Merge master into staging-nixos

2026-06-09 13:02:44 +00:00
parent 9ebfaa3411 a6d914805c
commit bcc3f5644f
121 changed files with 1422 additions and 813 deletions
@@ -813,6 +813,13 @@
    githubId = 19290901;
    name = "Andrew Brooks";
  };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
  agilesteel = {
    email = "agilesteel@gmail.com";
    github = "agilesteel";
@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
@@ -245,6 +245,7 @@
  ./programs/iio-hyprland.nix
  ./programs/immersed.nix
  ./programs/iotop.nix
+  ./programs/jai-jail.nix
  ./programs/java.nix
  ./programs/joycond-cemuhook.nix
  ./programs/k3b.nix
@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}
@@ -864,12 +864,19 @@ in

    networking.firewall.allowedTCPPorts = mkMerge [
      (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
        # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
    ];

+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
    # symlink the configuration to /etc/home-assistant
    environment.etc = mkMerge [
      (mkIf (cfg.config != null && !cfg.configWritable) {
@@ -304,7 +304,6 @@ in
  meta = {
    maintainers = with lib.maintainers; [
      happysalada
-      euxane
      onny
      norpol
    ];
@@ -252,12 +252,13 @@ in
            in
            {
              "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                extraConfig = ''
-                  proxy_set_header Host $host;
                  proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_set_header CLIENT_IP $remote_addr;

                  proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                proxyPass = "http://unix:${unixPath}";
              };
              "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                extraConfig = ''
                  internal;
                  proxy_pass_request_body off;
@@ -79,7 +79,6 @@ in
  meta = {
    maintainers = with lib.maintainers; [
      happysalada
-      euxane
      onny
    ];
  };
@@ -408,6 +408,8 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.withFeature withSelinux "selinux")
  ];

+  __structuredAttrs = true;
+
  env =
    lib.optionalAttrs withNativeCompilation {
      NATIVE_FULL_AOT = "1";
@@ -1,6 +1,6 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
  gdk-pixbuf,
  glib,
@@ -9,12 +9,9 @@
  gtksourceview,
  pango,
  webkitgtk_4_1,
-  pygobject3,
-  pyyaml,
-  setuptools,
 }:

-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "rednotebook";
  version = "2.42";
  pyproject = true;
@@ -31,7 +28,7 @@ buildPythonApplication (finalAttrs: {

  nativeBuildInputs = [ gobject-introspection ];

-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];

  propagatedBuildInputs = [
    gdk-pixbuf
@@ -40,9 +37,11 @@ buildPythonApplication (finalAttrs: {
    gtksourceview
    pango
    webkitgtk_4_1
+  ]
+  ++ (with python3Packages; [
    pygobject3
    pyyaml
-  ];
+  ]);

  makeWrapperArgs = [
    "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"
@@ -4043,20 +4043,6 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

-  coop-nvim = buildVimPlugin {
-    pname = "coop.nvim";
-    version = "0-unstable-2026-04-20";
-    src = fetchFromGitHub {
-      owner = "gregorias";
-      repo = "coop.nvim";
-      rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
-      hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
-    };
-    meta.homepage = "https://github.com/gregorias/coop.nvim/";
-    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
-    meta.hydraPlatforms = [ ];
-  };
-
  copilot-cmp = buildVimPlugin {
    pname = "copilot-cmp";
    version = "0-unstable-2024-12-11";
@@ -287,7 +287,6 @@ https://github.com/niklasdewally/conjure.nvim/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
 https://github.com/banjo/contextfiles.nvim/,,
-https://github.com/gregorias/coop.nvim/,,
 https://github.com/zbirenbaum/copilot-cmp/,,
 https://github.com/copilotlsp-nvim/copilot-lsp/,,
 https://github.com/AndreM222/copilot-lualine/,,
@@ -113,6 +113,9 @@ buildVscode {
    '';
    homepage = "https://code.visualstudio.com/";
    downloadPage = "https://code.visualstudio.com/Updates";
+    changelog = "https://code.visualstudio.com/updates/v${
+      lib.replaceString "." "_" (lib.versions.majorMinor version)
+    }";
    license = lib.licenses.unfree;
    maintainers = with lib.maintainers; [
      eadwu
@@ -79,6 +79,7 @@ buildVscode rec {
    '';
    homepage = "https://github.com/VSCodium/vscodium";
    downloadPage = "https://github.com/VSCodium/vscodium/releases";
+    changelog = "https://github.com/VSCodium/vscodium/releases/tag/${version}";
    license = lib.licenses.mit;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    maintainers = with lib.maintainers; [
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "opera";
-  version = "0-unstable-2026-05-30";
+  version = "0-unstable-2026-06-09";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "opera-libretro";
-    rev = "d0a3b910f8bef6b8d48fb5eec4ad72ea5f022394";
-    hash = "sha256-OH9gkbMC4PJnpboiYrKV+XkQqq5ldq5tneyVJHfDzsM=";
+    rev = "5e36d4a9fbb2afbb8de2313b8e2bf83998ec2341";
+    hash = "sha256-TmSk0PIXOLToElUnyRkDFfpq3bvBh7+P8r8brYICJSY=";
  };

  makefile = "Makefile";
@@ -1,14 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchPypi,
-  hatch-vcs,
-  hatchling,
-  pynput,
-  xdg-base-dirs,
 }:

-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "bitwarden-menu";
  version = "0.4.5";
  pyproject = true;
@@ -19,12 +15,12 @@ buildPythonApplication (finalAttrs: {
    hash = "sha256-vUlNqSVdGhfN5WjDjf1ub32Y2WoBndIdFzfCNwo5+Vg=";
  };

-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
    hatch-vcs
    hatchling
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    pynput
    xdg-base-dirs
  ];
@@ -1,11 +1,10 @@
 {
  lib,
+  python3Packages,
  fetchFromGitHub,
-  buildPythonApplication,
-  pybluez,
 }:

-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "bluetooth_battery";
  version = "1.3.1";

@@ -16,7 +15,7 @@ buildPythonApplication (finalAttrs: {
    sha256 = "067qfxh228cy1x95bnjp88dx4k00ajj7ay7fz5vr1gkj2yfa203s";
  };

-  propagatedBuildInputs = [ pybluez ];
+  propagatedBuildInputs = with python3Packages; [ pybluez ];

  pyproject = false;

@@ -1,14 +1,13 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  pytestCheckHook,
  git,
  testers,
  mu-repo,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "mu-repo";
  version = "1.9.0";
  format = "setuptools";
@@ -23,7 +22,7 @@ buildPythonApplication rec {
  dependencies = [ git ];

  nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
    git
  ];

@@ -1,16 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  libevdev,
-  paramiko,
-  pynput,
-  setuptools,
-  screeninfo,
-  tkinter,
 }:

-buildPythonApplication {
+python3Packages.buildPythonApplication {
  pname = "remarkable-mouse";
  version = "unstable-2024-02-23";

@@ -22,9 +16,9 @@ buildPythonApplication {
  };

  pyproject = true;
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    screeninfo
    paramiko
    pynput
@@ -1,19 +1,11 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
  bibtool,
-  pybtex,
-  pymupdf,
-  pynvim,
-  pyperclip,
-  roman,
-  pdfrw,
-  pagelabels,
-  setuptools,
 }:

-buildPythonApplication {
+python3Packages.buildPythonApplication {
  pname = "termpdf.py";
  version = "2022-03-28";
  format = "setuptools";
@@ -27,6 +19,8 @@ buildPythonApplication {

  propagatedBuildInputs = [
    bibtool
+  ]
+  ++ (with python3Packages; [
    pybtex
    pymupdf
    pyperclip
@@ -35,7 +29,7 @@ buildPythonApplication {
    pdfrw
    pynvim
    setuptools
-  ];
+  ]);

  # upstream doesn't contain tests
  doCheck = false;
@@ -1,15 +1,10 @@
 {
  lib,
+  python3Packages,
  fetchurl,
-  buildPythonApplication,
-  python-dateutil,
-  sqlalchemy,
-  setproctitle,
-  icalendar,
-  colorama,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "yokadi";
  version = "1.3.0";
  format = "setuptools";
@@ -19,7 +14,7 @@ buildPythonApplication rec {
    hash = "sha256-zF2ffHeU+i7wzu1u4DhQ5zJXr8AjXboiyFAisXNX6TM=";
  };

-  dependencies = [
+  dependencies = with python3Packages; [
    python-dateutil
    sqlalchemy
    setproctitle
@@ -1,9 +1,9 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchFromGitHub,
-  wrapPython,
  fetchpatch,
+  python3Packages,
 }:

 stdenv.mkDerivation {
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
    })
  ];

-  nativeBuildInputs = [ wrapPython ];
+  nativeBuildInputs = [ python3Packages.wrapPython ];

  installPhase = ''
    install -vD droopy $out/bin/droopy
@@ -43,5 +43,4 @@ stdenv.mkDerivation {
    maintainers = [ ];
    mainProgram = "droopy";
  };
-
 }
@@ -1,22 +1,11 @@
 {
  lib,
+  python3Packages,
  fetchFromGitHub,
-  buildPythonApplication,
  cacert,
-  setuptools,
-  matrix-nio,
-  python-magic,
-  markdown,
-  pillow,
-  aiofiles,
-  notify2,
-  dbus-python,
-  pyxdg,
-  python-olm,
-  emoji,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "matrix-commander";
  version = "8.0.5";

@@ -41,6 +30,8 @@ buildPythonApplication rec {

  propagatedBuildInputs = [
    cacert
+  ]
+  ++ (with python3Packages; [
    setuptools
    (matrix-nio.override { withOlm = true; })
    python-magic
@@ -52,7 +43,7 @@ buildPythonApplication rec {
    pyxdg
    python-olm
    emoji
-  ];
+  ]);

  meta = {
    description = "Simple but convenient CLI-based Matrix client app for sending and receiving";
@@ -1,24 +1,13 @@
 {
-  stdenv,
  lib,
-  billiard,
-  buildPythonApplication,
+  stdenv,
+  python3Packages,
  fetchFromGitHub,
  fetchpatch,
-  gnureadline,
-  lxml,
-  matplotlib,
-  numpy,
-  opencv-python,
-  pymavlink,
-  pynmeagps,
-  pyserial,
-  setuptools,
  versionCheckHook,
-  wxpython,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "MAVProxy";
  version = "1.8.74";
  pyproject = true;
@@ -38,23 +27,25 @@ buildPythonApplication rec {
    })
  ];

-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];

-  dependencies = [
-    lxml
-    matplotlib
-    numpy
-    opencv-python
-    pymavlink
-    pynmeagps
-    pyserial
-    setuptools # Imports `pkg_resources` at runtime
-    wxpython
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    billiard
-    gnureadline
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      lxml
+      matplotlib
+      numpy
+      opencv-python
+      pymavlink
+      pynmeagps
+      pyserial
+      setuptools # Imports `pkg_resources` at runtime
+      wxpython
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      billiard
+      gnureadline
+    ];

  pythonImportsCheck = [ "MAVProxy" ];

@@ -1,12 +1,9 @@
 {
  lib,
  stdenv,
-  python,
+  python3Packages,
  qt5,
  fetchFromGitHub,
-  wrapPython,
-  pyqt5,
-  pyserial,
  dos2unix,
 }:

