Merge staging-next into staging

ci/eval/compare/maintainers.nix

@@ -96,6 +96,8 @@ let
     (lib.filter (path: lib.length path > 3))
     (map (path: lib.elemAt path 3))
     (map lib.singleton)
+    # Filter out new packages
+    (lib.filter (attrPath: lib.hasAttrByPath attrPath pkgs))
   ];
 
   # An attribute can appear in affected *and* touched

ci/eval/compare/test.nix

@@ -138,6 +138,21 @@ let
         ];
       };
     };
+    testByNameNonExistentChanged = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ ];
+        };
+        # Happens when a new package was added to pkgs/by-name
+        changedFiles = [ "pkgs/by-name/he/hello/sources.json" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
     testByNameReadmeChanged = {
       expr = fun {
         pkgs = mockPkgs {

maintainers/maintainer-list.nix

@@ -2021,6 +2021,12 @@
     name = "Austin Lund";
     keys = [ { fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE"; } ];
   };
+  aporro = {
+    email = "git@aporro.dev";
+    github = "aporro1";
+    githubId = 124402746;
+    name = "Apollon Tsikas";
+  };
   appleboblin = {
     email = "github@appleboblin.com";
     github = "appleboblin";

nixos/doc/manual/redirects.json

@@ -718,12 +718,6 @@
   "module-services-suwayomi-server-extra-config": [
     "index.html#module-services-suwayomi-server-extra-config"
   ],
-  "module-services-immich": [
-    "index.html#module-services-immich"
-  ],
-  "module-services-immich-vectorchord-migration": [
-    "index.html#module-services-immich-vectorchord-migration"
-  ],
   "module-services-paisa": [
     "index.html#module-services-paisa"
   ],

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -382,7 +382,7 @@
 
 - `linux_libre` & `linux_latest_libre` have been removed due to a lack of maintenance.
 
-- Immich now has support for [VectorChord](https://github.com/tensorchord/VectorChord) when using the PostgreSQL configuration provided by `services.immich.database.enable`, which replaces `pgvecto-rs`. VectorChord support can be toggled with the option `services.immich.database.enableVectorChord`. Additionally, `pgvecto-rs` support is now disabled from NixOS 25.11 onwards using the option `services.immich.database.enableVectors`. This option will be removed fully in the future once Immich drops support for `pgvecto-rs` fully. See [Immich migration instructions](#module-services-immich-vectorchord-migration).
+- Immich now has support for [VectorChord](https://github.com/tensorchord/VectorChord) when using the PostgreSQL configuration provided by `services.immich.database.enable`, which replaces `pgvecto-rs`. VectorChord support can be toggled with the option `services.immich.database.enableVectorChord`. Additionally, `pgvecto-rs` support is now disabled from NixOS 25.11 onwards using the option `services.immich.database.enableVectors`. This option will be removed fully in the future once Immich drops support for `pgvecto-rs` fully. See [Immich migration instructions](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
 
 - It is now possible to configure the default source address using the new options [networking.defaultGateway.source](#opt-networking.defaultGateway.source),
   [networking.defaultGateway6.source](#opt-networking.defaultGateway6.source).

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -78,6 +78,8 @@
 
 - [Drasl](https://github.com/unmojang/drasl), an alternative authentication server for Minecraft. Available as [services.drasl](#opt-services.drasl.enable).
 
+- [tabbyAPI](https://github.com/theroyallab/tabbyAPI), the official OpenAI compatible API server for Exllama. Available as [services.tabbyapi](#opt-services.tabbyapi.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -136,6 +138,10 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
+- `services.immich` no longer supports pgvecto.rs since the package has been removed from nixpkgs.
+  As a result, options `services.immich.database.enableVectors` and `services.immich.database.enableVectorchord` have been removed, and VectorChord is now always used.
+  If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the [migration guide](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
+
 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
 
 - `rocmPackages_6` has been removed. `rocmPackages` has been updated to ROCm 7.x. Out of tree packages may rely on obsolete hipblas APIs or compile time constant warp size and need to be updated.

nixos/modules/module-list.nix

@@ -365,6 +365,8 @@
   ./programs/xfs_quota.nix
   ./programs/xonsh.nix
   ./programs/xppen.nix
+  ./programs/xscreensaver/sonar.nix
+  ./programs/xscreensaver/xscreensaver.nix
   ./programs/xss-lock.nix
   ./programs/xwayland.nix
   ./programs/yazi.nix
@@ -1771,6 +1773,7 @@
   ./services/web-apps/strfry.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
+  ./services/web-apps/tabbyapi.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/tuliprox.nix

nixos/modules/programs/foot/default.nix

@@ -75,13 +75,16 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment = {
-      systemPackages = [ cfg.package ];
-      etc."xdg/foot/foot.ini".source = settingsFormat.generate "foot.ini" cfg.settings;
-
-      etc."xdg/autostart/foot-server.desktop".source =
-        lib.mkIf cfg.xdg.serverAutostart "${cfg.package}/share/applications/foot-server.desktop";
-    };
+    environment = lib.mkMerge [
+      {
+        systemPackages = [ cfg.package ];
+        etc."xdg/foot/foot.ini".source = settingsFormat.generate "foot.ini" cfg.settings;
+      }
+      (lib.mkIf cfg.xdg.serverAutostart {
+        etc."xdg/autostart/foot-server.desktop".source =
+          "${cfg.package}/share/applications/foot-server.desktop";
+      })
+    ];
 
     programs = {
       foot.settings.main.include = lib.optionals (cfg.theme != null) [

nixos/modules/programs/xscreensaver/sonar.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs.xscreensaver.sonar;
+  globalCfg = config.programs.xscreensaver;
+in
+{
+  options.programs.xscreensaver.sonar = {
+    enable = lib.mkEnableOption "xscreensaver";
+  };
+  config = lib.mkIf cfg.enable {
+    security.wrappers.sonar = {
+      capabilities = "cap_net_raw+ep";
+      owner = "root";
+      group = "root";
+      source = pkgs.writeShellScript "sonar-fakeroot" ''
+        exec ${lib.getExe pkgs.fakeroot} ${globalCfg.package}/libexec/xscreensaver/sonar "$@"
+      '';
+    };
+  };
+}

nixos/modules/programs/xscreensaver/xscreensaver.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs.xscreensaver;
+in
+{
+  options.programs.xscreensaver = {
+    enable = lib.mkEnableOption "all of the xscreensaver programs";
+    package = lib.mkPackageOption pkgs "xscreensaver" { };
+  };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    programs.xscreensaver.sonar.enable = true;
+  };
+}

nixos/modules/services/web-apps/immich.md

@@ -1,32 +0,0 @@
-# Immich {#module-services-immich}
-
-[Immich](https://immich.app/) is a self-hosted photo and video management
-solution, similar to SaaS offerings like Google Photos.
-
-## Migrating from `pgvecto-rs` to VectorChord (pre-25.11 installations) {#module-services-immich-vectorchord-migration}
-
-Immich instances that were setup before 25.11 (as in
-`system.stateVersion = 25.11;`) will be automatically migrated to VectorChord.
-Note that this migration is not reversible, so database dumps should be created
-if desired.
-
-See [Immich documentation][vectorchord-migration-docs] for more details about
-the automatic migration.
-
-After a successful migration, `pgvecto-rs` should be removed from the database
-installation, unless other applications depend on it.
-
-1. Make sure VectorChord is enabled ([](#opt-services.immich.database.enableVectorChord)) and Immich has completed the migration. Refer to the [Immich documentation][vectorchord-migration-docs] for details.
-2. Run the following two statements in the PostgreSQL database using a superuser role in Immich's database.
-
-    ```sql
-    DROP EXTENSION vectors;
-    DROP SCHEMA vectors;
-    ```
-
-    - You may use the following command to run these statements against the database: `sudo -u postgres psql immich` (Replace `immich` with the value of [](#opt-services.immich.database.name))
-
-3. Disable `pgvecto-rs` by setting [](#opt-services.immich.database.enableVectors) to `false`.
-4. Rebuild and switch.
-
-[vectorchord-migration-docs]: https://immich.app/docs/administration/postgres-standalone/#migrating-to-vectorchord

nixos/modules/services/web-apps/immich.nix

@@ -69,6 +69,30 @@ in
           `services.immich.settings.oauth.clientSecret._secret = "/path/to/secret/file";`
       ''
     )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "immich"
+        "database"
+        "enableVectorChord"
+      ]
+      ''
+        `database.enableVectorChord` has been deprecated as the pgvecto.rs alternative
+        is no longer available. From now on, vectorchord is always enabled.
+      ''
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "immich"
+        "database"
+        "enableVectors"
+      ]
+      ''
+        `database.enableVectors` has been deprecated as pgvecto.rs is no longer available.
+        From now on, vectorchord is used instead.
+      ''
+    )
   ];
 
   options.services.immich = {
@@ -203,17 +227,6 @@ in
         // {
           default = true;
         };
-      enableVectorChord =
-        mkEnableOption "the new VectorChord extension for full-text search in Postgres"
-        // {
-          default = true;
-        };
-      enableVectors =
-        mkEnableOption "pgvecto.rs in the database. You may disable this, if you have migrated to VectorChord and deleted the `vectors` schema."
-        // {
-          default = lib.versionOlder config.system.stateVersion "25.11";
-          defaultText = lib.literalExpression "lib.versionOlder config.system.stateVersion \"25.11\"";
-        };
       createDB = mkEnableOption "the automatic creation of the database for immich." // {
         default = true;
       };
@@ -263,17 +276,6 @@ in
         assertion = !isPostgresUnixSocket -> cfg.secretsFile != null;
         message = "A secrets file containing at least the database password must be provided when unix sockets are not used.";
       }
-      {
-        # When removing this assertion, please adjust the nixosTests accordingly.
-        assertion =
-          (cfg.database.enable && cfg.database.enableVectors)
-          -> lib.versionOlder config.services.postgresql.package.version "17";
-        message = "Immich doesn't support PostgreSQL 17+ when using pgvecto.rs. Consider disabling it using services.immich.database.enableVectors if it is not needed anymore.";
-      }
-      {
-        assertion = cfg.database.enable -> (cfg.database.enableVectorChord || cfg.database.enableVectors);
-        message = "At least one of services.immich.database.enableVectorChord and services.immich.database.enableVectors has to be enabled.";
-      }
     ];
 
