Merge branch staging-next into haskell-updates

2026-02-19 11:45:24 +01:00
parent 092f6f26ab e5cca0a504
commit bae984db2d
435 changed files with 4192 additions and 2344 deletions
@@ -1003,3 +1003,27 @@ fetchtorrent {

 - `config`: When using `transmission` as the `backend`, a json configuration can
  be supplied to transmission. Refer to the [upstream documentation](https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md) for information on how to configure.
+
+## `fetchItchIo` {#fetchitchio}
+
+`fetchItchIo` is a fetcher for downloading game assets from [itch.io](https://itch.io/). It accepts these arguments:
+
+- `gameUrl`: The store page URL of the game.
+- `upload`: The numerical ID of the asset to download. To find the upload ID of an asset, check the basename of the request URL when you download the asset using a browser.
+- `hash`.
+- `name` (optional): The derivation name, often the filename of the asset.
+- `extraMessage` (optional): Extra message printed if the API key is not provided or if the account did not purchase the game.
+
+For this fetcher to work, the environment variable `NIX_ITCHIO_API_KEY` must be set for the nix building process (which is nix-daemon in multi-user mode), and it must belong to an account that has bought the game if it is behind a paywall.
+To get your API key, go to the ["API key" section](https://itch.io/user/settings/api-keys) of your account settings on itch.io.
+
+```nix
+{ fetchItchIo }:
+
+fetchItchIo {
+  name = "DungeonDuelMonsters-linux-x64.zip";
+  hash = "sha256-gq2nGwpaStqaVI1pL63xygxOI/z53o+zLwiKizG98Ks=";
+  gameUrl = "https://mikaygo.itch.io/ddm";
+  upload = "13371354";
+}
+```
@@ -1818,6 +1818,9 @@
  "fetchtorrent-parameters": [
    "index.html#fetchtorrent-parameters"
  ],
+  "fetchitchio": [
+    "index.html#fetchitchio"
+  ],
  "chap-trivial-builders": [
    "index.html#chap-trivial-builders"
  ],
@@ -1416,7 +1416,7 @@ lib.mapAttrs mkLicense (

    tsl = {
      shortName = "TSL";
-      fullName = "Timescale License Agreegment";
+      fullName = "Timescale License Agreement";
      url = "https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE";
      free = false;
    };
@@ -5799,12 +5799,6 @@
    name = "Daniil Berendeev";
    keys = [ { fingerprint = "60D7 0EE0 3BD4 A415 B255  1938 6556 0668 006B 4906"; } ];
  };
-  danbst = {
-    email = "abcz2.uprola@gmail.com";
-    github = "danbst";
-    githubId = 743057;
-    name = "Danylo Hlynskyi";
-  };
  danbulant = {
    name = "Daniel Bulant";
    email = "danbulant@gmail.com";
@@ -25294,6 +25288,11 @@
    githubId = 20484159;
    keys = [ { fingerprint = "F246 425A 7650 6F37 0552  BA8D DEA9 C405 09D9 65F5"; } ];
  };
+  squishykid = {
+    github = "squishykid";
+    githubId = 2177912;
+    name = "squishykid";
+  };
  srgom = {
    github = "SRGOM";
    githubId = 8103619;
@@ -73,7 +73,7 @@ in
        with pkgs;
        [
          linux-firmware
-          intel2200BGFirmware
+          ipw2200-firmware
          rtl8192su-firmware
          rt5677-firmware
          rtl8761b-firmware
@@ -27,7 +27,7 @@

  config = lib.mkIf config.networking.enableIntel2200BGFirmware {

-    hardware.firmware = [ pkgs.intel2200BGFirmware ];
+    hardware.firmware = [ pkgs.ipw2200-firmware ];

  };

@@ -1724,6 +1724,7 @@
  ./services/web-apps/peertube.nix
  ./services/web-apps/pgpkeyserver-lite.nix
  ./services/web-apps/photoprism.nix
+  ./services/web-apps/photoview.nix
  ./services/web-apps/phylactery.nix
  ./services/web-apps/pict-rs.nix
  ./services/web-apps/pihole-web.nix
@@ -23,6 +23,8 @@ in
    services.spotifyd = {
      enable = lib.mkEnableOption "spotifyd, a Spotify playing daemon";

+      package = lib.mkPackageOption pkgs "spotifyd" { };
+
      config = lib.mkOption {
        default = "";
        type = lib.types.lines;
@@ -43,6 +45,7 @@ in
          <https://docs.spotifyd.rs/configuration/index.html#config-file>.
        '';
      };
+
    };
  };

@@ -64,7 +67,7 @@ in
      description = "spotifyd, a Spotify playing daemon";
      environment.SHELL = "/bin/sh";
      serviceConfig = {
-        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --cache-path /var/cache/spotifyd --config-path ${spotifydConf}";
+        ExecStart = "${cfg.package}/bin/spotifyd --no-daemon --cache-path /var/cache/spotifyd --config-path ${spotifydConf}";
        Restart = "always";
        RestartSec = 12;
        DynamicUser = true;
@@ -168,6 +168,7 @@ in
          ffmpegthumbs
          krdp
          kconfig # required for xdg-terminal from xdg-utils
+          qtbase # for qtpaths which is required for xdg-mime from xdg-utils
        ]
        ++ lib.optionals config.hardware.sensor.iio.enable [
          # This is required for autorotation in Plasma 6
@@ -104,7 +104,7 @@ in
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} server start";
+        ExecStart = "${lib.getExe' cfg.package "atuin-server"} start";
        RuntimeDirectory = "atuin";
        RuntimeDirectoryMode = "0700";
        DynamicUser = true;
@@ -58,7 +58,7 @@ in
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
-        ExecStart = "${pkgs.fusionInventory}/bin/fusioninventory-agent --conf-file=${configFile} --daemon --no-fork";
+        ExecStart = "${pkgs.fusioninventory-agent}/bin/fusioninventory-agent --conf-file=${configFile} --daemon --no-fork";
      };
    };
  };
@@ -327,6 +327,15 @@ in
                example = "tailnet.example.com";
              };

+              override_local_dns = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = ''
+                  Whether to [override clients' DNS servers](https://tailscale.com/kb/1054/dns#override-dns-servers).
+                '';
+                example = false;
+              };
+
              nameservers = {
                global = lib.mkOption {
                  type = lib.types.listOf lib.types.str;
@@ -644,6 +653,10 @@ in
        assertion = with cfg.settings; dns.magic_dns -> dns.base_domain != "";
        message = "dns.base_domain must be set when using MagicDNS";
      }
+      {
+        assertion = with cfg.settings; dns.override_local_dns -> dns.nameservers.global != [ ];
+        message = "dns.nameservers.global must be set when overriding local DNS";
+      }
      (assertRemovedOption [ "settings" "acl_policy_path" ] "Use `policy.path` instead.")
      (assertRemovedOption [ "settings" "db_host" ] "Use `database.postgres.host` instead.")
      (assertRemovedOption [ "settings" "db_name" ] "Use `database.postgres.name` instead.")
@@ -17,7 +17,7 @@ if test "$1" = "start"; then
 	chown ircd: /home/ircd
 	cd /home/ircd
    env - HOME=/homeless-shelter $extraEnv \
-        @su@/bin/su ircd --shell=/bin/sh -c ' @ircdHybrid@/bin/ircd -configfile @out@/conf/ircd.conf </dev/null -logfile /home/ircd/ircd.log' 2>&1 >/var/log/ircd-hybrid.out
+        @su@/bin/su ircd --shell=/bin/sh -c ' @ircd-hybrid@/bin/ircd -configfile @out@/conf/ircd.conf </dev/null -logfile /home/ircd/ircd.log' 2>&1 >/var/log/ircd-hybrid.out
 	fi;
 fi

@@ -22,7 +22,7 @@ let
      ./ircd.conf
    ];
    inherit (pkgs)
-      ircdHybrid
+      ircd-hybrid
      coreutils
      su
      iproute2
@@ -0,0 +1,259 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.photoview;
+
+  dbUrl = {
+    sqlite = "PHOTOVIEW_SQLITE_PATH=${cfg.dataDir}/photoview.db";
+    mysql = "PHOTOVIEW_MYSQL_URL=${cfg.database.user}:$(cat $CREDENTIALS_DIRECTORY/db_password)@tcp(${cfg.database.host}:${toString cfg.database.port})/${cfg.database.name}";
+    postgres = "PHOTOVIEW_POSTGRES_URL=postgres://${cfg.database.user}:$(cat $CREDENTIALS_DIRECTORY/db_password)@${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}";
+  };
+in
+
+{
+  options.services.photoview = {
+    enable = lib.mkEnableOption "Photoview, a photo gallery for self-hosted personal servers";
+
+    package = lib.mkPackageOption pkgs "photoview" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "photoview";
+      description = "User account under which photoview runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "photoview";
+      description = "Group under which photoview runs.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/photoview";
+      description = "Directory for photoview state, cache, and database.";
+    };
+
+    mediaPath = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Path to the directory containing photos to be served.
+        This directory must be readable by the photoview user.
+      '';
+      example = "/mnt/photos";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Address to listen on.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 4001;
+      description = "Port to listen on.";
+    };
+
+    database = {
+      type = lib.mkOption {
+        type = lib.types.enum [
+          "sqlite"
+          "mysql"
+          "postgres"
+        ];
+        default = "sqlite";
+        description = "Database engine to use.";
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 5432;
+        description = "Database port.";
+      };
+
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "photoview";
+        description = "Database name.";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "photoview";
+        description = "Database user.";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          Path to a file containing the database password.
+          Required when using MySQL or PostgreSQL.
+        '';
+      };
+    };
+
+    settings = {
+      disableFaceRecognition = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Disable face recognition feature.";
+      };
+
+      disableVideoEncoding = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Disable video encoding with FFmpeg.";
+      };
+
+      disableRawProcessing = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Disable RAW photo processing.";
+      };
+
+      mapboxToken = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Mapbox API token for map features.";
+      };
+
+      videoEncoder = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "h264_qsv"
+            "h264_vaapi"
+            "h264_nvenc"
+          ]
+        );
+        default = null;
+        description = "Hardware video encoder to use.";
+      };
+    };
+
+    secretsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to an environment file containing secrets.
+        Can be used for MAPBOX_TOKEN or other sensitive settings.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.database.type == "sqlite" || cfg.database.passwordFile != null;
+        message = "services.photoview.database.passwordFile must be set when using MySQL or PostgreSQL.";
+      }
+    ];
+
+    users.users = lib.mkIf (cfg.user == "photoview") {
+      photoview = {
+        group = cfg.group;
+        home = cfg.dataDir;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "photoview") {
+      photoview = { };
+    };
+
+    systemd.services.photoview = {
+      description = "Photoview - Photo gallery for self-hosted personal servers";
+      documentation = [ "https://photoview.github.io/docs/" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional (cfg.database.type == "postgres") "postgresql.service"
+      ++ lib.optional (cfg.database.type == "mysql") "mysql.service";
+      requires =
+        lib.optional (cfg.database.type == "postgres") "postgresql.service"
+        ++ lib.optional (cfg.database.type == "mysql") "mysql.service";
+
+      environment = {
+        PHOTOVIEW_DATABASE_DRIVER = cfg.database.type;
+        PHOTOVIEW_LISTEN_IP = cfg.host;
+        PHOTOVIEW_LISTEN_PORT = toString cfg.port;
+        PHOTOVIEW_MEDIA_CACHE = "/var/cache/photoview";
+        PHOTOVIEW_DISABLE_FACE_RECOGNITION = toString cfg.settings.disableFaceRecognition;
+        PHOTOVIEW_DISABLE_VIDEO_ENCODING = toString cfg.settings.disableVideoEncoding;
+        PHOTOVIEW_DISABLE_RAW_PROCESSING = toString cfg.settings.disableRawProcessing;
+      }
+      // lib.optionalAttrs (cfg.settings.mapboxToken != null) {
+        MAPBOX_TOKEN = cfg.settings.mapboxToken;
+      }
+      // lib.optionalAttrs (cfg.settings.videoEncoder != null) {
+        PHOTOVIEW_VIDEO_ENCODER = cfg.settings.videoEncoder;
+      };
+
+      script = ''
+        export ${dbUrl.${cfg.database.type}}
+        exec ${lib.getExe cfg.package}
+      '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "photoview";
+        StateDirectoryMode = "0750";
+        CacheDirectory = "photoview";
+        CacheDirectoryMode = "0750";
+        WorkingDirectory = cfg.dataDir;
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        # Read access to media directory
+        ReadOnlyPaths = [ cfg.mediaPath ];
+
+        # Secrets
+        LoadCredential = lib.optional (
+          cfg.database.passwordFile != null
+        ) "db_password:${cfg.database.passwordFile}";
+        EnvironmentFile = lib.optional (cfg.secretsFile != null) cfg.secretsFile;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ nettika ];
+}
@@ -14,7 +14,6 @@ in
 {
  meta = {
    maintainers = with lib.maintainers; [
-      danbst
      anthonyroussel
    ];
  };
@@ -78,8 +78,8 @@ in
        copy_bin_and_libs ${pkgs.curl}/bin/curl
        copy_bin_and_libs ${pkgs.bashNonInteractive}/bin/bash
        copy_bin_and_libs ${pkgs.cryptsetup}/bin/cryptsetup
-        copy_bin_and_libs ${pkgs.gnused}/bin/gnused
-        copy_bin_and_libs ${pkgs.gnugrep}/bin/gnugrep
+        copy_bin_and_libs ${pkgs.gnused}/bin/sed
+        copy_bin_and_libs ${pkgs.gnugrep}/bin/grep