@@ -21,14 +18,15 @@ stdenv.mkDerivation rec {
    sha256 = "07snhwmqqp52vdgr66vx50zxx0nmpmns5cdjgh50hzlhji2z1fl9";
  };

-  buildInputs = [ python ];
-  pythonPath = [
+  buildInputs = [ python3Packages.python ];
+
+  pythonPath = with python3Packages; [
    pyqt5.dev
    pyserial
  ];

  nativeBuildInputs = [
-    wrapPython
+    python3Packages.wrapPython
    qt5.wrapQtAppsHook
    dos2unix
  ];
@@ -1,25 +1,14 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  copyDesktopItems,
  fetchPypi,
  gobject-introspection,
-  jellyfin-apiclient-python,
-  jinja2,
  makeDesktopItem,
-  mpv,
-  pillow,
-  pystray,
-  python,
-  python-mpv-jsonipc,
-  pywebview,
-  setuptools,
-  tkinter,
  wrapGAppsHook3,
-  pypresence,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "jellyfin-mpv-shim";
  version = "2.9.0";
  pyproject = true;
@@ -35,9 +24,9 @@ buildPythonApplication rec {
    gobject-introspection
  ];

-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];

-  dependencies = [
+  dependencies = with python3Packages; [
    jellyfin-apiclient-python
    mpv
    pillow
@@ -51,7 +40,7 @@ buildPythonApplication rec {
    jinja2
    pywebview

-    # discord rich presence dependencie
+    # discord rich presence dependency
    pypresence
  ];

@@ -80,7 +69,7 @@ buildPythonApplication rec {
  postInstall = ''
    for s in 16 32 48 64 128 256; do
      mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
-      ln -s $out/${python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
+      ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
        $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
    done
  '';
@@ -1,20 +1,13 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  fetchpatch,
-  python,
-  mpv,
-  requests,
-  python-mpv-jsonipc,
-  pystray,
-  tkinter,
  wrapGAppsHook3,
  gobject-introspection,
  mpv-shim-default-shaders,
 }:

-buildPythonApplication {
+python3Packages.buildPythonApplication {
  pname = "plex-mpv-shim";
  version = "1.11.0-unstable-2025-03-17";
  format = "setuptools";
@@ -31,7 +24,7 @@ buildPythonApplication {
    gobject-introspection
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    mpv
    requests
    python-mpv-jsonipc
@@ -47,7 +40,7 @@ buildPythonApplication {

  postInstall = ''
    # put link to shaders where upstream package expects them
-    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python.sitePackages}/plex_mpv_shim/default_shader_pack
+    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python3Packages.python.sitePackages}/plex_mpv_shim/default_shader_pack
  '';

  # does not contain tests
@@ -1,15 +1,12 @@
 {
  lib,
-  buildPythonPackage,
+  python3Packages,
  fetchFromGitHub,
-  hatchling,
-  more-itertools,
-  click,
  hyprland,
  makeWrapper,
 }:

-buildPythonPackage (finalAttrs: {
+python3Packages.buildPythonPackage (finalAttrs: {
  pname = "hyprshade";
  version = "4.0.1";
  pyproject = true;
@@ -22,11 +19,11 @@ buildPythonPackage (finalAttrs: {
  };

  nativeBuildInputs = [
-    hatchling
+    python3Packages.hatchling
    makeWrapper
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    more-itertools
    click
  ];
@@ -0,0 +1,38 @@
+{
+  lib,
+  ffmpeg_6,
+  alvr,
+}:
+
+(ffmpeg_6.override {
+  version = "6.0";
+  hash = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+
+  withHardcodedTables = false;
+
+  withHtmlDoc = false;
+  withManPages = false;
+  withPodDoc = false;
+  withTxtDoc = false;
+  withDocumentation = false;
+}).overrideAttrs
+  (old: {
+    # apply our own ffmpeg patches, but skip texinfo-7.1.patch as it does not apply to 6.0.
+    # apply upstream patches for ALVR as well.
+    patches =
+      (lib.filter (p: !(lib.hasSuffix "texinfo-7.1.patch" (baseNameOf (toString p)))) old.patches)
+      ++ [
+        (alvr.src + "/alvr/xtask/patches/0001-Add-AV_VAAPI_DRIVER_QUIRK_HEVC_ENCODER_ALIGN_64_16-f.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-av1-encode-backport.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-clip-constants-used-with-shift-instr.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-guid-conftest.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-lavu-hwcontext_vulkan-Fix-importing-RGBx-frames-to-C.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-update-rc-modes.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Add-filler_data-option.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Allow-to-dynamically-change-bitrate-and.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Enable-global-header.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode_h265-Set-vui_parameters_present_flag.patch")
+      ];
+
+    doCheck = false;
+  })
@@ -2,8 +2,10 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  fetchpatch,
  replaceVars,
  nix-update-script,
+  callPackage,
  pkg-config,
  autoAddDriverRunpath,
  alsa-lib,
@@ -11,7 +13,7 @@
  brotli,
  bzip2,
  celt,
-  ffmpeg_7,
+  ffmpeg-alvr ? callPackage ./ffmpeg.nix { },
  gmp,
  jack2,
  lame,
@@ -42,6 +44,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "alvr";
+
  version = "20.14.1";

  src = fetchFromGitHub {
@@ -56,20 +59,15 @@ rustPlatform.buildRustPackage (finalAttrs: {

  patches = [
    (replaceVars ./fix-finding-libs.patch {
-      ffmpeg = lib.getDev ffmpeg_7;
+      ffmpeg = lib.getDev ffmpeg-alvr;
      x264 = lib.getDev x264;
    })
+    (fetchpatch {
+      url = "https://github.com/alvr-org/ALVR/commit/12a238b9ac9d63438163ff82cbd689733558a1e4.patch";
+      hash = "sha256-yvIGjopXIwGXajs5/RlAo+eqfVNnXlomKy/VO/dL+gc=";
+    })
  ];

-  postPatch = ''
-    substituteInPlace alvr/server_openvr/cpp/platform/linux/EncodePipelineVAAPI.cpp \
-      --replace-fail 'FF_PROFILE_H264_MAIN' 'AV_PROFILE_H264_MAIN' \
-      --replace-fail 'FF_PROFILE_H264_BASELINE' 'AV_PROFILE_H264_BASELINE' \
-      --replace-fail 'FF_PROFILE_H264_HIGH' 'AV_PROFILE_H264_HIGH' \
-      --replace-fail 'FF_PROFILE_HEVC_MAIN' 'AV_PROFILE_HEVC_MAIN' \
-      --replace-fail 'FF_PROFILE_AV1_MAIN' 'AV_PROFILE_AV1_MAIN'
-  '';
-
  env = {
    NIX_CFLAGS_COMPILE = toString [
      "-lbrotlicommon"
@@ -107,7 +105,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    brotli
    bzip2
    celt
-    ffmpeg_7
+    ffmpeg-alvr
    gmp
    jack2
    lame
@@ -153,7 +151,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ln -s $out/lib $out/lib64
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit ffmpeg-alvr;
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Stream VR games from your PC to your headset via Wi-Fi";
@@ -164,6 +165,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    maintainers = with lib.maintainers; [
      luNeder
      jopejoe1
+      eyjhb
    ];
    platforms = lib.platforms.linux;
  };
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {

  # Use only versions specified in anytype-ts middleware.version file:
  #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.49.0-rc08";
+  version = "0.50.8";

  # Update only together with 'anytype' package.
  # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
    owner = "anyproto";
    repo = "anytype-heart";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gTUesFf6cDwsFCEUjpcy9VA67GwuZ9mNTih4HC0Vi7g=";
+    hash = "sha256-h59Vnmv+iB0NbLQPCHPlmHBDaYoFimrZP/4Cv/IQ7b8=";
  };

-  vendorHash = "sha256-1D7v/lgmoKOOHNG3vgpzDpWQ66lmmP8IeZ5rvXe4D9M=";
+  vendorHash = "sha256-uJ/Z2zxqIne3UuxAglZejoqHV/IchYdPhefL9K51U2I=";

  subPackages = [ "cmd/grpcserver" ];
  tags = [
@@ -59,16 +59,11 @@ buildGoModule (finalAttrs: {
    cp ${tantivy-go}/lib/libtantivy_go.a deps/libs/${arch}
  '';

-  postBuild = ''
-    protoc -I ./  --js_out=import_style=commonjs,binary:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-    protoc -I ./  --grpc-web_out=import_style=commonjs+dts,mode=grpcwebtext:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-  '';
-
  postInstall = ''
    mv $out/bin/grpcserver $out/bin/anytypeHelper
-    mkdir -p $out/lib
-    cp -r dist/js/pb/* $out/lib
-    cp -r dist/js/pb/* $out/lib
+    mkdir -p $out/lib/protos
+    find pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
+    find pkg/lib/pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;

    mkdir -p $out/lib/json/generated
    cp pkg/lib/bundle/system*.json $out/lib/json/generated
@@ -1,18 +1,8 @@
-From d236396b1da80a7233168e01e8164256e7f69cc1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
-Date: Fri, 25 Apr 2025 12:29:37 +0200
-Subject: [PATCH] feat(update): Disable auto checking for updates and updating
- manually
-
---
- electron/js/update.js | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/electron/js/update.js b/electron/js/update.js
-index 0e34efa..9386c90 100644
--- a/electron/js/update.js
-+++ b/electron/js/update.js
-@@ -29,7 +29,8 @@ class UpdateManager {
+diff --git a/electron/ts/update.ts b/electron/ts/update.ts
+index 8d63cb8eb7..ea2dadf0c9 100644
+--- a/electron/ts/update.ts
+++ b/electron/ts/update.ts
+@@ -31,7 +31,8 @@ class UpdateManager {
 		autoUpdater.autoInstallOnAppQuit = false;
 		autoUpdater.channel = channel;
 
@@ -22,16 +12,13 @@ index 0e34efa..9386c90 100644
 
 		autoUpdater.on('checking-for-update', () => {
 			Util.log('info', 'Checking for update');
-@@ -93,6 +94,9 @@ class UpdateManager {
+@@ -79,6 +80,9 @@ class UpdateManager {
 	};
 