     services.postgresql = mkIf cfg.database.enable {
@@ -286,19 +288,12 @@ in
           ensureClauses.login = true;
         }
       ];
-      extensions =
-        ps:
-        lib.optionals cfg.database.enableVectors [ ps.pgvecto-rs ]
-        ++ lib.optionals cfg.database.enableVectorChord [
-          ps.pgvector
-          ps.vectorchord
-        ];
+      extensions = ps: [
+        ps.pgvector
+        ps.vectorchord
+      ];
       settings = {
-        shared_preload_libraries =
-          lib.optionals cfg.database.enableVectors [
-            "vectors.so"
-          ]
-          ++ lib.optionals cfg.database.enableVectorChord [ "vchord.so" ];
+        shared_preload_libraries = [ "vchord.so" ];
         search_path = "\"$user\", public, vectors";
       };
     };
@@ -310,40 +305,27 @@ in
           "cube"
           "earthdistance"
           "pg_trgm"
-        ]
-        ++ lib.optionals cfg.database.enableVectors [
-          "vectors"
-        ]
-        ++ lib.optionals cfg.database.enableVectorChord [
           "vector"
           "vchord"
         ];
-        sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" (
-          # save previous version of vectorchord to trigger reindex on update
-          lib.optionalString cfg.database.enableVectorChord ''
-            SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
-          ''
-          + ''
-            ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions}
-            ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions}
-            ALTER SCHEMA public OWNER TO ${cfg.database.user};
-          ''
-          + lib.optionalString cfg.database.enableVectors ''
-            ALTER SCHEMA vectors OWNER TO ${cfg.database.user};
-            GRANT SELECT ON TABLE pg_vector_index_stat TO ${cfg.database.user};
-          ''
-          # trigger reindex if vectorchord updates
-          # https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
-          + lib.optionalString cfg.database.enableVectorChord ''
-            SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
+        sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
+          -- save previous version of vectorchord to trigger reindex on update
+          SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
 
-            SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
-            \if :has_vchord_updated
-              REINDEX INDEX face_index;
-              REINDEX INDEX clip_index;
-            \endif
-          ''
-        );
+          ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions}
+          ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions}
+          ALTER SCHEMA public OWNER TO ${cfg.database.user};
+
+          -- trigger reindex if vectorchord updates
+          -- https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
+          SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
+
+          SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
+          \if :has_vchord_updated
+            REINDEX INDEX face_index;
+            REINDEX INDEX clip_index;
+          \endif
+        '';
       in
       [
         ''
@@ -480,6 +462,5 @@ in
   };
   meta = {
     maintainers = with lib.maintainers; [ jvanbruegge ];
-    doc = ./immich.md;
   };
 }

nixos/modules/services/web-apps/tabbyapi.nix

@@ -0,0 +1,199 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.tabbyapi;
+  yamlFormat = pkgs.formats.yaml { };
+  configFile = yamlFormat.generate "config.yml" cfg.settings;
+in
+{
+  options.services.tabbyapi = {
+    enable = lib.mkEnableOption "tabbyapi";
+
+    package = lib.mkPackageOption pkgs "tabbyapi" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to open the firewall for the TabbyAPI port.";
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration for TabbyAPI. https://github.com/theroyallab/tabbyAPI/wiki/02.-Server-options
+      '';
+      type = lib.types.submodule {
+        freeformType = yamlFormat.type;
+
+        options = {
+          network = {
+            host = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              description = "The IP to host on. Use 0.0.0.0 to expose on all adapters.";
+            };
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 5000;
+              description = "The port to host on.";
+            };
+
+            disable_auth = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Disable HTTP token authentication. WARNING: Vulnerable if exposed.";
+            };
+
+            api_servers = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ "OAI" ];
+              description = "Select API servers to enable. Options: OAI, Kobold.";
+            };
+          };
+
+          logging = {
+            log_prompt = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Enable prompt logging.";
+            };
+
+            log_requests = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Enable request logging. Only use for debug.";
+            };
+          };
+
+          model = {
+            model_dir = lib.mkOption {
+              type = lib.types.str;
+              default = "models";
+              description = "Directory to look for models. Relative to the state directory.";
+              example = lib.literalExpression ''
+                (pkgs.linkFarm "models" {
+                  qwen-8b = pkgs.fetchgit {
+                    url = "https://huggingface.co/turboderp/Qwen3-VL-8B-Instruct-exl3";
+                    rev = "652ab6be95b3e2880e78d87269013d98ca9c392d"; # 4bpw
+                    fetchLFS = true;
+                    hash = "sha256-n+9Mt7EZ3XHM0w8oGUZr4EBz91EFyp1VBpvl9Php/QM=";
+                  };
+
+                  # Example for patching Qwen 3.5's template to work with OpenWebUI's thinking feature
+                  Qwen3_5-9B = pkgs.applyPatches {
+                    src = pkgs.fetchgit {
+                      url = "https://huggingface.co/turboderp/Qwen3.5-9B-exl3";
+                      rev = "6f8763307a3130ae989269fbc79a8c8e9db5ee42"; # 5.0bpw
+                      fetchLFS = true;
+                      hash = "sha256-Y7Uw/MChXU0Iu9hb3dv+cTtNBwhPbd/I/gYDUjM1j8g=";
+                    };
+                    patches = [ ./qwen-thinking.patch ];
+                  };
+                  # diff --git a/chat_template.jinja b/chat_template.jinja
+                  # index a585dec..68f1b6f 100644
+                  # --- a/chat_template.jinja
+                  # +++ b/chat_template.jinja
+                  # @@ -148,7 +148,5 @@
+                  #     {{- '<|im_start|>assistant\n' }}
+                  #     {%- if enable_thinking is defined and enable_thinking is false %}
+                  #         {{- '<think>\n\n</think>\n\n' }}
+                  # -    {%- else %}
+                  # -        {{- '<think>\n' }}
+                  #     {%- endif %}
+                  # {%- endif %}
+                  # \ No newline at end of file
+                }).outPath;
+              '';
+            };
+
+            model_name = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "The initial model to load on startup. Must exist in model_dir.";
+              example = "Qwen3_5-9B";
+            };
+
+            max_seq_len = lib.mkOption {
+              type = lib.types.nullOr lib.types.int;
+              default = null;
+              description = "Max sequence length. Set null to use model defaults.";
+            };
+
+            cache_mode = lib.mkOption {
+              type = lib.types.str;
+              default = "FP16";
+              description = "Cache mode for VRAM savings. ExLlamaV2: FP16, Q8, Q6, Q4. ExLlamaV3: specific pair string (e.g., '8,8').";
+            };
+
+            gpu_split_auto = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = "Automatically allocate resources to GPUs.";
+            };
+
+            dummy_model_names = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ "gpt-3.5-turbo" ];
+              description = "List of fake model names sent via the /v1/models endpoint.";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.package.passthru.cudaSupport;
+        message = ''
+          TabbyAPI requires CUDA support to function. The configured package does not have CUDA enabled.
+          Consider setting:
+            services.tabbyapi.package = pkgs.pkgsCuda.tabbyapi;
+        '';
+      }
+    ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+      cfg.settings.network.port
+    ];
+
+    systemd.services.tabbyapi = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+      description = "TabbyAPI - OAI compatible server for Exllama";
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
+        Restart = "on-failure";
+        StateDirectory = "tabbyapi";
+        WorkingDirectory = "/var/lib/tabbyapi";
+        User = "tabbyapi";
+        Group = "tabbyapi";
+        DynamicUser = true;
+
+        # Hardening
+        ProtectSystem = "strict";
+        ProtectHome = "yes";
+        LockPersonality = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ BatteredBunny ];
+}

nixos/tests/all-tests.nix

@@ -584,6 +584,7 @@ in
     _module.args.firefoxPackage = pkgs.firefox-esr-140;
   };
   firefox-syncserver = runTest ./firefox-syncserver.nix;
+  firefox_decrypt = runTest ./firefox_decrypt.nix;
   firefoxpwa = runTest ./firefoxpwa.nix;
   firejail = runTest ./firejail.nix;
   firewall = runTest {
@@ -771,7 +772,6 @@ in
   immich = runTest ./web-apps/immich.nix;
   immich-kiosk = runTest ./web-apps/immich-kiosk.nix;
   immich-public-proxy = runTest ./web-apps/immich-public-proxy.nix;
-  immich-vectorchord-migration = runTest ./web-apps/immich-vectorchord-migration.nix;
   immich-vectorchord-reindex = runTest ./web-apps/immich-vectorchord-reindex.nix;
   immichframe = runTest ./web-apps/immichframe.nix;
   incron = runTest ./incron.nix;

nixos/tests/firefox_decrypt.nix

@@ -0,0 +1,73 @@
+{ lib, ... }:
+{
+  name = "firefox_decrypt";
+
+  meta = {
+    maintainers = with lib.maintainers; [ schnusch ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      programs.firefox.enable = true;
+      environment.systemPackages = [ pkgs.firefox_decrypt ];
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    import csv
+    import io
+    import random
+    import string
+
+    machine.wait_for_x()
+
+    expected: dict[str, str] = {
+        "url": "http://localhost",
+        "user": "user",
+        "password": "".join(random.choices(string.ascii_letters + string.digits, k=32)),
+    }
+
+    machine.execute("firefox about:logins >&2 &")
+
+    # press "Add password" button
+    # "Search Passwords" is not found by OCR, probably due to too low contrast.
+    machine.wait_for_text("No passwords saved")
+    for c in ("tab", "\n"):
+        machine.send_key(c)
+
+    # add a new password entry
+    machine.wait_for_text("Add password")
+    for text, control in [
+        (expected["url"], "tab"),
+        (expected["user"], "tab"),
+        (expected["password"], "\n"),
+    ]:
+        with machine.nested(f"typing {repr(text)}"):
+            for c in text:
+                machine.send_key(c, log=False)
+        machine.send_key(control)
+
+    # "Remove" button for our new entry appeared
+    machine.wait_for_text("Remove")
+
+    # close Firefox
+    machine.send_key("ctrl-q")
+    machine.wait_for_text(r"Quit Firefox or close current tab\?")
+    machine.send_key("\n")
+
+    # extract Firefox logins
+    credentials = list(
+        csv.DictReader(
+            io.StringIO(
+                machine.succeed("firefox-decrypt -f csv ~/.config/mozilla/firefox"),
+                newline="",
+            ),
+            delimiter=";",
+        )
+    )
+    assert expected in credentials, f"expected {expected!r} in {credentials!r}"
+  '';
+}

