Merge commit '9d8e096346e9c51041858b3b301ffe1d7d4e63d5' into haskell-updates

.github/workflows/backport.yml

@@ -11,7 +11,7 @@ on:
 
 permissions:
   contents: read
-  issues: write # adding the 'has: port to stable' label
+  issues: write # adding the 'has: port to stable' and 'has: backport failed' label
   pull-requests: write # creating backport pull requests
 
 defaults:
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@7c3f6cd5843cac11bc59a04a1b7699af93261670 # v4.5.0
+        uses: korthout/backport-action@bf97bcfb53d5250af8b9a15fab0f56158a63b224 # v4.5.1
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true
@@ -82,3 +82,16 @@ jobs:
               issue_number: context.payload.pull_request.number,
               labels: [ '8.has: port to stable' ]
             })
+
+      - name: "Add 'has: failed backport' label"
+        if: steps.backport.outputs.was_successful == 'false'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # Not using the app on purpose to avoid triggering another workflow run after adding this label.
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: [ '8.has: failed backport' ]
+            })

.github/workflows/bot.yml

@@ -91,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -111,7 +111,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/build.yml

@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -136,7 +136,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Load supported versions
         id: versions
@@ -184,7 +184,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
@@ -274,7 +274,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Combine all output paths and eval stats
         run: |
@@ -481,7 +481,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true

ci/github-script/manual-file-edits.js

@@ -1,4 +1,5 @@
 // @ts-check
+const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
@@ -32,6 +33,27 @@ async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
     return
   }
 
+  const baseBranchType = classify(
+    pr.base.ref.replace(/^refs\/heads\//, ''),
+  ).type
+  const headBranchType = classify(
+    pr.head.ref.replace(/^refs\/heads\//, ''),
+  ).type
+
+  if (
+    baseBranchType.includes('development') &&
+    headBranchType.includes('development') &&
+    pr.base.repo.id === pr.head.repo?.id
+  ) {
+    // This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
+    // Ignore them: we should only care about PRs introducing *new* commits.
+    // We still want to run on PRs from, e.g., Someone:master to NixOS:master, though.
+    core.info(
+      'This PR is from one development branch to another. Skipping checks.',
+    )
+    return
+  }
+
   const details = await getCommitDetailsForPR({ core, pr, repoPath })
 
   if (

doc/release-notes/rl-2605.section.md

@@ -93,6 +93,8 @@
   This update introduces several breaking changes: the Python plugin interface is now v5.0, the `PATH` plugin has been renamed to `Commandline`, and the QStylesheets-based widgets box model frontend has been removed.
   For more information read the [changelog for 34.0.0](https://albertlauncher.github.io/2026/01/19/albert-v34.0.0-released/).
 
+- `asciinema_3` is now renamed to `asciinema` and the old `asciinema` version 2.x.x written in python was removed.
+
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
 
 - `cargo-codspeed` has been updated from `3.0.5` to `4.2.0`. Version `4.0.0` includes breaking changes. For more information read the [changelog for 4.0.0](https://github.com/CodSpeedHQ/codspeed-rust/releases/tag/v4.0.0).

doc/using/configuration.chapter.md

@@ -31,6 +31,22 @@ Unfree software is not tested or built in Nixpkgs continuous integration, and th
 Most unfree licenses prohibit either executing or distributing the software.
 :::
 
+The `NIXPKGS_CONFIG` environment variable can override the configuration file location.
+Nixpkgs resolves the config in this order:
+
+1.  `$NIXPKGS_CONFIG`, if set and the file exists.
+2.  `~/.config/nixpkgs/config.nix`, if it exists.
+3.  `~/.nixpkgs/config.nix` (legacy), if it exists.
+4.  Empty configuration.
+
+On NixOS, `NIXPKGS_CONFIG` points to `/etc/nix/nixpkgs-config.nix` system-wide.
+Drop a file there to apply configuration to `nix-env`, `nix-shell`, and other user-level commands.
+NixOS does not create this file.
+The [`nixpkgs.config`](https://nixos.org/manual/nixos/stable/options#opt-nixpkgs.config) option does not affect `nix-env`, `nix-shell`, or other user-level commands.
+
+This lookup applies to non-flake usage like channels and `<nixpkgs>`.
+Flakes ignore it; pass `config` directly when importing `nixpkgs`.
+
 ## Installing broken packages {#sec-allow-broken}
 
 There are several ways to try compiling a package which has been marked as broken.

lib/licenses/licenses.nix

@@ -527,6 +527,11 @@ lib.mapAttrs mkLicense (
       fullName = "DOC License";
     };
 
+    docBookDtd = {
+      spdxId = "DocBook-DTD";
+      fullName = "DocBook DTD License";
+    };
+
     drl10 = {
       spdxId = "DRL-1.0";
       fullName = "Detection Rule License 1.0";

lib/modules.nix

@@ -589,7 +589,8 @@ let
     in
     modulesPath: initialModules: args: {
       modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
-      # Intentionally not shared with `modules` above: this allows `collected`
+      # Intentionally not shared with `modules` above: this allows
+      # the return value of `collectStructuredModules`
       # to be garbage collected after `filterModules` returns.
       graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
     };

lib/strings.nix

@@ -337,7 +337,6 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
-    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -361,7 +360,7 @@ rec {
 
     :::
   */
-  concatLines = concatMapStrings (s: s + "\n");
+  concatLines = lines: optionalString (lines != [ ]) (concatStringsSep "\n" lines + "\n");
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.

maintainers/maintainer-list.nix

@@ -4537,6 +4537,12 @@
     githubId = 1945;
     name = "Casey Rodarmor";
   };
+  caseyavila = {
+    email = "casey@theavilas.org";
+    github = "caseyavila";
+    githubId = 53847249;
+    name = "Casey Avila";
+  };
   catap = {
     email = "kirill@korins.ky";
     github = "catap";
@@ -4604,6 +4610,12 @@
     githubId = 9086315;
     name = "Connor Brewster";
   };
+  cbrxyz = {
+    email = "me@cbrxyz.com";
+    github = "cbrxyz";
+    githubId = 52760912;
+    name = "Cameron Brown";
+  };
   ccellado = {
     email = "annplague@gmail.com";
     github = "ccellado";
@@ -7978,12 +7990,6 @@
     github = "EmanuelM153";
     githubId = 134736553;
   };
-  emattiza = {
-    email = "nix@mattiza.dev";
-    github = "emattiza";
-    githubId = 11719476;
-    name = "Evan Mattiza";
-  };
   embr = {
     email = "hi@liclac.eu";
     github = "liclac";
@@ -9218,6 +9224,12 @@
     githubId = 119691;
     name = "Michael Gough";
   };
+  fraioveio = {
+    email = "francesco@vecchia.lol";
+    github = "FraioVeio";
+    githubId = 181361445;
+    name = "Francesco Vecchia";
+  };
   franciscod = {
     github = "franciscod";
     githubId = 726447;
@@ -14036,13 +14048,6 @@
     github = "keller00";
     githubId = 8452750;
   };
-  kennyballou = {
-    email = "kb@devnulllabs.io";
-    github = "kennyballou";
-    githubId = 2186188;
-    name = "Kenny Ballou";
-    keys = [ { fingerprint = "932F 3E8E 1C0F 4A98 95D7  B8B8 B0CA A28A 0295 8308"; } ];
-  };
   kenran = {
     email = "johannes.maier@mailbox.org";
     github = "kenranunderscore";
@@ -19073,6 +19078,12 @@
       { fingerprint = "5A1D C7CE 51DC 0A85 6DEA  41F7 31A8 CE0D 2E7D 30C3"; }
     ];
   };
+  naomieow = {
+    name = "Naomi Roberts";
+    email = "mia@naomieow.xyz";
+    github = "naomieow";
+    githubId = 79906167;
+  };
   naora = {
     name = "Joris Gundermann";
     email = "jorisgundermann@gmail.com";
@@ -19901,6 +19912,12 @@
     name = "Alessio Caiazza";
     matrix = "@alessio:caiazza.info";
   };
+  nomadium = {
+    email = "miguel@miguel.cc";
+    github = "nomadium";
+    githubId = 79817;
+    name = "Miguel Landaeta";
+  };
   nomaterials = {
     email = "nomaterials@gmail.com";
     github = "no-materials";
@@ -20132,9 +20149,6 @@
     github = "nukdokplex";
     githubId = 25458915;
     name = "Viktor Titov";
-    keys = [
-      { fingerprint = "7CE2 4C42 942D 58EA 99F6  F00A A47E 7374 3EF6 FCC4"; }
-    ];
   };
   nullcube = {
     email = "nullcub3@gmail.com";
@@ -23069,6 +23083,13 @@
     githubId = 4196789;
     name = "Nathan Ringo";
   };
+  remidupre = {
+    email = "remi+nixpkgs@dupre.io";
+    github = "remi-dupre";
+    githubId = 1173464;
+    name = "Rémi Dupré";
+    keys = [ { fingerprint = "4762 C65B F8D8 6A33 65C1  D10A 4613 02CD 1249 4653"; } ];
+  };
   remix7531 = {
     email = "remix7531@mailbox.org";
     github = "remix7531";
@@ -23599,6 +23620,13 @@
     githubId = 53882428;
     name = "Erik Rodriguez";
   };
+  roehrijn = {
+    email = "jan.roehrich@loft.sh";
+    github = "roehrijn";
+    githubId = 2474078;
+    name = "Jan Roehrich";
+    keys = [ { fingerprint = "21C1 F506 455E 95B4 EB39  D566 BAE1 2FF6 0C8A 97F2"; } ];
+  };
   rogarb = {
     email = "rogarb@rgarbage.fr";
     github = "rogarb";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,6 +110,8 @@
 
 - [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable).
 
+- [Rustical](https://github.com/lennart-k/rustical), a CalDav/CardDav server aiming to be simple, fast and passwordless. Available as [services.rustical](options.html#opt-services.rustical.enable).
+
 - [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable).
 
 - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
@@ -162,6 +164,8 @@
 
 - `systemd.coredump.extraConfig` has been removed in favor of the structured [](#opt-systemd.coredump.settings.Coredump) option. Use `systemd.coredump.settings.Coredump` to set any `coredump.conf(5)` option directly. For example, replace `systemd.coredump.extraConfig = "Storage=journal";` with `systemd.coredump.settings.Coredump.Storage = "journal";`.
 
+- `services.home-assistant.config.lovelace.mode` has been renamed to `lovelace.dashboards` and `lovelace.resource_mode` to match the [configuration format](https://www.home-assistant.io/dashboards/dashboards/) required by Home Assistant 2026.8. Users who explicitly set `lovelace.mode` should remove it; the module generates the correct entries automatically.
+
 - `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
 
 - []{#sec-release-26.05-incompatibilities-profiles-hardened-removed} `profiles/hardened` has been removed, because:

nixos/modules/config/xdg/portals/lxqt.nix

@@ -29,7 +29,6 @@ in
         [
           pkgs.libsForQt5.qtstyleplugin-kvantum
           pkgs.breeze-qt5
-          pkgs.qtcurve
         ];
       '';
       description = ''

nixos/modules/hardware/i2c.nix

@@ -38,7 +38,7 @@ in
         name = "i2c-udev-rules";
         text = ''
           # allow group ${cfg.group} and users with a seat use of i2c devices
-          ACTION=="add", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660"
+          ACTION!="remove", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660"
         '';
         destination = "/etc/udev/rules.d/70-i2c.rules";
       }

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-cosmic.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ./installation-cd-graphical-calamares.nix ];
+
+  isoImage.edition = lib.mkDefault "cosmic";
+  isoImage.configurationName = "COSMIC (Linux LTS)";
+
+  environment.pathsToLink = [ "/share/calamares" ];
+
+  services = {
+    desktopManager.cosmic.enable = true;
+    displayManager = {
+      # Greeter needs to be enabled to handle an idle logout and login
+      cosmic-greeter.enable = true;
+
+      # No need to have a lockscreen on an installer ISO, enable autologin
+      autoLogin = {
+        enable = true;
+        user = "nixos";
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules =
+    let
+      desktopDir = "/home/nixos/Desktop";
+      filesInHomePerms = "0644 nixos users -";
+      dirsInHomePerms = "0755 nixos users - -";
+      CosmicAppList_favorites = "${pkgs.writeText "favorites" ''
+        [
+            "calamares",
+            "firefox",
+            "gparted",
+            "com.system76.CosmicFiles",
+            "com.system76.CosmicEdit",
+            "com.system76.CosmicTerm",
+            "com.system76.CosmicSettings",
+        ]''}";
+    in
+    [
+      # Need to create ${desktopDir} first or we get an ownership issue because
+      # otherwise ${desktopDir} gets the ownership of `root:root`.
+      "d ${desktopDir} ${dirsInHomePerms}"
+      "L+ ${desktopDir}/calamares.desktop ${filesInHomePerms} ${pkgs.calamares-nixos}/share/applications/calamares.desktop"
+      "L+ ${desktopDir}/firefox.desktop ${filesInHomePerms} ${pkgs.firefox}/share/applications/firefox.desktop"
+      "L+ ${desktopDir}/gparted.desktop ${filesInHomePerms} ${pkgs.gparted}/share/applications/gparted.desktop"
+      "L+ ${desktopDir}/nixos-manual.desktop ${filesInHomePerms} /run/current-system/sw/share/applications/nixos-manual.desktop"
+
+      # Same as ${desktopDir}, need to create all directories in the hierarchy
+      "d /home/nixos/.config ${dirsInHomePerms}"
+      "d /home/nixos/.config/cosmic ${dirsInHomePerms}"
+      "d /home/nixos/.config/cosmic/com.system76.CosmicAppList ${dirsInHomePerms}"
+      "d /home/nixos/.config/cosmic/com.system76.CosmicAppList/v1 ${dirsInHomePerms}"
+      "L+ /home/nixos/.config/cosmic/com.system76.CosmicAppList/v1/favorites ${filesInHomePerms} ${CosmicAppList_favorites}"
+    ];
+
+  specialisation = {
+    cosmic_latest_kernel.configuration =
+      { config, ... }:
+      {
+        imports = [ ./latest-kernel.nix ];
+        isoImage.configurationName = lib.mkForce "COSMIC (Linux ${config.boot.kernelPackages.kernel.version})";
+      };
+  };
+}

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -7,7 +7,10 @@
 
   isoImage.edition = lib.mkDefault "plasma6";
 
-  services.desktopManager.plasma6.enable = true;
+  services.desktopManager.plasma6 = {
+    enable = true;
+    enableQt5Integration = false;
+  };
 
   # Automatically login as nixos.
   services.displayManager = {

nixos/modules/module-list.nix

@@ -1768,6 +1768,7 @@
   ./services/web-apps/rimgo.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rsshub.nix
+  ./services/web-apps/rustical.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix
   ./services/web-apps/selfoss.nix

nixos/modules/programs/nix-required-mounts.nix

@@ -70,7 +70,10 @@ let
 
     zluda = {
       onFeatures = [
+        "amd-gpu"
         "cuda"
+        "gpu"
+        "opengl"
       ];
       paths = [
         pkgs.addDriverRunpath.driverLink

nixos/modules/services/databases/redis.nix

@@ -571,7 +571,7 @@ in
       lib.nameValuePair (redisName name) {
         description = "System user for the redis-server instance ${name}";
         isSystemUser = true;
-        group = redisName name;
+        group = conf.group;
       }
     ) (lib.filterAttrs (name: conf: conf.user == redisName name) enabledServers);
     users.groups = lib.mapAttrs' (

nixos/modules/services/desktop-managers/plasma6.nix

@@ -191,8 +191,8 @@ in
           # Only symlink the KIO plugins, so we don't accidentally pull any services
           # like KCMs or kcookiejar
           let
-            kioPluginPath = "${pkgs.plasma5Packages.qtbase.qtPluginPrefix}/kf5/kio";
-            inherit (pkgs.plasma5Packages) kio;
+            kioPluginPath = "${pkgs.libsForQt5.qtbase.qtPluginPrefix}/kf5/kio";
+            inherit (pkgs.libsForQt5.__internalKF5) kio;
           in
           pkgs.runCommand "kio5-plugins-only" { } ''
             mkdir -p $out/${kioPluginPath}

nixos/modules/services/hardware/asusd.nix

@@ -141,7 +141,6 @@ in
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
     services.udev.packages = [ cfg.package ];
-    services.supergfxd.enable = lib.mkDefault true;
   };
 
   meta.maintainers = pkgs.asusctl.meta.maintainers;

nixos/modules/services/home-automation/home-assistant.nix

@@ -30,6 +30,7 @@ let
     mapAttrsToList
     mergeAttrsList
     mkEnableOption
+    mkDefault
     mkIf
     mkMerge
     mkOption
@@ -70,7 +71,7 @@ let
   # Filter null values from the configuration, so that we can still advertise
   # optional options in the config attribute.
   filteredConfig = converge (filterAttrsRecursive (_: v: !elem v [ null ])) (
-    recursiveUpdate customLovelaceModulesResources (cfg.config or { })
+    recursiveUpdate (customLovelaceModulesResources // themesConfig) (cfg.config or { })
   );
   configFile = renderYAMLFile "configuration.yaml" filteredConfig;
 
@@ -142,13 +143,146 @@ let
     paths = cfg.customLovelaceModules;
   };
 
