Merge staging-next into staging

doc/redirects.json

@@ -1581,6 +1581,9 @@
   "lib.sourceTypes.binaryBytecode": [
     "index.html#lib.sourceTypes.binaryBytecode"
   ],
+  "lib.sourceTypes.obfuscatedCode": [
+    "index.html#lib.sourceTypes.obfuscatedCode"
+  ],
   "chap-passthru": [
     "index.html#chap-passthru"
   ],

doc/stdenv/meta.chapter.md

@@ -258,6 +258,10 @@ Code to be executed on a peripheral device or embedded controller, built by a th
 
 Code to run on a VM interpreter or JIT compiled into bytecode by a third party. This includes packages which download Java `.jar` files from another source.
 
+### `lib.sourceTypes.obfuscatedCode` {#lib.sourceTypes.obfuscatedCode}
+
+Code which is intentionally obfuscated by a third party, for example by using a code obfuscator or by being distributed in an obfuscated form.
+
 ## Software identifiers {#sec-meta-identifiers}
 
 Package's `meta.identifiers` attribute specifies information about software identifiers associated with this package. Software identifiers are used, for example:

lib/source-types.nix

@@ -17,4 +17,6 @@ lib.mapAttrs (tname: tset: defaultSourceType tname // tset) {
   binaryBytecode = { };
 
   binaryFirmware = { };
+
+  obfuscatedCode = { };
 }

maintainers/github-teams.json

@@ -64,7 +64,6 @@
       "ankhers": 750786,
       "gleber": 33185,
       "minijackson": 1200507,
-      "savtrip": 42227195,
       "yurrriq": 1866448
     },
     "name": "Beam"

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,6 +110,8 @@
 
 - [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable)
 
+- [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -305,6 +307,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - Support for Bluetooth audio based on `bluez-alsa` has been added to the `hardware.alsa` module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option.
 
+- `systemd.network.*` has been updated to support all configuration options from upstream `networkd` version 259.
+
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
 - IPVLAN interfaces can now be configured through the `networking.ipvlans` option in the networking module.

nixos/lib/systemd-network-units.nix

@@ -41,6 +41,14 @@ in
       [VLAN]
       ${attrsToSection def.vlanConfig}
     ''
+    + optionalString (def.macvlanConfig != { }) ''
+      [MACVLAN]
+      ${attrsToSection def.macvlanConfig}
+    ''
+    + optionalString (def.macvtapConfig != { }) ''
+      [MACVTAP]
+      ${attrsToSection def.macvtapConfig}
+    ''
     + optionalString (def.ipvlanConfig != { }) ''
       [IPVLAN]
       ${attrsToSection def.ipvlanConfig}
@@ -49,14 +57,50 @@ in
       [IPVTAP]
       ${attrsToSection def.ipvtapConfig}
     ''
-    + optionalString (def.macvlanConfig != { }) ''
-      [MACVLAN]
-      ${attrsToSection def.macvlanConfig}
-    ''
     + optionalString (def.vxlanConfig != { }) ''
       [VXLAN]
       ${attrsToSection def.vxlanConfig}
     ''
+    + optionalString (def.geneveConfig != { }) ''
+      [GENEVE]
+      ${attrsToSection def.geneveConfig}
+    ''
+    + optionalString (def.hsrConfig != { }) ''
+      [HSR]
+      ${attrsToSection def.hsrConfig}
+    ''
+    + optionalString (def.bareUDPConfig != { }) ''
+      [BareUDP]
+      ${attrsToSection def.bareUDPConfig}
+    ''
+    + optionalString (def.l2tpConfig != { }) ''
+      [L2TP]
+      ${attrsToSection def.l2tpConfig}
+    ''
+    + flip concatMapStrings def.l2tpSessions (x: ''
+      [L2TPSession]
+      ${attrsToSection x}
+    '')
+    + optionalString (def.macsecConfig != { }) ''
+      [MACsec]
+      ${attrsToSection def.macsecConfig}
+    ''
+    + optionalString (def.macsecConfig != { }) ''
+      [MACsec]
+      ${attrsToSection def.macsecConfig}
+    ''
+    + flip concatMapStrings def.macsecReceiveChannels (x: ''
+      [MACsecReceiveChannel]
+      ${attrsToSection x}
+    '')
+    + flip concatMapStrings def.macsecTransmitAssociations (x: ''
+      [MACsecTransmitAssociation]
+      ${attrsToSection x}
+    '')
+    + flip concatMapStrings def.macsecReceiveAssociations (x: ''
+      [MACsecReceiveAssociation]
+      ${attrsToSection x}
+    '')
     + optionalString (def.tunnelConfig != { }) ''
       [Tunnel]
       ${attrsToSection def.tunnelConfig}
@@ -69,6 +113,10 @@ in
       [Peer]
       ${attrsToSection def.peerConfig}
     ''
+    + optionalString (def.vxcanConfig != { }) ''
+      [VXCAN]
+      ${attrsToSection def.vxcanConfig}
+    ''
     + optionalString (def.tunConfig != { }) ''
       [Tun]
       ${attrsToSection def.tunConfig}
@@ -77,14 +125,6 @@ in
       [Tap]
       ${attrsToSection def.tapConfig}
     ''
-    + optionalString (def.l2tpConfig != { }) ''
-      [L2TP]
-      ${attrsToSection def.l2tpConfig}
-    ''
-    + flip concatMapStrings def.l2tpSessions (x: ''
-      [L2TPSession]
-      ${attrsToSection x}
-    '')
     + optionalString (def.wireguardConfig != { }) ''
       [WireGuard]
       ${attrsToSection def.wireguardConfig}
@@ -105,14 +145,18 @@ in
       [VRF]
       ${attrsToSection def.vrfConfig}
     ''
-    + optionalString (def.wlanConfig != { }) ''
-      [WLAN]
-      ${attrsToSection def.wlanConfig}
-    ''
     + optionalString (def.batmanAdvancedConfig != { }) ''
       [BatmanAdvanced]
       ${attrsToSection def.batmanAdvancedConfig}
     ''
+    + optionalString (def.ipoibConfig != { }) ''
+      [IPoIB]
+      ${attrsToSection def.ipoibConfig}
+    ''
+    + optionalString (def.wlanConfig != { }) ''
+      [WLAN]
+      ${attrsToSection def.wlanConfig}
+    ''
     + def.extraConfig;
 
