From ede03b9dcfc464f11c969ec904fb704edbf2ea47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gabriel=20N=C3=BCtzi?= <gnuetzi@gmail.com>
Date: Tue, 27 Jan 2026 12:36:57 +0100
Subject: [PATCH 01/67] nixosTests.gitlab.runner: add garbage collection to
 daemon

---
 .../gitlab/runner/podman-runner/default.nix   | 42 ++++++++++++-------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/nixos/tests/gitlab/runner/podman-runner/default.nix b/nixos/tests/gitlab/runner/podman-runner/default.nix
index 0bdccfaeed3a..885f0d191ae2 100644
--- a/nixos/tests/gitlab/runner/podman-runner/default.nix
+++ b/nixos/tests/gitlab/runner/podman-runner/default.nix
@@ -104,31 +104,41 @@ let
         + "/docker.nix"
       );
 
-  nixImageBase = pkgs.callPackage nixImageBaseFn {
-    name = "local/nix-base";
-    tag = "latest";
+  nixImageBase =
+    nixConf:
+    pkgs.callPackage nixImageBaseFn {
+      name = "local/nix-base";
+      tag = "latest";
 
-    bundleNixpkgs = false;
-    maxLayers = 2;
+      bundleNixpkgs = false;
+      maxLayers = 2;
 
-    # You can add here a user with uid,gid,uname,gname etc.
-    # We are using root.
+      # You can add here a user with uid,gid,uname,gname etc.
+      # We are using root.
 
-    extraPkgs = nixStorePkgs;
+      extraPkgs = nixStorePkgs;
 
-    nixConf = {
-      cores = "0";
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
+      nixConf = {
+        cores = "0";
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
+      }
+      // nixConf;
     };
-  };
 
   # This is the daemon image which provides the store
   # as volumes.
   nixDaemonImage = pkgs.dockerTools.buildLayeredImage {
-    fromImage = nixImageBase;
+    fromImage = nixImageBase {
+      min-free = "1G"; # Triggers garbage collection.
+      max-free = "10G"; # Stops garbage collection at 10G free space.
+
+      # Reduce disk usage by discarding old derivations/outputs
+      keep-derivations = false;
+      keep-outputs = false;
+    };
     name = "local/nix-daemon";
     tag = "latest";
 

From 96ee407b5860a79956aec4ef709b3ecca575f324 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 13 Mar 2026 02:59:11 +0000
Subject: [PATCH 02/67] sqlit-tui: 1.3.1 -> 1.3.1.1

---
 pkgs/by-name/sq/sqlit-tui/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sq/sqlit-tui/package.nix b/pkgs/by-name/sq/sqlit-tui/package.nix
index 2ea96f3c04ac..9d11745d6850 100644
--- a/pkgs/by-name/sq/sqlit-tui/package.nix
+++ b/pkgs/by-name/sq/sqlit-tui/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sqlit-tui";
-  version = "1.3.1";
+  version = "1.3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Maxteabag";
     repo = "sqlit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+7mv5aNJuNEudFARSZdB9/yedvqk6UHbfGku8J7Ye1g=";
+    hash = "sha256-MG5ZhYrEdOVngDkFVU8gWx9Kpfn+UFcxkdimqv7lAVE=";
   };
 
   build-system = with python3Packages; [

From 7dfab0e1380d912406e2b740aa05715a8cf8e6cb Mon Sep 17 00:00:00 2001
From: Dionysis Grigoropoulos <dgrig@erethon.com>
Date: Wed, 25 Mar 2026 00:00:15 +0200
Subject: [PATCH 03/67] nixos/librenms: Use new Artisan Console Command

After https://github.com/librenms/librenms/pull/18388/, rrdstep.php was
moved to an Artisan Console Command, so we need to update the script in
librenms-setup to use this new command since the older php script
doesn't exist anymore.
---
 nixos/modules/services/monitoring/librenms.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/librenms.nix b/nixos/modules/services/monitoring/librenms.nix
index 497cd38a4b09..db45fea66d86 100644
--- a/nixos/modules/services/monitoring/librenms.nix
+++ b/nixos/modules/services/monitoring/librenms.nix
@@ -705,7 +705,7 @@ in
           # convert rrd files when the oneMinutePolling option is changed
           OLD_ENABLED=$(cat ${cfg.dataDir}/one_minute_enabled)
           if [[ $OLD_ENABLED != "${lib.boolToString cfg.enableOneMinutePolling}" ]]; then
-            ${package}/scripts/rrdstep.php -h all
+            ${artisanWrapper}/bin/librenms-artisan maintenance:rrd-step all
             echo "${lib.boolToString cfg.enableOneMinutePolling}" > ${cfg.dataDir}/one_minute_enabled
           fi
 

From f32c37b88cb1cfbed408eca10d78b5db77516806 Mon Sep 17 00:00:00 2001
From: Timothy Gallion <timbama@gmail.com>
Date: Thu, 1 Jan 2026 15:17:53 -0500
Subject: [PATCH 04/67] lib.types.defaultTypeMerge: Fix for functors with no
 `wrapped` attr

Downstream types that want to use `lib.types.defaultTypeMerge` must include
`wrapped` even though it is deprecated or the internal
`wrappedDeprecationMessage`. This is caused by accessing the
`wrapped` attr in `lib.types.defaultTypeMerge`. The logic should first check
if the attr exists and then if it does check if it is null.
---
 lib/tests/modules.sh                          |  2 ++
 .../modules/default-type-merge-payload.nix    | 32 +++++++++++++++++++
 lib/types.nix                                 |  7 ++--
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 lib/tests/modules/default-type-merge-payload.nix

diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index bc89d4c20851..0ef680213946 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -728,6 +728,8 @@ checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survive
 # Test that specifying both functor.wrapped and functor.payload isn't allowed
 checkConfigError 'Type foo defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.' config.result ./default-type-merge-both.nix
 
+# Test that not including functor.wrapped is allowed
+checkConfigOutput 'ok' config.result ./default-type-merge-payload.nix
 
 # Anonymous submodules don't get nixed by import resolution/deduplication
 # because of an `extendModules` bug, issue 168767.
diff --git a/lib/tests/modules/default-type-merge-payload.nix b/lib/tests/modules/default-type-merge-payload.nix
new file mode 100644
index 000000000000..d6cdc5906074
--- /dev/null
+++ b/lib/tests/modules/default-type-merge-payload.nix
@@ -0,0 +1,32 @@
+{ lib, options, ... }:
+let
+  fooOf =
+    elemType:
+    lib.mkOptionType {
+      name = "foo";
+      functor = {
+        name = "foo";
+        type = payload: fooOf payload.elemType;
+        binOp = a: _b: a;
+        payload.elemType = elemType;
+      };
+    };
+in
+{
+  imports = [
+    {
+      options.foo = lib.mkOption {
+        type = fooOf lib.types.int;
+      };
+    }
+    {
+      options.foo = lib.mkOption {
+        type = fooOf lib.types.int;
+      };
+    }
+  ];
+
+  options.result = lib.mkOption {
+    default = builtins.seq options.foo "ok";
+  };
+}
diff --git a/lib/types.nix b/lib/types.nix
index 25286303f11e..cd0a73dab9e2 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -158,8 +158,11 @@ rec {
         assert (f'.payload != null) == (f.payload != null);
         f.payload != null;
       hasWrapped =
-        assert (f'.wrapped != null) == (f.wrapped != null);
-        f.wrapped != null;
+        let
+          hasWrappedNonNull = set: set ? "wrapped" && set.wrapped != null;
+        in
+        assert (hasWrappedNonNull f') == (hasWrappedNonNull f);
+        hasWrappedNonNull f;
 
       typeFromPayload = if mergedPayload == null then null else f.type mergedPayload;
       typeFromWrapped = if mergedWrapped == null then null else f.type mergedWrapped;

From 760f43a69e47fbbca3a9db56dcf7ac0c1d307ca3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Apr 2026 01:34:05 +0200
Subject: [PATCH 05/67] nixos/firewall: disable refused connections logging

On any server on the internet this causes fast rotation of the kernel
ringbuffer, which makes more important message disappear from dmesg much
too quickly.
---
 nixos/doc/manual/release-notes/rl-2605.section.md | 6 ++++++
 nixos/modules/services/networking/firewall.nix    | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 3090f9ee8891..ce14eba26764 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -343,6 +343,12 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
 
+- The `networking.firewall.logRefusedConnections` option now defaults to
+  `false`.  Logging of refused or dropped incoming connections can generate a
+  very high volume of kernel log messages on internet-facing systems, causing
+  the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
+  relevant diagnostic information.
+
 - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.
 
 - `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index 95308c2a9cfc..2e3d1250ef2c 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -118,7 +118,7 @@ in
 
       logRefusedConnections = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = false;
         description = ''
           Whether to log rejected or dropped incoming connections.
           Note: The logs are found in the kernel logs, i.e. dmesg

From 33b4d77b8527b826eab9498896407c51e0e6907f Mon Sep 17 00:00:00 2001
From: DSeeLP <46624152+DSeeLP@users.noreply.github.com>
Date: Fri, 6 Mar 2026 14:55:28 +0100
Subject: [PATCH 06/67] shairport-sync: use new names of pipewire and
 pulseaudio backends

The pipewire and pulseaudio backends where renamed from `pw` to
`pipewire` and from `pa` to `pulseaudio` in shairport-sync 5.0.

See https://github.com/mikebrady/shairport-sync/commit/b405c0b89651aaa276cfa1fabb36e2b2ba38fb7a#diff-49473dca262eeab3b4a43002adb08b4db31020d190caaad1594b47f1d5daa810
---
 .../services/networking/shairport-sync.nix       | 16 +++++++++++++---
 pkgs/by-name/sh/shairport-sync/package.nix       |  4 ++--
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/networking/shairport-sync.nix b/nixos/modules/services/networking/shairport-sync.nix
index ca2aa156b773..f4296396967c 100644
--- a/nixos/modules/services/networking/shairport-sync.nix
+++ b/nixos/modules/services/networking/shairport-sync.nix
@@ -38,13 +38,13 @@ in
       settings = mkOption {
         type = configFormat.type;
         default = {
-          general.output_backend = "pa";
+          general.output_backend = "pulseaudio";
           diagnostics.log_verbosity = 1;
         };
         example = {
           general = {
             name = "NixOS Shairport";
-            output_backend = "pw";
+            output_backend = "pipewire";
           };
           metadata = {
             enabled = "yes";
@@ -112,13 +112,23 @@ in
   ###### implementation
 
   config = mkIf config.services.shairport-sync.enable {
+    assertions = [
+      {
+        assertion = config.services.shairport-sync.settings.general.output_backend or null != "pw";
+        message = "shairport-sync 5.0 renamed the pipewire backend from 'pw' to 'pipewire'";
+      }
+      {
+        assertion = config.services.shairport-sync.settings.general.output_backend or null != "pa";
+        message = "shairport-sync 5.0 renamed the pulseaudio backend from 'pa' to 'pulseaudio'";
+      }
+    ];
 
     services.avahi.enable = true;
     services.avahi.publish.enable = true;
     services.avahi.publish.userServices = true;
 
     services.shairport-sync.settings = {
-      general.output_backend = lib.mkDefault "pa";
+      general.output_backend = lib.mkDefault "pulseaudio";
       diagnostics.log_verbosity = lib.mkDefault 1;
     };
 
diff --git a/pkgs/by-name/sh/shairport-sync/package.nix b/pkgs/by-name/sh/shairport-sync/package.nix
index 6039d6409450..be279d8affd2 100644
--- a/pkgs/by-name/sh/shairport-sync/package.nix
+++ b/pkgs/by-name/sh/shairport-sync/package.nix
@@ -119,8 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-ssl=openssl"
   ]
   ++ optional enableAvahi "--with-avahi"
-  ++ optional enablePulse "--with-pa"
-  ++ optional enablePipewire "--with-pw"
+  ++ optional enablePulse "--with-pulseaudio"
+  ++ optional enablePipewire "--with-pipewire"
   ++ optional enableAlsa "--with-alsa"
   ++ optional enableSndio "--with-sndio"
   ++ optional enableAo "--with-ao"

From 3040774c2f99756cc03c28dd78bbcb2bbd4e73f9 Mon Sep 17 00:00:00 2001
From: Adrian Pistol <vifino@posteo.net>
Date: Fri, 10 Apr 2026 20:27:26 +0200
Subject: [PATCH 07/67] wolfssl: 5.9.0 -> 5.9.1

---
 pkgs/by-name/wo/wolfssl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index 6df1a958ebcf..6cde924b81f7 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.9.0";
+  version = "5.9.1";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
+    hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE=";
   };
 
   postPatch = ''

From ac8ccc528a4b1c17eaf478f70da04bfc10d65283 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Apr 2026 21:09:57 +0000
Subject: [PATCH 08/67] mangareader: 2.3.0 -> 2.4.0

---
 pkgs/by-name/ma/mangareader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mangareader/package.nix b/pkgs/by-name/ma/mangareader/package.nix
index debf400bfec0..f2982b668642 100644
--- a/pkgs/by-name/ma/mangareader/package.nix
+++ b/pkgs/by-name/ma/mangareader/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangareader";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "g-fb";
     repo = "mangareader";
     rev = finalAttrs.version;
-    hash = "sha256-G/X8iJxEMNCSI0whxIpmzFh/Y/Hbr9vvzcGsbb8arig=";
+    hash = "sha256-l1rFyOXgBYPiDfAcGR3uGNJ2iHpFmVkfCacckulkkMM=";
   };
 
   nativeBuildInputs = [

From a3b13a82d4885365c775ba30e6e4513d9732badb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 12 Apr 2026 08:44:36 +0200
Subject: [PATCH 09/67] lib/modules: short-circuit mergeDefinitions for plain
 singletons

The vast majority of option definitions reaching mergeDefinitions are
singletons whose value carries no _type wrapper (mkIf/mkMerge/
mkOverride/mkOrder). For those, the dischargeProperties ->
filterOverrides' -> sortProperties pipeline is a no-op yet still costs
~125k function calls and ~70k thunks on a minimal NixOS system eval.

