Merge master into staging-nixos

ci/github-script/merge.js

@@ -66,8 +66,9 @@ function runChecklist({
     if (allByName) {
       // We can only determine the below, if all packages are in by-name, since
       // we can't reliably relate changed files to packages outside by-name.
-      checklist[`${user.login} is a maintainer of all touched packages.`] =
-        eligible.has(user.id)
+      checklist[
+        `${user.login} is a maintainer of all touched packages on the ${pull_request.base.ref} branch.`
+      ] = eligible.has(user.id)
     }
   } else {
     // This is only used when no user is passed, i.e. for labeling.

lib/services/lib.nix

@@ -37,17 +37,63 @@ rec {
   );
 
   /**
-    This is the entrypoint for the portable part of modular services.
+    Entrypoint for integrating modular services into a containing module system.
 
-    It provides the various options that are consumed by service manager implementations.
+    Each containing system (NixOS, ...) calls `configure` to
+    obtain a `serviceSubmodule` type for its services option. The returned submodule
+    includes the portable service base and any service-manager-specific modules
+    passed via `extraRootModules`.
+
+    **Implementing for a new system** (e.g. home-manager, nix-darwin):
+
+    ```nix
+    # darwin/modules/services/system.nix
+    { lib, config, pkgs, ... }:
+    let
+      portable-lib = import <nixpkgs/lib/services/lib.nix> { inherit lib; };
+
+      modularServiceConfiguration = portable-lib.configure {
+        serviceManagerPkgs = pkgs;
+        extraRootModules = [
+          ./launchd-service.nix    # launchd-specific options (plist generation, etc.)
+        ];
+      };
+    in
+    {
+      options.services = lib.mkOption {
+        type = lib.types.attrsOf modularServiceConfiguration.serviceSubmodule;
+        default = { };
+      };
+
+      config = {
+        # Convert service tree -> launchd plists, assertions, etc.
+        # (analogous to how NixOS converts to systemd units)
+        launchd.agents = ...;
+        assertions = ...;
+        warnings = ...;
+      };
+    }
+    ```
+
+    lib.services.configure :: AttrSet -> { serviceSubmodule :: SubmoduleType }
 
     # Inputs
 
-    `serviceManagerPkgs`: A Nixpkgs instance which will be used for built-in logic such as converting `configData.<path>.text` to a store path.
+    `serviceManagerPkgs`
 
-    `extraRootModules`: Modules to be loaded into the "root" service submodule, but not into its sub-`services`. That's the modules' own responsibility.
+    : 1\. A Nixpkgs instance used for built-in logic such as converting
+    `configData.<path>.text` to a store path.
 
-    `extraRootSpecialArgs`: Fixed module arguments that are provided in a similar manner to `extraRootModules`.
+    `extraRootModules`
+
+    : 2\. Modules to be loaded into the "root" service submodule, but not
+    into its sub-`services`. That's the modules' own responsibility.
+    Typically contains service-manager-specific option modules
+    (e.g. systemd unit options, launchd plist options).
+
+    `extraRootSpecialArgs`
+
+    : 3\. Fixed module arguments provided alongside `extraRootModules`.
 
     # Output
 

nixos/modules/security/dhparams.nix

@@ -143,68 +143,81 @@ in
     };
   };
 
-  config = lib.mkIf (cfg.enable && cfg.stateful) {
-    systemd.services = {
-      dhparams-init = {
-        description = "Clean Up Old Diffie-Hellman Parameters";
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      warnings = [
+        ''
+          The `security.dhparam` module is deprecated and scheduled for removal in NixOS 26.11.
+          Generating your own params has been shown to be problematic in RFC 7919 (2016).
 
