;
@@ -197,7 +222,7 @@ in
          KillSignal = "SIGINT";
          Restart = "on-failure";
          RestartSec = 5;
-          SyslogIdentifier = default;
+          SyslogIdentifier = stalwartIdentifier;

          ExecStartPre =
            if useLegacyStorage then
@@ -217,8 +242,8 @@ in
          ReadWritePaths = [
            cfg.dataDir
          ];
-          CacheDirectory = default;
-          StateDirectory = default;
+          CacheDirectory = stalwartIdentifier;
+          StateDirectory = stalwartIdentifier;

          # Upstream uses "stalwart" as the username since 0.12.0
          User = cfg.user;
@@ -10,11 +10,9 @@
 let
  inherit (lib)
    concatStrings
-    foldl
    foldl'
    genAttrs
    literalExpression
-    maintainers
    mapAttrs
    mapAttrsToList
    mkDefault
@@ -22,9 +20,7 @@ let
    mkIf
    mkMerge
    mkOption
-    optional
    types
-    mkOptionDefault
    flip
    attrNames
    xor
@@ -328,6 +324,7 @@ let
          description = "Prometheus ${name} exporter service user";
          isSystemUser = true;
          inherit (conf) group;
+          extraGroups = mkIf (name == "libvirt") [ "libvirtd" ];
        }
      );
      users.groups = mkMerge [
@@ -24,6 +24,11 @@ in
        --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
        --libvirt.uri ${cfg.libvirtUri} ${lib.concatStringsSep " " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
    };
  };
 }
@@ -6,8 +6,9 @@ let
    }:
    makeTest (
      { pkgs, lib, ... }:
+      assert lib.assertMsg withQt6 "`lomiri.morph-browser` has been dropped, cannot test it.";
      {
-        name = "morph-browser-${if withQt6 then "qt6" else "qt5"}-standalone";
+        name = "morph-browser-qt6-standalone";
        meta.maintainers = lib.teams.lomiri.members;

        nodes.machine =
@@ -24,7 +25,7 @@ let
            services.xserver.enable = true;

            environment = {
-              systemPackages = with (if withQt6 then pkgs.lomiri-qt6 else pkgs.lomiri); [
+              systemPackages = with pkgs.lomiri-qt6; [
                suru-icon-theme
                morph-browser
              ];
@@ -76,6 +77,6 @@ let
    );
 in
 {
-  qt5 = generic { withQt6 = false; };
+  qt5 = throw "`lomiri.morph-browser` has been removed because it relied on the known-vulnerable `libsForQt5.qtwebengine`. For testing the Qt6 version of Morph, please use `nixosTests.morph-browser.qt6` instead."; # Added on 2026-03-31
  qt6 = generic { withQt6 = true; };
 }
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:

 let
  certs = import ../common/acme/server/snakeoil-certs.nix;
@@ -9,6 +9,9 @@ in

  services.stalwart = {
    enable = true;
+
+    stateVersion = lib.trivial.release; # Only for the test; please don't do in production
+
    settings = {
      server.hostname = domain;

@@ -4848,6 +4848,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  duck-nvim = buildVimPlugin {
+    pname = "duck.nvim";
+    version = "1.0.0-unstable-2024-03-07";
+    src = fetchFromGitHub {
+      owner = "tamton-aquib";
+      repo = "duck.nvim";
+      rev = "d8a6b08af440e5a0e2b3b357e2f78bb1883272cd";
+      hash = "sha256-97QSkZHpHLq1XyLNhPz88i9VuWy6ux7ZFNJx/g44K2A=";
+    };
+    meta.homepage = "https://github.com/tamton-aquib/duck.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  earthly-vim = buildVimPlugin {
    pname = "earthly.vim";
    version = "0-unstable-2024-04-02";
@@ -5487,6 +5500,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  fluoromachine-nvim = buildVimPlugin {
+    pname = "fluoromachine.nvim";
+    version = "0-unstable-2025-10-21";
+    src = fetchFromGitHub {
+      owner = "maxmx03";
+      repo = "fluoromachine.nvim";
+      rev = "a279f667168e742df059caf1f1f4daf1de24f4f8";
+      hash = "sha256-alZBQYmo9jrsKYTL7dnObaP2op4SMQQRiEZBdhxUZiI=";
+    };
+    meta.homepage = "https://github.com/maxmx03/fluoromachine.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  flutter-tools-nvim = buildVimPlugin {
    pname = "flutter-tools.nvim";
    version = "2.2.0-unstable-2026-01-14";
@@ -10980,6 +11006,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-ansible = buildVimPlugin {
+    pname = "nvim-ansible";
+    version = "0-unstable-2026-02-09";
+    src = fetchFromGitHub {
+      owner = "mfussenegger";
+      repo = "nvim-ansible";
+      rev = "c7f595d568b588942d4d0c37b5cd6cae3764a148";
+      hash = "sha256-Ykp610LPF0tWidHM16UqeaU8sJxcr5OXJdHkjWCYUTU=";
+    };
+    meta.homepage = "https://github.com/mfussenegger/nvim-ansible/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-autopairs = buildVimPlugin {
    pname = "nvim-autopairs";
    version = "0.10.0-unstable-2026-01-30";
@@ -11251,6 +11290,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-dap-ruby = buildVimPlugin {
+    pname = "nvim-dap-ruby";
+    version = "0-unstable-2025-07-08";
+    src = fetchFromGitHub {
+      owner = "suketa";
+      repo = "nvim-dap-ruby";
+      rev = "ba36f9905ca9c6d89e5af5467a52fceeb2bbbf6d";
+      hash = "sha256-57BBhdrikDEswZe2QW+jHMSgfXIjauc6iDNpWS0YUaU=";
+    };
+    meta.homepage = "https://github.com/suketa/nvim-dap-ruby/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-dap-ui = buildVimPlugin {
    pname = "nvim-dap-ui";
    version = "4.0.0-unstable-2026-04-03";
@@ -371,6 +371,7 @@ https://github.com/dracula/vim/,,dracula-vim
 https://github.com/Mofiqul/dracula.nvim/,HEAD,
 https://github.com/stevearc/dressing.nvim/,,
 https://github.com/Bekaboo/dropbar.nvim/,HEAD,
+https://github.com/tamton-aquib/duck.nvim/,HEAD,
 https://github.com/earthly/earthly.vim/,HEAD,
 https://github.com/GustavEikaas/easy-dotnet.nvim/,HEAD,
 https://github.com/JellyApple102/easyread.nvim/,HEAD,
@@ -420,6 +421,7 @@ https://github.com/liangxianzhe/floating-input.nvim/,HEAD,
 https://github.com/floobits/floobits-neovim/,,
 https://github.com/0xstepit/flow.nvim/,HEAD,
 https://github.com/projectfluent/fluent.vim/,HEAD,
+https://github.com/maxmx03/fluoromachine.nvim/,HEAD,
 https://github.com/nvim-flutter/flutter-tools.nvim/,HEAD,
 https://github.com/nvim-focus/focus.nvim/,HEAD,
 https://github.com/anuvyklack/fold-preview.nvim/,HEAD,
@@ -841,6 +843,7 @@ https://github.com/nacro90/numb.nvim/,,
 https://github.com/nvchad/nvchad/,HEAD,
 https://github.com/nvchad/ui/,HEAD,nvchad-ui
 https://github.com/ChristianChiarulli/nvcode-color-schemes.vim/,,
+https://github.com/mfussenegger/nvim-ansible/,HEAD,
 https://github.com/AckslD/nvim-FeMaco.lua/,HEAD,
 https://github.com/nathanmsmith/nvim-ale-diagnostic/,,
 https://github.com/windwp/nvim-autopairs/,,
@@ -864,6 +867,7 @@ https://github.com/julianolf/nvim-dap-lldb/,HEAD,
 https://codeberg.org/mfussenegger/nvim-dap-python/,HEAD,
 https://github.com/rinx/nvim-dap-rego/,HEAD,
 https://github.com/jonboh/nvim-dap-rr/,HEAD,
+https://github.com/suketa/nvim-dap-ruby/,HEAD,
 https://github.com/rcarriga/nvim-dap-ui/,,
 https://github.com/igorlfs/nvim-dap-view/,HEAD,
 https://github.com/theHamsta/nvim-dap-virtual-text/,,
@@ -1175,13 +1175,13 @@
    "vendorHash": "sha256-QO+qM7tv75KbpJ08LDhaUCLtYogQ8dhKM3wNuR+aAhQ="
  },
  "scaleway_scaleway": {
-    "hash": "sha256-Flh/bJSCjaDvw6cVJC6LDcCs9LPXDKX/oXLJibZxTMc=",
+    "hash": "sha256-alsM14F6NbpkO1RVDgHPoIUoakv4PHeObVdwQMwADZA=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.70.1",
+    "rev": "v2.71.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FLap0ZFuYD6RXNQaVLScOI5w+Wfba3utyP2/gZ9fGWo="
+    "vendorHash": "sha256-a6A30IJlS6a6MjWrR/GWx7XCvilvTu9bQurCXWDLjV4="
  },
  "scottwinkler_shell": {
    "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "assh";
-  version = "2.17.0";
+  version = "2.17.1";

  src = fetchFromGitHub {
    repo = "advanced-ssh-config";
    owner = "moul";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X5UWQe4c+QudmXKjFKafivO/OvdBNzyutrL+CUK0olg=";
+    hash = "sha256-rHe0ynjj/7LXUKoS4iO+PJjh4SVBqh+kChuYzSFocfs=";
  };

  vendorHash = "sha256-EA39KqAN9SHPU362j6/j6okvT+eZb2R4unMA0bB+bVg=";
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ast-grep";
-  version = "0.41.1";
+  version = "0.42.1";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    tag = finalAttrs.version;
-    hash = "sha256-AijxixgT8X/c1UtMD6l4BFvYGj3Up0C1CtfwCRdxSfw=";
+    hash = "sha256-TdVjoJmWZ76e9h+/z4/TlytJgwQpQu/esRuZg1sZw8A=";
  };

  # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm .cargo/config.toml
  '';

-  cargoHash = "sha256-OIf59YUuu8ohpGXRdeiPaM/xdH4ZaQYoCuBG/NNhZcc=";
+  cargoHash = "sha256-EokHEduK+8h+JzIKRRga+QXLkfC4CK+qyoIxMwD2OPI=";

  nativeBuildInputs = [ installShellFiles ];