nixos/tests/web-apps/immich-vectorchord-migration.nix

@@ -1,71 +0,0 @@
-{ ... }:
-{
-  name = "immich-vectorchord-migration";
-
-  nodes.machine =
-    { lib, pkgs, ... }:
-    {
-      # These tests need a little more juice
-      virtualisation = {
-        cores = 2;
-        memorySize = 2048;
-        diskSize = 4096;
-      };
-
-      environment.systemPackages = with pkgs; [ immich-cli ];
-
-      services.immich = {
-        enable = true;
-        environment.IMMICH_LOG_LEVEL = "verbose";
-        # Simulate an existing setup
-        database.enableVectorChord = lib.mkDefault false;
-        database.enableVectors = lib.mkDefault true;
-      };
-
-      # TODO: Remove when PostgreSQL 17 is supported.
-      services.postgresql.package = pkgs.postgresql_16;
-
-      specialisation."immich-vectorchord-enabled".configuration = {
-        services.immich.database.enableVectorChord = true;
-      };
-
-      specialisation."immich-vectorchord-only".configuration = {
-        services.immich.database = {
-          enableVectorChord = true;
-          enableVectors = false;
-        };
-      };
-    };
-
-  testScript =
-    { nodes, ... }:
-    let
-      specBase = "${nodes.machine.system.build.toplevel}/specialisation";
-      vectorchordEnabled = "${specBase}/immich-vectorchord-enabled";
-      vectorchordOnly = "${specBase}/immich-vectorchord-only";
-    in
-    ''
-      def psql(command: str):
-        machine.succeed(f"sudo -u postgres psql -d ${nodes.machine.services.immich.database.name} -c '{command}'")
-
-      def immich_works():
-        machine.wait_for_unit("immich-server.service")
-
-        machine.wait_for_open_port(2283) # Server
-        machine.wait_for_open_port(3003) # Machine learning
-        machine.succeed("curl --fail http://localhost:2283/")
-
-      immich_works()
-
-      machine.succeed("${vectorchordEnabled}/bin/switch-to-configuration test")
-
-      immich_works()
-
-      psql("DROP EXTENSION vectors;")
-      psql("DROP SCHEMA vectors;")
-
-      machine.succeed("${vectorchordOnly}/bin/switch-to-configuration test")
-
-      immich_works()
-    '';
-}

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2026-03-04";
+  version = "0.0.27-unstable-2026-03-11";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "865cee5f80db8b7959592f23f174acac36f8be8d";
-    hash = "sha256-5Od/GWzqKpxqprAtmCGSRpJ0E9v6lbVUFK1TzN7G8wo=";
+    rev = "9a7793461549939f1d52b2b309a1aa44680170c8";
+    hash = "sha256-EEkAoufj29P46RIUrRNG0xJL9Wu4X7LZCS1fer4/nZQ=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vscode/extensions/default.nix

@@ -262,8 +262,8 @@ let
         mktplcRef = {
           name = "ng-template";
           publisher = "Angular";
-          version = "20.3.0";
-          hash = "sha256-o3e2qVKw/sfnFHbHHdRlB9UjEx1KLD1KVoaAsnlYjmY=";
+          version = "21.2.2";
+          hash = "sha256-rpll3EsTGEuynrw7EsP3GeltG/vtYqgO8mvTCVyU1ao=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";

pkgs/applications/emulators/libretro/cores/gambatte.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2026-01-16";
+  version = "0-unstable-2026-03-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "9fe223d9c4b615c55840170c6e85e6e9fa4bd1d2";
-    hash = "sha256-BBFT8+TLf5qbwo36BudPjeMRPLdSj2+0m4RnfeFrlOc=";
+    rev = "d3c39fa18476ddce05027db3d29abba813fa74e2";
+    hash = "sha256-FkvO03x6oRqdeaot8vq5C15VjQXJ7tUoJtal7/z09rU=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-01-23";
+  version = "0-unstable-2026-03-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "c858c9c5eebef46ea1a69427091853f9f1edbd23";
-    hash = "sha256-3Rzoy2G517Pc3mAQY+b2dvAMDxUoUmyR8FCyg4BR5bc=";
+    rev = "d446078a385a5acae701f4b3b6b3fd58476d73d3";
+    hash = "sha256-jw8vj3fTHwBH6h+OelVJHNqy86DKFlohhIeQ9TLkGjc=";
   };
 
   meta = {

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "146.0.7680.75",
+    "version": "146.0.7680.80",
     "chromedriver": {
-      "version": "146.0.7680.76",
-      "hash_darwin": "sha256-zCICFkv0dXZYIIp8xnqEbxBR4Q9+GlCEY6yoJHsqcVg=",
-      "hash_darwin_aarch64": "sha256-UzawlFfX/lIATPL8j6XMkurE1SzhNwyB/jn4v6tWY/g="
+      "version": "146.0.7680.80",
+      "hash_darwin": "sha256-sjCEvFWV07GNhXJ9CfGVtZ6nCeqsqtNtY4sPj/gq13w=",
+      "hash_darwin_aarch64": "sha256-kTxZJiF7mJlVbkDDFP4ZUB2htBn45se1Wuz28RP8pr8="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "d865c3fe495882da3a7c6575337a02867c4536b1",
-        "hash": "sha256-/hjpcI4GTw0bGqZ5/9gzM4Pc6/5fhk5dmdtw5EfidiY=",
+        "rev": "f08938029c887ea624da7a1717059788ed95034d",
+        "hash": "sha256-PCQeTdc6Fl74TLyvxjli4scIUIm0GgZ3e9wbC18Tclw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -652,8 +652,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "50841da4a7b7064b3cea8a851e60ef921c87a103",
-        "hash": "sha256-RoLgaE5mj9UqePhnfH+BOTit04TyiAvgF7/2PLuBG4Y="
+        "rev": "248acd90d9a35ac46b2ec30201ae50f301b8a173",
+        "hash": "sha256-zOL5j9X72ZvYmS8MzQ+pqSkT8AWBz2IwmaH7I3LN1IE="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1400,13 +1400,13 @@
     "vendorHash": null
   },
   "ubiquiti-community_unifi": {
-    "hash": "sha256-2IYiy/DLCj+bcEkU+nwLg7Wt2j7bh29cScPcSTGsU5A=",
+    "hash": "sha256-Y3MgMRhWmXYp0aYLIkV2Ug5bZb8LsPYr3oJkXhPtQoo=",
     "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
     "owner": "ubiquiti-community",
     "repo": "terraform-provider-unifi",
-    "rev": "v0.41.17",
+    "rev": "v0.41.25",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rixXMK+M6/8g4cw/f+zNzY9x3GkA3nqmkQTPrONoueY="
+    "vendorHash": "sha256-OVdhM8Zqnm1J8KducnkNkroBoSLER3fHfZBjyp7kBu8="
   },
   "ucloud_ucloud": {
     "hash": "sha256-UOVnfWYhntmRHMApQgemjUBsyUIz0bexsc1gwDGGee4=",

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -65,8 +65,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "148.0";
-    sha512 = "ec5e586206ef217f37eb6985356994e7e7c9db6090f57d5b4c43a3a5dc0e1f5a56c0e7080d86fb895446845f9c9b948284f7417afebcf6e6120eca0e1ed238f3";
+    version = "148.0.1";
+    sha512 = "4f6e721b0858bece740f04744d10d8bb0b0673d2ebfe5624d3797e28e394510a8518dc31fc6a121ba7ed8a5a44953efefe3a74071e9f967c22be17cee45b3faf";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/by-name/an/angular-language-server/package.nix

@@ -15,11 +15,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "21.2.0";
+  version = "21.2.2";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/angular/releases/download/vsix-${finalAttrs.version}/ng-template-${finalAttrs.version}.vsix";
-    hash = "sha256-q9ywNxdKLz431nCEzPs2sB8IDPveoUWAthmDKkBAkHI=";
+    hash = "sha256-rpll3EsTGEuynrw7EsP3GeltG/vtYqgO8mvTCVyU1ao=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apidog/package.nix

@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.11";
+  version = "2.8.12";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-+nilQYbkfS8z3J4CbD9jC1nm/zY3fX+bl8eNsaLOHVA=";
+    hash = "sha256-bCh3GW+K++3eI3SdcD5t7Vk1jYPl4KFWr1dwqXL7fOQ=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -155,6 +155,10 @@ stdenv.mkDerivation (finalAttrs: {
               "TestS3FS.*"
               "TestS3FSGeneric.*"
               "TestS3FSHTTPS.*" # Needs Minio
+            ]
+            ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+              # https://github.com/apache/arrow/issues/41505
+              "TestAzuriteGeneric.Empty"
             ];
         in
         "-${lib.concatStringsSep ":" filteredTests}";
@@ -307,10 +311,6 @@ stdenv.mkDerivation (finalAttrs: {
         # Failing with "run-test.sh: line 88: 63682 Abort trap: 6"
         "arrow-flight-internals-test"
         "arrow-flight-sql-test"
-      ]
-      ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-        # https://github.com/apache/arrow/issues/41505
-        "TestAzuriteGeneric.Empty"
       ];
     in
     ''

pkgs/by-name/at/atproto-goat/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atproto-goat";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "goat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jSwlKKMrUsb0stcPvC9i7dgH4DrlnUTwp+HYTwendB0=";
+    hash = "sha256-mI7GC0ElE+FxT7v29V/a+UZBI1d6os+HpEO5WYWxm6A=";
   };
 
   postPatch = ''
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
       --replace-fail '"github.com/earthboundkid/versioninfo/v2"' ""
   '';
 
