From 01baddda5ccbef7460b87f51f5c62e822a2dc2f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Dec 2025 04:29:52 +0000
Subject: [PATCH 01/54] percona-server: 8.4.6-6 -> 8.4.7-7

---
 pkgs/servers/sql/percona-server/8_4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index f7ae2b9e6abf..4e8d7977d805 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -50,11 +50,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.6-6";
+  version = "8.4.7-7";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-q01k+/TzvT7h52bqn9icc6VMlrUUjMDNKz0UdTyAWjU=";
+    hash = "sha256-5UBegcT25a1QUt4QQ6LlKWB7UGBnfQG6PK/Hxp9GYaY=";
   };
 
   nativeBuildInputs = [

From aee838e2e0ce4a9bfdce7bc5e278462b8f750110 Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 10 Feb 2026 12:13:42 +0100
Subject: [PATCH 02/54] foomatic-db: 0-unstable-2026-01-13 ->
 0-unstable-2026-02-09

The only change
https://github.com/OpenPrinting/foomatic-db/pull/58
"is limited strictly to metadata corrections and
does not modify PPD generation or driver behavior."
---
 pkgs/by-name/fo/foomatic-db/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/foomatic-db/package.nix b/pkgs/by-name/fo/foomatic-db/package.nix
index 0fd0492f58a9..42b27aec5a86 100644
--- a/pkgs/by-name/fo/foomatic-db/package.nix
+++ b/pkgs/by-name/fo/foomatic-db/package.nix
@@ -14,15 +14,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "foomatic-db";
-  version = "0-unstable-2026-01-13";
+  version = "0-unstable-2026-02-09";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db";
-    rev = "abdfdb89a56edb0d1b7e0de2e01ce30cd0dbed22";
-    hash = "sha256-D0ULsTIVv7rJWdgK9EqH7visZoJONc8zGsV0r1uVNKE=";
+    rev = "57e546cb7774c7b03e7090ced65fb1ffd552f33d";
+    hash = "sha256-mQEOV+NJId5h/hYOL+2JrEHjqM77qRExDNeqZ0IyA08=";
   };
 
   buildInputs = [

From c93ebf3531bd265c2053e7da79ff62d31cd6d361 Mon Sep 17 00:00:00 2001
From: Aaron Bieber <aaron@bolddaemon.com>
Date: Wed, 11 Feb 2026 14:46:07 -0700
Subject: [PATCH 03/54] obsidian: remove myself as maintainer

---
 pkgs/by-name/ob/obsidian/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index a55f6ca8e712..83b1e5120225 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -24,7 +24,6 @@ let
       atila
       conradmearns
       zaninime
-      qbit
       kashw2
       w-lfchen
     ];

From dd3efddee6ac8b104779cb0d2f815d724a6c717e Mon Sep 17 00:00:00 2001
From: Aaron Bieber <aaron@bolddaemon.com>
Date: Wed, 11 Feb 2026 14:46:28 -0700
Subject: [PATCH 04/54] tidal-hifi: remove myself as maintainer

---
 pkgs/by-name/ti/tidal-hifi/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index 92c6c5f395a3..23236cb515dd 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -219,7 +219,6 @@ buildNpmPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       gerg-l
-      qbit
       spikespaz
     ];
     # `castlabs-electron` doesn't have a distribution for `aarch64-linux`.

From fcf894d57e211ed5b2e48752e6fb8fd04dc713b7 Mon Sep 17 00:00:00 2001
From: Aaron Bieber <aaron@bolddaemon.com>
Date: Wed, 11 Feb 2026 14:47:14 -0700
Subject: [PATCH 05/54] maintainers: remove my matrix info

---
 maintainers/maintainer-list.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c66180c9329f..90b4ffb506c0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21674,7 +21674,6 @@
     email = "aaron@bolddaemon.com";
     github = "qbit";
     githubId = 68368;
-    matrix = "@qbit:tapenet.org";
     keys = [ { fingerprint = "3586 3350 BFEA C101 DB1A 4AF0 1F81 112D 62A9 ADCE"; } ];
   };
   qdlmcfresh = {

From 9c3d86523e1a465528164e5e3a942164f5bf9c3e Mon Sep 17 00:00:00 2001
From: teto <886074+teto@users.noreply.github.com>
Date: Thu, 19 Feb 2026 16:11:44 +0100
Subject: [PATCH 06/54] neovim: disable python3 and ruby providers by default

Providers are the thing I spend most of my time on while admittedly very
few users use it (I can only think of deoplete now) and it's going to disappear anyway.
We have no tests for it because of the previous reasons.

Before this patch:
nix path-info -Sh .#neovim
/nix/store/smd007xlbsx35y42rri5xlqhjgajz9in-neovim-0.11.6	365.0 MiB

After:
nix path-info -Sh .#neovim
/nix/store/4cr60j05l3pirhhrcs5hqb9rzj854n5r-neovim-0.11.6	240.6 MiB

To restore old behavior, pass `{withPython3= true; withRuby = true; }`
to the neovim wrapper.
---
 doc/release-notes/rl-2605.section.md         | 1 +
 pkgs/applications/editors/neovim/utils.nix   | 6 +++---
 pkgs/applications/editors/neovim/wrapper.nix | 4 ++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 10802b054ec7..c556a90ed107 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -201,6 +201,7 @@
 
 - `mold` is now wrapped by default.
 
+- `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB.
 
 ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}
 
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 47d55e3042b6..23968bf21d0e 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -177,7 +177,7 @@ let
       # the function you would have passed to python.withPackages
       extraPythonPackages ? (_: [ ]),
       # the function you would have passed to python.withPackages
-      withPython3 ? true,
+      withPython3 ? false,
       extraPython3Packages ? (_: [ ]),
       # the function you would have passed to lua.withPackages
       extraLuaPackages ? (_: [ ]),
@@ -243,9 +243,9 @@ let
   */
   generateProviderRc =
     {
-      withPython3 ? true,
+      withPython3 ? false,
       withNodeJs ? false,
-      withRuby ? true,
+      withRuby ? false,
       # Perl is problematic https://github.com/NixOS/nixpkgs/issues/132368
       withPerl ? false,
 
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 6c97a6f22377..c8d7d69eae0f 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -37,14 +37,14 @@ let
       # should contain all args but the binary. Can be either a string or list
       wrapperArgs ? [ ],
       withPython2 ? false,
-      withPython3 ? true,
+      withPython3 ? false,
       # the function you would have passed to python3.withPackages
       extraPython3Packages ? (_: [ ]),
 
       waylandSupport ? lib.meta.availableOn stdenv.hostPlatform wayland,
       withNodeJs ? false,
       withPerl ? false,
-      withRuby ? true,
+      withRuby ? false,
 
       # wether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
       vimAlias ? false,

From e122da5baa55557532d0ee715b51ca667b7813df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 19 Feb 2026 18:28:37 +0000
Subject: [PATCH 07/54] xdp-tools: 1.6.1 -> 1.6.2

---
 pkgs/by-name/xd/xdp-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index ce762a3b4711..b6e9b7532cc9 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdp-tools";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KIUuAaWmU5BsmLsp8T3S2hSF4p7BJ506luS82RpmOKs=";
+    hash = "sha256-CtXJAYR4T/4NyJlgvdc1E9JBIVWY7lN5gtyTUfmAkp8=";
   };
 
   outputs = [

From b5add0060b0b28c8dd90ad6951121918435f0c42 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Thu, 19 Feb 2026 22:38:05 +0100
Subject: [PATCH 08/54] python3Packages.bitsandbytes: move env vars into env
 for structuredAttrs

---
 .../python-modules/bitsandbytes/default.nix         | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index 4d33e8f943c0..29b135fb27fa 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -163,11 +163,14 @@ buildPythonPackage {
 
     (lib.cmakeFeature "CMAKE_HIP_ARCHITECTURES" (builtins.concatStringsSep ";" rocmGpuTargets))
   ];
-  CUDA_HOME = lib.optionalString cudaSupport "${cuda-native-redist}";
-  NVCC_PREPEND_FLAGS = lib.optionals cudaSupport [
-    "-I${cuda-native-redist}/include"
-    "-L${cuda-native-redist}/lib"
-  ];
+
+  env = lib.optionalAttrs cudaSupport {
+    CUDA_HOME = cuda-native-redist;
+    NVCC_PREPEND_FLAGS = toString [
+      "-I${cuda-native-redist}/include"
+      "-L${cuda-native-redist}/lib"
+    ];
+  };
 
   preBuild = ''
     make -j $NIX_BUILD_CORES

From e63daa938b163d59c261e9dcce11d0d1d8acf74f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 20 Feb 2026 01:03:33 +0100
Subject: [PATCH 09/54] python3Packages.mpd2: 3.1.1 -> 3.1.2

https://github.com/Mic92/python-mpd2/blob/v3.1.2/doc/changes.rst
---
 .../python-modules/mpd2/default.nix           | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/mpd2/default.nix b/pkgs/development/python-modules/mpd2/default.nix
index 79c4ed1653c2..09bd308fd74c 100644
--- a/pkgs/development/python-modules/mpd2/default.nix
+++ b/pkgs/development/python-modules/mpd2/default.nix
@@ -1,32 +1,34 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   twisted,
   unittestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-mpd2";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-S67DWEzEPtmUjVVZB5+vwmebBrKt4nPpCbNYJlSys/U=";
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "python-mpd2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3isX3e4Fu1orxuRsC3u8RxoFDQcE4XxQhf8PIHdo/e4=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   optional-dependencies = {
     twisted = [ twisted ];
   };
 
-  nativeCheckInputs = [ unittestCheckHook ] ++ optional-dependencies.twisted;
+  nativeCheckInputs = [ unittestCheckHook ] ++ finalAttrs.passthru.optional-dependencies.twisted;
 
   meta = {
-    changelog = "https://github.com/Mic92/python-mpd2/blob/v${version}/doc/changes.rst";
+    changelog = "https://github.com/Mic92/python-mpd2/blob/${finalAttrs.src.tag}/doc/changes.rst";
     description = "Python client module for the Music Player Daemon";
     homepage = "https://github.com/Mic92/python-mpd2";
     license = lib.licenses.lgpl3Plus;
@@ -35,4 +37,4 @@ buildPythonPackage rec {
       hexa
     ];
   };
-}
+})

From f749eda184af7c18757e464562f010aa54298ffc Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 20 Feb 2026 20:53:52 +0100
Subject: [PATCH 10/54] =?UTF-8?q?ocamlPackages.ocsigen=5Fserver:=206.0.0?=
 =?UTF-8?q?=20=E2=86=92=207.0.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ocaml-modules/ocsigen-server/default.nix        | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index b0dcac2f2f42..170f0e3fa873 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -52,17 +52,15 @@ let
   ];
 in
 
-buildDunePackage {
-  version = "6.0.0-unstable-2025-08-11";
+buildDunePackage (finalAttrs: {
+  version = "7.0.0";
   pname = "ocsigenserver";
 
-  minimalOCamlVersion = "4.08";
-
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "ocsigenserver";
-    rev = "0d3c74d71fbdf738d1e45a98814b7ebdd1efe6c1";
-    hash = "sha256-KEHTw4cCPRJSE4SAnUFWzeoiEz8y9nUQFpaFiNxAsiU=";
+    tag = finalAttrs.version;
+    hash = "sha256-J2XBelpRWJGeIF9RdC9+icJI1hc6Oe0k1w25QHZz0zs=";
   };
 
   nativeBuildInputs = [
@@ -110,8 +108,7 @@ buildDunePackage {
       A full featured Web server. It implements most features of the HTTP protocol, and has a very powerful extension mechanism that make very easy to plug your own OCaml modules for generating pages.
     '';
     license = lib.licenses.lgpl21Only;
-    inherit (ocaml.meta) platforms;
     maintainers = [ lib.maintainers.gal_bolle ];
   };
 
