Merge staging-next into staging

2026-04-28 18:33:58 +00:00
parent c849780141 919b9224bd
commit ec47e24365
88 changed files with 4076 additions and 891 deletions
@@ -201,7 +201,7 @@ in
        in
        if builtins.length matches != 0 then
          { inherit path matches; }
-        else if path == /. then
+        else if toString path == "/" then
          null
        else
          go (dirOf path);
@@ -211,7 +211,7 @@ in
          base = baseNameOf file;
          type = (builtins.readDir parent).${base} or null;
        in
-        file == /. || type == "directory";
+        toString file == "/" || type == "directory";
    in
    go (if isDir then file else parent);

@@ -311,7 +311,13 @@ let
          fileName = path + "/${file}";
          packedRefsName = path + "/packed-refs";
          absolutePath =
-            base: path: if lib.hasPrefix "/" path then path else toString (/. + "${base}/${path}");
+            base: path:
+            if lib.hasPrefix "/" path then
+              path
+            else if lib.hasPrefix "/" base then
+              "${base}/${path}"
+            else
+              "/${base}/${path}";
        in
        if
          pathIsRegularFile path
@@ -7764,6 +7764,12 @@
    githubId = 411447;
    name = "Leo Gaspard";
  };
+  ekzyis = {
+    email = "ramdip.singhgill@gmail.com";
+    github = "ekzyis";
+    githubId = 27162016;
+    name = "Ramdip Gill";
+  };
  elasticdog = {
    email = "aaron@elasticdog.com";
    github = "elasticdog";
@@ -358,6 +358,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `switch-to-configuration` now reloads a service instead of restarting it when the only change to its unit is `ExecReload=`, and takes no action when `ExecReload=` is removed. Previously both cases triggered a restart.
+
 - [`hardware.nvidia.branch`](#opt-hardware.nvidia.branch) was added to select the NVIDIA driver branch; setting [`hardware.nvidia.package`](#opt-hardware.nvidia.package) overrides this.

 - The NixOS NVIDIA module wiring has been updated to match the new `nvidia-x11` output layout.
@@ -1309,6 +1309,7 @@
  ./services/networking/netbird.nix
  ./services/networking/netbird/server.nix
  ./services/networking/netclient.nix
+  ./services/networking/netfoil.nix
  ./services/networking/networkd-dispatcher.nix
  ./services/networking/networkmanager.nix
  ./services/networking/newt.nix
@@ -5,9 +5,9 @@
  ...
 }:
 let
-  inherit (builtins) isList elem;
+  inherit (builtins) isList;
  inherit (lib)
-    getExe
+    concatMapStrings
    literalExpression
    maintainers
    mapAttrs'
@@ -36,33 +36,6 @@ let
      boolToString value
    else
      toString value;
-
-  initScript =
-    {
-      program,
-      shell,
-      flags ? [ ],
-    }:
-    if (shell != "fish") then
-      ''
-        eval "$(${getExe program} ${toString flags})"
-      ''
-    else
-      ''
-        ${getExe program} ${toString flags} | source
-      '';
-
-  shellInit =
-    shell:
-    optionalString (elem pkgs.bat-extras.batpipe cfg.extraPackages) (initScript {
-      program = pkgs.bat-extras.batpipe;
-      inherit shell;
-    })
-    + optionalString (elem pkgs.bat-extras.batman cfg.extraPackages) (initScript {
-      program = pkgs.bat-extras.batman;
-      inherit shell;
-      flags = [ "--export-env" ];
-    });
 in
 {
  options.programs.bat = {
@@ -112,17 +85,21 @@ in
      );
    };

-    programs = {
-      bash = mkIf (!config.programs.fish.enable) {
-        interactiveShellInit = shellInit "bash";
+    programs =
+      let
+        shellInit = shell: concatMapStrings (pkg: pkg.shellInit shell) cfg.extraPackages;
+      in
+      {
+        bash = mkIf (!config.programs.fish.enable) {
+          interactiveShellInit = shellInit "bash";
+        };
+        fish = mkIf config.programs.fish.enable {
+          interactiveShellInit = shellInit "fish";
+        };
+        zsh = mkIf (!config.programs.fish.enable && config.programs.zsh.enable) {
+          interactiveShellInit = shellInit "zsh";
+        };
      };
-      fish = mkIf config.programs.fish.enable {
-        interactiveShellInit = shellInit "fish";
-      };
-      zsh = mkIf (!config.programs.fish.enable && config.programs.zsh.enable) {
-        interactiveShellInit = shellInit "zsh";
-      };
-    };
  };
  meta.maintainers = with maintainers; [ sigmasquadron ];
 }
@@ -199,16 +199,16 @@ in
            ''
          else
            indentFishFile "nixos-env-preinit.fish" ''
-              # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
-              # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
-              set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d $__fish_datadir/functions
+              # This happens before embedded:config.fish sets fish_function_path, so it is currently
+              # unset. We set it and then completely erase it, leaving its configuration to embedded:config.fish
+              set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d

              # source the NixOS environment config
              if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]
                fenv source ${config.system.build.setEnvironment}
              end

-              # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish
+              # clear fish_function_path so that it will be correctly set when we return to embedded:config.fish
              set -e fish_function_path
            '';
      }
@@ -301,11 +301,18 @@ in
                    find -L $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
                  fi
                '';
+            packages =
+              if config.documentation.nixos.enable && config.documentation.man.enable then
+                builtins.filter (pkg: pkg != config.system.build.manual.nixos-configuration-reference-manpage) (
+                  cfge.systemPackages ++ cfg.extraCompletionPackages
+                )
+              else
+                cfge.systemPackages ++ cfg.extraCompletionPackages;
          in
          pkgs.buildEnv {
            name = "system_fish-completions";
            ignoreCollisions = true;
-            paths = map generateCompletions (config.environment.systemPackages ++ cfg.extraCompletionPackages);
+            paths = map generateCompletions packages;
          };
      })

@@ -0,0 +1,263 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.netfoil;
+in
+{
+  options = {
+    services.netfoil = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Enable Netfoil, a minimal, filtering, DNS proxy";
+      };
+      listen = {
+        port = lib.mkOption {
+          type = lib.types.int;
+          default = 53;
+          description = "Port on which Netfoil listens for incoming connections";
+        };
+        ipAddress = lib.mkOption {
+          type = lib.types.str;
+          default = "127.0.0.1";
+          description = "IP address on which Netfoil listens for incoming connections";
+        };
+      };
+      logAllowed = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Log allowed DNS queries";
+      };
+      doHUrl = lib.mkOption {
+        type = lib.types.str;
+        default = "https://security.cloudflare-dns.com/dns-query";
+        description = "The DoH URL to use for upstream DNS queries";
+      };
+      doHIPs = lib.mkOption {
+        type = lib.types.str;
+        default = "1.1.1.2,1.0.0.2";
+        description = "The DoH IPs to use for upstream DNS queries";
+      };
+      logDenied = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Log denied DNS queries";
+      };
+      config = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        description = "Additional configuration options for Netfoil";
+      };
+      rules = {
+        allow = {
+          exact = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of exact domain names to allow";
+          };
+          ipv4 = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of ipv4 CIDR ranges to allow";
+          };
+          ipv6 = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of ipv6 CIDR ranges to allow";
+          };
+          tld = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of TLDs to allow";
+          };
+        };
+        deny = {
+          exact = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of exact domain names to deny";
+          };
+          ipv4 = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of ipv4 CIDR ranges to deny";
+          };
+          ipv6 = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of ipv6 CIDR ranges to deny";
+          };
+          tld = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of TLDs to deny";
+          };
+        };
+        known = {
+          knownTlds = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              ".com"
+              ".net"
+              ".org"
+              ".edu"
+              ".gov"
+              ".mil"
+              ".int"
+            ];
+            description = "List of known TLDs";
+          };
+        };
+        pin = {
+          a = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of A records to pin <domain:ipv4>";
+          };
+          responseDomain = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of domains to pin <domain:domain>";
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      configFile = lib.concatStringsSep "\n" (
+        [
+          "LogAllowed=${lib.boolToString cfg.logAllowed}"
+          "LogDenied=${lib.boolToString cfg.logDenied}"
+          "DoHURL=${cfg.doHUrl}"
+          "DoHIPs=${cfg.doHIPs}"
+        ]
+        ++ (map (key: "${key} = \"${cfg.config.${key}}\"") (lib.attrNames cfg.config))
+        ++ lib.optional ((lib.length cfg.rules.pin.responseDomain) != 0) "PinResponseDomain=true"
+      );
+      configDir = pkgs.buildEnv {
+        name = "netfoil-config";
+        paths = [
+          (pkgs.writeTextDir "config" configFile)
+          (pkgs.writeTextDir "allow.exact" (lib.concatStringsSep "\n" cfg.rules.allow.exact))
+          (pkgs.writeTextDir "allow.ipv4" (lib.concatStringsSep "\n" cfg.rules.allow.ipv4))
+          (pkgs.writeTextDir "allow.ipv6" (lib.concatStringsSep "\n" cfg.rules.allow.ipv6))
+          (pkgs.writeTextDir "allow.suffix" (lib.concatStringsSep "\n" cfg.rules.allow.tld))
+          (pkgs.writeTextDir "allow.tld" (lib.concatStringsSep "\n" cfg.rules.allow.tld))
+          (pkgs.writeTextDir "deny.exact" (lib.concatStringsSep "\n" cfg.rules.deny.exact))
+          (pkgs.writeTextDir "deny.ipv4" (lib.concatStringsSep "\n" cfg.rules.deny.ipv4))
+          (pkgs.writeTextDir "deny.ipv6" (lib.concatStringsSep "\n" cfg.rules.deny.ipv6))
+          (pkgs.writeTextDir "deny.suffix" (lib.concatStringsSep "\n" cfg.rules.deny.tld))
+          (pkgs.writeTextDir "deny.tld" (lib.concatStringsSep "\n" cfg.rules.deny.tld))
+          (pkgs.writeTextDir "known.tld" (lib.concatStringsSep "\n" cfg.rules.known.knownTlds))
+          (pkgs.writeTextDir "pin.a" (lib.concatStringsSep "\n" cfg.rules.pin.a))
+          (pkgs.writeTextDir "pin.response-domain" (lib.concatStringsSep "\n" cfg.rules.pin.responseDomain))
+        ];
+      };
+    in
+    {
+      systemd = {
+        services.netfoil = {
+          enable = true;
+          description = "Netfoil DNS proxy";
+          after = [ "network.target" ];
+          requires = [ "netfoil.socket" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${pkgs.netfoil}/bin/netfoil --config-directory ${configDir}";
+            Restart = "always";
+            RestartSec = "5";
+            DynamicUser = true;
+            BindReadOnlyPaths = [
+              "${pkgs.netfoil}"
+              "${configDir}"
+              "/etc/ssl"
+              builtins.storeDir
+            ];
+            Slice = "netfoil.slice";
+            AmbientCapabilities = "";
+            CapabilityBoundingSet = [ ];
+            SystenCallArchitectures = "native";
+            SystemCallFilter = [
+              "@basic-io"
+              "@file-system"
+              "@network-io"
+              "@signal"
+              "@process"
+              "@io-event"
+              "@system-service"
+              "@resources"
+            ];
+            RuntimeDirectory = "netfoil";
+            RuntimeDirectoryMode = "0755";
+            RootDirectory = "/run/netfoil";
+            RestrictAddressFamilies = "AF_INET AF_INET6";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+
+            # This might set AllowDevices=char-rtc r
+            ProtectClock = true;
+
+            ProtectKernelModules = true;
+            ProtectKernelLogs = true;
+
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+
+            RemoveIPC = true;
+            UMask = "0077";
+
+            # IPC namespace
+            PrivateIPC = true;
+
+            # UTS namespace
+            ProtectHostname = true;
+
+            # Changes mounts (custom is more strict)
+            # https://github.com/systemd/systemd/blob/main/src/core/namespace.c
+            #
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectProc = "invisible";
+            ProcSubset = "pid";
+            ProtectSystem = "strict";
+            PrivateTmp = true;
+
+            #
+            # seccomp _sysctl (custom filter does not allow it anyway)
+            # /proc and /sys mounts (custom is more strict)
+            ProtectKernelTunables = true;
+            #
+            # seccomp @raw-io (custom filter does not allow it anyway)
+            PrivateDevices = true;
+            DevicePolicy = "closed";
+
+            SocketBindDeny = "any";
+
+            CPUQuota = "50%";
+            MemoryMax = "100M";
+            TasksMax = "100";
+          };
+        };
+        slices.netfoil = {
+          description = "Slice for Netfoil DNS proxy";
+        };
+        sockets.netfoil = {
+          description = "Netfoil DNS proxy socket";
+          wantedBy = [ "sockets.target" ];
+          socketConfig = {
+            ListenDatagram = "${cfg.listen.ipAddress}:${toString cfg.listen.port}";
+            Service = "netfoil.service";
+          };
+        };
+      };
+    }
+  );
+}
@@ -1068,6 +1068,7 @@ in
  netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
  netbox_4_5 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_5; };
  netdata = runTest ./netdata.nix;
+  netfoil = runTest ./netfoil.nix;
  networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
  networking.networkmanager = handleTest ./networking/networkmanager.nix { };
  networking.scripted = handleTest ./networking/networkd-and-scripted.nix { networkd = false; };
@@ -0,0 +1,28 @@
+{ lib, ... }:
+{
+  name = "netfoil";
+  meta.maintainers = with lib.maintainers; [
+    marcusramberg
+    sgo
+  ];
+
+  nodes = {
+    one =
+      { config, ... }:
+      {
+        services.netfoil = {
+          enable = true;
+          listen.port = 6353;
+        };
+      };
+  };
+  interactive.sshBackdoor.enable = true;
+
+  testScript = ''
+    start_all()
+
+    with subtest("ensure netfoil starts and listens on 6353"):
+        one.wait_for_unit("netfoil.service")
+        one.wait_for_open_port(6353)
+  '';
+}
@@ -45,7 +45,8 @@
    machine.wait_for_unit("default.target")

