Merge master into staging-nixos

2026-01-14 18:07:10 +00:00
parent 014278e849 ef618a7ad7
commit b0654fd533
156 changed files with 860 additions and 1510 deletions
@@ -374,10 +374,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # LuaPackages
 /pkgs/development/lua-modules         @NixOS/lua

-# mpvScripts
-/pkgs/by-name/mp/mpv/scripts     @uninsane
-/pkgs/by-name/mp/mpv/scripts.nix @uninsane
-
 # Neovim
 /pkgs/applications/editors/neovim      @NixOS/neovim

@@ -9351,12 +9351,6 @@
    githubId = 16470252;
    name = "Gemini Lasswell";
  };
-  gbpdt = {
-    email = "nix@pdtpartners.com";
-    github = "gbpdt";
-    githubId = 25106405;
-    name = "Graham Bennett";
-  };
  gbtb = {
    email = "goodbetterthebeast3@gmail.com";
    github = "gbtb";
@@ -11277,12 +11271,6 @@
    name = "Silvan Mosberger";
    keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170"; } ];
  };
-  ingenieroariel = {
-    email = "ariel@nunez.co";
-    github = "ingenieroariel";
-    githubId = 54999;
-    name = "Ariel Nunez";
-  };
  insipx = {
    email = "github@andrewplaza.dev";
    github = "insipx";
@@ -18958,6 +18946,11 @@
    github = "nitsky";
    githubId = 492793;
  };
+  nivalux = {
+    name = "Nivalux";
+    github = "Nivalux";
+    githubId = 88719017;
+  };
  nix-julia = {
    name = "nix-julia";
    github = "nix-julia";
@@ -71,6 +71,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh

 - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.

+- support for `ecryptfs` in nixpkgs has been removed.
+
 - The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.

  As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
@@ -89,7 +89,6 @@ in
        "devfs"
        "devpts"
        "devtmpfs"
-        "ecryptfs"
        "eventpollfs"
        "exofs"
        "futexfs"
@@ -202,7 +202,6 @@
  ./programs/droidcam.nix
  ./programs/dsearch.nix
  ./programs/dublin-traceroute.nix
-  ./programs/ecryptfs.nix
  ./programs/ente-auth.nix
  ./programs/environment.nix
  ./programs/envision.nix
@@ -1918,7 +1917,6 @@
  ./tasks/filesystems/bindfs.nix
  ./tasks/filesystems/btrfs.nix
  ./tasks/filesystems/cifs.nix
-  ./tasks/filesystems/ecryptfs.nix
  ./tasks/filesystems/envfs.nix
  ./tasks/filesystems/erofs.nix
  ./tasks/filesystems/exfat.nix
@@ -1,35 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.ecryptfs;
-
-in
-{
-  options.programs.ecryptfs = {
-    enable = lib.mkEnableOption "ecryptfs setuid mount wrappers";
-  };
-
-  config = lib.mkIf cfg.enable {
-    security.wrappers = {
-
-      "mount.ecryptfs_private" = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
-      };
-      "umount.ecryptfs_private" = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
-      };
-
-    };
-  };
-}
@@ -74,6 +74,10 @@ in
      "programs"
      "cardboard"
    ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [
+      "programs"
+      "ecryptfs"
+    ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [
      "programs"
      "gnome-documents"
@@ -452,6 +456,9 @@ in
    (mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
      services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
    '')
+    (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
+      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
+    '')
    (mkRemovedOptionModule [ "security" "rngd" ] ''
      rngd is not necessary for any device that the kernel recognises
      as an hardware RNG, as it will automatically run the krngd task
@@ -965,8 +965,7 @@ let
                  (
                    (cfg.unixAuth || config.services.homed.enable)
                    && (
-                      config.security.pam.enableEcryptfs
-                      || config.security.pam.enableFscrypt
+                      config.security.pam.enableFscrypt
                      || cfg.pamMount
                      || cfg.kwallet.enable
                      || cfg.enableGnomeKeyring
@@ -996,15 +995,6 @@ let
                        likeauth = true;
                      };
                    }
-                    {
-                      name = "ecryptfs";
-                      enable = config.security.pam.enableEcryptfs;
-                      control = "optional";
-                      modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
-                      settings = {
-                        unwrap = true;
-                      };
-                    }
                    {
                      name = "fscrypt";
                      enable = config.security.pam.enableFscrypt;
@@ -1191,12 +1181,6 @@ let
                  yescrypt = true;
                };
              }
-              {
-                name = "ecryptfs";
-                enable = config.security.pam.enableEcryptfs;
-                control = "optional";
-                modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
-              }
              {
                name = "fscrypt";
                enable = config.security.pam.enableFscrypt;
@@ -1331,12 +1315,6 @@ let
                  silent = true;
                };
              }
-              {
-                name = "ecryptfs";
-                enable = config.security.pam.enableEcryptfs;
-                control = "optional";
-                modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
-              }
              # Work around https://github.com/systemd/systemd/issues/8598
              # Skips the pam_fscrypt module for systemd-user sessions which do not have a password
              # anyways.
@@ -2223,7 +2201,6 @@ in

    security.pam.enableUMask = lib.mkEnableOption "umask PAM module";

-    security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
    security.pam.enableFscrypt = lib.mkEnableOption ''
      fscrypt, to automatically unlock directories with the user's login password.

@@ -2324,8 +2301,6 @@ in
      ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
      ++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];

-    boot.supportedFilesystems = lib.mkIf config.security.pam.enableEcryptfs [ "ecryptfs" ];
-
    security.wrappers = {
      unix_chkpwd = {
        setuid = true;
@@ -30,7 +30,7 @@ in
      default = null;
      description = ''
        Optional path to a file containing the mycelium key material.
-        If unset, the default location (`/var/lib/mycelium/key.bin`) will be used.
+        If unset, the location `/var/lib/mycelium/key.bin` will be used.
        If no key exist at this location, it will be generated on startup.
      '';
    };
@@ -1,29 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-# TODO: make ecryptfs work in initramfs?
-
-with lib;
-
-{
-  config = mkIf (config.boot.supportedFilesystems.ecryptfs or false) {
-    system.fsPackages = [ pkgs.ecryptfs ];
-    security.wrappers = {
-      "mount.ecryptfs_private" = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
-      };
-      "umount.ecryptfs_private" = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
-      };
-    };
-  };
-}
@@ -502,7 +502,6 @@ in
  ec2-image = runTest ./ec2-image.nix;
  ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
  echoip = runTest ./echoip.nix;
-  ecryptfs = runTest ./ecryptfs.nix;
  ejabberd = runTest ./xmpp/ejabberd.nix;
  elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
  emacs-daemon = runTest ./emacs-daemon.nix;
@@ -1,87 +0,0 @@
-{ ... }:
-{
-  name = "ecryptfs";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      imports = [ ./common/user-account.nix ];
-      boot.kernelModules = [ "ecryptfs" ];
-      security.pam.enableEcryptfs = true;
-      environment.systemPackages = with pkgs; [ keyutils ];
-    };
-
-  testScript = ''
-    def login_as_alice():
-        machine.wait_until_tty_matches("1", "login: ")
-        machine.send_chars("alice\n")
-        machine.wait_until_tty_matches("1", "Password: ")
-        machine.send_chars("foobar\n")
-        machine.wait_until_tty_matches("1", "alice\@machine")
-
-
-    def logout():
-        machine.send_chars("logout\n")
-        machine.wait_until_tty_matches("1", "login: ")
-
-
-    machine.wait_for_unit("default.target")
-
-    with subtest("Set alice up with a password and a home"):
-        machine.succeed("(echo foobar; echo foobar) | passwd alice")
-        machine.succeed("chown -R alice.users ~alice")
-
-    with subtest("Migrate alice's home"):
-        out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice")
-        machine.log(f"ecryptfs-migrate-home said: {out}")
-
-    with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"):
-        login_as_alice()
-        machine.send_chars("logout\n")
-        machine.wait_until_tty_matches("1", "login: ")
-
-    # Why do I need to do this??
-    machine.succeed("su alice -c ecryptfs-umount-private || true")
-    machine.sleep(1)
-
-    with subtest("check that encrypted home is not mounted"):
-        machine.fail("mount | grep ecryptfs")
-
-    with subtest("Show contents of the user keyring"):
-        out = machine.succeed("su - alice -c 'keyctl list \@u'")
-        machine.log(f"keyctl unlink said: {out}")
-
-    with subtest("Log alice again"):
-        login_as_alice()
-
-    with subtest("Create some files in encrypted home"):
-        machine.succeed("su alice -c 'touch ~alice/a'")
-        machine.succeed("su alice -c 'echo c > ~alice/b'")
-
-    with subtest("Logout"):
-        logout()
-
-    # Why do I need to do this??
-    machine.succeed("su alice -c ecryptfs-umount-private || true")
-    machine.sleep(1)
-
-    with subtest("Check that the filesystem is not accessible"):
-        machine.fail("mount | grep ecryptfs")
-        machine.succeed("su alice -c 'test \! -f ~alice/a'")
-        machine.succeed("su alice -c 'test \! -f ~alice/b'")
-
-    with subtest("Log alice once more"):
-        login_as_alice()
-
-    with subtest("Check that the files are there"):
-        machine.sleep(1)
-        machine.succeed("su alice -c 'test -f ~alice/a'")
-        machine.succeed("su alice -c 'test -f ~alice/b'")
-        machine.succeed('test "$(cat ~alice/b)" = "c"')
-
-    with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"):
-        machine.succeed("su alice -c 'ls -lh ~alice/'")
-
-    logout()
-  '';
-}
@@ -142,15 +142,13 @@ stdenv.mkDerivation rec {

  dontUnpack = true;

-  ${primaryBinary} = binaryPackage;
-
  nativeBuildInputs = [
    makeWrapper
  ];

  installPhase = ''
    mkdir -p "$out/bin"
-    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    makeWrapper "${binaryPackage}/${primaryBinary}" "$out/bin/${primaryBinary}"
  ''
  + builtins.concatStringsSep "" (
    map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases
@@ -159,18 +157,20 @@ stdenv.mkDerivation rec {
    mkdir -p "$out/share/applications"

    substitute \
-      "''$${primaryBinary}/${primaryBinary}.desktop" \
+      "${binaryPackage}/${primaryBinary}.desktop" \
      "$out/share/applications/${primaryBinary}.desktop" \
      --replace-fail "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"