@@ -0,0 +1,3 @@
+#!@runtimeShell@
+
+exec @binJava@ -jar @out@/share/parser_deploy.jar "$@"
@@ -0,0 +1,77 @@
+{
+  stdenv,
+  lndir,
+  lib,
+}:
+
+args@{
+  bazel,
+  registry ? null,
+  bazelRepoCache ? null,
+  bazelVendorDeps ? null,
+  startupArgs ? [ ],
+  commandArgs ? [ ],
+  bazelPreBuild ? "",
+  bazelPostBuild ? "",
+  serverJavabase ? null,
+  targets,
+  command,
+  ...
+}:
+
+stdenv.mkDerivation (
+  {
+    preBuildPhases = [ "preBuildPhase" ];
+    preBuildPhase =
+      (lib.optionalString (bazelRepoCache != null) ''
+        # repo_cache needs to be writeable even in air-gapped builds
+        mkdir repo_cache
+        ${lndir}/bin/lndir -silent ${bazelRepoCache}/repo_cache repo_cache
+      '')
+
+      + (lib.optionalString (bazelVendorDeps != null) ''
+        mkdir vendor_dir
+        ${lndir}/bin/lndir -silent ${bazelVendorDeps}/vendor_dir vendor_dir
+
+        # pin all deps to avoid re-fetch attempts by Bazel
+        rm vendor_dir/VENDOR.bazel
+        find vendor_dir -mindepth 1 -maxdepth 1 -type d -printf "pin(\"@@%P\")\n" > vendor_dir/VENDOR.bazel
+      '')
+      # keep preBuildPhase always defined as it is listed in preBuildPhases
+      + ''
+        true
+      '';
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+
+      ${bazelPreBuild}
+
+      ${bazel}/bin/bazel ${
+        lib.escapeShellArgs (
+          lib.optional (serverJavabase != null) "--server_javabase=${serverJavabase}"
+          ++ [ "--batch" ]
+          ++ startupArgs
+        )
+      } ${command} ${
+        lib.escapeShellArgs (
+          lib.optional (registry != null) "--registry=file://${registry}"
+          ++ lib.optionals (bazelRepoCache != null) [
+            "--repository_cache=repo_cache"
+            "--repo_contents_cache="
+          ]
+          ++ lib.optional (bazelVendorDeps != null) "--vendor_dir=vendor_dir"
+          ++ commandArgs
+          ++ targets
+        )
+      }
+
+      ${bazelPostBuild}
+
+      runHook postBuild
+    '';
+
+  }
+  // args
+)
@@ -0,0 +1,172 @@
+{
+  callPackage,
+  gnugrep,
+  lib,
+  autoPatchelfHook,
+  stdenv,
+}:
+
+{
+  name,
+  src,
+  sourceRoot ? null,
+  version ? null,
+  targets,
+  bazel,
+  startupArgs ? [ ],
+  commandArgs ? [ ],
+  env ? { },
+  serverJavabase ? null,
+  registry ? null,
+  bazelRepoCacheFOD ? {
+    outputHash = null;
+    outputHashAlgo = "sha256";
+  },
+  bazelVendorDepsFOD ? {
+    outputHash = null;
+    outputHashAlgo = "sha256";
+  },
+  installPhase,
+  buildInputs ? [ ],
+  nativeBuildInputs ? [ ],
+  autoPatchelfIgnoreMissingDeps ? null,
+  patches ? [ ],
+}:
+let
+  # FOD produced by `bazel fetch`
+  # Repo cache contains content-addressed external Bazel dependencies without any patching
+  # Potentially this can be nixified via --experimental_repository_resolved_file
+  # (Note: file itself isn't reproducible because it has lots of extra info and order
+  #        isn't stable too. Parsing it into nix fetch* commands isn't trivial but might be possible)
+  bazelRepoCache =
+    if bazelRepoCacheFOD.outputHash == null then
+      null
+    else
+      (callPackage ./bazelDerivation.nix { } {
+        name = "bazelRepoCache";
+        inherit (bazelRepoCacheFOD) outputHash outputHashAlgo;
+        inherit
+          src
+          version
+          sourceRoot
+          env
+          buildInputs
+          nativeBuildInputs
+          patches
+          ;
+        inherit registry;
+        inherit
+          bazel
+          targets
+          startupArgs
+          serverJavabase
+          ;
+        command = "fetch";
+        outputHashMode = "recursive";
+        commandArgs = [
+          "--repository_cache=repo_cache"
+          "--repo_contents_cache="
+        ]
+        ++ commandArgs;
+        bazelPreBuild = ''
+          mkdir repo_cache
+        '';
+        installPhase = ''
+          mkdir -p $out/repo_cache
+          cp -r --reflink=auto repo_cache/* $out/repo_cache
+        '';
+      });
+  # Stage1: FOD produced by `bazel vendor`, Stage2: eventual patchelf or other tuning
+  # Vendor deps contains unpacked&patches external dependencies, this may need Nix-specific
+  # patching to address things like
+  # - broken symlinks
+  # - symlinks or other references to absolute nix store paths which isn't allowed for FOD
+  # - autoPatchelf for externally-fetched binaries
+  #
+  # Either repo cache or vendor deps should be enough to build a given package
+  bazelVendorDeps =
+    if bazelVendorDepsFOD.outputHash == null then
+      null
+    else
+      (
+        let
+          stage1 = callPackage ./bazelDerivation.nix { } {
+            name = "bazelVendorDepsStage1";
+            inherit (bazelVendorDepsFOD) outputHash outputHashAlgo;
+            inherit
+              src
+              version
+              sourceRoot
+              env
+              buildInputs
+              nativeBuildInputs
+              patches
+              ;
+            inherit registry;
+            inherit
+              bazel
+              targets
+              startupArgs
+              serverJavabase
+              ;
+            dontFixup = true;
+            command = "vendor";
+            outputHashMode = "recursive";
+            commandArgs = [ "--vendor_dir=vendor_dir" ] ++ commandArgs;
+            bazelPreBuild = ''
+              mkdir vendor_dir
+            '';
+            bazelPostBuild = ''
+              # remove symlinks that point to locations under bazel_src/
+              find vendor_dir -type l -lname "$HOME/*" -exec rm '{}' \;
+              # remove symlinks to temp build directory on darwin
+              find vendor_dir -type l -lname "/private/var/tmp/*" -exec rm '{}' \;
+              # remove broken symlinks
+              find vendor_dir -xtype l -exec rm '{}' \;
+
+              # remove .marker files referencing NIX_STORE as those references aren't allowed in FOD
+              (${gnugrep}/bin/grep -rI "$NIX_STORE/" vendor_dir --files-with-matches --include="*.marker" --null || true) \
+                | xargs -0 --no-run-if-empty rm
+            '';
+            installPhase = ''
+              mkdir -p $out/vendor_dir
+              cp -r --reflink=auto vendor_dir/* $out/vendor_dir
+            '';
+
+          };
+        in
+        stdenv.mkDerivation {
+          name = "bazelVendorDeps";
+          buildInputs = lib.optional (!stdenv.hostPlatform.isDarwin) autoPatchelfHook ++ buildInputs;
+          inherit autoPatchelfIgnoreMissingDeps;
+          src = stage1;
+          installPhase = ''
+            cp -r . $out
+          '';
+        }
+      );
+
+  package = callPackage ./bazelDerivation.nix { } {
+    inherit
+      name
+      src
+      version
+      sourceRoot
+      env
+      buildInputs
+      nativeBuildInputs
+      patches
+      ;
+    inherit registry bazelRepoCache bazelVendorDeps;
+    inherit
+      bazel
+      targets
+      startupArgs
+      serverJavabase
+      commandArgs
+      ;
+    inherit installPhase;
+    command = "build";
+  };
+in
+package // { passthru = { inherit bazelRepoCache bazelVendorDeps; }; }
@@ -0,0 +1,24 @@
+{
+  stdenv,
+}:
+{
+  # If there's a need to patch external dependencies managed by Bazel
+  # one option is to configure patches on Bazel level. Bazel doesn't
+  # allow patches to be in absolute paths so this helper will produce
+  # sources patch that adds given file to given location
+  addFilePatch =
+    {
+      path,
+      file,
+    }:
+    stdenv.mkDerivation {
+      name = "add_file.patch";
+      dontUnpack = true;
+      buildPhase = ''
+        mkdir -p $(dirname "${path}")
+        cp ${file} "${path}"
+        diff -u /dev/null "${path}" >result.patch || true  # diff exit code is non-zero if there's a diff
+      '';
+      installPhase = "cp result.patch $out";
+    };
+}
@@ -0,0 +1,41 @@
+{
+  lib,
+  makeBinaryWrapper,
+  writeShellApplication,
+  bash,
+  stdenv,
+}:
+{ defaultShellUtils }:
+let
+  defaultShellPath = lib.makeBinPath defaultShellUtils;
+
+  bashWithDefaultShellUtilsSh = writeShellApplication {
+    name = "bash";
+    runtimeInputs = defaultShellUtils;
+    # Empty PATH in Nixpkgs Bash is translated to /no-such-path
+    # On other distros empty PATH search fallback is looking in standard
+    # locations like /bin,/usr/bin
+    # For Bazel many rules rely on such search finding some common utils,
+    # so we provide them in case rules or arguments didn't specify a precise PATH
+    text = ''
+      if [[ "$PATH" == "/no-such-path" ]]; then
+        export PATH=${defaultShellPath}
+      fi
+      exec ${bash}/bin/bash "$@"
+    '';
+  };
+
+in
+{
+  inherit defaultShellUtils defaultShellPath;
+  # Script-based interpreters in shebangs aren't guaranteed to work,
+  # especially on MacOS. So let's produce a binary
+  bashWithDefaultShellUtils = stdenv.mkDerivation {
+    name = "bash";
+    src = bashWithDefaultShellUtilsSh;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    buildPhase = ''
+      makeWrapper ${bashWithDefaultShellUtilsSh}/bin/bash $out/bin/bash
+    '';
+  };
+}
@@ -0,0 +1,151 @@
+{
+  fetchFromGitHub,
+  lib,
+  bazel_9,
+  libgcc,
+  cctools,
+  stdenv,
+  jdk_headless,
+  callPackage,
+  zlib,
+  libxcrypt-legacy,
+}:
+let
+  bazelPackage = callPackage ./build-support/bazelPackage.nix { };
+  registry = fetchFromGitHub {
+    owner = "bazelbuild";
+    repo = "bazel-central-registry";
+    rev = "0e9e0cfdb88577300cc369d0cbe81e678d0fb271";
+    sha256 = "sha256-YAR0tYVUdITfW/2H/LZky88nyoWTsgZf/CX4BtJ/Mwk=";
+  };
+  src = fetchFromGitHub {
+    owner = "bazelbuild";
+    repo = "examples";
+    rev = "2a8db5804341036b393ff7e1ba88edb30c8a82c7";
+    sha256 = "sha256-/+rU73WPIKguoEOJDCodE3pUGSGju0VhixIcr0zBVmY=";
+  };
+  inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
+in
+{
+  java = bazelPackage {
+    inherit src registry;
+    sourceRoot = "source/java-tutorial";
+    name = "java-tutorial";
+    targets = [ "//:ProjectRunner" ];
+    bazel = bazel_9;
+    commandArgs = [
+      "--extra_toolchains=@@rules_java++toolchains+local_jdk//:all"
+      "--tool_java_runtime_version=local_jdk_21"
+    ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin "--spawn_strategy=local";
+    env = {
+      JAVA_HOME = jdk_headless.home;
+      USE_BAZEL_VERSION = bazel_9.version;
+    };
+    installPhase = ''
+      mkdir $out
+      cp bazel-bin/ProjectRunner.jar $out/
+    '';
+    buildInputs = [
+      libgcc
+      libxcrypt-legacy
+      stdenv.cc.cc.lib
+    ];
+    nativeBuildInputs = lib.optional (stdenv.hostPlatform.isDarwin) cctools;
+    patches = [
+      ./patches/examples/java-tutorial.patch
+      (addFilePatch {
+        path = "b/rules_cc.patch";
+        file = ./patches/examples/rules_cc.patch;
+      })
+    ];
+    bazelVendorDepsFOD = {
+      outputHash =
+        {
+          aarch64-darwin = "sha256-MRm+Pm5mDXys8erQLKHRSClFzxWIYU7Y/otKxl5sJQg=";
+          aarch64-linux = "sha256-cJuNZapJ8LvfPRdv5V9iuy0xxCxLFI5uWTLtAa6bE/w=";
+          x86_64-darwin = "sha256-fOLRQIiRq7BATULy7W90bQ/DrW3Fn7vLut6fKFSoQDA=";
+          x86_64-linux = "sha256-nSe0ywhsTJz6ycqTZaUKfnOvpJOmwip8hYXck9HtW2Q=";
+        }
+        .${stdenv.hostPlatform.system};
+      outputHashAlgo = "sha256";
+    };
+  };
+  cpp = bazelPackage {
+    inherit src registry;
+    sourceRoot = "source/cpp-tutorial/stage3";
+    name = "cpp-tutorial";
+    targets = [ "//main:hello-world" ];
+    bazel = bazel_9;
+    installPhase = ''
+      mkdir $out
+      cp bazel-bin/main/hello-world $out/
+    '';
+    nativeBuildInputs = lib.optional (stdenv.hostPlatform.isDarwin) cctools;
+    commandArgs = lib.optionals (stdenv.hostPlatform.isDarwin) [
+      "--host_cxxopt=-xc++"
+      "--cxxopt=-xc++"
+      "--spawn_strategy=local"
+    ];
+    env = {
+      USE_BAZEL_VERSION = bazel_9.version;
+    };
+    patches = [
+      ./patches/examples/cpp-tutorial.patch
+      (addFilePatch {
+        path = "b/rules_cc.patch";
+        file = ./patches/examples/rules_cc.patch;
+      })
+    ];
+    bazelRepoCacheFOD = {
+      outputHash =
+        {
+          aarch64-darwin = "sha256-Yk+Y3XxlmE48RCYqmSfeBtElCGlVVdJvqRtuIMWbxrk=";
+          aarch64-linux = "sha256-Yk+Y3XxlmE48RCYqmSfeBtElCGlVVdJvqRtuIMWbxrk=";
+          x86_64-darwin = "sha256-Yk+Y3XxlmE48RCYqmSfeBtElCGlVVdJvqRtuIMWbxrk=";
+          x86_64-linux = "sha256-Yk+Y3XxlmE48RCYqmSfeBtElCGlVVdJvqRtuIMWbxrk=";
+        }
+        .${stdenv.hostPlatform.system};
+      outputHashAlgo = "sha256";
+    };
+  };
+  rust = bazelPackage {
+    inherit src registry;
+    sourceRoot = "source/rust-examples/01-hello-world";
+    name = "rust-examples-01-hello-world";
+    targets = [ "//:bin" ];
+    bazel = bazel_9;
+    env = {
+      USE_BAZEL_VERSION = bazel_9.version;
+    };
+    installPhase = ''
+      mkdir $out
+      cp bazel-bin/bin $out/hello-world
+    '';
+    buildInputs = [
+      zlib
+      libgcc
+    ];
+    nativeBuildInputs = lib.optional (stdenv.hostPlatform.isDarwin) cctools;
+    commandArgs = lib.optional stdenv.hostPlatform.isDarwin "--spawn_strategy=local";
+    autoPatchelfIgnoreMissingDeps = [ "librustc_driver-*.so" ];
+    patches = [
+      ./patches/examples/rust-examples.patch
+      (addFilePatch {
+        path = "b/rules_cc.patch";
+        file = ./patches/examples/rules_cc.patch;
+      })
+    ];
+    bazelVendorDepsFOD = {
+      outputHash =
+        {
+          aarch64-darwin = "sha256-6rUV8UMjFZXA053BXIruK8+OEturmtz+YeAlkivePdA=";
+          aarch64-linux = "sha256-/mv7HVsx97RLzYl12WwsI2gYf0qBr+78B5NiEpTRyrc=";
+          x86_64-darwin = "sha256-BpQFhalV5AfYSjWQp+9lxOnfbaD/NADtvrNMqznEojM=";
+          x86_64-linux = "sha256-uutDUAHYecqDYmS90jZfZ8IrhSzpWB6WgcsZPlRJVaM=";
+        }
+        .${stdenv.hostPlatform.system};
+      outputHashAlgo = "sha256";
+    };
+  };
+}
@@ -0,0 +1,343 @@
+{
+  stdenv,
+  callPackage,
+  # nix tooling and utilities
+  darwin,
+  lib,
+  fetchzip,
+  makeWrapper,
+  replaceVars,
+  # native build inputs
+  runtimeShell,
+  zip,
+  unzip,
+  bash,
+  coreutils,
+  which,
+  gawk,
+  gnused,
+  gnutar,
+  gnugrep,
+  gzip,
+  findutils,
+  diffutils,
+  gnupatch,
+  file,
+  installShellFiles,
