Merge staging-next into staging

2026-04-28 12:37:48 +00:00
parent 6df4c01b5a 5873882d54
commit f8f95c9be8
75 changed files with 1519 additions and 387 deletions
@@ -145,6 +145,13 @@

 - Varnish Cache has been updated to major version 8, `varnish` now refers to `varnish80`. That release contains breaking changes, see [Upgrading to Varnish-Cache 8.0](https://vinyl-cache.org/docs/8.0/whats-new/upgrading-8.0.html).
  Note that the Varnish 6 LTS release remains available as `varnish60`.
+  The Varnish Cache open-source project renamed itself to Vinyl Cache. Please migrate to `vinyl-cache`. See the `vinyl-cache` release notes entry for more information.
+  Varnish 8 is not supported for the entire NixOS 26.05 release cycle.
+
+- Vinyl Cache has been introduced with the major version 9 as the Varnish Cache open source project renamed itself to Vinyl Cache. Please migrate to Vinyl Cache 9 when you still use Varnish Cache.
+  A new module has also been introduced for this migration: `services.vinyl-cache`.
+  This release contains breaking changes, see [Upgrading to Vinyl Cache 9.0](https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html).
+  The `varnish-modules` project is currently not packaged for Vinyl Cache, as it is incompatible.

 - `eslint` has been updated from version 9 to version 10. Please see https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ for details about the breaking changes included in the update.

@@ -355,6 +362,8 @@ gnuradioMinimal.override {
 }
 ```

+- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -337,6 +337,7 @@ rec {

  /**
    Concatenate a list of strings, adding a newline at the end of each one.
+    Defined as `concatMapStrings (s: s + "\n")`.

    # Inputs

@@ -360,7 +361,7 @@ rec {

    :::
  */
-  concatLines = str: concatStringsSep "\n" str + "\n";
+  concatLines = concatMapStrings (s: s + "\n");

  /**
    Given string `s`, replace every occurrence of the string `from` with the string `to`.
@@ -559,6 +559,10 @@ runTests {
    ];
    expected = "a\nb\nc\n";
  };
+  testConcatLinesEmpty = {
+    expr = concatLines [ ];
+    expected = "";
+  };

  testMakeIncludePathWithPkgs = {
    expr = (
@@ -11298,6 +11298,12 @@
    githubId = 55025025;
    name = "Feather Lin";
  };
+  igor-ramazanov = {
+    email = "personal@igorramazanov.tech";
+    github = "igor-ramazanov";
+    githubId = 12570166;
+    name = "Igor Ramazanov";
+  };
  igsha = {
    email = "igor.sharonov@gmail.com";
    github = "igsha";
@@ -26045,6 +26051,12 @@
    github = "StayBlue";
    githubId = 23127866;
  };
+  stealthbadger747 = {
+    email = "parawell.erik@gmail.com";
+    github = "StealthBadger747";
+    githubId = 26052996;
+    name = "Erik Parawell";
+  };
  steamwalker = {
    email = "steamwalker@xs4all.nl";
    github = "steamwalker";
@@ -51,6 +51,11 @@

  Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`

+- The NixOS integration test driver now supports `systemd-nspawn` containers as an alternative backend to QEMU virtual machines ([#470248](https://github.com/NixOS/nixpkgs/pull/470248), [#478109](https://github.com/NixOS/nixpkgs/pull/478109), [#479968](https://github.com/NixOS/nixpkgs/pull/479968)).
+  Most NixOS integration tests do not require a full VM, and switching them to containers can considerably reduce test time and resource usage.
+  Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
+  See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
+
 ## New Modules {#sec-release-26.05-new-modules}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -75,6 +80,8 @@

 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).

+- [vinyl-cache] as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old `services.varnish` module is still available.
+
 - [papra](https://papra.app/), an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as [services.papra](#opt-services.papra.enable).

 - [rqbit](https://github.com/ikatson/rqbit), a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as [services.rqbit](#opt-services.rqbit.enable).
@@ -141,7 +148,9 @@

 - [tabbyAPI](https://github.com/theroyallab/tabbyAPI), the official OpenAI compatible API server for Exllama. Available as [services.tabbyapi](#opt-services.tabbyapi.enable).

- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable)
+- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable).
+
+- [Headplane](https://headplane.net), a feature-complete Web UI for Headscale. Available as [services.headplane](#opt-services.headplane.enable).

 - [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.

@@ -162,6 +171,8 @@

 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.

+- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
+
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.

 - `services.statsd` has been removed because the packages it relies on do not exist anymore in nixpkgs.
@@ -1226,6 +1226,7 @@
  ./services/networking/hans.nix
  ./services/networking/haproxy.nix
  ./services/networking/harmonia.nix
+  ./services/networking/headplane.nix
  ./services/networking/headscale.nix
  ./services/networking/hickory-dns.nix
  ./services/networking/hostapd.nix
@@ -1840,6 +1841,7 @@
  ./services/web-servers/unit/default.nix
  ./services/web-servers/uwsgi.nix
  ./services/web-servers/varnish/default.nix
+  ./services/web-servers/vinyl-cache/default.nix
  ./services/x11/clight.nix
  ./services/x11/colord.nix
  ./services/x11/desktop-managers/default.nix
@@ -0,0 +1,479 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+  inherit (lib.attrsets) filterAttrsRecursive;
+  cfg = config.services.headplane;
+  settingsFormat = pkgs.formats.yaml { };
+  filterSettings = lib.converge (
+    filterAttrsRecursive (
+      _: v:
+      !lib.elem v [
+        { }
+        null
+      ]
+    )
+  );
+  agentSettings = cfg.settings.integration.agent;
+  settings = cfg.settings // {
+    integration = cfg.settings.integration // {
+      agent = if agentSettings == null || !agentSettings.enabled then null else agentSettings;
+    };
+  };
+  settingsFile = settingsFormat.generate "headplane-config.yaml" (filterSettings settings);
+in
+{
+  options.services.headplane = {
+    enable = mkEnableOption "Headplane";
+    package = mkPackageOption pkgs "headplane" { };
+
+    agent.package = mkPackageOption pkgs "headplane-agent" { };
+
+    debug = mkEnableOption "debug logging";
+
+    settings = mkOption {
+      description = ''
+        Headplane configuration options. Generates a YAML config file.
+        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+      '';
+      type = types.submodule {
+        options = {
+          server = mkOption {
+            type = types.submodule {
+              options = {
+                host = mkOption {
+                  type = types.str;
+                  default = "127.0.0.1";
+                  description = "The host address to bind to.";
+                  example = "0.0.0.0";
+                };
+
+                port = mkOption {
+                  type = types.port;
+                  default = 3000;
+                  description = "The port to listen on.";
+                };
+
+                cookie_secret_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the cookie secret.
+                    The secret must be exactly 32 characters long.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_cookie.path";
+                };
+
+                cookie_secure = mkOption {
+                  type = types.bool;
+                  default = true;
+                  description = ''
+                    Should the cookies only work over HTTPS?
+                    Set to false if running via HTTP without a proxy.
+                    Recommended to be true in production.
+                  '';
+                };
+
+                data_path = mkOption {
+                  type = types.path;
+                  default = "/var/lib/headplane";
+                  description = ''
+                    The path to persist Headplane specific data.
+                    All data going forward is stored in this directory, including the internal database and any cache related files.
+                    Data formats prior to 0.6.1 will automatically be migrated.
+                  '';
+                  example = "/var/lib/headplane";
+                };
+              };
+            };
+            default = { };
+            description = "Server configuration for Headplane web application.";
+          };
+
+          headscale = mkOption {
+            type = types.submodule {
+              options = {
+                url = mkOption {
+                  type = types.str;
+                  default = "http://127.0.0.1:${toString config.services.headscale.port}";
+                  defaultText = lib.literalExpression "http://127.0.0.1:\${toString config.services.headscale.port}";
+                  description = ''
+                    The URL to your Headscale instance.
+                    All API requests are routed through this URL.
+                    THIS IS NOT the gRPC endpoint, but the HTTP endpoint.
+                    IMPORTANT: If you are using TLS this MUST be set to `https://`.
+                  '';
+                  example = "https://headscale.example.com";
+                };
+
+                tls_cert_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the TLS certificate.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.tls_cert.path";
+                };
+
+                public_url = mkOption {
+                  type = types.nullOr types.str;
+                  default = config.services.headscale.settings.server_url;
+                  defaultText = lib.literalExpression "config.services.headscale.settings.server_url";
+                  description = "Public URL if different. This affects certain parts of the web UI.";
+                  example = "https://headscale.example.com";
+                };
+
+                config_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = config.services.headscale.configFile;
+                  defaultText = lib.literalExpression "config.services.headscale.configFile";
+                  description = ''
+                    Path to the Headscale configuration file.
+                    This is optional, but HIGHLY recommended for the best experience.
+                    If this is read only, Headplane will show your configuration settings
+                    in the Web UI, but they cannot be changed.
+                  '';
+                  example = "/etc/headscale/config.yaml";
+                };
+
+                config_strict = mkEnableOption ''
+                  Headplane internally validates the Headscale configuration
+                  to ensure that it changes the configuration in a safe way.
+                  Disabled by default because it clashes with how the Headplane works in NixOS.
+                '';
+
+                dns_records_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    If you are using `dns.extra_records_path` in your Headscale configuration, you need to set this to the path for Headplane to be able to read the DNS records.
+                    Ensure that the file is both readable and writable by the Headplane process.
+                    When using this, Headplane will no longer need to automatically restart Headscale for DNS record changes.
+                  '';
+                  example = "/var/lib/headplane/extra_records.json";
+                };
+              };
+            };
+            default = { };
+            description = "Headscale specific settings for Headplane integration.";
+          };
+
+          integration = mkOption {
+            type = types.submodule {
+              options = {
+                agent = mkOption {
+                  type = types.nullOr (
+                    types.submodule {
+                      options = {
+                        enabled = mkOption {
+                          type = types.bool;
+                          default = false;
+                          description = ''
+                            The Headplane agent allows retrieving information about nodes.
+                            This allows the UI to display version, OS, and connectivity data.
+                            You will see the Headplane agent in your Tailnet as a node when it connects.
+                          '';
+                        };
+
+                        executable_path = mkOption {
+                          type = types.path;
+                          readOnly = true;
+                          default = "${cfg.agent.package}/bin/hp_agent";
+                          defaultText = lib.literalExpression ''"''${config.services.headplane.agent.package}/bin/hp_agent"'';
+                          description = ''
+                            Path to the headplane agent binary.
+                          '';
+                        };
+
+                        pre_authkey_path = mkOption {
+                          type = types.nullOr types.path;
+                          default = null;
+                          description = ''
+                            Path to a file containing the agent preauth key.
+                            To connect to your Tailnet, you need to generate a pre-auth key.
+                            This can be done via the web UI or through the `headscale` CLI.
+                          '';
+                          example = lib.literalExpression "config.sops.secrets.agent_pre_authkey.path";
+                        };
+
+                        host_name = mkOption {
+                          type = types.str;
+                          default = "headplane-agent";
+                          description = "Optionally change the name of the agent in the Tailnet";
+                        };
+
+                        cache_ttl = mkOption {
+                          type = types.ints.positive;
+                          default = 180000;
+                          description = ''
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                          '';
+                        };
+
+                        cache_path = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent_cache.json";
+                          description = "Where to store the agent cache.";
+                        };
+
+                        work_dir = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent";
+                          description = ''
+                            Do not change this unless you are running a custom deployment.
+                            The work_dir represents where the agent will store its data to be able to automatically reauthenticate with your Tailnet.
+                            It needs to be writable by the user running the Headplane process.
+                          '';
+                        };
+                      };
+                    }
+                  );
+                  default = null;
+                  description = "Agent configuration for the Headplane agent.";
+                };
+
+                proc = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        default = true;
+                        description = ''
+                          Enable "Native" integration that works when Headscale and
+                          Headplane are running outside of a container. There is no additional
+                          configuration, but you need to ensure that the Headplane process
+                          can terminate the Headscale process.