-  vendorHash = "sha256-rqnCFBSmHaZWWc1MrK8udQLkK5MP4Yv2TTlozQqW0fc=";
+  vendorHash = "sha256-QVnpISwYri8aL4umZWi2LJ0X13CXXK7JygaBh1Sq5PA=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bi/biome/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-xwnNTefv3E6Y27G8cSRNs9adXwzP2w3XK6xX1QEs60g=";
+    hash = "sha256-Ca1a8Q6YJpGUMZ3cbQkIndmeE10V7myB/3EQ4r3fa1o=";
   };
 
-  cargoHash = "sha256-Uf+W+f17DMKOYR/KYiyEd+RU/bPMq+itbpHfCAq+7R4=";
+  cargoHash = "sha256-z2JtrZkvlvfQGhhY3T3PIiXUq53bSb7Z8rgvGZPzPag=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/bq/bqn/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bqn";
-  version = "0-unstable-2024-05-13";
+  version = "0-unstable-2026-03-01";
 
   src = fetchFromGitHub {
     owner = "mlochbaum";
     repo = "BQN";
-    rev = "c971a177421d532a13c4b7515535552df19681e1";
-    hash = "sha256-Fru1IIb4IxBQxrEEBoRYStxBqYJJqd+Q+Hwyk++QA68=";
+    rev = "df1d848328194249e68635f8b8c04641d9fa6bdc";
+    hash = "sha256-2S675ru67bcSSXGLEWfPkyW+U+cHzKs/HbM8ZSWMcEs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/c2/c2patool/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.33";
+  version = "0.26.37";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-e016wNfAVhDFwCYvBb/I+nci1FVSG/knsPZFhsR4074=";
+    hash = "sha256-bxiYY55r1Vg8ljoGlUBi5WgAU8GtcEsX030uzfMsals=";
   };
 
-  cargoHash = "sha256-KCL3GhNb1ilKXXjj6DSnLTbSNfevAYDUuJt01y4bDVE=";
+  cargoHash = "sha256-AJr4auizFqumMaQzFd5G1keSIRJ3fWX7ftGHDTkPmX0=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/ca/carapace/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace";
-  version = "1.6.0";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-btExAFj3nnq5vv3LJgUA7pdmQhd6ANUexC/AQcIg0Ms=";
+    hash = "sha256-k6fWtwDTNc2qcr9ryL7wMVy744fiP8NrLqm4crVr+EI=";
   };
 
-  vendorHash = "sha256-7Gmt4ZHmYK5IukQYuY0felhW+ul23wSDX9PJyI6rDWQ=";
+  vendorHash = "sha256-5AqoM16M5pPfRYxqa72LrHJRRatK2qnZK3pQIoFXG9g=";
 
   proxyVendor = true;
 

pkgs/by-name/cc/ccache/package.nix

@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ccache";
-  version = "4.12.3";
+  version = "4.13.1";
 
   src = fetchFromGitHub {
     owner = "ccache";
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
         exit 1
       fi
     '';
-    hash = "sha256-oX7qG3jjrLm4gKZd8w7Bc7uE5U5sIa35//PDRJ/XHcM=";
+    hash = "sha256-8Qw5nkY86wGJ7B2hrNk9jIoz18nJ2FK+EbPH5fS5aEc=";
   };
 
   outputs = [
@@ -62,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    patchShebangs --build doc/scripts
     patchShebangs --build test/fake-compilers
   '';
 
@@ -98,8 +99,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   disabledTests = [
-    "test.trim_dir" # flaky on hydra (possibly filesystem-specific?)
+    "test.direct" # https://github.com/ccache/ccache/issues/1699
     "test.fileclone" # flaky on hydra, also seems to fail on zfs
+    "test.trim_dir" # flaky on hydra (possibly filesystem-specific?)
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test.basedir"

pkgs/by-name/cf/cfripper/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cfripper";
-  version = "1.19.1";
+  version = "1.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7lFHtdicpoZ3ZhwKeRhjex3tK+0aOzKD44Q7njOR2l4=";
+    hash = "sha256-uJy1n+bZgmKZpyu1MmbHgKeEOl5onUuQI3ZAlLgY+v4=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/co/coeurl/package.nix

@@ -12,18 +12,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coeurl";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     domain = "nheko.im";
     owner = "nheko-reborn";
     repo = "coeurl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NGplM5c/dMGSQbhKeuPOTWL8KsqvMd/76YuwCxnqNNE=";
+    hash = "sha256-8BwyPfLgkJG1CHnRAKxgn8ObEGSK+lKKUhQibs1dCg4=";
   };
-  postPatch = ''
-    substituteInPlace subprojects/curl.wrap --replace '[provides]' '[provide]'
-  '';
 
   nativeBuildInputs = [
     ninja

pkgs/by-name/co/collision/package.nix

@@ -21,13 +21,13 @@
 
 crystal.buildCrystalPackage rec {
   pname = "Collision";
-  version = "3.11.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "GeopJr";
     repo = "Collision";
-    rev = "v${version}";
-    hash = "sha256-OCFy7DFSRsqiw+b6zlJy9Us44zQXf150zVDu3GmclOk=";
+    tag = "v${version}";
+    hash = "sha256-GcCqItSHUhhS0yrOM8bMzkVsVHyC97c+yccw5ZP61IU=";
   };
 
   postPatch = ''
@@ -100,9 +100,6 @@ crystal.buildCrystalPackage rec {
         supportedFeatures = [ "silent" ];
       }
     ];
-    shardLock = runCommand "shard.lock" { inherit src; } ''
-      cp $src/shard.lock $out
-    '';
   };
 
   meta = {

pkgs/by-name/co/collision/shards.nix

@@ -11,13 +11,13 @@
   };
   "gi-crystal" = {
     url = "https://github.com/hugopl/gi-crystal.git";
-    rev = "v0.25.0";
-    sha256 = "0lgs85khg6yzmw7vnkjxygrga1618440hayjc51jmjcfh2lff1k2";
+    rev = "v0.25.1";
+    sha256 = "0283isgrann4r3ily8c7fip0x6h947g9s3hgmrja0m6si3lkgizs";
   };
   "gtk4" = {
     url = "https://github.com/hugopl/gtk4.cr.git";
-    rev = "v0.17.0";
-    sha256 = "0lv3nvsanxi4g2322zvkf1jxx5zgzaapk228vcw2cl0ja1drm06d";
+    rev = "v0.18.0";
+    sha256 = "03kab6nbkgxnnrp7g0gr4cv7rjsp7y8m7kz2rzb1ci63qzkzqlqi";
   };
   "harfbuzz" = {
     url = "https://github.com/hugopl/harfbuzz.cr.git";

pkgs/by-name/cu/curtail/package.nix

@@ -22,14 +22,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "curtail";
-  version = "1.14.0";
+  version = "1.15.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Huluti";
     repo = "Curtail";
     tag = finalAttrs.version;
-    sha256 = "sha256-AxQe7abHZp4SRp90fkFbmXf3ZQH3VmxQVkpxRcit+54=";
+    hash = "sha256-1X3isnhl5Lw+iVLM2WdZEaKphLiikBtg5QlSxgQHqy8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dolphin-emu/package.nix

@@ -55,13 +55,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolphin-emu";
-  version = "2512";
+  version = "2603";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
     tag = finalAttrs.version;
-    hash = "sha256-VmDhYZfYyzf08FXZTeBYmdEp9P8AugUpiOxNj8aEJqw=";
+    hash = "sha256-9kB5hFAJwLkFi2y5c5ZavwcnXRDE5bxerg5E1hPAutY=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''

pkgs/by-name/ea/easyeffects/package.nix

@@ -68,8 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Tz14pjI5pNJOQH0KFaf9mJkFdup1GVxlkMnzVQusx/M=";
   };
 
-  patches = [ ./qmlmodule-fix.patch ];
-
   nativeBuildInputs = [
     cmake
     extra-cmake-modules

pkgs/by-name/ea/easyeffects/qmlmodule-fix.patch

@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2736ac18b..85be09a90 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -65,7 +65,7 @@ find_package(KF${QT_MAJOR_VERSION} REQUIRED COMPONENTS
-     QQC2DesktopStyle
- )
- 
--ecm_find_qmlmodule(org.kde.kirigami REQUIRED)
-+ecm_find_qmlmodule(org.kde.kirigami)
- 
- qt_policy(SET QTP0001 NEW)

pkgs/by-name/em/emblem/package.nix

@@ -18,20 +18,22 @@
 
 stdenv.mkDerivation rec {
   pname = "emblem";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     group = "World";
     owner = "design";
     repo = "emblem";
-    rev = version;
-    sha256 = "sha256-knq8OKoc8Xv7lOr0ub9+2JfeQE84UlTHR1q4SFFF8Ug=";
+    tag = version;
+    hash = "sha256-OqP6KLaDix4hR/AA+lfaMu4nZPqpAKfYzZu7tr+RUJI=";
+    # Temporary workaround for https://github.com/NixOS/nixpkgs/issues/485701
+    forceFetchGit = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-CsISaVlRGtVVEna1jyGZo/IdWcJdwHJv6LXcXYha2UE=";
+    hash = "sha256-J00zw8jOeMLjGyn2Gj4TA5vHjIWOw+x/XEIXMyBFMdw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/everest-bin/package.nix

@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6170";
+  version = "6194";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6170.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6194.0/main.zip";
     extension = "zip";
-    hash = "sha256-tMovLxTHbBvqQ+e8GLaLIel2hSchuFXnOfnytgSKfsY=";
+    hash = "sha256-Ja/b/5kKekBZZbqp0o2I8dvtiQ/rRa2kS6Q+08yBX7I=";
   };
   buildInputs = [
     icu

pkgs/by-name/ev/everest/package.nix

@@ -11,8 +11,8 @@
 
 let
   pname = "everest";
-  version = "6170";
-  rev = "62ef4d0c36f433fa3a26502eabe6cda5ff205fbc";
+  version = "6194";
+  rev = "5adc0e7ae6087ba90f9dd1cad487cf4dde1d493b";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -25,7 +25,7 @@ buildDotnetModule {
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-OumeSvcWX3/zot7akcQea7jUQH0rL5/E0HzhITGPedA=";
+    hash = "sha256-GG3cxrMZRSHoUzewHEQvljXSgHWcF9GNunlyWbiKrQo=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];

pkgs/by-name/fi/firefox_decrypt/package.nix

@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   nss,
+  nixosTests,
   nix-update-script,
   stdenv,
   python3Packages,
@@ -9,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "firefox_decrypt";
-  version = "1.1.1";
+  version = "1.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "unode";
     repo = "firefox_decrypt";
     tag = finalAttrs.version;
-    hash = "sha256-HPjOUWusPXoSwwDvW32Uad4gFERvn79ee/WxeX6h3jY=";
+    hash = "sha256-Y958qXGpkNgMBYiM80OKQYkO7EdqH7T5FfINELAB9CY=";
   };
 
   build-system = with python3Packages; [
@@ -32,12 +33,28 @@ python3Packages.buildPythonApplication (finalAttrs: {
     (lib.makeLibraryPath [ nss ])
   ];
 