+  python3,
+  # Apple dependencies
+  cctools,
+  # Allow to independently override the jdks used to build and run respectively
+  jdk_headless,
+  version ? "9.0.1",
+}:
+
+let
+  inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+
+  defaultShellUtils =
+    # Keep this list conservative. For more exotic tools, prefer to use
+    # @rules_nixpkgs to pull in tools from the nix repository. Example:
+    #
+    # WORKSPACE:
+    #
+    #     nixpkgs_git_repository(
+    #         name = "nixpkgs",
+    #         revision = "def5124ec8367efdba95a99523dd06d918cb0ae8",
+    #     )
+    #
+    #     # This defines an external Bazel workspace.
+    #     nixpkgs_package(
+    #         name = "bison",
+    #         repositories = { "nixpkgs": "@nixpkgs//:default.nix" },
+    #     )
+    #
+    # some/BUILD.bazel:
+    #
+    #     genrule(
+    #        ...
+    #        cmd = "$(location @bison//:bin/bison) -other -args",
+    #        tools = [
+    #            ...
+    #            "@bison//:bin/bison",
+    #        ],
+    #     )
+    [
+      bash # see https://github.com/NixOS/nixpkgs/pull/489519
+      coreutils
+      diffutils
+      file
+      findutils
+      gawk
+      gnugrep
+      gnupatch
+      gnused
+      gnutar
+      gzip
+      python3 # see https://github.com/NixOS/nixpkgs/pull/489519
+      unzip
+      which
+      zip
+    ];
+  defaultShell = callPackage ./defaultShell.nix { } { inherit defaultShellUtils; };
+
+  bazelSystem = if isDarwin then "darwin" else "linux";
+
+  # on aarch64 Darwin, `uname -m` returns "arm64"
+  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
+
+  src = fetchzip {
+    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+    hash = "sha256-tdrSgtIXi8Xd03BgxLRWhw1bB1Zhuo0E2pWMCskBDG8=";
+    stripRoot = false;
+  };
+
+  commandArgs = [
+    "--nobuild_python_zip"
+    "--features=-module_maps"
+    "--host_features=-module_maps"
+    "--announce_rc"
+    "--verbose_failures"
+    "--curses=no"
+  ]
+  ++ lib.optionals isDarwin [
+    "--macos_sdk_version=${stdenv.hostPlatform.darwinMinVersion}"
+    "--action_env=NIX_CFLAGS_COMPILE_${stdenv.cc.suffixSalt}"
+  ];
+
+  extraCflags = lib.optionals isDarwin [
+    "-isystem ${lib.getDev darwin.libresolv}/include"
+    "-isystem ${lib.getDev stdenv.cc.libcxx}/include/c++/v1"
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "bazel";
+  inherit version src;
+
+  darwinPatches = [
+    # Bazel integrates with apple IOKit to inhibit and track system sleep.
+    # Inside the darwin sandbox, these API calls are blocked, and bazel
+    # crashes. It seems possible to allow these APIs inside the sandbox, but it
+    # feels simpler to patch bazel not to use it at all. So our bazel is
+    # incapable of preventing system sleep, which is a small price to pay to
+    # guarantee that it will always run in any nix context.
+    #
+    # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
+    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+    # sandbox.
+    #
+    # If you want to investigate the sandbox profile path,
+    # IORegisterForSystemPower can be allowed with
+    #
+    #     propagatedSandboxProfile = ''
+    #       (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
+    #     '';
+    #
+    # I do not know yet how to allow IOPMAssertion{CreateWithName,Release}
+    ./patches/darwin_sleep.patch
+
+    # Fix DARWIN_XCODE_LOCATOR_COMPILE_COMMAND by removing multi-arch support.
+    # Nixpkgs toolcahins do not support that (yet?) and get confused.
+    # Also add an explicit /usr/bin prefix that will be patched below.
+    (replaceVars ./patches/xcode.patch {
+      clangDarwin = "${stdenv.cc}/bin/clang";
+    })
+  ];
+
+  patches = lib.optionals isDarwin darwinPatches ++ [
+    # Revert preference for apple_support over rules_cc toolchain for now
+    # will need to figure out how to build with apple_support toolchain later
+    ./patches/apple_cc_toolchain.patch
+
+    ./patches/build_execlog_parser.patch
+
+    # --experimental_strict_action_env (which may one day become the default
+    # see bazelbuild/bazel#2574) hardcodes the default
+    # action environment to a non hermetic value (e.g. "/usr/local/bin").
+    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
+    # So we are replacing this bazel paths by defaultShellPath,
+    # improving hermeticity and making it work in nixos.
+    (replaceVars ./patches/strict_action_env.patch {
+      strictActionEnvPatch = defaultShell.defaultShellPath;
+    })
+
+    (replaceVars ./patches/default_bash.patch {
+      defaultBash = "${defaultShell.bashWithDefaultShellUtils}/bin/bash";
+    })
+
+    # Provide default JRE for Bazel process by setting --server_javabase=
+    # in a new default system bazelrc file
+    (replaceVars ./patches/bazel_rc.patch {
+      bazelSystemBazelRCPath = replaceVars ./system.bazelrc {
+        serverJavabase = jdk_headless;
+      };
+    })
+
+    # patch that propagates rules_* patches below
+    # patches need to be within source root and can't be absolute paths in Nix store
+    # so rules_* patches are injected via addFilePatch
+    ./patches/deps_patches.patch
+    (addFilePatch {
+      path = "b/third_party/rules_python.patch";
+      file = replaceVars ./patches/rules_python.patch {
+        usrBinEnv = "${coreutils}/bin/env";
+      };
+    })
+    (addFilePatch {
+      path = "b/third_party/rules_java.patch";
+      file = replaceVars ./patches/rules_java.patch {
+        defaultBash = "${defaultShell.bashWithDefaultShellUtils}/bin/bash";
+      };
+    })
+    (addFilePatch {
+      path = "b/third_party/rules_cc.patch";
+      file = replaceVars ./patches/rules_cc.patch {
+        defaultBash = "${defaultShell.bashWithDefaultShellUtils}/bin/bash";
+      };
+    })
+    (addFilePatch {
+      path = "b/third_party/grpc.patch";
+      file = ./patches/grpc.patch;
+    })
+
+    (replaceVars ./patches/md5sum.patch {
+      md5sum = "${coreutils}/bin/md5sum";
+    })
+
+    # Nix build sandbox can configure custom PATH but doesn't have
+    # /usr/bin/env which is unfortunate https://github.com/NixOS/nixpkgs/issues/6227
+    # and we need to do a silly patch
+    (replaceVars ./patches/usr_bin_env.patch {
+      usrBinEnv = "${coreutils}/bin/env";
+    })
+  ];
+
+  meta = {
+    homepage = "https://github.com/bazelbuild/bazel/";
+    description = "Build tool that builds code quickly and reliably";
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.bazel ];
+    mainProgram = "bazel";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    jdk_headless
+    python3
+    unzip
+    which
+
+    # Shell completion
+    installShellFiles
+    python3.pkgs.absl-py # Needed to build fish completion
+  ]
+  # Needed for execlog
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) stdenv.cc
+  ++ lib.optional (stdenv.hostPlatform.isDarwin) cctools.libtool;
+
+  buildPhase = ''
+    runHook preBuild
+    export HOME=$(mktemp -d)
+
+    # If EMBED_LABEL isn't set, it'd be auto-detected from CHANGELOG.md
+    # and `git rev-parse --short HEAD` which would result in
+    # "3.7.0- (@non-git)" due to non-git build and incomplete changelog.
+    # Actual bazel releases use scripts/release/common.sh which is based
+    # on branch/tag information which we don't have with tarball releases.
+    # Note that .bazelversion is always correct and is based on bazel-*
+    # executable name, version checks should work fine
+    export EMBED_LABEL="${version}- (@non-git)"
+
+    echo "Stage 1 - Running bazel bootstrap script"
+    # Note: can't use lib.escapeShellArgs here because it will escape arguments
+    #       with = using single quotes. This is fine for command invocations,
+    #       but for string variable they become literal single quote chars,
+    #       compile.sh will not unquote them either and command will be invalid.
+    export EXTRA_BAZEL_ARGS="${lib.strings.concatStringsSep " " commandArgs}"
+    export NIX_CFLAGS_COMPILE_${stdenv.cc.suffixSalt}="${lib.strings.concatStringsSep " " extraCflags}"
+
+
+    ${bash}/bin/bash ./compile.sh
+
+    # XXX: get rid of this, or move it to another stage.
+    # It is plain annoying when builds fail.
+    echo "Stage 2 - Generate bazel completions"
+    ${bash}/bin/bash ./scripts/generate_bash_completion.sh \
+        --bazel=./output/bazel \
+        --output=./output/bazel-complete.bash \
+        --prepend=./scripts/bazel-complete-header.bash \
+        --prepend=./scripts/bazel-complete-template.bash
+    ${python3}/bin/python3 ./scripts/generate_fish_completion.py \
+        --bazel=./output/bazel \
+        --output=./output/bazel-complete.fish
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Bazel binary contains zip archive, which contains text files and a jar
+    # both of which can have store references that might be obscured to Nix
+    # builder in packaged form, so we unpack and extract those references
+
+    # Note: grep isn't necessarily 100% accurate, other approaches could be
+    #       to disassemble Jar (slow) or hardcode known references
+    mkdir -p $out/nix-support
+    INSTALL_BASE=$(./output/bazel --batch info install_base)
+    find "$INSTALL_BASE" -type f -exec \
+       ${gnugrep}/bin/grep --text --only-matching --no-filename "$NIX_STORE/[^/]*" '{}' \; \
+    | sort -u >> $out/nix-support/depends
+
+    mkdir -p $out/bin
+
+    # official wrapper scripts that searches for $WORKSPACE_ROOT/tools/bazel if
+    # it can’t find something in tools, it calls
+    # $out/bin/bazel-{version}-{os_arch} The binary _must_ exist with this
+    # naming if your project contains a .bazelversion file.
+    cp ./scripts/packages/bazel.sh $out/bin/bazel
+    versioned_bazel="$out/bin/bazel-${version}-${bazelSystem}-${bazelArch}"
+    mv ./output/bazel "$versioned_bazel"
+    wrapProgram "$versioned_bazel" --suffix PATH : ${defaultShell.defaultShellPath}
+
+    mkdir $out/share
+    cp ./output/parser_deploy.jar $out/share/parser_deploy.jar
+    substitute ${./bazel-execlog.sh} $out/bin/bazel-execlog \
+      --subst-var out \
+      --subst-var-by runtimeShell ${runtimeShell} \
+      --subst-var-by binJava ${jdk_headless}/bin/java
+    chmod +x $out/bin/bazel-execlog
+
+    # shell completion files
+    installShellCompletion --bash \
+      --name bazel.bash \
+      ./output/bazel-complete.bash
+    installShellCompletion --zsh \
+      --name _bazel \
+      ./scripts/zsh_completion/_bazel
+    installShellCompletion --fish \
+      --name bazel.fish \
+      ./output/bazel-complete.fish
+  '';
+
+  postFixup =
+    # verify that bazel binary still works post-fixup
+    ''
+      USE_BAZEL_VERSION=${version} $out/bin/bazel --batch info release
+    '';
+
+  # Bazel binary includes zip archive at the end that `strip` would end up discarding
+  stripExclude = [ "bin/.bazel-${version}-*-wrapped" ];
+
+  passthru = {
+    tests = {
+      inherit (callPackage ./examples.nix { }) cpp java rust;
+    };
+  };
+}
@@ -0,0 +1,18 @@
+diff --git a/MODULE.bazel b/MODULE.bazel
+index 62c1c29d67..d845a0e98d 100644
+--- a/MODULE.bazel
+++ b/MODULE.bazel
+@@ -39,10 +39,10 @@ bazel_dep(name = "with_cfg.bzl", version = "0.13.0")
+ bazel_dep(name = "zlib", version = "1.3.1.bcr.7")
+ bazel_dep(name = "zstd-jni", version = "1.5.6-9")
+ 
+-# Depend on apple_support first and then rules_cc so that the Xcode toolchain
+-# from apple_support wins over the generic Unix toolchain from rules_cc.
+-bazel_dep(name = "apple_support", version = "1.24.5")
+# Depend on apple_support second after rules_cc so that the Xcode toolchain
+# from apple_support does not win over the generic Unix toolchain from rules_cc.
+ bazel_dep(name = "rules_cc", version = "0.2.17")
+bazel_dep(name = "apple_support", version = "1.24.5")
+ 
+ # The starlark rules in @rules_cc are hidden behind macros but docgen needs to
+ # load the rule class directly, so we need to expose the cc_compatibility_proxy
@@ -0,0 +1,13 @@
+diff --git a/src/main/cpp/option_processor.cc b/src/main/cpp/option_processor.cc
+index 8f8f15685f..a7ae52d1e4 100644
+--- a/src/main/cpp/option_processor.cc
+++ b/src/main/cpp/option_processor.cc
+@@ -56,7 +56,7 @@ OptionProcessor::OptionProcessor(
+     : workspace_layout_(workspace_layout),
+       startup_options_(std::move(default_startup_options)),
+       parse_options_called_(false),
+-      system_bazelrc_path_(BAZEL_SYSTEM_BAZELRC_PATH) {}
+      system_bazelrc_path_("@bazelSystemBazelRCPath@") {}
+ 
+ OptionProcessor::OptionProcessor(
+     const WorkspaceLayout* workspace_layout,
@@ -0,0 +1,28 @@
+diff --git a/compile.sh b/compile.sh
+index 4712355d48..feec286704 100755
+--- a/compile.sh
+++ b/compile.sh
+@@ -76,6 +76,13 @@ bazel_build "src:bazel_nojdk${EXE_EXT}" \
+   --host_platform=@platforms//host \
+   --platforms=@platforms//host \
+   || fail "Could not build Bazel"
+
+bazel_build src/tools/execlog:parser_deploy.jar \
+  --action_env=PATH \
+  --host_platform=@platforms//host \
+  --platforms=@platforms//host \
+  || fail "Could not build parser_deploy.jar"
+
+ bazel_bin_path="$(get_bazel_bin_path)/src/bazel_nojdk${EXE_EXT}"
+ [ -e "$bazel_bin_path" ] \
+   || fail "Could not find freshly built Bazel binary at '$bazel_bin_path'"
+@@ -84,5 +91,8 @@ cp -f "$bazel_bin_path" "output/bazel${EXE_EXT}" \
+ chmod 0755 "output/bazel${EXE_EXT}"
+ BAZEL="$(pwd)/output/bazel${EXE_EXT}"
+ 
+cp "$(get_bazel_bin_path)/src/tools/execlog/parser_deploy.jar" output/ \
+  || fail "Could not copy 'parser_deploy.jar' to 'output/"
+
+ clear_log
+ display "Build successful! Binary is here: ${BAZEL}"
+
@@ -0,0 +1,56 @@
+diff --git a/src/main/native/darwin/sleep_prevention_jni.cc b/src/main/native/darwin/sleep_prevention_jni.cc
+index 67c35b201e..e50a58320e 100644
+--- a/src/main/native/darwin/sleep_prevention_jni.cc
+++ b/src/main/native/darwin/sleep_prevention_jni.cc
+@@ -33,31 +33,13 @@ static int g_sleep_state_stack = 0;
+ static IOPMAssertionID g_sleep_state_assertion = kIOPMNullAssertionID;
+ 
+ int portable_push_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GE(g_sleep_state_stack, 0);
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_EQ(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    CFStringRef reasonForActivity = CFSTR("build.bazel");
