Merge 173eb8c1fb into haskell-updates

.github/actions/checkout/action.yml

@@ -103,14 +103,14 @@ runs:
             await run('sudo', 'mount', '-t', 'tmpfs', 'tmpfs', 'nixpkgs')
           }
 
-          // Create all worktrees in parallel.
-          await Promise.all(
-            commits.map(async ({ sha, path }) => {
-              await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
-              await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
-              await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
-            })
-          )
+          // Git worktree setup can race when multiple worktrees are created and
+          // initialized at the same time against one repository. See #511286.
+          // Keep the setup sequential so shared repo config updates cannot contend.
+          for (const { sha, path } of commits) {
+            await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
+            await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
+            await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
+          }
 
           // Apply pin bump to untrusted worktree
           if (pin_bump_sha) {

ci/default.nix

@@ -184,9 +184,10 @@ rec {
     nix = pkgs.nixVersions.latest;
   };
   parse = pkgs.lib.recurseIntoAttrs {
-    latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
+    nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
     nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
+    lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
+    lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
   };
   shell = import ../shell.nix { inherit nixpkgs system; };
   tarball = import ../pkgs/top-level/make-tarball.nix {

ci/parse.nix

@@ -28,7 +28,14 @@ runCommand "nix-parse-${nix.name}"
     # the other CI jobs will report in more detail. This job is about checking parsing
     # across different implementations / versions, not about providing the best DX.
     # Returning all parse errors requires significantly more resources.
-    find . -type f -iname '*.nix' | xargs -P $(nproc) nix-instantiate --parse >/dev/null
+
+    find . -type f -iname '*.nix' | xargs -P $(nproc) nix-instantiate --parse 2>&1 >/dev/null | {
+      # Also fail on (deprecation) warnings printed to stderr.
+      if grep "warning"; then
+        echo "Failing due to warnings in stderr" >&2
+        exit 1
+      fi
+    }
 
     touch $out
   ''

doc/languages-frameworks/rust.section.md

@@ -736,6 +736,35 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+### Compiling `wasm32-wasip1` package {#compiling-wasm32-wasip1-package}
+
+```nix
+pkgsCross.wasi32.callPackage (
+  {
+    fetchFromGitHub,
+    rustPlatform,
+    lld,
+  }:
+  rustPlatform.buildRustPackage (finalAttrs: {
+    pname = "zellij-harpoon";
+    version = "0.3.0";
+
+    src = fetchFromGitHub {
+      owner = "Nacho114";
+      repo = "harpoon";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-JmYcbzxIF6qZs2/RKuspHqNpyDibGp9CVQJj47y/BOQ=";
+    };
+
+    cargoHash = "sha256-lsv5Wssakni18jif++fPo3Z5WyBtvPsGpWwG3abR7jQ=";
+
+    # these two lines are currently required
+    env.RUSTFLAGS = "-C linker=wasm-ld";
+    nativeBuildInputs = [ lld ];
+  })
+) { }
+```
+
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}

doc/redirects.json

@@ -20,6 +20,9 @@
   "cmake-ctest-variables": [
     "index.html#cmake-ctest-variables"
   ],
+  "compiling-wasm32-wasip1-package": [
+    "index.html#compiling-wasm32-wasip1-package"
+  ],
   "coq-withPackages": [
     "index.html#coq-withPackages"
   ],

doc/release-notes/rl-2605.section.md

@@ -109,6 +109,8 @@
 
 - `nodePackages.browserify` has been removed, as it was unmaintained within nixpkgs.
 
+- `command-not-found` package will be enabled by default if the source of nixpkgs contains the file `programs.sqlite`. This is the case if a nixpkgs tarball from https://channels.nixos.org is used. This usage will also make the database of `command-no-found` stateless.
+
 - `nodePackages.sass` has been removed, as it was unmaintained within nixpkgs.
 
 - All `@tailwindcss` packages in the `nodePackages` set have been removed, as they are libraries that should instead be locked by JS projects that utilize them.
@@ -174,6 +176,8 @@
 
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
 
+- `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`.
+
 - The `man-pages` package's outputs have been split. The manual pages are installed into the `man` output, which is installed by default. Binaries (including `diffman-git`, `mansect`, `pdfman`, and `sortman`) are installed into the `out` output, which is not installed by default.
 
 - All Log4Shell vulnerability scanners were removed, as they were all unmaintained upstream and are no longer relevant given that the vulnerability has been fixed upstream for several years.

lib/licenses/licenses.nix

@@ -1495,6 +1495,11 @@ lib.mapAttrs mkLicense (
       fullName = "Unicode Terms of Use";
     };
 
+    universalFOSSException-10 = {
+      spdxId = "Universal-FOSS-exception-1.0";
+      fullName = "Universal FOSS Exception, Version 1.0";
+    };
+
     unlicense = {
       spdxId = "Unlicense";
       fullName = "The Unlicense";

lib/options.nix

@@ -590,7 +590,16 @@ rec {
           );
         }
         //
-          optionalAttrs (opt ? defaultText || opt ? default || ((opt.type or { }).emptyValue or { }) ? value)
+          optionalAttrs
+            (
+              opt ? defaultText
+              || opt ? default
+              # Render emptyValue-based defaults, but only for types without
+              # submodules (e.g. types.submodule). Submodules may evaluate to
+              # error without user defs, and their sub-options are documented
+              # individually, so best to skip those here.
+              || ((opt.type or { }).emptyValue or { }) ? value && (opt.type or { }).getSubModules or null == null
+            )
             {
               default =
                 builtins.addErrorContext

lib/tests/modules.sh

@@ -686,6 +686,8 @@ checkConfigOutput "\[\]" config.unique ./defaults.nix
 checkConfigOutput "\[\]" config.coercedTo ./defaults.nix
 # These types don't have empty values
 checkConfigError 'The option .int. was accessed but has no value defined. Try setting the option.' config.int ./defaults.nix
+## submodule emptyValue must evaluate sub-option defaults
+checkConfigOutput "ok" config.result ./defaults.nix
 
 # types.unique
 #   requires a single definition

lib/tests/modules/defaults.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, config, ... }:
 let
   inherit (lib) types;
 in
@@ -19,6 +19,18 @@ in
     submodule = lib.mkOption {
       type = types.submodule { };
     };
+    submoduleWithDefaults = lib.mkOption {
+      type = types.submodule {
+        options.enabled = lib.mkOption {
+          type = types.bool;
+          default = true;
+        };
+        options.count = lib.mkOption {
+          type = types.int;
+          default = 13;
+        };
+      };
+    };
     unique = lib.mkOption {
       type = types.unique { message = "hi"; } (types.listOf types.int);
     };
@@ -29,5 +41,16 @@ in
     int = lib.mkOption {
       type = types.int;
     };
+
+    result = lib.mkOption {
+      type = types.str;
+      default =
+        assert
+          config.submoduleWithDefaults == {
+            enabled = true;
+            count = 13;
+          };
+        "ok";
+    };
   };
 }

lib/types.nix

@@ -1320,7 +1320,7 @@ rec {
           };
       };
       emptyValue = {
-        value = { };
+        value = base.config;
       };
       getSubOptions =
         prefix:

maintainers/maintainer-list.nix

@@ -29380,6 +29380,12 @@
     githubId = 78392041;
     name = "Winter";
   };
+  winterec = {
+    github = "winterec";
+    githubId = 9159652;
+    name = "Edward";
+    keys = [ { fingerprint = "0BC2F3C6AE5D73DAE870CB0E8AE4DE0EFB6CC443"; } ];
+  };
   wirew0rm = {
     email = "alex@wirew0rm.de";
     github = "wirew0rm";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -303,6 +303,9 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   - SQLite paths are now relative to `service.rootpath` unless absolute. Startup now validates file
     storage and OAuth providers.
 
+- `xfsprogs` was updated to version 6.18.0, which enables parent pointers and exchange-range by default. Upstream recommends not to use these features with kernels older than 6.18.
+   GRUB2 is likely unable to boot from filesystems with these features enabled.
+
 - `lunarvim` package has been removed, as it was abandoned upstream and relied on an old version of `neovim` to work properly.
 
 - `opengfw` package and `services.opengfw` module have been removed as the upstream GitHub repository and website have been shut down.

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -38,8 +38,6 @@ in
         Whether interactive shells should show which Nix package (if
         any) provides a missing command.
 
-        Requires nix-channels to be set and downloaded (sudo nix-channel --update.)
-
         See also nix-index and nix-index-database as an alternative for flakes-based systems.
 
         Additionally, having the env var NIX_AUTO_RUN set will automatically run the matching package, and with NIX_AUTO_RUN_INTERACTIVE it will confirm the package before running.
@@ -47,38 +45,48 @@ in
     };
 
     dbPath = lib.mkOption {
-      default = "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite";
       description = ''
-        Absolute path to programs.sqlite.
+        Absolute path to `programs.sqlite`, which contains mappings from binary names to package names.
 
