Merge master into staging-nixos

2026-02-17 18:21:40 +00:00
parent 239638ed88 1fa09357b2
commit ee537d786a
140 changed files with 6049 additions and 459 deletions
@@ -126,6 +126,8 @@

 - `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).

+- `services.xserver` will now throw an error if an X11 driver specified in  `videoDriver(s)` cannot be found. Previously, unknown drivers would be silently ignored.
+
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
  two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
  retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
@@ -12593,6 +12593,12 @@
    githubId = 43830312;
    name = "Joël Miramon";
  };
+  jmmv = {
+    email = "julio@meroh.net";
+    github = "jmmv";
+    githubId = 879272;
+    name = "Julio Merino";
+  };
  jn-sena = {
    email = "jn-sena@proton.me";
    github = "jn-sena";
@@ -1515,6 +1515,7 @@
  ./services/security/reaction.nix
  ./services/security/shibboleth-sp.nix
  ./services/security/sks.nix
+  ./services/security/ssh-agent-switcher.nix
  ./services/security/sshguard.nix
  ./services/security/sslmate-agent.nix
  ./services/security/step-ca.nix
@@ -37,6 +37,7 @@ let

  # Dependencies needed by specific checks
  dependenciesForChecks = {
+    "Ping" = [ pkgs.iputils ];
    "Smb" = pkgs.samba;
    "XIdleTime" = [
      pkgs.xprintidle
@@ -225,6 +226,13 @@ in
  };

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.checks != { };
+        message = "`services.autosuspend.checks` must contain at least one activity check.";
+      }
+    ];
+
    systemd.services.autosuspend = {
      description = "A daemon to suspend your server in case of inactivity";
      documentation = [ "https://autosuspend.readthedocs.io/en/latest/systemd_integration.html" ];
@@ -235,16 +243,6 @@ in
        ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} daemon";
      };
    };
-
-    systemd.services.autosuspend-detect-suspend = {
-      description = "Notifies autosuspend about suspension";
-      documentation = [ "https://autosuspend.readthedocs.io/en/latest/systemd_integration.html" ];
-      wantedBy = [ "sleep.target" ];
-      after = [ "sleep.target" ];
-      serviceConfig = {
-        ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} presuspend";
-      };
-    };
  };

  meta = {
@@ -97,7 +97,7 @@ let
    ++ (
      if (cfg.enableAgentMode) then
        [
-          "--enable-feature=agent"
+          "--agent"
        ]
      else
        [
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.ssh-agent-switcher;
+in
+{
+  meta.maintainers = [ lib.maintainers.jmmv ];
+
+  options = {
+    services.ssh-agent-switcher = {
+      enable = lib.mkEnableOption "ssh-agent-switcher daemon" // {
+        description = ''
+          Whether to enable ssh-agent-switcher, a daemon that proxies SSH agent
+          connections to forwarded agents. This allows tmux/screen sessions to
+          access SSH agents across reconnections.
+
+          This is a per-user service that automatically starts when you log in
+          via SSH and sets SSH_AUTH_SOCK to point to a stable socket location.
+
+          Note: This only activates for SSH sessions, not graphical or console logins.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "ssh-agent-switcher" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.loginShellInit = ''
+      if [ -n "$SSH_CONNECTION" ]; then
+        mkdir -p "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+        export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/ssh-agent-switcher.sock"
+        ${lib.getExe cfg.package} --daemon --socket-path="$SSH_AUTH_SOCK" 2>/dev/null || true
+      fi
+    '';
+  };
+}
@@ -267,6 +267,7 @@ in
          "${cfg.dataDir}/storage/framework/sessions"
          "${cfg.dataDir}/storage/framework/testing"
          "${cfg.dataDir}/storage/framework/views"
+          "${cfg.dataDir}/storage/import-jobs"
          "${cfg.dataDir}/storage/jobs"
          "${cfg.dataDir}/storage/logs"
          "${cfg.dataDir}/storage/submission-routines"
@@ -830,7 +830,8 @@ in

    services.xserver.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];

-    # FIXME: somehow check for unknown driver names.
+    # We ignore unknown drivers here because they may be resolved by other modules (e.g., the Nvidia
+    # module). We assert that all specified drivers were eventually found in the assertions below.
    services.xserver.drivers = flip concatMap cfg.videoDrivers (
      name:
      lib.optional (videoDrivers ? ${name}) (
@@ -862,7 +863,11 @@ in
        assertion = cfg.upscaleDefaultCursor -> cfg.dpi != null;
        message = "Specify `config.services.xserver.dpi` to upscale the default cursor.";
      }
-    ];
+    ]
+    ++ map (driver: {
+      assertion = builtins.elem driver (builtins.catAttrs "name" cfg.drivers);
+      message = "Unknown X11 driver ‘${driver}’ specified in `services.xserver.videoDrivers`.";
+    }) cfg.videoDrivers;

    environment.etc =
      (optionalAttrs cfg.exportConfiguration {
@@ -257,6 +257,7 @@ in
  authelia = runTest ./authelia.nix;
  auto-cpufreq = runTest ./auto-cpufreq.nix;
  autobrr = runTest ./autobrr.nix;
+  autosuspend = runTest ./autosuspend.nix;
  avahi = runTest {
    imports = [ ./avahi.nix ];
    _module.args.networkd = false;
@@ -0,0 +1,30 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "autosuspend";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
+
+  nodes = {
+    machine = {
+      services.autosuspend = {
+        enable = true;
+
+        settings = {
+          interval = 5;
+          idle_time = 5;
+          suspend_cmd = "${pkgs.coreutils}/bin/touch /tmp/suspended";
+        };
+
+        # Return exit code 1 to trigger suspend
+        checks.ExternalCommand.command = "exit 1";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("autosuspend.service")
+    machine.wait_for_file("/tmp/suspended")
+  '';
+}
@@ -59,7 +59,9 @@ stdenv.mkDerivation rec {
  ++ lib.optional pipewireSupport pipewire
  ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;

-  TARGET = lib.optionalString stdenv.hostPlatform.isDarwin "MACOS";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    TARGET = "MACOS";
+  };

  cmakeFlags = [
    (lib.cmakeBool "BUILD_WITH_PULSE" pulseaudioSupport)
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2026-02-06";
+  version = "0-unstable-2026-02-16";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "c577e29f43edc5a86c6ed4edca46706000d214b2";
-    hash = "sha256-nHMtXwtrgxoN/tuY1d+DqZAJFag8vmHAP/9tS2j3ErU=";
+    rev = "ba5b3c71ecc966e52f698f41443e7cc9b81bf824";
+    hash = "sha256-tbq+NgbZDKMg0K0cWF1+7h80QTaAaO5BD9nf94z5fc0=";
    fetchSubmodules = true;
  };

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    xapian
    zlib
  ];
-  XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
+  env.XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
  meta = {
    description = "Synchronize maildirs and notmuch databases";
    mainProgram = "muchsync";
@@ -62,8 +62,10 @@ stdenv.mkDerivation (finalAttrs: {
    touch $XDG_CONFIG_HOME/icedtea-web/deployment.properties
  '';

-  HOME = "/build";
-  XDG_CONFIG_HOME = "/build";
+  env = {
+    HOME = "/build";
+    XDG_CONFIG_HOME = "/build";
+  };

  configureFlags = [
    "--with-itw-libs=DISTRIBUTION"
@@ -6,12 +6,12 @@
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
  pname = "anki-quizlet-importer-extended";
-  version = "2025.09.28";
+  version = "2026.01.17";
  src = fetchFromGitHub {
    owner = "sviatoslav-lebediev";
    repo = "anki-quizlet-importer-extended";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j/ow/HCc70dD/BpMDqGx7rib7G0FfxazzjuPmEQbYTk=";
+    hash = "sha256-BTddZColXM193x8xFa1axHeiWukjxXvwkXGpHxsLtR0=";
  };
  passthru.updateScript = nix-update-script { };
  meta = {
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {

    offlineCache = fetchYarnDeps {
      yarnLock = "${finalAttrs.src}/ui/yarn.lock";
-      hash = "sha256-ekhSPWzIgFhwSw0bIlBqu8LTYk3vuJ9VM8eHc3mnHGM=";
+      hash = "sha256-kqBolkQiwZUBic0f+Ek5HwYsOmro1+FStkDLXAre79o=";
    };

    nativeBuildInputs = [
@@ -175,5 +175,10 @@ stdenv.mkDerivation (finalAttrs: {
      "auparse"
    ];
    platforms = lib.platforms.linux;
+    identifiers.cpeParts =
+      lib.meta.cpeFullVersionWithVendor "linux_audit_project" finalAttrs.version
+      // {
+        product = "linux_audit";
+      };
  };
 })
@@ -2,21 +2,46 @@
  lib,
  dbus,
  fetchFromGitHub,
+  nixosTests,
  python3,
+  sphinxHook,
+  withDocs ? true,
+  withMan ? true,
 }:

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "autosuspend";
-  version = "9.0.1";
+  version = "10.0.0";
  pyproject = true;

+  outputs = [
+    "out"
+  ]
+  ++ lib.optionals withDocs [ "doc" ]
+  ++ lib.optionals withMan [ "man" ];
+
  src = fetchFromGitHub {
    owner = "languitar";
    repo = "autosuspend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PVxsdCPGu+bhjfAF5Hu4Xa3lETARitbBUKuy7ursAUE=";
+    hash = "sha256-o9Jpb4i2/SJ3s3h5sclNjpaN/UFk1YbpPf7b3rGXLRg=";
  };