    machine.succeed("expect-bash")
-    machine.succeed("expect-fish")
+    # FIXME: Fish test fails to display Starship while inside the test environment; works on real systems.
+    # machine.succeed("expect-fish")
    machine.succeed("expect-zsh")
  '';
 }
@@ -0,0 +1,69 @@
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
+  nix-update-script,
+  stdenv,
+  zig_0_15,
+  emacs,
+}:
+
+let
+  zig = zig_0_15;
+
+  pname = "ghostel";
+
+  version = "0.18.1-unstable-2026-04-24";
+
+  src = fetchFromGitHub {
+    owner = "dakra";
+    repo = "ghostel";
+    rev = "fdfb68f70ca6f43277ef8a0ba4103631857e4ad4";
+    hash = "sha256-u3zUj5uUHqFEP7mjmADNB6n6n/LmGR6ne0ylalop8WI=";
+  };
+
+  module = stdenv.mkDerivation (finalAttrs: {
+    inherit pname version src;
+
+    deps = zig.fetchDeps {
+      inherit (finalAttrs) src pname version;
+      fetchAll = true;
+      hash = "sha256-ghN/UMACgkFQQEr4nH5gbbJbt/+2bz6tL2bJpbw9mGE=";
+    };
+
+    nativeBuildInputs = [ zig ];
+
+    env.EMACS_INCLUDE_DIR = "${emacs}/include";
+
+    postConfigure = ''
+      cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
+      chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
+    '';
+  });
+
+  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
+in
+melpaBuild {
+  inherit pname version src;
+
+  files = ''
+    (:defaults "etc" "ghostel-module${libExt}")
+  '';
+
+  preBuild = ''
+    install ${module}/lib/libghostel-module${libExt} ghostel-module${libExt}
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { extraArgs = [ "--version=branch=main" ]; };
+
+    inherit module;
+  };
+
+  meta = {
+    homepage = "https://github.com/dakra/ghostel";
+    description = "Terminal emulator powered by libghostty";
+    maintainers = with lib.maintainers; [ vonfry ];
+    license = lib.licenses.gpl3Plus;
+  };
+}
@@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "150.0";
+  version = "150.0.1";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "77e8eae86e7b17c33933fdea6d3b5fbe73e6613949e62c13d9ed3e593e7ba0b50701fa97fc7d56a278961d2e1cdb2902244c30a1020790091b0ae2f0cb1b4e71";
+    sha512 = "b3710e1b35002312bf248e822681039b75ec1196f8d014c88b0377c9b06f34780469152a98ad967440a51a4a0ca45418ba6239438f869ae564cc82c023645179";
  };

  meta = {
@@ -16,6 +16,9 @@
 }:

 let
+  getOptionalAttrs =
+    names: attrs: lib.getAttrs (lib.intersectLists names (lib.attrNames attrs)) attrs;
+
  interpolateString =
    s:
    if lib.isList s then
@@ -39,16 +42,9 @@ lib.extendMkDerivation {
  extendDrvArgs =
    finalAttrs:
    {
-      name ? "${args.pname}-${args.version}",
-
      # Name for the vendored dependencies tarball
-      cargoDepsName ? name,
+      cargoDepsName ? null,

-      src ? null,
-      srcs ? null,
-      preUnpack ? null,
-      unpackPhase ? null,
-      postUnpack ? null,
      cargoPatches ? [ ],
      patches ? [ ],
      sourceRoot ? null,
@@ -115,17 +111,20 @@ lib.extendMkDerivation {
          throw "cargoHash, cargoVendorDir, cargoDeps, or cargoLock must be set"
        else
          fetchCargoVendor (
-            {
-              inherit
-                src
-                srcs
-                sourceRoot
-                cargoRoot
-                preUnpack
-                unpackPhase
-                postUnpack
-                ;
-              name = cargoDepsName;
+            getOptionalAttrs [
+              "name"
+              "pname"
+              "version"
+              "src"
+              "srcs"
+              "sourceRoot"
+              "cargoRoot"
+              "preUnpack"
+              "unpackPhase"
+              "postUnpack"
+            ] finalAttrs
+            // {
+              ${if cargoDepsName != null then "name" else null} = cargoDepsName;
              patches = cargoPatches;
              hash = args.cargoHash;
            }
@@ -1,28 +1,28 @@
 {
  "stable": {
    "linux": {
-      "version": "8.12.8",
+      "version": "8.12.12",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.8.x64.tar.gz",
-          "hash": "sha256-WMApavYGR4TX1/gx8yjzaI0SHf1CEC+Ay9nAyxCOLs0="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.12.x64.tar.gz",
+          "hash": "sha256-tdhuBJeCXbepDN6Z9Yqs6gE5lMUh72sOJuQSv4Qoj1M="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.8.arm64.tar.gz",
-          "hash": "sha256-Uqt44otc40/v7/f90r2BS0yK1TuctOO0VUcWGhjv0pI="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.12.arm64.tar.gz",
+          "hash": "sha256-RNwZOqr29aLgNJYH/66TFEKCK3AVBhk+qnSax+Y7Dl4="
        }
      }
    },
    "darwin": {
-      "version": "8.12.8",
+      "version": "8.12.12",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.8-x86_64.zip",
-          "hash": "sha256-w4gfs8Ctpe73TNaXebwUoa0cEOuZfiBUWN+qngSNcj4="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.12-x86_64.zip",
+          "hash": "sha256-6vVMkra7T4kVRrVn8QexBMRkHDrUoZXP/eALyBPYPow="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.8-aarch64.zip",
-          "hash": "sha256-tT7VG6KlIv4Q+UtG9pzkyBRnISzvAdrqOeO8zdlZPb4="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.12-aarch64.zip",
+          "hash": "sha256-IqMw4dgMhHkzjMVbmZy/h3li74JZxbY8D4COeMEg+1o="
        }
      }
    }
@@ -39,13 +39,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "art";
-  version = "1.26.3";
+  version = "1.26.4";

  src = fetchFromGitHub {
    owner = "artpixls";
    repo = "ART";
    tag = finalAttrs.version;
-    hash = "sha256-cBhM8vYQoEGntM4GjFaNNC5fuBQxcX343qEcrdMxuSE=";
+    hash = "sha256-T7ri0fQz3OBLmr3BBQvYgSmAQaV/aMax6SOupAQDg5o=";
  };

  # Fix the build with CMake 4.
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
  pname = "balena-cli";
-  version = "24.1.3";
+  version = "24.1.4";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-omx6nGHoo0yfmSTe4ikVQZ4zWU0drDzuM3gEKZo4G+k=";
+    hash = "sha256-NFZoJVhixD67dqLq0tVB2GtMHl0n6qngw1uj/Qqxz8w=";
  };

-  npmDepsHash = "sha256-sCQgzXUuJtM5CfHb2czvdn7ZoyME3dWz96wmvJopsCk=";
+  npmDepsHash = "sha256-yGPn9sJ5dsNIvrofqL1/F9E3T/vhI04RmZEQwjsHQa0=";

  makeCacheWritable = true;

@@ -19,14 +19,14 @@
 stdenv.mkDerivation (finalAttrs: {
  pname = "castget";
  # Using unstable version since it doesn't require `ronn`, see:
-  # https://github.com/mlj/castget/commit/e97b179227b4fc7e2e2bc5a373933624c0467daa
-  version = "2.0.1-unstable-2025-01-25";
+  # https://github.com/mlj/castget/commit/218734296e2efc53071e0dbd3c4d59930b571aae
+  version = "2.0.1-unstable-2026-02-04";

  src = fetchFromGitHub {
    owner = "mlj";
    repo = "castget";
-    rev = "e97b179227b4fc7e2e2bc5a373933624c0467daa";
-    hash = "sha256-3t/N8JO36wjHuzIdWNstRWphC/ZR6KkZX0l9yKarS7c=";
+    rev = "218734296e2efc53071e0dbd3c4d59930b571aae";
+    hash = "sha256-GEfsGOTBkorPWLGP3eNbuiGFwDUgb4Gu6ykyS3/RNOg=";
  };

  # without this, the build fails because of an encoding issue with the manual page.
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
      primarily intended for automatic, unattended downloading of podcasts.
    '';
    homepage = "https://castget.johndal.com/";
-    changelog = "https://github.com/mlj/castget/blob/${finalAttrs.version}/CHANGES.md";
+    changelog = "https://github.com/mlj/castget/blob/${finalAttrs.src.rev}/CHANGES.md";
    maintainers = with lib.maintainers; [ doronbehar ];
    license = lib.licenses.gpl2;
    platforms = lib.platforms.linux;
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
  pname = "clever-tools";

-  version = "4.8.0";
+  version = "4.9.0";

  nodejs = nodejs_22;

@@ -19,10 +19,10 @@ buildNpmPackage rec {
    owner = "CleverCloud";
    repo = "clever-tools";
    rev = version;
-    hash = "sha256-ei5wwx9rUfKe6hGbHuNU65kGo5quvTtRKb6sHjkEzQE=";
+    hash = "sha256-O/Uz+eG8FT3nsXGRqcRdREXNaGlTpyVgUBmNsH7tLJA=";
  };

-  npmDepsHash = "sha256-3gmDTBi0WpmtN+qTQXDvuXGkw0g/wdxuruMdyD4UMIc=";
+  npmDepsHash = "sha256-aps8j9Vx1LZQAWHuWmnAusCJfAuzREM+GyKdybw+Hcc=";

  nativeBuildInputs = [
    installShellFiles
@@ -159,6 +159,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    runHook postInstall
  '';

+  requiredSystemFeatures = [ "big-parallel" ];
+
  meta = {
    description = "Rust bindings for the V8 JavaScript engine";
    homepage = "https://github.com/denoland/rusty_v8";
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
  stdenvNoCC.mkDerivation
  {
    inherit pname;
-    version = "0-unstable-2026-04-17";
+    version = "0-unstable-2026-04-27";

    src = fetchFromGitLab {
      owner = "aiyahm";
      repo = "FairyWren-Icons";
-      rev = "c55f846436b13fcc0c5ee745eead9bf8e3bcb0bf";
-      hash = "sha256-ESh/3PNprmD0ecSoH9JVw1r0VsWoQDw4ujpmSaoyhoM=";
+      rev = "480e57a9ee90f8de05189f92dc5651fced9bc913";
+      hash = "sha256-1iz7Sv4XjoFcpo7XqB5iRHmki0hPE0kqqkH+ATVTPpY=";
    };

    propagatedBuildInputs = [
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Tails and ships log files";
    homepage = "https://github.com/elastic/beats";
-    changelog = "https://www.elastic.co/guide/en/beats/libbeat/${finalAttrs.version}/release-notes-${finalAttrs.version}.html";
+    changelog = "https://www.elastic.co/guide/en/beats/libbeat/${lib.versions.majorMinor finalAttrs.version}/release-notes-${finalAttrs.version}.html";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ srhb ];
    mainProgram = "filebeat";
@@ -105,11 +105,10 @@ let

    test -n "$NIX_PROFILES"
    and begin
-      # We ensure that __extra_* variables are read in $__fish_datadir/config.fish
-      # with a preference for user-configured data by making sure the package-specific
-      # data comes last. Files are loaded/sourced in encounter order, duplicate
-      # basenames get skipped, so we assure this by prepending Nix profile paths
-      # (ordered in reverse of the $NIX_PROFILE variable)
+      # We ensure that __extra_* variables are read in embedded:config.fish with a preference for
+      # user-configured data by making sure the package-specific data comes last. Files are
+      # loaded/sourced in encounter order, duplicate basenames get skipped, so we assure this by
+      # prepending Nix profile paths (ordered in reverse of the $NIX_PROFILE variable)
      #
      # Note that at this point in evaluation, there is nothing whatsoever on the
      # fish_function_path. That means we don't have most fish builtins, e.g., `eval`.
@@ -135,12 +134,12 @@ let
  # `begin; begin; …; end; end` but that's ok.
  sourceWithFenv = path: ''
    begin # fenv
-      # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
-      # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
-      set fish_function_path ${fishPlugins.foreign-env}/share/fish/vendor_functions.d $__fish_datadir/functions
+      # This happens before embedded:config.fish sets fish_function_path, so it is currently unset.
+      # We set it and then completely erase it, leaving its configuration to embedded:config.fish
+      set fish_function_path ${fishPlugins.foreign-env}/share/fish/vendor_functions.d
      fenv source ${lib.escapeShellArg path}
      set -l fenv_status $status
-      # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish
+      # clear fish_function_path so that it will be correctly set when we return to embedded:config.fish
      set -e fish_function_path
      test $fenv_status -eq 0
    end # fenv
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
-    changelog = "https://blog.floorp.app/en/release/${finalAttrs.version}.html";
+    changelog = "https://blog.floorp.app/en/release/${finalAttrs.version}/";
    description = "Fork of Firefox that seeks balance between versatility, privacy and web openness";
    homepage = "https://floorp.app/";
    # https://github.com/Floorp-Projects/Floorp#-floorp-license-notices-
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  meta = {
    description = "CLI read-only interface for Mozilla Firefox's bookmarks";
    homepage = "https://github.com/zer0-x/foxmarks";
-    changelog = "https://github.com/zer0-x/foxmarks/blobl/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/zer0-x/foxmarks/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [ loicreynier ];
  };
@@ -83,13 +83,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdal" + lib.optionalString useMinimalFeatures "-minimal";
-  version = "3.12.3";
+  version = "3.12.4";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "gdal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tGyZB0e2DNyi3OpiOb1Mk8R8SdQRwhxCy8fOQrauVso=";
+    hash = "sha256-sD/ZAOvMWK2+AGw6wgziDsheH+hwUwhd7i2f65cjFKg=";
  };