        copy_bin_and_libs ${pkgs.tpm2-tools}/bin/.tpm2-wrapped
        mv $out/bin/{.tpm2-wrapped,tpm2}
@@ -106,6 +106,7 @@ in
      systemd = {
        extraBin = lib.mkIf systemd.enable {
          clevis = "${cfg.package}/bin/clevis";
+          curl = "${pkgs.curl}/bin/curl";
        };

        storePaths = lib.mkIf systemd.enable [
@@ -2,7 +2,7 @@
 {
  name = "containers-reloadable";
  meta = {
-    maintainers = with lib.maintainers; [ danbst ];
+    maintainers = [ ];
  };

  nodes = {
@@ -10,7 +10,6 @@
  meta = with pkgs.lib.maintainers; {
    maintainers = [
      mbbx6spp
-      danbst
    ];
  };

@@ -6,13 +6,13 @@
 }:
 vimUtils.buildVimPlugin {
  pname = "zig.vim";
-  version = "0-unstable-2026-01-24";
+  version = "0-unstable-2026-02-13";

  src = fetchFromCodeberg {
    owner = "ziglang";
    repo = "zig.vim";
-    rev = "2f53c35bee0d64a1d417d47c894a3cbb6663dff4";
-    hash = "sha256-vrtcUAp/YWpZtf6lyg2l0GR62YdHprAb8sAHzZ89F48=";
+    rev = "f65b43b90cbc3e179b3146d2237f503783119ab8";
+    hash = "sha256-4Ssde+vLYn/NnL24sDW6Z+yDN2dWKaOFgrFYm1oVQjg=";
  };

  passthru.updateScript = nix-update-script {
@@ -3093,8 +3093,8 @@ let
        mktplcRef = {
          name = "compare-folders";
          publisher = "moshfeu";
-          version = "0.25.3";
-          hash = "sha256-QrSh8/AycC5nKbZ1+E3V/lJu/7Skket8b05yPnZg68s=";
+          version = "0.27.0";
+          hash = "sha256-v4ZIcrYa+5RXSX0OM5atXMcmN/EgAH6qqWS1vksxXpI=";
        };

        meta = {
@@ -4340,8 +4340,8 @@ let
        mktplcRef = {
          publisher = "sonarsource";
          name = "sonarlint-vscode";
-          version = "4.42.0";
-          hash = "sha256-jWw5vbORdi/qW8L4D1qbue8tdeiyof01FzJtcZUKs3Y=";
+          version = "4.43.0";
+          hash = "sha256-cpd8+fbp57l+XYBuDnz95lmKzJ8IUHu937KWHsLXrPk=";
        };
        meta.license = lib.licenses.lgpl3Only;
      };
@@ -4788,8 +4788,8 @@ let
        mktplcRef = {
          name = "emacs-mcx";
          publisher = "tuttieee";
-          version = "0.107.1";
-          hash = "sha256-x2WoDoYE4at2G8yuefc5evHRpCiJXh5WTTkNzW454N0=";
+          version = "0.107.2";
+          hash = "sha256-Id8pKACGLtRXas1Tb2dZrw+ZrZvAQLbWcI3Q1gYpXos=";
        };
        meta = {
          changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "dosbox-pure";
-  version = "0-unstable-2026-02-05";
+  version = "0-unstable-2026-02-17";

  src = fetchFromGitHub {
    owner = "schellingb";
    repo = "dosbox-pure";
-    rev = "6fe60a669e8781d738150ad2353b87c1e1de7dd4";
-    hash = "sha256-6hIevmWusjg8Wr9A5ov6RLovirtOIEhHtEYLQ7EHVh0=";
+    rev = "f587236b2d016f4f16d672e9ce2829bdf507bf9b";
+    hash = "sha256-OS6iY8b8pvqkJpDQO9DHRUh7ckjov5t1GZldOR+qg0Y=";
  };

  hardeningDisable = [ "format" ];
@@ -17,13 +17,13 @@
  makeWrapper,
  pkg-config,
  nixosTests,
-  supportFlags,
  pnameSuffix ? "",
  patches,
  moltenvk,
  buildScript ? null,
  configureFlags ? [ ],
  mainProgram ? "wine",
+
  # Staging support
  useStaging ? false,
  autoconf,
@@ -31,6 +31,39 @@
  perl,
  python3,
  gitMinimal,
+
+  # Support flags
+  gettextSupport ? false,
+  fontconfigSupport ? false,
+  alsaSupport ? false,
+  gtkSupport ? false,
+  openglSupport ? false,
+  tlsSupport ? false,
+  gstreamerSupport ? false,
+  cupsSupport ? false,
+  dbusSupport ? false,
+  openclSupport ? false,
+  cairoSupport ? false,
+  odbcSupport ? false,
+  netapiSupport ? false,
+  cursesSupport ? false,
+  vaSupport ? false,
+  pcapSupport ? false,
+  v4lSupport ? false,
+  saneSupport ? false,
+  gphoto2Support ? false,
+  krb5Support ? false,
+  pulseaudioSupport ? false,
+  udevSupport ? false,
+  xineramaSupport ? false,
+  vulkanSupport ? false,
+  sdlSupport ? false,
+  usbSupport ? false,
+  mingwSupport ? stdenv.hostPlatform.isDarwin,
+  waylandSupport ? false,
+  x11Support ? false,
+  ffmpegSupport ? false,
+  embedInstallers ? false,
 }:

 let
@@ -47,26 +80,23 @@ let
    };
  } ./setup-hook-darwin.sh;

-  # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
+  # Building Wine with these flags isn't supported on Darwin. Using any of them will result in an evaluation failures
  # because they will put Darwin in `meta.badPlatforms`.
-  darwinUnsupportedFlags = [
-    "alsaSupport"
-    "cairoSupport"
-    "dbusSupport"
-    "fontconfigSupport"
-    "gtkSupport"
-    "netapiSupport"
-    "pulseaudioSupport"
-    "udevSupport"
-    "v4lSupport"
-    "vaSupport"
-    "waylandSupport"
-    "x11Support"
-    "xineramaSupport"
-  ];
-
  badPlatforms = lib.optional (
-    !supportFlags.mingwSupport || lib.any (flag: supportFlags.${flag}) darwinUnsupportedFlags
+    !mingwSupport
+    || alsaSupport
+    || cairoSupport
+    || dbusSupport
+    || fontconfigSupport
+    || gtkSupport
+    || netapiSupport
+    || pulseaudioSupport
+    || udevSupport
+    || v4lSupport
+    || vaSupport
+    || waylandSupport
+    || x11Support
+    || xineramaSupport
  ) "x86_64-darwin";

  # Staging patches (from src.staging when useStaging is true)
@@ -101,7 +131,6 @@ stdenv.mkDerivation (
    strictDeps = true;

    nativeBuildInputs =
-      with supportFlags;
      lib.optionals useStaging [
        autoconf
        hexdump
@@ -134,7 +163,6 @@ stdenv.mkDerivation (
        )
      )
      ++ toBuildInputs pkgArches (
-        with supportFlags;
        pkgs:
        [
          pkgs.freetype
@@ -242,11 +270,11 @@ stdenv.mkDerivation (

    configureFlags =
      prevConfigFlags
-      ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
-      ++ lib.optionals supportFlags.vulkanSupport [ "--with-vulkan" ]
-      ++ lib.optionals (
-        (stdenv.hostPlatform.isDarwin && !supportFlags.xineramaSupport) || !supportFlags.x11Support
-      ) [ "--without-x" ];
+      ++ lib.optionals waylandSupport [ "--with-wayland" ]
+      ++ lib.optionals vulkanSupport [ "--with-vulkan" ]
+      ++ lib.optionals ((stdenv.hostPlatform.isDarwin && !xineramaSupport) || !x11Support) [
+        "--without-x"
+      ];

    # Wine locates a lot of libraries dynamically through dlopen().  Add
    # them to the RPATH so that the user doesn't have to set them in
@@ -255,10 +283,10 @@ stdenv.mkDerivation (
      map (path: "-rpath " + path) (
        map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ finalAttrs.buildInputs)
        # libpulsecommon.so is linked but not found otherwise
-        ++ lib.optionals supportFlags.pulseaudioSupport (
+        ++ lib.optionals pulseaudioSupport (
          map (x: "${lib.getLib x}/lib/pulseaudio") (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ]))
        )
-        ++ lib.optionals supportFlags.waylandSupport (
+        ++ lib.optionals waylandSupport (
          map (x: "${lib.getLib x}/share/wayland-protocols") (
            toBuildInputs pkgArches (pkgs: [ pkgs.wayland-protocols ])
          )
@@ -281,13 +309,13 @@ stdenv.mkDerivation (
      let
        links = prefix: pkg: "ln -s ${pkg} $out/${prefix}/${pkg.name}";
      in
-      lib.optionalString supportFlags.embedInstallers ''
+      lib.optionalString embedInstallers ''
        mkdir -p $out/share/wine/gecko $out/share/wine/mono/
        ${lib.strings.concatStringsSep "\n" (
          (map (links "share/wine/gecko") geckos) ++ (map (links "share/wine/mono") monos)
        )}
      ''
-      + lib.optionalString supportFlags.gstreamerSupport ''
+      + lib.optionalString gstreamerSupport ''
        # Wrapping Wine is tricky.
        # https://github.com/NixOS/nixpkgs/issues/63170
        # https://github.com/NixOS/nixpkgs/issues/28486
@@ -320,8 +348,8 @@ stdenv.mkDerivation (
      "bindnow"
      "stackclashprotection"
    ]
-    ++ lib.optional (stdenv.hostPlatform.isDarwin) "fortify"
-    ++ lib.optional (supportFlags.mingwSupport) "format";
+    ++ lib.optional stdenv.hostPlatform.isDarwin "fortify"
+    ++ lib.optional mingwSupport "format";

    passthru = {
      inherit pkgArches;
@@ -6,7 +6,7 @@
 # };
 # Make additional configurations on demand:
 # wine.override { wineBuild = "wine32"; wineRelease = "staging"; };
-{
+args@{
  lib,
  stdenv,
  callPackage,
@@ -50,6 +50,18 @@
 let
  sources = callPackage ./sources.nix { };