-        # Clean up even when no DH params is set
-        wantedBy = [ "multi-user.target" ];
+          Remove any uses of DHE and migrate to ECDHE (RFC 8422, 2018) and
+          Hybrid PQ (draft-ietf-tls-ecdhe-mlkem, 2026) key exchange algorithms.
+        ''
+      ];
+    })
+    (lib.mkIf (cfg.enable && cfg.stateful) {
+      systemd.services = {
+        dhparams-init = {
+          description = "Clean Up Old Diffie-Hellman Parameters";
 
-        serviceConfig.RemainAfterExit = true;
-        serviceConfig.Type = "oneshot";
+          # Clean up even when no DH params is set
+          wantedBy = [ "multi-user.target" ];
 
-        script = ''
-          if [ ! -d ${cfg.path} ]; then
-            mkdir -p ${cfg.path}
-          fi
+          serviceConfig.RemainAfterExit = true;
+          serviceConfig.Type = "oneshot";
 
-          # Remove old dhparams
-          for file in ${cfg.path}/*; do
-            if [ ! -f "$file" ]; then
-              continue
+          script = ''
+            if [ ! -d ${cfg.path} ]; then
+              mkdir -p ${cfg.path}
             fi
-            ${lib.concatStrings (
-              lib.mapAttrsToList (
-                name:
-                { bits, path, ... }:
-                ''
-                  if [ "$file" = ${lib.escapeShellArg path} ] && \
-                     ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
-                     | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
-                    continue
-                  fi
-                ''
-              ) cfg.params
-            )}
-            rm "$file"
-          done
 
-          # TODO: Ideally this would be removing the *former* cfg.path, though
-          # this does not seem really important as changes to it are quite
-          # unlikely
-          rmdir --ignore-fail-on-non-empty ${cfg.path}
-        '';
-      };
-    }
-    // lib.mapAttrs' (
-      name:
-      { bits, path, ... }:
-      lib.nameValuePair "dhparams-gen-${name}" {
-        description = "Generate Diffie-Hellman Parameters for ${name}";
-        after = [ "dhparams-init.service" ];
-        before = [ "${name}.service" ];
-        requiredBy = [ "${name}.service" ];
-        wantedBy = [ "multi-user.target" ];
-        unitConfig.ConditionPathExists = "!${path}";
-        serviceConfig.Type = "oneshot";
-        script = ''
-          mkdir -p ${lib.escapeShellArg cfg.path}
-          ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
-            ${toString bits}
-        '';
+            # Remove old dhparams
+            for file in ${cfg.path}/*; do
+              if [ ! -f "$file" ]; then
+                continue
+              fi
+              ${lib.concatStrings (
+                lib.mapAttrsToList (
+                  name:
+                  { bits, path, ... }:
+                  ''
+                    if [ "$file" = ${lib.escapeShellArg path} ] && \
+                       ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
+                       | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
+                      continue
+                    fi
+                  ''
+                ) cfg.params
+              )}
+              rm "$file"
+            done
+
+            # TODO: Ideally this would be removing the *former* cfg.path, though
+            # this does not seem really important as changes to it are quite
+            # unlikely
+            rmdir --ignore-fail-on-non-empty ${cfg.path}
+          '';
+        };
       }
-    ) cfg.params;
-  };
+      // lib.mapAttrs' (
+        name:
+        { bits, path, ... }:
+        lib.nameValuePair "dhparams-gen-${name}" {
+          description = "Generate Diffie-Hellman Parameters for ${name}";
+          after = [ "dhparams-init.service" ];
+          before = [ "${name}.service" ];
+          requiredBy = [ "${name}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          unitConfig.ConditionPathExists = "!${path}";
+          serviceConfig.Type = "oneshot";
+          script = ''
+            mkdir -p ${lib.escapeShellArg cfg.path}
+            ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
+              ${toString bits}
+          '';
+        }
+      ) cfg.params;
+    })
+  ];
 