+  postPatch = ''
+    # This mapping triggers network access on docs generation
+    substituteInPlace doc/source/conf.py \
+      --replace-fail 'intersphinx_mapping' '# intersphinx_mapping'
+  '';
+
+  nativeBuildInputs = lib.optionals (withDocs || withMan) (
+    [
+      sphinxHook
+    ]
+    ++ finalAttrs.passthru.optional-dependencies.docs
+  );
+
+  sphinxBuilders = lib.optionals withDocs [ "html" ] ++ lib.optionals withMan [ "man" ];
+
  build-system = with python3.pkgs; [
    setuptools
  ];
@@ -27,8 +52,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    jsonpath-ng
    lxml
    mpd2
-    portalocker
    psutil
+    pygobject3
    python-dateutil
    requests
    requests-file
@@ -36,6 +61,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    tzlocal
  ];

+  optional-dependencies = {
+    docs = with python3.pkgs; [
+      furo
+      recommonmark
+      sphinx-autodoc-typehints
+      sphinx-issues
+      sphinxcontrib-plantuml
+    ];
+  };
+
  nativeCheckInputs = with python3.pkgs; [
    dbus
    freezegun
@@ -53,6 +88,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "test_multiple_sessions"
  ];

+  passthru.tests = {
+    inherit (nixosTests) autosuspend;
+  };
+
  meta = {
    description = "Daemon to automatically suspend and wake up a system";
    homepage = "https://autosuspend.readthedocs.io";
@@ -70,11 +70,21 @@ stdenvNoCC.mkDerivation (
        ./0004-disable-windows-desktop.patch
      ];

-      # this needs to be match the version being patched above
-      UNICODE_CHARACTER_DATABASE = fetchzip {
-        url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
-        hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
-        stripRoot = false;
+      env = {
+        # this needs to be match the version being patched above
+        UNICODE_CHARACTER_DATABASE = fetchzip {
+          url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
+          hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
+          stripRoot = false;
+        };
+        FONTCONFIG_FILE =
+          let
+            fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
+          in
+          runCommand "fonts.conf" { } ''
+            substitute ${fc} $out \
+            --replace-fail "/etc/" "${fontconfig.out}/etc/"
+          '';
      };

      postPatch = ''
@@ -142,15 +152,6 @@ stdenvNoCC.mkDerivation (
      #  - NuGet packages config '/build/source/nukebuild/_build.csproj'
      linkNuGetPackagesAndSources = true;

-      FONTCONFIG_FILE =
-        let
-          fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
-        in
-        runCommand "fonts.conf" { } ''
-          substitute ${fc} $out \
-            --replace-fail "/etc/" "${fontconfig.out}/etc/"
-        '';
-
      preConfigure = ''
        # closed source (telemetry?) https://github.com/AvaloniaUI/Avalonia/discussions/16878
        dotnet remove packages/Avalonia/Avalonia.csproj package Avalonia.BuildServices
@@ -120,5 +120,10 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.boehmGC;
    maintainers = [ ];
    platforms = lib.platforms.all;
+    identifiers.cpeParts =
+      lib.meta.cpeFullVersionWithVendor "boehm-demers-weiser" finalAttrs.version
+      // {
+        product = "garbage_collector";
+      };
  };
 })
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  doCheck = false;

  # provide the list of solc versions to the `svm-rs-builds` dependency
-  SVM_RELEASES_LIST_JSON =
+  env.SVM_RELEASES_LIST_JSON =
    solc-versions.${stdenv.hostPlatform.system}
      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

@@ -34,6 +34,9 @@ let
      lukegb
    ];
    license = lib.licenses.mpl20;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "nss";
+    };
  };
  certdata = stdenv.mkDerivation {
    pname = "nss-cacert-certdata";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cfspeedtest";
-  version = "2.0.3";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "code-inflation";
    repo = "cfspeedtest";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KeJ/p9kXfI3OuAyNUx2C6DKpmtL3239uHpWAf4mDr4Q=";
+    hash = "sha256-EVZFmTjv2j7kax4MC5HTkVa7/IiDNZcIOgsntSGfzG4=";
  };

-  cargoHash = "sha256-mXSbbY3nuhEw+QUk6gt71HIh2gKNBO6C0trZbyzbpnM=";
+  cargoHash = "sha256-cA+eRVZiZL+bbPc+Vr7nkwMLbQBKOO3uU0XzrxVajqg=";

  nativeBuildInputs = [ installShellFiles ];

@@ -28,6 +28,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --zsh <($out/bin/cfspeedtest --generate-completion zsh)
  '';

+  # require internet access
+  checkFlags = map (t: "--skip=${t}") [
+    "speedtest::tests::test_fetch_metadata_integration"
+    "speedtest::tests::test_run_tests_does_not_retry_non_retryable_4xx"
+    "speedtest::tests::test_run_tests_retries_429_and_records_success"
+    "speedtest::tests::test_run_tests_retry_delay_resets_after_success"
+    "speedtest::tests::test_run_tests_retry_delay_uses_retry_streak_not_total_attempts"
+    "speedtest::tests::test_run_tests_stops_after_max_attempts_on_retryable_failures"
+    "speedtest::tests::test_upload_duration_excludes_delayed_response_body"
+    "speedtest::tests::test_upload_retryable_failure_parses_retry_after_without_drain_skew"
+  ];
+
  meta = {
    description = "Unofficial CLI for speed.cloudflare.com";
    homepage = "https://github.com/code-inflation/cfspeedtest";
@@ -39,10 +39,12 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-LOhBBd7QL5kH4TzMFgrh70C37WsFdsiKArP+tIEiPWo=";
  };

-  # dbus-1.pc has datadir=/etc
-  SYSTEM_BUS_DIR = "${placeholder "out"}/share/dbus-1/system-services";
-  # polkit-gobject-1.pc has prefix=${polkit.out}
-  POLKIT_ACTION_DIR = "${placeholder "out"}/share/polkit-1/actions";
+  env = {
+    # dbus-1.pc has datadir=/etc
+    SYSTEM_BUS_DIR = "${placeholder "out"}/share/dbus-1/system-services";
+    # polkit-gobject-1.pc has prefix=${polkit.out}
+    POLKIT_ACTION_DIR = "${placeholder "out"}/share/polkit-1/actions";
+  };

  postPatch = ''
    sed -i "s@pkg_get_variable(SYSTEM_BUS_DIR.*@set(SYSTEM_BUS_DIR $SYSTEM_BUS_DIR)@" CMakeLists.txt
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "cog";
-  version = "0.0.52";
+  version = "0.0.56";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "cog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BebTJZo9bL6xQY0njfLzyeElTgnnJsizGY2G7D9ClXI=";
+    hash = "sha256-puD0Xlap4yBoAXyhmK+AUSkqiungQsYqkW28BapscEU=";
  };

-  vendorHash = "sha256-S0P65rjIMcDWcJxGyk9aR46bsVXdvVWSt+MLJ4tLdqc=";
+  vendorHash = "sha256-WIYV1kqV5Cr49FDIa1GuR9Cnav/x09v3SwHhUAwqdhM=";

  subPackages = [ "cmd/cli" ];

@@ -64,10 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
    hash = sources.npmHash;
  };

-  RAILS_ENV = "production";
-  NODE_ENV = "production";
-  REDIS_URL = ""; # build error if not defined
-  TAILWINDCSS_INSTALL_DIR = "${tailwindcss_3}/bin";
+  env = {
+    RAILS_ENV = "production";
+    NODE_ENV = "production";
+    REDIS_URL = ""; # build error if not defined
+    TAILWINDCSS_INSTALL_DIR = "${tailwindcss_3}/bin";
+  };

  nativeBuildInputs = [
    nodejs
@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./no-updater-artifacts.patch
  ];

-  VITE_API_URL = "https://api.deadlockmods.app";
+  env.VITE_API_URL = "https://api.deadlockmods.app";

  # Skip tests that require network access
  checkFlags = [
@@ -84,12 +84,14 @@ stdenv.mkDerivation (finalAttrs: {
    libsForQt5.qtmultimedia
  ];

-  LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
-  LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
-  MOC = "${libsForQt5.qtbase.dev}/bin/moc";
-  QTDIR = libsForQt5.qtbase.dev;
-  RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
-  UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  env = {
+    LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
+    LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
+    MOC = "${libsForQt5.qtbase.dev}/bin/moc";
+    QTDIR = libsForQt5.qtbase.dev;
+    RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
+    UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  };

  configureFlags = [
    "--enable-libusb"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
  checkTarget = "test";
  installFlags = [ "PREFIX=$(out)" ];

-  TARGET_OS = stdenv.hostPlatform.uname.system;
+  env.TARGET_OS = stdenv.hostPlatform.uname.system;

  meta = {
    homepage = "https://eradman.com/entrproject/";
@@ -19,28 +19,30 @@ stdenv.mkDerivation {

  nativeBuildInputs = [ freebsd.makeMinimal ];

-  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
-  OPSYS = "FreeBSD";
-  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+  env = {
+    ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+    OPSYS = "FreeBSD";
+    _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";

-  AWK = "awk";
-  CHMOD = "chmod";
-  FIND = "find";
-  MKDIR = "mkdir -p";
-  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
-  RM = "rm -f";
-  SED = "${buildPackages.freebsd.sed}/bin/sed";
-  SETENV = "env";
-  SH = "sh";
-  TOUCH = "touch";
-  XARGS = "xargs";
+    AWK = "awk";
+    CHMOD = "chmod";
+    FIND = "find";
+    MKDIR = "mkdir -p";
+    PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+    RM = "rm -f";
+    SED = "${buildPackages.freebsd.sed}/bin/sed";
+    SETENV = "env";
+    SH = "sh";
+    TOUCH = "touch";
+    XARGS = "xargs";