   networkToUnit =
@@ -122,6 +166,10 @@ in
       [Link]
       ${attrsToSection def.linkConfig}
     ''
+    + optionalString (def.sriovConfig != { }) ''
+      [SR-IOV]
+      ${attrsToSection def.sriovConfig}
+    ''
     + ''
       [Network]
     ''
@@ -147,9 +195,6 @@ in
     + optionalString (def.vrf != [ ]) ''
       ${concatStringsSep "\n" (map (s: "VRF=${s}") def.vrf)}
     ''
-    + optionalString (def.vlan != [ ]) ''
-      ${concatStringsSep "\n" (map (s: "VLAN=${s}") def.vlan)}
-    ''
     + optionalString (def.macvlan != [ ]) ''
       ${concatStringsSep "\n" (map (s: "MACVLAN=${s}") def.macvlan)}
     ''
@@ -159,12 +204,15 @@ in
     + optionalString (def.macvtap != [ ]) ''
       ${concatStringsSep "\n" (map (s: "MACVTAP=${s}") def.macvtap)}
     ''
-    + optionalString (def.vxlan != [ ]) ''
-      ${concatStringsSep "\n" (map (s: "VXLAN=${s}") def.vxlan)}
-    ''
     + optionalString (def.tunnel != [ ]) ''
       ${concatStringsSep "\n" (map (s: "Tunnel=${s}") def.tunnel)}
     ''
+    + optionalString (def.vlan != [ ]) ''
+      ${concatStringsSep "\n" (map (s: "VLAN=${s}") def.vlan)}
+    ''
+    + optionalString (def.vxlan != [ ]) ''
+      ${concatStringsSep "\n" (map (s: "VXLAN=${s}") def.vxlan)}
+    ''
     + optionalString (def.xfrm != [ ]) ''
       ${concatStringsSep "\n" (map (s: "Xfrm=${s}") def.xfrm)}
     ''
@@ -173,10 +221,22 @@ in
       [Address]
       ${attrsToSection x}
     '')
+    + flip concatMapStrings def.neighbors (x: ''
+      [Neighbor]
+      ${attrsToSection x}
+    '')
+    + flip concatMapStrings def.ipv6AddressLabels (x: ''
+      [IPv6AddressLabel]
+      ${attrsToSection x}
+    '')
     + flip concatMapStrings def.routingPolicyRules (x: ''
       [RoutingPolicyRule]
       ${attrsToSection x}
     '')
+    + flip concatMapStrings def.nextHops (x: ''
+      [NextHop]
+      ${attrsToSection x}
+    '')
     + flip concatMapStrings def.routes (x: ''
       [Route]
       ${attrsToSection x}
@@ -201,14 +261,14 @@ in
       [DHCPServer]
       ${attrsToSection def.dhcpServerConfig}
     ''
+    + flip concatMapStrings def.dhcpServerStaticLeases (x: ''
+      [DHCPServerStaticLease]
+      ${attrsToSection x}
+    '')
     + optionalString (def.ipv6SendRAConfig != { }) ''
       [IPv6SendRA]
       ${attrsToSection def.ipv6SendRAConfig}
     ''
-    + flip concatMapStrings def.ipv6PREF64Prefixes (x: ''
-      [IPv6PREF64Prefix]
-      ${attrsToSection x}
-    '')
     + flip concatMapStrings def.ipv6Prefixes (x: ''
       [IPv6Prefix]
       ${attrsToSection x}
@@ -217,8 +277,8 @@ in
       [IPv6RoutePrefix]
       ${attrsToSection x}
     '')
-    + flip concatMapStrings def.dhcpServerStaticLeases (x: ''
-      [DHCPServerStaticLease]
+    + flip concatMapStrings def.ipv6PREF64Prefixes (x: ''
+      [IPv6PREF64Prefix]
       ${attrsToSection x}
     '')
     + optionalString (def.bridgeConfig != { }) ''
@@ -333,6 +393,14 @@ in
       [HierarchyTokenBucketClass]
       ${attrsToSection def.hierarchyTokenBucketClassConfig}
     ''
+    + optionalString (def.classfulMultiQueueingConfig != { }) ''
+      [ClassfulMultiQueueing]
+      ${attrsToSection def.classfulMultiQueueingConfig}
+    ''
+    + optionalString (def.bandMultiQueueingConfig != { }) ''
+      [BandMultiQueueing]
+      ${attrsToSection def.bandMultiQueueingConfig}
+    ''
     + optionalString (def.heavyHitterFilterConfig != { }) ''
       [HeavyHitterFilter]
       ${attrsToSection def.heavyHitterFilterConfig}

nixos/modules/module-list.nix

@@ -357,6 +357,7 @@
   ./programs/wayland/wayfire.nix
   ./programs/wayland/wayvnc.nix
   ./programs/weylus.nix
+  ./programs/whois.nix
   ./programs/winbox.nix
   ./programs/wireshark.nix
   ./programs/wshowkeys.nix

nixos/modules/programs/whois.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.whois;
+
+  configText =
+    lib.concatStringsSep "\n" (
+      [
+        "# Generated by NixOS."
+        "# See whois.conf(5) for the file format."
+      ]
+      ++ map (entry: "${entry.pattern} ${entry.server}") cfg.settings
+    )
+    + "\n";
+in
+
+{
+  options.programs.whois = {
+    enable = lib.mkEnableOption "whois, an intelligent WHOIS client";
+
+    package = lib.mkPackageOption pkgs "whois" { };
+
+    settings = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            pattern = lib.mkOption {
+              type = lib.types.str;
+              example = "\\.dn42$";
+              description = ''
+                Case-insensitive extended regular expression used to match the
+                WHOIS object identifier.
+              '';
+            };
+
+            server = lib.mkOption {
+              type = lib.types.str;
+              example = "whois.dn42";
+              description = ''
+                WHOIS server to use when {option}`pattern` matches.
+              '';
+            };
+          };
+        }
+      );
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          {
+            pattern = "\\.dn42$";
+            server = "whois.dn42";
+          }
+          {
+            pattern = "\\-DN42$";
+            server = "whois.dn42";
+          }
+          {
+            pattern = "^as424242[0-9]{4}$";
+            server = "whois.dn42";
+          }
+          {
+            pattern = "^172\\.2[0-3]\\.[0-9]{1,3}\\.[0-9]{1,3}(/(1[56789]|2[0-9]|3[012]))?$";
+            server = "whois.dn42";
+          }
+        ]
+      '';
+      description = ''
+        WHOIS configuration entries written to {file}`/etc/whois.conf`.
+
+        Entries are written in the declared order, which matters when multiple
+        patterns may match the same query.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.etc."whois.conf".text = configText;
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia ];
+}

nixos/modules/services/security/kanidm.nix

@@ -67,12 +67,20 @@ let
   # Merge bind mount paths and remove paths where a prefix is already mounted.
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
   # paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
-  hasPrefixInList = list: newPath: any (path: hasPrefix (toString path) (toString newPath)) list;
+  hasDirPrefix =
+    prefix: path:
+    let
+      normalizedDir = builtins.match "(.*[^/])/*" (toString prefix);
+      normalizedPrefix =
+        (if normalizedDir != null then builtins.head normalizedDir else toString prefix) + "/";
+    in
+    hasPrefix normalizedPrefix (toString path);
+  hasPrefixInList = list: newPath: any (path: hasDirPrefix path newPath) list;
   mergePaths = foldl' (
     merged: newPath:
     let
-      # If the new path is a prefix to some existing path, we need to filter it out
-      filteredPaths = filter (p: !hasPrefix (toString newPath) (toString p)) merged;
+      # If the new path is a prefix to some existing path, we need to filter it out. We make sure the prefix is a directory.
+      filteredPaths = filter (p: !hasDirPrefix newPath p) merged;
       # If a prefix of the new path is already in the list, do not add it
       filteredNew = optional (!hasPrefixInList filteredPaths newPath) newPath;
     in