- 	isAllowed () {
+ 	isAllowed (): boolean {
 +		// PATCH(update): Always disallow update check, even when requested by the user manually or when Anytype starts.
 +		return false;
 +
 		const { config } = ConfigManager;
 
 		if (config.updateDisabled) {
-- 
-2.49.0
-
@@ -1,12 +1,12 @@
-diff --git a/electron.js b/electron.js
-index c5d6760882..17afc05e26 100644
--- a/electron.js
-+++ b/electron.js
-@@ -15,7 +15,6 @@ const store = new Store({ name: [ 'localStorage', suffix ].join('-') });
- 
- // gRPC DevTools extension ID
- const GRPC_DEVTOOLS_ID = 'fohdnlaeecihjiendkfhifhlgldpeopm';
-const { installExtension } = require('@tomjs/electron-devtools-installer');
- 
- // Fix notifications app name
- if (is.windows) {
+diff --git a/electron/ts/main.ts b/electron/ts/main.ts
+index 373518ee2d..8eefcd58be 100644
+--- a/electron/ts/main.ts
+++ b/electron/ts/main.ts
+@@ -15,7 +15,6 @@ import storage from 'electron-json-storage';
+ import * as remote from '@electron/remote/main';
+ import { installNativeMessagingHost } from './lib/installNativeMessagingHost';
+ import { getSafeStorage } from './safeStorage';
+-import { installExtension } from '@tomjs/electron-devtools-installer';
+ import Api from './api';
+ import ConfigManager from './config';
+ import UpdateManager from './update';
@@ -1,13 +1,12 @@
-diff --git a/electron/js/util.js b/electron/js/util.js
-index da18f41ad0..bb07ec9f21 100644
--- a/electron/js/util.js
-+++ b/electron/js/util.js
-@@ -314,7 +314,9 @@ class Util {
- 		if (!is.linux) {
+diff --git a/electron/ts/util.ts b/electron/ts/util.ts
+index 1c5d6fd4b4..8c7811b58e 100644
+--- a/electron/ts/util.ts
+++ b/electron/ts/util.ts
+@@ -318,6 +318,9 @@ class Util {
 			return;
 		};
-
-+		// NixOS: desktop entries are managed by the package, avoid 
+ 
+		// NixOS: desktop entries are managed by the package, avoid
 +		// writing user-local anytype.desktop which goes stale on updates
 +		return;
 		const { execFile } = require('child_process');
@@ -1,57 +1,116 @@
 {
  lib,
  stdenv,
+  stdenvNoCC,
  fetchFromGitHub,
-  buildNpmPackage,
-  nodejs_22,
+  makeWrapper,
+  coreutils,
+  nodejs,
+  node-gyp,
+  python3,
+  bun,
  pkg-config,
  anytype-heart,
  libsecret,
  electron,
  go,
  lsof,
+  protobuf,
  makeDesktopItem,
  copyDesktopItems,
+  writableTmpDirAsHomeHook,
  commandLineArgs ? "",
 }:

-buildNpmPackage (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "anytype";
-  version = "0.54.11";
+  version = "0.55.5";
+
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "anyproto";
    repo = "anytype-ts";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HF7bP3Ry3djNQnFDl0v6x9hzMpSLMXyI6UBItgGT+DI=";
+    hash = "sha256-9myOd7LTH/NoRY4SjU7+FSSNIhDMGKRPTBOQOURk/Hs=";
  };

  locales = fetchFromGitHub {
    owner = "anyproto";
    repo = "l10n-anytype-ts";
-    rev = "afa12aeb0cea6c77ce38c3e3bfd082d532948a1c";
-    hash = "sha256-YpOkmm7vW97t19twfLNExRHQvLVcrC+oDtHjwJL9dx8=";
+    rev = "b96bf7b76f10e764e7a60c7f284854aaabedcec6";
+    hash = "sha256-+vkProHi25CWxG74QB5eo0Pnwj0u5vXoZeeCoXyMOv4=";
  };

-  npmDepsHash = "sha256-/QWHJ2grw34LOEIDn93WDTEpQH001vVtuQgncR2SRYQ=";
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "${finalAttrs.pname}-node_modules";
+    inherit (finalAttrs) version src;

-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      # https://bun.com/docs/pm/cli/install#configuring-with-environment-variables
+
+      # Bun always tries to use the fastest available installation method for the target platform. On macOS, that’s clonefile and on Linux, that’s hardlink.
+      bun install \
+        --backend=copyfile \
+        --cpu="*" \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --os="*"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      find . -type d -name node_modules -exec cp -R --parents {} $out \;
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+
+    #TODO: update it in update script
+    outputHash = "sha256-6IHFidjVDDzUOCRXVwjvzcLGKV6dWWS7k2jwrOuJ748=";
+    outputHashMode = "recursive";
+  };

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
  };

  nativeBuildInputs = [
+    bun
+    nodejs
    pkg-config
    go
+    protobuf
    copyDesktopItems
+    makeWrapper
+    node-gyp
+    stdenv.cc
+    python3
  ];
-  buildInputs = [ libsecret ];

-  npmFlags = [
-    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron.headers}"
+  buildInputs = [
+    libsecret
  ];

  patches = [
@@ -60,26 +119,54 @@ buildNpmPackage (finalAttrs: {
    ./0003-remove-desktop-entry.patch
  ];

+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/. .
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
  buildPhase = ''
    runHook preBuild

+    # Building keytar against electron's ABI
+    # Trying to build in temp dir, will not work due to the keytar calling the node -p require('node-addon-api').include_dir
+    # but building inside the node_modules/keytar will find the ../node-addon-api automatically
+    chmod -R u+w node_modules/keytar node_modules/node-addon-api
+    pushd node_modules/keytar
+    HOME=$(mktemp -d) node-gyp rebuild --nodedir=${electron.headers}
+    popd
+
+    substituteInPlace scripts/generate-protos.sh \
+      --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
+
    cp -r ${anytype-heart}/lib dist/
    cp -r ${anytype-heart}/bin/anytypeHelper dist/

+    # Without this, build fails when trying to copy/write into that directory during the js bundle step
+    chmod -R u+w dist/
+
+    bash ./scripts/generate-protos.sh --from-dist
+
+    bun run build
+
    for lang in ${finalAttrs.locales}/locales/*; do
      cp "$lang" "dist/lib/json/lang/$(basename $lang)"
    done

-    npm run build
-    npm run build:nmh
+    # $HOME/.cache/go-build.
+    export GOCACHE=$(mktemp -d)
+    # Runs "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"
+    bun run build:nmh

    runHook postBuild
  '';

  # remove unnecessary files
  preInstall = ''
-    npm prune --omit=dev
-    chmod u+w -R dist
+    chmod u+w -R dist node_modules
    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
  '';

@@ -103,7 +190,7 @@ buildNpmPackage (finalAttrs: {
      --add-flags ${lib.escapeShellArg commandLineArgs}

    wrapProgram $out/lib/anytype/dist/nativeMessagingHost \
-       --prefix PATH : ${lib.makeBinPath [ lsof ]}
+      --prefix PATH : ${lib.makeBinPath [ lsof ]}

    runHook postInstall
  '';
@@ -34,7 +34,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bazaar";
-  version = "0.8.1";
+  version = "0.8.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "bazaar-org";
    repo = "bazaar";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ni2WfZu4LpCIXueGJYnZ2c7sCQ9VJAeI9zVNNrh7BLE=";
+    hash = "sha256-s0l548kuVD+eNAxA3BnbpuMHD1alq0/xGBIkXb7WpC0=";
  };

  nativeBuildInputs = [
@@ -29,7 +29,7 @@
  cctools,
  # Allow to independently override the jdks used to build and run respectively
  jdk_headless,
-  version ? "9.1.0",
+  version ? "9.1.1",
 }:

 let
@@ -89,7 +89,7 @@ let

  src = fetchzip {
    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-RbRM9HxcBij5gbd0aeArslc/IyjvycM5v7zOnaDT3cU=";
+    hash = "sha256-NwZQcycUMAzos1wLdSlwv2EjhDcPVJgQTkLT57AjFvI=";
    stripRoot = false;
  };

@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
    homepage = "https://blackfire.io/";
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
@@ -16,57 +16,57 @@ let
  phpMajor = lib.versions.majorMinor php.version;
  inherit (stdenv.hostPlatform) system;

-  version = "1.92.51";
+  version = "2026.5.0";

  hashes = {
    "x86_64-linux" = {
      system = "amd64";
      hash = {
-        "8.1" = "sha256-HxVqkPupo3LrKfbQGOqoxpGJjFN17Jlkdya4BjBsBVw=";
-        "8.2" = "sha256-ssbMa4Wa27nwhJZ16FT+qrB4LH/HztOtCx+MI+i16Pg=";
-        "8.3" = "sha256-p9SXxHQGmsjtSeRFt9vYS5XK6nouT7qbqmlWbEpb2Hk=";
-        "8.4" = "sha256-ArI/SNjPIbjwEBMHvKCdSOkth8qqBWT6W0RnoWyWA+o=";
-        "8.5" = "sha256-5e4f9iEn5QPZY6Z+05O7QxTwaW+cjmP6nB5fkpValoM=";
+        "8.1" = "sha256-FQzmRL1Dk4HBnrfbfOclDWGvqflFXTUMK8b1NLIb880=";
+        "8.2" = "sha256-e2+hVsoBXt8gURRvGC4bgAkLpB1GriefokAjFFUuO8c=";
+        "8.3" = "sha256-C/NsbJ8XlkBPlZ0lPeNL4SWxfVWSLxvQYDxTVf2PfyA=";
+        "8.4" = "sha256-gqEV9thI/oe38/dyrGZxhPtv4+ufzMDXJL0zgt8IbOA=";
+        "8.5" = "sha256-kw57CBFOcRpaToXD/V2veXjcQnVaM3uTLC3tgrKyNzc=";
      };
    };
    "i686-linux" = {
      system = "i386";
      hash = {
-        "8.1" = "sha256-mTw8v5DaP7D5qb3XwRZvx8XH4bTiuu2xzzo82KsrrZU=";
-        "8.2" = "sha256-Vtb0DVfPBC0JtK1XOPQ8KmA0Jq0pBBA3jkDaCV7icGg=";
-        "8.3" = "sha256-vnL8gfA6ejMcpnfKXalSOvl7vixwQLJBC3DTO4Dafow=";
-        "8.4" = "sha256-x9/BcZPJib0hal6M2vUVk1cLmN1gc3k6hypViTqForo=";
-        "8.5" = "sha256-aVmQ8vHS/oQeb44RyV5hggOt+VXLqP7wKDxgfpbopQQ=";
+        "8.1" = "sha256-Cccapa4s6Wvo/MOjReCbbJY4H1HNe5uF8Fe4UX8ftFs=";
+        "8.2" = "sha256-1k8m4Mram806XIbR4x0Kf6IH7rvhbLbaqPgM9v1SHS4=";
+        "8.3" = "sha256-Si0boOO5BRDKARZbAbPPrxRIaUjwViQLepZ5tNvkjGk=";
+        "8.4" = "sha256-BOjlJy48fS2SWK28Lcd9/MVhciDEaBJe6mRIhTa9JhI=";
+        "8.5" = "sha256-OBySA7eGI+YqvMnsOlr7p6RznqYq7DJptnYjhMfqk2Q=";
      };
    };
    "aarch64-linux" = {
      system = "arm64";
      hash = {
-        "8.1" = "sha256-S41qr5wU2dsK0IBsR/mTALguPQU+SKYVTLP7DwGQo40=";
-        "8.2" = "sha256-eQkvDRxwQNXlkZ9XzcSRfkKjp/CTZGaFwolXq6TZWaE=";
-        "8.3" = "sha256-GBjjx0cSJjYCOdDiArUPA4iqOcgpk3y9o0wi6b6UJgM=";
-        "8.4" = "sha256-s4zcHogsOy1GjTAGJuO6i7S6dp/lmRVzbjJk3/t8Zn4=";
-        "8.5" = "sha256-/lFwv6p9izXj7X+pqZe9clcp+wSYtzIPnwqeE/HFqNk=";
+        "8.1" = "sha256-Od+c9X4yg4xW9aAI0x1CacUNp7PdJl1KRIi++m4DLY8=";
+        "8.2" = "sha256-ZI2n0lXkwUg8BvpjdhqHz1F3Z7dlX+oGv6IsjRVzzWA=";
+        "8.3" = "sha256-6NMvylxdwPpbmIN5EDVcBuplP2kEQDyY+fD23k89k48=";
+        "8.4" = "sha256-356ECFSrqu5kJX/qP+SNtKl7bsGGD/ROJd9vgEX5wSM=";
+        "8.5" = "sha256-z7GMQ9wqIr2/BKi3G2Wf3cZBtU/ZC+uKMcbnmYfmm8w=";
      };
    };
    "aarch64-darwin" = {
      system = "arm64";
      hash = {
-        "8.1" = "sha256-+ko465G24UELdMmEg4ZqOA9p0/0DSs3p+On6Gg2IVMM=";
-        "8.2" = "sha256-TERILY6E1vnl+L6t+oel+1H3HTHWTTeEb1rVXtriJ8w=";
-        "8.3" = "sha256-R5Ue3erVCe1gOPk1SuDRXGA05WPm1IisHCnbXfmjFcw=";
-        "8.4" = "sha256-qqbmZa4qd7Ck87GylHeHP9m3K47DAEiTxlKdtXEnzVo=";
-        "8.5" = "sha256-3d9glqfXCMXwtLZm8fuj9DVzCIczynX7MRxnbMC7/NE=";
+        "8.1" = "sha256-vlb6HCz9KqSL+bSuVixiHVgVVkEAuCaoR7ww0/ZSdR8=";
+        "8.2" = "sha256-3XVHonZ7UW3LENuKgywyZ5q3Mo/6XBhnbiuARRGqPAg=";
+        "8.3" = "sha256-Dw+L0Bo/6BeFi+w3sm5kekR0mXoMUcsCuEksCdFpVA0=";
+        "8.4" = "sha256-i5R+vUn08yNWvPaJGRRHBPAbpxdqDmvPq3l9NPCuqxg=";
+        "8.5" = "sha256-vyBbyS8Y1mD+zFO01bMbim8Riq45+ns9YA4k41KQup8=";
      };
    };
    "x86_64-darwin" = {
      system = "amd64";
      hash = {
-        "8.1" = "sha256-XvV6x8LKjR4j081PIdKpYCVl+ayXOmPsXf+gsMeFOro=";
-        "8.2" = "sha256-qxFWj1HpWokwzsFTiRhi4vw67H8yLwu1xbhja+fAxqY=";
-        "8.3" = "sha256-ffrwc48MZzX0MJHbaDmWQpday1LicOxhR2+fwylItD0=";
-        "8.4" = "sha256-P8j8gc8lZRbuVd1UmSpYmle88h50vhJfNxTZp3v9/Sg=";
-        "8.5" = "sha256-zy24hLCTajY+BVdkJCiXoy8abhQ82Ntw7Wuqn6zJKOQ=";
+        "8.1" = "sha256-0xf09E58+kOGZbfpUeaCNdeeJx/Sv4QazfgcdV3Fqho=";
+        "8.2" = "sha256-BU3INTjuVXJ+WB16Q/6I1I5y0k+7sR158vKOiuh6H4w=";
+        "8.3" = "sha256-TBTuabrEpQR7ff+ULjZCD99a1xX4KNjTWlMQTJ1l6NU=";
+        "8.4" = "sha256-45R0CrE6MZ4RU4HslaF5/jbMOz32fCMnzj8R1F9tu34=";
+        "8.5" = "sha256-40+kki7h6DLQemLyoKOSdd8hmQXJE+Yt4rcC4V706vs=";
      };
    };
  };
@@ -161,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Blackfire Profiler PHP module";
    homepage = "https://blackfire.io/";
    license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
@@ -8,7 +8,7 @@
  fetchPnpmDeps,
  pnpmConfigHook,
  fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
  vips,
  pkg-config,
  nixosTests,
@@ -18,22 +18,22 @@
 }:

