Merge 60ac0f6687 into haskell-updates

2026-02-10 00:34:38 +00:00
parent a1594bb47c 60ac0f6687
commit ed294aa6ff
406 changed files with 3934 additions and 1804 deletions
@@ -97,6 +97,10 @@

 - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce`

+- `peertube` has been updated from `7.3.0` to `8.0.2`, introducing several breaking changes.
+  Some notable new features include channel collaboration and video player redesign with a new theme.
+  For details on how to upgrade, see the `IMPORTANT NOTES` section of the [v8.0.0 CHANGELOG entry](https://docs.joinpeertube.org/CHANGELOG#v8-0-0).
+
 - `python3Packages.gradio` has been updated to version 6. See upstream's migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.

 - `vicinae` has been updated to v0.17. Version 0.17 contains a complete overhaul of the configuration system. For update instructions, see the [release notes for v0.17.0](https://github.com/vicinaehq/vicinae/releases/tag/v0.17.0) and the [upstream configuration documentation](https://docs.vicinae.com/config).
@@ -588,6 +588,11 @@
      { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
    ];
  };
+  adam-tj = {
+    github = "adam-tj";
+    githubId = 9314405;
+    name = "Adam Tjörnhammar";
+  };
  adam248 = {
    email = "adamjbutler091@gmail.com";
    github = "adam248";
@@ -1044,7 +1049,7 @@
    keys = [ { fingerprint = "F354 FFAB EA89 A49D 33ED  2590 4729 B829 AC5F CC72"; } ];
  };
  ALameLlama = {
-    email = "NicholasACiechanowski@gmail.com";
+    email = "nicholas@ciech.anow.ski";
    name = "Nicholas Ciechanowski";
    github = "ALameLlama";
    githubId = 55490546;
@@ -1416,6 +1421,12 @@
      { fingerprint = "DF68 C500 4024 23CC F9C5  E6CA 3D17 C832 4696 FE70"; }
    ];
  };
+  alper-han = {
+    email = "contact@zynix.net";
+    github = "alper-han";
+    githubId = 89567766;
+    name = "Zynix";
+  };
  alternateved = {
    email = "alternateved@pm.me";
    github = "alternateved";
@@ -4944,6 +4955,12 @@
    githubId = 136485;
    name = "Chad Jablonski";
  };
+  cjimti = {
+    email = "cj@imti.co";
+    github = "cjimti";
+    githubId = 356698;
+    name = "Craig Johnston";
+  };
  cjshearer = {
    email = "cjshearer@live.com";
    github = "cjshearer";
@@ -7903,6 +7920,7 @@
    email = "eric@eric.dev.br";
    github = "EpicEric";
    githubId = 3129194;
+    matrix = "@epiceric:nixos.dev";
    name = "Eric Rodrigues Pires";
  };
  epireyn = {
@@ -20715,6 +20733,12 @@
    github = "philipwilk";
    githubId = 50517631;
  };
+  philocalyst = {
+    name = "Myles Wirth";
+    email = "milestheperson@posteo.net";
+    github = "philocalyst";
+    githubId = 114884788;
+  };
  philtaken = {
    email = "philipp.herzog@protonmail.com";
    github = "philtaken";
@@ -21697,6 +21721,12 @@
    githubId = 115877;
    name = "Kenny Shen";
  };
+  qrzbing = {
+    email = "qrzbing@foxmail.com";
+    github = "qrzbing";
+    githubId = 23500397;
+    name = "qrzbing";
+  };
  quadradical = {
    email = "nixos@henryhiles.com";
    github = "Henry-Hiles";
@@ -23238,6 +23268,12 @@
    githubId = 12877905;
    name = "Roman Volosatovs";
  };
+  rwxd = {
+    email = "git@rwxd.de";
+    github = "rwxd";
+    githubId = 40308458;
+    name = "rwxd";
+  };
  rxiao = {
    email = "ben.xiao@me.com";
    github = "benxiao";
@@ -24773,6 +24809,14 @@
    githubId = 1505617;
    name = "Sean Lee";
  };
+  sleroq = {
+    name = "Sleroq";
+    email = "sleroq@cum.army";
+    github = "sleroq";
+    matrix = "@sleroq:sleroq.link";
+    githubId = 52239427;
+    keys = [ { fingerprint = "2502 640F 4254 7933 FEF1  7A33 3414 5C1D B76E 618F"; } ];
+  };
  SlothOfAnarchy = {
    email = "slothofanarchy1@gmail.com";
    matrix = "@michel.weitbrecht:helsinki-systems.de";
@@ -27130,12 +27174,6 @@
    githubId = 5623227;
    name = "Quentin Boyer";
  };
-  TredwellGit = {
-    email = "tredwell@tutanota.com";
-    github = "TredwellGit";
-    githubId = 61860346;
-    name = "Tredwell";
-  };
  treemo = {
    email = "matthieu.chevrier@treemo.fr";
    github = "treemo";
@@ -27673,6 +27711,12 @@
    github = "deviant";
    githubId = 68829907;
  };
+  v3rm1n0 = {
+    name = "Niklas Choinowski";
+    email = "niklas.choinowski@proton.me";
+    github = "v3rm1n0";
+    githubId = 57269010;
+  };
  vaavaav = {
    name = "Pedro Peixoto";
    github = "vaavaav";
@@ -4,7 +4,7 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- Create the first release note entry in this section!
+- The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.

 ## New Modules {#sec-release-26.05-new-modules}

@@ -58,6 +58,8 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
+
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.

 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
@@ -84,6 +86,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
  - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`.
  - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.

+- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
@@ -153,6 +157,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
+
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.

 - Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
@@ -0,0 +1,19 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.hardware.hid-fanatecff;
+  inherit (config.boot.kernelPackages) hid-fanatecff;
+  inherit (lib) maintainers mkEnableOption mkIf;
+in
+{
+  options.hardware.hid-fanatecff = {
+    enable = mkEnableOption "hid-fanatecff, a Linux kernel driver that aims to add support for Fanatec devices";
+  };
+
+  config = mkIf cfg.enable {
+    boot.extraModulePackages = [ hid-fanatecff ];
+    services.udev.packages = [ hid-fanatecff ];
+  };
+
+  meta.maintainers = with maintainers; [ rake5k ];
+}
@@ -74,6 +74,7 @@
  ./hardware/gpgsmartcards.nix
  ./hardware/graphics.nix
  ./hardware/hackrf.nix
+  ./hardware/hid-fanatecff.nix
  ./hardware/i2c.nix
  ./hardware/infiniband.nix
  ./hardware/inputmodule.nix
@@ -557,6 +558,7 @@
  ./services/desktops/blueman.nix
  ./services/desktops/bonsaid.nix
  ./services/desktops/cpupower-gui.nix
+  ./services/desktops/crossmacro.nix
  ./services/desktops/dleyna.nix
  ./services/desktops/dunst.nix
  ./services/desktops/espanso.nix
@@ -0,0 +1,119 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.crossmacro;
+in
+{
+  options.services.crossmacro = {
+    enable = lib.mkEnableOption "CrossMacro, a cross-platform mouse and keyboard macro application";
+
+    package = lib.mkPackageOption pkgs "crossmacro" { };
+
+    daemonPackage = lib.mkPackageOption pkgs "crossmacro-daemon" { };
+
+    users = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "alice"
+        "bob"
+      ];
+      description = "List of users granted permission to use CrossMacro.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.users != [ ];
+        message = "CrossMacro: You must specify at least one user. Set `services.crossmacro.users`.";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    hardware.uinput.enable = true;
+
+    services.udev.extraRules = ''
+      KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"
+      ACTION=="add|change", KERNEL=="event*", ATTRS{name}=="CrossMacro Virtual Input Device", ENV{LIBINPUT_ATTR_POINTER_ACCEL}="0"
+    '';
+
+    environment.etc."polkit-1/actions/org.crossmacro.policy".source =
+      "${cfg.daemonPackage}/share/polkit-1/actions/org.crossmacro.policy";
+
+    environment.etc."polkit-1/rules.d/50-crossmacro.rules".source =
+      "${cfg.daemonPackage}/share/polkit-1/rules.d/50-crossmacro.rules";
+
+    users.groups.crossmacro = { };
+
+    users.users =
+      lib.listToAttrs (
+        map (user: {
+          name = user;
+          value = {
+            extraGroups = [ "crossmacro" ];
+          };
+        }) cfg.users
+      )
+      // {
+        crossmacro = {
+          isSystemUser = true;
+          group = "input";
+          extraGroups = [
+            "crossmacro"
+            "uinput"
+          ];
+          description = "CrossMacro Input Daemon User";
+        };
+      };
+
+    systemd.services.crossmacro = {
+      description = "CrossMacro Input Daemon Service";
+      documentation = [ "https://github.com/alper-han/CrossMacro" ];
+
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "dbus.service"
+        "polkit.service"
+      ];
+      wants = [
+        "dbus.service"
+        "polkit.service"
+      ];
+
+      path = [ pkgs.polkit ];
+
+      serviceConfig = {
+        Type = "notify";
+        User = "crossmacro";
+        Group = "input";
+        ExecStart = lib.getExe cfg.daemonPackage;
+        Restart = "always";
+        RestartSec = 5;
+        RuntimeDirectory = "crossmacro";
+        RuntimeDirectoryMode = "0755";
+        CapabilityBoundingSet = [
+          "CAP_SYS_ADMIN"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_DAC_READ_SEARCH"
+        ];
+        AmbientCapabilities = [
+          "CAP_SYS_ADMIN"
+          "CAP_CHOWN"
+          "CAP_DAC_READ_SEARCH"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ alper-han ];
+}
@@ -7,11 +7,22 @@
 let
  cfg = config.services.n8n;

-  envVarToCredName = varName: lib.toLower varName;
-
  # Partition environment variables into regular and file-based (_FILE suffix)
-  regularEnv = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) cfg.environment;
-  fileBasedEnv = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) cfg.environment;
+  envVarToCredName = varName: lib.toLower varName;
+  partitionEnv =
+    env:
+    let
+      regular = lib.filterAttrs (name: _value: !(lib.hasSuffix "_FILE" name)) env;
+      fileBased = lib.filterAttrs (name: _value: lib.hasSuffix "_FILE" name) env;
+      fileBasedTransformed = lib.mapAttrs' (
+        varName: _secretPath: lib.nameValuePair varName "%d/${envVarToCredName varName}"
+      ) fileBased;
+    in
+    {
+      inherit regular fileBased fileBasedTransformed;
+    };
+
+  n8nEnv = partitionEnv cfg.environment;

  customNodesDir = pkgs.linkFarm "n8n-custom-nodes" (
    map (pkg: {
@@ -19,12 +30,6 @@ let
      path = "${pkg}/lib/node_modules/${pkg.pname}";
    }) cfg.customNodes
  );
-
-  # Transform file-based env vars to point to credentials directory
-  fileBasedEnvTransformed = lib.mapAttrs' (
-    varName: _secretPath: lib.nameValuePair varName "%d/${envVarToCredName varName}"
-  ) fileBasedEnv;
-
 in
 {
  imports = [
@@ -135,14 +140,14 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      environment =
-        regularEnv
+        n8nEnv.regular
        // {
-          HOME = config.services.n8n.environment.N8N_USER_FOLDER;
+          HOME = cfg.environment.N8N_USER_FOLDER;
        }
        // lib.optionalAttrs (cfg.customNodes != [ ]) {
          N8N_CUSTOM_EXTENSIONS = toString customNodesDir;
        }
-        // fileBasedEnvTransformed;
+        // n8nEnv.fileBasedTransformed;
      serviceConfig = {
        Type = "simple";
        ExecStart = lib.getExe cfg.package;
@@ -151,7 +156,7 @@ in

        LoadCredential = lib.mapAttrsToList (
          varName: secretPath: "${envVarToCredName varName}:${secretPath}"
-        ) fileBasedEnv;
+        ) n8nEnv.fileBased;

        # Basic Hardening
        NoNewPrivileges = "yes";
@@ -660,46 +660,66 @@ in
        }
      );

-      systemd.services = toHardenedClientAttrs (
-        client:
-        nameValuePair client.service.name (
-          mkIf client.hardened {
-            serviceConfig = {
-              RuntimeDirectoryMode = "0750";
+      systemd.services = mkMerge [
+        # netbird services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair client.service.name (
+            mkIf client.hardened {
+              serviceConfig = {
+                RuntimeDirectoryMode = "0750";

-              User = client.user.name;
-              Group = client.user.group;
+                User = client.user.name;
+                Group = client.user.group;

-              # settings implied by DynamicUser=true, without actually using it,
-              # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
-              RemoveIPC = true;
-              PrivateTmp = true;
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
+                # settings implied by DynamicUser=true, without actually using it,
+                # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+                RemoveIPC = true;
+                PrivateTmp = true;
+                ProtectSystem = "strict";
+                ProtectHome = "yes";

-              AmbientCapabilities = [
-                # see https://man7.org/linux/man-pages/man7/capabilities.7.html
-                # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
-                #
-                # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
-                # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
-                #  see https://github.com/netbirdio/netbird/pull/1513
+                AmbientCapabilities = [
+                  # see https://man7.org/linux/man-pages/man7/capabilities.7.html
+                  # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
+                  #
+                  # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
+                  # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
+                  #  see https://github.com/netbirdio/netbird/pull/1513