Detect this case up front and reuse the input list as
defsFinal'.values, keeping the addErrorContext around the value probe
so error traces still point at the defining file. highestPrio is
defaultOverridePriority by construction.

A single-fold filterOverrides' was prototyped but allocates an attrset
per definition and regressed gc.totalBytes; with the fast path in
place that function is no longer hot enough to matter.

NIX_SHOW_STATS, minimal `nix-instantiate ./nixos -A system`:
  nrFunctionCalls  5490285 -> 5365172  (-125113)
  nrThunks         8182569 -> 8112150   (-70419)
  gc.totalBytes     640.0M -> 635.2M     (-4.8M)
---
 lib/modules.nix | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/lib/modules.nix b/lib/modules.nix
index 9bf1ac9b4d73..7d91d4b10ce3 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1223,10 +1223,33 @@ let
           else
             defsFiltered.values;
       in
-      {
-        values = defsSorted;
-        inherit (defsFiltered) highestPrio;
-      };
+      # Fast path: the overwhelming majority of options have exactly one
+      # definition whose value carries no property wrapper
+      # (mkIf/mkMerge/mkOverride/mkOrder/definition). In that case the
+      # discharge/filter/sort pipeline above is a no-op but still allocates
+      # several intermediate lists and closures. Detect it up front and hand
+      # the original singleton straight to the type merge. The let-bindings
+      # above are lazy and thus never forced on this branch.
+      if
+        length defs == 1
+        && (
+          let
+            d = head defs;
+          in
+          addErrorContext "while evaluating definitions from `${d.file}':" (
+            !(isAttrs d.value && d.value ? _type)
+          )
+        )
+      then
+        {
+          values = defs;
+          highestPrio = defaultOverridePriority;
+        }
+      else
+        {
+          values = defsSorted;
+          inherit (defsFiltered) highestPrio;
+        };
     defsFinal = defsFinal'.values;
 
     # Type-check the remaining definitions, and merge them. Or throw if no definitions.

From 522731526c17982baa2b7450131fe120d72fef90 Mon Sep 17 00:00:00 2001
From: Gabriel Reynes <gabrielreynes@gmail.com>
Date: Sun, 12 Apr 2026 11:55:35 +0200
Subject: [PATCH 10/67] vivaldi: fix Vulkan ICD discovery

Vivaldi ships its own libvulkan.so.1 which does not know about the
NixOS-specific /run/opengl-driver/share search path, preventing
Vulkan ICD discovery. This causes WebGPU's requestAdapter() to
return null.

Replace the bundled libvulkan.so.1 with a symlink to the NixOS-patched
vulkan-loader and add addDriverRunpath.driverLink/share to XDG_DATA_DIRS,
matching the approach used by google-chrome and microsoft-edge.
---
 pkgs/by-name/vi/vivaldi/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 60055705301e..f1b333533346 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -47,6 +47,7 @@
   libdrm,
   libgbm,
   vulkan-loader,
+  addDriverRunpath,
   nss,
   nspr,
   patchelf,
@@ -208,9 +209,13 @@ stdenv.mkDerivation rec {
         "$out"/opt/vivaldi/product_logo_''${d}.png \
         "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
     done
+    # replace bundled vulkan-loader with the NixOS-patched one to enable Vulkan ICD discovery
+    rm $out/opt/vivaldi/libvulkan.so.1
+    ln -s "${lib.getLib vulkan-loader}/lib/libvulkan.so.1" $out/opt/vivaldi/libvulkan.so.1
+
     wrapProgram "$out/bin/vivaldi" \
       --add-flags ${lib.escapeShellArg commandLineArgs} \
-      --prefix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
+      --prefix XDG_DATA_DIRS : "${addDriverRunpath.driverLink}/share:${gtk3}/share/gsettings-schemas/${gtk3.name}" \
       --prefix LD_LIBRARY_PATH : ${libPath} \
       --prefix PATH : ${coreutils}/bin \
       ''${qtWrapperArgs[@]}

From 8682852a4d931f83e433bb7af2401e553a8e7277 Mon Sep 17 00:00:00 2001
From: Lyna <git@blooym.dev>
Date: Sun, 12 Apr 2026 16:54:50 +0100
Subject: [PATCH 11/67] porxie: init at 0.1.0

---
 pkgs/by-name/po/porxie/package.nix | 31 ++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 pkgs/by-name/po/porxie/package.nix

diff --git a/pkgs/by-name/po/porxie/package.nix b/pkgs/by-name/po/porxie/package.nix
new file mode 100644
index 000000000000..33c6265bf340
--- /dev/null
+++ b/pkgs/by-name/po/porxie/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromCodeberg,
+  rustPlatform,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "porxie";
+  version = "0.1.0";
+
+  src = fetchFromCodeberg {
+    owner = "Blooym";
+    repo = "porxie";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-TxN9BA/o9BI9yF7k3wpJae78hIcCAhB/ggXVQlt4oP0=";
+  };
+  cargoHash = "sha256-a0Ps8SvheQoX+Ai8EYgEpyTFwNvB7E3J6MfGiyEvMzM=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Porxie, an ATProto blob proxy for secure content delivery";
+    homepage = "https://codeberg.org/Blooym/porxie";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ blooym ];
+    mainProgram = "porxie";
+    platforms = lib.platforms.unix;
+  };
+})

From 612363033c4f69c85a31fb7de27e472e1ef47b6d Mon Sep 17 00:00:00 2001
From: Lyna <git@blooym.dev>
Date: Sun, 12 Apr 2026 16:58:29 +0100
Subject: [PATCH 12/67] nixos/porxie: init

---
 .../manual/release-notes/rl-2605.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/networking/porxie.nix  | 314 ++++++++++++++++++
 3 files changed, 317 insertions(+)
 create mode 100644 nixos/modules/services/networking/porxie.nix

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 80320c9bc670..03c0702b348d 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -124,6 +124,8 @@
 
 - [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.
 
+- [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fb773e97f7ef..f0a055130394 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1344,6 +1344,7 @@
   ./services/networking/pihole-ftl.nix
   ./services/networking/pixiecore.nix
   ./services/networking/pleroma.nix
+  ./services/networking/porxie.nix
   ./services/networking/powerdns.nix
   ./services/networking/pppd.nix
   ./services/networking/pptpd.nix
diff --git a/nixos/modules/services/networking/porxie.nix b/nixos/modules/services/networking/porxie.nix
new file mode 100644
index 000000000000..54c55230d3a7
--- /dev/null
+++ b/nixos/modules/services/networking/porxie.nix
@@ -0,0 +1,314 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.porxie;
+in
+{
+  options.services.porxie = {
+    enable = lib.mkEnableOption "Porxie, an ATProto blob proxy for secure content delivery";
+
+    package = lib.mkPackageOption pkgs "porxie" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        Files to load environment variables from. Use for secrets such as
+        {env}`PORXIE_SERVER_AUTH_TOKEN` and {env}`PORXIE_POLICY_REQUEST_HEADERS`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Configuration for Porxie as environment variables. See the
+        [README](https://codeberg.org/Blooym/porxie/src/branch/main/README.md)
+        for detailed information about application configuration.
+
+        Secrets such as {option}`settings.PORXIE_SERVER_AUTH_TOKEN` should be set via
+        {option}`environmentFiles` rather than here, as values set here will
+        be readable in the Nix store.
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.bool
+              lib.types.int
+            ]
+          )
+        );
+
+        options = {
+          # Server.
+          PORXIE_SERVER_ADDRESS = lib.mkOption {
+            type = lib.types.str;
+            default = "ip:127.0.0.1:6314";
+            description = ''
+              Address to bind the server to.
+
+              Use the `ip:` prefix for an IP address (e.g. `ip:127.0.0.1:6314`), or on UNIX
+              systems, the `unix:` prefix for a UNIX socket path (e.g. `unix:/run/porxie/porxie.sock`).
+            '';
+          };
+          PORXIE_SERVER_AUTH_TOKEN = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Bearer token for authenticating admin requests.
+
+              When unset, all authenticated endpoints will reject requests with HTTP 401.
+
+              Should be set via {option}`environmentFiles` rather than directly.
+            '';
+          };
+
+          # Blobs.
+          PORXIE_BLOB_ALLOWED_MIMETYPES = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            apply = v: if v != null then lib.concatStringsSep "," v else null;
+            description = ''
+              Blob MIME types that can be served.
+
+              Validation is done loosely via content inference. Further validation can be done by
+              a layer above this proxy, such as an image transformation service. When inference
+              fails, the blob's type falls back to `application/octet-stream`. When that type is
+              allowed, blobs failing inference can still be served.
+            '';
+          };
+          PORXIE_BLOB_MAX_SIZE = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum blob size that can be fetched and served.
+
+              Blobs that exceed this limit will return HTTP 413. Setting this too high can
+              exhaust process or system memory. The minimum value is 512kb and the maximum is
+              the system's total memory.
+            '';
+          };
+          PORXIE_BLOB_CACHE_HEADER = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              The `Cache-Control` header value to send alongside blob responses.
+
+              This does not affect internal cache lifetimes, only how downstream clients such as
+              CDNs and browsers are instructed to cache responses. Intermediary caches may need
+              to be cleared manually for changes to take effect quickly.
+            '';
+          };
+          PORXIE_BLOB_PROCESSING_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration a blob can be processed by this server before aborting.";
+          };
+          PORXIE_BLOB_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before blob fetch requests are timed out.";
+          };
+          PORXIE_BLOB_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before an attempted connection to a blob upstream is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_BLOB_HTTP_TIMEOUT`.
+            '';
+          };
+
+          # Identity.
+          PORXIE_IDENTITY_PLC_URL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              URL of the PLC instance used for `did:plc` lookups.
+
+              Can typically be left as default unless using a custom or local development setup.
+            '';
+          };
+          PORXIE_IDENTITY_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before identity resolution requests are timed out.";
+          };
+          PORXIE_IDENTITY_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before a connection attempt to an identity upstream is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_IDENTITY_HTTP_TIMEOUT`.
+            '';
+          };
+
+          # Cache.
+          PORXIE_CACHE_ALLOCATION = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Total memory allocation for the internal cache.
+
+              Blobs are cached using an LFU policy. The most frequently requested blobs are kept
+              longest when the cache approaches its limit.
+
+              For production deployments, a CDN or caching layer in front of this server is
+              recommended for lower latency and better global availability.
+
+              Setting this too high can exhaust process or system memory. The minimum value is
+              8mb and the maximum is the system's total memory.
+            '';
+          };
+          PORXIE_CACHE_BLOB_TTI = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long blobs can be idle in the cache before expiring.";
+          };
+          PORXIE_CACHE_OWNERSHIP_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long blob ownership can be cached before expiring.";
+          };
+          PORXIE_CACHE_POLICY_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long policy decisions can be cached before expiring.";
+          };
+          PORXIE_CACHE_IDENTITY_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long identity lookups (DID resolution, etc.) can be cached before expiring.";
+          };
+
+          # Policy.
+          PORXIE_POLICY_URL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Policy service URL that DID+CID pairs will be checked against.
+
+              Requests are sent as HTTP GET `<url>/<did>/<cid>`. The service is expected to
+              return HTTP 200 (OK) if permitted or HTTP 410 (GONE) if restricted.
+            '';
+          };
+          PORXIE_POLICY_REQUEST_HEADERS = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            apply = v: if v != null then lib.concatStringsSep "|" v else null;
+            description = ''
+              Headers sent alongside all requests to the policy service.
+              Each header must be in the format `Name: value`.
+
+              Should be set via {option}`environmentFiles` for sensitive values such as API keys.
+            '';
+          };
+          PORXIE_POLICY_FAIL_OPEN = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
+            default = null;
+            apply = v: if v != null then lib.boolToString v else null;
+            description = ''
+              Allow requests to proceed if the policy service is unavailable or returns an
+              unexpected status code.
+
+              Warning: enabling this means restricted blobs may be served when the policy
+              service is unreachable.
+            '';
+          };
+          PORXIE_POLICY_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before policy service requests are timed out.";
+          };
+          PORXIE_POLICY_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before an attempted connection to the policy service is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_POLICY_HTTP_TIMEOUT`.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          (cfg.settings.PORXIE_POLICY_REQUEST_HEADERS != null || cfg.settings.PORXIE_POLICY_FAIL_OPEN != null)
+          -> cfg.settings.PORXIE_POLICY_URL != null;
+        message = "services.porxie: PORXIE_POLICY_URL must be set when using any other policy options";
+      }
+    ];
+
+    systemd.services.porxie = {
+      description = "Porxie - ATProto blob proxy";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = "porxie";
+        DynamicUser = true;
+
+        ExecStart = lib.getExe cfg.package;
+        Environment = lib.mapAttrsToList (k: v: "${k}=${lib.escapeShellArg (toString v)}") (
+          lib.filterAttrs (_: v: v != null) cfg.settings
+        );
+        EnvironmentFile = cfg.environmentFiles;
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "porxie";
+        RuntimeDirectoryMode = "0750";
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "all";
+        ProtectSystem = "strict";
+
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        AmbientCapabilities = "";
+        RemoveIPC = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ blooym ];
+}

From f8658cdda3cc3bc0253adbf8cce7eda66e2315c7 Mon Sep 17 00:00:00 2001
From: Lyna <git@blooym.dev>
Date: Sun, 12 Apr 2026 17:30:21 +0100
Subject: [PATCH 13/67] nixosTests.porxie: init