 let
-  # build failure against better-sqlite3, so we use nodejs_22; upstream
-  # bluesky-pds uses 20
-  nodejs = nodejs_22;
+  # upstream bluesky-social/atproto uses nodejs 22+
+  nodejs = nodejs_24;
  nodeSources = srcOnly nodejs;
  pythonEnv = python3.withPackages (p: [ p.setuptools ]);
+  pnpm = pnpm_9;
 in

 stdenv.mkDerivation (finalAttrs: {
  pname = "pds";
-  version = "0.4.219";
+  version = "0.4.5001";

  src = fetchFromGitHub {
    owner = "bluesky-social";
    repo = "pds";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zXNg1rtXN9qdTBvRlSiPlRu6k1Pv3T8nhROsEarev5U=";
+    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
  };

  sourceRoot = "${finalAttrs.src.name}/service";
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    pythonEnv
    pkg-config
    pnpmConfigHook
-    pnpm_9
+    pnpm
    removeReferencesTo
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -61,9 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
      src
      sourceRoot
      ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-rZpimxX4oDXIaUdAkkNPEff6qYJ9C8KptsPWJKwPiFo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
  };

  buildPhase = ''
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {

    makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
      --add-flags --enable-source-maps \
-      --add-flags "$out/lib/pds/index.js" \
+      --add-flags "$out/lib/pds/index.ts" \
      --set-default NODE_ENV production

    runHook postBuild
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {

    mkdir -p $out/{bin,lib/pds}
    mv node_modules $out/lib/pds
-    mv index.js $out/lib/pds
+    mv index.ts $out/lib/pds

    runHook postInstall
  '';
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.5.1.882-stable";
-  rev = "5b96a8d8a5e2f4800b43a780911a39dc5a666e1c";
-  hash = "sha256-Z+xcmHIkCuYSqOFdWSRWk2BFuCeI9yXnJIntSa4zXUk=";
+  version = "26.5.2.39-stable";
+  rev = "8462fd8f3dea8603e67666414b2781ab57a8adb6";
+  hash = "sha256-lbVveT6cFT9ZhSl+0qh3NhtO4FHakFWDBJd757J8WJg=";
  lts = false;
 }
@@ -6,11 +6,11 @@

 buildGraalvmNativeImage (finalAttrs: {
  pname = "clj-kondo";
-  version = "2026.04.15";
+  version = "2026.05.25";

  src = fetchurl {
    url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-BJw4A5c9F6S6T5d3dP0VdfEaayqoLbHiXUyEyqKFP94=";
+    sha256 = "sha256-SzrfsIHUW+KzZITesZ9aS00Gx7S4hekLsXXdjQJJxLM=";
  };

  extraNativeImageBuildArgs = [
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "CopyQ";
-  version = "15.0.0";
+  version = "16.0.0";

  src = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-D1huGKvYa/GsVeLQcP69MCWF8p+ytcQxlu0qynmYbGw=";
+    hash = "sha256-QO7iOFwO++tXZMWvJVmzUDrjnuz0Fl2XYsqfIPl5GBA=";
  };

  nativeBuildInputs = [
@@ -15,13 +15,13 @@

 buildGoModule (finalAttrs: {
  pname = "dcp";
-  version = "0.24.3";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "dcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
+    hash = "sha256-9+z+umhxnu4X9Yk76qk5Li/6ltT9qR3IVgkKgFrLf2c=";
  };

  vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";
@@ -7,7 +7,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dix";
-  version = "2.0.0";
+  version = "2.0.1";

  __structuredAttrs = true;

@@ -15,18 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "manic-systems";
    repo = "dix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5aH8zX/Wm+KHzd1fjmjlxjDB+psDG42JAY5U8lrjGDU=";
+    hash = "sha256-KTlFgBEVKJIXymfN2UU8hvGM71PYRcNgJ1XWUmG2AI4=";
  };

-  cargoHash = "sha256-llStz2BaHBH9iHhfbptAE+Td5HPsvzAlPtXohrCxY4w=";
-
-  env.TMPDIR = "/tmp/";
-  checkFlags = [
-    "--skip=store::nix_command::tests::test_query_closure_path_info"
-    "--skip=store::nix_command::tests::test_query_closure_size"
-    "--skip=store::nix_command::tests::test_query_dependents"
-    "--skip=store::nix_command::tests::test_query_system_derivations"
-  ];
+  cargoHash = "sha256-pNkSdsxOpv0E/xXs7tMg2vtP0PBU7p8fh3H4IX/u5k4=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dtop";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitHub {
    owner = "amir20";
    repo = "dtop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-v4LG0k9eMZiFYmIecHXwQqrTINaMAiqPYiXYEuQxx2A=";
+    hash = "sha256-kYSOJCQfoYXhdZ3cyRv/+Ifov4VzOv0gqvjueVMmnuQ=";
  };

-  cargoHash = "sha256-4F5eCt8AaVtGJRe7uBMHqdM3g1mLlWDXIpZCojRUjjc=";
+  cargoHash = "sha256-fspIjgctyhQwyDygrSrtJBb/EYxY8o00/UJy/z89yso=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = "--version";
@@ -53,6 +53,7 @@ buildGoModule (finalAttrs: {

  postInstall = ''
    installShellCompletion \
+      --cmd git-bug \
      --bash misc/completion/bash/git-bug \
      --zsh misc/completion/zsh/git-bug \
      --fish misc/completion/fish/git-bug
@@ -10,15 +10,15 @@

 buildGoModule (finalAttrs: {
  pname = "gitsign";
-  version = "0.16.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner = "sigstore";
    repo = "gitsign";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-XFeKU956FIfQhaca2M/OtYgCF8qErzPcyMBEGvzPAcc=";
+    hash = "sha256-BkaEI3YSnfMbRQ0r/rGUgZqUaCe3L1BXGxO4Ft19TdQ=";
  };
-  vendorHash = "sha256-fjrdQZVXgBvdKQFnmjtLShBHsKNIp5Y/uW7aU2cP1aY=";
+  vendorHash = "sha256-Sltj/DwS3T7puIaH5HAZ+BE9vlv79+FlvK+t5O2VSM0=";