  nativeBuildInputs = [
@@ -10,13 +10,13 @@

 stdenv.mkDerivation {
  pname = "highscore-mgba";
-  version = "0-unstable-2026-02-03";
+  version = "0-unstable-2026-04-26";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "mgba";
-    rev = "178d7dbe3c2927f2fc52a6032bc7b6c805192e9b";
-    hash = "sha256-AXOe2YoYQDeRpicYD9B9BR2l0rCJ+syYTwTnJUIcG1U=";
+    rev = "4a1ca6566fc1c0a67341ddadfc18011aa0a0578f";
+    hash = "sha256-zcRynN01O6zAcOuV/q9u7kL5elFTDJ2tA3wTJR3JBt0=";
  };

  outputs = [
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "highscore-nestopia";
-  version = "0-unstable-2025-12-30";
+  version = "0-unstable-2026-03-03";

  src = fetchFromGitLab {
    owner = "highscore-emu";
    repo = "nestopia";
-    rev = "529e69b6e577f42a246c8fa44ef7f3095647adaf";
-    hash = "sha256-2aBEtut6AShP1Nz0BqNTFD3/gN2cj5PY8JL8WbLE7XE=";
+    rev = "0ef62709df9ff3af8729c9d7dc257d8fbc2cd48c";
+    hash = "sha256-DRA1l5wV/jZhbFni5ZXD6agObt+XZYrPIbgkzSgUGEo=";
  };

  sourceRoot = "${finalAttrs.src.name}/highscore";
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "highscore-sameboy";
-  version = "0-unstable-2026-02-17";
+  version = "0-unstable-2026-04-01";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "SameBoy";
-    rev = "aae1571db7de438638d4180dc451b1b348d5a135";
-    hash = "sha256-PZNWzN/C6QPTgNLIsN55cE/3DyfcUdUknAUjxZ7sJvA=";
+    rev = "f59693cc4f1f3ac547eaf25856574fb850c1da61";
+    hash = "sha256-GzBTB3lqWi+Cw24fFVN9YBa3ecOA5G9756RWM6mMxvA=";
  };

  sourceRoot = "${finalAttrs.src.name}/highscore";
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "highscore-stella";
-  version = "0-unstable-2026-01-27";
+  version = "0-unstable-2026-04-02";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "stella";
-    rev = "689e4325099fbc348a92be40237d94bba692aff4";
-    hash = "sha256-7+/qgWUiL/dzacuFmbQiAOO+R71rFas+Tf0kpZHOjgY=";
+    rev = "d4e5a1f26fd62766e2ff9eb070f59efa89d68ed6";
+    hash = "sha256-/TbINGmvsDFxTwdaewg1Hv/fDQMk4ELz6j1TDLaffUQ=";
  };

  sourceRoot = "${finalAttrs.src.name}/src/os/highscore";
@@ -13,14 +13,14 @@

 stdenv.mkDerivation {
  pname = "libhighscore";
-  version = "0-unstable-2026-01-30";
+  version = "0-unstable-2026-04-01";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "alicem";
    repo = "libhighscore";
-    rev = "81366c670b777a6943dbdd955b9e867c8da247e7";
-    hash = "sha256-z+gMU9IA0F9alrhXNf5e+0/J87ChwVyCn26iA+ythBE=";
+    rev = "a2fcebc004be977f45ecbe40e94a85d0c1690f43";
+    hash = "sha256-npJDapediUTpDgevwfsEskEWSObPD/0ERFL0JWzAvM0=";
  };

  nativeBuildInputs = [
@@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  stdenvNoCC,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation {
@@ -15,13 +16,7 @@ stdenvNoCC.mkDerivation {
    hash = "sha256-EjXcLjzVQeOJgLxGua8t0oMc+APOsONGGpG6VJVCgFw=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "Digital version of Frederic Goudy’s Deepdene";
@@ -23,14 +23,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mojoshader";
-  version = "0-unstable-2026-02-10";
+  version = "0-unstable-2026-04-28";

  src = fetchFromGitHub {
    owner = "icculus";
    repo = "mojoshader";
-    rev = "abdc80360c1d4560ab8f356035dcd53ae6e9b87f";
+    rev = "6333f74dbd5644789a63e903816441b16c1e8b60";
    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
-    hash = "sha256-NWXJfi12zLDDg8jvC+G/Dxf2CZPWtSjYFSo/6EV6qxY=";
+    hash = "sha256-32gRoYFGzQksOccpM9qvhd4Q6PyyH3EpQ2rcOI7qfp4=";
  };

  buildInputs = [ SDL2 ];
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "mongo-tools";
-  version = "100.16.0";
+  version = "100.16.1";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongo-tools";
    tag = finalAttrs.version;
-    hash = "sha256-r5oqgHs5aFeuKTGPy/+DPdJbc70S53frBh0ffMBiEFs=";
+    hash = "sha256-oxMc0+Il6pY0L8KF0h5+DYpBuqQvPzaOcZ8cjQDig0c=";
  };

  vendorHash = null;
@@ -97,7 +97,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.10";
+  version = "15.0.11";

  sources = {
    x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-1XUWPS7GZ+V9iHRGuNGpFxCP0IKPdMIUt3rLLsD4yQ8=";
+      hash = "sha256-+skGid5BYrptv3aHLPogxew28DNFArV6kEDhCTxD2Ic=";
    };
  };

@@ -6,15 +6,15 @@

 buildGoModule (finalAttrs: {
  pname = "netassert";
-  version = "2.1.0";
+  version = "2.1.4";

  src = fetchFromGitHub {
    owner = "controlplaneio";
    repo = "netassert";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9uzidE/b+7UWNMAknxTdeWYKLEjWbV0V9hab18w+E10=";
+    hash = "sha256-swnTJwsWsTROO6E9LFNP9L9SbdT99yZpfNWPb8CVcBk=";
  };
-  vendorHash = "sha256-JuyE1pYlTIeG3IGOsvYgQN1lTAb7NWytkp/Ibh91QgA=";
+  vendorHash = "sha256-AmYhpc80jlJBhQbN+DUE9U8Oj550Vg+QS4Rci8KLMCk=";

  ldflags = [
    "-s"
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "netfoil";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "tinfoil-factory";
+    repo = "netfoil";
+    tag = "v${version}";
+    hash = "sha256-1JpnVaU17uxQu0O8R0kfl7lCE3YMd/XFmbq9KUMAKqY=";
+  };
+
+  __structuredAttrs = true;
+
+  env.CGO_ENABLED = 0;
+
+  proxyVendor = true;
+
+  vendorHash = "sha256-xtc1zCSLuez9POx/jEjre0uVmvWvCW0TpXPFVi2p+CY=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Minimal, filtering, DNS proxy";
+    homepage = "https://github.com/tinfoil-factory/netfoil";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      sgo
+      marcusramberg
+    ];
+    mainProgram = "netfoil";
+  };
+}
@@ -84,6 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  # --run is used instead of --set to avoid makeWrapper's single-quote escaping,
+  # which prevents $USER from expanding at runtime. See #192396
  postFixup = ''
    wrapProgram $out/bin/nextflow \
      --prefix PATH : ${
@@ -96,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
        ]
      } \
      --set JAVA_HOME ${openjdk.home} \
-      --set NXF_OPTS "-Duser.name=\''${USER}"
+      --run 'export NXF_OPTS="-Duser.name=''$USER''${NXF_OPTS:+ ''$NXF_OPTS}"'
  '';

  passthru.tests.default = nixosTests.nextflow;
@@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nfs-ganesha";
-  version = "9.11";
+  version = "9.13";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "nfs-ganesha";
    repo = "nfs-ganesha";
    tag = "V${finalAttrs.version}";
-    hash = "sha256-5nDYJXOaceghkaTqRjy6DPsbmnyOOiANo3EMrnOgKsY=";
+    hash = "sha256-e6BDxb4Dt8xp9KdOcjxZKzRiKYPe+GP1UPvK/DAdX6M=";
  };

  patches = lib.optional useDbus ./allow-bypassing-dbus-pkg-config-test.patch;
@@ -14,16 +14,16 @@ assert

 buildGoModule (finalAttrs: {
  pname = "opa-envoy-plugin";
-  version = "1.13.2-envoy-2";
+  version = "1.15.2-envoy";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
    repo = "opa-envoy-plugin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2NztAdUcslKzr+OIMWWLJx76Fw0CNP1nw6056Xs6SVo=";
+    hash = "sha256-PUtiM72ENAJtCQeX0YnDuWCrQT/y7s4683AxvX/VsIs=";
  };

-  vendorHash = "sha256-3NV5YNwfZgcL+VYXBDWwtb+/0bwCgLRxE3XmLGA2Nkw=";
+  vendorHash = "sha256-zkEgvAD8HaObrbq8OZgx/HLLdv+r4b1Za+R4fYl4h3A=";

  nativeBuildInputs = [ installShellFiles ];

@@ -13,13 +13,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "openspec";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "Fission-AI";
    repo = "OpenSpec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yLzndbXdPoIv7xWHd23FOtMlPmWWz3+H7WODWQYylJc=";
+    hash = "sha256-L4LBHVVtgMhSJm+IzZSYOR0UXPbvIRg4xiEV5urYxdI=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -11,14 +11,14 @@
 let
  finalAttrs = {
    pname = "phylophlan";
-    version = "3.1.1";
+    version = "3.2.1";
    pyproject = true;

    src = fetchFromGitHub {
      owner = "biobakery";
      repo = "phylophlan";
      tag = finalAttrs.version;
-      hash = "sha256-KlWKt2tH2lQBh/eQ2Hbcu2gXHEFfmFEc6LrybluxINc=";
+      hash = "sha256-rPTEdu0W3LD27tDIWCOQ3K+RJuj97I9aEeYFdM77jOs=";
    };

    build-system = with python3Packages; [ setuptools ];
@@ -35,6 +35,8 @@ let
      seaborn
      distutils
      requests
+      scipy
+      tqdm
    ];

    # Minimum needed external tools
@@ -24,8 +24,8 @@ buildGoModule (finalAttrs: {
  ldflags = [
    "-s"
    "-w"
-    "-X main.version=v${finalAttrs.version}"
-    "-X main.commit=v${finalAttrs.version}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.version}"
    "-X main.date=1970-01-01-00:00:01"
  ];

@@ -2,6 +2,7 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

 let
@@ -18,13 +19,7 @@ stdenvNoCC.mkDerivation {
    stripRoot = false;
  };

-  installPhase = ''
-    runHook preInstall
-
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://dotcolon.net/font/route159/";
@@ -12,13 +12,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "starship";
-  version = "1.24.2";
+  version = "1.25.0";

  src = fetchFromGitHub {
    owner = "starship";
    repo = "starship";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QE0zsQa7JRSXbCBe9yGGGW2ZNo0kp+JD0/5jIyN0OIQ=";
+    hash = "sha256-r7qUsAcs/Ljp1bgormw9sw4UKePs4EdAV0PjMWFFTdo=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ''
  );

-  cargoHash = "sha256-CYRm8wvKK7HIPI1yxTWLV/wpK++mHVT9BvDVX96VFr0=";
+  cargoHash = "sha256-1fCdIJC1PW86ZV4dfL8OJ8Xm3y2rbBvDNeZ0Td+TZVY=";

  nativeCheckInputs = [
    gitMinimal
@@ -17,13 +17,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "surfer";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitLab {
    owner = "surfer-project";
    repo = "surfer";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-83UKSD9Z4pT0OXLqIgquuJ8W6+U29ZzWG1SOrAOK9ic=";
+    hash = "sha256-WO0TWmUaKqUh+Cr75Hrxa2x4V9xZhzHY5PzlIRNUzZA=";
    fetchSubmodules = true;
  };

@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    libxi
  ];

-  cargoHash = "sha256-UuZpgW8di79mTNpDJ7K12IC5Xa3YX9ex2BYd62pUh1o=";
+  cargoHash = "sha256-WK3+YlBfHTo48+JBEBrgR23PTmyCZo98wg35VZmBdWA=";

  # Avoid the network attempt from skia. See: https://github.com/cargo2nix/cargo2nix/issues/318
  doCheck = false;
@@ -489,9 +489,10 @@ enum UnitComparison {

 // Compare the contents of two unit files and return whether the unit needs to be restarted or
 // reloaded. If the units differ, the service is restarted unless the only difference is
-// `X-Reload-Triggers` in the `Unit` section. If this is the only modification, the unit is
-// reloaded instead of restarted. If the only difference is `Options` in the `[Mount]` section, the
-// unit is reloaded rather than restarted.
+// `X-Reload-Triggers` in the `[Unit]` section, `Options` in the `[Mount]` section, or `ExecReload`
+// in the `[Service]` section, in which case the unit is reloaded rather than restarted. Removing
+// `ExecReload` is treated as a no-op since the running process is unaffected and the new unit can
+// no longer be reloaded.
 fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison {
    let mut ret = UnitComparison::Equal;

@@ -532,6 +533,13 @@ fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison
                    }
                }
                continue; // check the next section
+            } else if section_name == "Service"
+                && section_val.len() == 1
+                && section_val.contains_key("ExecReload")
+            {
+                // Dropping ExecReload does not affect the running process and the
+                // new unit can no longer be reloaded, so there is nothing to do.
+                continue;
            } else {
                return UnitComparison::UnequalNeedsRestart;
            }
@@ -562,6 +570,11 @@ fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison
                if section_name == "Unit" && unit_section_ignores.contains_key(ini_key.as_str()) {
                    continue;
                }
+                // Dropping ExecReload does not affect the running process and the
+                // new unit can no longer be reloaded, so there is nothing to do.
+                if section_name == "Service" && ini_key == "ExecReload" {
+                    continue;
+                }
                return UnitComparison::UnequalNeedsRestart;
            };