-                # failed creating tunnel interface wt-priv: [operation not permitted
-                "CAP_NET_ADMIN"
-                # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
-                "CAP_NET_RAW"
-              ]
-              # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
-              ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
-              ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
-              ++ optional (
-                client.dns-resolver.address != null && client.dns-resolver.port < 1024
-              ) "CAP_NET_BIND_SERVICE";
-            };
-          }
-        )
-      );
+                  # failed creating tunnel interface wt-priv: [operation not permitted
+                  "CAP_NET_ADMIN"
+                  # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
+                  "CAP_NET_RAW"
+                ]
+                # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
+                ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
+                ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
+                ++ optional (
+                  client.dns-resolver.address != null && client.dns-resolver.port < 1024
+                ) "CAP_NET_BIND_SERVICE";
+              };
+            }
+          )
+        ))
+        # netbird-login services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair "${client.service.name}-login" (
+            mkIf client.hardened {
+              serviceConfig = {
+                User = client.user.name;
+                Group = client.user.group;
+
+                RemoveIPC = true;
+                PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
+                ProtectSystem = "strict";
+                ProtectHome = "yes";
+              };
+            }
+          )
+        ))
+      ];

      # see https://github.com/systemd/systemd/blob/17f3e91e8107b2b29fe25755651b230bbc81a514/src/resolve/org.freedesktop.resolve1.policy#L43-L43
      # see all actions used at https://github.com/netbirdio/netbird/blob/13e7198046a0d73a9cd91bf8e063fafb3d41885c/client/internal/dns/systemd_linux.go#L29-L32
@@ -736,14 +756,6 @@ in
              Type = "oneshot";
              RemainAfterExit = true;

-              User = client.user.name;
-              Group = client.user.group;
-
-              RemoveIPC = true;
-              PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
-
              LoadCredential = [ "setup-key:${client.login.setupKeyFile}" ];
            };

@@ -168,13 +168,12 @@ in
      enable = true;

      virtualHosts.${cfg.domain} = {
-        locations = {
-          "/" = {
-            root = cfg.finalDrv;
-            tryFiles = "$uri $uri.html $uri/ =404";
-          };
+        root = cfg.finalDrv;

-          "/404.html".extraConfig = ''
+        locations = {
+          "/".tryFiles = "$uri $uri.html $uri/ =404";
+
+          "= /404.html".extraConfig = ''
            internal;
          '';
        };
@@ -21,6 +21,8 @@ let
    // {
      description = "value coercible to CLI argument";
    };
+  format = pkgs.formats.yaml { };
+  blueprint-file = format.generate "blueprint.yml" cfg.blueprint;
 in
 {
  imports = [
@@ -48,13 +50,35 @@ in
        };
        description = "Settings for Newt module, see [Newt CLI docs](https://github.com/fosrl/newt?tab=readme-ov-file#cli-args) for more information.";
      };
+      blueprint = lib.mkOption {
+        inherit (format) type;
+        default = { };
+        example = {
+          proxy-resources = {
+            jellyfin = {
+              name = "Jellyfin";
+              protocol = "http";
+              full-domain = "jfn.example.com";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = 8096;
+                }
+              ];
+              auth.sso-enabled = true;
+            };
+          };
+        };
+        description = "Blueprint for declarative settings, see [Newt Blueprint docs](https://docs.pangolin.net/manage/blueprints#blueprints) for more information.";
+      };

      # provide path to file to keep secrets out of the nix store
      environmentFile = lib.mkOption {
        type = with lib.types; nullOr path;
        default = null;
        description = ''
-          Path to a file containing sensitive environment variables for Newt. See <https://docs.fossorial.io/Newt/overview#cli-args>
+          Path to a file containing sensitive environment variables for Newt. See [Client credentials](https://docs.pangolin.net/manage/clients/credentials) for more information.
          These will overwrite anything defined in the config.
          The file should contain environment-variable assignments like:
          NEWT_ID=2ix2t8xk22ubpfy
@@ -81,9 +105,10 @@ in
      environment = {
        HOME = "/var/lib/private/newt";
      };
-      # the flag values will all be overwritten if also defined in the env file
      serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toCommandLineShellGNU { } cfg.settings}";
+        ExecStart = "${lib.getExe cfg.package} ${
+          lib.cli.toCommandLineShellGNU { } (lib.recursiveUpdate cfg.settings { inherit blueprint-file; })
+        }";
        DynamicUser = true;
        StateDirectory = "newt";
        StateDirectoryMode = "0700";
@@ -16,13 +16,20 @@ let

  configFile = pkgs.writeText "chrony.conf" ''
    ${lib.concatMapStringsSep "\n" (
-      server: "server " + server + " " + cfg.serverOption + lib.optionalString (cfg.enableNTS) " nts"
+      server:
+      (if lib.strings.hasInfix "pool" server then "pool " else "server ")
+      + server
+      + " "
+      + cfg.serverOption
+      + lib.optionalString (cfg.enableNTS) " nts"
    ) cfg.servers}

    ${lib.optionalString (
      cfg.initstepslew.enabled && (cfg.servers != [ ])
    ) "initstepslew ${toString cfg.initstepslew.threshold} ${lib.concatStringsSep " " cfg.servers}"}

+    ${lib.optionalString cfg.makestep.enable "makestep ${toString cfg.makestep.threshold} ${toString cfg.makestep.limit}"}
+
    driftfile ${driftFile}
    keyfile ${keyFile}
    ${lib.optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
@@ -43,6 +50,20 @@ let
  ]
  ++ lib.optional cfg.enableMemoryLocking "-m"
  ++ cfg.extraFlags;
+
+  dispathcerScriptFile = pkgs.callPackage (
+    {
+      runCommand,
+      srcOnly,
+    }:
+    runCommand "10-chrony-onoffline" { } ''
+      cp ${srcOnly chronyPkg}/examples/chrony.nm-dispatcher.onoffline $out
+      substituteInPlace $out \
+        --replace-fail '/usr/bin/chronyc' '${chronyPkg}/bin/chronyc'
+      chmod +x $out
+      patchShebangs $out
+    ''
+  ) { };
 in
 {
  options = {
@@ -134,8 +155,9 @@ in
      initstepslew = {
        enabled = lib.mkOption {
          type = lib.types.bool;
-          default = true;
+          default = false;
          description = ''
+            DEPRECATED. Consider using `services.chrony.makestep` instead.
            Allow chronyd to make a rapid measurement of the system clock error
            at boot time, and to correct the system clock by stepping before
            normal operation begins.
@@ -153,12 +175,51 @@ in
        };
      };

+      makestep = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = ''
+            Allow chronyd to step the system clock if the error is larger than
+            the specified threshold.
+          '';
+        };
+
+        threshold = lib.mkOption {
+          type = lib.types.either lib.types.float lib.types.int;
+          default = 0.1;
+          description = ''
+            The threshold of system clock error (in seconds) above which the
+            clock will be stepped. If the correction required is less than the
+            threshold, a slew is used instead.
+          '';
+        };
+
+        limit = lib.mkOption {
+          type = lib.types.ints.positive;
+          default = 3;
+          description = ''
+            The maximum number of times the system clock will be stepped.
+          '';
+        };
+      };
+
      directory = lib.mkOption {
        type = lib.types.str;
        default = "/var/lib/chrony";
        description = "Directory where chrony state is stored.";
      };

+      dispatcherScript = lib.mkOption {
+        type = lib.types.bool;
+        default = config.networking.networkmanager.enable;
+        defaultText = lib.literalExpression "config.networking.networkmanager.enable";
+        description = ''
+          Whether to install the chrony NetworkManager dispatcher script
+          to handle connectivity changes.
+        '';
+      };
+
      extraConfig = lib.mkOption {
        type = lib.types.lines;
        default = "";
@@ -194,6 +255,13 @@ in
      home = stateDir;
    };

+    networking.networkmanager.dispatcherScripts = lib.mkIf cfg.dispatcherScript [
+      {
+        type = "basic";
+        source = dispathcerScriptFile;
+      }
+    ];
+
    services.timesyncd.enable = lib.mkForce false;

    # If chrony controls and tracks the RTC, writing it externally causes clock error.
@@ -46,7 +46,7 @@ let
      approval-prompt = approvalPrompt;
      basic-auth-password = basicAuthPassword;
      client-id = clientID;
-      client-secret = clientSecret;
+      client-secret-file = if clientSecretFile != null then "%d/client-secret" else null;
      custom-templates-dir = customTemplatesDir;
      email-domain = email.domains;
      http-address = httpAddress;
@@ -71,9 +71,9 @@ let
          secure
          expire
          name
-          secret
          refresh
          ;
+        secret-file = if cookie.secretFile != null then "%d/cookie-secret" else null;
        httponly = cookie.httpOnly;
      };
      set-xauthrequest = setXauthrequest;
@@ -159,6 +159,7 @@ in

    clientID = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
+      default = null;
      description = ''
        The OAuth Client ID.
      '';
@@ -174,11 +175,13 @@ in
      example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
    };

-    clientSecret = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+    clientSecretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
      description = ''
-        The OAuth Client Secret.
+        The path to a file containing the OAuth Client Secret.
      '';
+      example = "/run/keys/oauth2-client-secret";
    };

    skipAuthRegexes = lib.mkOption {
@@ -423,11 +426,13 @@ in
        example = "168h0m0s";
      };

-      secret = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      secretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
        description = ''
-          The seed string for secure cookies.
+          The path to a file containing the seed string for secure cookies.
        '';
+        example = "/run/keys/oauth2-cookie-secret";
      };

      secure = lib.mkOption {
@@ -595,14 +600,23 @@ in

  imports = [
    (lib.mkRenamedOptionModule [ "services" "oauth2_proxy" ] [ "services" "oauth2-proxy" ])
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "clientSecret" ] ''
+      This option has been removed as it made the client secret world-readable.
+      Use services.oauth2-proxy.clientSecretFile instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "cookie" "secret" ] ''
+      This option has been removed as it made the cookie secret world-readable.
+      Use services.oauth2-proxy.cookie.secretFile instead.
+    '')
  ];

  config = lib.mkIf cfg.enable {
-    services.oauth2-proxy = lib.mkIf (cfg.keyFile != null) {
-      clientID = lib.mkDefault null;
-      clientSecret = lib.mkDefault null;
-      cookie.secret = lib.mkDefault null;
-    };
+    assertions = [
+      {
+        assertion = cfg.clientID != null || cfg.keyFile != null;
+        message = "Either services.oauth2-proxy.clientID or services.oauth2-proxy.keyFile must be specified.";
+      }
+    ];

    users.users.oauth2-proxy = {
      description = "OAuth2 Proxy";
@@ -633,6 +647,9 @@ in
          Restart = "always";
          ExecStart = "${lib.getExe cfg.package} ${configString}";
          EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
+          LoadCredential =
+            lib.optional (cfg.clientSecretFile != null) "client-secret:${cfg.clientSecretFile}"
+            ++ lib.optional (cfg.cookie.secretFile != null) "cookie-secret:${cfg.cookie.secretFile}";
        };
      };
  };
@@ -735,7 +735,7 @@ in

        echo "exit( \$this->getPrimaryDB()->tableExists( 'user' ) ? 1 : 0 );" | \
        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/run.php eval --conf ${mediawikiConfig} && \
-        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/run.php ${pkg}/share/mediawiki/maintenance/install.php \
          --confpath /tmp \
          --scriptpath / \
          --dbserver ${lib.escapeShellArg dbAddr} \
@@ -242,9 +242,6 @@ in
          }
        ];

-        # Bcachefs upstream recommends using the latest kernel
-        boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
-
        # needed for systemd-remount-fs
        system.fsPackages = [ cfg.package ];
        services.udev.packages = [ cfg.package ];
@@ -29,8 +29,7 @@
  enableOCR = true;

  testScript = ''
-    machine.succeed(":")
-    # ^ this create a screen
+    machine.wait_for_unit("multi-user.target")

    with subtest("ensure we can open a tty"):
      machine.wait_for_text("machine login:")
@@ -38,6 +37,8 @@
      machine.wait_for_text("Password:")
      machine.send_chars("foobar\n")
      machine.wait_for_text("alice@machine")
+      machine.send_chars("echo $TERM\n")
+      machine.wait_for_text("xterm-256color")
      machine.screenshot("tty.png")
  '';
 }
@@ -68,21 +68,12 @@ listToAttrs (
  map (makeWineTest "winePackages" [ hello32 ]) variants
  ++ optionals pkgs.stdenv.hostPlatform.is64bit (
    map
-      (makeWineTest "wineWowPackages" [
+      (makeWineTest "wineWow64Packages" [
        hello32
        hello64
      ])
      # This wayland combination times out after spending many hours.
      # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
      (pkgs.lib.remove "wayland" variants)
-    ++
-      map
-        (makeWineTest "wineWow64Packages" [
-          hello32
-          hello64
-        ])
-        # This wayland combination times out after spending many hours.
-        # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
-        (pkgs.lib.remove "wayland" variants)
  )
 )
@@ -10,13 +10,13 @@
 }:
 vimUtils.buildVimPlugin rec {
  pname = "codediff.nvim";
-  version = "2.16.3";
+  version = "2.19.0";

  src = fetchFromGitHub {
    owner = "esmuellert";
    repo = "codediff.nvim";
    tag = "v${version}";
-    hash = "sha256-nIDjE5hf5kt3diEFgUEBz4dCxHatCYtdHY5Zc4YlHFg=";
+    hash = "sha256-l8bP8NNCoE7SLRMRh+Nq5OxUD+xdJ2qYyWbA140aFV0=";
  };