-}
+})

From cb50179cd9c2cd83a2cc8d88e9db86e3f100917e Mon Sep 17 00:00:00 2001
From: redianthus <l@ndrs.fr>
Date: Sun, 22 Feb 2026 12:40:35 +0100
Subject: [PATCH 11/54] ocamlPackages.smtml: enable bitwuzla support

---
 pkgs/development/ocaml-modules/smtml/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index 72ea1a635acd..91482674892e 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -5,6 +5,7 @@
   ocaml,
   fetchFromGitHub,
   menhir,
+  bitwuzla-cxx,
   bos,
   cmdliner,
   dolmen_model,
@@ -47,6 +48,7 @@ buildDunePackage (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
+    bitwuzla-cxx
     bos
     cmdliner
     dolmen_model

From 43537cf6b1817baf5e1192c3bb99b67edd1c5c36 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 17 Nov 2025 20:25:22 -0500
Subject: [PATCH 12/54] mesa: build KosmicKrisp on Darwin

---
 pkgs/development/libraries/mesa/darwin.nix | 63 ++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
index 83f3e16bf4ad..5e7743f117b6 100644
--- a/pkgs/development/libraries/mesa/darwin.nix
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -3,8 +3,12 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  apple-sdk_26,
   bison,
+  darwinMinVersionHook,
   flex,
+  glslang,
+  libpng,
   libxml2,
   llvmPackages,
   meson,
@@ -15,8 +19,30 @@
   libxext,
   libx11,
   libxcb,
+  libxshmfence,
+  spirv-llvm-translator,
+  spirv-tools,
   zlib,
+  eglPlatforms ? [
+    "macos"
+    "x11"
+  ],
+  galliumDrivers ? [
+    "llvmpipe" # software renderer
+    "softpipe" # older software renderer
+  ],
+  vulkanDrivers ? [
+    "kosmickrisp" # Vulkan on Metal
+  ],
+  vulkanLayers ? [
+    "anti-lag"
+    "intel-nullhw"
+    "overlay"
+    "screenshot"
+    "vram-report-limit"
+  ],
 }:
+
 let
   common = import ./common.nix { inherit lib fetchFromGitLab; };
 in
@@ -28,6 +54,11 @@ stdenv.mkDerivation {
     meta
     ;
 
+  patches = [
+    # Required to build KosmicKrisp
+    ./opencl.patch
+  ];
+
   outputs = [
     "out"
     "dev"
@@ -36,6 +67,9 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     bison
     flex
+    # Use bin output from glslang to not propagate the dev output at
+    # the build time with the host glslang.
+    (lib.getBin glslang)
     meson
     ninja
     pkg-config
@@ -46,12 +80,21 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
+    apple-sdk_26 # KosmicKrisp requires Metal 4 to build, but …
+    (darwinMinVersionHook "15.0") # … it supports back to Metal 3.2, which requires macOS 15.
+    libpng
     libxml2 # should be propagated from libllvm
+    llvmPackages.libclang
+    llvmPackages.libclc
     llvmPackages.libllvm
+    python3Packages.python # for shebang
+    spirv-llvm-translator
+    spirv-tools
     libx11
     libxext
     libxfixes
     libxcb
+    libxshmfence
     zlib
   ];
 
@@ -60,10 +103,30 @@ stdenv.mkDerivation {
   mesonFlags = [
     "--sysconfdir=/etc"
     "--datadir=${placeholder "out"}/share"
+
+    # What to build
+    (lib.mesonOption "platforms" (lib.concatStringsSep "," eglPlatforms))
+    (lib.mesonOption "gallium-drivers" (lib.concatStringsSep "," galliumDrivers))
+    (lib.mesonOption "vulkan-drivers" (lib.concatStringsSep "," vulkanDrivers))
+    (lib.mesonOption "vulkan-layers" (lib.concatStringsSep "," vulkanLayers))
+
+    # Disable glvnd on Darwin
     (lib.mesonEnable "glvnd" false)
+    (lib.mesonEnable "gbm" false)
+    (lib.mesonBool "libgbm-external" false)
+
+    # Needed for KosmicKrisp
+    (lib.mesonOption "clang-libdir" "${lib.getLib llvmPackages.libclang}/lib")
     (lib.mesonEnable "llvm" true)
+    (lib.mesonEnable "shared-llvm" true)
+    (lib.mesonEnable "spirv-tools" true)
+
+    # Needed for Apple GLX support
+    (lib.mesonOption "glx" "dri")
   ];
 
+  mesonBuildType = "release";
+
   passthru = {
     # needed to pass evaluation of bad platforms
     driverLink = throw "driverLink not supported on darwin";

From 3bbcd489b9f46f951df5774291ebd346842a6d6d Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Thu, 12 Feb 2026 13:05:55 +0530
Subject: [PATCH 13/54] reaction: 2.2.1 -> 2.3.0

Co-authored-by: ppom <38916722+ppom0@users.noreply.github.com>
Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/re/reaction/package.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index e5780fb044cf..e83a254f4df4 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -1,26 +1,28 @@
 {
   lib,
   stdenv,
-  nixosTests,
   rustPlatform,
   fetchFromGitLab,
+
   versionCheckHook,
   installShellFiles,
   nix-update-script,
+
+  nixosTests,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "ppom";
     repo = "reaction";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-81i0bkrf86adQWxeZgIoZp/zQQbRJwPqQqZci0ANRFw=";
+    hash = "sha256-OvNJsR9W5MlicqUpr1aOLJ7pI7H7guq1vAlC/hh1Q2o=";
   };
 
-  cargoHash = "sha256-Bf9XmlY0IMPY4Convftd0Hv8mQbYoiE8WrkkAeaS6Z8=";
+  cargoHash = "sha256-BOFZlVBKf6fjW1L1J8u7Vf+fzNJHlEtQI6YafDjlZ4U=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -40,13 +42,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # flaky and fails in hydra
     "--skip=concepts::config::tests::merge_config_distinct_concurrency"
   ];
+
   cargoTestFlags = [
     # Skip integration tests for the same reason
     "--lib"
   ];
 
   postInstall = ''
-    installBin $releaseDir/ip46tables $releaseDir/nft46
     installManPage $releaseDir/reaction*.1
     installShellCompletion --cmd reaction \
       --bash $releaseDir/reaction.bash \
@@ -62,15 +64,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
   passthru.tests = { inherit (nixosTests) reaction reaction-firewall; };
+  passthru.plugins = reaction-plugins;
 
   meta = {
+    changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
     description = "Scan logs and take action: an alternative to fail2ban";
     homepage = "https://framagit.org/ppom/reaction";
-    changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
     license = lib.licenses.agpl3Plus;
     mainProgram = "reaction";
     maintainers = with lib.maintainers; [ ppom ];
-    teams = [ lib.teams.ngi ];
     platforms = lib.platforms.unix;
+    teams = [ lib.teams.ngi ];
   };
 })

From 7b46dedf1d46904f48fcf2baebd0ea90fd4b4272 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Tue, 17 Feb 2026 23:07:13 +0530
Subject: [PATCH 14/54] reaction: fix build on macos

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 .../re/reaction/add-support-for-macos.patch   | 24 +++++++++++++++++++
 pkgs/by-name/re/reaction/package.nix          |  5 ++++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/by-name/re/reaction/add-support-for-macos.patch

diff --git a/pkgs/by-name/re/reaction/add-support-for-macos.patch b/pkgs/by-name/re/reaction/add-support-for-macos.patch
new file mode 100644
index 000000000000..f68e0d625873
--- /dev/null
+++ b/pkgs/by-name/re/reaction/add-support-for-macos.patch
@@ -0,0 +1,24 @@
+From dc51d7d432eeb408551ae84c6b08d172efbf4649 Mon Sep 17 00:00:00 2001
+From: ppom <reaction@ppom.me>
+Date: Tue, 17 Feb 2026 12:00:00 +0100
+Subject: [PATCH] Add support for macOS
+
+---
+ src/concepts/plugin.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/concepts/plugin.rs b/src/concepts/plugin.rs
+index c5bc330..8c3c142 100644
+--- a/src/concepts/plugin.rs
++++ b/src/concepts/plugin.rs
+@@ -1,5 +1,7 @@
+ use std::{collections::BTreeMap, io::Error, path, process::Stdio};
+ 
++#[cfg(target_os = "macos")]
++use std::os::darwin::fs::MetadataExt;
+ #[cfg(target_os = "freebsd")]
+ use std::os::freebsd::fs::MetadataExt;
+ #[cfg(target_os = "illumos")]
+-- 
+GitLab
+
diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index e83a254f4df4..de94c20e9d9b 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -22,6 +22,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-OvNJsR9W5MlicqUpr1aOLJ7pI7H7guq1vAlC/hh1Q2o=";
   };
 
+  patches = [
+    # remove patch in next tagged version
+    ./add-support-for-macos.patch
+  ];
+
   cargoHash = "sha256-BOFZlVBKf6fjW1L1J8u7Vf+fzNJHlEtQI6YafDjlZ4U=";
 
   nativeBuildInputs = [ installShellFiles ];

From 0f1dc709de61d2ea539d687797e795ee8239fea5 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Mon, 23 Feb 2026 18:12:42 +0530
Subject: [PATCH 15/54] reaction-plugins: init

Co-authored-by: eljamm <fedi.jamoussi@protonmail.ch>
Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/re/reaction/package.nix          |  9 +++--
 pkgs/by-name/re/reaction/plugins/default.nix  | 37 +++++++++++++++++++
 .../plugins/reaction-plugin-ipset.nix         | 14 +++++++
 .../plugins/reaction-plugin-virtual.nix       |  5 +++
 pkgs/top-level/all-packages.nix               |  2 +
 5 files changed, 64 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/re/reaction/plugins/default.nix
 create mode 100644 pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix
 create mode 100644 pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix

diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index de94c20e9d9b..4edea0b94ab5 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  callPackage,
   rustPlatform,
   fetchFromGitLab,
 
@@ -67,9 +68,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
-  passthru.updateScript = nix-update-script { };
-  passthru.tests = { inherit (nixosTests) reaction reaction-firewall; };
-  passthru.plugins = reaction-plugins;
+  passthru = {
+    inherit (callPackage ./plugins { }) mkReactionPlugin plugins;
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) reaction reaction-firewall; };
+  };
 
   meta = {
     changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
diff --git a/pkgs/by-name/re/reaction/plugins/default.nix b/pkgs/by-name/re/reaction/plugins/default.nix
new file mode 100644
index 000000000000..c6a7fa124699
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  rustPlatform,
+  callPackage,
+  reaction,
+}:
+{
+  # NOTE: plugins are binaries, so no special integration with the derivation is required
+  # mkReactionPlugin is meant for only official plugins living in the reaction source tree
+  mkReactionPlugin =
+    name: extra:
+    rustPlatform.buildRustPackage (
+      {
+        pname = name;
+        inherit (reaction) version src cargoHash;
+        buildAndTestSubdir = "plugins/${name}";
+
+        meta = {
+          changelog = "https://framagit.org/ppom/reaction/-/releases/v${reaction.version}";
+          description = "Official reaction plugin ${name}";
+          homepage = "https://framagit.org/ppom/reaction";
+          license = lib.licenses.agpl3Plus;
+          mainProgram = name;
+          maintainers = with lib.maintainers; [ ppom ];
+          platforms = lib.platforms.unix;
+          teams = [ lib.teams.ngi ];
+        };
+      }
+      // extra
+    );
+
+  # capture all plugins except default.nix (this file)
+  plugins = lib.removeAttrs (lib.packagesFromDirectoryRecursive {
+    inherit callPackage;
+    directory = ./.;
+  }) [ "default" ];
+}
diff --git a/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix b/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix
new file mode 100644
index 000000000000..23ae70ee4f57
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/reaction-plugin-ipset.nix
@@ -0,0 +1,14 @@
+{
+  ipset,
+  pkg-config,
+  rustPlatform,
+  reaction,
+  ...
+}:
+reaction.mkReactionPlugin "reaction-plugin-ipset" {
+  buildInputs = [ ipset ];
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    pkg-config
+  ];
+}
diff --git a/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix b/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix
new file mode 100644
index 000000000000..049a96613285
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/reaction-plugin-virtual.nix
@@ -0,0 +1,5 @@
+{
+  reaction,
+  ...
+}:
+reaction.mkReactionPlugin "reaction-plugin-virtual" { }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4a786b2e13f0..4f4531fbf6a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3878,6 +3878,8 @@ with pkgs;
 
   dprint-plugins = recurseIntoAttrs (callPackage ../by-name/dp/dprint/plugins { });
 