 }

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.39.2";
-    hash = "sha256-iSjwEPSlPWmg3cYLSCp2YmHOR8EShGuPHzXMHGoa4iM=";
+    version = "1.39.3";
+    hash = "sha256-uuWkSxjsY7ZL1QUwqkiwPTN8oGUktfm7/Hgv3Enmgqc=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-u3WK/pLsuwySJX6GMNho8ImB+F+XXUPC6h+IQtDrOp8="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-DWMa48u6D9lT6xtcYOQxWyHfMwFvI+iYufKoXgQJmC0=",
+    "hash": "sha256-0Wc+QgEeizydsvtyBdnxgLhpYuBZLMB3JGjmTDXzJY0=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.234.0",
+    "rev": "v1.235.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iUu/SG4VprmEuYo6e8az5GARJhJWHyvyyJNSapnpWME="
+    "vendorHash": "sha256-odyKlnrYufT5pQsYuGN0hKQeQx7LzTLVNTwde97wyPc="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",
@@ -1373,13 +1373,13 @@
     "vendorHash": "sha256-Bat/S4e5vzT0/XOhJ9zCWLa4IE4owLC6ec1yvEh+c0Y="
   },
   "topicusonderwijs_octodns": {
-    "hash": "sha256-ZfQ7OgW0kKfcoBNBe+wDFKL+hlyxyb80LrfArPBjtv4=",
+    "hash": "sha256-gbw0Na3m5X5CjoaXHPREfQIpwzQ9hpa7A3Hn+rwcjEA=",
     "homepage": "https://registry.terraform.io/providers/topicusonderwijs/octodns",
     "owner": "topicusonderwijs",
     "repo": "terraform-provider-octodns",
-    "rev": "v1.1.5",
+    "rev": "v1.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6qQ1k/fCxJGseqU+kjsE29kWYOpzorCeCTldXZo4ukY="
+    "vendorHash": "sha256-da0+/aLNEuMZWD7+zMUGpc1Ch5VKyN+EyO0Mp4mZWv8="
   },
   "trozz_pocketid": {
     "hash": "sha256-/rEdOnAbVM69mA/eP6SlZhk1FZfzrYpej2aO0NUP6E4=",
@@ -1418,13 +1418,13 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-uYlaJfXerng7VfZt08fwvdBTy9UU6DgD5WGIca36LrA=",
+    "hash": "sha256-8uMCtwldGlGqwyZXV4Q1g+9lHQqa952Sd+mywkt0weo=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.47.0",
+    "rev": "v2.48.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uXcqb1yTHzERpVtPnu0HCETJyo8BjI/Vw6dVeOyGXys="
+    "vendorHash": "sha256-i6Hw1hCr/LRhGjemGAzhZQYr/LsjBrT5aFVXAHDE85M="
   },
   "venafi_venafi": {
     "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",

pkgs/by-name/de/deezer-desktop/package.nix

@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.150";
+  version = "7.1.170";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-/q3qm+GBKVPNp+foeNQCE+0vr3bCFbfp1qKGtrwpUfM=";
+      hash = "sha256-l2+RJJZIzs6F5VC6Ei/49iJNkqWEUEY0vwGpzwSAOGc=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-QL8tLWUmBLfFSHBI7tJN19KmeoOmA2SR8OHMhGpL/Dk=";
+      hash = "sha256-FI8YWAZz8mFIs34Ht7KkWwrFH7dpVpo4dh5pTB2khBg=";
     };
   };
 

pkgs/by-name/ho/home-manager/package.nix

@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2026-04-14";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "3c7524c68348ef79ce48308e0978611a050089b2";
-    hash = "sha256-No6QGBmIv5ChiwKCcbkxjdEQ/RO2ZS1gD7SFy6EZ7rc=";
+    rev = "5826802354a74af18540aef0b01bc1320f82cc17";
+    hash = "sha256-hlNpIN18pw3xo34Lsrp6vAMUPn0aB/zFBqL0QXI1Pmk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ju/just-lsp/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-bNOQHFULe+gA9UC9JBoTaStQ1geqXqOxydIPF39w2xY=";
+    hash = "sha256-4DxyKzIcX2hVCmgMTnA/4kqlghJd38jPoL7B7PcV+NU=";
   };
 
