From 786bcc30c9ad91a425579b13413af5343048cc3b Mon Sep 17 00:00:00 2001
From: Sergei Volkov <taranarmo@gmail.com>
Date: Wed, 11 Mar 2026 14:00:04 +0100
Subject: [PATCH 01/86] julia_110: 1.10.10 -> 1.10.11

---
 pkgs/development/compilers/julia/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 016cbc294447..349f22b2237d 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -55,8 +55,8 @@ in
   julia_110 = wrapJulia (
     callPackage
       (import ./generic.nix {
-        version = "1.10.10";
-        hash = "sha256-/NTIGLlcNu4sI1rICa+PS/Jn+YnWi37zFBcbfMnv3Ys=";
+        version = "1.10.11";
+        hash = "sha256-XItQngSzszyIGzSvqdXBV/yLQGDxf5x8SnrQ/DtzUtU=";
         patches = [
           # Revert https://github.com/JuliaLang/julia/pull/55354
           # [build] Some improvements to the LLVM build system

From 07247c6c55752490175663bc654bb683bba6ffd1 Mon Sep 17 00:00:00 2001
From: Sergei Volkov <taranarmo@gmail.com>
Date: Wed, 11 Mar 2026 14:20:43 +0100
Subject: [PATCH 02/86] julia_110-bin: 1.10.10 -> 1.10.11

---
 pkgs/development/compilers/julia/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 349f22b2237d..956ecf76917b 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -21,12 +21,12 @@ in
 {
   julia_110-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.10.10";
+      version = "1.10.11";
       sha256 = {
-        x86_64-linux = "6a78a03a71c7ab792e8673dc5cedb918e037f081ceb58b50971dfb7c64c5bf81";
-        aarch64-linux = "a4b157ed68da10471ea86acc05a0ab61c1a6931ee592a9b236be227d72da50ff";
-        x86_64-darwin = "942b0d4accc9704861c7781558829b1d521df21226ad97bd01e1e43b1518d3e6";
-        aarch64-darwin = "52d3f82c50d9402e42298b52edc3d36e0f73e59f81fc8609d22fa094fbad18be";
+        x86_64-linux = "1grpvdzkh4b6mfdn1khbs1nz1b7q61rkzfip3q2x4330fjqwcjgv";
+        aarch64-linux = "1cn62bmrgz344zsml80rqpmryp8hk6bdni3zhh43lpqf8a0aj11h";
+        x86_64-darwin = "0jzk0kl1jvnav8ccarpwzfvyyzibfhrhfj72s3q17kzxwhpgbimx";
+        aarch64-darwin = "0nzh0zwjlagn4aglimyajmqv5m6qwdqz7lyjaszfxzyf1p0hcmxx";
       };
     }) { }
   );

From 27c7ddbb8c9188b3cd36f2808618b24654733aa0 Mon Sep 17 00:00:00 2001
From: Miguel Villafuerte <24855057+mvillafuertem@users.noreply.github.com>
Date: Tue, 17 Mar 2026 15:37:17 +0100
Subject: [PATCH 03/86] zulu17: 17.0.12 -> 17.0.18

---
 pkgs/development/compilers/zulu/17.nix | 32 +++++++++++++-------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/compilers/zulu/17.nix b/pkgs/development/compilers/zulu/17.nix
index 45abea1fc783..dd86c89ecd5e 100644
--- a/pkgs/development/compilers/zulu/17.nix
+++ b/pkgs/development/compilers/zulu/17.nix
@@ -10,43 +10,43 @@ callPackage ./common.nix (
     # Note that the latest build may differ by platform
     dists = {
       x86_64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-qKpkvk7/IEnlOJoy7An0AVGUXWkWeuuiQzqKKE/+Ec4="
+            "sha256-jQ2ByIKtivoc9nJ/LPMZCktyjceqXY+B6a36sXmwUbE="
           else
-            "sha256-JCRcjQzkkV2G5wsoi13psbTHjxCtuw5rqT4pEAOarRk=";
+            "sha256-gZ4/CepiiQGiGyEE7Y9SVuF66RpBRbJysushMfgyrx0=";
       };
 
       aarch64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-mpTM/43oyDsOnoZM8AW1Z7EFTznnPAnYoC+T6csc8Fw="
+            "sha256-ciyywX9R72RRt6HPfdmmsgFo/0ebr2xzNhnroAEDT7E="
           else
-            "sha256-uIz2D5WjqySy5lobuvWp3kFTGsBKhXzT56QgCGyXwSY=";
+            "sha256-21fcnh+CIsL47604yMo2CxAR2Ln7m+oJVths1157Lb0=";
       };
 
       x86_64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-jb1oPmRzlYUMONovdsHowlC44X3/PFZ8KilxSsR924U="
+            "sha256-td551xWmeHcD26J0gxboKS6Y3f5iLRhcUy97pfxhHxk="
           else
-            "sha256-8VlGFUhCn3NE2A42xi69KzZqu0RoGOV1ZYj8oaqCnTc=";
+            "sha256-mHVhWicg6xAn8BaT4uCN93ChT8gYSYAfX7h7kRgdqyI=";
       };
 
       aarch64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-rEILTKTpX8DEoOGhlrhbxpcCyF2+QrjW92h0ox9ezp0="
+            "sha256-TnN+tPJ8HJSlZ0EUDq5SHo40EviO0iMX0P9eYHyRVP4="
           else
-            "sha256-RZ3hNQQFE+spTT9lFHLjmkolSkpHDg2Hvro6xi7uNww=";
+            "sha256-EiRGuK028dyAZ3Jy29rXH9XKjXbfd0wB54Oce/TSZ9Y=";
       };
     };
   }

From 69a7d421c7cb2d5e74ef1625f4f85b5f02eb99d5 Mon Sep 17 00:00:00 2001
From: Igor Ramazanov <igor.ramazanov@magine.com>
Date: Wed, 14 Jan 2026 06:16:25 +0000
Subject: [PATCH 04/86] maintainers: `igor-ramazanov`

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2cd35cd6768b..cd1603f9101c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11202,6 +11202,12 @@
     githubId = 55025025;
     name = "Feather Lin";
   };
+  igor-ramazanov = {
+    email = "personal@igorramazanov.tech";
+    github = "igor-ramazanov";
+    githubId = 12570166;
+    name = "Igor Ramazanov";
+  };
   igsha = {
     email = "igor.sharonov@gmail.com";
     github = "igsha";

From 6758fac0638c4b371786cdab294c60567c359b01 Mon Sep 17 00:00:00 2001
From: Igor Ramazanov <igor.ramazanov@magine.com>
Date: Wed, 14 Jan 2026 06:16:53 +0000
Subject: [PATCH 05/86] maintainers: add `stealthbadger747`

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cd1603f9101c..232583976f08 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25824,6 +25824,12 @@
     github = "StayBlue";
     githubId = 23127866;
   };
+  stealthbadger747 = {
+    email = "parawell.erik@gmail.com";
+    github = "StealthBadger747";
+    githubId = 26052996;
+    name = "Erik Parawell";
+  };
   steamwalker = {
     email = "steamwalker@xs4all.nl";
     github = "steamwalker";

From 86c772911f9415a3f2048c9141a679d401b607a2 Mon Sep 17 00:00:00 2001
From: Igor Ramazanov <igor.ramazanov@magine.com>
Date: Wed, 14 Jan 2026 06:18:47 +0000
Subject: [PATCH 06/86] headplane: init at 0.6.1

https://github.com/tale/headplane/releases/tag/v0.6.1

Co-authored-by: Erik Parawell <parawell.erik@gmail.com>
---
 doc/release-notes/rl-2605.section.md        |   2 +
 pkgs/by-name/he/headplane-agent/package.nix |  37 +++++++
 pkgs/by-name/he/headplane/package.nix       | 116 ++++++++++++++++++++
 3 files changed, 155 insertions(+)
 create mode 100644 pkgs/by-name/he/headplane-agent/package.nix
 create mode 100644 pkgs/by-name/he/headplane/package.nix