+                        '';
+                      };
+                    };
+                  };
+                  default = { };
+                  description = "Native process integration settings.";
+                };
+              };
+            };
+            default = { };
+            description = "Integration configurations for Headplane to interact with Headscale.";
+          };
+
+          oidc = mkOption {
+            type = types.nullOr (
+              types.submodule {
+                options = {
+                  issuer = mkOption {
+                    type = types.str;
+                    description = "URL to OpenID issuer.";
+                    example = "https://provider.example.com/issuer-url";
+                  };
+
+                  client_id = mkOption {
+                    type = types.str;
+                    description = "The client ID for the OIDC client.";
+                    example = "your-client-id";
+                  };
+
+                  client_secret_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the OIDC client secret.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
+                  };
+
+                  disable_api_key_login = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = "Whether to disable API key login.";
+                  };
+
+                  token_endpoint_auth_method = mkOption {
+                    type = types.enum [
+                      "client_secret_post"
+                      "client_secret_basic"
+                      "client_secret_jwt"
+                    ];
+                    default = "client_secret_post";
+                    description = "The token endpoint authentication method.";
+                  };
+
+                  headscale_api_key_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the Headscale API key.
+                      Required when `services.headplane.settings.oidc` is set.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
+                  };
+
+                  redirect_uri = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = ''
+                      This should point to your publicly accessible URL
+                      for your Headplane instance with /admin/oidc/callback.
+                    '';
+                    example = "https://headscale.example.com/admin/oidc/callback";
+                  };
+
+                  user_storage_file = mkOption {
+                    type = types.path;
+                    default = "/var/lib/headplane/users.json";
+                    description = ''
+                      Path to a file containing the users and their permissions for Headplane.
+                    '';
+                    example = "/var/lib/headplane/users.json";
+                  };
+
+                  profile_picture_source = mkOption {
+                    type = types.enum [
+                      "oidc"
+                      "gravatar"
+                    ];
+                    default = "oidc";
+                    description = "Source for user profile pictures.";
+                  };
+
+                  strict_validation = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = "Enable strict validation of OIDC configuration.";
+                  };
+
+                  scope = mkOption {
+                    type = types.str;
+                    default = "openid email profile";
+                    description = "OIDC scope to request.";
+                  };
+
+                  extra_params = mkOption {
+                    type = types.nullOr (types.attrsOf types.str);
+                    default = null;
+                    description = "Extra parameters to send to the OIDC provider.";
+                    example = {
+                      prompt = "consent";
+                    };
+                  };
+
+                  authorization_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom authorization endpoint URL.";
+                    example = "https://provider.example.com/authorize";
+                  };
+
+                  token_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom token endpoint URL.";
+                    example = "https://provider.example.com/token";
+                  };
+
+                  userinfo_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom userinfo endpoint URL.";
+                    example = "https://provider.example.com/userinfo";
+                  };
+                };
+              }
+            );
+            default = null;
+            description = "OIDC Configuration for authentication.";
+          };
+        };
+      };
+      default = { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.headscale.enable;
+        message = ''
+          services.headplane requires services.headscale.enable = true.
+          The headplane module references the headscale systemd unit
+          (in `after`/`requires`) and reads its configFile, port, user,
+          and group. Enable headscale or disable headplane.
+        '';
+      }
+      {
+        assertion = cfg.settings.server.cookie_secret_path != null;
+        message = ''
+          services.headplane.settings.server.cookie_secret_path must be set.
+          Headplane refuses to start without either `cookie_secret` or
+          `cookie_secret_path` (validated at startup, see upstream
+          app/server/config/schema.ts). The NixOS module only exposes the
+          *_path form to keep secrets out of the world-readable /nix/store.
+          Provide a path to a file containing a 32-character secret, e.g.
+          via systemd `LoadCredential` or sops-nix.
+        '';
+      }
+      {
+        assertion =
+          cfg.settings.integration.agent == null
+          || !cfg.settings.integration.agent.enabled
+          || cfg.settings.integration.agent.pre_authkey_path != null;
+        message = ''
+          services.headplane.settings.integration.agent.pre_authkey_path must be set
+          when services.headplane.settings.integration.agent.enabled is true.
+        '';
+      }
+      {
+        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        message = ''
+          services.headplane.settings.oidc.headscale_api_key_path must be set
+          when services.headplane.settings.oidc is non-null. Headplane's OIDC
+          flow requires a Headscale API key to mint sessions; upstream config
+          validation rejects an OIDC block without it.
+        '';
+      }
+    ];
+
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."headplane/config.yaml".source = "${settingsFile}";
+    };
+
+    systemd.services.headplane = {
+      description = "Headscale Web UI";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        config.systemd.services.headscale.name
+      ];
+      requires = [ config.systemd.services.headscale.name ];
+
+      environment = {
+        HEADPLANE_DEBUG_LOG = toString cfg.debug;
+      };
+      serviceConfig = {
+        User = config.services.headscale.user;
+        Group = config.services.headscale.group;
+        StateDirectory = "headplane";
+
+        ExecStart = lib.getExe cfg.package;
+        Restart = "always";
+        RestartSec = 5;
+
+        # TODO: Harden `systemd` security according to the "The Principle of Least Power".
+        # See: `$ systemd-analyze security headplane`.
+      };
+    };
+  };
+}
@@ -83,9 +83,10 @@ localhost).

 Almost all options of Mosquitto are available for configuration at their appropriate levels, some
 as NixOS options written in camel case, the remainders under `settings` with their exact names in
-the Mosquitto config file. The exceptions are `acl_file` (which is always set according to the
-`acl` attributes of a listener and its users) and `per_listener_settings` (which is always set to
-`true`).
+the Mosquitto config file. The exceptions are `per_listener_settings` (which is always set to
+`true`) and the per-listener access control, which is always configured via instances of the
+`acl-file` and `password-file` plugins generated from the `acl` and `users` attributes of each
+listener.

 ### Password authentication {#module-services-mosquitto-config-passwords}

@@ -101,8 +102,8 @@ will not be able to use the broker.

 ### ACL format {#module-services-mosquitto-config-acl}

-Every listener has a Mosquitto `acl_file` attached to it. This ACL is configured via two
-attributes of the config:
+Every listener has an instance of the Mosquitto `acl-file` plugin attached to it. This ACL is
+configured via two attributes of the config:

  * the `acl` attribute of the listener configures pattern ACL entries and topic ACL entries
    for anonymous users. Each entry must be prefixed with `pattern` or `topic` to distinguish
@@ -7,6 +7,8 @@
 let
  cfg = config.services.mosquitto;

+  pluginLibDir = "${lib.getLib cfg.package}/lib";
+
  # note that mosquitto config parsing is very simplistic as of may 2021.
  # often times they'll e.g. strtok() a line, check the first two tokens, and ignore the rest.
  # there's no escaping available either, so we have to prevent any being necessary.
@@ -239,8 +241,8 @@ let
        options = lib.mkOption {
          type = attrsOf optionType;
          description = ''
-            Options for the auth plugin. Each key turns into a `auth_opt_*`
-             line in the config.
+            Options for the plugin. Each key turns into a `plugin_opt_*`
+            line in the config.
          '';
          default = { };
        };
@@ -257,12 +259,13 @@ let
  formatAuthPlugin =
    plugin:
    [
-      "auth_plugin ${plugin.plugin}"
+      "plugin ${plugin.plugin}"
      "auth_plugin_deny_special_chars ${optionToString plugin.denySpecialChars}"
    ]
-    ++ formatFreeform { prefix = "auth_opt_"; } plugin.options;
+    ++ formatFreeform { prefix = "plugin_opt_"; } plugin.options;

  freeformListenerKeys = {
+    accept_protocol_versions = 1;
    allow_anonymous = 1;
    allow_zero_length_clientid = 1;
    auto_id_prefix = 1;
@@ -274,13 +277,18 @@ let
    "ciphers_tls1.3" = 1;
    crlfile = 1;
    dhparamfile = 1;
+    disable_client_cert_date_checks = 1;
+    enable_proxy_protocol = 1;
    http_dir = 1;
    keyfile = 1;
+    listener_allow_anonymous = 1;
+    listener_auto_id_prefix = 1;
    max_connections = 1;
    max_qos = 1;
    max_topic_alias = 1;
    mount_point = 1;
    protocol = 1;
+    proxy_protocol_v2_require_tls = 1;
    psk_file = 1;
    psk_hint = 1;
    require_certificate = 1;
@@ -292,6 +300,7 @@ let
    use_identity_as_username = 1;
    use_subject_as_username = 1;
    use_username_as_clientid = 1;
+    websockets_origin = 1;
  };

  listenerOptions =
@@ -393,10 +402,16 @@ let
    idx: listener:
    [
      "listener ${toString listener.port} ${toString listener.address}"
-      "acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
    ]
-    ++ lib.optional (!listener.omitPasswordAuth) "password_file ${cfg.dataDir}/passwd-${toString idx}"
    ++ formatFreeform { } listener.settings
+    ++ [
+      "plugin ${pluginLibDir}/mosquitto_acl_file.so"
+      "plugin_opt_acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
+    ]
+    ++ lib.optionals (!listener.omitPasswordAuth) [
+      "plugin ${pluginLibDir}/mosquitto_password_file.so"
+      "plugin_opt_password_file ${cfg.dataDir}/passwd-${toString idx}"
+    ]
    ++ lib.concatMap formatAuthPlugin listener.authPlugins;

  freeformBridgeKeys = {
@@ -413,7 +428,11 @@ let
    bridge_outgoing_retain = 1;
    bridge_protocol_version = 1;
    bridge_psk = 1;
+    bridge_receive_maximum = 1;
+    bridge_reload_type = 1;
    bridge_require_ocsp = 1;
+    bridge_session_expiry_interval = 1;
+    bridge_tls_use_os_certs = 1;
    bridge_tls_version = 1;
    cleansession = 1;
    idle_timeout = 1;
@@ -512,6 +531,9 @@ let
    autosave_on_changes = 1;
    check_retain_source = 1;
    connection_messages = 1;
+    enable_control_api = 1;
+    global_max_clients = 1;
+    global_max_connections = 1;
    log_facility = 1;
    log_timestamp = 1;
    log_timestamp_format = 1;
@@ -634,6 +656,13 @@ let
  globalAsserts =
    prefix: cfg:
    lib.flatten [
+      {
+        assertion = lib.versionAtLeast cfg.package.version "2.1";
+        message = ''
+          ${prefix}.package must be at least version 2.1, since the generated
+          configuration relies on the acl-file and password-file plugins.
+        '';
+      }
      (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
      (lib.imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
      (lib.mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
@@ -223,16 +223,23 @@ in
      '')
    ];

-    assertions = concatMap (m: [
-      {
-        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
-        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
-      }
-      {
-        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
-        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
-      }
-    ]) cfg.listen;
+    assertions =
+      (concatMap (m: [
+        {
+          assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+          message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+        }
+        {
+          assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+          message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+        }
+      ]) cfg.listen)
+      ++ [
+        {
+          assertion = cfg.package.pname != "vinyl-cache";
+          message = "services.varnish only supports Varnish Cache. Please use services.vinyl-cache.";
+        }
+      ];

    warnings =
      lib.optional (!isNull cfg.http_address)
@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+
+  cfg = config.services.vinyl-cache;
+
+  # Vinyl Cache has very strong opinions and very complicated code around handling
+  # the stateDir. After a lot of back and forth, we decided that we a)
+  # do not want a configurable option here, as most of the handling depends
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Vinyl Cache anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir = "/var/run/vinyld";
+
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses = (
+    concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen
+  );
+
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvinyld") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr port;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
+  commandLine =
+    "-f ${pkgs.writeText "default.vcl" cfg.config}"
+    +
+      lib.optionalString (cfg.extraModules != [ ])
+        " -p vmod_path='${
+           lib.makeSearchPathOutput "lib" "lib/vinyl/vmods" ([ cfg.package ] ++ cfg.extraModules)
+         }' -r vmod_path";
+in
+{
+  meta.maintainers = [
+    lib.maintainers.leona
+    lib.maintainers.osnyx
+  ];
+  options = {
+    services.vinyl-cache = {
+      enable = lib.mkEnableOption "Vinyl Cache";
+
+      enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
+        default = true;
+      };
+
+      package = lib.mkPackageOption pkgs "vinyl-cache" { };
+
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = [
+          {
+            address = "*";
+            port = 6081;
+          }
+        ];
+      };
+
+      config = lib.mkOption {
+        type = lib.types.lines;
+        description = ''
+          Verbatim default.vcl configuration.