-  cargoHash = "sha256-3JsVJ84DWNf1UTYHbreAvj6XoAGaEk6OXML4saiZBlA=";
+  cargoHash = "sha256-E6eHB1tJ2rCgkU+xoyx5yg5X0ZGFn54Ozt0fJW7qn58=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ke/ketesa/package.nix

@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ketesa";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "ketesa";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z9qtCvpyFkBhqKWn9+dre9alBJ0nwyEvE0m9X8xWbRo=";
+    hash = "sha256-Yg5M3D4etEVwLXT5+QSLqebJwBIpRKV43nYycKSi/tw=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-nlyofNcvnANXHv26BZ7bNqpfnTQj7jw0lk0yhBGXsnc=";
+    hash = "sha256-mLFCVt2LsF4/evlVyTXEdSSk4aDU2tF2m3v8j8eX8ng=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ki/kin-openapi/package.nix

@@ -5,14 +5,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kin-openapi";
-  version = "0.135.0";
-  vendorHash = "sha256-Tf/F7L2F3nhyf6WYsc1FFsBEcMwFHfqkNBlRfcnVRO8=";
+  version = "0.136.0";
+  vendorHash = "sha256-6pvpmETeNAbzzuOlZqTyr6udazEElLW8E+HK6eAL8X4=";
 
   src = fetchFromGitHub {
     owner = "getkin";
     repo = "kin-openapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hg8FK11Q3dRcuKGCBsXkoBaHXpSGQLKM6PnKEir0kBI=";
+    hash = "sha256-buCxEDo9T4omjB63BC7iJab/8xJndEouorwWAi6v93c=";
   };
 
   checkFlags =

pkgs/by-name/mu/music-assistant/package.nix

@@ -38,14 +38,14 @@ assert
 
 python.pkgs.buildPythonApplication rec {
   pname = "music-assistant";
-  version = "2.8.4";
+  version = "2.8.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "server";
     tag = version;
-    hash = "sha256-/yKnUklNQMsumzj68KIfMN/h7Xsr3Brmwpicam9xuAY=";
+    hash = "sha256-//SR7UhaDgT6zNBZ6/B0tBQ88fWkHtrr9Ds0KwH6xzs=";
   };
 
   patches = [

pkgs/by-name/mu/music-assistant/providers.nix

@@ -1,7 +1,7 @@
 # Do not edit manually, run ./update-providers.py
 
 {
-  version = "2.8.4";
+  version = "2.8.6";
   providers = {
     airplay =
       ps: with ps; [

pkgs/by-name/py/pyradio/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyradio";
-  version = "0.9.3.11.29";
+  version = "0.9.3.11.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = finalAttrs.version;
-    hash = "sha256-WvvNgo5ajhKqArFYM5+IwEPX4yzoali9iZdGoxEKbFM=";
+    hash = "sha256-b4Euo9rD/A7PjROOaigx2ITel1uA7fa6S6bNi76FeUw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/qr/qrq/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   ncurses,
   pulseaudio,
 }:
@@ -19,6 +20,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
+  patches = [
+    # gcc15, remove after next release
+    (fetchpatch {
+      url = "https://github.com/dj1yfk/qrq/commit/f17363df923cd9d4607478a7406e0c4d3e044aae.patch";
+      hash = "sha256-EzGP6ExqiK30Vb4f8Q06zIP5Bebnw/jWvaAOb3juZMU=";
+      stripLen = 2;
+      extraPrefix = "";
+    })
+  ];
+
   buildInputs = [
     ncurses
     pulseaudio
@@ -33,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace qrq.c \
       --replace-fail '[80]' '[4000]' \
       --replace-fail '80,' '4000,'
+    substituteInPlace Makefile \
+      --replace-fail 'CC=gcc' 'CC=${stdenv.cc.targetPrefix}cc'
   '';
 
   meta = {

pkgs/by-name/rs/rs-tftpd/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rs-tftpd";
-  version = "0.5.3";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "altugbakan";
     repo = "rs-tftpd";
     tag = finalAttrs.version;
-    hash = "sha256-Q4WeRX0rGlsyp5riy16X5WXMWmWRZABEhCPz+HAiPuo=";
+    hash = "sha256-zdchV2WKkOyHPN4N0pFFavPXv8fcGgjoRKLAUbj5Rto=";
   };
 