-  passthru.updateScript = nix-update-script { };
+  checkPhase = ''
+    runHook preCheck
+
+    patchShebangs tests
+    (cd tests && ${
+      if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"
+    }=${lib.makeLibraryPath [ nss ]} ./run_all)
+
+    runHook postCheck
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) firefox_decrypt;
+    };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     homepage = "https://github.com/unode/firefox_decrypt";
     description = "Tool to extract passwords from profiles of Mozilla Firefox and derivates";
-    mainProgram = "firefox_decrypt";
+    mainProgram = "firefox-decrypt";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       schnusch

pkgs/by-name/fl/flix/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "flix";
-  version = "0.67.2";
+  version = "0.69.1";
 
   src = fetchurl {
     url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-MWK6Az135IHIzXMUQeHyeb2PROXyeLKyFjIUnDD47T8=";
+    sha256 = "sha256-UgYMaZ/v99dmfSUekU2xSOoJecrmvUoVfO5eYm9prZw=";
   };
 
   dontUnpack = true;

pkgs/by-name/fl/fluvio/package.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+  kubernetes-helm,
+  gitMinimal,
+  installShellFiles,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "fluvio-cli";
+  version = "0.18.1";
+
+  src = fetchFromGitHub {
+    owner = "fluvio-community";
+    repo = "fluvio";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7kGMOAzBGrMOMj4Fyvy9xVwTGEkee5W7JAldbyTV298=";
+  };
+
+  cargoHash = "sha256-OAw/nftF63WyE3E+zaVCYYXh37p6HB0ib7WModfXKBA=";
+
+  nativeBuildInputs = [
+    # Necessary because of a hard dependency to the openssl-src rust crate
+    perl
+    kubernetes-helm
+    installShellFiles
+    # Needed by build.rs scripts
+    gitMinimal
+  ];
+
+  cargoBuildFlags = [
+    "-p"
+    "fluvio-cli"
+    "-p"
+    "fluvio-run"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "fluvio-cli"
+    "-p"
+    "fluvio-run"
+  ];
+
+  # Patch to make cargoAuditable work
+  postPatch = ''
+    substituteInPlace crates/fluvio-cli-common/Cargo.toml \
+      --replace-fail '"dep:fluvio-sc-schema"' '"fluvio-sc-schema"'
+  '';
+
+  # asset generation
+  preBuild = ''
+    make -C k8-util/helm package
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd fluvio \
+      --bash <($out/bin/fluvio completions bash) \
+      --fish <($out/bin/fluvio completions fish) \
+      --zsh <($out/bin/fluvio completions zsh)
+  '';
+
+  meta = {
+    description = "Event stream processing for developers";
+    homepage = "https://fluvio.io/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ aporro ];
+    mainProgram = "fluvio";
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/foot/package.nix

@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.26.0";
+  version = "1.26.1";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     tag = version;
-    hash = "sha256-XnGNrQVdSyg5CVBZBwrqDPbf4/+9yyerGBrZArbh6xI=";
+    hash = "sha256-N9/lxbz9nLIGC7VyuRbNbuX0K0XAxhytLzsU16BMCWY=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/fs/fsnav/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  freetype,
+  libpng,
+  libjpeg,
+  libGL,
+  libGLU,
+  freeglut,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fsnav";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "jtsiomb";
+    repo = "fsnav";
+    tag = "v${version}";
+    hash = "sha256-Bt1QRqtJkVFR1uMzmB3OUyqyzUyJdQyQdbMOfMyWJOc=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    freetype
+    libpng
+    libjpeg
+    libGL
+    libGLU
+    freeglut
+  ];
+
+  preBuild = ''
+    makeFlagsArray+=(
+      "PREFIX=$out"
+      "CC=$CC"
+      "CXX=$CXX"
+    )
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/fsnav
+  '';
+
+  meta = {
+    description = "3D filesystem navigator inspired by SGI FSN";
+    homepage = "https://github.com/jtsiomb/fsnav";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ aaravrav ];
+    mainProgram = "fsnav";
+    platforms = with lib.platforms; linux;
+    broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  };
+
+}

pkgs/by-name/gi/gitea/package.nix

@@ -26,8 +26,8 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      fetcherVersion = 2;
-      hash = "sha256-0p7P68BvO3hv0utUbnPpHSpGLlV7F9HHmOITvJAb/ww=";
+      fetcherVersion = 3;
+      hash = "sha256-Atb6m5ZD9NKjYezFnYLnQqnlr72g5dz7ROfOF9fsqto=";
     };
 
     nativeBuildInputs = [
@@ -48,18 +48,18 @@ let
 in
 buildGoModule rec {
   pname = "gitea";
-  version = "1.25.4";
+  version = "1.25.5";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${gitea.version}";
-    hash = "sha256-sVpCdDJWzHtRKiqTeRuvrHf/cmeLbLs4THAqkH8hqMY=";
+    hash = "sha256-EDj/n4dOZsdJx4zdP8GwUavZNK145Q8ENXmIL+81MY4=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-y7HurJg+/V1cn8iKDXepk/ie/iNgiJXsQbDi1dhgark=";
+  vendorHash = "sha256-o7OIVo0/gunGMIDd0r6c9KDtku6pWwzmgm1X9qVbx4w=";
 
   outputs = [
     "out"

pkgs/by-name/go/goperf/package.nix

@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "goperf";
-  version = "0-unstable-2026-02-09";
+  version = "0-unstable-2026-03-11";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "b57e4e371b65454dd44026af9d45c69605bc0c3c";
-    hash = "sha256-Sz7Fq0H+ikccAfaJirKHLIA+P4ZqMPS3S/Vj7WrGFy4=";
+    rev = "16a31bc5fbd0f58f2e8e2a496d8e035bdc4a2e06";
+    hash = "sha256-be0vWFJUXTPWKapd+rX3Stnzra9LUGNEw+4P+fWzjyk=";
   };
 
-  vendorHash = "sha256-kGF184E+rOWncQsvjk1iCpF26/3Ll/IY9CPEh6vhRBQ=";
+  vendorHash = "sha256-oBSd0D66BGfanCADtrpyIoUit8c+yHk8Nm6o2GmKoZg=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf

pkgs/by-name/go/got/package.nix

@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.121";
+  version = "0.123";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1A6+69IkCAzalhEVcuhj6KO/IjXIqVOifiRRGomIIJo=";
+    hash = "sha256-U655XwPi7k9Glr+FdoqafWSkc/IGIvzIUI+iRswohSY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/grafana-image-renderer/package.nix

@@ -6,19 +6,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana-image-renderer";
-  version = "5.6.2";
+  version = "5.7.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rbR+TGkTWIpHeGxOQtVQFIeTv1/p8rGfbFp6hSSXQco=";
+    hash = "sha256-0n9esm8j3zRMUzFPrXrcllEen+F6XpL3yPY5KBY8H9g=";
   };
 
   vendorHash = "sha256-nRwd1luj8AFjDM67KtinVxRd31lUO+Vv3PDnsv2BMZU=";
 
   postPatch = ''
-    substituteInPlace go.mod --replace-fail 'go 1.25.6' 'go 1.25.5'
+    substituteInPlace go.mod --replace-fail 'go 1.26.1' 'go 1.25.7'
   '';
 
   subPackages = [ "." ];

pkgs/by-name/gv/gvfs/package.nix

@@ -49,11 +49,11 @@
 assert googleSupport -> gnomeSupport;
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvfs";
-  version = "1.58.2";
+  version = "1.58.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${lib.versions.majorMinor finalAttrs.version}/gvfs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-rZ1b8LRcryMlIN8K3uUetlAgCwNwaA+Ao1Dq2dHWHd8=";
+    hash = "sha256-5xJL7HJOJlrQ7gC6on2NUVzx3dzxAmOL5nueJZybBA0=";
   };
 
   patches = [

pkgs/by-name/ha/hardinfo2/package.nix

@@ -143,7 +143,7 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath finalAttrs.runtimeLibs}
 
       substituteInPlace $out/lib/systemd/system/hardinfo2.service \
-        --replace-fail "ExecStart=/usr/bin/hwinfo2_fetch_sysdata" "ExecStart=$out/hwinfo2_fetch_sysdata"
+        --replace-fail "ExecStart=/usr/bin/hwinfo2_fetch_sysdata" "ExecStart=$out/bin/hwinfo2_fetch_sysdata"
   '';
 
   # account for tags having a release- prefix

pkgs/by-name/im/immich/package.nix

@@ -224,7 +224,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
-      inherit (nixosTests) immich immich-vectorchord-migration immich-vectorchord-reindex;
+      inherit (nixosTests) immich immich-vectorchord-reindex;
     };
 
     machine-learning = immich-machine-learning.override {

pkgs/by-name/je/jemalloc/package.nix

@@ -13,8 +13,31 @@
   # compatibility.
   stripPrefix ? stdenv.hostPlatform.isDarwin,
   disableInitExecTls ? false,
+  # Page size in KiB to configure jemalloc for.
+  # Defaults to 64 on architectures where 64KB pages are common, 4 otherwise.
+  # Note that a higher value is compatible with lower page sizes but may waste memory.
+  pageSizeKiB ?
+    if
+      (
+        stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64 || stdenv.hostPlatform.isPower64
+      )
+    then
+      64
+    else
+      4,
 }:
 