+  reaction-plugins = reaction.passthru.plugins;
+
   elm2nix = haskell.lib.compose.justStaticExecutables haskellPackages.elm2nix;
 
   elmPackages = recurseIntoAttrs (callPackage ../development/compilers/elm { });

From 43580e4331377be7e6305b0cd70a027b0576f192 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 13 Feb 2026 15:31:37 +0530
Subject: [PATCH 16/54] nixos/reaction: document and include plugins

Co-authored-by: eljamm <fedi.jamoussi@protonmail.ch>
Co-authored-by: ppom <38916722+ppom0@users.noreply.github.com>
Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 nixos/modules/services/security/reaction.nix | 125 +++++++++++++++++--
 nixos/tests/reaction-firewall.nix            |   9 ++
 nixos/tests/reaction.nix                     |   1 +
 3 files changed, 122 insertions(+), 13 deletions(-)

diff --git a/nixos/modules/services/security/reaction.nix b/nixos/modules/services/security/reaction.nix
index 63e7eb586f60..039e507ae57f 100644
--- a/nixos/modules/services/security/reaction.nix
+++ b/nixos/modules/services/security/reaction.nix
@@ -7,10 +7,21 @@
 let
   settingsFormat = pkgs.formats.yaml { };
 
+  cfg = config.services.reaction;
+
   inherit (lib)
-    mkOption
+    concatMapStringsSep
+    filterAttrs
+    getExe
+    mkDefault
     mkEnableOption
+    mkIf
+    mkOption
     mkPackageOption
+    mapAttrs
+    optional
+    optionals
+    optionalString
     types
     ;
 in
@@ -30,7 +41,65 @@ in
       default = { };
       type = types.submodule {
         freeformType = settingsFormat.type;
-        options = { };
+        options = {
+          plugins = mkOption {
+            description = ''
+              Nixpkgs provides a `reaction-plugins` package set which includes both offical and community plugins for reaction.
+
+              To use the plugins in your module configuration, in `settings.plugins` you can use for e.g. `''${lib.getExe reaction-plugins.reaction-plugin-ipset}`
+              See https://reaction.ppom.me/plugins/ to configure plugins.
+            '';
+            default = { };
+            type = types.attrsOf (
+              types.submodule (
+                { name, ... }:
+                {
+                  options = {
+                    enable = mkOption {
+                      description = "enable reaction-plugin-${name}";
+                      type = types.bool;
+                      default = true;
+                    };
+                    path = mkOption {
+                      description = "path to the plugin binary";
+                      type = types.str;
+                      default = "${cfg.package.plugins."reaction-plugin-${name}"}/bin/reaction-plugin-${name}";
+                      defaultText = lib.literalExpression ''''${cfg.package.plugins."reaction-plugin-${name}"}/bin/reaction-plugin-${name}'';
+                    };
+                    check_root = mkOption {
+                      description = "Whether reaction must check that the executable is owned by root";
+                      type = types.bool;
+                      default = true;
+                    };
+                    systemd = mkOption {
+                      description = "Whether reaction must isolate the plugin using systemd's run0";
+                      type = types.bool;
+                      default = cfg.runAsRoot;
+                      defaultText = "config.services.reaction.runAsRoot";
+                    };
+                    systemd_options = mkOption {
+                      description = ''
+                        A key-value map of systemd options.
+                        Keys must be strings and values must be string arrays.
+
+                        See `man systemd.directives` for all supported options, and particularly options in `man systemd.exec`
+                      '';
+                      type = types.attrsOf (types.listOf types.str);
+                      default = { };
+                    };
+                  };
+                }
+              )
+            );
+            # Filter plugins which are disabled
+            apply =
+              self:
+              lib.pipe self [
+                (filterAttrs (name: p: p.enable))
+                (mapAttrs (name: p: removeAttrs p [ "enable" ]))
+              ];
+          };
+        };
       };
     };
 
@@ -113,25 +182,39 @@ in
           services.openssh.settings.LogLevel = lib.mkDefault "VERBOSE";
         }
         ```
+
+        ```nix
+        # core ipset plugin requires these if running as non-root
+        systemd.services.reaction.serviceConfig = {
+          CapabilityBoundingSet = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+            "CAP_DAC_READ_SEARCH" # for journalctl
+          ];
+          AmbientCapabilities = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+            "CAP_DAC_READ_SEARCH"
+          ];
+        };
+        ```
       '';
     };
   };
 
   config =
     let
-      cfg = config.services.reaction;
-
       generatedSettings = settingsFormat.generate "reaction.yml" cfg.settings;
       settingsDir = pkgs.runCommand "reaction-settings-dir" { } ''
         mkdir -p $out
-        ${lib.concatMapStringsSep "\n" (file: ''
+        ${concatMapStringsSep "\n" (file: ''
           filename=$(basename "${file}")
           ln -s "${file}" "$out/$filename"
         '') cfg.settingsFiles}
         ln -s ${generatedSettings} $out/reaction.yml
       '';
     in
-    lib.mkIf cfg.enable {
+    mkIf cfg.enable {
       assertions = [
         {
           assertion = cfg.settings != { } || (builtins.length cfg.settingsFiles) != 0;
@@ -139,7 +222,7 @@ in
         }
       ];
 
-      users = lib.mkIf (!cfg.runAsRoot) {
+      users = mkIf (!cfg.runAsRoot) {
         users.reaction = {
           isSystemUser = true;
           group = "reaction";
@@ -148,27 +231,29 @@ in
       };
 
       system.checks =
-        lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform)
+        optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform)
           (
             pkgs.runCommand "reaction-config-validation" { } ''
-              ${lib.getExe cfg.package} test-config -c ${settingsDir} >/dev/null
+              ${getExe cfg.package} test-config -c ${settingsDir} >/dev/null
               echo "reaction config ${settingsDir} is valid"
               touch $out
             ''
           );
 
       systemd.services.reaction = {
-        description = "Scan logs and take action";
+        description = "A daemon that scans program outputs for repeated patterns, and takes action.";
+        documentation = [ "https://reaction.ppom.me" ];
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        partOf = lib.optionals cfg.stopForFirewall [ "firewall.service" ];
+        partOf = optionals cfg.stopForFirewall [ "firewall.service" ];
         path = [ pkgs.iptables ];
         serviceConfig = {
           Type = "simple";
+          KillMode = "mixed"; # for plugins
           User = if (!cfg.runAsRoot) then "reaction" else "root";
           ExecStart = ''
-            ${lib.getExe cfg.package} start -c ${settingsDir}${
-              lib.optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
+            ${getExe cfg.package} start -c ${settingsDir}${
+              optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
             }
           '';
 
@@ -197,6 +282,20 @@ in
         };
       };
 
+      # pre-configure official plugins
+      services.reaction.settings.plugins = {
+        ipset = {
+          enable = mkDefault true;
+          systemd_options = {
+            CapabilityBoundingSet = [
+              "~CAP_NET_ADMIN"
+              "~CAP_PERFMON"
+            ];
+          };
+        };
+        virtual.enable = mkDefault true;
+      };
+
       environment.systemPackages = [ cfg.package ];
     };
 
diff --git a/nixos/tests/reaction-firewall.nix b/nixos/tests/reaction-firewall.nix
index 49d4d276da02..9286c036a025 100644
--- a/nixos/tests/reaction-firewall.nix
+++ b/nixos/tests/reaction-firewall.nix
@@ -17,6 +17,12 @@
           # "${pkgs.reaction}/share/examples/example.yml" # can't specify both because conflicts
         ];
         runAsRoot = true;
+        settings = {
+          # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
+          # see https://reaction.ppom.me/reference.html#systemd
+          plugins.ipset.systemd = false;
+          plugins.virtual.systemd = false;
+        };
       };
       networking.firewall.enable = true;
     };
@@ -68,6 +74,9 @@
   # - nix run .#nixosTests.reaction-firewall.driverInteractive -L
   # - run_tests()
   interactive.sshBackdoor.enable = true; # ssh -o User=root vsock%3
+  interactive.nodes.machine = _: {
+    virtualisation.graphics = false;
+  };
 
   meta.maintainers =
     with lib.maintainers;
diff --git a/nixos/tests/reaction.nix b/nixos/tests/reaction.nix
index 4cef6ead87a9..ff20f687a7e1 100644
--- a/nixos/tests/reaction.nix
+++ b/nixos/tests/reaction.nix
@@ -92,6 +92,7 @@
     {
       # not needed, only for manual interactive debugging
       virtualisation.memorySize = 4096;
+      virtualisation.graphics = false;
       environment.systemPackages = with pkgs; [
         btop
         sysz

From 94cf274c92a5ca71336b90f4a6f4f407884cff18 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 20 Feb 2026 10:54:16 +0530
Subject: [PATCH 17/54] nixos/reaction: refactor tests

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 nixos/tests/all-tests.nix                                 | 6 ++++--
 nixos/tests/{reaction.nix => reaction/basic.nix}          | 8 +++++++-
 nixos/tests/reaction/default.nix                          | 5 +++++
 .../{reaction-firewall.nix => reaction/firewall.nix}      | 0
 pkgs/by-name/re/reaction/package.nix                      | 2 +-
 5 files changed, 17 insertions(+), 4 deletions(-)
 rename nixos/tests/{reaction.nix => reaction/basic.nix} (89%)
 create mode 100644 nixos/tests/reaction/default.nix
 rename nixos/tests/{reaction-firewall.nix => reaction/firewall.nix} (100%)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0ad508dd87ec..6261b2f02cba 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1378,8 +1378,10 @@ in
   rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
   rauc = runTest ./rauc.nix;
-  reaction = runTest ./reaction.nix;
-  reaction-firewall = runTest ./reaction-firewall.nix;
+  reaction = import ./reaction {
+    inherit (pkgs) lib;
+    inherit runTest;
+  };
   readarr = runTest ./readarr.nix;
   readeck = runTest ./readeck.nix;
   realm = runTest ./realm.nix;
diff --git a/nixos/tests/reaction.nix b/nixos/tests/reaction/basic.nix
similarity index 89%
rename from nixos/tests/reaction.nix
rename to nixos/tests/reaction/basic.nix
index ff20f687a7e1..1001eb80ca95 100644
--- a/nixos/tests/reaction.nix
+++ b/nixos/tests/reaction/basic.nix
@@ -10,8 +10,14 @@
     services.reaction = {
       enable = true;
       stopForFirewall = false;
-      # example.jsonnet/example.yml can be copied and modified from ${pkgs.reaction}/share/examples
+      # example.jsonnet or example.yml can be copied and modified from ${pkgs.reaction}/share/examples
       settingsFiles = [ "${pkgs.reaction}/share/examples/example.jsonnet" ];
+      settings = {
+        # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
+        # see https://reaction.ppom.me/reference.html#systemd
+        plugins.ipset.systemd = false;
+        plugins.virtual.systemd = false;
+      };
       runAsRoot = false;
     };
     services.openssh.enable = true;
diff --git a/nixos/tests/reaction/default.nix b/nixos/tests/reaction/default.nix
new file mode 100644
index 000000000000..e4667e9e8b1d
--- /dev/null
+++ b/nixos/tests/reaction/default.nix
@@ -0,0 +1,5 @@
+{ lib, runTest }:
+lib.recurseIntoAttrs {
+  basic = runTest ./basic.nix;
+  firewall = runTest ./firewall.nix;
+}
diff --git a/nixos/tests/reaction-firewall.nix b/nixos/tests/reaction/firewall.nix
similarity index 100%
rename from nixos/tests/reaction-firewall.nix
rename to nixos/tests/reaction/firewall.nix
diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index 4edea0b94ab5..b8a693d4349a 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -71,7 +71,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     inherit (callPackage ./plugins { }) mkReactionPlugin plugins;
     updateScript = nix-update-script { };
-    tests = { inherit (nixosTests) reaction reaction-firewall; };
+    tests = nixosTests.reaction;
   };
 
   meta = {

From 4d4b662ab1a3f51c85b9a249d9b7d6dcb3045d46 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 20 Feb 2026 11:16:44 +0530
Subject: [PATCH 18/54] nixos/reaction: test core plugins

