Merge master into staging-next

.github/workflows/eval.yml

@@ -15,6 +15,9 @@ on:
       targetSha:
         required: true
         type: string
+      baseBranch:
+        required: true
+        type: string
       systems:
         required: true
         type: string
@@ -291,6 +294,7 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
+          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -299,6 +303,7 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
+            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

.github/workflows/merge-group.yml

@@ -97,6 +97,7 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/pull-request-target.yml

@@ -110,6 +110,7 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

ci/eval/compare/default.nix

@@ -49,6 +49,7 @@ in
 {
   combinedDir,
   touchedFilesJson,
+  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -242,7 +243,7 @@ runCommand "compare"
       echo
       echo "# Performance comparison"
       echo
-      echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
       echo
     } >> $out/step-summary.md
 

ci/eval/default.nix

@@ -288,6 +288,9 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
+      # The branch the local comparison is made against; matches the `master`
+      # used in the touched-files expression above.
+      baseBranch ? "master",
     }:
     let
       diffs = symlinkJoin {
@@ -305,7 +308,7 @@ let
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson;
+        inherit touchedFilesJson baseBranch;
       };
     in
     comparisonReport;

lib/systems/default.nix

@@ -17,6 +17,10 @@ let
 
   inherit (lib.strings) toJSON;
 
+  inherit (lib.trivial)
+    oldestSupportedReleaseIsAtLeast
+    ;
+
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
@@ -701,9 +705,12 @@ let
         };
       };
     in
-    # TODO: Remove in 27.05.
+    # Platforms elaborated by pre-26.11 Nixpkgs will include the `linux-kernel` attr,
+    # so we can't assert its absence until 26.11 is the oldest supported release.
+    # Assertion will activate during the 27.05 cycle, when 26.05 support ends.
+    # TODO: Remove assertion in the 27.11 cycle.
     assert
-      args ? linux-kernel
+      oldestSupportedReleaseIsAtLeast 2611 && args ? linux-kernel
       -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
 
     assert final.useAndroidPrebuilt -> final.isAndroid;

maintainers/maintainer-list.nix

@@ -27155,12 +27155,6 @@
     githubId = 101565936;
     name = "Tautvydas Cerniauskas";
   };
-  tcbravo = {
-    email = "tomas.bravo@protonmail.ch";
-    github = "tcbravo";
-    githubId = 66133083;
-    name = "Tomas Bravo";
-  };
   tchab = {
     email = "dev@chabs.name";
     github = "t-chab";

maintainers/team-list.nix

@@ -566,7 +566,6 @@ with lib.maintainers;
       ethancedwards8
       phanirithvij
       prince213
-      wegank
     ];
     scope = "Maintain NGI-supported software.";
     shortName = "NGI";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -57,6 +57,8 @@
   Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
   See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
 
+  - Coincidentally the driver now exposes machines to the testScript using their attr name used in the test module. E.g. a machine declared with `nodes.<name> = …` is now available as `<name>`. Before, the test driver used their `system.name` option value. They both default to the same value, but if you have set both independently, you might need to adapt your testScript.
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -14,6 +14,8 @@
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
+- [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

nixos/modules/module-list.nix

@@ -1052,6 +1052,7 @@
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
   ./services/monitoring/nezha-agent.nix
+  ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
   ./services/monitoring/osquery.nix

nixos/modules/services/display-managers/gdm.nix

@@ -200,8 +200,6 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    warnings = lib.optional config.services.pulseaudio.enable "Support for Pulseaudio + gdm will be removed in NixOS 26.11";
-
     services.xserver.displayManager.lightdm.enable = false;
 
     users.users = lib.mkMerge [

nixos/modules/services/monitoring/nezha.nix

@@ -0,0 +1,179 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nezha;
+
+  # nezha uses yaml as the configuration file format.
+  # Since we need to use jq to update the content, so here we generate json
+  settingsFormat = pkgs.formats.json { };
+  configFile = settingsFormat.generate "config.json" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+  options = {
+    services.nezha = {
+      enable = lib.mkEnableOption "Nezha Monitoring";
+
+      package = lib.mkPackageOption pkgs "nezha" { };
+
+      debug = lib.mkEnableOption "verbose log";
+
+      settings = lib.mkOption {
+        description = ''
+          Generate to {file}`config.yaml` as a Nix attribute set.
+          Check the [guide](https://nezha.wiki/en_US/guide/dashboard.html)
+          for possible options.
+        '';
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+
+          options = {
+            listenhost = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              description = ''
+                Host on which the nezha web interface and grpc should listen.
+              '';
+            };
+            listenport = lib.mkOption {
+              type = lib.types.port;
+              default = 8008;
+              description = ''
+                Port on which the nezha web interface and grpc should listen.
+              '';
+            };
+
+          };
+        };
+      };
+
+      mutableConfig = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether the config.yaml is writable by Nezha.
+
+          If this option is disabled, changes on the web interface won't
+          be possible. If an config.yaml is present, it will be overwritten.
+        '';
+      };
+
+      jwtSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret to sign web requests using JSON Web Tokens.
+        '';
+      };
+
+      agentSecretFile = lib.mkOption {
+        type = lib.types.path;
+        default = null;
+        description = ''
+          Path to the file containing the secret used by agents to connect.
+        '';
+      };
+
+      extraThemes = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.nezha-theme-nazhua ]";
+        description = ''
+          A list of additional themes.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nezha.settings.debug = cfg.debug;
+
+    systemd.services.nezha = {
+      serviceConfig = {
+        Restart = "on-failure";
+        StateDirectory = "nezha";
+        RuntimeDirectory = "nezha";
+        ConfigurationDirectory = "nezha";
+        WorkingDirectory = "/var/lib/nezha";
+        ReadWritePaths = [
+          "/var/lib/nezha"
+          "/etc/nezha"
+        ];
+
+        LoadCredential = [
+          "jwt-secret:${cfg.jwtSecretFile}"
+          "agent-secret:${cfg.agentSecretFile}"
+        ];
+
+        # Hardening
+        ProcSubset = "pid";
+        DynamicUser = true;
+        RemoveIPC = true;
+        LockPersonality = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = cfg.settings.listenport >= 1024; # incompatible with CAP_NET_BIND_SERVICE
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        AmbientCapabilities = lib.optionalString (cfg.settings.listenport < 1024) "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0066";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ]
+        ++ lib.optional (cfg.settings ? tsdb) "mincore";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        PrivateDevices = "yes";
+
+        ExecStart =
+          let
+            package = cfg.package.override { withThemes = cfg.extraThemes; };
+          in
+          ''${lib.getExe package} -c "''${CONFIGURATION_DIRECTORY}"/config.yaml -db "''${STATE_DIRECTORY}"/sqlite.db'';
+      };
+      enableStrictShellChecks = true;
+      startLimitIntervalSec = 10;
+      startLimitBurst = 3;
+      preStart = ''
+        cp "${configFile}" "''${RUNTIME_DIRECTORY}"/new
+        ${lib.getExe pkgs.jq} \
+            --arg jwt_secret "$(<"''${CREDENTIALS_DIRECTORY}"/jwt-secret)" \
+            --arg agent_secret "$(<"''${CREDENTIALS_DIRECTORY}"/agent-secret)" \
+            '. + { jwtsecretkey: $jwt_secret, agentsecretkey: $agent_secret }' \
+            < "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+        mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+
+        ${lib.optionalString cfg.mutableConfig ''
+          [ -e "''${CONFIGURATION_DIRECTORY}"/config.yaml ] && \
+            ${lib.getExe pkgs.yj} < "''${CONFIGURATION_DIRECTORY}"/config.yaml > "''${RUNTIME_DIRECTORY}"/old && \
+            ${lib.getExe pkgs.jq} -s '.[0] * .[1]' \
+              "''${RUNTIME_DIRECTORY}"/old "''${RUNTIME_DIRECTORY}"/new > "''${RUNTIME_DIRECTORY}"/tmp
+          [ -e "''${RUNTIME_DIRECTORY}"/old ] && rm "''${RUNTIME_DIRECTORY}"/old
+          [ -e "''${RUNTIME_DIRECTORY}"/tmp ] && mv "''${RUNTIME_DIRECTORY}"/tmp "''${RUNTIME_DIRECTORY}"/new
+        ''}
+        mv "''${RUNTIME_DIRECTORY}"/new  "''${CONFIGURATION_DIRECTORY}"/config.yaml
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -752,6 +752,7 @@ in
   hitch = handleTest ./hitch { };
   hledger-web = runTest ./hledger-web.nix;
   hockeypuck = runTest ./hockeypuck.nix;
+  holo-daemon-modular-service = runTest ./holo-daemon-modular.nix;
   home-assistant = runTest ./home-assistant.nix;
   homebox = runTest ./homebox.nix;
   homebridge = runTest ./homebridge.nix;
@@ -1099,6 +1100,7 @@ in
   nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = runTest ./nexus.nix;
+  nezha = runTest ./nezha.nix;
   # TODO: Test nfsv3 + Kerberos
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };

nixos/tests/holo-daemon-modular.nix

@@ -0,0 +1,66 @@
+{ ... }:
+{
+  _class = "nixosTest";
+  name = "holo-daemon-modular-service-test";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.holo-daemon
+          pkgs.holo-cli
+        ];
+        system.services.holo-daemon = {
+          imports = [ pkgs.holo-daemon.services.default ];
+        };
+        users.users.holo = {
+          isSystemUser = true;
+          group = "holo";
+          home = "/var/lib/holo";
+          createHome = true;
+        };
+        users.groups.holo = { };
+        services.getty.autologinUser = "root";
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import time
+
+      start_all()
+
+      # holo-cli connects to the daemon at startup
+      # features a bash-like editing functionality for interactive use
+      # uses -c option to execute arguments as commands
+
+      machine.wait_for_unit("multi-user.target")
+
+      machine.wait_for_unit("holo-daemon.service")
+
+      machine.succeed("holo-cli -V")
+
+      # wait for cli to connect to the daemon
+      machine.wait_for_open_port(50051)
+
+      # Test the running configuration is empty
+      machine.succeed("holo-cli -c 'show running format json'")
+
+      # Configure an OSPFv3 instance:
+      # as seen in https://asciinema.org/a/qYxmDu1QjGPBAt5gNyNKvXhHk
+
+      machine.send_chars("holo-cli\n", 1)
+      time.sleep(5)
+      machine.send_chars("configure\n", 1)
+      machine.send_chars("routing control-plane-protocols control-plane-protocol ietf-ospf:ospfv3 main\n", 1)
+      machine.send_chars("ospf preference inter-area 50\n", 1)
+      machine.send_chars("show changes\n", 1)
+      machine.send_chars("commit\n", 1)
+      machine.send_chars("exit\n", 1)
+
+      # Verify the configuration was applied (in interactive test)
+      machine.succeed("test \"$(holo-cli -c 'show running format json')\" != \"{}\"");
+    '';
+}

nixos/tests/nezha.nix

@@ -0,0 +1,114 @@
+{ lib, pkgs, ... }:
+let
+  agent_host = "agent.test";
+  dashboard_host = "dashboard.test";
+
+  agentSecret = pkgs.writeText "fakeagentsecret" "fakeagentsecret";
+
+  hosts = {
+    "${agent_host}" = "192.168.0.2";
+    "${dashboard_host}" = "192.168.0.1";
+  };
+  hostsEntries = lib.mapAttrs' (k: v: {
+    name = v;
+    value = lib.singleton k;
+  }) hosts;
+in
+{
+  name = "nezha";
+
+  meta.maintainers = with lib.maintainers; [ moraxyc ];
+
+  containers = {
+    agent = _: {
+      networking = {
+        hostName = builtins.elemAt (lib.splitString "." agent_host) 0;
+        domain = builtins.elemAt (lib.splitString "." agent_host) 1;
+        firewall.enable = false;
+        hosts = hostsEntries;
+        useDHCP = false;
+        interfaces.eth1.ipv4.addresses = lib.singleton {
+          address = hosts."${agent_host}";
+          prefixLength = 24;
+        };
+      };
+      services.nezha-agent = {
+        enable = true;
+        debug = true;
+        genUuid = true;
+        settings = {
+          server = hosts."${dashboard_host}" + ":80";
+        };
+        clientSecretFile = agentSecret;
+      };
+    };
+
+    dashboard =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1.ipv4.addresses = lib.singleton {
+            address = hosts."${dashboard_host}";
+            prefixLength = 24;
+          };
+        };
+        services.nezha = {
+          enable = true;
+          debug = true;
+          settings = {
+            listenhost = "0.0.0.0";
+            # Test CAP_NET_BIND_SERVICE
+            listenport = 80;
+          };
+          mutableConfig = true;
+          jwtSecretFile = pkgs.writeText "fakejwt" "fakejwt";
+          agentSecretFile = agentSecret;
+        };
+      };
+  };
+
+  testScript = ''
+    import json
+
+    with subtest("Wait for services and network"):
+        dashboard.wait_for_unit("nezha.service")
+        agent.wait_for_unit("nezha-agent.service")
+        dashboard.wait_for_open_port(80)
+        dashboard.wait_for_unit("network.target")
+        agent.wait_for_unit("network.target")
+        agent.succeed("curl --fail --max-time 10 http://dashboard.test/")
+
+    with subtest("Test mutableConfig"):
+        dashboard.succeed("systemctl stop nezha")
+        dashboard.succeed("""
+          echo '{"sitename": "Nezha on NixOS"}' > /etc/nezha/config.yaml
+        """)
+        dashboard.succeed("systemctl start nezha")
+        dashboard.wait_for_unit("nezha.service")
+        dashboard.wait_for_open_port(80)
+        result = json.loads(agent.succeed("""
+            curl --fail -X POST --json '{ "username": "admin", "password": "admin"}' \
+              'http://dashboard.test/api/v1/login'
+        """))
+        token = result['data']['token']
+        result = json.loads(agent.succeed(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/setting'
+        """))
+        assert "Nezha on NixOS" == result['data']['config']['site_name']
+
+    with subtest("Verify connection and uuid"):
+        uuid = agent.succeed(
+            "${lib.getExe' pkgs.util-linux "uuidgen"} --md5 -n @dns -N ${agent_host}"
+        )
+        # remove unprintable characters
+        uuid = "".join([char for char in uuid if char.isprintable()])
+        agent.wait_until_succeeds(f"""
+          curl --fail -X GET --header 'Authorization: Bearer {token}' \
+            'http://dashboard.test/api/v1/server' | grep {uuid}
+        """)
+  '';
+}

pkgs/by-name/as/ashuffle/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/joshkunz/ashuffle";
     description = "Automatic library-wide shuffle for mpd";
-    maintainers = [ lib.maintainers.tcbravo ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
     license = lib.licenses.mit;
     mainProgram = "ashuffle";

pkgs/by-name/be/betterleaks/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "betterleaks";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "betterleaks";
     repo = "betterleaks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eq0U4KiL91NW2lxizQ0tZuXxkNnTuSb/pvNSY/+3DZQ=";
+    hash = "sha256-7Oa6mtFhkHqgd4/FH85W7Bc/KSMwPCeHRhIFk2KVkik=";
   };
 
-  vendorHash = "sha256-zlZNay6srObMfm4iweCezsr/EImCN9rl03DH8qJU/rc=";
+  vendorHash = "sha256-KAZfl2t8LUsgQBKsrgXsh/1ziX0FZvDhnSUAv7D/hSA=";
 
   ldflags = [
     "-s"

pkgs/by-name/ca/cardinal/package.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  carla,
   cmake,
   dbus,
   fftwFloat,
@@ -37,6 +38,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   prePatch = ''
     patchShebangs ./dpf/utils/generate-ttl.sh
+
+    substituteInPlace plugins/Cardinal/src/Carla.cpp \
+      --replace-fail "/usr/lib/carla" "${carla}/bin" \
+      --replace-fail "/usr/share/carla/resources" "${carla}/share"
+
+    substituteInPlace plugins/Cardinal/src/Ildaeil.cpp \
+      --replace-fail "/usr/lib/carla" "${carla}/bin" \
+      --replace-fail "/usr/share/carla/resources" "${carla}/share"
   '';
 
   dontUseCmakeConfigure = true;

pkgs/by-name/cl/clamav/package.nix

@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clamav";
-  version = "1.4.3";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/clamav-${finalAttrs.version}.tar.gz";
-    hash = "sha256-2HTKvz1HZbNbUY71NWWKHm7HSAIAah1hP58SSqE0MhA=";
+    hash = "sha256-80AYzyLwW92dGhV0ygcZPj4DDKUgUMPlwiDiOjIxSWU=";
   };
 
   patches = [
@@ -67,11 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DSYSTEMD_UNIT_DIR=${placeholder "out"}/lib/systemd"
     "-DAPP_CONFIG_DIRECTORY=/etc/clamav"
+    "-DCVD_CERTS_DIRECTORY=${placeholder "out"}/share/clamav/certs"
   ];
 
-  # Seems to only fail on x86_64-darwin with sandboxing
-  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64);
-  __darwinAllowLocalNetworking = true;
+  # Fails on darwin with sandboxing
+  doCheck = !(stdenv.hostPlatform.isDarwin);
 
   checkInputs = [
     python3.pkgs.pytest

pkgs/by-name/co/context7-mcp/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "3.0.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-3Hk3YEXIR6SAEtCeDeaU1fU/CyvxuObZSNbgqrzeJ/o=";
+    hash = "sha256-Gf3GnVOceAMzsc1SYGQVriDzDD/dQYSoBSrCuQ5M4UI=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-ugUN1U0OR8dPTq4PADJaq6ElngSlw6PlmYDUFoW+2F4=";
+    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
   };
 
   buildPhase = ''