-  # Create parts of the lovelace config that reference lovelave modules as resources
+  # Create parts of the lovelace config that reference lovelace modules as resources
   customLovelaceModulesResources = {
     lovelace.resources = map (card: {
       url = "/local/nixos-lovelace-modules/${card.entrypoint or (card.pname + ".js")}?${card.version}";
       type = "module";
     }) cfg.customLovelaceModules;
   };
+
+  # Create a directory that holds all lovelace themes
+  themesDir = pkgs.buildEnv {
+    name = "home-assistant-themes";
+    paths = cfg.themes;
+  };
+
+  # Auto-inject frontend.themes include directive when themes are used.
+  themesConfig =
+    if cfg.themes != [ ] then
+      {
+        frontend.themes = "!include_dir_merge_named ${themesDir}/themes";
+      }
+    else
+      { };
+
+  componentsUsingBluetooth = [
+    # Components that require the AF_BLUETOOTH address family
+    "august"
+    "august_ble"
+    "airthings_ble"
+    "aranet"
+    "bluemaestro"
+    "bluetooth"
+    "bluetooth_adapters"
+    "bluetooth_le_tracker"
+    "bluetooth_tracker"
+    "bthome"
+    "default_config"
+    "eufylife_ble"
+    "esphome"
+    "fjaraskupan"
+    "gardena_bluetooth"
+    "govee_ble"
+    "homekit_controller"
+    "inkbird"
+    "improv_ble"
+    "keymitt_ble"
+    "ld2410_ble"
+    "leaone"
+    "led_ble"
+    "medcom_ble"
+    "melnor"
+    "moat"
+    "mopeka"
+    "motionblinds_ble"
+    "oralb"
+    "private_ble_device"
+    "qingping"
+    "rapt_ble"
+    "ruuvi_gateway"
+    "ruuvitag_ble"
+    "sensirion_ble"
+    "sensorpro"
+    "sensorpush"
+    "shelly"
+    "snooz"
+    "switchbot"
+    "thermobeacon"
+    "thermopro"
+    "tilt_ble"
+    "xiaomi_ble"
+    "yalexs_ble"
+  ];
+  componentsUsingPacketCapture = [
+    "default_config" # includes dhcp
+    "dhcp"
+  ];
+  componentsUsingPing = [
+    # Components that require the capset syscall for the ping wrapper
+    "ping"
+    "wake_on_lan"
+  ];
+  componentsUsingSerialDevices = [
+    # Components that require access to serial devices (/dev/tty*)
+    # List generated from home-assistant documentation:
+    #   git clone https://github.com/home-assistant/home-assistant.io/
+    #   cd source/_integrations
+    #   rg "/dev/tty" -l | cut -d'/' -f3 | cut -d'.' -f1 | sort
+    # And then extended by references found in the source code, these
+    # mostly the ones using config flows already.
+    "acer_projector"
+    "alarmdecoder"
+    "aurora_abb_powerone"
+    "blackbird"
+    "bryant_evolution"
+    "crownstone"
+    "deconz"
+    "dsmr"
+    "edl21"
+    "elkm1"
+    "elv"
+    "enocean"
+    "homeassistant_hardware"
+    "homeassistant_yellow"
+    "firmata"
+    "flexit"
+    "gpsd"
+    "insteon"
+    "kwb"
+    "lacrosse"
+    "landisgyr_heat_meter"
+    "modbus"
+    "modem_callerid"
+    "mysensors"
+    "nad"
+    "numato"
+    "nut"
+    "opentherm_gw"
+    "otbr"
+    "rainforst_raven"
+    "rflink"
+    "rfxtrx"
+    "scsgate"
+    "serial"
+    "serial_pm"
+    "sms"
+    "upb"
+    "usb"
+    "velbus"
+    "w800rf32"
+    "zha"
+    "zwave"
+    "zwave_js"
+
+    # Custom components, maintained manually.
+    "amshan"
+    "benqprojector"
+  ];
+  componentsUsingInputDevices = [
+    # Components that require access to input devices (/dev/input/*)
+    "keyboard_remote"
+  ];
 in
 {
   imports = [
@@ -319,7 +453,35 @@ in
         Available cards can be found below `pkgs.home-assistant-custom-lovelace-modules`.
 
         ::: {.note}
-        Automatic loading only works with lovelace in `yaml` mode.
+        When non-empty, `lovelace.resource_mode` is automatically set to `"yaml"`
+        so that resources are loaded from the YAML configuration.
+        :::
+      '';
+    };
+
+    themes = mkOption {
+      type = types.listOf (
+        types.addCheck types.package (p: p.isHomeAssistantTheme or false)
+        // {
+          name = "home-assistant-theme";
+          description = "package that is a Home Assistant theme";
+        }
+      );
+      default = [ ];
+      example = literalExpression ''
+        with pkgs.home-assistant-themes; [
+          material-you-theme
+        ];
+      '';
+      description = ''
+        List of themes to load.
+
+        Available themes can be found below `pkgs.home-assistant-themes`.
+
+        ::: {.note}
+        When `themes` is set, the module takes authoritative control
+        over the `frontend.themes` setting in
+        {option}`services.home-assistant.config`.
         :::
       '';
     };
@@ -428,21 +590,57 @@ in
 
             lovelace = {
               # https://www.home-assistant.io/lovelace/dashboards/
-              mode = mkOption {
-                type = types.enum [
-                  "yaml"
-                  "storage"
-                ];
+              dashboards.nixos-lovelace = mkOption {
+                type = types.nullOr format.type;
                 default =
-                  if (cfg.lovelaceConfig != null || cfg.lovelaceConfigFile != null) then "yaml" else "storage";
+                  if cfg.lovelaceConfig != null || cfg.lovelaceConfigFile != null then
+                    {
+                      mode = "yaml";
+                      filename = "ui-lovelace.yaml";
+                      title = "Overview";
+                      icon = "mdi:view-dashboard";
+                      show_in_sidebar = true;
+                    }
+                  else
+                    null;
                 defaultText = literalExpression ''
-                  if (cfg.lovelaceConfig != null || cfg.lovelaceConfigFile != null)
-                    then "yaml"
-                  else "storage";
+                  if cfg.lovelaceConfig != null || cfg.lovelaceConfigFile != null then {
+                    mode = "yaml";
+                    filename = "ui-lovelace.yaml";
+                    title = "Overview";
+                    icon = "mdi:view-dashboard";
+                    show_in_sidebar = true;
+                  } else null
                 '';
-                example = "yaml";
                 description = ''
-                  In what mode should the main Lovelace panel be, `yaml` or `storage` (UI managed).
+                  Default NixOS-managed Lovelace dashboard. Automatically populated
+                  when {option}`lovelaceConfig` or {option}`lovelaceConfigFile` is set.
+
+                  Additional dashboards can be defined under
+                  `config.lovelace.dashboards.<name>`.
+
+                  See <https://www.home-assistant.io/lovelace/dashboards/> for details.
+                '';
+              };
+
+              resource_mode = mkOption {
+                type = types.nullOr (
+                  types.enum [
+                    "yaml"
+                    "storage"
+                  ]
+                );
+                default = if cfg.customLovelaceModules != [ ] then "yaml" else null;
+                defaultText = literalExpression ''
+                  if cfg.customLovelaceModules != [ ] then "yaml" else null
+                '';
+                description = ''
+                  Set to `"yaml"` to load Lovelace resources from YAML configuration,
+                  or `"storage"` to manage them through the UI. See
+                  <https://www.home-assistant.io/dashboards/dashboards/#resource_mode>.
+
+                  Automatically set to `"yaml"` when {option}`customLovelaceModules`
+                  is non-empty.
                 '';
               };
             };
@@ -510,7 +708,7 @@ in
       '';
       description = ''
         Your {file}`ui-lovelace.yaml` as a Nix attribute set.
-        Setting this option will automatically set `lovelace.mode` to `yaml`.
+        Setting this option will automatically configure a Lovelace dashboard in YAML mode.
 
         Beware that setting this option will delete your previous {file}`ui-lovelace.yaml`
       '';
@@ -521,8 +719,8 @@ in
       type = types.nullOr types.path;
       example = "/path/to/ui-lovelace.yaml";
       description = ''
-        Your {file}`ui-lovelace.yaml` managed as configuraton file.
-        Setting this option will automatically set `lovelace.mode` to `yaml`.
+        Your {file}`ui-lovelace.yaml` managed as configuration file.
+        Setting this option will automatically configure a Lovelace dashboard in YAML mode.
       '';
     };
 
@@ -619,6 +817,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = optionals (cfg.config ? lovelace.mode) [
+      ''
+        services.home-assistant.config.lovelace.mode is deprecated.
+        Home Assistant 2026.8 renames the legacy top-level `lovelace.mode`
+        setting in favour of per-dashboard configuration.
+
+        Use `services.home-assistant.config.lovelace.dashboards` and
+        `services.home-assistant.config.lovelace.resource_mode` instead.
+
+        See https://www.home-assistant.io/dashboards/dashboards/ for details.
+      ''
+    ];
+
     assertions = [
       {
         assertion = cfg.openFirewall -> cfg.config != null;
@@ -628,6 +839,10 @@ in
         assertion = !(cfg.lovelaceConfig != null && cfg.lovelaceConfigFile != null);
         message = "Only one of `lovelaceConfig` or `lovelaceConfigFile` can be configured at the same time.";
       }
+      {
+        assertion = cfg.themes != [ ] -> !(hasAttrByPath [ "frontend" "themes" ] (cfg.config or { }));
+        message = "`services.home-assistant.themes` and `services.home-assistant.config.frontend.themes` cannot both be set. When `themes` is non-empty the module sets `frontend.themes` authoritatively.";
+      }
     ];
 
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.config.http.server_port ];
@@ -711,6 +926,7 @@ in
               ln -fns "''${paths[@]}" "${cfg.configDir}/custom_components/"
             done
           '';
+
           removeBlueprints = ''
             # remove blueprints symlinked in from below the /nix/store
             readarray -d "" blueprints < <(find "${cfg.configDir}/blueprints" -maxdepth 2 -type l -print0)
@@ -757,6 +973,10 @@ in
               "CAP_NET_ADMIN"
               "CAP_NET_RAW"
             ]
+            ++ optionals (any useComponent componentsUsingPacketCapture) [
+              # Raw packet capture using AF_PACKET
+              "CAP_NET_RAW"
+            ]
             ++ optionals (useComponent "emulated_hue") [
               # Alexa looks for the service on port 80
               # https://www.home-assistant.io/integrations/emulated_hue
@@ -769,119 +989,6 @@ in
               "CAP_NET_RAW"
             ]
           );
-          componentsUsingBluetooth = [
-            # Components that require the AF_BLUETOOTH address family
-            "august"
-            "august_ble"
-            "airthings_ble"
-            "aranet"
-            "bluemaestro"
-            "bluetooth"
-            "bluetooth_adapters"
-            "bluetooth_le_tracker"
-            "bluetooth_tracker"
-            "bthome"
-            "default_config"
-            "eufylife_ble"
-            "esphome"
-            "fjaraskupan"
-            "gardena_bluetooth"
-            "govee_ble"
-            "homekit_controller"
-            "inkbird"
-            "improv_ble"
-            "keymitt_ble"
-            "ld2410_ble"
-            "leaone"
-            "led_ble"
-            "medcom_ble"
-            "melnor"
-            "moat"
-            "mopeka"
-            "motionblinds_ble"
-            "oralb"
-            "private_ble_device"
-            "qingping"
-            "rapt_ble"
-            "ruuvi_gateway"
-            "ruuvitag_ble"
-            "sensirion_ble"
-            "sensorpro"
-            "sensorpush"
-            "shelly"
-            "snooz"
-            "switchbot"
-            "thermobeacon"
-            "thermopro"
-            "tilt_ble"
-            "xiaomi_ble"
-            "yalexs_ble"
-          ];
-          componentsUsingPing = [
-            # Components that require the capset syscall for the ping wrapper
-            "ping"
-            "wake_on_lan"
-          ];
-          componentsUsingSerialDevices = [
-            # Components that require access to serial devices (/dev/tty*)
-            # List generated from home-assistant documentation:
-            #   git clone https://github.com/home-assistant/home-assistant.io/
-            #   cd source/_integrations
-            #   rg "/dev/tty" -l | cut -d'/' -f3 | cut -d'.' -f1 | sort
-            # And then extended by references found in the source code, these
-            # mostly the ones using config flows already.
-            "acer_projector"
-            "alarmdecoder"
-            "aurora_abb_powerone"
-            "blackbird"
-            "bryant_evolution"
-            "crownstone"
-            "deconz"
-            "dsmr"
-            "edl21"
-            "elkm1"
-            "elv"
-            "enocean"
-            "homeassistant_hardware"
-            "homeassistant_yellow"
-            "firmata"
-            "flexit"
-            "gpsd"
-            "insteon"
-            "kwb"
-            "lacrosse"
-            "landisgyr_heat_meter"
-            "modbus"
-            "modem_callerid"
-            "mysensors"
-            "nad"
-            "numato"
-            "nut"
-            "opentherm_gw"
-            "otbr"
-            "rainforst_raven"
-            "rflink"
-            "rfxtrx"
-            "scsgate"
-            "serial"
-            "serial_pm"
-            "sms"
-            "upb"
-            "usb"
-            "velbus"
-            "w800rf32"
-            "zha"
-            "zwave"
-            "zwave_js"
-
-            # Custom components, maintained manually.
-            "amshan"
-            "benqprojector"
-          ];
-          componentsUsingInputDevices = [
-            # Components that require access to input devices (/dev/input/*)
-            "keyboard_remote"
-          ];
         in
         {
           ExecStart = escapeSystemdExecArgs (
@@ -958,6 +1065,9 @@ in
           ]
           ++ optionals (any useComponent componentsUsingBluetooth) [
             "AF_BLUETOOTH"
+          ]
+          ++ optionals (any useComponent componentsUsingPacketCapture) [
+            "AF_PACKET"
           ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
@@ -980,9 +1090,11 @@ in
           ];
           UMask = "0077";
         };
-      path = [
-        pkgs.unixtools.ping # needed for ping
-      ];
+      path =
+        with pkgs;
+        lib.optionals (useComponent "go2rtc") [ pkgs.go2rtc ]
+        ++ lib.optionals (useComponent "picotts") [ pkgs.picotts ]
+        ++ lib.optionals (any useComponent componentsUsingPing) [ unixtools.ping ];
     };
 
     systemd.targets.home-assistant = rec {

nixos/modules/services/networking/nbd.nix

@@ -36,8 +36,6 @@ let
     generic = (
       cfg.server.extraOptions
       // {
-        user = "root";
-        group = "root";
         port = cfg.server.listenPort;
       }
       // (optionalAttrs (cfg.server.listenAddress != null) {
@@ -155,8 +153,8 @@ in
       before = [ "multi-user.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${pkgs.nbd}/bin/nbd-server -C ${serverConfig}";
-        Type = "forking";
+        ExecStart = "${pkgs.nbd}/bin/nbd-server -n -C ${serverConfig}";
+        Type = "simple";
 
         DeviceAllow = map (path: "${path} rw") allowedDevices;
         BindPaths = boundPaths;

nixos/modules/services/networking/reframe.nix

@@ -9,7 +9,7 @@ let
   iniFmt = pkgs.formats.ini { };
 in
 {
-  options.programs.reframe = {
+  options.services.reframe = {
     enable = lib.mkEnableOption "DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login…";
     package = lib.mkPackageOption pkgs "reframe" { };
     configs = lib.mkOption {
@@ -113,7 +113,7 @@ in
                   "cpu"
                   "gpu"
                 ];
-                default = true;
+                default = "cpu";
                 description = ''
                   Set to `gpu` to use GPU damage region detection, which may be more efficiency but may cause artifacts depending on GPU vendors.
                   Set to `cpu` to use CPU damage region detection if you get bugs with `gpu`.
@@ -173,7 +173,7 @@ in
       description = "ReFrame Remote Desktop";
     };
     users.groups.reframe = { };
-    environment.etc = builtins.mapAttrs' (
+    environment.etc = lib.mapAttrs' (
       name: value:
       lib.nameValuePair "reframe/${name}.conf" {
         mode = "0644";

nixos/modules/services/networking/sunshine.nix

@@ -147,7 +147,7 @@ in
       ];
     };
 
-    boot.kernelModules = [ "uinput" ];
+    hardware.uinput.enable = true;
 
     services.udev.packages = [ cfg.package ];
 

nixos/modules/services/web-apps/lasuite-docs.nix

@@ -17,6 +17,7 @@ let
     types
     optional
     optionalString
+    escapeShellArg
     ;
 
   cfg = config.services.lasuite-docs;
@@ -76,6 +77,20 @@ let
     SystemCallArchitectures = "native";
     UMask = "0077";
   };
+
+  # Convert environment variables to be used as systemd-run arguments
+  envArgs = lib.concatStringsSep " " (
+    lib.mapAttrsToList (name: value: "-E ${escapeShellArg "${name}=${value}"}") pythonEnvironment
+  );
+
+  # Easier usage of django manage.py stuff
+  manage = pkgs.writeShellScriptBin "lasuite-docs-manage" ''
+    exec ${lib.getExe' config.systemd.package "systemd-run"} \
+      -p User=${commonServiceConfig.User} -p DynamicUser=yes \
+      -p StateDirectory=${commonServiceConfig.StateDirectory} --working-directory=${commonServiceConfig.WorkingDirectory} \
+      --quiet --collect --pipe --pty \
+      ${envArgs} ${lib.getExe cfg.backendPackage} "$@"
+  '';
 in
 {
   options.services.lasuite-docs = {
@@ -346,6 +361,7 @@ in
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ manage ];
     systemd.services.lasuite-docs-postgresql-setup = mkIf cfg.postgresql.createLocally {
       wantedBy = [ "lasuite-docs.target" ];
       requiredBy = [ "lasuite-docs.service" ];
@@ -534,6 +550,10 @@ in
           recommendedProxySettings = true;
         };
 