  subPackages = [
    "."
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "helmify";
+  version = "0.4.20";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "arttor";
+    repo = "helmify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Az/rNrNwWkQCZ8iy2qkix8xqsWA+eUbFw7YstA9usdw=";
+  };
+
+  vendorHash = "sha256-a2uA2P9eenpgb2bFMvy3ioI9crG0FpvD1vEXqCwwwyw=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.tag}"
+    "-X main.date=19700101"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Creates Helm chart from Kubernetes yaml";
+    homepage = "https://github.com/arttor/helmify";
+    changelog = "https://github.com/arttor/helmify/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "helmify";
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,99 @@
+{
+  math = {
+    hash = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
+    name = "IBM Plex Math";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-math@1.1.0/ibm-plex-math.zip";
+    version = "1.1.0";
+  };
+  mono = {
+    hash = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
+    name = "IBM Plex Mono";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip";
+    version = "1.1.0";
+  };
+  sans = {
+    hash = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
+    name = "IBM Plex Sans";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans@1.1.0/ibm-plex-sans.zip";
+    version = "1.1.0";
+  };
+  sans-arabic = {
+    hash = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
+    name = "IBM Plex Sans Arabic";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-arabic@1.1.0/ibm-plex-sans-arabic.zip";
+    version = "1.1.0";
+  };
+  sans-condensed = {
+    hash = "sha256-prqyJIPs+UpQxFTbn/eAfsG/jKwQTOO72fZNzAtXUWg=";
+    name = "IBM Plex Sans Condensed";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-condensed@2.0.0/ibm-plex-sans-condensed.zip";
+    version = "2.0.0";
+  };
+  sans-devanagari = {
+    hash = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
+    name = "IBM Plex Sans Devanagari";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-devanagari@1.1.0/ibm-plex-sans-devanagari.zip";
+    version = "1.1.0";
+  };
+  sans-hebrew = {
+    hash = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
+    name = "IBM Plex Sans Hebrew";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-hebrew@1.1.0/ibm-plex-sans-hebrew.zip";
+    version = "1.1.0";
+  };
+  sans-jp = {
+    hash = "sha256-2BbhqsutMXEoS2JoZjJprrElIpFa9lgvPaM65pnYdfs=";
+    name = "IBM Plex Sans Japanese";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-jp@3.0.0/ibm-plex-sans-jp.zip";
+    version = "3.0.0";
+  };
+  sans-kr = {
+    hash = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
+    name = "IBM Plex Sans Korean";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-kr@1.1.0/ibm-plex-sans-kr.zip";
+    version = "1.1.0";
+  };
+  sans-sc = {
+    hash = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
+    name = "IBM Plex Sans Chinese SC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-sc@1.1.0/ibm-plex-sans-sc.zip";
+    version = "1.1.0";
+  };
+  sans-tc = {
+    hash = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
+    name = "IBM Plex Sans Chinese TC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-tc@1.1.1/ibm-plex-sans-tc.zip";
+    version = "1.1.1";
+  };
+  sans-thai = {
+    hash = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
+    name = "IBM Plex Sans Thai";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai@1.1.0/ibm-plex-sans-thai.zip";
+    version = "1.1.0";
+  };
+  sans-thai-looped = {
+    hash = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
+    name = "IBM Plex Sans Thai Looped";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai-looped@1.1.0/ibm-plex-sans-thai-looped.zip";
+    version = "1.1.0";
+  };
+  sans-variable = {
+    hash = "sha256-W45wPOmmP4KuJ3TVes2x0n25KgyDzX48ce1lQrjAXpw=";
+    name = "IBM Plex Sans (Variable)";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-variable@0.2.0/plex-sans-variable.zip";
+    version = "0.2.0";
+  };
+  serif = {
+    hash = "sha256-PO9KxV4K3a7fB4fR/i7LSf0mhK4I2eUDMsbSYWDQcb4=";
+    name = "IBM Plex Serif";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif@2.0.0/ibm-plex-serif.zip";
+    version = "2.0.0";
+  };
+  serif-variable = {
+    hash = "sha256-xhjmeIMT7FAFhfR8fekAxzQEl1hOtPdQ6qsVpnZN6Xg=";
+    name = "IBM Plex Serif (Variable)";
+    stripRoot = false;
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif-variable@2.0.0/plex-serif-variable.zip";
+    version = "2.0.0";
+  };
+}
@@ -1,16 +0,0 @@
-{
-  "serif" = "sha256-8ygaAeMKygYS4GCub4YUQmkh87pYHfi3s0PQ6AbaeGw=";
-  "sans" = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
-  "sans-condensed" = "sha256-/aJTXmrHuoPSrtCKNodBY7I0CriayNTx5LCXw+/MFvE=";
-  "sans-arabic" = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
-  "sans-devanagari" = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
-  "sans-thai" = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
-  "sans-thai-looped" = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
-  "sans-sc" = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
-  "sans-tc" = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
-  "sans-kr" = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
-  "sans-jp" = "sha256-hUl/SSkN6q3pDTtrY2mJepw3ljhhLJskGbxfsTl9TuI=";
-  "sans-hebrew" = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
-  "mono" = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
-  "math" = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
-}
@@ -1,60 +1,71 @@
 {
  lib,
  stdenvNoCC,
-  fetchzip,
  symlinkJoin,
+  fetchzip,
  installFonts,
  families ? [ ],
 }:
 let
-  version = import ./version.nix;
-  availableFamilies = import ./hashes.nix;
-
-  availableFamilyNames = builtins.attrNames availableFamilies;
+  allFonts = import ./fonts.nix;
+  availableFamilyNames = builtins.attrNames allFonts;
  selectedFamilies = if (families == [ ]) then availableFamilyNames else families;
-
  unknownFamilies = lib.subtractLists availableFamilyNames families;
-in
-assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
-stdenvNoCC.mkDerivation {
-  pname = "ibm-plex";
-  inherit version;
+  fontsToBuild = lib.filterAttrs (name: _: lib.elem name selectedFamilies) allFonts;
+  makeFont =
+    font:
+    stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = lib.toLower (lib.replaceStrings [ " (" ")" " " ] [ "-" "" "-" ] font.name);
+      inherit (font) version;

-  src = symlinkJoin {
-    name = "ibm-plex-src";
-    paths = map (
-      family:
-      fetchzip {
-        url = "https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip";
-        hash = availableFamilies.${family};
-      }
-    ) selectedFamilies;
-    postBuild = ''
-      find "$out" \( -name unhinted -or -name split \) -exec rm -fr {} +
-    '';
-  };
+      nativeBuildInputs = [ installFonts ];

-  sourceRoot = ".";
+      outputs = [
+        "out"
+        "webfont"
+      ];

-  nativeBuildInputs = [ installFonts ];
+      src = fetchzip {
+        inherit (font) hash url;
+        stripRoot = font.stripRoot or true;
+      };

-  outputs = [
-    "out"
-    "webfont"
-  ];
-
-  passthru.updateScript = ./update.sh;
+      # Some fonts, e.g. "ibm-plex-sans-korean" and "ibm-plex-sans-japanese"
+      # include both unhinted and hinted variants of the ttf and woff/woff2 type
+      # fonts, which collide when using the `installFonts` hook.
+      # Default to installing the hinted variant of the fonts.
+      #
+      # Additionally, fonts with webfonts include complete and split forms.
+      # Default to the complete forms.
+      preInstall = ''
+        find . -type d \( -name unhinted -or -name split \) -exec rm -rf {} +
+      '';

+      meta = meta // {
+        description = font.name;
+      };
+    });
+  fontDerivations = lib.mapAttrs (_: v: makeFont v) fontsToBuild;
  meta = {
    description = "IBM Plex Typeface";
    homepage = "https://www.ibm.com/plex/";
-    changelog = "https://github.com/IBM/plex/raw/v${version}/CHANGELOG.md";
    license = lib.licenses.ofl;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [
+      magicquark
      ners
      romildo
      ryanccn
    ];
  };
+in
+assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
+symlinkJoin {
+  pname = "ibm-plex";
+  version = "0-unstable-2026-02-12";
+  paths = lib.attrValues fontDerivations;
+  passthru = fontDerivations // {
+    updateScript = ./update.py;
+  };
+  inherit meta;
 }
@@ -0,0 +1,85 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix nix-prefetch python3
+import json
+import subprocess
+import urllib.request
+
+fonts_file = "fonts.nix"
+fonts_data = json.loads(
+    subprocess.check_output(["nix", "eval", "--json", "-f", fonts_file])
+)
+
+releases_url = "https://api.github.com/repos/IBM/plex/releases"
+releases = json.loads(urllib.request.urlopen(releases_url).read())
+
+for font in fonts_data.keys():
+    font_tag = f"@ibm/plex-{font}@"
+    font_file = f"plex-{font}.zip"
+    current_version = fonts_data.get(font, {}).get("version")
+
+    latest_release = next(
+        (r for r in releases if r["tag_name"].lower().startswith(font_tag)), None
+    )
+
+    if latest_release is None:
+        print(f"No release found for {font}")
+        continue
+
+    latest_version = latest_release["tag_name"].split("@")[-1]
+
+    if current_version == latest_version:
+        print(f"Font {font} is up-to-date")
+        continue
+
+    print(f"Updating {font} from {current_version} to {latest_version}")
+
+    asset = next(
+        (
+            a
+            for a in latest_release["assets"]
+            if font_file.lower() in a["name"].lower()
+        ),
+        None,
+    )
+
+    if asset is None:
+        print(f"Warning: No asset found for {font}")
+        continue
+
+    asset_url = asset["browser_download_url"]
+
+    raw_hash = (
+        subprocess.check_output(["nix-prefetch-url", "--unpack", asset_url])
+        .decode()
+        .strip()
+    )
+
+    sri_hash = (
+        subprocess.check_output(
+            ["nix", "--extra-experimental-features", "nix-command", "hash", "convert", "--hash-algo", "sha256", raw_hash]
+        )
+        .decode()
+        .strip()
+    )
+
+    for x, y in zip(
+        ["version", "hash", "url"],
+        [latest_version, sri_hash, asset_url]
+    ):
+        if fonts_data[font].get(x) != y:
+            fonts_data[font][x] = y
+
+
+with open(fonts_file, "w") as f:
+    f.write("{\n")
+    for font in sorted(fonts_data.keys()):
+        attrs = fonts_data[font]
+        f.write(f"  {font} = {{\n")
+        for k in sorted(attrs.keys()):
+            v = attrs[k]
+            if isinstance(v, bool):
+                f.write(f"    {k} = {'true' if v else 'false'};\n")
+            else:
+                f.write(f'    {k} = "{v}";\n')
+        f.write("  };\n")
+    f.write("}\n")
@@ -1,43 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch jq
-#  shellcheck shell=bash
-set -eo pipefail
-
-families=(
-    "serif"
-    "sans"
-    "sans-condensed"
-    "sans-arabic"
-    "sans-devanagari"
-    "sans-thai"
-    "sans-thai-looped"
-    "sans-sc"
-    "sans-tc"
-    "sans-kr"
-    "sans-jp"
-    "sans-hebrew"
-    "mono"
-    "math"
-)
-
-version=$(curl --silent 'https://api.github.com/repos/IBM/plex/releases/latest' | jq -r '.tag_name | sub("^@ibm/[\\w-]+@"; "")')
-
-dirname="$(dirname "$0")"
-echo \""${version}"\" >"$dirname/version-new.nix"
-if diff -q "$dirname/version-new.nix" "$dirname/version.nix"; then
-    echo No new version available, current: "$version"
-    rm "$dirname/version-new.nix"
-    exit 0
-else
-    echo Updated to version "$version"
-    mv "$dirname/version-new.nix" "$dirname/version.nix"
-fi
-
-printf '{\n' > "$dirname/hashes.nix"
-
-for family in "${families[@]}"; do
-    url="https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip"
-    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
-done
-
-printf '}\n' >> "$dirname/hashes.nix"
@@ -1 +0,0 @@
-"1.1.0"
@@ -0,0 +1,50 @@
+{
+  lib,
+  gcc15Stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  pandoc,
+  systemd,
+  util-linux,
+  acl,
+}:
+
+gcc15Stdenv.mkDerivation (finalAttrs: {
+  pname = "jai-jail";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stanford-scs";
+    repo = "jai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AByC7Xh1FYbQ/4Au396m2zYUxsLqcF1PEbpdz7x6LaQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+    systemd
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  buildInputs = [
+    util-linux # libmount
+    acl
+  ];
+
+  configureFlags = [ "--with-untrusted-user=jai" ];
+
+  meta = {
+    description = "Lightweight jail for AI CLIs";
+    mainProgram = "jai";
+    homepage = "https://jai.scs.stanford.edu";
+    changelog = "https://github.com/stanford-scs/jai/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ agentelement ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -5,7 +5,7 @@
 }:

 let
-  version = "7.1.4-1";
+  version = "7.1.4-3";
 in

 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    tag = "v${version}";
-    hash = "sha256-VijSSbtcaeQNf1UwpPKTIfzAHHp2BHvBdhXeigTQEbI=";
+    hash = "sha256-3aPiR4BJrR/5UFKRbrK8IbyW6HN9wC6oTSYKH4Ak4EU=";
  };
 }).overrideAttrs
  (old: {
@@ -13,7 +13,7 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "jellyfin-web";
-  version = "10.11.10";
+  version = "10.11.11";

  src =
    assert finalAttrs.version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
      owner = "jellyfin";
      repo = "jellyfin-web";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-fSpzF6Arx0JfL9fuQHjzf3m82XZR2BZkV0lA37L4DN4=";
+      hash = "sha256-3Gyg0eSbOXO0wgdgzuOtD8nDmSM37z7Bc0fKcbo9ffA=";
    };

  nodejs = nodejs_22;
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
      --replace-fail "git describe --always --dirty" "echo ${finalAttrs.src.rev}"
  '';