+  supportFlags = lib.filterAttrs (
+    name: _:
+    !builtins.elem name [
+      "lib"
+      "stdenv"
+      "callPackage"
+      "darwin"
+      "wineRelease"
+      "wineBuild"
+    ]
+  ) args;
+
  # Map user-facing release names to sources, pname suffix, and staging flag
  releaseInfo = {
    stable = {
@@ -77,47 +89,7 @@ let
  };

  baseWine = lib.getAttr wineBuild (
-    callPackage ./packages.nix (
-      releaseInfo.${wineRelease}
-      // {
-        supportFlags = {
-          inherit
-            alsaSupport
-            cairoSupport
-            cupsSupport
-            cursesSupport
-            dbusSupport
-            embedInstallers
-            fontconfigSupport
-            gettextSupport
-            gphoto2Support
-            gstreamerSupport
-            gtkSupport
-            krb5Support
-            mingwSupport
-            netapiSupport
-            odbcSupport
-            openclSupport
-            openglSupport
-            pcapSupport
-            pulseaudioSupport
-            saneSupport
-            sdlSupport
-            tlsSupport
-            udevSupport
-            usbSupport
-            v4lSupport
-            vaSupport
-            vulkanSupport
-            waylandSupport
-            x11Support
-            ffmpegSupport
-            xineramaSupport
-            ;
-        };
-        inherit moltenvk;
-      }
-    )
+    callPackage ./packages.nix (releaseInfo.${wineRelease} // supportFlags)
  );
 in
 if wineRelease == "yabridge" then
@@ -10,14 +10,14 @@
  src,
  pnameSuffix ? "",
  useStaging ? false,
-  supportFlags,
  # Staging native build deps
  autoconf,
  hexdump,
  perl,
  python3,
  gitMinimal,
-}:
+  ...
+}@args:

 let
  inherit (src)
@@ -27,118 +27,110 @@ let
    gecko64
    mono
    ;
+
+  # Args to pass through to base.nix (support flags, etc.)
+  baseArgs = removeAttrs args [
+    "stdenv_32bit"
+    "lib"
+    "pkgs"
+    "pkgsi686Linux"
+    "pkgsCross"
+    "callPackage"
+    "replaceVars"
+  ];
 in
 {
-  wine32 = pkgsi686Linux.callPackage ./base.nix {
-    pname = "wine";
-    inherit
-      src
-      version
-      supportFlags
-      patches
-      moltenvk
-      pnameSuffix
-      useStaging
+  wine32 = pkgsi686Linux.callPackage ./base.nix (
+    baseArgs
+    // {
+      pname = "wine";
+      inherit version patches;
      # Forcing these `nativeBuildInputs` used in the `staging` to come
      # from ambient `pkgs`, rather than being provided by
      # `pkgsi686Linux.callPackage` for that platform.
-      autoconf
-      hexdump
-      perl
-      python3
-      gitMinimal
-      ;
-    pkgArches = [ pkgsi686Linux ];
-    geckos = [ gecko32 ];
-    mingwGccs = with pkgsCross; [ mingw32.buildPackages.gcc ];
-    monos = [ mono ];
-    platforms = [
-      "i686-linux"
-      "x86_64-linux"
-    ];
-  };
-  wine64 = callPackage ./base.nix {
-    pname = "wine64";
-    inherit
-      src
-      version
-      supportFlags
-      patches
-      moltenvk
-      pnameSuffix
-      useStaging
-      ;
-    pkgArches = [ pkgs ];
-    mingwGccs = with pkgsCross; [ mingwW64.buildPackages.gcc ];
-    geckos = [ gecko64 ];
-    monos = [ mono ];
-    configureFlags = [ "--enable-win64" ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    mainProgram = "wine";
-  };
-  wineWow = callPackage ./base.nix {
-    pname = "wine-wow";
-    inherit
-      src
-      version
-      supportFlags
-      patches
-      moltenvk
-      pnameSuffix
-      useStaging
-      ;
-    stdenv = stdenv_32bit;
-    pkgArches = [
-      pkgs
-      pkgsi686Linux
-    ];
-    geckos = [
-      gecko32
-      gecko64
-    ];
-    mingwGccs = with pkgsCross; [
-      mingw32.buildPackages.gcc
-      mingwW64.buildPackages.gcc
-    ];
-    monos = [ mono ];
-    buildScript = replaceVars ./builder-wow.sh {
-      # pkgconfig has trouble picking the right architecture
-      pkgconfig64remove = lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
-        pkgs.glib
-        pkgs.gst_all_1.gstreamer
+      inherit
+        autoconf
+        hexdump
+        perl
+        python3
+        gitMinimal
+        ;
+      pkgArches = [ pkgsi686Linux ];
+      geckos = [ gecko32 ];
+      mingwGccs = with pkgsCross; [ mingw32.buildPackages.gcc ];
+      monos = [ mono ];
+      platforms = [
+        "i686-linux"
+        "x86_64-linux"
      ];
-    };
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "wine";
-  };
-  wineWow64 = callPackage ./base.nix {
-    pname = "wine-wow64";
-    inherit
-      src
-      version
-      patches
-      moltenvk
-      pnameSuffix
-      useStaging
-      ;
-    supportFlags = supportFlags // {
-      mingwSupport = true;
-    }; # Required because we request "--enable-archs=x86_64"
-    pkgArches = [ pkgs ];
-    mingwGccs = with pkgsCross; [
-      mingw32.buildPackages.gcc
-      mingwW64.buildPackages.gcc
-    ];
-    geckos = [ gecko64 ];
-    monos = [ mono ];
-    configureFlags = [ "--enable-archs=x86_64,i386" ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    mainProgram = "wine";
-  };
+    }
+  );
+  wine64 = callPackage ./base.nix (
+    baseArgs
+    // {
+      pname = "wine64";
+      inherit version patches;
+      pkgArches = [ pkgs ];
+      mingwGccs = with pkgsCross; [ mingwW64.buildPackages.gcc ];
+      geckos = [ gecko64 ];
+      monos = [ mono ];
+      configureFlags = [ "--enable-win64" ];
+      platforms = [
+        "x86_64-linux"
+        "x86_64-darwin"
+      ];
+      mainProgram = "wine";
+    }
+  );
+  wineWow = callPackage ./base.nix (
+    baseArgs
+    // {
+      pname = "wine-wow";
+      inherit version patches;
+      stdenv = stdenv_32bit;
+      pkgArches = [
+        pkgs
+        pkgsi686Linux
+      ];
+      geckos = [
+        gecko32
+        gecko64
+      ];
+      mingwGccs = with pkgsCross; [
+        mingw32.buildPackages.gcc
+        mingwW64.buildPackages.gcc
+      ];
+      monos = [ mono ];
+      buildScript = replaceVars ./builder-wow.sh {
+        # pkgconfig has trouble picking the right architecture
+        pkgconfig64remove = lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
+          pkgs.glib
+          pkgs.gst_all_1.gstreamer
+        ];
+      };
+      platforms = [ "x86_64-linux" ];
+      mainProgram = "wine";
+    }
+  );
+  wineWow64 = callPackage ./base.nix (
+    baseArgs
+    // {
+      pname = "wine-wow64";
+      inherit version patches;
+      mingwSupport = true; # Required because we request "--enable-archs=x86_64"
+      pkgArches = [ pkgs ];
+      mingwGccs = with pkgsCross; [
+        mingw32.buildPackages.gcc
+        mingwW64.buildPackages.gcc
+      ];
+      geckos = [ gecko64 ];
+      monos = [ mono ];
+      configureFlags = [ "--enable-archs=x86_64,i386" ];
+      platforms = [
+        "x86_64-linux"
+        "x86_64-darwin"
+      ];
+      mainProgram = "wine";
+    }
+  );
 }
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "145.0.7632.75",
+    "version": "145.0.7632.109",
    "chromedriver": {
-      "version": "145.0.7632.76",
-      "hash_darwin": "sha256-7bZgvz6yD8qO1G82KTlAuPxLPelZ5TfIlLvyugDJUjM=",
-      "hash_darwin_aarch64": "sha256-fwtLzGyT810JoTKI52jXPGBu2EnrD+ROG1L2kGMfFfk="
+      "version": "145.0.7632.110",
+      "hash_darwin": "sha256-wa8s3PwS5G1TopGYheyLD7wlxxTZWPYwU90TLFpBMZw=",
+      "hash_darwin_aarch64": "sha256-/J4A4DrERlHdlI0Pv9hHCnBGoeUIB6G43fS0Y8taLFs="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "ab0b95409566de9da1ed76e690022f774aec7793",
-        "hash": "sha256-VvHDqNTXOFeV+QY3K2O9fTFxDzrkz6qKl9hP8nVDMAw=",
+        "rev": "61eff07de4f37ac1c6969c91034a447ef6cd394d",
+        "hash": "sha256-b498JyyvsN/+0Gqjdrq+eT1HW54/ayEENRHa1Sw69Xw=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "0cf07977de12e7056ab3cbcbf584411e88a1f734",
-        "hash": "sha256-2OgNRRkpUlkyXAQDSOL4279JAi1C0QbH4MEfNW7WieQ="
+        "rev": "d9f5a980bb5a4baeb7d9c1fef89a39789a6cd9fb",
+        "hash": "sha256-DaNsRQm9bR2lfbiP6vWr2R7KD8mYWOaJ72VJyrUkJvI="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -257,8 +257,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "cc75f545bcb65238f74fd291833112305ce6915a",
-        "hash": "sha256-tOE96dcLmUaAVvOo4oGoUrEFpGSH2yxIBtvXSAVzbK0="
+        "rev": "8eb35b80efbc72ffb3aff36c3c1106fe9269df88",
+        "hash": "sha256-fzcXSU0kaIZVTQx1L5A0Xmn3HEzUE35mzfsU0YEaxw0="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -602,8 +602,8 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "3c679253a9e17c10be696d345c63636b18b7f925",
-        "hash": "sha256-OW39m1TVJnSdbeVeTCgSxePTqFTOwWqZIrU/5SEioCc="
+        "rev": "004b47619573a582c076679764e07725ace3e497",
+        "hash": "sha256-PHu3v/ZeEa11/CTGJh8aJjV/lTIVSJ6W7uH2njsHj1w="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -817,8 +817,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "fffd2bdc35a900b4312833885d9d30803580670e",
-        "hash": "sha256-WqSGzOCvLw6k3t1oNgZV17KY8TVl6j4lJr0NZSVbm4o="
+        "rev": "a8b42c8fae7c7f1ce4e32b08ee61c22775185c01",
+        "hash": "sha256-HZ4JbSoMNVqUrCWoxk0/AxzlcpMgKhe/HJ7DGeTeE9M="
      }
    }
  },
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = "firefox-devedition";
-  version = "148.0b14";
+  version = "148.0b15";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "10de6926c3c20fcbffe2f25f97213ac777e4ce3984cb303262ddaef15be24788a40c6064ce8cc138ab3a35ba621efdcd0f6e0a105b2e773f7f14a1d661c10693";
+    sha512 = "32d7e4b9df739d5bdab2cd54250b1c7546d26b248a62e0bbc71e4b78b12d4e3d6d9451b631a0f18568f2540141786967a33b6543256a6ec6f4f245093d37a5d5";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
@@ -27,13 +27,13 @@
    "vendorHash": null
  },
  "aiven_aiven": {
-    "hash": "sha256-Aih7prC6CKv414bxiJnV3PFXZfH0MxsmS2g9c4eVWOk=",
+    "hash": "sha256-lNDorhkIngyZ8S51lyuI3LRtnFtzVG01Nzo1vRPytbQ=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.50.0",
+    "rev": "v4.51.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-S2QbhaK7GlfUnggLE9wNNJCrNnk5ReD7kY8yeRKPi7Q="
+    "vendorHash": "sha256-c4eCY/iQ8v/gBX55j22TRxWIeoevi5EJs4TtN9xXfKA="
  },
  "akamai_akamai": {
    "hash": "sha256-WXIx2/1EiamjolyPy+d3Gwp4hOguJrmxKwgLZqzQqDg=",
@@ -63,14 +63,14 @@
    "vendorHash": "sha256-AO6reoqxDcPAMXKlqjJLGmhsgFrekaQXjMPm9fxhpFA="
  },
  "argoproj-labs_argocd": {
-    "hash": "sha256-xIEl9SsiwJp3X7hyVPE/Z9qHGTL9ZotvzIz7Zx5bdEc=",
+    "hash": "sha256-2QatWxaR5lO4+0RxUMOQjyLp8XG6O0vwCYc8jHKL+48=",
    "homepage": "https://registry.terraform.io/providers/argoproj-labs/argocd",
    "owner": "argoproj-labs",
    "proxyVendor": true,
    "repo": "terraform-provider-argocd",
-    "rev": "v7.12.5",
+    "rev": "v7.13.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gVzj5x95MNgCbxwqiqakrUnhF/x+vXnAurv4pUt8kV4="
+    "vendorHash": "sha256-OBXAl3MRAtnYYATHD0UWEuB1dJozG7al9csGYLClaYw="
  },
  "auth0_auth0": {
    "hash": "sha256-d93MvkFn2+slFh2yvllcwthVTY15ezLn+q8Jm3MPQ+0=",
@@ -580,13 +580,13 @@
    "vendorHash": "sha256-lhTdDrTwTbRuWngQ+NGuh+x5Z5HZfVTtNi+mZqIENbg="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-NRTnx5nqdCtjz0mGZjuA96jEzW1rKR+M0AY2//TAYk4=",
+    "hash": "sha256-frRtwDdgNNux875U9rgSbZict8//X/WzxM7EBSxRqW4=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v7.18.0",
+    "rev": "v7.20.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/wClcz8fwl9Of2JSKcfETs7VR6c5KrYnnF+yW5iUoSU="
+    "vendorHash": "sha256-KnB6R5yrEeaf4Z+LzQjCeQJjAgHK0kJEJzT1rb3pimY="
  },
  "hashicorp_helm": {
    "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -652,13 +652,13 @@
    "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
  },
  "hashicorp_tfe": {
-    "hash": "sha256-U58uWRmLMI9XfYT89wfNuwhok+PaWCanz23RjQYyL98=",
+    "hash": "sha256-+FIiatVTff/MNk1Ik0vZDii7yjeWQLO5BLqSrs2bGME=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.73.0",
+    "rev": "v0.74.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-n+by9Z0JhLOk/td8Or5IUQIapy9TTHnf9QJSVddTL2Y="
+    "vendorHash": "sha256-GAwAGw8N4B/jCtcR2ok3g/0j//CHK9yPaBj+otJLjKc="
  },
  "hashicorp_time": {
    "hash": "sha256-ZArYfbzbrkxGlL1BRFM7PN3hLzdssIL4COsUBdLVMYY=",
@@ -1418,13 +1418,13 @@
    "vendorHash": null
  },
  "vancluever_acme": {
-    "hash": "sha256-Fjn1eNqB0Ye5MRg8+YsPwMBdkvsVELTzf2wvHluFzN8=",
+    "hash": "sha256-hviw2syXALi3B47jwfvEn61sOOZ1qvUMWJE7Ob6M36U=",
    "homepage": "https://registry.terraform.io/providers/vancluever/acme",
    "owner": "vancluever",
    "repo": "terraform-provider-acme",
-    "rev": "v2.43.0",
+    "rev": "v2.44.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LAM2pzTIRdspYnXboDA+iGwt7uaI+/ItXPAgOJUELps="
+    "vendorHash": "sha256-FSyJ5ZCaGbMZbDop/Pj8TKaUAeOBNz/RSfV/rkVYbD0="
  },
  "venafi_venafi": {
    "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",
@@ -39,6 +39,12 @@ let
          inherit hash;
        };