  dependencies = [ vimPlugins.nui-nvim ];
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.34";
-    hash = "sha256-qCvgb2fs0t3hlI36egvlZYem8CzUKIAipaEZOumDtWk=";
+    version = "2.1.37";
+    hash = "sha256-Lc3TNj74BW/M1sK+bz/xw4L5B6KKBUh2uzXckScwPr8=";
  };

  postInstall = ''
@@ -1268,8 +1268,8 @@ let
        mktplcRef = {
          publisher = "denoland";
          name = "vscode-deno";
-          version = "3.49.0";
-          hash = "sha256-eyH5zPLhDjEEVom1nDUo9rSh/O3QtjcFIMcp/XuibFE=";
+          version = "3.50.0";
+          hash = "sha256-+EQP1QfI6W6wcIFKgr7B4gzZn6XamageDbGs5I/Iu1Q=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";
@@ -2344,8 +2344,8 @@ let
        mktplcRef = {
          name = "Ionide-fsharp";
          publisher = "Ionide";
-          version = "7.30.0";
-          hash = "sha256-cN+NWHkl21ibvW743ST4kFmxGwfc6ZyNWPOyIRjFEwU=";
+          version = "7.31.1";
+          hash = "sha256-phVmMpcg3t08IeUgEOzdFPhW9Z/4XjbzmM9j17ra+uo=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -2611,8 +2611,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.176.2";
-          hash = "sha256-vhdEGbIBMLTci803O+3ALDgCG2VmhjFmhcDy4rsa+BI=";
+          version = "1.180.2";
+          hash = "sha256-4F4xZrB13+jAt/LhYigLygZoGZqQPfs8LJJzRqMUFaQ=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -3413,8 +3413,8 @@ let
        mktplcRef = {
          name = "remote-containers";
          publisher = "ms-vscode-remote";
-          version = "0.437.0";
-          hash = "sha256-shEBOvwJokLOXIr4oEsSsvsxQ2WAThjlLJ4dCSfONgI=";
+          version = "0.442.0";
+          hash = "sha256-oTWYOwEfC8o2eB5G2BeNDRmgaMA26E3pZ4GbPH86rWc=";
        };
        meta = {
          description = "Open any folder or repository inside a Docker container";
@@ -3568,8 +3568,8 @@ let
        mktplcRef = {
          name = "vscode-just-syntax";
          publisher = "nefrob";
-          version = "0.8.0";
-          hash = "sha256-zuDfIxhiUKRpVRxp9BceW6WPBq5NNCuS1Si0/6kfqF8=";
+          version = "0.9.0";
+          hash = "sha256-+9OZ8sRYK9D/JiI+cR1BajqrmLqnOYvrwTIfOaPnoq4=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/nefrob.vscode-just-syntax/changelog";
@@ -4470,8 +4470,8 @@ let
        mktplcRef = {
          name = "vscode-stylelint";
          publisher = "stylelint";
-          version = "2.0.1";
-          hash = "sha256-TYUDm+i7Chuybbx91AUxH/oIyZYWpZ5XnYxjhjXGP88=";
+          version = "2.0.2";
+          hash = "sha256-nJYy7HFycKXTQCHgaLP46CGl0hlgaexL1QZ8icGpeVo=";
        };
        meta = {
          description = "Official Stylelint extension for Visual Studio Code";
@@ -4509,8 +4509,8 @@ let
        mktplcRef = {
          name = "svelte-vscode";
          publisher = "svelte";
-          version = "109.12.1";
-          hash = "sha256-0KotF1HGrM9BkImYAfSHGvAeUCZMRnveIBldjhxUUuY=";
+          version = "109.13.0";
+          hash = "sha256-8eHnAuQArNTOxewNWcPJRekXUyYGc6LnR66rHe5j9u0=";
        };
        meta = {
          changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -4629,8 +4629,8 @@ let
        mktplcRef = {
          name = "ayu";
          publisher = "teabyii";
-          version = "1.1.7";
-          sha256 = "sha256-b83c4/63XHNmjUMrPCgpBhn2XA2tBcfPh5izfNS45gI=";
+          version = "1.1.8";
+          sha256 = "sha256-md6G6Zf9E8oVyBvDQZfu9jTO6ZseNM+xJ/kx9efkuHA=";
        };
        meta = {
          description = "Simple theme with bright colors and comes in three versions — dark, light and mirage for all day long comfortable work";
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "periscope";
    publisher = "joshmu";
-    version = "1.15.1";
-    hash = "sha256-Ssa3qoookSa/JnmZl1AmlT48exAgd6pbwdzzsmTcEqs=";
+    version = "1.16.1";
+    hash = "sha256-gYfsY5ZwB4vTDplWW49o9EZITY74CfM1FOrCxJ7+g6U=";
  };
  meta = {
    changelog = "https://marketplace.visualstudio.com/items/joshmu.periscope/changelog";
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "sourcegraph";
    name = "amp";
-    version = "0.0.1769991964";
-    hash = "sha256-RlACEEbRZjeM1JUgAxfMlwFIo8CmrJxr1DVq1XxRdoM=";
+    version = "0.0.1770596843";
+    hash = "sha256-FLajygfJM+EPOXSU7g5I7Yo1YU7zYvTuw2cfY3B17BE=";
  };

  meta = {
@@ -73,6 +73,8 @@ in

 runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}"
  {
+    pname = wrappedPkgName;
+    version = wrappedPkgVersion;
    nativeBuildInputs = [ makeWrapper ];
    buildInputs = [ vscode ];
    dontPatchELF = true;
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fbneo";
-  version = "0-unstable-2026-01-18";
+  version = "0-unstable-2026-02-08";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbneo";
-    rev = "3faea4f9c678bad8063f3a2774b051f42848c856";
-    hash = "sha256-tH9XMBfg3O2oKIUeKWi2hl4yQuHa9BMgvkWjIxv/KIo=";
+    rev = "e21e3f3c40eb4422b93b8984ef46fe04cdaee9db";
+    hash = "sha256-7hZ2TJwHtgyHd+CZahazXZnKhfNpWZqfev9jtTHlmag=";
  };

  makefile = "Makefile";
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
  core = "mame";
-  version = "0-unstable-2026-01-01";
+  version = "0-unstable-2026-01-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame";
-    rev = "b207f9c6fc93b9d21417a9e4424607840c71db6b";
-    hash = "sha256-n9vDYSzij01rRgUc8l763FCLXsFGHIsZxAIZ+N8IBGo=";
+    rev = "6cdc40fc53ba5574073d4009b531fda07156ff49";
+    hash = "sha256-4XmQsVuieIEcLTP1CJfNrJjXD2ENkh4MPLkTVjrx8dE=";
    fetchSubmodules = true;
  };

@@ -77,7 +77,7 @@ in
      "x86_64-linux"
      "x86_64-darwin"
    ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
  };
  wineWow = callPackage ./base.nix {
    pname = "wine-wow";
@@ -112,7 +112,7 @@ in
      ];
    };
    platforms = [ "x86_64-linux" ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
  };
  wineWow64 = callPackage ./base.nix {
    pname = "wine-wow64";
@@ -97,9 +97,9 @@ in
 rec {

  stable = fetchurl rec {
-    version = "10.0";
-    url = "https://dl.winehq.org/wine/source/10.0/wine-${version}.tar.xz";
-    hash = "sha256-xeCz9ffvr7MOnNTZxiS4XFgxcdM1SdkzzTQC80GsNgE=";
+    version = "11.0";
+    url = "https://dl.winehq.org/wine/source/11.0/wine-${version}.tar.xz";
+    hash = "sha256-wHpoV5M8H8YN/1RI1585ySSBwenbWqYo250DWERuBwE=";

    ## see http://wiki.winehq.org/Gecko
    gecko32 = fetchurl rec {
@@ -115,17 +115,15 @@ rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "8.1.0";
+      version = "10.0.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-DtPsUzrvebLzEhVZMc97EIAAmsDFtMK8/rZ4rJSOCBA=";
+      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
    };

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
      ./cert-path.patch
-    ]
-    ++ patches-binutils-2_44-fix-wine-older-than-10_2
-    ++ patches-add-truncf-to-the-import-library;
+    ];

    updateScript = writeShellScript "update-wine-stable" ''
      ${updateScriptPreamble}
@@ -144,9 +142,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.20";
-    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-gbShU5WPYkf+UEHV32Xq3Lvuoba6jNok6349fOLR/jw=";
+    version = "11.1";
+    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
+    hash = "sha256-v0x8j7XYwfZW8wor6pOHDIXxP/gxGrL2Hd75AOsoy48=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -156,7 +154,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-Ys0VNYj568qMHq56ZCprnsbpb/iqtiDlU3w0er8Ol5g=";
+      hash = "sha256-KBiESkLVEEWyUPzv1I7j8U9zjqfYdF+FL6wRCcIE290=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-cm-push";
-  version = "0.10.4";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "chartmuseum";
    repo = "helm-push";
    rev = "v${version}";
-    hash = "sha256-YnhI1/BDk9swr3YFm5ajGf4LLgPty7blA2tlsMH0erY=";
+    hash = "sha256-0HskUSj1+5YZMLb0OMMhkNfN7J36GzE5Rdd9uLTO1Ys=";
  };

-  vendorHash = "sha256-7bUDKqkvBV1Upcrj4DQnVCP74QtKlSwF0Kl2sPFZpjc=";
+  vendorHash = "sha256-W7nWiWCLrzevunxYoDAqVbG5LhG+VXCAeI1D78fQQvw=";

  subPackage = [ "cmd/helm-cm-push" ];

@@ -12,51 +12,15 @@ let
  extraArgs = removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_32 = common (
-    (import ./1_32/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "32"
-      ];
-    }
-  ) extraArgs;
+  k3s_1_32 = common (import ./1_32/versions.nix) extraArgs;

-  k3s_1_33 = common (
-    (import ./1_33/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "33"
-      ];
-    }
-  ) extraArgs;
+  k3s_1_33 = common (import ./1_33/versions.nix) extraArgs;

-  k3s_1_34 =
-    (common (
-      (import ./1_34/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "34"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        patches = [ ./go_runc_require.patch ];
-      };
+  k3s_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
+    patches = [ ./go_runc_require.patch ];
+  };

-  k3s_1_35 =
-    (common (
-      (import ./1_35/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "35"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        patches = [ ./go_runc_require.patch ];
-      };
+  k3s_1_35 = (common (import ./1_35/versions.nix) extraArgs).overrideAttrs {
+    patches = [ ./go_runc_require.patch ];
+  };
 }
@@ -108,19 +108,9 @@ respective package block.

 ```nix
 {
-  rke2_1_34 =
-    (common (
-      (import ./1_34/versions.nix)
-      // {
-        updateScript = [
-          ./update-script.sh
-          "34"
-        ];
-      }
-    ) extraArgs).overrideAttrs
-      {
-        meta.knownVulnerabilities = [ "rke2_1_34 has reached end-of-life on 2026-10-27" ];
-      };
+  rke2_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
+    meta.knownVulnerabilities = [ "rke2_1_34 has reached end-of-life on 2026-10-27" ];
+  };
 }
 ```

@@ -4,7 +4,7 @@ lib:
  rke2Commit,
  rke2TarballHash,
  rke2VendorHash,
-  updateScript,
+  updateScript ? null,
  k8sImageTag,
  etcdVersion,
  pauseVersion,
@@ -5,45 +5,13 @@ let
  extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_32 = common (
-    (import ./1_32/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "32"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_32 = common (import ./1_32/versions.nix) extraArgs;

-  rke2_1_33 = common (
-    (import ./1_33/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "33"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;

-  rke2_1_34 = common (
-    (import ./1_34/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "34"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;

-  rke2_1_35 = common (
-    (import ./1_35/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "35"
-      ];
-    }
-  ) extraArgs;
+  rke2_1_35 = common (import ./1_35/versions.nix) extraArgs;