+let
+  pageSizeMap = {
+    "4" = 12;
+    "16" = 14;
+    "64" = 16;
+  };
+in
+assert lib.asserts.assertOneOf "pageSizeKiB" (toString pageSizeKiB) (
+  builtins.attrNames pageSizeMap
+);
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "jemalloc";
   version = "5.3.0-unstable-2025-09-12";
@@ -54,12 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/jemalloc/jemalloc/issues/467
   # https://sources.debian.org/src/jemalloc/5.3.0-3/debian/rules/
   ++ [
-    (
-      if (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64) then
-        "--with-lg-page=16"
-      else
-        "--with-lg-page=12"
-    )
+    "--with-lg-page=${toString pageSizeMap."${toString pageSizeKiB}"}"
   ]
   # See https://github.com/jemalloc/jemalloc/issues/1997
   # Using a value of 48 should work on both emulated and native x86_64-darwin.

pkgs/by-name/ka/kargo/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kargo";
-  version = "1.8.6";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sBUgoR3Eqv2OQRnXR9IaB4QcZ+awJb3ah7ySZ0XsaYA=";
+    hash = "sha256-jdRba3n9jGpZIp8E7Fz4DC3eDV4GK+MpuxBpYhpR60o=";
   };
 
-  vendorHash = "sha256-ZB1Eq8xQ/oF5sm750K9yJyBpwCIcCqmFL8FWpNsiXfo=";
+  vendorHash = "sha256-ir73yLXLOs6/6YX72EeyMcGLsImRkGmH4vppwKeOD+A=";
 
   subPackages = [ "cmd/cli" ];
 

pkgs/by-name/ko/kontainer/package.nix

@@ -22,11 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-15H4fTZ4Tja+nt0iKtFuULj/4g/0UK+W79R4kH7BFcs=";
   };
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "ecm_find_qmlmodule(org.kde.kirigami REQUIRED)" "ecm_find_qmlmodule(org.kde.kirigami)"
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja

pkgs/by-name/la/ladybugdb/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybugdb";
-  version = "0.14.2";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "LadybugDB";
     repo = "ladybug";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hc0SltZYreENpa3PyCSgj72tSVVIiIJRQSN0f33iPr8=";
+    hash = "sha256-wqvX6yPhh1CbviPgcRW4XOmNjLe5s9FaqHYDFs7GQOg=";
   };
 
   outputs = [

pkgs/by-name/li/lighthouse/package.nix

@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "8.1.0";
+  version = "8.1.2";
 
   # lighthouse/common/deposit_contract/build.rs, `TAG`
   depositContractSpecVersion = "0.12.1";
@@ -28,14 +28,14 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     tag = "v${version}";
-    hash = "sha256-+MF3KbyKbaEBsrNHQOOolfhl4uJ1laOL1eGtcWEoaLE=";
+    hash = "sha256-Gtx5wowQM9jycy2Bl0FFGkgOZtyRvK3lMuc3K9v9sW4=";
   };
 
   patches = [
     ./use-system-sqlite.patch
   ];
 
-  cargoHash = "sha256-6C0rDVsF0wIcApc2YL3qC/Xa9qby9GDbQYGiaaJuH0k=";
+  cargoHash = "sha256-tmOEcxcMbGtOypNcxIbqfdlvFmNix21iIsRWVcFxJC4=";
 
   buildFeatures = [
     "gnosis"

pkgs/by-name/li/linyaps/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linyaps";
-  version = "1.11.2";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "OpenAtom-Linyaps";
     repo = finalAttrs.pname;
     tag = finalAttrs.version;
-    hash = "sha256-FpmsrH4Xphf4QKtAJEaoVdE9S7hWlCayDbEnYZ9o4iI=";
+    hash = "sha256-5vbCic+kAa1c5Io92LyJ20y+/v3M3fKh+AHKaf7kP14=";
   };
 
   patches = [

pkgs/by-name/lo/lock/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lock";
-  version = "1.8.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "konstantintutsch";
     repo = "Lock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8vJK9uvmm3GtQcJ/6L0R8Y9gAv1W07asfKmDYZyeEOQ=";
+    hash = "sha256-UXTkrH+b4HIi+QC85gjASAFHgf0BQEZ6RkC99FksqsU=";
   };
 
   strictDeps = true;

pkgs/by-name/ma/mate-terminal/package.nix

@@ -1,7 +1,10 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoconf-archive,
+  autoreconfHook,
+  mate-common,
   pkg-config,
   gettext,
   itstool,
@@ -11,27 +14,35 @@
   vte,
   pcre2,
   wrapGAppsHook3,
+  yelp-tools,
   gitUpdater,
   nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mate-terminal";
-  version = "1.28.1";
+  version = "1.28.2";
 
-  src = fetchurl {
-    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor finalAttrs.version}/mate-terminal-${finalAttrs.version}.tar.xz";
-    sha256 = "8TXrGp4q4ieY7LLcGRT9tM/XdOa7ZcAVK+N8xslGnpI=";
+  src = fetchFromGitHub {
+    owner = "mate-desktop";
+    repo = "mate-terminal";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-tyYHMn+qwytpSNUZg4xfwnuVClxj2IcyB4C4Dsn+1Nc=";
   };
 
   strictDeps = true;
 
   nativeBuildInputs = [
+    autoconf-archive
+    autoreconfHook
     gettext
     itstool
+    mate-common # mate-common.m4 macros
     pkg-config
     libxml2 # xmllint
     wrapGAppsHook3
+    yelp-tools
   ];
 
   buildInputs = [
@@ -44,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {
-    url = "https://git.mate-desktop.org/mate-terminal";
     odd-unstable = true;
     rev-prefix = "v";
   };

pkgs/by-name/me/metabase/package.nix

@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
-  version = "0.59.1";
+  version = "0.59.2";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
-    hash = "sha256-pPJdFljzzNuhRvH6ofPkNGq0Ly/RpHcqeQQh3JTG08I=";
+    hash = "sha256-k1UfpSHOBsFZF85q0LhuiC9L5R8fbSnZBRB5MjBUh+M=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/mp/mpls/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mpls";
-  version = "0.17.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "mhersson";
     repo = "mpls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RJadJEIwBdDtZZxPSm12WYVKrIAOc1EvSxLrkhs4sx4=";
+    hash = "sha256-a33XbUw6H2EKfGZnpV6L00iab6AoXqPiNTMw/OaouHs=";
   };
 
-  vendorHash = "sha256-QtNQnJtYLmSTTLwKKQ8P6O6wyctgwN8OcGZkMXa+Ark=";
+  vendorHash = "sha256-pi7KBA/313cG0AYWM/mUDng2M9L2tMLkonY4LI5XiW0=";
 
   ldflags = [
     "-s"

pkgs/by-name/ne/nerva/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EZQQLXN9eixL3BUSn6VAaKPe9uA3uW1l6zfzq3bG+vk=";
+    hash = "sha256-X39P/4OrRDwZieCDVaMj0YJhotZ0PHMGVgN5ky5+pDk=";
   };
 
-  vendorHash = "sha256-h3pxl84P7dUmXJJ9t/Rnzx0oJcGnA+7ytGWhk401ecY=";
+  vendorHash = "sha256-c8dkMsuzBuHBPBTHAhwMgpGLUVLkzBmItnp1QAUBQSI=";
 
   ldflags = [
     "-s"

pkgs/by-name/ne/nezha/package.nix

@@ -48,13 +48,13 @@ let
 in
 buildGo126Module (finalAttrs: {
   pname = "nezha";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JzdjIAeWswW/6ZnwfRZAexzl/ehvzKmyiNyzCHBDqgA=";
+    hash = "sha256-g5mXt0NfRFezLmQ27FAE+wU+a+sSHlCzx2oh/z1Xz+I=";
   };
 
   proxyVendor = true;

pkgs/by-name/nf/nfpm/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nfpm";
-  version = "2.45.0";
+  version = "2.45.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "nfpm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sz6+oUvEi3iYKLRxHaeP2T+9m5CavgIzZIz8wuSfM+M=";
+    hash = "sha256-ThoCDsuz52odVLVJuT4F96sjtqOOzjqq7JIE5Idzl1k=";
   };
 
-  vendorHash = "sha256-tEuNOBBUnJNjk1Mao8A7KtuPIdkxsmj+yp8fuovOK0s=";
+  vendorHash = "sha256-cq0pcbC0T3klh3D9l0e0u5JPYv1kWYlpeNYyGczGX+A=";
 
   ldflags = [
     "-s"

pkgs/by-name/ol/ollama/package.nix

@@ -137,13 +137,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.17.7";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cAqc38NHvUo5gphq1csTyosTcpUjFcs0dzB0wreEGjs=";
+    hash = "sha256-nnVuWjx3ZmAjHRPmsh+ut4UzzZxq6b7kXf0jq2ZsbXU=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";

pkgs/by-name/ox/oxker/package.nix

@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxker";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-cTusvvxr2ec2Qy6iWwGRmPcvGpRMOKxzrAx/qRvj+BE=";
+    hash = "sha256-4rIqZOWYqd7zUrDmEIZTH7iDRzed8on6UeP871M/KAI=";
   };
 
-  cargoHash = "sha256-X5iNAwp0DcXoT82ZLq37geifztvJ/zZgOgM3SycAazA=";
+  cargoHash = "sha256-/Uw8IDVHmWpClAwWol2t10biDD3AGkZQDz5fmRSLlRI=";
 
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_one_definition"

pkgs/by-name/ox/oxlint/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxlint";
-  version = "1.51.0";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-J5EChGADug+SEvhjStyS1s5kek5QNc2VrjEa5MEWTpA=";
+    hash = "sha256-A2cq1WgZg8csNGB3yFNo21450f46n4ZVblke1yqlBCc=";
   };
 
-  cargoHash = "sha256-chNxYraN9upILXCqDQ/TrN3xiKhxKhZlN2HGrPF4qT8=";
+  cargoHash = "sha256-Oz9u2+5lq+z9A81BEn2T4jvVMqf1uNXip+OH4AxiTG0=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/pi/picgo/package.nix