-    for directory in ''$${primaryBinary}/Icon/*; do
+    for directory in ${binaryPackage}/Icon/*; do
      size=$(basename $directory)
      mkdir -p "$out/share/icons/hicolor/$size/apps"
-      ln -s ''$${primaryBinary}/Icon/$size/* $out/share/icons/hicolor/$size/apps
+      ln -s ${binaryPackage}/Icon/$size/* $out/share/icons/hicolor/$size/apps
    done
  '';

  passthru = {
+    unwrapped = binaryPackage;
+
    updateScript =
      let
        script = writeShellScript "${packageAttribute}-update-script" ''
@@ -191,7 +191,7 @@ stdenv.mkDerivation rec {
          fi

          for platform in ${lib.escapeShellArgs meta.platforms}; do
-              update-source-version "${packageAttribute}.${primaryBinary}" "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
+              update-source-version "${packageAttribute}".unwrapped "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
          done
        '';
      in
@@ -4,6 +4,7 @@
  buildVimPlugin,
  buildNeovimPlugin,
  fetchFromGitHub,
+  fetchFromGitea,
 }:

 final: prev: {
@@ -10503,6 +10504,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nidhogg-nvim = buildVimPlugin {
+    pname = "nidhogg.nvim";
+    version = "0-unstable-2026-01-11";
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "koibtw";
+      repo = "nidhogg.nvim";
+      rev = "a8c72aa204f68d5bd79a2508fbbed7b0ad2290cf";
+      hash = "sha256-x8CryNcg3u5uCncCMTgK7yzCvk5MiomjKpdjNEoCQu4=";
+    };
+    meta.homepage = "https://codeberg.org/koibtw/nidhogg.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  night-owl-nvim = buildVimPlugin {
    pname = "night-owl.nvim";
    version = "0.5-beta-unstable-2024-09-12";
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.27-unstable-2026-01-04";
+  version = "0.0.27-unstable-2026-01-09";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "a27b821cc1f9fec70d7b7dc4a42c6dbd76266997";
-    hash = "sha256-Hm1Zr10xH9B4GzRyCKI/qsbhkJCD69qo8gC+Njna/5w=";
+    rev = "e89eb79abf5754645e20aa6074da10ed20bba33c";
+    hash = "sha256-jxbDBvaVtgC0L/MSyoZjGjBxvRUdNofRsiUHwntab7c=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
@@ -806,6 +806,7 @@ https://github.com/fiatjaf/neuron.vim/,,
 https://github.com/Olical/nfnl/,main,
 https://github.com/joeveiga/ng.nvim/,HEAD,
 https://github.com/chr4/nginx.vim/,,
+https://codeberg.org/koibtw/nidhogg.nvim,HEAD,
 https://github.com/oxfist/night-owl.nvim/,,
 https://github.com/bluz71/vim-nightfly-colors/,,nightfly
 https://github.com/EdenEast/nightfox.nvim/,,
@@ -27,13 +27,13 @@
    "vendorHash": null
  },
  "aiven_aiven": {
-    "hash": "sha256-cr/Z1sMm2TcO1GbOLTdMJ9JOly5kYrDxwbYgQVPFJ9M=",
+    "hash": "sha256-KOEXMx0QRvvxtKH1zjjfZH29lyAiukIGvk7POVs5KQo=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.48.0",
+    "rev": "v4.49.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-ki9PKr+1++mDQoclXSYOagMTzPJnXew1/TiciEjR3B4="
+    "vendorHash": "sha256-ctEZoEULhdsWahsRBXVv1QfSvQ17I5PYUB6++pTFJE8="
  },
  "akamai_akamai": {
    "hash": "sha256-HjrBPaLYeJ8/9gmdn+BGHtu5dmyT5MeTsIBgzS0X0gY=",
@@ -580,13 +580,13 @@
    "vendorHash": "sha256-6re5ARUiWmpkND7hfjSDm2aOX5vlESp7UrcPJDNIJ+s="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-rgN9FJGz5BxYkVqmDLQH+Sw4HRwOs+PbBB4hMmYmTTU=",
+    "hash": "sha256-LcCuSoOXHLoRwk4AxMSjQkSWieNDqmWzEPXu4BFISQw=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v7.15.0",
+    "rev": "v7.16.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FcKZHfUWzJj8unXxhCsuw3131uyWFYzJyALv1vSGCsQ="
+    "vendorHash": "sha256-DfvtZVbke4Rydp5PaD6QQr2bITHOaK1rNU773zDqdXQ="
  },
  "hashicorp_helm": {
    "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -26,6 +26,8 @@
  libgbm,
  libglvnd,
  libappindicator-gtk3,
+  pipewire,
+  libpulseaudio,
 }:

 # Helper function for building a derivation for Franz and forks.
@@ -99,6 +101,8 @@ stdenv.mkDerivation (
        cups
        expat
        stdenv.cc.cc
+        pipewire
+        libpulseaudio
      ];
    runtimeDependencies = [
      libglvnd
@@ -106,6 +110,8 @@ stdenv.mkDerivation (
      (lib.getLib udev)
      libnotify
      libappindicator-gtk3
+      pipewire
+      libpulseaudio
    ];

    installPhase = ''
@@ -14,8 +14,6 @@ python3.pkgs.buildPythonApplication rec {
  version = "1.9.5";
  pyproject = true;

-  disabled = python3.pythonOlder "3.7";
-
  src = fetchFromGitHub {
    owner = "SamSchott";
    repo = "maestral-qt";
@@ -29,6 +29,8 @@ in
 {
  outputs = [
    "out"
+  ]
+  ++ lib.optionals (hasFeature "man-pages") [
    "man"
  ];
  src =
@@ -144,8 +144,6 @@ stdenv.mkDerivation rec {

  dontUnpack = true;

-  ${primaryBinary} = binaryPackage;
-
  nativeBuildInputs = [
    makeWrapper
  ];
@@ -153,7 +151,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall
    mkdir -p "$out/bin"
-    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    makeWrapper "${binaryPackage}/${primaryBinary}" "$out/bin/${primaryBinary}"
  ''
  + builtins.concatStringsSep "" (
    map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases
@@ -162,19 +160,21 @@ stdenv.mkDerivation rec {
    mkdir -p "$out/share/applications"

    substitute \
-      "''$${primaryBinary}/${primaryBinary}.desktop" \
+      "${binaryPackage}/${primaryBinary}.desktop" \
      "$out/share/applications/${primaryBinary}.desktop" \
      --replace-fail "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"

-    for directory in ''$${primaryBinary}/Icon/*; do
+    for directory in ${binaryPackage}/Icon/*; do
      size=$(basename $directory)
      mkdir -p "$out/share/icons/hicolor/$size/apps"
-      ln -s ''$${primaryBinary}/Icon/$size/* $out/share/icons/hicolor/$size/apps
+      ln -s ${binaryPackage}/Icon/$size/* $out/share/icons/hicolor/$size/apps
    done
    runHook postInstall
  '';

  passthru = {
+    unwrapped = binaryPackage;
+
    updateScript =
      let
        script = writeShellScript "${packageAttribute}-update-script" ''
@@ -196,7 +196,7 @@ stdenv.mkDerivation rec {
          fi

          for platform in ${lib.escapeShellArgs meta.platforms}; do
-              update-source-version "${packageAttribute}.${primaryBinary}" "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
+              update-source-version "${packageAttribute}".unwrapped "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
          done
        '';
      in
@@ -5,15 +5,14 @@
  fetchPypi,
  ansible-lint,
 }:
-python3Packages.buildPythonApplication rec {
+
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ansible-navigator";
  version = "25.12.0";
  pyproject = true;

-  disabled = python3Packages.pythonOlder "3.10";
-
  src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
    pname = "ansible_navigator";
    hash = "sha256-i6yw282NWUaCZBtAYi3rQsLk+GGyp8QHyqBi7nwwIlo=";
  };
@@ -43,8 +42,8 @@ python3Packages.buildPythonApplication rec {
  meta = {
    description = "Text-based user interface (TUI) for Ansible";
    homepage = "https://ansible.readthedocs.io/projects/navigator/";
-    changelog = "https://github.com/ansible/ansible-navigator/releases/tag/v${version}";
+    changelog = "https://github.com/ansible/ansible-navigator/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ melkor333 ];
  };
-}
+})
@@ -346,8 +346,6 @@ buildPythonPackage rec {
    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
-      gbpdt
-      ingenieroariel
      taranarmo
    ];
  };
@@ -0,0 +1,14 @@
+diff --git a/dirs.proj b/dirs.proj
+index 28a91c8..cd9b8b4 100644
+--- a/dirs.proj
+++ b/dirs.proj
+@@ -22,6 +22,9 @@
+     <ProjectReference Remove="src/Android/**/*.*proj" />
+     <ProjectReference Remove="src/iOS/**/*.*proj" />
+     <ProjectReference Remove="src/Tizen/**/*.*proj" />
+    <ProjectReference Remove="tests/Avalonia.RenderTests.WpfCompare/Avalonia.RenderTests.WpfCompare.csproj" />
+    <ProjectReference Remove="samples/interop/WindowsInteropTest/WindowsInteropTest.csproj" />
+    <ProjectReference Remove="src/Windows/Avalonia.Win32.Interoperability/Avalonia.Win32.Interoperability.csproj" />
+   </ItemGroup>
+ 
+   <ItemGroup Condition="'$(SkipObscurePlatforms)' == 'True'">
@@ -44,6 +44,11 @@
    "version": "2.4.3",
    "hash": "sha256-pTyYP26uXXLe6ejCb/yVYpb23ad/Dkl2Ka8NWwQeiqk="
  },
+  {
+    "pname": "CommunityToolkit.Mvvm",
+    "version": "8.4.0",
+    "hash": "sha256-a0D550q+ffreU9Z+kQPdzJYPNaj1UjgyPofLzUg02ZI="
+  },
  {
    "pname": "dotnet-ilrepack",
    "version": "1.0.0",
@@ -59,16 +64,6 @@
    "version": "3.11.0",
    "hash": "sha256-OLKoHGsBOlGDrwjbSHHITl2mWKbUXoRBbTjNMCkzDQg="
  },
-  {
-    "pname": "DynamicData",
-    "version": "7.12.8",
-    "hash": "sha256-MIR66d5vWwpOo06b8f3UDJXMlwyiGl/9JsedtVAh6LA="
-  },
-  {
-    "pname": "DynamicData",
-    "version": "8.4.1",
-    "hash": "sha256-r+haH5VlmZFJTEJ3UedsYybw+oddn/CSvfm6x7PrrQ4="
-  },
  {
    "pname": "GdkSharp",
    "version": "3.24.24.95",
@@ -880,16 +875,6 @@
    "version": "0.11.4-experimental",
    "hash": "sha256-b3oKUKbr+3Udfl7RWzUY9BR/XWNsN+VmEkBxk6KiFo0="
  },
-  {
-    "pname": "Microsoft.WindowsDesktop.App.Ref",
-    "version": "6.0.36",
-    "hash": "sha256-K8l2UQgrEOJt6w3Q4Jy7dJlXAI1gG6o+2NEBgmG8dG4="
-  },
-  {
-    "pname": "Microsoft.WindowsDesktop.App.Ref",
-    "version": "8.0.22",
-    "hash": "sha256-F8DQPfK1IiD8+H8A85QSBHhzJIo1fmAXwXaSge7EhBE="
-  },
  {
    "pname": "Mono.Cecil",
    "version": "0.11.5",
@@ -1020,21 +1005,6 @@
    "version": "2.0.9",
    "hash": "sha256-DLkL5i3q+y2AOg68oe6ROxgcwkPaLg7ViI3pytJd80k="
  },
-  {
-    "pname": "ReactiveUI",
-    "version": "18.4.1",
-    "hash": "sha256-IqaIu3xmShw3m/ko34SytnL9sIm/LQnTUZcda7CF7tA="
-  },
-  {
-    "pname": "ReactiveUI",
-    "version": "20.1.1",
-    "hash": "sha256-p9l2GMzBRchKb4gW9pQ3DIKhs2O9fX3t/V7jDDztBqE="
-  },
-  {
-    "pname": "ReactiveUI.Validation",
-    "version": "3.0.22",
-    "hash": "sha256-f/1yGwrQb/Nauj+0lqBV6xxbfp8qCQvJxbxUy2VhS8I="
-  },
  {
    "pname": "runtime.any.System.Collections",
    "version": "4.0.11",
@@ -1790,16 +1760,6 @@
    "version": "2.88.9",
    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
  },
-  {
-    "pname": "Splat",
-    "version": "14.5.1",
-    "hash": "sha256-qv/N4VN3MtCW3t/OJ77NGUMfPON2kHIq5BtrMTQLRUQ="
-  },
-  {
-    "pname": "Splat",
-    "version": "15.1.1",
-    "hash": "sha256-WipAVaUx2HrYNQ9LcYm496LndmSpVbuzJxzP9FA6Ohg="
-  },
  {
    "pname": "System.AppContext",
    "version": "4.1.0",
@@ -1920,11 +1880,6 @@
    "version": "4.5.0",
    "hash": "sha256-15yE2NoT9vmL9oGCaxHClQR1jLW1j1ef5hHMg55xRso="
  },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "5.0.0",
-    "hash": "sha256-0pST1UHgpeE6xJrYf5R+U7AwIlH3rVC3SpguilI/MAg="
-  },
  {
    "pname": "System.ComponentModel.Primitives",
    "version": "4.3.0",
@@ -1980,11 +1935,6 @@
    "version": "4.3.1",
    "hash": "sha256-6vgjSBp0rBpp5qcpCWHNVSUJBzRign1h8cdk4Q75lNw="
  },
-  {
-    "pname": "System.Diagnostics.Contracts",
-    "version": "4.3.0",
-    "hash": "sha256-K74oyUn0Vriv3mwrbZwQFQ6EA0M7Hm9YlcWLRjLjqr8="
-  },
  {
    "pname": "System.Diagnostics.Debug",
    "version": "4.0.11",
@@ -2440,11 +2390,6 @@
    "version": "5.0.0",
    "hash": "sha256-M5Z8pw8rVb8ilbnTdaOptzk5VFd5DlKa7zzCpuytTtE="
  },
-  {
-    "pname": "System.Reactive",
-    "version": "6.0.0",
-    "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
-  },
  {
    "pname": "System.Reactive",
    "version": "6.0.1",
@@ -2930,11 +2875,6 @@
    "version": "6.0.0",
    "hash": "sha256-UemDHGFoQIG7ObQwRluhVf6AgtQikfHEoPLC6gbFyRo="
  },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "8.0.0",
-    "hash": "sha256-IUQkQkV9po1LC0QsqrilqwNzPvnc+4eVvq+hCvq8fvE="
-  },
  {
    "pname": "System.Text.Json",
    "version": "4.7.0",
@@ -2945,11 +2885,6 @@
    "version": "6.0.0",
    "hash": "sha256-9AE/5ds4DqEfb0l+27fCBTSeYCdRWhxh2Bhg8IKvIuo="
  },
-  {
-    "pname": "System.Text.Json",
-    "version": "8.0.3",
-    "hash": "sha256-ljBBGkResXv3MbrA14hR6QXo8SFLLV52GkpA+wxKdEo="
-  },
  {
    "pname": "System.Text.RegularExpressions",
    "version": "4.1.0",
@@ -3230,11 +3165,6 @@
    "version": "1.4.13",
    "hash": "sha256-pLtx0/2oTKYO1Y1Vg3k/Eli2OWHT5uorGdBp2uXvFfw="
  },
-  {
-    "pname": "Xunit.StaFact",
-    "version": "1.2.46-alpha",
-    "hash": "sha256-GkHy4fEg8nvT2K+N/8KDPpJAtwLgVCLERZa5kO08e2E="
-  },
  {
    "pname": "YamlDotNet",
    "version": "11.2.1",
@@ -46,14 +46,14 @@ stdenvNoCC.mkDerivation (
    }
    rec {
      pname = "Avalonia";
-      version = "11.3.9";
+      version = "11.3.11";