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index ed1f18a3c3bb..6d73249aae56 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -294,6 +294,8 @@ gnuradioMinimal.override {
 }
 ```
 
+- Added `headplane` and `headplane-agent` packages.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/pkgs/by-name/he/headplane-agent/package.nix b/pkgs/by-name/he/headplane-agent/package.nix
new file mode 100644
index 000000000000..e12db5adecf7
--- /dev/null
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@@ -0,0 +1,37 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "headplane-agent";
+  # Note, if you are upgrading this, you should upgrade headplane at the same time
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+  env.CGO_ENABLED = 0;
+
+  meta = {
+    description = "Optional sidecar process providing additional features for headplane";
+    homepage = "https://github.com/tale/headplane";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "hp_agent";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/he/headplane/package.nix b/pkgs/by-name/he/headplane/package.nix
new file mode 100644
index 000000000000..51c6b74609a6
--- /dev/null
+++ b/pkgs/by-name/he/headplane/package.nix
@@ -0,0 +1,116 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  git,
+  lib,
+  makeWrapper,
+  nodejs_22,
+  pnpm_10,
+  pnpmConfigHook,
+  stdenv,
+}:
+let
+  pname = "headplane";
+  # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
+  version = "0.6.1";
+  pnpmDepsHash = "sha256-AYfEL3HSRg87I+Y0fkLthFSDWgHTg5u0DBpzn6KBn1Q=";
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  headplaneSshWasm = buildGoModule {
+    pname = "headplane-ssh-wasm";
+    inherit version src;
+    subPackages = [ "cmd/hp_ssh" ];
+    vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+    env.CGO_ENABLED = 0;
+    doCheck = false;
+    buildPhase = ''
+      export GOOS=js
+      export GOARCH=wasm
+      go build -o hp_ssh.wasm ./cmd/hp_ssh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm444 hp_ssh.wasm "$out/hp_ssh.wasm"
+
+      # Go's WebAssembly shim (wasm_exec.js) has no stable `go env` key, and
+      # different Go packages may place it in different locations under GOROOT.
+      #   1. Ask `go env GOROOT` for the active GOROOT.
+      #   2. First try the path misc/wasm/wasm_exec.js.
+      #   3. If that fails, fall back to searching under GOROOT to handle
+      #      distro / OS / packaging layout variations.
+      goRoot="$(go env GOROOT)"
+
+      wasm_exec="$goRoot/misc/wasm/wasm_exec.js"
+      if [ ! -e "$wasm_exec" ]; then
+        wasm_exec="$(find "$goRoot" -path '*wasm_exec.js' -print -quit || true)"
+      fi
+
+      if [[ -z "$wasm_exec" || ! -e "$wasm_exec" ]]; then
+        echo "ERROR: wasm_exec.js not found under GOROOT=$goRoot" >&2
+        exit 1
+      fi
+
+      install -Dm444 "$wasm_exec" "$out/wasm_exec.js"
+      runHook postInstall
+    '';
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    git
+    makeWrapper
+    nodejs_22
+    pnpm_10
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    hash = pnpmDepsHash;
+    fetcherVersion = 3;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    cp ${headplaneSshWasm}/hp_ssh.wasm app/hp_ssh.wasm
+    cp ${headplaneSshWasm}/wasm_exec.js app/wasm_exec.js
+    pnpm --offline build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/headplane}
+    cp -r build $out/share/headplane/
+    cp -r node_modules $out/share/headplane/
+    cp -r drizzle $out/share/headplane/
+    substituteInPlace $out/share/headplane/build/server/index.js \
+      --replace "$PWD" "../.."
+    makeWrapper ${lib.getExe nodejs_22} $out/bin/headplane \
+      --chdir $out/share/headplane \
+      --add-flags $out/share/headplane/build/server/index.js
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Feature-complete Web UI for Headscale";
+    homepage = "https://github.com/tale/headplane";
+    changelog = "https://github.com/tale/headplane/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "headplane";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})

From 9ffc6aa12ea89c2e5307ccd32984efeff1dc2ec9 Mon Sep 17 00:00:00 2001
From: Igor Ramazanov <igor.ramazanov@magine.com>
Date: Mon, 14 Apr 2025 20:42:04 +0000
Subject: [PATCH 07/86] nixos/headplane: init module

https://github.com/tale/headplane/releases/tag/v0.6.1

Co-authored-by: Erik Parawell <parawell.erik@gmail.com>
---
 doc/release-notes/rl-2605.section.md          |   2 +-
 .../manual/release-notes/rl-2605.section.md   |   4 +-
 nixos/modules/module-list.nix                 |   1 +
 .../modules/services/networking/headplane.nix | 420 ++++++++++++++++++
 4 files changed, 425 insertions(+), 2 deletions(-)
 create mode 100644 nixos/modules/services/networking/headplane.nix

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 6d73249aae56..b5a2008c5976 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -294,7 +294,7 @@ gnuradioMinimal.override {
 }
 ```
 
-- Added `headplane` and `headplane-agent` packages.
+- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 5220d49e71e2..72b551b4d947 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -108,7 +108,9 @@
 
 - [tabbyAPI](https://github.com/theroyallab/tabbyAPI), the official OpenAI compatible API server for Exllama. Available as [services.tabbyapi](#opt-services.tabbyapi.enable).
 
-- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable)
+- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable).
+
+- [Headplane](https://headplane.net), a feature-complete Web UI for Headscale. Available as [services.headplane](#opt-services.headplane.enable).
 
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index df81fa95aca2..19f1e83d98ad 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1219,6 +1219,7 @@
   ./services/networking/hans.nix
   ./services/networking/haproxy.nix
   ./services/networking/harmonia.nix
+  ./services/networking/headplane.nix
   ./services/networking/headscale.nix
   ./services/networking/hickory-dns.nix
   ./services/networking/hostapd.nix
diff --git a/nixos/modules/services/networking/headplane.nix b/nixos/modules/services/networking/headplane.nix
new file mode 100644
index 000000000000..ef35f19e4a01
--- /dev/null
+++ b/nixos/modules/services/networking/headplane.nix
@@ -0,0 +1,420 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+  inherit (lib.attrsets) filterAttrsRecursive;
+  cfg = config.services.headplane;
+  settingsFile = (pkgs.formats.yaml { }).generate "headplane-config.yaml" (
+    # Headplane config can't have `null` values.
+    filterAttrsRecursive (n: v: v != null) cfg.settings
+  );
+in
+{
+  options.services.headplane = {
+    enable = mkEnableOption "Headplane";
+    package = mkPackageOption pkgs "headplane" { };
+
+    debug = mkEnableOption "Enable debug loggin";
+
+    settings = mkOption {
+      description = ''
+        Headplane configuration options. Generates a YAML config file.
+        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+      '';
+      type = types.submodule {
+        options = {
+          server = mkOption {
+            type = types.submodule {
+              options = {
+                host = mkOption {
+                  type = types.str;
+                  default = "127.0.0.1";
+                  description = "The host address to bind to.";
+                  example = "0.0.0.0";
+                };
+
+                port = mkOption {
+                  type = types.port;
+                  default = 3000;
+                  description = "The port to listen on.";
+                };
+
+                cookie_secret_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the cookie secret.
+                    The secret must be exactly 32 characters long.
+                  '';
+                  example = "config.sops.secrets.headplane_cookie.path";
+                };
+
+                cookie_secure = mkOption {
+                  type = types.bool;
+                  default = true;
+                  description = ''
+                    Should the cookies only work over HTTPS?
+                    Set to false if running via HTTP without a proxy.
+                    Recommended to be true in production.
+                  '';
+                };
+
+                data_path = mkOption {
+                  type = types.path;
+                  default = "/var/lib/headplane";
+                  description = ''
+                    The path to persist Headplane specific data.
+                    All data going forward is stored in this directory, including the internal database and any cache related files.
+                    Data formats prior to 0.6.1 will automatically be migrated.
+                  '';
+                  example = "/var/lib/headplane";
+                };
+              };
+            };
+            default = { };
+            description = "Server configuration for Headplane web application.";
+          };
+
+          headscale = mkOption {
+            type = types.submodule {
+              options = {
+                url = mkOption {
+                  type = types.str;
+                  default = "http://127.0.0.1:${toString config.services.headscale.port}";
+                  defaultText = lib.literalExpression "http://127.0.0.1:\${toString config.services.headscale.port}";
+                  description = ''
+                    The URL to your Headscale instance.
+                    All API requests are routed through this URL.
+                    THIS IS NOT the gRPC endpoint, but the HTTP endpoint.
+                    IMPORTANT: If you are using TLS this MUST be set to `https://`.
+                  '';
+                  example = "https://headscale.example.com";
+                };
+
+                tls_cert_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the TLS certificate.
+                  '';
+                  example = "config.sops.secrets.tls_cert.path";
+                };
+
+                public_url = mkOption {
+                  type = types.nullOr types.str;
+                  default = config.services.headscale.settings.server_url;
+                  defaultText = lib.literalExpression "config.services.headscale.settings.server_url";
+                  description = "Public URL if different. This affects certain parts of the web UI.";
+                  example = "https://headscale.example.com";
+                };
+
+                config_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = config.services.headscale.configFile;
+                  defaultText = lib.literalExpression "config.services.headscale.configFile";
+                  description = ''
+                    Path to the Headscale configuration file.
+                    This is optional, but HIGHLY recommended for the best experience.
+                    If this is read only, Headplane will show your configuration settings
+                    in the Web UI, but they cannot be changed.
+                  '';
+                  example = "/etc/headscale/config.yaml";
+                };
+
+                config_strict = mkEnableOption ''
+                  Headplane internally validates the Headscale configuration
+                  to ensure that it changes the configuration in a safe way.
+                  Disabled by default because it clashes with how the Headplane works in NixOS.
+                '';
+
+                dns_records_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    If you are using `dns.extra_records_path` in your Headscale configuration, you need to set this to the path for Headplane to be able to read the DNS records.
+                    Ensure that the file is both readable and writable by the Headplane process.
+                    When using this, Headplane will no longer need to automatically restart Headscale for DNS record changes.
+                  '';
+                  example = "/var/lib/headplane/extra_records.json";
+                };
+              };
+            };
+            default = { };
+            description = "Headscale specific settings for Headplane integration.";
+          };
+
+          integration = mkOption {
+            type = types.submodule {
+              options = {
+                agent = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        default = false;
+                        description = ''
+                          The Headplane agent allows retrieving information about nodes.
+                          This allows the UI to display version, OS, and connectivity data.
+                          You will see the Headplane agent in your Tailnet as a node when it connects.
+                        '';
+                      };
+
+                      executable_path = mkOption {
+                        type = types.path;
+                        readOnly = true;
+                        default = "${cfg.settings.integration.agent.package}/bin/hp_agent";
+                        defaultText = lib.literalExpression ''"''\${config.services.headplane.settings.integration.agent.package}/bin/hp_agent"'';
+                        description = ''
+                          Path to the headplane agent binary.
+                        '';
+                      };
+
+                      pre_authkey_path = mkOption {
+                        type = types.nullOr types.path;
+                        default = null;
+                        description = ''
+                          Path to a file containing the agent preauth key.
+                          To connect to your Tailnet, you need to generate a pre-auth key.
+                          This can be done via the web UI or through the `headscale` CLI.
+                        '';
+                        example = "config.sops.secrets.agent_pre_authkey.path";
+                      };
+
+                      host_name = mkOption {
+                        type = types.str;
+                        default = "headplane-agent";
+                        description = "Optionally change the name of the agent in the Tailnet";
+                      };
+
+                      cache_ttl = mkOption {
+                        type = types.ints.positive;
+                        default = 180000;
+                        description = ''
+                          How long to cache agent information (in milliseconds).
+                          If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                        '';
+                      };
+
+                      cache_path = mkOption {
+                        type = types.path;
+                        default = "/var/lib/headplane/agent_cache.json";
+                        description = "Where to store the agent cache.";
+                      };
+
+                      work_dir = mkOption {
+                        type = types.path;
+                        default = "/var/lib/headplane/agent";
+                        description = ''
+                          Do not change this unless you are running a custom deployment.
+                          The work_dir represents where the agent will store its data to be able to automatically reauthenticate with your Tailnet.
+                          It needs to be writable by the user running the Headplane process.
+                        '';
+                      };
+
+                      package = mkPackageOption pkgs "headplane-agent" { };
+                    };
+                  };
+                  default = { };
+                  description = "Agent configuration for the Headplane agent.";
+                };
+
+                proc = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        default = true;
+                        description = ''
+                          Enable "Native" integration that works when Headscale and
+                          Headplane are running outside of a container. There is no additional
+                          configuration, but you need to ensure that the Headplane process
+                          can terminate the Headscale process.
+                        '';
+                      };
+                    };
+                  };
+                  default = { };
+                  description = "Native process integration settings.";
+                };
+              };
+            };
+            default = { };
+            description = "Integration configurations for Headplane to interact with Headscale.";
+          };
+
+          oidc = mkOption {
+            type = types.submodule {
+              options = {
+                issuer = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "URL to OpenID issuer.";
+                  example = "https://provider.example.com/issuer-url";
+                };
+
+                client_id = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "The client ID for the OIDC client.";
+                  example = "your-client-id";
+                };
+
+                client_secret_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the OIDC client secret.
+                  '';
+                  example = "config.sops.secrets.oidc_client_secret.path";
+                };
+
+                disable_api_key_login = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "Whether to disable API key login.";
+                };
+
+                token_endpoint_auth_method = mkOption {
+                  type = types.enum [
+                    "client_secret_post"
+                    "client_secret_basic"
+                    "client_secret_jwt"
+                  ];
+                  default = "client_secret_post";
+                  description = "The token endpoint authentication method.";
+                };
+
+                headscale_api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the Headscale API key.
+                  '';
+                  example = "config.sops.secrets.headscale_api_key.path";
+                };
+
+                redirect_uri = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    This should point to your publicly accessible URL
+                    for your Headplane instance with /admin/oidc/callback.
+                  '';
+                  example = "https://headscale.example.com/admin/oidc/callback";
+                };
+
+                user_storage_file = mkOption {
+                  type = types.path;
+                  default = "/var/lib/headplane/users.json";
+                  description = ''
+                    Path to a file containing the users and their permissions for Headplane.
+                  '';
+                  example = "/var/lib/headplane/users.json";
+                };
+
+                profile_picture_source = mkOption {
+                  type = types.enum [
+                    "oidc"
+                    "gravatar"
+                  ];
+                  default = "oidc";
+                  description = "Source for user profile pictures.";
+                };
+
+                strict_validation = mkOption {
+                  type = types.bool;
+                  default = true;
+                  description = "Enable strict validation of OIDC configuration.";
+                };
+
+                scope = mkOption {
+                  type = types.str;
+                  default = "openid email profile";
+                  description = "OIDC scope to request.";
+                };
+
+                extra_params = mkOption {
+                  type = types.nullOr (types.attrsOf types.str);
+                  default = null;
+                  description = "Extra parameters to send to the OIDC provider.";
+                  example = {
+                    prompt = "consent";
+                  };
+                };
+
+                authorization_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Custom authorization endpoint URL.";
+                  example = "https://provider.example.com/authorize";
+                };
+
+                token_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Custom token endpoint URL.";
+                  example = "https://provider.example.com/token";
+                };
+
+                userinfo_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Custom userinfo endpoint URL.";
+                  example = "https://provider.example.com/userinfo";
+                };
+              };
+            };
+            default = { };
+            description = "OIDC Configuration for authentication.";
+          };
+        };
+      };
+      default = { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."headplane/config.yaml".source = "${settingsFile}";
+    };
+
+    systemd.services.headplane = {
+      description = "Headscale Web UI";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        config.systemd.services.headscale.name
+      ];
+      requires = [ config.systemd.services.headscale.name ];
+
+      environment = {
+        HEADPLANE_DEBUG_LOG = toString cfg.debug;
+      };
+      serviceConfig = {
+        User = config.services.headscale.user;
+        Group = config.services.headscale.group;
+        StateDirectory = "headplane";
+
+        ExecStart = lib.getExe cfg.package;
+        Restart = "always";
+        RestartSec = 5;
+
+        # TODO: Harden `systemd` security according to the "The Principle of Least Power".
+        # See: `$ systemd-analyze security headplane`.
+      };
+    };
+  };
+}