-  npmDepsHash = "sha256-DCFgivbZrDufRaB+4PeFxO6ISbEM9lXhXmlzc/5GbVU=";
+  npmDepsHash = "sha256-4kZo50xY/SvjpHToeIt0E91yeM7ab6Q6XtBMU5zSrF4=";

  preBuild = ''
    # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
@@ -14,13 +14,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jellyfin";
-  version = "10.11.10"; # ensure that jellyfin-web has matching version
+  version = "10.11.11"; # ensure that jellyfin-web has matching version

  src = fetchFromGitHub {
    owner = "jellyfin";
    repo = "jellyfin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bad532F8Ln5Y3TV4x5c7mgsiI+ZJGTZoahuSZhefMvQ=";
+    hash = "sha256-HCs4ZsutVoVH+bBZANjpPeMyV8e63Yemjg9DSr0R9zg=";
  };

  propagatedBuildInputs = [ sqlite ];
@@ -17,16 +17,16 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "k3d";
-  version = "5.8.3";
+  version = "5.9.0";

  src = fetchFromGitHub {
    owner = "k3d-io";
    repo = "k3d";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UBiDDZf/UtgPGRV9WUnoC32wc64nthBpBheEYOTp6Hk=";
+    hash = "sha256-W/fcpIgpE6kn87EXNVU+K9rFis5QAvVC2LgthI9M6yg=";
  };

-  vendorHash = "sha256-lFmIRtkUiohva2Vtg4AqHaB5McVOWW5+SFShkNqYVZ8=";
+  vendorHash = "sha256-QRr8dmiqoNHu30OILwrS9AXK68hnNIqXlKMkASbcKVo=";
  deleteVendor = true;

  nativeBuildInputs = [ installShellFiles ];
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
      using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
    '';
    homepage = "https://keepassxc.org/";
+    donationPage = "https://keepassxc.org/donate/";
    changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.gpl2Plus;
    mainProgram = "keepassxc";
@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
      runHook preInstall

      mkdir -p $out/data
+      sed -i '/"packageManager":/d' package.json
      cp -r . $out/data

      # Set up symlink for use at runtime
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
      makeWrapper ${pnpm}/bin/pnpm $out/bin/misskey \
        --run "${checkEnvVarScript} || exit" \
        --chdir $out/data \
+        --add-flag "--config.store-dir=/tmp/pnpm-store" \
        --add-flag "--config.verify-deps-before-run=false" \
        --add-flag run \
        --set-default NODE_ENV production \
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "muffet";
-  version = "2.11.4";
+  version = "2.11.5";

  src = fetchFromGitHub {
    owner = "raviqqe";
    repo = "muffet";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xczs3H1Jcr+WH8SCOhXRZx7Aft2BNpI+Kg4He8YEVVA=";
+    hash = "sha256-dPScTdOGR3cgcFBa09iez0/DkCugXseIGGRMiCPJeYo=";
  };

-  vendorHash = "sha256-94ytPGPbpXADIyDl28wWU2KmtwT17GyQFUe/bUc4RkA=";
+  vendorHash = "sha256-FXV+wP22R3gPAMGbhyz/v1Rk7w6z2ovoWirbLM1Wl24=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -6,7 +6,7 @@
 }:

 let
-  version = "1.2.0-22728942";
+  version = "1.2.0-23522718";
  urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;

 in
@@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
  inherit version;

  src = fetchzip {
-    url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-kSBql3oHG368DczSM7FkWeAZcfTrNP1x31LX7HRrgTE=";
+    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
+    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
  };

  # removing packaged jre since we use our own
@@ -3,13 +3,30 @@

 set -eu -o pipefail

+website=$(curl -sL https://necessegame.com/server)
+
 version=$(
-    curl -s http://www.necessegame.com/server \
+    echo "$website" \
        | pup 'a[href*="linux64"] text{}' \
        | awk -F'[v ]' '/Linux64/ {print $4"-"$6}' \
        | sort -Vu \
        | tail -n1
 )

-[[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]] \
-    && update-source-version necesse-server "$version"
+if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]]; then
+    version_url=${version//./-}
+
+    # extract the expiring presigned S3 URL for the new zip
+    url=$(
+        echo "$website" \
+            | pup "a[href*=\"linux64-${version_url}\"] attr{href}" \
+            | sed 's/\&amp;/\&/g'
+    )
+
+    # call API to remote-fetch the zip immediately and keep it cached,
+    # then fetch the zip locally to get the SRI hash, then update.
+    # fails early if the zip cannot be remote-fetched / cached.
+    curl -s --fail-with-body "https://necesse.pwn.sh/cache.php?version=${version_url}" \
+        && sri=$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256 --to sri) \
+        && update-source-version necesse-server "$version" "$sri"
+fi
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
  gettext,
  libuv,
@@ -123,6 +124,11 @@ stdenv.mkDerivation (
      # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
      # it installs. See https://github.com/neovim/neovim/issues/9413.
      ./system_rplugin_manifest.patch
+      (fetchpatch {
+        name = "CVE-2026-11487.patch";
+        url = "https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf.patch";
+        hash = "sha256-iWnq0ezbKYJqjvevVlcTJBvUc17ZvrhsanhtuKrh8zM=";
+      })
    ];

    inherit lua;
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
  pname = "ollama";
-  version = "0.30.5";
+  version = "0.30.6";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jh/B/FkmAliCVzqc8DGCPYa5+XejE3cFZTzSuRxjPvw=";
+    hash = "sha256-qO+Tsjg64QekGHNNiNy5YGSDoToGSnqiN5hN+0LCp4Q=";
  };

  vendorHash = "sha256-lZdGzGb9xRjTm1Rm7/wHjqM490gLznLEndmb4mNbCX0=";
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "openfga-cli";
-  version = "0.7.13";
+  version = "0.7.15";

  src = fetchFromGitHub {
    owner = "openfga";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-nV0Y0oCPH0zRWdhjGhXqX7dkMwhlEjwucr3K6dN0vDg=";
+    hash = "sha256-KChWGGbrgAAbIW6JU6FBaxMbkxv50hNzcOK44ebt7hI=";
  };

-  vendorHash = "sha256-kzxuFP1D3oD2P2goU48nj40/4KyY9bDhf9gTtpuoz1I=";
+  vendorHash = "sha256-4PLtThxswBnxHhCI6zDePOge8lpqTfAYXkKbktP+C5E=";

  nativeBuildInputs = [ installShellFiles ];

@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "openfga";
-  version = "1.14.2";
+  version = "1.16.1";

  src = fetchFromGitHub {
    owner = "openfga";
    repo = "openfga";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-nY5HRkZCKgjr1a5XxxRcUwCms9PCQs3IZiFgAEaD7To=";
+    hash = "sha256-4vp2lyONLP5YJzbzJidg3+LAsQ/NhJAh+mvI2IrZWKI=";
  };

-  vendorHash = "sha256-q5NZLPtdwFeHzLi+ZmRzGScxkl0OOxTVo/W6yUL1lO8=";
+  vendorHash = "sha256-S47vnGCnDiXUMINc53X1n0vVqU8fs0LHz3vbdtNZjlY=";

  nativeBuildInputs = [ installShellFiles ];

@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pipeform";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "magodo";
+    repo = "pipeform";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qmA+4xNstR1VRoYZW+xukNCEuEq6aGVkja3DYxZZVyY=";
+  };
+
+  vendorHash = "sha256-QI6Rnq3JxQuKRMkeo9Fvv6wfcTMgDEQ3Ot+es3IAUIA=";
+
+  subPackages = [ "." ];
+
+  __structuredAttrs = true;
+
+  # Clipboard support
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  meta = {
+    description = "TUI for Terraform runtime progress";
+    homepage = "https://github.com/magodo/pipeform";
+    license = lib.licenses.mpl20;
+    mainProgram = "pipeform";
+    maintainers = with lib.maintainers; [ jlesquembre ];
+  };
+})
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "pocketbase";
-  version = "0.39.0";
+  version = "0.39.3";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = "pocketbase";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4myp2MleKb6mAwDKhN39uyc5PZJhB3lvm2x/KDR9u0g=";
+    hash = "sha256-eCOGApbp/PLFpsX1GC2p56t3H+ksjiw5TL3iT7wnPGM=";
  };

-  vendorHash = "sha256-VBsClxCOA9Mp/kCHQKuBPd2Nt5sfXkVRx/8mGk5Gkcg=";
+  vendorHash = "sha256-ZKDMy+XUjCAvyis8wp9ddjuH+nFHh/A4bl5QZ33wtLE=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
  pname = "pretix";
-  version = "2026.5.0";
+  version = "2026.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-twXz3RaFujhZmARzZ5zIjGAwWchwhV8knq8Cr3h0Gjg=";
+    hash = "sha256-p4ZZzfoR4Wg65xeqk9JyCdZ+S7RqBVd1drWpHjj8oqc=";
  };

  patches = [
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rabbitmqadmin-ng";
-  version = "2.29.0";
+  version = "2.32.0";

  src = fetchFromGitHub {
    owner = "rabbitmq";
    repo = "rabbitmqadmin-ng";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-On4eUeFM4/GDfbGJ7249LTAu3srAbxU6vizsGP3sXj4=";
+    hash = "sha256-RCDjMOKPRRm1l9hcLPyxa6Qzf7fHXe1898SLqwZ+n7I=";
  };

-  cargoHash = "sha256-Xr6j5lCdl0CXj3nWBMawHAWoizrMR7KABC3nIFc9kgk=";
+  cargoHash = "sha256-VO7Kwm2mtED4/eirL6lsYSFMsyE8A2LdAFkXIjHFgUE=";

  buildInputs = [ openssl ];
  nativeBuildInputs = [ pkg-config ];
@@ -18,14 +18,14 @@

 buildGoModule (finalAttrs: {
  pname = "spotiflac";
-  version = "7.1.7";
+  version = "7.1.8";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "afkarxyz";
    repo = "SpotiFLAC";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2bCKsgrJH8jfggluNdNqX+LdG8NLcsuhrJwkaRTXAOs=";
+    hash = "sha256-Uz+9vsneP8xLGi5pgwYIufCPUzKSH4CRAdt0o+FifAM=";
  };

  nativeBuildInputs = [
@@ -88,7 +88,7 @@ buildGoModule (finalAttrs: {
    runHook postInstall;
  '';