Co-authored-by: ppom <38916722+ppom0@users.noreply.github.com>
Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 nixos/tests/reaction/basic.nix    |   6 --
 nixos/tests/reaction/default.nix  |   1 +
 nixos/tests/reaction/plugins.nix  | 125 ++++++++++++++++++++++++++++++
 nixos/tests/reaction/settings.nix |  74 ++++++++++++++++++
 4 files changed, 200 insertions(+), 6 deletions(-)
 create mode 100644 nixos/tests/reaction/plugins.nix
 create mode 100644 nixos/tests/reaction/settings.nix

diff --git a/nixos/tests/reaction/basic.nix b/nixos/tests/reaction/basic.nix
index 1001eb80ca95..2b454723c8b2 100644
--- a/nixos/tests/reaction/basic.nix
+++ b/nixos/tests/reaction/basic.nix
@@ -12,12 +12,6 @@
       stopForFirewall = false;
       # example.jsonnet or example.yml can be copied and modified from ${pkgs.reaction}/share/examples
       settingsFiles = [ "${pkgs.reaction}/share/examples/example.jsonnet" ];
-      settings = {
-        # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
-        # see https://reaction.ppom.me/reference.html#systemd
-        plugins.ipset.systemd = false;
-        plugins.virtual.systemd = false;
-      };
       runAsRoot = false;
     };
     services.openssh.enable = true;
diff --git a/nixos/tests/reaction/default.nix b/nixos/tests/reaction/default.nix
index e4667e9e8b1d..38328b56c5ca 100644
--- a/nixos/tests/reaction/default.nix
+++ b/nixos/tests/reaction/default.nix
@@ -2,4 +2,5 @@
 lib.recurseIntoAttrs {
   basic = runTest ./basic.nix;
   firewall = runTest ./firewall.nix;
+  plugins = runTest ./plugins.nix;
 }
diff --git a/nixos/tests/reaction/plugins.nix b/nixos/tests/reaction/plugins.nix
new file mode 100644
index 000000000000..68bec4408469
--- /dev/null
+++ b/nixos/tests/reaction/plugins.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "reaction-core-plugins";
+
+  nodes.server = args: {
+    services.reaction = {
+      enable = true;
+      stopForFirewall = false;
+      runAsRoot = false;
+      settings = import ./settings.nix args;
+      /*
+        # NOTE: When runAsRoot is true, disable run0
+        settings = {
+          # In the qemu vm `run0 ls` as root prints nothing, so we can't use it
+          # see https://reaction.ppom.me/reference.html#systemd
+          plugins.ipset.systemd = false;
+          plugins.virtual.systemd = false;
+        };
+      */
+    };
+    /*
+      NOTE:
+        - if reaction is run as non-root, the plugins need these capabilities, remove these if runAsRoot is true
+        - CAP_DAC_READ_SEARCH is for journalctl for accessing ssh logs
+        - useful tools: capable (from package bcc), captree, getpcaps (from libpcap)
+    */
+    systemd.services.reaction.serviceConfig = {
+      CapabilityBoundingSet = [
+        "CAP_NET_ADMIN"
+        "CAP_NET_RAW"
+        "CAP_DAC_READ_SEARCH"
+      ];
+      AmbientCapabilities = [
+        "CAP_NET_ADMIN"
+        "CAP_NET_RAW"
+        "CAP_DAC_READ_SEARCH"
+      ];
+    };
+    services.openssh.enable = true;
+
+    users.users.nixos.isNormalUser = true; # neeeded to establish a ssh connection, by default root login is succeeding without any password
+  };
+
+  nodes.client = _: {
+    environment.systemPackages = [
+      pkgs.sshpass
+      pkgs.libressl.nc
+    ];
+  };
+
+  testScript =
+    { nodes, ... }: # py
+    ''
+      start_all()
+
+      # Wait for everything to be ready.
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("reaction")
+      server.wait_for_unit("sshd")
+
+      client_addr = "${(lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address}"
+      server_addr = "${(lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address}"
+
+      # Verify there is not ban and the port is reachable from the client.
+      server.succeed(f"reaction show | grep -q {client_addr} || test $? -eq 1")
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+
+      # Cause authentication failure log entries.
+      for _ in range(2):
+        client.fail(f"""
+          sshpass -p 'wrongpassword' \
+            ssh -o StrictHostKeyChecking=no \
+              -o User=nixos \
+              -o ServerAliveInterval=1 \
+              -o ServerAliveCountMax=2 \
+              {server_addr}
+        """)
+
+      # Verify there is a ban and the port is unreachable from the client.
+      server.sleep(2)
+      output = server.succeed("reaction show")
+      print(output)
+      assert client_addr in output, f"client did not get banned, {client_addr}"
+
+      client.fail(f"nc -w3 -z {server_addr} 22")
+
+      # Check that unbanning works
+      output = server.succeed("reaction flush")
+      print(output)
+
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+    '';
+
+  # Debug interactively with:
+  # - nix run .#nixosTests.reaction.driverInteractive -L
+  # - run_tests()
+  # ssh -o User=root vsock%3 (can also do vsock/3, but % works with scp etc.)
+  # ssh -o User=root vsock%4
+  interactive.sshBackdoor.enable = true;
+
+  interactive.nodes.server =
+    { config, ... }:
+    {
+      # not needed, only for manual interactive debugging
+      virtualisation.memorySize = 4096;
+      virtualisation.graphics = false;
+      environment.systemPackages = with pkgs; [
+        btop
+        sysz
+        sshpass
+        libressl.nc
+      ];
+    };
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
+      ppom
+    ]
+    ++ lib.teams.ngi.members;
+}
diff --git a/nixos/tests/reaction/settings.nix b/nixos/tests/reaction/settings.nix
new file mode 100644
index 000000000000..c342f4384f78
--- /dev/null
+++ b/nixos/tests/reaction/settings.nix
@@ -0,0 +1,74 @@
+{ config, ... }:
+let
+  banFor = name: duration: {
+    ban = {
+      type = "ipset";
+      options = {
+        set = "reaction-${name}";
+        action = "add";
+      };
+    };
+    unban = {
+      after = duration;
+      type = "ipset";
+      options = {
+        set = "reaction-${name}";
+        action = "del";
+      };
+    };
+  };
+
+  journalctl = "${config.systemd.package}/bin/journalctl";
+in
+{
+  patterns = {
+    ip = {
+      type = "ip";
+      ipv6mask = 64;
+      ignore = [
+        "127.0.0.1"
+        "::1"
+      ];
+      ignorecidr = [
+        "10.1.1.0/24"
+        "2a01:e0a:b3a:1dd0::/64"
+      ];
+    };
+  };
+
+  streams = {
+    ssh = {
+      cmd = [
+        journalctl
+        "-fn0"
+        "-o"
+        "cat"
+        "-u"
+        "sshd.service"
+      ];
+      filters = {
+        failedlogin = {
+          regex = [
+            "authentication failure;.*rhost=<ip>(?: |$)"
+            "Failed password for .* from <ip> port"
+            "Invalid user .* from <ip> "
+            "Connection (?:reset|closed) by invalid user .* <ip> port"
+          ];
+          retry = 2;
+          retryperiod = "6h";
+          actions = banFor "ssh" "48h";
+        };
+        connectionreset = {
+          regex = [
+            "Connection (?:reset|closed) by(?: authenticating user .*)? <ip> port"
+            "Received disconnect from <ip> port .*[preauth]"
+            "Timeout before authentication for connection from <ip> to"
+          ];
+          retry = 2;
+          retryperiod = "6h";
+          actions = banFor "sshreset" "48h";
+        };
+      };
+    };
+  };
+}

From 5bf2c0f2a229ec6163539271a61660d113560a66 Mon Sep 17 00:00:00 2001
From: Martin Joerg <martin.joerg@gmail.com>
Date: Tue, 24 Feb 2026 15:47:05 +0000
Subject: [PATCH 19/54] undmg: use shared zlib build

---
 pkgs/by-name/un/undmg/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/un/undmg/package.nix b/pkgs/by-name/un/undmg/package.nix
index 868062c3dde2..480d49f62588 100644
--- a/pkgs/by-name/un/undmg/package.nix
+++ b/pkgs/by-name/un/undmg/package.nix
@@ -9,6 +9,9 @@
   pkg-config,
 }:
 
+let
+  zlib' = zlib.override { static = false; };
+in
 stdenv.mkDerivation {
   pname = "undmg";
   version = "1.1.0-unstable-2024-08-02";
@@ -23,7 +26,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    zlib
+    zlib'
     bzip2
     lzfse
     xz

From 955bdf78e2cbdac33f5d746f44aa98a55ad5a964 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 24 Feb 2026 18:11:04 +0000
Subject: [PATCH 20/54] lxcfs: 6.0.5 -> 6.0.6

Changelog: https://github.com/lxc/lxcfs/releases/tag/v6.0.6
---
 pkgs/by-name/lx/lxcfs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lx/lxcfs/package.nix b/pkgs/by-name/lx/lxcfs/package.nix
index 63a8597bf885..59ea2ea6da7d 100644
--- a/pkgs/by-name/lx/lxcfs/package.nix
+++ b/pkgs/by-name/lx/lxcfs/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lxcfs";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mRTM06QyWcB4XOi0w2qvyDABGuu1SPJX0gjlBktDOac=";
+    hash = "sha256-lEXXbYDxnOi4Xa/fO1Uy/aVLjVfzYeZm6qzR4XBMBsY=";
   };
 
   patches = [
@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "FUSE filesystem for LXC";
     mainProgram = "lxcfs";
     homepage = "https://linuxcontainers.org/lxcfs";
-    changelog = "https://linuxcontainers.org/lxcfs/news/";
+    changelog = "https://github.com/lxc/lxcfs/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.lxc ];

From 55d576ea25e66cff38766a85fc9ac694a222df92 Mon Sep 17 00:00:00 2001
From: Thane Gill <me@thanegill.com>
Date: Tue, 24 Feb 2026 15:09:08 -0800
Subject: [PATCH 21/54] syncthing-macos: 1.30.0-1 -> 2.0.14-1