-  ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
-  CLEAN_FETCH_ENV = true;
-  INSTALL_AS_USER = true;
-  NO_CHECKSUM = true;
-  NO_MTREE = true;
-  SRC_BASE = freebsd.source;
+    ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
+    CLEAN_FETCH_ENV = true;
+    INSTALL_AS_USER = true;
+    NO_CHECKSUM = true;
+    NO_MTREE = true;
+    SRC_BASE = freebsd.source;
+  };

  preUnpack = ''
    export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
@@ -25,15 +25,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
  env = {
    # disable fetching and building of tree-sitter grammars in the helix-term build.rs
    HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
-    HELIX_DEFAULT_RUNTIME = "${placeholder "out"}/lib/runtime";
+    HELIX_DEFAULT_RUNTIME = helix.runtime;
  };

  postInstall = ''
    mkdir -p $out/lib
-    cp -r runtime $out/lib
-    # copy tree-sitter grammars from helix package
-    # TODO: build it from source instead
-    cp -r ${helix}/lib/runtime/grammars/* $out/lib/runtime/grammars/
    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
    mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
    cp contrib/Helix.desktop $out/share/applications
@@ -12,14 +12,14 @@
 }:

 let
-  version = "1.5.1";
+  version = "1.6.0";
  tag = "v${version}";
  system = lib.replaceStrings [ "darwin" ] [ "macos" ] stdenvNoCC.hostPlatform.system;
  hashes = {
-    aarch64-darwin = "sha256-BHld8Dwwd6fexc05oHOIawa5PtGZAI61wQGWE8T+iMs=";
-    aarch64-linux = "sha256-KM3/y31OdLmEAcc48TSLmXei2GD6FhOHYlD7W/ErP+I=";
-    x86_64-darwin = "sha256-cE0JJK92pTJyGnHEZ7wA6+dpMvVOTMzFM2Mkwfy5kbQ=";
-    x86_64-linux = "sha256-9qSjqPFmUaUnpGQ/ldIpyFSgTWbUYozcckpYxpm5PJU=";
+    aarch64-darwin = "sha256-VI4lvaOXGgfDLXiiSRNc+Mt7Pu3hAeh44G5T4BrC4M4=";
+    aarch64-linux = "sha256-FaGGJQ5o1r/07IOf/yddRakOODppIJ3MEjnrnjrubhs=";
+    x86_64-darwin = "sha256-2FqHXCoHHwwp/lcnZMUsOkmfFXq3+e+siTmkNkOQ4ps=";
+    x86_64-linux = "sha256-Te0nHM9GUDHM0Nw156FA4TTX8wchZxzEqOH/gF1KrWg=";
  };
 in
 stdenvNoCC.mkDerivation {
@@ -61,6 +61,11 @@ stdenvNoCC.mkDerivation {
    versionCheckHook
  ];

+  # https://github.com/extism/js-pdk/pull/154
+  preInstallCheck = ''
+    version=1.5.1
+  '';
+
  meta = {
    changelog = "https://github.com/extism/js-pdk/releases/tag/${tag}";
    description = "Write Extism plugins in JavaScript & TypeScript";
@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    zstandard
  ];

-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

  nativeCheckInputs =
    with python3.pkgs;
@@ -11,13 +11,13 @@

 buildNpmPackage rec {
  pname = "ghostfolio";
-  version = "2.237.0";
+  version = "2.239.0";

  src = fetchFromGitHub {
    owner = "ghostfolio";
    repo = "ghostfolio";
    tag = version;
-    hash = "sha256-udko0oiO5tLEDBKxkGiTRU0Qd/Yd0bvPB6iPM5wJ7Ls=";
+    hash = "sha256-1CJM395lApSIo5/7WVaLaBV1MwNJ7ehWukln59Ew6fg=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
    '';
  };

-  npmDepsHash = "sha256-2j/u++63qaOzvsgdhWeDsH+TUVmOLvgQQRNY14LZI2k=";
+  npmDepsHash = "sha256-rX/RkM2wjDFoL/BtnNa3WuUlHIIlviGGsfoobDzeD0M=";

  nativeBuildInputs = [
    prisma_6
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-IVizzc2dKZ83dz3KBMDDiaFNdnS40cS++k8AywyvakQ=";
  };

-  ZSTD_SYS_USE_PKG_CONFIG = true;
+  env.ZSTD_SYS_USE_PKG_CONFIG = true;

  enableParallelBuilding = true;

@@ -10,11 +10,11 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitlab-timelogs";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-WmdN3w0t7omA2F+Fpv+PkT/hymgTzxlTSBytKep+6Lo=";
+    hash = "sha256-DNMJczR4yaglIOcNmb2E1g+UP0VeJaIb5TvdKUcWzc0=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
    iconv
  ];

-  cargoHash = "sha256-Ap/R/Sa60LUAKByzKGYzj/IZeq/UDiZzBxYY0Ell6Kw=";
+  cargoHash = "sha256-aCt534oDG9u37xLQjG7Ye+EKpTgW4q/LqaVkxw5iEJ0=";

  meta = {
    description = "CLI utility to support you with your time logs in GitLab";
@@ -1,26 +1,36 @@
 {
  lib,
  fetchFromGitHub,
-  # Build fails with Go 1.25, with the following error:
-  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
-  # Wait for upstream to update their vendored dependencies before unpinning.
-  buildGo124Module,
+  fetchpatch,
+  applyPatches,
+  buildGoModule,
 }:

-buildGo124Module {
+buildGoModule {
  pname = "goconvey";
  version = "1.8.1-unstable-2024-03-06";

  excludedPackages = "web/server/watch/integration_testing";

-  src = fetchFromGitHub {
-    owner = "smartystreets";
-    repo = "goconvey";
-    rev = "a50310f1e3e53e63e2d23eb904f853aa388a5988";
-    hash = "sha256-w5eX/n6Wu2gYgCIhgtjqH3lNckWIDaN4r80cJW3JqFo=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "smartystreets";
+      repo = "goconvey";
+      rev = "a50310f1e3e53e63e2d23eb904f853aa388a5988";
+      hash = "sha256-w5eX/n6Wu2gYgCIhgtjqH3lNckWIDaN4r80cJW3JqFo=";
+    };
+    patches = [
+      # Update golang.org/x/tools to v0.42.0 for Go 1.25+ compatibility
+      # https://github.com/smartystreets/goconvey/pull/703
+      (fetchpatch {
+        url = "https://github.com/smartystreets/goconvey/commit/a8d73b2e5380902ab6caa6716ad69c324f390a2d.patch";
+        hash = "sha256-4JZs4/kxt3KP21q4U8mpBJkueVmRsCsKqST1Cn6ySN8=";
+      })
+    ];
  };

-  vendorHash = "sha256-P4J/CZY95ks08DC+gSqG+eanL3zoiaoz1d9/ZvBoc9Q=";
+  proxyVendor = true;
+  vendorHash = "sha256-0LQ5yxqy+WGc9TzmXiiHYyUNIIImoLsItkv5KcHjVGc=";

  ldflags = [
    "-s"
@@ -14,16 +14,16 @@

 buildGo126Module (finalAttrs: {
  pname = "golangci-lint";
-  version = "2.9.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8LEtm1v0slKwdLBtS41OilKJLXytSxcI9fUlZbj5Gfw=";
+    hash = "sha256-rHttQ+QJ9JrFvgfoX68Y0lD6BUv/aoOpRRFvZ1BIGIs=";
  };

-  vendorHash = "sha256-w8JfF6n1ylrU652HEv/cYdsOdDZz9J2uRQDqxObyhkY=";
+  vendorHash = "sha256-yREpROQJ300+mii7R2oiyDjOGcYXBpv3o/park0TJYE=";

  subPackages = [ "cmd/golangci-lint" ];