  # Automatically set by update script, changes shouldn't be backported
  rke2_stable = rke2_1_34;
@@ -101,11 +101,11 @@
    "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
  },
  "baidubce_baiducloud": {
-    "hash": "sha256-0THQNO2odOAeRKwi9NpQnq52YwgdYATAchAM5iw55C8=",
+    "hash": "sha256-UDcyYXo4K7tlr5appmzgZh1V+wX3WuaC6YEWXx5Pk8Y=",
    "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
    "owner": "baidubce",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.22.18",
+    "rev": "v1.22.19",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -887,13 +887,13 @@
    "vendorHash": "sha256-0Z2V8CyIZEHZFFqTNFnseBbvVenOnpNz9Tlbu7zaPOI="
  },
  "maxlaverse_bitwarden": {
-    "hash": "sha256-9HSxaU+/1HaN4mmi9JnKuTwP/HLCh72zcKecTAQJQpM=",
+    "hash": "sha256-n1d2n6CX8iV/bRqQSaivRxMAYKA/ctfWPQaFgS7ETgE=",
    "homepage": "https://registry.terraform.io/providers/maxlaverse/bitwarden",
    "owner": "maxlaverse",
    "repo": "terraform-provider-bitwarden",
-    "rev": "v0.17.1",
+    "rev": "v0.17.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vDvGIiUIMjMAz9ST/Qjo7aurkB9RIVeevSUkQ8eJ9tk="
+    "vendorHash": "sha256-2IlD9IdiN+TBk/Eng2K4jZD8GB91IvQPeVAKhxI/6aY="
  },
  "metio_migadu": {
    "hash": "sha256-rAf+q/zNANhW8cFSJR3TtA0yYqiG5mjCStyBFG0U3tg=",
@@ -1049,11 +1049,11 @@
    "vendorHash": null
  },
  "oracle_oci": {
-    "hash": "sha256-gzjvdAuT3HDMRULa+b2u75zqei4x1ylj3NGyHh4qa+U=",
+    "hash": "sha256-2uSMK9GvqCdIPjr/PI4FlOM5qXhPsEY6dnY3S795/vg=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v7.32.0",
+    "rev": "v8.0.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1283,13 +1283,13 @@
    "vendorHash": "sha256-rWiafaFE1RolO9JUN1WoW4EWJjR7kpfeVEOTLf21j50="
  },
  "tailscale_tailscale": {
-    "hash": "sha256-G8vSPFGtx9klRCW8Rab8UHR1AK1Kt421WMsCE0pohR0=",
+    "hash": "sha256-hw8psXRFtFkBF3x1gj/72bxcnFkuZ5RYXENNeiWB7gc=",
    "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
    "owner": "tailscale",
    "repo": "terraform-provider-tailscale",
-    "rev": "v0.25.0",
+    "rev": "v0.26.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-UWdPgXvJ68xRUNbAhBQ2SjGkerRlwNUjMA8Yu9EAowo="
+    "vendorHash": "sha256-gc8JCbYzA0nz0JBSNBSZsK0VLTAPmXRhXW2MZiadC90="
  },
  "telmate_proxmox": {
    "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",
@@ -1,8 +1,8 @@
 {
  "linux-canary": {
-    "hash": "sha256-HtcgQS8P5R57qV3pKYyVLcT9FCOtZ6UbFBQWFkvU8B0=",
-    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.854/discord-canary-0.0.854.tar.gz",
-    "version": "0.0.854"
+    "hash": "sha256-kjIrLBHbCvDEi/lyJadyaqR/5z77u5CvOekbptJZnxY=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.862/discord-canary-0.0.862.tar.gz",
+    "version": "0.0.862"
  },
  "linux-development": {
    "hash": "sha256-EVkjWoqWl9Z+iHCLPOLu4PIUb2wC3HVcPVjOVz++IVw=",
@@ -10,19 +10,19 @@
    "version": "0.0.94"
  },
  "linux-ptb": {
-    "hash": "sha256-Y+e3HHXE5D9Q9qKE7ipaLijZ+E6yEr9NzEOy5c+Gk54=",
-    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.173/discord-ptb-0.0.173.tar.gz",
-    "version": "0.0.173"
+    "hash": "sha256-SOShH+EzFN1ti1RcgvRaxaD45nHosi4R6lSXSY3MGYU=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.176/discord-ptb-0.0.176.tar.gz",
+    "version": "0.0.176"
  },
  "linux-stable": {
-    "hash": "sha256-WR9xyw3Zn/HAZQlfiKMAXqc2TueF6wCfQzvYtnXd1yM=",
-    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.121/discord-0.0.121.tar.gz",
-    "version": "0.0.121"
+    "hash": "sha256-2cNAfYzPbZ9O8s4b3RBLki8aM9TiFuZcGffFbY4zxJQ=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.123/discord-0.0.123.tar.gz",
+    "version": "0.0.123"
  },
  "osx-canary": {
-    "hash": "sha256-q/PAGdlOTdkQudiH/NFXSgwhz2XBL9ZwrhJXiY9Iibc=",
-    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.958/DiscordCanary.dmg",
-    "version": "0.0.958"
+    "hash": "sha256-KPneQR4BBC/1CHWYm1ie8m//tiagRCk92e1/Tz+Fx9Y=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.966/DiscordCanary.dmg",
+    "version": "0.0.966"
  },
  "osx-development": {
    "hash": "sha256-B1//zMlTv2+RWHfWZSaaU8ubVOwWob+EYjNdtFRwlgg=",
@@ -30,13 +30,13 @@
    "version": "0.0.107"
  },
  "osx-ptb": {
-    "hash": "sha256-QCzJsb1RH6HORk9hw9F9Xu0rE+NCFYJDTJQO9UrdBxo=",
-    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.205/DiscordPTB.dmg",
-    "version": "0.0.205"
+    "hash": "sha256-EPhQwolrHda8gh+G84quVlbNGYSThqJsg4qjK44nZuc=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.208/DiscordPTB.dmg",
+    "version": "0.0.208"
  },
  "osx-stable": {
-    "hash": "sha256-/CEN67VbRRwK64Iy7GIhs2XFwHe47njI5X6n45j5Q/E=",
-    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.373/Discord.dmg",
-    "version": "0.0.373"
+    "hash": "sha256-pRL1fCBXQL3iMNM/po73KrtJRQhWNvED7H8PrOBWTaU=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.375/Discord.dmg",
+    "version": "0.0.375"
  }
 }
@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "qctools";
-  version = "1.4";
+  version = "1.4.1";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/${pname}/${version}/${pname}_${version}.tar.xz";
-    hash = "sha256-1WqCP/4PV8hQT8ubPxHGTwZrRnOPm+msEPBGR4gkWhA=";
+    hash = "sha256-4HuNBCvN1BDjIsEyo8Lo/H1rNgCFygkXqo6yD3oDf18=";
  };

  sourceRoot = "${pname}/Project/QtCreator";
@@ -33,7 +33,9 @@ const fixupYarnLock = async (lockContents, verbose) => {
      if (hash)
        pkg.resolved += `#${hash}`

-      return [dep, pkg]
+      // Rewrite key to remove git+ prefix and .git suffix to prevent yarn git resolver
+      let fixedDep = dep.replace(/@git\+/, '@').replace(/\.git(#|$)/, '$1')
+      return [fixedDep, pkg]
    })
  )

@@ -46,17 +46,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
  pname = binName;

-  version = "0.25.7";
+  version = "0.26.2";
  src = fetchFromGitHub {
    owner = "toeverything";
    repo = "AFFiNE";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+MdPo2THiwgRT4x/Xnf9+1C+Bu0BsV9P1yIXhgdA3CQ=";
+    hash = "sha256-qFJezmSNq6Uq6xvCGUITeidrChQiZWI6lw9ZX8PcwXc=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-0SOuaMjVihmSBQhVKZHIZkIUs+MXnW5VkrhGRD6xNcM=";
+    hash = "sha256-3cvq3FV3juzEaKczw/SUHSXHLLEIEJlcv2LUAMxGVVQ=";
  };

  # keep yarnOfflineCache same output style with offlineCache = yarn-berry.fetchYarnBerryDeps { inherit (finalAttrs) src missingHashes; hash = "" };
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
      '';
    dontInstall = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-pPLnNsQ7+ao+MQw6Zmf/XA8ITWr+AeUA0gvu6qVUECw=";
+    outputHash = "sha256-TgrepMMOZkVK2uUEvwllrnFzVsEjgvRb8AtBsDzrHSg=";
  };

  buildInputs = lib.optionals hostPlatform.isDarwin [
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "air";
-  version = "1.64.4";
+  version = "1.64.5";

  src = fetchFromGitHub {
    owner = "air-verse";
    repo = "air";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-m2NIRf/dZQKB3IeEChEBfJ7GJkxiyuWSRvMoHfbsLeI=";
+    hash = "sha256-vaNXG+bS+RB0Qi0kI9lBGyr8FcUxm5igG982+cOZwqw=";
  };

  vendorHash = "sha256-03xZ3P/7xjznYdM9rv+8ZYftQlnjJ6ZTq0HdSvGpaWw=";
@@ -2,7 +2,7 @@
  lib,
  multiStdenv,
  fetchFromGitHub,
-  wineWowPackages,
+  wineWow64Packages,
  cmake,
  makeWrapper,
  file,
@@ -12,7 +12,7 @@
 }:

 let
-  wine-wow64 = wineWowPackages.stableFull;
+  wine-wow64 = wineWow64Packages.stableFull;
 in
 multiStdenv.mkDerivation (finalAttrs: {
  pname = "airwave";
@@ -65,7 +65,7 @@ multiStdenv.mkDerivation (finalAttrs: {
    mkdir $out/bin
    mv $out/libexec/airwave-manager $out/bin
    wrapProgram $out/libexec/airwave-host-32.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
-    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine64"}
+    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
  '';

  meta = {
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alt-tab-macos";
-  version = "8.3.3";
+  version = "8.3.4";

  src = fetchurl {
    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-213AlF4lNg5K4y25rXCBtVoc4w/3m7b8gGi0jFgzqR0=";
+    hash = "sha256-I5Dx/71+rY6qThE8ton4EtDtcfMQzx4Yle+1tpOAkDI=";
  };

  sourceRoot = ".";
@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "ansel";
-  version = "0-unstable-2026-01-25";
+  version = "0-unstable-2026-02-08";

  src = fetchFromGitHub {
    owner = "aurelienpierreeng";
    repo = "ansel";
-    rev = "2cb699e7a2367390db6fdb56c78383854a8522b9";
-    hash = "sha256-a6p3ZL3Rg3zK4B8Nfoe28etWnDeV6/sn5pnCpVQThXY=";
+    rev = "e9988402c5007c886f5256bd189009d3abd842a7";
+    hash = "sha256-qjai8UeqSkoDmc0YAmIxxaMJiLwTDcZteqChHGf3CPg=";
    fetchSubmodules = true;
  };

@@ -20,7 +20,7 @@
  wavpack,
  #, musepackSupport ? false, TODO: mpcenc
  monkeysAudioSupport ? false,
-  monkeysAudio,
+  monkeys-audio,
  #, aacSupport ? false, TODO: neroAacEnc
 }:

@@ -31,7 +31,7 @@ let
    ++ lib.optional flacSupport flac
    ++ lib.optional opusSupport opusTools
    ++ lib.optional wavpackSupport wavpack
-    ++ lib.optional monkeysAudioSupport monkeysAudio
+    ++ lib.optional monkeysAudioSupport monkeys-audio
    ++ [ cdparanoia ];
 in

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "async-profiler";
-  version = "4.2.1";
+  version = "4.3";

  src = fetchFromGitHub {
    owner = "jvm-profiling-tools";
    repo = "async-profiler";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ggqfBndcwHUerWjsvDqmRQ5uEyL6zhNgwVl18R18k0Q=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wysOjirCfxm0SmwDW7GS+S73lAT8/0g4avu7T5+qy2Q=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "atac";
-  version = "0.22.1";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "Julien-cpsn";
    repo = "ATAC";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PXSjyMe7Rcoeczm/cqFgn1Ra66T9cA34NdfaqLTljmc=";
+    hash = "sha256-2z0+6CyVJR6sTFHotegCU8+isDy4Pw+gkJ1eUBs+AYM=";
  };

-  cargoHash = "sha256-qjg5yxWRcNnmrl91kogUEOfFOs06tcgmK2hpqx6nftU=";
+  cargoHash = "sha256-lJO9riP/3FRrQ/gkKQCghfkNn1ePS+p6FtMcJTIJxZY=";

  nativeBuildInputs = [ pkg-config ];

@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "autotiling-rs";
-  version = "0.1.6";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "ammgws";
    repo = "autotiling-rs";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-21XIKZ2rzuQMpkaOhGu1pg4J3OGOzHNQ20Rcw1V4BfI=";
+    sha256 = "sha256-jeakiO28LM223qyPqZ4tdozQbNxJ6vEEl2Avk8ZBwlA=";
  };

-  cargoHash = "sha256-+5GibhSkiKmgRrESKrliKLrrtUQ7iv2sFz46OFwAIwE=";
+  cargoHash = "sha256-ytViAnvcU99hr9Ki9AOtcmBRYFtuBdWeRe2Z00+WRGs=";

  meta = {
    description = "Autotiling for sway (and possibly i3)";
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "badger";
-  version = "4.9.0";
+  version = "4.9.1";

  src = fetchFromGitHub {
    owner = "dgraph-io";
    repo = "badger";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-AmDfG4IOpptdH0/Un4V275UTTUXoV1LNKtbSj3O50rs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BsKFi4oMNJE09PBjFmqNhbMcQcHk5uR5QssbwN2ZNCk=";
  };

  vendorHash = "sha256-+rXXCVH2xuULPzdM0KVPwYht+tu0qyxPjLLaBMWVIuI=";
@@ -18,13 +18,13 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.37.2";
+  version = "1.37.4";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-xFbVeNfOse7FfivTFwBnEZ0XUU2uUXqe1im6MncZwyY=";
+    hash = "sha256-BTqsymgthJH1gIakSrDBx3Hxthm48kLPc85IjreX1vA=";
  };

  npmDepsHash = "sha256-aZ9kfkW+S6Hjt59Z4Fc5joghs7OQ32354IYevFuKNeo=";
@@ -44,6 +44,6 @@ stdenv.mkDerivation {
      platforms
      ;