@@ -576,6 +589,12 @@ fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison
                    }
                }

+                // If this is a service unit, check if it was only `ExecReload`
+                if section_name == "Service" && ini_key == "ExecReload" {
+                    ret = UnitComparison::UnequalNeedsReload;
+                    continue;
+                }
+
                // If this is a mount unit, check if it was only `Options`
                if section_name == "Mount" && ini_key == "Options" {
                    ret = UnitComparison::UnequalNeedsReload;
@@ -598,6 +617,12 @@ fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison
                        return UnitComparison::UnequalNeedsRestart;
                    }
                }
+            } else if section_name == "Service"
+                && ini_cmp.len() == 1
+                && ini_cmp.contains_key("ExecReload")
+            {
+                ret = UnitComparison::UnequalNeedsReload;
+                continue;
            } else {
                return UnitComparison::UnequalNeedsRestart;
            }
@@ -606,15 +631,28 @@ fn compare_units(current_unit: &UnitInfo, new_unit: &UnitInfo) -> UnitComparison

    // A section was introduced that was missing in the previous unit
    if !section_cmp.is_empty() {
-        if section_cmp.keys().len() == 1 && section_cmp.contains_key("Unit") {
-            if let Some(new_unit_unit) = new_unit.get("Unit") {
-                for ini_key in new_unit_unit.keys() {
-                    if !unit_section_ignores.contains_key(ini_key.as_str()) {
-                        return UnitComparison::UnequalNeedsRestart;
-                    } else if ini_key == "X-Reload-Triggers" {
-                        ret = UnitComparison::UnequalNeedsReload;
+        if section_cmp.keys().len() == 1 {
+            // Dispatch on which section is actually new.
+            if section_cmp.contains_key("Unit") {
+                if let Some(new_unit_unit) = new_unit.get("Unit") {
+                    for ini_key in new_unit_unit.keys() {
+                        if !unit_section_ignores.contains_key(ini_key.as_str()) {
+                            return UnitComparison::UnequalNeedsRestart;
+                        } else if ini_key == "X-Reload-Triggers" {
+                            ret = UnitComparison::UnequalNeedsReload;
+                        }
                    }
                }
+            } else if section_cmp.contains_key("Service") {
+                if let Some(new_unit_service) = new_unit.get("Service") {
+                    if new_unit_service.len() == 1 && new_unit_service.contains_key("ExecReload") {
+                        ret = UnitComparison::UnequalNeedsReload;
+                    } else {
+                        return UnitComparison::UnequalNeedsRestart;
+                    }
+                }
+            } else {
+                return UnitComparison::UnequalNeedsRestart;
            }
        } else {
            return UnitComparison::UnequalNeedsRestart;
@@ -2623,6 +2661,112 @@ invalid
                ) == super::UnitComparison::UnequalNeedsReload
            );

+            assert!(
+                super::compare_units(
+                    &HashMap::from([]),
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecReload".to_string(), vec!["foobar".to_string()])])
+                    )])
+                ) == super::UnitComparison::UnequalNeedsReload
+            );
+
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecReload".to_string(), vec!["foobar".to_string()])])
+                    )]),
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecReload".to_string(), vec!["barfoo".to_string()])])
+                    )])
+                ) == super::UnitComparison::UnequalNeedsReload
+            );
+
+            // New [Service] section while [Unit] already existed: must inspect
+            // the [Service] section, not the (unchanged) [Unit] one.
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Unit".to_string(),
+                        HashMap::from([("Description".to_string(), vec!["x".to_string()])])
+                    )]),
+                    &HashMap::from([
+                        (
+                            "Unit".to_string(),
+                            HashMap::from([("Description".to_string(), vec!["x".to_string()])])
+                        ),
+                        (
+                            "Service".to_string(),
+                            HashMap::from([("ExecStart".to_string(), vec!["y".to_string()])])
+                        ),
+                    ]),
+                ) == super::UnitComparison::UnequalNeedsRestart
+            );
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Unit".to_string(),
+                        HashMap::from([("Description".to_string(), vec!["x".to_string()])])
+                    )]),
+                    &HashMap::from([
+                        (
+                            "Unit".to_string(),
+                            HashMap::from([("Description".to_string(), vec!["x".to_string()])])
+                        ),
+                        (
+                            "Service".to_string(),
+                            HashMap::from([("ExecReload".to_string(), vec!["y".to_string()])])
+                        ),
+                    ]),
+                ) == super::UnitComparison::UnequalNeedsReload
+            );
+
+            // ExecReload removed: running process is unaffected and the new
+            // unit cannot be reloaded, so no action is needed.
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([
+                            ("ExecStart".to_string(), vec!["x".to_string()]),
+                            ("ExecReload".to_string(), vec!["y".to_string()]),
+                        ])
+                    )]),
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecStart".to_string(), vec!["x".to_string()])])
+                    )]),
+                ) == super::UnitComparison::Equal
+            );
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecReload".to_string(), vec!["y".to_string()])])
+                    )]),
+                    &HashMap::from([]),
+                ) == super::UnitComparison::Equal
+            );
+
+            // ExecReload added to an existing [Service] section
+            assert!(
+                super::compare_units(
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([("ExecStart".to_string(), vec!["x".to_string()])])
+                    )]),
+                    &HashMap::from([(
+                        "Service".to_string(),
+                        HashMap::from([
+                            ("ExecStart".to_string(), vec!["x".to_string()]),
+                            ("ExecReload".to_string(), vec!["y".to_string()]),
+                        ])
+                    )]),
+                ) == super::UnitComparison::UnequalNeedsReload
+            );
+
            assert!(
                super::compare_units(
                    &HashMap::from([(
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "warmup-s3-archives";
-  version = "1.1.0";
+  version = "1.1.4";

  src = fetchFromGitLab {
    owner = "philipmw";
    repo = "warmup-s3-archives";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0moqSc87B3LFL7P5qoSqvdkf+RwLbiWkzGhjR2jgTR4=";
+    hash = "sha256-O2gLnCQ7Y7PKFeXlQqzL6FAoj7m7UI5NpKcYTexaKo4=";
  };

-  cargoHash = "sha256-sWSsxGj8+tSNs2JlhDZt+ulo89rPqZM8FjHpbUdeC5w=";
+  cargoHash = "sha256-cOUIbeGAhAiAPbXU8OxCuaczJcUGkjPaTKRvMceeM+Y=";

  passthru.updateScript = nix-update-script { };

@@ -6,7 +6,7 @@
  pkg-config,
 }:
 let
-  version = "1.28.0";
+  version = "1.29.0";
 in
 rustPlatform.buildRustPackage {
  pname = "websurfx";
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage {
    owner = "neon-mmd";
    repo = "websurfx";
    tag = "v${version}";
-    hash = "sha256-FQkwRRa4QmkDZ7JIxFjumCDLgzREVQm3K4U1ACpiZX0=";
+    hash = "sha256-F9tXo+DjLR7v6z3BtV/sO/gGlV9aBXgcXRMHEFki98Q=";
  };

  nativeBuildInputs = [
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage {
    openssl
  ];

-  cargoHash = "sha256-3wq9KN1n0XCXF9b2VldtlW6DeYt2euBoSIThLWeGCWk=";
+  cargoHash = "sha256-nSZ1sOVsIGdxXuR61R/seW7UX17Kx67f6Sm77GDtLQE=";

  postPatch = ''
    substituteInPlace src/handler.rs \
@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "yabai";
-  version = "7.1.23";
+  version = "7.1.24";

  src =
    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@@ -66,13 +66,13 @@ stdenv.mkDerivation (finalAttrs: {
      # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
      "aarch64-darwin" = fetchzip {
        url = "https://github.com/asmvik/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-p8LHuAhmkKNPkRNIw4NHpAA+/oQPMI34H21mlUiwK+M=";
+        hash = "sha256-2NTZUxptWhcF6sb1iUQwOuvG6omVAGVeb+j8XPBhRvs=";
      };
      "x86_64-darwin" = fetchFromGitHub {
        owner = "asmvik";
        repo = "yabai";
        rev = "v${finalAttrs.version}";
-        hash = "sha256-6fvjwn2MBJ8LKShR3evLyS3BfoJ4yYtnaCif7c9faxc=";
+        hash = "sha256-WyZbkIcqtVogvCfy/ee5Dk2+6OqXgMuVq6GzKKZ9F0A=";
      };
    };

@@ -21,7 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Free Unicode plain-text editor for Unix-like systems";
    homepage = "https://www.yudit.org/";
-    changelog = "https://www.yudit.org/download/CHANGELOG.TXT";
    mainProgram = "yudit";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ doronbehar ];
@@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zapret2";
-  version = "0.9.5";
+  version = "0.9.5.1";

  outputs = [
    "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "bol-van";
    repo = "zapret2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KdkUCfxxe2ddcYebvKsslIUBkl5g7Rc/f+xY00hy5JM=";
+    hash = "sha256-uKLHzsi/AYQ8OLj2g8pszSCyD485Sg/s45Ko8gKN5z8=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "actron-neo-api";
-  version = "0.5.4";
+  version = "0.5.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kclif9";
    repo = "actronneoapi";
    tag = "v${version}";
-    hash = "sha256-XyX9o1fIyY5TZqLzK1a+KLkLDVEorw2illg+lHutLtc=";
+    hash = "sha256-bBPhwiJQYDBEPZKA1Cq94X9LYAmBkOWCI+4afrQntmw=";
  };

  build-system = [
@@ -39,15 +39,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  disabledTests = [
-    # test hangs
-    "test_poll_for_token_pending"
-    # AttributeError: property 'authorization_header' of 'ActronAirOAuth2DeviceCodeAuth' object has no setter
-    "test_lazy_token_refres"
-    # ActronAirAuthError: Refresh token is required to refresh the access token
-    "test_get_user_info"
-  ];
-
  meta = {
    changelog = "https://github.com/kclif9/actronneoapi/releases/tag/${src.tag}";
    description = "Communicate with Actron Air systems via the Actron Neo API";
@@ -9,20 +9,24 @@

 buildPythonPackage rec {
  pname = "aiosomecomfort";
-  version = "0.0.35";
+  version = "0.0.36";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mkmer";
    repo = "AIOSomecomfort";
    tag = version;
-    hash = "sha256-zhCpV11nzRpWiCPNgeBfBzXgLM2NAw1p9R0ACD3u/mk=";
+    hash = "sha256-Da2Nvke01S7Pt+md2G5RRJqyUc6M3tcj4qsdSJVoQds=";
  };

  build-system = [
    setuptools
  ];

+  pythonRelaxDeps = [
+    "aiohttp"
+  ];
+
  dependencies = [
    aiohttp
    prettytable
@@ -20,18 +20,18 @@

 buildPythonPackage rec {
  pname = "approvaltests";
-  version = "17.4.1";
+  version = "18.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "approvals";
    repo = "ApprovalTests.Python";
    tag = "v${version}";
-    hash = "sha256-8JOd1JRwJS+y5Eh/an0RrGtwBZMPW/ziGTRd1H9Sveo=";
+    hash = "sha256-2lz3TMI4/QoNVfnZga5Ro9rheixFpVJfNbvVLy0lnLA=";
  };

  postPatch = ''
-    test -f setup.py || mv setup/setup.publish.py setup.py
+    test -f setup.py || mv setup/setup.approvaltests.py setup.py