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YXEEiWbbP6G7x/rQiihAq20OEMxJNSgky+JTEaKlNDU=";
+    hash = "sha256-FZP+RTV4pcj9pzDq3G2+sWeJnkh9WnW3Atd0CC9zDCk=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor

pkgs/by-name/de/dep-scan/package.nix

@@ -79,6 +79,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     teams = [ lib.teams.ngi ];
-    mainProgram = "dep-scan";
+    mainProgram = "depscan";
   };
 })

pkgs/by-name/du/duplicati/deps.json

@@ -26,8 +26,8 @@
   },
   {
     "pname": "Avalonia",
-    "version": "12.0.0",
-    "hash": "sha256-pBn3o40TTYAPtjcfvaVK6wMFNSY7AHEE5wU4zDUj4FA="
+    "version": "12.0.2",
+    "hash": "sha256-Ht2h4cBtnVhrk9VWsHDOEvU1wd/y80CxMDWn8W0lHKk="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
@@ -46,8 +46,8 @@
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "12.0.0",
-    "hash": "sha256-M18vFA8cxZDR6RBF32O82n5pQAj70Jr6CpVXUEjtEso="
+    "version": "12.0.2",
+    "hash": "sha256-ydFDRX0zTEtJJzjn+TTpcSYL49xBJ3vFi9v3NSOyPww="
   },
   {
     "pname": "Avalonia.Diagnostics",
@@ -56,23 +56,23 @@
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "12.0.0",
-    "hash": "sha256-jOAw9i1K093cfGrNOVZQgXm8nNxaFcRMhbLM3NFrGE8="
+    "version": "12.0.2",
+    "hash": "sha256-raEQGX8Vwr+c7W5SzkEZ/phEEs/a5N0xeUfAWKEpl6A="
   },
   {
     "pname": "Avalonia.FreeDesktop.AtSpi",
-    "version": "12.0.0",
-    "hash": "sha256-/sXI18zP+SB8kRBZLl1WddrNxsgQRceoB3AiZwQYfWs="
+    "version": "12.0.2",
+    "hash": "sha256-5AQPlWW6g7G6pm7qI8RHR/MQ45VGd7iAFWseXUitIVI="
   },
   {
     "pname": "Avalonia.HarfBuzz",
-    "version": "12.0.0",
-    "hash": "sha256-3S0L0YqiULMBgXbwlJl7qTwhBZl8I/ahM8GF1kcK/hE="
+    "version": "12.0.2",
+    "hash": "sha256-FUYKVfweWiFix+LJZt9scI7HYiIl3C+8j9K0/yKsOIE="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "12.0.0",
-    "hash": "sha256-QqPWE4I2TxCPHufuNkfx1r35lGN1W+c992gxzrB+RRc="
+    "version": "12.0.2",
+    "hash": "sha256-E1uQvsvnVBIyzAyV3803LXMpitPvaoJezCedz6ZeV1A="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
@@ -81,18 +81,18 @@
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "12.0.0",
-    "hash": "sha256-l/NCO/I3Zavlta14Q198MpYn7jtwMclUWk6cqEgqmTU="
+    "version": "12.0.2",
+    "hash": "sha256-19hc0GSsa9JujiZlHxLKn7x6fUjAeJSH3lO43hL0bD0="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "12.0.0",
-    "hash": "sha256-w8i8lTkf3yp78rPxg7LlcsrKF/K3J7ATOTy3D/Bt6CA="
+    "version": "12.0.2",
+    "hash": "sha256-ZzNoO/8/SYG4xN0RmPz9AC6N1RtPTnSaTVrQ0+NNvGU="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "12.0.0",
-    "hash": "sha256-wpBWj5EsRPDhsoE+RFGy8Z7wS8lN2s0mW7qFgRaVOOA="
+    "version": "12.0.2",
+    "hash": "sha256-H8AXau1gV8m33lKYrSzxp0GDmoCuyx7+B93gTfcpXXU="
   },
   {
     "pname": "Avalonia.Themes.Simple",
@@ -101,13 +101,13 @@
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "12.0.0",
-    "hash": "sha256-QDS1fxNQMw3EHfrqihk05emNENjUmxLQyYgNCQp9vwM="
+    "version": "12.0.2",
+    "hash": "sha256-yHcePPF2tKc9oussntmAr/4LX3FEkGRRFuzdmlE+NHQ="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "12.0.0",
-    "hash": "sha256-WJjJKB2q1s18BVlLDUdPIpLQC2Bhgkl7fkO42Kjv2zU="
+    "version": "12.0.2",
+    "hash": "sha256-not3Qv87nbN6Bi8sE49WKDSNzUTISBdcNR3rcFqgwHE="
   },
   {
     "pname": "AWSSDK.Core",
@@ -936,28 +936,28 @@
   },
   {
     "pname": "SkiaSharp",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-fIrOUgx8K/qnJaQCPa06BPlkIy3PHRgrhHGkKn5d3qY="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-yUHsoau6WVQkzYV5UVnKcgpABiapa9aoTDd1pw/J5r8="
   },
   {
     "pname": "SkiaSharp.NativeAssets.Linux",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-JsQ9xmreA1zNaLwEHNPMaFsRygEDhemJCrbkhs8WHvQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-jcf0FhUgOzxpJ4ENn1q5uPe8dT+kXl0/yUWJs+hDYNA="
   },
   {
     "pname": "SkiaSharp.NativeAssets.macOS",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-9l1xrgVl6kH2kjW5ffluKv4ec/kqUfVnqlz9OVwP2cQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-olbqFOHmkiCdlnXHU4l1lTb04yAPn21CvLNMP4AGncs="
   },
   {
     "pname": "SkiaSharp.NativeAssets.WebAssembly",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-5UsssFayYOMcvWNBGJeChLRc9EahpIuuexNhGHnnrhU="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-R+67ADA6luDa9b7xvsE4PSL6GWwQTaNYzw2WYou/ofQ="
   },
   {
     "pname": "SkiaSharp.NativeAssets.Win32",
-    "version": "3.119.3-preview.1.1",
-    "hash": "sha256-MWsHe/NBlbHGtEhUICVuuhpRYSjtU06msLCoglqmVhQ="
+    "version": "3.119.4-preview.1.1",
+    "hash": "sha256-Sd+KnMezIKbc4OLklHsfeM7EVZERtmawWuSCoaySteM="
   },
   {
     "pname": "SMBLibrary",
@@ -1204,11 +1204,6 @@
     "version": "1.5.4",
     "hash": "sha256-5rYv675c14DNMne6FUkebyBI+7fWwLCqGs+KQCjbCcI="
   },
-  {
-    "pname": "Tmds.DBus.Protocol",
-    "version": "0.90.3",
-    "hash": "sha256-jK/98C0WrkVqPPNMx+xkdGK7vhcFmDsMqX7hUmALAWM="
-  },
   {
     "pname": "Tmds.DBus.Protocol",
     "version": "0.92.0",

pkgs/by-name/du/duplicati/package.nix

@@ -14,9 +14,9 @@
 
 let
   # for update.sh easy to handle
-  ngclientVersion = "0.0.218";
-  ngclientRev = "67e437adee2fefa9dc2a9464d3748a8512525f71";
-  ngclientHash = "sha256-1DT/WIaQ+di8vsnsAaA5qYinhvaKImEfGn2pyljXxjw=";
+  ngclientVersion = "0.0.225";
+  ngclientRev = "b740ef00435af2066936f90d4cf284b5662c4bf9";
+  ngclientHash = "sha256-X8ZhCmwfroIZWj3DjFq/InN+2zCOtHjEE1TyCXHNaIw=";
 
   # from Duplicati/Server/webroot/ngclient/package.json
   ngclient = buildNpmPackage {
@@ -30,7 +30,7 @@ let
       hash = ngclientHash;
     };
 
-    npmDepsHash = "sha256-yytz5qMhgd/yXr11szuVslTLTjV5XpfNPyLW3mmRM1E=";
+    npmDepsHash = "sha256-DhP1gY965xNOj98s95LqSTCaqJt4YdFfbZ4bGp3o4cA=";
 
     nativeBuildInputs = [ bun ];
 
@@ -58,15 +58,15 @@ let
 in
 buildDotnetModule rec {
   pname = "duplicati";
-  version = "2.3.0.1";
+  version = "2.3.0.3";
   channel = "stable";
-  buildDate = "2026-04-24";
+  buildDate = "2026-06-10";
 
   src = fetchFromGitHub {
     owner = "duplicati";
     repo = "duplicati";
     tag = "v${version}_${channel}_${buildDate}";
-    hash = "sha256-r3Oumo2vrViTNvZDUaVoJyGMBf1/uHS6oAhn9Aegb3s=";
+    hash = "sha256-vRD3pehsGznGesynrftns6F5md9Ej509A99Ug0IOPGk=";
     stripRoot = true;
   };
 

pkgs/by-name/fl/fluent-bit/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VXf1F0TZFi8d7gil8yc3WWA/0X3QyYPnbA3luE1DE98=";
+    hash = "sha256-5X6qiwoRc7FTJSGjWYhhef9N8gaxrc9dwD8Z/8woIUo=";
   };
 
   # The source build documentation covers some dependencies and CMake options.

pkgs/by-name/gr/graphite/package.nix

@@ -30,12 +30,12 @@
 }:
 
 let
-  version = "0-unstable-2026-06-06";
-  rev = "2c29d2c40614a0ea51b8be113daba2f7f54c4209";
+  version = "0-unstable-2026-06-15";
+  rev = "34e0fd77574c30749d00d775df87a7e9362e7ce8";
 