nixos/tests/all-tests.nix

@@ -1746,6 +1746,7 @@ in
   wg-access-server = runTest ./wg-access-server.nix;
   whisparr = runTest ./whisparr.nix;
   whoami = runTest ./whoami.nix;
+  whois = runTest ./whois.nix;
   whoogle-search = runTest ./whoogle-search.nix;
   wiki-js = runTest ./wiki-js.nix;
   windmill = import ./windmill {

nixos/tests/whois.nix

@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  name = "whois";
+  meta.maintainers = with lib.maintainers; [ Cryolitia ];
+
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    programs.whois = {
+      enable = true;
+      settings = [
+        {
+          pattern = "\\.dn42$";
+          server = "whois.dn42";
+        }
+        {
+          pattern = "\\-DN42$";
+          server = "whois.dn42";
+        }
+        {
+          pattern = "^as424242[0-9]{4}$";
+          server = "whois.dn42";
+        }
+      ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.succeed("command -v whois")
+
+    whois_conf = machine.succeed("cat /etc/whois.conf").strip()
+    expected = """
+    # Generated by NixOS.
+    # See whois.conf(5) for the file format.
+    \\.dn42$ whois.dn42
+    \\-DN42$ whois.dn42
+    ^as424242[0-9]{4}$ whois.dn42
+    """.strip()
+    assert whois_conf == expected
+  '';
+}

pkgs/applications/editors/vim/plugins/generated.nix

@@ -7102,6 +7102,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  ipynb-nvim = buildVimPlugin {
+    pname = "ipynb.nvim";
+    version = "0-unstable-2026-01-31";
+    src = fetchFromGitHub {
+      owner = "ajbucci";
+      repo = "ipynb.nvim";
+      rev = "b9ec93f7c37a3a081810a733d6baf4973fc31f3d";
+      hash = "sha256-uB89olqvc5m6DHwtOOPpTRtyBnhNp6z6Pr9DS6mX7JA=";
+    };
+    meta.homepage = "https://github.com/ajbucci/ipynb.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   ir_black = buildVimPlugin {
     pname = "ir_black";
     version = "0-unstable-2012-03-05";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -544,6 +544,7 @@ https://github.com/pta2002/intellitab.nvim/,HEAD,
 https://github.com/parsonsmatt/intero-neovim/,,
 https://github.com/keith/investigate.vim/,,
 https://github.com/neutaaaaan/iosvkem/,,
+https://github.com/ajbucci/ipynb.nvim/,HEAD,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,HEAD,
 https://github.com/haya14busa/is.vim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1967,8 +1967,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.71.9";
-          hash = "sha256-8+5Njd4s3iSrZwwdEVvr/R+uv8i16wDdsbiv3xPISWc=";
+          version = "6.72.0";
+          hash = "sha256-QqoGCxGJ0l69Q6P+L/AsEIN99xP9ReYzRC2AJVpk/gU=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4207,8 +4207,8 @@ let
         mktplcRef = {
           publisher = "shopify";
           name = "ruby-lsp";
-          version = "0.10.1";
-          hash = "sha256-IBOYuldJO1FjpFtpDMxo5n7XjXmN21qqrZcYy9+Ddso=";
+          version = "0.10.2";
+          hash = "sha256-FWvRGMB19uHVe97TvwI0EDjjnUqHpJNVTI0ZwfpBDKY=";
         };
         meta = {
           description = "VS Code plugin for connecting with the Ruby LSP";

pkgs/applications/editors/vscode/extensions/google.colab/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "google";
     name = "colab";
-    version = "0.4.1";
-    hash = "sha256-ebSMfnDumkXKsMqg3/ifi0GVXfXtrs2mLCCG8hZlkR0=";
+    version = "0.5.0";
+    hash = "sha256-os1wdxun6HHZKZ7IjObn88mGX0Kr/A1zqeMXW/7lIr4=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/language-packs.nix