      src = fetchFromGitHub {
        owner = "AvaloniaUI";
        repo = "Avalonia";
        tag = version;
        fetchSubmodules = true;
-        hash = "sha256-qvkQKlz9GQayAxCPITYJbCk+w4d9xJNo+P1I9J1SYho=";
+        hash = "sha256-lB0Td/YmQc8GtTpoinxDYHfxnDLQPTWXsp/X0ddslFM=";
      };

      patches = [
@@ -65,6 +65,9 @@ stdenvNoCC.mkDerivation (
        # Microsoft.Common.CurrentVersion.targets(5034,5): error MSB3021: Unable to copy file "[...]/JetBrains.Annotations.dll" to "bin/Debug/JetBrains.Annotations.dll". Access to the path '/build/source/nukebuild/bin/Debug/JetBrains.Annotations.dll' is denied. [/build/source/nukebuild/_build.csproj]
        # This happens because the source packages have symlinks due to linkNuGetPackagesAndSources.
        ./0003-disable-hard-links.patch
+        # Remove dependencies on Microsoft.WindowsDesktop.App.Ref, which sdk
+        # specific and currently not packaged in nixpkgs
+        ./0004-disable-windows-desktop.patch
      ];

      # this needs to be match the version being patched above
@@ -1,8 +1,8 @@
 diff --git a/package-lock.json b/package-lock.json
-index 1b4fe5f40e..fe3166797e 100644
+index 32d5abebb913..fea866c148c9 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -230,51 +230,6 @@
+@@ -231,51 +231,6 @@
         "bw": "build/bw.js"
       }
     },
@@ -53,515 +53,4 @@ index 1b4fe5f40e..fe3166797e 100644
 -    },
     "apps/desktop": {
       "name": "@bitwarden/desktop",
-       "version": "2025.9.0",
-@@ -4913,33 +4868,6 @@
-         }
-       }
-     },
-    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics/node_modules/chokidar": {
-      "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "anymatch": "~3.1.2",
-        "braces": "~3.0.2",
-        "glob-parent": "~5.1.2",
-        "is-binary-path": "~2.1.0",
-        "is-glob": "~4.0.1",
-        "normalize-path": "~3.0.0",
-        "readdirp": "~3.6.0"
-      },
-      "engines": {
-        "node": ">= 8.10.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.2"
-      }
-    },
-     "node_modules/@compodoc/compodoc/node_modules/@babel/core": {
-       "version": "7.25.8",
-       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.25.8.tgz",
-@@ -5122,21 +5050,6 @@
-       "dev": true,
-       "license": "MIT"
-     },
-    "node_modules/@compodoc/compodoc/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-     "node_modules/@compodoc/compodoc/node_modules/magic-string": {
-       "version": "0.30.11",
-       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.11.tgz",
-@@ -5147,36 +5060,6 @@
-         "@jridgewell/sourcemap-codec": "^1.5.0"
-       }
-     },
-    "node_modules/@compodoc/compodoc/node_modules/readdirp": {
-      "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "picomatch": "^2.2.1"
-      },
-      "engines": {
-        "node": ">=8.10.0"
-      }
-    },
-    "node_modules/@compodoc/compodoc/node_modules/readdirp/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-     "node_modules/@compodoc/live-server": {
-       "version": "1.2.3",
-       "resolved": "https://registry.npmjs.org/@compodoc/live-server/-/live-server-1.2.3.tgz",
-@@ -5908,28 +5791,6 @@
-         "node": ">=16.4"
-       }
-     },
-    "node_modules/@electron/windows-sign": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@electron/windows-sign/-/windows-sign-1.2.2.tgz",
-      "integrity": "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "cross-dirname": "^0.1.0",
-        "debug": "^4.3.4",
-        "fs-extra": "^11.1.1",
-        "minimist": "^1.2.8",
-        "postject": "^1.0.0-alpha.6"
-      },
-      "bin": {
-        "electron-windows-sign": "bin/electron-windows-sign.js"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
-     "node_modules/@emnapi/core": {
-       "version": "1.4.3",
-       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.4.3.tgz",
-@@ -8285,21 +8146,6 @@
-         "@msgpack/msgpack": "^2.7.0"
-       }
-     },
-    "node_modules/@microsoft/signalr/node_modules/utf-8-validate": {
-      "version": "5.0.10",
-      "resolved": "https://registry.npmjs.org/utf-8-validate/-/utf-8-validate-5.0.10.tgz",
-      "integrity": "sha512-Z6czzLq4u8fPOyx7TU6X3dvUZVvoJmxSQ+IcrlmagKhilxlhZgxPK6C5Jqbkw1IDUmFTM+cz9QDnnLTwDz/2gQ==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "node-gyp-build": "^4.3.0"
-      },
-      "engines": {
-        "node": ">=6.14.2"
-      }
-    },
-     "node_modules/@microsoft/signalr/node_modules/ws": {
-       "version": "7.5.10",
-       "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz",
-@@ -11310,21 +11156,6 @@
-         "linux"
-       ]
-     },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.44.0.tgz",
-      "integrity": "sha512-TDKO8KlHJuvTEdfw5YYFBjhFts2TR0VpZsnLLSYmB7AaohJhM8ctDSdDnUGq77hUh4m/djRafw+9zQpkOanE2Q==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-       "version": "4.34.8",
-       "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.34.8.tgz",
-@@ -18997,15 +18828,6 @@
-       "integrity": "sha512-vQOuWmBgsgG1ovGeDi8m6Zeu1JaqH/JncrxKmaqMbv/LunyOQdLiQhPHtOsNlbUI05TocR5nod/Mbs3HYtr6sQ==",
-       "license": "MIT"
-     },
-    "node_modules/cross-dirname": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/cross-dirname/-/cross-dirname-0.1.0.tgz",
-      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true
-    },
-     "node_modules/cross-env": {
-       "version": "10.0.0",
-       "resolved": "https://registry.npmjs.org/cross-env/-/cross-env-10.0.0.tgz",
-@@ -33661,36 +33483,6 @@
-       "dev": true,
-       "license": "MIT"
-     },
-    "node_modules/postject": {
-      "version": "1.0.0-alpha.6",
-      "resolved": "https://registry.npmjs.org/postject/-/postject-1.0.0-alpha.6.tgz",
-      "integrity": "sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "commander": "^9.4.0"
-      },
-      "bin": {
-        "postject": "dist/cli.js"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/postject/node_modules/commander": {
-      "version": "9.5.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
-      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": "^12.20.0 || >=14"
-      }
-    },
-     "node_modules/prebuild-install": {
-       "version": "7.1.3",
-       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-@@ -39330,291 +39122,6 @@
-         }
-       }
-     },
-    "node_modules/vite/node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.44.0.tgz",
-      "integrity": "sha512-xEiEE5oDW6tK4jXCAyliuntGR+amEMO7HLtdSshVuhFnKTYoeYMyXQK7pLouAJJj5KHdwdn87bfHAR2nSdNAUA==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.44.0.tgz",
-      "integrity": "sha512-uNSk/TgvMbskcHxXYHzqwiyBlJ/lGcv8DaUfcnNwict8ba9GTTNxfn3/FAoFZYgkaXXAdrAA+SLyKplyi349Jw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.44.0.tgz",
-      "integrity": "sha512-VGF3wy0Eq1gcEIkSCr8Ke03CWT+Pm2yveKLaDvq51pPpZza3JX/ClxXOCmTYYq3us5MvEuNRTaeyFThCKRQhOA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.44.0.tgz",
-      "integrity": "sha512-fBkyrDhwquRvrTxSGH/qqt3/T0w5Rg0L7ZIDypvBPc1/gzjJle6acCpZ36blwuwcKD/u6oCE/sRWlUAcxLWQbQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.44.0.tgz",
-      "integrity": "sha512-u5AZzdQJYJXByB8giQ+r4VyfZP+walV+xHWdaFx/1VxsOn6eWJhK2Vl2eElvDJFKQBo/hcYIBg/jaKS8ZmKeNQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.44.0.tgz",
-      "integrity": "sha512-qC0kS48c/s3EtdArkimctY7h3nHicQeEUdjJzYVJYR3ct3kWSafmn6jkNCA8InbUdge6PVx6keqjk5lVGJf99g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.44.0.tgz",
-      "integrity": "sha512-x+e/Z9H0RAWckn4V2OZZl6EmV0L2diuX3QB0uM1r6BvhUIv6xBPL5mrAX2E3e8N8rEHVPwFfz/ETUbV4oW9+lQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.44.0.tgz",
-      "integrity": "sha512-1exwiBFf4PU/8HvI8s80icyCcnAIB86MCBdst51fwFmH5dyeoWVPVgmQPcKrMtBQ0W5pAs7jBCWuRXgEpRzSCg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.44.0.tgz",
-      "integrity": "sha512-ZTR2mxBHb4tK4wGf9b8SYg0Y6KQPjGpR4UWwTFdnmjB4qRtoATZ5dWn3KsDwGa5Z2ZBOE7K52L36J9LueKBdOQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.44.0.tgz",
-      "integrity": "sha512-GFWfAhVhWGd4r6UxmnKRTBwP1qmModHtd5gkraeW2G490BpFOZkFtem8yuX2NyafIP/mGpRJgTJ2PwohQkUY/Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-loongarch64-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.44.0.tgz",
-      "integrity": "sha512-xw+FTGcov/ejdusVOqKgMGW3c4+AgqrfvzWEVXcNP6zq2ue+lsYUgJ+5Rtn/OTJf7e2CbgTFvzLW2j0YAtj0Gg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.44.0.tgz",
-      "integrity": "sha512-bKGibTr9IdF0zr21kMvkZT4K6NV+jjRnBoVMt2uNMG0BYWm3qOVmYnXKzx7UhwrviKnmK46IKMByMgvpdQlyJQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.44.0.tgz",
-      "integrity": "sha512-vV3cL48U5kDaKZtXrti12YRa7TyxgKAIDoYdqSIOMOFBXqFj2XbChHAtXquEn2+n78ciFgr4KIqEbydEGPxXgA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.44.0.tgz",
-      "integrity": "sha512-8541GEyktXaw4lvnGp9m84KENcxInhAt6vPWJ9RodsB/iGjHoMB2Pp5MVBCiKIRxrxzJhGCxmNzdu+oDQ7kwRA==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.44.0.tgz",
-      "integrity": "sha512-iUVJc3c0o8l9Sa/qlDL2Z9UP92UZZW1+EmQ4xfjTc1akr0iUFZNfxrXJ/R1T90h/ILm9iXEY6+iPrmYB3pXKjw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.44.0.tgz",
-      "integrity": "sha512-PQUobbhLTQT5yz/SPg116VJBgz+XOtXt8D1ck+sfJJhuEsMj2jSej5yTdp8CvWBSceu+WW+ibVL6dm0ptG5fcA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.44.0.tgz",
-      "integrity": "sha512-M0CpcHf8TWn+4oTxJfh7LQuTuaYeXGbk0eageVjQCKzYLsajWS/lFC94qlRqOlyC2KvRT90ZrfXULYmukeIy7w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.44.0.tgz",
-      "integrity": "sha512-3XJ0NQtMAXTWFW8FqZKcw3gOQwBtVWP/u8TpHP3CRPXD7Pd6s8lLdH3sHWh8vqKCyyiI8xW5ltJScQmBU9j7WA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "peer": true
-    },
-    "node_modules/vite/node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.44.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.44.0.tgz",
-      "integrity": "sha512-Q2Mgwt+D8hd5FIPUuPDsvPR7Bguza6yTkJxspDGkZj7tBRn2y4KSWYuIXpftFSjBra76TbKerCV7rgFPQrn+wQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "peer": true
-    },
-     "node_modules/vite/node_modules/rollup": {
-       "version": "4.44.0",
-       "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.44.0.tgz",
+       "version": "2025.12.1",
@@ -14,16 +14,17 @@