-  srcHash = "sha256-0arLP1xUAZRUezNkTvxuVLn470Zl7EKlGecdBb5xw0Q=";
+  srcHash = "sha256-SyxteWavvyeRtKcGuJkOxojstJk1C2ndbNERuSM3Cng=";
   shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
-  cargoHash = "sha256-LAb279Acwl57aY5ijJ70c9rRMrBLGpGJ7Q5gVnEcRT0=";
+  cargoHash = "sha256-KktJj1c/OrJazNk40NND8irmNd30nzpZOxdwaTAqjIs=";
   npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig=";
 
   brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";

pkgs/by-name/gr/gridtracker2/package.nix

@@ -11,16 +11,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "gridtracker2";
-  version = "2.260323.0";
+  version = "2.260609.0";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3DUbKG7bMR2VpJPPsLNRLzYaStv5iTanECAT6DHMExo=";
+    hash = "sha256-QlL8q5TaUizACr4uRbFZtl8hy/Eyq7d4v56ca3ckj4o=";
   };
 
-  npmDepsHash = "sha256-dJmrNP2AwIaQaCq0guG+OTogfcL8f97MAp6N7HAw5z8=";
+  npmDepsHash = "sha256-5h3bswjVf/8JHhwHRFTUfydN7XXtWbxNHTZ0mLL7RT8=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/ho/holo-cli/libyang4-sys.patch

@@ -0,0 +1,12 @@
+--- a/build.rs
++++ b/build.rs
+@@ -62,6 +62,9 @@
+         cmake_config.define("ENABLE_BUILD_TESTS", "OFF");
+         cmake_config.define("CMAKE_BUILD_TYPE", "Release");
+         cmake_config.define("CMAKE_POSITION_INDEPENDENT_CODE", "ON");
++        // https://github.com/CESNET/libyang/blob/3d07c3a71534a580c3960907da17568eff7e5c64/CMakeModules/FindPCRE2.cmake#L9
++        cmake_config.define("PCRE2_INCLUDE_DIRS", "@PCRE2_INCLUDE_DIRS@");
++        cmake_config.define("PCRE2_LIBRARIES", "@PCRE2_LIBRARIES@");
+         let cmake_dst = cmake_config.build();
+         println!("cargo:root={}", env::var("OUT_DIR").unwrap());
+         println!("cargo:rustc-link-search=native={}/lib", cmake_dst.display());

pkgs/by-name/ho/holo-cli/package.nix

@@ -2,26 +2,48 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+
+  stdenv,
+  replaceVars,
+
   cmake,
   pkg-config,
   protobuf,
+
   pcre2,
+
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-cli";
-  version = "0.5.0-unstable-2025-09-22";
+  version = "0.5.0-unstable-2026-03-15";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo-cli";
-    rev = "7d99e7de5eb5226728ee57153c03362c90eb65b2";
-    hash = "sha256-O509LNSpak+MJPQheYLPtJQcNGPyZLMHMasKScoVnls=";
+    rev = "36fdc13323e384c086da8663f0d510b238fb6e4f";
+    hash = "sha256-5Nvyh9gznMsutu3wHR6gwgKkIm115hbx4R6D/Gm1Rug=";
   };
 
-  cargoHash = "sha256-bsoxWjOMzRRtFGEaaqK0/adhGpDcejCIY0Pzw1HjQ5U=";
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  cargoPatches = [
+    # cargo lock is outdated
+    # https://github.com/holo-routing/holo-cli/pull/31
+    ./update-cargo-lock.patch
+  ];
+
+  cargoHash = "sha256-77aUfXcnVQLVEKQuUdBZ4k5/3rOoe9PvGC0AlJS0UJc=";
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    pushd $cargoDepsCopy/*/libyang4-sys-*
+    patch -p1 < ${
+      replaceVars ./libyang4-sys.patch {
+        PCRE2_INCLUDE_DIRS = "${lib.getInclude pcre2}/include";
+        PCRE2_LIBRARIES = "${lib.getLib pcre2}/lib/libpcre2-8${stdenv.hostPlatform.extensions.sharedLibrary}";
+      }
+    }
+    popd
+  '';
 
   # Use rust nightly features
   env.RUSTC_BOOTSTRAP = 1;
@@ -31,17 +53,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pkg-config
     protobuf
   ];
+
   buildInputs = [
     pcre2
   ];
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     description = "Holo` Command Line Interface";
     homepage = "https://github.com/holo-routing/holo-cli";
-    teams = with lib.teams; [ ngi ];
-    maintainers = with lib.maintainers; [ themadbit ];
     license = lib.licenses.mit;
     mainProgram = "holo-cli";
+    maintainers = with lib.maintainers; [ themadbit ];
     platforms = lib.platforms.all;
+    teams = with lib.teams; [ ngi ];
   };
 })

pkgs/by-name/ho/holo-cli/update-cargo-lock.patch

@@ -0,0 +1,96 @@
+From 8e282c056f7d3cc00c1f1b544659f94c150e72e9 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sat, 28 Mar 2026 22:01:41 +0530
+Subject: [PATCH] update cargo lock file
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ Cargo.lock | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index a7279b9b9a339056b625a217a642c50e2fb97780..b1f8b251d1e0d9c3cdfa4f769b690a75c7404624 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,12 +26,6 @@ dependencies = [
+  "memchr",
+ ]
+ 
+-[[package]]
+-name = "android-tzdata"
+-version = "0.1.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+-
+ [[package]]
+ name = "android_system_properties"
+ version = "0.1.5"
+@@ -224,15 +218,16 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+ 
+ [[package]]
+ name = "chrono"
+-version = "0.4.40"
++version = "0.4.44"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
++checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+ dependencies = [
+- "android-tzdata",
+  "iana-time-zone",
++ "js-sys",
+  "num-traits",
+  "serde",
+- "windows-link",
++ "wasm-bindgen",
++ "windows-link 0.2.1",
+ ]
+ 
+ [[package]]
+@@ -537,6 +532,7 @@ checksum = "fbd780fe5cc30f81464441920d82ac8740e2e46b29a6fad543ddd075229ce37e"
+ name = "holo-cli"
+ version = "0.5.0"
+ dependencies = [
++ "chrono",
+  "clap",
+  "derive-new",
+  "enum-as-inner",
+@@ -1877,7 +1873,7 @@ checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+ dependencies = [
+  "windows-implement",
+  "windows-interface",
+- "windows-link",
++ "windows-link 0.1.1",
+  "windows-result",
+  "windows-strings",
+ ]
+@@ -1910,13 +1906,19 @@ version = "0.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+ 
++[[package]]
++name = "windows-link"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
++
+ [[package]]
+ name = "windows-result"
+ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
+ dependencies = [
+- "windows-link",
++ "windows-link 0.1.1",
+ ]
+ 
+ [[package]]
+@@ -1925,7 +1927,7 @@ version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+ dependencies = [
+- "windows-link",
++ "windows-link 0.1.1",
+ ]
+ 
+ [[package]]
+

pkgs/by-name/ho/holo-daemon/package.nix

@@ -6,6 +6,7 @@
   pkg-config,
   protobuf,
   pcre2,
+  pkgs,
   nix-update-script,
 }:
 
@@ -20,8 +21,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-zZrse46NJb8gD4BtM20FfdtRdxVNLZ+/51dy2nuiOd8=";
   };
 
-  passthru.updateScript = nix-update-script { };
-
   cargoHash = "sha256-cHJzwI7FDVA1iwqg+x9sMlao22SGQoOuq+MB0XtYsEc=";
 
   # Use rust nightly features
@@ -36,6 +35,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pcre2
   ];
 
+  passthru = {
+    updateScript = nix-update-script { };
+    services.default = {
+      imports = [
+        (lib.modules.importApply ./service.nix {
+          inherit pkgs;
+        })
+      ];
+      holo-daemon.package = lib.mkDefault finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "`holo` daemon that provides the routing protocols, tools and policies";
     homepage = "https://github.com/holo-routing/holo";

pkgs/by-name/ho/holo-daemon/service.nix

@@ -0,0 +1,133 @@
+# Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkPackageOption
+    mkOption
+    types
+    ;
+  cfg = config.holo-daemon;
+  format = pkgs.formats.toml { };
+  configFile = format.generate "holod.toml" cfg.settings;
+in
+{
+  _class = "service";
+
+  options.holo-daemon = {
+    package = mkPackageOption pkgs "holo-daemon" { };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          user = mkOption {
+            type = types.str;
+            description = "User for the holo daemon";
+            default = "holo";
+          };
+          group = mkOption {
+            type = types.str;
+            description = "Group for the holo daemon";
+            default = "holo";
+          };
+          # Needs to be writable by @user or @group
+          database_path = mkOption {
+            type = types.str;
+            description = "Path to the holo database";
+            default = "/var/run/holod/holod.db";
+          };
+          logging = mkOption {
+            type = types.submodule {
+              freeformType = format.type;
+              options = {
+                journald = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable journald logging";
+                        default = true;
+                      };
+                    };
+                  };
+                  description = "Journald logging configuration";
+                  default = { };
+                };
+                file = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable file logging";
+                        default = true;
+                      };
+                      dir = mkOption {
+                        type = types.str;
+                        description = "Directory for log files";
+                        default = "/var/log/";
+                      };
+                      name = mkOption {
+                        type = types.str;
+                        description = "Name of the log file";
+                        default = "holod.log";
+                      };
+                    };
+                  };
+                  description = "File logging configuration";
+                  default = { };
+                };
+              };
+            };
+            description = "Logging configuration for the holo daemon";
+            default = { };
+          };
+          plugins = mkOption {
+            type = types.submodule {
+              freeformType = format.type;
+              options = {
+                grpc = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        description = "Enable or disable gRPC plugin";
+                        default = true;
+                      };
+                      address = mkOption {
+                        type = types.str;
+                        description = "gRPC server listening address";
+                        default = "[::]:50051";
+                      };
+                    };
+                  };
+                  description = "gRPC plugin configuration";
+                  default = { };
+                };
+              };
+            };
+            description = "Plugin configuration for the holo daemon";
+            default = { };
+          };
+        };
+      };
+      description = "Configuration for the holo daemon";
+      default = { };
+    };
+  };
+
+  config = {
+    process.argv = [
+      "${cfg.package}/bin/holod"
+      "-c"
+      configFile
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ themadbit ];
+}