From 113f9f04fc86094d70074934e5b421d51205d96e Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Tue, 31 Mar 2026 10:18:16 +0200
Subject: [PATCH 08/86] nixos/rancher: fix multi node test

---
 nixos/tests/rancher/multi-node.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/rancher/multi-node.nix b/nixos/tests/rancher/multi-node.nix
index 2e47db1f18e4..d44884e5002e 100644
--- a/nixos/tests/rancher/multi-node.nix
+++ b/nixos/tests/rancher/multi-node.nix
@@ -224,7 +224,7 @@ in
 
       # Now create a pod on each node via a daemonset and verify they can talk to each other.
       server.succeed("kubectl apply -f ${networkTestDaemonset}")
-      server.wait_until_succeeds(f'[ "$(kubectl get ds test -o json | jq .status.numberReady)" -eq {len(machines)} ]')
+      server.wait_until_succeeds("kubectl rollout status daemonset test")
 
       # Get pod IPs
       pods = server.succeed("kubectl get po -o json | jq '.items[].metadata.name' -r").splitlines()

From 8b1fa6d7c5b2163b2e25df42052f24f3e147f241 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 4 Apr 2026 05:14:47 +0000
Subject: [PATCH 09/86] python3Packages.pyqt6-charts: 6.10.0 -> 6.11.0

---
 pkgs/development/python-modules/pyqt6-charts/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyqt6-charts/default.nix b/pkgs/development/python-modules/pyqt6-charts/default.nix
index 92eb9ac0b9d7..a5234ebce56c 100644
--- a/pkgs/development/python-modules/pyqt6-charts/default.nix
+++ b/pkgs/development/python-modules/pyqt6-charts/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-charts";
-  version = "6.10.0";
+  version = "6.11.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyqt6_charts";
     inherit version;
-    hash = "sha256-keFeKNARyqTIOIGpBoezXj0F71cpDN2XYIJMlb2saj4=";
+    hash = "sha256-EJHNkZgGo84F0idnKfeb5Oy9CpOVAKiJkCbD71dpxlA=";
   };
 
   # fix include path and increase verbosity

From 0e6934a4539b730d3f27843c248a61bf4dae0933 Mon Sep 17 00:00:00 2001
From: Maevi <me@maevi.net>
Date: Sat, 4 Apr 2026 13:45:39 +0200
Subject: [PATCH 10/86] rke2_1_32: drop

---
 .../cluster/rke2/1_32/images-versions.json    | 138 ------------------
 .../networking/cluster/rke2/1_32/versions.nix |  13 --
 .../networking/cluster/rke2/default.nix       |   2 -
 pkgs/top-level/aliases.nix                    |   1 +
 pkgs/top-level/all-packages.nix               |   1 -
 5 files changed, 1 insertion(+), 154 deletions(-)
 delete mode 100644 pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
 delete mode 100644 pkgs/applications/networking/cluster/rke2/1_32/versions.nix