---
 pkgs/by-name/sy/syncthing-macos/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sy/syncthing-macos/package.nix b/pkgs/by-name/sy/syncthing-macos/package.nix
index 61a93cf2b8ae..245b0a166c12 100644
--- a/pkgs/by-name/sy/syncthing-macos/package.nix
+++ b/pkgs/by-name/sy/syncthing-macos/package.nix
@@ -3,15 +3,16 @@
   fetchurl,
   stdenv,
   undmg,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syncthing-macos";
-  version = "1.30.0-1";
+  version = "2.0.14-1";
 
   src = fetchurl {
     url = "https://github.com/syncthing/syncthing-macos/releases/download/v${finalAttrs.version}/Syncthing-${finalAttrs.version}.dmg";
-    hash = "sha256-9kerr89PZ90fQwxPfqrSlujuLYY9THv6Ne/cUErt3YU=";
+    hash = "sha256-5BjYwS2xcANqEXWadbppUwIGNd1UTQjzhWIAyATwWEU=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -27,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
+
   meta = {
     description = "Official frugal and native macOS Syncthing application bundle";
     homepage = "https://github.com/syncthing/syncthing-macos";

From b2ceab11a3a9970f235feee93026ed53bdd75db2 Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Wed, 25 Feb 2026 16:53:10 +0000
Subject: [PATCH 22/54] moonlight: 2026.2.1 -> 2026.2.2

Diff: https://github.com/moonlight-mod/moonlight/compare/v2026.2.1...v2026.2.2

Changelog: https://raw.githubusercontent.com/moonlight-mod/moonlight/refs/tags/v2026.2.2/CHANGELOG.md
---
 pkgs/by-name/mo/moonlight/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 4cfc622e53a3..c6c59fc92ed7 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.2.1";
+  version = "2026.2.2";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BpTN9AdQEDD2XnEUsUxgkoq+EPGhtnYgJhLKF4GVZoc=";
+    hash = "sha256-wZEpoUlDEbObXD5d2uA5vNBRrFOw4A6VLAc/MVNC4EE=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-b3d8VcfQjCkcJThebXJ2yvKZfU8u4QnpZgNyqP6XIu0=";
+    hash = "sha256-1jGEzTPPlwAFDKPbH92HvYg4rzFrUJLqhZRMNS+H6GI=";
   };
 
   env = {

From 072848b7afaad0132c5241236145039dcab1dcd3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Feb 2026 18:25:46 +0000
Subject: [PATCH 23/54] n8n: 2.8.3 -> 2.9.4

---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index c2a673959fd8..cd5de0265588 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -25,20 +25,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.8.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-xbJZD+L/8ZK7GPqFKO6H/Cg40Pk2cqN3MWC+mNFVxbI=";
+    hash = "sha256-XXQPZHtY66gOQ+nYH+Q1IjbR+SRZ9g06sgBy2x8gGh4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-gX4pYiztKIRFbJNZhtQviWpp80teOzX1JaYKylGe4TY=";
+    hash = "sha256-TU7HIShYj20QtdcthP0nQdubYl0bdy+XM3CoX5Rvhzk=";
   };
 
   nativeBuildInputs = [

From 6bda2431f4dc280995e3e7393e9cf412534c3a65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 25 Feb 2026 20:17:21 +0100
Subject: [PATCH 24/54] nixosTests.n8n: rename machine to machine_configured,
 tiny refactor

---
 nixos/tests/n8n.nix | 58 ++++++++++++++++++++++-----------------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix
index 270f63648904..77d488bf56e9 100644
--- a/nixos/tests/n8n.nix
+++ b/nixos/tests/n8n.nix
@@ -16,9 +16,8 @@ in
 
   node.pkgsReadOnly = false;
 
-  nodes.machine =
-    { ... }:
-    {
+  nodes = {
+    machine_configured = {
       services.n8n = {
         enable = true;
         customNodes = [ pkgs.n8n-nodes-carbonejs ];
@@ -49,52 +48,53 @@ in
         };
       };
     };
+  };
 
   testScript = ''
-    machine.wait_for_unit("n8n.service")
-    machine.wait_for_console_text("Editor is now accessible via")
+    machine_configured.wait_for_unit("n8n.service")
+    machine_configured.wait_for_console_text("Editor is now accessible via")
 
     # Test regular environment variables
-    machine.succeed("curl --fail -vvv http://localhost:${toString port}/")
-    machine.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
-    machine.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_DIAGNOSTICS_ENABLED=false' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_TEMPLATES_ENABLED=false' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'DB_PING_INTERVAL_SECONDS=2' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("curl --fail -vvv http://localhost:${toString port}/")
+    machine_configured.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
+    machine_configured.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_DIAGNOSTICS_ENABLED=false' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_TEMPLATES_ENABLED=false' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'DB_PING_INTERVAL_SECONDS=2' /etc/systemd/system/n8n.service")
 
     # Test _FILE environment variables
-    machine.succeed("grep -qF 'LoadCredential=n8n_encryption_key_file:${secretFile}' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_ENCRYPTION_KEY_FILE=%d/n8n_encryption_key_file' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_encryption_key_file:${secretFile}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_ENCRYPTION_KEY_FILE=%d/n8n_encryption_key_file' /etc/systemd/system/n8n.service")
 
     # Test custom nodes
-    machine.succeed("grep -qF 'N8N_CUSTOM_EXTENSIONS=' /etc/systemd/system/n8n.service")
-    custom_extensions_dir = machine.succeed("grep -oP 'N8N_CUSTOM_EXTENSIONS=\\K[^\"]+' /etc/systemd/system/n8n.service").strip()
-    machine.succeed(f"test -L {custom_extensions_dir}/n8n-nodes-carbonejs")
-    machine.succeed(f"test -f {custom_extensions_dir}/n8n-nodes-carbonejs/package.json")
+    machine_configured.succeed("grep -qF 'N8N_CUSTOM_EXTENSIONS=' /etc/systemd/system/n8n.service")
+    custom_extensions_dir = machine_configured.succeed("grep -oP 'N8N_CUSTOM_EXTENSIONS=\\K[^\"]+' /etc/systemd/system/n8n.service").strip()
+    machine_configured.succeed(f"test -L {custom_extensions_dir}/n8n-nodes-carbonejs")
+    machine_configured.succeed(f"test -f {custom_extensions_dir}/n8n-nodes-carbonejs/package.json")
 
     # Test task runner integration on n8n service
-    machine.succeed("grep -qF 'N8N_RUNNERS_MODE=external' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'N8N_RUNNERS_BROKER_PORT=${toString brokerPort}' /etc/systemd/system/n8n.service")
-    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_MODE=external' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_BROKER_PORT=${toString brokerPort}' /etc/systemd/system/n8n.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n.service")
 
     # Test task runner service
-    machine.wait_for_unit("n8n-task-runner.service")
-    machine.succeed("systemctl is-active n8n-task-runner.service")
+    machine_configured.wait_for_unit("n8n-task-runner.service")
+    machine_configured.succeed("systemctl is-active n8n-task-runner.service")
 
     # Test that both runner types are enabled
-    machine.succeed("grep -qF 'javascript python' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'javascript python' /etc/systemd/system/n8n-task-runner.service")
 
     # Test common environment variables are passed to launcher
-    machine.succeed("grep -qF 'N8N_RUNNERS_MAX_CONCURRENCY=10' /etc/systemd/system/n8n-task-runner.service")
-    machine.succeed("grep -qF 'N8N_RUNNERS_TASK_BROKER_URI=http://127.0.0.1:${toString brokerPort}' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_MAX_CONCURRENCY=10' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'N8N_RUNNERS_TASK_BROKER_URI=http://127.0.0.1:${toString brokerPort}' /etc/systemd/system/n8n-task-runner.service")
 
     # Test auth token is loaded via credentials
-    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n-task-runner.service")
+    machine_configured.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n-task-runner.service")
 
     # Test launcher config file
-    config_path = machine.succeed("grep -oP 'N8N_RUNNERS_CONFIG_PATH=\\K[^[:space:]\"]+' /etc/systemd/system/n8n-task-runner.service").strip()
-    config = machine.succeed(f"cat {config_path}")
+    config_path = machine_configured.succeed("grep -oP 'N8N_RUNNERS_CONFIG_PATH=\\K[^[:space:]\"]+' /etc/systemd/system/n8n-task-runner.service").strip()
+    config = machine_configured.succeed(f"cat {config_path}")
     assert "NODE_FUNCTION_ALLOW_BUILTIN" in config, "JavaScript env-override not in config"
     assert "N8N_RUNNERS_STDLIB_ALLOW" in config, "Python env-override not in config"
     assert "N8N_RUNNERS_MAX_CONCURRENCY" in config, "Common allowed-env not in config"

From 6922af6e7a6218c16f49787a0ccb7541afac10c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 25 Feb 2026 20:22:52 +0100
Subject: [PATCH 25/54] nixosTests.n8n: add simple config

Currently fails.
---
 nixos/tests/n8n.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix
index 77d488bf56e9..3d2c1ad4d9c1 100644
--- a/nixos/tests/n8n.nix
+++ b/nixos/tests/n8n.nix
@@ -17,6 +17,9 @@ in
   node.pkgsReadOnly = false;
 
   nodes = {
+    machine_simple = {
+      services.n8n.enable = true;
+    };
     machine_configured = {
       services.n8n = {
         enable = true;
@@ -51,6 +54,11 @@ in
   };
 
   testScript = ''
+    machine_simple.wait_for_unit("n8n.service")
+    machine_simple.wait_for_console_text("Editor is now accessible via")
+    machine_simple.succeed("curl --fail -vvv http://localhost:${toString port}/")
+
+
     machine_configured.wait_for_unit("n8n.service")
     machine_configured.wait_for_console_text("Editor is now accessible via")
 

From 6a7650ebddf91d38b867cc35151be8fbebd6cf19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 25 Feb 2026 20:41:43 +0100
Subject: [PATCH 26/54] nixos/n8n: move N8N_RUNNERS_CONFIG_PATH option to the
 final environment

Without this, the next commit would cause an infinite recursion error.
---
 nixos/modules/services/misc/n8n.nix | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 7e302a190a87..ed149ce75952 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -240,14 +240,6 @@ in
               (coercedTo bool builtins.toJSON str)
             ]);
           options = {
-            N8N_RUNNERS_CONFIG_PATH = lib.mkOption {
-              internal = true;
-              type = with lib.types; nullOr path;
-              default = launcherConfigFile;
-              description = ''
-                Path to the configuration file for the task runner launcher.
-              '';
-            };
             N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkOption {
               type = with lib.types; nullOr path;
               default = cfg.environment.N8N_RUNNERS_AUTH_TOKEN_FILE;
@@ -401,7 +393,11 @@ in
       after = [ "n8n.service" ];
       requires = [ "n8n.service" ];
       wantedBy = [ "multi-user.target" ];
-      environment = runnersEnv.regular // runnersEnv.fileBasedTransformed;
+      environment = {
+        N8N_RUNNERS_CONFIG_PATH = launcherConfigFile;
+      }
+      // runnersEnv.regular
+      // runnersEnv.fileBasedTransformed;
       serviceConfig = {
         Type = "simple";
         ExecStart = "${lib.getExe runnersCfg.launcherPackage} ${lib.concatStringsSep " " runnerTypes}";

From 5ad853409cf18274ab2b061b2d83231e5a31a3f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 25 Feb 2026 20:42:56 +0100
Subject: [PATCH 27/54] nixos/n8n: fix eval error with null environment
 variables

---
 nixos/modules/services/misc/n8n.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index ed149ce75952..30b1f284b10d 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -10,8 +10,9 @@ let
   # Partition environment variables into regular and file-based (_FILE suffix)
   envVarToCredName = varName: lib.toLower varName;
   partitionEnv =
-    env:
+    allEnv:
     let
+      env = lib.filterAttrs (_name: value: value != null) allEnv;
       regular = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) env;
       fileBased = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) env;
       fileBasedTransformed = lib.mapAttrs' (