pkgs/by-name/ic/icestudio/package.nix

@@ -13,13 +13,13 @@
 
 let
   # Use unstable because it has improvements for finding python
-  version = "0.12-unstable-2026-02-16";
+  version = "0.12-unstable-2026-05-28";
 
   src = fetchFromGitHub {
     owner = "FPGAwars";
     repo = "icestudio";
-    rev = "3398b694f7d8eeda47fae37067a66f011ce22880";
-    hash = "sha256-OJQepq424ml86LHMfkexArwC7LWoXgJP1UEkqwSXtmY=";
+    rev = "cfa40bd83ada8d7f3594c2cd60e39d2d63ff14d0";
+    hash = "sha256-vp4cLDK2mfheLw+0ysNjKW5bbrm806Y6sHkSpEgWo4U=";
   };
 
   collection = fetchurl {

pkgs/by-name/ko/kopia/package.nix

@@ -11,18 +11,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kopia";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
+    hash = "sha256-yjeLV7N/U88oVdP4iJYgSM/QJLAMREaB/2jBcbTDWkA=";
   };
 
   __structuredAttrs = true;
 
-  vendorHash = "sha256-VMfFXGBIUtRa4JxhOn7YBfdLNmpmGrkBVKiIDn5vKTc=";
+  vendorHash = "sha256-5p/MUNkqNb+iAFxXXYRR2NB1WiGVIcNrTADsd/VjapU=";
 
   subPackages = [ "." ];
 

pkgs/by-name/le/ledger-live-desktop/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "4.6.1";
+  version = "4.8.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-OXzxOraDgOBNpsbDAPpf5dGERiK/pkfsVtpzTZkXPQA=";
+    hash = "sha256-9S2Iuxqe6YpuV3lXqirO4b1J71EkTZW1wSmxv7Qg3uY=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/ll/lldap/package.nix

@@ -6,7 +6,7 @@
   nixosTests,
   rustPlatform,
   rustc,
-  wasm-bindgen-cli_0_2_100,
+  wasm-bindgen-cli_0_2_120,
   wasm-pack,
   which,
   runCommand,
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lldap";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "lldap";
     repo = "lldap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
+    hash = "sha256-EafYBCorK5t8ZLoXTjqLg+Q6GDRZjalpRqSoVySdpOk=";
   };
 
-  cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  cargoHash = "sha256-GhSoPDMsWRuW6SYS/QTPgsA7fBFup5C5+DBqnlFqwlQ=";
   ## workaround for overrideAttrs on buildRustPackage
   ## see https://discourse.nixos.org/t/is-it-possible-to-override-cargosha256-in-buildrustpackage/4393/3
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -61,7 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       pname = finalAttrs.pname + "-frontend";
       nativeBuildInputs = [
         wasm-pack
-        wasm-bindgen-cli_0_2_100
+        wasm-bindgen-cli_0_2_120
         binaryen
         which
         rustc

pkgs/by-name/ma/markdownlint-cli/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "markdownlint-cli";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "igorshubovych";
     repo = "markdownlint-cli";
     rev = "v${version}";
-    hash = "sha256-sepA0XUAXzhjKiHrOwtoXN9rJ3t6ge9vA5xYNzIHyDs=";
+    hash = "sha256-Se8Dw3pFGUiAMchbX4gH56aIMtvSg6wxGYecqRK1UAA=";
   };
 
-  npmDepsHash = "sha256-pFJKEntmpO8CskQiSEqTwDxVZbdZDa/Uk2HcnMctiz4=";
+  npmDepsHash = "sha256-CrffManYnidN0XgRmTBaBpu4skCMXubbfz91Q4sGh80=";
 
   dontNpmBuild = true;
 

pkgs/by-name/me/memtier-benchmark/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "memtier-benchmark";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "memtier_benchmark";
     tag = finalAttrs.version;
-    hash = "sha256-pvi5p/0HZIiZYi5+eqcAu4MMrF0Hh42ByPEHuA9jcug=";
+    hash = "sha256-0whioOhzs5aLu/fjRJvybZ8UYE5Lv1VnQDmgikC3tEA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ne/nezha-theme-user/package.nix

@@ -2,36 +2,44 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_11,
   nix-update-script,
 }:
 
+let
+  pnpm = pnpm_11;
+in
 buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-user";
-  version = "2.0.1";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "hamster1963";
-    repo = "nezha-dash-v1";
+    repo = "nezha-dash-v2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3zaA3T4zW18caOQe5DBF8Zsms3cjks3Ywyfkyk6N2N0=";
+    hash = "sha256-X7NRpDeZqLijgbUQOEdML00TPRM2D55zlJkzWB2TKfM=";
   };
 
-  # TODO: Switch to the bun build function once available in nixpkgs
   postPatch = ''
-    cp ${./package-lock.json} package-lock.json
-
     # We cannot directly get the git commit hash from the tarball
     substituteInPlace vite.config.ts \
-      --replace-fail 'git rev-parse --short HEAD' 'echo refs/tags/v${finalAttrs.version}'
+      --replace-fail 'git rev-parse --short HEAD' 'echo ${finalAttrs.src.rev}'
     substituteInPlace src/components/Footer.tsx \
       --replace-fail '/commit/' '/tree/'
   '';
 
-  npmDepsHash = "sha256-hjVvp2dWBHqXrq/7+kLDmcUUrV15ln/8tNNqDmJ/Sh4=";
+  nativeBuildInputs = [ pnpm ];
 
-  npmPackFlags = [ "--ignore-scripts" ];
-
-  npmFlags = [ "--legacy-peer-deps" ];
+  npmDeps = null;
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-4Zfiw//9w16I2CXOEy/ocAI5frK5w4g3b8pxguGWOdA=";
+  };
+  npmConfigHook = pnpmConfigHook;
 
   dontNpmInstall = true;
   installPhase = ''
@@ -42,13 +50,13 @@ buildNpmPackage (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Nezha monitoring user frontend based on next.js";
-    changelog = "https://github.com/hamster1963/nezha-dash-v1/releases/tag/v${finalAttrs.version}";
-    homepage = "https://github.com/hamster1963/nezha-dash-v1";
-    license = lib.licenses.apsl20;
+    changelog = "https://github.com/hamster1963/nezha-dash-v2/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/hamster1963/nezha-dash-v2";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ moraxyc ];
   };
 })

pkgs/by-name/ne/nezha/package.nix

@@ -7,6 +7,7 @@
   dbip-country-lite,
   formats,
   nix-update-script,
+  nixosTests,
   nezha-theme-admin,
   nezha-theme-user,
   withThemes ? [ ],
@@ -114,6 +115,9 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) nezha;
+    };
   };
 
   meta = {

pkgs/by-name/op/openfga/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.16.1";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4vp2lyONLP5YJzbzJidg3+LAsQ/NhJAh+mvI2IrZWKI=";
+    hash = "sha256-wRK+EhjJh0OlNTLKYRohQyaFtsNL8vPPfppgiw/xDGI=";
   };
 
-  vendorHash = "sha256-S47vnGCnDiXUMINc53X1n0vVqU8fs0LHz3vbdtNZjlY=";
+  vendorHash = "sha256-F8XHaUGmaeMCE2eLWafyvPDuc3YiBGda55/fycMv5KQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/po/polonium/package.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildNpmPackage,
+  kdePackages,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "polonium";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "zeroxoneafour";
+    repo = "polonium";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Rn6mfn1R7K36fcLfIlt89SSfDQ8r6Ck0lHcI0H/yGWI=";
+    fetchSubmodules = true;
+  };
+
+  npmDepsHash = "sha256-9j5UxPRfFnaqDAW877TDNHH4rmN5QvzsUSeRVCjIz3g=";
+
+  __structuredAttrs = true;
+
+  dontConfigure = true;
+
+  # the installer does a bunch of stuff that fails in our sandbox, so just build here and then we
+  # manually do the install
+  buildFlags = [
+    "res"
+    "src"
+  ];
+
+  dontNpmBuild = true;
+
+  dontWrapQtApps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/kwin/scripts/polonium
+    cp -a pkg/. $out/share/kwin/scripts/polonium
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Auto-tiler that uses KWin 6.0+ tiling functionality";
+    homepage = "https://polonium.vaughanm.xyz/";
+    downloadPage = "https://github.com/zeroxoneafour/polonium/releases";
+    changelog = "https://github.com/zeroxoneafour/polonium/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      nelind
+      HeitorAugustoLN
+    ];
+    inherit (kdePackages.kwin.meta) platforms;
+  };
+})

pkgs/by-name/pr/process-compose/package.nix

@@ -10,13 +10,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "process-compose";
-  version = "1.110.0";
+  version = "1.116.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = "process-compose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kKb7CFjjvgmRTVgYKXM/EP/ti8OFhlFGcATqZcYHxOI=";
+    hash = "sha256-f+XH4L+yFnPTGmbbsKrXjPMVMzkaR56XQmTtekVCMcQ=";
 