diff --git a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
deleted file mode 100644
index a9287cab5d3c..000000000000
--- a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
+++ /dev/null
@@ -1,138 +0,0 @@
-{
-  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "b2b1ce6fc213202829513dd99997de7979dc5dd26f4fad8e02918848928ac892"
-  },
-  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "9aae79e102c20418d184906f5e1e36bb01c6a2c41b7e9405b2a20816d0ec58ff"
-  },
-  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "52bdb3ebd6f2cbe4fe0a1894dda8f853e33bc31eaee83a352d014f3464168116"
-  },
-  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "86f6f5cfe607e15eeb7a35522325ccbea56f1d84ca27cd02c626e4356ca54c56"
-  },
-  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "1fbe1a2c48fcedcec613cee071f0b524f007a191c858952c0c6243c28a292e30"
-  },
-  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "7e3f80b037079922f6a0aaf5a701459ef550d67ca31119a0c74955254fa52b1e"
-  },
-  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "1152d6f24c5b955e37300cbfcd68a8c212c1036ce8964e2ffc22422522fa1d83"
-  },
-  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "50f4d1b1bb03523b922d7ce989d2d83f009d751d7fbf4aa8821fe52c9b9fd96d"
-  },
-  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "c28b224620327061bb707c31733c3428a7573e2f905178ddd9d038dec7d00370"
-  },
-  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "8db98924c2e9534574bab2584b08467cc1c379e740d345b8bad3768d1bed4c5f"
-  },
-  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "b6a8a882c1285687a78add12e4be64c335f13de8975f9bb7c142aadbaa1f10c5"
-  },
-  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "7ea32966e4a4fb2ad0c5fae8eece897d22e1a1515ce7d7954f7aa341c6ca51ac"
-  },
-  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "02c940745706a79eedb0b579f2368cdbdf8c54de148f4d8fda70f7ee66d7ecf2"
-  },
-  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "a52feceeb43d21fb8494def190841a046b896c4dfc8e964f3646916f1b20f829"
-  },
-  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "2d2e23a72f23bedee62d2163df68009fc099ae9c3de1aa34c5cbcfa75f1a8e73"
-  },
-  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "e872a4ceb854138916c4a283904f658398c6894e2595c348b40f03e1cdcc6f86"
-  },
-  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "a3f60044c7da90d4c2dd5cbc44c897ffcc2660bd1d2dcafa8a900bf8ca100589"
-  },
-  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "d843630e86003cf4b18a1ef070b44c3a73e1431770244e853eafcecdb714bfa3"
-  },
-  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "e4a605d5af2a79bd7901f1678e488f776774916e1c5104090e813bd45a257bc3"
-  },
-  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "c94fecb19b6b1eaa347c49fc60def2e1251d866714e9ab05ea6ce29d5da41fb3"
-  },
-  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "d0d213e4e6a3931950b5b61f67c9c0163838095f3fb5486e9256902aff397547"
-  },
-  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "6a914bba0f07f9f3431058f2b1b2c5ed9d8124069f436bfea747c293b5276dff"
-  },
-  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "a133106b2348dcbfa28c7b219a22e6cc7cf399a741196c1a435a211050aba4b5"
-  },
-  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "0a28d456de6bdc33b806a236e0732c5bcb8bd01dc0e64e84eb2daee51467dace"
-  },
-  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "7df59c19b452c971cd5e739042d0cc3146ba061f3e54aeae25794203592e6866"
-  },
-  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "83c9451a8dfc116bddc38146f2a6eddef95d09348386e2b11c7d5479a114de34"
-  },
-  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "77a270820a7955fe9bc7b0d2b6b4b6b8b73e6f042ddd9101b89d1cc0a1b95908"
-  },
-  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "d3eb6dab20944a417d0cbc6eed3a4838c008646a40c3e6b637729f7f9251ff8c"
-  },
-  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "24f246a655706dbcfc34fb1fbe055978f79bee25791e3ba8c0239cd370b3630a"
-  },
-  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
-  },
-  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "1f553eb44e38ffe20cae2a8297c249b3d46fa1ddee859b5823102077525e2ca7"
-  },
-  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
-  },
-  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "a38d2489e69e4e25ecba96c3ecc91d087df4eb0ebb7f7dbffc9a25f3fef9e823"
-  },
-  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "768defc1af4754f6a77ac7fda8bf9472764dab3cc82b9b3f8f9622ed17fb311c"
-  }
-}
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
deleted file mode 100644
index fedc30664a4a..000000000000
--- a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  rke2Version = "1.32.13+rke2r1";
-  rke2Commit = "a361386c83e8e581c2634a408bc7e4dd44fdcedc";
-  rke2TarballHash = "sha256-jEr7wTMRUk0dOO50G0+iIKywVlBM5Et//nbt7R2mu/0=";
-  rke2VendorHash = "sha256-rptP0Pb5tgufcXMmtaYaNk/Lyqp1bmlk9upm2amKfno=";
-  k8sImageTag = "v1.32.13-rke2r1-build20260227";
-  etcdVersion = "v3.5.26-k3s1-build20260227";
-  pauseVersion = "3.6";
-  ccmVersion = "v1.32.12-0.20260211145907-0dc662e80238-build20260211";
-  dockerizedVersion = "v1.32.13-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
-  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
-}
diff --git a/pkgs/applications/networking/cluster/rke2/default.nix b/pkgs/applications/networking/cluster/rke2/default.nix
index 5b3f1ceac55f..a76456652e5d 100644
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@@ -5,8 +5,6 @@ let
   extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_32 = common (import ./1_32/versions.nix) extraArgs;
-
   rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;
 
   rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2754e3bae31e..2e255afc5e3f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1748,6 +1748,7 @@ mapAliases {
   rke2_1_29 = throw "'rke2_1_29' has been removed from nixpkgs as it has reached end of life"; # Added 2025-05-05
   rke2_1_30 = throw "'rke2_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-11-04
   rke2_1_31 = throw "'rke2_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
+  rke2_1_32 = throw "'rke2_1_32' has been removed from nixpkgs as it has reached end of life"; # Added 2026-04-04
   rl_json = throw "'rl_json' has been renamed to/replaced by 'tclPackages.rl_json'"; # Converted to throw 2025-10-27
   rockbox_utility = throw "'rockbox_utility' has been renamed to/replaced by 'rockbox-utility'"; # Converted to throw 2025-10-27
   rockcraft = throw "rockcraft was removed in Sep 25 following removal of LXD from nixpkgs"; # Added 2025-09-18
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 10e58b8c0268..bb2f65589ba7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10450,7 +10450,6 @@ with pkgs;
       callPackage ../applications/networking/instant-messengers/ripcord/darwin.nix { };
 
   inherit (callPackage ../applications/networking/cluster/rke2 { })
-    rke2_1_32
     rke2_1_33
     rke2_1_34
     rke2_1_35

From 666d75a81e55b716cb17804359a658c8ced57d18 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 4 Apr 2026 18:01:51 +0000
Subject: [PATCH 11/86] python3Packages.pyqt6-webengine: 6.10.0 -> 6.11.0

---
 pkgs/development/python-modules/pyqt6-webengine/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyqt6-webengine/default.nix b/pkgs/development/python-modules/pyqt6-webengine/default.nix
index d1894ca206dd..009390998e4c 100644
--- a/pkgs/development/python-modules/pyqt6-webengine/default.nix
+++ b/pkgs/development/python-modules/pyqt6-webengine/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-webengine";
-  version = "6.10.0";
+  version = "6.11.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyqt6_webengine";
     inherit version;
-    hash = "sha256-Jn0nJ10Mea4nC8pLA1IKQfp+hcKk2WMtqMucwjOlWtE=";
+    hash = "sha256-Fc9J77u9TGvIdlOyxK6A1gSfgA4xYgszZzSuLjfL7a4=";
   };
 
   patches = [

From 5f7b8e1797fb77241dba445ff934faec2b0040e3 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Thu, 9 Apr 2026 17:57:22 +0200
Subject: [PATCH 12/86] lixPackageSets.git.lix: 2.96.0-pre-20260318 ->
 2.96.0-pre-20260408

---
 pkgs/tools/package-management/lix/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 8ebcd187f4a3..df1580115bd9 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -295,14 +295,14 @@ lib.makeExtensible (
       attrName = "git";
 
       lix-args = rec {
-        version = "2.96.0-pre-20260318_${builtins.substring 0 12 src.rev}";
+        version = "2.96.0-pre-20260408_${builtins.substring 0 12 src.rev}";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
-          rev = "8294cd534b2f01ee967b28aa73fcab1535d62b3d";
-          hash = "sha256-BFijbNDCrfzpDdW+gNauP25QsTvEZ39dygWEI/RYeyY=";
+          rev = "bc9fb560ac2d36cd317a856ee96785ea2055fbff";
+          hash = "sha256-bONRPjhk5OZdnkQZexZNJzlvwIPg31Gy7fNiwGoX3BQ=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {

From a428a525d3886cf120b62c4b398eab0bde1ec95c Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Fri, 10 Apr 2026 08:58:40 +0200
Subject: [PATCH 13/86] vinyl-cache_9: init at 9.0.0

This package is fairly similar to the varnish packages, but has no modules
packages because the "varnish-modules" projects expects a varnish, not a
vinyl cache.
---
 pkgs/servers/vinyl-cache/default.nix | 132 +++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix      |   6 ++
 2 files changed, 138 insertions(+)
 create mode 100644 pkgs/servers/vinyl-cache/default.nix

diff --git a/pkgs/servers/vinyl-cache/default.nix b/pkgs/servers/vinyl-cache/default.nix
new file mode 100644
index 000000000000..03aab5a100f3
--- /dev/null
+++ b/pkgs/servers/vinyl-cache/default.nix
@@ -0,0 +1,132 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  buildPackages,
+  pcre2,
+  jemalloc,
+  libunwind,
+  libxslt,
+  groff,
+  ncurses,
+  pkg-config,
+  readline,
+  libedit,
+  coreutils,
+  python3,
+  makeWrapper,
+  nixosTests,
+}:
+
+let
+  generic =
+    {
+      version,
+      hash,
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      pname = "vinyl-cache";
+      inherit version;
+
+      src = fetchurl {
+        url = "https://vinyl-cache.org/downloads/${finalAttrs.pname}-${version}.tgz";
+        inherit hash;
+      };
+
+      __structuredAttrs = true;
+      strictDeps = true;
+
+      nativeBuildInputs = [
+        pkg-config
+        python3.pkgs.docutils
+        python3.pkgs.sphinx
+        makeWrapper
+      ];
+
+      buildInputs = [
+        libxslt
+        groff
+        ncurses
+        readline
+        libedit
+        pcre2
+        python3
+      ]
+      ++ lib.optional stdenv.hostPlatform.isDarwin libunwind
+      ++ lib.optional stdenv.hostPlatform.isLinux jemalloc;
+
+      configureFlags = [
+        # the checks behind those to not work when doing cross but for simplicity we always define them
+        "ac_cv_have_tcp_fastopen=yes"
+        "ac_cv_have_tcp_keep=yes"
+        "ac_cv_have_working_close_range=yes"
+        "PYTHON=${buildPackages.python3.interpreter}"
+      ];
+
+      buildFlags = [ "localstatedir=/var/run" ];
+
+      postPatch = ''
+        substituteInPlace bin/vinyltest/vtest2/src/vtc_main.c --replace-fail /bin/rm "${coreutils}/bin/rm"
+      '';
+
+      postConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        # prevent cache invalidation
+        substituteInPlace bin/vinyld/Makefile \
+          --replace-fail "vhp_hufdec.h: vhp_gen_hufdec" "vhp_hufdec.h:"
+
+        ln -s "${buildPackages.vinyl.vhp_hufdec_h}" bin/vinyld/vhp_hufdec.h
+
+        substituteInPlace bin/vinylstat/Makefile \
+          --replace-fail "vinylstat_curses_help.c: vinylstat_help_gen" "vinylstat_curses_help.c:" \
+          --replace-fail "./vinylstat_help_gen" "${buildPackages.vinyl}/bin/vinylstat_help_gen"
+
+        # the docs execute lots of commands to gather options and flags
+        substituteInPlace doc/Makefile \
+          --replace-fail "SUBDIRS = graphviz sphinx" "SUBDIRS = graphviz"
+        substituteInPlace Makefile \
+          --replace-fail "include lib bin vmod etc doc man contrib" "include lib bin vmod etc doc contrib"
+      '';
+
+      postInstall = ''
+        wrapProgram "$out/sbin/vinyld" --prefix PATH : "${lib.makeBinPath [ stdenv.cc ]}"
+      ''
+      + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        cp bin/vinyld/vhp_hufdec.h $vhp_hufdec_h
+      '';
+
+      # https://github.com/varnishcache/varnish-cache/issues/1875
+      env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isi686 "-fexcess-precision=standard";
+
+      outputs = [
+        "out"
+        "dev"
+      ]
+      ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+        "man"
+        "vhp_hufdec_h" # only used for cross compilation
+      ];
+
+      passthru = {
+        python = python3;
+      };
+
+      meta = {
+        description = "Web application accelerator also known as a caching HTTP reverse proxy";
+        homepage = "https://vinyl-cache.org";
+        license = lib.licenses.bsd2;
+        maintainers = [
+          lib.maintainers.leona
+          lib.maintainers.osnyx
+        ];
+        platforms = lib.platforms.unix;
+        broken = stdenv.hostPlatform.isDarwin;
+      };
+    });
+in
+{
+  # EOL 2027-03-16
+  vinyl-cache_9 = generic {
+    version = "9.0.0";
+    hash = "sha256-l0DCEMKndifVD9CtbHWdw8oJT8tOZVW6VfynHPSDvRc=";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0a5b07f5deb6..7acac5432b43 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3557,6 +3557,12 @@ with pkgs;
   varnishPackages = varnish80Packages;
   varnish = varnishPackages.varnish;
 