-        By default this file will be provided by your channel
-        (nixexprs.tar.xz).
+        If a nixpkgs tarball from https://channels.nixos.org is used as the source of nixpkgs, this file will be provided and this option be set by default.
+
+        To use the stateful `programs.sqlite` database, set this option to
+        `/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite`.
+        If you do so, you can update it with `sudo nix-channels --update`.
       '';
       type = lib.types.path;
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    programs.bash.interactiveShellInit = ''
-      command_not_found_handle() {
-        '${commandNotFound}/bin/command-not-found' "$@"
-      }
-    '';
+  config = lib.mkMerge [
+    {
+      programs.command-not-found = {
+        enable = lib.mkOptionDefault (builtins.pathExists cfg.dbPath);
+        dbPath = pkgs.path + "/programs.sqlite";
+      };
+    }
 
-    programs.zsh.interactiveShellInit = ''
-      command_not_found_handler() {
-        '${commandNotFound}/bin/command-not-found' "$@"
-      }
-    '';
+    (lib.mkIf cfg.enable {
+      programs.bash.interactiveShellInit = ''
+        command_not_found_handle() {
+          '${commandNotFound}/bin/command-not-found' "$@"
+        }
+      '';
 
-    # NOTE: Fish by itself checks for nixos command-not-found, let's instead makes it explicit.
-    programs.fish.interactiveShellInit = ''
-      function fish_command_not_found
-         "${commandNotFound}/bin/command-not-found" $argv
-      end
-    '';
+      programs.zsh.interactiveShellInit = ''
+        command_not_found_handler() {
+          '${commandNotFound}/bin/command-not-found' "$@"
+        }
+      '';
 
-    environment.systemPackages = [ commandNotFound ];
-  };
+      # NOTE: Fish by itself checks for nixos command-not-found, let's instead makes it explicit.
+      programs.fish.interactiveShellInit = ''
+        function fish_command_not_found
+           "${commandNotFound}/bin/command-not-found" $argv
+        end
+      '';
 
+      environment.systemPackages = [ commandNotFound ];
+    })
+  ];
 }

nixos/modules/services/display-managers/sddm.nix

@@ -584,6 +584,10 @@ in
           "plymouth-quit.service"
           "systemd-logind.service"
         ];
+        # sddm stores state in this directory, which should be mounted.
+        unitConfig.RequiresMountsFor = [
+          config.users.users.sddm.home
+        ];
       };
     };
   };

nixos/modules/services/hardware/buffyboard.nix

@@ -10,8 +10,8 @@
 # Desktop users are recommended to either:
 # 1. Stop buffyboard once your DE is started.
 #   e.g. `services.buffyboard.unitConfig.Conflicts = [ "my-de.service" ];`
-# 2. Configure your DE to ignore input events from buffyboard (product-id=25209; vendor-id=26214; name=rd)
-#   e.g. `echo 'input "26214:25209:rd" events disabled' > ~/.config/sway/config`
+# 2. Configure your DE to ignore input events from buffyboard (product-id=0; vendor-id=0; name=buffyboard)
+#   e.g. `echo 'input "0:0:buffyboard" events disabled' > ~/.config/sway/config`
 
 {
   config,
@@ -68,6 +68,24 @@ in
         type = types.submodule {
           freeformType = ini.type;
 
+          options.keyboard.haptic_feedback = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Enable or disable vibrations when pressing keys.
+            '';
+          };
+
+          options.keyboard.sticky_shift = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Changes shift key behavior. When true, the keyboard remains in uppercase mode until
+              the shift key is pressed again (sticky). When false, the keyboard switches back to
+              lowercase mode and the shift key deactivates after a non-modifier key is pressed.
+            '';
+          };
+
           options.input.pointer = mkOption {
             type = types.nullOr types.bool;
             default = null;

nixos/tests/installer.nix

@@ -1323,7 +1323,7 @@ in
   };
 
   # Create two physical LVM partitions combined into one volume group
-  # that contains the logical swap and root partitions.
+  # that contains the logical swap, boot and root partitions.
   lvm = makeInstallerTest "lvm" {
     createPartitions = ''
       installer.succeed(
@@ -1336,11 +1336,15 @@ in
           "pvcreate /dev/vda1 /dev/vda2",
           "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
           "lvcreate --size 1G --name swap MyVolGroup",
-          "lvcreate --size 6G --name nixos MyVolGroup",
+          "lvcreate --size 1G --name boot MyVolGroup",
+          "lvcreate --size 5G --name nixos MyVolGroup",
           "mkswap -f /dev/MyVolGroup/swap -L swap",
           "swapon -L swap",
+          "mkfs.ext4 -L boot /dev/MyVolGroup/boot",
           "mkfs.xfs -L nixos /dev/MyVolGroup/nixos",
           "mount LABEL=nixos /mnt",
+          "mkdir /mnt/boot",
+          "mount LABEL=boot /mnt/boot",
       )
     '';
     extraConfig = optionalString systemdStage1 ''

nixos/tests/mysql/common.nix

@@ -7,7 +7,7 @@
     inherit (pkgs) mysql84;
   };
   perconaPackages = {
-    inherit (pkgs) percona-server_8_0 percona-server_8_4;
+    inherit (pkgs) percona-server_8_4;
   };
   mkTestName =
     pkg: "mariadb_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";

pkgs/applications/editors/neovim/tests/default.nix

@@ -91,7 +91,6 @@ let
     neovim-drv: buildCommand:
     runCommandLocal "test-${neovim-drv.name}"
       {
-        nativeBuildInputs = [ ];
         meta.platforms = neovim-drv.meta.platforms;
       }
       (

pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-wakatime";
     publisher = "WakaTime";
-    version = "30.0.5";
-    hash = "sha256-8K8EgdHOGL3sYW5j8hpfbZFifbInMNWEYe60F1UGsj4=";
+    version = "30.0.8";
+    hash = "sha256-IRpjwlLzof2Ll2s/k9K6LPFYp4NTvpfZWfMbMMk+rbY=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1260,8 +1260,8 @@ let
         mktplcRef = {
           name = "languagetool-linter";
           publisher = "davidlday";
-          version = "0.25.5";
-          hash = "sha256-/ZSxaxiv76aJ+KmDlR5h8PrkEo0pPMvb9C3KGdKCNK8=";
+          version = "0.25.7";
+          hash = "sha256-XLW49YkgDuojNEzqWRztK8mKWKbVU5OeGOjHl0heH/w=";
         };
         meta = {
           description = "LanguageTool integration for VS Code";
@@ -1744,8 +1744,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.144";
-          hash = "sha256-gKs0DNloispkKb7F6V38W5LoPk4OFPayv7MX9bQLJ2k=";
+          version = "0.4.147";
+          hash = "sha256-gMlGU6XSvWEufaaszFJ7VmPM9q5oI5K/hFzIwQGTSCE=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.35.0";
-          hash = "sha256-5tjSXwjiNMC8NlGAa0NQ5uWw+wTEPePL1GgRhnBAtUo=";
+          version = "0.38.0";
+          hash = "sha256-SJozi2AlV+wHD0wuhpgkG6Ve5AGIhsVDC37eE8/bnKM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -1998,8 +1998,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.72.0";
-          hash = "sha256-QqoGCxGJ0l69Q6P+L/AsEIN99xP9ReYzRC2AJVpk/gU=";
+          version = "6.74.3";
+          hash = "sha256-2G/dyedhmjN8630yMccY58ZtNwPPtBB8HFFkZ0dLYDA=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2486,8 +2486,8 @@ let
         mktplcRef = {
           name = "gruvbox";
           publisher = "jdinhlife";
-          version = "1.29.0";
-          hash = "sha256-LDbeCwuUxvyuacuvikZbV25iEtXWPRJ/ihnqpuM8Ky4=";
+          version = "1.29.1";
+          hash = "sha256-FGZx/R3hLgYlC2BdQkcJ+puQtgNYm2iPbJJJmjEzLS0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jdinhlife.gruvbox/changelog";
@@ -2648,8 +2648,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.189.2";
-          hash = "sha256-ydnE34xD2u5cwPOJezXtSbC/JXrGz4j1QL26YaWjfoU=";
+          version = "1.209.2";
+          hash = "sha256-uS0KYSqJJ1IXEcDy1Y3Fl0GHpEpq6eskgBCoBZqYuUo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -3877,8 +3877,8 @@ let
         mktplcRef = {
           publisher = "redhat";
           name = "java";
-          version = "1.53.0";
-          hash = "sha256-4gMFV6uMpExqZgWwcPYLxOnHJBQtT02LY3VqfzRLoaQ=";
+          version = "1.54.0";
+          hash = "sha256-G1L8fSRXj4rmyGFyvPuz7zoQ367Lc5PoyVOZnHPHcu0=";
         };
         buildInputs = [ jdk ];
         meta = {
@@ -4218,8 +4218,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.22";
-          hash = "sha256-3yABYp50iyk6nJO6xXmyhWLgMtA+fuqiEq6uFOJhWdU=";
+          version = "0.8.24";
+          hash = "sha256-SKDg0AVzlDFPq3ZHE65vX6OUPWeZGTJb5DaVs/y14UY=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
@@ -5076,8 +5076,8 @@ let
         mktplcRef = {
           name = "vscode-gradle";
           publisher = "vscjava";
-          version = "3.17.2";
-          hash = "sha256-oBtUDkuGMu7/CvxiHxvbiHHTQ2dG85VY08es9u3xKJk=";
+          version = "3.17.3";
+          hash = "sha256-heFcGOe10r7y23xyFc/nFKk/nsrX4wc5fT9e4GKGhW0=";
         };
 
         meta = {

pkgs/applications/editors/vscode/extensions/oracle.oracle-java/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "oracle-java";
     publisher = "oracle";
-    version = "25.0.1";
-    hash = "sha256-6l1StFyGixGCvOfpq4iyHkoGQb1UZGlB4j0IQxAuXl8=";
+    version = "25.1.0";
+    hash = "sha256-HjDSlvG6khFJA/3ukjVCrPqbQiAKVhgP6KcCfC/jUrc=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-04-03";
+  version = "0-unstable-2026-04-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "15f6b56912df40593261b369d8c7f45911c9e11d";
-    hash = "sha256-w74AV9OLEht3nMDfT9OuDN3jEpfxGsKHLyJ14lhwEZc=";
+    rev = "906b6465f1d4da2d04d8735b0d24ca0af0533590";
+    hash = "sha256-xg+irszrpUu689MyP2iJDl9a/YHR4RRqLJmRdu6/4Nw=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/desmume.nix