    patchShebangs internal_documentation/scripts
  '';
@@ -67,7 +67,7 @@ buildPythonPackage rec {
  meta = {
    homepage = "https://github.com/crate/crate-python";
    description = "Python client library for CrateDB";
-    changelog = "https://github.com/crate/crate-python/blob/${version}/CHANGES.txt";
+    changelog = "https://github.com/crate/crate-python/blob/${version}/CHANGES.rst";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ doronbehar ];
  };
@@ -0,0 +1,43 @@
+{
+  replaceVars,
+  cudaLibPaths,
+}:
+{
+  version = "12.9.6";
+  sourceHash = "sha256-uRv27h2b6wXC8oOf5k2KxZ0bUFNvNu6XO05FBbJcU1k=";
+
+  nvidiaLibsPatch = replaceVars ./patch-nvidia-libs-paths_12_9.patch {
+    inherit (cudaLibPaths)
+      libcudart
+      libcufile
+      libnvfatbin
+      libnvjitlink
+      libnvml
+      libnvrtc
+      libnvvm
+      ;
+  };
+
+  pythonImportsCheck = [
+    "cuda.bindings.nvfatbin"
+    "cuda.bindings.nvml"
+  ];
+
+  disabledTests = [
+    # sysfs cpu topology is not available in the sandbox, causing:
+    #   cuda.bindings.nvml.UnknownError: Unknown Error
+    #   hwloc/linux: failed to find sysfs cpu topology directory, aborting linux discovery.
+    "test_device_get_cpu_affinity_within_scope"
+    "test_device_get_memory_affinity"
+
+    # Requires the nvidia_fs kernel module (GPUDirect Storage), causing:
+    #   cuda.bindings.cufile.cuFileError: NVFS_SETUP_ERROR (5033): NVFS driver initialization error
+    "test_buf_register_already_registered"
+    "test_buf_register_host_memory"
+    "test_buf_register_invalid_flags"
+    "test_buf_register_large_buffer"
+    "test_buf_register_multiple_buffers"
+    "test_buf_register_simple"
+    "test_driver_open"
+  ];
+}
@@ -0,0 +1,40 @@
+{
+  replaceVars,
+  cudaLibPaths,
+}:
+{
+  version = "13.0.3";
+  sourceHash = "sha256-Uq1oQWtilocQPh6cZ3P/L/L6caCHv17u1y67sm5fhhA=";
+
+  nvidiaLibsPatch = replaceVars ./patch-nvidia-libs-paths_13_0.patch {
+    inherit (cudaLibPaths)
+      libcudart
+      libcufile
+      libnvjitlink
+      libnvrtc
+      libnvvm
+      ;
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "cython>=3.1,<3.2" "cython"
+  '';
+
+  disabledTests = [
+    # Requires the nvidia_fs kernel module (GPUDirect Storage), causing:
+    #   cuda.bindings.cufile.cuFileError: NVFS_SETUP_ERROR (5033): NVFS driver initialization error
+    "test_buf_register_already_registered"
+    "test_buf_register_host_memory"
+    "test_buf_register_invalid_flags"
+    "test_buf_register_large_buffer"
+    "test_buf_register_multiple_buffers"
+    "test_buf_register_simple"
+    "test_driver_open"
+    "test_get_bar_size_in_kb"
+    "test_get_parameter_min_max_value"
+    "test_set_parameter_posix_pool_slab_array"
+    "test_set_stats_level"
+    "test_stats_start_stop"
+  ];
+}
@@ -0,0 +1,45 @@
+{
+  replaceVars,
+  cudaLibPaths,
+}:
+{
+  version = "13.1.1";
+  sourceHash = "sha256-AvIw2G4EGWsX7PxFGxzECXhwkbwYslHzRdUArTNf7jE=";
+
+  nvidiaLibsPatch = replaceVars ./patch-nvidia-libs-paths_13_1.patch {
+    inherit (cudaLibPaths)
+      libcudart
+      libcufile
+      libnvjitlink
+      libnvml
+      libnvrtc
+      libnvvm
+      ;
+  };
+
+  pythonImportsCheck = [
+    "cuda.bindings._nvml"
+  ];
+
+  disabledTests = [
+    # sysfs cpu topology is not available in the sandbox, causing:
+    #   cuda.bindings._nvml.UnknownError: Unknown Error
+    #   hwloc/linux: failed to find sysfs cpu topology directory, aborting linux discovery.
+    "test_device_get_cpu_affinity_within_scope"
+    "test_device_get_memory_affinity"
+
+    # Requires the nvidia_fs kernel module (GPUDirect Storage), causing:
+    #   cuda.bindings.cufile.cuFileError: NVFS_SETUP_ERROR (5033): NVFS driver initialization error
+    "test_buf_register_already_registered"
+    "test_buf_register_host_memory"
+    "test_buf_register_invalid_flags"
+    "test_buf_register_large_buffer"
+    "test_buf_register_multiple_buffers"
+    "test_buf_register_simple"
+    "test_get_bar_size_in_kb"
+    "test_get_parameter_min_max_value"
+    "test_set_parameter_posix_pool_slab_array"
+    "test_set_stats_level"
+    "test_stats_start_stop"
+  ];
+}
@@ -0,0 +1,50 @@
+{
+  replaceVars,
+  cudaLibPaths,
+}:
+{
+  version = "13.2.0";
+  sourceHash = "sha256-VOaRjZwg1phGjkOeXjWMcs/vjlPMNKiVSKyKrQG5ohM=";
+
+  nvidiaLibsPatch = replaceVars ./patch-nvidia-libs-paths_13_2.patch {
+    inherit (cudaLibPaths)
+      libcudart
+      libcufile
+      libnvfatbin
+      libnvjitlink
+      libnvml
+      libnvrtc
+      libnvvm
+      ;
+  };
+
+  pythonImportsCheck = [
+    "cuda.bindings.nvfatbin"
+    "cuda.bindings.nvml"
+  ];
+
+  disabledTests = [
+    # Requires GPU discovery support not available in the test environment
+    "test_discover_gpus"
+
+    # sysfs cpu topology is not available in the sandbox, causing:
+    #   cuda.bindings.nvml.UnknownError: Unknown Error
+    #   hwloc/linux: failed to find sysfs cpu topology directory, aborting linux discovery.
+    "test_device_get_cpu_affinity_within_scope"
+    "test_device_get_memory_affinity"
+
+    # Requires the nvidia_fs kernel module (GPUDirect Storage), causing:
+    #   cuda.bindings.cufile.cuFileError: NVFS_SETUP_ERROR (5033): NVFS driver initialization error
+    "test_buf_register_already_registered"
+    "test_buf_register_host_memory"
+    "test_buf_register_invalid_flags"
+    "test_buf_register_large_buffer"
+    "test_buf_register_multiple_buffers"
+    "test_buf_register_simple"
+    "test_get_bar_size_in_kb"
+    "test_get_parameter_min_max_value"
+    "test_set_parameter_posix_pool_slab_array"
+    "test_set_stats_level"
+    "test_stats_start_stop"
+  ];
+}
@@ -19,15 +19,49 @@
  numpy,

  # tests
+  cuda-pathfinder,
+  pytest-benchmark,
  pytestCheckHook,
+  util-linux,

  # passthru
  cuda-bindings,
 }:

+let
+  cudaVersion = cudaPackages.cudaMajorMinorVersion;
+
+  versionSpecificAttrs =
+    let
+      args = {
+        inherit replaceVars;
+        cudaLibPaths = {
+          libcudart = lib.getLib cudaPackages.cuda_cudart;
+          libcufile = lib.getLib cudaPackages.libcufile;
+          libnvfatbin = lib.getLib cudaPackages.libnvfatbin;
+          libnvjitlink = lib.getLib cudaPackages.libnvjitlink;
+          libnvml = addDriverRunpath.driverLink;
+          libnvrtc = lib.getLib cudaPackages.cuda_nvrtc;
+          libnvvm =
+            if cudaOlder "13.0" then "${cudaPackages.cuda_nvcc}/nvvm" else lib.getLib cudaPackages.libnvvm;
+        };
+      };
+    in
+    {
+      # cuda-bindings patch versions DO NOT correspond to cuda toolkits' own path versions.
+      # Only major.minor is supposed to match
+      "12.9" = import ./12_9.nix args;
+      "13.0" = import ./13_0.nix args;
+      "13.1" = import ./13_1.nix args;
+      "13.2" = import ./13_2.nix args;
+    }
+    .${cudaVersion} or (throw "Unsupported cuda-bindings version: ${cudaVersion}");
+
+  inherit (cudaPackages) cudaOlder cudaAtLeast;
+in
 buildPythonPackage (finalAttrs: {
  pname = "cuda-bindings";
-  version = "12.9.6";
+  inherit (versionSpecificAttrs) version;
  pyproject = true;
  __structuredAttrs = true;

@@ -35,22 +69,14 @@ buildPythonPackage (finalAttrs: {
    owner = "NVIDIA";
    repo = "cuda-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uRv27h2b6wXC8oOf5k2KxZ0bUFNvNu6XO05FBbJcU1k=";
+    hash = versionSpecificAttrs.sourceHash;
  };

  # Apply patch relative to cuda_bindings
  patchFlags = [ "-p2" ];

  patches = [
-    (replaceVars ./patch-nvidia-libs-paths.patch {
-      libcudart = lib.getLib cudaPackages.cuda_cudart;
-      libcufile = lib.getLib cudaPackages.libcufile;
-      libnvfatbin = lib.getLib cudaPackages.libnvfatbin;
-      libnvjitlink = lib.getLib cudaPackages.libnvjitlink;
-      libnvml = addDriverRunpath.driverLink;
-      libnvrtc = lib.getLib cudaPackages.cuda_nvrtc;
-      libnvvm = "${cudaPackages.cuda_nvcc}/nvvm";
-    })
+    versionSpecificAttrs.nvidiaLibsPatch
  ];

  sourceRoot = "${finalAttrs.src.name}/cuda_bindings";
@@ -76,7 +102,8 @@ buildPythonPackage (finalAttrs: {
        --replace-fail \
          "path = 'libcuda.so.1'" \
          "path = '${libCudaPath}/lib/libcuda.so.1'"
-    '';
+    ''
+    + (versionSpecificAttrs.postPatch or "");

  preBuild = ''
    export CUDA_PYTHON_PARALLEL_LEVEL=$NIX_BUILD_CORES
@@ -101,8 +128,14 @@ buildPythonPackage (finalAttrs: {
  };

  buildInputs = [
-    cudaPackages.cuda_nvcc # crt/host_defines.h
    cudaPackages.libcufile # cufile.h
+  ]
+  # Until 13.0, crt headers are shipped in nvcc
+  ++ lib.optionals (cudaOlder "13.0") [
+    cudaPackages.cuda_nvcc # crt/host_defines.h
+  ]
+  ++ lib.optionals (cudaAtLeast "13.0") [
+    cudaPackages.cuda_crt # crt/host_defines.h
  ];

  pythonRemoveDeps = [
@@ -118,13 +151,12 @@ buildPythonPackage (finalAttrs: {
    "cuda"
    "cuda.bindings.cufile"
    "cuda.bindings.driver"
-    "cuda.bindings.nvfatbin"
    "cuda.bindings.nvjitlink"
-    "cuda.bindings.nvml"
    "cuda.bindings.nvrtc"
    "cuda.bindings.nvvm"
    "cuda.bindings.runtime"
-  ];
+  ]
+  ++ (versionSpecificAttrs.pythonImportsCheck or [ ]);

  preCheck = ''
    rm -rf cuda
@@ -132,38 +164,28 @@ buildPythonPackage (finalAttrs: {

  nativeCheckInputs = [
    pytestCheckHook
+  ]
+  ++ lib.optionals (cudaPackages.cudaAtLeast "13.0") [
+    # Although we don't want cuda.pathfinder as a dependency (to handle dlopens), it is imported by
+    # some tests
+    cuda-pathfinder
+
+    pytest-benchmark
+    util-linux # findmnt
  ];

  enabledTestPaths = [
    "tests/"
  ];

-  disabledTestPaths = [
+  disabledTestPaths = lib.optionals (cudaOlder "13.0") [
    # The current driver shipped in NixOS (590.48.01) advertises CUDA 13.1, causing the following
    # error:
    # cuda.bindings._internal.utils.NotSupportedError: only CUDA 12 driver is supported
-    #
-    # Ideally, we should transition to cuda 13 across the whole nixpkgs tree.
    "tests/test_nvjitlink.py"
  ];

-  disabledTests = [
-    # sysfs cpu topology is not available in the sandbox, causing:
-    #   cuda.bindings.nvml.UnknownError: Unknown Error
-    #   hwloc/linux: failed to find sysfs cpu topology directory, aborting linux discovery.
-    "test_device_get_cpu_affinity_within_scope"
-    "test_device_get_memory_affinity"
-
-    # Requires the nvidia_fs kernel module (GPUDirect Storage), causing:
-    #   cuda.bindings.cufile.cuFileError: NVFS_SETUP_ERROR (5033): NVFS driver initialization error
-    "test_buf_register_already_registered"
-    "test_buf_register_host_memory"
-    "test_buf_register_invalid_flags"
-    "test_buf_register_large_buffer"
-    "test_buf_register_multiple_buffers"
-    "test_buf_register_simple"
-    "test_driver_open"
-  ];
+  disabledTests = versionSpecificAttrs.disabledTests or [ ];