From 0963ea589053c35d7bae494bce6b2e7b24101d91 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 26 Feb 2026 14:02:12 +0000
Subject: [PATCH 28/54] ngtcp2-gnutls: 1.20.0 -> 1.21.0

---
 pkgs/development/libraries/ngtcp2/gnutls.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 17e1f569f8c6..62b03f8b230e 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    hash = "sha256-8enkRWmPLZXBtlD9v8N7zuZB+Fv+igl30W7q2UqI2ZE=";
+    hash = "sha256-8dfktmiiwJ0CVB5BCNBLmTYuUG9Y9Ik2esJNmynJvCU=";
   };
 
   outputs = [

From d253a4e1b94809c6f1fa45a597611c10da896df3 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 26 Feb 2026 10:27:07 -0500
Subject: [PATCH 29/54] incus-ui-canonical: 0.19.7 -> 0.19.8

---
 pkgs/by-name/in/incus-ui-canonical/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index b86aaa916b29..496499e9ff86 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "incus-ui-canonical";
-  version = "0.19.7";
+  version = "0.19.8";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${finalAttrs.version}";
-    hash = "sha256-YMUGEHhfwDzasSZOqnlhb7zw5qG+LRlKhIHCuAztu2M=";
+    hash = "sha256-Dql04inmmWi7X6dQdjJmw0hkIBxlNlnwlTrK3/EN3yA=";
   };
 
   offlineCache = fetchYarnDeps {

From f0f242ec4e9fc096c38619a2f5bf063721796c5f Mon Sep 17 00:00:00 2001
From: RoGreat <roguegreat@gmail.com>
Date: Wed, 31 Dec 2025 21:29:37 -0600
Subject: [PATCH 30/54] pascube: 1.5.1 -> 1.7.0

---
 pkgs/by-name/pa/pascube/package.nix | 67 ++++++++++++-----------------
 1 file changed, 27 insertions(+), 40 deletions(-)

diff --git a/pkgs/by-name/pa/pascube/package.nix b/pkgs/by-name/pa/pascube/package.nix
index 2d8a1684bce2..61582ef04c47 100644
--- a/pkgs/by-name/pa/pascube/package.nix
+++ b/pkgs/by-name/pa/pascube/package.nix
@@ -1,47 +1,46 @@
 {
-  autoPatchelfHook,
-  copyDesktopItems,
+  clangStdenv,
   fetchFromGitHub,
   fpc,
   lazarus-qt6,
   lib,
-  libGLU,
-  makeDesktopItem,
+  libx11,
+  makeWrapper,
   nix-update-script,
   qt6Packages,
-  stdenv,
+  SDL2,
+  vulkan-loader,
+  zlib,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "pascube";
-  version = "1.5.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "pascube";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-djkrMgX3RTTXSLISYpBfdyCIh3/WWODxd473M53iFKE=";
+    tag = finalAttrs.version;
+    hash = "sha256-qKjOA5/l2trQC238WheeOzqbpltjkwksqzMtcfw7ci0=";
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
     fpc
     lazarus-qt6
+    makeWrapper
     qt6Packages.wrapQtAppsHook
   ];
 
   buildInputs = [
     qt6Packages.libqtpas
     qt6Packages.qtbase
-  ];
-
-  runtimeDependencies = [
-    libGLU
+    SDL2
   ];
 
   buildPhase = ''
     runHook preBuild
+    clang -c -O3 -D linux -fverbose-asm -fno-builtin \
+      pasvulkan/src/lzma_c/LzmaDec.c -o pasvulkan/src/lzma_c/lzmadec_linux_x86_64.o
     HOME=$(mktemp -d) lazbuild \
       --lazarusdir=${lazarus-qt6}/share/lazarus \
       --widgetset=qt6 \
@@ -52,45 +51,33 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
     install -Dm755 pascube $out/bin/pascube
+    wrapProgram $out/bin/pascube --prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        libx11
+        SDL2
+        vulkan-loader
+        zlib
+      ]
+    }
+    mkdir -p $out/share/pascube
+    cp -a assets $out/share/pascube
+    install -Dm644 data/pascube.desktop $out/share/applications/pascube.desktop
     for sz in 128x128 256x256 512x512; do
       install -Dm644 "data/icons/''${sz}/pascube.png" \
         "$out/share/icons/hicolor/''${sz}/apps/pascube.png"
     done
-    install -Dm644 "data/skybox.png" "$out/share/pascube/skybox.png"
     runHook postInstall
   '';
 
-  desktopItems = [
-    (makeDesktopItem {
-      name = "pascube";
-      desktopName = "pasCube";
-      comment = finalAttrs.meta.description;
-      exec = finalAttrs.meta.mainProgram;
-      icon = "pascube";
-      terminal = false;
-      categories = [
-        "Graphics"
-        "Education"
-        "Qt"
-      ];
-    })
-  ];
-
-  preFixup = ''
-    qtWrapperArgs+=(
-      --set QT_QPA_PLATFORM xcb
-    )
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Simple OpenGL spinning cube written in Pascal";
     homepage = "https://github.com/benjamimgois/pascube";
-    changelog = "https://github.com/benjamimgois/pascube/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/benjamimgois/pascube/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ RoGreat ];
     mainProgram = "pascube";
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 })

From 7fb16ae3de395ccffa09a532dc4f40a80bd523fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 00:27:59 +0000
Subject: [PATCH 31/54] cargo-public-api: 0.50.2 -> 0.51.0

---
 pkgs/by-name/ca/cargo-public-api/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index 2e72b7526c4e..177486c90f51 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.50.2";
+  version = "0.51.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Lg8X0t5u4Mq/eWc0yfuLyn4HlE+j6qSsLE+MFBjBpbk=";
+    hash = "sha256-fnkoIXv6QYJPYtsLZldOEjOxke6YVDEds3jF5SGZGKE=";
   };
 
-  cargoHash = "sha256-OjuCABObMRkFrTbtV4wpSHzV9Yqmwr/VotmsUW9qUDk=";
+  cargoHash = "sha256-F4s3h+WF/S6sQ9ux28sqNe9+C1I5H9735b+cVuRFjk8=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 00cbbf8014938da2077afc3ec02c01b6c2399385 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 01:12:02 +0000
Subject: [PATCH 32/54] zensical: 0.0.23 -> 0.0.24

---
 pkgs/by-name/ze/zensical/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zensical/package.nix b/pkgs/by-name/ze/zensical/package.nix
index 70ecee996539..27d11cfe010f 100644
--- a/pkgs/by-name/ze/zensical/package.nix
+++ b/pkgs/by-name/ze/zensical/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zensical";
-  version = "0.0.23";
+  version = "0.0.24";
   pyproject = true;
 
   # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   # We could combine sources, but then nix-update won't work.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-XE/DqvB135nYz0G58lZuTViBgNmolJMBTTYH3+UKxLw=";
+    hash = "sha256-tdmeIlMpv0+YyAIr3woO6ViML62ntN8be4lvzGKzfsM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-cS8gxMPRpMMHwrjqXjyxBl4dbwll01Y+G4eOBZ3/vdM=";
+    hash = "sha256-oBg9wq/hJPvAIpl6IEJKVAWnUIVO6L+3q+L5z9UtvKg=";
   };
 
   nativeBuildInputs = with rustPlatform; [

From 0493754db84cfdc7304b3749d0ffe3e10a91583f Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Thu, 26 Feb 2026 22:42:26 -0600
Subject: [PATCH 33/54] luaPackages.luaexpat: 1.4.1-1 -> 1.5.2-1

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
---
 maintainers/scripts/luarocks-packages.csv           |  2 +-
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 6b5e9dd045b9..98ec3ae17cdd 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -78,7 +78,7 @@ luadbi-postgresql,,,,,,
 luadbi-sqlite3,,,,,,
 luaepnf,,,,,,
 luaevent,,,,,,
-luaexpat,,,,1.4.1-1,,arobyn flosse
+luaexpat,,,,,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
 luafilesystem,,,,,,flosse
 lualdap,,,,,,aanderse
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index dfcc51cb6e30..5a03d98ebeea 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2593,17 +2593,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luaexpat";
-      version = "1.4.1-1";
+      version = "1.5.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luaexpat-1.4.1-1.rockspec";
-          sha256 = "1abwd385x7wnza7qqz5s4aj6m2l1c23pjmbgnpq73q0s17pn1h0c";
+          url = "mirror://luarocks/luaexpat-1.5.2-1.rockspec";
+          sha256 = "0wdbph2c92zmvvyp3q669rbjy1xjm7jy1i13lin8b636vswykw6p";
         }).outPath;
       src = fetchFromGitHub {
         owner = "lunarmodules";
         repo = "luaexpat";
-        tag = "1.4.1";
-        hash = "sha256-SnI+a7555R/EFFdnrvJohP6uzwQiMNQPqgp0jxAI178=";
+        tag = "1.5.2";
+        hash = "sha256-PudxKlN4WKUUK/h6ekVNSa/C453CnLh3TxCncXIOiw8=";
       };
 
       disabled = luaOlder "5.1";

From b5180e0d548a19b91812fd384d0d59997dd6d33e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 08:34:04 +0000
Subject: [PATCH 34/54] jnv: 0.6.1 -> 0.6.2

---
 pkgs/by-name/jn/jnv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index fc5f995c0a90..2b7f08212d04 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jnv";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VjT0S+eEaO8FOPb1grIpheeP9v1dCpV7FRHn+nJXOEM=";
+    hash = "sha256-sW3wy5m3fnTDIxRC/E/EWEvuJ92o+l4QCmwdqL2tZ98=";
   };
 
-  cargoHash = "sha256-dR9cb3TBxrRGP3BFYro/nGe5XVEfJuTZbQLo+FUfFNs=";
+  cargoHash = "sha256-jKeAgeW54lAgcv6Xpz9Rwt10tdac4S4B5EAmwanaW9c=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From cbc74d0d5f41365ae4b2bedc25bef7401f0d1397 Mon Sep 17 00:00:00 2001
From: pancaek <20342389+pancaek@users.noreply.github.com>
Date: Fri, 27 Feb 2026 01:00:26 -0800
Subject: [PATCH 35/54] freefilesync: move icon to spec-compliant location

---
 pkgs/by-name/fr/freefilesync/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index 2887b84b11a7..3d90f41dbc61 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -110,8 +110,8 @@ stdenv.mkDerivation (finalAttrs: {
     cp -R FreeFileSync/Build/* $out
     mv $out/{Bin,bin}
 
-    mkdir -p $out/share/pixmaps
-    unzip -j $out/Resources/Icons.zip '*Sync.png' -d $out/share/pixmaps
+    mkdir -p $out/share/icons/hicolor/128x128/apps
+    unzip -j $out/Resources/Icons.zip '*Sync.png' -d $out/share/icons/hicolor/128x128/apps
 
     runHook postInstall
   '';

From 48e1691c78ff410fd372f2f5190185e01798d161 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 09:11:38 +0000
Subject: [PATCH 36/54] postgresqlPackages.vectorchord: 1.0.0 -> 1.1.0

---
 pkgs/servers/sql/postgresql/ext/vectorchord/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 7eef0c06e74b..62b8cb1c7b91 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -12,16 +12,16 @@ buildPgrxExtension (finalAttrs: {
   cargo-pgrx = cargo-pgrx_0_16_0;
 
   pname = "vectorchord";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "tensorchord";
     repo = "vectorchord";
     tag = finalAttrs.version;
-    hash = "sha256-+BOuiinbKPZZaDl9aYsIoZPgvLZ4FA6Rb4/W+lAz4so=";
+    hash = "sha256-8Gk5/wIGu5/t8EKeG9Wna7yUWKiuCOC9yjJFo2euF/I=";
   };
 