---
 nixos/tests/all-tests.nix          |  1 +
 nixos/tests/porxie.nix             | 23 +++++++++++++++++++++++
 pkgs/by-name/po/porxie/package.nix |  9 ++++++++-
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/porxie.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9a059c30563c..b6512c99ca01 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1303,6 +1303,7 @@ in
   polaris = runTest ./polaris.nix;
   pomerium = handleTestOn [ "x86_64-linux" ] ./pomerium.nix { };
   portunus = runTest ./portunus.nix;
+  porxie = runTest ./porxie.nix;
   postfix = handleTest ./postfix.nix { };
   postfix-raise-smtpd-tls-security-level =
     handleTest ./postfix-raise-smtpd-tls-security-level.nix
diff --git a/nixos/tests/porxie.nix b/nixos/tests/porxie.nix
new file mode 100644
index 000000000000..7f14509a6ba6
--- /dev/null
+++ b/nixos/tests/porxie.nix
@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  name = "porxie";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.porxie = {
+        enable = true;
+        settings = {
+          PORXIE_SERVER_ADDRESS = "ip:127.0.0.1:6453";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("porxie.service")
+    machine.wait_for_open_port(6453)
+    machine.succeed("curl --fail http://localhost:6453")
+  '';
+
+  meta.maintainers = [ lib.maintainers.blooym ];
+}
diff --git a/pkgs/by-name/po/porxie/package.nix b/pkgs/by-name/po/porxie/package.nix
index 33c6265bf340..9920eaf7e84b 100644
--- a/pkgs/by-name/po/porxie/package.nix
+++ b/pkgs/by-name/po/porxie/package.nix
@@ -2,6 +2,8 @@
   lib,
   fetchFromCodeberg,
   rustPlatform,
+  nixosTests,
+  stdenvNoCC,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -18,7 +20,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
   cargoHash = "sha256-a0Ps8SvheQoX+Ai8EYgEpyTFwNvB7E3J6MfGiyEvMzM=";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux {
+      porxie = nixosTests.porxie;
+    };
+  };
 
   meta = {
     description = "Porxie, an ATProto blob proxy for secure content delivery";

From 77e9049646721bc67ef47109fc1595d4f987daa1 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Apr 2026 21:33:04 +0100
Subject: [PATCH 14/67] htop: 3.4.1 -> 3.5.0

Changes: https://github.com/htop-dev/htop/blob/3.5.0/ChangeLog
---
 pkgs/by-name/ht/htop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ht/htop/package.nix b/pkgs/by-name/ht/htop/package.nix
index 55a8c08f49be..8b0dcb321964 100644
--- a/pkgs/by-name/ht/htop/package.nix
+++ b/pkgs/by-name/ht/htop/package.nix
@@ -19,13 +19,13 @@ assert systemdSupport -> stdenv.hostPlatform.isLinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "htop" + lib.optionalString withVimKeys "-vim";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "htop-dev";
     repo = "htop";
     tag = finalAttrs.version;
-    hash = "sha256-fVqQwXbJus2IVE1Bzf3yJJpKK4qcZN/SCTX1XYkiHhU=";
+    hash = "sha256-RVJH7osffP3vU74A3e2mjGBAB0ZPMBisBL8n2kDMB+Q=";
   };
 
   patches = lib.optional withVimKeys (fetchpatch2 {

From 924e5a22c732c1caebb498c2efcb3c0eecd9feee Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 30 Mar 2026 07:08:23 -0700
Subject: [PATCH 15/67] nixVersions.stable: nix_2_31 -> nix_2_34

---
 nixos/modules/installer/tools/nix-fallback-paths.nix | 12 ++++++------
 pkgs/tools/package-management/nix/default.nix        |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 98bd3cec0de2..7a74c45432ca 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/vals1fs2rl6yn5f8gbqj9mvly4r27shs-nix-2.31.4";
-  i686-linux = "/nix/store/fyrlz8cdzvf5csdh5885wifpxc8ywdii-nix-2.31.4";
-  aarch64-linux = "/nix/store/19p3nc892m7idfg2ngd1614660xqbhnm-nix-2.31.4";
-  riscv64-linux = "/nix/store/x1isvq0xnyrg0l29qk2xlp929cgjsmqy-nix-riscv64-unknown-linux-gnu-2.31.4";
-  x86_64-darwin = "/nix/store/4gqxzd5zkxcq271wi5saml4zd92rdkws-nix-2.31.4";
-  aarch64-darwin = "/nix/store/r3gz609kdqchxcmil7dhbravbq8kwm93-nix-2.31.4";
+  x86_64-linux = "/nix/store/q7f0d4m54yj98fcjmbkscw83j82fypnd-nix-2.34.6";
+  i686-linux = "/nix/store/mlv349bmjjx34p50idp54rg0wsm44hws-nix-2.34.6";
+  aarch64-linux = "/nix/store/wlcv2ymswfgwv1cj1q29p26rh26xj3nd-nix-2.34.6";
+  riscv64-linux = "/nix/store/000b0vjlhw359rl82p8pld00g6363c78-nix-riscv64-unknown-linux-gnu-2.34.6";
+  x86_64-darwin = "/nix/store/mqvv503c5l9kgjvc7vyxj3rdx5a71c11-nix-2.34.6";
+  aarch64-darwin = "/nix/store/hcgga2smfm8lqirshrbfpk5j1my1wh4j-nix-2.34.6";
 }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 78cbbd8541bf..de0556356e53 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -230,7 +230,7 @@ lib.makeExtensible (
       latest = self.nix_2_34;
 
       # Read ./README.md before bumping a major release
-      stable = addFallbackPathsCheck self.nix_2_31;
+      stable = addFallbackPathsCheck self.nix_2_34;
     }
     // lib.optionalAttrs config.allowAliases (
       lib.listToAttrs (

From 0ca69b06507c8a66ba02774b218aa2e8ccd2b59e Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 30 Mar 2026 08:42:46 -0700
Subject: [PATCH 16/67] nix: fix nix-store-tests-run for static builds

The test runner's buildInputs (writableTmpDirAsHomeHook, openssl)
need to be nativeBuildInputs. In the static (cross-musl) build,
strictDeps is enabled and only nativeBuildInputs are added to PATH.
With buildInputs, openssl was not in PATH, causing
HttpsBinaryCacheStoreTest.queryPathInfo to crash.
---
 .../nix/modular/src/libstore-tests/package.nix                | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
index e31044270a76..b7eebc6f53ca 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
@@ -62,10 +62,10 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-            buildInputs = [
+            nativeBuildInputs = [
               writableTmpDirAsHomeHook
             ]
-            ++ lib.optional (lib.versionAtLeast version "2.34pre") openssl;
+            ++ lib.optional (lib.versionAtLeast version "2.34pre") (lib.getBin openssl);
           }
           ''
             export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}

From 20268e0ada6d437056825f995b55e1300cd02af3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 13 Apr 2026 02:29:12 +0200
Subject: [PATCH 17/67] nixos/hedgedoc: remove minio from examples

---
 nixos/modules/services/web-apps/hedgedoc.nix | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index 61ad0a3a1a05..646eb1f79d09 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -229,20 +229,16 @@ in
         Nix store, by specifying placeholder variables as the option value in Nix and
         setting these variables accordingly in the environment file.
 
+
+        Snippet of HedgeDoc config containing a secret:
         ```
-          # snippet of HedgeDoc-related config
-          services.hedgedoc.settings.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
-          services.hedgedoc.settings.minio.secretKey = "$MINIO_SECRET_KEY";
+        services.hedgedoc.settings.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
         ```
 
-        ```
-          # content of the environment file
+        and the content of this environment file:
+        ````
           DB_PASSWORD=verysecretdbpassword
-          MINIO_SECRET_KEY=verysecretminiokey
         ```
-
-        Note that this file needs to be available on the host on which
-        `HedgeDoc` is running.
       '';
     };
   };

From 149201a7e37c197bc090723af5c016f4f596c735 Mon Sep 17 00:00:00 2001
From: Michael Schneider <michael@m1-s.com>
Date: Wed, 18 Feb 2026 13:35:44 +0200
Subject: [PATCH 18/67] nixos/test-driver: use log levels

---
 .../test-driver/src/test_driver/__init__.py   | 13 ++++++
 .../lib/test-driver/src/test_driver/logger.py | 45 ++++++++++++++++---
 nixos/lib/testing/driver.nix                  | 12 +++++
 3 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
index 0f42f2842c77..da527f46b824 100644
--- a/nixos/lib/test-driver/src/test_driver/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/__init__.py
@@ -12,6 +12,7 @@ from test_driver.driver import Driver
 from test_driver.logger import (
     CompositeLogger,
     JunitXMLLogger,
+    LogLevel,
     TerminalLogger,
     XMLLogger,
 )
@@ -151,6 +152,15 @@ def main() -> None:
         help="indicates that the interactive SSH backdoor is active and dumps information about it on start",
         type=int,
     )
+    log_level_map = {level.name.lower(): level for level in LogLevel}
+    arg_parser.add_argument(
+        "--log-level",
+        metavar="LOG_LEVEL",
+        action=EnvDefault,
+        envvar="logLevel",
+        choices=log_level_map,
+        help="Set the log level",
+    )
 
     args = arg_parser.parse_args()
 
@@ -169,6 +179,9 @@ def main() -> None:
     if args.junit_xml:
         logger.add_logger(JunitXMLLogger(output_directory / args.junit_xml))
 
+    if args.log_level:
+        logger.set_log_level(log_level_map[args.log_level])
+
     if not args.keep_machine_state:
         logger.info(
             "Machine state will be reset. To keep it, pass --keep-machine-state"
diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py
index a218d234fe3f..3c2cb41d33b1 100644
--- a/nixos/lib/test-driver/src/test_driver/logger.py
+++ b/nixos/lib/test-driver/src/test_driver/logger.py
@@ -7,6 +7,7 @@ import unicodedata
 from abc import ABC, abstractmethod
 from collections.abc import Iterator
 from contextlib import ExitStack, contextmanager
+from enum import IntEnum
 from pathlib import Path
 from queue import Empty, Queue
 from typing import Any
@@ -17,6 +18,12 @@ from colorama import Fore, Style
 from junit_xml import TestCase, TestSuite
 
 
+class LogLevel(IntEnum):
+    INFO = 1
+    WARNING = 2
+    ERROR = 3
+
+
 class AbstractLogger(ABC):
     @abstractmethod
     def log(self, message: str, attributes: dict[str, str] = {}) -> None:
@@ -56,6 +63,10 @@ class AbstractLogger(ABC):
     def print_serial_logs(self, enable: bool) -> None:
         pass
 
+    @abstractmethod
+    def set_log_level(self, level: LogLevel) -> None:
+        pass
+
 
 class JunitXMLLogger(AbstractLogger):
     class TestCaseState:
@@ -71,6 +82,7 @@ class JunitXMLLogger(AbstractLogger):
         self.currentSubtest = "main"
         self.outfile: Path = outfile
         self._print_serial_logs = True
+        self._log_level = LogLevel.INFO
         atexit.register(self.close)
 
     def log(self, message: str, attributes: dict[str, str] = {}) -> None:
@@ -92,10 +104,12 @@ class JunitXMLLogger(AbstractLogger):
         yield
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+        if self._log_level <= LogLevel.INFO:
+            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+        if self._log_level <= LogLevel.WARNING:
+            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.tests[self.currentSubtest].stderr += args[0] + os.linesep
@@ -113,6 +127,9 @@ class JunitXMLLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
+    def set_log_level(self, level: LogLevel) -> None:
+        self._log_level = level
+
     def close(self) -> None:
         with open(self.outfile, "w") as f:
             test_cases = []
@@ -180,10 +197,15 @@ class CompositeLogger(AbstractLogger):
         for logger in self.logger_list:
             logger.log_serial(message, machine)
 
+    def set_log_level(self, level: LogLevel) -> None:
+        for logger in self.logger_list:
+            logger.set_log_level(level)
+
 
 class TerminalLogger(AbstractLogger):
     def __init__(self) -> None:
         self._print_serial_logs = True
+        self._log_level = LogLevel.INFO
 
     def maybe_prefix(self, message: str, attributes: dict[str, str]) -> str:
         if "machine" in attributes:
@@ -216,10 +238,12 @@ class TerminalLogger(AbstractLogger):
         self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)", attributes)
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        self.log(*args, **kwargs)
+        if self._log_level <= LogLevel.INFO:
+            self.log(*args, **kwargs)
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        self.log(*args, **kwargs)
+        if self._log_level <= LogLevel.WARNING:
+            self.log(*args, **kwargs)
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.log(*args, **kwargs)
@@ -227,6 +251,9 @@ class TerminalLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
+    def set_log_level(self, level: LogLevel) -> None:
+        self._log_level = level
+
     def log_serial(self, message: str, machine: str) -> None:
         if not self._print_serial_logs:
             return
@@ -246,6 +273,7 @@ class XMLLogger(AbstractLogger):
         self.queue: Queue[dict[str, str]] = Queue()
 
         self._print_serial_logs = True
+        self._log_level = LogLevel.INFO
 
         self.xml.startDocument()
         self.xml.startElement("logfile", attrs=AttributesImpl({}))
@@ -269,10 +297,12 @@ class XMLLogger(AbstractLogger):
         self.xml.endElement("line")
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        self.log(*args, **kwargs)
+        if self._log_level <= LogLevel.INFO:
+            self.log(*args, **kwargs)
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        self.log(*args, **kwargs)
+        if self._log_level <= LogLevel.WARNING:
+            self.log(*args, **kwargs)
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.log(*args, **kwargs)
@@ -287,6 +317,9 @@ class XMLLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
+    def set_log_level(self, level: LogLevel) -> None:
+        self._log_level = level
+
     def log_serial(self, message: str, machine: str) -> None:
         if not self._print_serial_logs:
             return
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index 5cd7c2ebb806..d5638718dda7 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -119,6 +119,7 @@ let
           --set testScript "$out/test-script" \
           --set globalTimeout "${toString config.globalTimeout}" \
           --set vlans '${toString vlans}' \
+          --set logLevel "${config.logLevel}" \
           ${lib.escapeShellArgs (
             lib.concatMap (arg: [
               "--add-flags"
@@ -219,6 +220,17 @@ in
         This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript).
       '';
     };
+
+    logLevel = mkOption {
+      description = "Log level for the test driver.";
+      type = types.enum [
+        "info"
+        "warning"
+        "error"
+      ];
+      default = "info";
+      example = "warning";
+    };
   };
 
   config = {

From 7272b6ad4d631566ae1cfba328e881e6e092441e Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 21 Mar 2026 12:00:00 +0000
Subject: [PATCH 19/67] canokey-qemu: 0-unstable-2023-06-06 ->
 0-unstable-2026-03-24

---
 doc/release-notes/rl-2605.section.md          |  2 +
 nixos/tests/systemd-initrd-luks-fido2.nix     | 13 +++--
 .../ca/canokey-qemu/canokey-qemu-memcpy.patch | 41 --------------
 pkgs/by-name/ca/canokey-qemu/package.nix      | 53 +++++++++++++------
 4 files changed, 46 insertions(+), 63 deletions(-)
 delete mode 100644 pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 9d3bb68f5c06..c59d72f7da45 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -337,6 +337,8 @@ gnuradioMinimal.override {
 
 - The `neovim` package and module now disable by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`).
 