@@ -0,0 +1,155 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 nurl
+"""
+Generate grammar information for Helix editor by parsing languages.toml
+and fetching source information using nurl in parallel.
+"""
+
+import argparse
+import asyncio
+import json
+import os
+import sys
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass
+class Grammar:
+    name: str
+    git_url: str
+    rev: str
+    subpath: str | None = None
+
+
+async def run_nurl(url: str, rev: str, semaphore: asyncio.Semaphore) -> dict[str, Any]:
+    """Run nurl command for a single grammar and return parsed JSON output."""
+    async with semaphore:
+        proc = await asyncio.create_subprocess_exec(
+            "nurl",
+            url,
+            rev,
+            "--json",
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        stdout, stderr = await proc.communicate()
+
+        if proc.returncode != 0:
+            raise RuntimeError(f"nurl failed for {url}@{rev}: {stderr.decode()}")
+
+        return json.loads(stdout.decode())
+
+
+def parse_languages_toml(toml_path: Path) -> list[Grammar]:
+    """Parse languages.toml and extract grammar information."""
+    with open(toml_path, "rb") as f:
+        config = tomllib.load(f)
+
+    grammars = []
+    for grammar in config.get("grammar", []):
+        if "source" not in grammar:
+            continue
+
+        source = grammar["source"]
+        if "git" not in source or "rev" not in source:
+            continue
+
+        grammars.append(
+            Grammar(
+                name=grammar["name"].replace("_", "-"),
+                git_url=source["git"],
+                rev=source["rev"],
+                subpath=source.get("subpath"),
+            )
+        )
+
+    return grammars
+
+
+async def fetch_all_grammars(
+    grammars: list[Grammar], max_parallel: int
+) -> dict[str, Any]:
+    """Fetch nurl information for all grammars in parallel."""
+    semaphore = asyncio.Semaphore(max_parallel)
+    results = {}
+    total = len(grammars)
+    completed = 0
+
+    tasks = []
+    for grammar in grammars:
+        task = run_nurl(grammar.git_url, grammar.rev, semaphore)
+        tasks.append((grammar, task))
+
+    for grammar, task in tasks:
+        try:
+            result = await task
+            results[grammar.name] = {
+                "nurl": result,
+                "subpath": grammar.subpath,
+            }
+            completed += 1
+            print(f"[{completed}/{total}] ✓ {grammar.name}", file=sys.stderr)
+        except Exception as e:
+            completed += 1
+            print(f"[{completed}/{total}] ✗ {grammar.name}: {e}", file=sys.stderr)
+            results[grammar.name] = {"error": str(e)}
+
+    return results
+
+
+async def main():
+    parser = argparse.ArgumentParser(
+        description="Generate grammar information for Helix editor"
+    )
+    parser.add_argument(
+        "languages_toml",
+        type=Path,
+        help="path to languages.toml from Helix repository",
+    )
+    parser.add_argument(
+        "-o",
+        "--output",
+        type=Path,
+        default=Path("grammars.json"),
+        help="output JSON file (default: grammars.json)",
+    )
+    parser.add_argument(
+        "-j",
+        "--jobs",
+        type=int,
+        default=os.cpu_count(),
+        help=f"number of parallel nurl instances (default: {os.cpu_count()})",
+    )
+
+    args = parser.parse_args()
+
+    if not args.languages_toml.exists():
+        print(f"Error: {args.languages_toml} not found", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"Parsing {args.languages_toml}...", file=sys.stderr)
+    grammars = parse_languages_toml(args.languages_toml)
+    print(f"Found {len(grammars)} grammars", file=sys.stderr)
+
+    print(f"Fetching grammar information ({args.jobs} parallel jobs)...", file=sys.stderr)
+    results = await fetch_all_grammars(grammars, args.jobs)
+
+    errors = [name for name, data in results.items() if "error" in data]
+    if errors:
+        print(f"\nFailed grammars ({len(errors)}):", file=sys.stderr)
+        for name in errors:
+            print(f"  - {name}: {results[name]['error']}", file=sys.stderr)
+        sys.exit(1)
+
+    with open(args.output, "w") as f:
+        json.dump(results, f, indent=2)
+        f.write('\n')
+
+    print(f"\nResults written to {args.output}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
@@ -1,88 +1,154 @@
 {
-  fetchzip,
-  fetchpatch,
+  fetchFromGitHub,
  lib,
  rustPlatform,
  mdbook,
-  git,
+  gitMinimal,
  installShellFiles,
  versionCheckHook,
-  nix-update-script,
+  runCommand,
+  removeReferencesTo,
+  pkgs,
+  tree-sitter,
+  lockedGrammars ? lib.importJSON ./grammars.json,
+  grammarsOverlay ? (
+    final: prev: {
+      tree-sitter-sql = prev.tree-sitter-sql.override {
+        generate = false;
+      };
+      tree-sitter-qmljs = prev.tree-sitter-qmljs.overrideAttrs {
+        dontCheckForBrokenSymlinks = true;
+      };
+    }
+  ),
 }:

-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "helix";
-  version = "25.07.1";
-  outputs = [
-    "out"
-    "doc"
-  ];
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    lockedVersionsOverlay =
+      final: prev:
+      lib.mapAttrs (
+        drvName: grammar:
+        let
+          lockedGrammar = lockedGrammars.${lib.removePrefix "tree-sitter-" drvName};
+        in
+        (prev.${drvName}.override {
+          location = lockedGrammar.subpath;
+        }).overrideAttrs
+          {
+            version = lib.sources.shortRev lockedGrammar.nurl.args.rev;
+            src = (pkgs.${lockedGrammar.nurl.fetcher} lockedGrammar.nurl.args);
+          }
+      ) prev;

-  # This release tarball includes source code for the tree-sitter grammars,
-  # which is not ordinarily part of the repository.
-  src = fetchzip {
-    url = "https://github.com/helix-editor/helix/releases/download/${finalAttrs.version}/helix-${finalAttrs.version}-source.tar.xz";
-    hash = "sha256-Pj/lfcQXRWqBOTTWt6+Gk61F9F1UmeCYr+26hGdG974=";
-    stripRoot = false;
-  };
+    tree-sitter-grammars =
+      lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
+        (
+          tree-sitter.grammarsScope.overrideScope (
+            lib.composeExtensions lockedVersionsOverlay grammarsOverlay
+          )
+        );

-  patches = [
-    # Support mdbook 0.5.x: escape HTML tags in command descriptions
-    ./mdbook-0.5-support.patch
-  ];
+    # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
+    # See here: https://github.com/helix-editor/helix/pull/14982
+    # Switch to `stdenv.hostPlatform.extensions.sharedLibrary` once the fix above reaches the next release

-  postPatch = ''
-    # mdbook 0.5 uses asset hashing for CSS/JS files
-    # Remove custom theme to use default mdbook theme with correct asset references
-    rm -f book/theme/index.hbs
-  '';
+    grammarsFarm = runCommand "helix-grammars" { } (
+      lib.concatMapAttrsStringSep "\n" (_: grammar: ''
+        install -D ${grammar}/parser $out/${grammar.language}.so
+        ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
+      '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
+    );

-  cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+    lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);

-  nativeBuildInputs = [
-    git
-    installShellFiles
-    mdbook
-  ];
-
-  env.HELIX_DEFAULT_RUNTIME = "${placeholder "out"}/lib/runtime";
-
-  postBuild = ''
-    mdbook build book -d ../book-html
-  '';
-
-  postInstall = ''
-    # not needed at runtime
-    rm -r runtime/grammars/sources
-
-    mkdir -p $out/lib $doc/share/doc
-    cp -r runtime $out/lib
-    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
-    mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
-    cp contrib/Helix.desktop $out/share/applications
-    cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
-    cp -r ../book-html $doc/share/doc/$name
-  '';
-
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  versionCheckProgram = "${placeholder "out"}/bin/hx";
-  doInstallCheck = true;
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Post-modern modal text editor";
-    homepage = "https://helix-editor.com";
-    changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = lib.licenses.mpl20;
-    mainProgram = "hx";
-    maintainers = with lib.maintainers; [
-      danth
-      yusdacra
+    runtimeDir = runCommand "helix-runtime" { } ''
+      cp -r --no-preserve=mode ${finalAttrs.src}/runtime $out
+      rm -r $out/grammars
+      ln -s ${grammarsFarm} $out/grammars
+      count=$(ls -1 "$out/grammars/" | wc -l)
+      if [ "$count" -ne ${toString lockedGrammarsCount} ]; then
+        echo "Expected ${toString lockedGrammarsCount} grammars, found $count"
+        exit 1
+      fi
+    '';
+  in
+  {
+    pname = "helix";
+    version = "25.07.1";
+    outputs = [
+      "out"
+      "doc"
    ];
-  };
-})
+
+    src = fetchFromGitHub {
+      owner = "helix-editor";
+      repo = "helix";
+      tag = "${finalAttrs.version}";
+      hash = "sha256-RFSzGAcB0mMg/02ykYfTWXzQjLFu2CJ4BkS5HZ/6pBo=";
+    };
+
+    patches = [
+      # Support mdbook 0.5.x: escape HTML tags in command descriptions
+      ./mdbook-0.5-support.patch
+    ];
+
+    postPatch = ''
+      # mdbook 0.5 uses asset hashing for CSS/JS files
+      # Remove custom theme to use default mdbook theme with correct asset references
+      rm -f book/theme/index.hbs
+    '';
+
+    cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+
+    nativeBuildInputs = [
+      gitMinimal
+      installShellFiles
+      mdbook
+    ];
+
+    env = {
+      HELIX_DEFAULT_RUNTIME = runtimeDir;
+      HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
+    };
+
+    postBuild = ''
+      mdbook build book -d ../book-html
+    '';
+
+    postInstall = ''
+      mkdir -p $out/lib $doc/share/doc
+      installShellCompletion contrib/completion/hx.{bash,fish,zsh}
+      mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
+      cp contrib/Helix.desktop $out/share/applications/Helix.desktop
+      cp contrib/helix.png $out/share/icons/hicolor/256x256/apps/helix.png
+      cp -r ../book-html $doc/share/doc/$name
+    '';
+
+    nativeInstallCheckInputs = [
+      versionCheckHook
+    ];
+    versionCheckProgram = "${placeholder "out"}/bin/hx";
+    doInstallCheck = true;
+
+    passthru = {
+      updateScript = ./update.sh;
+      runtime = runtimeDir;
+      inherit tree-sitter-grammars;
+    };
+
+    meta = {
+      description = "Post-modern modal text editor";
+      homepage = "https://helix-editor.com";
+      changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
+      license = lib.licenses.mpl20;
+      mainProgram = "hx";
+      maintainers = with lib.maintainers; [
+        aciceri
+        danth
+        yusdacra
+      ];
+    };
+  }
+)
@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nurl nix-update python3
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+echo "Updating helix source to the latest stable..."
+nix-update helix
+
+echo "Fetching updated helixSource..."
+HELIX_SRC=$(nix-instantiate --eval -A "helix.src.outPath" --raw)
+
+echo "Generating grammars.json..."
+"$SCRIPT_DIR/generate_grammars.py" \
+  "$HELIX_SRC/languages.toml" \
+  -o "$SCRIPT_DIR/grammars.json"
+
+if [ $? -ne 0 ]; then
+  echo "Error: Failed to generate grammars.json" >&2
+  exit 1
+fi
+
+echo "Done! Updated grammars.json"
@@ -20,8 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
    openssl
  ];