+-    IOReturn success = IOPMAssertionCreateWithName(
+-        kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, reasonForActivity,
+-        &g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-  }
+-  g_sleep_state_stack += 1;
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ int portable_pop_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GT(g_sleep_state_stack, 0);
+-  g_sleep_state_stack -= 1;
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_NE(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    IOReturn success = IOPMAssertionRelease(g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-    g_sleep_state_assertion = kIOPMNullAssertionID;
+-  }
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ }  // namespace blaze_jni
+diff --git a/src/main/native/darwin/system_suspension_monitor_jni.cc b/src/main/native/darwin/system_suspension_monitor_jni.cc
+index 3483aa7935..51782986ec 100644
+--- a/src/main/native/darwin/system_suspension_monitor_jni.cc
+++ b/src/main/native/darwin/system_suspension_monitor_jni.cc
+@@ -83,10 +83,7 @@ void portable_start_suspend_monitoring() {
+     // Register to receive system sleep notifications.
+     // Testing needs to be done manually. Use the logging to verify
+     // that sleeps are being caught here.
+-    suspend_state.connect_port = IORegisterForSystemPower(
+-        &suspend_state, &notifyPortRef, SleepCallBack, &notifierObject);
+-    BAZEL_CHECK_NE(suspend_state.connect_port, MACH_PORT_NULL);
+-    IONotificationPortSetDispatchQueue(notifyPortRef, queue);
+    // XXX: Unreliable, disable for now
+ 
+     // Register to deal with SIGCONT.
+     // We register for SIGCONT because we can't catch SIGSTOP.
@@ -0,0 +1,22 @@
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+index a982b782e1..d49b047074 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+@@ -89,13 +89,13 @@ public class BazelRuleClassProvider {
+     public boolean useStrictActionEnv;
+   }
+ 
+-  private static final PathFragment FALLBACK_SHELL = PathFragment.create("/bin/bash");
+  private static final PathFragment FALLBACK_SHELL = PathFragment.create("@defaultBash@");
+ 
+   public static final ImmutableMap<OS, PathFragment> SHELL_EXECUTABLE =
+       ImmutableMap.<OS, PathFragment>builder()
+           .put(OS.WINDOWS, PathFragment.create("c:/msys64/usr/bin/bash.exe"))
+-          .put(OS.FREEBSD, PathFragment.create("/usr/local/bin/bash"))
+-          .put(OS.OPENBSD, PathFragment.create("/usr/local/bin/bash"))
+          .put(OS.FREEBSD, PathFragment.create("@defaultBash@"))
+          .put(OS.OPENBSD, PathFragment.create("@defaultBash@"))
+           .put(OS.UNKNOWN, FALLBACK_SHELL)
+           .buildOrThrow();
+ 
+
@@ -0,0 +1,47 @@
+diff --git a/MODULE.bazel b/MODULE.bazel
+index d845a0e98d..be0aa7bd7c 100644
+--- a/MODULE.bazel
+++ b/MODULE.bazel
+@@ -22,16 +22,30 @@ bazel_dep(name = "googleapis", version = "0.0.0-20250604-de157ca3")
+ bazel_dep(name = "googletest", version = "1.17.0.bcr.2", repo_name = "com_google_googletest")
+ bazel_dep(name = "grpc-java", version = "1.71.0")
+ bazel_dep(name = "grpc", version = "1.76.0.bcr.1", repo_name = "com_github_grpc_grpc")
+single_version_override(
+    module_name = "grpc",
+    patches = ["//third_party:grpc.patch"],
+    patch_strip = 1,
+)
+ bazel_dep(name = "platforms", version = "1.0.0")
+ bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")
+ bazel_dep(name = "re2", version = "2025-11-05.bcr.1")
+ bazel_dep(name = "rules_graalvm", version = "0.11.1")
+ bazel_dep(name = "rules_java", version = "9.0.3")
+single_version_override(
+    module_name = "rules_java",
+    patches = ["//third_party:rules_java.patch"],
+)
+ bazel_dep(name = "bazel_features", version = "1.42.1")
+ bazel_dep(name = "rules_jvm_external", version = "6.6")
+ bazel_dep(name = "rules_license", version = "1.0.0")
+ bazel_dep(name = "rules_pkg", version = "1.1.0")
+ bazel_dep(name = "rules_python", version = "1.7.0")
+single_version_override(
+    module_name = "rules_python",
+    patches = ["//third_party:rules_python.patch"],
+    patch_strip = 1,
+)
+ bazel_dep(name = "rules_shell", version = "0.6.1")
+ bazel_dep(name = "rules_testing", version = "0.9.0")
+ bazel_dep(name = "stardoc", version = "0.8.0", repo_name = "io_bazel_skydoc")
+@@ -42,6 +56,11 @@ bazel_dep(name = "zstd-jni", version = "1.5.6-9")
+ # Depend on apple_support second after rules_cc so that the Xcode toolchain
+ # from apple_support does not win over the generic Unix toolchain from rules_cc.
+ bazel_dep(name = "rules_cc", version = "0.2.17")
+single_version_override(
+    module_name = "rules_cc",
+    patches = ["//third_party:rules_cc.patch"],
+    patch_strip = 1,
+)
+ bazel_dep(name = "apple_support", version = "1.24.5")
+ 
+ # The starlark rules in @rules_cc are hidden behind macros but docgen needs to
@@ -0,0 +1,15 @@
+diff --git a/BUILD b/BUILD
+new file mode 100644
+index 0000000..e69de29
+diff --git a/MODULE.bazel b/MODULE.bazel
+index 4874ffc..f4e0d56 100644
+--- a/MODULE.bazel
+++ b/MODULE.bazel
+@@ -1 +1,6 @@
+ bazel_dep(name = "rules_cc", version = "0.0.17")
+single_version_override(
+    module_name = "rules_cc",
+    patches = [":rules_cc.patch"],
+    patch_strip = 1,
+)
+
@@ -0,0 +1,12 @@
+diff --git a/java-tutorial/MODULE.bazel b/java-tutorial/MODULE.bazel
+index 1496f64..d3df2d5 100644
+--- a/MODULE.bazel
+++ b/MODULE.bazel
+@@ -1 +1,7 @@
+ bazel_dep(name = "rules_java", version = "7.11.1")
+bazel_dep(name = "rules_cc", version = "0.2.13")
+single_version_override(
+    module_name = "rules_cc",
+    patches = [":rules_cc.patch"],
+    patch_strip = 1,
+)
@@ -0,0 +1,10 @@
+diff --git a/cc/private/toolchain/generate_system_module_map.sh b/cc/private/toolchain/generate_system_module_map.sh
+index 6bcbd85..b5e4f2c 100755
+--- a/cc/private/toolchain/generate_system_module_map.sh
+++ b/cc/private/toolchain/generate_system_module_map.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!/bin/bash
+ # Copyright 2020 The Bazel Authors. All rights reserved.
+ #
+ # Licensed under the Apache License, Version 2.0 (the "License");
@@ -0,0 +1,17 @@
+diff --git a/rust-examples/01-hello-world/MODULE.bazel b/rust-examples/01-hello-world/MODULE.bazel
+index 53f685c..9c1dccd 100644
+--- a/MODULE.bazel
+++ b/MODULE.bazel
+@@ -5,6 +5,12 @@ module(
+
+ # https://github.com/bazelbuild/rules_rust/releases
+ bazel_dep(name = "rules_rust", version = "0.65.0")
+bazel_dep(name = "rules_cc", version = "0.2.4")
+single_version_override(
+    module_name = "rules_cc",
+    patches = [":rules_cc.patch"],
+    patch_strip = 1,
+)
+
+ # Rust toolchain
+ RUST_EDITION = "2021"  # NOTE: 2024 edition will be released with Rust 1.85.0
@@ -0,0 +1,24 @@
+diff --git a/bazel/grpc_build_system.bzl b/bazel/grpc_build_system.bzl
+index 66d6368..8dd1b16 100644
+--- a/bazel/grpc_build_system.bzl
+++ b/bazel/grpc_build_system.bzl
+@@ -196,18 +196,11 @@ def grpc_proto_plugin(name, srcs = [], deps = []):
+         srcs = srcs,
+         deps = deps,
+     )
+-    universal_binary(
+-        name = name + "_universal",
+-        binary = name + "_native",
+-    )
+
+     # In order to avoid warnings from Bazel, names of the rule and its output file must differ.
+     native.genrule(
+         name = name,
+-        srcs = select({
+-            "@platforms//os:macos": [name + "_universal"],
+-            "//conditions:default": [name + "_native"],
+-        }),
+        srcs = [name + "_native"],
+         outs = [name + "_binary"],
+         cmd = "cp $< $@",
+         executable = True,
@@ -0,0 +1,30 @@
+diff --git a/src/md5_darwin_freebsd.sh b/src/md5_darwin_freebsd.sh
+index cd9c7687bc..2c5e71959a 100755
+--- a/src/md5_darwin_freebsd.sh
+++ b/src/md5_darwin_freebsd.sh
+@@ -14,4 +14,4 @@
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ #
+-/sbin/md5 "$@" | /sbin/md5 | head -c 32
+@md5sum@ "$@" | @md5sum@ | head -c 32
+diff --git a/src/md5_default.sh b/src/md5_default.sh
+index d5d4f0b8f4..2c5e71959a 100755
+--- a/src/md5_default.sh
+++ b/src/md5_default.sh
+@@ -14,4 +14,4 @@
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ #
+-md5sum "$@" | md5sum | head -c 32
+@md5sum@ "$@" | @md5sum@ | head -c 32
+diff --git a/src/md5_openbsd.sh b/src/md5_openbsd.sh
+index 6c85df1899..67c3bd9fed 100755
+--- a/src/md5_openbsd.sh
+++ b/src/md5_openbsd.sh
+@@ -16,4 +16,4 @@
+ #
+ # We avoid using the `head` tool's `-c` option, since it does not exist
+ # on OpenBSD.
+-/bin/md5 "$@" | /bin/md5 | dd bs=32 count=1
+@md5sum@ "$@" | @md5sum@ | dd bs=32 count=1
@@ -0,0 +1,11 @@
+diff --git a/cc/private/toolchain/generate_system_module_map.sh b/cc/private/toolchain/generate_system_module_map.sh
+index 6bcbd85..b5e4f2c 100755
+--- a/cc/private/toolchain/generate_system_module_map.sh
+++ b/cc/private/toolchain/generate_system_module_map.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@defaultBash@
+ # Copyright 2020 The Bazel Authors. All rights reserved.
+ #
+ # Licensed under the Apache License, Version 2.0 (the "License");
+
@@ -0,0 +1,11 @@
+diff --git java/bazel/rules/java_stub_template.txt java/bazel/rules/java_stub_template.txt
+index 115b46e..56d2ff7 100644
+--- java/bazel/rules/java_stub_template.txt
+++ java/bazel/rules/java_stub_template.txt
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@defaultBash@
+ # Copyright 2014 The Bazel Authors. All rights reserved.
+ #
+ # Licensed under the Apache License, Version 2.0 (the "License");
+
@@ -0,0 +1,13 @@
+diff --git a/python/private/runtime_env_toolchain.bzl b/python/private/runtime_env_toolchain.bzl
+index de749007..72d14499 100644
+--- a/python/private/runtime_env_toolchain.bzl
+++ b/python/private/runtime_env_toolchain.bzl
+@@ -48,7 +48,7 @@ def define_runtime_env_toolchain(name):
+         name = "_runtime_env_py3_runtime",
+         interpreter = "//python/private:runtime_env_toolchain_interpreter.sh",
+         python_version = "PY3",
+-        stub_shebang = "#!/usr/bin/env python3",
+        stub_shebang = "#!@usrBinEnv@ python3",
+         visibility = ["//visibility:private"],
+         tags = ["manual"],
+         supports_build_time_venv = supports_build_time_venv,
@@ -0,0 +1,13 @@
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+index a70b5559bc..10bdffe961 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/BazelRuleClassProvider.java
+@@ -466,7 +466,7 @@ public class BazelRuleClassProvider {
+       // Note that --action_env does not propagate to the host config, so it is not a viable
+       // workaround when a genrule is itself built in the host config (e.g. nested genrules). See
+       // #8536.
+-      return "/bin:/usr/bin:/usr/local/bin";
+      return "@strictActionEnvPatch@";
+     }
+
+     String newPath = "";
@@ -0,0 +1,76 @@
+diff --git a/src/zip_builtins.sh b/src/zip_builtins.sh
+index d78ca5526a..c7d8f251cc 100755
+--- a/src/zip_builtins.sh
+++ b/src/zip_builtins.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+
+ # Copyright 2020 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/zip_files.sh b/src/zip_files.sh
+index 1422a6c659..4b1c221784 100755
+--- a/src/zip_files.sh
+++ b/src/zip_files.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+
+ # Copyright 2019 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/package-bazel.sh b/src/package-bazel.sh
+index 56e94db400..65fef20988 100755
+--- a/src/package-bazel.sh
+++ b/src/package-bazel.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+ #
+ # Copyright 2015 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/main/cpp/generate_jvm_module_options.sh b/src/main/cpp/generate_jvm_module_options.sh
+index dbed0e7576..421c432d3e 100755
+--- a/src/main/cpp/generate_jvm_module_options.sh
+++ b/src/main/cpp/generate_jvm_module_options.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
+#!@usrBinEnv@ bash
+ #
+ # Copyright 2025 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/md5_darwin_freebsd.sh b/src/md5_darwin_freebsd.sh
+index 2c5e71959a..a77a0cebd3 100755
+--- a/src/md5_darwin_freebsd.sh
+++ b/src/md5_darwin_freebsd.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+ #
+ # Copyright 2025 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/md5_default.sh b/src/md5_default.sh
+index 2c5e71959a..a77a0cebd3 100755
+--- a/src/md5_default.sh
+++ b/src/md5_default.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+ #
+ # Copyright 2025 The Bazel Authors. All rights reserved.
+ #
+
+diff --git a/src/md5_openbsd.sh b/src/md5_openbsd.sh
+index 67c3bd9fed..17dca32477 100755
+--- a/src/md5_openbsd.sh
+++ b/src/md5_openbsd.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
+#!@usrBinEnv@ bash
+ #
+ # Copyright 2025 The Bazel Authors. All rights reserved.
+ #
@@ -0,0 +1,27 @@
+diff --git a/scripts/bootstrap/compile.sh b/scripts/bootstrap/compile.sh
+index 1bad14cba7..d312fe08bb 100755
+--- a/scripts/bootstrap/compile.sh
+++ b/scripts/bootstrap/compile.sh
+@@ -402,7 +402,7 @@ cp $OUTPUT_DIR/libblaze.jar ${ARCHIVE_DIR}
+ # TODO(b/28965185): Remove when xcode-locator is no longer required in embedded_binaries.
+ log "Compiling xcode-locator..."
+ if [[ $PLATFORM == "darwin" ]]; then
+-  run /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices -framework Foundation -o ${ARCHIVE_DIR}/xcode-locator tools/osx/xcode_locator.m
+  run @clangDarwin@ -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices -framework Foundation -o ${ARCHIVE_DIR}/xcode-locator tools/osx/xcode_locator.m
+ else
+   cp tools/osx/xcode_locator_stub.sh ${ARCHIVE_DIR}/xcode-locator
+ fi
+diff --git a/tools/osx/BUILD b/tools/osx/BUILD
+index 5b99589ad4..3d3269772b 100644
+--- a/tools/osx/BUILD
+++ b/tools/osx/BUILD
+@@ -27,7 +27,7 @@ exports_files([
+ ])
+ 
+ DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
+-  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
+  @clangDarwin@ -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
+       -framework Foundation -arch arm64 -arch x86_64 -o $@ $<
+ """
+ 
+
@@ -0,0 +1,4 @@
+startup --server_javabase=@serverJavabase@
+
+# load default location for the system wide configuration
+try-import /etc/bazel.bazelrc
@@ -8,17 +8,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "berkeley_upc";
-  version = "2020.12.0";
+  version = "2022.10.0";