+        # Set CGO_ENABLED based on platform:
+        # - Linux: CGO_ENABLED=0 for static linking (avoids LTO plugin issues)
+        # - Darwin: CGO_ENABLED=1 to avoid DNS resolution issues
+        # See: https://github.com/hashicorp/terraform/blob/main/BUILDING.md
+        env.CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
+
        ldflags = [
          "-s"
          "-w"
@@ -65,8 +65,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "147.0.1";
-    sha512 = "bae9adbcb1d45a7644e4d699215a3da85b612b9d99516bdf12f84482f1a6f89153ec4d5ab6dd8bcf69dc512cb50080db4630a5bb52525f22213c7af92b4b77d7";
+    version = "147.0.2";
+    sha512 = "4fe6d0389e8bc6078b3d4db79d1f8547666950de4a5a72e49ba24d5b60cb531908b88efa9f3dd32e154ee917a8b80786389ce9b1186b6c45fb0717d4e180e537";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
    description = "Pass mouse wheel commands to secondary screens (screen, less, nano, etc)";
    homepage = "https://aur.archlinux.org/packages/urxvt-vtwheel";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ danbst ];
+    maintainers = [ ];
    platforms = with lib.platforms; unix;
  };

@@ -1,6 +1,6 @@
 {
  coreutils,
-  flattenReferencesGraph,
+  flatten-references-graph,
  lib,
  jq,
  runCommand,
@@ -26,7 +26,7 @@ else
      inherit pipeline;
      nativeBuildInputs = [
        coreutils
-        flattenReferencesGraph
+        flatten-references-graph
        jq
      ];
    }
@@ -0,0 +1,115 @@
+{
+  lib,
+  stdenvNoCC,
+  python3,
+}:
+
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+  excludeDrvArgNames = [
+    "derivationArgs"
+    "sha1"
+    "sha256"
+    "sha512"
+  ];
+  extendDrvArgs =
+    finalAttrs:
+    lib.fetchers.withNormalizedHash { } (
+      {
+
+        endpoint ? "https://api.itch.io",
+
+        # The name of the environment variable that contains the itch.io API key.
+        # The environment variable needs to be set for the nix building process,
+        # which is nix-daemon for multi-user mode.
+        apiKeyVar ? "NIX_ITCHIO_API_KEY",
+
+        # The game store page URL in the format of https://{author}.itch.io/{game}
+        gameUrl,
+
+        # The upload ID of the downloadable file.
+        # To get the upload ID, look at the request URL when you download it.
+        upload,
+
+        # Derivation name.
+        name ? null,
+
+        # The extra message printed when the API key is not provided
+        # or when the account of the API key did not purchase the game.
+        extraMessage ? null,
+
+        # Show the download URL without actually downloading it, for testing purposes.
+        # Notice that this can potentially leak the API key.
+        showUrl ? false,
+
+        outputHash ? lib.fakeHash,
+        outputHashAlgo ? null,
+        preFetch ? "",
+        postFetch ? "",
+        nativeBuildInputs ? [ ],
+        impureEnvVars ? [ ],
+        passthru ? { },
+        meta ? { },
+        preferLocalBuild ? true,
+        derivationArgs ? { },
+      }:
+      let
+        finalHashHasColon = lib.hasInfix ":" finalAttrs.hash;
+        finalHashColonMatch = lib.match "([^:]+)[:](.*)" finalAttrs.hash;
+      in
+      derivationArgs
+      // {
+        __structuredAttrs = true;
+
+        name = if name != null then name else baseNameOf gameUrl;
+
+        hash =
+          if outputHashAlgo == null || outputHash == "" || lib.hasPrefix outputHashAlgo outputHash then
+            outputHash
+          else
+            "${outputHashAlgo}:${outputHash}";
+        outputHash =
+          if finalAttrs.hash == "" then
+            lib.fakeHash
+          else if finalHashHasColon then
+            lib.elemAt finalHashColonMatch 1
+          else
+            finalAttrs.hash;
+        outputHashAlgo = if finalHashHasColon then lib.head finalHashColonMatch else null;
+        outputHashMode = "flat";
+
+        nativeBuildInputs = [ python3 ] ++ nativeBuildInputs;
+
+        inherit preferLocalBuild;
+
+        # ENV
+        nixpkgsVersion = lib.trivial.release;
+        uploadName = name;
+        inherit
+          endpoint
+          apiKeyVar
+          gameUrl
+          extraMessage
+          showUrl
+          preFetch
+          postFetch
+          ;
+        impureEnvVars =
+          lib.fetchers.proxyImpureEnvVars
+          ++ [
+            apiKeyVar
+            "NIX_CONNECT_TIMEOUT"
+          ]
+          ++ impureEnvVars;
+
+        builder = builtins.toFile "builder.sh" ''
+          source "$NIX_ATTRS_SH_FILE"
+          runHook preFetch
+          python ${./fetchitchio.py}
+          runHook postFetch
+        '';
+      }
+    );
+
+  inheritFunctionArgs = false;
+}
@@ -0,0 +1,76 @@
+import itertools
+import json
+import os
+import platform
+import shutil
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+with open(os.environ['NIX_ATTRS_JSON_FILE']) as env_file:
+    ENV = json.load(env_file)
+
+USER_AGENT = f'Python/{platform.python_version()} Nixpkgs/{ENV['nixpkgsVersion']}'
+TIMEOUT = float(os.environ.get('NIX_CONNECT_TIMEOUT') or '15')
+
+ENDPOINT = ENV['endpoint']
+GAME_URL = ENV['gameUrl']
+UPLOAD_ID = ENV['upload']
+
+def abort(message):
+    if 'extraMessage' in ENV:
+        message = f'{message} {ENV['extraMessage']}'
+    print(message, file=sys.stderr)
+    sys.exit(1)
+
+try:
+    API_KEY = os.environ[ENV['apiKeyVar']]
+except KeyError:
+    abort(
+        f'Either set {ENV['apiKeyVar']} for the nix building process '
+        f'or manually download {ENV.get('uploadName', 'the required file')} '
+        f'from {GAME_URL} and add it to nix store.'
+    )
+
+def urlopen(url_or_request):
+    return urllib.request.urlopen(url_or_request, timeout=TIMEOUT)
+
+with urlopen(f'{GAME_URL}/data.json') as response:
+    data = json.load(response)
+    GAME_ID = data['id']
+    IS_FREE = 'price' not in data
+
+def api(path, params={}, download=False):
+    url = f'{ENDPOINT}{path}?{urllib.parse.urlencode({'api_key': API_KEY, **params})}'
+    if download and ENV['showUrl']:
+        with open(os.environ['out'], 'w') as output_file:
+            print(url, file=output_file)
+        return
+    request = urllib.request.Request(url, headers={'User-Agent': USER_AGENT})
+    with urlopen(request) as response:
+        if download:
+            with open(os.environ['out'], 'wb') as output_file:
+                shutil.copyfileobj(response, output_file)
+        else:
+            return json.load(response)
+
+if IS_FREE:
+    api(f'/uploads/{UPLOAD_ID}/download', download=True)
+    sys.exit()
+
+KEY_ID = None
+for page in itertools.count(1):
+    data = api('/profile/owned-keys', {'page': page})
+    if 'owned_keys' not in data:
+        break
+    for key in data['owned_keys']:
+        if key['game_id'] == GAME_ID:
+            KEY_ID = key['id']
+            break
+    if len(data['owned_keys']) < data['per_page']:
+        break
+if not KEY_ID:
+    abort(f'Cannot find a key associated with {GAME_URL}. Did you buy the game?')
+
+api(f'/uploads/{UPLOAD_ID}/download', {'download_key_id': KEY_ID}, download=True)
@@ -67,6 +67,20 @@ const ALLOWED_VERSION_FIELDS: &[&str] = &[
    "scripts",
 ];