@@ -6,7 +6,7 @@
   pnpm,
   fetchPnpmDeps,
   pnpmConfigHook,
-  electron_38,
+  electron_40,
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
@@ -16,19 +16,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "picgo";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "Molunerfinn";
     repo = "PicGo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fEj5ymnDBxeJ33GeIrcciQW3Wg7jMQaitwhUHne9a14=";
+    hash = "sha256-4Ih7PPBo6scJoUS8yTAR0iyG5vxNc/c0CCw5FGaIbHM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) version src;
     pname = "picgo";
-    hash = "sha256-hYQM1KiKfsQL0AbYpHtmpDHbG3HsdXFbpgGzcZVW7R0=";
+    hash = "sha256-tILvWDoHAN5XT1F/cJYgfeMzowuO/fhiughI+0FvHzc=";
     fetcherVersion = 3; # lockfileVersion 9.0 corresponds to fetcherVersion 3
   };
 
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Create startup script
     mkdir -p $out/bin
-    makeWrapper ${lib.getExe electron_38} $out/bin/picgo \
+    makeWrapper ${lib.getExe electron_40} $out/bin/picgo \
       --add-flags "$out/lib/picgo/.launcher.cjs" \
       --add-flags "--name picgo" \
       --set NODE_ENV production \

pkgs/by-name/po/postman/package.nix

@@ -8,7 +8,7 @@
 
 let
   pname = "postman";
-  version = "11.82.1";
+  version = "11.87.4";
 
   src =
     let
@@ -27,10 +27,10 @@ let
       name = "postman-${version}.${if stdenvNoCC.hostPlatform.isLinux then "tar.gz" else "zip"}";
       url = "https://dl.pstmn.io/download/version/${version}/${system}";
       hash = selectSystem {
-        aarch64-darwin = "sha256-7n/9ezPgpon3AEQXmoK/iazOPvRh/pDVy/YBVUwjbkI=";
-        aarch64-linux = "sha256-nn6Krn3/z7FkPRJDO7wNhny50YvuWwWWQ9lf9mk8ZGo=";
-        x86_64-darwin = "sha256-jN6TbPRkEFH9KyU3owcsrWbJvyIqMT0f8zV9OymiNzY=";
-        x86_64-linux = "sha256-PEPMrWrm57SAdaHL6ZWES0Ao7J7vn0TAX9WZ/WCFq6U=";
+        aarch64-darwin = "sha256-1ilYfvduHTh5tvIrIXmrwQgfiWnYhdXhNv/o19wUNrE=";
+        aarch64-linux = "sha256-JdO/gBT7B+FQ8mguyw7oD2hfQACfyDVxF714iVkTW2I=";
+        x86_64-darwin = "sha256-Sb66zJQJzixk032fsdAfU88Yw9t7xeFoPBlQ+pRcdmU=";
+        x86_64-linux = "sha256-a8jsIFlJD12tydTZM9Mibv+m7bcSqAN4JVQgQxB4WJo=";
       };
     };
 

pkgs/by-name/qu/quill-log/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quill-log";
-  version = "11.0.2";
+  version = "11.1.0";
 
   src = fetchFromGitHub {
     owner = "odygrd";
     repo = "quill";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b5kHxvjmTea5HU9gTvizFwhG2zwOJSPlf30XKEhxe8w=";
+    hash = "sha256-OBvKOJt/GPwrFk9JHaJ658CWAkhyVQNprbwsKJb8aHs=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/re/remmina/package.nix

@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "remmina";
-  version = "1.4.41";
+  version = "1.4.43";
 
   src = fetchFromGitLab {
     owner = "Remmina";
     repo = "Remmina";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0KUwZ81CyuLa05Cwe7wJrTbM1Dp9mAzNBI5pR7FKTOU=";
+    hash = "sha256-7nY2NhlWp+4FTTmeam1B+sotqis0lSwhozSC8I14aMI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ru/rusty-path-of-building/package.nix

@@ -19,16 +19,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusty-path-of-building";
-  version = "0.2.13";
+  version = "0.2.14";
 
   src = fetchFromGitHub {
     owner = "meehl";
     repo = "rusty-path-of-building";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4lxMQfENucDaDZov82iZD5DMgksLuJ/2nXUKYYf/m/w=";
+    hash = "sha256-rgXxy1r4ZyFFG5BiodogeHnCcppw79xzb0MsQDZxL4E=";
   };
 
-  cargoHash = "sha256-PeVVDOWFYoDKkCy+UV5ikFwrHTK93zt2WZ3Oxp0ez1Y=";
+  cargoHash = "sha256-IZ5+Dvr1u/X278U6WCD6CNu4HBh5uLRWFbPeZ6EXryo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -121,7 +121,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/meehl/rusty-path-of-building";
     changelog = "https://github.com/meehl/rusty-path-of-building/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ k900 ];
+    maintainers = with lib.maintainers; [
+      k900
+      cholli
+    ];
     mainProgram = "rusty-path-of-building";
   };
 })

pkgs/by-name/sc/scaleway-cli/package.nix

@@ -2,24 +2,24 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  buildGoModule,
+  buildGo126Module,
   installShellFiles,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
   pname = "scaleway-cli";
-  version = "2.52.0";
+  version = "2.53.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-92OSk0oJQrLAllbfsJB9FUC8C+0jLQLjw9wYHG+Lc98=";
+    hash = "sha256-IxnDmmvWH17xd2djroikwrQq0bLexWeN8VHMPiNEBhU=";
   };
 
-  vendorHash = "sha256-1pi9WQZ6dwCVsJbpA+seIzRn5lFFOjYUvt8MKUHKcVg=";
+  vendorHash = "sha256-/UEE3XSbpwlywF8TMmp90bS537RRZG0yN0oq1sbrcPQ=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/se/search-vulns/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Or0B6ENoSpaoYwUsd2jrDKr5gHjORMxvTQzlkoNkPdw=";
+    hash = "sha256-0aqAjDJy+ShybYawUFyqKzz3yDut5n3t47lCEksykEU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/se/seaweedfs/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.16";
+  version = "4.17";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     tag = finalAttrs.version;
-    hash = "sha256-BRdI/50YxwdCdBj91w6OPgTcOb7JkshkVSD8b8bHcYA=";
+    hash = "sha256-xy3gXw3cbFO3OkzgEmIecvxPJT15tn58FI4ppibckzE=";
   };
 
   vendorHash = "sha256-XbfKYftKfbJDkbp9DwVAs56w5lMvqdlW5cwhhivniBM=";

pkgs/by-name/si/sioyek/package.nix

@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sioyek";
-  version = "2.0.0-unstable-2026-02-21";
+  version = "2.0.0-unstable-2026-03-13";
 
   src = fetchFromGitHub {
     owner = "ahrm";
     repo = "sioyek";
-    rev = "b526a54a98e16275b118dfba73171177008d6970";
-    hash = "sha256-/ZYSiSuEGrbaWU7ZYXQl5ztL5AMGhOkDFyR2ftfEuVw=";
+    rev = "13a37e0e0ab77a76f8dbe3adf599ee916615b3db";
+    hash = "sha256-3bMVoF4f1+pZV3tdti8KNS17wWK1tmIgjKQUQS+Rzt8=";
   };
 
   buildInputs = [

pkgs/by-name/si/siyuan/package.nix

@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.5.9";
+  version = "3.5.10";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lQtgVYYinkgxgwnxyhsebt8CpdCDClcS+qo0tQaTD94=";
+    hash = "sha256-IJKWrveUn7kvJjSu0YYGargGFY8T8gxAAh2fr0BnbUE=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-Qz2LAtznJ8MxPQ6bSuMuvCDWt+8JSe0MawNWH70X/5k=";
+    vendorHash = "sha256-JwtXllLj6+ALrDZMjFoX5TDwE3yMaij2a9t+T1F1hG0=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {

pkgs/by-name/st/stevenblack-blocklist/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.65";
+  version = "3.16.67";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-tbPVxjpuNYftAM7vIPfDpTV1la9XX8GkQTuPVgvwOtE=";
+    hash = "sha256-oNmcZEOUg1AuCZ3jFtrfO+dOJ6DhwMMg/rgJ8fn7+bg=";
   };
 
   outputs = [

pkgs/by-name/st/stm32cubemx/package.nix

@@ -14,13 +14,13 @@ let
   iconame = "STM32CubeMX";
   package = stdenvNoCC.mkDerivation rec {
     pname = "stm32cubemx";
-    version = "6.15.0";
+    version = "6.17.0";
 
     src = fetchzip {
       url = "https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${
         builtins.replaceStrings [ "." ] [ "" ] version
       }-lin.zip";
-      hash = "sha256-50P+/uvNH3NN1UN+T3RxGgR8QYBIgBDA56mAEU4BipI=";
+      hash = "sha256-OroIcdvNzCm7lyL62zNm4sbDgUb+GgJW50mqE1M1KT4=";
       stripRoot = false;
     };
 

pkgs/by-name/su/supercronic/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "supercronic";
-  version = "0.2.41";
+  version = "0.2.43";
 
   src = fetchFromGitHub {
     owner = "aptible";
     repo = "supercronic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-i7Y4g9f5vEGTETNaLXdQb/JG/NpBIgWWg+kGtX/LQOc=";
+    hash = "sha256-X6Q/TiABNVVgsKZOzWhiaKhhHFindWgrX721mfO5b3Q=";
   };
 
-  vendorHash = "sha256-a1W/Ah3zPMLvYfQj6uWsHvwjxpLs2vb8E2YYH/RRQvs=";
+  vendorHash = "sha256-w7BL/OgNbm4mMZ6x4zZhN7kYFmUOEX7ixYzocAFzAcU=";
 
   excludedPackages = [ "cronexpr/cronexpr" ];
 

pkgs/by-name/ta/tabbyapi/package.nix

@@ -99,7 +99,10 @@ python3Packages.buildPythonApplication {
       --add-flags "$out/${python3Packages.python.sitePackages}/main.py"
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    cudaSupport = python3Packages.torch.cudaSupport;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Official API server for Exllama";

pkgs/by-name/te/tellico/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tellico";
-  version = "4.1.4";
+  version = "4.2";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "office";
     repo = "tellico";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eScAOd1da05fqXtbcz8oEJiObB7CUxiYReSrr3R7ybM=";
+    hash = "sha256-4bwx5zWJT8jD+kRshHKROx8hc+zuysGTd0HOwU7Ena0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ul/ultrastardx/package.nix