+        '';
+      };
+
+      extraModules = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = ''
+          Vinyl Cache modules (except 'std').
+        '';
+      };
+
+      extraCommandLine = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        example = "-s malloc,256M";
+        description = ''
+          Command line switches for vinyld (run 'vinyld -?' to get list of options)
+        '';
+      };
+
+      enableFileLogging = lib.mkEnableOption "file based logging";
+    };
+
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      systemd.services.vinyl-cache = {
+        description = "Vinyl Cache";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${cfg.package}/bin/vinyld ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+          Restart = "always";
+          RestartSec = "5s";
+          User = "vinyl-cache";
+          Group = "vinyl-cache";
+          DynamicUser = true;
+          RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          NoNewPrivileges = true;
+          LimitNOFILE = 131072;
+        };
+      };
+
+      environment.systemPackages = [ cfg.package ];
+
+      # check .vcl syntax at compile time (e.g. before nixops deployment)
+      system.checks = lib.mkIf cfg.enableConfigCheck [
+        (pkgs.runCommand "check-vinyl-cache-syntax" { } ''
+          ${cfg.package}/bin/vinyld -C ${commandLine} 2> $out || (cat $out; exit 1)
+        '')
+      ];
+
+      assertions =
+        concatMap (m: [
+          {
+            assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+            message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+          }
+          {
+            assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+            message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+          }
+        ]) cfg.listen
+        ++ [
+          {
+            assertion = cfg.package.pname == "vinyl-cache";
+            message = "services.vinyl-cache only supports Vinyl Cache. Please use services.varnish.";
+          }
+        ];
+    })
+    (lib.mkIf (cfg.enable && cfg.enableFileLogging) {
+      systemd.services = {
+        vinylncsa = {
+          after = [ "vinyl-cache.service" ];
+          requires = [ "vinyl-cache.service" ];
+          description = "Vinyl Cache logging daemon";
+          wantedBy = [ "multi-user.target" ];
+          # We want to reopen logs with HUP. vinylncsa must run in daemon mode for that.
+          serviceConfig = {
+            Type = "forking";
+            Restart = "always";
+            RuntimeDirectory = "vinylncsa";
+            LogsDirectory = "vinyl-cache";
+            PIDFile = "/run/vinylncsa/vinylncsa.pid";
+            User = "vinyl-cache";
+            Group = "vinyl-cache";
+            ExecStart = "${cfg.package}/bin/vinylncsa -D -a -w /var/log/vinyl-cache/vinyl-cache.log -P /run/vinylncsa/vinylncsa.pid";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          };
+        };
+      };
+
+      services.logrotate.settings.vinyl-cache = lib.mapAttrs (_: lib.mkDefault) {
+        files = [ "/var/log/vinyl-cache/*.log" ];
+        frequency = "daily";
+        rotate = 14;
+        compress = true;
+        delaycompress = true;
+        postrotate = "systemctl reload vinylncsa";
+      };
+    })
+  ];
+}
@@ -1753,6 +1753,10 @@ in
  victoriametrics = import ./victoriametrics { inherit runTest; };
  victoriatraces = import ./victoriatraces { inherit runTest; };
  vikunja = runTest ./vikunja.nix;
+  vinyl-cache_9 = runTest {
+    imports = [ ./vinyl-cache.nix ];
+    _module.args.package = pkgs.vinyl-cache_9;
+  };
  virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
  vm-variant = handleTest ./vm-variant.nix { };
  vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
@@ -224,7 +224,7 @@ in

      # Now create a pod on each node via a daemonset and verify they can talk to each other.
      server.succeed("kubectl apply -f ${networkTestDaemonset}")
-      server.wait_until_succeeds(f'[ "$(kubectl get ds test -o json | jq .status.numberReady)" -eq {len(machines)} ]')
+      server.wait_until_succeeds("kubectl rollout status daemonset test")

      # Get pod IPs
      pods = server.succeed("kubectl get po -o json | jq '.items[].metadata.name' -r").splitlines()
@@ -0,0 +1,126 @@
+{
+  pkgs,
+  package,
+  lib,
+  ...
+}:
+let
+  testPath = pkgs.hello;
+in
+{
+  name = "vinyl";
+  meta = {
+    maintainers = [
+      lib.maintainers.leona
+      lib.maintainers.osnyx
+    ];
+  };
+
+  nodes = {
+    vinyl =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services.nix-serve = {
+          enable = true;
+        };
+
+        services.vinyl-cache = {
+          inherit package;
+          enable = true;
+          enableFileLogging = true;
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            {
+              address = "/var/run/vinyld/client.http.sock";
+              user = "vinyl-cache";
+              group = "vinyl-cache";
+              mode = "660";
+            }
+          ]
+          ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+            # Support added in 7.3.0
+            { address = "@asdf"; }
+          ];
+          config = ''
+            vcl 4.1;
+
+            backend nix-serve {
+              .host = "127.0.0.1";
+              .port = "${toString config.services.nix-serve.port}";
+            }
+          '';
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        system.extraDependencies = [ testPath ];
+
+        assertions =
+          let
+            cmdline = config.systemd.services.vinyl-cache.serviceConfig.ExecStart;
+          in
+          map
+            (pattern: {
+              assertion = lib.hasInfix pattern cmdline;
+              message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+            })
+            (
+              [
+                " -a 0.0.0.0:80,HTTP "
+                " -a proxyport=0.0.0.0:8080,PROXY "
+                " -a /var/run/vinyld/client.http.sock,HTTP,user=vinyl-cache,group=vinyl-cache,mode=660 "
+              ]
+              ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+                " -a @asdf,HTTP "
+              ]
+            );
+      };
+
+    client =
+      { lib, ... }:
+      {
+        nix.settings = {
+          require-sigs = false;
+          substituters = lib.mkForce [ "http://vinyl" ];
+        };
+      };
+  };
+
+  testScript = ''
+    from pathlib import Path
+    import os
+
+    start_all()
+    vinyl.wait_for_open_port(80)
+    vinyl.wait_for_unit("vinylncsa")
+
+    client.wait_until_succeeds("curl -f http://vinyl/nix-cache-info");
+
+    client.wait_until_succeeds("nix-store -r ${testPath}")
+    client.succeed("${testPath}/bin/hello")
+
+    output = vinyl.succeed("vinyladm status")
+    print(output)
+    assert "Child in state running" in output, "Unexpected vinyladm response"
+
+    vinyl.copy_from_machine("/var/log/vinyl-cache/vinyl-cache.log")
+
+    out_dir = os.environ.get("out", os.getcwd())
+    vinyl_log = (Path(out_dir) / "vinyl-cache.log").read_text()
+    assert "http://vinyl/nix-cache-info" in vinyl_log
+  '';
+}
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-gba";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-gba-libretro";
-    rev = "6cee80685f735ea6c2373db2622a1f1ee9f39d39";
-    hash = "sha256-a3XgExXVCUFw3GLCUkEl6now2L8qVdNOaXvrDMcT1ZE=";
+    rev = "145d4884ad246e3c16765f6d69decb2a4359b6ae";
+    hash = "sha256-4LRMPsPrYvdTJGcbbS3ZyimrWKxZSU+bP0SxUMLkYgE=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-pcfx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-pcfx-libretro";
-    rev = "035191393485280cad1866ce3aedd626d4fa09d0";
-    hash = "sha256-jchEbKvHSE4D90ezwi//nl8vefQD4gp6YWb0eb6zkeY=";
+    rev = "650c30ea2203636a1716675854d11c608ed6eacc";
+    hash = "sha256-xB3O7N23bS2IAaWuvxIXfVodua8s1dcbZ2XAB0Lt6gc=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "81";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "81-libretro";
-    rev = "f9e5fa3bef9a6d6e1e19a4b1c7e5922467b582a2";
-    hash = "sha256-c/0L0NLAFyyjQcPNmmfHW29i1As4Wk2/U3qKtClk1VE=";
+    rev = "fa7094910d040baa5fd8b11dbf6a1a618330ecd9";
+    hash = "sha256-TuAx8frehC9h+s77xcigydMxvHXLzIc/q1y4vK8/WuI=";
  };

  meta = {
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
  core = "melonds";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "melonds";
-    rev = "e548eba517ccb964ddba31dcf8f0136041f5bb05";
-    hash = "sha256-4bCunBPpBP0RWwL1vUTQxLPtCBnQ0M5pC3GAX1uTL5A=";
+    rev = "634e51477364edc39aaccd3bebf8bcab5776148c";
+    hash = "sha256-/u6CQKpb9eIls0TYpSpWoIf+IQ0CTIx48oq8LscfhFw=";
  };

  extraBuildInputs = [
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "neocd";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "neocd_libretro";
-    rev = "9216ca226f24e01e77fc2670035e97da154f3de4";
-    hash = "sha256-Mq9UOuPwmG2Di68jWUgCbBvG3jUCEMON8Kfly/aCdH4=";
+    rev = "9e9ad181bed60f84f9cff02c03617b41e8a31cfe";
+    hash = "sha256-1rmoV6jxClTSRWNzsYepP8VSHKbSB+HUOLkvRrvYz/c=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "tgbdual";
-  version = "0-unstable-2025-05-10";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "tgbdual-libretro";
-    rev = "933707c0ba8f12360f6d79712f735a917713709a";
-    hash = "sha256-58OLuF14aSJGhmXR0RGgPpuHLXYk9LOz7LX03AEFPr4=";
+    rev = "12540f0b2d3783259a0dce34ac8aa7a86beeaa11";
+    hash = "sha256-l+WiFC5GxbdY9ulmtdqd2iKU7qKoVWqcf4YR/waSVhQ=";
  };

  makefile = "Makefile";
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "yabause";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "yabause";
-    rev = "76faf7c601359bafc41785325d686644000a7ba9";
-    hash = "sha256-UHmUsqAK+As6qfvhto2aOsW9A/lZMypfn2NxFui2x8c=";
+    rev = "7cb15b8f9eea5a6fa7cae34468a6989522bcba75";
+    hash = "sha256-UWZgt0vdjncM7JCzdSWa4XZMJBJ/pnk4QpSKz459Fq0=";
  };

  makefile = "Makefile";
@@ -1,138 +0,0 @@
-{
-  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "b2b1ce6fc213202829513dd99997de7979dc5dd26f4fad8e02918848928ac892"
-  },
-  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "9aae79e102c20418d184906f5e1e36bb01c6a2c41b7e9405b2a20816d0ec58ff"
-  },
-  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "52bdb3ebd6f2cbe4fe0a1894dda8f853e33bc31eaee83a352d014f3464168116"
-  },
-  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "86f6f5cfe607e15eeb7a35522325ccbea56f1d84ca27cd02c626e4356ca54c56"
-  },
-  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "1fbe1a2c48fcedcec613cee071f0b524f007a191c858952c0c6243c28a292e30"
-  },
-  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "7e3f80b037079922f6a0aaf5a701459ef550d67ca31119a0c74955254fa52b1e"
-  },
-  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "1152d6f24c5b955e37300cbfcd68a8c212c1036ce8964e2ffc22422522fa1d83"
-  },
-  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "50f4d1b1bb03523b922d7ce989d2d83f009d751d7fbf4aa8821fe52c9b9fd96d"
-  },
-  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "c28b224620327061bb707c31733c3428a7573e2f905178ddd9d038dec7d00370"
-  },
-  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "8db98924c2e9534574bab2584b08467cc1c379e740d345b8bad3768d1bed4c5f"
-  },