 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-cli";
-  version = "2025.12.0";
+  version = "2025.12.1";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-Pas9NQKLblVuB0Gx4j6Y64Mb2+RaCg7iquSWtN4K7kU=";
+    hash = "sha256-yER9LDFwTQkOdjB84UhEiWUDE+5Qa2vlRzq1/Qc/soY=";
  };

  patches = [
+    # https://github.com/bitwarden/clients/pull/18308
    ./fix-lockfile.patch
  ];

@@ -34,7 +35,7 @@ buildNpmPackage (finalAttrs: {

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-N7e8WKk2REEH4gP5c7k5zsu3n44hFFLxQ2X35viMuwM=";
+  npmDepsHash = "sha256-kgYXuiHeyqAKW0gVitL3b7eZMiZPFCeVeNtxClEJRfc=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    perl
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    } $ZIG_GLOBAL_CACHE_DIR/p
  '';

-  nativeBuildInputs = [ zig_0_14.hook ];
+  nativeBuildInputs = [ zig_0_14 ];

  buildInputs = [
    glfw
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  doInstallCheck = true;
@@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  buildInputs = [
@@ -8,7 +8,6 @@ python312Packages.buildPythonApplication rec {
  pname = "brutalmaze";
  version = "1.1.1";
  pyproject = true;
-  disabled = python312Packages.pythonOlder "3.7";

  src = fetchFromSourcehut {
    owner = "~cnx";
@@ -4,11 +4,14 @@
 # ```
 {
  lib,
+  stdenv,
  buildNpmPackage,
  fetchzip,
-  procps,
-  writableTmpDirAsHomeHook,
  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  bubblewrap,
+  procps,
+  socat,
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
@@ -44,9 +47,17 @@ buildNpmPackage (finalAttrs: {
      --set DISABLE_AUTOUPDATER 1 \
      --unset DEV \
      --prefix PATH : ${
-        lib.makeBinPath [
-          procps # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)
-        ]
+        lib.makeBinPath (
+          [
+            # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)
+            procps
+          ]
+          # the following packages are required for the sandbox to work (Linux only)
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            bubblewrap
+            socat
+          ]
+        )
      }
  '';

@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "colordiff";
-  version = "1.0.21";
+  version = "1.0.22";

  src = fetchFromGitHub {
    owner = "daveewart";
    repo = "colordiff";
    rev = "v${version}";
-    sha256 = "sha256-TNOw6dqsT0dOIddRoGwEF85CaQF8ICMFUi+GiG5WWpk=";
+    sha256 = "sha256-ZFxBY/QrKlRC7glEGWpB/79Jup0e4RCnS82Ct6lhK4Y=";
  };

  nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  depsBuildBuild = [ pkg-config ];

  nativeBuildInputs = [
-    zig.hook
+    zig
    pkg-config
    wayland-scanner
  ];
@@ -10,7 +10,6 @@ let
      # see https://github.com/devicetree-org/dt-schema/issues/108
      jsonschema = super.jsonschema.overridePythonAttrs (old: rec {
        version = "4.17.3";
-        disabled = self.pythonOlder "3.7";

        src = old.src.override {
          inherit version;
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-pfTlOMJpOPbXZaJJvOKDUyCZxFHNLRRUteJFWT9IKOU=";
  };

-  nativeBuildInputs = [ zig_0_13.hook ];
+  nativeBuildInputs = [ zig_0_13 ];

  passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };

@@ -1,107 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  perl,
-  util-linux,
-  keyutils,
-  nss,
-  nspr,
-  python2,
-  pam,
-  enablePython ? false,
-  intltool,
-  makeWrapper,
-  coreutils,
-  bash,
-  gettext,
-  cryptsetup,
-  lvm2,
-  rsync,
-  which,
-  lsof,
-  nixosTests,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ecryptfs";
-  version = "111";
-
-  src = fetchurl {
-    url = "https://launchpad.net/ecryptfs/trunk/${version}/+download/ecryptfs-utils_${version}.orig.tar.gz";
-    sha256 = "0zwq19siiwf09h7lwa7n7mgmrr8cxifp45lmwgcfr8c1gviv6b0i";
-  };
-
-  # TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
-  wrapperDir = "/run/wrappers/bin";
-
-  postPatch = ''
-    FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)"
-    for file in $FILES; do
-      substituteInPlace "$file" \
-        --replace /bin/mount ${util-linux}/bin/mount \
-        --replace /bin/umount ${util-linux}/bin/umount \
-        --replace /sbin/mount.ecryptfs_private ${wrapperDir}/mount.ecryptfs_private \
-        --replace /sbin/umount.ecryptfs_private ${wrapperDir}/umount.ecryptfs_private \
-        --replace /sbin/mount.ecryptfs $out/sbin/mount.ecryptfs \
-        --replace /sbin/umount.ecryptfs $out/sbin/umount.ecryptfs \
-        --replace /usr/bin/ecryptfs-rewrite-file $out/bin/ecryptfs-rewrite-file \
-        --replace /usr/bin/ecryptfs-mount-private $out/bin/ecryptfs-mount-private \
-        --replace /usr/bin/ecryptfs-setup-private $out/bin/ecryptfs-setup-private \
-        --replace /sbin/cryptsetup ${cryptsetup}/sbin/cryptsetup \
-        --replace /sbin/dmsetup ${lvm2}/sbin/dmsetup \
-        --replace /sbin/unix_chkpwd ${wrapperDir}/unix_chkpwd \
-        --replace /bin/bash ${bash}/bin/bash
-    done
-  '';
-
-  configureFlags = [ " --disable-openssl" ] ++ lib.optionals (!enablePython) [ "--disable-pywrap" ];
-
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
-    intltool
-  ]
-  # if python2 support is requested, it is needed at builtime as well as runtime.
-  ++ lib.optionals enablePython [ python2 ];
-  buildInputs = [
-    perl
-    nss
-    nspr
-    pam
-  ]
-  ++ lib.optionals enablePython [ python2 ];
-  propagatedBuildInputs = [
-    coreutils
-    gettext
-    cryptsetup
-    lvm2
-    rsync
-    keyutils
-    which
-  ];
-
-  postInstall = ''
-    FILES="$(grep -r '/bin/sh' $out/bin -l)"
-    for file in $FILES; do
-      wrapProgram $file \
-        --prefix PATH ":" "${coreutils}/bin" \
-        --prefix PATH ":" "${gettext}/bin" \
-        --prefix PATH ":" "${rsync}/bin" \
-        --prefix PATH ":" "${keyutils}/bin" \
-        --prefix PATH ":" "${which}/bin" \
-        --prefix PATH ":" "${lsof}/bin" \
-        --prefix PATH ":" "$out/bin"
-    done
-  '';
-
-  passthru.tests = { inherit (nixosTests) ecryptfs; };
-
-  meta = {
-    description = "Enterprise-class stacked cryptographic filesystem";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ obadz ];
-    platforms = lib.platforms.linux;
-  };
-}
@@ -3,14 +3,14 @@
    "alpha": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.72.tar.xz"
+          "factorio_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.72.tar.xz",
+        "name": "factorio_alpha_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "87d9f593569cbdf2f7a160f6a573f4939cbf01206209fbcdbaebf0385c2c7331",
+        "sha256": "68280b39bd01d7647df0cfa0e291d82c8123ffc2d522c8565860f6d52a7673eb",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/alpha/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/alpha/linux64",
+        "version": "2.0.73"
      },
      "stable": {
        "candidateHashFilenames": [
@@ -27,14 +27,14 @@
    "demo": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.70.tar.xz"
+          "factorio-demo_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_demo_x64-2.0.70.tar.xz",
+        "name": "factorio_demo_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "3be56bbfde644a3a97ab925a1fc2a32f9620e595fa14700bdcfbb127bc528bc8",
+        "sha256": "1c04ab58fe5e47eb83ba984014e355e8edbc7f941f655bad0b1ff0c5e68bd0f2",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.70/demo/linux64",
-        "version": "2.0.70"
+        "url": "https://factorio.com/get-download/2.0.73/demo/linux64",
+        "version": "2.0.73"
      },
      "stable": {
        "candidateHashFilenames": [
@@ -51,14 +51,14 @@
    "expansion": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.72.tar.xz"
+          "factorio-space-age_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.72.tar.xz",
+        "name": "factorio_expansion_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "9a667dd899ad4c8c410739a1da3a9318b46a5f34ee190e8b75ec22beac708249",
+        "sha256": "85d7223258f0001cd943004f30cb4d4f4c1a05d1f0fd3d19e05bc42c42b0d7a4",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/expansion/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/expansion/linux64",
+        "version": "2.0.73"
      },
      "stable": {
        "candidateHashFilenames": [
@@ -75,15 +75,15 @@
    "headless": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.72.tar.xz",
-          "factorio_headless_x64_2.0.72.tar.xz"
+          "factorio-headless_linux_2.0.73.tar.xz",
+          "factorio_headless_x64_2.0.73.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.72.tar.xz",
+        "name": "factorio_headless_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "cf3057340dbc9d82bd5161949ae3e7b8fad912ec7ca07b8a3151e0424a5568cd",
+        "sha256": "752025f81b5ec1229919edc869f9c8773db4bb548a90d370f85938236c857d9a",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/headless/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/headless/linux64",
+        "version": "2.0.73"
      },
      "stable": {
        "candidateHashFilenames": [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [ ./0001-changes.patch ];

  nativeBuildInputs = [
-    zig_0_14.hook
+    zig_0_14
  ];

  zigBuildFlags = [ "--release=fast" ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-6/rQ4xNfzJQwJgrpvFRuirqlx6fVn7sLXfVRFsG3fUw=";
  };