+/// Allowed fields in `dist` sub-objects.
+///
+/// Only fields that npm reads during `npm install` are included.
+/// Excluded volatile fields:
+///   - `signatures`: changes when npm rotates registry signing keys
+///   - `npm-signature`: legacy signature format, also mutable
+///   - `attestations`: provenance attestations, can be added/updated post-publish
+///   - `fileCount`, `unpackedSize`: informational only, not used during install
+const ALLOWED_DIST_FIELDS: &[&str] = &[
+    "tarball",   // URL to download the package tarball
+    "integrity", // SRI hash for verification (e.g., sha512-...)
+    "shasum",    // SHA-1 fallback hash for older lockfiles
+];
+
 fn normalize_packument(
    package_name: &str,
    data: &[u8],
@@ -91,6 +105,12 @@ fn normalize_packument(
        for version_val in versions.values_mut() {
            if let Some(version_obj) = version_val.as_object_mut() {
                version_obj.retain(|key, _| ALLOWED_VERSION_FIELDS.contains(&key.as_str()));
+
+                // Normalize the dist sub-object to strip volatile fields
+                // (signatures, npm-signature, attestations, fileCount, unpackedSize)
+                if let Some(Value::Object(dist_obj)) = version_obj.get_mut("dist") {
+                    dist_obj.retain(|key, _| ALLOWED_DIST_FIELDS.contains(&key.as_str()));
+                }
            }
        }
    }
@@ -6,7 +6,7 @@
 }:

 let
-  version = "0.11.12";
+  version = "0.11.13";
 in
 python3Packages.buildPythonApplication {
  pname = "ablog";
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication {
    owner = "sunpy";
    repo = "ablog";
    tag = "v${version}";
-    hash = "sha256-bPTaxkuIKeypfnZItG9cl51flHBIx/yg0qENuiqQgY4=";
+    hash = "sha256-P1eSN3wqlPNYbYW3Rkz2Y6yFcC379dt/qK8aVNwZRSs=";
  };

  build-system = with python3Packages; [
@@ -43,7 +43,6 @@ python3Packages.buildPythonApplication {

  pytestFlags = [
    "--rootdir=src/ablog"
-    "-Wignore::sphinx.deprecation.RemovedInSphinx90Warning" # Ignore ImportError
  ];

  disabledTests = [
@@ -5,14 +5,16 @@
  nix-update-script,
  cmake,
  ninja,
-  qtbase,
-  qtwayland,
  qt5,
+  qt6,
  libxcb,
  useQt6 ? false,
 }:
+let
+  qt = if useQt6 then qt6 else qt5;
+in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "adwaita-qt";
  version = "1.4.2";

@@ -24,8 +26,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "FedoraQt";
    repo = "adwaita-qt";
-    rev = version;
-    sha256 = "sha256-K/+SL52C+M2OC4NL+mhBnm/9BwH0KNNTGIDmPwuUwkM=";
+    tag = finalAttrs.version;
+    hash = "sha256-K/+SL52C+M2OC4NL+mhBnm/9BwH0KNNTGIDmPwuUwkM=";
  };

  nativeBuildInputs = [
@@ -34,7 +36,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    qtbase
+    qt.qtbase
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    libxcb
@@ -43,7 +45,7 @@ stdenv.mkDerivation rec {
    qt5.qtx11extras
  ]
  ++ lib.optionals useQt6 [
-    qtwayland
+    qt6.qtwayland
  ];

  # Qt setup hook complains about missing `wrapQtAppsHook` otherwise.
@@ -70,4 +72,4 @@ stdenv.mkDerivation rec {
    maintainers = [ ];
    platforms = lib.platforms.all;
  };
-}
+})
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "albert";
-  version = "34.0.5";
+  version = "34.0.10";

  src = fetchFromGitHub {
    owner = "albertlauncher";
    repo = "albert";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DwFU3hb63Lf9Etr/I1lQ0SpkHfB1hRI+8V0ILk5a2C0=";
+    hash = "sha256-Ryjv8oLUXxK9iOa4ed1lDEbMM7nRj9I02gVT0JNHonQ=";
    fetchSubmodules = true;
  };

@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-02-10";
+  version = "0-unstable-2026-02-18";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "061314309227b08b5acf8ff2963fc3ce976539e9";
-    hash = "sha256-Kn+m6evpaB4r/a11+6ItfhnCveB8iC6ZJGgkvvPWulc=";
+    rev = "e9108a0d71d7197d42f0315d8bc72147737ebc4a";
+    hash = "sha256-SgcmCsHnZtsMzYeVfb4tUkm9+KARVTZP+weOLHoYdtc=";
  };

  dontConfigure = true;
@@ -5,7 +5,7 @@
  nix-update-script,
 }:
 buildGoModule (finalAttrs: {
-  pname = "arduinoOTA";
+  pname = "arduino-ota";
  version = "1.4.1";

  src = fetchFromGitHub {
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {

  postPatch = ''
    substituteInPlace version/version.go \
-      --replace 'versionString        = ""' 'versionString        = "${finalAttrs.version}"'
+      --replace-fail 'versionString        = ""' 'versionString        = "${finalAttrs.version}"'
  '';

  passthru.updateScript = nix-update-script { };
@@ -69,8 +69,8 @@ let
    name = "arrow-testing";
    owner = "apache";
    repo = "arrow-testing";
-    rev = "9a02925d1ba80bd493b6d4da6e8a777588d57ac4";
-    hash = "sha256-dEFCkeQpQrU61uCwJp/XB2umbQHjXtzado36BGChoc0=";
+    rev = "19dda67f485ffb3ffa92f4c6fa083576ef052d58";
+    hash = "sha256-mna6I/a5ZxMLdWN0QfCsgsre6yMeuSv4syX5ePGLhfg=";
  };

  parquet-testing = fetchFromGitHub {
@@ -81,7 +81,7 @@ let
    hash = "sha256-Xd6o3RT6Q0tPutV77J0P1x3F6U3RHdCBOKGUKtkQCKk=";
  };

-  version = "22.0.0";
+  version = "23.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "arrow-cpp";
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "apache";
    repo = "arrow";
    rev = "apache-arrow-${version}";
-    hash = "sha256-i4Smt43oi4sddUt3qH7ePjensBSfPW+w/ExLVcVNKic=";
+    hash = "sha256-BluUlbtGJwvlrpN/c/KziOfFh5dvzZyuCy4JZkkFea4=";
  };

  sourceRoot = "${finalAttrs.src.name}/cpp";
@@ -120,8 +120,8 @@ stdenv.mkDerivation (finalAttrs: {
      ARROW_XSIMD_URL = fetchFromGitHub {
        owner = "xtensor-stack";
        repo = "xsimd";
-        tag = "13.0.0";
-        hash = "sha256-qElJYW5QDj3s59L3NgZj5zkhnUMzIP2mBa1sPks3/CE=";
+        tag = "14.0.0";
+        hash = "sha256-ijNoHb6xC+OHJbUB4j1PRsoHMzjrnOHVoDRe/nKguDo=";
      };

      ARROW_SUBSTRAIT_URL = fetchFromGitHub {
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "atuin";
-  version = "18.11.0";
+  version = "18.12.0";

  src = fetchFromGitHub {
    owner = "atuinsh";
    repo = "atuin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yjsCNN15E06te6cueSZksg7mcMyx2FiXKrbGAEcQWmg=";
+    hash = "sha256-nubhaIxVpVDiiNxX2InbhmYBkk/fMO0i9XrJgtJxD1o=";
  };

-  cargoHash = "sha256-xaALIVJpMek4nbSozxtOEWivRDlMmKdu6KqKiNMp0jk=";
+  cargoHash = "sha256-ZBqZhWQ5tPhfWDtJ8/7oVR1EoP+MrF55ofUQZ5qUpAw=";