-    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.19");
+    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.20");
  };
 }
@@ -5,7 +5,6 @@
  cmake,
  elfutils,
  fetchFromGitHub,
-  fetchpatch,
  flex,
  iperf,
  lib,
@@ -23,14 +22,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "bcc";
-  version = "0.35.0";
+  version = "0.36.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "iovisor";
    repo = "bcc";
    tag = "v${version}";
-    hash = "sha256-eP/VEq7cPALi2oDKAZFQGQ3NExdmcBKyi6ddRZiYmbI=";
+    hash = "sha256-J00GRIM9AemLkKHoyKqLR2U2aEBwNy/a5hbGjLRrO8w=";
  };

  patches = [
@@ -44,12 +43,6 @@ python3Packages.buildPythonApplication rec {
    (replaceVars ./absolute-ausyscall.patch {
      ausyscall = lib.getExe' audit "ausyscall";
    })
-
-    (fetchpatch {
-      name = "clang-21.patch";
-      url = "https://github.com/iovisor/bcc/commit/8c5c96ad3beeed2fa827017f451a952306826974.diff";
-      hash = "sha256-VOzhdeZ3mRstLlMhxHwEgqCa6L39eRpbFJuKZqFnBws=";
-    })
  ];

  build-system = [ python3Packages.setuptools ];
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "beans";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "hmans";
+    repo = "beans";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3SgTqR5DGAb5r+VU3YknoWATqglq8G7QV3kTVUSL9u4=";
+  };
+
+  vendorHash = "sha256-TprfPZ/clb7PLMAkxF0y78bCef4XarhgHlIhIPn1nQA=";
+
+  ldflags = [
+    "-s"
+    "-X github.com/hmans/beans/cmd.version=${finalAttrs.version}"
+    "-X github.com/hmans/beans/cmd.commit=${finalAttrs.src.rev}"
+    "-X github.com/hmans/beans/cmd.date=unknown"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  meta = {
+    description = "Issue tracker for you, your team, and your coding agents";
+    homepage = "https://github.com/hmans/beans";
+    changelog = "https://github.com/hmans/beans/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sleroq ];
+    mainProgram = "beans";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
@@ -39,7 +39,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "beekeeper-studio";
-  version = "5.5.3";
+  version = "5.5.5";

  src =
    let
@@ -54,10 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
    fetchurl {
      url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
      hash = selectSystem {
-        x86_64-linux = "sha256-zbOePN975TWp7zo3XagKYPjHPQiz3r6ui2fPfNEboGs=";
-        aarch64-linux = "sha256-AoyaHBKO0gHgbq51D+OMH7SyUVnq2IjH4FIbeNepFHw=";
-        x86_64-darwin = "sha256-GzK9fmhW86IKER1IPsLNDwyz03rKuqCTO+hcPR/2QnM=";
-        aarch64-darwin = "sha256-pRBkgzp2w92/ACQaqpruwRtbfvg7f+nNE5rZ4YuQREc=";
+        x86_64-linux = "sha256-XV7PXoXA99BwPolg20vUVAAWhs3eBTmgLOEWZrq6Mq4=";
+        aarch64-linux = "sha256-lfW7gjes/Kn8zCKh2LNItu4kwSr9dxYGviUjgXFiHzU=";
+        x86_64-darwin = "sha256-EGsfHUYAxjgMBye+D8XzPdUqtXIG7X+DpJoViVcYGHU=";
+        aarch64-darwin = "sha256-JfxhOS74xQP8MK2nBz3V0VPxHbXF5m9OtRI2m4ZWjk0=";
      };
    };

@@ -18,15 +18,15 @@
  steam-run-free,
 }:

-buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
+buildNpmPackage (finalAttrs: {
  pname = "bs-manager";
-  version = "1.5.4";
+  version = "1.5.6";

  src = fetchFromGitHub {
    owner = "Zagrios";
    repo = "bs-manager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YitQjhnadQrpdBOV2CUedRNm/RW7/rpXtS9PJTa9kUU=";
+    hash = "sha256-hx6ciEz772NYd9+7WjLqTzNNenWMoOq57IneqsDC1Qg=";
  };

  postPatch = ''
@@ -39,13 +39,13 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
    ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
  '';

-  npmDepsHash = "sha256-3NMqYD7S4wYjwYuGJOmq2/C82qtG1mImsR4crjFLe30=";
+  npmDepsHash = "sha256-wmPZv1lqGr31wBGaeLw7LL6ZMzq/x8lkoy/iMxU+M80=";

  extraNpmDeps = fetchNpmDeps {
    name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
    inherit (finalAttrs) src;
    sourceRoot = "${finalAttrs.src.name}/release/app";
-    hash = "sha256-UWsxty1kfxMr5fybtykrN2G+yiQ9dw/bbMwfcVLJgp4=";
+    hash = "sha256-jE/M22QQzuTS0zgcB+tLEL8Ey61HE8MP7H1MTX060gY=";
  };

  makeCacheWritable = true;
@@ -64,6 +64,10 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
    stdenv.cc.cc
  ];

+  autoPatchelfIgnoreMissingDeps = [
+    "libc.musl-x86_64.so.1" # musl-based node modules won't be used on glibc systems
+  ];
+
  preBuild = ''
    pushd release/app

@@ -18,13 +18,13 @@

 buildGoModule (finalAttrs: {
  pname = "buildah";
-  version = "1.42.2";
+  version = "1.43.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YWyA2wTIlJNwuqcPHOBFZ2wr46Z0I83FWRew/FC3Wxs=";
+    hash = "sha256-SihJXPnUrOe4TxbbnQOhXoZlbQZfLy0YGMV32CtojV8=";
  };

  outputs = [
@@ -16,7 +16,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "capypdf";
-  version = "0.18.0";
+  version = "0.20.0";

  outputs = [
    "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "jpakkane";
    repo = "capypdf";
    rev = finalAttrs.version;
-    hash = "sha256-FivwBSpaIpkdKPYk7FuwpcBCYq59XH7SouA47rmGSaQ=";
+    hash = "sha256-A2wjXYLiszWNaPChWGzBMG7OggsomT2cRi3LsjasOIQ=";
  };

  nativeBuildInputs = [
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "carapace-bridge";
-  version = "1.5.0";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "carapace-sh";
    repo = "carapace-bridge";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-u+vcXTTLoRyKW/o/+bPpeFd7tgks9yfQcZDfgHjxZmc=";
+    hash = "sha256-jqE5xSq/Nbh7rhDHs21w6tY/oqRZEvq0bj0kvoDY3SI=";
  };

  # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on
@@ -1,62 +1,62 @@
 diff --git a/nextest-runner/Cargo.toml b/nextest-runner/Cargo.toml
-index 776c9341..06196bd2 100644
+index 748f162e4c..2cda438ded 100644
 --- a/nextest-runner/Cargo.toml
 +++ b/nextest-runner/Cargo.toml
-@@ -118,7 +118,7 @@ nix.workspace = true
+@@ -126,7 +126,7 @@
 #
 # Also, usdt 0.6.0 fails to compile on x86_64-apple-darwin, so restrict it to
 # aarch64-apple-darwin.
 -[target.'cfg(any(all(target_arch = "x86_64", any(target_os = "linux", target_os = "freebsd", target_os = "illumos")), all(target_arch = "aarch64", any(target_os = "macos", target_os = "freebsd", target_os = "illumos"))))'.dependencies]
 +[target.'cfg(any(all(target_arch = "x86_64", any(target_os = "linux", target_os = "freebsd", target_os = "illumos")), all(target_arch = "aarch64", any(target_os = "freebsd", target_os = "illumos"))))'.dependencies]
- usdt = "0.6.0"
+ usdt = { version = "0.6.0", optional = true }
 
 [target.'cfg(windows)'.dependencies]
 diff --git a/nextest-runner/src/usdt.rs b/nextest-runner/src/usdt.rs
-index 7732eeb4..af69015b 100644
+index b0905030a4..a1abbcfdca 100644
 --- a/nextest-runner/src/usdt.rs
 +++ b/nextest-runner/src/usdt.rs
-@@ -28,7 +28,7 @@ use serde::Serialize;
-     ),
-     all(
-         target_arch = "aarch64",
-        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -30,7 +30,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
+            any(target_os = "freebsd", target_os = "illumos")
+         )
     )
 ))]
- pub fn register_probes() -> Result<(), usdt::Error> {
-@@ -43,7 +43,7 @@ pub fn register_probes() -> Result<(), usdt::Error> {
-     ),
-     all(
-         target_arch = "aarch64",
-        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -48,7 +48,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
+            any(target_os = "freebsd", target_os = "illumos")
+         )
     )
 )))]
- pub fn register_probes() -> Result<(), std::convert::Infallible> {
-@@ -57,7 +57,7 @@ pub fn register_probes() -> Result<(), std::convert::Infallible> {
-     ),
-     all(
-         target_arch = "aarch64",
-        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -65,7 +65,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
+            any(target_os = "freebsd", target_os = "illumos")
+         )
     )
 ))]
- #[usdt::provider(provider = "nextest")]
-@@ -135,7 +135,7 @@ pub mod usdt_probes {
-     ),
-     all(
-         target_arch = "aarch64",
-        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -146,7 +146,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
+            any(target_os = "freebsd", target_os = "illumos")
+         )
     )
 ))]
- #[macro_export]
-@@ -246,7 +246,7 @@ macro_rules! fire_usdt {
-     ),
-     all(
-         target_arch = "aarch64",
-        any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
-+        any(target_os = "freebsd", target_os = "illumos")
+@@ -260,7 +260,7 @@
+         ),
+         all(
+             target_arch = "aarch64",
+-            any(target_os = "macos", target_os = "freebsd", target_os = "illumos")
+            any(target_os = "freebsd", target_os = "illumos")
+         )
     )
 )))]
- #[macro_export]
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-nextest";
-  version = "0.9.124";
+  version = "0.9.126";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-qvJ/dqbls2fVSPY++kYBIeiu14eDD8ORuvcD8dEtMZ8=";
+    hash = "sha256-meAry18+M+VizSWFvMY99F4ZDbb2LuaTqi3kBuoxhD0=";
  };

  # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./no-dtrace-macos.patch
  ];

-  cargoHash = "sha256-3fZSXBP6vMh7GN2eY2upsvV/mTuDOcSovdsbcZBQA4U=";
+  cargoHash = "sha256-I25ObQEM9sxwnmqebb4P6EXFUMkXWjNfoV01WyZOivA=";

  cargoBuildFlags = [
    "-p"
@@ -22,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ccache";
-  version = "4.12.2";
+  version = "4.12.3";

  src = fetchFromGitHub {
    owner = "ccache";
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
        exit 1
      fi
    '';
-    hash = "sha256-oWzVCrNgYtOeN4+KJmIynT3jiFZfxrsLkoIm0lK3MBo=";
+    hash = "sha256-oX7qG3jjrLm4gKZd8w7Bc7uE5U5sIa35//PDRJ/XHcM=";
  };

  outputs = [
@@ -18,6 +18,11 @@ stdenv.mkDerivation (finalAttrs: {

  hardeningDisable = [ "format" ];

+  outputs = [
+    "out"
+    "man"
+  ];
+
  meta = {
    homepage = "https://ccrypt.sourceforge.net/";
    description = "Utility for encrypting and decrypting files and streams with AES-256";
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ceph-csi";
-  version = "3.15.1";
+  version = "3.16.0";

  src = fetchFromGitHub {
    owner = "ceph";
    repo = "ceph-csi";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-eLF/V6NaBU8r3ttJku4lSGrIuP2vao24rsAsEAWB0wk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dVSztcnfofPkd4lv/WBZQNS6POHWdAeNqMta1p7G51c=";
  };

  preConfigure = ''
@@ -19,14 +19,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.18.0";
+  version = "1.18.1";
  pname = "chafa";

  src = fetchFromGitHub {
    owner = "hpjansson";
    repo = "chafa";
    tag = finalAttrs.version;
-    hash = "sha256-SKwrc0bOaSdxENUWMtErSCug7of9s/ZGLeKhTtUCbWY=";
+    hash = "sha256-Is7N5WUjYVDFz1VKrKQqa7n48gXf2JtvDHB5vXMjoZg=";
  };

  outputs = [
@@ -6,18 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "chamber";
-  version = "3.1.4";
+  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "segmentio";
    repo = "chamber";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-CSLG1y7D2dozwB5Lme9xX+kjDuPB/5cOrsfmvGDXX4E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vmWRbQzgZJA2dQMdmZ/dLFlYb5O2yAexBZt3Oc2FLMM=";
  };

  env.CGO_ENABLED = 0;

-  vendorHash = "sha256-xhfBpLAhAVT42vA2oRm+EQHXA1dWy3UD5m8Ds8/IyAk=";
+  vendorHash = "sha256-Yin8hNavlcANY8ynmzceLVHUfgk/MbH9Xx9MfW12E+0=";

  ldflags = [
    "-s"
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chhoto-url";
-  version = "6.5.5";
+  version = "6.5.8";

  src = fetchFromGitHub {
    owner = "SinTan1729";
    repo = "chhoto-url";
    tag = finalAttrs.version;
-    hash = "sha256-Kr/DpxptU3j3Q97G+5fG5y7oLrpK7KaqlDv0TtsAl4E=";
+    hash = "sha256-JrGiRYE9YLuUdOhIqtNOsk+yiTLeiaTVQ7A5g3jqk/8=";
  };

  sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
  '';