-  nativeBuildInputs = [ zig.hook ];
+  nativeBuildInputs = [ zig ];

  passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };

@@ -14,15 +14,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "foomatic-db";
-  version = "0-unstable-2025-11-22";
+  version = "0-unstable-2026-01-13";

  src = fetchFromGitHub {
    # there is also a daily snapshot at the `downloadPage`,
    # but it gets deleted quickly and would provoke 404 errors
    owner = "OpenPrinting";
    repo = "foomatic-db";
-    rev = "d4774d0c39bcdf970ccb335452f48d9241ec1f71";
-    hash = "sha256-r2Lb7qUoaBI1c/RVOvTuue8UkFnUbUKfBjB93qaC1pQ=";
+    rev = "abdfdb89a56edb0d1b7e0de2e01ce30cd0dbed22";
+    hash = "sha256-D0ULsTIVv7rJWdgK9EqH7visZoJONc8zGsV0r1uVNKE=";
  };

  buildInputs = [
@@ -98,11 +98,9 @@ stdenvNoCC.mkDerivation {
    ln -s ${lib.getExe fstarOldZ3} $out/bin/z3-${lib.escapeShellArg fstarOldZ3.version}
  '';

-  passthru = rec {
-    new = fstarNewZ3;
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = new;
+  passthru = {
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = fstarNewZ3;

-    old = fstarOldZ3;
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = old;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = fstarOldZ3;
  };
 }
@@ -37,8 +37,6 @@ python.pkgs.buildPythonApplication rec {
    hash = "sha256-Jam7Txm+Fq5zEkJZMmbWW5Ok4ThsPyi6NIeawQot0RE=";
  };

-  disabled = python.pythonOlder "3.7";
-
  propagatedBuildInputs = with python.pkgs; [
    docopt
    lark
@@ -24,8 +24,7 @@
  wrapGAppsHook4,
  zig_0_14,

-  # Usually you would override `zig.hook` with this, but we do that internally
-  # since upstream recommends a non-default level
+  # Upstream recommends a non-default level
  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/PACKAGING.md#build-options
  optimizeLevel ? "ReleaseFast",
 }:
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "git-wt";
-  version = "0.13.0";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "k1LoW";
    repo = "git-wt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-513y6uB32ln1k3N4f8L2ph6sf2/1tLfLSO+4kEc4nB8=";
+    hash = "sha256-uyvLbWsDN2ZxPzkLqHM782L/YyfarOgd8jDfmjtLNRY=";
  };

  vendorHash = "sha256-K5geAvG+mvnKeixOyZt0C1T5ojSBFmx2K/Msol0HsSg=";
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  postPatch = ''
@@ -5,7 +5,7 @@
  nix-update-script,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "gorilla-cli";
  version = "0.0.9";
  pyproject = true;
@@ -13,13 +13,11 @@ python3.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "gorilla-llm";
    repo = "gorilla-cli";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-3h3QtBDKswTDL7zNM2C4VWiGCqknm/bxhP9sw4ieIcQ=";
  };

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
    requests
@@ -35,9 +33,9 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "LLMs for your CLI";
    homepage = "https://github.com/gorilla-llm/gorilla-cli";
-    changelog = "https://github.com/gorilla-llm/gorilla-cli/releases/tag/${version}";
+    changelog = "https://github.com/gorilla-llm/gorilla-cli/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ happysalada ];
    mainProgram = "gorilla";
  };
-}
+})
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "goverlay";
-  version = "1.6.8";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "benjamimgois";
    repo = "goverlay";
    tag = finalAttrs.version;
-    hash = "sha256-88Ev83onTrtH+xPu11RNTZN4pCsWJ+eTJc6J2XTN7Z4=";
+    hash = "sha256-xfc+ht1piVnjXK+hxHKbhdpp63p/DMLPSzvJq+mYhFs=";
  };

  outputs = [
@@ -8,29 +8,29 @@

 let
  pname = "hamrs-pro";
-  version = "2.45.0";
+  version = "2.47.0";

  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-XnG0hOjngq1lJEfw1JivsHfUhwaTaXDMP5HPJrPNHc4=";
+      hash = "sha256-TFiU3bbDm3NpjfOJcbzp9Rpyn2YkvZYTf25vgOwlCvE=";
    };

    aarch64-linux = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-cNanQy2OYX5v20pD5UOwjS1/aBCXCMeuXkhNnYJCXxk=";
+      hash = "sha256-AH93E5WCIffEshtPiy6Yq9f1DLc2w9o9f6KcnYP5EI0=";
    };

    x86_64-darwin = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-//diABsf82kg5u5NjT6r5soo+dAxMe5QNGLdDAUJJ6w=";
+      hash = "sha256-/tEaRfviWGxvSP/TsR3ZOa3FFOqxdV2uwhg1TNSsTxU=";
    };

    aarch64-darwin = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-ljRB2XqiIWl/uIAi74F4/xQ8qPnPl8Iriu0rwe9JXLA=";
+      hash = "sha256-MXz5d1GeXeoOG29FxecXGunSFwRSVbFf1dozsAhTzE0=";
    };
  };

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  postPatch = ''
@@ -24,18 +24,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "impression";
-  version = "3.5.5";
+  version = "3.6.0";

  src = fetchFromGitLab {
    owner = "adhami3310";
    repo = "Impression";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ldWINEU4ne15neinuPhs90X2bTkg44xcalyEW0g6TdA=";
+    hash = "sha256-jxfleGDIetTxh0YltKYz2KYE00opwZb+rnaR76beGWA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-QjGtPA2RO+0BF/bTlBz8xx8DRO9lRwTOQIgRmZB6Fbs=";
+    hash = "sha256-RR27VE1/8jG2HgeWtIwGsF9HUlI3Kky9J4X6kZnA+kw=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-compute-runtime";
-  version = "25.48.36300.8";
+  version = "26.01.36711.4";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    tag = version;
-    hash = "sha256-ymXvbDX01WnsQ2pxCnQU1dKhK+/Jzz1m3Tgg665mdcM=";
+    hash = "sha256-77fVA2T6niK2a9i6v6sAR98fHnExbHqRdHexKBkqd7M=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-43w5kA/rGEt7mZCPWlSzYQAme7YJ4EZ97zHmNiDzZ0c=";
+    hash = "sha256-wcUDzrI8jR8fedwu1Z9eY1NLJytDgZsdVK3ay2q6IbM=";
  };

-  cargoHash = "sha256-/Y9GCKsam5x1FjWcNxKiwf3LiYRg3SWILWGnuyhptrc=";
+  cargoHash = "sha256-ajZUTE/J0I0jEQebLRw/4lstOQNxe+Nh7HTINN0g5K8=";

  passthru = {
    updateScript = nix-update-script { };
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "kanboard";
-  version = "1.2.48";
+  version = "1.2.49";

  src = fetchFromGitHub {
    owner = "kanboard";
    repo = "kanboard";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qaVQ0urVdy5ADlLY7v9FJB8TSEuuopuX/XUYRzwbgY0=";
+    hash = "sha256-d74XjURu7vJwn+6p/br76jp4zJiYhYJLSjvxLamt48Q=";
  };

  dontBuild = true;
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libphonenumber";
-  version = "9.0.21";
+  version = "9.0.22";

  src = fetchFromGitHub {
    owner = "google";
    repo = "libphonenumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2YiTjudHEKl3JJMF4jV/DpQFZbBEb4z6WZxU+jdGVx0=";
+    hash = "sha256-gQcMpwVf49m/f62ABd7/IluLe8mUjapNtnrPSmaLJJ0=";
  };

  patches = [
@@ -1,12 +1,18 @@
 {
  lib,
  stdenv,
+  gcc14Stdenv,
  fetchFromGitHub,
  libpq,
  python3,
+  postgresql,
+  postgresqlTestHook,
+  autoreconfHook,
 }:

-stdenv.mkDerivation (finalAttrs: {
+# Work around issue reported in https://github.com/NixOS/nixpkgs/issues/476278.
+# Should be solved when libpqxx 8.x is released.
+gcc14Stdenv.mkDerivation (finalAttrs: {
  pname = "libpqxx";
  version = "7.10.5";

@@ -23,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
+    # Needed because Makefile.am is patched to disable the tools/lint test.
+    autoreconfHook
    python3
  ];

@@ -30,8 +38,19 @@ stdenv.mkDerivation (finalAttrs: {
    libpq
  ];

+  nativeCheckInputs = [
+    postgresql
+    postgresqlTestHook
+  ];
+
  postPatch = ''
+    # Disable linting step for tests, it tries to install packages with pip.
+    substituteInPlace Makefile.am \
+      --replace-fail "TESTS = tools/lint" ""
+
    patchShebangs ./tools/splitconfig.py
+    # Needed for autoreconfHook
+    patchShebangs tools/*.py
  '';

  configureFlags = [
@@ -39,6 +58,12 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-shared"
  ];

+  doCheck = true;
+
+  enableParallelBuilding = true;
+
+  __structuredAttrs = true;
+
  strictDeps = true;

  meta = {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    installShellFiles
-    zig.hook
+    zig
  ];

  postInstall = ''
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    installShellFiles
-    zig.hook
+    zig
  ];

  doInstallCheck = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    makeBinaryWrapper
-    zig_0_15.hook
+    zig_0_15
  ];
  buildInputs = [
    linux-pam
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "maltego";
-  version = "4.11.0";
+  version = "4.11.1";

  src = fetchzip {
    url = "https://downloads.maltego.com/maltego-v4/linux/Maltego.v${finalAttrs.version}.linux.zip";
-    hash = "sha256-+kbQsXIp9BAr6NxleMiGbmvIFWTDJzYQC6vtzYlK39Y=";
+    hash = "sha256-9VDArX8fc4Orh5xCILX7n2teB6cRUABTkCYaStPoa80=";
  };

  postPatch = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    pkg-config
-    zig_0_14.hook
+    zig_0_14
    makeWrapper
  ];

@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  meta = {
@@ -4,23 +4,19 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "mongoaudit";
  version = "0.1.1";
  pyproject = true;