@@ -13,7 +13,7 @@ let
   buildVscodeLanguagePack =
     {
       language,
-      version ? "1.110.2026031919",
+      version ? "1.110.2026033112",
       hash,
     }:
     buildVscodeMarketplaceExtension {
@@ -41,71 +41,71 @@ in
   # French
   vscode-language-pack-fr = buildVscodeLanguagePack {
     language = "fr";
-    hash = "sha256-a8N3SX7lgfTMlBk70hOdKtgO4e9uyMziRaSp/QmkUQM=";
+    hash = "sha256-ctn6bY2zJVz6XfhI37NOdf12RiKsS/Pa2IYFBMD06fs=";
   };
   # Italian
   vscode-language-pack-it = buildVscodeLanguagePack {
     language = "it";
-    hash = "sha256-OyZ0rUTFg2Epb/adz2kFbStIeDoDyWj/fA3MC3QPLT4=";
+    hash = "sha256-ZZgTzQa0oTS7HFzYuJXncG97tPUovKr8BEh4ZgGwmWY=";
   };
   # German
   vscode-language-pack-de = buildVscodeLanguagePack {
     language = "de";
-    hash = "sha256-Z7zIviuD9UcSK8Z0qlq7PnqYWmacUlrYu0lDTjbmS+g=";
+    hash = "sha256-8qCjGIArVSfy/kwv00aLPniBREVW+cNAUbged10VQQs=";
   };
   # Spanish
   vscode-language-pack-es = buildVscodeLanguagePack {
     language = "es";
-    hash = "sha256-fSJ5D7kQ5zMppUqVIAjBfQ2mNzBpiF1myFfqtk2QPSs=";
+    hash = "sha256-9F4JEp0qVu1rsrJ01QMuhZPgMxybH/J5ENh2riDAe2c=";
   };
   # Russian
   vscode-language-pack-ru = buildVscodeLanguagePack {
     language = "ru";
-    hash = "sha256-qEXRsqI8jfuTCX2zMnDwfHAiszk2abiwzJ+a1dio3ss=";
+    hash = "sha256-1xRKJLuKjxYQ2D20K9QaQQQjmd8oHFmWVIe0OdeEfG8=";
   };
   # Chinese (Simplified)
   vscode-language-pack-zh-hans = buildVscodeLanguagePack {
     language = "zh-hans";
-    hash = "sha256-zwBfoB17agsVK/NLxZ8WaoM49emmLX2otPsba0pjg7w=";
+    hash = "sha256-VxM+Jjch/hVO80boUCU1iYkYoToTtUewHcIuJhQGkZA=";
   };
   # Chinese (Traditional)
   vscode-language-pack-zh-hant = buildVscodeLanguagePack {
     language = "zh-hant";
-    hash = "sha256-P9cKdfuGAOq/Ow3ojKaUiEfChEED4eXbSaFtqp5yWWs=";
+    hash = "sha256-ADR/ouefp5HnBwmGV0UBNAklgHg5mXNcBfX+VbJed74=";
   };
   # Japanese
   vscode-language-pack-ja = buildVscodeLanguagePack {
     language = "ja";
-    hash = "sha256-+SXH6Uy9CIrG4Ff+Wzq9+N+SKEGcTtXbcpyW5OA2sGA=";
+    hash = "sha256-hSilIspgNnJ05qgZk7uWvr8y4BAAPK/82j+dwshsGVc=";
   };
   # Korean
   vscode-language-pack-ko = buildVscodeLanguagePack {
     language = "ko";
-    hash = "sha256-7gV6rK8RC1LDMu6Rvo84ScmJJcc/BfgQl5dVE/dyWis=";
+    hash = "sha256-A2gGsrno76caJvZguMsjE2xa6AzOfCz1Ge3fbh7yZWw=";
   };
   # Czech
   vscode-language-pack-cs = buildVscodeLanguagePack {
     language = "cs";
-    hash = "sha256-NvXwyaDDkAO22Hb7octXswkUP55zo3UgNtoLEQL1AQE=";
+    hash = "sha256-t70KwNkxiXFSw0NdiOGH6tjmeRP/RYinK/YxwLGfSw8=";
   };
   # Portuguese (Brazil)
   vscode-language-pack-pt-br = buildVscodeLanguagePack {
     language = "pt-BR";
-    hash = "sha256-E9m4ATCtFm+Q+hHe9Yd++a1cuqjj3eF8H632HRsdjAc=";
+    hash = "sha256-wOjewAGd1BCkrOQuhcWRbMm7YsRJGjac2+w5+fjWhBM=";
   };
   # Turkish
   vscode-language-pack-tr = buildVscodeLanguagePack {
     language = "tr";
-    hash = "sha256-YXXpXftw86/0vRPr9s4kOuf4EMykhgy0SDInNVgcr+c=";
+    hash = "sha256-X7A8MWlBzijd+1Z6POBSRef5BgeI9qfSy576dx3yfII=";
   };
   # Polish
   vscode-language-pack-pl = buildVscodeLanguagePack {
     language = "pl";
-    hash = "sha256-mQ/Aya728qX/d5RNrv4IQrBu3IPh50HeC1Bn292/QYg=";
+    hash = "sha256-bJc428MT8HyEUltmCFZEliSSPOE5TpHsaVKL1qukbVk=";
   };
   # Pseudo Language
   vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
     language = "qps-ploc";
-    hash = "sha256-//+9p7P8CBVmAL6vcn1LzlAZBcrOlahjJvQhLeOQ1UU=";
+    hash = "sha256-XVT+ssMh4SD+O93oDYbkLh4b8VPYA/9HOAKQURrLUuQ=";
   };
 }

pkgs/applications/editors/vscode/generic.nix

@@ -274,6 +274,17 @@ stdenv.mkDerivation (
       (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
     ];
 
+    # autoPatchelfHook cannot index libwebkit2gtk-4.1.so because pyelftools
+    # fails to parse it (ELFError: String Table not found).  Ignore the
+    # missing dep and add the library path via appendRunpaths so it is still
+    # available at runtime for libmsalruntime.so (Microsoft Authentication).
+    autoPatchelfIgnoreMissingDeps = lib.optionals stdenv.hostPlatform.isLinux [
+      "libwebkit2gtk-4.1.so.0"
+    ];
+    appendRunpaths = lib.optionals stdenv.hostPlatform.isLinux [
+      "${webkitgtk_4_1}/lib"
+    ];
+
     dontBuild = true;
     dontConfigure = true;
     noDumpEnvVars = true;

pkgs/applications/editors/vscode/vscode.nix

@@ -35,17 +35,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-p+8hlq6eB/d3oyPMirJ4ZRqY65xQyEk0jc8k2FiduuY=";
-      x86_64-darwin = "sha256-GyD9Z+o8mW6GgTDtGWs66Zja32fDKUEb5EblxMuqwHY=";
-      aarch64-linux = "sha256-C1HpQ/yJwkOkGcQssSwjAqhKCCdspc6Xq0pMdmpmSBc=";
-      aarch64-darwin = "sha256-m9wZ+7eyuTbGkr+TjCUrSGScr1L0eatKC7N0jJacjzY=";
-      armv7l-linux = "sha256-W8MjdmQLzwVqGjnrfLjM4Jj8B98fklm5I8SFsmI4URA=";
+      x86_64-linux = "sha256-D+2JWjC0kutfkEF5QKOKwh9Z8+jWgMgMN2b8pKwYays=";
+      x86_64-darwin = "sha256-dgOKMYRKfGRipLMsQcVmlOEHbG9l4ryJZv5J8znSxwA=";
+      aarch64-linux = "sha256-NRaxhWEdYDNIK1AbimKwzw4zGd3ljwBIYJ+BaTz2/gk=";
+      aarch64-darwin = "sha256-nWkNoryvsD2SPkc5veQ12+DWPXgWPJjfWwUcC7PjbC4=";
+      armv7l-linux = "sha256-Ae5sKYiyvIF9KZzKi7BK3/SLgKjuQCLjNKi9dXIqGbo=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.113.0";
+  version = "1.114.0";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -53,7 +53,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "cfbea10c5ffb233ea9177d34726e6056e89913dc";
+  rev = "e7fb5e96c0730b9deb70b33781f98e2f35975036";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -86,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-UFZJRZ2mAK0aZ58Pa2PgFOEQT7Ec7F/m1MoO5BrXaJI=";
+      hash = "sha256-Sx9XXo3qB+7hwi9vzAncX49usOSMVgKilgBa2UrG6pQ=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix

@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hyprsplit";
-  version = "0.53.1";
+  version = "0.54.2";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-seA9mz0Yej4yYZVgzd7yKoHwuueKhfQPu0CyB7EL8No=";
+    hash = "sha256-NFMLZmM6lM7v6WFcewOp7pKPlr6ampX/MB/kGxt/gPE=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +30,7 @@ mkHyprlandPlugin (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       aacebedo
+      mrdev023
     ];
   };
 })

pkgs/by-name/ca/capnproto-rust/package.nix

@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "capnproto-rust";
-  version = "0.25.0";
+  version = "0.25.3";
 
   src = fetchCrate {
     crateName = "capnpc";
     inherit (finalAttrs) version;
-    hash = "sha256-2+GSM9oIT/he/Ra3SJH5YSrNUU/Jc+PE1N5TjK7OX28=";
+    hash = "sha256-jDdsGy/T41R4duclyMpPmPZeflXg+Zp7wdBxbR527ZM=";
   };
 