-  cargoHash = "sha256-3WZgjf2ytnnTKVR0E6n3d4WhHS/cjgEgfENtOpBf57w=";
+  cargoHash = "sha256-QXSOeiXJadTQaCRRfbn3C3KDyKIV4eOa2IdHHPK5Dzo=";

  postInstall = ''
    mkdir -p $out/share/chhoto-url
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2026-02-01";
+  version = "0.4.0-unstable-2026-02-06";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "52a3a4be4035fac1bec56ee6f20ae50ea15f8c31";
-    hash = "sha256-HrLOo9duWDOxoranH2fo9KVs3OIV0oHDvzEcWdwthTs=";
+    rev = "450cf8a7a126419400eb3b271e4e22f7a8ada1ec";
+    hash = "sha256-UjLVYLd+OjDPoSBSSQQuh5eXn+7Hq5BFXnoy/PuaUsI=";
  };

  nativeBuildInputs = [
@@ -0,0 +1 @@
+{ python3Packages }: with python3Packages; toPythonApplication circus
@@ -1,41 +1,41 @@
 {
-  "version": "2.1.34",
-  "buildDate": "2026-02-06T06:39:27Z",
+  "version": "2.1.37",
+  "buildDate": "2026-02-07T18:40:47Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "58bd74f33a9f0beb4338e02f613f63064fda73e9226288d10909df50a466ec60",
-      "size": 180901616
+      "checksum": "00ed10afb7a562440773de31284568ce9c33385d79d3a912a12af262aefd130e",
+      "size": 181423280
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "57e08c32782d0e3d1e38cf697261f85813a710d2719447a75770bdafdc4740c8",
-      "size": 187198656
+      "checksum": "5ad9639bf34affa47066fb98f2d7ad7b0f236009744d309077b194d896fc011d",
+      "size": 186482592
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "ffb0625ad609b5816cedfb23f88325f62b63747ab6fdfe5a53f352fd4ed77b33",
-      "size": 215296297
+      "checksum": "d725cc73060f400a7ac03a769969397daec9d411dbd5b1c7bb1fa60427bf657e",
+      "size": 218584946
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "3665f12f67a1159b31005dcce11ca1de41d49759bae3d01ed853940fe7c4a21f",
-      "size": 223101542
+      "checksum": "f967a4d06e16a32436b6329e2dbed459a9fa4d34f07635a1fb271b74f706c91f",
+      "size": 221426063
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "2f610b62fb441b4b9d4223f1036a76d86576ab484876eb5f10bcede91178f913",
-      "size": 210560329
+      "checksum": "8b1852e9922ecb67a6eef467d5d8f4408d58d71e51c785e155cd0c8efe417754",
+      "size": 211768338
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "e1f8081c9f53bcb7055bfe855c717bd6040cee8a81a7c29deb6d8b1c6e4d8259",
-      "size": 215790118
+      "checksum": "df4f2a657f4e5c21b1907d7fb10a36622aced68d5ac4c94e709862298d1e2aac",
+      "size": 213926119
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "655008c690f8e5397ce7d420d0b3e09ef286035e7a1e4d12caa8f61fb3c968ec",
-      "size": 232975520
+      "checksum": "8a54bdc2c7d60e84b92f5aeedb9b66791006cfff992415e58e15a6df52842859",
+      "size": 231153824
    }
  }
 }
@@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.1.34",
+  "version": "2.1.37",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.1.34",
+      "version": "2.1.37",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.1.34";
+  version = "2.1.37";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-J3kltFY5nR3PsRWbW310VqD/6hhfMbVSvynv0eaIi3M=";
+    hash = "sha256-ijyZCT4LEEtXWOBds8WzizcfED9hVgaJByygJ4P4Yss=";
  };

-  npmDepsHash = "sha256-n762einDxLUUXWMsfdPVhA/kn0ywlJgFQ2ZGoEk3E68=";
+  npmDepsHash = "sha256-2if3LsTEnC2OQjEgojqgzs8YOXdpoqJijEmVlxmEfzw=";

  strictDeps = true;

@@ -56,7 +56,7 @@ in
      }
      ''
        export HOME="$(mktemp -d)"
-        wine64 $exe help
+        wine $exe help
        mkdir $out
      '';
 }
@@ -16,11 +16,13 @@ stdenv.mkDerivation (finalAttrs: {

  env = {
    RANLIB = "${stdenv.cc.targetPrefix}gcc-ranlib";
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=implicit-int"
-      "-Wno-error=implicit-function-declaration"
-      "-std=gnu17"
-    ];
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-Wno-error=implicit-int"
+        "-Wno-error=implicit-function-declaration"
+      ]
+      ++ lib.optional stdenv.cc.isGNU "-std=gnu17"
+    );
  };

  autoreconfFlags = "REGEX";
@@ -15,7 +15,7 @@

 stdenv.mkDerivation rec {
  pname = "codeql";
-  version = "2.24.0";
+  version = "2.24.1";

  dontConfigure = true;
  dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {

  src = fetchzip {
    url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-LxKS/KKuw6vwsYnrHE2jAJ3lEuudXQ57870WSdtTW50=";
+    hash = "sha256-NpbXUw2KivAi/7Lg3UuL30HPa/PeTjhvSgXliDkVKe4=";
  };

  nativeBuildInputs = [
@@ -12,14 +12,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "commitizen";
-  version = "4.11.6";
+  version = "4.13.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "commitizen-tools";
    repo = "commitizen";
    tag = "v${version}";
-    hash = "sha256-7KF7qzBWF8OQLHxXYWHI+zcjBWV7KogMr0FYhitPSTw=";
+    hash = "sha256-f0fB5FkWG4fkV7ccMPJ8z5MBFVYBwE33BDa4Cz94K4M=";
  };

  postPatch = ''
@@ -12,18 +12,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "commitlint";
-  version = "20.4.0";
+  version = "20.4.1";

  src = fetchFromGitHub {
    owner = "conventional-changelog";
    repo = "commitlint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Koi4twmDeCV716rGEUUmkt25gzBROBFL5y48qr+J/FA=";
+    hash = "sha256-FJod+jzd8zHOcyoHyxw+UltS2NsHmbocIWIbxHk2EDg=";
  };

  yarnOfflineCache = fetchYarnDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-ihN9DmW46nKeFjcZWdxsutE+Q6ezdqPXO0i/xkNJdI0=";
+    hash = "sha256-pnxnFvEv6fo1I6XAFZw6xcues52WYxFjdehH9BzB+w4=";
  };

  nativeBuildInputs = [
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "complgen";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "adaszko";
    repo = "complgen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5fEownFj5cyLL+4ZPN80qlkw3xu6xspsKfruk7KBhrI=";
+    hash = "sha256-6cduIe0qy3r4hYaVzajYHDklN9fzOpmmWo875pPsTWk=";
  };

-  cargoHash = "sha256-wGbf1UiCwjOzUbR0k45EAuGjEg9+x14d8kKpz7pHQN8=";
+  cargoHash = "sha256-UeaXwq9Q8ognW9IWtUJmQ0kxm7bbootN7epzwobHR70=";

  meta = {
    changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";
@@ -9,15 +9,7 @@ let
  python = python3.override {
    self = python3;
    packageOverrides = self: super: {
-      pyrate-limiter = super.pyrate-limiter.overridePythonAttrs (oldAttrs: rec {
-        version = "2.10.0";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src) owner repo;
-          tag = "v${version}";
-          hash = "sha256-CPusPeyTS+QyWiMHsU0ii9ZxPuizsqv0wQy3uicrDw0=";
-        };
-        doCheck = false;
-      });
+      pyrate-limiter = super.pyrate-limiter_2;
    };
  };

@@ -11,11 +11,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "container";
-  version = "0.7.1";
+  version = "0.9.0";