+        locations."/static/" = {
+          alias = "${cfg.backendPackage}/share/static/";
+        };
+
         locations."/collaboration/ws/" = {
           proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
           recommendedProxySettings = true;

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -7,12 +7,16 @@
 }:
 let
   inherit (lib)
+    elem
     getExe
     mapAttrs
     mkEnableOption
     mkIf
+    mkMerge
     mkPackageOption
     mkOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
     types
     optional
     optionalString
@@ -77,12 +81,37 @@ let
   };
 in
 {
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "lasuite-meet" "backendPackage" ]
+      [ "services" "lasuite-meet" "package" ]
+    )
+    (mkRemovedOptionModule [
+      "services"
+      "lasuite-meet"
+      "frontendPackage"
+    ] "services.lasuite-mette.package.frotend should be used instead")
+  ];
+
   options.services.lasuite-meet = {
     enable = mkEnableOption "SuiteNumérique Meet";
 
-    backendPackage = mkPackageOption pkgs "lasuite-meet" { };
+    package = mkPackageOption pkgs "lasuite-meet" { };
 
-    frontendPackage = mkPackageOption pkgs "lasuite-meet-frontend" { };
+    addons = mkOption {
+      type = types.listOf (
+        types.enum [
+          "outlook"
+        ]
+      );
+      default = [ ];
+      example = ''
+        [
+          "outlook"
+        ]
+      '';
+      description = "Addons to use and configure";
+    };
 
     bind = mkOption {
       type = types.str;
@@ -295,7 +324,7 @@ in
       '';
       description = ''
         Configuration options of meet.
-        See https://github.com/suitenumerique/meet/blob/v${cfg.backendPackage.version}/docs/env.md
+        See https://github.com/suitenumerique/meet/blob/v${cfg.package.version}/docs/env.md
         `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-meet.redis.createLocally` is true.
         `DB_NAME` `DB_USER` and `DB_HOST` are set if `services.lasuite-meet.postgresql.createLocally` is true.
       '';
@@ -340,20 +369,20 @@ in
             )
           fi
         ''}
-        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.backendPackage} migrate
-          echo -n "${cfg.backendPackage.version}" > .version
+        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.package} migrate
+          echo -n "${cfg.package.version}" > .version
         fi
       '';
 
       environment = pythonEnvironment;
 
       serviceConfig = {
-        BindReadOnlyPaths = "${cfg.backendPackage}/share/static:/var/lib/lasuite-meet/static";
+        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
         ExecStart = utils.escapeSystemdExecArgs (
           [
-            (lib.getExe' cfg.backendPackage "gunicorn")
+            (lib.getExe' cfg.package "gunicorn")
             "--bind=${cfg.bind}"
           ]
           ++ cfg.gunicorn.extraArgs
@@ -381,7 +410,7 @@ in
 
       serviceConfig = {
         ExecStart = utils.escapeSystemdExecArgs (
-          [ (lib.getExe' cfg.backendPackage "celery") ]
+          [ (lib.getExe' cfg.package "celery") ]
           ++ cfg.celery.extraArgs
           ++ [
             "--app=meet.celery_app"
@@ -417,36 +446,97 @@ in
     services.nginx = mkIf cfg.enableNginx {
       enable = true;
 
-      virtualHosts.${cfg.domain} = {
-        root = cfg.frontendPackage;
+      virtualHosts.${cfg.domain} = mkMerge [
+        {
+          root = cfg.package.frontend;
 
-        extraConfig = ''
-          error_page 404 = /index.html;
-        '';
-
-        locations."/api" = {
-          proxyPass = "http://${cfg.bind}";
-          recommendedProxySettings = true;
-        };
-
-        locations."/admin" = {
-          proxyPass = "http://${cfg.bind}";
-          recommendedProxySettings = true;
-        };
-
-        locations."/static" = {
-          root = "${cfg.backendPackage}/share";
-        };
-
-        locations."/livekit" = mkIf cfg.livekit.enable {
-          proxyPass = "http://localhost:${toString config.services.livekit.settings.port}";
-          recommendedProxySettings = true;
-          proxyWebsockets = true;
           extraConfig = ''
-            rewrite ^/livekit/(.*)$ /$1 break;
+            error_page 404 = /index.html;
           '';
-        };
-      };
+
+          locations."/api" = {
+            proxyPass = "http://${cfg.bind}";
+            recommendedProxySettings = true;
+          };
+
+          locations."/admin" = {
+            proxyPass = "http://${cfg.bind}";
+            recommendedProxySettings = true;
+          };
+
+          locations."/static" = {
+            root = "${cfg.package}/share";
+          };
+        }
+        (mkIf cfg.livekit.enable {
+          locations."/livekit" = {
+            proxyPass = "http://localhost:${toString config.services.livekit.settings.port}";
+            recommendedProxySettings = true;
+            proxyWebsockets = true;
+            extraConfig = ''
+              rewrite ^/livekit/(.*)$ /$1 break;
+            '';
+          };
+        })
+        (mkIf (elem "outlook" cfg.addons) {
+          locations."= /.well-known/windows-app-web-link" = {
+            alias = pkgs.writeText "lasuite-meet-winsows-app-web-link.json" ''
+              [{
+                "packageFamilyName" : "Visio_g3z6ba6vek6vg",
+                "paths" : [ "*" ]
+              }]
+            '';
+            extraConfig = ''
+              default_type application/json;
+              add_header Content-Disposition "attachment; filename=windows-app-web-link";
+            '';
+          };
+
+          locations."= /addons/outlook/manifest.xml" = {
+            alias = pkgs.stdenv.mkDerivation {
+              name = "lasuite-meet-manifest.xml";
+              buildCommand = ''
+                substitute ${cfg.package.addons.outlook}/manifest.xml $out \
+                  --replace-fail "__APP_NAME__" "LaSuite Meet" \
+                  --replace-fail "https://localhost:3000/" "https://${cfg.domain}/addons/outlook/"
+              '';
+            };
+            extraConfig = ''
+              add_header Access-Control-Allow-Origin "*";
+              add_header Cache-Control "no-cache, no-store, must-revalidate";
+              add_header X-Frame-Options "DENY";
+              add_header Content-Security-Policy "frame-ancestors 'none'";
+            '';
+          };
+
+          locations."/addons/outlook/" = {
+            alias = "${cfg.package.addons.outlook}/";
+            extraConfig = ''
+              error_page 404 =200 /index.html;
+              add_header Cache-Control "no-cache, no-store, must-revalidate";
+              add_header Pragma "no-cache" always;
+              add_header Expires 0 always;
+
+              set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
+
+              set $nonce $request_id;
+
+              set $csp "upgrade-insecure-requests; ";
+              set $csp "''${csp}frame-ancestors ''${ms_domains}; ";
+              set $csp "''${csp}script-src 'nonce-''${nonce}' 'strict-dynamic'; ";
+              set $csp "''${csp}connect-src 'self' ''${ms_domains}; ";
+              set $csp "''${csp}frame-src 'none'; ";
+              set $csp "''${csp}object-src 'none'; ";
+              set $csp "''${csp}base-uri 'none'; ";
+
+              add_header Content-Security-Policy $csp;
+
+              sub_filter 'NONCE_PLACEHOLDER' $nonce;
+              sub_filter_once off;
+            '';
+          };
+        })
+      ];
     };
   };
 

nixos/modules/services/web-apps/peertube.nix

@@ -525,7 +525,7 @@ in
       environment = env;
 
       path = with pkgs; [
-        nodejs_20
+        cfg.package.nodejs
         yarn
         ffmpeg-headless
         openssl
@@ -946,7 +946,7 @@ in
       })
       (lib.attrsets.setAttrByPath
         [ cfg.user "packages" ]
-        [ peertubeEnv pkgs.nodejs_20 pkgs.yarn pkgs.ffmpeg-headless ]
+        [ peertubeEnv cfg.package.nodejs pkgs.yarn pkgs.ffmpeg-headless ]
       )
       (lib.mkIf cfg.redis.enableUnixSocket {
         ${config.services.peertube.user}.extraGroups = [ "redis-peertube" ];

nixos/modules/services/web-apps/rustical.nix

@@ -0,0 +1,183 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.rustical;
+
+  format = pkgs.formats.toml { };
+  configFile = format.generate "rustical.toml" cfg.settings;
+in
+
+{
+  options.services.rustical = {
+    enable = mkEnableOption "RustiCali CalDAV/CardDAV server";
+
+    package = mkPackageOption pkgs "rustical" { };
+
+    settings = mkOption {
+      description = ''
+        Your {file}`/etc/rustical/config.toml` as a Nix attribute set.
+
+        Possible options can be found in the [Config struct]. A default
+        configuration can be viewed by running `rustical gen-config`.
+
+        [Config struct]: https://lennart-k.github.io/rustical/_crate/rustical/config/struct.Config.html
+      '';
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          data_store.sqlite = {
+            db_url = mkOption {
+              type = types.path;
+              default = "/var/lib/rustical/db.sqlite3";
+              description = ''
+                Path where the sqlite database is stored.
+              '';
+            };
+          };
+
+          frontend = {
+            enabled = mkEnableOption "the HTTP frontend" // {
+              default = true;
+            };
+          };
+
+          http = {
+            host = mkOption {
+              type = types.str;
+              default = "[::1]";
+              example = "[::]";
+              description = ''
+                Host address to bind the HTTP service to.
+
+                :::{.note}
+                Rustical expects to be hosted behind a reverse proxy that
+                provides HTTPS. Without HTTPS, the web frontend and some clients
+                (e.g. Apple Calendar) may not work.
+                :::
+              '';
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 4000;
+              description = ''
+                Port to bind the HTTP service to.
+              '';
+            };
+          };
+
+          dav_push.enabled = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether to enable [WebDav Push] support.
+
+              This allows the server to notify clients about changed data.
+
+              [WebDav Push]: https://github.com/bitfireAT/webdav-push/
+            '';
+          };
+
+          nextcloud_login.enabled = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether to emulate the Nextcloud login flow.
+
+              This is supported in [DAVx5] and enables automatic app token generation.
+
+              [DAVx5]: https://www.davx5.com/
+            '';
+          };
+        };
+      };
+    };
+
+    environmentFiles = mkOption {
+      type = with types; listOf path;
+      default = [ ];
+      example = [ "/run/keys/rustical.env" ];
+      description = ''
+        Environment files to load into the runtime environment.
+
+        Check the documentation for how to construct [environment variables].
+
+        :::{.tip}
+        Environment variables can substitute any config value and are useful for
+        hiding secrets.
+        :::
+
+        [environment variables]: https://lennart-k.github.io/rustical/installation/configuration/#environment-variables
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # install the config at a path where the cli will find it
+    environment.etc."rustical/config.toml".source = configFile;
+
+    # provide the rustical cli
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.rustical = {
+      description = "RustiCal CalDav/CardDav server";
+      documentation = [ "https://lennart-k.github.io/rustical/" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = lib.getExe cfg.package;
+        EnvironmentFile = cfg.environmentFiles;
+        Restart = "on-failure";
+        StateDirectory = "rustical";
+
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/modules/system/boot/kernel.nix

@@ -412,7 +412,9 @@ in
 
           echo -n "$kernelParams" > $out/kernel-params
 
-          ln -s ${initrdPath} $out/initrd
+          ${optionalString config.boot.initrd.enable ''
+            ln -s ${initrdPath} $out/initrd
+          ''}
 
           ${optionalString (config.boot.initrd.secrets != { }) ''
             ln -s ${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets $out

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -395,7 +395,7 @@ def option_from_config(name: str, config_path: List[str]) -> str:
         return ""
     if isinstance(value, bool):
         value = bool_to_yes_no(value)
-    return f"{name}: {config(*config_path)}\n"
+    return f"{name}: {value}\n"
 
 
 def install_bootloader() -> None:

nixos/modules/tasks/filesystems/zfs.nix

@@ -204,11 +204,11 @@ let
             poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
           fi
           if poolImported "${pool}"; then
-          ${lib.optionalString config.boot.initrd.clevis.enable (
-            lib.concatMapStringsSep "\n" (
-              elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key -L prompt ${elem} || true "
-            ) (lib.filter (p: (lib.elemAt (lib.splitString "/" p) 0) == pool) clevisDatasets)
-          )}
+            ${lib.optionalString config.boot.initrd.clevis.enable (
+              lib.concatMapStringsSep "\n" (
+                elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key -L prompt ${elem} || true "
+              ) (lib.filter (p: (lib.elemAt (lib.splitString "/" p) 0) == pool) clevisDatasets)
+            )}
 
 
             ${lib.optionalString keyLocations.hasKeys ''

nixos/modules/virtualisation/kvmgt.nix

@@ -24,9 +24,10 @@ in
   options = {
     virtualisation.kvmgt = {
       enable = mkEnableOption ''
-        KVMGT (iGVT-g) VGPU support. Allows Qemu/KVM guests to share host's Intel integrated graphics card.
-        Currently only one graphical device can be shared. To allow users to access the device without root add them
-        to the kvm group: `users.extraUsers.<yourusername>.extraGroups = [ "kvm" ];`
+        KVMGT (iGVT-g) VGPU support.
+        When enabled on a host, allows Qemu/KVM guests to share host's Intel integrated graphics card.
+        Currently only one graphical device can be shared.
+        To allow host users to access the device without root add them to the kvm group: `users.extraUsers.<yourusername>.extraGroups = [ "kvm" ];`
       '';
       # multi GPU support is under the question
       device = mkOption {
@@ -38,8 +39,8 @@ in
         default = { };
         type = with types; attrsOf (submodule [ { options = vgpuOptions; } ]);
         description = ''
-          Virtual GPUs to be used in Qemu. You can find devices via {command}`ls /sys/bus/pci/devices/*/mdev_supported_types`
-          and find info about device via {command}`cat /sys/bus/pci/devices/*/mdev_supported_types/i915-GVTg_V5_4/description`
+          Virtual GPUs of the host to be used in Qemu.
+          You can find devices via {command}`ls /sys/bus/pci/devices/*/mdev_supported_types` and find info about device via {command}`cat /sys/bus/pci/devices/*/mdev_supported_types/i915-GVTg_V5_4/description`
         '';
         example = {
           i915-GVTg_V5_8.uuid = [ "a297db4a-f4c2-11e6-90f6-d3b88d6c9525" ];

nixos/tests/all-tests.nix

@@ -1469,6 +1469,7 @@ in
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
   rush = runTest ./rush.nix;
+  rustical = runTest ./web-apps/rustical.nix;
   rustls-libssl = runTest ./rustls-libssl.nix;
   rxe = runTest ./rxe.nix;
   sabnzbd = runTest ./sabnzbd.nix;

nixos/tests/harmonia.nix

@@ -35,7 +35,7 @@
     ''
       start_all()
 
-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")
 
       client01.wait_until_succeeds("curl -f http://harmonia:5000/nix-cache-info | grep '${toString nodes.harmonia.services.harmonia.cache.settings.priority}' >&2")
       client01.succeed("curl -f http://harmonia:5000/version | grep '${nodes.harmonia.services.harmonia.package.version}' >&2")

nixos/tests/home-assistant.nix

@@ -11,7 +11,10 @@ in
   meta.maintainers = lib.teams.home-assistant.members;
 
   nodes.hass =
-    { pkgs, ... }:
+    {
+      pkgs,
+      ...
+    }:
     {
       services.postgresql = {
         enable = true;
@@ -24,6 +27,9 @@ in
         ];
       };
 
+      # required for dbus activation in the bluetooth component
+      hardware.bluetooth.enable = true;
+
       services.home-assistant = {
         enable = true;
         inherit configDir;
@@ -65,6 +71,11 @@ in
           mini-graph-card
         ];
 
+        # test loading themes
+        themes = with pkgs.home-assistant-themes; [
+          material-you-theme
+        ];
+
         config = {
           homeassistant = {
             name = "Home";
@@ -77,9 +88,30 @@ in
           # configure the recorder component to use the postgresql db
           recorder.db_url = "postgresql://@/hass";
 
-          # without these some components that are loaded anyway fail to find
-          # their dependencies
-          default_config = { };
+          # this is effecitvely default_config (2026.5.0), but with components
+          # skipped that would cause ERRORs in the sandbox
+          bluetooth = { };
+          cloud = { };
+          conversation = { };
+          dhcp = { };
+          energy = { };
+          file = { };
+          # Requires go2rtc service
+          # go2rtc = { };
+          history = { };
+          # Requires DNS and HTTP queries
+          # homeassistant_alerts = { };
+          logbook = { };
+          media_source = { };
+          mobile_app = { };
+          my = { };
+          ssdp = { };
+          stream = { };
+          sun = { };
+          usage_prediction = { };
+          usb = { };
+          webhook = { };
+          zeroconf = { };
 
           # include some popular integrations, that absolutely shouldn't break
           knx = { };
@@ -223,6 +255,11 @@ in
           hass.succeed("grep -q 'mini-graph-card-bundle.js' '${configDir}/configuration.yaml'")
           hass.succeed("curl --fail http://localhost:8123/local/nixos-lovelace-modules/mini-graph-card-bundle.js")
 