-  cargoHash = "sha256-fVHLWBxB9PQhOx01G01qIyudnMQiHXj0BI8A6e7t1yQ=";
+  cargoHash = "sha256-egb4Jpwzkj3PSVStqCX5ZLKgrH7nGHgZUCIleZcWIeI=";
 
   postInstall = ''
     mkdir -p $out/include/capnp

pkgs/by-name/co/constrict/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   python3Packages,
-  fetchFromGitHub,
+  fetchFromGitLab,
   meson,
   ninja,
   pkg-config,
@@ -16,18 +16,20 @@
   ffmpeg,
   gst-thumbnailers,
   glycin-loaders,
+  nix-update-script,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "constrict";
-  version = "25.12.1";
+  version = "26.2";
   pyproject = false; # Built with meson
 
-  src = fetchFromGitHub {
-    owner = "Wartybix";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
     repo = "Constrict";
     tag = finalAttrs.version;
-    hash = "sha256-ZSiBlejNFakz+/3qj3n+ekB5l9JOk3MiQ8PRZOdxtLQ=";
+    hash = "sha256-SkfutiBi0Y7gNx5PyTaSzVw/5rU/0ULxbtf2606i2wA=";
   };
 
   nativeBuildInputs = [
@@ -67,10 +69,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     )
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Compresses your videos to your chosen file size";
-    homepage = "https://github.com/Wartybix/Constrict";
-    changelog = "https://github.com/Wartybix/Constrict/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://gitlab.gnome.org/World/Constrict";
+    changelog = "https://gitlab.gnome.org/World/Constrict/-/releases/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Plus;
     mainProgram = "constrict";
     teams = [ lib.teams.gnome-circle ];

pkgs/by-name/de/debase/package.nix

@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  fetchpatch, # Delete at next version bump.
   lib,
   libgit2,
   stdenv,
@@ -28,6 +27,10 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile \
       --replace-fail 'git rev-parse HEAD' 'echo aa083074d67938d50336bd3737c960b038d91134' \
       --replace-fail '$(GITHASHHEADER): .git/HEAD .git/index' '$(GITHASHHEADER):'
+
+    # fix build with gcc15
+    substituteInPlace lib/Makefile \
+      --replace-fail './configure' './configure cf_cv_type_of_bool=bool'
   '';
 
   patches = [

pkgs/by-name/el/elastic/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elastic";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "elastic";
     rev = finalAttrs.version;
-    hash = "sha256-ydRKkVYQ1f6Jlymej1Wzoppo6E0FEUvIfrfnDqLRcPY=";
+    hash = "sha256-zOqOAUbPjyVl/96oVBhsjBrSMGt+NEbraznNGu374dM=";
   };
 
   nativeBuildInputs = [
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Design spring animations";
     homepage = "https://gitlab.gnome.org/World/elastic/";
+    changelog = "https://gitlab.gnome.org/World/elastic/-/releases/${finalAttrs.version}";
     mainProgram = "app.drey.Elastic";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;

pkgs/by-name/ex/exercise-timer/package.nix

@@ -1,24 +1,21 @@
 {
   lib,
   stdenv,
-  alsa-lib,
   appstream-glib,
   blueprint-compiler,
-  cargo,
   desktop-file-utils,
   fetchFromGitHub,
-  json-glib,
   glib,
+  gst_all_1,
   gtk4,
+  json-glib,
   libadwaita,
   meson,
   ninja,
   nix-update-script,
   pkg-config,
-  rustPlatform,
-  rustc,
-  wrapGAppsHook4,
   vala,
+  wrapGAppsHook4,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -36,20 +33,20 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     appstream-glib
     blueprint-compiler
-    cargo
     desktop-file-utils
     glib
     gtk4
     meson
     ninja
     pkg-config
-    rustc
     wrapGAppsHook4
     vala
   ];
 
   buildInputs = [
-    alsa-lib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gstreamer
     json-glib
     libadwaita
   ];

pkgs/by-name/gd/gdu/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gdu";
-  version = "5.34.4";
+  version = "5.35.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = "gdu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dt16bq0I//ptofT3s2OnU6C4Rd4itov9+Rzz7jai6hw=";
+    hash = "sha256-zWwnM6CJBVGt4DM3Y5/ETbRdoq2yJeq53Co2ZvlwPRQ=";
   };
 
-  vendorHash = "sha256-Dtjirx2sHbN4AWxED5weRGtCRNc2VIdaz7RHssGuJeQ=";
+  vendorHash = "sha256-+fv+agIgIq3guIfBhY8VQz85T0cm3xxTRGFHLSIMpwc=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/hi/highscore-unwrapped/package.nix

@@ -47,14 +47,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "highscore-unwrapped";
-  version = "0-unstable-2026-01-01";
+  version = "0-unstable-2026-02-01";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "highscore";
-    rev = "c9f537e06414a32632e9f9d7a73d9028b788f275";
-    hash = "sha256-6sBfjVFIFg0w3apzJBYMYEIjTavnOAE0YK3ayzoyDks=";
+    rev = "281d8e1d7d9abaa8452b869d1d52d4a933a00d26";
+    hash = "sha256-HQD8Dge/nSvIDgiekCxHzCmRl4cO98Er8X24ZoP8OiQ=";
   };
 
   patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace meson.build --replace-fail \
-      "run_command('git', 'rev-parse', '--short', 'HEAD').stdout().strip()" \
+      "run_command('git', 'rev-parse', '--short', 'HEAD', check: false).stdout().strip()" \
       "'${finalAttrs.src.rev}'"
   '';
 

pkgs/by-name/ir/iroh-ssh/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iroh-ssh";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner = "rustonbsd";
     repo = "iroh-ssh";
     tag = finalAttrs.version;
-    hash = "sha256-0G2RZbxyxi96FpVPEamfcTrOgPxpFYHmyYg1kQfo7TQ=";
+    hash = "sha256-A/QdpPHI9TCqQ2oghxPUJl4KKX8gqkA3kBvN8f1Kegg=";
   };
 
-  cargoHash = "sha256-2/hc1K6zUyQlWorZh34HP9PCdV4YD1ob9l1DFiW7c1Y=";
+  cargoHash = "sha256-/cq/rOzrQ4t0qvdaqM3JhRn8IMncx7jWYDjdYmLCYvc=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/jn/jnv/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jnv";
-  version = "0.6.2";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sW3wy5m3fnTDIxRC/E/EWEvuJ92o+l4QCmwdqL2tZ98=";
+    hash = "sha256-m+yntdBXnZEFtDvjXRb/NYKyMFBRL5JJYUz9UTGqCSA=";
   };
 
-  cargoHash = "sha256-jKeAgeW54lAgcv6Xpz9Rwt10tdac4S4B5EAmwanaW9c=";
+  cargoHash = "sha256-Ae+YUtZ/sDBjngxIxYZq5M7edCc8tq1X+7rc3IsJhvc=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/js/jsongrep/package.nix