+- `canokey-qemu` support for `qemu` was restored (although disabled by default), after being marked as broken since nixpkgs 25.11. Please note that the format of canokey files has changed, and that some data created with older canokey-qemu release cannot be read by the current version. See the [documentation](https://github.com/canokeys/canokey-qemu/tree/v1?tab=readme-ov-file#compatibility-warning) for details.
+
 ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}
 
 - `mpv-unwrapped.scripts` and `mpv-unwrapped.wrapper` have been removed. Please use `mpvScripts` and `mpv.override` accordingly.
diff --git a/nixos/tests/systemd-initrd-luks-fido2.nix b/nixos/tests/systemd-initrd-luks-fido2.nix
index 002281585064..a38c97e8b0dd 100644
--- a/nixos/tests/systemd-initrd-luks-fido2.nix
+++ b/nixos/tests/systemd-initrd-luks-fido2.nix
@@ -1,11 +1,13 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  hostPkgs,
+  ...
+}:
 {
   name = "systemd-initrd-luks-fido2";
 
-  meta = {
-    # `canokey-qemu` is marked broken.
-    broken = true;
-  };
+  qemu.package = hostPkgs.qemu_test.override { canokeySupport = true; };
 
   nodes.machine =
     { pkgs, config, ... }:
@@ -22,6 +24,7 @@
           "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file"
         ];
       };
+
       boot.loader.systemd-boot.enable = true;
 
       boot.initrd.systemd.enable = true;
diff --git a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch b/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch
deleted file mode 100644
index 578c687f54cf..000000000000
--- a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 9e59480d941c40b868ebafa5138bbc71ca87f08e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sat, 18 May 2024 09:55:17 +0200
-Subject: [PATCH] Fix build where memcpy is a macro
-
-I got the following compiler error with Clang 16 building for
-x86_64-apple-darwin:
-
-	/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:50: error: too many arguments provided to function-like macro invocation
-	  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-	                                                 ^
-	/nix/store/vw8y07yai2pjv02s1piw3r5cyhmjbddf-Libsystem-1238.60.2/include/secure/_string.h:64:9: note: macro 'memcpy' defined here
-	#define memcpy(dest, src, len)                                  \
-	        ^
-	/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:3: note: parentheses are required around macro argument containing braced initializer list
-	  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-	  ^
-	                (                                                                            )
-	1 error generated.
-
-Link: https://github.com/canokeys/canokey-core/pull/85
----
- canokey-core/applets/oath/oath.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/canokey-core/applets/oath/oath.c b/canokey-core/applets/oath/oath.c
-index bd8361a..2d2c0ef 100644
---- a/canokey-core/applets/oath/oath.c
-+++ b/canokey-core/applets/oath/oath.c
-@@ -41,7 +41,7 @@ int oath_install(uint8_t reset) {
- static int oath_select(const CAPDU *capdu, RAPDU *rapdu) {
-   if (P2 != 0x00) EXCEPT(SW_WRONG_P1P2);
- 
--  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-+  memcpy(RDATA, ((uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}), 7);
-   if (read_attr(OATH_FILE, ATTR_HANDLE, RDATA + 7, HANDLE_LEN) < 0) return -1;
-   LL = 7 + HANDLE_LEN;
- 
--- 
-2.44.0
-
diff --git a/pkgs/by-name/ca/canokey-qemu/package.nix b/pkgs/by-name/ca/canokey-qemu/package.nix
index be8235b8dda4..78030234fc0c 100644
--- a/pkgs/by-name/ca/canokey-qemu/package.nix
+++ b/pkgs/by-name/ca/canokey-qemu/package.nix
@@ -3,29 +3,30 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  python3Packages,
   unstableGitUpdater,
 }:
 stdenv.mkDerivation rec {
   pname = "canokey-qemu";
-  version = "0-unstable-2023-06-06";
-  rev = "151568c34f5e92b086b7a3a62a11c43dd39f628b";
+  version = "0-unstable-2026-03-24";
+  rev = "41044ec17ddb835b3e5acb385a2e429aa74af627";
 
   src = fetchFromGitHub {
     owner = "canokeys";
     repo = "canokey-qemu";
     inherit rev;
     fetchSubmodules = true;
-    hash = "sha256-4V/2UOgGWgL+tFJO/k90bCDjWSVyIpxw3nYi9NU/OxA=";
+    hash = "sha256-eunhMRp3HJ80kCCZbiMGNjA9b0uUMzOsSeNh61d1iJU=";
   };
 
-  patches = [
-    ./canokey-qemu-memcpy.patch
-  ];
-
   postPatch = ''
     substituteInPlace canokey-core/CMakeLists.txt \
-      --replace "COMMAND git describe --always --tags --long --abbrev=8 --dirty >>" "COMMAND echo '$rev' >>"
-  '';
+      --replace-fail "git describe --always --tags --long --abbrev=8 --dirty >>" "echo '$rev' >>"
+  ''
+  + (lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "add_library(canokey-qemu SHARED" "add_library(canokey-qemu STATIC"
+  '');
 
   preConfigure = ''
     cmakeFlagsArray+=(
@@ -38,6 +39,24 @@ stdenv.mkDerivation rec {
           ++ lib.optionals stdenv.cc.isClang [
             "-Wno-error=documentation"
           ]
+          ++ lib.optionals stdenv.cc.isGNU [
+            # canokey-qemu contains a vendored copy of mbedtls, and
+            # mbedtls widely uses a pattern of starting unions with an
+            # unsigned int dummy member, and then initializing those unions to
+            # { 0 }.  The problem with this is that it only initializes that
+            # first union member, so in the common case where the non-dummy
+            # members are larger than the dummy member, they will only be
+            # partially initialized since GCC 15[1].  Upstream has added
+            # ad-hoc memset calls to mitigate this issue, but initializers are
+            # also still widely used.  To avoid the risk of using
+            # uninitialized memory, force the compiler to zero all bits of
+            # unions, not just the first element, until upstream has a
+            # systemic fix in place[2].
+            #
+            # [1]: https://gcc.gnu.org/gcc-15/changes.html
+            # [2]: https://github.com/Mbed-TLS/mbedtls/issues/9885
+            "-fzero-init-padding-bits=unions"
+          ]
         )
       }
     )
@@ -48,19 +67,19 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    python3Packages.jsonschema
+    python3Packages.jinja2
+  ];
 
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {
     homepage = "https://github.com/canokeys/canokey-qemu";
-    description = "CanoKey QEMU Virt Card";
+    description = "CanoKey QEMU Virtual Card";
+    longDescription = "A virtual OPENPGP and FIDO2 card. Only for testing purpose. There is no warranty on security.";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ oxalica ];
-    # Uses a four‐year‐old patched vendored version of Mbed TLS for
-    # cryptography that doesn’t build with CMake 4. Doesn’t build with
-    # gurrent versions of `canokey-core`, either. No upstream
-    # development since 2023.
-    broken = true;
+    maintainers = with lib.maintainers; [ symphorien ];
   };
 }

From 0f21f18c78527405aa8db83457a634b18ea600c4 Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Mon, 13 Apr 2026 05:53:32 +0200
Subject: [PATCH 20/67] parted: 3.6 -> 3.7

Changelog: https://savannah.gnu.org/news/?id=10879
Diff: https://cgit.git.savannah.gnu.org/cgit/parted.git/diff/?id=v3.7&id2=v3.6
---
 pkgs/by-name/pa/parted/package.nix | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/pa/parted/package.nix b/pkgs/by-name/pa/parted/package.nix
index 60584013714f..6b8ecf1280fc 100644
--- a/pkgs/by-name/pa/parted/package.nix
+++ b/pkgs/by-name/pa/parted/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
+  pkg-config,
   lvm2,
   libuuid,
   gettext,
@@ -18,22 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parted";
-  version = "3.6";
+  version = "3.7";
 
   src = fetchurl {
     url = "mirror://gnu/parted/parted-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-O0Pb4zzKD5oYYB66tWt4UrEo7Bo986mzDM3l5zNZ5hI=";
+    sha256 = "sha256-AI3ldWGk88JaBkjmbtEeezC+STiJtkM0ptcPLBlR73s=";
   };
 
-  patches = [
-    # Fix the build against C23 compilers (like gcc-15):
-    (fetchpatch {
-      name = "c23.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=parted.git;a=patch;h=16343bda6ce0d41edf43f8dac368db3bbb63d271";
-      hash = "sha256-8FgnwMrzMHPZNU+b/mRHCSu8sn6H7GhVLIhMUel40Hk=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -52,6 +43,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (gettext != null) gettext
   ++ lib.optional (lvm2 != null) lvm2;
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
   configureFlags =
     (if (readline != null) then [ "--with-readline" ] else [ "--without-readline" ])
     ++ lib.optional (lvm2 == null) "--disable-device-mapper"

From d0625f347ee07eb178332e7526cd9d0b2da0a70c Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Mon, 13 Apr 2026 06:01:54 +0200
Subject: [PATCH 21/67] parted: add kybe236 as maintainer

---
 pkgs/by-name/pa/parted/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/parted/package.nix b/pkgs/by-name/pa/parted/package.nix
index 6b8ecf1280fc..97c63b66c930 100644
--- a/pkgs/by-name/pa/parted/package.nix
+++ b/pkgs/by-name/pa/parted/package.nix
@@ -81,8 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.gnu.org/software/parted/";
     license = lib.licenses.gpl3Plus;
 
-    maintainers = [
-      # Add your name here!
+    maintainers = with lib.maintainers; [
+      kybe236
     ];
 
     # GNU Parted requires libuuid, which is part of util-linux-ng.

From 33dc39b949b8642d1542f6aa28c83b123208869d Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Sun, 12 Apr 2026 15:54:25 -0700
Subject: [PATCH 22/67] duckdb: fix build on darwin

---
 pkgs/by-name/du/duckdb/package.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 905eab0038ee..401df7d6762b 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -123,8 +123,11 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/aggregate/aggregates/histogram_table_function.test"
         ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          # SIGTRAP during iejoin tests on aarch64-darwin (with and without sandbox)
-          # iejoin implementation rewritten in 1.5.x with new parallel task scheduling
+          # UB in PhysicalRangeJoin (shared by IEJoin and PiecewiseMergeJoin) causes
+          # Apple Clang at -O3 to emit brk trap instructions on aarch64-darwin.
+          # Affects any test routing through PhysicalIEJoin (2+ inequality conditions,
+          # cardinality >= merge_join_threshold) or forcing IEJoin via debug_asof_iejoin.
+          "test/sql/join/iejoin/iejoin_issue_6314.test_slow"
           "test/sql/join/iejoin/iejoin_issue_6861.test"
           "test/sql/join/iejoin/iejoin_issue_7278.test"
           "test/sql/join/iejoin/iejoin_projection_maps.test"
@@ -138,7 +141,13 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/join/iejoin/test_iejoin_null_keys.test"
           "test/sql/join/iejoin/test_iejoin_overlaps.test"
           "test/sql/join/iejoin/test_iejoin_predicate.test"
+          "test/sql/join/iejoin/test_iejoin_sort_tasks.test_slow"
           "test/sql/join/iejoin/test_iesemijoin.test"
+          # asof tests that loop debug_asof_iejoin=True, forcing the IEJoin path
+          "test/sql/join/asof/test_asof_join_inequalities.test"
+          "test/sql/join/asof/test_asof_join_missing.test_slow"
+          # 10240-row inequality join routing to IEJoin via plan_comparison_join.cpp
+          "test/sql/join/test_complex_range_join.test"
         ]
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";

From ef9d5133540f95b1146a895546eb87a80d5ea6ce Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 22:22:23 +0200
Subject: [PATCH 23/67] python3Packages.dnsight: init at 1.0.1

SDK and CLI tool for DNS, email and web security hygiene

https://github.com/dnsight/dnsight
---
 pkgs/by-name/dn/dnsight/package.nix           |  5 +
 .../python-modules/dnsight/default.nix        | 93 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 3 files changed, 100 insertions(+)
 create mode 100644 pkgs/by-name/dn/dnsight/package.nix
 create mode 100644 pkgs/development/python-modules/dnsight/default.nix

diff --git a/pkgs/by-name/dn/dnsight/package.nix b/pkgs/by-name/dn/dnsight/package.nix
new file mode 100644
index 000000000000..73f35e491ff1
--- /dev/null
+++ b/pkgs/by-name/dn/dnsight/package.nix
@@ -0,0 +1,5 @@
+{ python3Packages }:
+
+(python3Packages.toPythonApplication python3Packages.dnsight).overrideAttrs {
+  __structuredAttrs = true;
+}
diff --git a/pkgs/development/python-modules/dnsight/default.nix b/pkgs/development/python-modules/dnsight/default.nix
new file mode 100644
index 000000000000..b62625bad763
--- /dev/null
+++ b/pkgs/development/python-modules/dnsight/default.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cryptography,
+  dnspython,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  httpx,
+  hypothesis,
+  iana-etc,
+  libredirect,
+  pydantic,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pyyaml,
+  rich,
+  typer,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dnsight";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dnsight";
+    repo = "dnsight";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WoYLAqNTbMVe+kd/cG1MPRSlYMMYPWP8wm96qr3IdY8=";
+  };
+
+  pythonRelaxDeps = [ "typer" ];
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    cryptography
+    dnspython
+    httpx
+    pydantic
+    pyyaml
+    rich
+    typer
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "dnsight" ];
+
+  preCheck = lib.optionalString stdenv.hostPlatform.isLinux ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
+    export LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
+
+  postCheck = ''
+    unset NIX_REDIRECTS LD_PRELOAD
+  '';
+
+  disabledTests = [
+    # AssertionError
+    "test_audit_explicit_domains_honour_global_config_path"
+    "test_audit_manifest_runs_only_configured_checks"
+    # AssertionError: assert (None is not None)
+    "test_check_dmarc_async_config_slice_overrides_config"
+    "test_check_dmarc_sync_config_slice_overrides_config"
+    "test_check_spf_sync_with_mgr"
+    "test_run_check_for_target_matches_run_zone"
+    "test_run_check_sync_dmarc"
+    "test_run_check_sync_programmatic_config_no_file"
+    "test_run_check_sync_yaml_plus_overlay_merge"
+  ];
+
+  meta = {
+    description = "SDK and CLI tool for DNS, email and web security hygiene";
+    homepage = "https://github.com/dnsight/dnsight";
+    changelog = "https://github.com/dnsight/dnsight/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "dnsight";
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a9dd0eda53f7..a94d80432684 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4535,6 +4535,8 @@ self: super: with self; {
 
   dns-lexicon = callPackage ../development/python-modules/dns-lexicon { };
 