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
@@ -46,7 +46,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  vendorHash = "sha256-dNSf2CJQRJAZiIimriYqlqwcaD1NQg7a1qFPMzEsrgw=";
+  vendorHash = "sha256-50N4IsSnUh3qmqqw+WACx2j0fMhLZKZdYK+7HAszxAY=";
 
   doCheck = false;
 

pkgs/by-name/ra/rattler-build/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rattler-build";
-  version = "0.65.1";
+  version = "0.66.1";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "rattler-build";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e9Alo7ZiPUhpupl46WDiHUDSAe9N8T+3eBy83o+Hf1g=";
+    hash = "sha256-HXmduOm07YZT8mfvJj5e0cL9twP/WyqZR6VnRk45IZA=";
   };
 
-  cargoHash = "sha256-eUG2/jNNLF0OJEQ9griNbl3UxY9CwWOjsdM5gZDcHrI=";
+  cargoHash = "sha256-vhaJX7prp+XUJbLy0GYfbGWTpZ+W162MmuVUcQc3r/0=";
 
   doCheck = false; # test requires network access
 

pkgs/by-name/re/rectangle/package.nix

@@ -134,13 +134,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rectangle";
-  version = "0.95";
+  version = "0.96";
 
   src = fetchFromGitHub {
     owner = "rxhanson";
     repo = "Rectangle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M/qZo2dWsFQxiBD5ypKh0M7AdHdLkY/rx4Lx01OBSlc=";
+    hash = "sha256-3FDCptlNztmexfFDRD/XX9fVuEHVG+EzcrqksJeI+fo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/so/songrec/package.nix

@@ -68,10 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/marin-m/SongRec/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [
-      tcbravo
-      tomasrivera
-    ];
+    maintainers = with lib.maintainers; [ tomasrivera ];
     mainProgram = "songrec";
   };
 })

pkgs/by-name/sp/spruce/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spruce";
-  version = "1.35.6";
+  version = "1.35.8";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = "spruce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Rk8NZ8CKK1bzwbfFrBx4I2lkAkViwVknZpuJGSAqGyA=";
+    hash = "sha256-aB1TRlPuWjTcXYK4X1LgLmdRlSI5xRf4OMsRQc91Wlg=";
   };
 
   vendorHash = null;

pkgs/by-name/st/stasis/package.nix

@@ -4,43 +4,42 @@
   fetchFromGitHub,
   versionCheckHook,
   nix-update-script,
-  wayland-scanner,
   wayland,
   wayland-protocols,
   dbus,
   pkg-config,
-  libinput,
-  udev,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stasis";
-  version = "1.2.0";
+  version = "1.3.0";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "saltnpepper97";
     repo = "stasis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xnEzGsUhB7ZAWgBlpZstJqIWcQNiu9o6P/eS7qMv/0w=";
+    hash = "sha256-5p0r9ymR2YimorGEVFdjqYKaQTeqSY7dZleV3kghUIc=";
   };
 
-  cargoHash = "sha256-CZ9TRtd+4KtHwZn8VjkuLMujP9eZHFkaiItGc6BqQsI=";
+  cargoHash = "sha256-pXu9TQ3LKzjvenHzFjPEhtEj0oEl7cplGBchBRHWAAo=";
 
   nativeBuildInputs = [
     pkg-config
-    wayland-scanner
   ];
 
   buildInputs = [
     wayland
     wayland-protocols
     dbus
-    libinput
-    udev
   ];
 
   #There are no tests
   doCheck = false;
 
+  postInstall = ''
+    install -Dm644 assets/stasis.png $out/share/icons/hicolor/256x256/apps/stasis.png
+  '';
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -57,7 +56,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       configuration language.
     '';
     homepage = "https://github.com/saltnpepper97/stasis";
-    changelog = "https://github.com/saltnpepper97/stasis/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/saltnpepper97/stasis/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nartsiss ];
     platforms = lib.platforms.linux;

pkgs/by-name/st/static-web-server/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "static-web-server";
-  version = "2.42.0";
+  version = "2.43.0";
 
   src = fetchFromGitHub {
     owner = "static-web-server";
     repo = "static-web-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EWCkad2v937GPL7qeHxPp24wf3EWk+M5iQkZBhErv/Y=";
+    hash = "sha256-oZPUyRN0X4wgJqdiqU3nX/SYb2kE8EuSCQP6Fl4A+AM=";
   };
 
-  cargoHash = "sha256-RYTG54c4Q4uP4lAZpjfulP/BV4jDp5xxsa6vtSn+vOs=";
+  cargoHash = "sha256-Bi53+xl9AdC3NWKJCnz6KA8vg7ydhX1zK13uPxTjJCU=";
 
   # static-web-server already has special handling for files with modification
   # time = Unix epoch, but the nix store is Unix epoch + 1 second.

pkgs/by-name/te/ted/package.nix

@@ -1,124 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  zlib,
-  pcre,
-  libxpm,
-  libx11,
-  libsm,
-  libice,
-  libjpeg,
-  libtiff,
-  libpng,
-  gtk2-x11,
-  libpaper,
-  makeWrapper,
-  ghostscript,
-  libxft,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ted";
-  version = "2.23";
-
-  src = fetchurl {
-    url = "https://ftp.nluug.nl/pub/editors/ted/ted-${version}.src.tar.gz";
-    hash = "sha256-P6mSwryWrzyniO+UHLUxT0odhDIC79AgG4tO6a2/MWw=";
-  };
-
-  preConfigure = ''
-    mkdir pkgconfig-append
-    pushd pkgconfig-append
-
-    # ted looks for libtiff, not libtiff-4 in its pkg-config invokations
-    cp ${libtiff.dev}/lib/pkgconfig/libtiff-4.pc libtiff.pc
-
-    # ted needs a libpaper pkg-config file
-    cat > libpaper.pc << EOF
-    prefix=${libpaper}
-    libdir=${libpaper}/lib
-    includedir=${libpaper}/include
-    exec_prefix=\''${prefix}
-
-    Name: libpaper
-    Version: ${libpaper.version}
-    Description: ${libpaper.meta.description}
-    Libs: -L\''${libdir} -lpaper
-    Cflags: -I\''${includedir}
-    EOF
-
-    export PKG_CONFIG_PATH="$PWD:$PKG_CONFIG_PATH"
-
-    popd
-  '';
-
-  makeFlags = [
-    "CONFIGURE_OPTIONS=--with-GTK"
-    "CONFIGURE_OPTIONS+=--prefix=$(out)"
-    "compile.shared"
-  ];
-
-  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-liconv";
-
-  installPhase = ''
-    runHook preInstall
-
-    make tedPackage/makefile
-    pushd tedPackage
-    substituteInPlace makefile --replace /usr ""
-    make PKGDESTDIR=$out datadir
-    popd
-
-    pushd $out/share/Ted/examples
-    for f in rtf2*.sh
-    do
-        makeWrapper "$PWD/$f" "$out/bin/$f" --prefix PATH : $out/bin:${lib.makeBinPath [ ghostscript ]}
-    done
-    popd
-
-    cp -v Ted/Ted $out/bin
-
-    runHook postInstall
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
-  ];
-  buildInputs = [
-    zlib
-    pcre
-    libx11
-    libice
-    libsm
-    libxpm
-    libjpeg
-    libtiff
-    libpng
-    gtk2-x11
-    libpaper
-    libxft
-  ];
-
-  meta = {
-    description = "Easy rich text processor";
-    longDescription = ''
-      Ted is a text processor running under X Windows on Unix/Linux systems.
-      Ted was developed as a standard easy light weight word processor, having
-      the role of Wordpad on MS-Windows. Since then, Ted has evolved to a real
-      word processor. It still has the same easy appearance and the same speed
-      as the original. The possibility to type a letter, a note or a report
-      with a simple light weight program on a Unix/Linux machine is clearly
-      missing. Ted was made to make it possible to edit rich text documents on
-      Unix/Linux in a wysiwyg way. RTF files from Ted are fully compatible with
-      MS-Word. Additionally, Ted also is an RTF to PostScript and an RTF to
-      Acrobat PDF converter.
-    '';
-    homepage = "https://ftp.nluug.nl/pub/editors/ted/";
-    license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ obadz ];
-  };
-}

pkgs/by-name/ty/typescript-go/package.nix

@@ -15,17 +15,17 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2026-06-07";
+  version = "0-unstable-2026-06-17";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "254e9a5331fe7e08a8303deecc45521f98e1e5f9";
-    hash = "sha256-a6G86TTxxjWWB3pVM1B5EdRcpwaFQW5RKoi+wWizMdY=";
+    rev = "2fb5d4ce13935aef1f3c2896fad76d0ab4d43604";
+    hash = "sha256-PkMX++B5qsHAib/VHc8QS0WAo9d/jXatlF6sUPymBN4=";
     fetchSubmodules = false;
   };
 