  src = fetchurl {
    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-installer-signed.pkg";
-    hash = "sha256-2rfh8OD0H5BQkJsnST886U2dyf4aedJvCQziJ9YTxnE=";
+    hash = "sha256-6KQysR85bVzlDkTqFPAvffkP/O9EHJFrL6krY+lfWAE=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,154 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+
+  # Build deps
+  bun,
+  tailwindcss_4,
+  typescript,
+  makeBinaryWrapper,
+
+  # Runtime deps
+  assimp,
+  calibre,
+  dasel,
+  ffmpeg-headless,
+  graphicsmagick,
+  imagemagick,
+  inkscape,
+  libheif,
+  libjxl,
+  libreoffice,
+  libva,
+  pandoc,
+  perl5Packages,
+  potrace,
+  python3,
+  resvg,
+  texliveBasic,
+  vips,
+  vtracer,
+}:
+let
+  pin = lib.importJSON ./pin.json;
+  inherit (pin) version;
+
+  pname = "convertx";
+
+  src = fetchFromGitHub {
+    owner = "C4illin";
+    repo = "ConvertX";
+    tag = "v${version}";
+    hash = pin.srcHash;
+  };
+
+  node_modules = stdenv.mkDerivation (finalAttrs: {
+    pname = "${pname}-node_modules";
+    inherit version src;
+
+    dontConfigure = true;
+
+    nativeBuildInputs = [
+      bun
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      bun install --frozen-lockfile --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mkdir -p $out/lib/node_modules
+
+      rm -rf ./node_modules/.cache
+      rm -rf node_modules/.bin
+      cp -R ./node_modules $out/lib
+      cp package.json $out/lib
+    '';
+
+    outputHash = pin."${stdenv.system}";
+    outputHashMode = "recursive";
+  });
+in
+stdenv.mkDerivation {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    tailwindcss_4
+    typescript
+  ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ln -s ${node_modules}/lib/node_modules ./node_modules
+    tailwindcss -i ./src/main.css -o ./public/generated.css
+    tsc
+
+    substituteInPlace ./dist/src/index.js \
+      --replace-fail "assets: \"public\"" "assets: \"$out/share/convertx/dist/public\""
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/convertx
+    cp -R ./dist $out/share/convertx
+    cp -R ./public $out/share/convertx/dist
+    ln -s ${node_modules}/lib/node_modules $out
+
+    makeBinaryWrapper ${bun}/bin/bun $out/bin/convertx \
+      --add-flags "run --prefer-offline --no-install $out/share/convertx/dist/src/index.js" \
+      --set NODE_ENV production \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          assimp
+          calibre
+          dasel
+          ffmpeg-headless
+          graphicsmagick
+          imagemagick
+          inkscape
+          libheif
+          libjxl
+          libreoffice
+          libva
+          pandoc
+          perl5Packages.EmailOutlookMessage
+          potrace
+          (python3.withPackages (ps: [ ps.markitdown ]))
+          resvg
+          (texliveBasic.withPackages (ps: [
+            ps.dvisvgm
+            ps.latex
+            ps.latexmk
+            ps.unicode-math
+            ps.xcolor
+            ps.xetex
+          ]))
+          vips
+          vtracer
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Self-hosted online file converter";
+    homepage = "https://github.com/C4illin/ConvertX/tree/main";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    changelog = "https://github.com/C4illin/ConvertX/blob/main/CHANGELOG.md";
+    mainProgram = "convertx";
+    maintainers = with lib.maintainers; [
+      EpicEric
+    ];
+  };
+}
@@ -0,0 +1,6 @@
+{
+  "version": "0.17.0",
+  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
+  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
+  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+}
@@ -0,0 +1,218 @@
+[
+  {
+    "pname": "Avalonia",
+    "version": "11.3.11",
+    "hash": "sha256-FSMuXVA5q5L5evwos5bIsuT81suO8FbCjEF3OvAL9p0="
+  }
+,
+  {
+    "pname": "Avalonia.Angle.Windows.Natives",
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
+  }
+,
+  {
+    "pname": "Avalonia.BuildServices",
+    "version": "11.3.2",
+    "hash": "sha256-6wx06tjSKWQOlX2czdp6Wh0nuwVapx5qf/s8Qj5we40="
+  }
+,
+  {
+    "pname": "Avalonia.Controls.ColorPicker",
+    "version": "11.3.11",
+    "hash": "sha256-Ki6O9HYbseQPV3DsvwmJ+ERimi/WmvzelNJDKP6loo0="
+  }
+,
+  {
+    "pname": "Avalonia.Desktop",
+    "version": "11.3.11",
+    "hash": "sha256-oFivO8/0rir4BwQsTeWs3bSnb7RmldwxYmI77j5pt8k="
+  }
+,
+  {
+    "pname": "Avalonia.Diagnostics",
+    "version": "11.3.11",
+    "hash": "sha256-p38+O0VDqZ8u5VOzImP21/U5wyP1BUp2UrLLc9HSfwE="
+  }
+,
+  {
+    "pname": "Avalonia.Fonts.Inter",
+    "version": "11.3.11",
+    "hash": "sha256-S0DWwcZHulVUIckiv2HM1Vbqno64c/Xt+mPhZp1tfsA="
+  }
+,
+  {
+    "pname": "Avalonia.FreeDesktop",
+    "version": "11.3.11",
+    "hash": "sha256-UE2/w9cw3YDzsw3HuhI2sTPy8reH9C71ufmHOpzvlSQ="
+  }
+,
+  {
+    "pname": "Avalonia.Native",
+    "version": "11.3.11",
+    "hash": "sha256-vw67lp/oOt+2lqdJ5PK2FY93jqPTcgZqOAXLtSXlJ8s="
+  }
+,
+  {
+    "pname": "Avalonia.Remote.Protocol",
+    "version": "11.3.11",
+    "hash": "sha256-l1f3rVygtI268llwbN0NvTDSfXwZE3CyRw8w5tbHBC4="
+  }
+,
+  {
+    "pname": "Avalonia.Skia",
+    "version": "11.3.11",
+    "hash": "sha256-89TGu50JfEVFo+QZgyOR0uOagC/xoJvqfnrHep3W/cc="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Fluent",
+    "version": "11.3.11",
+    "hash": "sha256-tiJ0xAFf0UVSH7LASPtg/7ils7+vZjw2UKBMydyUR3Q="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Simple",
+    "version": "11.3.11",
+    "hash": "sha256-AJS5Ls0tJ6PCr2mnr1PpxGWX4sII8mpe2R+VCFYRg44="
+  }
+,
+  {
+    "pname": "Avalonia.Win32",
+    "version": "11.3.11",
+    "hash": "sha256-6/NG4OrB/4YisXzJ51GPuq3uDn8oEUWyJRAqejyMCQw="
+  }
+,
+  {
+    "pname": "Avalonia.X11",
+    "version": "11.3.11",
+    "hash": "sha256-2fiQvKxU/r71UOAQgy0zwSHVCM2uG2sdEUhObd5TrQQ="
+  }
+,
+  {
+    "pname": "CommunityToolkit.Mvvm",
+    "version": "8.4.0",
+    "hash": "sha256-a0D550q+ffreU9Z+kQPdzJYPNaj1UjgyPofLzUg02ZI="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp",
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Linux",
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.macOS",
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Win32",
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
+  }
+,
+  {
+    "pname": "MicroCom.Runtime",
+    "version": "0.11.0",
+    "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection",
+    "version": "10.0.2",
+    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
+  }
+,
+  {
+    "pname": "Serilog",
+    "version": "4.3.0",
+    "hash": "sha256-jyIy4BjsyFXge3aO4GRFAdnX4/rz1MHfBkBDIpCDsTw="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Async",
+    "version": "2.1.0",
+    "hash": "sha256-LDoLpXkleD2MVPK2KBsLGRf5yqrwckBiAnYDbuIbaUM="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "6.1.1",
+    "hash": "sha256-CfIg4Us4kSMQAn6rU2rsAeE22g6MpFiZdhoZWySpZeY="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "7.0.0",
+    "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
+  }
+,
+  {
+    "pname": "SkiaSharp",
+    "version": "2.88.9",
+    "hash": "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux",
+    "version": "2.88.9",
+    "hash": "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux.NoDependencies",
+    "version": "2.88.9",
+    "hash": "sha256-WjpcM78Q6kaW0eU5iqDR5+fGcF+06/tawWHsJRK57Es="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.macOS",
+    "version": "2.88.9",
+    "hash": "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.WebAssembly",
+    "version": "2.88.9",
+    "hash": "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Win32",
+    "version": "2.88.9",
+    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
+  }
+,
+  {
+    "pname": "Tmds.DBus",
+    "version": "0.23.0",
+    "hash": "sha256-BwWQSqOOMS+Cf2fM8MIuiHey8QnGH4WvYjOn9haq5e0="
+  }
+,
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.21.2",
+    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+  }
+
+]
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  buildDotnetModule,
+  dotnetCorePackages,
+  fetchFromGitHub,
+  nix-update-script,
+  autoPatchelfHook,
+  clang,
+  patchelf,
+  systemd,
+  zlib,
+}:
+
+buildDotnetModule rec {
+  pname = "crossmacro-daemon";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "alper-han";
+    repo = "CrossMacro";
+    tag = "v${version}";
+    hash = "sha256-6Cc1mC34l+4dUPD1LAYxlXxzNF76l4HoOmbqTdTJVk0=";
+  };
+
+  projectFile = "src/CrossMacro.Daemon/CrossMacro.Daemon.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = null;
+
+  selfContainedBuild = true;
+  executables = [ "CrossMacro.Daemon" ];
+  buildType = "Release";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    clang
+    patchelf
+  ];
+
+  buildInputs = [
+    systemd
+    zlib
+  ];
+
+  dotnetFlags = [ "-p:Version=${version}" ];
+
+  postInstall = ''
+    install -Dm644 scripts/assets/org.crossmacro.policy \
+      $out/share/polkit-1/actions/org.crossmacro.policy
+
+    install -Dm644 scripts/assets/50-crossmacro.rules \
+      $out/share/polkit-1/rules.d/50-crossmacro.rules
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    patchelf --add-needed libsystemd.so.0 $out/lib/crossmacro-daemon/CrossMacro.Daemon
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Privileged input daemon for CrossMacro";
+    homepage = "https://github.com/alper-han/CrossMacro";
+    changelog = "https://github.com/alper-han/CrossMacro/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "CrossMacro.Daemon";
+    maintainers = with lib.maintainers; [ alper-han ];
+  };
+}
@@ -0,0 +1,218 @@
+[
+  {
+    "pname": "Avalonia",
+    "version": "11.3.11",
+    "hash": "sha256-FSMuXVA5q5L5evwos5bIsuT81suO8FbCjEF3OvAL9p0="
+  }
+,
+  {
+    "pname": "Avalonia.Angle.Windows.Natives",
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
+  }
+,
+  {
+    "pname": "Avalonia.BuildServices",
+    "version": "11.3.2",
+    "hash": "sha256-6wx06tjSKWQOlX2czdp6Wh0nuwVapx5qf/s8Qj5we40="
+  }
+,
+  {
+    "pname": "Avalonia.Controls.ColorPicker",
+    "version": "11.3.11",
+    "hash": "sha256-Ki6O9HYbseQPV3DsvwmJ+ERimi/WmvzelNJDKP6loo0="
+  }
+,
+  {
+    "pname": "Avalonia.Desktop",
+    "version": "11.3.11",
+    "hash": "sha256-oFivO8/0rir4BwQsTeWs3bSnb7RmldwxYmI77j5pt8k="
+  }
+,
+  {
+    "pname": "Avalonia.Diagnostics",
+    "version": "11.3.11",
+    "hash": "sha256-p38+O0VDqZ8u5VOzImP21/U5wyP1BUp2UrLLc9HSfwE="
+  }
+,
+  {
+    "pname": "Avalonia.Fonts.Inter",
+    "version": "11.3.11",
+    "hash": "sha256-S0DWwcZHulVUIckiv2HM1Vbqno64c/Xt+mPhZp1tfsA="
+  }
+,
+  {
+    "pname": "Avalonia.FreeDesktop",
+    "version": "11.3.11",
+    "hash": "sha256-UE2/w9cw3YDzsw3HuhI2sTPy8reH9C71ufmHOpzvlSQ="
+  }
+,
+  {
+    "pname": "Avalonia.Native",
+    "version": "11.3.11",
+    "hash": "sha256-vw67lp/oOt+2lqdJ5PK2FY93jqPTcgZqOAXLtSXlJ8s="
+  }
+,
+  {
+    "pname": "Avalonia.Remote.Protocol",
+    "version": "11.3.11",
+    "hash": "sha256-l1f3rVygtI268llwbN0NvTDSfXwZE3CyRw8w5tbHBC4="
+  }
+,
+  {
+    "pname": "Avalonia.Skia",
+    "version": "11.3.11",
+    "hash": "sha256-89TGu50JfEVFo+QZgyOR0uOagC/xoJvqfnrHep3W/cc="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Fluent",
+    "version": "11.3.11",
+    "hash": "sha256-tiJ0xAFf0UVSH7LASPtg/7ils7+vZjw2UKBMydyUR3Q="
+  }
+,
+  {
+    "pname": "Avalonia.Themes.Simple",
+    "version": "11.3.11",
+    "hash": "sha256-AJS5Ls0tJ6PCr2mnr1PpxGWX4sII8mpe2R+VCFYRg44="
+  }
+,
+  {
+    "pname": "Avalonia.Win32",
+    "version": "11.3.11",
+    "hash": "sha256-6/NG4OrB/4YisXzJ51GPuq3uDn8oEUWyJRAqejyMCQw="
+  }
+,
+  {
+    "pname": "Avalonia.X11",
+    "version": "11.3.11",
+    "hash": "sha256-2fiQvKxU/r71UOAQgy0zwSHVCM2uG2sdEUhObd5TrQQ="
+  }
+,
+  {
+    "pname": "CommunityToolkit.Mvvm",
+    "version": "8.4.0",
+    "hash": "sha256-a0D550q+ffreU9Z+kQPdzJYPNaj1UjgyPofLzUg02ZI="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp",
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Linux",
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.macOS",
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
+  }
+,
+  {
+    "pname": "HarfBuzzSharp.NativeAssets.Win32",
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
+  }
+,
+  {
+    "pname": "MicroCom.Runtime",
+    "version": "0.11.0",
+    "hash": "sha256-VdwpP5fsclvNqJuppaOvwEwv2ofnAI5ZSz2V+UEdLF0="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection",
+    "version": "10.0.2",
+    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
+  }
+,
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.2",
+    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
+  }
+,
+  {
+    "pname": "Serilog",
+    "version": "4.3.0",
+    "hash": "sha256-jyIy4BjsyFXge3aO4GRFAdnX4/rz1MHfBkBDIpCDsTw="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Async",
+    "version": "2.1.0",
+    "hash": "sha256-LDoLpXkleD2MVPK2KBsLGRf5yqrwckBiAnYDbuIbaUM="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "6.1.1",
+    "hash": "sha256-CfIg4Us4kSMQAn6rU2rsAeE22g6MpFiZdhoZWySpZeY="
+  }
+,
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "7.0.0",
+    "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
+  }
+,
+  {
+    "pname": "SkiaSharp",
+    "version": "2.88.9",
+    "hash": "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux",
+    "version": "2.88.9",
+    "hash": "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Linux.NoDependencies",
+    "version": "2.88.9",
+    "hash": "sha256-WjpcM78Q6kaW0eU5iqDR5+fGcF+06/tawWHsJRK57Es="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.macOS",
+    "version": "2.88.9",
+    "hash": "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.WebAssembly",
+    "version": "2.88.9",
+    "hash": "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY="
+  }
+,
+  {
+    "pname": "SkiaSharp.NativeAssets.Win32",
+    "version": "2.88.9",
+    "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
+  }
+,
+  {
+    "pname": "Tmds.DBus",
+    "version": "0.23.0",
+    "hash": "sha256-BwWQSqOOMS+Cf2fM8MIuiHey8QnGH4WvYjOn9haq5e0="
+  }
+,
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.21.2",
+    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+  }
+
+]
@@ -0,0 +1,105 @@
+{
+  lib,
+  buildDotnetModule,
+  dotnetCorePackages,
+  fetchFromGitHub,
+  nix-update-script,
+  fontconfig,
+  freetype,
+  expat,
+  libx11,
+  libice,
+  libsm,
+  libxi,
+  libxcursor,
+  libxext,
+  libxrandr,
+  libxrender,
+  libxfixes,
+  libxtst,
+  libglvnd,
+  mesa,
+  wayland,
+  libxkbcommon,
+  glib,
+  icu,
+  openssl,
+  zlib,
+}:
+
+buildDotnetModule rec {
+  pname = "crossmacro";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "alper-han";
+    repo = "CrossMacro";
+    tag = "v${version}";
+    hash = "sha256-6Cc1mC34l+4dUPD1LAYxlXxzNF76l4HoOmbqTdTJVk0=";
+  };
+
+  projectFile = "src/CrossMacro.UI/CrossMacro.UI.csproj";
+  nugetDeps = ./deps.json;
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+
+  executables = [ "CrossMacro.UI" ];
+  buildType = "Release";
+
+  dotnetFlags = [
+    "-p:SelfContained=false"
+    "-p:Version=${version}"
+  ];
+
+  runtimeDeps = [
+    zlib
+    icu
+    openssl
+    fontconfig
+    freetype
+    expat
+    libx11
+    libice
+    libsm
+    libxi
+    libxcursor
+    libxext
+    libxrandr
+    libxrender
+    libxfixes
+    libxtst
+    glib
+    libglvnd
+    mesa
+    wayland
+    libxkbcommon
+  ];
+
+  postInstall = ''
+    install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
+
+    for size in 16 32 48 64 128 256 512; do
+      install -Dm644 src/CrossMacro.UI/Assets/icons/''${size}x''${size}/apps/crossmacro.png \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/crossmacro.png
+    done
+
+    install -Dm644 scripts/assets/io.github.alper-han.CrossMacro.metainfo.xml \
+      $out/share/metainfo/io.github.alper-han.CrossMacro.metainfo.xml
+
+    mkdir -p $out/bin
+    ln -sf $out/bin/CrossMacro.UI $out/bin/crossmacro
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cross-platform mouse and keyboard macro recorder and player";
+    homepage = "https://github.com/alper-han/CrossMacro";
+    changelog = "https://github.com/alper-han/CrossMacro/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "crossmacro";
+    maintainers = with lib.maintainers; [ alper-han ];
+  };
+}
@@ -13,7 +13,7 @@
  # Enabling both withOneDNN and withOpenblas is broken
  # https://github.com/OpenNMT/CTranslate2/issues/1294
  withOneDNN ? false,
-  oneDNN,
+  onednn,
  withOpenblas ? true,
  openblas,
  withRuy ? true,
@@ -93,7 +93,7 @@ stdenv'.mkDerivation (finalAttrs: {
      cudaPackages.cudnn
    ]
    ++ lib.optionals withOneDNN [
-      oneDNN
+      onednn
    ]
    ++ lib.optionals withOpenblas [
      openblas
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "drawterm";
-  version = "0-unstable-2025-12-27";
+  version = "0-unstable-2026-01-11";

  src = fetchFrom9Front {
    owner = "plan9front";
    repo = "drawterm";
-    rev = "ec862e9c8acd30ec73eb9e11b8e849ed5b711e76";
-    hash = "sha256-nFWOJnZKT5mr/Bf1r228v1Oexvy35bL2VS2JLPvJHp0=";
+    rev = "8a88fb5b8c75450d2e20ae1c7839d823bb1f6fad";
+    hash = "sha256-hejdFLYJvANKOC4Jgr9XvYl/5kU9PiKSH5cWE6d6e/o=";
  };

  enableParallelBuilding = true;
@@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
+  fetchpatch2,
  pkg-config,
  hackrf,
  libbladeRF,
@@ -24,6 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-kTJ8FMugBRJaxWas/jEj4E5TmVnNpNdhq4r2YFFwgTU=";
  };