-  vendorHash = "sha256-0H3U+i7SbbO7WkF9O8U8JoRxtroyEofzi2XrrWi6HWY=";
+  vendorHash = "sha256-dTrfLnuo7W3m3mg32wBDv8IbmQA44KXsazRLdanIi/Y=";

  desktopItems = [
    (makeDesktopItem {
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "telemt";
-  version = "3.4.13";
+  version = "3.4.15";

  src = fetchFromGitHub {
    owner = "telemt";
    repo = "telemt";
    tag = version;
-    hash = "sha256-ChzvbbWS/h7bZXqG4h3Iftslzsv2Rad+hXx+SyY2p30=";
+    hash = "sha256-YnV6lE+NyI8Wqj4Lf37G0McJyWYatebTnGn7yObXs5k=";
  };

-  cargoHash = "sha256-UicmtNQvGUZJtj3I8zztyGiy+oU66LWwNV+MNpZ3omc=";
+  cargoHash = "sha256-ekVPICi/UyVrtAB9kHaFhBe0PXoxjgF85cQMtVEPGjY=";

  checkFlags = [
    # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths
@@ -7,14 +7,14 @@

 buildGoModule (finalAttrs: {
  pname = "tempo";
-  version = "2.10.5";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "tempo";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg=";
+    hash = "sha256-KYb3QJ4jdPsEmxVCezpakRRDtdyeGc4JUgeCHkZTG50=";
  };

  vendorHash = null;
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
  pname = "traccar";
-  version = "6.13.0";
+  version = "6.13.3";
  nativeBuildInputs = [ pkgs.makeWrapper ];

  src = fetchzip {
    stripRoot = false;
    url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-nrAT/ewMpRXTN7bTU02VIJ4YoK5yvgfVZqMvQ1fXPo8=";
+    hash = "sha256-QQJ3+QByXkdfGBPA38F8+sQ72NnRbet6zcD3K82JLbI=";
  };

  installPhase = ''
@@ -0,0 +1,50 @@
+{
+  lib,
+  gitMinimal,
+  runCommandLocal,
+  stdenv,
+  wrapper,
+}:
+/**
+  Test that the given project tree is formatted with the treefmt config.
+
+  Input argument is the path to the project tree.
+*/
+project:
+runCommandLocal "${lib.getName wrapper}-check"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+    nativeBuildInputs = [
+      gitMinimal
+      wrapper
+    ];
+    inherit project;
+    env = {
+      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+    };
+    meta.description = "Check that the project tree is formatted";
+  }
+  ''
+    # Copy project files into the build-dir
+    cp -r "$project" project
+    chmod -R a+w project
+    cd project
+
+    # Setup a git repo
+    git init --initial-branch main
+    git config user.name nixbld
+    git config user.email nixbld@example.com
+    git add .
+    git commit -m init --quiet
+
+    # Run treefmt
+    treefmt --version
+    treefmt --no-cache
+
+    # Ensure nothing changed
+    git status
+    git --no-pager diff --exit-code
+    touch "$out"
+  ''
@@ -40,6 +40,20 @@
  /**
    Wrap treefmt, configured using structured settings.

+    # Check
+
+    The resulting package has a `check` attribute of type `Path -> Derivation`.
+    The derivation returned will only build if the path supplied is already formatted correctly.
+
+    ```
+    { pkgs }:
+    let
+      myTreefmt = pkgs.treefmt.withConfig ./treefmt-config.nix;
+      project = ../.;
+    in
+    myTreefmt.check project
+    ```
+
    # Type

    ```
@@ -15,7 +15,7 @@
    internal = true;
  };

-  config.result = pkgs.symlinkJoin {
+  config.result = pkgs.symlinkJoin (finalAttrs: {
    pname = config.name;
    inherit (config.package) meta version;
    nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
@@ -27,11 +27,14 @@
    passthru = {
      inherit (config) runtimeInputs;
      inherit config options;
+      check = pkgs.callPackage ../check-wrapper.nix {
+        wrapper = finalAttrs.finalPackage;
+      };
    };
    postBuild = ''
      wrapProgram "$out/bin/treefmt" \
        --prefix PATH : "$binPath" \
        --add-flags "--config-file $configFile"
    '';
-  };
+  });
 }
@@ -1,6 +1,7 @@
 {
  lib,
  runCommand,
+  runCommandLocal,
  testers,
  treefmt,
  nixfmt,
@@ -31,6 +32,28 @@ let
    settings = nixfmtExampleConfig;
    runtimeInputs = [ nixfmt ];
  };
+
+  wellFormattedTree = runCommandLocal "well-formatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo = "bar";
+      attrs = { };
+      list = [ ];
+    }
+    EOF
+  '';
+
+  unformattedTree = runCommandLocal "unformatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo="bar";
+      attrs={};
+      list=[];
+    }
+    EOF
+  '';
 in
 {
  buildConfigEmpty = testEqualContents {
@@ -68,6 +91,22 @@ in
    '';
  };

+  nixfmtExampleCheckPasses = nixfmtExamplePackage.check wellFormattedTree;
+
+  nixfmtExampleCheckFails = testers.testBuildFailure' {
+    drv = nixfmtExamplePackage.check unformattedTree;
+    expectedBuilderExitCode = 1;
+    expectedBuilderLogEntries = [
+      "diff --git a/file.nix b/file.nix"
+      "-  foo=\"bar\";"
+      "+  foo = \"bar\";"
+      "-  attrs={};"
+      "+  attrs = { };"
+      "-  list=[];"
+      "+  list = [ ];"
+    ];
+  };
+
  runNixfmtExample =
    runCommand "run-nixfmt-example"
      {
@@ -46,21 +46,21 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "unblob";
-  version = "26.3.30";
+  version = "26.6.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "onekey-sec";
    repo = "unblob";
    tag = version;
-    hash = "sha256-wYWuKvxAagctlmdO5Fi9/WzfJ4zkDgfXejgDTJPHsTI=";
+    hash = "sha256-NV4xnTejDW8mTxv0BGB4n+M/bxTMd4GWQQPXhqw5f2Y=";
    forceFetchGit = true;
    fetchLFS = true;
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-wjN4QPOUYFWWYMWL9aAgGqEucM7q+H6YyoS9Mv2dpp4=";
+    hash = "sha256-lEpnpvPwred1KRXxuM1KPxKbIIJUGvR0tmj16QyL5UQ=";
  };

  strictDeps = true;
@@ -9,12 +9,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20260531040030";
+    version = "20260609060640";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-+3lr7x+Ye2FcNjPNlxzI51yaNjQZl0CKeJ497HQZkm0=";
+      hash = "sha256-iedleoE+KXtCSEVgC7R8nSWgTFBXEVnp56J/PsmQ41I=";
    };
    vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
    meta = {
@@ -100,12 +100,12 @@ let
  allPkgs = pkgs;
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.2.0";
+  version = "11.3.0";
  pname = "octave";

  src = fetchurl {
    url = "mirror://gnu/octave/octave-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-zV0nMbYchh/yDKMN3ezrNmREuRjHoulZmG8DrsNuT6I=";
+    sha256 = "sha256-y1if6zzvhNE0hUaDcYycE+C0ceqRbQdhvnqMTiYaMtE=";
  };

  postPatch = ''
@@ -490,6 +490,38 @@ final: prev: {
    }
  ) { };

+  coop-nvim = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchFromGitHub,
+      fetchurl,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "coop.nvim";
+      version = "1.2.0-0";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/coop.nvim-1.2.0-0.rockspec";
+          sha256 = "1fkpdddk2c2wibk0khgmvr03in2hz8wd3gdmmfbfbpb6jybhcckg";
+        }).outPath;
+      src = fetchFromGitHub {
+        owner = "gregorias";
+        repo = "coop.nvim";
+        rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
+        hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
+      };
+
+      disabled = luaOlder "5.1";
+
+      meta = {
+        homepage = "https://github.com/gregorias/coop.nvim";
+        license = lib.licenses.gpl3Only;
+        description = "A Neovim plugin for structured concurrency with coroutines.";
+      };
+    }
+  ) { };
+
  cosmo = callPackage (
    {
      buildLuarocksPackage,
@@ -51,6 +51,7 @@ buildPythonPackage (finalAttrs: {

  pythonRelaxDeps = [
    "numpy"
+    "torch"
  ];
  dependencies = [
    aistore
@@ -87,6 +88,23 @@ buildPythonPackage (finalAttrs: {
    "test_total_cpu_count_linux"
    "test_total_cpu_count_mac"
    "test_total_cpu_count_windows"
+
+    # Numerical precision asertion errors since torch was updated to 2.12.0
+    # AssertionError: Output is not as expected
+    "test_ab_upt_determinism_regression_check"
+    "test_double_kwargs"
+    "test_forward_shape"
+    "test_forward_transolver_attention"
+    "test_forward_with_mask"
+    "test_perceiver_attention_forward_shape"
+    "test_perceiver_block_forward"
+    "test_rope_perceiver"
+    "test_rope_transformer"
+    "test_single"
+    "test_transformer_block_forward"
+    "test_transformer_determinism_regression_check"
+    "test_transolver_determinism_regression_check"
+    "test_upt_determinism_regression_check"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # flaky: assert 0.32007395901018754 == 0.3 ± 0.02
@@ -0,0 +1,170 @@
+{
+  lib,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+  python,
+
+  # build-system
+  cmake,
+  nanobind,
+  setuptools,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+  cudaPackages,
+
+  # buildInputs
+  blas,
+  lapack,
+
+  # dependencies
+  numpy,
+  scipy,
+
+  # tests
+  pytest-xdist,
+  pytestCheckHook,
+
+  # passthru
+  libmobility,
+}:
+let
+  uammd-src = fetchFromGitHub {
+    owner = "RaulPPelaez";
+    repo = "uammd";
+    tag = "v3.0.1";
+    hash = "sha256-/7ceXlA96dZQs1WzkV1OpRv61xa0Tdt5gFe17I0s1BI=";
+  };
+in
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
+  pname = "libmobility";
+  version = "1.1.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stochasticHydroTools";
+    repo = "libMobility";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7jUpVR4bS9vkgeKN68of6VNZzGPlQMcRMBStQ+wFEx4=";
+  };
+
+  postPatch =
+    # Various setup.py patches:
+    # - Inject nix's cmakeFlags
+    # - Patch install destination
+    # - Don't let setuptools ship the `solvers/` directory as the package is
+    #   already installed by cmake
+    # - Patch the version
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          "cmake_args = [" \
+          "cmake_args = [${lib.concatStringsSep "," (map (f: "'${f}'") finalAttrs.cmakeFlags)}," \
+        --replace-fail \
+          "sys.prefix" \
+          'os.environ["out"]' \
+        --replace-fail \
+          "packages=find_packages()," \
+          "packages=[]," \
+        --replace-fail \
+          'version = "0"' \
+          'version = "${finalAttrs.version}"'
+    ''
+    # Upstream installs the modules into the (read-only) absolute `Python_SITEARCH`.
+    # Make the destination relative so it lands under CMAKE_INSTALL_PREFIX ($out).
+    + ''
+      substituteInPlace solvers/CMakeLists.txt \
+        --replace-fail "$""{Python_SITEARCH}" "${python.sitePackages}"
+    ''
+    # The C++ test suite unconditionally fetches googletest over the network and
+    # is not run here (it requires a GPU); drop it.
+    + ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "add_subdirectory(tests/cpp)" ""
+    '';
+
+  build-system = [
+    cmake
+    nanobind
+    setuptools
+  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_UAMMD" uammd-src.outPath)
+    (lib.cmakeFeature "nanobind_DIR" "${nanobind}/${python.sitePackages}/nanobind/cmake")
+  ];
+
+  env = {
+    CMAKE_CUDA_ARCHITECTURES = cudaPackages.flags.cmakeCudaArchitecturesString;
+  };
+
+  preBuild = ''
+    export BUILD_JOBS="$NIX_BUILD_CORES"
+  '';
+
+  buildInputs = [
+    blas
+    lapack
+  ]
+  ++ (with cudaPackages; [
+    cuda_cccl # <nv/target>
+    cuda_cudart # CUDA::cuda_driver (driver stub)
+    libcublas
+    libcufft
+    libcurand
+    libcusolver
+  ]);
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  pythonImportsCheck = [ "libMobility" ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # FileNotFoundError: [Errno 2] No such file or directory: './ref/pair_mobility_nbody_freespace.npz'
+    "test_pair_mobility_angular_nbody"
+
+    # AssertionError (numerical assertion)
+    "test_deterministic_divM_matches_rfd"
+    "test_non_square_box"
+
+    # TypeError: Iterator operand 1 dtype could not be cast from dtype('complex128') to
+    # dtype('float64') according to the rule 'safe'
+    "test_fluctuation_dissipation_angular_displacements"
+
+    # Extremely long
+    "test_fluctuation_dissipation_linear_displacements"
+  ];
+
+  # Tests require GPU access
+  doCheck = false;
+  passthru.gpuCheck = libmobility.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Python interface to a collection of GPU hydrodynamic mobility solvers";
+    homepage = "https://github.com/stochasticHydroTools/libMobility";
+    changelog = "https://github.com/stochasticHydroTools/libMobility/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+    broken = !config.cudaSupport;
+  };
+})
@@ -25,8 +25,6 @@ buildPythonPackage (finalAttrs: {