+  dnsight = callPackage ../development/python-modules/dnsight { };
+
   dnslib = callPackage ../development/python-modules/dnslib { };
 
   dnspython = callPackage ../development/python-modules/dnspython { };

From facac4e9dc6cb4f32d50717288d7ccaa319cae7c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 22:31:52 +0200
Subject: [PATCH 24/67] checkov: 3.2.513 -> 3.2.521

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/3.2.521
---
 pkgs/by-name/ch/checkov/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index d38e7c7c9d9c..b1e76369c259 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.2.513";
+  version = "3.2.521";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-diPsVe8fhWKHMn02qKK91MwPqXNVFpmE8n5e9JJsDCM=";
+    hash = "sha256-xRVA5VPDevdq4LIcJRl/fbCn9iZA+pnw2hvDfHi0MIo=";
   };
 
   pythonRelaxDeps = [
@@ -106,6 +106,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     networkx
     openai
     packaging
+    platformdirs
     policyuniverse
     prettytable
     pycep-parser
@@ -158,6 +159,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "test_sast_js_filtered_files_by_ts"
     # Timing sensitive
     "test_non_multiline_pair_time_limit_creating_report"
+    # Tests want to run bash script
+    "test_entrypoint"
   ];
 
   disabledTestPaths = [

From e26cc1370e3bafdf6ad05a79abc54c317f74fe8c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 22:45:24 +0200
Subject: [PATCH 25/67] python3Packages.switchbot-api: 2.11.0 -> 2.11.1

Diff: https://github.com/SeraphicCorp/py-switchbot-api/compare/v2.11.0...v2.11.1

Changelog: https://github.com/SeraphicCorp/py-switchbot-api/releases/tag/v2.11.1
---
 pkgs/development/python-modules/switchbot-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/switchbot-api/default.nix b/pkgs/development/python-modules/switchbot-api/default.nix
index bf9a58c97ca9..9839f490ee1c 100644
--- a/pkgs/development/python-modules/switchbot-api/default.nix
+++ b/pkgs/development/python-modules/switchbot-api/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "switchbot-api";
-  version = "2.11.0";
+  version = "2.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SeraphicCorp";
     repo = "py-switchbot-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n2KAKILbywObqxG/lDNHkXWVCcrEJAaqv6xBDH8ed/Q=";
+    hash = "sha256-xgfFpylMS8Xs3erM7vuJKun6fYOtJ6kfXgBVSkejbJI=";
   };
 
   build-system = [ poetry-core ];

From d77dbd9311b548d1b0df6bcc6120d7c86548c28c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 22:27:52 +0000
Subject: [PATCH 26/67] firefox-beta-unwrapped: 150.0b5 -> 150.0b9

---
 .../networking/browsers/firefox/packages/firefox-beta.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 48920c478bff..6864ad465b89 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "150.0b5";
+  version = "150.0b9";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "6ae09ae8a73865a4d9cdfd389f0cfec667fc717e13127ae9927b6fc3bd5e7cf49a83dd5dbbed8bae9b72dddd24e6156bdc483fcb3ccb726b46070d25fd02f86f";
+    sha512 = "5afa7b27ee38e809717ca02fede9aa5ebe27f9aeb78d7953e7b0790e30edb663bf0053335e42e258b7bf01b8859e6b0a10c23851cf8b495217f954ac41a386d4";
   };
 
   meta = {

From e3a64b4adb71ee8dff930bc907e542f065c18ddc Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 01:29:36 +0200
Subject: [PATCH 27/67] python3Packages.pysigma: 1.2.0 -> 1.3.1

Diff: https://github.com/SigmaHQ/pySigma/compare/v1.2.0...v1.3.1

Changelog: https://github.com/SigmaHQ/pySigma/releases/tag/v1.3.1
---
 pkgs/development/python-modules/pysigma/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index f76528153620..d9f1ee33e782 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysigma";
-  version = "1.2.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "pySigma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QPGpmEWfgea420y8mmUF+CHV3xslr39TvxPxAjhI8d4=";
+    hash = "sha256-gMRcrP9ZVCi3QD0W5RlbCNIuZT/oTDpB0WqTKiwKcfU=";
   };
 
   pythonRelaxDeps = [

From cc2ece6aeea50b497d64718ce6c451f8fc1ebb04 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 23:31:25 +0000
Subject: [PATCH 28/67] python3Packages.netutils: 1.17.1 -> 1.17.2

---
 pkgs/development/python-modules/netutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index 55d002fe2012..6c2ecd7532fa 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "netutils";
-  version = "1.17.1";
+  version = "1.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
     tag = "v${version}";
-    hash = "sha256-LdLNDzO5ANpTqpcemgyNoZxm6LDYRonS5o8mMmdg4vM=";
+    hash = "sha256-DHftRRqbuUa74ATfh8MHxINwNkpz9lo/drwOmeo0itE=";
   };
 
   build-system = [ poetry-core ];

From 0f71379d10e01798537587021eb25fe8340fdd05 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 01:35:10 +0200
Subject: [PATCH 29/67] python3Packages.pysigma-backend-qradar: disable failing
 test

---
 .../python-modules/pysigma-backend-qradar/default.nix        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
index 558003b6192a..163f7d2eeda7 100644
--- a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "sigma.backends.qradar" ];
 
+  disabledTests = [
+    # Output format unknown
+    "test_qradar_extension_output"
+  ];
+
   meta = {
     description = "Library to support Qradar for pySigma";
     homepage = "https://github.com/nNipsx-Sec/pySigma-backend-qradar";

From 15fc03cdc4081499832e75e18b5fb1e9a4bbbb05 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 01:35:55 +0200
Subject: [PATCH 30/67] sigma-cli: 2.0.2 -> 3.0.0

Changelog: https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.0.0
---
 pkgs/by-name/si/sigma-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/sigma-cli/package.nix b/pkgs/by-name/si/sigma-cli/package.nix
index 4b197c6ff833..12dcdb26e283 100644
--- a/pkgs/by-name/si/sigma-cli/package.nix
+++ b/pkgs/by-name/si/sigma-cli/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "2.0.2";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "sigma-cli";
     tag = "v${version}";
-    hash = "sha256-Gd41uNARH9RbyRkTDiXmP9gWTMpS9zlkb4rPF3ikRc8=";
+    hash = "sha256-eRPOGI/mK1jFAs56MJ+VSuce95gMKEffba3cR9Sl8k0=";
   };
 
   pythonRelaxDeps = [ "click" ];

From e19ff720495a9484b11b2438f1f0c19c42ab6d47 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 01:37:12 +0200
Subject: [PATCH 31/67] python3Packages.pysigma-backend-qradar: migrate to
 finalAttrs

---
 .../python-modules/pysigma-backend-qradar/default.nix     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
index 163f7d2eeda7..11c598ef6ab8 100644
--- a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
@@ -8,7 +8,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pysigma-backend-qradar";
   version = "0.3.3";
   pyproject = true;
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "nNipsx-Sec";
     repo = "pySigma-backend-qradar";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-VymaxX+iqrRlf+WEt4xqEvNt5kg8xI5O/MoYahayu0o=";
   };
 
@@ -41,8 +41,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to support Qradar for pySigma";
     homepage = "https://github.com/nNipsx-Sec/pySigma-backend-qradar";
-    changelog = "https://github.com/nNipsx-Sec/pySigma-backend-qradar/releases/tag/${src.tag}";
+    changelog = "https://github.com/nNipsx-Sec/pySigma-backend-qradar/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl21Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From eb99ea10a99d567233342b50b4fe71b7e5d065f3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 02:02:01 +0200
Subject: [PATCH 32/67] python3Packages.netutils: migrate to finalAttrs

---
 pkgs/development/python-modules/netutils/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index 6c2ecd7532fa..3edba52dd173 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -11,7 +11,7 @@
   toml,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "netutils";
   version = "1.17.2";
   pyproject = true;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DHftRRqbuUa74ATfh8MHxINwNkpz9lo/drwOmeo0itE=";
   };
 
@@ -59,8 +59,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library that is a collection of objects for common network automation tasks";
     homepage = "https://github.com/networktocode/netutils";
-    changelog = "https://github.com/networktocode/netutils/releases/tag/${src.tag}";
+    changelog = "https://github.com/networktocode/netutils/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From ea2ae503d62e9876e9e60be44c69ca4d9714899c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 00:07:05 +0000
Subject: [PATCH 33/67] remnote: 1.25.0 -> 1.25.7

---
 pkgs/by-name/re/remnote/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index cb437e5ef216..3a6c7ebe1ef0 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.25.0";
+  version = "1.25.7";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-epaGP+rTg2as121mmx2KjmivAqDSzDh3eqnTGYmB++w=";
+    hash = "sha256-ckigM+kXV8W5iI42SGSyFd1//e5ghqiV/b6Ja5at7Do=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in

From 654e8e0099f94884efd3c6e0db051a2d1350aa3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 00:38:42 +0000
Subject: [PATCH 34/67] lycheeslicer: 7.6.3 -> 7.6.4

---
 pkgs/by-name/ly/lycheeslicer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ly/lycheeslicer/package.nix b/pkgs/by-name/ly/lycheeslicer/package.nix
index 6eadd39f0e07..884e988fd4d6 100644
--- a/pkgs/by-name/ly/lycheeslicer/package.nix
+++ b/pkgs/by-name/ly/lycheeslicer/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "lycheeslicer";
-  version = "7.6.3";
+  version = "7.6.4";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-lRG7uTMhKS5zIAI2WRan5ZxbVLIw1l2F3/aD/gee9OA=";
+    hash = "sha256-lLE40ByNdfK7GkLjfbEEX0nmhL0+E51qPDe+whIJqEM=";
   };
 
   desktopItem = makeDesktopItem {

From aac0cb2ead1f40b5bc29c351b66c8d323c6613a7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 01:39:04 +0000
Subject: [PATCH 35/67] libretro.snes9x2010: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-09

---
 pkgs/applications/emulators/libretro/cores/snes9x2010.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
index 64d38695d142..70391d943e7a 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "693c0dd2a3004a6332a076a08d14c78086f26bc1";
-    hash = "sha256-/+VdaLY6JycN2o1/LOPFIOmcp6ZVAqpX1MVuHN3B/Nc=";
+    rev = "a7a4bfaed4c6408908c76af20ad625e1645c3d11";
+    hash = "sha256-mtTgh/koM7jS7/cH7qRgTa+xJXBBJSdxHHbhOd/q4i4=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];

From 8b95275958abd62abce43ea225e31dc6509e7f53 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 01:45:33 +0000
Subject: [PATCH 36/67] lua-language-server: 3.18.0 -> 3.18.1

---
 pkgs/by-name/lu/lua-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/lua-language-server/package.nix b/pkgs/by-name/lu/lua-language-server/package.nix
index 0ab2225a577e..b964eaa18cff 100644
--- a/pkgs/by-name/lu/lua-language-server/package.nix
+++ b/pkgs/by-name/lu/lua-language-server/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.18.0";
+  version = "3.18.1";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-5N27/bGMEQDXUD9amXgGVO8dtiV/7c/8sfSPEhit8gc=";
+    hash = "sha256-fD7qFY2xL86x/Ac03HkusvNh9Tn4LiqkJGGXNO0bPO8=";
     fetchSubmodules = true;
   };
 

From 0ac5766bf8252b828d66ab621205a067abed6b8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sadjow=20Le=C3=A3o?= <sadjow@gmail.com>
Date: Mon, 13 Apr 2026 22:52:27 -0300
Subject: [PATCH 37/67] prek: 0.3.8 -> 0.3.9

---
 pkgs/by-name/pr/prek/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index a469f12b7f8e..40e728c575dc 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.8";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0mddrCEGQHFm4zW5nQ7HHFK826XcYSymr9AfVd5P+eg=";
+    hash = "sha256-gfWaJxcT44+yEkZtDSQwKP1oILMUsF4apYeety+XESM=";
   };
 
-  cargoHash = "sha256-YZqIx6P2nkaKaJUW6IPboiHVDlaDvPCpLMlX0swJYyU=";
+  cargoHash = "sha256-dKSsH4IUWLdlthvAmS+MmuAVicCCKefy1D4YleRO0fI=";
 
   nativeBuildInputs = [
     installShellFiles

From 8b985df14c7487be81796758c733ae350ffb3fa5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 01:54:20 +0000
Subject: [PATCH 38/67] python3Packages.dtfabric: 20251118 -> 20260411

---
 pkgs/development/python-modules/dtfabric/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dtfabric/default.nix b/pkgs/development/python-modules/dtfabric/default.nix
index 4f15cd1db584..f853f3c637b8 100644
--- a/pkgs/development/python-modules/dtfabric/default.nix
+++ b/pkgs/development/python-modules/dtfabric/default.nix
@@ -8,12 +8,12 @@
 }:
 buildPythonPackage rec {
   pname = "dtfabric";
-  version = "20251118";
+  version = "20260411";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v2qsZtqGb40p5/Q1IGhI+prMCkuruxFB0BTMORKzmX4=";
+    hash = "sha256-0hnJJ76wpINsNXecrGCQILqixo4xUhH8dW6djq9/vH4=";
   };
 
   build-system = [ setuptools ];