-  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "b6a8a882c1285687a78add12e4be64c335f13de8975f9bb7c142aadbaa1f10c5"
-  },
-  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "7ea32966e4a4fb2ad0c5fae8eece897d22e1a1515ce7d7954f7aa341c6ca51ac"
-  },
-  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "02c940745706a79eedb0b579f2368cdbdf8c54de148f4d8fda70f7ee66d7ecf2"
-  },
-  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "a52feceeb43d21fb8494def190841a046b896c4dfc8e964f3646916f1b20f829"
-  },
-  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "2d2e23a72f23bedee62d2163df68009fc099ae9c3de1aa34c5cbcfa75f1a8e73"
-  },
-  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "e872a4ceb854138916c4a283904f658398c6894e2595c348b40f03e1cdcc6f86"
-  },
-  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "a3f60044c7da90d4c2dd5cbc44c897ffcc2660bd1d2dcafa8a900bf8ca100589"
-  },
-  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "d843630e86003cf4b18a1ef070b44c3a73e1431770244e853eafcecdb714bfa3"
-  },
-  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "e4a605d5af2a79bd7901f1678e488f776774916e1c5104090e813bd45a257bc3"
-  },
-  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "c94fecb19b6b1eaa347c49fc60def2e1251d866714e9ab05ea6ce29d5da41fb3"
-  },
-  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "d0d213e4e6a3931950b5b61f67c9c0163838095f3fb5486e9256902aff397547"
-  },
-  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "6a914bba0f07f9f3431058f2b1b2c5ed9d8124069f436bfea747c293b5276dff"
-  },
-  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "a133106b2348dcbfa28c7b219a22e6cc7cf399a741196c1a435a211050aba4b5"
-  },
-  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "0a28d456de6bdc33b806a236e0732c5bcb8bd01dc0e64e84eb2daee51467dace"
-  },
-  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "7df59c19b452c971cd5e739042d0cc3146ba061f3e54aeae25794203592e6866"
-  },
-  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "83c9451a8dfc116bddc38146f2a6eddef95d09348386e2b11c7d5479a114de34"
-  },
-  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "77a270820a7955fe9bc7b0d2b6b4b6b8b73e6f042ddd9101b89d1cc0a1b95908"
-  },
-  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "d3eb6dab20944a417d0cbc6eed3a4838c008646a40c3e6b637729f7f9251ff8c"
-  },
-  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "24f246a655706dbcfc34fb1fbe055978f79bee25791e3ba8c0239cd370b3630a"
-  },
-  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
-  },
-  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "1f553eb44e38ffe20cae2a8297c249b3d46fa1ddee859b5823102077525e2ca7"
-  },
-  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
-  },
-  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "a38d2489e69e4e25ecba96c3ecc91d087df4eb0ebb7f7dbffc9a25f3fef9e823"
-  },
-  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "768defc1af4754f6a77ac7fda8bf9472764dab3cc82b9b3f8f9622ed17fb311c"
-  }
-}
@@ -1,13 +0,0 @@
-{
-  rke2Version = "1.32.13+rke2r1";
-  rke2Commit = "a361386c83e8e581c2634a408bc7e4dd44fdcedc";
-  rke2TarballHash = "sha256-jEr7wTMRUk0dOO50G0+iIKywVlBM5Et//nbt7R2mu/0=";
-  rke2VendorHash = "sha256-rptP0Pb5tgufcXMmtaYaNk/Lyqp1bmlk9upm2amKfno=";
-  k8sImageTag = "v1.32.13-rke2r1-build20260227";
-  etcdVersion = "v3.5.26-k3s1-build20260227";
-  pauseVersion = "3.6";
-  ccmVersion = "v1.32.12-0.20260211145907-0dc662e80238-build20260211";
-  dockerizedVersion = "v1.32.13-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
-  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
-}
@@ -5,8 +5,6 @@ let
  extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_32 = common (import ./1_32/versions.nix) extraArgs;
-
  rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;

  rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "alistral";
-  version = "0.6.6";
+  version = "0.6.7";

  src = fetchFromGitHub {
    owner = "RustyNova016";
    repo = "Alistral";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b6htcjBdh4E9cCUw4ETl3AnmMO3yT6654PLKIGPOPlo=";
+    hash = "sha256-XsN4UyIXkd0YVtO/q9EcFP/sBYkH9leISmbJZ93ef6E=";
  };

-  cargoHash = "sha256-Udbf0h8XZ8uD7MLTNRKaIJ8AdTvzq1dDQKPXWXunR/w=";
+  cargoHash = "sha256-KFNFioZ/5moC5FNXw+hA+NrPjsqu+3V8A5mtZ4FZUHw=";

  buildNoDefaultFeatures = true;
  # Would be cleaner with an "--all-features" option
@@ -15,10 +15,10 @@

 let
  source = {
-    version = "2.33.2";
-    hash = "sha256-YsKUoJ0SlBO3fAbMvzaEEIgo90HclB+0iLVIH4LDmEY=";
-    npmDepsHash = "sha256-h/5brNurUEMHTSu2PGODhRtIenGzhsNM558i85Cs86w=";
-    clientNpmDepsHash = "sha256-EbXkHRjOE1A7Sk4MhbJFuBwG/VY+SHhHYjscsXkSMjU=";
+    version = "2.34.0";
+    hash = "sha256-ZHPrNQ36+bS5wwoiKUQKkGLnKhHKpftI3kQ08ItReWI=";
+    npmDepsHash = "sha256-8y0+3zj3UH5wi9Nbl7X5rne0/tzz6Bf7HrxZpYVYZ3Y=";
+    clientNpmDepsHash = "sha256-xna4tZK40dOew380exp/XR32ekyiFVCTWgWNE9BpTl8=";
  };

  src = fetchFromGitHub {
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "better-commits";
-  version = "1.19.1";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "Everduin94";
    repo = "better-commits";
    tag = "v${version}";
-    hash = "sha256-4akYngeDf7EqLxCzObjb5MUA8Cb3X3jlrvLEM71OcCA=";
+    hash = "sha256-JgAe55aMr6gP9/dEj3rDW5glA+ntftthJSCFYvtmWso=";
  };

-  npmDepsHash = "sha256-vtUtdgOJEQk9PzxOz7AlwOxWS6PTjAtrjAugXRXo89c=";
+  npmDepsHash = "sha256-7+WMrkAYKQgUdOBI4jSOTt6gxwfCwft4GcUKMvpTiYc=";

  passthru.updateScript = nix-update-script { };

@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chainsaw";
-  version = "2.14.1";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "WithSecureLabs";
    repo = "chainsaw";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-M+gHsh4u5CEZndMn5sUFk/69ojyaL2AftF8Ao0mKmtY=";
+    hash = "sha256-FsetcuVl1JHkVy4Haal6e16NLQz+zS9mFyqH65Qr5zU=";
  };

-  cargoHash = "sha256-NFyo6elDsqjFI4Kr9BG2ppM8DXictY+N+D3G5+89TJU=";
+  cargoHash = "sha256-UumlqHRssy401iiZSMq5N5r8a2f6ZLoqPuyBoDHPxYg=";

  ldflags = [
    "-w"
@@ -7,17 +7,21 @@
  libcap,
  libite,
  libuev,
+  shadow,
+  sysctl,
+  plymouth,
+  plymouthSupport ? false,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "finit";
-  version = "4.16";
+  version = "4.17";

  src = fetchFromGitHub {
    owner = "finit-project";
    repo = "finit";
    tag = finalAttrs.version;
-    hash = "sha256-DtocGgFvt7RLqwjHczwUbsszBD5MQI5fEuq9EB2tFp4=";
+    hash = "sha256-sH4xZNMEuIS+r6rVQAKnsHtSyTe2B6gdYcmH9J8eSZ0=";
  };

  postPatch = ''
@@ -57,12 +61,21 @@ stdenv.mkDerivation (finalAttrs: {

    # monitor kernel events, like ac power status
    "--with-keventd"
+  ]
+  ++ lib.optionals plymouthSupport [
+    "--enable-plymouth-plugin=yes"
  ];

-  env.NIX_CFLAGS_COMPILE = toString [
-    "-D_PATH_LOGIN=\"/run/current-system/sw/bin/login\""
-    "-DSYSCTL_PATH=\"/run/current-system/sw/bin/sysctl\""
-  ];
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-D_PATH_LOGIN=\"${shadow}/bin/login\""
+      "-DSYSCTL_PATH=\"${sysctl}/bin/sysctl\""
+    ]
+    ++ lib.optionals plymouthSupport [
+      "-DPLYMOUTH_PATH=\"${plymouth}/bin/plymouth\""
+      "-DPLYMOUTHD_PATH=\"${plymouth}/bin/plymouthd\""
+    ]
+  );

  meta = {
    description = "Fast init for Linux";
@@ -16,13 +16,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "firefly-iii-data-importer";
-  version = "2.2.3";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "firefly-iii";
    repo = "data-importer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2/zfxBggXK9mJDpuofQyMZ+WWV0OHyUWTUU+4CRNOUQ=";
+    hash = "sha256-JLN13SCpMXByu3rWSclcsLBGCLFMzHGHOM+bWLJ2MPw=";
  };

  buildInputs = [ php ];
@@ -42,12 +42,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  composerStrictValidation = true;
  strictDeps = true;

-  vendorHash = "sha256-0p0xPBX4nKFYlpIvGVZU7ay+btjpxBO2s73wzysSzUU=";
+  vendorHash = "sha256-QobjMMPEhLvsTwlJJvf4nUi1PcZEDOaU8EzexluOI90=";

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
    name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-baPsbZwGu1tx6bMH2tWcZVlkZuIpSflwj9JyX9vQW/U=";
+    hash = "sha256-NkxCvC0EPMLi7GV5GG1+5niL3KIaqBsleo11/gzaX/s=";
  };

  composerRepository = php.mkComposerRepository {
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "newt";
-  version = "1.10.4";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "newt";
    tag = finalAttrs.version;
-    hash = "sha256-Dtzx/Rs7aa2GkG7Qq4pvGN4ghfS7EyVhx7rQh8sRlQU=";
+    hash = "sha256-csD7QcSQE4/eRw3EHX0m2nI3JjglFxXlnyuS4xpCmRY=";
  };

-  vendorHash = "sha256-vy6Dqjek7pLdASbCrM9snq5Dt9lbwNJ0AuQboy1JWNQ=";
+  vendorHash = "sha256-+zMSzNbqmWm/DXL2xMUd5uPP5tSIybsRokwJ2zd0pf0=";

  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "olm";
-  version = "1.4.4";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "olm";
    tag = finalAttrs.version;
-    hash = "sha256-G2kYzYg4RUFHgW9z44PcQPK85FsD5SVBefpzBKIwUw0=";
+    hash = "sha256-OnHOfP3dCduTe0xnZD77YZcI3GOKxGsen5i7dOiCjy8=";
  };

-  vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";
+  vendorHash = "sha256-+KQpYGoyNI2SnEjj23GM0FqZFX6lHx7oNw9qdkkgcPU=";

  ldflags = [
    "-s"
@@ -10,16 +10,19 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "harmonia";
-  version = "3.0.0";
+  version = "3.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "harmonia";
    tag = "harmonia-v${finalAttrs.version}";
-    hash = "sha256-BovRI3p2KXwQ6RF49NqLc0uKP/Jk+yA8E0eqScaIP68=";
+    hash = "sha256-fm8PBugKnw72/dAXsRj84jf4EZK1BcVEdEWgtojIuA0=";
  };

-  cargoHash = "sha256-X3A+gV32itmt0SqepioT64IGzHfrCdLsQjF6EDwCTbo=";
+  cargoHash = "sha256-qp4frhNsWDma8uYcRe3BXmfIu6btYb8IaoXhk4oI4qM=";

  doCheck = false;

@@ -0,0 +1,39 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "headplane-agent";
+  __structuredAttrs = true;
+  # Note, if you are upgrading this, you should upgrade headplane at the same time
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+  subPackages = [ "cmd/hp_agent" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+  env.CGO_ENABLED = 0;
+
+  meta = {
+    description = "Optional sidecar process providing additional features for headplane";
+    homepage = "https://github.com/tale/headplane";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "hp_agent";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
@@ -0,0 +1,119 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  git,
+  lib,
+  makeWrapper,
+  nodejs_22,
+  pnpm_10,
+  pnpmConfigHook,
+  stdenv,
+}:
+let
+  pname = "headplane";
+  # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
+  version = "0.6.1";
+  pnpmDepsHash = "sha256-AYfEL3HSRg87I+Y0fkLthFSDWgHTg5u0DBpzn6KBn1Q=";
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  headplaneSshWasm = buildGoModule {
+    pname = "headplane-ssh-wasm";
+    inherit version src;
+    subPackages = [ "cmd/hp_ssh" ];
+    vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+    env.CGO_ENABLED = 0;
+    doCheck = false;
+    buildPhase = ''
+      export GOOS=js
+      export GOARCH=wasm
+      go build -o hp_ssh.wasm ./cmd/hp_ssh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm444 hp_ssh.wasm "$out/hp_ssh.wasm"
+
+      # Go's WebAssembly shim (wasm_exec.js) has no stable `go env` key, and
+      # different Go packages may place it in different locations under GOROOT.