@@ -0,0 +1,50 @@
+{
+  fetchFromGitHub,
+  installShellFiles,
+  lib,
+  nix-update-script,
+  rustPlatform,
+  stdenvNoCC,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "jsongrep";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "micahkepe";
+    repo = "jsongrep";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-A4cBHIRXmjpRSJtUNNPGOfSOFQG4om5QFa9xw4MeYj8=";
+  };
+
+  cargoHash = "sha256-RQLMQ2jEtqh7km4FWhBaWuw9QY4B4O50DbPdBO+hcW4=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+    for shell in bash fish zsh; do
+      installShellCompletion --cmd jg \
+        --"$shell" <("$out"/bin/jg generate shell "$shell")
+    done
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/micahkepe/jsongrep/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "JSONPath-inspired query language";
+    longDescription = ''
+      `jsongrep` is a command-line tool and Rust library for querying
+      JSON documents using regular path expressions.
+    '';
+    homepage = "https://github.com/micahkepe/jsongrep";
+    license = lib.licenses.mit;
+    mainProgram = "jg";
+    maintainers = with lib.maintainers; [ yiyu ];
+  };
+})

pkgs/by-name/li/libhighscore/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation {
   pname = "libhighscore";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2026-01-30";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "alicem";
     repo = "libhighscore";
-    rev = "6920d96b440ccfc070fc87c39c51beab8ac053bd";
-    hash = "sha256-JXfPLPHA3HwXRG6sT/5TSMbtU+BqBh/+ZVrzJxW0xLg=";
+    rev = "81366c670b777a6943dbdd955b9e867c8da247e7";
+    hash = "sha256-z+gMU9IA0F9alrhXNf5e+0/J87ChwVyCn26iA+ythBE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/lo/lorem/package.nix

@@ -26,12 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "design";
     repo = "lorem";
     rev = finalAttrs.version;
-    hash = "sha256-q6gpxxNebf2G/lT5wWXT/lVp3zR8QLWB8/sdK+wLTJ8=";
+    hash = "sha256-DY2UVB6N3vQehDm1s3KIjodUfyWu3QBo6NxWlPswDN4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-4JYYcfsEoCGJWZCp0273gXrf8hfuHL/QSsLEHvNa4uA=";
+    hash = "sha256-DE0jzI9Tmusm6VT19PsmJoTYHQ4fjrg3ik6tAWhMVSA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ne/netbird-dashboard/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "netbird-dashboard";
-  version = "2.34.2";
+  version = "2.36.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "dashboard";
     rev = "v${version}";
-    hash = "sha256-eqDH0mtxb756M6G0pC+FmbZtgj0vk9uKXnzCHlPEquE=";
+    hash = "sha256-VsecD83dz6U6jEaGIxv7M9ePzbTPCXeffSoyyBr2Vh4=";
   };
 
-  npmDepsHash = "sha256-AYbTtUgo/e9BD5Kg877qUHkj+4l2OJ88rxnquA2789k=";
+  npmDepsHash = "sha256-ljko66NYBgwyvgIbqnexfbSaILNf/74qrNXZUsHT8/o=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   installPhase = ''

pkgs/by-name/ne/netbird/package.nix

@@ -67,16 +67,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird-${componentName}";
-  version = "0.67.0";
+  version = "0.67.3";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5Q90bEAXTnvkEHcsheohu9wdwZRFIoLnqBNzjotFz54=";
+    hash = "sha256-bt6NMyRxzzzAnMh0V62cu9+eg/jvV0RRwGqHJm32eZw=";
   };
 
-  vendorHash = "sha256-6qYS2jXjfPczAfv+g79JsTcEJR9FniAVjW52Yi/g42M=";
+  vendorHash = "sha256-tsAbNuSqH8NjI6VWDXJ/9u3JKkBAnhjcEdeDXT2Bbv8=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional (componentName == "ui") pkg-config;
 

pkgs/by-name/ne/netron/package.nix

@@ -97,9 +97,5 @@ buildNpmPackage (finalAttrs: {
     maintainers = with lib.maintainers; [ flokli ];
     mainProgram = "netron";
     platforms = electron.meta.platforms;
-    badPlatforms = [
-      # Fails on darwin
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 })

pkgs/by-name/ni/nice-dcv-client/fix-paths.patch

@@ -0,0 +1,31 @@
+--- a/usr/bin/dcvviewer
++++ b/usr/bin/dcvviewer
+@@ -13,7 +13,7 @@
+ 
+     basedir="${_dir}/usr"
+ else
+-    basedir=/usr
++    basedir=@basedir@
+ fi
+ 
+ bindir=${basedir}/bin
+@@ -33,15 +33,15 @@
+ 
+ export LD_LIBRARY_PATH="${libdir}/${variant}:${libdir}:/usr/share/${variant}/cef:${LD_LIBRARY_PATH}"
+ export XDG_DATA_DIRS="${datadir}:${XDG_DATA_DIRS}:/usr/share:/usr/local/share"
+-export GIO_EXTRA_MODULES="${libdir}/${variant}/gio/modules"
+-export GST_PLUGIN_SCANNER="${libexecdir}/${variant}/gst-plugin-scanner"
+-export GST_PLUGIN_SYSTEM_PATH="${libdir}/${variant}/gstreamer-1.0"
++export GIO_EXTRA_MODULES=@gio_extra_modules@
++export GST_PLUGIN_SCANNER=@gst_plugin_scanner@
++export GST_PLUGIN_SYSTEM_PATH=@gst_plugin_system_path@
+ export GTK_PATH="${libdir}/${variant}"
+ export PANGO_LIBDIR="${libdir}/${variant}"
+ export GDK_PIXBUF_MODULE_FILE="${libdir}/${variant}/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+ export GSETTINGS_SCHEMA_DIR="${datadir}/${variant}/schemas"
+ export FONTCONFIG_PATH="${sysconfdir}/fonts"
+-export DCV_SASL_PLUGIN_DIR="${libdir}/dcvviewer/sasl2"
++export DCV_SASL_PLUGIN_DIR=@dcv_sasl_plugin_dir@
+ 
+ case "$1" in
+     --gdb)