  # atuin's default features include 'check-updates', which do not make sense
  # for distribution builds. List all other default features.
@@ -27,7 +27,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
  buildFeatures = [
    "client"
    "sync"
-    "server"
    "clipboard"
    "daemon"
  ];
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "auth0-cli";
-  version = "1.27.0";
+  version = "1.27.2";

  src = fetchFromGitHub {
    owner = "auth0";
    repo = "auth0-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DrQCbuVFfbhobF3lppQg/a0J/ZSMuP+wbLrMsLcKSRE=";
+    hash = "sha256-Se3jLcMU+KDkaF5UY18KWs/Q+YK3782e7cKc9BxaYqY=";
  };

  vendorHash = "sha256-Us6NJiSfOK1BBRyrYil26HGaZAgum6k3B5LdV60rCeA=";
@@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "autosuspend";
-  version = "10.0.0";
+  version = "10.1.0";
  pyproject = true;

  outputs = [
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    owner = "languitar";
    repo = "autosuspend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o9Jpb4i2/SJ3s3h5sclNjpaN/UFk1YbpPf7b3rGXLRg=";
+    hash = "sha256-4mByuJ75hd5TEoKxVglAHlYXZSlbAldMwnIianSw8O4=";
  };

  postPatch = ''
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "aws-vault";
-  version = "7.9.4";
+  version = "7.9.5";

  src = fetchFromGitHub {
    owner = "ByteNess";
    repo = "aws-vault";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Tdi2kGoJ0ZwEnBvjkjZuoTTIdmsJjdMi75gwBmy+5N4=";
+    hash = "sha256-MVeYKeFpGKk0asO7u5RE3arpX3x4EpF4xRCav5oj9J4=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-rY7UbAgv+dLnZBLFptPp7D+gYBsCj7QYM4VvH/HBdq4=";
+  vendorHash = "sha256-6JgcU+NRQSQjoGxF0ByaY2h9/HZUdg8BdbHazz5m8VM=";

  nativeBuildInputs = [
    installShellFiles
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "azurehound";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "SpecterOps";
    repo = "AzureHound";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/ene4POMlqpSFixbD7uzubmOmI/IOPgJbzEQV2dq1gU=";
+    hash = "sha256-bTg/XYPrV9+319e704Hmc4JdpvdiqNqY6XmCxogJbno=";
  };

  vendorHash = "sha256-+iNFWKFNON4HX2mf4O29zAdElEkIGIx55Wi9MRtg1dg=";
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Firmware extractor for cards supported by the b43 kernel module";
    mainProgram = "b43-fwcutter";
-    homepage = "http://wireless.kernel.org/en/users/Drivers/b43";
+    homepage = "https://wireless.docs.kernel.org/en/latest/en/users/drivers/b43.html";
    license = lib.licenses.bsd2;
    platforms = lib.platforms.linux;
  };
@@ -11,7 +11,6 @@
  gitMinimal,
 }:
 let
-  version = "1.23.0";
  deps = lib.makeBinPath [
    curl
    python3
@@ -21,14 +20,14 @@ let
    gitMinimal
  ];
 in
-stdenv.mkDerivation {
-  pname = "bashSnippets";
-  inherit version;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bash-snippets";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "alexanderepstein";
    repo = "Bash-Snippets";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "044nxgd3ic2qr6hgq5nymn3dyf5i4s8mv5z4az6jvwlrjnvbg8cp";
  };

@@ -58,4 +57,4 @@ stdenv.mkDerivation {
    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
-}
+})
@@ -44,7 +44,7 @@ appimageTools.wrapAppImage {
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"

    install -m 444 -D ${src}/Bazecor.desktop -t $out/share/applications
-    install -m 444 -D ${src}/bazecor.png -t $out/share/pixmaps
+    install -m 444 -D ${src}/bazecor.png -t $out/share/icons/hicolor/512x512/apps

    mkdir -p $out/lib/udev/rules.d
    install -m 444 -D ${./60-dygma.rules} $out/lib/udev/rules.d/60-dygma.rules
@@ -24,7 +24,7 @@
 }:

 let
-  version = "2.1.7";
+  version = "2.1.9";

  jdk = zulu25.override { enableJavaFX = true; };

@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: rec {
  # nixpkgs-update: no auto update
  src = fetchurl {
    url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb";
-    hash = "sha256-kNQbTZoHFR2qFw/Jjc9iaEews/oUOYoJanmbVH/vs44=";
+    hash = "sha256-E7GV4YGbF0Nj6aWVqJNUUpwLH1G5v5bEQamHP7OUzQY=";

    # Verify the upstream Debian package prior to extraction.
    # See https://bisq.wiki/Bisq_2#Installation
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: rec {

  signature = fetchurl {
    url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb.asc";
-    hash = "sha256-Cl9EIp+ycD8Tp/bx5dXQK206jZzrYJkI/U9ItfXDRWw=";
+    hash = "sha256-bNZNRbm9uNGfLzGvshXNaRLUNX38Uz58GGy6WqJwV1E=";
  };

  nativeBuildInputs = [
@@ -54,7 +54,7 @@ flutter329.buildFlutterApplication rec {
  postInstall = ''
    sed -i 's#Icon=.*/bluebubbles.png#Icon=bluebubbles#g' snap/gui/bluebubbles.desktop
    install -Dm0644 snap/gui/bluebubbles.desktop $out/share/applications/bluebubbles.desktop
-    install -Dm0644 snap/gui/bluebubbles.png $out/share/pixmaps/bluebubbles.png
+    install -Dm0644 snap/gui/bluebubbles.png -t $out/share/icons/hicolor/1024x1024/apps
  '';

  extraWrapProgramArgs = ''
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
  postInstall = ''
    patchelf --add-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/boilr
    install -Dpm 0644 flatpak/io.github.philipk.boilr.desktop $out/share/applications/boilr.desktop
-    install -Dpm 0644 resources/io.github.philipk.boilr.png $out/share/pixmaps/io.github.philipk.boilr.png
+    install -Dpm 0644 resources/io.github.philipk.boilr.png -t $out/share/icons/hicolor/32x32/apps
  '';

  dontPatchELF = true;
@@ -21,13 +21,13 @@

 buildNpmPackage rec {
  pname = "bruno";
-  version = "3.0.2";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    tag = "v${version}";
-    hash = "sha256-lvv1SJuUxNwukg/yi6mhgvVs8M/Eyf2H36NJN+6XKSE=";
+    hash = "sha256-XoGD8lDc6QGka17KTvVX3gEj1fo+4NWpUM8mLA5F+i4=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,7 @@ buildNpmPackage rec {

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-zb0oP4/L7449z83tpcT6W/6sXS4Urph3ELN9kUC32dA=";
+  npmDepsHash = "sha256-XJsQFyi448yoRM8pUvaNpGDIZ41q0vpwYTgJufBBu1g=";
  npmFlags = [ "--legacy-peer-deps" ];

  nativeBuildInputs = [
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
        install -Dm755 {.,$out/bin}/Bugdom
        wrapProgram $out/bin/Bugdom --run "cd $out/share/bugdom"
        install -Dm644 $src/packaging/io.jor.bugdom.desktop $out/share/applications/io.jor.bugdom.desktop
-        install -Dm644 $src/packaging/io.jor.bugdom.png $out/share/pixmaps/io.jor.bugdom.png
+        install -Dm644 $src/packaging/io.jor.bugdom.png -t $out/share/icons/hicolor/512x512/apps
      ''
  )
  + ''
@@ -87,8 +87,8 @@ buildFHSEnv {
    ];

  extraInstallCommands = ''
-    mkdir -p "$out/share/pixmaps"
-    ${lib.getBin unzip}/bin/unzip -p ${src} resources/Media/icon64${product.productName}.png > "$out/share/pixmaps/burpsuite.png"
+    mkdir -p "$out/share/icons/hicolor/64x64/apps"
+    ${lib.getBin unzip}/bin/unzip -p ${src} resources/Media/icon64${product.productName}.png > "$out/share/icons/hicolor/64x64/apps/burpsuite.png"
    cp -r ${desktopItem}/share/applications $out/share
  '';

@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    wrapProgram $out/bin/cargo-lambda --prefix PATH : ${lib.makeBinPath [ zig_0_13 ]}
  '';

-  CARGO_LAMBDA_BUILD_INFO = "(nixpkgs)";
+  env.CARGO_LAMBDA_BUILD_INFO = "(nixpkgs)";

  cargoBuildFlags = [ "--features=skip-build-banner" ];
  cargoCheckFlags = [ "--features=skip-build-banner" ];
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-zigbuild";
-  version = "0.21.6";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "messense";
    repo = "cargo-zigbuild";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZoZM43439Pph4slCyLe8D0KcZzO9F3Mb3wAT3xK9jBg=";
+    hash = "sha256-vW5SDi4oIJ2ScAdpZhLmP5RY9C1fN38XsBauaNrx9Nw=";
  };

-  cargoHash = "sha256-X7cOyn0ZZHUtRqaGOZqLh4Y61Q3u9PLA31GkN3zu/VM=";
+  cargoHash = "sha256-DLg91rS+fjo7QhmQr1NaZE+vpVVxs+5euPqM1QySDlE=";

  nativeBuildInputs = [ makeWrapper ];

@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    cp -r ${desktopItem}/share/applications $out/share/applications

    install -D ${finalAttrs.src} $out/share/ccemux/ccemux.jar
-    install -D ${desktopIcon} $out/share/pixmaps/ccemux.png
+    install -D ${desktopIcon} $out/share/icons/hicolor/256x256/apps/ccemux.png

    makeWrapper ${jre}/bin/java $out/bin/ccemux \
      --add-flags "-jar $out/share/ccemux/ccemux.jar"
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  writeTextFile,

  pkg-config,
@@ -43,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
    ./remove-default-commit-hash.patch
    ./remove-vendored-libraries.patch
    ./fix-avcodec-close.patch
+    (fetchpatch {
+      name = "CVE-2026-2245.patch";
+      url = "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925.patch";
+      hash = "sha256-wZiJob5v4SVa5YBmiHuNvgphSi4PhTTb3hg4vs1lhVg=";
+    })
  ]
  ++ finalAttrs.cargoDeps.vendorStaging.patches;

@@ -57,6 +57,7 @@ stdenvNoCC.mkDerivation {

  src =
    if overrideSrc == null then
+      # TODO: Replace this with fetchItchIo
      requireFile {
        name = "celeste-linux.zip";
        hash = "sha256-phNDBBHb7zwMRaBHT5D0hFEilkx9F31p6IllvLhHQb8=";
@@ -40,7 +40,7 @@ flutter332.buildFlutterApplication rec {
  ];

  postInstall = ''
-    install -Dm0644 assets/logo.png $out/share/pixmaps/chatmcp.png
+    install -Dm0644 assets/logo.png $out/share/icons/hicolor/1024x1024/apps/chatmcp.png
  '';

  passthru = {
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "check-jsonschema";
-  version = "0.36.1";
+  version = "0.36.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-jsonschema";
    repo = "check-jsonschema";
    tag = finalAttrs.version;
-    hash = "sha256-s8a/9kWKSu+WuHQyoBsK4Vn30c+EA/eld/OD3kHYvbk=";
+    hash = "sha256-Cml1pqy8H8mCCE7qte3JS80RZFdNrI6m+Ktd4QgnrF4=";
  };

  build-system = with python3Packages; [ setuptools ];
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
      else
        "cp -r dist/linux-unpacked/{resources,LICENSE*} $out/opt/cherry-studio"
    }
-    install -Dm644 build/icon.png $out/share/pixmaps/cherry-studio.png
+    install -Dm644 build/icon.png $out/share/icons/hicolor/1024x1024/apps/cherry-studio.png
    makeWrapper ${lib.getExe electron} $out/bin/cherry-studio \
      --inherit-argv0 \
      --add-flags $out/opt/cherry-studio/resources/app.asar \
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postInstall = ''
-    install -D misc/chromium-bsu.png $out/share/pixmaps/chromium-bsu.png
+    install -D misc/chromium-bsu.png -t $out/share/icons/hicolor/64x64/apps
    install -D misc/chromium-bsu.desktop $out/share/applications/chromium-bsu.desktop
  '';