@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ultrastardx";
-  version = "2026.2.0";
+  version = "2026.3.0";
 
   src = fetchFromGitHub {
     owner = "UltraStar-Deluxe";
     repo = "USDX";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vcVHwdCNuwqn9wurLWU0Jv+A9aXIqmVNtSSDSRTbCxw=";
+    hash = "sha256-xVlg24EaHyfrpdfnCk4Wupi33BVKwisvg0hN5Q/dNC4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/uv/uv/package.nix

@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.10.9";
+  version = "0.10.10";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-IAbewFab4X21SYqhjfxfWI9LsNSNVMIChbNc3j3EJQA=";
+    hash = "sha256-axDmf81Hiv/Pw5tHXh0X+mA8b9zp2YUFdJBgOADxJms=";
   };
 
-  cargoHash = "sha256-LqrHze1MVaWq31Td/EGDeJCG+hRmPOSV1t7+ayQorlA=";
+  cargoHash = "sha256-ZhRZIpsz/7monrs80Y/WHiErulT0sQut0RIAnqBWcmk=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/ve/versatiles/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "versatiles";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+NMS4sHT47E8SuFcCHnUDBBpsA+6X4zLXvzVWc7yWGI=";
+    hash = "sha256-P1r+UzqMiu1BqXv+ORhUojKzjcl0kb9gBTBi6PseP0s=";
   };
 
-  cargoHash = "sha256-jzbaQw+Ez2PiLAYxqadvdWEGvsMlSkjECk0k3zPUni8=";
+  cargoHash = "sha256-fju6aWh6HfVnVN60M0+LmGDBxdgDSaLl+iQ358vmYm8=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/vi/vicinae/package.nix

@@ -23,23 +23,23 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.20.3";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9xE2izQakApB+cgibErwyY3KAlc6F26UhgCw/Tak43c=";
+    hash = "sha256-k3rmWZlUYLMOT33AvwZ56eZfjNc6KXH2AN5Fe8LDKFM=";
   };
 
   apiDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/src/typescript/api";
-    hash = "sha256-UsTpMR23UQBRseRo33nbT6z/UCjZByryWfn2AQSgm6U=";
+    hash = "sha256-Tr+m8MLaWR8wq+cYpQwZTIzRt2tgDIyc8vVda2x+k4k=";
   };
 
   extensionManagerDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/src/typescript/extension-manager";
-    hash = "sha256-wl8FDFB6Vl1zD0/s2EbU6l1KX4rwUW6dOZof4ebMMO8=";
+    hash = "sha256-8ONawCmKxHwWS0Tx04MCpQmtWfIpJYU8RcqMtQiT/Sw=";
   };
 
   cmakeFlags = lib.mapAttrsToList lib.cmakeFeature {

pkgs/by-name/we/webdav/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.11.1";
+  version = "5.11.2";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YkVw5hlN6Sl7gUzJdmELRkabFUwS+9ILaOUUBbdO0tY=";
+    hash = "sha256-OVR+64g02bT7K1LDKCW7O7kGjhkjovIDIrDUXNK189k=";
   };
 
-  vendorHash = "sha256-pI4VJQeYz5/6N7wLpwxKw5754DQyINFlu3WGR2aCdAQ=";
+  vendorHash = "sha256-OmYXNpzx3GWw0hxMdMyQARE89JXeiamwOS4KclLjRwU=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/wh/whatsapp-for-mac/package.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "whatsapp-for-mac";
-  version = "2.25.22.79";
+  version = "2.26.9.17";
 
   src = fetchzip {
     extension = "zip";
     name = "WhatsApp.app";
-    url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=relbranch";
-    hash = "sha256-LYjPMiXLD1U5ZNt/acBagrV2RS7U/OGMJ06mUFBluSQ=";
+    url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=master";
+    hash = "sha256-bba22HBnIeio4M92mckiOa1IQpRUfx/I7OkfA4hO6rU=";
   };
 
   dontConfigure = true;
@@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       common-updater-scripts
     ];
     text = ''
-      url=$(curl --silent "https://web.whatsapp.com/desktop/mac_native/updates/?branch=relbranch&configuration=Release")
+      url=$(curl --silent "https://web.whatsapp.com/desktop/mac_native/updates/?branch=master&configuration=Release")
       version=$(echo "$url" | xmlstarlet sel -t -v "substring-before(substring-after(//enclosure/@url, 'version='), '&')")
       update-source-version whatsapp-for-mac "$version" --file=./pkgs/by-name/wh/whatsapp-for-mac/package.nix
     '';

pkgs/by-name/za/zapret/package.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret";
-  version = "72.10";
+  version = "72.12";
 
   src = fetchFromGitHub {
     owner = "bol-van";
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m9MKyOwAUeH8LZ1GgbuYdHdNTrI3mJ7+Q9R9JT5y2gY=";
+    hash = "sha256-UWkLi/wWihtdLyk77cQ90xZ31vho1PjPfFQ6bQWrIUs=";
   };
 
   buildInputs = [

pkgs/by-name/zl/zlsplitter/package.nix

@@ -29,13 +29,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "zlsplitter";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ZL-Audio";
     repo = "ZLSplitter";
     tag = finalAttrs.version;
-    hash = "sha256-6ICXL1jX6MMYf5VasTW9osJ2BNb6jqWfeAtmmEp6L/4=";
+    hash = "sha256-QNTSxvp4trbdm6wbl0u187LTjRMIp1tvoo06+m2z+8Y=";
     fetchSubmodules = true;
   };
 

pkgs/development/haskell-modules/configuration-common.nix

@@ -1325,18 +1325,6 @@ with haskellLib;
   # https://github.com/emilypi/Base32/issues/24
   base32 = doJailbreak super.base32;
 
-  # Djinn's last release was 2014, incompatible with Semigroup-Monoid Proposal
-  # https://github.com/augustss/djinn/pull/8
-  djinn = overrideSrc {
-    version = "unstable-2023-11-20";
-    src = pkgs.fetchFromGitHub {
-      owner = "augustss";
-      repo = "djinn";
-      rev = "69b3fbad9f42f0b1b2c49977976b8588c967d76e";
-      hash = "sha256-ibxn6DXk4pqsOsWhi8KcrlH/THnuMWvIu5ENOn3H3So=";
-    };
-  } super.djinn;
-
   # https://github.com/Philonous/hs-stun/pull/1
   # Remove if a version > 0.1.0.1 ever gets released.
   stunclient = overrideCabal (drv: {

pkgs/development/interpreters/bqn/cbqn/default.nix

@@ -41,6 +41,7 @@ stdenv.mkDerivation {
     "o3"
     "notui=1" # display build progress in a plain-text format
     "REPLXX=${if enableReplxx then "1" else "0"}"
+    "version=${sources.cbqn.version}"
   ]
   ++ lib.optionals stdenv.hostPlatform.avx2Support [
     "has=avx2"

pkgs/development/interpreters/bqn/cbqn/sources.nix

@@ -11,13 +11,13 @@
     let
       self = {
         pname = "cbqn";
-        version = "0.10.0";
+        version = "0.11.0";
 
         src = fetchFromGitHub {
           owner = "dzaima";
           repo = "CBQN";
           rev = "v${self.version}";
-          hash = "sha256-RZIxIRlx1SSYP+WrMRvg6nUqqs4zqEaGPvFyY3WFgbU=";
+          hash = "sha256-ZXhCFLLUVJTgpJqMd97EMSoE4fwuqBJ742kzV662bnY=";
         };
       };
     in
@@ -25,25 +25,25 @@
 
   cbqn-bytecode = {
     pname = "cbqn-bytecode";
-    version = "0-unstable-2025-11-24";
+    version = "0-unstable-2026-01-24";
 
     src = fetchFromGitHub {
       owner = "dzaima";
       repo = "cbqnBytecode";
-      rev = "cca48b93b2e3260d2fa371c578d94cf044e39042";
-      hash = "sha256-xBjXlzWhbsKjiknnncVRkh9VlUNzaxYVNB7BhZTI/r4=";
+      rev = "156b47caf895f6706811c5c34bbbbaf192b8018b";
+      hash = "sha256-xz4gs1b1yNbnR3v4Kw1xLCAb1I1uoBMdYJRQH9JVD/k=";
     };
   };
 
   replxx = {
     pname = "replxx";
-    version = "0-unstable-2025-05-20";
+    version = "0-unstable-2026-02-02";
 
     src = fetchFromGitHub {
       owner = "dzaima";
       repo = "replxx";
-      rev = "c1ce5b0bcabd96ec93ebf630a85619295ec7c2f3";
-      hash = "sha256-4TEjJdF0FAIT69uVMp0y4bFFrRda1CXC/bLX6mrUTA0=";
+      rev = "5e3bd870699007b9536d29f60e3a2b0a68ce0a7a";
+      hash = "sha256-B1N1d5K4E20OlbX4wTclEiXULM2FT3oT0btyrYCNQ20=";
     };
   };
 

pkgs/development/php-packages/openswoole/default.nix

@@ -18,7 +18,7 @@ buildPecl {
   src = fetchFromGitHub {
     owner = "openswoole";
     repo = "swoole-src";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-fTr7CuWZt902YnTtEriWL8wjHni71N/u5upJqY+UvYs=";
   };
 

pkgs/development/python-modules/django-flags/default.nix

@@ -10,26 +10,23 @@
   pytestCheckHook,
   setuptools-scm,
   setuptools,
-  pythonOlder,
 }:
 buildPythonPackage rec {
   pname = "django-flags";
-  version = "5.0.14";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cfpb";
     repo = "django-flags";
     tag = version;
-    hash = "sha256-0IOcpl8OamNlalqNqMvmx/bkuIkaNnLwCD7nFclR8S4=";
+    hash = "sha256-4UOueNXfDouTqpLpG391zcGHTTJ8GfznYmEl33YKdv8=";
   };
 
   dependencies = [
     django
   ];
 
-  disabled = pythonOlder "3.8";
-
   build-system = [
     setuptools
     setuptools-scm

pkgs/development/python-modules/django-markdownify/default.nix

@@ -12,14 +12,14 @@
 }:
 buildPythonPackage rec {
   pname = "django-markdownify";
-  version = "0.9.5";
+  version = "0.9.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwinmatijsen";
     repo = "django-markdownify";
     tag = version;
-    hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
+    hash = "sha256-L/N0jjxBz7aQletOg+qairgq4utifPz4oqjT9AcljLI=";
   };
 
   dependencies = [