pkgs/by-name/ni/nice-dcv-client/package.nix

@@ -2,89 +2,119 @@
   lib,
   stdenv,
   fetchurl,
-  glib,
-  libx11,
-  gst_all_1,
-  libepoxy,
-  pango,
-  cairo,
-  gdk-pixbuf,
-  e2fsprogs,
-  libkrb5,
-  libva,
-  openssl,
-  pcsclite,
-  gtk3,
-  libselinux,
-  libxml2,
-  libffi,
+  autoPatchelfHook,
+  replaceVars,
+  wrapGAppsHook4,
   python3Packages,
   cpio,
-  autoPatchelfHook,
-  wrapGAppsHook3,
+  cups,
+  cyrus_sasl,
+  gdk-pixbuf,
+  glib,
+  glib-networking,
+  gst_all_1,
+  gtk4,
+  libfido2,
+  libva,
+  lz4,
+  pcsclite,
+  protobufc,
 }:
-
-stdenv.mkDerivation rec {
+let
   pname = "nice-dcv-client";
-  version = "2021.2.3797-1";
+  version = "2025.0.8846-1";
+in
+stdenv.mkDerivation {
+  inherit version pname;
+
   src = fetchurl {
-    url = "https://d1uj6qtbmh3dt5.cloudfront.net/2021.2/Clients/nice-dcv-viewer-${version}.el8.x86_64.rpm";
-    sha256 = "sha256-iLz25SB5v7ghkAZOMGPmpNaPihd8ikzCQS//r1xBNRU=";
+    url = "https://d1uj6qtbmh3dt5.cloudfront.net/${lib.versions.majorMinor version}/Clients/nice-dcv-viewer-${version}.el9.x86_64.rpm";
+    sha256 = "sha256-JYvOxwSQQKjTLvpfpAQe1tqHS4QsshYJyzC5kIFEZLc=";
   };
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook3
+    wrapGAppsHook4
     python3Packages.rpm
   ];
+
   unpackPhase = ''
     rpm2cpio $src | ${cpio}/bin/cpio -idm
   '';
 
   buildInputs = [
-    libselinux
-    libkrb5
-    libxml2
-    libva
-    e2fsprogs
-    libx11
-    openssl
-    pcsclite
-    gtk3
-    cairo
-    libepoxy
-    pango
+    cups
+    cyrus_sasl
     gdk-pixbuf
+    gtk4
+    libfido2
+    libva
+    lz4
+    pcsclite
+    protobufc
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
   ];
 
-  installPhase = ''
-    mkdir -p $out/bin/
-    mkdir -p $out/lib64/
-    mv usr/bin/dcvviewer $out/bin/dcvviewer
-    mv usr/lib64/* $out/lib64/
-    mkdir -p $out/libexec/dcvviewer
-    mv usr/libexec/dcvviewer/dcvviewer $out/libexec/dcvviewer/dcvviewer
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      $out/libexec/dcvviewer/dcvviewer
-    # Fix the wrapper script to have the right basedir.
-    sed -i "s#basedir=/usr#basedir=$out#" $out/bin/dcvviewer
-    mv usr/share $out/
+  installPhase =
+    let
+      gst_plugin_system_path = lib.makeSearchPath "lib/gstreamer-1.0/" (
+        with gst_all_1;
+        [
+          gstreamer
+          gst-plugins-base
+          gst-plugins-good
+        ]
+      );
+      fixPathsPatch = replaceVars ./fix-paths.patch {
+        basedir = null;
+        gio_extra_modules = "${glib-networking}/lib/gio/modules";
+        gst_plugin_scanner = "${gst_all_1.gstreamer.out}/libexec/gstreamer-1.0/gst-plugin-scanner";
+        gst_plugin_system_path = gst_plugin_system_path;
+        dcv_sasl_plugin_dir = "${cyrus_sasl.out}/lib/sasl2";
+      };
+    in
+    ''
+      # Fix the wrapper script paths.
+      patch -p1 < ${fixPathsPatch}
+      substituteInPlace usr/bin/dcvviewer \
+        --replace-fail '@basedir@' "$out"
 
-    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+      mkdir -p $out/bin/
+      mv usr/bin/dcvviewer $out/bin/dcvviewer
 
-    # we already ship libffi.so.7
-    ln -s ${lib.getLib libffi}/lib/libffi.so $out/lib64/libffi.so.6
-  '';
+      mkdir -p $out/libexec/dcvviewer
+      mv \
+        usr/libexec/dcvviewer/dcvextensionswatchdog \
+        usr/libexec/dcvviewer/dcvviewer \
+        $out/libexec/dcvviewer
+      patchelf \
+        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        $out/libexec/dcvviewer/dcvviewer
 
-  meta = {
+      mkdir -p $out/lib64/dcvviewer
+      mv \
+        ./usr/lib64/dcvviewer/libavcodec.so.61 \
+        ./usr/lib64/dcvviewer/libavutil.so.59 \
+        ./usr/lib64/dcvviewer/libdcv.so \
+        ./usr/lib64/dcvviewer/libsoup-3.0.so.0 \
+        $out/lib64/dcvviewer
+
+      mv usr/share $out/
+      rm -rf $out/usr/share/doc
+
+      ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+    '';
+
+  meta = with lib; {
     description = "High-performance remote display protocol";
     homepage = "https://aws.amazon.com/hpc/dcv/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [ rmcgibbo ];
+    maintainers = with maintainers; [
+      rmcgibbo
+      jhol
+    ];
   };
 }

pkgs/by-name/ow/owntracks-frontend/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "owntracks-frontend";
+  version = "2.15.3";
+
+  src = fetchFromGitHub {
+    owner = "owntracks";
+    repo = "frontend";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-omNsCD6sPwPrC+PdyftGDUeZA8nOHkHkRHC+oHFC0eM=";
+  };
+  npmDepsHash = "sha256-sZkOvffpRoUTbIXpskuVSbX4+k1jiwIbqW4ckBwnEHM=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/owntracks-frontend
+    cp -r dist/* $out/share/owntracks-frontend
+    cp dist/config/config.example.js $out/share/owntracks-frontend/config/config.js
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Web interface for OwnTracks";
+    homepage = "https://github.com/owntracks/frontend";
+    changelog = "https://github.com/owntracks/frontend/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.aionescu ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ow/owntracks-recorder/package.nix

@@ -77,10 +77,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Store and access data published by OwnTracks apps";
     homepage = "https://github.com/owntracks/recorder";
-    changelog = "https://github.com/owntracks/recorder/blob/master/Changelog";
+    changelog = "https://github.com/owntracks/recorder/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.aionescu ];
     mainProgram = "ot-recorder";
   };
 })

pkgs/by-name/po/pocketbase/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pocketbase";
-  version = "0.36.7";
+  version = "0.36.8";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CI4OiFqYHr662EYa1mSGqAYyVDhoqXIOSPZQv5IVxk0=";
+    hash = "sha256-47Z0piORkQphm/XSoTLEXrYsKJXcdOKIes9OLRxjFfY=";
   };
 