  # Tests need access to a GPU
  doCheck = false;
@@ -0,0 +1,125 @@
+diff --git a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+index 8409032852..b3a04478c2 100644
+--- a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+++ b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+@@ -8,7 +8,7 @@ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+ cimport cuda.bindings._lib.dlfcn as dlfcn
+ {{endif}}
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ 
+@@ -45,7 +45,7 @@ cdef int _cuPythonInit() except -1 nogil:
+     # Load library
+     with gil, __symbol_lock:
+         {{if 'Windows' == platform.system()}}
+-        handle = load_nvidia_dynamic_lib("nvrtc")._handle_uint
+        handle = CDLL("@libnvrtc@/lib/libnvrtc.so")._handle
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+@@ -146,7 +146,7 @@ cdef int _cuPythonInit() except -1 nogil:
+         {{endif}}
+ 
+         {{else}}
+-        handle = <void*><uintptr_t>(load_nvidia_dynamic_lib("nvrtc")._handle_uint)
+        handle = <void*><uintptr_t>(CDLL("@libnvrtc@/lib/libnvrtc.so")._handle)
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+diff --git a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+index 33b6384647..9fe3eb78e4 100644
+--- a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+@@ -9,7 +9,7 @@ import threading
+ 
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ import cython
+ 
+@@ -107,7 +107,7 @@ cdef void* __cuFileGetParameterPosixPoolSlabArray = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("cufile")._handle_uint
+    cdef uintptr_t handle = CDLL("@libcufile@/lib/libcufile.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+index a8e2b4e56b..917facb824 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -76,7 +76,7 @@ cdef void* __nvJitLinkVersion = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvJitLink")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvjitlink@/lib/libnvJitLink.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+index 64d97334b9..d325e68ea7 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -75,7 +75,7 @@ cdef void* __nvvmGetProgramLog = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvvm")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvvm@/lib/libnvvm.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/cyruntime.pyx.in b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+index 3031e43d2f..bb83421b46 100644
+--- a/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+++ b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+@@ -1886,7 +1886,7 @@ cdef cudaError_t cudaGraphicsVDPAURegisterOutputSurface(cudaGraphicsResource** r
+ {{if True}}
+ 
+ from libc.stdint cimport uintptr_t
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ {{if 'Windows' == platform.system()}}
+ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+@@ -1896,11 +1896,11 @@ cimport cuda.bindings._lib.dlfcn as dlfcn
+ cdef cudaError_t getLocalRuntimeVersion(int* runtimeVersion) except ?cudaErrorCallRequiresNewerDriver nogil:
+     # Load
+     with gil:
+-        loaded_dl = load_nvidia_dynamic_lib("cudart")
+        loaded_dl = CDLL("@libcudart@/lib/libcudart.so")
+         {{if 'Windows' == platform.system()}}
+-        handle = <uintptr_t>loaded_dl._handle_uint
+        handle = <uintptr_t>loaded_dl._handle
+         {{else}}
+-        handle = <void *><uintptr_t>loaded_dl._handle_uint
+        handle = <void *><uintptr_t>loaded_dl._handle
+         {{endif}}
+ 
+     {{if 'Windows' == platform.system()}}
@@ -0,0 +1,147 @@
+diff --git a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+index 608aebd1af..7f60917f71 100644
+--- a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+++ b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+@@ -8,7 +8,7 @@ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+ cimport cuda.bindings._lib.dlfcn as dlfcn
+ {{endif}}
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ 
+@@ -45,7 +45,7 @@ cdef int _cuPythonInit() except -1 nogil:
+     # Load library
+     with gil, __symbol_lock:
+         {{if 'Windows' == platform.system()}}
+-        handle = load_nvidia_dynamic_lib("nvrtc")._handle_uint
+        handle = CDLL("@libnvrtc@/lib/libnvrtc.so")._handle
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+@@ -146,7 +146,7 @@ cdef int _cuPythonInit() except -1 nogil:
+         {{endif}}
+ 
+         {{else}}
+-        handle = <void*><uintptr_t>(load_nvidia_dynamic_lib("nvrtc")._handle_uint)
+        handle = <void*><uintptr_t>(CDLL("@libnvrtc@/lib/libnvrtc.so")._handle)
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+diff --git a/cuda_bindings/cuda/bindings/_internal/_nvml_linux.pyx b/cuda_bindings/cuda/bindings/_internal/_nvml_linux.pyx
+index 1622cc82aa..ddff5dad75 100644
+--- a/cuda_bindings/cuda/bindings/_internal/_nvml_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/_nvml_linux.pyx
+@@ -10,7 +10,7 @@ import threading
+ 
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -410,7 +410,7 @@ cdef void* __nvmlDeviceGetSramUniqueUncorrectedEccErrorCounts = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    return dlopen("libnvidia-ml.so.1", RTLD_NOW | RTLD_GLOBAL)
+    return dlopen("@libnvml@/lib/libnvidia-ml.so.1", RTLD_NOW | RTLD_GLOBAL)
+ 
+ 
+ cdef int _init_nvml() except -1 nogil:
+diff --git a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+index c64eb00c5c..9ba4ea2727 100644
+--- a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+@@ -9,7 +9,7 @@ import threading
+ 
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ import cython
+ 
+@@ -107,7 +107,7 @@ cdef void* __cuFileGetParameterPosixPoolSlabArray = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("cufile")._handle_uint
+    cdef uintptr_t handle = CDLL("@libcufile@/lib/libcufile.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+index 8c96b6d640..96761a95ae 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -76,7 +76,7 @@ cdef void* __nvJitLinkVersion = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvJitLink")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvjitlink@/lib/libnvJitLink.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+index 408a2cb592..2b31888e1f 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -75,7 +75,7 @@ cdef void* __nvvmGetProgramLog = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvvm")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvvm@/lib/libnvvm.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/cyruntime.pyx.in b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+index 248346d274..e041b41d69 100644
+--- a/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+++ b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+@@ -2012,7 +2012,7 @@ cdef cudaError_t cudaGraphicsVDPAURegisterOutputSurface(cudaGraphicsResource** r
+ {{if True}}
+ 
+ from libc.stdint cimport uintptr_t
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ {{if 'Windows' == platform.system()}}
+ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+@@ -2022,11 +2022,11 @@ cimport cuda.bindings._lib.dlfcn as dlfcn
+ cdef cudaError_t getLocalRuntimeVersion(int* runtimeVersion) except ?cudaErrorCallRequiresNewerDriver nogil:
+     # Load
+     with gil:
+-        loaded_dl = load_nvidia_dynamic_lib("cudart")
+        loaded_dl = CDLL("@libcudart@/lib/libcudart.so")
+         {{if 'Windows' == platform.system()}}
+-        handle = <uintptr_t>loaded_dl._handle_uint
+        handle = <uintptr_t>loaded_dl._handle
+         {{else}}
+-        handle = <void *><uintptr_t>loaded_dl._handle_uint
+        handle = <void *><uintptr_t>loaded_dl._handle
+         {{endif}}
+ 
+     {{if 'Windows' == platform.system()}}
@@ -0,0 +1,169 @@
+diff --git a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+index 534dcb55cb..bd3feb2760 100644
+--- a/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+++ b/cuda_bindings/cuda/bindings/_bindings/cynvrtc.pyx.in
+@@ -8,7 +8,7 @@ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+ cimport cuda.bindings._lib.dlfcn as dlfcn
+ {{endif}}
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ 
+@@ -47,7 +47,7 @@ cdef int _cuPythonInit() except -1 nogil:
+     # Load library
+     with gil, __symbol_lock:
+         {{if 'Windows' == platform.system()}}
+-        handle = load_nvidia_dynamic_lib("nvrtc")._handle_uint
+        handle = CDLL("@libnvrtc@/lib/libnvrtc.so")._handle
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+@@ -156,7 +156,7 @@ cdef int _cuPythonInit() except -1 nogil:
+         {{endif}}
+ 
+         {{else}}
+-        handle = <void*><uintptr_t>(load_nvidia_dynamic_lib("nvrtc")._handle_uint)
+        handle = <void*><uintptr_t>(CDLL("@libnvrtc@/lib/libnvrtc.so")._handle)
+ 
+         # Load function
+         {{if 'nvrtcGetErrorString' in found_functions}}
+diff --git a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+index 5231808058..f74cf1daec 100644
+--- a/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/cufile_linux.pyx
+@@ -9,7 +9,7 @@ import threading
+ 
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ import cython
+ 
+@@ -107,7 +107,7 @@ cdef void* __cuFileGetParameterPosixPoolSlabArray = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("cufile")._handle_uint
+    cdef uintptr_t handle = CDLL("@libcufile@/lib/libcufile.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvfatbin_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvfatbin_linux.pyx
+index f5a9bbd218..8271f7aa20 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvfatbin_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvfatbin_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -73,7 +73,7 @@ cdef void* __nvFatbinAddTileIR = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvfatbin")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvfatbin@/lib/libnvfatbin.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+index d676aac372..ed3c000566 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvjitlink_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -76,7 +76,7 @@ cdef void* __nvJitLinkVersion = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvJitLink")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvjitlink@/lib/libnvJitLink.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvml_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvml_linux.pyx
+index 28f0919423..852f75e46d 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvml_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvml_linux.pyx
+@@ -10,7 +10,7 @@ import threading
+ 
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -406,7 +406,7 @@ cdef void* __nvmlDeviceSetRusdSettings_v1 = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvml")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvml@/lib/libnvidia-ml.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+index 8a84834a9a..a3ced66807 100644
+--- a/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+++ b/cuda_bindings/cuda/bindings/_internal/nvvm_linux.pyx
+@@ -9,7 +9,7 @@ from libc.stdint cimport intptr_t, uintptr_t
+ import threading
+ from .utils import FunctionNotFoundError, NotSupportedError
+ 
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ 
+ 
+ ###############################################################################
+@@ -75,7 +75,7 @@ cdef void* __nvvmGetProgramLog = NULL
+ 
+ 
+ cdef void* load_library() except* with gil:
+-    cdef uintptr_t handle = load_nvidia_dynamic_lib("nvvm")._handle_uint
+    cdef uintptr_t handle = CDLL("@libnvvm@/lib/libnvvm.so")._handle
+     return <void*>handle
+ 
+ 
+diff --git a/cuda_bindings/cuda/bindings/cyruntime.pyx.in b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+index 244410a382..769664e157 100644
+--- a/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+++ b/cuda_bindings/cuda/bindings/cyruntime.pyx.in
+@@ -2042,7 +2042,7 @@ cdef cudaError_t cudaGraphicsVDPAURegisterOutputSurface(cudaGraphicsResource** r
+ {{if True}}
+ 
+ from libc.stdint cimport uintptr_t
+-from cuda.pathfinder import load_nvidia_dynamic_lib
+from ctypes import CDLL
+ {{if 'Windows' == platform.system()}}
+ cimport cuda.bindings._lib.windll as windll
+ {{else}}
+@@ -2052,11 +2052,11 @@ cimport cuda.bindings._lib.dlfcn as dlfcn
+ cdef cudaError_t getLocalRuntimeVersion(int* runtimeVersion) except ?cudaErrorCallRequiresNewerDriver nogil:
+     # Load
+     with gil:
+-        loaded_dl = load_nvidia_dynamic_lib("cudart")
+        loaded_dl = CDLL("@libcudart@/lib/libcudart.so")
+         {{if 'Windows' == platform.system()}}
+-        handle = <uintptr_t>loaded_dl._handle_uint
+        handle = <uintptr_t>loaded_dl._handle
+         {{else}}
+-        handle = <void *><uintptr_t>loaded_dl._handle_uint
+        handle = <void *><uintptr_t>loaded_dl._handle
+         {{endif}}
+ 
+     {{if 'Windows' == platform.system()}}
@@ -25,19 +25,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "dulwich";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jelmer";
    repo = "dulwich";
    tag = "dulwich-${finalAttrs.version}";
-    hash = "sha256-9y7+00M2Ib5j+1fHNsJBomkyNZWhihqcIvAgGpJ5AB8=";
+    hash = "sha256-R5vq3mb1nSqEn+LIUaXc8Edrw8TgTb5H4LOXnHgeAzQ=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-NEYauayn7laPLQUomQAFEskFP5m8546jYltazR/gn1A=";
+    hash = "sha256-r2Ef8ciZW6rNBg8eLr5lkqtTEXugy7B9DjbSCErJkzc=";
  };

  nativeBuildInputs = [
@@ -89,8 +89,6 @@ buildPythonPackage (finalAttrs: {
  '';

  disabledTestPaths = [
-    # "Code [in contrib] is not an official part of Dulwich, and may no longer work"
-    "tests/contrib"
    # AssertionError: GPGMEError not raised
    "tests/test_signature.py::GPGSignatureVendorTests::test_verify_invalid_signature"
  ];
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "elevenlabs";
-  version = "2.43.0";
+  version = "2.45.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elevenlabs";
    repo = "elevenlabs-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w8IvjwC1X81BhPgTcHWx/vDL9M/ZoHUNsvTySmN0qW0=";
+    hash = "sha256-E9+hlFfDx1pBEMPcsx1vuawkbmsgCDv3s+/JYqVUu3U=";
  };

  build-system = [ poetry-core ];
@@ -113,7 +113,12 @@ buildPythonPackage rec {
  meta = {
    description = "Python library generating graphical user interfaces for easy dataset editing and display";
    homepage = "https://github.com/PlotPyStack/guidata";
-    changelog = "https://github.com/PlotPyStack/guidata/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/PlotPyStack/guidata/blob/master/doc/release_notes/release_${lib.versions.major version}.${
+      lib.pipe version [
+        lib.versions.minor
+        (lib.fixedWidthString 2 "0")
+      ]
+    }.md";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ doronbehar ];
  };
@@ -117,7 +117,12 @@ buildPythonPackage rec {
  meta = {
    description = "Curve and image plotting tools for Python/Qt applications";
    homepage = "https://github.com/PlotPyStack/PlotPy";
-    changelog = "https://github.com/PlotPyStack/PlotPy/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/PlotPyStack/PlotPy/blob/master/doc/release_notes/release_${lib.versions.major version}.${
+      lib.pipe version [
+        lib.versions.minor
+        (lib.fixedWidthString 2 "0")
+      ]
+    }.md";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ doronbehar ];
  };
@@ -27,7 +27,7 @@ buildPythonPackage rec {
  meta = {
    description = "Package for interacting with Bluetooth Low Energy (BLE) compatible bike trainers, power meters, radars and heart rate monitors";
    homepage = "https://github.com/zacharyedwardbull/pycycling";
-    changelog = "https://github.com/zacharyedwardbull/pycycling/releases/tag/${version}";
+    changelog = "https://github.com/zacharyedwardbull/pycycling/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ viraptor ];
  };
@@ -19,14 +19,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-bsblan";
-  version = "5.1.4";
+  version = "5.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "liudger";
    repo = "python-bsblan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-97Hgsu0ipX5oSAZdCikaWhj6g3gEom/Is2wnm6vpblY=";
+    hash = "sha256-rp75cUDlciibMCpEEXn6zta6kquwCwXstRkA9A7JJYc=";
  };

  postPatch = ''
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "satel-integra";
-  version = "1.2.1";
+  version = "1.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "c-soft";
    repo = "satel_integra";
    tag = version;
-    hash = "sha256-haSCSWLHEvd4AUXMvopYjFdEXQ2u6IGrT7q3sY711PQ=";
+    hash = "sha256-bYwAW8mbgE4D6xvAmkOPewAGkKJuF5AKPjXGeaJpk6s=";
  };

  build-system = [
@@ -18,14 +18,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "serialx";
-  version = "1.2.3";
+  version = "1.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "puddly";
    repo = "serialx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FroHqWuNGna5FxP4PXZzhADaNNRQnVjG9S5JJq4CVkQ=";
+    hash = "sha256-ttKnjpF3SYo2QIKMuPU2EuTTp/Hq0s+4gvNdXdNApbs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -62,6 +62,8 @@ buildPythonPackage (finalAttrs: {
  disabledTests = [
    # tries to access /sys/class/tty in sandbox
    "test_compat_tools_module"
+    # connects to 192.0.2.1
+    "test_async_socket_connect_timeout"
  ];

  meta = {
@@ -1,20 +1,22 @@
 {
  lib,
-  fetchPypi,
+  fetchFromGitHub,
  buildPythonPackage,
  setuptools,
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "siphashc";
  version = "2.7";
  pyproject = true;
  build-system = [ setuptools ];