-  cargoHash = "sha256-kwe2x7OTjpdPonZsvnR1C/89D5W/R5JswYF79YcSFEA=";
+  cargoHash = "sha256-o7NZEH3NCf/T81kL7jDa4HHGWsyTkLXXhq4KQR2/PGM=";
 
   # Include upgrade scripts in the final package
   # https://github.com/tensorchord/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366

From 39a5ef7a7c7e151368ad43cb3fe2540bd686319d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 09:42:49 +0000
Subject: [PATCH 37/54] kaput-cli: 2.5.0 -> 2.6.0

---
 pkgs/by-name/ka/kaput-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ka/kaput-cli/package.nix b/pkgs/by-name/ka/kaput-cli/package.nix
index 1fc0631f9f87..c16fc227e243 100644
--- a/pkgs/by-name/ka/kaput-cli/package.nix
+++ b/pkgs/by-name/ka/kaput-cli/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kaput-cli";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "davidchalifoux";
     repo = "kaput-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sy8k9L9rmiRFzvhLc+hYl9OqmmP8INLxMNRjAx7/V8g=";
+    hash = "sha256-N+vdK9DpooPEtXVUNZtmbdjVSpN5ddYggb4FsrvyCwU=";
   };
 
-  cargoHash = "sha256-yb56rrPlTuc7O4fF9NPNB2djCfq3fLu2hD4gUjRHvqM=";
+  cargoHash = "sha256-bz7K3eWv9i50k5nXBb9k8IZ+xPIz4PSomp6K2LDSH78=";
 
   env = {
     OPENSSL_NO_VENDOR = 1;

From f3db9f33f2e3d8252bd5d5c56e2b6f2a13537a53 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 26 Feb 2026 08:32:10 +0000
Subject: [PATCH 38/54] python3Packages.wandb: 0.24.0 -> 0.25.0

Diff: https://github.com/wandb/wandb/compare/v0.24.0...v0.25.0

Changelog: https://github.com/wandb/wandb/raw/0.25.0/CHANGELOG.md
---
 pkgs/development/python-modules/wandb/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 56aa5a429995..efce4dd939c3 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -75,12 +75,12 @@
 }:
 
 let
-  version = "0.24.0";
+  version = "0.25.0";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-dICa/sIFEHI59gJxrvWyI9Uc3rbwXi+Xh60O/hElZh0=";
+    hash = "sha256-ouJHMPcWiHn2p0mFatmC28xUmjzxsoDW9WBX6FzjyDc=";
   };
 
   gpu-stats = rustPlatform.buildRustPackage {
@@ -90,7 +90,7 @@ let
 
     sourceRoot = "${src.name}/gpu_stats";
 
-    cargoHash = "sha256-iZinowkbBc3nuE0uRS2zLN2y97eCMD1mp/MKVKdnXaE=";
+    cargoHash = "sha256-yzvXJYkQTNOScOI3yfVBH6IGZzcFduuXqW3pI5hEZGw=";
 
     checkFlags = [
       # fails in sandbox

From ddb0b4875609baad0cae19d0462943ef77f1e9da Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 26 Feb 2026 16:51:04 +0000
Subject: [PATCH 39/54] python3Packages.pymilvus: cosmetic changes

---
 pkgs/development/python-modules/pymilvus/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 668c49daebfa..52285d5bfdd5 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -79,6 +79,8 @@ buildPythonPackage (finalAttrs: {
     ];
   };
 
+  pythonImportsCheck = [ "pymilvus" ];
+
   nativeCheckInputs = [
     grpcio-testing
     pytest-asyncio
@@ -88,13 +90,13 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ finalAttrs.passthru.optional-dependencies.bulk_writer;
 
-  pythonImportsCheck = [ "pymilvus" ];
-
   disabledTests = [
     # tries to read .git
     "test_get_commit"
+
     # requires network access
     "test_deadline_exceeded_shows_connecting_state"
+
     # mock issue in sandbox
     "test_milvus_client_creates_unbound_alias"
   ];
@@ -102,6 +104,7 @@ buildPythonPackage (finalAttrs: {
   disabledTestPaths = [
     # requires running milvus server
     "examples/"
+
     # tries to write to nix store
     "tests/test_bulk_writer_stage.py"
   ];
@@ -109,7 +112,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python SDK for Milvus";
     homepage = "https://github.com/milvus-io/pymilvus";
-    changelog = "https://github.com/milvus-io/pymilvus/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/milvus-io/pymilvus/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ happysalada ];
   };

From 62603017174e84b60f632ecaee5a565bd91e4871 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 26 Feb 2026 17:54:47 +0000
Subject: [PATCH 40/54] python3Packages.spacy-transformers: cleanup, fix

---
 .../spacy-transformers/default.nix            | 45 +++++++++++++------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 9e92c08480fe..1b3376fa3a24 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -3,18 +3,24 @@
   callPackage,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+
+  # build-system
   cython,
-  spacy,
+  setuptools,
+
+  # dependencies
   numpy,
-  transformers,
-  torch,
-  srsly,
+  spacy,
   spacy-alignments,
+  srsly,
+  torch,
+  transformers,
+
+  # tests
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spacy-transformers";
   version = "1.3.9";
   pyproject = true;
@@ -22,22 +28,33 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "spacy-transformers";
-    tag = "release-v${version}";
+    tag = "release-v${finalAttrs.version}";
     hash = "sha256-06M/e8/+hMVQdZfqyI3qGaZY7iznMwMtblEkFR6Sro0=";
   };
 
+  # ImportError: cannot import name 'BatchEncoding' from 'transformers.tokenization_utils' (unknown location)
+  postPatch = ''
+    substituteInPlace \
+      spacy_transformers/data_classes.py \
+      spacy_transformers/layers/transformer_model.py \
+      spacy_transformers/util.py \
+      --replace-fail \
+        "from transformers.tokenization_utils import BatchEncoding" \
+        "from transformers import BatchEncoding"
+  '';
+
   build-system = [
-    setuptools
     cython
+    setuptools
   ];
 
   dependencies = [
-    spacy
     numpy
-    transformers
-    torch
-    srsly
+    spacy
     spacy-alignments
+    srsly
+    torch
+    transformers
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -54,8 +71,8 @@ buildPythonPackage rec {
   meta = {
     description = "spaCy pipelines for pretrained BERT, XLNet and GPT-2";
     homepage = "https://github.com/explosion/spacy-transformers";
-    changelog = "https://github.com/explosion/spacy-transformers/releases/tag/${src.tag}";
+    changelog = "https://github.com/explosion/spacy-transformers/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})

From ad13c4f44d85a4a2d5d7ae6b2c4d9727508f5365 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 26 Feb 2026 17:56:43 +0000
Subject: [PATCH 41/54] python3Packages.lerobot: fix

---
 pkgs/development/python-modules/lerobot/default.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/python-modules/lerobot/default.nix b/pkgs/development/python-modules/lerobot/default.nix
index 90730adc2769..187fac569c01 100644
--- a/pkgs/development/python-modules/lerobot/default.nix
+++ b/pkgs/development/python-modules/lerobot/default.nix
@@ -58,6 +58,7 @@ buildPythonPackage (finalAttrs: {
   pythonRelaxDeps = [
     "av"
     "datasets"
+    "diffusers"
     "draccus"
     "gymnasium"
     "huggingface-hub"
@@ -104,6 +105,17 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = [
+    # TypeError: only 0-dimensional arrays can be converted to Python scalars
+    "test_add_frame"
+    "test_add_frame_state_numpy"
+    "test_data_consistency_across_episodes"
+    "test_delta_timestamps_query_returns_correct_values"
+    "test_episode_boundary_integrity"
+    "test_from_lerobot_dataset"
+    "test_statistics_metadata_validation"
+    "test_task_indexing_and_validation"
+    "test_to_lerobot_dataset"
+
     # RuntimeError: OpenCVCamera(/build/source/tests/artifacts/cameras/image_480x270.png) read failed
     "test_async_read"
     "test_fourcc_with_camer"

From 5b217270d64f53be6a79eae2479d38751ee52d0f Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 27 Feb 2026 13:28:57 +0100
Subject: [PATCH 42/54] freerdp: 3.22.0 -> 3.23.0

https://www.freerdp.com/2026/02/25/3_23_0-release

Fixes:
* CVE-2026-26271 / https://github.com/NixOS/nixpkgs/issues/494703
* CVE-2026-26965 / https://github.com/NixOS/nixpkgs/issues/494702
* CVE-2026-26955 / https://github.com/NixOS/nixpkgs/issues/494699
* CVE-2026-27951 / https://github.com/NixOS/nixpkgs/issues/494712
* CVE-2026-25952 / https://github.com/NixOS/nixpkgs/issues/494700
* CVE-2026-26986 / https://github.com/NixOS/nixpkgs/issues/494708
* CVE-2026-25997 / https://github.com/NixOS/nixpkgs/issues/494710
* CVE-2026-25953 / https://github.com/NixOS/nixpkgs/issues/494706
* CVE-2026-25955 / https://github.com/NixOS/nixpkgs/issues/494705
* CVE-2026-25959 / https://github.com/NixOS/nixpkgs/issues/494701
* CVE-2026-25942 / https://github.com/NixOS/nixpkgs/issues/494697
* CVE-2026-27015 / https://github.com/NixOS/nixpkgs/issues/494709
* CVE-2026-25954 / https://github.com/NixOS/nixpkgs/issues/494704
* CVE-2026-25941 / https://github.com/NixOS/nixpkgs/issues/494698
* CVE-2026-27950 / https://github.com/NixOS/nixpkgs/issues/494696
---
 pkgs/by-name/fr/freerdp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix
index 67a1f72cbfff..983691553f72 100644
--- a/pkgs/by-name/fr/freerdp/package.nix
+++ b/pkgs/by-name/fr/freerdp/package.nix
@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.22.0";
+  version = "3.23.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-cJFY0v2zvbaKVINOKVZGvLozwgD7kf2ffVU9EGYBMGQ=";
+    hash = "sha256-WGuRnNwcvxwIudSzPoJB4BmaTLHKU7bsZkgWmzJPLSQ=";
   };
 
   postPatch = ''

From 006fbf16a6eb6e58c28778587b3ce6614af36bce Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 27 Feb 2026 20:46:15 +0800
Subject: [PATCH 43/54] qemu: add fuse support

---
 pkgs/applications/virtualization/qemu/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index eab01e012993..45af6fe007a7 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -88,6 +88,8 @@
   tpmSupport ? !minimal,
   uringSupport ? stdenv.hostPlatform.isLinux && !userOnly,
   liburing,
+  fuseSupport ? stdenv.hostPlatform.isLinux && !minimal,
+  fuse3,
   canokeySupport ? false,
   canokey-qemu,
   capstoneSupport ? !minimal,
@@ -241,6 +243,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals libiscsiSupport [ libiscsi ]
   ++ lib.optionals smbdSupport [ samba ]
   ++ lib.optionals uringSupport [ liburing ]
+  ++ lib.optionals fuseSupport [ fuse3 ]
   ++ lib.optionals canokeySupport [ canokey-qemu ]
   ++ lib.optionals capstoneSupport [ capstone ]
   ++ lib.optionals valgrindSupport [ valgrind-light ];
@@ -324,6 +327,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional libiscsiSupport "--enable-libiscsi"
   ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd"
   ++ lib.optional uringSupport "--enable-linux-io-uring"
+  ++ lib.optional fuseSupport "--enable-fuse"
   ++ lib.optional canokeySupport "--enable-canokey"
   ++ lib.optional capstoneSupport "--enable-capstone"
   ++ lib.optional (!pluginsSupport) "--disable-plugins"