@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume";
-    rev = "7f05a8d447b00acd9e0798aee97b4f72eb505ef9";
-    hash = "sha256-BttWMunVbfPOTGx+DV+3QyOwW+55tgXKVIn99DZhbBI=";
+    rev = "a4db60dc63f36134ffebfe524b56e87a0b05f20f";
+    hash = "sha256-v9jppfo85wR4KrblE9HtI/psQiQafn4OIXmDofxqOfc=";
   };
 
   extraBuildInputs = [

pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-04-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "13f09ce0e3eb375e02879c51926d2b7c54e5f86b";
-    hash = "sha256-WjdliWglIYGI1X9jGq5LqCBLijlR56TOwiVmJjCTi8M=";
+    rev = "00512d47f9d4d220efa4f2418b4a5896f9cd2e75";
+    hash = "sha256-ERllT1RkoLMafnHx2HSHdURoWdnF8fJlZ80pfiw18gQ=";
   };
 
   dontConfigure = true;

pkgs/applications/emulators/libretro/cores/snes9x.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2026-04-07";
+  version = "0-unstable-2026-04-14";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "cc2b4e185a66778af6a062d0d5502e3ad92171c1";
-    hash = "sha256-OZGvThUfKH5Zt71khrIqR1+wB2tup5Iq6eRAOQcMB8M=";
+    rev = "121bb374d0d9a5ba2dd73c7b14a58c95c236a9bf";
+    hash = "sha256-8/Xe8T2+FP/l07AsW19arreXvygZhwTvIBypyvRBfnk=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/stella.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-04-19";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "7d9148f97c9f4ba8903ba3e19cbfb418c779bbb5";
-    hash = "sha256-l1PdtMtYmnYzUyEoAuZ2Wh9g85kUFHTfq6iBJOZ5Cfc=";
+    rev = "8b7bc991d2500cbf2e861c25f96ff81e0d13f273";
+    hash = "sha256-jeu/7hHuPfSoJg2/6UxUqHWOGMSe0vX6cgWLmVYHABQ=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -155,7 +155,7 @@ stdenv.mkDerivation {
   };
 
   meta = {
-    changelog = "https://www.mozilla.org/en-US/firefox/${version}/releasenotes/";
+    changelog = "https://www.firefox.com/en-US/firefox/${version}/releasenotes/";
     description = "Mozilla Firefox, free web browser (binary package)";
     homepage = "https://www.mozilla.org/firefox/";
     license = {

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -9,15 +9,15 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.9.1esr";
+  version = "140.10.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "119a4e4e536fd4534adcc4a546a988e553285f9326bf16e9771854ec2dc7d039a729aedc5925623e172260a5e154172c56a011f131068736eb2a89a8de611840";
+    sha512 = "56b274df21d0a908e826af6dda89a42b77fb0f597b75542b0330d448ae22be07a3636a3187ff1b488e466cc8c5264a8a75f79901354a49e35a3e99dcb0852514";
   };
 
   meta = {
-    changelog = "https://www.mozilla.org/en-US/firefox/${lib.removeSuffix "esr" version}/releasenotes/";
+    changelog = "https://www.firefox.com/en-US/firefox/${lib.removeSuffix "esr" version}/releasenotes/";
     description = "Web browser built from Firefox source tree";
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [ hexa ];

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,14 +9,14 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "149.0.2";
+  version = "150.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "844a46ee068ecdc66b7227d089a057ad3f4945114fea2cb280d5e2a383d0a022fc6628ad57c068ea34cf159472f63c50ea7ed128bc11a0b27f16bb7b67d7f3cf";
+    sha512 = "77e8eae86e7b17c33933fdea6d3b5fbe73e6613949e62c13d9ed3e593e7ba0b50701fa97fc7d56a278961d2e1cdb2902244c30a1020790091b0ae2f0cb1b4e71";
   };
 
   meta = {
-    changelog = "https://www.mozilla.org/en-US/firefox/${version}/releasenotes/";
+    changelog = "https://www.firefox.com/en-US/firefox/${version}/releasenotes/";
     description = "Web browser built from Firefox source tree";
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [

pkgs/applications/networking/cluster/calico/default.nix

@@ -14,16 +14,16 @@ builtins.mapAttrs
     }:
     buildGoModule rec {
       inherit pname;
-      version = "3.31.3";
+      version = "3.31.5";
 
       src = fetchFromGitHub {
         owner = "projectcalico";
         repo = "calico";
         rev = "v${version}";
-        hash = "sha256-w+dStKYbytNekl3HxBAek8kS+FC5Aeu7OEU4SIFLURY=";
+        hash = "sha256-HdTnERSuqJ2ORijvI8AbzLGTwXaRl349p9onKgH4HE8=";
       };
 
-      vendorHash = "sha256-J9X7W7UozsxNlXQwXYeDi++KkyjxwtnYvs4EkUq4Vec=";
+      vendorHash = "sha256-LwOEshx4VU+a0oBlq/881RC/ViQVDnZZlZs/U3BMJ7M=";
 
       inherit doCheck subPackages;
 

pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.5";
+  version = "3.15.6";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-ti247vkYPW6PH0DNkgdH99MyUy2uc2n+zHgpNET/cgU=";
+    hash = "sha256-DGJtvCQ3WGY/Aajrpn/QUQebjb0K9otyRtqCZa4iqMY=";
   };
 
-  vendorHash = "sha256-b479InQ1ZoOtRgY1cyKeDDoGrOIg0aPqNfDrrY1E4tQ=";
+  vendorHash = "sha256-psfNtI5rf5B/dQKPjPPwuG14Z/hsJWmuL5JiLuux6ng=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "helm-dt";
-  version = "0.4.12";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
     tag = "v${version}";
-    hash = "sha256-/fU56Dw7tvUnby4S78tyH/dasg4n3rb0hMlIkzvrv4M=";
+    hash = "sha256-WBrRVlYruokNKW0fSRd/YESH5Vw+hKFa76R/2ABphr8=";
   };
 
   vendorHash = "sha256-dkE3eYZnaS+kC0kDVxaFW/Ev15TY2MY3m5xgPof7Y18=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -526,11 +526,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-22ZxBz5ZKJzgG/HMv6kce5NosPtmYPk46R7pu3Ss4OA=",
+    "hash": "sha256-dLapX7pWRKR90D19e7DZZki+VTgKLP2n9ADww2CIQg8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.68.0",
+    "rev": "v4.69.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -724,13 +724,13 @@
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-0zJuYzNU4Q6RSzl6qNglRiJ4fcj9QA3wF/9UPBRx49c=",
+    "hash": "sha256-FeH8XVy+xTal2bbylEfvVqqqoURvuNKNzcK1fv+Ng50=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v2.0.0",
+    "rev": "v2.0.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0J10Nz6o12NuUJBkluiHWb8BElfuuz1wEKEQUb6epo0="
+    "vendorHash": "sha256-HDZiRZoq3/2E8aK/whBBeLVPcWYXYZqTNPa4DvNG2aQ="
   },
   "icinga_icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",

pkgs/build-support/rust/hooks/default.nix

@@ -75,7 +75,6 @@
 
   cargoSetupHook = makeSetupHook {
     name = "cargo-setup-hook.sh";
-    propagatedBuildInputs = [ ];
     substitutions = {
       defaultConfig = ../fetchcargo-default-config.toml;
 

pkgs/by-name/_1/_1password-cli/package.nix

@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.33.1";
+  version = "2.34.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-rBXJ5BT/1TFySOgC1wpgOz4tcOF9flHplfonYGOA9Ac=" "zip";
-    i686-linux = fetch "linux_386" "sha256-2Hh+ML+hewwZATrh01kPXoNBdYWN3dI2ZqfLBiH/gK8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-ge+4thdTnymQYFQ2G9qwh9i3zsY13W1M5za1CXybUqI=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-LuOI9r1VRnL9IGsK4vy4ENOS64xdpIZ+ZskIkUJ0s34=" "zip";
+    i686-linux = fetch "linux_386" "sha256-VvqEyDHEIY3BsgubiJKXql1WEnwXHkSHpFvCcKBIeYw=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-sbydXPoT0Vo3r2gyZBdl4OMtOejbhvra5JM4wB6Ex5s=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-+3NI4BIazI21m6teLBvKalCTN8cx6RhFqwXnkNK6tjQ="
+      fetch "apple_universal" "sha256-9h+Z7INYcJcWeVQ9QnXKjtT5QyV2J+dP857qSOpBAy8="
         "pkg";
     x86_64-darwin = aarch64-darwin;
   };

pkgs/by-name/ac/actual-server/package.nix

@@ -4,9 +4,10 @@
   cctools,
   fetchFromGitHub,
   jq,
-  makeWrapper,
+  makeBinaryWrapper,
   nodejs_22,
   python3,
+  xcbuild,
   yarn-berry_4,
   nixosTests,
 }:
@@ -44,10 +45,11 @@ stdenv.mkDerivation (finalAttrs: {
     nodejs
     (yarn-berry.yarnBerryConfigHook.override { inherit nodejs; })
     (python3.withPackages (ps: [ ps.setuptools ])) # Used by node-gyp
-    makeWrapper
+    makeBinaryWrapper
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     cctools
+    xcbuild
   ];
 
   env = {
@@ -121,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
     rm -r node_modules/.bin
     cp -r ./node_modules $out/lib/actual/
 
-    makeWrapper ${lib.getExe nodejs} "$out/bin/actual-server" \
+    makeBinaryWrapper ${lib.getExe nodejs} "$out/bin/actual-server" \
       --add-flags "$out/lib/actual/packages/sync-server/bin/actual-server.js" \
       --set NODE_PATH "$out/actual/lib/node_modules"
 
@@ -141,6 +143,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://actualbudget.org/";
     mainProgram = "actual-server";
     license = lib.licenses.mit;
+    platforms = with lib.platforms; linux ++ darwin;
     maintainers = [
       lib.maintainers.oddlama
       lib.maintainers.patrickdag

pkgs/by-name/ai/airwindows/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2026-04-04";
+  version = "0-unstable-2026-04-11";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "714ffb2db6f799067e63bf1f88ae8a89f4ee0d3c";
-    hash = "sha256-Ed8U0AC+9ggsPS+fWfm7yBdnygjhHIdUtJlML2J4zKY=";
+    rev = "7f9131b826e12b2dabe8a06c7cc4b002b9952be1";
+    hash = "sha256-Rt4Q/fxh181bPFAhD3WgEVbq0ClQfhGjJoHa99lgguw=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

pkgs/by-name/al/alioth/package.nix

@@ -6,19 +6,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alioth";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "alioth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VkyR9NOxv5PVuW172Sw2ign6sApDnKTnH2BBlVl6GFk=";
+    hash = "sha256-Ny/YrXHo4qP8NDiRNtXv843RjJKzKFuSH20ZoGp3ODQ=";
   };
 
   # Checks use `debug_assert_eq!`
   checkType = "debug";
 
-  cargoHash = "sha256-NUbu2AL5gD7OOskNGO0pitJaTlgCYxAr6GYyv8nuytI=";
+  cargoHash = "sha256-eWozwXaVtR/3k7w7+tPzK1xlt9/DtvTYC+YPL/A+sU0=";
 
   separateDebugInfo = true;
 