-  disabled = python3.pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "stampery";
    repo = "mongoaudit";
-    rev = version;
-    sha256 = "17k4vw5d3kr961axl49ywid4cf3n7zxvm885c4lv15w7s2al1425";
+    tag = finalAttrs.version;
+    hash = "sha256-RZBAldCHl7ApYQWhuvs/djhGWuQ+EdpVMCnP0QrfZJ4=";
  };

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
    pymongo
@@ -28,19 +24,16 @@ python3.pkgs.buildPythonApplication rec {
    urwid
  ];

-  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "mongoaudit"
-  ];
+  pythonImportsCheck = [ "mongoaudit" ];

  meta = {
    description = "MongoDB auditing and pentesting tool";
    homepage = "https://github.com/stampery/mongoaudit";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/stampery/mongoaudit/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "mongoaudit";
  };
-}
+})
@@ -327,6 +327,7 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    mainProgram = "mpv";
    maintainers = with lib.maintainers; [
+      colinsane
      fpletz
      SchweGELBin
    ];
@@ -20,8 +20,6 @@ python3Packages.buildPythonApplication rec {
    substituteInPlace requirements.txt --replace-fail 'junit-xml==1.8' 'junit-xml==1.9'
  '';

-  disabled = python3Packages.pythonOlder "3.7";
-
  doCheck = false;

  build-system = with python3Packages; [ setuptools ];
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "mycelium";
-  version = "0.6.1";
+  version = "0.7.1";

  sourceRoot = "${src.name}/myceliumd";

@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
    owner = "threefoldtech";
    repo = "mycelium";
    rev = "v${version}";
-    hash = "sha256-DP6gCTuWraCwprY5C0JlTR1VrOwrOnUMSVxuPSVMjo0=";
+    hash = "sha256-9/9vPUGIEGzbD8uMu3J8uQvNItc7UB4+X21riYjtDD8=";
  };

-  cargoHash = "sha256-5TyJNYBTULSu886D+vy8YRh50oFBubNZ9KkMu1/PvgU=";
+  cargoHash = "sha256-F8zHaFDOfgTolW1tO4T8QpGaPoN3kehhqKgwv2KouRM=";

  nativeBuildInputs = [ versionCheckHook ];

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig_0_15.hook
+    zig_0_15
    installShellFiles
    pkg-config
  ];
@@ -5,24 +5,21 @@
  fetchFromGitHub,
 }:

-let
-  version = "1.1.2";
-in
-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nile";
-  inherit version;
+  version = "1.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "imLinguin";
    repo = "nile";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-/C4b8wPKWHGgiheuAN7AvU+KcD5aj5i6KzgFSdTIkNI=";
  };

-  disabled = python3Packages.pythonOlder "3.8";
+  build-system = with python3Packages; [ setuptools ];

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
    setuptools
    requests
    protobuf
@@ -43,14 +40,16 @@ python3Packages.buildPythonApplication {

  pythonImportsCheck = [ "nile" ];

-  meta = {
-    description = "Unofficial Amazon Games client";
-    mainProgram = "nile";
-    homepage = "https://github.com/imLinguin/nile";
-    license = with lib.licenses; [ gpl3 ];
-  };
-
  passthru.updateScript = gitUpdater {
    rev-prefix = "v";
  };
-}
+
+  meta = {
+    description = "Unofficial Amazon Games client";
+    homepage = "https://github.com/imLinguin/nile";
+    changelog = "https://github.com/imLinguin/nile/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "nile";
+    maintainers = [ ];
+  };
+})
@@ -1,13 +1,13 @@
 {
  lib,
  stdenv,
-  python3,
+  awscli,
  fetchFromGitHub,
  installShellFiles,
-  awscli,
+  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "nimbo";
  version = "0.3.0";
  format = "setuptools";
@@ -15,33 +15,40 @@ python3.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "nimbo-sh";
    repo = "nimbo";
-    rev = "v${version}";
-    sha256 = "YC5T02Sw22Uczufbyts8l99oCQW4lPq0gPMRXCoKsvw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YC5T02Sw22Uczufbyts8l99oCQW4lPq0gPMRXCoKsvw=";
  };

-  # Rich + Colorama are added in `propagatedBuildInputs`
  postPatch = ''
+    # Wrong format specifier in awscli dependency
    substituteInPlace setup.py \
-      --replace "awscli>=1.19<2.0" "" \
-      --replace "colorama==0.4.3" "" \
-      --replace "rich>=10.1.0" ""
+      --replace-fail "awscli>=1.19<2.0" "awscli>=1.19,<2.0"
  '';

+  pythonRelaxDeps = [
+    "awscli"
+    "colorama"
+    "rich"
+  ];
+
+  build-system = with python3.pkgs; [ setuptools ];
+
  nativeBuildInputs = [ installShellFiles ];

-  propagatedBuildInputs = with python3.pkgs; [
-    setuptools
+  dependencies = with python3.pkgs; [
    boto3
-    requests
    click
-    pyyaml
-    pydantic
-    rich
    colorama
+    pydantic
+    pyyaml
+    requests
+    rich
+    setuptools
  ];

  # nimbo tests require an AWS instance
  doCheck = false;
+
  pythonImportsCheck = [ "nimbo" ];

  makeWrapperArgs = [
@@ -51,17 +58,10 @@ python3.pkgs.buildPythonApplication rec {
    (lib.makeBinPath [ awscli ])
  ];

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd nimbo \
-      --zsh <(_NIMBO_COMPLETE=source_zsh $out/bin/nimbo) \
-      --bash <(_NIMBO_COMPLETE=source_bash $out/bin/nimbo) \
-      --fish  <(_NIMBO_COMPLETE=source_fish $out/bin/nimbo)
-  '';
-
  meta = {
    description = "Run machine learning jobs on AWS with a single command";
    homepage = "https://github.com/nimbo-sh/nimbo";
    license = lib.licenses.bsl11;
    maintainers = with lib.maintainers; [ noreferences ];
  };
-}
+})
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    installShellFiles
-    zig.hook
+    zig
    nasm
  ];

@@ -17,8 +17,6 @@ python3Packages.buildPythonApplication rec {
  version = "2.8";
  pyproject = true;

-  disabled = python3Packages.pythonOlder "3.7";
-
  src = fetchFromSourcehut {
    owner = "~lioploum";
    repo = "offpunk";
@@ -138,16 +138,16 @@ in
 goBuild (finalAttrs: {
  pname = "ollama";
  # don't forget to invalidate all hashes each update
-  version = "0.13.5";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4K1+GE96Uu5w1otSiP69vNDJ03tFvr78VluIEHMzFGQ=";
+    hash = "sha256-hJeEWkIWQHITxzo6VGqkWJHOktBJyVNIEKtUdSPyD24=";
  };

-  vendorHash = "sha256-NM0vtue0MFrAJCjmpYJ/rPEDWBxWCzBrWDb0MVOhY+Q=";
+  vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc=";

  env =
    lib.optionalAttrs enableRocm {
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oniux";
-  version = "0.6.1";
+  version = "0.7.0";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
    owner = "tpo/core";
    repo = "oniux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-icrNKF9cGPBZPbaGCj2c8OtdP6A14whPoP39zhs4wlo=";
+    hash = "sha256-MUSLyNKJTLwFxDLglNN9YoX58yBDrtW2Atds/zvnmFY=";
  };

-  cargoHash = "sha256-juWtf0aX70xJTx9KpXOATyXARhk7aTaveUFN0OPKrbs=";
+  cargoHash = "sha256-MoAjUn6rBiIK3sZDEcJjRZdfFOTSUT4/eeC3ymsQs14=";

  nativeBuildInputs = [
    perl
@@ -1,38 +0,0 @@
-#!/usr/bin/env bun
-
-import solidPlugin from "./node_modules/@opentui/solid/scripts/solid-plugin"
-import fs from "fs"
-
-const version = process.env.OPENCODE_VERSION!
-const channel = process.env.OPENCODE_CHANNEL!
-
-const result = await Bun.build({
-  target: "bun",
-  outdir: "./dist",
-  entrypoints: [
-    "./src/index.ts",
-    "./src/cli/cmd/tui/worker.ts"
-  ],
-  plugins: [solidPlugin],
-  naming: {
-    entry: "[dir]/[name].js"
-  },
-  define: {
-    OPENCODE_VERSION: JSON.stringify(version),
-    OPENCODE_CHANNEL: JSON.stringify(channel),
-  },
-  external: [
-    "@opentui/core-*",
-  ],
-})
-
-if (!result.success) {
-  console.error("Bundle failed:", result.logs)
-  process.exit(1)
-}
-
-// Move worker file to worker.ts at the dist root so the code can find it
-if (fs.existsSync("./dist/cli/cmd/tui/worker.js")) {
-  fs.renameSync("./dist/cli/cmd/tui/worker.js", "./dist/worker.ts")
-  fs.rmdirSync("./dist/cli/cmd/tui", { recursive: true })
-}
@@ -8,8 +8,8 @@
  models-dev,
  nix-update-script,
  ripgrep,
-  testers,
  installShellFiles,
+  versionCheckHook,
  writableTmpDirAsHomeHook,
 }:
 let
@@ -19,7 +19,7 @@ let
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${version}";
-    hash = "sha256-B0NkJ4HSxgdjBuydvjcNcoaW5WIYcuKV8qHYapAaDmU=";
+    hash = "sha256-uNeje6WZ/FJVOtxdTdWXbWhPl7BwMws+7/Iz2Hz/stw=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -41,20 +41,15 @@ let
    buildPhase = ''
      runHook preBuild

-      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
-
      bun install \
        --cpu="*" \
-        --filter=./packages/opencode \
-        --force \
        --frozen-lockfile \
        --ignore-scripts \
        --no-progress \
-        --os="*" \
-        --production
+        --os="*"

-      bun run ./nix/scripts/canonicalize-node-modules.ts
-      bun run ./nix/scripts/normalize-bun-binaries.ts
+      bun --bun ./nix/scripts/canonicalize-node-modules.ts
+      bun --bun ./nix/scripts/normalize-bun-binaries.ts

      runHook postBuild
    '';
@@ -71,7 +66,7 @@ let
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-vRIWQt02VljcoYG3mwJy8uCihSTB/OLypyw+vt8LuL8=";
+    outputHash = "sha256-OJ3C4RMzfbbG1Fwa/5yru0rlISj+28UPITMNBEU5AeM=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -95,37 +90,38 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  patches = [
    # NOTE: Relax Bun version check to be a warning instead of an error
    ./relax-bun-version-check.patch
+    # NOTE: Remove special and windows build targes
+    ./remove-special-and-windows-build-targets.patch
  ];

-  dontConfigure = true;
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${node_modules}/. .
+
+    runHook postConfigure
+  '';

  env.MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
  env.OPENCODE_VERSION = finalAttrs.version;
  env.OPENCODE_CHANNEL = "stable";

+  preBuild = ''
+    chmod -R u+w ./packages/opencode/node_modules
+    pushd ./packages/opencode/node_modules/@opentui/
+      for pkg in ../../../../node_modules/.bun/@opentui+core-*; do
+        linkName=$(basename "$pkg" | sed 's/@.*+\(.*\)@.*/\1/')
+        ln -sf "$pkg/node_modules/@opentui/$linkName" "$linkName"
+      done
+    popd
+  '';
+
  buildPhase = ''
    runHook preBuild