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-ppRNc3aM9So6g0LunBka2UBFWQAvck9E4Ot6sOC96jM=";
+  src = fetchFromGitHub {
+    owner = "WeblateOrg";
+    repo = "siphashc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Rj+0oIlGs2Xs2TTN0PIwcVUlTgd1AZITC8xBf/Hn31Q=";
  };

  nativeCheckInputs = [ pytestCheckHook ];
@@ -24,8 +26,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python c-module for siphash";
    homepage = "https://github.com/WeblateOrg/siphashc";
-    changelog = "https://github.com/WeblateOrg/siphashc/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/WeblateOrg/siphashc/blob/${finalAttrs.src.tag}/CHANGES.rst";
    license = lib.licenses.isc;
    maintainers = with lib.maintainers; [ erictapen ];
  };
-}
+})
@@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "striprtf";
-  version = "0.0.29";
+  version = "0.0.32";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-WoItB14XQXk07Trdb8ebX8j7VE/kNwsviUzdKPDd144=";
+    hash = "sha256-fzdaN12ZonAIQhcxaMkMm1RcskQkH/xdho7Z9rr5FV8=";
  };

  build-system = [ hatchling ];
@@ -16,12 +16,18 @@ let
    "name"
    "dependencies"
    "meta"
+    "shellInit"
  ];
 in
 {
  name,
  dependencies,
  meta ? { },
+  # Config for the `shellInit` passthru (a `shell -> string`
+  # function returning the shell-specific init snippet for the bat-extras
+  # package). Specified as an attrset with a 'flags' string list argument.
+  # If null, there is no shell init for the package.
+  shellInit ? null,
  ...
 }@args:
 stdenv.mkDerivation (
@@ -76,6 +82,36 @@ stdenv.mkDerivation (
    # We have already patched
    dontPatchShebangs = true;

+    passthru =
+      let
+        initScript =
+          {
+            program,
+            shell,
+            flags ? [ ],
+          }:
+          if (shell != "fish") then
+            ''
+              eval "$(${lib.getExe program} ${toString flags})"
+            ''
+          else
+            ''
+              ${lib.getExe program} ${toString flags} | source
+            '';
+      in
+      {
+        shellInit =
+          shell:
+          if shellInit == null then
+            ""
+          else
+            initScript {
+              program = finalAttrs.finalPackage;
+              inherit shell;
+              flags = shellInit.flags or [ ];
+            };
+      };
+
    meta = core.meta // { mainProgram = name; } // meta;
  }
 )
@@ -7,5 +7,8 @@
 buildBatExtrasPkg {
  name = "batman";
  dependencies = lib.optional stdenv.targetPlatform.isLinux util-linux;
+  shellInit = {
+    flags = [ "--export-env" ];
+  };
  meta.description = "Read system manual pages (man) using bat as the manual page formatter";
 }
@@ -11,6 +11,9 @@ buildBatExtrasPkg {
    less
    procps
  ];
+  shellInit = {
+    flags = [ ];
+  };

  patches = [
    ../patches/batpipe-skip-outdated-test.patch
@@ -17,6 +17,7 @@
  wine ? null,
  cmocka,
  llvmPackages,
+  withNyx ? false,
 }:

 # wine fuzzing is only known to work for win32 binaries, and using a mixture of
@@ -24,6 +25,10 @@
 # a full 32bit version of this package if you want to do wine fuzzing
 assert (wine != null) -> (stdenv.targetPlatform.system == "i686-linux");

+# nyx mode is only available on x86_64-linux,
+# see nyx_mode/build_nyx_support.sh in source code of aflplusplus
+assert withNyx -> (stdenv.targetPlatform.system == "x86_64-linux");
+
 let
  aflplusplus-qemu = callPackage ./qemu.nix { };
  qemu-exe-name =
@@ -35,6 +40,17 @@ let
      throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!";
  libdislocator = callPackage ./libdislocator.nix { inherit aflplusplus; };
  libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };
+
+  libnyx =
+    if withNyx then callPackage ./nyx_mode/libnyx/libnyx.nix { inherit aflplusplus; } else null;
+  qemu-nyx =
+    if withNyx then callPackage ./nyx_mode/QEMU-Nyx/qemu-nyx.nix { inherit aflplusplus; } else null;
+  nyx-packer =
+    if withNyx then
+      callPackage ./nyx_mode/packer/packer.nix { inherit aflplusplus qemu-nyx; }
+    else
+      null;
+
  aflplusplus = stdenvNoCC.mkDerivation rec {
    pname = "aflplusplus";
    version = "4.35c";
@@ -43,7 +59,12 @@ let
      owner = "AFLplusplus";
      repo = "AFLplusplus";
      tag = "v${version}";
-      hash = "sha256-j5YH39JKcjYuDqyl+KRMtgn3UoeWEW1z7m4ysf2uilc=";
+      hash =
+        if withNyx then
+          "sha256-srHrYPEb0UAP/G9cOxJOZ9D6v9pxqez28suPsa70E2M="
+        else
+          "sha256-j5YH39JKcjYuDqyl+KRMtgn3UoeWEW1z7m4ysf2uilc=";
+      fetchSubmodules = withNyx;
    };

    enableParallelBuilding = true;
@@ -68,6 +89,10 @@ let
    # warning: "_FORTIFY_SOURCE" redefined
    hardeningDisable = [ "fortify" ];

+    # We build nyx mode dependencies ourselves, so this patch skips
+    # build_nyx_support.sh in the aflplusplus source code. It also skips
+    # test-nyx-mode.sh because we can't test nyx mode in the sandbox.
+    patches = lib.optional withNyx ./nyx_mode/nyx_mode.patch;
    postPatch = ''
      # Don't care about this.
      rm Android.bp
@@ -94,6 +119,9 @@ let

      substituteInPlace GNUmakefile.llvm \
        --replace-fail "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang"
+    ''
+    + lib.optionalString withNyx ''
+      patchShebangs nyx_mode/build_nyx_support.sh
    '';

    env.NIX_CFLAGS_COMPILE = toString [
@@ -145,7 +173,15 @@ let
        --replace-fail "cgdelete" "${libcgroup}/bin/cgdelete"

      patchShebangs $out/bin
-
+    ''
+    + lib.optionalString withNyx ''
+      # Use same FHS as if built from source using build_nyx_support.sh. This
+      # means libnyx.so must be next to afl binaries and nyx_mode dependencies
+      # are in nyx_mode/.
+      cp ${libnyx}/lib/libnyx.so $out/bin
+      mkdir $out/nyx_mode
+      ln -s ${nyx-packer} $out/nyx_mode/packer
+      ln -s ${qemu-nyx} $out/nyx_mode/QEMU-Nyx
    ''
    + lib.optionalString (wine != null) ''
      substitute afl-wine-trace $out/bin/afl-wine-trace \
@@ -166,6 +202,7 @@ let
      file
      cmocka
    ];
+
    doInstallCheck = true;
    installCheckPhase = ''
      runHook preInstallCheck
@@ -191,7 +228,13 @@ let
    '';

    passthru = {
-      inherit libdislocator libtokencap;
+      inherit
+        libdislocator
+        libtokencap
+        libnyx
+        nyx-packer
+        qemu-nyx
+        ;
      qemu = aflplusplus-qemu;
    };