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.4";
+  version = "3.3.8";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ykq7UkpGy9w3VQ2LcGsdREN0na0F7Mj9RxVu8iLr96s=";
+    hash = "sha256-5RFGpfeW3nLubN920hrBVyEdJEPa/V3Dz2YdxCh9YLU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2413";
+  version = "2.0.2421";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-loI9wKz0EcePvM2kXqmxNx9rfC/VaMCmJtm0dTjWoOk=";
+    hash = "sha256-1ES2T8PjajmXtNM2xIxM795ub5OKQ0WRa1XH9te+8+0=";
   };
 
-  npmDepsHash = "sha256-6XLDdamRG+IVq/zdyKKlIsnfUVD8pKES7K7hm+yTQ78=";
+  npmDepsHash = "sha256-cYCNNc9+jM6sVBc15OlNaTo0BZ7XudI5c1SODrXD548=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/al/alpaca-proxy/package.nix

@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "alpaca-proxy";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "samuong";
     repo = "alpaca";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-74JQ9ltJ7+sasySgNN3AaXlBILP7VgFN06adoNJG+Bc=";
+    hash = "sha256-Yz90kJGyf2iA3LCj9d/oG5rLVUZVI//cqI6w67iV9Tc=";
   };
 
-  vendorHash = "sha256-N9qpyCQg6H1v/JGJ2wCxDX+ZTM9x6/BM6wQ26xC+dlE=";
+  vendorHash = "sha256-3A88gc8j0OrxBIAFBNlz3Np5CV9xpwwIDCnnfXyBj4Q=";
 
   ldflags = [
     "-s"

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.14.1";
+  version = "4.8.14.5";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-NZku10mU6Psl03lT4ITYhjWDkKH70RAw+axUuKe22j0=";
+    hash = "sha256-ijo6PC1Be06K8hxvgjybLvU80xEYUPahBV4f5JqabLc=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/am/amtterm/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Intel AMT® SoL client + tools";
-    homepage = "https://www.kraxel.org/cgit/amtterm/";
+    homepage = "https://github.com/kraxel/amtterm";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };

pkgs/by-name/ao/ao3downloader/package.nix

@@ -8,14 +8,14 @@
 # https://github.com/nianeyna/ao3downloader/blob/f8399bb8aca276ae7359157b90afd13925c90056/pyproject.toml#L8
 python312Packages.buildPythonApplication (finalAttrs: {
   pname = "ao3downloader";
-  version = "2026.2.0";
+  version = "2026.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nianeyna";
     repo = "ao3downloader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NrVzRYNxvy8LOvXy0/1go0wEQyLt56inu+f93UFX1CM=";
+    hash = "sha256-PlMVhvUX/XeNrKfwe+/sFv8Y4k7GEzCR+xIO/zuspxM=";
   };
 
   build-system = with python312Packages; [

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.1.12";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UqvmHIHHMNJ3VX6UT/CdK6vhrAW6TLwtfvmRPPGXjVI=";
+    hash = "sha256-YHehcCaMclkWkiOFL7FzVUKdLcIjhUXNJUaFEXNdubI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-Pi0egpWT/12CZI84NtJKYpRT7OwzwF9MTq9Q+9DN2cw=";
+  vendorHash = "sha256-6KLdW45fUb1smdjEuVEe3PBhmC5Z6LnlHp8OkRKghno=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

pkgs/by-name/au/audiobookshelf/package.nix

@@ -15,10 +15,10 @@
 
 let
   source = {
-    version = "2.33.1";
-    hash = "sha256-O1AurSUq3MNcSchQlC/UfPO2KoB4dBBsONAQ2Bmxk9o=";
-    npmDepsHash = "sha256-NVHKPiT4GFiFVVyO7z/fZtU8Zf4o/LM1PmUs6zwzZF0=";
-    clientNpmDepsHash = "sha256-KWGnFeXxOVGqAruB9k/FqQfQNG6JrZFUQpo0Ls8jEYA=";
+    version = "2.33.2";
+    hash = "sha256-YsKUoJ0SlBO3fAbMvzaEEIgo90HclB+0iLVIH4LDmEY=";
+    npmDepsHash = "sha256-h/5brNurUEMHTSu2PGODhRtIenGzhsNM558i85Cs86w=";
+    clientNpmDepsHash = "sha256-EbXkHRjOE1A7Sk4MhbJFuBwG/VY+SHhHYjscsXkSMjU=";
   };
 
   src = fetchFromGitHub {

pkgs/by-name/au/authelia/sources.nix

@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.18";
+  version = "4.39.19";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-IROdncF3TC1X9000jw0RGtrcFrzqRpG7g2QuLGQ/Q4k=";
+    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
   };
   vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-ki/jXNT9dIno1UIcDgBcsLdiKcaiw/dwnff3t9xv07o=";
+  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
 }

pkgs/by-name/au/autobrr/package.nix

@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.75.1";
+  version = "1.76.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-y1whIPx4s399WmO2xzjLFXPKhINE9b3+jHJcmsP+3ZA=";
+    hash = "sha256-MGqsRRN73L6i/lhdhnoi3ehnDIRDQpgFYluO6ZeOPT0=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
@@ -46,7 +46,7 @@ let
         ;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-euDGtNERNq3IgxggiHoLmcq2+e2SslXLSfY8TTFnqoE=";
+      hash = "sha256-BEsYcS0SiWLQyQc7CRadoQ146VAnq0zmHxdd838H6iI=";
     };
 
     postBuild = ''
@@ -66,7 +66,7 @@ buildGoModule (finalAttrs: {
     src
     ;
 
-  vendorHash = "sha256-kxly/+7wnPbxs1LKzoSFRYcPBWqZg4tgzV3uYJji+yA=";
+  vendorHash = "sha256-HjHRT/PAZdMM/2JWmNMK/I9Gc0ThTAFDSxWW/ATYxW8=";
 
   preBuild = ''
     cp -r ${autobrr-web}/* web/dist

pkgs/by-name/au/automatic-timezoned/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "automatic-timezoned";
-  version = "2.0.125";
+  version = "2.0.126";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YYI0ISLaOcKZu2AFf08DmriApTLKdUUgLF5AhEhGf04=";
+    sha256 = "sha256-e6r8XfzwIdcGlQwN64bfSQ481b1ViLI+9jTxUYNsA3w=";
   };
 
-  cargoHash = "sha256-jhsW33xDTDBDi2ySSwePjjNmIFKKm6ZnP5xklvB4+Iw=";
+  cargoHash = "sha256-0iUBZXybkK6y19RsZXSibcSRh4jEYwSSYUDyCI3ihOc=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/be/bento/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "bento";
-  version = "1.16.2";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SNX80JTX4jqbcCQWP+HlQaXTkODOYzbDN1KQ4iOZqYs=";
+    hash = "sha256-VfXXGtcn4bUTtIL39nusHciw3Rv2A4xL6s1fGnmBTZ0=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-N5CRU4Mv9e8kHXUXP95cNe02DkoEhJWcypF4vkEaMBA=";
+  vendorHash = "sha256-eVZd24c3imolyrt97gNrm1ro8VBMYH4fbzTzzSk4iEI=";
 
   subPackages = [
     "cmd/bento"

pkgs/by-name/bi/biome/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.4.11";
+  version = "2.4.12";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-EPrbr0FOYlP+HKa9YkNi4cw2oisoHRkQAahMIoq9QIo=";
+    hash = "sha256-PVax57P496gDksvyGskW3MeR9YDZFE0E8yiv2zW6L/o=";
   };
 
-  cargoHash = "sha256-SxHTeZ3snOeBsYmjN4to9UoGVnH0mSXtWtAOv85Ztxs=";
+  cargoHash = "sha256-638M2/qRXTZSD4/2/PWkfo5DbsLzWlhwwSBGlkUaLBc=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/bo/boulder/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "boulder";
-  version = "0.20260331.0";
+  version = "0.20260413.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-2kYZp/cU9OuXmy8EDoX7htqlM7NpAl45Nf2S5MTVn6Y=";
+    hash = "sha256-8saRz7g0KsXNr5oR4a2qd4kKDR686J0TIFMzsX/zlV0=";
   };
 
   vendorHash = null;

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.67.0";
+  version = "1.68.2";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lipptVcjSRYh1EP1hOQwnJrnZScrua/ViXw8eBAvzio=";
+    hash = "sha256-h09Q8/K8SX3B13NZlU8VJLHmkpaUhL0UKG0gwIhnUHg=";
   };
 
-  vendorHash = "sha256-stzZSzM8volS26qLsDll1errJe+cwpmIHnzlMEJCv8I=";
+  vendorHash = "sha256-3WasjCKLf8P5szPa2Rdb0qWqgPAP67x0AZA1pF5qCUU=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/bu/buffrs/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "buffrs";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "helsing-ai";
     repo = "buffrs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DTA30wVgThUu76AHWcpxAiOQZf92N6hMDPUHOUjg1vA=";
+    hash = "sha256-IKL8zBDM83TgyYHcGOBn+6nzIo6ywvlZk+G5cBC4ijE=";
   };
 
-  cargoHash = "sha256-c8Y81+IUpOWWlCsnltFWgbWW9I2ZkardzT94wGTKMVo=";
+  cargoHash = "sha256-Mku0H3fwyxtHgPuJndHA/lcd7/rGVw69+j1GdFt5JyQ=";
 
   # Disabling tests meant to work over the network, as they will fail
   # inside the builder.

pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py

@@ -247,7 +247,7 @@ cfgmisc = """  # Enable CUPS to print documents.
 