  src = fetchurl {
    url = "https://upc.lbl.gov/download/release/berkeley_upc-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JdpFORlXHpCQE+TivoQQnjQlxQN7C8BNfHvTOSwXbYQ=";
+    hash = "sha256-ZckvdxDixr06BTzJ0ErEdtmR4G05llIUsVgLEUR65LU=";
  };

  postPatch = ''
    patchShebangs .
  '';

+  # gcc 15
+  env.NIX_CFLAGS_COMPILE = "-Wno-incompatible-pointer-types";
+
  # Used during the configure phase
  env.ENVCMD = "${coreutils}/bin/env";

@@ -35,8 +35,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
  env = {
    # requires features: sync_unsafe_cell, unbounded_shifts, let_chains, ip
    RUSTC_BOOTSTRAP = 1;
-    RUSTFLAGS = "--cfg tokio_unstable -A stable_features";
-    NIX_CFLAGS_COMPILE = "-Wno-error";
  };

  buildFeatures = [ "plus" ];
@@ -26,19 +26,19 @@
 }:

 let
-  version = "2026.1.150.0";
+  version = "2026.3.846.0";
  sources = rec {
    x86_64-linux = fetchurl {
      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_amd64.deb";
-      hash = "sha256-LjiOR0biyxkYIn+E2jh4bePd7Yg/6qOtT7W+EKcLwwo=";
+      hash = "sha256-1SKTK0QW+3CcqBLqHbIsPny/6ekyjZe9qRcjYOMnR58=";
    };
    aarch64-linux = fetchurl {
      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_arm64.deb";
-      hash = "sha256-HnuRQtSv176ZaIOswd9f0gwfo6BguKXgszzxwizDCig=";
+      hash = "sha256-0zYsyZbX8qq/P+GHW4UHSTy2OsDa4fJAVjHcRbpHtSc=";
    };
    aarch64-darwin = fetchurl {
      url = "https://downloads.cloudflareclient.com/v1/download/macos/version/${version}";
-      hash = "sha256-pBpkvnzsg7ZdHcmD4Lp75Ag65nypRlmdn22+qzub6t4=";
+      hash = "sha256-cDmoM0nIYYQyurJeeiVSX0IWJdIY0pVLmjIae5mEXI4=";
    };
    x86_64-darwin = aarch64-darwin;
  };
@@ -0,0 +1,10 @@
+--- a/Common/CaretRgb.h
+++ b/Common/CaretRgb.h
+@@ -23,6 +23,7 @@
+ 
+ 
+ #include <array>
+#include <cstdint>
+ #include <memory>
+ 
+ namespace caret {
@@ -22,6 +22,11 @@ stdenv.mkDerivation (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/src";

+  patches = [
+    # GCC 15 compatibility: add missing #include <cstdint>
+    ./gcc15-cstdint.patch
+  ];
+
  postPatch = ''
    substituteInPlace kloewe/{cpuinfo,dot}/CMakeLists.txt --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
  ''
@@ -9,13 +9,13 @@

 stdenv.mkDerivation {
  pname = "cpp-ipfs-http-client";
-  version = "unstable-2022-01-30";
+  version = "0-unstable-2023-06-04";

  src = fetchFromGitHub {
    owner = "vasild";
    repo = "cpp-ipfs-http-client";
-    rev = "3cdfa7fc6326e49fc81b3c7ca43ce83bdccef6d9";
-    sha256 = "sha256-/oyafnk4SbrvoCh90wkZXNBjknMKA6EEUoEGo/amLUo=";
+    rev = "29a103af79ad62ef42180f54f6cd2128b4128836";
+    hash = "sha256-B57W4OqNU0M4yYxbHIZb2TyHfMaihCOD1KdvPrm6xLE=";
  };

  patches = [ ./unvendor-nlohmann-json.patch ];
@@ -1,7 +1,9 @@
 {
  lib,
+  stdenv,
  buildGo126Module,
  fetchFromGitHub,
+  installShellFiles,
  nix-update-script,
  writableTmpDirAsHomeHook,
  versionCheckHook,
@@ -25,6 +27,10 @@ buildGo126Module (finalAttrs: {
    "-X=github.com/charmbracelet/crush/internal/version.Version=${finalAttrs.version}"
  ];

+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
  checkFlags =
    let
      # these tests fail in the sandbox
@@ -44,6 +50,13 @@ buildGo126Module (finalAttrs: {
  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd crush \
+      --bash <($out/bin/crush completion bash) \
+      --fish <($out/bin/crush completion fish) \
+      --zsh <($out/bin/crush completion zsh)
+  '';
+
  updateScript = nix-update-script { };

  meta = {
@@ -24,16 +24,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dash-mpd-cli";
-  version = "0.2.31";
+  version = "0.2.32";

  src = fetchFromGitHub {
    owner = "emarsden";
    repo = "dash-mpd-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4Jh1AAYOrOqaJV4d5laTtN9AQ061rTeEcCt+8QFtcmM=";
+    hash = "sha256-kqOzJZR2eoua8ruGcwNHdQHXg58xIkH8wlx1sEwzqtA=";
  };

-  cargoHash = "sha256-GiGrWjwEshktAVTTXJ4lBRSUpywNlIMocd6EfL8ferY=";
+  cargoHash = "sha256-NHsEfqnJOyy5F3ALFKVB0by7xe4N/sVEBH0k8fO+cjI=";

  nativeBuildInputs = [
    makeWrapper
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "files-cli";
-  version = "2.15.241";
+  version = "2.15.257";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-bhRsRZFfbBs6RLmh5FWVNv3UdD60Bd6xEOcCgpS+GMk=";
+    hash = "sha256-Ym9rmgs5TO24+rgtNyCD+r7Spxo5y0WK+ly3AVLwj2g=";
  };

-  vendorHash = "sha256-PTEE+qtNf6ZFTW4CY7zGT5D2G+kXIk4aWNSR37F5TE0=";
+  vendorHash = "sha256-iOAyeIA0eyE9sPoR2EM7477WcIH5GkPdCKs14oL52uE=";

  ldflags = [
    "-s"
@@ -13,6 +13,11 @@ stdenv.mkDerivation {
    sha256 = "0zqhys0j9gabrd12mnk8ibblpc8dal4kbl8vnhxmdlplsdpwn4wg";
  };

+  postPatch = ''
+    substituteInPlace source/style.h \
+      --replace-fail "typedef unsigned        bool   ; /* Unsigned, [0,1].                          */" ""
+  '';
+
  buildPhase = ''
    cd source
    ${stdenv.cc}/bin/cc -D__linux__ -o fw *.c
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fzf-make";
-  version = "0.67.0";
+  version = "0.68.0";

  src = fetchFromGitHub {
    owner = "kyu08";
    repo = "fzf-make";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ciUixT+ELBL90rPe1wUyp41ZL2a6YhEDY+n66cOB1xk=";
+    hash = "sha256-6lnu+wIRfd2DwCjPe5nng/6qZx/H9YBj3jItSREY+fI=";
  };

-  cargoHash = "sha256-pVkoxMYcPUjzpN3nbyECtLS8wXo78P1ybOdl3P05Zkc=";
+  cargoHash = "sha256-geAaKOD1FbRasb648fBmrkxMMwd1OnNzjg23lgjpY+0=";

  nativeBuildInputs = [ makeBinaryWrapper ];

@@ -26,6 +26,12 @@ stdenv.mkDerivation (finalAttrs: {

  hardeningDisable = [ "format" ];

+  postPatch = ''
+    # gcc15
+    substituteInPlace bdfgrab.c --replace-fail 'int (*old_error_handler)();' 'XErrorHandler old_error_handler;'
+    substituteInPlace hbf.c --replace-fail 'typedef	int	bool;' '// typedef	int	bool;'
+  '';
+
  meta = {
    description = "Bitmap Font Editor";
    longDescription = ''
@@ -15,18 +15,18 @@

 buildNpmPackage (finalAttrs: {
  pname = "gemini-cli";
-  version = "0.35.3";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "google-gemini";
    repo = "gemini-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tAv34dHEf9uK6A/d+zkYYB7FVPviRnjYrP5E23b9OXw=";
+    hash = "sha256-eSGznx64xN/2/TPkLTx57Ar56FogYSzUkINBduhMn/8=";
  };

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-gJJ2UD6m5vwUwYoYU8L4bjefrTX9CMWRYz4YTHi6Q/M=";
+  npmDepsHash = "sha256-ztpKe7kgQAgfCBiIBlzPDa5muOI+9kESwrzBLqwz3V0=";

  dontPatchElf = stdenv.isDarwin;