@@ -0,0 +1,77 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  python3,
+  pkg-config,
+  flex,
+  bison,
+  glib,
+  pixman,
+  aflplusplus,
+}:
+
+# this derivation assumes x86_64-linux
+assert stdenv.targetPlatform.system == "x86_64-linux";
+
+stdenv.mkDerivation {
+  version = builtins.readFile (aflplusplus.src + "/nyx_mode/QEMU_NYX_VERSION");
+  pname = "QEMU-Nyx";
+
+  src = aflplusplus.src;
+  postUnpack = ''
+    sourceRoot="$sourceRoot/nyx_mode/QEMU-Nyx"
+  '';
+
+  # same flags for ./configure as ./compile_qemu_nyx.sh static would set
+  configureFlags = [
+    "--target-list=x86_64-softmmu"
+    "--disable-docs"
+    "--disable-gtk"
+    "--disable-werror"
+    "--disable-capstone"
+    "--disable-libssh"
+    "--disable-tools"
+    "--enable-nyx"
+    "--enable-nyx-static"
+  ];
+
+  nativeBuildInputs = [
+    python3
+    pkg-config
+    flex
+    bison
+  ];
+
+  buildInputs = [
+    glib
+    pixman
+  ];
+
+  enableParallelBuilding = true;
+
+  preConfigure = ''
+    CAPSTONE_ROOT=$PWD/capstone_v4
+    LIBXDC_ROOT=$PWD/libxdc
+
+    make -C $CAPSTONE_ROOT -j$(nproc)
+    make -C $LIBXDC_ROOT -j$(nproc) clean
+
+    # For some reason the Makefile of libxdc clears LDFLAGS; we remove that line
+    # so ld can find libcapstone.so.4
+    sed -i '3d' $LIBXDC_ROOT/Makefile
+
+    NO_LTO=1 LDFLAGS="-L$CAPSTONE_ROOT -L$LIBXDC_ROOT" CFLAGS="-I$CAPSTONE_ROOT/include/" make -C $LIBXDC_ROOT -j$(nproc)
+
+    export LIBS="-L$CAPSTONE_ROOT -L$LIBXDC_ROOT/"
+    export QEMU_CFLAGS="-I$CAPSTONE_ROOT/include/ -I$LIBXDC_ROOT/ $QEMU_CFLAGS"
+  '';
+
+  meta = {
+    homepage = "https://github.com/nyx-fuzz/QEMU-Nyx";
+    description = "Nyx's fork of QEMU";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.x86_64;
+    maintainers = with lib.maintainers; [ ekzyis ];
+  };
+}
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  aflplusplus,
+  python3,
+}:
+
+rustPlatform.buildRustPackage {
+  version = builtins.readFile (aflplusplus.src + "/nyx_mode/LIBNYX_VERSION");
+  pname = "libnyx";
+
+  src = aflplusplus.src;
+  postUnpack = ''
+    sourceRoot="$sourceRoot/nyx_mode/libnyx/libnyx"
+    cp ${./Cargo.lock} "$sourceRoot/Cargo.lock"
+  '';
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib
+    cp "target/${stdenv.hostPlatform.rust.rustcTarget}/release/liblibnyx.so" $out/lib/libnyx.so
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/nyx-fuzz/libnyx";
+    description = "Rust library to build hypervisor-based snapshot fuzzers";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ekzyis ];
+  };
+}
@@ -0,0 +1,98 @@
+diff --git a/nyx_mode/build_nyx_support.sh b/nyx_mode/build_nyx_support.sh
+index 9b75b7bf..b7ec92e8 100755
+--- a/nyx_mode/build_nyx_support.sh
+++ b/nyx_mode/build_nyx_support.sh
+@@ -7,7 +7,8 @@ echo "           Nyx build script"
+ echo "================================================="
+ echo
+ 
+-echo "[*] Performing basic sanity checks..."
+echo "[+] Nyx mode dependencies are built in other derivations, skipping ..."
+exit 1
+ 
+ if [ "$CI" = "true" ]; then
+ 
+diff --git a/test/test-nyx-mode.sh b/test/test-nyx-mode.sh
+index 7aaa8c5b..5f624ada 100755
+--- a/test/test-nyx-mode.sh
+++ b/test/test-nyx-mode.sh
+@@ -4,78 +4,7 @@
+ 
+ $ECHO "$BLUE[*] Testing: nyx_mode"
+ 
+-test "$CI" = "true" && {
+-  $ECHO "$YELLOW[-] nyx_mode cannot be tested in the Github CI, skipping ..."
+-} || {
+-
+- unset AFL_CC
+-
+- test -e ../libnyx.so && {
+-  ../afl-cc -o test-instr ../test-instr.c > errors 2>&1
+-  test -e test-instr && {
+-    {
+-      rm -rf nyx-test in out
+-      $ECHO "$GREY[*] running nyx_packer"
+-      python3 ../nyx_mode/packer/packer/nyx_packer.py \
+-        ./test-instr \
+-        nyx-test \
+-        afl \
+-        instrumentation \
+-        --fast_reload_mode \
+-        --purge > /dev/null 2>&1
+-
+-      test -e nyx-test/test-instr && {
+-
+-        $ECHO "$GREY[*] running nyx_config_gen"
+-        python3 ../nyx_mode/packer/packer/nyx_config_gen.py nyx-test Kernel > /dev/null 2>&1
+-        
+-        test -e nyx-test/config.ron && {
+-          sudo modprobe -r kvm-intel
+-          sudo modprobe -r kvm
+-          sudo modprobe  kvm enable_vmware_backdoor=y
+-          sudo modprobe  kvm-intel
+-          #cat /sys/module/kvm/parameters/enable_vmware_backdoor 
+-
+-          mkdir -p in
+-          echo 00000 > in/in
+-          $ECHO "$GREY[*] running afl-fuzz for nyx_mode, this will take approx 10 seconds"
+-          {
+-            AFL_DEBUG=1 ../afl-fuzz -i in -o out -V05 -X -- ./nyx-test >>errors 2>&1
+-          } >>errors 2>&1
+-          test -n "$( ls out/default/queue/id:000002* 2>/dev/null )" && {
+-            $ECHO "$GREEN[+] afl-fuzz is working correctly with nyx_mode"
+-            RUNTIME=`grep execs_done out/default/fuzzer_stats | awk '{print$3}'`
+-            rm -rf errors nyx-test test-instr in out
+-          } || {
+-            echo CUT------------------------------------------------------------------CUT
+-            cat errors
+-            echo CUT------------------------------------------------------------------CUT
+-            $ECHO "$RED[!] afl-fuzz is not working correctly with nyx_mode"
+-            CODE=1
+-          }
+-        } || {
+-          $ECHO "$RED[!] nyx_packer failed, likely install requirements not met."
+-          CODE=1
+-        }
+-      } || {
+-       $ECHO "$RED[!] nyx_packer failed, likely install requirements not met."
+-       CODE=1
+-      }
+-      #rm -rf test-instr in out errors nyx-test
+-    }
+-  } || {
+-    echo CUT------------------------------------------------------------------CUT
+-    cat errors
+-    echo CUT------------------------------------------------------------------CUT
+-    $ECHO "$RED[!] afl-cc compilation of test targets failed - what is going on??"
+-    CODE=1
+-  }
+- } || {
+-  $ECHO "$YELLOW[-] nyx_mode is not compiled, cannot test"
+-  INCOMPLETE=1
+- }
+-
+-}
+$ECHO "$GREY[-] nyx_mode cannot be tested inside the sandbox"
+ 
+ . ./test-post.sh
+ 
@@ -0,0 +1,156 @@
+{
+  stdenv,
+  lib,
+  callPackage,
+  fetchFromGitHub,
+  cpio,
+  gzip,
+  glibc,
+  pkgsi686Linux,
+  pax-utils,
+  makeWrapper,
+  python3,
+  aflplusplus,
+  qemu-nyx,
+}:
+
+# this derivation assumes x86_64-linux
+assert stdenv.targetPlatform.system == "x86_64-linux";
+
+let
+  python3WithPkgs = python3.withPackages (ps: [
+    ps.msgpack
+    ps.jinja2
+  ]);
+in
+stdenv.mkDerivation {
+  version = builtins.readFile (aflplusplus.src + "/nyx_mode/PACKER_VERSION");
+  pname = "nyx-packer";
+
+  src = aflplusplus.src;
+  postUnpack = ''
+    sourceRoot="$sourceRoot/nyx_mode/packer"
+  '';
+
+  patches = [
+    # this patch does following things:
+    #   * write default config to ~/.nyx/nyx.ini because nix store is read-only
+    #   * fix https://github.com/nyx-fuzz/packer/issues/35
+    #   * apply Matt Morehouse's patch (https://github.com/nyx-fuzz/packer/pull/34)
+    ./packer.patch
+  ];
+
+  strictDeps = true;
+
+  # compile_64.sh / compile_loader use -O0; _FORTIFY_SOURCE needs optimization
+  hardeningDisable = [ "fortify" ];
+
+  nativeBuildInputs = [
+    cpio
+    gzip
+    makeWrapper
+  ];
+
+  buildInputs = [
+    glibc
+    glibc.static
+    pkgsi686Linux.glibc
+  ];
+
+  dontConfigure = true;
+
+  postPatch = ''
+    substituteInPlace packer/common/config.py \
+      --replace-fail \
+        '"QEMU-PT_PATH": "../../QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64"' \
+        '"QEMU-PT_PATH": "${qemu-nyx}/bin/qemu-system-x86_64"'
+
+    # fix paths to shared libraries that assume debian FHS
+    substituteInPlace linux_initramfs/pack.sh \
+      --replace-fail \
+        'cp -L /lib/ld-linux.so.2' \
+        'cp -L ${pkgsi686Linux.glibc}/lib/ld-linux.so.2' \
+      --replace-fail \
+        'cp -L /lib/x86_64-linux-gnu/libdl.so.2' \
+        'cp -L ${glibc}/lib/libdl.so.2' \
+      --replace-fail \
+        'cp -L /lib/x86_64-linux-gnu/libc.so.6' \
+        'cp -L ${glibc}/lib/libc.so.6' \
+      --replace-fail \
+        'cp -L /lib64/ld-linux-x86-64.so.2' \
+        'cp -L ${glibc}/lib/ld-linux-x86-64.so.2' \
+      --replace-fail \
+        'cp -L /lib64/libdl.so.2' \
+        'cp -L ${glibc}/lib/libdl.so.2' \
+      --replace-fail \
+        'cp -L /lib64/libc.so.6' \
+        'cp -L ${glibc}/lib/libc.so.6' \
+      --replace-fail \
+        'cp -L /lib32/libc.so.6' \
+        'cp -L ${pkgsi686Linux.glibc}/lib/libc.so.6' \
+      --replace-fail \
+        'cp -L /lib32/libdl.so.2' \
+        'cp -L ${pkgsi686Linux.glibc}/lib/libdl.so.2' \
+      --replace-fail \
+        'cp /lib/x86_64-linux-gnu/libnss_compat.so.2' \
+        'cp -L ${glibc}/lib/libnss_compat.so.2' \
+      --replace-fail \
+        'cp /lib64/libnss_compat.so.2' \
+        'cp ${glibc}/lib/libnss_compat.so.2'
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd packer/linux_x86_64-userspace
+    echo "+ bash -e compile_64.sh"
+    bash -e compile_64.sh
+    popd
+
+    pushd linux_initramfs
+    echo "+ bash -e pack.sh"
+    bash -e pack.sh
+    popd
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # copy build tree so python scripts can assume regular relative paths
+    cp -r . "$out" && chmod -R u+w "$out"
+
+    PATH="${python3WithPkgs}/bin:$PATH" patchShebangs --build $out/packer
+    wrapProgram $out/packer/nyx_packer.py \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          pax-utils
+          qemu-nyx
+        ]
+      }
+    wrapProgram $out/packer/nyx_config_gen.py \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          pax-utils
+          qemu-nyx
+        ]
+      }
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # packer binaries are meant to run inside the vm
+    find "$out/packer/linux_x86_64-userspace/bin64" -type f \
+      -exec patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 {} \;
+  '';
+
+  meta = {
+    homepage = "https://github.com/nyx-fuzz/packer";
+    description = "image packer for Nyx VMs";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.x86_64;
+    maintainers = with lib.maintainers; [ ekzyis ];
+  };
+}
@@ -0,0 +1,103 @@
+diff --git a/linux_initramfs/pack.sh b/linux_initramfs/pack.sh
+index e042bb5..f04c0a1 100644
+--- a/linux_initramfs/pack.sh
+++ b/linux_initramfs/pack.sh
+@@ -40,15 +40,17 @@ mkdir rootTemplate/lib/i386-linux-gnu/
+ mkdir rootTemplate/lib/x86_64-linux-gnu/
+ 
+ cp -L /lib/ld-linux.so.2 rootTemplate/lib/ld-linux.so.2
+-cp -L /lib64/ld-linux-x86-64.so.2 rootTemplate/lib64/ld-linux-x86-64.so.2
+ cp -L /lib/x86_64-linux-gnu/libdl.so.2 rootTemplate/lib/x86_64-linux-gnu/libdl.so.2
+ cp -L /lib/x86_64-linux-gnu/libc.so.6 rootTemplate//lib/x86_64-linux-gnu/libc.so.6
+cp -L /lib64/ld-linux-x86-64.so.2 rootTemplate/lib64/ld-linux-x86-64.so.2
+cp -L /lib64/libdl.so.2 rootTemplate/lib64/libdl.so.2
+cp -L /lib64/libc.so.6 rootTemplate/lib64/libc.so.6
+ cp -L /lib32/libc.so.6  rootTemplate//lib32/libc.so.6
+-cp -L /lib/ld-linux.so.2 rootTemplate/lib/ld-linux.so.2
+ cp -L /lib32/libdl.so.2 rootTemplate/lib32/libdl.so.2
+ 
+ # fix nasty nss bugs (getpwnam_r, ...)
+ cp /lib/x86_64-linux-gnu/libnss_compat.so.2 rootTemplate//lib/x86_64-linux-gnu/
+cp /lib64/libnss_compat.so.2 rootTemplate/lib64/
+ 
+ cp -r "rootTemplate" "init"
+ sed '/START/c\./loader' init/init_template > init/init
+diff --git a/linux_initramfs/rootTemplate/init_template b/linux_initramfs/rootTemplate/init_template
+index 0d29602..f555082 100755
+--- a/linux_initramfs/rootTemplate/init_template
+++ b/linux_initramfs/rootTemplate/init_template
+@@ -19,7 +19,7 @@ adduser --gecos "ubuntu" --disabled-password --ingroup ubuntu ubuntu
+ echo "ubuntu:ubuntu" | chpasswd
+ 
+ # multiarch support
+-export LD_LIBRARY_PATH=/lib32
+export LD_LIBRARY_PATH=/lib64:/lib32
+ 
+ START
+ #./loader
+diff --git a/packer/common/config.py b/packer/common/config.py
+index 74f2b2e..e0fcf3a 100644
+--- a/packer/common/config.py
+++ b/packer/common/config.py
+@@ -39,7 +39,7 @@ default_config = {
+                   "QEMU-PT_PATH": "../../QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64",
+                   "KERNEL": "../linux_initramfs/bzImage-linux-4.15-rc7",
+                   "INIT_RAMFS": "../linux_initramfs/init.cpio.gz",
+-                  "DEFAULT_FUZZER_CONFIG_FOLDER": "./fuzzer_configs/",
+                  "DEFAULT_FUZZER_CONFIG_FOLDER": os.path.expanduser("~/.nyx/fuzzer_configs/"),
+                   "DEFAULT_VM_HDA": "",
+                   "DEFAULT_VM_PRESNAPSHOT": "",
+                   }
+@@ -149,6 +149,9 @@ class ConfigReader(object):
+     def __init_config(self, config_file):    
+         if not os.path.exists(config_file):
+             print("Configuration \"%s\" not found -> Creating..."%(os.path.realpath(config_file)))
+            config_dir = os.path.dirname(os.path.abspath(config_file))
+            os.makedirs(config_dir, exist_ok=True)
+            os.makedirs(config_dir+"/fuzzer_configs/", exist_ok=True)
+             f = open(config_file, "w")
+             config = configparser.ConfigParser()
+             config["Packer"] = {}
+@@ -261,7 +264,7 @@ class PackerConfiguration:
+             self.load_old_state = False
+ 
+     def __load_config(self):
+-        self.config_values = ConfigReader(os.path.dirname(os.path.realpath(__file__))+"/../nyx.ini", self.__config_section, self.__config_default).get_values()
+        self.config_values = ConfigReader(os.path.expanduser("~/.nyx/nyx.ini"), self.__config_section, self.__config_default).get_values()
+ 
+     def __load_arguments(self):
+         modes = ["afl", "spec"]
+@@ -344,7 +347,7 @@ class ConfigGeneratorConfiguration:
+             self.load_old_state = False
+ 
+     def __load_config(self):
+-        self.config_values = ConfigReader(os.path.dirname(os.path.realpath(__file__)) +"/../nyx.ini", self.__config_section, self.__config_default).get_values()
+        self.config_values = ConfigReader(os.path.expanduser("~/.nyx/nyx.ini"), self.__config_section, self.__config_default).get_values()
+ 
+     def __load_arguments(self):
+ 
+diff --git a/packer/common/self_check.py b/packer/common/self_check.py
+index 10f2405..e16ac37 100644
+--- a/packer/common/self_check.py
+++ b/packer/common/self_check.py
+@@ -170,12 +170,14 @@ def check_apple_ignore_msrs(config):
+ 
+ 
+ def check_nyx_ini():
+-    if not os.path.exists(os.path.dirname(sys.argv[0])+"/nyx.ini") and not os.path.exists("nyx.ini"):
+-        from common.config import FuzzerConfiguration
+-        FuzzerConfiguration(skip_args=True).create_initial_config()
+-        print(WARNING + WARNING_PREFIX + "nyx.ini file does not exist. Creating..." + ENDC)
+-        return False
+-    return True
+    # comment this code out because FuzzerConfiguration does not exist
+    # see https://github.com/nyx-fuzz/packer/issues/35
+    # if not os.path.exists(os.path.dirname(sys.argv[0])+"/nyx.ini") and not os.path.exists("nyx.ini"):
+    #     from common.config import FuzzerConfiguration
+    #     FuzzerConfiguration(skip_args=True).create_initial_config()
+    #     print(WARNING + WARNING_PREFIX + "nyx.ini file does not exist. Creating..." + ENDC)
+    #     return False
+    return os.path.exists(os.path.expanduser("~/.nyx/nyx.ini"))
+ 
+ 
+ def check_qemu_version(config):
@@ -19,14 +19,14 @@ let
    }:
    buildNpmPackage rec {
      pname = name;
-      version = "2026.3.0";
+      version = "2026.4.0";
      nodejs = nodejs_22;

      src = fetchFromGitHub {
        owner = "bitwarden";
        repo = "directory-connector";
        rev = "v${version}";
-        hash = "sha256-MfYFxcK0pqwIGBJFMVbmSUaGyrwLhMzdSoO6q46F9l8=";
+        hash = "sha256-FcT+rZkSqlDjSXjmNTHWoNXzW8WPo8LTED8Do5sDvwE=";
      };

      postPatch = ''
@@ -38,7 +38,7 @@ let
          --replace-fail "AppImage" "dir"
      '';

-      npmDepsHash = "sha256-c3Q+b+ZS6nXPuSPq8CZliDYfpN/HIH49tIcGj3bVmLg=";
+      npmDepsHash = "sha256-kFuSCcIWAEJ0KNVqEabjqqSZ8CVBbPyxkAxhrbRBqVc=";

      env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

@@ -1658,6 +1658,8 @@ with pkgs;

  intel-oneapi = recurseIntoAttrs (callPackage ../development/libraries/intel-oneapi { });

+  intelLlvmStdenv = intel-llvm.stdenv;
+
  cambrinary = python3Packages.callPackage ../applications/misc/cambrinary { };

  cplex = callPackage ../applications/science/math/cplex (config.cplex or { });