 """
 cfgusers = """  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.@@username@@ = {
+  users.users."@@username@@" = {
     isNormalUser = true;
     description = "@@fullname@@";
     extraGroups = [ @@groups@@ ];

pkgs/by-name/ca/cantus/package.nix

@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cantus";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "CodedNil";
     repo = "cantus";
     tag = finalAttrs.version;
-    hash = "sha256-C/djQKG25azM/Vfw6UurPhgIyHGhWcMwM8FXQt+alko=";
+    hash = "sha256-pnc/fjmi932tZQsAfvvAoZ1PXEP8gckGuauR+5btei8=";
   };
 
-  cargoHash = "sha256-qg7YeIJVDzrAmUNUjfIB7eoZYUTMNu69L7dlZ6D9nLU=";
+  cargoHash = "sha256-sDZF5cWlhsBblAe0sreGbfgXKIip5raM0r9ZeJrLrLQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ch/chezmoi/package.nix

@@ -7,16 +7,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "chezmoi";
-  version = "2.69.4";
+  version = "2.70.1";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x809oaZk6vwkXMUAtIAnB2YTXH0zOjZVh75uClfBkH4=";
+    hash = "sha256-wGNv5O339fjzEPpK4/xAkUpgbOlRq3+DN9e0R7A393Y=";
   };
 
-  vendorHash = "sha256-mPZaxrIhwRMcC0mmYBXU1lDcZy1p7iMSO7sfRUI/dU0=";
+  vendorHash = "sha256-URvpoVW763bIBRFJvHMiTNobSRBA8lGualeRfNtKkYE=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ch/chirpstack-concentratord/package.nix

@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chirpstack-concentratord";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-concentratord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-945ZJZ/OLoR/3dAC/PZHRRziyuLDZ+xfitF8jpvZ420=";
+    hash = "sha256-icvbZjqsDf/RLiDUyx0lQKRVHFh6FNxkLVkv9kckDBc=";
   };
 
-  cargoHash = "sha256-cwm8ZSfml9B/OO5QzH1eUhoF/3DPUEEV0T/YL427X80=";
+  cargoHash = "sha256-iJhNaXv5a8+9TZJGLdKZdq1VFE09w0L/05V1y6kabN0=";
 
   buildInputs = [
     libloragw-2g4

pkgs/by-name/cl/clac/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clac";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "soveran";
     repo = "clac";
     tag = finalAttrs.version;
-    hash = "sha256-DcW35jKIZQqkNa5Y6am2e5/TAEg3Fo2n+fHG3nOpNzM=";
+    hash = "sha256-o/KYsiQDRva2mercTz1dmdcuXWCv7x8fy4LvPgk9Qn4=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/by-name/cl/clightning/package.nix

@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clightning";
-  version = "25.12.1";
+  version = "26.04";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${finalAttrs.version}/clightning-v${finalAttrs.version}.zip";
-    hash = "sha256-50rcNH9dXeRezJ3nEW/cRK5uE+IpGoHAzkU3C7p44KY=";
+    hash = "sha256-6dxnhLkXIrfxqXi+UoBKsJw1YFIanOVGBYizJB0X3oU=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool

pkgs/by-name/cl/cloud-nuke/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloud-nuke";
-  version = "0.46.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "cloud-nuke";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uuTyLT6Qfnv7cLP//avPcNZreTWGHJRS6kxMC+UT39U=";
+    hash = "sha256-ygmgGe89YdvvP60zl8RWTXchXVNd23fodyFjiSDwQAI=";
   };
 
-  vendorHash = "sha256-EYIfecD3X3EdllR9FoqfEWSwB7wh6IxQTKItSivSPDs=";
+  vendorHash = "sha256-1DMwVJvr3zU96yAV2Vb4v58VNt7xg9dLCH7XGEMopjQ=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/co/coc-rust-analyzer/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-04-14";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "561aea31f1e263c8386ab7e09b7ffa95e64cd351";
-    hash = "sha256-Ee/5nkPdQBXwt5jQOMN+2/nHRwk33HigeY/L0NpTLAY=";
+    rev = "3a82969c169b9d71b51e74fe8841d1f04326725d";
+    hash = "sha256-8/wgdlM4US5R6xOYFD4uP6gEeRfJsjDwwCz3BIUpoFI=";
   };
 
   npmDepsHash = "sha256-+3eXdiM0Nll7V6EnDXq88rBjRkPN6GLFASdJ3fMXbq4=";

pkgs/by-name/co/codex/package.nix

@@ -38,6 +38,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-zpQ0vg9XuarLfdZYiRIhcwLHUOdunNbOb5xLW3MPzp8=";
 
+  # Match upstream's release build (codex only, no fat LTO) to cut build time.
+  cargoBuildFlags = [
+    "--package"
+    "codex-cli"
+    "--config"
+    ''profile.release.lto="off"''
+  ];
+  cargoCheckFlags = [
+    "--package"
+    "codex-cli"
+  ];
+
   postPatch = ''
     # webrtc-sys asks rustc to link libwebrtc statically by default,
     # but nixpkgs provides libwebrtc as a shared library.

pkgs/by-name/co/conmon-rs/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "conmon-rs";
-  version = "0.7.3";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "conmon-rs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fs+IcibhyoC5+Sbr9lWtBbb0Sk6Uf+YVockXNbCLXCY=";
+    hash = "sha256-3+W+keg+4XwbtQDps/9FRVPtX3yuR2sQbkoSusDiLmA=";
   };
 
   nativeBuildInputs = [
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
   doCheck = false;
 
-  cargoHash = "sha256-l+FcrLPE+EGb3IEWikUJ1Ak8lOSlYz9WvUffGHzU0tc=";
+  cargoHash = "sha256-shfufw5Ompcp8rv5tnuojEP7t7r7eGTvomPVoFv2AFE=";
 
   meta = {
     description = "OCI container runtime monitor written in Rust";

pkgs/by-name/co/containerd/package.nix

@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.2.1";
+  version = "2.2.3";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-fDOfN0XESrBTDW7Nxj9niqU93BQ5/JaGLwAR3u6Xaik=";
+    hash = "sha256-jaOLZf246kmvBHHrwgvqrhxuh+n1HE6NDqckZK4tvnM=";
   };
 
   postPatch = ''

pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-04-16";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "a01f7d1217de6dcc961f258bef5ff2eb54fa84f3";
-    hash = "sha256-BtCArWWC5WbObpNp2OBxfn9Au+3SS+Gj/JBptDs8qbk=";
+    rev = "3a22684788b839ead634b8abb6ab2296296dba9d";
+    hash = "sha256-7gqf1m7jlsuzadsELDJL7XwYlpdmEhHYG5FEFsI3HRU=";
   };
 
   cargoHash = "sha256-vD90KMBI1bQTwazVnEMFo3eKXmLLI9QswdIwz+XoDho=";

pkgs/by-name/cp/cpuinfo/package.nix

@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpuinfo";
-  version = "0-unstable-2026-03-12";
+  version = "0-unstable-2026-04-15";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "7607ca500436b37ad23fb8d18614bec7796b68a7";
-    hash = "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg=";
+    rev = "d05fbcd57dc096718c4979e7c054e628f1f3520b";
+    hash = "sha256-GF88Y83G9hh3gze0n4wySH9ix3PSGhaZey3t2aej0BQ=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "cpu-info";
     maintainers = with lib.maintainers; [ pawelchcki ];
     pkgConfigModules = [ "libcpuinfo" ];
-    # https://github.com/pytorch/cpuinfo/blob/7607ca500436b37ad23fb8d18614bec7796b68a7/CMakeLists.txt#L98
+    # https://github.com/pytorch/cpuinfo/blob/d05fbcd57dc096718c4979e7c054e628f1f3520b/CMakeLists.txt#L98
     platforms = lib.platforms.x86 ++ lib.platforms.aarch ++ lib.platforms.riscv;
   };
 })

pkgs/by-name/cr/crawley/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "crawley";
-  version = "1.7.18";
+  version = "1.7.19";
 
   src = fetchFromGitHub {
     owner = "s0rg";
     repo = "crawley";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fopIRHaHiLYLA6/WHuY18Y91vF/BOPs0dHE7KCFXtj4=";
+    hash = "sha256-d854JL2/ZhEKQUG8tJ7TctDaicWnAKEFl0mJF6MIvls=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-0CGkRyW353JD04f0/F5dcRCD6YE5DXYaNetEx8moAGY=";
+  vendorHash = "sha256-lptFxIt5b7d6hIXdAqakA1K78NGJ86u0p/XfbQMiTsc=";
 
   ldflags = [
     "-w"

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "4.3.1";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c4o8AMCtDGLChXxJKJyxkWhuYu7axqLb2ce8IOGk920=";
+    hash = "sha256-wks7kkF0va7RUJXY74ku/yWTSsHQKlFczfhAHyuNudM=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor
@@ -28,6 +28,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  postPatch = ''
+    # Fixes the build of dependent projects by updating the supported
+    # CMake version.
+    # Issue: https://github.com/RoaringBitmap/CRoaring/issues/793
+    # PR: https://github.com/RoaringBitmap/CRoaring/pull/794
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '2.8...3.15' '3.15'
+  '';
+
   preConfigure = ''
     mkdir -p dependencies/.cache
     ln -s ${
@@ -49,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
       mit
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/cu/cura-appimage/package.nix

@@ -13,7 +13,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cura-appimage";
-  version = "5.12.0";
+  version = "5.12.1";
 
   # Give some good names so the intermediate packages are easy
   # to recognise by name in the Nix store.
@@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/Ultimaker/Cura/releases/download/${version}/Ultimaker-Cura-${version}-linux-X64.AppImage";
-    hash = "sha256-0eO7g061SBr78rn+oLqxo9TWyYAFjAy2pjteIjAzaAI=";
+    hash = "sha256-GBQvMZRaOqbOmBOOaIfduWKkwHbyZosr6AaFMty0Jfo=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/cv/cvemap/package.nix

@@ -1,37 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule (finalAttrs: {
-  pname = "cvemap";
-  version = "1.0.0";
-
-  src = fetchFromGitHub {
-    owner = "projectdiscovery";
-    repo = "cvemap";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-pzCLzSsAaoiRrTBENnmyqaSyDnHQdDAcTNyaxpc7mt4=";
-  };
-
-  vendorHash = "sha256-4GW1mgwOXbdiDmQoN1yxVOJC8mXpqkKliabWZzvOff4=";
-
-  subPackages = [
-    "cmd/cvemap/"
-  ];
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  meta = {
-    description = "Tool to work with CVEs";
-    homepage = "https://github.com/projectdiscovery/cvemap";
-    changelog = "https://github.com/projectdiscovery/cvemap/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
-    mainProgram = "cvemap";
-  };
-})

pkgs/by-name/de/decktape/package.nix

@@ -6,16 +6,16 @@
 }:
 buildNpmPackage rec {
   pname = "decktape";
-  version = "3.16.0";
+  version = "3.16.1";
 
   src = fetchFromGitHub {
     owner = "astefanutti";
     repo = "decktape";
     rev = "v${version}";
-    hash = "sha256-hriWwH7/YKCwdDhXwqoOmjOJX3Dk4aKMnCBJKepUTzg=";
+    hash = "sha256-ZsNSQlkzIlawQ9FWG9kjz3bDJAx3X5YHv7LESI0tmpc=";
   };
 