From 20dab2803951359ff2fc5164cd3a1c7a92eca2ba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 02:14:35 +0000
Subject: [PATCH 39/67] fluent-reader: 1.2.0 -> 1.2.1

---
 pkgs/by-name/fl/fluent-reader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluent-reader/package.nix b/pkgs/by-name/fl/fluent-reader/package.nix
index b2a3e3e9cdec..282835570157 100644
--- a/pkgs/by-name/fl/fluent-reader/package.nix
+++ b/pkgs/by-name/fl/fluent-reader/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "fluent-reader";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://github.com/yang991178/fluent-reader/releases/download/v${version}/Fluent.Reader.${version}.AppImage";
-    hash = "sha256-v9sj0xy6YalPZ49z8E6bczgzu9XmBuA1JK7/leKnvV4=";
+    hash = "sha256-83bqDyiPcAKIEejIPLSVLb8hxAtNogF98nYbOCjZtsg=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

From dcca91f8d4805fb29d1871651f302857b3cbb3b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 02:18:35 +0000
Subject: [PATCH 40/67] python3Packages.smbus2: 0.6.0 -> 0.6.1

---
 pkgs/development/python-modules/smbus2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/smbus2/default.nix b/pkgs/development/python-modules/smbus2/default.nix
index 71e1dcadf18a..b8b5984ed8d0 100644
--- a/pkgs/development/python-modules/smbus2/default.nix
+++ b/pkgs/development/python-modules/smbus2/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "smbus2";
-  version = "0.6.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kplindegaard";
     repo = "smbus2";
     tag = version;
-    hash = "sha256-GoXSDUmMnrJAfQ8EfCP5bdkq5g0nKLRHcvou5c6vZGU=";
+    hash = "sha256-CWcRlbZTLiB45DaV6rbhvlk8cTaEJgPAq/JDmbxD7H4=";
   };
 
   build-system = [ setuptools ];

From cbb4e7652ca49ce3aa5ff83f18939bbe63b3710c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 02:26:35 +0000
Subject: [PATCH 41/67] python3Packages.python-discovery: 1.2.1 -> 1.2.2

---
 pkgs/development/python-modules/python-discovery/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-discovery/default.nix b/pkgs/development/python-modules/python-discovery/default.nix
index eeda7554f9ad..52f1d8119f4e 100644
--- a/pkgs/development/python-modules/python-discovery/default.nix
+++ b/pkgs/development/python-modules/python-discovery/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-discovery";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "python-discovery";
     tag = finalAttrs.version;
-    hash = "sha256-96o8qGe38fifkA5zaBJ7jXgkJzm/gP3W/wUClFVUUH8=";
+    hash = "sha256-udyPGZ3vz+1nld2m3igLNZ+i1pnutkLeXFpHn738KRQ=";
   };
 
   build-system = [

From 975ba901b0661f41a4f08f298540f2229c132f35 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 02:30:27 +0000
Subject: [PATCH 42/67] python3Packages.django-dbbackup: 5.2.0 -> 5.3.0

---
 pkgs/development/python-modules/django-dbbackup/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-dbbackup/default.nix b/pkgs/development/python-modules/django-dbbackup/default.nix
index 323bd5b93f02..710fd7befcdb 100644
--- a/pkgs/development/python-modules/django-dbbackup/default.nix
+++ b/pkgs/development/python-modules/django-dbbackup/default.nix
@@ -14,14 +14,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "django-dbbackup";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Archmonger";
     repo = "django-dbbackup";
     tag = finalAttrs.version;
-    hash = "sha256-fl4ezDLHO6KwLfX5KMK9uMonONJCCDLyZUj9KMRZsGc=";
+    hash = "sha256-vSBZmYMcrpJQEhVVqKgn35vaI5TvMBbdwGXZOFjXQbw=";
   };
 
   build-system = [ hatchling ];

From 73aca4219492e1747da236e1c0f30d15aa875a9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 03:45:10 +0000
Subject: [PATCH 43/67] vivaldi: 7.9.3970.47 -> 7.9.3970.50

---
 pkgs/by-name/vi/vivaldi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 60055705301e..8c62a87cce77 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -66,7 +66,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.9.3970.47";
+  version = "7.9.3970.50";
 
   suffix =
     {
@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-08KlF8JJlZqAZeSFAqaNzMPfHp95GddRScnLnkQ2PF8=";
-        x86_64-linux = "sha256-Dc1VyxB60WsrynOT5r85+Xljx8mU7IKodnIIeGZ/u+M=";
+        aarch64-linux = "sha256-DIaBjUPs9bgpzwxT20cwdOJzo8kCO1chmudo4wqWSeU=";
+        x86_64-linux = "sha256-9fX0xnIZeu7hTYyKvSQrJj3mQkTPGg8S3IjEjh/84g0=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

From b058fbd658fb6506327a031614dc8f30d5e46e9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 03:48:01 +0000
Subject: [PATCH 44/67] fence: 0.1.42 -> 0.1.46

---
 pkgs/by-name/fe/fence/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fe/fence/package.nix b/pkgs/by-name/fe/fence/package.nix
index a5be31cc803f..3ce2c5b7cbd7 100644
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.42";
+  version = "0.1.46";
 
   src = fetchFromGitHub {
     owner = "Use-Tusk";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TxSUgU32Y+IScFtAgWnB32OgyLaC7kWRVmYiM986nVo=";
+    hash = "sha256-IoWnA7gUfp6wyVBkqtH0How6DqHnaO78GlxknA5Y8+w=";
   };
 
   vendorHash = "sha256-P30NCXYX27R7F/dNhWSwiLg8T2f6J0/hlu6G3wlENFI=";

From 40edea6c125318a24bea9ef16076a2f0382c1133 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 04:03:14 +0000
Subject: [PATCH 45/67] terraform-providers.opentelekomcloud_opentelekomcloud:
 1.36.62 -> 1.36.63

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f475c9783948..7a78a76326e1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1031,13 +1031,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-JSVznbwVTc9/c1q16hv76qJuOI8eRPzsEo0ozRR6oxw=",
+    "hash": "sha256-F8V/eLkKJCC5zPfNh0NC6Z6c3aZjnEoXXa+po3I1NDw=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.62",
+    "rev": "v1.36.63",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QFC9oFQ6NiQZiJCltMrwX8p9shm6vEfVnRpJBAtnPW4="
+    "vendorHash": "sha256-qtH6jjhzGRGaHYKjpJLPWjwRL5PQIyOPvI33BVf4cO4="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",

From 93a50ca37a0550daddea5bf578cd549cec9d8bc6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 04:53:37 +0000
Subject: [PATCH 46/67] walker: 2.15.2 -> 2.16.0

---
 pkgs/by-name/wa/walker/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wa/walker/package.nix b/pkgs/by-name/wa/walker/package.nix
index a34d6019e43b..17409408b212 100644
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "walker";
-  version = "2.15.2";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jYvDe44MLx444BfiO1EtCKgHoKfXeIG1DvAw7P2qCrY=";
+    hash = "sha256-ugacgbPxYM68pAcQRceuSlCWtUEuddltMUzAWrnWlHA=";
   };
 
   cargoHash = "sha256-MPjMB5TsrJd28QuEoIDRJjM+SE0cTNCO5PRW+I+/CHE=";

From a60e18a6cd653c59e331cdf6853d175b2b39591a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 04:56:37 +0000
Subject: [PATCH 47/67] dprint-plugins.dprint-plugin-biome: 0.12.6 -> 0.12.7

---
 pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index dc75ae854562..1eb892d89f2f 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-KwmgD5VzU9m7jELeFAkSjS53B0fGVxZp8YvOG1nc8gM=";
+  hash = "sha256-OCnhTv0UfRX4ntmkhNlswfhHbxVFiGu8ovYagEITlI8=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.6.wasm";
-  version = "0.12.6";
+  url = "https://plugins.dprint.dev/biome-0.12.7.wasm";
+  version = "0.12.7";
 }

From 65ea35e65114eec4d8d69a0ea314d0a921a94b33 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 05:17:29 +0000
Subject: [PATCH 48/67] python3Packages.py-unifi-access: 1.1.4 -> 1.1.5

---
 pkgs/development/python-modules/py-unifi-access/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-unifi-access/default.nix b/pkgs/development/python-modules/py-unifi-access/default.nix
index c4eef261fbfa..d31c917b2838 100644
--- a/pkgs/development/python-modules/py-unifi-access/default.nix
+++ b/pkgs/development/python-modules/py-unifi-access/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "py-unifi-access";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "imhotep";
     repo = "py-unifi-access";
     tag = finalAttrs.version;
-    hash = "sha256-oh8Y1hfr+mJL5gz2P4uaZ68TtSCG0CgcrKgnhuEgfQc=";
+    hash = "sha256-TGAZpvqX5H+kaSJb3rraDfXnekPGCMb092NF2ilNdHM=";
   };
 
   build-system = [ setuptools ];

From 67da696dd262b77419efa6d9f4ae9d088814b7a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 05:18:18 +0000
Subject: [PATCH 49/67] python3Packages.python-qube-heatpump: 1.8.0 -> 1.9.0

---
 .../python-modules/python-qube-heatpump/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-qube-heatpump/default.nix b/pkgs/development/python-modules/python-qube-heatpump/default.nix
index 050488398b91..5b07d81563d5 100644
--- a/pkgs/development/python-modules/python-qube-heatpump/default.nix
+++ b/pkgs/development/python-modules/python-qube-heatpump/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-qube-heatpump";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MattieGit";
     repo = "python-qube-heatpump";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+g/70W09QymkFcjYLhxzYXBQCcPHzUX/hOqAL7/aas=";
+    hash = "sha256-E3JVk3eYJhesPMu0eFqxPu1HTyLWtKc8rV9z1E5IwJs=";
   };
 
   build-system = [ hatchling ];

From d9c0977bdebb36790a975a0ce0a26e9dfbc67e8c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 06:15:02 +0000
Subject: [PATCH 50/67] wpprobe: 0.11.4 -> 0.11.8

---
 pkgs/by-name/wp/wpprobe/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wp/wpprobe/package.nix b/pkgs/by-name/wp/wpprobe/package.nix
index 5973aea6cdee..4e57a5145ad5 100644
--- a/pkgs/by-name/wp/wpprobe/package.nix
+++ b/pkgs/by-name/wp/wpprobe/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wpprobe";
-  version = "0.11.4";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "Chocapikk";
     repo = "wpprobe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uJ/88Uw9w9I4fnIgmRcOG4l5pFd/MhCczO4vyo/ERTc=";
+    hash = "sha256-OJDiTAsSqYOAzYIwYCosrGbPdrbGdldPt2I3FwSdLXE=";
   };
 
   vendorHash = "sha256-pAKFrdja+rH0kiJH6hToZwLjE8lLBHFAUCjnCLbgxVo=";

From 09062456773fc944e299ed2f310207d68686dd5a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 08:55:11 +0200
Subject: [PATCH 51/67] python3Packages.iamdata: 0.1.202604131 -> 0.1.202604141

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202604131...v0.1.202604141

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202604141
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index e3dbdda8e4a5..90d210c2827c 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604131";
+  version = "0.1.202604141";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NFEhmbq0vAn0mZtdVnzyU8TWz3FaYbodFz6wMKOdjTk=";
+    hash = "sha256-0eCvRqYAiG0+zlJy37Z/28JhzsIyWGhLLSs6Xj8wWfQ=";
   };
 
   __darwinAllowLocalNetworking = true;

From c02ec9a7c537d858bcc9809525e00532abe5e8dd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 08:58:26 +0200
Subject: [PATCH 52/67] python3Packages.tencentcloud-sdk-python: 3.1.76 ->
 3.1.77

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.76...3.1.77

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.77/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index a15d64ebe8ee..e5c80cf60c7f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.76";
+  version = "3.1.77";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-21BXGAPXCyRHTqPSUjvWWbrEbxAqqeSZavqIZ6sax3Q=";
+    hash = "sha256-pLkHUcy8CbEz6f3bNHx+ynJg9snxRphCoKldO//4PmM=";
   };
 
   build-system = [ setuptools ];

From a6ec95d9b93fb81aceb1f20910c66d4f3735ecf8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 08:59:08 +0200
Subject: [PATCH 53/67] python3Packages.mypy-boto3-customer-profiles: 1.42.66
 -> 1.42.89

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 82c5150b2b9b..db97915851be 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -363,8 +363,8 @@ in
       "sha256-SAgpP1O6oGP8QIp6qoG4bu/axKZyVWgbdt8ZmZkrezY=";
 
   mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.42.66"
-      "sha256-q+QcH2dYyQ4jf9CWfNG6hT+qZPFQ1mJCwPxzFVC3sCc=";
+    buildMypyBoto3Package "customer-profiles" "1.42.89"
+      "sha256-5Y2OYBWdbtFa2AnnlFQ5AaVuGi3IGqPSimFC/Izx7Og=";
 
   mypy-boto3-databrew =
     buildMypyBoto3Package "databrew" "1.42.3"

From 4e54536a7183ba54184ba9a0b09dc5b58bfc18f4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 08:59:23 +0200
Subject: [PATCH 54/67] python3Packages.mypy-boto3-glue: 1.42.70 -> 1.42.89

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index db97915851be..0c101190ab29 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -571,8 +571,8 @@ in
       "sha256-N0kQ7Fc44SFKXhl4V+oAclPNlWhluOs53NDokiXcSNM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.42.70"
-      "sha256-1LdCLIL9olH9DiZFsWulOaFqc8UE9tK/+cDiCXohYFQ=";
+    buildMypyBoto3Package "glue" "1.42.89"
+      "sha256-U+NzY02OyhR/GbZy+2Ye3+FgAVzF/UTNhUH3fy9SmMc=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.42.51"
       "sha256-QHAuRJrioMD7ASgV1Wobm81Gb+Z87c78yBs9X1+Kz+E=";

From d3d9b7b5ce6dd77a4ff01982667bc0013693c709 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 08:59:41 +0200
Subject: [PATCH 55/67] python3Packages.mypy-boto3-macie2: 1.42.3 -> 1.42.89