From 06f214abdc0f4fc813bd3ff935f6e929c67fae3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 27 Feb 2026 14:02:41 +0100
Subject: [PATCH 44/54] Revert "passt: 2025_09_19.623dbf6 ->
 2026_01_20.386b5f5"

---
 pkgs/by-name/pa/passt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/passt/package.nix b/pkgs/by-name/pa/passt/package.nix
index 799dbe2f3eb6..064b36f21465 100644
--- a/pkgs/by-name/pa/passt/package.nix
+++ b/pkgs/by-name/pa/passt/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passt";
-  version = "2026_01_20.386b5f5";
+  version = "2025_09_19.623dbf6";
 
   src = fetchurl {
     url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-s3izbMbReYj9jv3J5DJJWvyWeHw+4jGu5VvH5QxO320=";
+    hash = "sha256-3krWW/QKijgZsmHuelMjpcaL8OyRqmPKC/wUvag0ZHI=";
   };
 
   separateDebugInfo = true;

From 2d04a4c4063cb2400588297fe6c6bd84f18abdd1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 27 Feb 2026 16:08:54 +0300
Subject: [PATCH 45/54] Revert "kernel updates for 2026-02-26"

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index fad7f3538163..0dd8cc79f635 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,13 +30,13 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.14",
-        "hash": "sha256:1f3wv9vdg43cy1lnqd60zqgki6px67mdhfkfnpk1npqq5akk86cd",
-        "lts": true
+        "version": "6.18.13",
+        "hash": "sha256:0zv8qml075jpk2i58cxp61hm3yb74mpkbkjg15n87riqzmakqb7d",
+        "lts": false
     },
     "6.19": {
-        "version": "6.19.4",
-        "hash": "sha256:1b68i7z91fbs1zayzzzf71g9ilfk0wi2fr8nralha60xq723p6r7",
+        "version": "6.19.3",
+        "hash": "sha256:1glf369wfr66lmv9wmijin6idlfgijfsh0gx2qly7gpwmml4jiqf",
         "lts": false
     }
 }

From 6f91f521c29680549dd50d99ce2bef86f5e1e13d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 13:31:41 +0000
Subject: [PATCH 46/54] slade-unstable: 3.2.11-unstable-2026-02-18 ->
 3.2.12-unstable-2026-02-21

---
 pkgs/by-name/sl/slade-unstable/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sl/slade-unstable/package.nix b/pkgs/by-name/sl/slade-unstable/package.nix
index 14eebfe9310e..3377d07a6a2c 100644
--- a/pkgs/by-name/sl/slade-unstable/package.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.11-unstable-2026-02-18";
+  version = "3.2.12-unstable-2026-02-21";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "3615810ce2aee36909fb0a1a1e8a605edc2caf81";
-    hash = "sha256-/70LynJvcrjM4ztudaPp2pv6hPy+TQXwafwLj0n7T8E=";
+    rev = "030cab09eb2108c65b47c088d1ce97d27e671b9a";
+    hash = "sha256-dU08yoHikQsGO9yEhFoRvWE1C38ZQ1W/f7DmJyrAijQ=";
   };
 
   nativeBuildInputs = [

From 528937c2edeac77563f888477c98e0911b74c67f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 13:39:26 +0000
Subject: [PATCH 47/54] sizelint: 0.1.4 -> 0.1.5

---
 pkgs/by-name/si/sizelint/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/sizelint/package.nix b/pkgs/by-name/si/sizelint/package.nix
index f42f6c1c7b21..7bac1c3ef04c 100644
--- a/pkgs/by-name/si/sizelint/package.nix
+++ b/pkgs/by-name/si/sizelint/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sizelint";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "a-kenji";
     repo = "sizelint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1k1+7fVWhflEKyhOlb7kMn2xqeAM6Y5N9uHtOJvVn4A=";
+    hash = "sha256-m8Pd7Bnz++5k6J4stbKVd8Y596Y+52xbF0zFJVhdfzI=";
   };
 
   nativeCheckInputs = [ git ];
 
-  cargoHash = "sha256-Z+pmlp/0LlKfc4QLosePw7TdLFYe6AnAVOJSw2DzlfI=";
+  cargoHash = "sha256-7cDZrRNTGPdzbvVNt3/HTp7PgoH2txX26RCxdpeo4dM=";
 
   meta = {
     description = "Lint your file tree based on file sizes";

From 40f5c2606489863cb621bf7d31312f98a37fe9c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 13:53:06 +0000
Subject: [PATCH 48/54] python3Packages.forecast-solar: 4.2.0 -> 5.0.0

---
 pkgs/development/python-modules/forecast-solar/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/forecast-solar/default.nix b/pkgs/development/python-modules/forecast-solar/default.nix
index 4965722508e0..f8edb6cee3cd 100644
--- a/pkgs/development/python-modules/forecast-solar/default.nix
+++ b/pkgs/development/python-modules/forecast-solar/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "forecast-solar";
-  version = "4.2.0";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "forecast_solar";
     tag = "v${version}";
-    hash = "sha256-ZBkuhONvn1/QpD+ml3HJinMIdg1HFpVj5KZAlUt/qR4=";
+    hash = "sha256-gFa1jq4Dq6fWqL/3eY+OGcJU+T+R6TZs8CX1ynnW+pU=";
   };
 
   build-system = [ poetry-core ];

From d075fb4ebe792e8dd8d8411b908f64260da1b2fa Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 27 Feb 2026 08:55:22 -0500
Subject: [PATCH 49/54] beamPackages.expert: 0.1.0-rc.4 -> 0.1.0-rc.5

Diff: https://github.com/elixir-lang/expert/compare/v0.1.0-rc.4...v0.1.0-rc.5

Changelog: https://github.com/elixir-lang/expert/blob/v0.1.0-rc.5/CHANGELOG.md
---
 pkgs/development/beam-modules/expert/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/beam-modules/expert/default.nix b/pkgs/development/beam-modules/expert/default.nix
index 8448f51e6045..a04d967638eb 100644
--- a/pkgs/development/beam-modules/expert/default.nix
+++ b/pkgs/development/beam-modules/expert/default.nix
@@ -6,13 +6,13 @@
   fetchMixDeps,
 }:
 let
-  version = "0.1.0-rc.4";
+  version = "0.1.0-rc.5";
 
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "expert";
     tag = "v${version}";
-    hash = "sha256-DghNlNbGUTMX859Y9HYRowCXvAxZKJffodTzy94Mb5Q=";
+    hash = "sha256-7e8zi3AFHESXyxTA0/YRmzR4L4tl19L0LHKaEM1l0P4=";
   };
 
   engineDeps = fetchMixDeps {
@@ -62,7 +62,7 @@ mixRelease rec {
 
   meta = {
     homepage = "https://github.com/elixir-lang/expert";
-    changelog = "https://github.com/elixir-lang/expert/releases/tag/v${version}";
+    changelog = "https://github.com/elixir-lang/expert/blob/v${version}/CHANGELOG.md";
     description = "Official Elixir Language Server Protocol implementation";
     longDescription = ''
       Expert is the official language server implementation for the Elixir programming language.

From f06ce2c1c37b922d01ab50fbc8c0655999d28ed6 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 27 Feb 2026 14:49:40 +0000
Subject: [PATCH 50/54] vikunja: 2.0.0 -> 2.1.0

Changelog: https://github.com/go-vikunja/vikunja/blob/v2.1.0/CHANGELOG.md
---
 pkgs/by-name/vi/vikunja/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 10bf66ed8a78..db7ee498f15b 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -14,12 +14,12 @@
 }:
 
 let
-  version = "2.0.0";
+  version = "2.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-EfAhJq2LPuCF8Pwyg0TYqSjNCaG15iZ2paDLfA6JI5w=";
+    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ let
         ;
       pnpm = pnpm_10;
       fetcherVersion = 1;
-      hash = "sha256-ME9sGKGRY3vaOTFwbFyzsDT20HnEnrfq3Z5nrL19k0A=";
+      hash = "sha256-oY8DXJFFwLBjUno3EithLhmnA8hTksq4xgMSSOGtwuo=";
     };
 
     nativeBuildInputs = [
@@ -142,7 +142,7 @@ buildGoModule {
   };
 
   meta = {
-    changelog = "https://kolaente.dev/vikunja/api/src/tag/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/go-vikunja/vikunja/blob/v${version}/CHANGELOG.md";
     description = "Todo-app to organize your life";
     homepage = "https://vikunja.io/";
     license = lib.licenses.agpl3Plus;

From 68e13f1cc5249c623f275ef43b5057438be32785 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 27 Feb 2026 14:53:14 +0000
Subject: [PATCH 51/54] vikunja-desktop: 2.0.0 -> 2.1.0

---
 pkgs/by-name/vi/vikunja-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index cdc83367027b..e7a0985d9496 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -15,12 +15,12 @@
 
 let
   executableName = "vikunja-desktop";
-  version = "2.0.0";
+  version = "2.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-EfAhJq2LPuCF8Pwyg0TYqSjNCaG15iZ2paDLfA6JI5w=";
+    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmInstallFlags
       ;
     fetcherVersion = 1;
-    hash = "sha256-9KPQaRLep4n+2b9mk8KQoK22zdlMFrCb1VT6SEHxanQ=";
+    hash = "sha256-yiVlEr1gi2g3m+hkYfDv6qd/wRlwwknM6lAaIeR58Ok=";
   };
 
   env = {

From 6a43370a4b794f8b6de35ab5b4c52c0c9ac35f65 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 27 Feb 2026 14:53:19 +0000
Subject: [PATCH 52/54] vikunja: add adamcstephens to maintainers

---
 pkgs/by-name/vi/vikunja/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index db7ee498f15b..07e9c5424849 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -146,7 +146,10 @@ buildGoModule {
     description = "Todo-app to organize your life";
     homepage = "https://vikunja.io/";
     license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ leona ];
+    maintainers = with lib.maintainers; [
+      leona
+      adamcstephens
+    ];
     mainProgram = "vikunja";
     platforms = lib.platforms.linux;
   };

From 8628d2c2dc66ee37e21765428f5e3aa7e920183c Mon Sep 17 00:00:00 2001
From: Aaron Bieber <aaron@bolddaemon.com>
Date: Fri, 27 Feb 2026 07:29:44 -0700
Subject: [PATCH 53/54] step-kms-plugin: remove myself as maintainer

---
 pkgs/by-name/st/step-kms-plugin/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index 5a061773979f..d6ec456ad4b2 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -48,7 +48,7 @@ buildGoModule rec {
     description = "Step plugin to manage keys and certificates on cloud KMSs and HSMs";
     homepage = "https://smallstep.com/cli/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ qbit ];
+    maintainers = [ ];
     mainProgram = "step-kms-plugin";
   };
 }

From 833106e65e5ea2407a97edc6835422442a3c53ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 15:53:34 +0000
Subject: [PATCH 54/54] python3Packages.systemrdl-compiler: 1.32.1 -> 1.32.2

---
 .../development/python-modules/systemrdl-compiler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/systemrdl-compiler/default.nix b/pkgs/development/python-modules/systemrdl-compiler/default.nix
index 70430c4777b2..fcf0e6486c15 100644
--- a/pkgs/development/python-modules/systemrdl-compiler/default.nix
+++ b/pkgs/development/python-modules/systemrdl-compiler/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "systemrdl-compiler";
-  version = "1.32.1";
+  version = "1.32.2";
 
   pyproject = true;
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "SystemRDL";
     repo = "systemrdl-compiler";
     tag = "v${version}";
-    hash = "sha256-BTONBzNE9GfBeallS6P4E1ukPs2EzFa31/SpxEjXmKw=";
+    hash = "sha256-1Dx6WxSzGaZxwRzXR/bjfZSU7TsvTYNVN0NaK3qQ7eo=";
   };
 
   build-system = [