-  npmDepsHash = "sha256-wnT6kRiYanwi8G9ZtBmqxAFctJEyyi0XlwaOXTjvlA8=";
+  npmDepsHash = "sha256-B84p4VBaQMZlhwiwXdF9Ijwpn3MisMlOXWc0E+5R5l8=";
   npmPackFlags = [ "--ignore-scripts" ];
 
   dontNpmBuild = true;

pkgs/by-name/de/deno/librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch

@@ -0,0 +1,13 @@
+Submodule build contains modified content
+diff --git a/build/rust/allocator/lib.rs b/build/rust/allocator/lib.rs
+index 4b834e322..1970d664e 100644
+--- a/build/rust/allocator/lib.rs
++++ b/build/rust/allocator/lib.rs
+@@ -87,7 +87,6 @@ mod both_allocators {
+     /// rustc-generated shims we must define this symbol, since we are opting in
+     /// to unstable functionality. See https://github.com/rust-lang/rust/issues/123015
+     #[rustc_std_internal_symbol]
+-    #[linkage = "weak"]
+     fn __rust_no_alloc_shim_is_unstable_v2() {}
+ 
+     #[cfg(not(RUST_ALLOCATOR_NIGHTLY_CAPABILITY))]

pkgs/by-name/de/deno/librusty_v8.nix

@@ -1,12 +1,169 @@
-# auto-generated file -- DO NOT EDIT!
-{ fetchLibrustyV8 }:
-
-fetchLibrustyV8 {
-  version = "147.0.0";
-  shas = {
-    x86_64-linux = "sha256-PXLRowkOBRVWeonQDTN6e4BQlSLK/kobCX7eE0Y1NLY=";
-    aarch64-linux = "sha256-6jaFVmmYYOZNZmk6UHUAGyibSBQn51Ie57hB7CIZBFI=";
-    x86_64-darwin = "sha256-yTrxJ5ABXg1r0myZqy4J3m/ivYdXnsgG089PrD5cMhY=";
-    aarch64-darwin = "sha256-HVr7hNzZk4qQTct2Px7DvSJAnyq1duJCqJawY475SR4=";
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  rustPlatform,
+  rustc,
+  rustc-unwrapped,
+  rust-bindgen,
+  rust-analyzer,
+  rustfmt,
+  cargo,
+  clippy,
+  llvmPackages ? rustc.llvmPackages,
+  pkg-config,
+  stdenv,
+  glib,
+  glibc,
+  icu,
+  python3,
+  gn,
+  ninja,
+  xcbuild,
+  apple-sdk_15,
+  symlinkJoin,
+  deno,
+}:
+let
+  rustToolchain = symlinkJoin {
+    name = "rusty-v8-rust-toolchain";
+    paths = [
+      rustc
+      rustc-unwrapped
+      rust-bindgen
+      rust-analyzer
+      rustfmt
+      cargo
+      clippy
+      llvmPackages.libclang.lib
+    ];
+    postBuild = ''
+      mkdir -p "$out/lib/rustlib/src/rust"
+      cp -r '${rustPlatform.rustcSrc}'/* "$out/lib/rustlib/src/rust/"
+      chmod u+w "$out/lib/rustlib/src/rust/library/"
+      ln -s '${rustPlatform.rustVendorSrc}' "$out/lib/rustlib/src/rust/library/vendor"
+    '';
   };
-}
+
+  clangBasePath = symlinkJoin {
+    name = "rusty-v8-llvm-toolchain";
+    paths = [
+      llvmPackages.clang-unwrapped.lib
+      llvmPackages.clang
+      llvmPackages.llvm
+      llvmPackages.lld
+    ];
+    postBuild =
+      if stdenv.targetPlatform.isDarwin then
+        ''
+          dir="$out/lib/clang/${lib.versions.major llvmPackages.clang.version}/lib/darwin/"
+          mkdir -p "$dir"
+          ln -s ${llvmPackages.compiler-rt}/lib/darwin/libclang_rt.osx* "$dir/libclang_rt.osx${stdenv.hostPlatform.extensions.staticLibrary}"
+        ''
+      else
+        ''
+          dir="$out/lib/clang/${lib.versions.major llvmPackages.clang.version}/lib/${stdenv.hostPlatform.config}/"
+          mkdir -p "$dir"
+          ln -s ${llvmPackages.compiler-rt}/lib/linux/libclang_rt.builtins-* "$dir/libclang_rt.builtins${stdenv.hostPlatform.extensions.staticLibrary}"
+        '';
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rusty-v8";
+  version = "147.1.0";
+
+  src = fetchFromGitHub {
+    owner = "denoland";
+    repo = "rusty_v8";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-USCQtK5pJBpU1FTLMQ/bNwJXnVNkdX/EtCWqs2kVL50=";
+  };
+
+  patches = [
+    ./librusty_v8_no_downloads.patch
+    (fetchpatch {
+      name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7539408
+      url = "https://chromium.googlesource.com/chromium/src/+/acb47d9a6b56c4889a2ed4216e9968cfc740086c^!?format=TEXT";
+      decode = "base64 -d";
+      revert = true;
+      includes = [ "build/config/compiler/BUILD.gn" ];
+      hash = "sha256-0yEK66IEyS8xABDHY4W8oIvl4Ga1JfL1wxQy8PhXyqI=";
+    })
+    ./librusty_v8_revert_-fno-lifetime-dse.patch
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    ./librusty_v8-darwin-fix-__rust_no_alloc_shim_is_unstable_v2.patch
+  ];
+
+  cargoHash = "sha256-FKwXdms9j+izRKsm5TKJ8Ct8lvBuG/tYXfNzVsbs8cM=";
+
+  nativeBuildInputs = [
+    llvmPackages.clang
+    python3
+    pkg-config
+    llvmPackages.lld
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isLinux [
+    glibc
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    xcbuild
+  ];
+  buildInputs = [
+    glib
+    icu
+  ]
+  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
+  env = {
+    V8_FROM_SOURCE = 1;
+    PYTHON = "python3";
+    NINJA = lib.getExe ninja;
+    GN = lib.getExe gn;
+    RUSTC_BOOTSTRAP = 1;
+    EXTRA_GN_ARGS = lib.concatStringsSep " " (
+      [
+        "use_sysroot=false" # prevent download of debian sysroot
+        "clang_version=\"${lib.versions.major llvmPackages.clang.version}\""
+        "rustc_version=\"${rustc.version}\""
+        "rust_sysroot_absolute=\"${rustToolchain}\""
+        "rust_bindgen_root=\"${rustToolchain}\""
+        "use_chromium_rust_toolchain=true"
+        # To accomodate our newer rustc compiler
+        "removed_rust_stdlib_libs=[\"adler\"]"
+        "added_rust_stdlib_libs=[\"adler2\"]"
+      ]
+      ++ lib.optional stdenv.targetPlatform.isDarwin "mac_deployment_target=\"${stdenv.targetPlatform.darwinMinVersion}\""
+    );
+    LIBCLANG_PATH = lib.makeLibraryPath [ llvmPackages.libclang ];
+    CLANG_BASE_PATH = clangBasePath;
+  };
+
+  buildFeatures = [ "simdutf" ];
+
+  checkFlags = [
+    # These tests probably fail due to a more recent rustc version (upstream: 1.89.0, here: 1.93.0)
+    "--skip=ui"
+    "--skip=scope"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    cp target/*/release/gn_out/obj/librusty_v8${stdenv.hostPlatform.extensions.staticLibrary} $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Rust bindings for the V8 JavaScript engine";
+    homepage = "https://github.com/denoland/rusty_v8";
+    license = lib.licenses.mit;
+    maintainers = deno.meta.maintainers;
+    platforms = deno.meta.platforms;
+  };
+})

pkgs/by-name/de/deno/librusty_v8_no_downloads.patch

@@ -0,0 +1,30 @@
+diff --git a/build.rs b/build.rs
+index 970e88bb..afb92e8a 100644
+--- a/build.rs
++++ b/build.rs
+@@ -251,7 +251,6 @@ fn build_v8(is_asan: bool) {
+     download_ninja_gn_binaries();
+   }
+ 
+-  download_rust_toolchain();
+ 
+   // `#[cfg(...)]` attributes don't work as expected from build.rs -- they refer to the configuration
+   // of the host system which the build.rs script will be running on. In short, `cfg!(target_<os/arch>)`
+@@ -461,17 +460,6 @@ fn maybe_clone_repo(dest: &str, repo: &str) {
+ }
+ 
+ fn maybe_install_sysroot(arch: &str) {
+-  let sysroot_path = format!("build/linux/debian_sid_{arch}-sysroot");
+-  if !PathBuf::from(sysroot_path).is_dir() {
+-    assert!(
+-      Command::new(python())
+-        .arg("./build/linux/sysroot_scripts/install-sysroot.py")
+-        .arg(format!("--arch={arch}"))
+-        .status()
+-        .unwrap()
+-        .success()
+-    );
+-  }
+ }
+ 
+ fn download_ninja_gn_binaries() {

pkgs/by-name/de/deno/librusty_v8_revert_-fno-lifetime-dse.patch

@@ -0,0 +1,19 @@
+Submodule build contains modified content
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index ff8022f04..59699e1d4 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -625,13 +625,6 @@ config("compiler") {
+       ]
+     }
+ 
+-    # The performance improvement does not seem worth the risk. See
+-    # https://crbug.com/484082200 for background and https://crrev.com/c/7593035
+-    # for discussion.
+-    if (!is_wasm) {
+-      cflags += [ "-fno-lifetime-dse" ]
+-    }
+-
+     # TODO(hans): Remove this once Clang generates better optimized debug info
+     # by default. https://crbug.com/765793
+     cflags += [