+      #   1. Ask `go env GOROOT` for the active GOROOT.
+      #   2. First try the path misc/wasm/wasm_exec.js.
+      #   3. If that fails, fall back to searching under GOROOT to handle
+      #      distro / OS / packaging layout variations.
+      goRoot="$(go env GOROOT)"
+
+      wasm_exec="$goRoot/misc/wasm/wasm_exec.js"
+      if [ ! -e "$wasm_exec" ]; then
+        wasm_exec="$(find "$goRoot" -path '*wasm_exec.js' -print -quit || true)"
+      fi
+
+      if [[ -z "$wasm_exec" || ! -e "$wasm_exec" ]]; then
+        echo "ERROR: wasm_exec.js not found under GOROOT=$goRoot" >&2
+        exit 1
+      fi
+
+      install -Dm444 "$wasm_exec" "$out/wasm_exec.js"
+      runHook postInstall
+    '';
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    git
+    makeWrapper
+    nodejs_22
+    pnpm_10
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    hash = pnpmDepsHash;
+    fetcherVersion = 3;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    cp ${headplaneSshWasm}/hp_ssh.wasm app/hp_ssh.wasm
+    cp ${headplaneSshWasm}/wasm_exec.js app/wasm_exec.js
+    pnpm --offline build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/headplane}
+    cp -r build $out/share/headplane/
+    cp -r node_modules $out/share/headplane/
+    cp -r drizzle $out/share/headplane/
+    substituteInPlace $out/share/headplane/build/server/index.js \
+      --replace "$PWD" "../.."
+    makeWrapper ${lib.getExe nodejs_22} $out/bin/headplane \
+      --chdir $out/share/headplane \
+      --add-flags $out/share/headplane/build/server/index.js
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Feature-complete Web UI for Headscale";
+    homepage = "https://github.com/tale/headplane";
+    changelog = "https://github.com/tale/headplane/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "headplane";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
@@ -49,7 +49,7 @@ in

 ags.bundle {
  pname = "hyprpanel";
-  version = "0-unstable-2026-03-23";
+  version = "0-unstable-2026-04-23";

  __structuredAttrs = true;
  strictDeps = true;
@@ -57,8 +57,8 @@ ags.bundle {
  src = fetchFromGitHub {
    owner = "Jas-SinghFSU";
    repo = "HyprPanel";
-    rev = "e919b4a8a8ab5f2a0752f68576ab3eed6993cefd";
-    hash = "sha256-92ZbaBfsEXEE7VaWJjv9aRSk3l9nyoYYyMe2AwTqSZI=";
+    rev = "1961ba86ad5ab880beb639e5454054b2b5037e0d";
+    hash = "sha256-QowlCOrE4jGOTDCUCEx/E8gHjqSx3r25y7v4dEBpBhk=";
  };

  # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
@@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "inko";
-  version = "0.19.1";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "inko-lang";
    repo = "inko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZHVOwYvNRL2ObZt2PvayoqvS64MumN4oXQOgeCWbEUM=";
+    hash = "sha256-Bisw84MwdLb2pgzwQ5zpZiyNHSWtdJ2QpaFn40x+SdI=";
  };

-  cargoHash = "sha256-BHrbqPMQnhw8pjN8e0/qW1rPe/fMhs2iUbRVPt5ATrg=";
+  cargoHash = "sha256-+3U3rMVF3qwyTIGOb/6NIxSBdiLuf/uY/VL3tYHte+c=";

  buildInputs = [
    libffi
@@ -41,12 +41,11 @@
    ]
  ),
  writeScript,
-  fetchpatch2,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "lilypond";
-  version = "2.24.4";
+  version = "2.26.0";
  outputs = [
    "out"
    "man"
@@ -54,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchzip {
    url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor finalAttrs.version}/lilypond-${finalAttrs.version}.tar.gz";
-    hash = "sha256-UYdORvodrVchxslOxpMiXrAh7DtB9sWp9yqZU/jeB9Y=";
+    hash = "sha256-HUkPhaWNZ4UKbmlEyLXepHCFcgrdoRSDtjZMriO68RM=";
  };

  postInstall = ''
@@ -79,18 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail "mem=mf2pt1" "mem=$PWD/mf/mf2pt1"
  '';

-  patches = [
-    # fixes #475503
-    # distilled version of https://gitweb.git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=f2192eb294e
-    # so, remove once that commit reaches a stable release
-    (fetchpatch2 {
-      name = "fix-clang-21-build.patch";
-      url = "https://cgit.freebsd.org/ports/plain/print/lilypond/files/patch-lily_include_smobs.hh?id=58bab68c706086774b17dcacc61c8fd37ecc8a15";
-      extraPrefix = ""; # adds old/new prefixes to process properly in patchPhase
-      hash = "sha256-nT8+nYU+m6lLTvHEvSIpG/yAwy1Omb6+4Z+NGwEVE4Q=";
-    })
-  ];
-
  strictDeps = true;

  depsBuildBuild = [
@@ -7,11 +7,13 @@
  libxslt,
  c-ares,
  cjson,
+  libargon2,
  libuuid,
  libuv,
  libwebsockets,
  openssl,
  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  sqlite,
  systemd,
  uthash,
  nixosTests,
@@ -32,13 +34,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mosquitto";
-  version = "2.0.22";
+  version = "2.1.2";
+  # Tests disabled: upstream test suite requires additional Python deps,
+  # uses chown() to fixed UIDs, and relies on signal handling that breaks
+  # in sandboxed builds. Re-enable once upstream tests are sandbox-friendly.
+  doCheck = false;

  src = fetchFromGitHub {
-    owner = "eclipse";
+    owner = "eclipse-mosquitto";
    repo = "mosquitto";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PCiNxRG2AqVlS2t/u7Cqn8NbTrrYGO1OXl8zvPQRrJM=";
+    hash = "sha256-Zl55yjuzQY2fyaKs/zLaJ7a3OONKTDQPaT+DpPURdZI=";
  };

  postPatch = ''
@@ -63,22 +69,27 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    c-ares
    cjson
+    libargon2
    libuuid
    libuv
    libwebsockets'
    openssl
+    sqlite
    uthash
  ]
  ++ lib.optional withSystemd systemd;

+  propagatedBuildInputs = [ cjson ];
+
  cmakeFlags = [
    (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
    (lib.cmakeBool "WITH_WEBSOCKETS" true)
    (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
  ];

  postFixup = ''
-    sed -i "s|^prefix=.*|prefix=$lib|g" $dev/lib/pkgconfig/*.pc
+    sed -i "s|^libdir=.*|libdir=$lib/lib|g" $dev/lib/pkgconfig/*.pc
  '';

  passthru.tests = {
@@ -37,6 +37,20 @@ stdenv.mkDerivation (finalAttrs: {
    patchShebangs --build ./config
    patchShebangs --build ./contrib
    patchShebangs --build ./src/util/convert-help.py
+
+  ''
+  # 1. Remove the build information (options to configure and the CC path)
+  # These are hardcoded in the library and create an unwanted dependency
+  # on *.dev inputs.
+  # 2. Remove the reference to the pmix include directories, which are
+  # also hardcoded into the library (would be a cyclic reference).
+  + ''
+    substituteInPlace ./src/runtime/pmix_info_support.c \
+      --replace-fail 'PMIX_CONFIGURE_CLI' '""' \
+      --replace-fail 'PMIX_CC_ABSOLUTE' '""'
+
+    substituteInPlace ./src/mca/pinstalldirs/config/pinstall_dirs.h.in \
+      --replace-fail '@includedir@' ""
  '';

  nativeBuildInputs = [
@@ -91,10 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  postFixup = lib.optionalString (lib.elem "dev" finalAttrs.outputs) ''
-    # The build info (parameters to ./configure) are hardcoded
-    # into the library. This clears all references to $dev/include.
-    remove-references-to -t "''${!outputDev}" $(readlink -f $out/lib/libpmix.so)