-    # Copy all node_modules including the .bun directory with actual packages
-    cp -r ${finalAttrs.node_modules}/node_modules .
-    cp -r ${finalAttrs.node_modules}/packages .
-
-    (
-      cd packages/opencode
-
-      # Fix symlinks to workspace packages
-      chmod -R u+w ./node_modules
-      mkdir -p ./node_modules/@opencode-ai
-      rm -f ./node_modules/@opencode-ai/{script,sdk,plugin}
-      ln -s $(pwd)/../../packages/script ./node_modules/@opencode-ai/script
-      ln -s $(pwd)/../../packages/sdk/js ./node_modules/@opencode-ai/sdk
-      ln -s $(pwd)/../../packages/plugin ./node_modules/@opencode-ai/plugin
-
-      # Use upstream bundle.ts for Nix-compatible bundling
-      cp ../../nix/bundle.ts ./bundle.ts
-      chmod +x ./bundle.ts
-      bun run ./bundle.ts
-    )
+    cd ./packages/opencode
+    bun --bun ./script/build.ts --single --skip-install
+    bun --bun ./script/schema.ts schema.json

    runHook postBuild
  '';
@@ -133,93 +129,37 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    cd packages/opencode
-    if [ ! -d dist ]; then
-      echo "ERROR: dist directory missing after bundle step"
-      exit 1
-    fi
-
-    mkdir -p $out/lib/opencode
-    cp -r dist $out/lib/opencode/
-    chmod -R u+w $out/lib/opencode/dist
-
-    # Select bundled worker assets deterministically (sorted find output)
-    worker_file=$(find "$out/lib/opencode/dist" -type f \( -path '*/tui/worker.*' -o -name 'worker.*' \) | sort | head -n1)
-    parser_worker_file=$(find "$out/lib/opencode/dist" -type f -name 'parser.worker.*' | sort | head -n1)
-    if [ -z "$worker_file" ]; then
-      echo "ERROR: bundled worker not found"
-      exit 1
-    fi
-
-    main_wasm=$(printf '%s\n' "$out"/lib/opencode/dist/tree-sitter-*.wasm | sort | head -n1)
-    wasm_list=$(find "$out/lib/opencode/dist" -maxdepth 1 -name 'tree-sitter-*.wasm' -print)
-    for patch_file in "$worker_file" "$parser_worker_file"; do
-      [ -z "$patch_file" ] && continue
-      [ ! -f "$patch_file" ] && continue
-      if [ -n "$wasm_list" ] && grep -q 'tree-sitter' "$patch_file"; then
-        # Rewrite wasm references to absolute store paths to avoid runtime resolve failures.
-        bun --bun ../../nix/scripts/patch-wasm.ts "$patch_file" "$main_wasm" $wasm_list
-      fi
-    done
-
-    mkdir -p $out/lib/opencode/node_modules
-    cp -r ../../node_modules/.bun $out/lib/opencode/node_modules/
-    mkdir -p $out/lib/opencode/node_modules/@opentui
-
-    # Generate and install JSON schema
-    mkdir -p $out/share/opencode
-    HOME=$TMPDIR bun --bun script/schema.ts $out/share/opencode/schema.json
-
-    mkdir -p $out/bin
-    makeWrapper ${lib.getExe bun} $out/bin/opencode \
-      --add-flags "run" \
-      --add-flags "$out/lib/opencode/dist/src/index.js" \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          fzf
-          ripgrep
-        ]
-      } \
-      --argv0 opencode
+    install -Dm755 dist/opencode-*/bin/opencode $out/bin/opencode
+    install -Dm644 schema.json $out/share/opencode/schema.json

    runHook postInstall
  '';

-  postInstall = ''
-    # Add symlinks for platform-specific native modules
-    pkgs=(
-      $out/lib/opencode/node_modules/.bun/@opentui+core-*
-      $out/lib/opencode/node_modules/.bun/@opentui+solid-*
-      $out/lib/opencode/node_modules/.bun/@opentui+core@*
-      $out/lib/opencode/node_modules/.bun/@opentui+solid@*
-    )
-    for pkg in "''${pkgs[@]}"; do
-      if [ -d "$pkg" ]; then
-        pkgName=$(basename "$pkg" | sed 's/@opentui+\([^@]*\)@.*/\1/')
-        ln -sf ../.bun/$(basename "$pkg")/node_modules/@opentui/$pkgName \
-          $out/lib/opencode/node_modules/@opentui/$pkgName
-      fi
-    done
-
-    ${lib.optionalString
-      (
-        (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform)
-        && (stdenvNoCC.hostPlatform.system != "x86_64-darwin")
-      )
-      ''
-        installShellCompletion --cmd opencode \
-          --bash <($out/bin/opencode completion)
-      ''
-    }
+  postInstall = lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+    installShellCompletion --cmd opencode \
+      --bash <($out/bin/opencode completion)
  '';

+  postFixup = ''
+    wrapProgram $out/bin/opencode \
+     --prefix PATH : ${
+       lib.makeBinPath [
+         fzf
+         ripgrep
+       ]
+     }
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  doInstallCheck = true;
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "--version";
+
  passthru = {
    jsonschema = "${placeholder "out"}/share/opencode/schema.json";
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "HOME=$(mktemp -d) opencode --version";
-      inherit (finalAttrs) version;
-    };
    updateScript = nix-update-script {
      extraArgs = [
        "--subpackage"
@@ -230,11 +170,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  meta = {
    description = "AI coding agent built for the terminal";
-    longDescription = ''
-      OpenCode is a terminal-based agent that can build anything.
-      It combines a TypeScript/JavaScript core with a Go-based TUI
-      to provide an interactive AI coding experience.
-    '';
    homepage = "https://github.com/anomalyco/opencode";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ delafthi ];
@@ -0,0 +1,100 @@
+From 4d0a82e8f3cf8bf011e2592677db4aa31b6b290b Mon Sep 17 00:00:00 2001
+From: Thierry Delafontaine <delafthi@pm.me>
+Date: Sun, 4 Jan 2026 20:55:49 +0100
+Subject: [PATCH]  Remove special and windows build targets
+
+---
+ packages/opencode/script/build.ts | 70 +++++++++++++++----------------
+ 1 file changed, 35 insertions(+), 35 deletions(-)
+
+diff --git a/packages/opencode/script/build.ts b/packages/opencode/script/build.ts
+index f51cb2924..ee3c0e863 100755
+--- a/packages/opencode/script/build.ts
+++ b/packages/opencode/script/build.ts
+@@ -33,27 +33,27 @@ const allTargets: {
+     os: "linux",
+     arch: "x64",
+   },
+-  {
+-    os: "linux",
+-    arch: "x64",
+-    avx2: false,
+-  },
+-  {
+-    os: "linux",
+-    arch: "arm64",
+-    abi: "musl",
+-  },
+-  {
+-    os: "linux",
+-    arch: "x64",
+-    abi: "musl",
+-  },
+-  {
+-    os: "linux",
+-    arch: "x64",
+-    abi: "musl",
+-    avx2: false,
+-  },
+  // {
+  //   os: "linux",
+  //   arch: "x64",
+  //   avx2: false,
+  // },
+  // {
+  //   os: "linux",
+  //   arch: "arm64",
+  //   abi: "musl",
+  // },
+  // {
+  //   os: "linux",
+  //   arch: "x64",
+  //   abi: "musl",
+  // },
+  // {
+  //   os: "linux",
+  //   arch: "x64",
+  //   abi: "musl",
+  //   avx2: false,
+  // },
+   {
+     os: "darwin",
+     arch: "arm64",
+@@ -62,20 +62,20 @@ const allTargets: {
+     os: "darwin",
+     arch: "x64",
+   },
+-  {
+-    os: "darwin",
+-    arch: "x64",
+-    avx2: false,
+-  },
+-  {
+-    os: "win32",
+-    arch: "x64",
+-  },
+-  {
+-    os: "win32",
+-    arch: "x64",
+-    avx2: false,
+-  },
+  // {
+  //   os: "darwin",
+  //   arch: "x64",
+  //   avx2: false,
+  // },
+  // {
+  //   os: "win32",
+  //   arch: "x64",
+  // },
+  // {
+  //   os: "win32",
+  //   arch: "x64",
+  //   avx2: false,
+  // },
+ ]
+ 
+ const targets = singleFlag
+-- 
+2.52.0
+
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  meta = {
@@ -4,19 +4,19 @@
  python3Packages,
 }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "peru";
-  version = "1.3.4";
+  version = "1.3.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "buildinspace";
    repo = "peru";
-    rev = version;
-    sha256 = "sha256-ubkDB/McG2Tp3s0K5PbL6QpHbpqRLAUSHa7v+u/n6hI=";
+    tag = finalAttrs.version;
+    hash = "sha256-RFf4JWjt5FqM3At0boBNmg4GStLehyxuueA8hCc0sxg=";
  };

-  build-system = with python3Packages; [ setuptools ];
+  build-system = with python3Packages; [ hatchling ];

  dependencies = with python3Packages; [
    pyyaml
@@ -29,11 +29,12 @@ python3Packages.buildPythonApplication rec {
  pythonImportsCheck = [ "peru" ];

  meta = {
-    homepage = "https://github.com/buildinspace/peru";
    description = "Tool for including other people's code in your projects";
+    homepage = "https://github.com/buildinspace/peru";
+    changelog = "https://github.com/buildinspace/peru/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
+    maintainers = [ ];
    platforms = lib.platforms.unix;
    mainProgram = "peru";
  };
-
-}
+})
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig_0_13.hook
+    zig_0_13
  ];

  meta = {
@@ -4,38 +4,31 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "regexploit";
  version = "1.0.0";
  pyproject = true;

-  disabled = python3.pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "doyensec";
    repo = "regexploit";
-    rev = "v${version}";
-    sha256 = "0z3fghsyw0ll36in7ihc0qi3gy7mqi6cw1mi8m8c8xb1nlwpfr0y";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HmR3ObVhdcRQRbEGzkzE9fg3IgYMxmOjGZQC7jV8bnw=";
  };

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

-  dependencies = with python3.pkgs; [
-    pyyaml
-  ];
+  dependencies = with python3.pkgs; [ pyyaml ];

-  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];

  pythonImportsCheck = [ "regexploit" ];

  meta = {
    description = "Tool to find regular expressions which are vulnerable to ReDoS";
    homepage = "https://github.com/doyensec/regexploit";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/doyensec/regexploit/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -6,27 +6,24 @@
  qt6,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "retool";
  version = "2.4.5";
-
  pyproject = true;
-  disabled = python3.pkgs.pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "unexpectedpanda";
    repo = "retool";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-q1v/VPcKIMGcAtnELKUpVgRGPyMmL8zJr5RdOClCwoc=";
  };

-  nativeBuildInputs = with python3.pkgs; [
-    hatchling
-    qt6.wrapQtAppsHook
-  ];
-
  pythonRelaxDeps = true;

+  build-system = with python3.pkgs; [ hatchling ];
+
+  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
+
  buildInputs = [
    qt6.qtbase
  ]
@@ -34,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
    qt6.qtwayland
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    alive-progress
    darkdetect
    lxml
@@ -50,8 +47,8 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "Better filter tool for Redump and No-Intro dats";
    homepage = "https://github.com/unexpectedpanda/retool";
-    changelog = "https://github.com/unexpectedpanda/retool/blob/${src.tag}/changelog.md";
+    changelog = "https://github.com/unexpectedpanda/retool/blob/${finalAttrs.src.tag}/changelog.md";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ thiagokokada ];
  };
-}
+})
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    pkg-config
-    zig.hook
+    zig
  ];

  buildInputs = [
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    wayland-scanner
    xwayland
-    zig_0_15.hook
+    zig_0_15
  ]
  ++ lib.optional withManpages scdoc;