-  vendorHash = "sha256-9eu1850py6hn0m93ofJ3k7cjFcSaVxpaUStzAE/EtgA=";
+  vendorHash = "sha256-EDaok/vDi7r9L3HGiUN8+Xg39cACihHxBn3BQayDs2M=";
 
   ldflags = [
     "-s"

pkgs/by-name/vi/vimpc/package.nix

@@ -1,61 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  autoreconfHook,
-  libmpdclient,
-  ncurses,
-  pcre,
-  pkg-config,
-  taglib,
-  curl,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  version = "0.09.2";
-  pname = "vimpc";
-
-  src = fetchFromGitHub {
-    owner = "boysetsfrog";
-    repo = "vimpc";
-    rev = "v${finalAttrs.version}";
-    sha256 = "0lswzkap2nm7v5h7ppb6a64cb35rajysd09nb204rxgrkij4m6nx";
-  };
-
-  patches = [
-    # Pull fix pending upstream inclusion for ncurses-6.3:
-    #  https://github.com/boysetsfrog/vimpc/pull/100
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/boysetsfrog/vimpc/commit/055ecdce0720fdfc9ec2528c520b6c33da36271b.patch";
-      sha256 = "01p858jjxm0bf8hnk1z8h45j8c1y9i995mafa6ff3vg9vlak61pv";
-    })
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-  buildInputs = [
-    libmpdclient
-    ncurses
-    pcre
-    taglib
-    curl
-  ];
-
-  postInstall = ''
-    mkdir -p $out/etc
-    cp doc/vimpcrc.example $out/etc
-  '';
-
-  meta = {
-    description = "Vi/vim inspired client for the Music Player Daemon (mpd)";
-    homepage = "https://github.com/boysetsfrog/vimpc";
-    license = lib.licenses.gpl3;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ pSub ];
-    mainProgram = "vimpc";
-  };
-})

pkgs/by-name/vo/vopono/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vopono";
-  version = "0.10.16";
+  version = "0.10.18";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-mZ2PHN1dBW++MZ3APV6sbPgrltcjzTyZvxbvvrsveo4=";
+    hash = "sha256-qke5wYRpiqpV1dOZDApPZYYWWn2owokfa3ly+imhbzM=";
   };
 
-  cargoHash = "sha256-jC3iANsDXdit9gAPs5k+rbUUL/J+lH9H4JGiEigMKiw=";
+  cargoHash = "sha256-GxzEOdsHJUa3LQKvtR/ZmOnBPaHOSMk0Qwqx7fikr1U=";
 
   meta = {
     description = "Run applications through VPN connections in network namespaces";

pkgs/by-name/xj/xjadeo/package.nix

@@ -46,8 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
     freetype
     libGLU
     liblo
-    libxv
     portmidi
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libxv
   ];
 
   meta = {
@@ -60,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://xjadeo.sourceforge.net";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ mitchmindtree ];
   };
 })

pkgs/development/ocaml-modules/camlpdf/default.nix

@@ -4,17 +4,18 @@
   fetchFromGitHub,
   ocaml,
   findlib,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.9";
+  version = "2.9.1";
   pname = "ocaml${ocaml.version}-camlpdf";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "camlpdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8xBna7GDFbFf48069/ct71uFxLJU0eBfKVRWDnyYocs=";
+    hash = "sha256-f3Bm64T27eiIzOY2nwdzMRH68VlyNp2jXpOPyBouSCs=";
   };
 
   nativeBuildInputs = [
@@ -28,11 +29,15 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "OCaml library for reading, writing and modifying PDF files";
     homepage = "https://github.com/johnwhitington/camlpdf";
+    changelog = "https://github.com/johnwhitington/camlpdf/blob/${finalAttrs.src.rev}/Changes.txt";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ vbgl ];
+    teams = with lib.teams; [ ngi ];
     broken = lib.versionOlder ocaml.version "4.10";
   };
 })

pkgs/development/ocaml-modules/cpdf/default.nix

@@ -5,17 +5,18 @@
   ocaml,
   findlib,
   camlpdf,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-cpdf";
-  version = "2.9";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "cpdf-source";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6fGKFM9Q2YxW8FoyewGNTkF9XBtjdq0Bur6KgVi5T4=";
+    hash = "sha256-P3CQwYp23URVBDcdnrRAg7gAsOMIifwraIcFSJh8pd0=";
   };
 
   nativeBuildInputs = [
@@ -35,11 +36,15 @@ stdenv.mkDerivation (finalAttrs: {
     cp cpdfmanual.pdf $out/share/doc/cpdf/
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "PDF Command Line Tools";
     homepage = "https://www.coherentpdf.com/";
+    changelog = "https://github.com/johnwhitington/cpdf-source/blob/${finalAttrs.src.rev}/Changes.txt";
     license = lib.licenses.agpl3Only;
-    maintainers = [ lib.maintainers.vbgl ];
+    maintainers = with lib.maintainers; [ vbgl ];
+    teams = with lib.teams; [ ngi ];
     mainProgram = "cpdf";
     inherit (ocaml.meta) platforms;
     broken = lib.versionOlder ocaml.version "4.10";

pkgs/development/ocaml-modules/ocaml-version/default.nix

@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ocaml-version";
-  version = "4.1.0";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://github.com/ocurrent/ocaml-version/releases/download/v${finalAttrs.version}/ocaml-version-${finalAttrs.version}.tbz";
-    hash = "sha256-QTfVH6kNu4SkjAylM3ySyIkOYAXQFrffSFkZ2FojjgY=";
+    hash = "sha256-+NqijIAmedHTU9/5ZfZojwr0vQZ0onS6lBWIrnBqPAc=";
   };
 
   checkInputs = [ alcotest ];

pkgs/development/python-modules/comet-ml/default.nix

@@ -17,21 +17,24 @@
   setuptools,
   simplejson,
   urllib3,
+  versionCheckHook,
   wrapt,
   wurlitzer,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "comet-ml";
-  version = "3.55.0";
+  version = "3.58.1";
+  pyproject = true;
+  __structuredAttrs = true;
 
+  # No GitHub repository
   src = fetchPypi {
     pname = "comet_ml";
-    inherit version;
-    hash = "sha256-bNfh6tVpsU2LrSLcAKy5lXLgd4lbo3/6dzzMB4+Eh08=";
+    inherit (finalAttrs) version;
+    hash = "sha256-6DHmsd7CcFd1QU06G09CVMeVuHGAtn8Rxsr1++epdeU=";
   };
 
-  pyproject = true;
   build-system = [
     setuptools
   ];
@@ -62,6 +65,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "comet_ml" ];
 
+  nativeCheckInputs = [
+    versionCheckHook
+    # Skip pytestCheckHook, as Python tests require a lot of additional dependencies to run.
+  ];
+
   meta = {
     description = "Platform designed to help machine learning teams track, compare, explain, and optimize their models";
     homepage = "https://www.comet.com/site/";
@@ -70,4 +78,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ jherland ];
     mainProgram = "comet";
   };
-}
+})

pkgs/development/python-modules/executorch/default.nix

@@ -54,7 +54,7 @@
 }:
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "executorch";
-  version = "1.2.0";
+  version = "1.3.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -68,7 +68,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     name = "executorch";
 
     fetchSubmodules = true;
-    hash = "sha256-Rkw6+keOygQaf6iOCpGoW9JgXiCimgx8gsxLEH3bxME=";
+    hash = "sha256-UyMPY+qYTHYZDeftj4YVqzO2ibTswzd+HWW5JeXHW0Q=";
   };
 
   postPatch =
@@ -76,8 +76,8 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     ''
       substituteInPlace exir/_serialize/_flatbuffer.py \
         --replace-fail \
-          'flatc_path = "flatc"' \
-          'flatc_path = "${lib.getExe pkgs.flatbuffers}"'
+          '_flatc_cached_path = os.getenv("FLATC_EXECUTABLE", "flatc")' \
+          '_flatc_cached_path = os.getenv("FLATC_EXECUTABLE", "${lib.getExe pkgs.flatbuffers}")'
     ''
     # Relax build-system dependencies
     + ''
@@ -102,13 +102,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
       sed -i "1i #include <cstdint>" backends/apple/coreml/runtime/inmemoryfs/memory_buffer.hpp
       sed -i "1i #include <cstdint>" extension/llm/tokenizers/third-party/sentencepiece/src/sentencepiece_processor.h
-    ''
-    # AssertionError: '1.3.0' != '0.1.0'
-    + ''
-      substituteInPlace extension/llm/tokenizers/test/test_python_bindings.py \
-        --replace-fail \
-          'self.assertEqual(pytorch_tokenizers.__version__, "0.1.0")' \
-          'self.assertEqual(pytorch_tokenizers.__version__, "${pytorch-tokenizers.version}")'
     '';
 
   env = {

pkgs/development/python-modules/garminconnect/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "garminconnect";
-  version = "0.3.5";
+  version = "0.3.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     tag = finalAttrs.version;
-    hash = "sha256-ncQuZq9W94SGoxoLHhyuEW8qMOPqvCCTIi+56k7vOG8=";
+    hash = "sha256-2nhBLaITFZPzk6fWnS6VAllPxkFofTIU8M+2yLvQMdA=";
   };
 
   pythonRelaxDeps = [ "garth" ];