-
    # The path to the pmixcc-wrapper-data.txt is hard coded and
    # points to $out instead of dev. Use wrapper to fix paths.
    wrapProgram "''${!outputDev}"/bin/pmixcc \
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "pur";
-  version = "7.3.3";
+  version = "7.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "alanhamlett";
    repo = "pip-update-requirements";
    tag = finalAttrs.version;
-    hash = "sha256-zSEzYYpDmu3fennTZNvQjAoMekzxoMDUEqvSjN6hNUk=";
+    hash = "sha256-BxUR4yyT6ipvBozWgat709rNPHELE/PNPVJ4LtfOdfQ=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "qovery-cli";
-  version = "1.157.6";
+  version = "1.158.0";

  src = fetchFromGitHub {
    owner = "Qovery";
    repo = "qovery-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zkTiGo8QtcE4TrmYpuXBzq/b9IJQ4e3T3h11NbuFRM0=";
+    hash = "sha256-b6nvJPLMvqXM+hYJzOG65G15N+ErJnWySQrjJQmsMe8=";
  };

  vendorHash = "sha256-kENqEnk5RxN8kJ/dnXtG6ypnb8CPcOsHKid1z6uuKAc=";
@@ -7,6 +7,14 @@
 }:

 linkFarm "zig-packages" [
+  {
+    name = "aro-0.0.0-JSD1Qi7QNgDnfcrdEJf82v3o6MhZySjYVrtdfEf3E4Se";
+    path = fetchgit {
+      url = "https://github.com/Vexu/arocc";
+      rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+      hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
+    };
+  }
  {
    name = "pixman-0.3.0-LClMnz2VAAAs7QSCGwLimV5VUYx0JFnX5xWU6HwtMuDX";
    path = fetchzip {
@@ -15,24 +23,25 @@ linkFarm "zig-packages" [
    };
  }
  {
-    name = "wayland-0.4.0-lQa1khbMAQAsLS2eBR7M5lofyEGPIbu2iFDmoz8lPC27";
-    path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.4.0.tar.gz";
-      hash = "sha256-ulIII5iJpM/W/VJB0HcdktEO2eb9T9J0ln2A1Z94dU4=";
+    name = "translate_c-0.0.0-Q_BUWlX1BgCD1wo6uo97prlp9VJ4gxAjwN_vZ7nsSjGN";
+    path = fetchgit {
+      url = "https://codeberg.org/ziglang/translate-c/";
+      rev = "57c559cf581b1fcad90494eda219f98abeb155ce";
+      hash = "sha256-7OlW2f5tRc1UZySDcEQERsLGChSxIcJAiVWdvuFUvvY=";
    };
  }
  {
-    name = "wayland-0.5.0-lQa1knz8AQCh08NA8BeQrwJB9U3CfqcVAdHZYGRKIGuu";
+    name = "wayland-0.6.0-lQa1kqz8AQADQmdNJsNhLoNHcnEGEUjrOaPV-dtEnEmX";
    path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.5.0.tar.gz";
-      hash = "sha256-mhqOtC26iACIvQUq74AbLSXSPsnWMi3AvDV7G2uElpo=";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.6.0.tar.gz";
+      hash = "sha256-3m/ITNhZUJ/5uD/Tqm+0uZSktGoYgWF5oldOqOCUkIE=";
    };
  }
  {
-    name = "wlroots-0.20.0-jmOlcmtCBADS6eoJ6mkeiSNZkibrhD-c5Qwn-LiM86r1";
+    name = "wlroots-0.20.1-jmOlcqNVBAB3uB5oqBTzpRlwu-FmMyyZMVAWCe5kmcSt";
    path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.0.tar.gz";
-      hash = "sha256-QblQBVsDV2kSj31jqmVVi4hQUXuv8bsRgRMaCqlNxNM=";
+      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.1.tar.gz";
+      hash = "sha256-cfzHJ2ziiCkMyNlIo6I9o/NjaZGrsv22hq41WYwCnpk=";
    };
  }
  {
@@ -18,14 +18,16 @@
  wayland-scanner,
  wlroots_0_20,
  xwayland,
-  zig_0_15,
+  zig_0_16,
  withManpages ? true,
  xwaylandSupport ? true,
 }:
-
+let
+  zig = zig_0_16;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "river";
-  version = "0.4.2";
+  version = "0.4.5";

  outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];

@@ -33,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "river";
    repo = "river";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Nufonz39XphxPW1lERq2acVgE5mGmW+x1yimyS6O4tc=";
+    hash = "sha256-q4JAlr9/ex+BEgktBmFwOvZzQEAGvxXPD1QyKqyha4g=";
  };

  strictDeps = true;
@@ -44,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    wayland-scanner
    xwayland
-    zig_0_15
+    zig
  ]
  ++ lib.optional withManpages scdoc;

@@ -43,20 +43,20 @@ in

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sparkle";
-  version = "1.26.3";
+  version = "1.26.4";

  src = fetchFromGitHub {
    owner = "xishang0128";
    repo = "sparkle";
    tag = finalAttrs.version;
-    hash = "sha256-36eqSgXDl3ASDO4wn8cCptSE4qf3FwFyl+TEhCzhGwA=";
+    hash = "sha256-+3MHCy1N1/kOVFYDNvNiP/jkL0HHi2RwfeIqe2Z40O8=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-uiUp2YtPMvG0d9GIedxNzkY0TR/bdbWQv4IFiVZew5s=";
+    hash = "sha256-Us4qsCJdRZKYJQAgcqeStX7MfEqBWr4rKXBqU2K+KZI=";
  };

  nativeBuildInputs = [
@@ -24,14 +24,14 @@

 stdenv.mkDerivation rec {
  pname = "tev";
-  version = "2.10.0";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "Tom94";
    repo = "tev";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-o8ejMsaiplnTLiWtjaJnV9z2ZNkiOWy3DLU+x49MJrg=";
+    hash = "sha256-o5Yrlt39RGKjtfqMfq3w/JTPORuKbxTIX5uuF4zmGXk=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux (
@@ -8,13 +8,13 @@

 buildGo126Module (finalAttrs: {
  pname = "tsgolint";
-  version = "0.22.0";
+  version = "0.22.1";

  src = fetchFromGitHub {
    owner = "oxc-project";
    repo = "tsgolint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tB+39Z6KpNj6/mejB/+Zxe4evdlGAnQW1LJtH3pQlVw=";
+    hash = "sha256-v6gSUeBcjSx/3/hjBST3ba6N366GQvryVTeAjV5+zEc=";
    fetchSubmodules = true;
  };

@@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.140.0";
+  version = "1.141.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f/qcUSf/JMfe0rTUY5qT9k7MCVqsZCwRzsCv6puz6tw=";
+    hash = "sha256-eMaCChrv3/w7KNlnLdV1/YGGh4ZMGqeNAnMV1OlIQWE=";
  };

  vendorHash = null;
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "xnldorker";
-  version = "4.3";
+  version = "4.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xnl-h4ck3r";
    repo = "xnldorker";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YOYBEoYZBZfGtnJKku88XMj56JSN/EP9jLvqNXNqNJs=";
+    hash = "sha256-2Oh341KTxD47aZVTikDMFs6e4HGfQ77BPptksw+6w7s=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "elm-review";
-  version = "2.13.4";
+  version = "2.13.5";

  src = fetchFromGitHub {
    owner = "jfmengels";
    repo = "node-elm-review";
    rev = "v${version}";
-    hash = "sha256-rhNLIShZERxrzdTdrPcthTQ+gHUikgR0jchBfcBDGTo=";
+    hash = "sha256-IjaPJ9ic/5Z8pdtziNwLqzXfnSmgkurjC6afmNIX4LU=";
  };

-  npmDepsHash = "sha256-mI94fYNKZ9Jx1Iyo/VjZqaXQ64tZA2S8mtn5l6TtCSc=";
+  npmDepsHash = "sha256-eY9U9mLVL9tizN8touWQfLqFAJJ8pHaSHVD//cvNdhE=";

  postPatch = ''
    sed -i "s/elm-tooling install/echo 'skipping elm-tooling install'/g" package.json
@@ -32,7 +32,7 @@ buildNpmPackage rec {
  };

  meta = {
-    changelog = "https://github.com/jfmengels/node-elm-review/blob/v${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/jfmengels/node-elm-review/blob/main/CHANGELOG.md";
    description = "Analyzes Elm projects, to help find mistakes before your users find them";
    mainProgram = "elm-review";
    homepage = "https://github.com/jfmengels/node-elm-review";
@@ -9,11 +9,11 @@
  runCommand,
  bintools,
  # A package with CGO_ENABLED=0
-  athens,
+  uplosi,
 }:
 let
  skopeo' = skopeo.override { buildGoModule = buildGoModule; };
-  athens' = athens.override { buildGoModule = buildGoModule; };
+  uplosi' = uplosi.override { buildGoModule = buildGoModule; };
  expectedCgoEnabledType = "DYN";
  expectedCgoDisabledType = "EXE";
 in
@@ -24,7 +24,7 @@ in
    command = "go version";
    version = "go${go.version}";
  };
-  athens = testers.testVersion { package = athens'; };
+  uplosi = testers.testVersion { package = uplosi'; };
 }
 # bin type tests assume ELF file + linux-specific exe types
 // lib.optionalAttrs stdenv.hostPlatform.isLinux {
@@ -41,13 +41,13 @@ in
      exit 1
    fi
  '';
-  athens-bin-type = runCommand "athens-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
-    bin="${lib.getExe athens'}"
+  uplosi-bin-type = runCommand "uplosi-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
+    bin="${lib.getExe uplosi'}"
    ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) ''
      # For CGO_ENABLED=0 the internal linker should be used, except
      # for cross where we rely on external linking by default
-      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe athens'} | grep -Fq "GCC: (GNU)"; then
-        echo "${lib.getExe athens'} has a GCC .comment, but it should have used the internal go linker"
+      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe uplosi'} | grep -Fq "GCC: (GNU)"; then
+        echo "${lib.getExe uplosi'} has a GCC .comment, but it should have used the internal go linker"
        exit 1
      fi
    ''}
@@ -23,12 +23,12 @@ in
 {
  julia_110-bin = wrapJulia (
    callPackage (import ./generic-bin.nix {
-      version = "1.10.10";
+      version = "1.10.11";
      sha256 = {
-        x86_64-linux = "6a78a03a71c7ab792e8673dc5cedb918e037f081ceb58b50971dfb7c64c5bf81";
-        aarch64-linux = "a4b157ed68da10471ea86acc05a0ab61c1a6931ee592a9b236be227d72da50ff";
-        x86_64-darwin = "942b0d4accc9704861c7781558829b1d521df21226ad97bd01e1e43b1518d3e6";
-        aarch64-darwin = "52d3f82c50d9402e42298b52edc3d36e0f73e59f81fc8609d22fa094fbad18be";
+        x86_64-linux = "1grpvdzkh4b6mfdn1khbs1nz1b7q61rkzfip3q2x4330fjqwcjgv";
+        aarch64-linux = "1cn62bmrgz344zsml80rqpmryp8hk6bdni3zhh43lpqf8a0aj11h";
+        x86_64-darwin = "0jzk0kl1jvnav8ccarpwzfvyyzibfhrhfj72s3q17kzxwhpgbimx";
+        aarch64-darwin = "0nzh0zwjlagn4aglimyajmqv5m6qwdqz7lyjaszfxzyf1p0hcmxx";
      };
    }) { }
  );
@@ -57,8 +57,8 @@ in
  julia_110 = wrapJulia (
    callPackage
      (import ./generic.nix {
-        version = "1.10.10";
-        hash = "sha256-/NTIGLlcNu4sI1rICa+PS/Jn+YnWi37zFBcbfMnv3Ys=";
+        version = "1.10.11";
+        hash = "sha256-XItQngSzszyIGzSvqdXBV/yLQGDxf5x8SnrQ/DtzUtU=";
        patches = [
          # Revert https://github.com/JuliaLang/julia/pull/55354
          # [build] Some improvements to the LLVM build system
@@ -10,43 +10,43 @@ callPackage ./common.nix (
    # Note that the latest build may differ by platform
    dists = {
      x86_64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
        hash =
          if enableJavaFX then
-            "sha256-qKpkvk7/IEnlOJoy7An0AVGUXWkWeuuiQzqKKE/+Ec4="
+            "sha256-jQ2ByIKtivoc9nJ/LPMZCktyjceqXY+B6a36sXmwUbE="