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 0c101190ab29..0bfb2d590653 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -830,8 +830,8 @@ in
       "sha256-mERVlNSjfxNqfyGRlNgfP1MrzhGrMYgIuZ0pZLPrfBQ=";
 
   mypy-boto3-macie2 =
-    buildMypyBoto3Package "macie2" "1.42.3"
-      "sha256-fzZHKPUXOh/tLGCx6xAHJd4jefApYtEwbt6BSakOLXA=";
+    buildMypyBoto3Package "macie2" "1.42.89"
+      "sha256-Y19V3g8CM4L2L5dWPjpokPNj6iX39OPxUP+H1blFaH0=";
 
   mypy-boto3-managedblockchain =
     buildMypyBoto3Package "managedblockchain" "1.42.3"

From 22343baff8ae120529f227a61b8f2b8293ac9108 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 09:00:06 +0200
Subject: [PATCH 56/67] python3Packages.mypy-boto3-securityhub: 1.42.58 ->
 1.42.89

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 0bfb2d590653..b0ba9533364e 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1218,8 +1218,8 @@ in
       "sha256-WrQvNc6TJ2XrsWhBRvR4qHzEuDvvlQ/Rqg4mi4jVnIE=";
 
   mypy-boto3-securityhub =
-    buildMypyBoto3Package "securityhub" "1.42.58"
-      "sha256-svAuxOrTZz/fludiFZFolRVMQmS2qdaJBrfTlynb8oA=";
+    buildMypyBoto3Package "securityhub" "1.42.89"
+      "sha256-cXpUTYf1lt0Wtu39NzdaKjgJRyRsIOpJ+GJPvO7Iu/Y=";
 
   mypy-boto3-securitylake =
     buildMypyBoto3Package "securitylake" "1.42.3"

From bcb5ec98ea019ecc2e57cbe324ef188d293a348c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 09:00:32 +0200
Subject: [PATCH 57/67] python3Packages.boto3-stubs: 1.42.88 -> 1.42.89

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index e9aa59d1a0aa..7a6e7bbe923d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.88";
+  version = "1.42.89";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-hSFftJOKlNHPg82GMvRq53KLXsiBh9g0aPOTu+ZCNtY=";
+    hash = "sha256-27xP0meM+yHam6sbXjC6lRhSMi0FUEWsEgQro00EWXo=";
   };
 
   build-system = [ setuptools ];

From d5370b25d215adec0529aed379523eb74769a4f6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 09:03:23 +0200
Subject: [PATCH 58/67] python3Packages.smbus2: migrate to finalAttrs

---
 pkgs/development/python-modules/smbus2/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/smbus2/default.nix b/pkgs/development/python-modules/smbus2/default.nix
index b8b5984ed8d0..72037e135dd0 100644
--- a/pkgs/development/python-modules/smbus2/default.nix
+++ b/pkgs/development/python-modules/smbus2/default.nix
@@ -6,7 +6,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "smbus2";
   version = "0.6.1";
   pyproject = true;
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "kplindegaard";
     repo = "smbus2";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-CWcRlbZTLiB45DaV6rbhvlk8cTaEJgPAq/JDmbxD7H4=";
   };
 
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   meta = {
     description = "Drop-in replacement for smbus-cffi/smbus-python";
     homepage = "https://smbus2.readthedocs.io/";
-    changelog = "https://github.com/kplindegaard/smbus2/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/kplindegaard/smbus2/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 187cd6b88e9738d33d686d87e7f724e46e88f960 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 14 Apr 2026 09:10:16 +0200
Subject: [PATCH 59/67] python3Packages.dtfabric: modernize

- migrate to finalAttrs
- add pythonImportsCheck
- update ordering
---
 .../python-modules/dtfabric/default.nix       | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/dtfabric/default.nix b/pkgs/development/python-modules/dtfabric/default.nix
index f853f3c637b8..e66403b6ca36 100644
--- a/pkgs/development/python-modules/dtfabric/default.nix
+++ b/pkgs/development/python-modules/dtfabric/default.nix
@@ -6,38 +6,39 @@
   pyyaml,
   setuptools,
 }:
-buildPythonPackage rec {
+
+buildPythonPackage (finalAttrs: {
   pname = "dtfabric";
   version = "20260411";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-0hnJJ76wpINsNXecrGCQILqixo4xUhH8dW6djq9/vH4=";
   };
 
+  pythonRemoveDeps = [ "pip" ];
+
   build-system = [ setuptools ];
 
-  dependencies = [
-    pyyaml
-  ];
-
-  pythonRemoveDeps = [
-    "pip"
-  ];
+  dependencies = [ pyyaml ];
 
   checkPhase = ''
     runHook preCheck
+
     ${python.interpreter} run_tests.py
+
     runHook postCheck
   '';
 
+  pythonImportsCheck = [ "dtfabric" ];
+
   meta = {
-    changelog = "https://github.com/libyal/dtfabric/releases/tag/${version}";
     description = "Project to manage data types and structures, as used in the libyal projects";
+    changelog = "https://github.com/libyal/dtfabric/releases/tag/${finalAttrs.version}";
     downloadPage = "https://github.com/libyal/dtfabric/releases";
     homepage = "https://github.com/libyal/dtfabric";
     license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.jayrovacsek ];
+    maintainers = with lib.maintainers; [ jayrovacsek ];
   };
-}
+})

From b3055b6b3a9cc0c1f131aa127c12516988274ce7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 07:19:39 +0000
Subject: [PATCH 60/67] signal-desktop: 8.6.0 -> 8.6.1

---
 pkgs/by-name/si/signal-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 5bda913e7a00..48454e6de50a 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -58,13 +58,13 @@ let
     '';
   });
 
-  version = "8.6.0";
+  version = "8.6.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-K6mufC7LFGWeCkIkrsYPO2n/0L1b6yBqiLcv7w7e57g=";
+    hash = "sha256-UeCjj3txcBQxfvEJOuCKka3VVfd4OY/4wXoQ4lq4NiE=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -185,7 +185,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1775687068;
+    SOURCE_DATE_EPOCH = 1776101010;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Disable code signing during local macOS builds.

From a55848fbc380cf7d699e15cb2cfef10043ab6dbe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 07:39:51 +0000
Subject: [PATCH 61/67] terraform-providers.dopplerhq_doppler: 1.21.1 -> 1.21.2

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8778068f12ba..349e20fee23f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -346,11 +346,11 @@
     "vendorHash": null
   },
   "dopplerhq_doppler": {
-    "hash": "sha256-ZqlakWqu9gOMxVLAFUzmho3hl+wbwPA5AXX8Z7XRsCc=",
+    "hash": "sha256-43NFvuKJ2QlCLoEq9N1RSv4BtF4s/GFzzakeIxw6V4Q=",
     "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
     "owner": "DopplerHQ",
     "repo": "terraform-provider-doppler",
-    "rev": "v1.21.1",
+    "rev": "v1.21.2",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },

From 1d16486166a9eb27aefc7739b9c3c615bfa1345d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 14 Apr 2026 10:30:14 +0200
Subject: [PATCH 62/67] Revert "nixos/test-driver: use log levels"

This reverts commit 149201a7e37c197bc090723af5c016f4f596c735.
I don't get what needs to done to fix redirects in the NixOS manual,
so let's unblock by reverting for now.
---
 .../test-driver/src/test_driver/__init__.py   | 13 ------
 .../lib/test-driver/src/test_driver/logger.py | 45 +++----------------
 nixos/lib/testing/driver.nix                  | 12 -----
 3 files changed, 6 insertions(+), 64 deletions(-)

diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
index da527f46b824..0f42f2842c77 100644
--- a/nixos/lib/test-driver/src/test_driver/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/__init__.py
@@ -12,7 +12,6 @@ from test_driver.driver import Driver
 from test_driver.logger import (
     CompositeLogger,
     JunitXMLLogger,
-    LogLevel,
     TerminalLogger,
     XMLLogger,
 )
@@ -152,15 +151,6 @@ def main() -> None:
         help="indicates that the interactive SSH backdoor is active and dumps information about it on start",
         type=int,
     )
-    log_level_map = {level.name.lower(): level for level in LogLevel}
-    arg_parser.add_argument(
-        "--log-level",
-        metavar="LOG_LEVEL",
-        action=EnvDefault,
-        envvar="logLevel",
-        choices=log_level_map,
-        help="Set the log level",
-    )
 
     args = arg_parser.parse_args()
 
@@ -179,9 +169,6 @@ def main() -> None:
     if args.junit_xml:
         logger.add_logger(JunitXMLLogger(output_directory / args.junit_xml))
 
-    if args.log_level:
-        logger.set_log_level(log_level_map[args.log_level])
-
     if not args.keep_machine_state:
         logger.info(
             "Machine state will be reset. To keep it, pass --keep-machine-state"
diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py
index 3c2cb41d33b1..a218d234fe3f 100644
--- a/nixos/lib/test-driver/src/test_driver/logger.py
+++ b/nixos/lib/test-driver/src/test_driver/logger.py
@@ -7,7 +7,6 @@ import unicodedata
 from abc import ABC, abstractmethod
 from collections.abc import Iterator
 from contextlib import ExitStack, contextmanager
-from enum import IntEnum
 from pathlib import Path
 from queue import Empty, Queue
 from typing import Any
@@ -18,12 +17,6 @@ from colorama import Fore, Style
 from junit_xml import TestCase, TestSuite
 
 
-class LogLevel(IntEnum):
-    INFO = 1
-    WARNING = 2
-    ERROR = 3
-
-
 class AbstractLogger(ABC):
     @abstractmethod
     def log(self, message: str, attributes: dict[str, str] = {}) -> None:
@@ -63,10 +56,6 @@ class AbstractLogger(ABC):
     def print_serial_logs(self, enable: bool) -> None:
         pass
 
-    @abstractmethod
-    def set_log_level(self, level: LogLevel) -> None:
-        pass
-
 
 class JunitXMLLogger(AbstractLogger):
     class TestCaseState:
@@ -82,7 +71,6 @@ class JunitXMLLogger(AbstractLogger):
         self.currentSubtest = "main"
         self.outfile: Path = outfile
         self._print_serial_logs = True
-        self._log_level = LogLevel.INFO
         atexit.register(self.close)
 
     def log(self, message: str, attributes: dict[str, str] = {}) -> None:
@@ -104,12 +92,10 @@ class JunitXMLLogger(AbstractLogger):
         yield
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.INFO:
-            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+        self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.WARNING:
-            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+        self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.tests[self.currentSubtest].stderr += args[0] + os.linesep
@@ -127,9 +113,6 @@ class JunitXMLLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
-    def set_log_level(self, level: LogLevel) -> None:
-        self._log_level = level
-
     def close(self) -> None:
         with open(self.outfile, "w") as f:
             test_cases = []
@@ -197,15 +180,10 @@ class CompositeLogger(AbstractLogger):
         for logger in self.logger_list:
             logger.log_serial(message, machine)
 
-    def set_log_level(self, level: LogLevel) -> None:
-        for logger in self.logger_list:
-            logger.set_log_level(level)
-
 
 class TerminalLogger(AbstractLogger):
     def __init__(self) -> None:
         self._print_serial_logs = True
-        self._log_level = LogLevel.INFO
 
     def maybe_prefix(self, message: str, attributes: dict[str, str]) -> str:
         if "machine" in attributes:
@@ -238,12 +216,10 @@ class TerminalLogger(AbstractLogger):
         self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)", attributes)
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.INFO:
-            self.log(*args, **kwargs)
+        self.log(*args, **kwargs)
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.WARNING:
-            self.log(*args, **kwargs)
+        self.log(*args, **kwargs)
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.log(*args, **kwargs)
@@ -251,9 +227,6 @@ class TerminalLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
-    def set_log_level(self, level: LogLevel) -> None:
-        self._log_level = level
-
     def log_serial(self, message: str, machine: str) -> None:
         if not self._print_serial_logs:
             return
@@ -273,7 +246,6 @@ class XMLLogger(AbstractLogger):
         self.queue: Queue[dict[str, str]] = Queue()
 
         self._print_serial_logs = True
-        self._log_level = LogLevel.INFO
 
         self.xml.startDocument()
         self.xml.startElement("logfile", attrs=AttributesImpl({}))
@@ -297,12 +269,10 @@ class XMLLogger(AbstractLogger):
         self.xml.endElement("line")
 
     def info(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.INFO:
-            self.log(*args, **kwargs)
+        self.log(*args, **kwargs)
 
     def warning(self, *args, **kwargs) -> None:  # type: ignore
-        if self._log_level <= LogLevel.WARNING:
-            self.log(*args, **kwargs)
+        self.log(*args, **kwargs)
 
     def error(self, *args, **kwargs) -> None:  # type: ignore
         self.log(*args, **kwargs)
@@ -317,9 +287,6 @@ class XMLLogger(AbstractLogger):
     def print_serial_logs(self, enable: bool) -> None:
         self._print_serial_logs = enable
 
-    def set_log_level(self, level: LogLevel) -> None:
-        self._log_level = level
-
     def log_serial(self, message: str, machine: str) -> None:
         if not self._print_serial_logs:
             return
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index d5638718dda7..5cd7c2ebb806 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -119,7 +119,6 @@ let
           --set testScript "$out/test-script" \
           --set globalTimeout "${toString config.globalTimeout}" \
           --set vlans '${toString vlans}' \
-          --set logLevel "${config.logLevel}" \
           ${lib.escapeShellArgs (
             lib.concatMap (arg: [
               "--add-flags"
@@ -220,17 +219,6 @@ in
         This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript).
       '';
     };
-
-    logLevel = mkOption {
-      description = "Log level for the test driver.";
-      type = types.enum [
-        "info"
-        "warning"
-        "error"
-      ];
-      default = "info";
-      example = "warning";
-    };
   };
 
   config = {

From 2fd0fa1a77ae15e52b242cb43b985615dd2076fa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 08:32:54 +0000
Subject: [PATCH 63/67] piliplus: 2.0.2 -> 2.0.4