-  PREFIX = "\${out}";
-  USE_SSL = 1;
+  env = {
+    PREFIX = "\${out}";
+    USE_SSL = 1;
+  };

  meta = {
    homepage = "https://github.com/redis/hiredis";
@@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ipmiutil";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchurl {
    url = "mirror://sourceforge/project/ipmiutil/ipmiutil-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-BIEbLmV/+YzTHkS5GnAMnzPEyd2To2yPyYfeH0fCQCQ=";
+    sha256 = "sha256-N/m8jmsYwRVeTV6jjIe4OQi3rMekT7xeOvST8m74t2c=";
  };

  buildInputs = [ openssl ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-T7053eAH3IqkAxNZpYHdC6Z7JZtArrOqGMjoIccjemI=";

-  SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
+  env.SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";

  nativeBuildInputs = [
    autoPatchelfHook
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    echo "fn main() {}" > build.rs
  '';

-  VERGEN_GIT_SEMVER = "v${finalAttrs.version}";
+  env.VERGEN_GIT_SEMVER = "v${finalAttrs.version}";

  # Test require network access
  doCheck = false;
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "kubectl-oidc-login";
+  version = "1.35.2";
+
+  src = fetchFromGitHub {
+    owner = "int128";
+    repo = "kubelogin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jSPNvr+spZvilTooK7s6l8CyvP5tzSWxqJzaoJCA5AM=";
+  };
+
+  vendorHash = "sha256-otzcOmW3mkiJrIv69wme5cHp5/iO2YSH+ecZgeX2aV0=";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  # Rename output binary to kubectl-<plugin-name> so kubectl recognizes it on $PATH.
+  postInstall = ''
+    mv $out/bin/{kubelogin,${finalAttrs.meta.mainProgram}}
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Kubernetes kubelogin plugin to add OpenID Connect authentication to kubectl. Run \"kubectl oidc-login ...\"";
+    # Quirk: we have to write "oidc_login" instead of "oidc-login"
+    # (at least on Mac "aarch64-darwin" and "x86_64_linux"), otherwise calling
+    # "kubectl oidc-login <subcommand>" fails that it can't find the underlying plugin in $PATH.
+    mainProgram = "kubectl-oidc_login";
+    homepage = "https://github.com/int128/kubelogin";
+    changelog = "https://github.com/int128/kubelogin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.malteneuss ];
+  };
+})
@@ -9,7 +9,7 @@ kubernetes.overrideAttrs (_: {
    "convert"
  ];

-  WHAT = lib.concatStringsSep " " [
+  env.WHAT = toString [
    "cmd/kubectl"
    "cmd/kubectl-convert"
  ];
@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {

  patches = [ ./fixup-addonmanager-lib-path.patch ];

-  WHAT = lib.concatStringsSep " " components;
+  env.WHAT = toString components;

  buildPhase = ''
    runHook preBuild
@@ -15,7 +15,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lean4";
-  version = "4.27.0";
+  version = "4.28.0";

  # Using a vendored version rather than nixpkgs' version to match the exact version required by
  # Lean.  Apparently, even a slight version change can impact greatly the final performance.
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "leanprover";
    repo = "lean4";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nxAznaWQEilzn93SZTKLKL7TZEPD5LRcJLFmgoCWsXA=";
+    hash = "sha256-K6lWXZ8XVEv91skjCal+hML2Tzr9G804j9Roq+4HXQQ=";
  };

  postPatch =
@@ -61,5 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = lib.platforms.linux;
    license = lib.licenses.lgpl21;
    maintainers = with lib.maintainers; [ grimmauld ];
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "libcap-ng_project" finalAttrs.version;
  };
 })
@@ -14,7 +14,9 @@ let
  flatbuffers_23_5_26 = flatbuffers.overrideAttrs (oldAttrs: rec {
    version = "23.5.26";
    cmakeFlags = (oldAttrs.cmakeFlags or [ ]) ++ [ "-DFLATBUFFERS_BUILD_SHAREDLIB=ON" ];
-    NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+    env = (oldAttrs.env or { }) // {
+      NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+    };
    configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ "--enable-shared" ];
    src = fetchFromGitHub {
      owner = "google";
@@ -67,13 +69,15 @@ stdenv.mkDerivation {

  nativeBuildInputs = [ xxd ];

-  NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+  env = {
+    NIX_CXXSTDLIB_COMPILE = "-std=c++17";

-  TFROOT = fetchFromGitHub {
-    owner = "tensorflow";
-    repo = "tensorflow";
-    rev = "v2.16.1";
-    hash = "sha256-UPvK5Kc/FNVJq3FchN5IIBBObvcHtAPVv0ARzWzA35M=";
+    TFROOT = fetchFromGitHub {
+      owner = "tensorflow";
+      repo = "tensorflow";
+      rev = "v2.16.1";
+      hash = "sha256-UPvK5Kc/FNVJq3FchN5IIBBObvcHtAPVv0ARzWzA35M=";
+    };
  };

  enableParallelBuilding = true;
@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.86.12";
+  version = "0.87.1";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XVq1fvhUF0WqSs1lJRCBRuhOW4idY6Nm21UdX4/6TE8=";
+    hash = "sha256-yr2+yM7RmUQ7mNDMCcaM5cCpudof14JuO5J6D944k0U=";
  };

  nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  env.BORING_BSSL_PATH = "${boringssl-wrapper}";
  env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";

-  cargoHash = "sha256-vat7vjL9HDY/m7CLUJNpU3NZ79nCVHxLO5tEtaEDBnE=";
+  cargoHash = "sha256-rqxp+RZuuT+nFudNeCgA8g04C9KT1Qi59K4b2avL5u4=";

  cargoBuildFlags = [
    "-p"
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "libucl";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "vstakhov";
    repo = "libucl";
    rev = finalAttrs.version;
-    sha256 = "sha256-dub829xZ10sJ5qwegYUiGoyAVLiwg44GKSzz+BMLJis=";
+    sha256 = "sha256-m6VRtFNKm6+T7pPP2u3avMkVTmye4CM6Z7wjhddVMZE=";
  };

  nativeBuildInputs = [
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ jdk17_headless ];

-  _JAVA_HOME = "${jdk17_headless}/";
+  env._JAVA_HOME = "${jdk17_headless}/";

  postPatch = ''
    substituteInPlace bin/lfc \
@@ -59,5 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = [ lib.maintainers.tobim ];
    platforms = lib.platforms.all;
    mainProgram = "logrotate";
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "logrotate_project" finalAttrs.version;
  };
 })
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
  pname = "mautrix-signal";
-  version = "26.01";
-  tag = "v0.2601.0";
+  version = "26.02";
+  tag = "v0.2602.0";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "signal";
    inherit tag;
-    hash = "sha256-zvB0CbSzrLcUJiEIj3vtDq2C0XEYUNRbaUAn+636+uk=";
+    hash = "sha256-FWFAH+jtPdLG9vJS4QXpFjsGWUzILW17WRFyfdnFlAE=";
  };

  buildInputs =
@@ -44,7 +44,7 @@ buildGoModule rec {

  CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];

-  vendorHash = "sha256-Eo7T/63ywNnn/t0RzjwkSYRmrL0IMdIsv4wqrQFv+5U=";
+  vendorHash = "sha256-TFz5P8czj8J9+QTFHjffCldw8Je2+DiM49W7jv5rY/I=";

  ldflags = [
    "-X"
@@ -8,27 +8,36 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "monocle";
-  version = "0.9.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "bgpkit";
    repo = "monocle";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-64oa3rmPR1PFmtGti1LVubO+2lY4VIkdMBKP6/IeyFk=";
+    hash = "sha256-F7z8WZAj00dYfawUiCTLnipkut9QAnXiO8DgIhJ/78U=";
  };

-  cargoHash = "sha256-rSvq+aHI5u0W1RG3JQooljeDmxTHE9ywdPguHdV3T+c=";
+  cargoHash = "sha256-+XdOvjQJkeDBH/3XtMX0SCGyji10UgnSme4oZuhwiq8=";

  # require internet access
-  checkFlags = [
-    "--skip=datasets::as2org::tests::test_crawling"
-    "--skip=datasets::ip::tests::test_fetch_ip_info"
-    "--skip=datasets::rpki::validator::tests::test_bgp"
-    "--skip=datasets::rpki::validator::tests::test_list_asn"
-    "--skip=datasets::rpki::validator::tests::test_list_prefix"
-    "--skip=datasets::rpki::validator::tests::test_validation"
-    "--skip=filters::search::tests::test_build_broker_with_filters"
-    "--skip=filters::search::tests::test_pagination_logic"
+  checkFlags = map (t: "--skip=${t}") [
+    "datasets::as2org::tests::test_crawling"
+    "datasets::ip::tests::test_fetch_ip_info"
+    "datasets::rpki::validator::tests::test_bgp"
+    "datasets::rpki::validator::tests::test_list_asn"
+    "datasets::rpki::validator::tests::test_list_prefix"
+    "datasets::rpki::validator::tests::test_validation"
+    "filters::search::tests::test_build_broker_with_filters"
+    "filters::search::tests::test_pagination_logic"
+    "lens::country::tests::test_all"
+    "lens::country::tests::test_lookup_by_code"
+    "lens::country::tests::test_lookup_by_name"
+    "lens::country::tests::test_lookup_code"
+    "lens::country::tests::test_search_with_args"
+    "lens::ip::tests::test_fetch_ip_info"
+    "lens::search::tests::test_build_broker_with_filters"
+    "lens::search::tests::test_pagination_logic"
+    "server::handlers::country::tests::test_country_lens_lookup"
  ];

  doInstallCheck = true;
@@ -103,8 +103,10 @@ stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_SKIP_BUILD_RPATH=ON"
  ];