@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "clapgrep";
-  version = "25.10";
+  version = "26.02";

  src = fetchFromGitHub {
    owner = "luleyleo";
    repo = "clapgrep";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y7XwS4jOj8WHi3ntLwPne86/ZVkdBaWrDtPmUcUG4XE=";
+    hash = "sha256-8OG3yVfmvAJN/e07r/2rij0tairE/hOdERDwqDt8fbk=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "cocoon";
-  version = "0.8.4";
+  version = "0.8.5";

  src = fetchFromGitHub {
    owner = "haileyok";
    repo = "cocoon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xXXHJcI3icsCeOeI+6L/waK3+UtjhBZosQPLoGN1TiY=";
+    hash = "sha256-2+K4KiF0N+Y+J5dS4xQZuYlxr6OYzNloVXjxyGnEHh4=";
  };

  ldflags = [
@@ -1,22 +1,22 @@
 {
-  "version": "2.4.31",
+  "version": "2.5.17",
  "vscodeVersion": "1.105.1",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/3578107fdf149b00059ddad37048220e4168100f/linux/x64/Cursor-2.4.31-x86_64.AppImage",
-      "hash": "sha256-4cEa5SsbE2QFfmcndnVI5QQIS9DPjFQ6u/iQO9P8SEk="
+      "url": "https://downloads.cursor.com/production/7b98dcb824ea96c9c62362a5e80dbf0d1aae4775/linux/x64/Cursor-2.5.17-x86_64.AppImage",
+      "hash": "sha256-tUVqfxkUUMXGFzI2lGgoIDuQxI9LSrspDuz4xPGpQig="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/3578107fdf149b00059ddad37048220e4168100f/linux/arm64/Cursor-2.4.31-aarch64.AppImage",
-      "hash": "sha256-b66KmFN92HZRyZnlFVMxCCgX0bWBktfKojtnXF7c+Qg="
+      "url": "https://downloads.cursor.com/production/7b98dcb824ea96c9c62362a5e80dbf0d1aae4775/linux/arm64/Cursor-2.5.17-aarch64.AppImage",
+      "hash": "sha256-yXr/sNyhsGbO1Coj7jI/LyRtyNfRuzOlaLuMAXNAI7g="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/3578107fdf149b00059ddad37048220e4168100f/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-JQq73IqSAlkedhCuxr+uIpWPEAslnMPxciDDQYHWU6o="
+      "url": "https://downloads.cursor.com/production/7b98dcb824ea96c9c62362a5e80dbf0d1aae4775/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-w738cXHYcckDtnOYYcuL3xxUH/rAcHS/nQG78npJ6IQ="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/3578107fdf149b00059ddad37048220e4168100f/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-xXzWWDfU00IDx3vqnB0A4mItSyvfRqasUhqOAj8U5aE="
+      "url": "https://downloads.cursor.com/production/7b98dcb824ea96c9c62362a5e80dbf0d1aae4775/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-zHQJb/FNV2jLMrtDzMSMVs09+FvZj1ndSWB7HnB9lsU="
    }
  }
 }
@@ -20,8 +20,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
  buildAndTestSubdir = "crates/codebook-lsp";
  cargoHash = "sha256-hxPgYGBq+KZfEyFiHQG31cNEN6A6hUgKRgZXIHOGalw=";

-  CARGO_PROFILE_RELEASE_LTO = "fat";
-  CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
+  env = {
+    CARGO_PROFILE_RELEASE_LTO = "fat";
+    CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
+  };

  # Integration tests require internet access for dictionaries
  doCheck = false;
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "color-lsp";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "huacnlee";
    repo = "color-lsp";
    rev = "v${version}";
-    hash = "sha256-U0pTzW2PCgMxVsa1QX9MC249PXXL2KvRSN1Em2WvIeI=";
+    hash = "sha256-p58rAVznBzhBv7gVvaEjMpCrk9kFuEjUvY6U4uMXUE8=";
  };

-  cargoHash = "sha256-etK+9fcKS+y+0C36vJrMkQ0yyVSpCW/DLKg4nTw3LrE=";
+  cargoHash = "sha256-o/me2LIv6qvxOuHUnyv8+GcfoJlmdFymJkJMuOlC1Nw=";

  # Only build the color-lsp binary, not the zed extension
  cargoBuildFlags = [
@@ -9,21 +9,21 @@
 }:

 let
-  commitHash = "d5bc935e4801a02fdbd953f8f0ae7989eaef50cf"; # matches tag release
+  commitHash = "be318748da098346a52133c0f7d4a4104a56efc5"; # matches tag release
  shortCommitHash = builtins.substring 0 7 commitHash;
 in
 buildGoModule (finalAttrs: {
  pname = "copywrite";
-  version = "0.22.0";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "copywrite";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gPVlHgFlLxoAj4pkg3OxD4CGQaLdAL312/Zn/pJ+7fg=";
+    hash = "sha256-gw5i50fHshyRrSU3/M4HWM/J82HawGXPHHg9nKIRBkQ=";
  };

-  vendorHash = "sha256-Qxp6BwN/Y6Xb1BwFGT/T8WYsXGPgN27mzoTE0i6cS1Q=";
+  vendorHash = "sha256-607qlAhrk+1SdrIeE9eYBW3qJKq9i7hEzObvKH66Dfk=";

  ldflags = [
    "-s"
@@ -34,6 +34,10 @@ buildGoModule (finalAttrs: {

  env.CGO_ENABLED = 0;

+  checkFlags = [
+    "-skip=Test_FormatCopyrightYears_AutoDetect" # depends on git metadata
+  ];
+
  nativeBuildInputs = [ installShellFiles ];
  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    $out/bin/copywrite completion bash > copywrite.bash
@@ -1,21 +1,20 @@
 {
-  buildPythonApplication,
-  fetchPypi,
  lib,
-  pycryptodome,
+  python3Packages,
+  fetchPypi,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dcnnt";
  version = "0.10.0";
  format = "setuptools";

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-73ZLgb5YcXlAOjbKLVv8oqgS6pstBdJxa7LFUgIHpUE=";
  };

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    pycryptodome
  ];

@@ -30,4 +29,4 @@ buildPythonApplication rec {
    maintainers = with lib.maintainers; [ arnoutkroeze ];
    mainProgram = "dcnnt";
  };
-}
+})
@@ -1,7 +1,7 @@
 {
  stdenvNoCC,
  lib,
-  requireFile,
+  fetchItchIo,
  asar,
  copyDesktopItems,
  electron,
@@ -18,10 +18,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "ddm";
  version = "4.1.0";

-  src = requireFile {
+  src = fetchItchIo {
    name = "DungeonDuelMonsters-linux-x64.zip";
    hash = "sha256-gq2nGwpaStqaVI1pL63xygxOI/z53o+zLwiKizG98Ks=";
-    url = "https://mikaygo.itch.io/ddm";
+    gameUrl = "https://mikaygo.itch.io/ddm";
+    upload = "13371354";
  };

  strictDeps = true;
@@ -7,6 +7,7 @@
  copyDesktopItems,
  buildFHSEnv,
  alsa-lib,
+  alsa-plugins,
  freetype,
  nghttp2,
  libx11,
@@ -15,7 +16,7 @@

 let
  pname = "decent-sampler";
-  version = "1.15.0";
+  version = "1.15.5";
  rlkey = "orvjprslmwn0dkfs0ncx6nxnm";

  icon = fetchurl {
@@ -28,8 +29,8 @@ let

    src = fetchzip {
      # dropbox links: https://www.dropbox.com/sh/dwyry6xpy5uut07/AABBJ84bjTTSQWzXGG5TOQpfa\
-      url = "https://www.dropbox.com/scl/fo/a0i0udw7ggfwnjoi05hh3/ABn4zZmR24tyJx0xaRS_lXg/Decent_Sampler-${version}-Linux-Static-x86_64.tar.gz?rlkey=${rlkey}&dl=0";
-      hash = "sha256-A+CBsGUtqXo7KAlx6BjbHGRZww73TlJCI68thicGKiE=";
+      url = "https://www.dropbox.com/scl/fo/a0i0udw7ggfwnjoi05hh3/ADKHnE9GsrZx5RepuBKy7dg/Decent_Sampler-${version}-Linux-Static-x86_64.tar.gz?rlkey=${rlkey}&dl=0";
+      hash = "sha256-uUEncrT0M4AmIokizrUdSATm8Dnvg3cBNGlH8wOPt+Y=";
    };

    nativeBuildInputs = [ copyDesktopItems ];
@@ -68,6 +69,7 @@ buildFHSEnv {

  targetPkgs = pkgs: [
    alsa-lib
+    alsa-plugins
    decent-sampler
    freetype
    nghttp2
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "discordo";
-  version = "0-unstable-2026-02-09";
+  version = "0-unstable-2026-02-17";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = "discordo";
-    rev = "4c61e7c67a78d0906ffa77794deeb45e53d659d2";
-    hash = "sha256-3UHQJDi+9TW7yD2yWfD+1hr8iSvyd1HLGqbtk0iYlVg=";
+    rev = "f1650a0df751e40a589ceda4ec19626e109bac2b";
+    hash = "sha256-+1XK5Zri7DiKzaqsFHYjzde1XEFlp4cj878+FzLaibg=";
  };

-  vendorHash = "sha256-8Le/d6sXXH0dCORWLOFUjHlbGcKr0yqQ2l8GQzLaYt0=";
+  vendorHash = "sha256-eltE7RkxqjYMWMv8/YmCC+WlntBTF8zO7UE0MQsG8Is=";

  env.CGO_ENABLED = 1;

@@ -28,13 +28,13 @@ buildGoModule (
  in
  {
    pname = "dms-shell";
-    version = "1.4.0";
+    version = "1.4.1";

    src = fetchFromGitHub {
      owner = "AvengeMedia";
      repo = "DankMaterialShell";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-O9NIJqfuSjwY//7OyFH3FqxRHe5M0vmmsXcryOi/bAE=";
+      hash = "sha256-abNemkJQxp8E9bCNyTlAcFxKx+t1Wsc49J5NRZuyCgs=";
    };

    sourceRoot = "${finalAttrs.src.name}/core";
@@ -26,6 +26,6 @@ buildGoModule (finalAttrs: {
    mainProgram = "dolt";
    homepage = "https://github.com/dolthub/dolt";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ danbst ];
+    maintainers = [ ];
  };
 })
@@ -1,29 +0,0 @@
-From cdbf3ba41ddce41d8ae375464e514f72d158ec0b Mon Sep 17 00:00:00 2001
-From: Marcin Serwin <marcin@serwin.dev>
-Date: Sat, 5 Jul 2025 22:26:49 +0200
-Subject: [PATCH] CMakeLists: update mcl version to 0.1.13
-
-The mcl in externals is already at this version, but it wasn't bumped
-here which makes it impossible to use prebuilt mcl.
-
-Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
- CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e95050da..edd153d0 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -145,7 +145,7 @@ set(TSL_ROBIN_MAP_ENABLE_INSTALL ON)
- 
- find_package(Boost 1.57 REQUIRED)
- find_package(fmt 9 CONFIG)
-find_package(mcl 0.1.12 EXACT CONFIG)
-+find_package(mcl 0.1.13 EXACT CONFIG)
- find_package(tsl-robin-map CONFIG)
- 
- if ("arm64" IN_LIST ARCHITECTURE OR DYNARMIC_TESTS)
-- 
-2.49.0
-
@@ -13,69 +13,21 @@
  nix-update-script,
  azahar,
  darwin,
+  oaknut,
+  mcl-cpp-utility-lib,
 }:
-let
-  oaknut = stdenv.mkDerivation {
-    pname = "oaknut";
-    version = "1.2.2-unstable-2024-03-01";
-
-    src = fetchFromGitHub {
-      owner = "merryhime";
-      repo = "oaknut";
-      rev = "94c726ce0338b054eb8cb5ea91de8fe6c19f4392";
-      hash = "sha256-IhP/110NGN42/FvpGIEm9MgsSiPYdtD8kNxL0cAWbqM=";
-    };
-
-    nativeBuildInputs = [
-      cmake
-      ninja
-    ];
-  };
-
-  mcl = stdenv.mkDerivation {
-    pname = "mcl";
-    version = "0.1.13-unstable-2025-03-16";
-
-    src = fetchFromGitHub {
-      owner = "azahar-emu";
-      repo = "mcl";
-      rev = "7b08d83418f628b800dfac1c9a16c3f59036fbad";
-      hash = "sha256-uTOiOlMzKbZSjKjtVSqFU+9m8v8horoCq3wL0O2E8sI=";
-    };
-
-    nativeBuildInputs = [
-      cmake
-      ninja
-    ];
-
-    buildInputs = [
-      fmt
-    ];
-
-    checkInputs = [
-      catch2_3
-    ];
-
-    doCheck = true;
-    checkPhase = ''
-      tests/mcl-tests
-    '';
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
  pname = "dynarmic";
-  version = "6.7.0-unstable-2025-03-16";
+  version = "6.7.0-unstable-2026-01-04";