@@ -117,6 +117,7 @@ buildNpmPackage (finalAttrs: {
      xiaoxiangmoe
      FlameFlag
      taranarmo
+      caverav
    ];
    platforms = lib.platforms.all;
    mainProgram = "gemini";
@@ -2,35 +2,33 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
-  stdenv,
+  versionCheckHook,
 }:

 # note: upstream has a flake
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ghgrab";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "abhixdd";
    repo = "ghgrab";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eXyLIrXsMV1p6xicKA5QNRPc4pkBdVM+fovOSaJT9/8=";
+    hash = "sha256-Ea5JdOKu4LBD77Nlj9gmISb6GPDhOZc3XCrRj2X/cB0=";
  };

-  cargoHash = "sha256-mYOl2yI6D6c7Xs8ABFnRazyQZYQJCElXqvqQUET0zEc=";
+  cargoHash = "sha256-S1wkdPYVvH+4rfCQ/IohrqvHsiVWlb9OW5Dva3jNeis=";

-  # fails on darwin
-  # https://github.com/abhixdd/ghgrab/issues/31
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "--skip=agent_tree_invalid_url_returns_json_error"
-  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];

  meta = {
    changelog = "https://github.com/abhixdd/ghgrab/releases/tag/v${finalAttrs.version}";
    description = "Simple, pretty terminal tool that lets you search and download files from GitHub without leaving your CLI";
    homepage = "https://github.com/abhixdd/ghgrab";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ phanirithvij ];
    mainProgram = "ghgrab";
+    maintainers = with lib.maintainers; [ phanirithvij ];
  };
 })
@@ -16,7 +16,7 @@
  mpv-unwrapped,
 }:
 let
-  version = "0.3.21";
+  version = "0.3.22";
  url_base = "https://github.com/alexmercerind2/harmonoid-releases/releases/download/v${version}";
  url =
    rec {
@@ -29,9 +29,9 @@ let
      or (throw "${stdenv.hostPlatform.system} is an unsupported platform");
  hash =
    rec {
-      x86_64-linux = "sha256-RZDRb/afXbalNbLBGaQgx5Qd4UEbNrvIsa3h+e6osJE=";
-      aarch64-linux = "sha256-1ys7uyCjXe4IBeXRk8mFjqmP9OottNefQrrtTkxq/qU=";
-      x86_64-darwin = "sha256-mo7Rj6c89KZrsL29i99x4E7b6soWlGUsC6KpSB7y5iY=";
+      x86_64-linux = "sha256-+fEx30uu0rZiORrtE00xG2piJzpFbfxSZw3OjrhLJyg=";
+      aarch64-linux = "sha256-jXN5i+LudsODNZUzb5SXClqgQxYzanrbZCqB8X0pJRQ=";
+      x86_64-darwin = "sha256-YYMKrb7ZilfEztL2JTxSdeoDd8xQMrHFtN9N9fmsm3w=";
      aarch64-darwin = x86_64-darwin;
    }
    .${stdenv.hostPlatform.system};
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
    inherit url hash;
  };

+  passthru.updateScript = ./update.sh;
+
  nativeBuildInputs = [
    makeWrapper
  ]
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl pcre2 jq common-updater-scripts
+
+set -eu -o pipefail
+
+release_data=$(curl https://api.github.com/repos/alexmercerind2/harmonoid-releases/releases/latest)
+version=$(jq -r '.tag_name[1:]' <<< "$release_data")
+
+linux64_hash=$(jq '.assets[] as $item | if $item.name == "harmonoid-linux-x86_64.tar.gz" then $item.digest[7:] else empty end' -r <<< "$release_data")
+linux64_hash=$(nix-hash --to-sri --type sha256 "$linux64_hash")
+
+linux_aarch_hash=$(jq '.assets[] as $item | if $item.name == "harmonoid-linux-aarch64.tar.gz" then $item.digest[7:] else empty end' -r <<< "$release_data")
+linux_aarch_hash=$(nix-hash --to-sri --type sha256 "$linux_aarch_hash")
+
+macos_hash=$(jq '.assets[] as $item | if $item.name == "harmonoid-macos-universal.dmg" then $item.digest[7:] else empty end' -r <<< "$release_data")
+macos_hash=$(nix-hash --to-sri --type sha256 "$macos_hash")
+
+update-source-version harmonoid "$version" "$linux64_hash" --system=x86_64-linux --ignore-same-version
+update-source-version harmonoid "$version" "$linux_aarch_hash" --system=aarch64-linux --ignore-same-version
+update-source-version harmonoid "$version" "$macos_hash" --system=x86_64-darwin --ignore-same-version
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "helix-db";
-  version = "2.3.3";
+  version = "2.3.4";

  src = fetchFromGitHub {
    repo = "helix-db";
    owner = "HelixDB";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Qr6rrZx9wXQm4l7HqmGz3PXRJHuV3lUZMcGMH+sOPDY=";
+    hash = "sha256-2dhCTMCgB7vbGa3URbPGJTPJQXcAUQjlTshemZqWH8E=";
  };

-  cargoHash = "sha256-nx4jq+2EChhtUEwCgZeqPIDidfRFZ0i0DZhkLVKapDo=";
+  cargoHash = "sha256-Nx30s7530W7JDizLKAHxf1aoe78QApNBJL97vO0FDZA=";

  patches = [
    #There are no feature yet
@@ -24,6 +24,11 @@ stdenv.mkDerivation (finalAttrs: {

  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-narrowing" ];

+  configureFlags = [
+    # Fails to build on -std=gnu23.
+    "CFLAGS=-std=gnu17"
+  ];
+
  meta = {
    description = "File editor/viewer/analyzer for executables";
    homepage = "https://hte.sourceforge.net";
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "k6";
-  version = "1.6.1";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "k6";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-pKkLrvqOz5d6iRCv3Ln31vhTBi0XWG1nSkIQ8xrK468=";
+    hash = "sha256-vULff8EVWns2N7QRK/dt90Jq10W3UFGXcIe3IXqJ+yA=";
  };

  subPackages = [ "./" ];
@@ -23,16 +23,19 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ autoreconfHook ];

-  env = lib.optionalAttrs (stdenv.hostPlatform.is32bit || stdenv.hostPlatform.isDarwin) {
-    NIX_CFLAGS_COMPILE = toString [
-      # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
-      "-Wno-error=format"
-      # multithreading.c:257:16: error: 'sem_init' is deprecated [-Werror,-Wdeprecated-declarations]
-      "-Wno-error=deprecated-declarations"
-      # scsi-lowlevel.c:1244:11: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'uint16_t *' (aka 'unsigned short *') increases required alignment from 1 to 2 [-Werror,-Wcast-align]
-      "-Wno-error=cast-align"
-    ];
-  };
+  env =
+    lib.optionalAttrs
+      (stdenv.hostPlatform.is32bit || stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isRiscV)
+      {
+        NIX_CFLAGS_COMPILE = toString [
+          # iscsi-discard.c:223:57: error: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]
+          "-Wno-error=format"
+          # multithreading.c:257:16: error: 'sem_init' is deprecated [-Werror,-Wdeprecated-declarations]
+          "-Wno-error=deprecated-declarations"
+          # scsi-lowlevel.c:1244:11: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'uint16_t *' (aka 'unsigned short *') increases required alignment from 1 to 2 [-Werror,-Wcast-align]
+          "-Wno-error=cast-align"
+        ];
+      };

  meta = {
    description = "iSCSI client library and utilities";
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "11.1.0";
+  version = "11.2.1";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-70WFRCtc3h/Asy5ZZooW3Sg/lngPF4Nk4oPm/q/phGA=";
+    hash = "sha256-HQq4hrjuITQY9ia1z4pKid81+WfX9CGUUSQUfvBPPgE=";
  };

  enableParallelBuilding = true;
@@ -78,7 +78,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "8664";
+  version = "8667";

  outputs = [
    "out"
@@ -89,7 +89,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-JTQg8A+8S7O/GSnRTDmvQuwDSuss+ydv6JDrNxWNeK8=";
+    hash = "sha256-bDI7a7OMCbuZyaJX4o22fmQIyrGdzYkoIeVvxBYlnRI=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -6,12 +6,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "12.60";
+  version = "12.62";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-vlxXAyo0dMwkyr7SE/JWgUr0ANDhWCm4zg2i/p+GlSc=";
+    hash = "sha256-YUY/VATJ+2bCKEdNfdvf+TQXHD7UWjd++CSZ5ut6Bs4=";
    stripRoot = false;
  };

@@ -1,19 +1,23 @@
 {
  lib,
+  copyDesktopItems,
  fetchFromGitHub,
+  gcc-arm-embedded,
+  makeDesktopItem,
  python3Packages,
+  udevCheckHook,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "mtkclient";
-  version = "2.1.2";
+  version = "2.1.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bkerler";
    repo = "mtkclient";
    rev = "v${version}";
-    hash = "sha256-mbfuOYJvwHfDvjTtAgMBLi7REIRRcJ9bhkY5oVjxCAM=";
+    hash = "sha256-8Y9tyw+dmhhc4tFo3slr4wQIPXIrmIk/wuCK4aM6oLY=";
  };

  build-system = [ python3Packages.hatchling ];
@@ -29,10 +33,38 @@ python3Packages.buildPythonApplication rec {
    shiboken6
  ];

+  nativeBuildInputs = [
+    udevCheckHook
+    copyDesktopItems
+
+    # Dependencies for stage1 kamakiri payloads
+    gcc-arm-embedded
+  ];
+
  pythonImportsCheck = [ "mtkclient" ];

-  # Note: No need to install mtkclient udev rules, 50-android.rules is covered by
+  # Build on-device payloads from source before assembling into a python package.
+  preBuild = ''
+    make -C src/stage1
+  '';
+
+  # Note: No need to install other mtkclient udev rules, 50-android.rules is covered by
  #       systemd 258 or newer and 51-edl.rules only applies to Qualcomm (i.e. not MTK).
+  postInstall = ''
+    install -Dm444 Setup/Linux/52-mtk.rules -t $out/lib/udev/rules.d
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "mtkclient";
+      desktopName = "MTKClient";
+      comment = "Mediatek Flash and Repair Utility";
+      exec = "mtk_gui";
+      categories = [
+        "Development"
+      ];
+    })
+  ];

  meta = {
    description = "MTK reverse engineering and flash tool";
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "23.0.1";
+  version = "25.0.1";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-X5Pyh5QqVbH+4z1hf+u/JmN4lVKcW1RYu+rtDd5ec3w=";
+    sha256 = "sha256-qi+VzDe91yEQzNEcUSuhcuxF76FmBsVkmb5LCB+yjP0=";
  };

  nativeBuildInputs = [
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "nominatim";
-  version = "5.2.0";
+  version = "5.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "osm-search";
    repo = "Nominatim";
    tag = "v${version}";
-    hash = "sha256-ao4oEPz5rtRQtPC2UcIHH1M+o914JraASf+hcB2SDKA=";
+    hash = "sha256-cICDzsEJ2yRi8PaQpjfVC9ZI3KeQPiqGu4U1nTxxBvk=";
  };

  postPatch = ''
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

+  # boolean type guards in olsr_types.h are incompatible with C23
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  buildInputs = [
    bison
    flex
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    pnpm = pnpm_9;
    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
    fetcherVersion = 3;
-    hash = "sha256-AAAzo//YG5X2531C3vEhsLHRYJilRcomT5uTBSmzNmQ=";
+    hash = "sha256-b7GGb9+7gpaTAjUmnvBoVFNgE6a1EhpEdNBHOfMMJa4=";
  };

  nativeBuildInputs = [
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "opencloud";
-  version = "5.2.0";
+  version = "6.0.0";

  src = fetchFromGitHub {
    owner = "opencloud-eu";
    repo = "opencloud";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lycqekiYAkNABl8144W8ZdUjAruc5OKp6c3FUSrLvOw=";
+    hash = "sha256-PWXO4lrNWHr9Yqexv4lTzAvLwnabRv4oP/CAjpdTezg=";
  };

  postPatch = ''
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencloud-web";
-  version = "6.0.0";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "opencloud-eu";
    repo = "web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eHu12DcP2LFJaRBX6WEieucS0HkSi231ZtUSZlunCuo=";
+    hash = "sha256-vUDkE1rF30r6guuQIb2XLnaq+1NsyjS5L319AfCzJvA=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-YOu0a/mR4PiRQx03BkPQbZgGQzgqXHy9DDihm8aD3wc=";
+    hash = "sha256-uaQTWytTHsQP19IHUIXccGkx8StIjMZ3MgepRydeims=";
  };

  nativeBuildInputs = [
@@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openimageio";
-  version = "3.1.11.0";
+  version = "3.1.12.0";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "OpenImageIO";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7VP/XSYti8YbFQwofAXAolsHc0rEHw14oqN0359LYJg=";
+    hash = "sha256-+5X2gR2WE6rO1OkhlTe0ptfCEKRxJVjw8v73lMTzURc=";
  };

  outputs = [
@@ -1,7 +1,15 @@
 {
  lib,
-  rustPlatform,
+  stdenv,
  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs_24,
+  nodejs-slim,
+  rustPlatform,
+  cargo,
+  rustc,
  cmake,
  makeBinaryWrapper,
  nix-update-script,
@@ -10,7 +18,10 @@
  versionCheckHook,
 }:

-rustPlatform.buildRustPackage (finalAttrs: {
+# Build with pnpm instead of buildRustPackage because the upstream npm CLI is the
+# JS-plugin-capable runtime. The standalone Rust `oxlint` binary intentionally
+# runs without an external linter, which leaves `jsPlugins` configs inert.
+stdenv.mkDerivation (finalAttrs: {
  pname = "oxlint";
  version = "1.58.0";

@@ -21,31 +32,145 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-FqKqLO31ej9NgBdcCjzVkgjlfMHV6RZMcHbdBVVwhHs=";
  };

-  cargoHash = "sha256-OpMGS5+pTPZvfY2EMxQMTWrCHhnxUQb9kQC/pLvrZSY=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-OpMGS5+pTPZvfY2EMxQMTWrCHhnxUQb9kQC/pLvrZSY=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+    hash = "sha256-cYlY8UHd9yWWJkktycfhbvg/7N2rY9h/jYA+QQ20rK0=";
+  };
+
+  dontUseCmakeConfigure = true;

  nativeBuildInputs = [
+    cargo
    cmake
    makeBinaryWrapper
+    nodejs_24
+    pnpmConfigHook
+    pnpm_10
+    rustPlatform.cargoSetupHook
+    rustc
  ];
-  buildInputs = [
-    rust-jemalloc-sys
-  ];
+
+  buildInputs = [ rust-jemalloc-sys ];

  env.OXC_VERSION = finalAttrs.version;

-  cargoBuildFlags = [
-    "--bin=oxlint"
-  ];
-  cargoTestFlags = finalAttrs.cargoBuildFlags;
+  buildPhase = ''
+    runHook preBuild

-  postFixup = ''
-    wrapProgram $out/bin/oxlint \
+    pnpm --workspace-concurrency=1 --filter oxlint-app run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    local -r packageRoot="$out/lib/oxlint"
+    mkdir -p "$packageRoot/bin"
+
+    cp npm/oxlint/configuration_schema.json "$packageRoot/"
+    cp npm/oxlint/bin/oxlint "$packageRoot/bin/oxlint"
+    cp -r apps/oxlint/dist "$packageRoot/dist"
+
+    chmod +x "$packageRoot/bin/oxlint"
+
+    makeBinaryWrapper "${lib.getExe nodejs-slim}" "$out/bin/oxlint" \
+      --add-flags "$packageRoot/bin/oxlint" \
      --prefix PATH : "${lib.makeBinPath [ tsgolint ]}"
+
+    runHook postInstall
  '';

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    pluginTestDir="$(mktemp -d)"
+    cat > "$pluginTestDir/plugin.mjs" <<'EOF'
+    const plugin = {
+      meta: { name: "smoke-plugin" },
+      rules: {
+        "always-error": {
+          create(context) {
+            return {
+              Program(node) {
+                context.report({ node, message: "plugin-smoke-ok" });
+              },
+            };
+          },
+        },
+      },
+    };
+    export default plugin;
+    EOF
+    cat > "$pluginTestDir/.oxlintrc.jsonc" <<'EOF'
+    {
+      "jsPlugins": ["./plugin.mjs"],
+      "rules": {
+        "smoke-plugin/always-error": "error"
+      }
+    }
+    EOF
+    printf 'const value = 1;\n' > "$pluginTestDir/input.js"
+
+    (
+      cd "$pluginTestDir"
+      set +e
+      pluginOutput="$($out/bin/oxlint input.js 2>&1)"
+      pluginStatus=$?
+      set -e
+      test "$pluginStatus" -ne 0
+      printf '%s\n' "$pluginOutput" | grep -F "plugin-smoke-ok" > /dev/null
+    )
+
+    typeAwareTestDir="$(mktemp -d)"
+    cat > "$typeAwareTestDir/.oxlintrc.jsonc" <<'EOF'
+    {
+      "rules": {
+        "typescript/no-unnecessary-type-assertion": "error"
+      }
+    }
+    EOF
+    cat > "$typeAwareTestDir/tsconfig.json" <<'EOF'
+    {
+      "compilerOptions": {
+        "target": "es2024",
+        "lib": ["ES2024", "DOM"],
+        "module": "es2022",
+        "strict": true,
+        "skipLibCheck": true
+      }
+    }
+    EOF
+    cat > "$typeAwareTestDir/input.ts" <<'EOF'
+    const str: string = "hello";
+    const redundant = str as string;
+
+    export {};
+    EOF
+
+    (
+      cd "$typeAwareTestDir"
+      set +e
+      typeAwareOutput="$($out/bin/oxlint --type-aware input.ts 2>&1)"
+      typeAwareStatus=$?
+      set -e
+      test "$typeAwareStatus" -ne 0
+      printf '%s\n' "$typeAwareOutput" | grep -F "no-unnecessary-type-assertion" > /dev/null
+    )
+
+    runHook postInstallCheck
+  '';
+
  passthru.updateScript = nix-update-script {
    extraArgs = [ "--version-regex=^oxlint_v([0-9.]+)$" ];
  };
@@ -57,5 +182,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ iamanaws ];
    mainProgram = "oxlint";
+    inherit (nodejs-slim.meta) platforms;
  };
 })
@@ -29,14 +29,14 @@ in

 python3Packages.buildPythonApplication rec {
  pname = "piper-tts";
-  version = "1.4.1";
+  version = "1.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "OHF-Voice";
    repo = "piper1-gpl";
    tag = "v${version}";
-    hash = "sha256-V/ESZMUT1PXxHNN7H2ckTBVOQRRf4c/L2GNtnkXvNpA=";
+    hash = "sha256-FHO+1d1iJimc6KweY/O6lEvWqGCyUwnDrslEfkxYR7A=";
  };

  patches = [
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pixi-pack";
-  version = "0.7.5";
+  version = "0.7.6";

  src = fetchFromGitHub {
    owner = "Quantco";
    repo = "pixi-pack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zMrr/47oTej6uyiRpPRVlfUIFtl0wesCm+qN6Y7iUkE=";
+    hash = "sha256-j9b+wpVUvEU/0R3inMO12TUs65Avtn3NU11gEE4hxLM=";
  };

-  cargoHash = "sha256-FnKmUNCmLcTTYqagOYhJFp7d/qbc0OBCb8nT7ZKx3n0=";
+  cargoHash = "sha256-22fE8XFTt10mUGl1jYb8UgoxD/rBlX4dNkjKEgtgAR8=";

  buildInputs = [ openssl ];

@@ -68,6 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    changelog = "https://pixi.sh/latest/CHANGELOG";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
+      esteve
      xiaoxiangmoe
    ];
    mainProgram = "pixi";
@@ -7,13 +7,13 @@

 buildGoModule {
  pname = "pkgsite";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-04-02";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "pkgsite";
-    rev = "95295059bea6702b583a9530f8335fa353fbf601";
-    hash = "sha256-OF6dWNs23PsRgwke7ydElTPrsBXRBwI3zMuBvCaWIk4=";
+    rev = "2d0d60d0e456af02dfc52d79053d5a3a20fb11ff";
+    hash = "sha256-mHTARhEwD7li9xJQdnjDesgZ4DE34N35oBJIqvo4aUY=";
  };

  vendorHash = "sha256-Dzizb692xTyCmaGpIoXU9OJ0//K+0QQ04vc4Dsnh34Q=";
@@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
  pname = "pocket-id";
-  version = "2.4.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "pocket-id";
    repo = "pocket-id";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lH8OYBJn1tsHs2wZCbqMqevjqK+tgAqG+Z+fsWP/fV4=";
+    hash = "sha256-5y4XIwBnag+vWoNH3RBYn5QbmpM2S08mkY7GiLFchag=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";

-  vendorHash = "sha256-a/h8Ptvs4UTgfX9jweo1IyDbwTFafgYrzUSE5pRUjRI=";
+  vendorHash = "sha256-ZrwnM3X8PbR89xQrM2VeYUTRR2/HupoAb5k9sH26vb8=";

  env.CGO_ENABLED = 0;
  ldflags = [
@@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
      inherit (finalAttrs) pname version src;
      pnpm = pnpm_10;
      fetcherVersion = 3;
-      hash = "sha256-vVCRfQWck9SR1hkJhUnoZ+0QDT8XmOiWeontgzv1e0s=";
+      hash = "sha256-4rMVdZnPMAIX/F3CGNJQJtH9OcJ663UlF+arvuwgS80=";
    };

    env.BUILD_OUTPUT_PATH = "dist";
@@ -30,5 +30,6 @@ buildGoModule (finalAttrs: {
    homepage = "https://github.com/Tinkoff/libvirt-exporter";
    license = lib.licenses.asl20;
    maintainers = [ ];
+    mainProgram = "libvirt-exporter";
  };
 })
@@ -14,7 +14,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "proton-pass-cli";
-  version = "1.8.0";
+  version = "1.9.0";

  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};

@@ -46,19 +46,19 @@ stdenv.mkDerivation (finalAttrs: {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-6kFY7cLN/xCez4aeprV4HllPxxTECiV2jI475izsrI8=";
+        hash = "sha256-mLYtw8ON2B+RUXVkD10VyI03d3yrdwFFz8giDb/PiNg=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-t3AyOLF0mXh9eCxBOh3e8WPBPowv9pWZ2WQTCTl+StA=";
+        hash = "sha256-dg7jNFrzuIeXKN3wV3nj92acwP1lqE3QHsuiosjrvLw=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-x86_64";
-        hash = "sha256-f8P0Pv4DUJPlcF4qPmqlLEHFfRYkLrxmPIgakUFYZlk=";
+        hash = "sha256-C9nWUikfaCfroVwz4C9K9dNMUpP6kbpHuuHMRTch5aU=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-M7zWxVYHHjM86/l3K+0AR8QceiydP0n0sXj9rSctaeI=";
+        hash = "sha256-m3HllX9YAmavVbkAyJ5h69QCcH2i4Ux+p17e0/VGovQ=";
      };
    };
    updateScript = writeShellScript "update-proton-pass-cli" ''
@@ -18,22 +18,21 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "protonmail-export";
-  version = "1.0.5";
+  version = "1.0.6";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-mail-export";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-rpfTI3vcZlEK1TrxRMMHFKutwC/YqAZrZCFiUsfMafc=";
+    hash = "sha256-ZYUqbxT9Aq3iaXdaCag4xstbrm9z9X435zm/Qz8OOyM=";
  };

  goModules =
    (buildGoModule {
-      pname = "protonmail-export-go-modules";
-      inherit (finalAttrs) src version;
+      inherit (finalAttrs) pname src version;
      sourceRoot = "${finalAttrs.src.name}/go-lib";
-      vendorHash = "sha256-rKi3PNsYsZA+MLcLTVrVI3T2SUBZCiq9Zxtf+1SGArk=";
+      vendorHash = "sha256-jtrfxKPFTiowllHDR7fo8GaeyhcPxAAXehBTk4bXKn8=";

      nativeBuildInputs = [ unzip ];

@@ -1,13 +0,0 @@
-diff --git a/rust/pyxel-platform/build.rs b/rust/pyxel-platform/build.rs
-index 45eecae..f385eb9 100644
--- a/rust/pyxel-platform/build.rs
-+++ b/rust/pyxel-platform/build.rs
-@@ -31,7 +31,7 @@ impl SDL2BindingsBuilder {
-     }
- 
-     fn should_bundle_sdl2(&self) -> bool {
-        self.target_os.contains("windows") || self.target_os == "darwin"
-+        false
-     }
- 
-     fn download_sdl2(&self) {
@@ -1,42 +1,58 @@
 {
  lib,
-  python3,
+  python3Packages,
+  cargo,
  fetchFromGitHub,
  rustPlatform,
+  rustc,
  SDL2,
 }:

-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "pyxel";
-  version = "2.3.18";
+  version = "2.8.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kitao";
    repo = "pyxel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pw1ZDmQ7zGwfM98jjym34RbLmUbjuuUnCoPGczxdai8=";
+    hash = "sha256-+SitYe2HFA6rwqk5lipcKFdBy69zdAhw3Q+Nb0iBx6s=";
  };

-  patches = [ ./never-bundle-sdl2.patch ];
-
  postPatch = ''
-    cp ${./Cargo.lock} rust/Cargo.lock
+    cp ${./Cargo.lock} crates/Cargo.lock
+    chmod u+w crates/Cargo.lock
  '';

-  cargoRoot = "rust";
+  cargoRoot = "crates";

-  cargoDeps = rustPlatform.importCargoLock {
-    # generated by running `cargo generate-lockfile` in the `rust` directory
-    lockFile = ./Cargo.lock;
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      src
+      pname
+      version
+      cargoRoot
+      ;
+    postPatch = ''
+      cp ${./Cargo.lock} crates/Cargo.lock
+    '';
+    hash = "sha256-UEN66yygcyOJt8fROClfBi1V5F7/I7P4j4vkPzKJ7jY=";
  };

  buildAndTestSubdir = "python";