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606161";
+  version = "0.1.202606171";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B5xXUgF709FCmiLD8t0nNhDhCIid1IDW1cTgJ6UR7c0=";
+    hash = "sha256-/ObglIjoGPf96vD6BCweXvwHE7yvqSSdqZPSUmn5jwg=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/kafka-python-ng/default.nix

@@ -1,54 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools-scm,
-  crc32c,
-  lz4,
-  python-snappy,
-  zstandard,
-  botocore,
-  pytest-mock,
-  pytestCheckHook,
-  xxhash,
-}:
-
-buildPythonPackage rec {
-  version = "2.2.3";
-  pname = "kafka-python-ng";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "wbarnha";
-    repo = "kafka-python-ng";
-    tag = "v${version}";
-    hash = "sha256-a2RFiBRh3S2YQBekpwEK74ow8bGlgWCGqSf2vcgYPYk=";
-  };
-
-  build-system = [ setuptools-scm ];
-
-  optional-dependencies = {
-    crc32c = [ crc32c ];
-    lz4 = [ lz4 ];
-    snappy = [ python-snappy ];
-    zstd = [ zstandard ];
-    boto = [ botocore ];
-  };
-
-  pythonImportsCheck = [ "kafka" ];
-
-  nativeCheckInputs = [
-    pytest-mock
-    pytestCheckHook
-    xxhash
-  ]
-  ++ lib.concatAttrValues optional-dependencies;
-
-  meta = {
-    changelog = "https://github.com/wbarnha/kafka-python-ng/releases/tag/v${version}";
-    description = "Pure Python client for Apache Kafka";
-    homepage = "https://github.com/wbarnha/kafka-python-ng";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}

pkgs/development/python-modules/silero-vad/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  packaging,
+  torch,
+  torchaudio,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "silero-vad";
+  version = "6.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "snakers4";
+    repo = "silero-vad";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-peGaJkSqjeobgx479OKt8ErorFviTIA7naFPewgab4U=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    packaging
+    torch
+    torchaudio
+  ];
+
+  # tests use torchcodec which refuses to decode tests/data/test.mp3
+  # this causes all tests to fail. See https://github.com/snakers4/silero-vad/issues/777
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "silero_vad"
+  ];
+
+  meta = {
+    description = "Silero VAD: pre-trained enterprise-grade Voice Activity Detector";
+    changelog = "https://github.com/snakers4/silero-vad/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/snakers4/silero-vad";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ seudonym ];
+  };
+})

pkgs/development/python-modules/websockify/default.nix

@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   jwcrypto,
   numpy,
   pytestCheckHook,
@@ -11,19 +12,23 @@
   simplejson,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "websockify";
   version = "0.13.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "novnc";
     repo = "websockify";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-b57L4o071zEt/gX9ZVzEpcnp0RCeo3peZrby2mccJgQ=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     jwcrypto
     numpy
     redis
@@ -33,6 +38,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # this test failed on macos
     # https://github.com/novnc/websockify/issues/552
@@ -44,9 +51,9 @@ buildPythonPackage rec {
   meta = {
     description = "WebSockets support for any application/server";
     mainProgram = "websockify";
-    homepage = "https://github.com/kanaka/websockify";
-    changelog = "https://github.com/novnc/websockify/releases/tag/${src.tag}";
+    homepage = "https://github.com/novnc/websockify";
+    changelog = "https://github.com/novnc/websockify/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl3Only;
     maintainers = [ ];
   };
-}
+})

pkgs/development/rocq-modules/parseque/default.nix

@@ -18,12 +18,13 @@ mkRocqDerivation {
       [
         {
           cases = [ (lib.versions.range "9.0" "9.2") ];
-          out = "0.3.0";
+          out = "0.3.1";
         }
       ]
       null;
 
   release."0.3.0".sha256 = "sha256-W2eenv5Q421eVn2ubbninFmmdT875f3w/Zs7yGHUKP4=";
+  release."0.3.1".sha256 = "sha256-t7nHpHl6E3iXkhMO0A53URmKVpWENjf/VODVXjD9Y1A=";
 
   propagatedBuildInputs = [ stdlib ];
 

pkgs/top-level/aliases.nix

@@ -1808,7 +1808,6 @@ mapAliases {
   podofo_0_10 = warnAlias "'podofo_0_10' has been renamed to 'podofo0'" podofo0; # Added 2026-05-08
   podofo_1_0 = throw "'podofo_1_0' has been deprecated in favour of 'podofo'"; # Added 2026-05-08
   polipo = throw "'polipo' has been removed as it is unmaintained upstream"; # Added 2025-05-18
-  polonium = throw "'polonium' has been removed, as Plasma 5 has reached end of life."; # Added 2026-05-01
   polyml56 = throw "'polyml56' has been deprecated in favor of polyml"; # Added 2026-06-01
   polyml57 = throw "'polyml57' has been deprecated in favor of polyml"; # Added 2026-06-01
   polypane = throw "'polypane' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-25
@@ -2171,6 +2170,7 @@ mapAliases {
   teamspeak3 = throw "'teamspeak3' has been removed as it depended on qt5 webengine which is EOL"; # Added 2026-04-25
   teamspeak5_client = throw "'teamspeak5_client' has been renamed to/replaced by 'teamspeak6-client'"; # Converted to throw 2025-10-27
   teamspeak_client = throw "'teamspeak_client' has been renamed to/replaced by 'teamspeak3'"; # Converted to throw 2025-10-27
+  ted = throw "'ted' has been removed as it is unmaintained and depends on pcre, which is deprecated"; # Added 2026-06-17
   tegaki-zinnia-japanese = throw "'tegaki-zinnia-japanese' has been removed due to lack of maintenance"; # Added 2025-09-10
   telepathy-haze = throw "'telepathy-haze' has been removed due to being unmaintained and broken since 2023"; # Added 2025-11-04
   teleport_16 = throw "teleport 16 has been removed as it is EOL. Please upgrade to Teleport 17 or later"; # Added 2025-11-10
@@ -2289,6 +2289,7 @@ mapAliases {
   ViennaRNA = throw "'ViennaRNA' has been renamed to/replaced by 'viennarna'"; # Converted to throw 2025-10-27
   vim_configurable = throw "'vim_configurable' has been renamed to/replaced by 'vim-full'"; # Converted to throw 2025-10-27
   vimHugeX = throw "'vimHugeX' has been renamed to/replaced by 'vim-full'"; # Converted to throw 2025-10-27
+  vimpc = throw "'vimpc' has been removed as it is unmaintained and depends on pcre, which is deprecated"; # Added 2026-06-06
   virt-manager-qt = throw "'virt-manager-qt' has been dropped as it depends on KDE Gear 5, and is unmaintained"; # Added 2025-08-20
   virtkey = throw "'virtkey' has been removed, as it was unmaintained, abandoned upstream, and relied on gtk2."; # Added 2025-10-12
   vistafonts = throw "'vistafonts' has been renamed to/replaced by 'vista-fonts'"; # Converted to throw 2025-10-27

pkgs/top-level/python-aliases.nix

@@ -301,6 +301,7 @@ mapAliases {
   jupyter_core = throw "'jupyter_core' has been renamed to/replaced by 'jupyter-core'"; # Converted to throw 2025-10-29
   jupyter_server = throw "'jupyter_server' has been renamed to/replaced by 'jupyter-server'"; # Converted to throw 2025-10-29
   jupyterlab_server = throw "'jupyterlab_server' has been renamed to/replaced by 'jupyterlab-server'"; # Converted to throw 2025-10-29
+  kafka-python-ng = throw "'kafka-python-ng' has been replaced by 'kafka-python'"; # added 2026-06-13
   Kajiki = throw "'Kajiki' has been renamed to/replaced by 'kajiki'"; # Converted to throw 2025-10-29
   keepkey-agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11
   keepkey_agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11

pkgs/top-level/python-packages.nix

@@ -8344,8 +8344,6 @@ self: super: with self; {
 
   kafka-python = callPackage ../development/python-modules/kafka-python { };
 
-  kafka-python-ng = callPackage ../development/python-modules/kafka-python-ng { };
-
   kaggle = callPackage ../development/python-modules/kaggle { };
 
   kagglehub = callPackage ../development/python-modules/kagglehub { };
@@ -18053,6 +18051,8 @@ self: super: with self; {
 
   sigtools = callPackage ../development/python-modules/sigtools { };
 
+  silero-vad = callPackage ../development/python-modules/silero-vad { };
+
   silver-platter = callPackage ../development/python-modules/silver-platter { };
 
   simanneal = callPackage ../development/python-modules/simanneal { };