+  inherit (callPackages ../servers/vinyl-cache { })
+    vinyl-cache_9
+    ;
+
+  vinyl-cache = vinyl-cache_9;
+
   vncdo = with python3Packages; toPythonApplication vncdo;
 
   # An alias to work around the splicing incidents

From 1b76e5a9ce840f9880ce7d5d1a6076f1ca71713e Mon Sep 17 00:00:00 2001
From: 2tefan <me@2tefan.eu>
Date: Sat, 18 Apr 2026 20:35:43 +0200
Subject: [PATCH 14/86] mosquitto: 2.0.22 -> 2.1.2

---
 pkgs/by-name/mo/mosquitto/package.nix | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mo/mosquitto/package.nix b/pkgs/by-name/mo/mosquitto/package.nix
index 967eade3b7dd..ae3e932a0aa6 100644
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -7,11 +7,13 @@
   libxslt,
   c-ares,
   cjson,
+  libargon2,
   libuuid,
   libuv,
   libwebsockets,
   openssl,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  sqlite,
   systemd,
   uthash,
   nixosTests,
@@ -32,13 +34,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mosquitto";
-  version = "2.0.22";
+  version = "2.1.2";
+  # Tests disabled: upstream test suite requires additional Python deps,
+  # uses chown() to fixed UIDs, and relies on signal handling that breaks
+  # in sandboxed builds. Re-enable once upstream tests are sandbox-friendly.
+  doCheck = false;
 
   src = fetchFromGitHub {
-    owner = "eclipse";
+    owner = "eclipse-mosquitto";
     repo = "mosquitto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PCiNxRG2AqVlS2t/u7Cqn8NbTrrYGO1OXl8zvPQRrJM=";
+    hash = "sha256-Zl55yjuzQY2fyaKs/zLaJ7a3OONKTDQPaT+DpPURdZI=";
   };
 
   postPatch = ''
@@ -63,22 +69,27 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     c-ares
     cjson
+    libargon2
     libuuid
     libuv
     libwebsockets'
     openssl
+    sqlite
     uthash
   ]
   ++ lib.optional withSystemd systemd;
 
+  propagatedBuildInputs = [ cjson ];
+
   cmakeFlags = [
     (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
     (lib.cmakeBool "WITH_WEBSOCKETS" true)
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
   postFixup = ''
-    sed -i "s|^prefix=.*|prefix=$lib|g" $dev/lib/pkgconfig/*.pc
+    sed -i "s|^libdir=.*|libdir=$lib/lib|g" $dev/lib/pkgconfig/*.pc
   '';
 
   passthru.tests = {

From 0101675dad73660b4f037da356ccc5b00217b512 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 21 Apr 2026 13:09:07 +0200
Subject: [PATCH 15/86] nixos/mosquitto: allow 2.1 config keys in freeform
 settings

Mosquitto 2.1 introduced a number of new listener, bridge and global
config keys. The module rejects unknown keys via assertKeysValid, so
these need to be added to the allowlists for users to be able to set
them.
---
 nixos/modules/services/networking/mosquitto.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index fd16442ad185..36fcc5f752ea 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -263,6 +263,7 @@ let
     ++ formatFreeform { prefix = "auth_opt_"; } plugin.options;
 
   freeformListenerKeys = {
+    accept_protocol_versions = 1;
     allow_anonymous = 1;
     allow_zero_length_clientid = 1;
     auto_id_prefix = 1;
@@ -274,13 +275,18 @@ let
     "ciphers_tls1.3" = 1;
     crlfile = 1;
     dhparamfile = 1;
+    disable_client_cert_date_checks = 1;
+    enable_proxy_protocol = 1;
     http_dir = 1;
     keyfile = 1;
+    listener_allow_anonymous = 1;
+    listener_auto_id_prefix = 1;
     max_connections = 1;
     max_qos = 1;
     max_topic_alias = 1;
     mount_point = 1;
     protocol = 1;
+    proxy_protocol_v2_require_tls = 1;
     psk_file = 1;
     psk_hint = 1;
     require_certificate = 1;
@@ -292,6 +298,7 @@ let
     use_identity_as_username = 1;
     use_subject_as_username = 1;
     use_username_as_clientid = 1;
+    websockets_origin = 1;
   };
 
   listenerOptions =
@@ -413,7 +420,11 @@ let
     bridge_outgoing_retain = 1;
     bridge_protocol_version = 1;
     bridge_psk = 1;
+    bridge_receive_maximum = 1;
+    bridge_reload_type = 1;
     bridge_require_ocsp = 1;
+    bridge_session_expiry_interval = 1;
+    bridge_tls_use_os_certs = 1;
     bridge_tls_version = 1;
     cleansession = 1;
     idle_timeout = 1;
@@ -512,6 +523,9 @@ let
     autosave_on_changes = 1;
     check_retain_source = 1;
     connection_messages = 1;
+    enable_control_api = 1;
+    global_max_clients = 1;
+    global_max_connections = 1;
     log_facility = 1;
     log_timestamp = 1;
     log_timestamp_format = 1;

From 068672d9af8c54206629ac685b6a3ca02404b11e Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 21 Apr 2026 13:09:31 +0200
Subject: [PATCH 16/86] nixos/mosquitto: emit plugin/plugin_opt_* instead of
 deprecated aliases

The auth_plugin and auth_opt_* config keys have been deprecated upstream
in favour of plugin and plugin_opt_*. Both spellings are accepted since
mosquitto 2.0, so this is safe regardless of the package version.

auth_plugin_deny_special_chars has no new-style alias and is kept as-is.
---
 nixos/modules/services/networking/mosquitto.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index 36fcc5f752ea..1d3bf8d671df 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -239,8 +239,8 @@ let
         options = lib.mkOption {
           type = attrsOf optionType;
           description = ''
-            Options for the auth plugin. Each key turns into a `auth_opt_*`
-             line in the config.
+            Options for the plugin. Each key turns into a `plugin_opt_*`
+            line in the config.
           '';
           default = { };
         };
@@ -257,10 +257,10 @@ let
   formatAuthPlugin =
     plugin:
     [
-      "auth_plugin ${plugin.plugin}"
+      "plugin ${plugin.plugin}"
       "auth_plugin_deny_special_chars ${optionToString plugin.denySpecialChars}"
     ]
-    ++ formatFreeform { prefix = "auth_opt_"; } plugin.options;
+    ++ formatFreeform { prefix = "plugin_opt_"; } plugin.options;
 
   freeformListenerKeys = {
     accept_protocol_versions = 1;

From 386a2346d7c43582bee112c3241343ce477d0019 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 21 Apr 2026 13:13:15 +0200
Subject: [PATCH 17/86] nixos/mosquitto: use acl-file/password-file plugins

Mosquitto 2.1 deprecated the acl_file and password_file config options
in favour of plugins shipping the same code, with removal scheduled for
3.0. Switch the per-listener config generation over to load the plugins
instead.

per_listener_settings is also deprecated but kept for now since the
module design is built around per-listener auth and the 3.0 replacement
semantics are not yet finalised upstream.

A version assertion is added since the plugins only ship with 2.1+.
---
 .../manual/release-notes/rl-2605.section.md   |  2 ++
 .../modules/services/networking/mosquitto.md  | 11 ++++++-----
 .../modules/services/networking/mosquitto.nix | 19 +++++++++++++++++--
 3 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index f883372fd450..b07a270be3da 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -147,6 +147,8 @@
 
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
 
+- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
+
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
 
 - `services.statsd` has been removed because the packages it relies on do not exist anymore in nixpkgs.
diff --git a/nixos/modules/services/networking/mosquitto.md b/nixos/modules/services/networking/mosquitto.md
index 53b5beb16b89..b1a6fabb1f2a 100644
--- a/nixos/modules/services/networking/mosquitto.md
+++ b/nixos/modules/services/networking/mosquitto.md
@@ -83,9 +83,10 @@ localhost).
 
 Almost all options of Mosquitto are available for configuration at their appropriate levels, some
 as NixOS options written in camel case, the remainders under `settings` with their exact names in
-the Mosquitto config file. The exceptions are `acl_file` (which is always set according to the
-`acl` attributes of a listener and its users) and `per_listener_settings` (which is always set to
-`true`).
+the Mosquitto config file. The exceptions are `per_listener_settings` (which is always set to
+`true`) and the per-listener access control, which is always configured via instances of the
+`acl-file` and `password-file` plugins generated from the `acl` and `users` attributes of each
+listener.
 