+  patches = [
+    # Fix compilation with GCC 15: https://github.com/flightaware/dump1090/pull/261
+    (fetchpatch2 {
+      url = "https://github.com/flightaware/dump1090/commit/93be1da123215e8ac15a0deaffedd480e8899f77.patch";
+      hash = "sha256-ehpMfLLEh1pMgvFAPg1JHo8XRlta+GvCIZsSXVPISLc=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dumpvdl2";
-  version = "2.5.1";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "szpajder";
    repo = "dumpvdl2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7UAw48BQttF+6J/nhg9zpoplRCtpTwjM1XB7DxM7Ymg=";
+    hash = "sha256-SSCPJ2D5JuMEEDG+8KYoequWCwRJcd6XwZAZSprShy8=";
  };

  buildInputs = [
@@ -145,7 +145,7 @@ export WINEDEBUG=-all
 export WINEDLLOVERRIDES="mscoree,mshtml="

 wine="wine"
-wine64="wine64"
+wine64="wine"
 wineboot="wineboot"

 # $PATH is the way for user to control where wine is located (including custom Wine versions).
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "ebusd";
-  version = "25.1";
+  version = "26.1";

  src = fetchFromGitHub {
    owner = "john30";
    repo = "ebusd";
    rev = version;
-    sha256 = "sha256-rj0Wkfk3Tpm58fbCUkgCdHt5MvW+tGgDyUd5COXfBc0=";
+    sha256 = "sha256-CmArhkJfxf8lL6FoHRQKjk/8ObfEy3Xef9DUtOVKRas=";
  };

  nativeBuildInputs = [
@@ -1,9 +1,15 @@
 {
  lib,
  stdenv,
+  binaryen,
+  cargo,
  fetchFromGitHub,
  fetchYarnDeps,
  nodejs,
+  rustPlatform,
+  rustc,
+  wasm-bindgen-cli_0_2_106,
+  wasm-pack,
  yarnConfigHook,
  yarnBuildHook,
  nix-update-script,
@@ -19,43 +25,73 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ente-web-${enteApp}";
-  version = "1.2.22";
+  version = "1.3.10";

  src = fetchFromGitHub {
    owner = "ente-io";
    repo = "ente";
-    sparseCheckout = [ "web" ];
+    sparseCheckout = [
+      "rust"
+      "web"
+    ];
    tag = "photos-v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-ckrACrgQ9qj6e44QifiUPtldBbDVrKv29s5oQ1Y+gvk=";
+    hash = "sha256-2f4A8RQFhXjPpHKvZACUmUcoukJ800yqTTMWBtLyIlI=";
  };
  sourceRoot = "${finalAttrs.src.name}/web";

+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      cargoRoot
+      ;
+    hash = "sha256-dedLmQP15V+gAtycXx1fpWfjXWsTPLXPPcCIAcr/ME0=";
+  };
+  cargoRoot = "packages/wasm";
+
  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-omFNobZ+2hb1cEO2Gfn+F3oYy7UDSrtIY4cliQ80CUs=";
+    hash = "sha256-H9ZNnbY22BddJl3SDhg+cEN0IaBZtilBFBDUf+zOzV0=";
  };

  nativeBuildInputs = [
    yarnConfigHook
    yarnBuildHook
+    binaryen
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+    rustc.llvmPackages.lld
    nodejs
+    wasm-bindgen-cli_0_2_106
+    wasm-pack
  ];

  # See: https://github.com/ente-io/ente/blob/main/web/apps/photos/.env
  env = extraBuildEnv;

-  # Replace hardcoded ente.io urls if desired
-  postPatch = lib.optionalString (enteMainUrl != null) ''
-    substituteInPlace \
-      apps/payments/src/services/billing.ts \
-      apps/photos/src/pages/shared-albums.tsx \
-      --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}
+  postPatch =
+    # Use our `wasm-pack` binary, rather than the Node version, which is
+    # just a wrapper that tries to download the actual binary
+    ''
+      substituteInPlace \
+        packages/wasm/package.json \
+        --replace-fail "wasm-pack " ${lib.escapeShellArg "${wasm-pack}/bin/wasm-pack "}
+    ''
+    # Replace hardcoded ente.io urls if desired
+    + lib.optionalString (enteMainUrl != null) ''
+      substituteInPlace \
+        apps/payments/src/services/billing.ts \
+        apps/photos/src/pages/shared-albums.tsx \
+        --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}

-    substituteInPlace \
-      apps/accounts/src/pages/index.tsx \
-      --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
-  '';
+      substituteInPlace \
+        apps/accounts/src/pages/index.tsx \
+        --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
+    '';

  yarnBuildScript = "build:${enteApp}";
  installPhase =
@@ -85,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      pinpox
      oddlama
+      nicegamer7
    ];
    platforms = lib.platforms.all;
  };
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
  pname = "enzyme";
-  version = "0.0.239";
+  version = "0.0.249";

  src = fetchFromGitHub {
    owner = "EnzymeAD";
    repo = "Enzyme";
    rev = "v${version}";
-    hash = "sha256-Sa+AVA8OdCQ5PGphs60zWnMkkEMm9CRyGT5Nsc5TX+M=";
+    hash = "sha256-M15AUk5x/vB6TpWVXueXGAChnlVvKCgrQxJb6tY2Y0M=";
  };

  postPatch = ''
@@ -50,8 +50,8 @@ stdenvNoCC.mkDerivation {

  outputHash =
    {
-      x86_64-linux = "sha256-YqUAP11oSxfKifa8QL4VXGCWV5xGG2+vk60f4NdIXIA=";
-      aarch64-linux = "sha256-q7adhMY95g5BCcoiCVIwCpnqJAidE4a2cxGOjuE2YDk=";
+      x86_64-linux = "sha256-os/+0Xb3N1NMtTMP/G9bhELoQF3kDfqzuKUP5RcelJI=";
+      aarch64-linux = "sha256-EvHJQGtW62AOyMnWAEK0HsrwU875JrbMeqD+ctBEI3k=";
    }
    .${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "equibop";
-  version = "3.1.7";
+  version = "3.1.8";

  src = fetchFromGitHub {
    owner = "Equicord";
    repo = "Equibop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AzXBANUcm/DYYkNlO7q++/Dx826o5Hg/1cYJ84rMY0U=";
+    hash = "sha256-OcD4xcD/A48oJcsKuhYBc/UigK+1NfTEuJivL+qdfeA=";
  };

  postPatch = ''
@@ -23,7 +23,17 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  outputs = [
    "out"
    "man"
-  ];
+  ]
+  # From some reason upstream installs documentation only for Linux, solaris,
+  # sunos and any gnu system.
+  ++ lib.optionals (lib.pipe stdenv.hostPlatform [
+    (lib.attrVals [
+      "isLinux"
+      "isSunOS"
+      "isGnu"
+    ])
+    (builtins.any lib.id)
+  ]) [ "doc" ];

  nativeBuildInputs = [ installShellFiles ];

@@ -89,6 +99,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
      rm $out/bin/fail2ban-python
      ln -s ${python3.interpreter} $out/bin/fail2ban-python

+      # Irrelevant for NixOS
+      rm -r $out/var
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      # see https://github.com/NixOS/nixpkgs/issues/4968
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "famly-fetch";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jacobbunk";
    repo = "famly-fetch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ua2g+YGzMHfMGZrOSKzeqdT/ppanZZWJHjrRxfwVDmE=";
+    hash = "sha256-uyLGBNV+GiYNqy4wWxPNx/xQL0lnMsIHfPIlaIu85HA=";
  };

  build-system = with python3Packages; [
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ffizer";
-  version = "2.13.6";
+  version = "2.13.7";

  buildFeatures = [ "cli" ];

@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "ffizer";
    repo = "ffizer";
    rev = finalAttrs.version;
-    hash = "sha256-1UKXUcoAFQymz1J4oLH8Bwqxby8d+fhcFFYbfQBwTeo=";
+    hash = "sha256-r4jaqjHYDZxftU7J6hGMXW/Oq+8biy9bFoHIOt33ta8=";
  };

-  cargoHash = "sha256-+0d2cnRso6M4qhtdb3fk4AZ7vsDl49Ycly98xybaZRg=";
+  cargoHash = "sha256-+aXhumywpcynKz0R0wWPWhEMfqiPBuwLbIFsABvWTnA=";

  nativeBuildInputs = [
    pkg-config
@@ -14,7 +14,7 @@
  taglib,
  wavpack,
  vorbisgain,
-  monkeysAudio,
+  monkeys-audio,
  sox,
  gtk3,
  libsForQt5,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    mp3gain
    lame
    wavpack
-    monkeysAudio
+    monkeys-audio
    vorbisgain
    sox
  ];
@@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gelly";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "Fingel";
    repo = "gelly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TU2WI927ECSqbvIcQbxSLXLxmos4pxqPuDV7LCOY2bY=";
+    hash = "sha256-FMkn5yNfMdQyKXFz9oBgvbPrwpjPrsssoU4MAmPsIdQ=";
  };

-  cargoHash = "sha256-rgKvfOsP85THalkr412aLOxl6gmFKPpBann1i9BEB20=";
+  cargoHash = "sha256-wjb3GWl7mXn3aM/gqcmK6uM/odGylRs9jwotxqHo0QQ=";

  nativeBuildInputs = [
    pkg-config
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "ghorg";
-  version = "1.11.8";
+  version = "1.11.9";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Co6TR60RfY24y/FZkdBQUvXtE19Il0KASbkDSe/e3Bw=";
+    sha256 = "sha256-rbbPa1svbGOrjWepPpZyTU+NHdwR2A2nkI1HA/UOhnI=";
  };

  doCheck = false;
@@ -11,13 +11,13 @@

 buildNpmPackage rec {
  pname = "ghostfolio";
-  version = "2.234.0";
+  version = "2.237.0";

  src = fetchFromGitHub {
    owner = "ghostfolio";
    repo = "ghostfolio";
    tag = version;
-    hash = "sha256-kj7KCgk4s9Ua//UPGXBh3pI91FTGC90bqMdUrvH4Bhc=";
+    hash = "sha256-udko0oiO5tLEDBKxkGiTRU0Qd/Yd0bvPB6iPM5wJ7Ls=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
    '';
  };

-  npmDepsHash = "sha256-FA5T95nii7pk36YwQQVMSJAvKgOWKFbGwKeyCuygDIQ=";
+  npmDepsHash = "sha256-2j/u++63qaOzvsgdhWeDsH+TUVmOLvgQQRNY14LZI2k=";

  nativeBuildInputs = [
    prisma_6
@@ -2,46 +2,61 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  git,
-  bash,
+  installShellFiles,
+  asciidoc,
+  makeBinaryWrapper,
+  coreutils,
+  gnused,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.0";
+  version = "1.7.1";
  pname = "git-latexdiff";

  src = fetchFromGitLab {
-    hash = "sha256-DMoGEbCBuqUGjbna3yDpD4WNTikPudYRD4Wy1pPG2mw=";
-    rev = finalAttrs.version;
    repo = "git-latexdiff";
    owner = "git-latexdiff";
+    tag = finalAttrs.version;
+    hash = "sha256-ocEDds1vAnaj84YiAez150OZV82w3NlsgXoxNbUGW/Q=";
  };

-  buildInputs = [
-    git
-    bash
-  ];
-
-  dontBuild = true;
-
-  patches = [ ./version-test.patch ];
-
  postPatch = ''
    substituteInPlace git-latexdiff \
-      --replace "@GIT_LATEXDIFF_VERSION@" "v${finalAttrs.version}"
+      --replace-fail "@GIT_LATEXDIFF_VERSION@" "v${finalAttrs.version}"
    patchShebangs git-latexdiff
  '';

+  nativeBuildInputs = [
+    installShellFiles
+    asciidoc
+    makeBinaryWrapper
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  dontBuild = true;
+
  installPhase = ''
-    mkdir -p $prefix/bin
-    mv git-latexdiff $prefix/bin
-    chmod +x $prefix/bin/git-latexdiff
+    installBin git-latexdiff
+    wrapProgram ''${!outputBin}/bin/git-latexdiff \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          gnused
+        ]
+      }
+    make git-latexdiff.1
+    installManPage git-latexdiff.1
  '';

  meta = {
    description = "View diff on LaTeX source files on the generated PDF files";
    homepage = "https://gitlab.com/git-latexdiff/git-latexdiff";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ doronbehar ];
    license = lib.licenses.bsd3; # https://gitlab.com/git-latexdiff/git-latexdiff/issues/9
    platforms = lib.platforms.unix;
    mainProgram = "git-latexdiff";
@@ -1,17 +0,0 @@
-Fix for https://gitlab.com/git-latexdiff/git-latexdiff/issues/7
---
--- src/git-latexdiff	2016-01-26 14:04:54.338568955 +0100
-+++ src/git-latexdiff	2016-01-26 14:40:23.700381943 +0100
-@@ -44,11 +44,7 @@
- git_latexdiff_version='@GIT_LATEXDIFF_VERSION@'
-
- git_latexdiff_compute_version () {
-    if [ "$git_latexdiff_version" = '@GIT_LATEXDIFF''_VERSION@' ]; then
-	(cd "$(dirname "$0")" && git describe --tags HEAD 2>/dev/null || echo 'Unknown version')
-    else
-	echo "$git_latexdiff_version"
-    fi
-+    echo "$git_latexdiff_version"
- }
-
- usage () {
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{ python3Packages }: with python3Packages; toPythonApplication circus`