-  vendorHash = "sha256-2zqDgHgZ8W1/iFkgmP5Frcd5YmPqr2PEC3aYTMrmdtE=";
+  vendorHash = "sha256-p085Ru3csNpGDMeF5q+W23Mc30WwhF9zHv0U29aEp/w=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/by-name/rs/rsshub/package.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsshub";
-  version = "0-unstable-2026-03-24";
+  version = "0-unstable-2026-04-03";
 
   src = fetchFromGitHub {
     owner = "DIYgod";
     repo = "RSSHub";
-    rev = "df6b73d8663c0ba4c11bae89a61cf0b87c8c52a5";
-    hash = "sha256-6YasIbThh5S7UH7WFVEdl++96hL3BEmxdp/QAAzIm18=";
+    rev = "de181a6cdcac0c534ecf7db5c51a5b5c2b0157e9";
+    hash = "sha256-xw80Fh2MdMrSfIKq/k44Bn67JxjubSXeM2idnX7B288=";
   };
 
   patches = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-uzPDx48dWAguQ3PolTWz0HDtnO6qBVlKpJRn+ub7mM0=";
+    hash = "sha256-0800u6UHIG2qc9Of74HXKo1g9GzdR1Gu/N/TRq+z/W8=";
     pnpm = pnpm_10;
   };
 

pkgs/by-name/sc/scite/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scite";
-  version = "5.5.8";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "https://www.scintilla.org/scite${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.tgz";
-    hash = "sha256-q9XuxPl96ddGvKD3Gbicy4Shx+5b03/sxLjJE7aWjSE=";
+    hash = "sha256-Bune5B0v/WfWxFgM0cqOtUOhKDPLWJXKUK7JKckZS/A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ti/tinyauth/package.nix

@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "tinyauth";
-  version = "5.0.4";
+  version = "5.0.6";
 
   src = fetchFromGitHub {
     owner = "steveiliop56";
     repo = "tinyauth";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-pToHUXUItcI6M0GkApqWjKtllidCi5aFwnIyLykOmPk=";
+    hash = "sha256-V75kjO34b1DBBI5aJMfn9finHSbVbWqQ34CH68gzrig=";
   };
 
-  vendorHash = "sha256-mECaACnQuJe5uBty6hs54vvaQ5uOafm6rhRfBhktvkc=";
+  vendorHash = "sha256-iyduJgKt9OAkOY6J8J1GztCkYEssr/TcB43L6/Qdzmc=";
 
   subPackages = [ "cmd/tinyauth" ];
 
@@ -83,7 +83,7 @@ buildGoModule (finalAttrs: {
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-0XmblrGZfi8EH4J+KONf5ZrnEmeeaVptVrIJDNz6PKo=";
+    outputHash = "sha256-pd5v5lD8Lyhf21OQvzjDTh63EcAe7E1OAoQuFGhAOX8=";
   };
 
   passthru = {

pkgs/by-name/un/units/package.nix

@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "units";
-  version = "2.26";
+  version = "2.27";
 
   src = fetchurl {
     url = "mirror://gnu/units/units-${finalAttrs.version}.tar.gz";
-    hash = "sha256-TEP3pJ/iIS7kM9PAdVoKGTXbNUl8Sla/n2jF9xiHPFQ=";
+    hash = "sha256-4bvbCWcufAju6YZ0nnoWKeuEpr30H1oqedaARESrvhA=";
   };
 
   # Until upstream updates their code to work with GCC 15.

pkgs/by-name/wh/wheelwizard/package.nix

@@ -14,13 +14,13 @@
 }:
 buildDotnetModule rec {
   pname = "wheelwizard";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "TeamWheelWizard";
     repo = "WheelWizard";
     tag = version;
-    hash = "sha256-pxz4aZozpQQB8GgL/D2AgbtCy+cTbd5DNsODoDd2Xa0=";
+    hash = "sha256-ayik04mn11NbD4R09O99Yqij6aIjz6DUhpgqKQoGRP4=";
   };
   postPatch = ''
     rm .config/dotnet-tools.json

pkgs/desktops/pantheon/desktop/gala/default.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gala";
-  version = "8.4.1";
+  version = "8.4.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "gala";
     tag = finalAttrs.version;
-    hash = "sha256-CBgrHd9euRuOxBR+hut5J1d0S2qZ5hVU3b8pjJuNG7s=";
+    hash = "sha256-T4Kpgc9i0dqzG/dX46fCpkAbXtppkqUPu2bYtCl708k=";
   };
 
   depsBuildBuild = [ pkg-config ];

pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix

@@ -12,15 +12,15 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-bigquery-logging";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_bigquery_logging";
-    inherit version;
-    hash = "sha256-2ENcmRKghxKocDtYOjZgsvOfQ2GooC/RpoSdKSVhBV0=";
+    inherit (finalAttrs) version;
+    hash = "sha256-jgXYORisIBuJxLVgyd0Dig1aFR8CYWfjuBWsi+VgDew=";
   };
 
   build-system = [ setuptools ];
@@ -51,8 +51,8 @@ buildPythonPackage rec {
   meta = {
     description = "Bigquery logging client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-bigquery-logging";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-bigquery-logging-v${version}/packages/google-cloud-bigquery-logging/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-bigquery-logging-v${finalAttrs.version}/packages/google-cloud-bigquery-logging/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/llm-echo/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "llm-echo";
-  version = "0.3a3";
+  version = "0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-echo";
     tag = version;
-    hash = "sha256-4345UIyaQx+mYYBAFD5AaX5YbjbnJQt8bKMD5Vl8VJc=";
+    hash = "sha256-E0C/SZ+0t1iPWulr/xaQQPzRR7Qg7nF/X5/HX8QxkMw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/niquests/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "niquests";
-  version = "3.18.3";
+  version = "3.18.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "niquests";
     tag = "v${version}";
-    hash = "sha256-8XR1TZ2VbUVbXb6dEBS3yr+FB4L6Gbhhx3hoYlHfcoA=";
+    hash = "sha256-AcF0HpC7vPusEGp7i4ofY2FTJrFxLwXv33MnR6sdvJg=";
   };
 
   build-system = [ hatchling ];

pkgs/development/rocq-modules/relation-algebra/default.nix

@@ -16,7 +16,7 @@ mkRocqDerivation {
       [ rocq-core.rocq-version ]
       [
         {
-          cases = [ (lib.versions.isEq "9.0") ];
+          cases = [ (lib.versions.range "9.0" "9.1") ];
           out = "1.8.0";
         }
       ]

pkgs/top-level/coq-packages.nix

@@ -359,6 +359,6 @@ rec {
   coq_9_1 = coqPackages_9_1.coq;
   coq_9_2 = coqPackages_9_2.coq;
 
-  coqPackages = lib.recurseIntoAttrs coqPackages_9_0;
+  coqPackages = lib.recurseIntoAttrs coqPackages_9_1;
   coq = coqPackages.coq;
 }

pkgs/top-level/rocq-packages.nix

@@ -116,6 +116,6 @@ rec {
   rocqPackages_9_1 = mkRocqPackages rocq-core_9_1;
   rocqPackages_9_2 = mkRocqPackages rocq-core_9_2;
 
-  rocqPackages = lib.recurseIntoAttrs rocqPackages_9_0;
+  rocqPackages = lib.recurseIntoAttrs rocqPackages_9_1;
   rocq-core = rocqPackages.rocq-core;
 }