 ### Password authentication {#module-services-mosquitto-config-passwords}
 
@@ -101,8 +102,8 @@ will not be able to use the broker.
 
 ### ACL format {#module-services-mosquitto-config-acl}
 
-Every listener has a Mosquitto `acl_file` attached to it. This ACL is configured via two
-attributes of the config:
+Every listener has an instance of the Mosquitto `acl-file` plugin attached to it. This ACL is
+configured via two attributes of the config:
 
   * the `acl` attribute of the listener configures pattern ACL entries and topic ACL entries
     for anonymous users. Each entry must be prefixed with `pattern` or `topic` to distinguish
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index 1d3bf8d671df..21b531533513 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -7,6 +7,8 @@
 let
   cfg = config.services.mosquitto;
 
+  pluginLibDir = "${lib.getLib cfg.package}/lib";
+
   # note that mosquitto config parsing is very simplistic as of may 2021.
   # often times they'll e.g. strtok() a line, check the first two tokens, and ignore the rest.
   # there's no escaping available either, so we have to prevent any being necessary.
@@ -400,10 +402,16 @@ let
     idx: listener:
     [
       "listener ${toString listener.port} ${toString listener.address}"
-      "acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
     ]
-    ++ lib.optional (!listener.omitPasswordAuth) "password_file ${cfg.dataDir}/passwd-${toString idx}"
     ++ formatFreeform { } listener.settings
+    ++ [
+      "plugin ${pluginLibDir}/mosquitto_acl_file.so"
+      "plugin_opt_acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
+    ]
+    ++ lib.optionals (!listener.omitPasswordAuth) [
+      "plugin ${pluginLibDir}/mosquitto_password_file.so"
+      "plugin_opt_password_file ${cfg.dataDir}/passwd-${toString idx}"
+    ]
     ++ lib.concatMap formatAuthPlugin listener.authPlugins;
 
   freeformBridgeKeys = {
@@ -648,6 +656,13 @@ let
   globalAsserts =
     prefix: cfg:
     lib.flatten [
+      {
+        assertion = lib.versionAtLeast cfg.package.version "2.1";
+        message = ''
+          ${prefix}.package must be at least version 2.1, since the generated
+          configuration relies on the acl-file and password-file plugins.
+        '';
+      }
       (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
       (lib.imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
       (lib.mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)

From 3c82eeaac24160c1f7d256786734150d42fed374 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 23 Apr 2026 10:15:29 -0400
Subject: [PATCH 18/86] river: 0.4.2 -> 0.4.4

Changelog: https://codeberg.org/river/river/releases/tag/v0.4.4
---
 pkgs/by-name/ri/river/build.zig.zon.nix | 25 +++++++++++++++++++++----
 pkgs/by-name/ri/river/package.nix       | 12 +++++++-----
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ri/river/build.zig.zon.nix b/pkgs/by-name/ri/river/build.zig.zon.nix
index 9ba533294dc2..84468fb2d9a4 100644
--- a/pkgs/by-name/ri/river/build.zig.zon.nix
+++ b/pkgs/by-name/ri/river/build.zig.zon.nix
@@ -7,6 +7,14 @@
 }:
 
 linkFarm "zig-packages" [
+  {
+    name = "aro-0.0.0-JSD1Qi7QNgDnfcrdEJf82v3o6MhZySjYVrtdfEf3E4Se";
+    path = fetchgit {
+      url = "https://github.com/Vexu/arocc";
+      rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+      hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
+    };
+  }
   {
     name = "pixman-0.3.0-LClMnz2VAAAs7QSCGwLimV5VUYx0JFnX5xWU6HwtMuDX";
     path = fetchzip {
@@ -14,6 +22,14 @@ linkFarm "zig-packages" [
       hash = "sha256-8tA4auo5FEI4IPnomV6bkpQHUe302tQtorFQZ1l14NU=";
     };
   }
+  {
+    name = "translate_c-0.0.0-Q_BUWrT0BgDOFSyiz0UVBIpBe3-CiEqx9ej2EecgKcBD";
+    path = fetchgit {
+      url = "https://codeberg.org/ifreund/translate-c";
+      rev = "fdf30e6298cd1184ae6da5602aff0cb5d4cde4cb";
+      hash = "sha256-4ZZZMugHHxUwdot7/lKQe0UDwgZWqiub0bz6jkX2hCY=";
+    };
+  }
   {
     name = "wayland-0.4.0-lQa1khbMAQAsLS2eBR7M5lofyEGPIbu2iFDmoz8lPC27";
     path = fetchzip {
@@ -22,10 +38,11 @@ linkFarm "zig-packages" [
     };
   }
   {
-    name = "wayland-0.5.0-lQa1knz8AQCh08NA8BeQrwJB9U3CfqcVAdHZYGRKIGuu";
-    path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.5.0.tar.gz";
-      hash = "sha256-mhqOtC26iACIvQUq74AbLSXSPsnWMi3AvDV7G2uElpo=";
+    name = "wayland-0.6.0-dev-lQa1krD8AQBlMqwuhAMJjPQKXvpRByZBxxqMVAZ7yzbG";
+    path = fetchgit {
+      url = "https://codeberg.org/ifreund/zig-wayland";
+      rev = "4a150a04f76f7329e80280661355c04328369d1f";
+      hash = "sha256-B5nA05xYm6iRDDRFC2KUbhBCtjwmApka+BcDCZRssfw=";
     };
   }
   {
diff --git a/pkgs/by-name/ri/river/package.nix b/pkgs/by-name/ri/river/package.nix
index 66439a4bff31..1e510da77cac 100644
--- a/pkgs/by-name/ri/river/package.nix
+++ b/pkgs/by-name/ri/river/package.nix
@@ -18,14 +18,16 @@
   wayland-scanner,
   wlroots_0_20,
   xwayland,
-  zig_0_15,
+  zig_0_16,
   withManpages ? true,
   xwaylandSupport ? true,
 }:
-
+let
+  zig = zig_0_16;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.4.2";
+  version = "0.4.4";
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
 
@@ -33,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "river";
     repo = "river";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nufonz39XphxPW1lERq2acVgE5mGmW+x1yimyS6O4tc=";
+    hash = "sha256-2RmyiwqXCBVN44zsdDKNv/ha08uIuzma3rnY0QhhKy4=";
   };
 
   strictDeps = true;
@@ -44,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     wayland-scanner
     xwayland
-    zig_0_15
+    zig
   ]
   ++ lib.optional withManpages scdoc;
 

From d7de32990ced51752ec8c60ffe8835c490244b92 Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Fri, 10 Apr 2026 08:58:40 +0200
Subject: [PATCH 19/86] nixos/vinyl-cache: init module