-  WITH_FONTS = "NO";
-  WITH_UPDATER = "NO";
+  env = {
+    WITH_FONTS = "NO";
+    WITH_UPDATER = "NO";
+  };

  installPhase = ''
    runHook preInstall
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "namespace-cli";
-  version = "0.0.479";
+  version = "0.0.486";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-EznGetJAjUMgQjTHgWA4nv3c6RobrSU28lEjN0PgsiE=";
+    hash = "sha256-FBk4PVIKpy6MvquqtQyfgw1/Twgef/CHE7/+mpsJjTw=";
  };

-  vendorHash = "sha256-dk32fNNO5nN/RuYOu+vx8Gjxdcs1vt6K9CrV1iXn++E=";
+  vendorHash = "sha256-GPO3vdk26K54VmjHmg1PL/nQd6GTz/ZQk8ZpNQHoqSQ=";

  subPackages = [
    "cmd/nsc"
@@ -41,31 +41,33 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {

  cargoHash = "sha256-DD2c63JHMdzwD1OmC7c9dMB59qjvdAYZ9drQf3f8xCs=";

-  SKIA_SOURCE_DIR =
-    let
-      repo = fetchFromGitHub {
-        owner = "rust-skia";
-        repo = "skia";
-        # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-        tag = "m140-0.87.4";
-        hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
-      };
-      # The externals for skia are taken from skia/DEPS
-      externals = linkFarm "skia-externals" (
-        lib.mapAttrsToList (name: value: {
-          inherit name;
-          path = fetchgit value;
-        }) (lib.importJSON ./skia-externals.json)
-      );
-    in
-    runCommand "source" { } ''
-      cp -R ${repo} $out
-      chmod -R +w $out
-      ln -s ${externals} $out/third_party/externals
-    '';
+  env = {
+    SKIA_SOURCE_DIR =
+      let
+        repo = fetchFromGitHub {
+          owner = "rust-skia";
+          repo = "skia";
+          # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
+          tag = "m140-0.87.4";
+          hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
+        };
+        # The externals for skia are taken from skia/DEPS
+        externals = linkFarm "skia-externals" (
+          lib.mapAttrsToList (name: value: {
+            inherit name;
+            path = fetchgit value;
+          }) (lib.importJSON ./skia-externals.json)
+        );
+      in
+      runCommand "source" { } ''
+        cp -R ${repo} $out
+        chmod -R +w $out
+        ln -s ${externals} $out/third_party/externals
+      '';

-  SKIA_GN_COMMAND = "${gn}/bin/gn";
-  SKIA_NINJA_COMMAND = "${ninja}/bin/ninja";
+    SKIA_GN_COMMAND = "${gn}/bin/gn";
+    SKIA_NINJA_COMMAND = "${ninja}/bin/ninja";
+  };

  nativeBuildInputs = [
    makeWrapper
@@ -124,7 +126,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
      install -m444 -Dt $out/share/applications assets/neovide.desktop
    '';

-  disallowedReferences = [ finalAttrs.SKIA_SOURCE_DIR ];
+  disallowedReferences = [ finalAttrs.env.SKIA_SOURCE_DIR ];

  meta = {
    description = "Simple, no-nonsense, cross-platform graphical user interface for Neovim";
@@ -56,9 +56,6 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  # Environment variables
-  STRIPPROG = "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip";
-
  postPatch = ''
    # Install libnetpbm.so symlink to correct destination
    substituteInPlace lib/Makefile \
@@ -102,7 +99,10 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postConfigure
  '';

-  env = lib.optionalAttrs stdenv.cc.isClang {
+  env = {
+    STRIPPROG = "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip";
+  }
+  // lib.optionalAttrs stdenv.cc.isClang {
    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
  };

@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "networkmanager";
-  version = "1.54.3";
+  version = "1.56.0";

  src = fetchurl {
    url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-z0/vw76WgCxaTas+aQvcTOTHglGVTvChtlAm2IZwmYk=";
+    hash = "sha256-WaMtOFzB564m5DeYxvEtB/9hmKvQQewGILOgjPwCHMw=";
  };

  outputs = [
@@ -4,18 +4,18 @@
  makeWrapper,
  nextflow,
  nf-test,
-  openjdk11,
+  openjdk17,
  stdenv,
  testers,
 }:
 stdenv.mkDerivation (finalAttrs: {

  pname = "nf-test";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchurl {
    url = "https://github.com/askimed/nf-test/releases/download/v${finalAttrs.version}/nf-test-${finalAttrs.version}.tar.gz";
-    hash = "sha256-LLylgv34HiMXg+sjBbMdeLVPMV5+h+Z2xEWCiBqbNEY=";
+    hash = "sha256-A9k8HVIPqbfHZKqSY2wqOhgvZ9aSb3K4SdoLOypB2j8=";
  };
  sourceRoot = ".";

@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
    install -Dm644 nf-test.jar $out/share/nf-test

    mkdir -p $out/bin
-    makeWrapper ${openjdk11}/bin/java $out/bin/nf-test \
+    makeWrapper ${openjdk17}/bin/java $out/bin/nf-test \
      --add-flags "-jar $out/share/nf-test/nf-test.jar" \
      --prefix PATH : ${lib.makeBinPath [ nextflow ]} \

@@ -25,8 +25,10 @@ stdenv.mkDerivation (finalAttrs: {
    openblas
  ];

-  NIX_ENFORCE_NO_NATIVE = !enableAVX;
-  __AVX2__ = if enableAVX then 1 else 0;
+  env = {
+    NIX_ENFORCE_NO_NATIVE = !enableAVX;
+    __AVX2__ = if enableAVX then 1 else 0;
+  };

  meta = {
    homepage = "https://github.com/yahoojapan/NGT";
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage {
  doCheck = false;

  # link against packaged libnitrokey
-  USE_SYSTEM_LIBNITROKEY = 1;
+  env.USE_SYSTEM_LIBNITROKEY = 1;

  nativeBuildInputs = [ installShellFiles ];

@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {

  # Tests require certificates
  # https://github.com/NixOS/nixpkgs/pull/72544#issuecomment-582674047
-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

  pythonImportsCheck = [ "nix_playground" ];

@@ -19,6 +19,10 @@
  swig,
  # Optionally exclude Luksan solvers to allow licensing under MIT
  withoutLuksanSolvers ? false,
+
+  # Builds docs on-demand
+  withDocs ? false,
+
  # Build static on-demand
  withStatic ? stdenv.hostPlatform.isStatic,

@@ -37,49 +41,16 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
  pname = "nlopt";
-  version = "2.10.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "stevengj";
    repo = "nlopt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mZRmhXrApxfiJedk+L/poIP2DR/BkV04c5fiwPGAyjI=";
+    hash = "sha256-i+Cd2VLMbI4PUSXennR8jgF+/ZkzKX9WkVTPtayr8vs=";
  };

-  outputs = [
-    "out"
-    "doc"
-  ];
-
-  patches = [
-    # 26-03-2025: `mkdocs.yml` is missing a link for the subpage related to the Java bindings.
-    # 26-03-2025: This commit was merged after v2.10.0 was released, and has not been made
-    # 26-03-2025: part of a release.
-    (fetchpatch {
-      name = "missing-java-reference-mkdocs";
-      url = "https://github.com/stevengj/nlopt/commit/7e34f1a6fe82ed27daa6111d83c4d5629555454b.patch";
-      hash = "sha256-XivfZtgIGLyTtU+Zo2jSQAx2mVdGLJ8PD7VSSvGR/5Q=";
-    })
-
-    # 26-03-2025: The docs pages still list v2.7.1 as the newest version.
-    # 26-03-2025: This commit was merged after v2.10.0 was released, and has not been made
-    # 26-03-2025: part of a release.
-    (fetchpatch {
-      name = "update-index-md";
-      url = "https://github.com/stevengj/nlopt/commit/2c4147832eff7ea15d0536c82351a9e169f85e43.patch";
-      hash = "sha256-BXcbNUyu20f3N146v6v9cpjSj5CwuDtesp6lAqOK2KY=";
-    })
-
-    # 26-03-2025: There is an off-by-one error in the test/CMakeLists.txt
-    # 26-03-2025: that causes the tests to attempt to run disabled Luksan solver code,
-    # 26-03-2025: which in turn causes the test suite to fail.
-    # 26-03-2025: See https://github.com/stevengj/nlopt/pull/605
-    (fetchpatch {
-      name = "fix-nondisabled-luksan-algorithm";
-      url = "https://github.com/stevengj/nlopt/commit/7817ec19f21be6877a4b79777fc5315a52c6850b.patch";
-      hash = "sha256-KgdAMSYKOQuraun4HNr9GOx48yjyeQk6W3IgWRA44oo=";
-    })
-  ];
+  outputs = [ "out" ] ++ lib.optional withDocs "doc";

  postPatch = ''
    substituteInPlace nlopt.pc.in \
@@ -123,7 +94,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    lib.cmakeFeature "Python_EXECUTABLE" "${buildPythonBindingsEnv.interpreter}"
  );