+      with subtest("Check that themes are referenced and installed"):
+          hass.succeed("grep -q '!include_dir_merge_named.*themes' '${configDir}/configuration.yaml'")
+          themes_dir = hass.succeed("sed -n 's/.*!include_dir_merge_named \\(.*\\)/\\1/p' '${configDir}/configuration.yaml'").strip()
+          hass.succeed(f"test -f {themes_dir}/material_you.yaml")
+
       with subtest("Check that optional dependencies are in the PYTHONPATH"):
           env = get_unit_property("Environment")
           python_path = env.split("PYTHONPATH=")[1].split()[0]

nixos/tests/invidious.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   name = "invidious";
 
@@ -24,7 +24,7 @@
         networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
       };
     machine =
-      { lib, pkgs, ... }:
+      { pkgs, ... }:
       {
         services.invidious = {
           enable = true;
@@ -142,7 +142,7 @@
       # invidious does connect to the sig helper though and crashes when the sig helper is not available
       machine.wait_for_open_port(80)
       curl_assert_status_code("http://invidious.example.com/search", 200)
-      machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
+      machine.succeed("journalctl -eu invidious.service | grep -o \"WARNING: Invidious companion is required to view and playback videos\"")
 
       postgres_tcp.wait_for_unit("postgresql.target")
       activate_specialisation("postgres-tcp")

nixos/tests/ncps-ha-pg-redis.nix

@@ -180,7 +180,7 @@ in
 
       start_all()
 
-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")
 
       ncps0.wait_for_unit("ncps.service")
       ncps1.wait_for_unit("ncps.service")

nixos/tests/ncps.nix

@@ -66,7 +66,7 @@
     ''
       start_all()
 
-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")
 
       ncps.wait_for_unit("ncps.service")
 

nixos/tests/systemd-initrd-swraid.nix

@@ -23,12 +23,7 @@
         mdadm
         e2fsprogs
       ]; # for mdadm and mkfs.ext4
-      boot.swraid = {
-        enable = true;
-        mdadmConf = ''
-          ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-        '';
-      };
+      boot.swraid.enable = true;
       environment.etc."mdadm.conf".text = ''
         MAILADDR test@example.com
       '';
@@ -64,12 +59,12 @@
     assert "hello" in machine.succeed("cat /test")
     assert "md0" in machine.succeed("cat /proc/mdstat")
 
-    expected_config = """MAILADDR test@example.com
+    # Verify the RAID array was properly auto-detected and assembled
+    detail = machine.succeed("mdadm --detail /dev/md0")
+    assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
+    assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
+    assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"
 
-    ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-    """
-    got_config = machine.execute("cat /etc/mdadm.conf")[1]
-    assert expected_config == got_config, repr((expected_config, got_config))
     machine.wait_for_unit("mdmonitor.service")
   '';
 }

nixos/tests/web-apps/rustical.nix

@@ -0,0 +1,72 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
+  name = "rustical";
+
+  meta.maintainers = pkgs.rustical.meta.maintainers;
+
+  nodes.machine =
+    {
+      pkgs,
+      ...
+    }:
+    {
+      services.rustical.enable = true;
+      environment.systemPackages = with pkgs; [ calendar-cli ];
+    };
+
+  testScript =
+    {
+      nodes,
+      ...
+    }:
+    let
+      port = toString nodes.machine.services.rustical.settings.http.port;
+      url = "http://localhost:${toString port}";
+
+      createPrincipalScript = pkgs.writeScript "rustical-create-principal" ''
+        #!${lib.getExe pkgs.expect}
+        spawn rustical principals create alice --password
+        expect "Enter your password:\r"
+        send "foobar\r"
+        expect eof
+      '';
+
+      calendarCliConfig = (pkgs.formats.json { }).generate "rustical-test-calendar-cli.json" {
+        default = {
+          caldav_user = "alice";
+          caldav_url = "${url}/caldav/";
+          calendar_url = "${url}/caldav/principal/alice";
+        };
+        testcal = {
+          inherits = "default";
+          calendar_url = "${url}/caldav/principal/alice/testcal";
+        };
+      };
+    in
+    # python
+    ''
+      machine.wait_for_unit("rustical.service")
+      machine.wait_for_open_port(${port})
+
+      with subtest("Smoketest"):
+        machine.succeed("curl --fail ${url}")
+
+      with subtest("Create principal"):
+        machine.succeed("${createPrincipalScript}")
+        machine.succeed("rustical principals list | grep alice")
+
+      with subtest("Generate token for principal"):
+        machine.succeed("curl -f -c cookies.txt -d 'username=alice&password=foobar' ${url}/frontend/login")
+        machine.succeed("curl -f -b cookies.txt -d 'name=mytoken' ${url}/frontend/user/alice/app_token > token.txt")
+
+      with subtest("Interact with caldav"):
+        machine.succeed('calendar-cli --config-file ${calendarCliConfig} --caldav-pass "$(cat token.txt)" calendar create testcal')
+        machine.succeed('calendar-cli --config-file ${calendarCliConfig} --config-section testcal --caldav-pass "$(cat token.txt)" calendar add 2013-10-01 testevent')
+
+      machine.log(machine.execute("systemd-analyze security rustical.service | grep -v ✓")[1])
+    '';
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -13,13 +13,13 @@ let
 
   pname = "ghostel";
 
-  version = "0.18.1-unstable-2026-04-24";
+  version = "0-unstable-2026-05-06";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "fdfb68f70ca6f43277ef8a0ba4103631857e4ad4";
-    hash = "sha256-u3zUj5uUHqFEP7mjmADNB6n6n/LmGR6ne0ylalop8WI=";
+    rev = "5bce751687f3b33978a4244a1611648bbedb7124";
+    hash = "sha256-MAV3iQeriZhE9SGwVEnKs2rwebbEnPP1LiHuCAjlGE8=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {

pkgs/applications/editors/kakoune/default.nix

@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kakoune-unwrapped";
-  version = "2025.06.03";
+  version = "2026.04.12";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AJvh6NVFpbPsyzfeii/5muE+i4TwfxhwhDVgMLYOJCM=";
+    hash = "sha256-m8q1+TooDREbQD848ciHxeHwMajmlmhAhCqGmdbThIU=";
   };
 
   makeFlags = [

pkgs/applications/editors/okteta/default.nix

@@ -1,50 +1,55 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  cmake,
   extra-cmake-modules,
-  kdoctools,
   wrapQtAppsHook,
-  qtscript,
-  kconfig,
-  kinit,
+  shared-mime-info,
+  xz,
+  qttools,
   karchive,
-  kcrash,
   kcmutils,
+  kconfig,
   kconfigwidgets,
+  kcrash,
   knewstuff,
   kparts,
-  qca-qt5,
-  shared-mime-info,
+  qca,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "okteta";
-  version = "0.26.25";
+  version = "0.26.25-unstable-2026-04-28";
 
-  src = fetchurl {
-    url = "mirror://kde/stable/okteta/${finalAttrs.version}/src/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-K+GJG/SYyzgDDKXbGtAixQJVfBwLj/asP9rIJUpbt2s=";
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "utilities";
+    repo = "okteta";
+    rev = "9ab055f50e7569c9a0bc401be4b5686dc1e61dcc";
+    hash = "sha256-1ih0kFS7opA5w1QyB7MQAOYFoSAUPKNM8fRi1G/mq2U=";
   };
 
   nativeBuildInputs = [
-    qtscript
+    cmake
     extra-cmake-modules
-    kdoctools
     wrapQtAppsHook
   ];
-  buildInputs = [ shared-mime-info ];
 
-  propagatedBuildInputs = [
-    kconfig
-    kinit
+  buildInputs = [
+    shared-mime-info
+    xz
+
+    qttools
+
+    karchive
     kcmutils
+    kconfig
     kconfigwidgets
+    kcrash
     knewstuff
     kparts
-    qca-qt5
-    karchive
-    kcrash
+    qca
   ];
 
   outputs = [

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -4950,10 +4950,13 @@ assertNoAdditions {
     };
   });
 
-  vim-flog = super.vim-flog.overrideAttrs {
+  vim-flog = super.vim-flog.overrideAttrs (old: {
     # Not intended to be required, used by vim plugin
     nvimSkipModules = "flog.graph_bin";
-  };
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
 
   vim-fugitive = super.vim-fugitive.overrideAttrs (old: {
     meta = old.meta // {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-cn/GLWORkVa/mJRdpV5jqOm5iFW1QFFrTlGPGCzm1/o=";
+          hash = "sha256-6+fMMB8Vgvmi3JO6YMqMiiHWdlq+PfTD1/zemIqf5sw=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-w7RB1WI5Lyn8LkFarIgwSTbuECuLF0wT5ht3jnGO+9A=";
+          hash = "sha256-HA2I2+4F5NSLWJJpArTDcEHIAJShARjgomM2GcVwj5Q=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-XTE03L6SrIGZNaz2/XSKGLp3D45EWeh6RUxgBabURz0=";
+          hash = "sha256-MaclGEzgUAHLV2Fe8O3ex6yjfnM73Clory0n+BVNZIs=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Xq2+C9/g9y+K9s6qIMgUZxyyPaMSLQI31uLyR5dAyww=";
+          hash = "sha256-YR/geLezoi+UPa7Eo0M4wQmRGuHiRTK74BdkGGOxPis=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.131";
+      version = "2.1.133";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -871,8 +871,8 @@ let
           mktplcRef = {
             name = "catppuccin-vsc";
             publisher = "catppuccin";
-            version = "3.18.1";
-            hash = "sha256-Kph5nQgbRSgDVqo2n2eXoQXh7ga0o8/oNkQyoSZxHZo=";
+            version = "3.19.0";
+            hash = "sha256-6/NHZkg37b6RyZIP89FMltSii+7sC5UTfHYFgyYyl4A=";
           };
           meta = {
             changelog = "https://marketplace.visualstudio.com/items/Catppuccin.catppuccin-vsc/changelog";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.39.0";
-          hash = "sha256-kOzr8YjwHdA3Tgo4JeEAWda4tBrXjMQNBITNhmy9cP4=";
+          version = "0.40.3";
+          hash = "sha256-NGC6uW1biseqQ04fD3K4mK4D4rcGVqt0LBlGFC1Exu8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -3534,8 +3534,8 @@ let
         mktplcRef = {
           publisher = "mvllow";
           name = "rose-pine";
-          version = "2.15.1";
-          hash = "sha256-GCN201yqr4lf2rc0ZV+iWkZi69qGOXFKhLPMhJ08U2w=";
+          version = "2.15.2";
+          hash = "sha256-5jXlCFk/86BL1yojTRuhRzS3XqcwcCpl/gmApcTdlBw=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -3898,8 +3898,8 @@ let
         mktplcRef = {
           publisher = "redhat";
           name = "vscode-yaml";
-          version = "1.22.0";
-          hash = "sha256-Xsy2350zAxSEhJgCl5/bVwWEwaXgmnN0Y/orDjwNuw4=";
+          version = "1.23.0";
+          hash = "sha256-GC7AIQIUw+F5rBscTe+ulKt/97s7p636TLRvmcT9b9c=";
         };
         meta = {
           description = "YAML Language Support by Red Hat, with built-in Kubernetes syntax support";
@@ -4218,8 +4218,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.24";
-          hash = "sha256-SKDg0AVzlDFPq3ZHE65vX6OUPWeZGTJb5DaVs/y14UY=";
+          version = "0.8.25";
+          hash = "sha256-0yOtvHL24eJizmzXAC956Tx9eNJaWDPl/OAhmFv2KJk=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
@@ -4530,8 +4530,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "109.15.0";
-          hash = "sha256-/1we+6X3l7MCx96ELz7wg6oDDAcYCJBt7XJ4X0ihwx0=";
+          version = "110.0.0";
+          hash = "sha256-l5L0uqHpBR6nWzr8/edz3EU8+BP9yqRRFhpnngG0RGY=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";

pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix

@@ -26,8 +26,8 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      fetcherVersion = 2;
-      hash = "sha256-mr5GwwfuNoLhKM5bAhNAO3j0ow4FcyZhvQlVnAENoyg=";
+      fetcherVersion = 3;
+      hash = "sha256-Yuxuqr1BiviSw+dGNHLs2jAy8ADlBvRks6Kmy7FmCMw=";
     };
 
     postPatch = ''

pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.14.1";
-    hash = "sha256-lsbiKzZTlkq/9K7ptLg0kHAd4i5OyNh2pLGGYUOJS9A=";
+    version = "10.15.2";
+    hash = "sha256-H/WJdkwfiNIFBc4dW6XqB6QopKZYjYN/zDVUpoY3erk=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";

pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix

@@ -34,7 +34,7 @@ let
     };
     makeCacheWritable = true;
 
-    buildInputs = lib.optionals stdenv.isLinux [
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
       libsecret
     ];
     nativeBuildInputs = [
@@ -42,10 +42,10 @@ let
       nodejs-slim.python
       npmHooks.npmConfigHook
     ]
-    ++ lib.optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       pkg-config
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools.libtool
       clang_20 # clang_21 breaks @vscode/vsce's optional dependency keytar
     ];

pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix

@@ -32,7 +32,7 @@ let
       hash = "sha256-vktxhQA2a+D9Nr4vhbmGCnNdGzt0U89K50g0SgiV5SE=";
     };
 
-    buildInputs = lib.optionals stdenv.isLinux [
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
       libsecret
     ];
 
@@ -41,10 +41,10 @@ let
       nodejs-slim.python
       npmHooks.npmConfigHook
     ]
-    ++ lib.optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       pkg-config
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       clang_20 # clang_21 breaks @vscode/vsce's optional dependency keytar
     ];
 

pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix

@@ -25,8 +25,8 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      fetcherVersion = 2;
-      hash = "sha256-kQjxcqHEClQtG6x2QM1/zixN6rvcEivX8vicNydDdOw=";
+      fetcherVersion = 3;
+      hash = "sha256-t2sPuhn8xdk6hGfmViPGG+5TAhtBBOMYNoOb6DlPzws=";
     };
 
     nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix

@@ -47,7 +47,7 @@ let
       pkg-config
 
     ]
-    ++ lib.optionals stdenv.isDarwin [ clang_20 ]; # clang_21 breaks keytar
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks keytar
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
     installPhase = ''

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.81.0";
-    hash = "sha256-gVQmKuyUH+bXpr7X2Z23U2oKFnAV2mxhckjef2uL8KQ=";
+    version = "3.82.0";
+    hash = "sha256-+CtWfRGumMTFckmU9Z8TAwrn35WiUrri1x6XL9khOnM=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/node_deps.nix

@@ -22,7 +22,7 @@ buildNpmPackage {
     python3
     pkg-config
   ]
-  ++ lib.optionals stdenv.isDarwin [ clang_20 ]; # clang_21 breaks keytar
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks keytar
 
   buildInputs = [ libsecret ];
 

pkgs/applications/editors/vscode/vscode.nix

@@ -35,17 +35,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-YF0zu0aqZpGGGaf5uNqaVaL1sMQuEVIzZ1Mczuwnfq4=";
-      x86_64-darwin = "sha256-zv6Ryr1wTR9+osEhtAHO4viXAI4pc7Yk47dex622ymg=";
-      aarch64-linux = "sha256-Mym9ijieF7jVAyZJ/3sO0Wp5JJ4c+/8psCjxrlEH/ok=";
-      aarch64-darwin = "sha256-qLshyr9jGyx5dxUGnf5GftlTSoA1OeAWtIvK1aDxqCQ=";
-      armv7l-linux = "sha256-JdyQ+65gJCU8Ye2darRV4Hi0//0imkX56bvc52MNLcM=";
+      x86_64-linux = "sha256-HcZIRGB0y8U5huxXN9jNrhMD0Jjmn+QNUU60EHGduXo=";
+      x86_64-darwin = "sha256-mMDxEAt/Lst4ifeczcL+QT8mVVXNk8fDNTM1YHGZ8tY=";
+      aarch64-linux = "sha256-o0JV1Vc6utTmJkH9uTSylBsYM3mAfiDIgwg3LUOBWb0=";
+      aarch64-darwin = "sha256-8ixVOUe4EcNX/z0jnux1hXOhnG1JuhbssH2BARqU80o=";
+      armv7l-linux = "sha256-KxrSOVCdfa4L9RlnHybwGLRciMFwC/COsctX+5nqR/c=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.118.1";
+  version = "1.119.0";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -53,7 +53,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "034f571df509819cc10b0c8129f66ef77a542f0e";
+  rev = "8b640eef5a6c6089c029249d48efa5c99adf7d51";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -86,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-is+djb3G/Lchc4+rqNgjW5xH6vD+OuHDKH7MBKPAJoA=";
+      hash = "sha256-FyRpbjxY8PWr8z+ttn1H93ud4raFAJz704Vn38+LYCM=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "95b5274dfeda36f7e77c70daa666a63302ad83cf";
-    hash = "sha256-BEt2g63jBOrgWk0tYp8DJVC65AbeSVRQz9rIMwjj2Sg=";
+    rev = "9ba79648d6ec85e833aef719d7f359117498d89c";
+    hash = "sha256-VSZelshWjMxIe8sumNZZ6WHm1WTE9r2xm62og0YLGlY=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ab72423afd429c1e96ca56fbd39094a71270842b";
-    hash = "sha256-j1ZCbB0hKcxay/0BkkuoncYPAkMTgSGEAOzYNgJaAh4=";
+    rev = "c699953afa01bc3f179edbcb14c4cfbeee6107a2";
+    hash = "sha256-s009GuPnsufDT70dBmhwfZmYjdf7pYO13FjycYvUF4c=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/desmume.nix