This module is essentialy the same as services.varnish, but adapts to the
changed project name. For the lifetime of NixOS 26.05, we still support
Varnish to simplify the migration.
---
 nixos/modules/module-list.nix                 |   1 +
 .../web-servers/vinyl-cache/default.nix       | 240 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   4 +
 nixos/tests/vinyl-cache.nix                   | 126 +++++++++
 pkgs/servers/vinyl-cache/default.nix          |   1 +
 5 files changed, 372 insertions(+)
 create mode 100644 nixos/modules/services/web-servers/vinyl-cache/default.nix
 create mode 100644 nixos/tests/vinyl-cache.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b23517fcce16..c77cca562a6c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1834,6 +1834,7 @@
   ./services/web-servers/unit/default.nix
   ./services/web-servers/uwsgi.nix
   ./services/web-servers/varnish/default.nix
+  ./services/web-servers/vinyl-cache/default.nix
   ./services/x11/clight.nix
   ./services/x11/colord.nix
   ./services/x11/desktop-managers/default.nix
diff --git a/nixos/modules/services/web-servers/vinyl-cache/default.nix b/nixos/modules/services/web-servers/vinyl-cache/default.nix
new file mode 100644
index 000000000000..ba498537edc8
--- /dev/null
+++ b/nixos/modules/services/web-servers/vinyl-cache/default.nix
@@ -0,0 +1,240 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+
+  cfg = config.services.vinyl-cache;
+
+  # Vinyl Cache has very strong opinions and very complicated code around handling
+  # the stateDir. After a lot of back and forth, we decided that we a)
+  # do not want a configurable option here, as most of the handling depends
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Vinyl Cache anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir = "/var/run/vinyld";
+
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses = (
+    concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen
+  );
+
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvinyld") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr port;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
+  commandLine =
+    "-f ${pkgs.writeText "default.vcl" cfg.config}"
+    +
+      lib.optionalString (cfg.extraModules != [ ])
+        " -p vmod_path='${
+           lib.makeSearchPathOutput "lib" "lib/vinyl/vmods" ([ cfg.package ] ++ cfg.extraModules)
+         }' -r vmod_path";
+in
+{
+  meta.maintainers = [
+    lib.maintainers.leona
+    lib.maintainers.osnyx
+  ];
+  options = {
+    services.vinyl-cache = {
+      enable = lib.mkEnableOption "Vinyl Cache";
+
+      enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
+        default = true;
+      };
+
+      package = lib.mkPackageOption pkgs "vinyl-cache" { };
+
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = [
+          {
+            address = "*";
+            port = 6081;
+          }
+        ];
+      };
+
+      config = lib.mkOption {
+        type = lib.types.lines;
+        description = ''
+          Verbatim default.vcl configuration.
+        '';
+      };
+
+      extraModules = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = ''
+          Vinyl Cache modules (except 'std').
+        '';
+      };
+
+      extraCommandLine = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        example = "-s malloc,256M";
+        description = ''
+          Command line switches for vinyld (run 'vinyld -?' to get list of options)
+        '';
+      };
+
+      enableFileLogging = lib.mkEnableOption "file based logging";
+    };
+
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      systemd.services.vinyl-cache = {
+        description = "Vinyl Cache";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${cfg.package}/bin/vinyld ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+          Restart = "always";
+          RestartSec = "5s";
+          User = "vinyl-cache";
+          Group = "vinyl-cache";
+          DynamicUser = true;
+          RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          NoNewPrivileges = true;
+          LimitNOFILE = 131072;
+        };
+      };
+
+      environment.systemPackages = [ cfg.package ];
+
+      # check .vcl syntax at compile time (e.g. before nixops deployment)
+      system.checks = lib.mkIf cfg.enableConfigCheck [
+        (pkgs.runCommand "check-vinyl-cache-syntax" { } ''
+          ${cfg.package}/bin/vinyld -C ${commandLine} 2> $out || (cat $out; exit 1)
+        '')
+      ];
+
+    (lib.mkIf (cfg.enable && cfg.enableFileLogging) {
+      systemd.services = {
+        vinylncsa = {
+          after = [ "vinyl-cache.service" ];
+          requires = [ "vinyl-cache.service" ];
+          description = "Vinyl Cache logging daemon";
+          wantedBy = [ "multi-user.target" ];
+          # We want to reopen logs with HUP. vinylncsa must run in daemon mode for that.
+          serviceConfig = {
+            Type = "forking";
+            Restart = "always";
+            RuntimeDirectory = "vinylncsa";
+            LogsDirectory = "vinyl-cache";
+            PIDFile = "/run/vinylncsa/vinylncsa.pid";
+            User = "vinyl-cache";
+            Group = "vinyl-cache";
+            ExecStart = "${cfg.package}/bin/vinylncsa -D -a -w /var/log/vinyl-cache/vinyl-cache.log -P /run/vinylncsa/vinylncsa.pid";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          };
+        };
+      };
+
+      services.logrotate.settings.vinyl-cache = lib.mapAttrs (_: lib.mkDefault) {
+        files = [ "/var/log/vinyl-cache/*.log" ];
+        frequency = "daily";
+        rotate = 14;
+        compress = true;
+        delaycompress = true;
+        postrotate = "systemctl reload vinylncsa";
+      };
+    })
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 929e8362e8f3..68ece27faa63 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1743,6 +1743,10 @@ in
   victoriametrics = import ./victoriametrics { inherit runTest; };
   victoriatraces = import ./victoriatraces { inherit runTest; };
   vikunja = runTest ./vikunja.nix;
+  vinyl-cache_9 = runTest {
+    imports = [ ./vinyl-cache.nix ];
+    _module.args.package = pkgs.vinyl-cache_9;
+  };
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
diff --git a/nixos/tests/vinyl-cache.nix b/nixos/tests/vinyl-cache.nix
new file mode 100644
index 000000000000..aec9415b333f
--- /dev/null
+++ b/nixos/tests/vinyl-cache.nix
@@ -0,0 +1,126 @@
+{
+  pkgs,
+  package,
+  lib,
+  ...
+}:
+let
+  testPath = pkgs.hello;
+in
+{
+  name = "vinyl";
+  meta = {
+    maintainers = [
+      lib.maintainers.leona
+      lib.maintainers.osnyx
+    ];
+  };
+
+  nodes = {
+    vinyl =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services.nix-serve = {
+          enable = true;
+        };
+
+        services.vinyl-cache = {
+          inherit package;
+          enable = true;
+          enableFileLogging = true;
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            {
+              address = "/var/run/vinyld/client.http.sock";
+              user = "vinyl-cache";
+              group = "vinyl-cache";
+              mode = "660";
+            }
+          ]
+          ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+            # Support added in 7.3.0
+            { address = "@asdf"; }
+          ];
+          config = ''
+            vcl 4.1;
+
+            backend nix-serve {
+              .host = "127.0.0.1";
+              .port = "${toString config.services.nix-serve.port}";
+            }
+          '';
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        system.extraDependencies = [ testPath ];
+
+        assertions =
+          let
+            cmdline = config.systemd.services.vinyl-cache.serviceConfig.ExecStart;
+          in
+          map
+            (pattern: {
+              assertion = lib.hasInfix pattern cmdline;
+              message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+            })
+            (
+              [
+                " -a 0.0.0.0:80,HTTP "
+                " -a proxyport=0.0.0.0:8080,PROXY "
+                " -a /var/run/vinyld/client.http.sock,HTTP,user=vinyl-cache,group=vinyl-cache,mode=660 "
+              ]
+              ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+                " -a @asdf,HTTP "
+              ]
+            );
+      };
+
+    client =
+      { lib, ... }:
+      {
+        nix.settings = {
+          require-sigs = false;
+          substituters = lib.mkForce [ "http://vinyl" ];
+        };
+      };
+  };
+
+  testScript = ''
+    from pathlib import Path
+    import os
+
+    start_all()
+    vinyl.wait_for_open_port(80)
+    vinyl.wait_for_unit("vinylncsa")
+
+    client.wait_until_succeeds("curl -f http://vinyl/nix-cache-info");
+
+    client.wait_until_succeeds("nix-store -r ${testPath}")
+    client.succeed("${testPath}/bin/hello")
+
+    output = vinyl.succeed("vinyladm status")
+    print(output)
+    assert "Child in state running" in output, "Unexpected vinyladm response"
+
+    vinyl.copy_from_machine("/var/log/vinyl-cache/vinyl-cache.log")
+
+    out_dir = os.environ.get("out", os.getcwd())
+    vinyl_log = (Path(out_dir) / "vinyl-cache.log").read_text()
+    assert "http://vinyl/nix-cache-info" in vinyl_log
+  '';
+}
diff --git a/pkgs/servers/vinyl-cache/default.nix b/pkgs/servers/vinyl-cache/default.nix
index 03aab5a100f3..11f4438ea787 100644
--- a/pkgs/servers/vinyl-cache/default.nix
+++ b/pkgs/servers/vinyl-cache/default.nix
@@ -108,6 +108,7 @@ let
 
       passthru = {
         python = python3;
+        tests = nixosTests."vinyl-cache_${lib.versions.major version}";
       };
 
       meta = {

From 21318349b989af918031c0a41c7385792ae40996 Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Fri, 10 Apr 2026 08:58:40 +0200
Subject: [PATCH 20/86] nixos/{varnish,vinyl-cache}: add assertions to prevent
 users using wrong module

Varnish Cache and Vinyl Cache are similar, so it could happen that users
use the wrong module. This change adds assertions to both modules that
only the supported packages can be used with it.
---
 .../services/web-servers/varnish/default.nix  | 27 ++++++++++++-------
 .../web-servers/vinyl-cache/default.nix       | 18 +++++++++++++
 2 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index 0f1217fa9b35..3d6a41498a70 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -223,16 +223,23 @@ in
       '')
     ];
 
-    assertions = concatMap (m: [
-      {
-        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
-        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
-      }
-      {
-        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
-        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
-      }
-    ]) cfg.listen;
+    assertions =
+      (concatMap (m: [
+        {
+          assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+          message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+        }
+        {
+          assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+          message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+        }
+      ]) cfg.listen)
+      ++ [
+        {
+          assertion = cfg.package.pname != "vinyl-cache";
+          message = "services.varnish only supports Varnish Cache. Please use services.vinyl-cache.";
+        }
+      ];
 
     warnings =
       lib.optional (!isNull cfg.http_address)
diff --git a/nixos/modules/services/web-servers/vinyl-cache/default.nix b/nixos/modules/services/web-servers/vinyl-cache/default.nix
index ba498537edc8..5efc681247e2 100644
--- a/nixos/modules/services/web-servers/vinyl-cache/default.nix
+++ b/nixos/modules/services/web-servers/vinyl-cache/default.nix
@@ -205,6 +205,24 @@ in
         '')
       ];
 
+      assertions =
+        concatMap (m: [
+          {
+            assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+            message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+          }
+          {
+            assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+            message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+          }
+        ]) cfg.listen
+        ++ [
+          {
+            assertion = cfg.package.pname == "vinyl-cache";
+            message = "services.vinyl-cache only supports Vinyl Cache. Please use services.varnish.";
+          }
+        ];
+    })
     (lib.mkIf (cfg.enable && cfg.enableFileLogging) {
       systemd.services = {
         vinylncsa = {

From 27a4cf14c7d8a338fbab84dd06989caecc579977 Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Fri, 10 Apr 2026 08:58:40 +0200
Subject: [PATCH 21/86] doc: add release notes for vinyl cache 9

---
 doc/release-notes/rl-2605.section.md              | 7 +++++++
 nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index c59d72f7da45..2eb1c598e665 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -132,6 +132,13 @@
 
 - Varnish Cache has been updated to major version 8, `varnish` now refers to `varnish80`. That release contains breaking changes, see [Upgrading to Varnish-Cache 8.0](https://vinyl-cache.org/docs/8.0/whats-new/upgrading-8.0.html).
   Note that the Varnish 6 LTS release remains available as `varnish60`.
+  The Varnish Cache open-source project renamed itself to Vinyl Cache. Please migrate to `vinyl-cache`. See the `vinyl-cache` release notes entry for more information.
+  Varnish 8 is not supported for the entire NixOS 26.05 release cycle.
+
+- Vinyl Cache has been introduced with the major version 9 as the Varnish Cache open source project renamed itself to Vinyl Cache. Please migrate to Vinyl Cache 9 when you still use Varnish Cache.
+  A new module has also been introduced for this migration: `services.vinyl-cache`.
+  This release contains breaking changes, see [Upgrading to Vinyl Cache 9.0](https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html).
+  The `varnish-modules` project is currently not packaged for Vinyl Cache, as it is incompatible.
 
 - `eslint` has been updated from version 9 to version 10. Please see https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ for details about the breaking changes included in the update.
 
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 3c17c6f3d764..56f7f703610f 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -62,6 +62,8 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
+- [vinyl-cache] as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old `services.varnish` module is still available.
+
 - [papra](https://papra.app/), an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as [services.papra](#opt-services.papra.enable).
 
 - [rqbit](https://github.com/ikatson/rqbit), a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as [services.rqbit](#opt-services.rqbit.enable).