  build-system = [ setuptools ];

-  pythonRelaxDeps = [ "rns" ];
-
  buildInputs = lib.optionals (!propagateRns) [
    rns
  ];
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  aioresponses,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-duco-connectivity";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ronaldvdmeer";
+    repo = "python-duco-connectivity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AH8EhC0v8GDNvPSUaTownV9d4upvKRiO//2sipGHz9g=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "duco_connectivity" ];
+
+  meta = {
+    description = "Async HTTP client for the local Duco Connectivity API";
+    homepage = "https://github.com/ronaldvdmeer/python-duco-connectivity";
+    changelog = "https://github.com/ronaldvdmeer/python-duco-connectivity/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
@@ -4,7 +4,7 @@
  buildPythonPackage,
  cryptography,
  esptool,
-  fetchFromGitHub,
+  fetchPypi,
  netifaces,
  pyserial,
  replaceVars,
@@ -14,15 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "rns";
-  version = "1.3.4";
+  version = "1.3.5";
  pyproject = true;
  __structuredAttrs = true;

-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "Reticulum";
-    tag = finalAttrs.version;
-    hash = "sha256-rhZfkSV2OtCVPbUyTrYry2lwIeSfz3JnX+mVTkZt+Rc=";
+  src = fetchPypi {
+    pname = "rns";
+    version = finalAttrs.version;
+    hash = "sha256-YxReocD6Ump5FMCnLEqCJ5tZcZh1kYsFWNBJ0pGYzuM=";
  };

  patches = [
@@ -49,7 +48,7 @@ buildPythonPackage (finalAttrs: {
  meta = {
    description = "Cryptography-based networking stack for wide-area networks";
    homepage = "https://reticulum.network";
-    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.src.tag}/Changelog.md";
+    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.version}/Changelog.md";
    # Reticulum License
    # https://github.com/markqvist/Reticulum/blob/master/LICENSE
    license = lib.licenses.unfree;
@@ -80,7 +80,7 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
  pname = "transformer-engine";
-  version = "2.15";
+  version = "2.16";
  pyproject = true;
  __structuredAttrs = true;

@@ -90,7 +90,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
    tag = "v${finalAttrs.version}";
    # Their CMakeLists.txt does not easily let us inject dependencies
    fetchSubmodules = true;
-    hash = "sha256-0a6etDttNoTL1pe2OZb1CcS0/AtozeAG8NFz2Hkppn8=";
+    hash = "sha256-PUs/qIdF894232GmdjLsDD2rzU5NPTt/u20v93yZTog=";
  };

  patches = optionals cudaSupport [
@@ -1,16 +1,11 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitLab,
  makeWrapper,
-  cmake,
-  six,
-  pyparsing,
-  asn1ate,
-  colored,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "asn2quickder";
  version = "1.7.1";
  format = "setuptools";
@@ -33,10 +28,10 @@ buildPythonApplication rec {

  nativeBuildInputs = [
    makeWrapper
-    cmake
+    python3Packages.cmake
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    pyparsing
    asn1ate
    six
@@ -1,25 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchPypi,
-
-  certifi,
-  charset-normalizer,
-  enochecker-core,
-  exceptiongroup,
-  idna,
-  iniconfig,
-  jsons,
-  packaging,
-  pluggy,
-  pytest,
-  requests,
-  tomli,
-  typish,
-  urllib3,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "enochecker-test";
  version = "0.9.0";
  format = "setuptools";
@@ -35,7 +20,7 @@ buildPythonApplication rec {

  pythonRelaxDeps = true;

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    certifi
    charset-normalizer
    enochecker-core
@@ -1,23 +1,18 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
  clang-tools,
-  cmake,
  colordiff,
  flex,
  libclang,
  llvm,
  unifdef,
-  chardet,
-  pebble,
-  psutil,
-  pytestCheckHook,
  testers,
  cvise,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "cvise";
  version = "2.12.0";
  pyproject = false;
@@ -46,7 +41,7 @@ buildPythonApplication rec {
  '';

  nativeBuildInputs = [
-    cmake
+    python3Packages.cmake # TODO: swap this out for the non-python cmake
    flex
    llvm.dev
  ];
@@ -58,14 +53,14 @@ buildPythonApplication rec {
    unifdef
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    chardet
    pebble
    psutil
  ];

  nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
    unifdef
  ];

@@ -1,23 +1,19 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchPypi,
  gdb,
-  eventlet,
-  flask-compress,
-  flask-socketio,
-  pygdbmi,
-  pygments,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "gdbgui";

  version = "0.15.3.0";
  format = "setuptools";

  buildInputs = [ gdb ];
-  propagatedBuildInputs = [
+
+  propagatedBuildInputs = with python3Packages; [
    eventlet
    flask-compress
    flask-socketio
@@ -1,22 +1,11 @@
 {
  lib,
-  buildPythonApplication,
-  fetchPypi,
  stdenv,
-  click,
-  coloredlogs,
-  mido,
-  psutil,
-  pycyphal,
-  pysdl2,
-  python-rtmidi,
-  ruamel-yaml,
-  requests,
-  scipy,
-  simplejson,
+  python3Packages,
+  fetchPypi,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "yakut";
  version = "0.14.2";
  format = "setuptools";
@@ -29,7 +18,8 @@ buildPythonApplication rec {
  buildInputs = [
    (lib.getLib stdenv.cc.cc)
  ];
-  dependencies = [
+
+  dependencies = with python3Packages; [
    click
    coloredlogs
    psutil
@@ -39,7 +29,8 @@ buildPythonApplication rec {
    scipy
    simplejson
  ];
-  optional-dependencies.joystick = [
+
+  optional-dependencies.joystick = with python3Packages; [
    pysdl2
    mido
    python-rtmidi
@@ -1,10 +1,9 @@
 {
  lib,
+  python3Packages,
  fetchFromGitHub,
  fetchpatch,
-  buildPythonApplication,
  appstream-glib,
-  dbus-python,
  desktop-file-utils,
  gettext,
  glib,
@@ -14,14 +13,11 @@
  libappindicator,
  libhandy,
  meson,
-  ninja,
  pkg-config,
-  pygobject3,
-  pyxdg,
  wrapGAppsHook3,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "cpupower-gui";
  version = "1.0.0";

@@ -57,15 +53,13 @@ buildPythonApplication rec {
    gobject-introspection # need for gtk namespace to be available
    hicolor-icon-theme # needed for postinstall script
    meson
-    ninja
+    python3Packages.ninja # TODO: maybe swap out for the non-python package
    pkg-config
    wrapGAppsHook3
-
-    # Python packages
-    dbus-python
+    python3Packages.dbus-python
    libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
  ];

  buildInputs = [
@@ -75,10 +69,10 @@ buildPythonApplication rec {
  ];

  propagatedBuildInputs = [
-    dbus-python
+    python3Packages.dbus-python
    libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
  ];

  mesonFlags = [
@@ -1496,7 +1496,8 @@
      ];
    "duco" =
      ps: with ps; [
-      ]; # missing inputs: python-duco-connectivity
+        python-duco-connectivity
+      ];
    "dunehd" =
      ps: with ps; [
        pdunehd
@@ -7927,6 +7928,7 @@
    "dsmr"
    "dsmr_reader"
    "duckdns"
+    "duco"
    "dunehd"
    "duotecno"
    "dwd_weather_warnings"
@@ -1,8 +1,7 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  pkgconfig,
  wrapGAppsHook3,
  gettext,
  gtk3,
@@ -10,12 +9,6 @@
  dbus,
  gobject-introspection,
  xmodmap,
-  pygobject3,
-  setuptools,
-  evdev,
-  pydantic,
-  pydbus,
-  psutil,
  procps,
  gtksourceview4,
  bash,
@@ -37,7 +30,7 @@
 let
  maybeXmodmap = lib.optional withXmodmap xmodmap;
 in
-(buildPythonApplication rec {
+(python3Packages.buildPythonApplication rec {
  pname = "input-remapper";
  version = "2.2.0";
  format = "setuptools";
@@ -66,11 +59,11 @@ in
    gtk3
    glib
    gobject-introspection
-    pygobject3
+    python3Packages.pygobject3
  ]
  ++ maybeXmodmap;

-  dependencies = [
+  dependencies = with python3Packages; [
    setuptools # needs pkg_resources
    pygobject3
    evdev
@@ -86,7 +79,7 @@ in
    udevCheckHook
    versionCheckHook
  ]
-  ++ lib.optionals withDoCheck [ psutil ];
+  ++ lib.optionals withDoCheck [ python3Packages.psutil ];

  versionCheckProgram = "${placeholder "out"}/bin/input-remapper-control";

@@ -1,21 +1,10 @@
 {
  lib,
-  buildPythonApplication,
-  appdirs,
-  beautifulsoup4,
-  colorlog,
+  python3Packages,
  fetchFromGitHub,
-  mako,
-  online-judge-api-client,
-  online-judge-tools,
-  ply,
-  pyyaml,
-  requests,
-  setuptools,
-  toml,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "online-judge-template-generator";
  version = "4.8.1";
  format = "setuptools";
@@ -27,7 +16,7 @@ buildPythonApplication rec {
    sha256 = "sha256-cS1ED1a92fEFqy6ht8UFjxocWIm35IA/VuaPSLsdlqg=";
  };

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    appdirs
    beautifulsoup4
    colorlog
--- a/Show More
+++ b/Show More