@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume";
-    rev = "a4db60dc63f36134ffebfe524b56e87a0b05f20f";
-    hash = "sha256-v9jppfo85wR4KrblE9HtI/psQiQafn4OIXmDofxqOfc=";
+    rev = "a55c393de8ecf19df8111f65b8e12d08b9616520";
+    hash = "sha256-0+uSOg1asszgnDbdRsfWQY/E2Ky2tK3KxkcNV2mGjBQ=";
   };
 
   extraBuildInputs = [

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-04-30";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "806cbc866c973caf442b4b6c6058f867b36bd1fb";
-    hash = "sha256-kHB2Zz6mjhZiYDtoMIuaFvB2C/RIU89e2JNeBzHgIuU=";
+    rev = "776ae715211d3ef2413b2828e9e9d50d869a6822";
+    hash = "sha256-NgPs8H8/ysD18J2G9StaLM5e05EzgjLW8c2kTrcOXZI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2010.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-05-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "a7a4bfaed4c6408908c76af20ad625e1645c3d11";
-    hash = "sha256-mtTgh/koM7jS7/cH7qRgTa+xJXBBJSdxHHbhOd/q4i4=";
+    rev = "d9cba8a41b3407ebb929816a7033e0407fd7b2d0";
+    hash = "sha256-OdJStJK823PayWS+bmwG+kDrdx6KeVWYiSAu61C9UFs=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];

pkgs/applications/emulators/wine/base.nix

@@ -268,16 +268,6 @@ stdenv.mkDerivation (
           }
         '';
 
-    # Fix dcomp test for aarch64
-    postPatch = lib.optionalString (useStaging && stdenv.hostPlatform.isAarch64) ''
-      if [ -f dlls/dcomp/tests/dcomp.c ]; then
-        substituteInPlace dlls/dcomp/tests/dcomp.c \
-          --replace-fail \
-            '#error "Unsupported architecture"' \
-            '__asm__ __volatile__("mov %0, sp" : "=r"(stack_pointer));'
-      fi
-    '';
-
     configureFlags =
       prevConfigFlags
       ++ lib.optionals waylandSupport [ "--with-wayland" ]

pkgs/applications/emulators/wine/sources.nix

@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.7";
+    version = "11.8";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-sBqyHHn+3mx71THUadma/Z3N9T6ymviK2sajMutDX58=";
+    hash = "sha256-U6qFmV1Ll/ARahxWuKahQXcw71mid4GdLT0xNk6lVrA=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-EjAmwSZu/Q/8QfFERnV5iz1n5CsWPneBHflQDaD4LAc=";
+      hash = "sha256-lW5dfCfsB+z84mlLpfmkR7QDxmhL+RcBufSftUutHto=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/graphics/inkscape/default.nix

@@ -76,7 +76,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "inkscape";
-  version = "1.4.3";
+  version = "1.4.4";
   outputs = [
     "out"
     "man"
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://inkscape.org/release/inkscape-${finalAttrs.version}/source/archive/xz/dl/inkscape-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-6DosPbVwtsWh/w/M/nCYg3s/a9dLEzVnk3yKkXEO0dE=";
+    sha256 = "sha256-u85XU6Hgi4caXPFsZl6wYHAKqrmmo3ncY/TE2bO4hW4=";
   };
 
   # Inkscape hits the ARGMAX when linking on macOS. It appears to be

pkgs/applications/misc/cask-server/default.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  extra-cmake-modules,
+  kdePackages,
   wrapQtAppsHook,
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     wrapQtAppsHook
   ];
 

pkgs/applications/misc/diffpdf/default.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase =
-    if stdenv.isDarwin then
+    if stdenv.hostPlatform.isDarwin then
       ''
         mkdir -p "$out"
         mv diffpdf.app "$out"/

pkgs/applications/misc/k4dirstat/default.nix

@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  extra-cmake-modules,
-  wrapQtAppsHook,
-  kiconthemes,
-  kio,
-  kjobwidgets,
-  kxmlgui,
-  testers,
-  k4dirstat,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "k4dirstat";
-  version = "3.4.3";
-
-  src = fetchFromGitHub {
-    owner = "jeromerobert";
-    repo = "k4dirstat";
-    rev = version;
-    hash = "sha256-TXMUtiPS7qRLm6cCy2ZntYrcNJ0fn6X+3o3P5u7oo08=";
-  };
-
-  nativeBuildInputs = [
-    extra-cmake-modules
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    kiconthemes
-    kio
-    kjobwidgets
-    kxmlgui
-  ];
-
-  passthru.tests.version = testers.testVersion {
-    package = k4dirstat;
-    command = "k4dirstat -platform offscreen --version &>/dev/stdout";
-  };
-
-  meta = {
-    homepage = "https://github.com/jeromerobert/k4dirstat";
-    description = "Small utility program that sums up disk usage for directory trees";
-    mainProgram = "k4dirstat";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.raboof ];
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/applications/misc/ksmoothdock/default.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  extra-cmake-modules,
-  wrapQtAppsHook,
-  kactivities,
-  qtbase,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "KSmoothDock";
-  version = "6.3";
-
-  src = fetchFromGitHub {
-    owner = "dangvd";
-    repo = "ksmoothdock";
-    rev = "v${version}";
-    sha256 = "sha256-hO7xgjFMFrEhQs3oc2peFTjSVEDsl7Ma/TeVybEZMEk=";
-  };
-
-  # Upstream seems dead and there are new deprecation warnings in KF5.100
-  # Remember, kids: friends don't let friends build with -Werror
-  postPatch = ''
-    substituteInPlace src/CMakeLists.txt --replace "-Werror" ""
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    kactivities
-    qtbase
-  ];
-
-  cmakeDir = "../src";
-
-  meta = {
-    description = "Cool desktop panel for KDE Plasma 5";
-    mainProgram = "ksmoothdock";
-    license = lib.licenses.mit;
-    homepage = "https://dangvd.github.io/ksmoothdock/";
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/applications/misc/kup/default.nix

@@ -1,63 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  extra-cmake-modules,
-  shared-mime-info,
-  wrapQtAppsHook,
-  kcoreaddons,
-  kdbusaddons,
-  ki18n,
-  kio,
-  solid,
-  kidletime,
-  knotifications,
-  kconfig,
-  kinit,
-  kjobwidgets,
-  kcmutils,
-  plasma-framework,
-  libgit2,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "kup";
-  version = "0.10.0";
-
-  src = fetchFromGitLab {
-    domain = "invent.kde.org";
-    repo = "kup";
-    owner = "system";
-    rev = "kup-${version}";
-    hash = "sha256-G/GXmcQI1OBnCE7saPHeHDAMeL2WR6nVttMlKV2e01I=";
-  };
-
-  nativeBuildInputs = [
-    extra-cmake-modules
-    shared-mime-info
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    kcoreaddons
-    kdbusaddons
-    ki18n
-    kio
-    solid
-    kidletime
-    knotifications
-    kconfig
-    kinit
-    kjobwidgets
-    plasma-framework
-    libgit2
-    kcmutils
-  ];
-
-  meta = {
-    description = "Backup tool for KDE";
-    homepage = "https://apps.kde.org/kup";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ lib.maintainers.pwoelfel ];
-  };
-}

pkgs/applications/misc/pure-maps/default.nix

@@ -5,7 +5,6 @@
   cmake,
   qttools,
   wrapQtAppsHook,
-  kirigami2,
   qtquickcontrols2,
   qtlocation,
   qtsensors,
@@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    kirigami2
     qtquickcontrols2
     qtlocation
     qtsensors
@@ -47,7 +45,7 @@ stdenv.mkDerivation rec {
     s2geometry
   ];
 
-  cmakeFlags = [ "-DFLAVOR=kirigami" ];
+  cmakeFlags = [ "-DFLAVOR=qtcontrols" ];
 
   pythonPath = with python3.pkgs; [ gpxpy ];
 

pkgs/applications/misc/qelectrotech/default.nix

@@ -4,51 +4,63 @@
   fetchFromGitHub,
   installShellFiles,
   pkg-config,
-  qmake,
+  cmake,
   qtbase,
-  kcoreaddons,
-  kwidgetsaddons,
   qtsvg,
   wrapQtAppsHook,
+  qttools,
+  pugixml,
 }:
-
+let
+  singleApplication = fetchFromGitHub {
+    owner = "itay-grudev";
+    repo = "SingleApplication";
+    tag = "v3.2.0";
+    hash = "sha256-qjpPYPe1Oism6TetD/dMvTo1qyZKOsOPW+MzzNpJf3A=";
+  };
+in
 stdenv.mkDerivation rec {
   pname = "qelectrotech";
-  version = "0.9.0";
+  version = "0.100";
 
   src = fetchFromGitHub {
     owner = "qelectrotech";
     repo = "qelectrotech-source-mirror";
-    tag = "0.9";
-    hash = "sha256-tj8q+mRVtdeDXbpiv4retdbNiIfvAFlutXn7BmjqFYU=";
+    tag = version;
+    hash = "sha256-ElkqRiIHSXavXEw1ioFKL1cGnaBb2GXZuxgl98O4WuI=";
   };
 
+  patches = [
+    # stripped down version of https://codeberg.org/gentoo/gentoo/src/branch/master/sci-electronics/qelectrotech/files/qelectrotech-0.90_pre20250820-cmake.patch
+    ./system-pugixml.patch
+  ];
+
+  # fix wrong cmake conditional
   postPatch = ''
-    substituteInPlace qelectrotech.pro \
-      --replace-fail 'GIT_COMMIT_SHA="\\\"$(shell git -C \""$$_PRO_FILE_PWD_"\" rev-parse --verify HEAD)\\\""' \
-                'GIT_COMMIT_SHA="\\\"${version}\\\""' \
-      --replace-fail "COMPIL_PREFIX              = '/usr/local/'" \
-                "COMPIL_PREFIX              = '$out/'" \
-      --replace-fail "INSTALL_PREFIX             = '/usr/local/'" \
-                "INSTALL_PREFIX             = '$out/'"
+    substituteInPlace cmake/fetch_kdeaddons.cmake \
+      --replace-fail "DEFINED BUILD_WITH_KF5" "BUILD_WITH_KF5"
   '';
 
+  cmakeFlags = [
+    "-DBUILD_WITH_KF5=OFF"
+    # relies on vendored catch2
+    "-DPACKAGE_TESTS=OFF"
+    "-DFETCHCONTENT_SOURCE_DIR_SINGLEAPPLICATION=${singleApplication}"
+    "-DBUILD_PUGIXML=OFF"
+  ];
+
   nativeBuildInputs = [
     installShellFiles
     pkg-config
-    qmake
+    cmake
     wrapQtAppsHook
+    qttools
   ];
 
   buildInputs = [
-    kcoreaddons
-    kwidgetsaddons
     qtbase
     qtsvg
-  ];
-
-  qmakeFlags = [
-    "INSTALLROOT=$(out)"
+    pugixml
   ];
 
   installPhase = ''

pkgs/applications/misc/qelectrotech/system-pugixml.patch

@@ -0,0 +1,57 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -121,7 +121,6 @@
+   ${QET_DIR}/sources/NameList
+   ${QET_DIR}/sources/NameList/ui
+   ${QET_DIR}/sources/utils
+-  ${QET_DIR}/pugixml/src
+   ${QET_DIR}/sources/dataBase
+   ${QET_DIR}/sources/dataBase/ui
+   ${QET_DIR}/sources/factory/ui
+--- a/cmake/qet_compilation_vars.cmake
++++ b/cmake/qet_compilation_vars.cmake
+@@ -421,10 +421,6 @@
+   ${QET_DIR}/sources/PropertiesEditor/propertieseditorwidget.cpp
+   ${QET_DIR}/sources/PropertiesEditor/propertieseditorwidget.h
+ 
+-  ${QET_DIR}/pugixml/src/pugiconfig.hpp
+-  ${QET_DIR}/pugixml/src/pugixml.cpp
+-  ${QET_DIR}/pugixml/src/pugixml.hpp
+-
+   ${QET_DIR}/sources/qetgraphicsitem/conductor.cpp
+   ${QET_DIR}/sources/qetgraphicsitem/conductor.h
+   ${QET_DIR}/sources/qetgraphicsitem/conductortextitem.cpp
+--- a/sources/diagramcontext.h
++++ b/sources/diagramcontext.h
+@@ -17,7 +17,7 @@
+ */
+ #ifndef DIAGRAM_CONTEXT_H
+ #define DIAGRAM_CONTEXT_H
+-#include "pugixml/src/pugixml.hpp"
++#include <pugixml.hpp>
+ 
+ #include <QDomElement>
+ #include <QHash>
+--- a/sources/ElementsCollection/elementslocation.h
++++ b/sources/ElementsCollection/elementslocation.h
+@@ -20,7 +20,7 @@
+ 
+ #include "../NameList/nameslist.h"
+ #include "../diagramcontext.h"
+-#include "pugixml/src/pugixml.hpp"
++#include <pugixml.hpp>
+ 
+ #include <QIcon>
+ #include <QString>
+--- a/sources/NameList/nameslist.h
++++ b/sources/NameList/nameslist.h
+@@ -17,7 +17,7 @@
+ */
+ #ifndef NAMES_LIST_H
+ #define NAMES_LIST_H
+-#include "pugixml/src/pugixml.hpp"
++#include <pugixml.hpp>
+ 
+ #include <QtXml>
+ /**
+

pkgs/applications/misc/rsibreak/default.nix

@@ -2,26 +2,29 @@
   fetchurl,
   lib,
   stdenv,
+  cmake,
   extra-cmake-modules,
   kdoctools,
   wrapQtAppsHook,
   knotifyconfig,
   kidletime,
   kwindowsystem,
+  kstatusnotifieritem,
   ktextwidgets,
   kcrash,
 }:
 
 stdenv.mkDerivation rec {
   pname = "rsibreak";
-  version = "0.12.13";
+  version = "0.13.0";
 
   src = fetchurl {
-    url = "mirror://kde/stable/rsibreak/${version}/rsibreak-${version}.tar.xz";
-    sha256 = "N0C+f788fq5yotSC54H2K4WDc6PnGi8Nh/vXL4v0fxo=";
+    url = "mirror://kde/stable/rsibreak/${lib.versions.majorMinor version}/rsibreak-${version}.tar.xz";
+    hash = "sha256-arLOCcV9D+UXgwjqlfh9675VrpjPs3QkkireJZO60SA=";
   };
 
   nativeBuildInputs = [
+    cmake
     extra-cmake-modules
     kdoctools
     wrapQtAppsHook
@@ -30,6 +33,7 @@ stdenv.mkDerivation rec {
     knotifyconfig
     kidletime
     kwindowsystem
+    kstatusnotifieritem
     ktextwidgets
     kcrash
   ];