pkgs/by-name/de/deno/package.nix

@@ -9,9 +9,7 @@
   protobuf,
   installShellFiles,
   makeBinaryWrapper,
-  librusty_v8 ? callPackage ./librusty_v8.nix {
-    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
-  },
+  librusty_v8 ? callPackage ./librusty_v8.nix { },
   libffi,
   sqlite,
   lld,
@@ -244,7 +242,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = ./update/update.ts;
+    updateScript = ./update.sh;
     tests = callPackage ./tests { };
     inherit librusty_v8;
   };
@@ -267,6 +265,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       jk
       ofalvai
+      mynacol
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/de/deno/update.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update curl yq
+
+old_version="$(nix-instantiate --raw --eval -A deno.version)"
+
+nix-update deno
+
+new_version="$(nix-instantiate --raw --eval -A deno.version)"
+
+if [ "$old_version" = "$new_version" ]; then
+  echo "No deno update, nothing to do"
+  exit 0
+fi
+
+new_v8_version="$(curl -sL "https://raw.githubusercontent.com/denoland/deno/refs/tags/v$new_version/Cargo.lock" | \
+  tomlq -r ".package[] | select(.name == \"v8\") | .version")"
+
+nix-update deno.librusty_v8 "--version=$new_v8_version"

pkgs/by-name/de/deno/update/common.ts

@@ -1,51 +0,0 @@
-interface GHRelease {
-  tag_name: string;
-}
-
-const decode = (buffer: Uint8Array) => new TextDecoder("utf-8").decode(buffer);
-export const run = async (command: string, args: string[]) => {
-  const cmd = new Deno.Command(command, { args });
-  const { code, stdout, stderr } = await cmd.output();
-  if (code !== 0) {
-    const error = decode(stderr).trimEnd();
-    // Known error we can ignore
-    if (error.includes("'allow-unsafe-native-code-during-evaluation'")) {
-      // Extract the target sha256 out of the error
-      const target = "  got:    sha256:";
-      const match = error
-        .split("\n")
-        .find((l) => l.includes(target))
-        ?.split(target)[1];
-      if (typeof match !== "undefined") {
-        return match;
-      }
-    }
-    throw new Error(error);
-  }
-  return decode(stdout).trimEnd();
-};
-
-// Exports
-export const versionRegExp = /\d+\.\d+\.\d+/;
-export const sha256RegExp = /[a-z0-9]{52}|sha256-.{44}/;
-
-export const getExistingVersion = async (filePath: string) =>
-  read(filePath).then(
-    (s) => s.match(genValueRegExp("version", versionRegExp))?.shift() || "",
-  );
-
-export const getLatestVersion = (owner: string, repo: string) =>
-  fetch(`https://api.github.com/repos/${owner}/${repo}/releases`)
-    .then((res) => res.json())
-    .then((res: GHRelease[]) => res[0].tag_name);
-
-// The (?<=) and (?=) allow replace to only change inside
-// Match the regex passed in or empty
-export const genValueRegExp = (key: string, regex: RegExp) =>
-  new RegExp(`(?<=${key} = ")(${regex.source}|)(?=")`);
-
-export const logger = (name: string) => (...a: any) =>
-  console.log(`[${name}]`, ...a);
-
-export const read = Deno.readTextFile;
-export const write = Deno.writeTextFile;

pkgs/by-name/de/deno/update/src.ts

@@ -1,67 +0,0 @@
-import {
-  genValueRegExp,
-  logger,
-  read,
-  run,
-  sha256RegExp,
-  versionRegExp,
-  write,
-} from "./common.ts";
-
-interface Replacer {
-  regex: RegExp;
-  value: string;
-}
-
-const log = logger("src");
-
-const prefetchHash = (nixpkgs: string, version: string) =>
-  run("nurl", ["https://github.com/denoland/deno", version, "-H", "-n", nixpkgs, "-S"]);
-const prefetchCargoHash = (nixpkgs: string) =>
-  run(
-    "nurl",
-    ["-e", `(import ${nixpkgs} {}).deno.cargoDeps.overrideAttrs (_: { hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; })`]
-  );
-
-const replace = (str: string, replacers: Replacer[]) =>
-  replacers.reduce(
-    (str, r) => str.replace(r.regex, r.value),
-    str,
-  );
-
-const updateNix = (filePath: string, replacers: Replacer[]) =>
-  read(filePath).then((str) => write(filePath, replace(str, replacers)));
-
-const genVerReplacer = (k: string, value: string): Replacer => (
-  { regex: genValueRegExp(k, versionRegExp), value }
-);
-const genShaReplacer = (k: string, value: string): Replacer => (
-  { regex: genValueRegExp(k, sha256RegExp), value }
-);
-
-export async function updateSrc(
-  filePath: string,
-  nixpkgs: string,
-  denoVersion: string,
-) {
-  log("Starting src update");
-  const trimVersion = denoVersion.substring(1);
-  log("Fetching hash for:", trimVersion);
-  const sha256 = await prefetchHash(nixpkgs, denoVersion);
-  log("sha256 to update:", sha256);
-  await updateNix(
-    filePath,
-    [
-      genVerReplacer("version", trimVersion),
-      genShaReplacer("hash", sha256),
-    ],
-  );
-  log("Fetching cargoHash for:", sha256);
-  const cargoHash = await prefetchCargoHash(nixpkgs);
-  log("cargoHash to update:", cargoHash);
-  await updateNix(
-    filePath,
-    [genShaReplacer("cargoHash", cargoHash)],
-  );
-  log("Finished src update");
-}

pkgs/by-name/de/deno/update/update.ts

@@ -1,43 +0,0 @@
-#!/usr/bin/env nix-shell
-/*
-#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nurl
-*/
-import { getExistingVersion, getLatestVersion, logger } from "./common.ts";
-import { Architecture, updateLibrustyV8 } from "./librusty_v8.ts";
-import { updateSrc } from "./src.ts";
-
-const log = logger("update");
-// TODO: Getting current file position to more-safely point to nixpkgs root
-const nixpkgs = Deno.cwd();
-// TODO: Read values from default.nix
-const owner = "denoland";
-const repo = "deno";
-const denoDir = `${nixpkgs}/pkgs/by-name/de/${repo}`;
-const src = `${denoDir}/package.nix`;
-const librusty_v8 = `${denoDir}/librusty_v8.nix`;
-const architectures: Architecture[] = [
-  { nix: "x86_64-linux", rust: "x86_64-unknown-linux-gnu" },
-  { nix: "aarch64-linux", rust: "aarch64-unknown-linux-gnu" },
-  { nix: "x86_64-darwin", rust: "x86_64-apple-darwin" },
-  { nix: "aarch64-darwin", rust: "aarch64-apple-darwin" },
-];
-
-log("Updating deno");
-
-log("Getting latest deno version");
-const version = await getLatestVersion(owner, repo);
-const existingVersion = await getExistingVersion(src);
-const trimVersion = version.substr(1); // Strip v from v0.0.0
-log("Latest version:   ", trimVersion);
-log("Extracted version:", existingVersion);
-if (trimVersion === existingVersion) {
-  log("Version already matches latest, skipping...");
-  Deno.exit(0);
-}
-
-const tasks = [
-  updateSrc(src, nixpkgs, version),
-  updateLibrustyV8(librusty_v8, owner, repo, version, architectures),
-];
-await Promise.all(tasks);
-log("Updating deno complete");

pkgs/by-name/di/di-tui/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "di-tui";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "acaloiaro";
     repo = "di-tui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8aNwEDxaNUS909gRZ1PGEIKHIK8NmlxM6zwvc2xBlzc=";
+    hash = "sha256-rT9iH9kkkWtg4H7YJUD2ElvWLUIzFHGSlH31A68pDDo=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";

pkgs/by-name/di/dioxus-cli/package.nix

@@ -8,7 +8,7 @@
   rustfmt,
   makeWrapper,
   esbuild,
-  wasm-bindgen-cli_0_2_114,
+  wasm-bindgen-cli_0_2_118,
   testers,
   dioxus-cli,
   withTelemetry ? false,
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --suffix PATH : ${
         lib.makeBinPath [
           esbuild
-          wasm-bindgen-cli_0_2_114
+          wasm-bindgen-cli_0_2_118
         ]
       }
   '';

pkgs/by-name/do/docker-credential-helpers/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "docker-credential-helpers";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-credential-helpers";
     rev = "v${version}";
-    sha256 = "sha256-iZETkZK7gY5dQOT4AN341wfzeaol9HT4kr/G4o2oWzw=";
+    sha256 = "sha256-OM5NU0I3272KaCHv8ZtkbkB86d6mo/Ym1QXMGmCisVc=";
   };
 
   vendorHash = null;

pkgs/by-name/do/dolt/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "dolt";
-  version = "1.84.1";
+  version = "1.86.2";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gV5KqBo3Sk+oUER/VOgQVwnCucc4IZF/QmqZRTddI04=";
+    hash = "sha256-CXhdt9uIhdSEW3M21pL2WeT+zKPUxyYrU4fGTgMgun4=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-SRwxzkBNNVnGVDDhi3YR4ZXY1q2O78S2I+kp79Wh+50=";
+  vendorHash = "sha256-JdpPKao8LOGzKzzLtfiYh3rUn1OLLcA7YIrztHwTLmU=";
   proxyVendor = true;
   doCheck = false;
 

pkgs/by-name/do/dosage-tracker/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosage";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchFromGitHub {
     owner = "diegopvlk";
     repo = "Dosage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dd7q/txbgvlpKi7/sTvxyo9DarZ19BUCYRaO37zK/tU=";
+    hash = "sha256-Tgsab1KzdEQ9C9gkh09M5gKpocrMrgxQ16pIJ4zcKsY=";
   };
 
   # https://github.com/NixOS/nixpkgs/issues/318830

pkgs/by-name/do/dotenvx/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.61.0";
+  version = "1.61.1";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-Ph/L+OOoO3UMc8FmZSNSLNqyMSAnxyXL+jFV3WkAfMw=";
+    hash = "sha256-ZNGHtscG3JSxHyKfn6d39SamPwkOXkb3xPNgyeo9JmU=";
   };
 