-  nativeBuildInputs = with rustPlatform; [
-    cargoSetupHook
-    maturinBuildHook
-    bindgenHook
+  maturinBuildFlags = [
+    "--features"
+    "sdl2_dynamic"
+  ];
+
+  nativeBuildInputs = [
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustPlatform.bindgenHook
  ];

  buildInputs = [ SDL2 ];
@@ -48,7 +64,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {

  pythonImportsCheck = [
    "pyxel"
-    "pyxel.pyxel_wrapper"
+    "pyxel.pyxel_binding"
  ];

  meta = {
@@ -57,7 +73,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    homepage = "https://github.com/kitao/pyxel";
    license = lib.licenses.mit;
    mainProgram = "pyxel";
-    maintainers = with lib.maintainers; [ tomasajt ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      tomasajt
+      miniharinn
+    ];
+    platforms = with lib.platforms; linux ++ darwin;
  };
 })
@@ -7,12 +7,12 @@
  stdenv,
 }:
 let
-  version = "25.3.11";
+  version = "26.1.2";
  src = fetchFromGitHub {
    owner = "redpanda-data";
    repo = "redpanda";
    rev = "v${version}";
-    sha256 = "sha256-Nl+lz5tF9/N5B0jgM4tS3psrg7qDIGZh77HgggFoXHQ=";
+    sha256 = "sha256-dY6orYo5t+l0xKEqnCrXiaQ/57rqJnn9RAP67EgDi98=";
  };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
  inherit doCheck src version;
  modRoot = "./src/go/rpk";
  runVend = false;
-  vendorHash = "sha256-ozhu/4DGhpRj8vK4rzyhyV9/ZXg3LtoFYcubHVwjMbQ=";
+  vendorHash = "sha256-0lxwIemmAdsnGjyF6dNc9YVPrc4VENxSYpcWRiF4KpI=";

  ldflags = [
    ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
@@ -9,20 +9,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sampo";
-  version = "0.17.0";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "bruits";
    repo = "sampo";
    tag = "sampo-v${finalAttrs.version}";
-    hash = "sha256-NY73wGLS5r7C5GoF6p9Yf1d9nhbis/QZWAgnIVjytjA=";
+    hash = "sha256-lCF38mDdoBqm9F9enEhYx3fdrTgLG+ItL37Kxzqhqcw=";
  };

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ openssl ];

-  cargoHash = "sha256-9Z0Jdx220+GrdNZPcJnjxqSOp6GHFXomtME0qczHbvs=";
+  cargoHash = "sha256-roYUqxY+zkRoHZbC52Psk7/T1lRYjgnQ0cAFlUCZPn4=";

  cargoBuildFlags = [
    "-p"
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 830f0baf..a9048f14 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -147,7 +147,7 @@ endif()
+ find_package( 
+ 	Boost 1.48.0 REQUIRED COMPONENTS
+ 	serialization
+-	filesystem system
+	filesystem
+ )
+ 
+ if(NOT Boost_FOUND)
@@ -21,7 +21,10 @@ stdenv.mkDerivation (finalAttrs: {
  # https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/tree/develop/SuperBuild/patches/SHARK?ref_type=heads
  # patch of hdf5 seems to be not needed based on latest master branch of shark as HDF5 has been removed
  # c.f https://github.com/Shark-ML/Shark/commit/221c1f2e8abfffadbf3c5ef7cf324bc6dc9b4315
-  patches = [ ./shark-2-ext-num-literals-all.diff ];
+  patches = [
+    ./shark-2-ext-num-literals-all.diff
+    ./boost-1.89.patch
+  ];

  # Remove explicitly setting C++11, because boost::math headers need C++14 since Boost187.
  postPatch = ''
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "supabase-cli";
-  version = "2.75.0";
+  version = "2.84.2";

  src = fetchFromGitHub {
    owner = "supabase";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-AroDni0IQ6jMn5mOXt4+8j5tTwEk1upIUo2qvbWY9Jo=";
+    hash = "sha256-0S+FV1aty/RzkLA6WK4Me/eKEr4LduDfIVdruQO9ZrM=";
  };

-  vendorHash = "sha256-+qFZHCBcZ8tfSrDoYzw7wrVhZM+cUU5okiii8eeDCek=";
+  vendorHash = "sha256-7BkSPFR5ciEVA/i1gy53SZu26MMkZNC+VwRHMoLJSxI=";

  ldflags = [
    "-s"
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "turso-cli";
-  version = "1.0.18";
+  version = "1.0.19";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "turso-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-mWX7cJK4TX2JXHYQ4d5WaS/ZwlEkXJaiNM7zx/w+n9c=";
+    hash = "sha256-A0stg1w3nlrybqRcMROlWF3PnvYEYqy8KskjIXXA7Rk=";
  };

  vendorHash = "sha256-Cb4/KA9jfI/pNHbJqLWtm9oEXfMHGBS46J9o3lL4/Tk=";
@@ -9,11 +9,11 @@
 }:
 let
  pname = "volanta";
-  version = "1.16.3";
-  build = "581a1e68";
+  version = "1.16.4";
+  build = "af311390";
  src = fetchurl {
    url = "https://cdn.volanta.app/software/volanta-app/${version}-${build}/volanta-${version}.AppImage";
-    hash = "sha256-5187tE37dRyqjBa8P0Jwio2lBd8qd+tEZgl/98nGQy8=";
+    hash = "sha256-KLbScB7yaFbSdoR1piQppK33Lsvlfamb+MVvESrFqAA=";
  };
  appImageContents = appimageTools.extract { inherit pname version src; };
 in
@@ -72,6 +72,11 @@ stdenv.mkDerivation (finalAttrs: {
    LIRC_LIBS = "-L ${lib.getLib lirc}/lib -llirc_client";
  };

+  postPatch = ''
+    substituteInPlace src/common/getopt.h \
+      --replace-fail 'extern int getopt ();' 'extern int getopt (int ___argc, char *const *___argv, const char *__shortopts);'
+  '';
+
  strictDeps = true;

  meta = {
@@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "xlights";
-  version = "2026.03";
+  version = "2026.04";

  src = fetchurl {
    url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-xIJHzWnkxTEFfbVoLqMxd+wC+jfK/0rPVuwGXhOBTrk=";
+    hash = "sha256-eNt1dm2TDnw+JtRP73RppKeCspxKLgS3mnYKRNQ3Srs=";
  };

  meta = {
@@ -33,13 +33,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xournalpp";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = "xournalpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AHW3LfGAXoP9F3EJiRgVBQ9NuYdVJrh0cQKSEiG48rc=";
+    hash = "sha256-RNGVUgpn1Wefc48x5E88AGk4rtXyu0RovZxaS2bqQ+c=";
  };

  nativeBuildInputs = [
@@ -159,11 +159,12 @@ stdenv.mkDerivation (finalAttrs: {

  passthru = {
    updateScript = gitUpdater { };
+  }
+  // lib.optionalAttrs withQt6 {
    tests = {
      # Test of morph-browser itself
      standalone = if withQt6 then nixosTests.morph-browser.qt6 else nixosTests.morph-browser.qt5;
-    }
-    // lib.optionalAttrs withQt6 {
+
      # Interactions between the Lomiri ecosystem and this browser
      inherit (nixosTests.lomiri) desktop-basics desktop-appinteractions;
    };
@@ -2,21 +2,21 @@
  stdenvNoCC,
  lib,
  fetchFromGitLab,
+  adwaita-icon-theme,
  gitUpdater,
  gtk3,
  hicolor-icon-theme,
-  ubuntu-themes,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "suru-icon-theme";
-  version = "2025.05.0";
+  version = "2026.03.0";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/suru-icon-theme";
    rev = finalAttrs.version;
-    hash = "sha256-6MyZTRcfCpiCXzwrwNiBP6J4L4oFbFtoymhke13tLy0=";
+    hash = "sha256-cH3Ce2DKlfFZYpkYA7J4GFtYBYSoHoQICPWygI45/so=";
  };

  # Commit 79763fa4ff701d1d89d7362c37c65b2a3cbdf543 introduced abunch of symlinks for Lomiri apps' icons to files from this theme.
@@ -36,7 +36,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hicolor-icon-theme # theme setup hook
  ];

-  propagatedBuildInputs = [ ubuntu-themes ];
+  propagatedBuildInputs = [ adwaita-icon-theme ];

  dontConfigure = true;
  dontBuild = true;
@@ -16,12 +16,6 @@ let
      inherit (self) callPackage;
    in
    {
-      #### Core Apps
-      morph-browser = callPackage ./applications/morph-browser {
-        # get_target_property() called with non-existent target "Qt6::qdoc".
-        withDocumentation = !useQt6;
-      };
-
      #### Data
      lomiri-schemas = callPackage ./data/lomiri-schemas { };
      lomiri-sounds = callPackage ./data/lomiri-sounds { };
@@ -56,6 +50,13 @@ let
      lomiri-indicator-network = callPackage ./services/lomiri-indicator-network { };
      lomiri-url-dispatcher = callPackage ./services/lomiri-url-dispatcher { };
    }
+    // lib.optionalAttrs useQt6 {
+      #### Core Apps
+      morph-browser = callPackage ./applications/morph-browser {
+        # get_target_property() called with non-existent target "Qt6::qdoc".
+        withDocumentation = !useQt6;
+      };
+    }
    // lib.optionalAttrs (!useQt6) {
      #### Core Apps
      lomiri = callPackage ./applications/lomiri { };
@@ -105,5 +106,6 @@ lib.makeScope qtPackages.newScope packages
  content-hub = lib.warnOnInstantiate "`content-hub` was renamed to `lomiri-content-hub`." pkgs.lomiri.lomiri-content-hub; # Added on 2024-09-11
  history-service = lib.warnOnInstantiate "`history-service` was renamed to `lomiri-history-service`." pkgs.lomiri.lomiri-history-service; # Added on 2024-11-11
  lomiri-system-settings-security-privacy = lib.warnOnInstantiate "`lomiri-system-settings-security-privacy` upstream was merged into `lomiri-system-settings`. Please use `pkgs.lomiri.lomiri-system-settings-unwrapped` if you need to directly access the plugins that belonged to this project." pkgs.lomiri.lomiri-system-settings-unwrapped; # Added on 2024-08-08
+  morph-browser = throw "`lomiri.morph-browser` has been removed because it relied on the known-vulnerable `libsForQt5.qtwebengine`. Please use `lomiri-qt6.morph-browser` instead."; # Added on 2026-03-31
  telephony-service = lib.warnOnInstantiate "`telephony-service` was renamed to `lomiri-telephony-service`." pkgs.lomiri.lomiri-telephony-service; # Adder on 2025-01-15
 }
@@ -42,21 +42,21 @@

 buildPythonPackage (finalAttrs: {
  pname = "lancedb";
-  version = "0.30.1";
+  version = "0.30.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lancedb";
    repo = "lancedb";
    tag = "python-v${finalAttrs.version}";
-    hash = "sha256-LzuzVl6cTkn1Owd91bHi5JS43KZUhd/ZD9biS21MdVs=";
+    hash = "sha256-k7eVUOnriR91DqVRJP7N9VG75bHAzbDB8bHFLFi5h1w=";
  };

  buildAndTestSubdir = "python";

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-U5wpWN6e26187DYeT85l6TxBnUu8rD+UzE98OIkretc=";
+    hash = "sha256-yux18lKMaNOmrmVOYNMo5MMNAO0at5g/0eEsjF97Pes=";
  };

  build-system = [ rustPlatform.maturinBuildHook ];
@@ -17,14 +17,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "mhcgnomes";
-  version = "3.15.1";
+  version = "3.19.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pirl-unc";
    repo = "mhcgnomes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tcJfGIJsbCdN+U/+2zsYBhKEJNy55QMf7eu9Z4nuXlk=";
+    hash = "sha256-Z5Xmo3yXsFr2u2BUVc5YJZc7gjcBSkpfWy2VuXK8qEc=";
  };

  build-system = [
@@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "modelscope";
-  version = "1.35.1";
+  version = "1.35.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "modelscope";
    repo = "modelscope";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-p8Pv58IpP165z4CHq+CO6160LyHd3BS3Y3I2JBGp4KE=";
+    hash = "sha256-3PG20FqNn8syngxmzxjIr1C8u128RPFj+FjU494QTYA=";
  };

  build-system = [ setuptools ];
@@ -28,7 +28,7 @@
 }:
 buildPythonPackage (finalAttrs: {
  pname = "pgmpy";
-  version = "1.0.0-unstable-2025-12-20";
+  version = "1.1.0";
  pyproject = true;

  src = fetchFromGitHub {
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "py-opensonic";
-  version = "8.1.1";
+  version = "8.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "khers";
    repo = "py-opensonic";
    tag = "v${version}";
-    hash = "sha256-/P/7ytA0YHuJZEq7KQosPBQM2vo6VAss1G8pTIEswJA=";
+    hash = "sha256-lpPRkPLWHzsXhpZ1PVvgNWTQUuuU8N0g7ntqyOAbPlM=";
  };

  build-system = [ setuptools ];
@@ -34,14 +34,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pylance";
-  version = "3.0.1";
+  version = "4.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lancedb";
    repo = "lance";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zlD6jHMpgk4gvMjBizZP2VV0zM6iKaatIq6PbBKWaJ8=";
+    hash = "sha256-Z7lgK7sIeZCL8VXfmwC8G1f7cBqG2nfFM3oyJZfmNQ4=";
  };

  sourceRoot = "${finalAttrs.src.name}/python";
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
      src
      sourceRoot
      ;
-    hash = "sha256-+4UVY4JjQsVT+S5+j9PEXoFuiZhrrelSEfY8EvXp/Sk=";
+    hash = "sha256-hZEcTo4B3+viRwWExkaguq+c7DejjaouNf0+L96rms4=";
  };

  nativeBuildInputs = [
@@ -151,6 +151,9 @@ buildPythonPackage (finalAttrs: {
  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
    # OSError: LanceError(IO): Resources exhausted: Failed to allocate additional 1245184 bytes for ExternalSorter[0]...
    "test_merge_insert_large"
+
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_index_cast_centroids"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # Build hangs after all the tests are run due to a torch subprocess not exiting
--- a/Show More
+++ b/Show More