---
 pkgs/by-name/pi/piliplus/git-hashes.json   |  4 +-
 pkgs/by-name/pi/piliplus/package.nix       |  2 +-
 pkgs/by-name/pi/piliplus/pubspec.lock.json | 78 ++++++++++++++--------
 pkgs/by-name/pi/piliplus/src-info.json     |  8 +--
 4 files changed, 56 insertions(+), 36 deletions(-)

diff --git a/pkgs/by-name/pi/piliplus/git-hashes.json b/pkgs/by-name/pi/piliplus/git-hashes.json
index 92047d1acb9f..d164ae8fdddc 100644
--- a/pkgs/by-name/pi/piliplus/git-hashes.json
+++ b/pkgs/by-name/pi/piliplus/git-hashes.json
@@ -1,9 +1,8 @@
 {
-  "auto_orientation": "sha256-0QOEW8+0PpBIELmzilZ8+z7ozNRxKgI0BzuBS8c1Fng=",
   "canvas_danmaku": "sha256-XbOYi66WU6hV6Q2FnMC8HxFcY1MxAhyyJr4K+gCPEX4=",
   "chat_bottom_container": "sha256-+R1MiDMO4onCMXiJ7MJtJVAwyEJcikTyONwp+HibqA0=",
   "extended_nested_scroll_view": "sha256-ocjIy7gpCikoqRMqY4oGw/p9YaQ2v2clhon2pIzTXk4=",
-  "file_picker": "sha256-vBTRs/YlzmiPfcxStNWE1HdhbkIFQZMY7zEOKkd20oI=",
+  "file_picker": "sha256-4zwyrsyXb6KnCzSRGBLgypH79ifKVji8Y8lIb5AIc58=",
   "floating": "sha256-0Xd9dsXJCQ/r/8Nb16oM+M8Jdw+r4QzGmU++HpqF/v0=",
   "flutter_smart_dialog": "sha256-sehrQraEWmYvUd9pdG4l3edbtR4yTcJOqPbuhzIrih4=",
   "flutter_sortable_wrap": "sha256-Qj9Lzh+pJy+vHznGt5M3xwoJtaVtt00fxm4JJXL4bFI=",
@@ -17,6 +16,7 @@
   "media_kit_libs_windows_video": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
   "media_kit_native_event_loop": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
   "media_kit_video": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
+  "native_device_orientation": "sha256-uJ/sGUeEDv+3PTfMBCiNsE3WlkUiNwtwjJREUZTv94I=",
   "super_sliver_list": "sha256-G24uRql1aIc1TDJwKqwQ72Pi4YbJybMn6lxOUySSDwk=",
   "webdav_client": "sha256-euNF7HdDtZ68BqSEq9BvO10BK09MxX2wWGoElFS0yeE=",
   "window_manager": "sha256-UAN3uOXKMfWk+G9GTHyhD2dGDojKA76mGbUR+EFc2Qo="
diff --git a/pkgs/by-name/pi/piliplus/package.nix b/pkgs/by-name/pi/piliplus/package.nix
index 73bfd5235ece..a88da3e6e004 100644
--- a/pkgs/by-name/pi/piliplus/package.nix
+++ b/pkgs/by-name/pi/piliplus/package.nix
@@ -13,7 +13,7 @@
 let
   srcInfo = lib.importJSON ./src-info.json;
   description = "Third-party Bilibili client developed in Flutter";
-  version = "2.0.2";
+  version = "2.0.4";
 in
 flutter341.buildFlutterApplication {
   pname = "piliplus";
diff --git a/pkgs/by-name/pi/piliplus/pubspec.lock.json b/pkgs/by-name/pi/piliplus/pubspec.lock.json
index 271274301a7a..9ef18ac26b27 100644
--- a/pkgs/by-name/pi/piliplus/pubspec.lock.json
+++ b/pkgs/by-name/pi/piliplus/pubspec.lock.json
@@ -150,17 +150,6 @@
       "source": "hosted",
       "version": "0.2.3"
     },
-    "auto_orientation": {
-      "dependency": "direct main",
-      "description": {
-        "path": ".",
-        "ref": "master",
-        "resolved-ref": "ca2bb137bd0e4b221df3bc5ba1492d2902c78624",
-        "url": "https://github.com/bggRGjQaUbCoE/auto_orientation.git"
-      },
-      "source": "git",
-      "version": "2.3.1"
-    },
     "battery_plus": {
       "dependency": "direct main",
       "description": {
@@ -306,11 +295,11 @@
       "dependency": "direct main",
       "description": {
         "name": "catcher_2",
-        "sha256": "3c9bc7435d250c1a958bbc7beb2f1d960ffb6c2658f2a5afd8d8e6db15cf8708",
+        "sha256": "ac9dd03230fa4058d14d46450335ca3c40564f734d793e52f81053f3cbf95009",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.8"
+      "version": "2.1.9"
     },
     "characters": {
       "dependency": "direct main",
@@ -397,11 +386,11 @@
       "dependency": "direct main",
       "description": {
         "name": "connectivity_plus",
-        "sha256": "b8fe52979ff12432ecf8f0abf6ff70410b1bb734be1c9e4f2f86807ad7166c79",
+        "sha256": "62ffa266d9a23b79fb3fcbc206afc00bb979417ba57b1324c546b5aab95ba057",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.1.0"
+      "version": "7.1.1"
     },
     "connectivity_plus_platform_interface": {
       "dependency": "transitive",
@@ -659,11 +648,11 @@
       "description": {
         "path": ".",
         "ref": "mod",
-        "resolved-ref": "8ba6a6a73691262bd006deec247311d136596032",
+        "resolved-ref": "d1dde80df07a6ec46d9291cfeba6c01de53b5305",
         "url": "https://github.com/bggRGjQaUbCoE/flutter_file_picker.git"
       },
       "source": "git",
-      "version": "11.0.0"
+      "version": "11.0.2"
     },
     "file_selector_linux": {
       "dependency": "transitive",
@@ -1127,11 +1116,11 @@
       "dependency": "direct main",
       "description": {
         "name": "image_cropper",
-        "sha256": "d2555be1ec4b7b12fc502ede481c846ad44578fbb0748debd4c648b25ca07cad",
+        "sha256": "e2c8da14ecb4c6ead02b8e1265f966ce72b43ff930da66eef3833e622185dec7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.1.1"
+      "version": "12.2.0"
     },
     "image_cropper_for_web": {
       "dependency": "transitive",
@@ -1167,11 +1156,11 @@
       "dependency": "transitive",
       "description": {
         "name": "image_picker_android",
-        "sha256": "9eae0cbd672549dacc18df855c2a23782afe4854ada5190b7d63b30ee0b0d3fd",
+        "sha256": "66810af8e99b2657ee98e5c6f02064f69bb63f7a70e343937f70946c5f8c6622",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.8.13+15"
+      "version": "0.8.13+16"
     },
     "image_picker_for_web": {
       "dependency": "transitive",
@@ -1263,6 +1252,26 @@
       "source": "hosted",
       "version": "0.6.1"
     },
+    "jni": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni",
+        "sha256": "c2230682d5bc2362c1c9e8d3c7f406d9cbba23ab3f2e203a025dd47e0fb2e68f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "jni_flutter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni_flutter",
+        "sha256": "8b59e590786050b1cd866677dddaf76b1ade5e7bc751abe04b86e84d379d3ba6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.1"
+    },
     "js": {
       "dependency": "transitive",
       "description": {
@@ -1542,6 +1551,17 @@
       "source": "hosted",
       "version": "2.0.0"
     },
+    "native_device_orientation": {
+      "dependency": "direct main",
+      "description": {
+        "path": ".",
+        "ref": "master",
+        "resolved-ref": "240534adb4b4b5c2c7e6c4578b1fc052ce98d7fd",
+        "url": "https://github.com/bggRGjQaUbCoE/flutter_native_device_orientation.git"
+      },
+      "source": "git",
+      "version": "2.0.5"
+    },
     "native_toolchain_c": {
       "dependency": "transitive",
       "description": {
@@ -1646,11 +1666,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "149441ca6e4f38193b2e004c0ca6376a3d11f51fa5a77552d8bd4d2b0c0912ba",
+        "sha256": "69cbd515a62b94d32a7944f086b2f82b4ac40a1d45bebfc00813a430ab2dabcd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.23"
+      "version": "2.3.1"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1866,11 +1886,11 @@
       "dependency": "direct main",
       "description": {
         "name": "saver_gallery",
-        "sha256": "1d942bd7f4fedc162d9a751e156ebac592e4b81fc2e757af82de9077f3437003",
+        "sha256": "3f983d4be63aff52523c3e097a9b00ce9ab8444f9a982c878cde9d0359f4681d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.1.1"
     },
     "screen_brightness_android": {
       "dependency": "direct overridden",
@@ -1956,11 +1976,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sentry",
-        "sha256": "288aee3d35f252ac0dc3a4b0accbbe7212fa2867604027f2cc5bc65334afd743",
+        "sha256": "682360642a7b14b36daef3b5574b7269164e7763512ac92cdafd55b695bd2183",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.16.0"
+      "version": "9.16.1"
     },
     "share_plus": {
       "dependency": "direct main",
@@ -2433,11 +2453,11 @@
       "dependency": "direct main",
       "description": {
         "name": "wakelock_plus",
-        "sha256": "8b12256f616346910c519a35606fb69b1fe0737c06b6a447c6df43888b097f39",
+        "sha256": "ddf3db70eaa10c37558ff817519b85d527dbd21034fd5d8e1c2e85f31588f1c1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.1"
+      "version": "1.5.2"
     },
     "wakelock_plus_platform_interface": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/pi/piliplus/src-info.json b/pkgs/by-name/pi/piliplus/src-info.json
index f526955f25ae..3d0033b44ad3 100644
--- a/pkgs/by-name/pi/piliplus/src-info.json
+++ b/pkgs/by-name/pi/piliplus/src-info.json
@@ -1,6 +1,6 @@
 {
-  "rev": "8ad130567e0f4b1d1be400281c49964e67193c2c",
-  "revCount": 4814,
-  "commitDate": 1774952739,
-  "hash": "sha256-6rQSNOryhFLeNeypWKNazOUQOev1BXf4nCea6+2nUwc="
+  "rev": "0b4ed25891e9567c8e4d386ae72e39c677db2187",
+  "revCount": 4848,
+  "commitDate": 1776146399,
+  "hash": "sha256-e/chUgvE7oJPdVZ4tmgIYxfLD2R2Fs57Uo2xmn4hNTk="
 }

From e76ee720676d42d427c12f6a52ed9db38124b755 Mon Sep 17 00:00:00 2001
From: kashw2 <supra4keanu@hotmail.com>
Date: Tue, 14 Apr 2026 18:39:10 +1000
Subject: [PATCH 64/67] nixos/flood: add `AF_NETLINK` to
 `RestrictedAddressFamilies`

---
 nixos/modules/services/torrent/flood.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/torrent/flood.nix b/nixos/modules/services/torrent/flood.nix
index 658ce55939f6..ed99e3a16cf8 100644
--- a/nixos/modules/services/torrent/flood.nix
+++ b/nixos/modules/services/torrent/flood.nix
@@ -80,6 +80,7 @@ in
           "AF_UNIX"
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;

From a5be142ac62b03e5780d770090bb51cba5087838 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 14 Apr 2026 09:37:48 +0000
Subject: [PATCH 65/67] sanbdox-runtime: fix wrapProgram

---
 pkgs/by-name/sa/sandbox-runtime/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index c5455d952375..a3491cfb2029 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -50,7 +50,7 @@ buildNpmPackage (finalAttrs: {
     in
     ''
       wrapProgram $out/bin/srt \
-        --prefix PATH ${lib.makeBinPath runtimeDeps}
+        --prefix PATH : ${lib.makeBinPath runtimeDeps}
     '';
 
   nativeInstallCheckInputs = [

From bfb560593d0d8bd774e1c685ac9501994f2d3991 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 11:32:59 +0000
Subject: [PATCH 66/67] lisette: 0.1.3 -> 0.1.9

---
 pkgs/by-name/li/lisette/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lisette/package.nix b/pkgs/by-name/li/lisette/package.nix
index 8c2b1ffb00ab..f1831e26b189 100644
--- a/pkgs/by-name/li/lisette/package.nix
+++ b/pkgs/by-name/li/lisette/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lisette";
-  version = "0.1.3";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "ivov";
     repo = "lisette";
     tag = "lisette-v${finalAttrs.version}";
-    hash = "sha256-vepiowHDu0l7BCT42ceIEOVaoUd9ttrE21N6D9+zPgo=";
+    hash = "sha256-9fjnYYoW3wwoJ+YV89dThSlWljNG6Jaa51PMc5DqtFI=";
   };
 
-  cargoHash = "sha256-N7Y0BHaVcF8ejKnFrci0KHoy0SLuiTmJpgAPOV8hkAg=";
+  cargoHash = "sha256-XOMr8oDV82BgXfLc8oHqm8WAvmEHJjFGVmprxvso1cE=";
 
   preCheck = ''
     export NO_COLOR=true

From a39a49a04a5191f4ec37ac6b0b0a05e641195135 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 07:43:05 +0000
Subject: [PATCH 67/67] firefox-esr-140-unwrapped: 140.9.0esr -> 140.9.1esr

https://www.mozilla.org/en-US/firefox/140.9.1/releasenotes/
https://www.mozilla.org/security/advisories/mfsa2026-27/

Fixes: CVE-2026-5732, CVE-2026-5731, CVE-2026-5734
---
 .../networking/browsers/firefox/packages/firefox-esr-140.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
index c920d47bb04c..76661f7d88d8 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.9.0esr";
+  version = "140.9.1esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bc03fd2a73d00a88bd0a3c9eeaefe618ffb34226fb7bc2fac4a02246ff29fe038423bf77538273ee6fac25fb1e3e4fa98bb522026ae3427a0ad5f41d2ec6ba98";
+    sha512 = "119a4e4e536fd4534adcc4a546a988e553285f9326bf16e9771854ec2dc7d039a729aedc5925623e172260a5e154172c56a011f131068736eb2a89a8de611840";
   };
 
   meta = {