  src = fetchFromGitHub {
    owner = "azahar-emu";
    repo = "dynarmic";
-    rev = "278405bd71999ed3f3c77c5f78344a06fef798b9";
-    hash = "sha256-D7nXn5y0h8FV0V8Tc8uBlRoeEU+gcpt44afujZvG+1A=";
+    rev = "526227eebe1efff3fb14dbf494b9c5b44c2e9c1f";
+    hash = "sha256-WG9mUFUnhEEF0+qsQzslTAj1nox3jaz6rVKs245EtV4=";
  };

  patches = [
-    # https://github.com/azahar-emu/dynarmic/pull/2
-    ./0001-CMakeLists-update-mcl-version-to-0.1.13.patch
    # https://github.com/azahar-emu/dynarmic/pull/3
    ./0001-xbyak-Fix-tests-when-using-newer-versions.patch
  ];
@@ -94,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    boost
    robin-map
-    mcl
+    mcl-cpp-utility-lib
    fmt
  ]
  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
@@ -123,8 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;

  passthru = {
-    inherit mcl oaknut;
-
    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
    tests = { inherit azahar; };
  };
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    zlib
  ];

-  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER = "gcc";
+  env.CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER = "gcc";

  preBuild = ''
    # `SANDBOX` defined by upstream to disable build-time network access
@@ -0,0 +1,13 @@
+diff --git a/src/common/settings.cpp b/src/common/settings.cpp
+index 2c88356888..96198006b7 100644
+--- a/src/common/settings.cpp
+++ b/src/common/settings.cpp
+@@ -176,7 +176,7 @@ bool IsFastmemEnabled() {
+     if (values.cpu_accuracy.GetValue() == CpuAccuracy::Unsafe) {
+         return bool(values.cpuopt_unsafe_host_mmu);
+     }
+-#if !defined(__APPLE__) && !defined(__linux__) && !defined(__ANDROID__) && !defined(_WIN32)
+#if !defined(__APPLE__) && !defined(__linux__) && !defined(__ANDROID__) && !defined(_WIN32) || (defined(__linux__) && defined(__aarch64__))
+     return false;
+ #else
+     return true;
@@ -0,0 +1,254 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  SDL2,
+  boost,
+  catch2_3,
+  cpp-jwt,
+  cubeb,
+  enet,
+  fetchFromGitea,
+  fetchurl,
+  ffmpeg-headless,
+  fmt,
+  frozen-containers,
+  gamemode,
+  glslang,
+  httplib,
+  kdePackages,
+  libopus,
+  libusb1,
+  lz4,
+  mcl-cpp-utility-lib,
+  mbedtls,
+  nix-update-script,
+  nlohmann_json,
+  oaknut,
+  openssl,
+  pipewire,
+  pkg-config,
+  python3,
+  qt6,
+  simpleini,
+  sirit,
+  spirv-headers,
+  spirv-tools,
+  stb,
+  unordered_dense,
+  vulkan-headers,
+  vulkan-loader,
+  vulkan-memory-allocator,
+  vulkan-utility-libraries,
+  xbyak,
+  zlib,
+  zstd,
+  tzdata,
+}:
+
+let
+  # Old yuzu compat list, the project does not publish its own at the moment
+  compat-list = fetchurl {
+    url = "https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/4abf1d239aba843180abfed58fa8541432fece5b/compatibility_list.json";
+    hash = "sha256-OC22KdawYK9yKiffqc1rtgrBanVExYMi9jqhvkwMD6w=";
+  };
+
+  nx_tzdb = stdenv.mkDerivation (finalAttrs: {
+    name = "tzdb_to_nx";
+    version = "120226";
+
+    src = fetchFromGitea {
+      domain = "git.crueter.xyz";
+      owner = "misc";
+      repo = "tzdb_to_nx";
+      tag = finalAttrs.version;
+      hash = "sha256-egPu8UVbj73RQ0Z5JMTjd5HVdy47WTfkUMlQaS0wUTg=";
+    };
+
+    nativeBuildInputs = [
+      cmake
+      ninja
+    ];
+
+    cmakeFlags = [
+      (lib.cmakeFeature "TZDB2NX_ZONEINFO_DIR" "${tzdata}/share/zoneinfo")
+      (lib.cmakeFeature "TZDB2NX_VERSION" tzdata.version)
+    ];
+
+    ninjaFlags = [ "x80e" ];
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r src/tzdb/nx $out
+
+      runHook postInstall
+    '';
+  });
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "eden";
+  version = "0.1.1";
+
+  src = fetchFromGitea {
+    domain = "git.eden-emu.dev";
+    owner = "eden-emu";
+    repo = "eden";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tkro7ZHgn2809Utf/Li5+OiseywyQKH15eqphxlJZQQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    glslang
+    pkg-config
+    python3
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    boost
+    cpp-jwt
+    cubeb
+    enet
+    ffmpeg-headless
+    fmt
+    frozen-containers
+    gamemode
+    httplib
+    kdePackages.quazip
+    libopus
+    libusb1
+    # intentionally omitted: LLVM - heavy, only used for stack traces in the debugger
+    lz4
+    mcl-cpp-utility-lib
+    nlohmann_json
+    openssl
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtwayland
+    qt6.qtwebengine
+    # intentionally omitted: renderdoc - heavy, developer only
+    SDL2
+    stb
+    simpleini
+    spirv-tools
+    spirv-headers
+    vulkan-headers
+    vulkan-memory-allocator
+    vulkan-utility-libraries
+    mbedtls
+    sirit
+    unordered_dense
+    zlib
+    zstd
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+    xbyak
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    oaknut
+  ];
+
+  patches = [
+    # https://git.eden-emu.dev/eden-emu/eden/issues/3484
+    ./aarch64-disable-fastmem.patch
+  ];
+
+  doCheck = true;
+
+  checkInputs = [
+    catch2_3
+    oaknut
+  ];
+
+  __structuredAttrs = true;
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "YUZU_TESTS" false) # some timer tests are flaky
+
+    # use system libraries
+    (lib.cmakeBool "CPMUTIL_FORCE_SYSTEM" true)
+    (lib.cmakeBool "YUZU_USE_EXTERNAL_SDL2" false)
+    (lib.cmakeBool "YUZU_USE_BUNDLED_FFMPEG" false)
+    (lib.cmakeFeature "YUZU_TZDB_PATH" "${nx_tzdb}")
+
+    # enable some optional features
+    (lib.cmakeBool "YUZU_USE_QT_WEB_ENGINE" true)
+    (lib.cmakeBool "YUZU_USE_QT_MULTIMEDIA" true)
+    (lib.cmakeBool "ENABLE_QT_TRANSLATION" true)
+
+    # We dont want to bother upstream with potentially outdated compat reports
+    (lib.cmakeBool "YUZU_ENABLE_COMPATIBILITY_REPORTING" false)
+
+    (lib.cmakeFeature "TITLE_BAR_FORMAT_IDLE" "${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) {}")
+    (lib.cmakeFeature "TITLE_BAR_FORMAT_RUNNING" "${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) | {}")
+  ];
+
+  postConfigure = ''
+    ln -sf ${compat-list} ./dist/compatibility_list/compatibility_list.json
+  '';
+
+  postInstall = ''
+    install -Dm444 $src/dist/72-yuzu-input.rules $out/lib/udev/rules.d/72-yuzu-input.rules
+  '';
+
+  preFixup = ''
+    qtWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        vulkan-loader
+        pipewire
+      ]
+    })
+  '';
+
+  passthru = {
+    inherit nx_tzdb compat-list;
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Switch 1 emulator derived from Yuzu and Sudachi";
+    homepage = "https://eden-emu.dev/";
+    mainProgram = "eden";
+    maintainers = with lib.maintainers; [ marcin-serwin ];
+    license = with lib.licenses; [
+      # Primary
+      gpl3Plus
+
+      # Build system
+      lgpl3Plus
+
+      # Dynarmic and Yuzu code
+      gpl2Plus
+      bsd0
+
+      # Icons
+      cc-by-40
+      cc-by-sa-30
+      cc0
+
+      # Timezone data
+      publicDomain
+
+      # Vendored/incorporated libs
+      apsl20
+      llvm-exception
+      lib.licenses.boost
+      bsd2
+      bsd3
+      mit
+      mpl20
+      wtfpl
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+})
@@ -5,6 +5,7 @@
  installShellFiles,
  git,
  stdenv,
+  writableTmpDirAsHomeHook,
 }:

 buildGoModule (finalAttrs: {
@@ -29,11 +30,16 @@ buildGoModule (finalAttrs: {
  ldflags = [
    "-s"
    "-w"
+    "-X=github.com/entireio/cli/cmd/entire/cli/buildinfo.Version=${finalAttrs.version}"
+    "-X=github.com/entireio/cli/cmd/entire/cli/buildinfo.Commit=${finalAttrs.src.rev}"
  ];

  nativeBuildInputs = [ installShellFiles ];

-  nativeCheckInputs = [ git ];
+  nativeCheckInputs = [
+    git
+    writableTmpDirAsHomeHook
+  ];

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd entire \
@@ -50,9 +56,12 @@ buildGoModule (finalAttrs: {
      of how code was written in your repo.
    '';
    homepage = "https://github.com/entireio/cli";
-    changelog = "https://github.com/entireio/cli/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/entireio/cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sheeeng ];
+    maintainers = with lib.maintainers; [
+      sheeeng
+      squishykid
+    ];
    mainProgram = "entire";
  };
 })
@@ -75,7 +75,7 @@ let
        sourceRoot
        ;
      fetcherVersion = 2;
-      hash = "sha256-3ZgE1ysb1OeB4BNszvlrnYcc7gOo7coPfOEQmMHC6E0=";
+      hash = "sha256-ok1Yl8CIPwViioH5HOM4VWilRU3HsSa8IAsBFl/QgG0=";
    };
  });

@@ -1,5 +1,5 @@
 # Start this shell with:
-# nix-shell path/to/root/of/nixpkgs -A flattenReferencesGraph.dev-shell
+# nix-shell path/to/root/of/nixpkgs -A flatten-references-graph.dev-shell
 {
  mkShell,
  callPackage,
--- a/Show More
+++ b/Show More