-  postBuild = ''
+  postBuild = lib.optionalString withDocs ''
    ${buildDocsEnv.interpreter} -m mkdocs build \
      --config-file ../mkdocs.yml \
      --site-dir $doc \
@@ -24,8 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
    libpcap
  ];

-  PREFIX = "${placeholder "out"}";
-  STANDALONE_VERSION = finalAttrs.version;
+  env = {
+    PREFIX = "${placeholder "out"}";
+    STANDALONE_VERSION = finalAttrs.version;
+  };

  preInstall = ''
    mkdir -p $out/bin
@@ -29,8 +29,10 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  # Build parameters
-  CFGPATH = cfgPath;
-  SENDMAIL = "sendmail";
+  env = {
+    CFGPATH = cfgPath;
+    SENDMAIL = "sendmail";
+  };

  preConfigure = "export GOCACHE=$NIX_BUILD_TOP/gocache";

@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-Bn2HxmFiqOeb3oUnUL/K0SahcFWRlY9RrbGU4orQz+Y=";

-  SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
+  env.SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";

  nativeBuildInputs = [
    cmake
@@ -12,25 +12,35 @@
  gtk4,
  libadwaita,
  pango,
-  cargo-make,
+  just,
+  sqlite,
+  wayland,
+  libxkbcommon,
+  libGL,
+  libx11,
+  libxcursor,
+  libxi,
+  autoPatchelfHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "open-scq30";
-  version = "1.12.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "Oppzippy";
    repo = "OpenSCQ30";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-DL2hYm1j27K0nnBvE3iGnguqm0m1k56bkuG+6+u4u4c=";
+    hash = "sha256-BSh10x0cbxfds/3m7XrWmVI1/9Li/Uh9OZA6I9gH8qE=";
  };

  nativeBuildInputs = [
    pkg-config
    protobuf
    wrapGAppsHook4
-    cargo-make
+    just
+    autoPatchelfHook
  ];

  buildInputs = [
@@ -41,23 +51,41 @@ rustPlatform.buildRustPackage (finalAttrs: {
    gtk4
    libadwaita
    pango
+    sqlite
+    libxkbcommon
  ];

-  cargoHash = "sha256-3K+/CpTGWSjCRa2vOEcDvLIiZMdntugIqnzkXF4wkng=";
+  # Wayland and X11 libs are required at runtime since winit uses dlopen
+  runtimeDependencies = [
+    wayland
+    libxkbcommon
+    libGL
+    libx11
+    libxcursor
+    libxi
+  ];
+
+  cargoHash = "sha256-410iXY9Ae3CPRX82LmbkWh+huna6YwBV2gtdfc3ap90=";

  env.INSTALL_PREFIX = placeholder "out";

  # Requires headphones
  doCheck = false;

+  postPatch = ''
+    patchShebangs ./gui/scripts ./cli/scripts ./scripts
+  '';
+
  buildPhase = ''
-    cargo make --profile release build
+    just build-cli
+    just build-gui
  '';

  installPhase = ''
-    cargo make --profile release install
+    just install ${placeholder "out"}
  '';

+  passthru.updateScript = nix-update-script { };
  meta = {
    description = "Cross platform application for controlling settings of Soundcore headphones";
    homepage = "https://github.com/Oppzippy/OpenSCQ30";
@@ -44,5 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.bsd2;
    maintainers = [ ];
    platforms = lib.platforms.unix;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openresolv_project" finalAttrs.version;
  };
 })
@@ -8,18 +8,18 @@

 buildGoModule (finalAttrs: {
  pname = "parca-agent";
-  version = "0.45.0";
+  version = "0.45.1";

  src = fetchFromGitHub {
    owner = "parca-dev";
    repo = "parca-agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WGR4EFsM7C7lf8VbPefw/4sQQD2ld3jCJE52M7MbRi8=";
+    hash = "sha256-NcvEU9MgAYK7jFbg/jdUP/ltgzDAIR6JNphv5Xkcba4=";
    fetchSubmodules = true;
  };

  proxyVendor = true;
-  vendorHash = "sha256-KwXSiZsviyR0wDKYFwlDUvJ+7PpEUoSyLsw2ZVcyK60=";
+  vendorHash = "sha256-/V4proGF8Vpv2w4+3vZv4tcKkEgBi6eZGMjXW9vrLts=";

  buildInputs = [
    stdenv.cc.libc.static
@@ -12,11 +12,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "plasticscm-client-core-unwrapped";
-  version = "11.0.16.9925";
+  version = "11.0.16.9943";

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-core_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-cysJFw10nTNh+WzDCFFN2DLVwhbeSnOJ5JGMNQEqd60=";
+    hash = "sha256-8YQhrRxqRfyc3n2MfVGOchOlRpr2WuteOR40dIwMOF4=";
    nativeBuildInputs = [ dpkg ];
    downloadToTemp = true;
    recursiveHash = true;
@@ -11,11 +11,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "plasticscm-client-gui-unwrapped";
-  version = "11.0.16.9925";
+  version = "11.0.16.9943";

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-gui_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-nzq5Wj/UDvBUGDNgSd/Ib+0TwD+uq1hN1J5OZCvH7sE=";
+    hash = "sha256-h3yMePj9064YSw5kIHSuTEwF5puDEaEKpylQdmzIXUE=";
    nativeBuildInputs = [ dpkg ];
    downloadToTemp = true;
    recursiveHash = true;
@@ -11,7 +11,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "plasticscm-theme";
-  version = "11.0.16.9925";
+  version = "11.0.16.9943";

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-theme_${finalAttrs.version}_amd64.deb";
@@ -23,7 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  makefile = "Makefile.unx";
-  makeFlags = [ "ZPATH=${zlib.static}/lib" ];

  nativeBuildInputs = [ installShellFiles ];

@@ -31,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {

  installPhase = ''
    runHook preInstall
-    install -Dm555 -t $out/bin/ pngcheck
+    installBin pngcheck
    installManPage $pname.1
    runHook postInstall
  '';
@@ -55,7 +55,10 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  passthru = {
-    updateScript = gitUpdater { rev-prefix = "v"; };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+      ignoredVersions = "rc";
+    };
    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
  };

@@ -23,7 +23,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  nativeBuildInputs = [ pkg-config ];

-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
  checkInputs = [ cacert ];

  meta = {
@@ -27,7 +27,7 @@ buildPythonApplication rec {
  buildInputs = [ m2r ];

  # setup.py reads its version from the TRAVIS_TAG environment variable
-  TRAVIS_TAG = version;
+  env.TRAVIS_TAG = version;

  checkPhase = ''
    ${python.interpreter} -m doctest pylint_exit.py
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm build.rs
  '';

-  VERGEN_SEMVER = finalAttrs.version;
+  env.VERGEN_SEMVER = finalAttrs.version;

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -65,7 +65,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    ++ extraInputs;

  # Don't use fixed dependencies on Darwin
-  USE_STATIC_REQUIREMENTS = "0";
+  env.USE_STATIC_REQUIREMENTS = "0";

  # The tests fail due to socket path length limits at the very least;
  # possibly there are more issues but I didn't leave the test suite running
@@ -159,16 +159,18 @@ python312Packages.buildPythonApplication {
    libiconv
  ];

-  HGNAME = "sl";
-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-  SAPLING_OSS_BUILD = "true";
-  SAPLING_VERSION = version;
-  SAPLING_VERSION_HASH =
-    let
-      sha1Hash = builtins.hashString "sha1" version;
-      hexSubstring = builtins.substring 0 16 sha1Hash;
-    in
-    lib.trivial.fromHexString hexSubstring;
+  env = {
+    HGNAME = "sl";
+    LIBCLANG_PATH = "${lib.getLib libclang}/lib";
+    SAPLING_OSS_BUILD = "true";
+    SAPLING_VERSION = version;
+    SAPLING_VERSION_HASH =
+      let
+        sha1Hash = builtins.hashString "sha1" version;
+        hexSubstring = builtins.substring 0 16 sha1Hash;
+      in
+      lib.trivial.fromHexString hexSubstring;
+  };

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    sha256 = "sha256-ztM1g71g8SN1LTyFF7sxaLhC3+nVsC9fJwfYPjkUsdE=";
  };

-  SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;

  build-system = with python3Packages; [ setuptools-scm ];

@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sentry-native";
-  version = "0.12.6";
+  version = "0.12.8";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = finalAttrs.version;
-    hash = "sha256-2GapfbYtfo+Dw5KJjQ07ni1bUyLoVt6bINOBdohFKrI=";
+    hash = "sha256-cdi9B0XxORIXwTgS6Se/FePSqsMbbo8/KOr3Ir0Ip+Q=";
  };

  nativeBuildInputs = [
@@ -135,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ mdaniels5757 ];
    platforms = lib.platforms.linux;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "shadow_project" finalAttrs.version;
  };

  passthru = {
@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "shtk";
+  version = "1.7";
+
+  src = fetchFromGitHub {
+    owner = "jmmv";
+    repo = "shtk";
+    tag = "shtk-${finalAttrs.version}";
+    hash = "sha256-EnJpysBI00JqLsRzdrHW62gV0wXx/Q+tpLR26jrgukU=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  configureFlags = [
+    "SHTK_SHELL=${stdenv.shell}"
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  postInstall = ''
+    # The "shtk" binary is only used when building packages that need shtk at
+    # runtime, so it's only a developer tool.
+    moveToOutput bin "$dev"
+
+    moveToOutput share/aclocal "$dev"
+    moveToOutput lib/pkgconfig "$dev"
+
+    substituteInPlace "$dev/lib/pkgconfig/shtk.pc" \
+      --replace-fail "$out/bin/shtk" "$dev/bin/shtk"
+
+    # Do not install tests.  This is a weird pattern that not many packages
+    # follow.
+    rm -rf "$out/tests"
+  '';
+
+  meta = {
+    description = "Application toolkit for programmers writing POSIX-compliant shell scripts";
+    longDescription = ''
+      The Shell Toolkit, or shtk for short, is an application toolkit
+      for programmers writing POSIX-compliant shell scripts.
+
+      shtk provides a collection of reusable modules that work on a wide
+      variety of operating systems and shell interpreters. These modules are all
+      ready to be used by calling the provided shtk_import primitive and
+      "compiling" the shell scripts into their final form using the shtk(1)
+      utility.
+
+      shtk is purely written in the shell scripting language so there are no
+      dependencies to be installed, and is known to be compatible with at least
+      bash, dash, pdksh and zsh.
+    '';
+    homepage = "https://github.com/jmmv/shtk";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.jmmv ];
+    platforms = lib.platforms.unix;
+    mainProgram = "shtk";
+  };
+})
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-IoK37ZXlMRLDPjzsLUqcfcu4asdstFJYgHc2wAg9lno=";
  };