          else
-            "sha256-JCRcjQzkkV2G5wsoi13psbTHjxCtuw5rqT4pEAOarRk=";
+            "sha256-gZ4/CepiiQGiGyEE7Y9SVuF66RpBRbJysushMfgyrx0=";
      };

      aarch64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
        hash =
          if enableJavaFX then
-            "sha256-mpTM/43oyDsOnoZM8AW1Z7EFTznnPAnYoC+T6csc8Fw="
+            "sha256-ciyywX9R72RRt6HPfdmmsgFo/0ebr2xzNhnroAEDT7E="
          else
-            "sha256-uIz2D5WjqySy5lobuvWp3kFTGsBKhXzT56QgCGyXwSY=";
+            "sha256-21fcnh+CIsL47604yMo2CxAR2Ln7m+oJVths1157Lb0=";
      };

      x86_64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
        hash =
          if enableJavaFX then
-            "sha256-jb1oPmRzlYUMONovdsHowlC44X3/PFZ8KilxSsR924U="
+            "sha256-td551xWmeHcD26J0gxboKS6Y3f5iLRhcUy97pfxhHxk="
          else
-            "sha256-8VlGFUhCn3NE2A42xi69KzZqu0RoGOV1ZYj8oaqCnTc=";
+            "sha256-mHVhWicg6xAn8BaT4uCN93ChT8gYSYAfX7h7kRgdqyI=";
      };

      aarch64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
        hash =
          if enableJavaFX then
-            "sha256-rEILTKTpX8DEoOGhlrhbxpcCyF2+QrjW92h0ox9ezp0="
+            "sha256-TnN+tPJ8HJSlZ0EUDq5SHo40EviO0iMX0P9eYHyRVP4="
          else
-            "sha256-RZ3hNQQFE+spTT9lFHLjmkolSkpHDg2Hvro6xi7uNww=";
+            "sha256-EiRGuK028dyAZ3Jy29rXH9XKjXbfd0wB54Oce/TSZ9Y=";
      };
    };
  }
@@ -390,7 +390,7 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = "https://www.pypy.org/";
-    changelog = "https://doc.pypy.org/en/stable/release-v${version}.html";
+    changelog = "https://doc.pypy.org/release-v${version}.html";
    description = "Fast, compliant alternative implementation of the Python language (${pythonVersion})";
    mainProgram = "pypy";
    license = lib.licenses.mit;
@@ -2,7 +2,6 @@
  lib,
  fetchurl,
  buildDunePackage,
-  ocaml,
  dune-configurator,
  optint,
  fmt,
@@ -14,14 +13,12 @@
 }:

 buildDunePackage (finalAttrs: {
-  version = "0.5.2";
+  version = "0.5.3";
  pname = "checkseum";

-  minimalOCamlVersion = "4.07";
-
  src = fetchurl {
    url = "https://github.com/mirage/checkseum/releases/download/v${finalAttrs.version}/checkseum-${finalAttrs.version}.tbz";
-    hash = "sha256-nl5P1EBctKi03wCHdUMlGDPgimSZ70LMuNulgt8Nr8g=";
+    hash = "sha256-uIwRmUNBITo1wj80Fou6enS/P4kFH3e+s52COtzhpTE=";
  };

  buildInputs = [ dune-configurator ];
@@ -38,7 +35,7 @@ buildDunePackage (finalAttrs: {
    rresult
  ];

-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;

  meta = {
    description = "ADLER-32 and CRC32C Cyclic Redundancy Check";
@@ -1,23 +1,20 @@
 {
  lib,
  buildDunePackage,
-  ocaml,
  fetchurl,
  alcotest,
 }:

 buildDunePackage (finalAttrs: {
  pname = "duration";
-  version = "0.2.1";
-
-  duneVersion = "3";
+  version = "0.3.1";

  src = fetchurl {
    url = "https://github.com/hannesm/duration/releases/download/v${finalAttrs.version}/duration-${finalAttrs.version}.tbz";
-    hash = "sha256-xzjB84z7mYIMEhzT3fgZ3ksiKPDVDqy9HMPOmefHHis=";
+    hash = "sha256-zYjaaTlR4SEuqD4kzhf3Z+laOanOKt2gZUsy11zmjBM=";
  };

-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
  checkInputs = [ alcotest ];

  meta = {
@@ -21,7 +21,7 @@

 buildDunePackage (finalAttrs: {
  pname = "earlybird";
-  version = "1.3.5";
+  version = "1.3.6";

  minimalOCamlVersion = "4.12";

@@ -29,7 +29,7 @@ buildDunePackage (finalAttrs: {
    owner = "hackwaly";
    repo = "ocamlearlybird";
    tag = finalAttrs.version;
-    hash = "sha256-QDRtuphOb02L75JyCF9K1NqvIdtWlfefeLG3HmJVHW4=";
+    hash = "sha256-UtJwb941JEIaE4zUlOWqFX3w0U7gFdYlYpKl+mZ1FNg=";
  };

  nativeBuildInputs = [ menhir ];
@@ -15,7 +15,7 @@ buildPecl {
  src = fetchFromGitHub {
    owner = "NoiseByNorthwest";
    repo = "php-spx";
-    rev = "v${version}";
+    tag = "v${version}";
    hash = "sha256-P53g/o4i+QETWdErZaGA3AREvnr8kL9h0B1BMQlKdFA=";
  };

@@ -25,7 +25,7 @@ buildPecl {
  ];

  meta = {
-    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/${version}";
+    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/v${version}";
    description = "Simple & straight-to-the-point PHP profiling extension with its built-in web UI";
    homepage = "https://github.com/NoiseByNorthwest/php-spx";
    license = lib.licenses.php301;
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.42.96";
+  version = "1.42.97";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-HngZw00ero5ePPr50UT9ytZarRhLOASIhx3h0LKFGHk=";
+    hash = "sha256-9/R3WwhR/22w4/sJcGSvZDfk3jG3l9h0pzcQSZjgKMY=";
  };

  build-system = [ setuptools ];
@@ -68,19 +68,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "chromadb";
-  version = "1.5.7";
+  version = "1.5.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "chroma-core";
    repo = "chroma";
    tag = finalAttrs.version;
-    hash = "sha256-JrkfLwEL7iTL9P/4UDM4hFQtRL1JYH47dgZ1d+Mphqw=";
+    hash = "sha256-bxRRpwd7pmE+/JMARaqjuE+xFh8Qx70Aon2w56sOi1I=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-Szy2mSTriMwMViVTbI+0XaizcQBKh1Ncipf84moDREI=";
+    hash = "sha256-0vuXMxwbbpfMA0UcHcLieTJK6u67o6EYdJLH5Q+wtc8=";
  };

  # Can't use fetchFromGitHub as the build expects a zipfile
@@ -263,6 +263,11 @@ buildPythonPackage (finalAttrs: {
    "chromadb/test/test_client.py::test_http_client_with_inconsistent_host_settings[async_client]"
    "chromadb/test/test_client.py::test_http_client_with_inconsistent_port_settings[async_client]"
    "chromadb/test/test_client.py::test_http_client[async_client]"
+
+    # ValueError: Could not connect to a Chroma server.
+    "chromadb/test/property/test_add_mcmr.py::test_add_small[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_medium[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_large[single-region]"
  ];

  __darwinAllowLocalNetworking = true;
@@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "groq";
-  version = "1.1.2";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "groq";
    repo = "groq-python";
    tag = "v${version}";
-    hash = "sha256-uOTttpjV2iislaink/0Jewkinyb2hYt0J+sv/OSuhJ4=";
+    hash = "sha256-PisqKpVM2KAlGgZDcCoFJhoib7WhuM1AkJOGYVimW0U=";
  };

  postPatch = ''
@@ -36,7 +36,7 @@

 buildPythonPackage rec {
  pname = "gymnasium";
-  version = "1.2.3";
+  version = "1.3.0";

  pyproject = true;

@@ -44,7 +44,7 @@ buildPythonPackage rec {
    owner = "Farama-Foundation";
    repo = "gymnasium";
    tag = "v${version}";
-    hash = "sha256-b712BPs7AS8UE8Zsu9GW/J6Vag9NB/x728MtQ5yrjbY=";
+    hash = "sha256-asQ/RqnmGRoVdwBkp4RIkqzGtQ7PnISt8/mRcXrNbBc=";
  };

  build-system = [ setuptools ];
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202604271";
+  version = "0.1.202604281";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WKbjXsBprC/z4FFRaEztdGCRKdZ926muGUM6tCxLXu0=";
+    hash = "sha256-8evw78YKTofoMEp+yHdzN0NdMX5aeP63ax3DsBwaSYA=";
  };

  __darwinAllowLocalNetworking = true;
@@ -9,13 +9,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "llama-index-llms-openai-like";
-  version = "0.7.1";
+  version = "0.7.2";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_llms_openai_like";
    inherit (finalAttrs) version;
-    hash = "sha256-znzvNoax5i18CBNLTYylZwbMqBbkxAmOrt4zACgppvk=";
+    hash = "sha256-7Z/3P5ddzkcPmKxhyYIVG6eO7fo/ubA4lLwdExKyE/8=";
  };

  build-system = [ hatchling ];
@@ -167,8 +167,8 @@ in
      "sha256-BpJmc4Dq72eN7RPSpo51FAfpfrYRz7X/p6QBUpj2wuk=";

  mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.42.7"
-      "sha256-ZQsHPgnPepj1HbBd37u76Fd1td4M7B5o6kId8FPP5yQ=";
+    buildMypyBoto3Package "billingconductor" "1.42.97"
+      "sha256-CsBeZk3+PmOx8ZLXVZQM/wR9PXsKJ4YD8PqfUjV/2ho=";

  mypy-boto3-braket =
    buildMypyBoto3Package "braket" "1.42.85"
@@ -571,8 +571,8 @@ in
      "sha256-N0kQ7Fc44SFKXhl4V+oAclPNlWhluOs53NDokiXcSNM=";

  mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.42.89"
-      "sha256-U+NzY02OyhR/GbZy+2Ye3+FgAVzF/UTNhUH3fy9SmMc=";
+    buildMypyBoto3Package "glue" "1.42.97"
+      "sha256-YtkjsZejVm6IHku0Iz0KYjRIo4LpI/DsYSn77a+O1tE=";
  mypy-boto3-grafana =
    buildMypyBoto3Package "grafana" "1.42.51"
      "sha256-QHAuRJrioMD7ASgV1Wobm81Gb+Z87c78yBs9X1+Kz+E=";
@@ -694,8 +694,8 @@ in
      "sha256-Q6ypzi2rIhj5oECPe/Xz6GoKU8Uu04PdpdGvMgxjpnc=";

  mypy-boto3-ivs =
-    buildMypyBoto3Package "ivs" "1.42.94"
-      "sha256-deZSEEfLk/ml9447Y4G5PPSj3OJHt/XHRfeD1CdBWBE=";
+    buildMypyBoto3Package "ivs" "1.42.97"
+      "sha256-UBVezeWNDLG2drCDZjKR5sgQBmKtZ8wZv1dLvI6OCx0=";

  mypy-boto3-ivs-realtime =
    buildMypyBoto3Package "ivs-realtime" "1.42.86"
@@ -758,8 +758,8 @@ in
      "sha256-x9ntwcOhUm5Hsd/L+O5N77xJ/NWxgQhNVdtaaShM7p8=";

  mypy-boto3-kms =
-    buildMypyBoto3Package "kms" "1.42.50"
-      "sha256-bCVvuhK3mpTeNDYDYaACVWgQMhKR9mIi9BbbCI0ynCA=";
+    buildMypyBoto3Package "kms" "1.42.97"
+      "sha256-VyPK4Jin6POXMX/A0zzOd2Fd9CQyzDqR1qpFprMvxsA=";

  mypy-boto3-lakeformation =
    buildMypyBoto3Package "lakeformation" "1.42.79"
@@ -806,8 +806,8 @@ in
      "sha256-UBSxl5YmYh3m4gl4iKdDU2McetKuDcLkiR73Yvf0AQQ=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.42.96"
-      "sha256-MU6OS6h65vu4ILnioSVFSjptSkCow4T2qbTky2vo8ao=";
+    buildMypyBoto3Package "logs" "1.42.97"
+      "sha256-Vy973itXZ2B1hsp/f6D8X2QN290L+5QcuelK43H7bNU=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.42.3"
@@ -906,8 +906,8 @@ in
      "sha256-kFHGogiCfbftZr67o8zT7eb8na74J4AGneac03q+Pvc=";

  mypy-boto3-mgn =
-    buildMypyBoto3Package "mgn" "1.42.68"
-      "sha256-zrUwEeofbz+Tj7GgHzOzodYzsnPKqAISOuRGG6B7rpY=";
+    buildMypyBoto3Package "mgn" "1.42.97"
+      "sha256-45OfbZhzJ6bEZo+qIfvIc++26MeRThRp162iyWWQNEo=";

  mypy-boto3-migration-hub-refactor-spaces =
    buildMypyBoto3Package "migration-hub-refactor-spaces" "1.42.3"
@@ -962,12 +962,12 @@ in
      "sha256-CGt/WuKol9nVwLHEwNgEsQDzIBhFarJNbq30OpiK0+I=";

  mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.42.78"
-      "sha256-h0urK602L1j2CtD1xsUOMaXizzc2CxbttMlaSNyQNoM=";
+    buildMypyBoto3Package "omics" "1.42.97"