-  cargoHash = "sha256-VloKNrje6nmiHZmyO5IGRGIHRc/VfldgYsG5kpmrvyw=";
+  cargoHash = "sha256-I49jiMcC9ndk8GuCKJE3+qS7F6V38meUdbtrxKJNhsg=";
 
   buildFeatures = [ "client" ];
 

pkgs/by-name/sn/snobol4/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snobol4";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     urls = [
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
       # fallback for when the current version is moved to the old folder
       "https://ftp.regressive.org/snobol4/old/snobol4-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-v9UwcdaSg3dvWydk94ZdNUuJ03JWmFShiHjln1c4jtI=";
+    hash = "sha256-cC9ztBB0OL0lHrwlPTNZlPN7tAN5JCNg2Hbi3m3AP3g=";
   };
 
   outputs = [

pkgs/by-name/sn/snx-rs/package.nix

@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "snx-rs";
-  version = "5.3.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+LgVWZzPfn/OJ+m3kV8N+alo5rU8OZwxB2R3iA0O6ds=";
+    hash = "sha256-aXpMrf1gRhbMU8la8mMo/hAYRNVY5VN7DKj/b/KU+GQ=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
 
-  cargoHash = "sha256-82Hz0+9YgrImBokP2pMh21iH9jCqVTj7HljCFEWXw4E=";
+  cargoHash = "sha256-j9m4L9zNjfOthYAQporI5atn0nuNjh50VvHp4w0NK2w=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";

pkgs/by-name/st/stevenblack-blocklist/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.75";
+  version = "3.16.76";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-U1EDwPWYmG8F/EpNA0hOz//SC1o8spbTqRc/xl8hB5Y=";
+    hash = "sha256-mGti2nilpiN5Sc0qZ9w4e/NBi3dfuHvLRjsr/kUMZc0=";
   };
 
   outputs = [

pkgs/by-name/su/sub-store-frontend/package.nix

@@ -13,13 +13,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sub-store-frontend";
-  version = "2.16.55";
+  version = "2.16.59";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store-Front-End";
     tag = finalAttrs.version;
-    hash = "sha256-9QBgy+5sIvFcbZpxFc9mOowH4dw4rewqLYZfUKwPOjU=";
+    hash = "sha256-dTjKRkYtt7BA2Q95skXdn2TZNEt1NnXlVzRGUlRdly4=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-HEeNYLKvzO/RQWYnm5gqRjTrXiiCxKUxf3bcRvz+O4k=";
+    hash = "sha256-gQe5AMRZgjp1G95bFgCBMlhVql+ZHgPfJ2DOklFyk2k=";
   };
 
   npmConfigHook = pnpmConfigHook;

pkgs/by-name/su/sub-store/package.nix

@@ -15,13 +15,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sub-store";
-  version = "2.21.98";
+  version = "2.22.6";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store";
     tag = finalAttrs.version;
-    hash = "sha256-r2zlOZQ6pPxm/zjtaJkMMaG3vM/05xvS+hTDg4bydo8=";
+    hash = "sha256-bK9N1/HodME8XEHA07h8IEMXDtnBKzBf8waMBQsEYbA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";

pkgs/by-name/ty/typescript-go/package.nix

@@ -15,17 +15,17 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2026-04-16";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "83b8d2aa23b2d385087dabe5a5a8afd5e296013d";
-    hash = "sha256-d7Kld2ehO+EWkCl2/Pb+xP6p/RuEZFR24JItGDLpHJY=";
+    rev = "515d036f927aba8b468011098e2721335f0e2d00";
+    hash = "sha256-agEuOB7dnYZB6I5qA+/IdrGVSewg/8b74gRntwtaeaE=";
     fetchSubmodules = false;
   };
 