pkgs/applications/networking/browsers/chromium/info.json

@@ -828,28 +828,28 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "147.0.7727.137",
+    "version": "148.0.7778.96",
     "deps": {
       "depot_tools": {
-        "rev": "f2f7ec41f2c170d6f1899406f11a48411760a683",
-        "hash": "sha256-/4Zz169PVxRGFubknL+5hbUX9uRnOGArjt0dA8u0I88="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "gn": {
-        "version": "0-unstable-2026-03-05",
-        "rev": "d8c2f07d653520568da7cace755a87dad241b72d",
-        "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
+        "version": "0-unstable-2026-04-01",
+        "rev": "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+        "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
       "ungoogled-patches": {
-        "rev": "147.0.7727.137-1",
-        "hash": "sha256-MtsTk7aV7qpeXYBTxfEauCJlcoWYxdsQFbtN9ockSME="
+        "rev": "148.0.7778.96-1",
+        "hash": "sha256-yuc51ursl3pNyqSuTT9391AAlytoTzEMeronxjsNM7g="
       },
-      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
+      "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "68ba233a543d25e75c30f1228dd3bafa2da96937",
-        "hash": "sha256-ktIkQRYWcyKnZKEhvxFGssMZ///ctd/Ue3VIYPvQzuM=",
+        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
+        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -859,8 +859,8 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "338a5c004c774a8927899b1f1c0c25a82d14510f",
-        "hash": "sha256-2lj4oF8IbJoPOBWwQ4ZfDQjPklxQyNyG5AcHazxEYcs="
+        "rev": "76287b5da8e155135536c8e3a67432d97d74fe3a",
+        "hash": "sha256-q6syHriTR8TCQSqTWbbAkVVK0a/i4wojdEGN7sWGxUY="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
@@ -874,13 +874,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "78884e23fe39cf5cc6987ea188a9b802d65a21c9",
-        "hash": "sha256-G8CtxDHzo8WtJ6qrtghXBoYCWwnDvXcAueEGzLc6C14="
+        "rev": "6ca46ff28e3578c57cbead6f233969eb3dabc176",
+        "hash": "sha256-JW4kqpVTCFDN4WZE2S5gEkX1O7eDycl+adm3KGlUoTU="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "c42ab4598a74eea2cf3efff9d44b22de155d41af",
-        "hash": "sha256-NJCdrmVyF80aQLtrdVgcWQadhj5w7nKrLShaZDen1GA="
+        "rev": "2a826f2fda3cf8d75b47cbc3bb1d9b244f13a6ab",
+        "hash": "sha256-OWe2lAT5XbADWuxHgg53lZiU0My/ys86FEXvn4zlVx0="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -899,18 +899,18 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "d3b3b620e65ebaf511c6c8399b98a081cd644a66",
-        "hash": "sha256-xTGvhQUKOgt007WdvzN4eDpue8nheEMSV+Cl3Tnwviw="
+        "rev": "44319eca109f9678595924a90547c1f6650d8664",
+        "hash": "sha256-Trkan7bzRaLFlTkRfNGh7ssoZ3QpMh+mxQacsSM+d2I="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "9920660ea0162f88c44a648de177e6f8cb976d07",
-        "hash": "sha256-rC/aV3vsFzXQ8BiOIK+OTXxTsgTLEEqC19KDAot1PTs="
+        "rev": "33c977516b3dfe5b065bc298aa74175e1999ab51",
+        "hash": "sha256-GsaRxLnsz1jrFZ3m5tv65d1dioG23uJnmfa+WD7XcFc="
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "435c98c0d9ab7a2b60592c5297635b4791745191",
-        "hash": "sha256-dhsq9kLRcXPxv0Ih6CQhDvLAGjh3EgSCl28Cxjk2aos="
+        "rev": "21ffbe4c7b717d00d2d768c259b5b330fd754ac3",
+        "hash": "sha256-yKMmfdSBvbB3T042TJbZ1Mw+y0kyfHP0knQVFWAFPTg="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "534e0d1c1d0fcb4b57fd6a3fb9284cd14eaa28cd",
-        "hash": "sha256-o3UV8X27G7wpaDiKDzgMZN64+d9JQrvcQXpSybxi/h4="
+        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
+        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -934,8 +934,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "1cf4ed5bc0620ea514404609b1a2958c4518b86d",
-        "hash": "sha256-IZ5tVrld2+wDOWaYX93j2eLZJJs/EMW1+FtxhOeWi6w="
+        "rev": "f52e89f885064b9109501bca16c813bb29389993",
+        "hash": "sha256-3jx4QVR9nB3WggfrORGJGifmJQhAYVSPusa7RlR16qg="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -954,48 +954,53 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "b546257f770768b2c88258c533da38b91a06f737",
-        "hash": "sha256-E3da/LJ8HNy1osExmupovqnL8JHgVNzPUCG5F8TJKXQ="
+        "rev": "d69235dd804b24c04ed05639cffcc912cd6cfd75",
+        "hash": "sha256-iKq6TYscIBK4ydv+0msNV3tcs82Ljk5ZNr954Qv2lII="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "049880d58d6636a819168c00f44f8a4ed1e33e51",
-        "hash": "sha256-AHUos4ejvcsHTDdretkDHAeyLugtI6Jg14Hb9MbbPPs="
+        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
+        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
       },
-      "src/third_party/dawn/third_party/glfw": {
+      "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
-        "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-        "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE="
+        "rev": "043378876a67b092f5d0d3d9748660121a336dd3",
+        "hash": "sha256-4QSD1/uxWfYZPMjShB0h639eqAfuBRXAVfOm6BbZCBs="
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "2888a8764a33693f5a351e0c4ec87f430ccb0f7a",
-        "hash": "sha256-xAe7SdcOeNiqNF6pYwMPMnd9/2yTWUlVdH1aCco/PEo="
+        "rev": "eb67a9085c758516d940e1ce3fed0acfb6518209",
+        "hash": "sha256-z+yIuVweIyLdOiZDRfSppjTRoYq8S93+JNUla4Umot8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
         "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
         "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
       },
-      "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
+      "src/third_party/dawn/third_party/directx-headers/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
+        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
+        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
+      },
+      "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
         "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
         "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE="
       },
-      "src/third_party/dawn/third_party/khronos/EGL-Registry": {
+      "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
         "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
         "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A="
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "d213d4b8dba58ca7a0685e30cfaf1d29f4fc5d5b",
-        "hash": "sha256-6YGLG9BMQbF2pjV40su5ddHMqDW8/CEwM3RDEc/t2kM="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "b2b04dde36a941434c88ccff7a730d7e464d638c",
-        "hash": "sha256-+/qXZNkm26p+becMVcyHNUPyEUCejSV+tyTGFE4ivak="
+        "rev": "7d3186c3dd2c708703524027b46b8703534ab3cc",
+        "hash": "sha256-yE3/mfhqc7YtVNg4f/nrUpuRUGRjOzdwl++vPvd+mvc="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -1009,13 +1014,13 @@
       },
       "src/third_party/libpfm4/src": {
         "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
-        "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
-        "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ="
+        "rev": "977a25bb3dfe45f653a6cee71ffaae9a92fc3095",
+        "hash": "sha256-t4LMG38GksMEM5DktyJ0qLUX1biXErQ57MaMtd7hoeo="
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "27bc28d7f03fb9e3752980dce01de1a529236532",
-        "hash": "sha256-u+yvIPrdb9fWzJXJeIidUQ1MkKUx6sKLs7vdW68QhYc="
+        "rev": "d8be2b4a71155bf82da092ef543176351eeb59ff",
+        "hash": "sha256-fZc95YrREDbf0YcO6zahIjdX6TcRJANcH9MrkLIIIHw="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -1029,13 +1034,13 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "e0ebf38a01214aba11f31daa1c743782def031d5",
-        "hash": "sha256-njtIcvzo2v9uDuP+AostVAZRTtH2vePsshF4cANHkxo="
+        "rev": "4f1d71f6841d210b3a06ab3ef2e2ed679af0ee56",
+        "hash": "sha256-aHlf8gw3KxbKoyyajP4w586iYybx7HSkcKtLcZIgiDE="
       },
       "src/third_party/catapult/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -1059,8 +1064,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "7364b490b5f78d58efe23ea76e74210fd6c3c76f",
-        "hash": "sha256-lB6e5zcw5UiwTOf+a+B35apXP5t1bxI6yOMiEeFwIwY="
+        "rev": "7607ca500436b37ad23fb8d18614bec7796b68a7",
+        "hash": "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1069,28 +1074,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "1fb70b2851b292e48b612482a6d4d1b4c343c862",
-        "hash": "sha256-YBN8ogJn5Yup9GYrsE9UW15KPCuXbhD6hdqXWWCPD20="
+        "rev": "c27a09148de373889e5d2bf616c4e85a68050ae2",
+        "hash": "sha256-a/mAa1+if6B1FHe9crO8PDpc3o8M+CeIuXjXT0lwZOY="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "19cee54825bc57215266f5b14a5874bfbbb57543",
-        "hash": "sha256-HVwX8E3/7yw7zUqZrptN1iSBWF4ls0FAzPObPagNYtM="
+        "rev": "c179f7919aade97c5cff64d14b9171736e7aaef9",
+        "hash": "sha256-Hxazf58z9imnGO1aj2NRtsQ+BYrfAuIuZscADpr1NVI="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "909ad1733b50f28510c840ebad7b878a5ce07715",
-        "hash": "sha256-RYih9sn4rIBnFW/styZaUl5H0A1eEy3//DypZjY6n0M="
+        "rev": "b19e4e52c33fb8a105c3fc99598b0b9b4bc59752",
+        "hash": "sha256-7vCQw91L2c97dnVdrJ53zL8hi0KZffDJJjk7GaG3b/U="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
-        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
+        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
+        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1104,8 +1109,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "54458cb39d1081d0cfe6b77ed8e085d457a4c921",
-        "hash": "sha256-WXxSe2AY3hSMXz7lHNeFefOHGGkdXoSQLC6FuOa6Exo="
+        "rev": "a3074053a614df7a3896cb4edbcba40222a5f549",
+        "hash": "sha256-9AHpSqemqdwXoMiP3hH1YuEd3+nrudeVGTpInw+8BU4="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1119,13 +1124,13 @@
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "271aa00f8aec5bc801f542710efe1b2f0b5f0ef9",
-        "hash": "sha256-6ZATBYkyIdGuhG0Ps2vr0DT9nq1LhW2XCWWAkiZh9Hc="
+        "rev": "eb170f645b270c7979edb863fd2cf8edab2b2fd1",
+        "hash": "sha256-Cp0WQBbqWvPdrKCMQhH4Z6zl6YlIPLjafWZEwdkYWlc="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "946d97db8d906277085e361892b7efda5152e2f1",
-        "hash": "sha256-UxrmVqfX6TvFy1yxWXIQbd3ABD3jEAtDesgfnbJGg1E="
+        "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
+        "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1154,18 +1159,18 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "45556a19aab9502b91d6f30931e0cb5256f683f8",
-        "hash": "sha256-eMt2orPeG81o42O/HU+4B5b/G62TYAVIEeWwOmiML14="
+        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
+        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
         "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
         "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38="
       },
-      "src/third_party/harfbuzz-ng/src": {
+      "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "5d4e96ad8d00fc871ffa17707b2ca08fa850e7d6",
-        "hash": "sha256-9ef1P2JVJc7ZiP7TObFOxJbccCLsEgjhj+Z/ooEAGiI="
+        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
+        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1174,13 +1179,13 @@
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "3fa5129ed1ae6f8b2ec4e9b60fa5d08cc81e2d78",
-        "hash": "sha256-/TBxFsmLH1h3kfeE90LhR0RWJ3NrCTiLKklcaPbean8="
+        "rev": "da42d439389c90ec7574f0381ec53e7f5be0c2eb",
+        "hash": "sha256-W5HgVe0v9O/EuhpKMHp83PLq4p6cuBul3QUGLYdF6rY="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
-        "rev": "69015643b3f68dbd438c010439c59adc52cac808",
-        "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU="
+        "rev": "e8cb570a9a2ee9128e2214c73417ad2a3c47780b",
+        "hash": "sha256-5cb9qhSEzb941pF5HH0Br+x9wEH7MiGwQttvErb2mZo="
       },
       "src/third_party/emoji-segmenter/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git",
@@ -1214,8 +1219,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ee5f27adc28bd3f15b2c293f726d14d2e336cbd5",
-        "hash": "sha256-UQWSAekvYc1bTEAEQTPdeB406Uqb0mptpnGRZSaLewo="
+        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
+        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
       },
       "src/third_party/nlohmann_json/src": {
         "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@@ -1229,8 +1234,8 @@
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
-        "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-        "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w="
+        "rev": "7ee830d02b623e8ffe0b95d59a74db1e58da04c5",
+        "hash": "sha256-a1fcVI9Vsm1qE17Fnx5UxwOy4ZFMMJ0OKwNs/gZHYQI="
       },
       "src/third_party/libFuzzer/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git",
@@ -1239,8 +1244,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "1f7726d61f7afa9aca1198a9395ede472ed70366",
-        "hash": "sha256-RhJ676e6Kr/muR0ZCfZOAcs3kfoK7CjG2cwOpYG/JCY="
+        "rev": "800c545cf9d6e9c01328a1974f93a7e6564a74fd",
+        "hash": "sha256-Pvz+CWTBcWE0N0yfNGZhXDgUrGeIaCNfEjP1jYmF6G0="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1254,13 +1259,13 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
-        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
+        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
+        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c05daf3e2e6d83f2a359ab97094ce042944020a9",
-        "hash": "sha256-vVKAgvPdba0Lt3BUStOQsILlhiHNJeIv1jS9691+a80="
+        "rev": "7466a44ac80893803d4a7168b98dc6cd02d1fe2d",
+        "hash": "sha256-x1MRNtGLmwlRNenoQKz2Bgm3J5eHlNiJZtzhT9lttmk="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -1314,8 +1319,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "ddb611c60142c72be3719e753a42fb434b6f2458",
-        "hash": "sha256-M/b7PKEu+mFxsEeedJeppkwl8aZnX/932zqWlrCx8Y4="
+        "rev": "fb512780dcc5ba4b5be9e8a3118919002077c760",
+        "hash": "sha256-7wx73HZ6aqXQvLxwX6XnJAPefi/t47gIhvDH3FRT1j4="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1324,8 +1329,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
-        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
+        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
+        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -1369,13 +1374,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
-        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
+        "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
+        "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "f2a982d748b80586ae53b89a2e6ebbc305848b8c",
-        "hash": "sha256-SxDGt7nPVkSxwRF/lMmcch1h+C2Dyh6GZUXoZjnXWb4="
+        "rev": "b7a1e4767fbb02ad467f45ba378e858e897028da",
+        "hash": "sha256-Lzfs15Us8MDDQYvLRVf6xKg9A76aXPnTukx/A8Mf7rw="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -1404,8 +1409,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "af5eeeb054bebadfbb79c7bcd100a95e2ad4525f",
-        "hash": "sha256-vH3OUzfLZbaPY4DMAvSW0jKYRJmOa7aE8EfIJtZ1/Xs="
+        "rev": "45252858722aad12e545819b2d0f370eb865431b",
+        "hash": "sha256-0KsHYi76IaVNwk0dBhem2AnUXd9PpeS+jUsY+zPmeJ8="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -1419,8 +1424,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "571620ad60afc9f317d77605c65335f5412aada2",
-        "hash": "sha256-ktR3EpmkjueEmEip2oUTcSclVkUlPi/7+qmhElG+Bzs="
+        "rev": "448a19d1f24e0f8ce85ad0c1c6a50cf370ae69d7",
+        "hash": "sha256-hRDFnoqAH4HoWZ3oTWlzNge2nwlxpUC/GEq0MQVzBw8="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -1434,13 +1439,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
-        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
+        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
+        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "728eb5626a3bc701d044dd16d9cd289360ff47c3",
-        "hash": "sha256-LeGGkzSMfVXuioVJmRi/TjMYgG/0YrK7PckBJTejSHU="
+        "rev": "46432bb2a7a60e10fcee516f1692e6846d098a8d",
+        "hash": "sha256-jVih4xWota4SZQi4yEtaIP+4qgD03OsELt2aaulIXik="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1454,8 +1459,8 @@
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
-        "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-        "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4="
+        "rev": "8047437615d66d3267ac0134834b80e70639d572",
+        "hash": "sha256-rEnt08K90/Psfa+SQgTUG3YGrhp4/udXG9VKIwPM7pk="
       },
       "src/third_party/quic_trace/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
@@ -1484,8 +1489,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e0fbe154ccaf018b2dd1f0e42eec285e7d79d00",
-        "hash": "sha256-oqfNOSQB+5sbAnw4tPBXn22rk6Ai5b2aZNLJUyM181k="
+        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
+        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1499,13 +1504,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "727f7c8991f7b622a8b5c833cff99871a8c2cd8e",
-        "hash": "sha256-L42hkqcsuyMkNUeornIul7AYNgachkYpfNFE8H/VeVc="
+        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
+        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "313545f85af72f954820e54f4110cda591a6cf7b",
-        "hash": "sha256-EGgC5nK68Wk0b466K9yvLlGMxBd/CeI+KTgyoE+x6DY="
+        "rev": "89556131bf9d48af3c5c9fbb9a3322e706da89a3",
+        "hash": "sha256-h0utcwCnzwhFufggkBNeA674x2Kqwu4sz3jQ/9eoQv0="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1514,23 +1519,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "b476481b77f6e939e813ac93df22a4a6e7a3dd57",
-        "hash": "sha256-oKLFjed5sbYjEX5kddkAEdhkVOwFf5ddEUlOS55zLWE="
+        "rev": "de8d7f65b6eb670e4dad0225d0d6f99bebaab559",
+        "hash": "sha256-r2b+/VBffxsh1sRM2xcFiBx9K6GD6FsaQXpfFMBFUag="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "82bf3bef8a04a416bcb9d1cca5bdd51a6b3ab4ba",
-        "hash": "sha256-uMBuoGQIgRhmc8KJqLUnf13XK9tveuS0/OzzwKHKNUw="
+        "rev": "588075c77c6895cce6397d41d2890b1aa0a14372",
+        "hash": "sha256-rcEPZNSV0DiDrmoBCtJ07wFzzpmpM93jG4jYaEdNWvI="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "4a9f2cec3d5e7cb4810cf84716f597aff768ffa4",
-        "hash": "sha256-PyBxtzesZR/5jrWt96DxK7QwRoG8qhzWzbiE1fqdqkI="
+        "rev": "0ced1107c62836f439f684a5696c4bd69e09fce3",
+        "hash": "sha256-VOyN618wzyyO2Wh18gCnw+FCr/NbegX3A/54MClyhwc="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "b11b03839c940685b0201026bd2a4ffef1d5a4b8",
-        "hash": "sha256-FjUqETWBiI91hq5wGomPmCeW7K4k9kn5r74pUP0QFNo="
+        "rev": "715c8500e7cd67f2eba9e60e98852a1ed49d2f15",
+        "hash": "sha256-vSbMdTjlRVvYLi5ZvTVmfe76oAQ4AhqyD+ohvkvIYIs="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1539,38 +1544,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "f88a2d766840fc825af1fc065977953ba1fa4a91",
-        "hash": "sha256-VhcGQ+Tr9sH0ZEIk0oJsXh8MvCo2qpA2W3i8YVCwKaE="
+        "rev": "6dd7ba990830f7c15ac1345ff3b43ef6ffdad216",
+        "hash": "sha256-UKBVs2s05hP+paPq1dZFaUEQQ9Kx9acHxYUyJVx22eY="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "7d8d9e58c384949f1615c069d4c9346bf51b9738",
-        "hash": "sha256-AxS7vHw3RoXZLayWEDKBU7H0M1BZ9RMVdIsD/4rYap8="
+        "rev": "2d14d2e76aa7de72404b17078eda15c20a6a0389",
+        "hash": "sha256-8Xtzq8WOdFEw+uEJqMW39LLHt2m165K9OJsIFZuifoM="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "74d8a6cb930c68ef617b202c3ff3c59d919e086b",
-        "hash": "sha256-bZKNFiZMVYDxa6RKb1c/GxIR+eEFQAyYNaEptzQW5TE="
+        "rev": "afe9eb980aa928a66d1c9c06f38c55dd59868720",
+        "hash": "sha256-/yolWlC7ruRiJ0gSdCoSlqL9+j2uJAh+o+H0OG37pq4="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "363f465abadab0a8dcfc5c85d2c691e9b0b788d6",
-        "hash": "sha256-Zk2QyKu19g52vzGpNq5Qm+mlEgqk4jCFn/861eK8+64="
+        "rev": "df84d2be47457a8dfd7eb66f8c2b031683bd1ba5",
+        "hash": "sha256-8ParcURRRU3eS9Oej/vHTwOwvYy3HsVJsKh2wQLKUgM="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "59f963ce1b1d16cc92137a241a0fe98d637d21f4",
-        "hash": "sha256-Hh0N4N4XN7p7PBKk2uCU5g9TO9vmxJbomC1Gvf5oDZc="
+        "rev": "90bf5bc4fd8bea0d300f6564af256a51a34124b8",
+        "hash": "sha256-tmTD/waVX/duaKXvj0FNUS+ncL1agM73kK7pEfHEsSA="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "20fb10eb1ec08ccd5cacec32b7df1b0e99e48a0c",
-        "hash": "sha256-4XsQN94JsQXFGwJKp3W2gdTCCxUZrpCKiRVXzxL+Qs0="
+        "rev": "48b1fd1a65e436bae806cb6180c9338846b9de97",
+        "hash": "sha256-B3GXmwJEvnGcER5DJt0FGrwqNi3t8iV6VgX8uOrExlU="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "20948525099c0ea030ec5b149c809e48010be4ed",
-        "hash": "sha256-H05Ms2a770ApiCz5ERiIm8g893TJG9gRRuM9Qr4bj60="
+        "rev": "ac146eef210b6f52b842111c5d3419ab32a7293f",
+        "hash": "sha256-GqjVHxtda1a47+9G+nqh4qNMJmQaUdZNMUGQ8kAIIkk="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1604,23 +1609,23 @@
       },
       "src/third_party/webgl/src": {
         "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git",
-        "rev": "8fc2a0dff53abfc0cf2c140d8420759b2036cc54",
-        "hash": "sha256-cU7kfmxgaem6rPHGW+VwjxfKe7c0u1tCc98MQjsp5l8="
+        "rev": "216b10fafd3f6a900c715a8c758a4c7f9883b030",
+        "hash": "sha256-Aax2hr/9Zq6Avk+TMU1OMBLGshUL6hyRTX6eoOQesqM="
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "54441b8d176b12a5e2b01b8db78191ace56d7f34",
-        "hash": "sha256-gGvvKMTUJGm4ZwM7C1xTY1DKskCmlrCpSl3HLgVZqoY="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28452dff1bf86fec881a47949d4dedd4a2fe1f09",
-        "hash": "sha256-KBz94jvdVgxWuTuSoeHKNdY7wEJDGqG3xVsSVB3ubRQ="
+        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
+        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1632,25 +1637,20 @@
         "rev": "b65be9e699847c975440108a42f05412cc7fddac",
         "hash": "sha256-PySen9syu0OshtlHAZw666FeSQXdnsV8nlW9RmxgapM="
       },
-      "src/third_party/xdg-utils": {
-        "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
-        "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-        "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U="
-      },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "abd8e60edf09db5f5ba8e7fa2f1fcab0ae0807e1",
-        "hash": "sha256-VdrA2UwQ7/kHbnlIXBmga3ZjAqWaxCDQcDAssbLrh/M="
+        "rev": "1812bbe2928a32f26c5e48466712ba6460cf290c",
+        "hash": "sha256-xal21wjgeql3MjQXw6F1ezcRsnhVKod5jv0nYWroJ1o="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "1168da0e567960d50cba1b58c9b0ba047ece4733",
-        "hash": "sha256-T2CwRpL/XT/OsBrRfxC8kNIm43U4qPMBju8Ug13Qebo="
+        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
+        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c152c31c55cd54fd239772532a86c802d95b4617",
-        "hash": "sha256-7qEPh9l94LqyaA9qW0ZfFmmFyMNTjTJaeunLgDhtFuM="
+        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
+        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
       }
     }
   }

pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml

@@ -1,4 +1,3 @@
-build_with_tflite_lib=false
 chrome_pgo_phase=0
 clang_use_chrome_plugins=false
 disable_fieldtrial_testing_config=true

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.10.1esr";
+  version = "140.10.2esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "aa3481dbdda0a302acefff52007ba2e6927962523408b942a7df673e80618fc381faf1ca70ebaac3760645bf7cb382b85658af49beca705cd636ce9de58349a5";
+    sha512 = "bda7d5e6d59a2ad310e3f3e6e8ec05c78222edce266671d5d454dfa3e8f0086add3b9c0099db907cb62b2587ed47026ba7b3aa4f0406693d142d8d91b818d551";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-nQIpxNiWYFHYgmiLjva+3tyOVdjrap35Zmy1nRWwpH4=",
+    "hash": "sha256-RgyPVv3CWHgArDjmcz46j578hgleHFQ81MJ5OUWXnBk=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.104.0",
+    "rev": "v0.106.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pgFHrO71UGfH/w4Du7ocy437FNtptoDTWHmARQG/5A0="
+    "vendorHash": "sha256-AxXZRn2D6iEIG6p00KGQi1kMkt2F/ZyeBsXHR345wag="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -310,11 +310,11 @@
     "vendorHash": null
   },
   "digitalocean_digitalocean": {
-    "hash": "sha256-qiXN8ktqhJuN7Sb9XHf5HFaBfJASEpVkE07pAHg80QU=",
+    "hash": "sha256-LmG3NpDkGgaQRworjC+CEhXxMO1lPbgOVhFTiObNkCA=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.85.0",
+    "rev": "v2.85.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -328,13 +328,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-pbc7jLhIm+ogcpCBhi4CVsr2qM5vDzH0QuP3+cEVYLw=",
+    "hash": "sha256-j3O1gztyDCiq0Rchcx1lYktY2EhaNaa3t1yL+lH7IAg=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v2.0.1",
+    "rev": "v2.1.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DRMbcAR+DDrxrg1jNgnoWUg+OjlKm7wkqgIN6Hhkp3U="
+    "vendorHash": "sha256-1CpswocnTe6aj4TP7fMGy6mv0d/yX8FcYAKkAW5k7kk="
   },
   "dnsmadeeasy_dme": {
     "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -382,11 +382,11 @@
     "vendorHash": "sha256-WFlKj1IO9ylXn5frdnLcctQawjUXBTqcoMhQUQTU06A="
   },
   "exoscale_exoscale": {
-    "hash": "sha256-qjevix8bIRY3MKLlTZK/uUHS8nmKgjPk/rgqNWRdKes=",
+    "hash": "sha256-eK9XWu1Hh/sFWkUO5r0HIcw8tIhhP1nzkI41B0DpMZg=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.68.0",
+    "rev": "v0.69.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-4I3YwVn3lGSDXKLqzlOlY4TlaSSJk6uKBNeCn7IdX6w="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-SMG66AP5IWbnwUOQBsf0p1WT1ht4a740Z7ltLgyhN2o=",
+    "hash": "sha256-x1IcDODMayfVCZYz4kVf809Up0ictjJ0AzM0rA2z3Ks=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.82.0",
+    "rev": "v1.83.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2muLyg2LPj0broth01BZBysOdZyXaY/QzJWYjxTyKEw="
+    "vendorHash": "sha256-jLJECrwL9JoWz2FSfTM/yQGzBg3gsrGtGpiZFRYwbII="
   },
   "hashicorp_azuread": {
     "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -571,13 +571,13 @@
     "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
   },
   "hashicorp_google": {
-    "hash": "sha256-ZS5KnCC40Tt0G8aHd+wIYllEAfvT+e7zliuoo9fduTA=",
+    "hash": "sha256-6cvRvVQmKRi4kyNAo/UAGN00bO+uCJYvf661xYW/QCQ=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.30.0",
+    "rev": "v7.31.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9Vs/ksWpdusfIHOM1jXZ6XYptLReY7LeQKflXlsOWj8="
+    "vendorHash": "sha256-UoS4iIVHhCQ+Zk+SJmsMHJgJBKLMbfMVmtm4MDmzT68="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-ltqZ6nyl/leYsV2pBJVgOtcOYIyfDmDLsZLfHTPOyew=",
@@ -715,22 +715,22 @@
     "vendorHash": "sha256-fWnf2l9a7bzXtofA+Aow6F17K+slpMpXEYZPuqDNwfg="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-Eg811AwJwuHZ/270+TNh6JskCGRUt0ikk6yShjtVtcU=",
+    "hash": "sha256-CtqPtXccE6I+yDj/7XbjbACMwCGMv+pSEIa5DVh+AGo=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.90.0",
+    "rev": "v1.91.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-FeH8XVy+xTal2bbylEfvVqqqoURvuNKNzcK1fv+Ng50=",
+    "hash": "sha256-sd7/8xjsNwP5ALFDMCbKy6L7zke2wxK2gylSbqpeD9o=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v2.0.2",
+    "rev": "v2.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HDZiRZoq3/2E8aK/whBBeLVPcWYXYZqTNPa4DvNG2aQ="
+    "vendorHash": "sha256-euaLEnXZ9xmee5nTymFqPeUU4cewE+Ij6ZKGksNy25o="
   },
   "icinga_icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -842,13 +842,13 @@
     "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
   },
   "linode_linode": {
-    "hash": "sha256-nrNyOcaC5wKJijfubBBuEBKA6dT6Ajo33MR4P80j29k=",
+    "hash": "sha256-prYSxbzRCrB3IDpctEUBLIHpV2iwHHILDlCceRVdIvw=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.11.0",
+    "rev": "v3.12.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-91mdCcM5BSNdgW1/mMbuNtAxc4TH1abW8xbRcbHAnNc="
+    "vendorHash": "sha256-4PQGnRL+z3EgVsTbKLXCBYwbzhd57tPije8RMJNrkKs="
   },
   "loafoe_htpasswd": {
     "hash": "sha256-1HCvAGWsYlcYCA8iOmBb/AawxHPLuoxxQWLzNy0x79M=",
@@ -914,22 +914,22 @@
     "vendorHash": "sha256-JRqBv5N+i5yhKrC+Eenm1xmwylNF7k/EIJXaklrsFfA="
   },
   "mongey_kafka-connect": {
-    "hash": "sha256-XMGpK22Ww8swvfrnbClxjErVmkBKX3dxdlkjgNJHlCE=",
+    "hash": "sha256-A20rLdvunuTU3zZOJ1bj/yIaWs+xsdvSmpDPuxN7XQc=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka-connect",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka-connect",
-    "rev": "v0.4.3",
+    "rev": "v0.5.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
+    "vendorHash": "sha256-ulhKT0DaS6gg9Ucz9pqqIg4mxRpGDGz2rN1R0RNuumg="
   },
   "mongodb_mongodbatlas": {
-    "hash": "sha256-2qthbblL0yh/SZjZg+49OkLi1EVODQxGWN41xD3AMpQ=",
+    "hash": "sha256-8HZOdEHD5KwVuSDe3EDX54nPqn3Uz6kooi/HEGoI3F0=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v2.11.0",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-65I0oFyE9252aRaHvmYhOX8RTyH6UDE3Ude4b/LIkdo="
+    "vendorHash": "sha256-c864XU6t/ehD1KhlV0aBddEc0eifWHHWeS67BH3odbM="
   },
   "namecheap_namecheap": {
     "hash": "sha256-eV2K3KHTEXEEt1WXwfYfNMK+gLUY0EoHFQg9kLdAI3s=",
@@ -941,13 +941,13 @@
     "vendorHash": null
   },
   "nats-io_jetstream": {
-    "hash": "sha256-xEWUMZBGLjUK3iab0VPQfR02WYnx2KEChG2nApvwW54=",
+    "hash": "sha256-DRpHKfzvb5ubeTXoLis52RacvWSHjLBhC5/8oFTAS0w=",
     "homepage": "https://registry.terraform.io/providers/nats-io/jetstream",
     "owner": "nats-io",
     "repo": "terraform-provider-jetstream",
-    "rev": "v0.3.0",
+    "rev": "v0.4.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-+ZUPqDQ/YhDVJ/ukvp/Zk6nOCa/NKDPgeGqTRnrXEtQ="
+    "vendorHash": "sha256-z1Qi/07jh0A8PNo87dVMAq2O5+oc33J7/SNx7rrm/Kg="
   },
   "nbering_ansible": {
     "hash": "sha256-3nha5V4rNgVzgqliebmbC5e12Lj/zlCsyyiIVFlmUrY=",
@@ -959,13 +959,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-j4DQRsw7QP7d83HTIchgSVt3CPUCIJ8CKmuMSKr5GaQ=",
+    "hash": "sha256-m8KZQUmDyMTR3S1BC5nmo15j5TUDV3ZZsy4hg16VZlc=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.85.1",
+    "rev": "v3.87.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zFg0xT6iLBxnM9ysKB/Dmveffp6Ohbj9akgr6lbU8MI="
+    "vendorHash": "sha256-W/a04lDiPVh/tkcWz9eJp/pupI46cXxqukdv1h17xYY="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",
@@ -1031,13 +1031,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-rhufSDVO6Yu5EXwduREFg3dkA/SkjzTyW3rR+Tqivbg=",
+    "hash": "sha256-NQ8yB4maHOF/sfFSSeCW9MNnAo/PgYrXAPRuM4NNti0=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.64",
+    "rev": "v1.36.65",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qtH6jjhzGRGaHYKjpJLPWjwRL5PQIyOPvI33BVf4cO4="
+    "vendorHash": "sha256-NOsmv0G+tfNwqbPF8U4vihp3cd5Kn9N0dJBWh9m5X+Y="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-xB/wHvFmv14Lz1IR4+n7+l+RbRJCtDqZisLURK9IB4E=",
+    "hash": "sha256-Yt46N9wVwgz8VbPSHQF1UQ4XT1ENIcE+yeKmO0JqnlM=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.12.0",
+    "rev": "v8.13.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1391,11 +1391,11 @@
     "vendorHash": "sha256-ozAYLFkilSK0Nygdglhz3VNtRVKoLDGRnrVvg4nWyH4="
   },
   "turbot_turbot": {
-    "hash": "sha256-zh809E1qII8EJm7QFHEORju2WF//+A2uk7olrCNdBkU=",
+    "hash": "sha256-sJODPeFzU3vaiHbKlGe1dR5Pi7aS56JcmZUe8Yg1BcQ=",
     "homepage": "https://registry.terraform.io/providers/turbot/turbot",
     "owner": "turbot",
     "repo": "terraform-provider-turbot",
-    "rev": "v1.13.1",
+    "rev": "v1.13.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1481,13 +1481,13 @@
     "vendorHash": "sha256-rUYHapEVqRupLOPVbcAH8YP0cuXclMmYTQUkqeOwCN0="
   },
   "vultr_vultr": {
-    "hash": "sha256-gw4Eo4wrBDAycQyN7xGHe/w1VazTSgtIcAlBBrePrgs=",
+    "hash": "sha256-IKXby/v1oNjxwgzbFTSDQYEEWbV8v8qzB4ZC9ISEf5o=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.31.0",
+    "rev": "v2.31.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bKf0QittBRoEbuz0JvmcyCyus1wPP3pacuYmq2RLV08="
+    "vendorHash": "sha256-XQcxOSvZKXyq+k8N5n1lMM1ThbWfDXBm1Hc+Rmagu7I="
   },
   "wgebis_mailgun": {
     "hash": "sha256-Li4eyqZ6huO5Q+XTcQ+HQCg8IOjhxGU9Z4Uw3TbMdAc=",

pkgs/applications/networking/cluster/terraform/default.nix

@@ -200,8 +200,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.15.0";
-    hash = "sha256-cKgZFCPLusXXSjcff/PmKGIdSm3wRY1DpduXBRrgcDc=";
+    version = "1.15.2";
+    hash = "sha256-jwmyZJHGfi2oO8FBebPKBQdXt61w02H6zbbqSXxMhMM=";
     vendorHash = "sha256-Gv6V5aXqTuQoG1StbD/7Ln2QrLpMsW6fbUJUkyZMkvk=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -17,6 +17,10 @@ let
     inherit stdenv;
     # N/A on Qt5
     kimageformats = null;
+    unwrapped = libsForQt5.callPackage ../telegram-desktop/unwrapped.nix {
+      inherit stdenv;
+      kcoreaddons = null;
+    };
   };
   version = "1.4.9";
   tg_owt = telegram-desktop.tg_owt.overrideAttrs (oldAttrs: {

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -45,14 +45,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "6.7.6";
+  version = "6.8.1";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-TGI1SLtzjjDaodQc+JIVRRiwCy9PCO3MuPfv2DpDFxo=";
+    hash = "sha256-CcibFBPbviakOsf+BpAF8U0CRWIt3zO/KiHycwRw2V0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/irc/quassel/default.nix