+      "sha256-7eLIW6ucZ/KQ/yGFinkBAPLKXOBKdd9RpxUromwqc6c=";

  mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.42.95"
-      "sha256-CGCwYDcgttsyYSKUB2kVVeeOxtT6svLxR+fDFtjZ854=";
+    buildMypyBoto3Package "opensearch" "1.42.97"
+      "sha256-jAtx5h6lBgoBf/nzt7WO/QC+ZGFBGGCC6OF9OmkAqYY=";

  mypy-boto3-opensearchserverless =
    buildMypyBoto3Package "opensearchserverless" "1.42.75"
@@ -1170,8 +1170,8 @@ in
      "sha256-juVfwdjPDNPaT5tvyXpzDtomugqxeu++AERLkVtFIxw=";

  mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.42.93"
-      "sha256-ZxPcCnneSMwI0Yl3TiiMxim9FIBzen4hC5X76Dhnd7U=";
+    buildMypyBoto3Package "sagemaker" "1.42.97"
+      "sha256-FGjRmINeQxxdn20Jn7SvjwYfpDZdfDys/VTC6fzGov0=";

  mypy-boto3-sagemaker-a2i-runtime =
    buildMypyBoto3Package "sagemaker-a2i-runtime" "1.42.3"
@@ -1422,8 +1422,8 @@ in
      "sha256-bxh+mhwsHHwt/cx/njegTa/QGHu+xa7YPg4SRos1deM=";

  mypy-boto3-workspaces =
-    buildMypyBoto3Package "workspaces" "1.42.66"
-      "sha256-HFB5MRlLqUlk2KSwh6Fzv352mTR3ComSRK0vwNVxwoQ=";
+    buildMypyBoto3Package "workspaces" "1.42.97"
+      "sha256-WLheY3TM39Li6b6cvzsEgNTMplDikmoh5zuQ0aRLNAk=";

  mypy-boto3-workspaces-web =
    buildMypyBoto3Package "workspaces-web" "1.42.51"
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-data";
-  version = "1.4.11";
+  version = "1.4.12";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-data";
    tag = finalAttrs.version;
-    hash = "sha256-zd4SmDIHtOKYK19tr/72CIKAfhWtm7957Ax7b2kAXdw=";
+    hash = "sha256-Q+h5qSCvybxO+RojDNoS6g1Bt/fLpiWVJHRiMkgPpvY=";
  };

  build-system = [
@@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "pyqt6-charts";
-  version = "6.10.0";
+  version = "6.11.0";
  pyproject = true;

  src = fetchPypi {
    pname = "pyqt6_charts";
    inherit version;
-    hash = "sha256-keFeKNARyqTIOIGpBoezXj0F71cpDN2XYIJMlb2saj4=";
+    hash = "sha256-EJHNkZgGo84F0idnKfeb5Oy9CpOVAKiJkCbD71dpxlA=";
  };

  # fix include path and increase verbosity
@@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "pyqt6-webengine";
-  version = "6.10.0";
+  version = "6.11.0";
  pyproject = true;

  src = fetchPypi {
    pname = "pyqt6_webengine";
    inherit version;
-    hash = "sha256-Jn0nJ10Mea4nC8pLA1IKQfp+hcKk2WMtqMucwjOlWtE=";
+    hash = "sha256-Fc9J77u9TGvIdlOyxK6A1gSfgA4xYgszZzSuLjfL7a4=";
  };

  patches = [
@@ -24,6 +24,7 @@ buildPythonPackage (finalAttrs: {
  pname = "stable-baselines3";
  version = "2.8.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "DLR-RM";
@@ -34,6 +35,9 @@ buildPythonPackage (finalAttrs: {

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "gymnasium"
+  ];
  dependencies = [
    cloudpickle
    gymnasium
@@ -58,6 +62,12 @@ buildPythonPackage (finalAttrs: {
    "tests/test_dict_env.py"
    "tests/test_her.py"
    "tests/test_save_load.py"
+
+    # gymnasium.error.DeprecatedEnv: Environment version v3 for `Taxi` is deprecated.
+    # Please use `Taxi-v4` instead.
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-A2C]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-DQN]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-PPO]"
  ];

  disabledTests = [
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.85";
+  version = "3.1.87";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-8uJNo4gDUlY4oX1cMrJtrwGYc0la2nac+rjHBRoPAj8=";
+    hash = "sha256-KxKUZNGn3SYxI9W4gJHRcWQMTUAxdgYiwNUbYKYaCp8=";
  };

  build-system = [ setuptools ];
@@ -105,7 +105,7 @@ rec {
        owner = "FirebirdSQL";
        repo = "firebird";
        rev = "v${version}";
-        hash = "sha256-EnD0cTQSOh1fARjKdoOCR5UjpvVA96EZVVWfqlH+m48=";
+        hash = "sha256-4u1Vgwk5cMCkrGfGSk2xO7hVHiDda0ioitvX/r3KPQc=";
      };

      nativeBuildInputs = base.nativeBuildInputs ++ [ unzip ];
@@ -126,7 +126,8 @@ rec {
        owner = "FirebirdSQL";
        repo = "firebird";
        rev = "v${version}";
-        hash = "sha256-wAiOyCVS7fjVqrDlJJwDFxw5ZD5spnXlYKCAQ8gctHI=";
+        fetchSubmodules = true;
+        hash = "sha256-IJrfs8q7GtX4Y+Cmg4avT5QJmLpld38tyR3TR1CcgyE=";
      };

      # CMake is just used for libcds
@@ -0,0 +1,133 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  buildPackages,
+  pcre2,
+  jemalloc,
+  libunwind,
+  libxslt,
+  groff,
+  ncurses,
+  pkg-config,
+  readline,
+  libedit,
+  coreutils,
+  python3,
+  makeWrapper,
+  nixosTests,
+}:
+
+let
+  generic =
+    {
+      version,
+      hash,
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      pname = "vinyl-cache";
+      inherit version;
+
+      src = fetchurl {
+        url = "https://vinyl-cache.org/downloads/${finalAttrs.pname}-${version}.tgz";
+        inherit hash;
+      };
+
+      __structuredAttrs = true;
+      strictDeps = true;
+
+      nativeBuildInputs = [
+        pkg-config
+        python3.pkgs.docutils
+        python3.pkgs.sphinx
+        makeWrapper
+      ];
+
+      buildInputs = [
+        libxslt
+        groff
+        ncurses
+        readline
+        libedit
+        pcre2
+        python3
+      ]
+      ++ lib.optional stdenv.hostPlatform.isDarwin libunwind
+      ++ lib.optional stdenv.hostPlatform.isLinux jemalloc;
+
+      configureFlags = [
+        # the checks behind those to not work when doing cross but for simplicity we always define them
+        "ac_cv_have_tcp_fastopen=yes"
+        "ac_cv_have_tcp_keep=yes"
+        "ac_cv_have_working_close_range=yes"
+        "PYTHON=${buildPackages.python3.interpreter}"
+      ];
+
+      buildFlags = [ "localstatedir=/var/run" ];
+
+      postPatch = ''
+        substituteInPlace bin/vinyltest/vtest2/src/vtc_main.c --replace-fail /bin/rm "${coreutils}/bin/rm"
+      '';
+
+      postConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        # prevent cache invalidation
+        substituteInPlace bin/vinyld/Makefile \
+          --replace-fail "vhp_hufdec.h: vhp_gen_hufdec" "vhp_hufdec.h:"
+
+        ln -s "${buildPackages.vinyl.vhp_hufdec_h}" bin/vinyld/vhp_hufdec.h
+
+        substituteInPlace bin/vinylstat/Makefile \
+          --replace-fail "vinylstat_curses_help.c: vinylstat_help_gen" "vinylstat_curses_help.c:" \
+          --replace-fail "./vinylstat_help_gen" "${buildPackages.vinyl}/bin/vinylstat_help_gen"
+
+        # the docs execute lots of commands to gather options and flags
+        substituteInPlace doc/Makefile \
+          --replace-fail "SUBDIRS = graphviz sphinx" "SUBDIRS = graphviz"
+        substituteInPlace Makefile \
+          --replace-fail "include lib bin vmod etc doc man contrib" "include lib bin vmod etc doc contrib"
+      '';
+
+      postInstall = ''
+        wrapProgram "$out/sbin/vinyld" --prefix PATH : "${lib.makeBinPath [ stdenv.cc ]}"
+      ''
+      + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        cp bin/vinyld/vhp_hufdec.h $vhp_hufdec_h
+      '';
+
+      # https://github.com/varnishcache/varnish-cache/issues/1875
+      env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isi686 "-fexcess-precision=standard";
+
+      outputs = [
+        "out"
+        "dev"
+      ]
+      ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+        "man"
+        "vhp_hufdec_h" # only used for cross compilation
+      ];
+
+      passthru = {
+        python = python3;
+        tests = nixosTests."vinyl-cache_${lib.versions.major version}";
+      };
+
+      meta = {
+        description = "Web application accelerator also known as a caching HTTP reverse proxy";
+        homepage = "https://vinyl-cache.org";
+        license = lib.licenses.bsd2;
+        maintainers = [
+          lib.maintainers.leona
+          lib.maintainers.osnyx
+        ];
+        platforms = lib.platforms.unix;
+        broken = stdenv.hostPlatform.isDarwin;
+      };
+    });
+in
+{
+  # EOL 2027-03-16
+  vinyl-cache_9 = generic {
+    version = "9.0.0";
+    hash = "sha256-l0DCEMKndifVD9CtbHWdw8oJT8tOZVW6VfynHPSDvRc=";
+  };
+}
@@ -238,14 +238,14 @@ lib.makeExtensible (
      attrName = "git";

      lix-args = rec {
-        version = "2.96.0-pre-20260318_${builtins.substring 0 12 src.rev}";
+        version = "2.96.0-pre-20260408_${builtins.substring 0 12 src.rev}";

        src = fetchFromGitea {
          domain = "git.lix.systems";
          owner = "lix-project";
          repo = "lix";
-          rev = "8294cd534b2f01ee967b28aa73fcab1535d62b3d";
-          hash = "sha256-BFijbNDCrfzpDdW+gNauP25QsTvEZ39dygWEI/RYeyY=";
+          rev = "bc9fb560ac2d36cd317a856ee96785ea2055fbff";
+          hash = "sha256-bONRPjhk5OZdnkQZexZNJzlvwIPg31Gy7fNiwGoX3BQ=";
        };

        cargoDeps = rustPlatform.fetchCargoVendor {
@@ -1804,6 +1804,7 @@ mapAliases {
  rke2_1_29 = throw "'rke2_1_29' has been removed from nixpkgs as it has reached end of life"; # Added 2025-05-05
  rke2_1_30 = throw "'rke2_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-11-04
  rke2_1_31 = throw "'rke2_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
+  rke2_1_32 = throw "'rke2_1_32' has been removed from nixpkgs as it has reached end of life"; # Added 2026-04-04
  rl_json = throw "'rl_json' has been renamed to/replaced by 'tclPackages.rl_json'"; # Converted to throw 2025-10-27
  rockbox_utility = throw "'rockbox_utility' has been renamed to/replaced by 'rockbox-utility'"; # Converted to throw 2025-10-27
  rockcraft = throw "rockcraft was removed in Sep 25 following removal of LXD from nixpkgs"; # Added 2025-09-18
@@ -3520,6 +3520,12 @@ with pkgs;
  varnishPackages = varnish80Packages;
  varnish = varnishPackages.varnish;

+  inherit (callPackages ../servers/vinyl-cache { })
+    vinyl-cache_9
+    ;
+
+  vinyl-cache = vinyl-cache_9;
+
  vncdo = with python3Packages; toPythonApplication vncdo;

  # An alias to work around the splicing incidents
@@ -10192,7 +10198,6 @@ with pkgs;
      callPackage ../applications/networking/instant-messengers/ripcord/darwin.nix { };

  inherit (callPackage ../applications/networking/cluster/rke2 { })
-    rke2_1_32
    rke2_1_33
    rke2_1_34
    rke2_1_35