-  npmDepsHash = "sha256-7Ei3roqBrwtdko6qdD88ljRw3MzkgonMyT7fFQDdSpo=";
+  npmDepsHash = "sha256-csxBcYg0iT0iPsRloLwicVqe2Fg+TprG1eZkg6gHSWs=";
 
   dontNpmBuild = true;
 

pkgs/by-name/dr/drone/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.28.1";
+  version = "2.28.2";
 
   src = fetchFromGitHub {
     owner = "harness";
     repo = "drone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p4fsQu46HX8Gc2W/RCvvjI1KZGcN2S/3ZOLty0MHmfg=";
+    hash = "sha256-jKM+jET6dsMe5+QRDKIHA40OOHb/nZmli3owaDB7IvU=";
   };
 
-  vendorHash = "sha256-6a4Xdp8lcPq+GPewQmEPzr9hXjSrqHR7kqw7pqHzjXE=";
+  vendorHash = "sha256-BHfuQ4bloqvdqHK4HSlzHVd9r0yhGkWqLY0XZazwiZQ=";
 
   tags = lib.optionals (!enableUnfree) [
     "oss"

pkgs/by-name/dt/dtsfmt/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "dtsfmt";
+  version = "0.8.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mskelton";
+    repo = "dtsfmt";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2DKfmWnz9Iaxs4VN16BHOzsncEFXaX2mwR2Ta9AyYn0=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-BbX/IEfn5qhyW/IkgARfxD0rTx+hcoq8TmoDmUqclHQ=";
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Auto formatter for device tree files";
+    homepage = "https://github.com/mskelton/dtsfmt";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ toodeluna ];
+    mainProgram = "dtsfmt";
+  };
+})

pkgs/by-name/ea/easyeffects/package.nix

@@ -59,13 +59,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easyeffects";
-  version = "8.1.8";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U0+OGxej5my2KpqzRTiHrB80arkWT1mxHOSxOCDsnb0=";
+    hash = "sha256-HBCYXFFDOhwVebwPIduYNGJ61LFw9lOTZyYmt1k6CuA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ea/easylpac/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  wrapGAppsHook3,
+  makeDesktopItem,
+  copyDesktopItems,
+  gtk3,
+  libglvnd,
+  libxxf86vm,
+  libxrandr,
+  libxi,
+  libxinerama,
+  libxcursor,
+  libx11,
+  libxext,
+  lpac,
+}:
+
+buildGoModule rec {
+  pname = "easylpac";
+  version = "0.8.0.2";
+
+  src = fetchFromGitHub {
+    owner = "creamlike1024";
+    repo = "EasyLPAC";
+    tag = version;
+    hash = "sha256-GxcaMyEaPIGf+/wzmmycmFssTkP5Praj4GCYbxbJU28=";
+  };
+
+  vendorHash = "sha256-52I8hlnoHPhygwr0dxDP50X2A7Gsh0v/0SGQFH3FG/8=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    gtk3
+    libglvnd
+    libxxf86vm
+    libx11
+    libxrandr
+    libxinerama
+    libxcursor
+    libxi
+    libxext
+  ];
+
+  postInstall = ''
+    install -Dm644 assets/icon64.png "$out/share/icons/hicolor/64x64/apps/EasyLPAC.png"
+    install -Dm644 assets/icon128.png "$out/share/icons/hicolor/128x128/apps/EasyLPAC.png"
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ lpac ]}
+    )
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "EasyLPAC";
+      exec = "EasyLPAC";
+      icon = "EasyLPAC";
+      desktopName = "EasyLPAC";
+      comment = "GUI frontend for lpac, a C-based eUICC LPA";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "GUI frontend for lpac, a C-based eUICC LPA";
+    homepage = "https://github.com/creamlike1024/EasyLPAC";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ stargate01 ];
+    mainProgram = "EasyLPAC";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/ec/ecspresso/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "ecspresso";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "kayac";
     repo = "ecspresso";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mcKvjNHpyP6s9D1KVIqZLmSPOUZ0RkXioGXWbRsp3uc=";
+    hash = "sha256-EJP7wvMalb+Usd2NAUUihhbNcWXT7KaB1HM0Ao3RDTM=";
   };
 
   subPackages = [
     "cmd/ecspresso"
   ];
 
-  vendorHash = "sha256-gkCs7wtaRdpA8BY8H309fJKRB8NwMehGvIW8tNNFb/I=";
+  vendorHash = "sha256-G7IA2aQfvvretp310uh/t/u1NiqeJQzIUHdKyJdNDeg=";
 
   ldflags = [
     "-s"

pkgs/by-name/ed/edukai/package.nix

@@ -2,32 +2,32 @@
   stdenvNoCC,
   lib,
   fetchzip,
+  installFonts,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "edukai";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchzip {
-    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai-${version}.zip";
-    sha256 = "sha256-3+w9n6GJQg9+HfHYukC7tlm4GVs8vEOO23hrLw6qjTY=";
+    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai-${finalAttrs.version}.zip";
+    hash = "sha256-B4TwTPX1dsq6rB4YunY6q2yx2OJhNhmn3an/dJwDPJc=";
   };
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    mv *.ttf $out/share/fonts/
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "MOE Standard Kai Font, a Chinese font by the Ministry of Education, ROC (Taiwan)";
     longDescription = ''
-      The MOE Standard Kai Font is a kai (regular srcipt) font
-      provided by
-      the Midistry of Education, Republic of China (Taiwan).
-      It currently includes 13,076 Chinese characters.
+      The MOE Standard Kai Font is a kai (regular script) font
+      provided by the Ministry of Education, Republic of China (Taiwan).
+      It currently includes 13,084 Chinese characters.
     '';
-    homepage = "http://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=47";
+    homepage = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edukai.pdf";
     license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
   };
-}
+})

pkgs/by-name/ed/eduli/package.nix

@@ -2,35 +2,33 @@
   stdenvNoCC,
   lib,
   fetchzip,
+  installFonts,
 }:
 
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "eduli";
   version = "3.0";
 
   src = fetchzip {
-    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-3.0.zip";
+    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-${finalAttrs.version}.zip";
     hash = "sha256-bDQtLugYPWwJJNusBLEJrgIVufocRK4NIR0CCGaTkyw=";
   };
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    for name in *.ttf; do
-      mv "$name" "$out/share/fonts/$(echo $name | sed -r 's/(.*)\(.*\)\.ttf/\1.ttf/')"
-    done
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "MOE Li Font, a clerical Chinese font by the Ministry of Education, ROC (Taiwan)";
     longDescription = ''
-      The MOE Li Font is a li (clerical srcipt) font
-      provided by
-      the Midistry of Education, Republic of China (Taiwan).
+      The MOE Li Font is a li (clerical script) font provided by
+      the Ministry of Education, Republic of China (Taiwan).
       It currently includes 4,808 Chinese characters.
       The clerical script (lishu) is an archaic style of Chinese calligraphy.
     '';
-    homepage = "http://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=49";
+    homepage = "https://language.moe.gov.tw/material/info?m=9fe3fb11-c3d5-41f2-b029-6d18a2c2fd0d";
     license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
   };
-}
+})

pkgs/by-name/ed/edusong/package.nix

@@ -2,30 +2,31 @@
   stdenvNoCC,
   lib,
   fetchzip,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "edusong";
-  version = "4.0";
+  version = "4.4";
 
   src = fetchzip {
     name = "edusong-${finalAttrs.version}";
     url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/eduSong_Unicode.zip";
-    hash = "sha256-4NBnwMrYufeZbgSiD2fAhe4tuy0aAA5u9tWwjQQjEQk=";
+    hash = "sha256-+wH6I0sOfzytstDNT81LMuqknGQuYekl31e1tYaDvRg=";
   };
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/
-    mv eduSong_Unicode*.ttf $out/share/fonts/eduSong_Unicode\(2024年12月\).ttf
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "MOE Song font, a Song-style Chinese character typeface";
     longDescription = ''
       A Song-style Chinese character typeface published by the Ministry of Education of the Republic of China (Taiwan). The Song style is also referred to as 宋體, 宋体, sòngtǐ, 明體, 明体, or míngtǐ, in Chinese; 명조체, 明朝體, or myeongjo in Korean; 明朝体, みんちょうたい, or minchōtai in Japanese.
     '';
-    homepage = "https://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=48";
+    homepage = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/edusun.pdf";
     license = lib.licenses.cc-by-nd-30;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      winterec
+    ];
   };
 })

pkgs/by-name/en/ent-go/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ent-go";
-  version = "0.14.3";
+  version = "0.14.6";
 
   src = fetchFromGitHub {
     owner = "ent";
     repo = "ent";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rKGzYOdNaSbFyHIuytuppYjpiTz1/tcvXel1SjtwEhA=";
+    sha256 = "sha256-pkD8MYyinvuKCtSpHGfFE9y8GRP40qdeyjhB32yeiK4=";
   };
 
-  vendorHash = "sha256-ec5tA9TsDKGnHVZWilLj7bdHrd46uQcNQ8YCK/s6UAY=";
+  vendorHash = "sha256-CCjZv9ef/F+Cx6qmIkG/isX2Dd8WO/1mtjsJ4d8E3m0=";
 
   patches = [
     # patch in version information so we don't get "version = "(devel)";"

pkgs/by-name/es/espflash/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "espflash";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espflash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CeXkC+3M22EmHG0KL0wMXn49bUbxgD33ojQvbeaf5Gs=";
+    hash = "sha256-SXXFXwr+oO+BbBQ/BZgCKhbdcaybVr1JY66q+xM2Quc=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-Vgf3k0pT8VswESXuWIIeZlCFLm861BYrteRFkmhk/3M=";
+  cargoHash = "sha256-ZAp9hEzDrzjYSJLKeMCjAoiybOqPdDLqIGOvBTCr5uU=";
 
   cargoBuildFlags = [
     "--exclude=xtask"

pkgs/by-name/ev/evcc/package.nix

@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.305.0";
+  version = "0.305.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-dkBYIgOEN0n8B4tluiOau436tXgZ1II6vIL61QfUyBg=";
+    hash = "sha256-XRaowjOErq+gAarBNcSydWbjuq4KUQkXb4YBbL7pCas=";
   };
 
   vendorHash = "sha256-dQwbg1gTpDVnNGAN3scvohfsy2LCe4v9eGtNBVdZ1Hs=";