-  vendorHash = "sha256-YmKVn9fc7dKMBiXnutI15mg/BFCyvyXntr7QaxJ7qU8=";
+  vendorHash = "sha256-n2wBDcMSKQGUJlTgCuJbKPTYOCiwkMpbvavqIrRvzS8=";
 
   ldflags = [
     "-s"

pkgs/by-name/wa/wakatime-cli/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wakatime-cli";
-  version = "2.3.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "wakatime";
     repo = "wakatime-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZOCOhLeDzdlePETOaBlaGmcxXxEtlKhmWlkXQRhlVBE=";
+    hash = "sha256-N0CYz0G3J7gdCE0Q9QJeukfzVb3E5gCKDEu22vOUO9k=";
   };
 
   vendorHash = "sha256-HngszNLX2b2EVvh8ovouIEvjBOJL1jA5AhA6Y11ke9Y=";

pkgs/by-name/wo/wootility/package.nix

@@ -7,10 +7,10 @@
 
 let
   pname = "wootility";
-  version = "5.2.5";
+  version = "5.3.0";
   src = fetchurl {
     url = "https://wootility-updates.ams3.cdn.digitaloceanspaces.com/wootility-linux/Wootility-${version}.AppImage";
-    sha256 = "sha256-bDhwlI+zi13xdMXqT5ztzR7RNOLgTBxNtjGkEFezZsw=";
+    sha256 = "sha256-37dABMNFqW4E2oQ5Zx4ZFdiq1uAMzvPD1vt7pb5PnZY=";
   };
 in
 

pkgs/development/libraries/mesa/darwin.nix

@@ -127,6 +127,10 @@ stdenv.mkDerivation {
 
   mesonBuildType = "release";
 
+  postFixup = ''
+    install_name_tool -add_rpath "$out/lib" "$out/lib/libGL.dylib"
+  '';
+
   passthru = {
     # needed to pass evaluation of bad platforms
     driverLink = throw "driverLink not supported on darwin";

pkgs/development/python-modules/aiotractive/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiotractive";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zhulik";
     repo = "aiotractive";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Tr8USF7GF9CMOcjy62e+oTu4k/1jIAOsZmWTFWEzJvk=";
+    hash = "sha256-wRV/ZQ2T3Dlrmq6jY5IatrGr07uxPFWcVoMiJN+md88=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyhive-integration/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyhive-integration";
-  version = "1.0.8";
+  version = "1.0.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Pyhass";
     repo = "Pyhiveapi";
-    tag = finalAttrs.version;
-    hash = "sha256-9qcRvkRV/3GT66jlnkdKk+J3frEcsJ3C+Oio5gbRi5s=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8Lv41xgkwVpisdJpzhhBxdAG3VdKYazmbvl3V7lAjYA=";
   };
 
   pythonRemoveDeps = [ "pre-commit" ];

pkgs/development/python-modules/pytibber/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytibber";
-  version = "0.37.1";
+  version = "0.37.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pyTibber";
     tag = finalAttrs.version;
-    hash = "sha256-r2EaT1e9ztmtLXtO9Bpr6mXVXlZQW74G2nTTkJAeZEA=";
+    hash = "sha256-ZM9oXX6iEmsR20f2Jgg3fME1lm3egKun1GvNOZIKTV0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/qh3/default.nix

@@ -14,19 +14,19 @@
 
 buildPythonPackage rec {
   pname = "qh3";
-  version = "1.7.1";
+  version = "1.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "qh3";
     tag = "v${version}";
-    hash = "sha256-duZstcheiv3eLPp2IMaZvYo5vq5SMBxcy7HQmBI0SaI=";
+    hash = "sha256-wi2PYd74kOU2tol7pVgpMqbL3peGhXyKKEke6+CBIwU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-BqUofzjfDNUhE27GYcV7CXUK2dT/BQ16Z5aQkHyYUIE=";
+    hash = "sha256-sv5DFeapeH00CBssQcRZ7SI3JlyUuKo7gIRVjN/kA+Q=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/scikit-base/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-base";
-  version = "0.13.2";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sktime";
     repo = "skbase";
     tag = "v${version}";
-    hash = "sha256-NZpuc2MUziqpzB2x7ae9xH8mWzia2j/cgzUbJKAVTqE=";
+    hash = "sha256-qKMOvGm876zG2P9W593922YZvOOCSgUeEWXWkKiTnEY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/zstandard/default.nix