-  VERSION = finalAttrs.version;
+  env.VERSION = finalAttrs.version;

  doCheck = true;

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional stdenv.hostPlatform.isLinux gomp
  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;

-  SQLITE_VSS_CMAKE_VERSION = finalAttrs.version;
+  env.SQLITE_VSS_CMAKE_VERSION = finalAttrs.version;

  installPhase = ''
    runHook preInstall
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  openssh,
+  shtk,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ssh-agent-switcher";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "jmmv";
+    repo = "ssh-agent-switcher";
+    tag = "ssh-agent-switcher-${version}";
+    hash = "sha256-p9W0H25pWDB+GCrwLwuVruX9p8b8kICpp+6I11ym1aw=";
+  };
+
+  cargoHash = "sha256-WioA/RjXOAHM9QWl/lxnb7gqzcp76rus7Rv+IfCYceg=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    shtk.dev
+  ];
+
+  nativeCheckInputs = [ openssh ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cargoCheckHook
+
+    shtk build -m shtk_unittest_main -o inttest inttest.sh
+    MODE="${stdenv.hostPlatform.rust.rustcTarget}/release" ./inttest
+
+    runHook postCheck
+  '';
+
+  postInstall = ''
+    installManPage ssh-agent-switcher.1
+
+    install -Dm644 README.md -t $out/share/doc/ssh-agent-switcher/
+    install -Dm644 NEWS.md -t $out/share/doc/ssh-agent-switcher/
+    install -Dm644 COPYING -t $out/share/doc/ssh-agent-switcher/
+  '';
+
+  meta = {
+    description = "SSH agent forwarding and tmux done right";
+    longDescription = ''
+      ssh-agent-switcher is a daemon that proxies SSH agent connections to any
+      valid forwarded agent provided by sshd. This allows long-lived processes
+      such as terminal multiplexers like tmux or screen to access the
+      connection-specific forwarded agents.
+    '';
+    homepage = "https://github.com/jmmv/ssh-agent-switcher";
+    changelog = "https://github.com/jmmv/ssh-agent-switcher/blob/ssh-agent-switcher-${version}/NEWS.md";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.jmmv ];
+    mainProgram = "ssh-agent-switcher";
+    platforms = lib.platforms.unix;
+  };
+}
@@ -13,13 +13,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.16.13";
+  version = "2.16.15";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-aqwmuTD2PgMGJgpBhFj2lqRcPqxhir+NHLNsFRLjG98=";
+    hash = "sha256-YlN3nv/wbHMUocQbt77iq5vD8FTJAdysDEmRRZSbQkE=";
  };

  nativeBuildInputs = [
@@ -15,13 +15,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "sub-store";
-  version = "2.21.21";
+  version = "2.21.25";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store";
    tag = finalAttrs.version;
-    hash = "sha256-b8UU7MrkoWMxo7AXQSvLrmjC4PqOFSSNglW7yOFddIs=";
+    hash = "sha256-/ltYEwzH6F0C0nMhtptJeJWxgewJ3uABlvSCZSgOufA=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";
@@ -10,12 +10,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "unifi-controller";
-  version = "10.1.84";
+  version = "10.1.85";

  # see https://community.ui.com/releases / https://www.ui.com/download/unifi
  src = fetchurl {
    url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-GHsaEbHh+t8AYOtc1LAMryWDNdz01EASQdfiiPp2T3E=";
+    hash = "sha256-bmTk17n2N7+SV+E90C8xoeFVoTgA6WhX746wOTSiU6c=";
  };

  nativeBuildInputs = [
@@ -144,7 +144,7 @@ let
    ++ google-api-core.optional-dependencies.grpc
    ++ unstructured.optional-dependencies.all-docs
  );
-  version = "0.0.92";
+  version = "0.1.1";
  unstructured_api_nltk_data = python3.pkgs.nltk.dataDir (d: [
    d.punkt
    d.averaged-perceptron-tagger
@@ -158,7 +158,7 @@ stdenvNoCC.mkDerivation {
    owner = "Unstructured-IO";
    repo = "unstructured-api";
    rev = version;
-    hash = "sha256-kPPgLb6J0vg2bpFl85N+sVrapnozS/7pCcqG0xHYcMY=";
+    hash = "sha256-xQwgk7cjerKxLn1P5ogVbNHuHCFijai13n/1bBNvsYo=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -254,5 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
      "uuid"
    ];
    priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
+
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "kernel" finalAttrs.version;
  };
 })
@@ -126,11 +126,23 @@ stdenv.mkDerivation (finalAttrs: {
    lib.optional withPAM "pam" ++ lib.optional withSystemd "systemd_logger"
  );

-  # UWSGI_INCLUDES environment variable required for "auto" plugins
-  # to be detected. See uwsgiconfig.py for more details.
-  UWSGI_INCLUDES = lib.concatStringsSep "," (
-    map (p: "${lib.getDev p}/include") finalAttrs.buildInputs
-  );
+  env = {
+    # UWSGI_INCLUDES environment variable required for "auto" plugins
+    # to be detected. See uwsgiconfig.py for more details.
+    UWSGI_INCLUDES = lib.concatStringsSep "," (
+      map (p: "${lib.getDev p}/include") finalAttrs.buildInputs
+    );
+  }
+  // lib.optionalAttrs (lib.any (x: x.name == "php") needed) {
+    # this is a hack to make the php plugin link with session.so (which on nixos is a separate package)
+    # the hack works in coordination with ./additional-php-ldflags.patch
+    UWSGICONFIG_PHP_LDFLAGS = lib.concatStringsSep "," [
+      "-Wl"
+      "-rpath=${php-embed.extensions.session}/lib/php/extensions/"
+      "--library-path=${php-embed.extensions.session}/lib/php/extensions/"
+      "-l:session.so"
+    ];
+  };

  passthru = {
    inherit python3;
@@ -154,17 +166,6 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postConfigure
  '';

-  # this is a hack to make the php plugin link with session.so (which on nixos is a separate package)
-  # the hack works in coordination with ./additional-php-ldflags.patch
-  UWSGICONFIG_PHP_LDFLAGS = lib.optionalString (lib.any (x: x.name == "php") needed) (
-    lib.concatStringsSep "," [
-      "-Wl"
-      "-rpath=${php-embed.extensions.session}/lib/php/extensions/"
-      "--library-path=${php-embed.extensions.session}/lib/php/extensions/"
-      "-l:session.so"
-    ]
-  );
-
  buildPhase = ''
    runHook preBuild

@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxplay";
-  version = "1.73";
+  version = "1.73.3";

  src = fetchFromGitHub {
    owner = "FDH2";
    repo = "UxPlay";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-cPewe1pO/PknEBogcXU5WdDOvqya7bC6aIt3itHsrEw=";
+    hash = "sha256-Fz9zraaFBqdUdRZ/OhoFe/kSGyBMkNKClhQXnTUhqKY=";
  };

  postPatch = ''
@@ -21,10 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "verilator";
  version = "5.044";

-  # Verilator gets the version from this environment variable
-  # if it can't do git describe while building.
-  VERILATOR_SRC_VERSION = "v${finalAttrs.version}";
-
  src = fetchFromGitHub {
    owner = "verilator";
    repo = "verilator";
@@ -88,6 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  env = {
+    # Verilator gets the version from this environment variable
+    # if it can't do git describe while building.
+    VERILATOR_SRC_VERSION = "v${finalAttrs.version}";
+
    SYSTEMC_INCLUDE = "${lib.getDev systemc}/include";
    SYSTEMC_LIBDIR = "${lib.getLib systemc}/lib";
  };
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "versatiles";
-  version = "3.5.0";
+  version = "3.6.2";

  src = fetchFromGitHub {
    owner = "versatiles-org";
    repo = "versatiles-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bxrx+gjJbOzDvD6/Ov3vGCvDL6x5/tEo1+qFIWl7tTI=";
+    hash = "sha256-OK+rcnWxr1s4kGsXJ8u1WK7VWzfGO7LhD/HYg9Cy1u8=";
  };

-  cargoHash = "sha256-SN1+ujgaS/lfN/CyTOVwDft8MypdYfnz1LiJE7FtQ2s=";
+  cargoHash = "sha256-/8Nnau4zkEY6oTYh08/XiN2rQ5M/bTMYyZTVD6UjAgU=";

  __darwinAllowLocalNetworking = true;

--- a/Show More
+++ b/Show More