@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
    pkg-config
    wayland
    wayland-scanner
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    wayland
    wayland-protocols
    wayland-scanner
-    zig.hook
+    zig
  ];

  postPatch = ''
@@ -155,18 +155,6 @@
    "hash": "sha256-pfhN5HDSWbo6hmlSnCVWvnkYTqSjs8PNtSyHCEEtUjI=",
    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/microsoft.visualstudio.threading.analyzers/17.13.2/microsoft.visualstudio.threading.analyzers.17.13.2.nupkg"
  },
-  {
-    "pname": "Microsoft.WindowsDesktop.App.Ref",
-    "version": "8.0.22",
-    "hash": "sha256-F8DQPfK1IiD8+H8A85QSBHhzJIo1fmAXwXaSge7EhBE=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/microsoft.windowsdesktop.app.ref/8.0.22/microsoft.windowsdesktop.app.ref.8.0.22.nupkg"
-  },
-  {
-    "pname": "Microsoft.WindowsDesktop.App.Ref",
-    "version": "9.0.11",
-    "hash": "sha256-i9M6vgo3DOA04FzxnWIjleUySW7Wy7d5elyUp6tI5OY=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/microsoft.windowsdesktop.app.ref/9.0.11/microsoft.windowsdesktop.app.ref.9.0.11.nupkg"
-  },
  {
    "pname": "NETStandard.Library",
    "version": "2.0.3",
@@ -47,6 +47,11 @@ buildDotnetModule rec {
      --replace-fail "patch" "latestFeature"
  '';

+  dotnetFlags = [
+    # this removes the Microsoft.WindowsDesktop.App.Ref dependency
+    "-p:EnableWindowsTargeting=false"
+  ];
+
  buildPhase = ''
    runHook preBuild

@@ -54,7 +59,8 @@ buildDotnetModule rec {
      -p:Configuration=Release \
      -p:RepositoryUrl="${meta.homepage}" \
      -p:RepositoryCommit="v${version}" \
-      src/NuGet/Microsoft.Net.Compilers.Toolset/Framework/Microsoft.Net.Compilers.Toolset.Framework.Package.csproj
+      $dotnetFlags \
+      $dotnetProjectFiles

    runHook postBuild
  '';
@@ -12,14 +12,14 @@

 stdenv.mkDerivation {
  pname = "scitokens-cpp";
-  version = "1.1.3";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "scitokens";
    repo = "scitokens-cpp";

-    rev = "v1.1.3";
-    hash = "sha256-5EVN/Q4/veNsIdTKcULdKJ+BmRodelfo+CTdrfvkkK8=";
+    rev = "v1.2.0";
+    hash = "sha256-Sc3+g2MMxVnPNI4V/f8Ss8Z3SOQScC9fj8woJDm2O/A=";
  };

  nativeBuildInputs = [
@@ -19,14 +19,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "SG-323";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "greyboxaudio";
    repo = "SG-323";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-DvA9Y7eAG0pWLmHEZmJlo0JLU+0B4c8rlkX1bbVcnL8=";
+    hash = "sha256-yAC4YQt8f5kQ03ECAxvoM9wcqna98F4XKcwUQg6l4E0=";
  };

  nativeBuildInputs = [
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    zig.hook
+    zig
  ];

  postPatch = ''
@@ -17,7 +17,7 @@
 let
  pname = "synology-drive-client";
  baseUrl = "https://global.synologydownload.com/download/Utility/SynologyDriveClient";
-  version = "3.5.1-16101";
+  version = "4.0.1-17885";
  buildNumber = lib.last (lib.splitString "-" version);
  meta = {
    description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server";
@@ -27,6 +27,7 @@ let
    maintainers = with lib.maintainers; [
      jcouyang
      MoritzBoehme
+      nivalux
    ];
    platforms = [
      "x86_64-linux"
@@ -37,14 +38,19 @@ let
  };
  passthru.updateScript = writeScript "update-synology-drive-client" ''
    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl common-updater-scripts
+    #!nix-shell -i bash -p curl jq common-updater-scripts

    set -eu -o pipefail

-    version="$(curl -s https://www.synology.com/en-uk/releaseNote/SynologyDriveClient \
-             | grep -oP '(?<=data-version=")(\d.){2}\d-\d{5}' \
-             | head -1)"
-    update-source-version synology-drive-client "$version"
+    version=$(curl -s "https://www.synology.com/api/releaseNote/findChangeLog?identify=SynologyDriveClient&lang=en-uk" \
+              | jq -r '.info.versions | to_entries | .[0].value.all_versions[0].version')
+
+    if [[ "$version" =~ ^[0-9.]+(-[0-9]+)?$ ]]; then
+      update-source-version synology-drive-client "$version"
+    else
+      echo "Error: Invalid version format: '$version'"
+      exit 1
+    fi
  '';

  linux = stdenv.mkDerivation {
@@ -57,7 +63,7 @@ let

    src = fetchurl {
      url = "${baseUrl}/${version}/Ubuntu/Installer/synology-drive-client-${buildNumber}.x86_64.deb";
-      sha256 = "sha256-VeS5bPcMM4JDCSH5GXkl4OgQjrPKaNDh5PfX28/zqaU=";
+      sha256 = "sha256-DMHqh8o0RknWTycANSbMpJj133/MZ8uZ18ytDZVaKMg=";
    };

    nativeBuildInputs = [
@@ -77,6 +83,10 @@ let
      mkdir -p $out
      dpkg -x $src $out
      rm -rf $out/usr/lib/nautilus
+      rm -rf $out/lib/x86_64-linux-gnu/nautilus
+      rm -rf $out/usr/lib/x86_64-linux-gnu/nautilus
+
+      find $out -name "libqpdf.so" -delete
      rm -rf $out/opt/Synology/SynologyDrive/package/cloudstation/icon-overlay
    '';

@@ -101,7 +111,7 @@ let

    src = fetchurl {
      url = "${baseUrl}/${version}/Mac/Installer/synology-drive-client-${buildNumber}.dmg";
-      sha256 = "sha256-VyhROpQCeVHNxxYgPUZdAlng15aJ1/IYadz30FThlsw=";
+      sha256 = "sha256-0rK7w4/RCv4qml+8XYPwLQmxHen3pB793Co4DvnDVuU=";
    };

    nativeBuildInputs = [
@@ -1,19 +1,22 @@
 {
  lib,
-  fetchPypi,
+  fetchFromGitHub,
+  gitMinimal,
+  gitSetupHook,
  python3Packages,
+  writableTmpDirAsHomeHook,
 }:
-python3Packages.buildPythonApplication rec {
+
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "tbump";
  version = "6.11.0";
  pyproject = true;

-  disabled = python3Packages.pythonOlder "3.8";
-
-  src = fetchPypi {
-    inherit version;
-    pname = "tbump";
-    hash = "sha256-OF5xDu3wqKb/lZzx6fPP0XyHNhcTL8DsX2Ka8MNVyHA=";
+  src = fetchFromGitHub {
+    owner = "your-tools";
+    repo = "tbump";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+H4C4q+/QlYFgz9hvDZhKtREpa8yN1xLx99odSI3WlY=";
  };

  pythonRelaxDeps = [ "tomlkit" ];
@@ -29,11 +32,20 @@ python3Packages.buildPythonApplication rec {
    cli-ui
  ];

+  nativeCheckInputs = with python3Packages; [
+    gitMinimal
+    gitSetupHook
+    pytest-mock
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
  meta = {
    description = "Bump software releases";
    homepage = "https://github.com/your-tools/tbump";
+    changelog = "https://github.com/your-tools/tbump/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
    mainProgram = "tbump";
    maintainers = with lib.maintainers; [ slashformotion ];
  };
-}
+})
@@ -51,7 +51,6 @@ buildGoModule {
    homepage = "https://www.tegola.io/";
    description = "Mapbox Vector Tile server";
    mainProgram = "tegola";
-    maintainers = with lib.maintainers; [ ingenieroariel ];
    teams = [ lib.teams.geospatial ];
    license = lib.licenses.mit;
  };
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  strictDeps = true;

-  nativeBuildInputs = [ zig_0_13.hook ];
+  nativeBuildInputs = [ zig_0_13 ];

  preBuild = ''
    export ZIG_LOCAL_CACHE_DIR=$TMPDIR/zig-cache
@@ -4,7 +4,7 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "usbrip";
  version = "0-unstable-2021-07-02";
  pyproject = true;
@@ -13,9 +13,16 @@ python3.pkgs.buildPythonApplication {
    owner = "snovvcrash";
    repo = "usbrip";
    rev = "0f3701607ba13212ebefb4bbd9e68ec0e22d76ac";
-    sha256 = "1vws8ybhv7szpqvlbmv0hrkys2fhhaa5bj9dywv3q2y1xmljl0py";
+    hash = "sha256-/gIqae3BCzw29y3JVZSC0AntZ4Zg10U3vl+fDZdHmu8=";
  };

+  postPatch = ''
+    # Remove install helpers which we don't need
+    substituteInPlace setup.py \
+      --replace-fail "resolve('wheel')" "" \
+      --replace-fail "'install': LocalInstallCommand," ""
+  '';
+
  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
@@ -24,13 +31,6 @@ python3.pkgs.buildPythonApplication {
    tqdm
  ];

-  postPatch = ''
-    # Remove install helpers which we don't need
-    substituteInPlace setup.py \
-      --replace-fail "resolve('wheel')" "" \
-      --replace-fail "'install': LocalInstallCommand," ""
-  '';
-
  # Project has no tests
  doCheck = false;

@@ -38,10 +38,10 @@ python3.pkgs.buildPythonApplication {

  meta = {
    description = "Tool to track the history of USB events";
-    mainProgram = "usbrip";
    homepage = "https://github.com/snovvcrash/usbrip";
-    license = with lib.licenses; [ gpl3Plus ];
+    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "usbrip";
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.9.24";
+  version = "0.9.25";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-ZgZhEgSzCje7penbL1bgSyt2zu42dar9v9RBQUMv96U=";
+    hash = "sha256-LwfcClkx/apazspYuGJ2wx9wK2/tin9zusSUrqJSmO8=";
  };

-  cargoHash = "sha256-D00LMdCQ3j5Uguc6aU1TYkSezy35r0+yRtI17HxAX64=";
+  cargoHash = "sha256-9CPxOMFk2lz1UXFN/gvXDLtDlHBkRRs/ayS+UYF06is=";

  buildInputs = [
    rust-jemalloc-sys
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    scdoc
    wayland-scanner
-    zig_0_15.hook
+    zig_0_15
  ];

  buildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  deps = callPackage ./build.zig.zon.nix { };

  nativeBuildInputs = [
-    zig_0_13.hook
+    zig_0_13
    pkg-config
    wayland
    wayland-scanner
@@ -4,24 +4,21 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "xcat";
  version = "1.2.0";
-  disabled = python3.pythonOlder "3.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "orf";
    repo = "xcat";
-    rev = "v${version}";
-    sha256 = "01r5998gdvqjdrahpk0ci27lx9yghbddlanqcspr3qp5y5930i0s";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GkQwUvHl4pGvZtgq2tqCz6dOj4gMzAtVbhLv9lBKJQc=";
  };

-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    aiodns
    aiohttp
    appdirs
@@ -34,11 +31,11 @@ python3.pkgs.buildPythonApplication rec {

  # Project has no tests
  doCheck = false;
+
  pythonImportsCheck = [ "xcat" ];

  meta = {
    description = "XPath injection tool";
-    mainProgram = "xcat";
    longDescription = ''
      xcat is an advanced tool for exploiting XPath injection vulnerabilities,
      featuring a comprehensive set of features to read the entire file being
@@ -46,8 +43,9 @@ python3.pkgs.buildPythonApplication rec {
      and directories.
    '';
    homepage = "https://github.com/orf/xcat";
-    changelog = "https://github.com/orf/xcat/releases/tag/v${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/orf/xcat/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "xcat";
  };
-}
+})
--- a/Show More
+++ b/Show More