@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = {
     description = "Zstandard bindings for Python";
     homepage = "https://github.com/indygreg/python-zstandard";
-    license = lib.licenses.bsdOriginal;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
 }

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -34,11 +34,6 @@
         "hash": "sha256:0pr5s7hkmn7n17bm7p6sqrkq8g9z42jnvqihv96kn42qrrbwa1y2",
         "lts": true
     },
-    "6.19": {
-        "version": "6.19.14",
-        "hash": "sha256:11giqsz9qa7s9lm94nn4h1bcb2411crsbfyvzrvhfjmy75kvzs6d",
-        "lts": false
-    },
     "7.0": {
         "version": "7.0.1",
         "hash": "sha256:1gw7v1j0pp2w6fm5y1n0krhnfvgab2jkrvcvwl8hx614dnikbjdj",

pkgs/os-specific/windows/mcfgthreads/default.nix

@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mcfgthread";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "lhmouse";
     repo = "mcfgthread";
     tag = "v${lib.versions.majorMinor finalAttrs.version}-ga.${lib.versions.patch finalAttrs.version}";
-    hash = "sha256-x20wmqm675+pFx+eOu2zWA3BZsG+TXgBTwOoc6+I7WA=";
+    hash = "sha256-1gD2Cu2suvxopTxGN2RYSzise6bS8lpkrXLcdm9ZBLU=";
   };
 
   postPatch = ''

pkgs/servers/home-assistant/component-packages.nix

@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.4.3";
+  version = "2026.4.4";
   components = {
     "3_day_blinds" =
       ps: with ps; [

pkgs/servers/home-assistant/custom-components/battery_notes/package.nix

@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "andrew-codechimp";
   domain = "battery_notes";
-  version = "3.4.4";
+  version = "3.4.5";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HA-Battery-Notes";
     tag = version;
-    hash = "sha256-aF6OeTiTuN1A1ffW9LjTtkFW4CAMPWFGX0scjKAUyOE=";
+    hash = "sha256-amMrXBTkDZAeMjGScdXMyTZFm90o5jN3VbR2PTydgZA=";
   };
 
   # has no tests

pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix

@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "dckiller51";
   domain = "bodymiscale";
-  version = "2026.4.2";
+  version = "2026.4.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = version;
-    hash = "sha256-4U3e6PCzr1zS/2y7RjYMSHDVeOuN+l+gp4EhKMXjzyA=";
+    hash = "sha256-hkwOgEiBqx0w8gc8ZouH6LWz/psZPT3E3scdKHugsYI=";
   };
 
   dependencies = [

pkgs/servers/home-assistant/custom-components/browser-mod/package.nix

@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.10.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-GUYQlydFxifMR/ASJCTIfMBKh3lrB8lNDqJvHa/eVHs=";
+    hash = "sha256-IenC39xaHxD7Q+r8w4zfn8ZwF+s7i+dliwG4lOPPLHk=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-ZLWBi1EmqC1MD0O4ZQpie6IRHl6S+qGHhwonvjKGCqo=";
+    hash = "sha256-DmN2gWhtfGhqLJpSXW7XAt9stvsH6jJfR4FUQOZqh6M=";
   };
 
   npmBuildScript = "build";

pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix

@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2026.04.3";
+  version = "2026.04.4";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-hcalMQWkZmve/iuv9jgriEgLhhNVU94ETIbQOZ5aDd4=";
+    hash = "sha256-OH3RCm6QnqDdeIA3w0Z9GqSF8NyigoMaJeDNqR3OcIc=";
   };
 
   dependencies = [ pymodbus ];

pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix

@@ -20,13 +20,13 @@
 buildHomeAssistantComponent rec {
   owner = "mampfes";
   domain = "waste_collection_schedule";
-  version = "2.20.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hacs_waste_collection_schedule";
     tag = "v${version}";
-    hash = "sha256-Dt1Ey2vIk5f6AEC9qepUb3S8+1rBwG5o6/6/pEoglcw=";
+    hash = "sha256-QUXtozk5FIUsXDJfb1GHGYa1LKh+CCARAsPKkX9ok34=";
   };
 
   dependencies = [

pkgs/servers/home-assistant/default.nix

@@ -253,7 +253,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.4.3";
+  hassVersion = "2026.4.4";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -274,13 +274,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-65LZU4OpvVeV70xujI3kd/8VIzZh723l9F5xe8qEvX4=";
+    hash = "sha256-x2BF1N1LDZAnryOkGy/Pru+mlw3CaOgnrmdQMg0uo7k=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-P76HVL5NW8TOpic1kRUXxeMeAtsy+UxkmTvsc0J+6nY=";
+    hash = "sha256-EPmX+3wAsvirvjDzQ0aUKGZbaNWh5mX+7iuCfZ2BUhI=";
   };
 
   build-system = with python.pkgs; [

pkgs/servers/home-assistant/frontend.nix

@@ -8,7 +8,7 @@ buildPythonPackage (finalAttrs: {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20260325.7";
+  version = "20260325.8";
   format = "wheel";
 
   src = fetchPypi {
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-0OQM+UNI1QX3V53OQ57NuDXr05BllaYRjKnNrFXpwDc=";
+    hash = "sha256-+zM6D+mBsBNrx0oj99t83iJb2A8tz6OGe01LTWFvf5s=";
   };
 
   # there is nothing to strip in this package

pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.324";
+  version = "0.13.325";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-gN9lU2H8XVQgjtA3x7jiP9B1QqPq8oz9XfOCmi/EohI=";
+    hash = "sha256-Rs3CZsQDL/gCgJzUwBEbAX56EUNugpmwxNAAQRK6Nvs=";
   };
 
   build-system = [ setuptools ];

pkgs/servers/home-assistant/stubs.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.4.3";
+  version = "2026.4.4";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-sWyeB/+G/1OtH7J97EifJw8AZIGd7IX1mLJ+1Dn/qjU=";
+    hash = "sha256-ysVtXtiMmXmCq39cOO2Eh+YJN+SIi+Y4Y62+psJSkWM=";
   };
 
   build-system = [

pkgs/top-level/linux-kernels.nix

@@ -106,14 +106,6 @@ in
           ];
         };
 
-        linux_6_19 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.19";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
         linux_7_0 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "7.0";
           kernelPatches = [
@@ -188,6 +180,7 @@ in
         linux_6_15 = throw "linux 6.15 was removed because it has reached its end of life upstream";
         linux_6_16 = throw "linux 6.16 was removed because it has reached its end of life upstream";
         linux_6_17 = throw "linux 6.17 was removed because it has reached its end of life upstream";
+        linux_6_19 = throw "linux 6.19 was removed because it has reached its end of life upstream";
 
         linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
         linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
@@ -684,7 +677,6 @@ in
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
     linux_6_18 = recurseIntoAttrs (packagesFor kernels.linux_6_18);
-    linux_6_19 = recurseIntoAttrs (packagesFor kernels.linux_6_19);
     linux_7_0 = recurseIntoAttrs (packagesFor kernels.linux_7_0);
   }
   // lib.optionalAttrs config.allowAliases {
@@ -698,6 +690,7 @@ in
     linux_6_15 = throw "linux 6.15 was removed because it reached its end of life upstream"; # Added 2025-08-23
     linux_6_16 = throw "linux 6.16 was removed because it reached its end of life upstream"; # Added 2025-10-22
     linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22
+    linux_6_19 = throw "linux 6.19 was removed because it reached its end of life upstream"; # Added 2026-04-23
   };
 
   rpiPackages = {