@@ -16,20 +16,9 @@
   boost,
   zlib,
   qtscript,
-  phonon,
   libdbusmenu,
   qca-qt5,
   openldap,
-
-  withKDE ? true, # enable KDE integration
-  extra-cmake-modules,
-  kconfigwidgets,
-  kcoreaddons,
-  knotifications,
-  knotifyconfig,
-  ktextwidgets,
-  kwidgetsaddons,
-  kxmlgui,
 }:
 
 let
@@ -39,7 +28,6 @@ in
 
 assert monolithic -> !client && !enableDaemon;
 assert client || enableDaemon -> !monolithic;
-assert !buildClient -> !withKDE; # KDE is used by the client only
 
 let
   edf = flag: feature: [ ("-D" + feature + (if flag then "=ON" else "=OFF")) ];
@@ -76,17 +64,6 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals buildClient [
     libdbusmenu
-    phonon
-  ]
-  ++ lib.optionals (buildClient && withKDE) [
-    extra-cmake-modules
-    kconfigwidgets
-    kcoreaddons
-    knotifications
-    knotifyconfig
-    ktextwidgets
-    kwidgetsaddons
-    kxmlgui
   ];
 
   cmakeFlags = [
@@ -97,8 +74,7 @@ stdenv.mkDerivation rec {
   ++ edf monolithic "WANT_MONO"
   ++ edf enableDaemon "WANT_CORE"
   ++ edf enableDaemon "WITH_LDAP"
-  ++ edf client "WANT_QTCLIENT"
-  ++ edf withKDE "WITH_KDE";
+  ++ edf client "WANT_QTCLIENT";
 
   dontWrapQtApps = true;
 

pkgs/applications/office/mytetra/default.nix

@@ -29,6 +29,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  # K&R-style declarations in vendored mimetex break under gcc 15's C23 default.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   preBuild = ''
     substituteInPlace app/app.pro \
       --replace /usr/local/bin $out/bin \

pkgs/applications/science/math/labplot/default.nix

@@ -1,11 +1,14 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   fetchurl,
+  fetchpatch,
   cmake,
+  pkg-config,
   extra-cmake-modules,
   shared-mime-info,
+  bison,
+  flex,
   wrapQtAppsHook,
 
   qtbase,
@@ -33,7 +36,7 @@
   netcdf,
   cfitsio,
   libcerf,
-  # cantor,
+  cantor,
   zlib,
   lz4,
   readstat,
@@ -44,30 +47,33 @@
 
 stdenv.mkDerivation rec {
   pname = "labplot";
-  version = "2.10.1";
+  version = "2.12.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/labplot/labplot-${version}.tar.xz";
-    sha256 = "sha256-K24YFRfPtuDf/3uJXz6yDHzjWeZzLThUXgdXya6i2u8=";
+    hash = "sha256-4oFVv930DltvfEeRMTVW0eSBOARPIW8hDVFbn21sEGo=";
   };
 
-  cmakeFlags = [
-    # Disable Vector BLF since it depends on DBC parser which fails to be detected
-    "-DENABLE_VECTOR_BLF=OFF"
+  patches = [
+    # backport build fix
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://invent.kde.org/education/labplot/-/commit/c2db2ec28aa8958f7041ae5cd03ddae9f44e5aa3.diff";
+      hash = "sha256-0biKZXWMs5y1U9phAivEAbd2N4C/CiOKvk/QRAaPimo=";
+    })
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "matio-fix-compilation-for-latest-version-1.5.27.patch";
-      url = "https://github.com/KDE/labplot/commit/d6142308ffa492d9f7cea00fad3b4cd1babfd00c.patch";
-      hash = "sha256-qD5jj6GxBKbQezKJb1Z8HnwFO84WJBGQDawS/6o/wHE=";
-    })
+  cmakeFlags = [
+    "-DQT_FIND_PRIVATE_MODULES=ON"
   ];
 
   nativeBuildInputs = [
     cmake
+    pkg-config
     extra-cmake-modules
     shared-mime-info
+    bison
+    flex
     wrapQtAppsHook
   ];
 
@@ -97,7 +103,7 @@ stdenv.mkDerivation rec {
     netcdf
     cfitsio
     libcerf
-    # cantor
+    cantor
     zlib
     lz4
     readstat

pkgs/applications/video/kaffeine/default.nix

@@ -1,53 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitLab,
-  cmake,
-  extra-cmake-modules,
-  libvlc,
-  libv4l,
-  libx11,
-  kidletime,
-  kdelibs4support,
-  libxscrnsaver,
-  wrapQtAppsHook,
-  qtx11extras,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "kaffeine";
-  version = "2.0.19";
-
-  src = fetchFromGitLab {
-    domain = "invent.kde.org";
-    repo = "kaffeine";
-    owner = "Multimedia";
-    rev = "v${version}";
-    hash = "sha256-AHyUS2vyeuWFLRXdIoy1sbssDgzz7N957vyf5rWiooI=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    libvlc
-    libv4l
-    libx11
-    kidletime
-    qtx11extras
-    kdelibs4support
-    libxscrnsaver
-  ];
-
-  meta = {
-    description = "KDE media player";
-    homepage = "https://apps.kde.org/kaffeine/";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.pasqui23 ];
-    platforms = lib.platforms.all;
-    mainProgram = "kaffeine";
-  };
-}

pkgs/applications/video/minitube/default.nix

@@ -5,11 +5,8 @@
   qmake,
   qttools,
   wrapQtAppsHook,
-  phonon,
-  phonon-backend-vlc,
   qtbase,
   qtdeclarative,
-  qtx11extras,
   mpv,
 
   # "Free" key generated by pasqui23
@@ -18,21 +15,21 @@
 
 stdenv.mkDerivation rec {
   pname = "minitube";
-  version = "3.9.3";
+  version = "4.0";
 
   src = fetchFromGitHub {
-    hash = "sha256-ROqROQsV8ddrxYT5mMdkf6rCgCoGr1jpxQ1ohcoEaQs=";
-    rev = version;
     repo = "minitube";
     owner = "flaviotordini";
+    tag = version;
     fetchSubmodules = true;
+    hash = "sha256-JAxdPiiPDpmhJBiNtlaMbdcC/YEGJyc9mP3kBvee/74=";
   };
 
-  patches = [
-    # Taken from FreeBSD; already merged upstream in the media submodule
-    # (https://github.com/flaviotordini/media/commit/f6b7020f273e1fc06e6e204fab37a7c8edaa857a)
-    ./lib_media_src_mpv_mpvwidget.patch
-  ];
+  # https://github.com/NixOS/nixpkgs/issues/214765
+  postPatch = ''
+    substituteInPlace locale/locale.pri \
+      --replace-fail '$$[QT_INSTALL_BINS]/lrelease' '${lib.getDev qttools}/bin/lrelease'
+  '';
 
   nativeBuildInputs = [
     qmake
@@ -41,11 +38,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    phonon
-    phonon-backend-vlc
     qtbase
     qtdeclarative
-    qtx11extras
     mpv
   ];
 

pkgs/applications/video/minitube/lib_media_src_mpv_mpvwidget.patch

@@ -1,16 +0,0 @@
-diff -Nur a/lib/media/src/mpv/mpvwidget.cpp b/lib/media/src/mpv/mpvwidget.cpp
---- a/lib/media/src/mpv/mpvwidget.cpp
-+++ b/lib/media/src/mpv/mpvwidget.cpp
-@@ -30,7 +30,11 @@
-     qDebug() << "initializeGL" << nativeParent;
-     if (nativeParent == nullptr) qFatal("No native parent");
- 
--    mpv_opengl_init_params gl_init_params{get_proc_address, this, nullptr};
-+    #if MPV_CLIENT_API_VERSION < MPV_MAKE_VERSION(2,0)
-+	mpv_opengl_init_params gl_init_params{get_proc_address, this, nullptr};
-+    #else
-+	mpv_opengl_init_params gl_init_params{get_proc_address, this};
-+    #endif
-     mpv_render_param params[]{{MPV_RENDER_PARAM_API_TYPE, (void *)MPV_RENDER_API_TYPE_OPENGL},
-                               {MPV_RENDER_PARAM_OPENGL_INIT_PARAMS, &gl_init_params},
-                               {MPV_RENDER_PARAM_INVALID, nullptr},

pkgs/applications/video/natron/default.nix

@@ -10,7 +10,7 @@
   cairo,
   ceres-solver,
   expat,
-  extra-cmake-modules,
+  kdePackages,
   glog,
   libxdmcp,
   python312,
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     pkg-config
     wrapQtAppsHook
   ];

pkgs/applications/video/obs-studio/default.nix

@@ -62,7 +62,7 @@
   qrcodegencpp,
   simde,
   nix-update-script,
-  extra-cmake-modules,
+  kdePackages,
 }:
 
 let
@@ -121,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     wrapGAppsHook3
     wrapQtAppsHook
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
   ]
   ++ optional scriptingSupport swig
   ++ optional cudaSupport autoAddDriverRunpath;

pkgs/applications/video/obs-studio/plugins/obs-plugin-countdown.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-plugin-countdown";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "ashmanix";
     repo = "obs-plugin-countdown";
     tag = finalAttrs.version;
-    hash = "sha256-rDs+X2eH8aUUH6phEo/pelUY1mHnnJNc6mqcT/lT+6c=";
+    hash = "sha256-0E2pNRg4vwXK54aYuWYZyuRJaNrpwX7X0Dq6V8B/SgA=";
   };
 
   buildInputs = [

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -222,9 +222,14 @@ let
         ro_mounts+=(--ro-bind /etc /.host-etc)
       fi
 
+      declare -A etc_ignored_set
+      for ign in "''${etc_ignored[@]}"; do
+        etc_ignored_set[$ign]=1
+      done
+
       # link selected etc entries from the actual root
       for i in ${escapeShellArgs etcBindEntries}; do
-        if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
+        if [[ -n "''${etc_ignored_set[$i]:-}" ]]; then
           continue
         fi
         if [[ -e $i ]]; then
@@ -232,11 +237,21 @@ let
         fi
       done
 
+      declare -A ignored_set
+      for ign in "''${ignored[@]}"; do
+        ignored_set[$ign]=1
+      done
+
       declare -a auto_mounts
       # loop through all directories in the root
       for dir in /*; do
-        # if it is a directory and it is not ignored
-        if [[ -d "$dir" ]] && [[ ! "''${ignored[@]}" =~ "$dir" ]]; then
+        # if it is a directory and not already provided by the FHS env or
+        # explicitly ignored, bind-mount it into the chroot. Use exact match
+        # via associative array because regex substring matching incorrectly
+        # skips prefixes (e.g. /sb would match /sbin and never get mounted,
+        # breaking --chdir when CWD is on a custom mount like /sb/project).
+        # https://github.com/NixOS/nixpkgs/issues/241151
+        if [[ -d "$dir" ]] && [[ -z "''${ignored_set[$dir]:-}" ]]; then
           # add it to the mount list
           auto_mounts+=(--bind "$dir" "$dir")
         fi

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -325,6 +325,7 @@ lib.makeOverridable
       buildDependencies_ = buildDependencies;
       processedAttrs = [
         "src"
+        "propagatedBuildInputs"
         "nativeBuildInputs"
         "buildInputs"
         "crateBin"
@@ -418,7 +419,8 @@ lib.makeOverridable
         buildInputs =
           lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
           ++ (crate.buildInputs or [ ])
-          ++ buildInputs_;
+          ++ buildInputs_
+          ++ completePropagatedBuildInputs;
         dependencies = map lib.getLib dependencies_;
         buildDependencies = map lib.getLib buildDependencies_;
 
@@ -428,6 +430,16 @@ lib.makeOverridable
           ++ lib.concatMap (dep: dep.completeBuildDeps ++ dep.completeDeps) buildDependencies
         );
 
+        # Propagated native build inputs from this crate and all transitive Rust
+        # dependencies. Analogous to completeDeps but for native library deps:
+        # a crate can declare `propagatedBuildInputs` in its override and they
+        # will automatically be added to the buildInputs of every crate that
+        # depends on it, without having to repeat them up the dependency tree.
+        completePropagatedBuildInputs = lib.unique (
+          (crate.propagatedBuildInputs or [ ])
+          ++ lib.concatMap (dep: dep.completePropagatedBuildInputs or [ ]) dependencies
+        );
+
         # Create a list of features that are enabled by the crate itself and
         # through the features argument of buildRustCrate. Exclude features
         # with a forward slash, since they are passed through to dependencies,

pkgs/build-support/rust/build-rust-crate/test/default.nix

@@ -1060,6 +1060,69 @@ rec {
                 test -x '${pkg}/bin/rcgen' && touch $out
               ''
           );
+
+      # Test that propagatedBuildInputs declared in a crate override are
+      # collected by completePropagatedBuildInputs and propagate transitively
+      # to all crates that depend on it.
+      propagatedBuildInputsTest =
+        let
+          fakeNativeLib = runCommand "fake-native-lib" { } "mkdir -p $out/lib && touch $out/lib/libfoo.a";
+
+          # Library crate that declares a native dep via propagatedBuildInputs
+          libCrate = mkHostCrate {
+            crateName = "mylib";
+            src = mkLib "src/lib.rs";
+            propagatedBuildInputs = [ fakeNativeLib ];
+          };
+
+          # Binary crate with a direct dependency on libCrate
+          binCrate = mkHostCrate {
+            crateName = "mybin";
+            src = mkFile "src/main.rs" "fn main() {}";
+            dependencies = [ libCrate ];
+          };
+
+          # Intermediate library that depends on libCrate
+          transitiveLib = mkHostCrate {
+            crateName = "transitivelib";
+            src = mkLib "src/lib.rs";
+            dependencies = [ libCrate ];
+          };
+
+          # Binary crate that only depends on transitiveLib (not libCrate directly)
+          transitiveBin = mkHostCrate {
+            crateName = "transitivebin";
+            src = mkFile "src/main.rs" "fn main() {}";
+            dependencies = [ transitiveLib ];
+          };
+        in
+        runCommand "propagated-build-inputs-test"
+          {
+            libCrateInputs = libCrate.completePropagatedBuildInputs;
+            binCrateInputs = binCrate.completePropagatedBuildInputs;
+            transitiveBinInputs = transitiveBin.completePropagatedBuildInputs;
+          }
+          ''
+            # libCrate itself should have fakeNativeLib in completePropagatedBuildInputs
+            echo "$libCrateInputs" | grep -q "${fakeNativeLib}" || {
+              echo "ERROR: fakeNativeLib not in libCrate.completePropagatedBuildInputs"
+              exit 1
+            }
+
+            # binCrate depends on libCrate, so fakeNativeLib should propagate
+            echo "$binCrateInputs" | grep -q "${fakeNativeLib}" || {
+              echo "ERROR: fakeNativeLib not propagated to binCrate.completePropagatedBuildInputs"
+              exit 1
+            }
+
+            # transitiveBin → transitiveLib → libCrate: fakeNativeLib should propagate transitively
+            echo "$transitiveBinInputs" | grep -q "${fakeNativeLib}" || {
+              echo "ERROR: fakeNativeLib not transitively propagated to transitiveBin.completePropagatedBuildInputs"
+              exit 1
+            }
+
+            touch $out
+          '';
     }
   );
   test = releaseTools.aggregate {

pkgs/build-support/rust/hooks/default.nix

@@ -27,7 +27,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoBuildHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoBuildHook;
     };
   } ./cargo-build-hook.sh;
@@ -41,7 +41,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoCheckHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoCheckHook;
     };
   } ./cargo-check-hook.sh;
@@ -54,7 +54,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoInstallHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoInstallHook;
     };
   } ./cargo-install-hook.sh;
@@ -68,7 +68,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoNextestHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoNextestHook;
     };
   } ./cargo-nextest-hook.sh;
@@ -107,7 +107,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoSetupHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoSetupHook;
     };
   } ./cargo-setup-hook.sh;

pkgs/build-support/setup-hooks/install-fonts.sh

@@ -52,6 +52,9 @@ installFonts() {
   if [ -n "${webfont-}" ]; then
     installFont 'woff' "$webfont/share/fonts/woff"
     installFont 'woff2' "$webfont/share/fonts/woff2"
+  elif [[ "${dontInstallWebfonts-}" != 1 && -n "$(find . \( -iname "*.woff" -o -iname "*.woff2" \) -print)" ]]; then
+    nixErrorLog "Consider adding \"webfont\" to outputs to install woff/woff2 files."
+    nixErrorLog "Alternatively, set dontInstallWebfonts to silence this."
+    exit 1
   fi
-
 }

pkgs/by-name/_6/_64gram/package.nix

@@ -10,13 +10,13 @@ telegram-desktop.override {
   inherit withWebkit;
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
     pname = "64gram-unwrapped";
-    version = "1.2.0";
+    version = "1.2.1";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       tag = "v${version}";
-      hash = "sha256-Xhyk/rCb4EakU0Nc80U1QN3PyMqlLBtcYb+zGjllhDM=";
+      hash = "sha256-C3DpwMF+0P2YKLG+USZMrBqRmfTSoF82YPMAgj33L+Y=";
       fetchSubmodules = true;
     };
 

pkgs/by-name/_8/_86box/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
-  extra-cmake-modules,
+  kdePackages,
   pkg-config,
   makeWrapper,
   freetype,
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt5.wrapQtAppsHook
   ]
   ++ lib.optionals enableWayland [
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     wayland-scanner
   ];
 

pkgs/by-name/ab/abbaye-des-morts/package.nix

@@ -28,11 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
     "PREFIX=${placeholder "out"}"
     "DESTDIR="
   ]
-  ++ lib.optional stdenv.isDarwin "PLATFORM=mac";
+  ++ lib.optional stdenv.hostPlatform.isDarwin "PLATFORM=mac";
 
   # Even with PLATFORM=mac, the Makefile specifies some GCC-specific CFLAGS that
   # are not supported by modern Clang on macOS
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Makefile \
       --replace-fail "-funswitch-loops" "" \
       --replace-fail "-fgcse-after-reload" ""