From 93c87e1808d403921890c8293700cd4b6abd5442 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 24 Apr 2026 17:55:08 +0000
Subject: [PATCH 22/86] python3Packages.gymnasium: 1.2.3 -> 1.3.0

Diff: https://github.com/Farama-Foundation/gymnasium/compare/v1.2.3...v1.3.0

Changelog: https://github.com/Farama-Foundation/Gymnasium/releases/tag/v1.3.0
---
 pkgs/development/python-modules/gymnasium/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gymnasium/default.nix b/pkgs/development/python-modules/gymnasium/default.nix
index 89b8ba72f766..d163732a96f2 100644
--- a/pkgs/development/python-modules/gymnasium/default.nix
+++ b/pkgs/development/python-modules/gymnasium/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "gymnasium";
-  version = "1.2.3";
+  version = "1.3.0";
 
   pyproject = true;
 
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "Farama-Foundation";
     repo = "gymnasium";
     tag = "v${version}";
-    hash = "sha256-b712BPs7AS8UE8Zsu9GW/J6Vag9NB/x728MtQ5yrjbY=";
+    hash = "sha256-asQ/RqnmGRoVdwBkp4RIkqzGtQ7PnISt8/mRcXrNbBc=";
   };
 
   build-system = [ setuptools ];

From c5e4d5f03fe33a20e68eb09568ab64626cdbb9de Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 24 Apr 2026 19:24:22 +0000
Subject: [PATCH 23/86] python3Packages.stable-baselines3: relax gymnasium
 dependency, skip failing tests

---
 .../python-modules/stable-baselines3/default.nix       | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/stable-baselines3/default.nix b/pkgs/development/python-modules/stable-baselines3/default.nix
index cb752b201af5..efa234413391 100644
--- a/pkgs/development/python-modules/stable-baselines3/default.nix
+++ b/pkgs/development/python-modules/stable-baselines3/default.nix
@@ -24,6 +24,7 @@ buildPythonPackage (finalAttrs: {
   pname = "stable-baselines3";
   version = "2.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DLR-RM";
@@ -34,6 +35,9 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "gymnasium"
+  ];
   dependencies = [
     cloudpickle
     gymnasium
@@ -58,6 +62,12 @@ buildPythonPackage (finalAttrs: {
     "tests/test_dict_env.py"
     "tests/test_her.py"
     "tests/test_save_load.py"
+
+    # gymnasium.error.DeprecatedEnv: Environment version v3 for `Taxi` is deprecated.
+    # Please use `Taxi-v4` instead.
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-A2C]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-DQN]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-PPO]"
   ];
 
   disabledTests = [

From a7330a7dd4b9cc73066a03208c79fabe57d18789 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:30:18 +0200
Subject: [PATCH 24/86] firebird_4: fix hash mismatch

---
 pkgs/servers/firebird/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index e90ec51768f9..abb29fc00d0f 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -105,7 +105,7 @@ rec {
         owner = "FirebirdSQL";
         repo = "firebird";
         rev = "v${version}";
-        hash = "sha256-EnD0cTQSOh1fARjKdoOCR5UjpvVA96EZVVWfqlH+m48=";
+        hash = "sha256-4u1Vgwk5cMCkrGfGSk2xO7hVHiDda0ioitvX/r3KPQc=";
       };
 
       nativeBuildInputs = base.nativeBuildInputs ++ [ unzip ];

From b38b8cb3e0eb5abcca97fa40d09899d6440f46e3 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:30:25 +0200
Subject: [PATCH 25/86] firebird_5: fix hash mismatch

---
 pkgs/servers/firebird/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index abb29fc00d0f..96523788522a 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -126,7 +126,8 @@ rec {
         owner = "FirebirdSQL";
         repo = "firebird";
         rev = "v${version}";
-        hash = "sha256-wAiOyCVS7fjVqrDlJJwDFxw5ZD5spnXlYKCAQ8gctHI=";
+        fetchSubmodules = true;
+        hash = "sha256-IJrfs8q7GtX4Y+Cmg4avT5QJmLpld38tyR3TR1CcgyE=";
       };
 
       # CMake is just used for libcds

From 26e31d199ba0f62320320cb94d185ee209616918 Mon Sep 17 00:00:00 2001
From: Yunhao Zhao <yunhaozhaots@gmail.com>
Date: Sun, 26 Apr 2026 14:17:50 +0000
Subject: [PATCH 26/86] lilypond: 2.24.4 -> 2.26.0

---
 pkgs/by-name/li/lilypond/package.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/li/lilypond/package.nix b/pkgs/by-name/li/lilypond/package.nix
index 0fad1654d612..011082c5345b 100644
--- a/pkgs/by-name/li/lilypond/package.nix
+++ b/pkgs/by-name/li/lilypond/package.nix
@@ -41,12 +41,11 @@
     ]
   ),
   writeScript,
-  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lilypond";
-  version = "2.24.4";
+  version = "2.26.0";
   outputs = [
     "out"
     "man"
@@ -54,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor finalAttrs.version}/lilypond-${finalAttrs.version}.tar.gz";
-    hash = "sha256-UYdORvodrVchxslOxpMiXrAh7DtB9sWp9yqZU/jeB9Y=";
+    hash = "sha256-HUkPhaWNZ4UKbmlEyLXepHCFcgrdoRSDtjZMriO68RM=";
   };
 
   postInstall = ''
@@ -79,17 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "mem=mf2pt1" "mem=$PWD/mf/mf2pt1"
   '';
 
-  patches = [
-    # fixes #475503
-    # distilled version of https://gitweb.git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=f2192eb294e
-    # so, remove once that commit reaches a stable release
-    (fetchpatch2 {
-      name = "fix-clang-21-build.patch";
-      url = "https://cgit.freebsd.org/ports/plain/print/lilypond/files/patch-lily_include_smobs.hh?id=58bab68c706086774b17dcacc61c8fd37ecc8a15";
-      extraPrefix = ""; # adds old/new prefixes to process properly in patchPhase
-      hash = "sha256-nT8+nYU+m6lLTvHEvSIpG/yAwy1Omb6+4Z+NGwEVE4Q=";
-    })
-  ];
+  patches = [ ];
 
   strictDeps = true;
 

From 212a505c332f49afd3bf2e3daca4d8361d194a2c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 06:42:49 +0000
Subject: [PATCH 27/86] firefly-iii-data-importer: 2.2.3 -> 2.3.2

---
 pkgs/by-name/fi/firefly-iii-data-importer/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index fca5856cd4a5..d9afbec8e06e 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.2.3";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2/zfxBggXK9mJDpuofQyMZ+WWV0OHyUWTUU+4CRNOUQ=";
+    hash = "sha256-JLN13SCpMXByu3rWSclcsLBGCLFMzHGHOM+bWLJ2MPw=";
   };
 
   buildInputs = [ php ];
@@ -42,12 +42,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-0p0xPBX4nKFYlpIvGVZU7ay+btjpxBO2s73wzysSzUU=";
+  vendorHash = "sha256-QobjMMPEhLvsTwlJJvf4nUi1PcZEDOaU8EzexluOI90=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-baPsbZwGu1tx6bMH2tWcZVlkZuIpSflwj9JyX9vQW/U=";
+    hash = "sha256-NkxCvC0EPMLi7GV5GG1+5niL3KIaqBsleo11/gzaX/s=";
   };
 
   composerRepository = php.mkComposerRepository {

From 71580b9d4ff1de7bd1605647f8471f39ee6447d6 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@gmail.com>
Date: Tue, 21 Apr 2026 13:49:27 +0200
Subject: [PATCH 28/86] pmix: ensure build info pointing to dev outputs is
 removed

Configure flags, absolute CC path, and the pmix include paths
are recorded and hardcoded into library as human readable build information.
This pulls in all
dev inputs and gcc.

reduces the pmix runtime enclosure size: 394M -> 44M
reduces the openmpi runtime enclosure size: 592M -> 256M
---
 pkgs/by-name/pm/pmix/package.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pm/pmix/package.nix b/pkgs/by-name/pm/pmix/package.nix
index 476ff708edc0..c4cf1c963123 100644
--- a/pkgs/by-name/pm/pmix/package.nix
+++ b/pkgs/by-name/pm/pmix/package.nix
@@ -37,6 +37,20 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs --build ./config
     patchShebangs --build ./contrib
     patchShebangs --build ./src/util/convert-help.py
+
+  ''
+  # 1. Remove the build information (options to configure and the CC path)
+  # These are hardcoded in the library and create an unwanted dependency
+  # on *.dev inputs.
+  # 2. Remove the reference to the pmix include directories, which are
+  # also hardcoded into the library (would be a cyclic reference).
+  + ''
+    substituteInPlace ./src/runtime/pmix_info_support.c \
+      --replace-fail 'PMIX_CONFIGURE_CLI' '""' \
+      --replace-fail 'PMIX_CC_ABSOLUTE' '""'
+
+    substituteInPlace ./src/mca/pinstalldirs/config/pinstall_dirs.h.in \
+      --replace-fail '@includedir@' ""
   '';
 
   nativeBuildInputs = [
@@ -90,10 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = lib.optionalString (lib.elem "dev" finalAttrs.outputs) ''
-    # The build info (parameters to ./configure) are hardcoded
-    # into the library. This clears all references to $dev/include.
-    remove-references-to -t "''${!outputDev}" $(readlink -f $out/lib/libpmix.so)
-
     # The path to the pmixcc-wrapper-data.txt is hard coded and
     # points to $out instead of dev. Use wrapper to fix paths.
     wrapProgram "''${!outputDev}"/bin/pmixcc \

From 7821669ceb7fe22dfd67c974afb9e934941b5741 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 14:04:23 +0000
Subject: [PATCH 29/86] alistral: 0.6.6 -> 0.6.7

---
 pkgs/by-name/al/alistral/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index a40ee4ae233b..609ae97d936d 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6htcjBdh4E9cCUw4ETl3AnmMO3yT6654PLKIGPOPlo=";
+    hash = "sha256-XsN4UyIXkd0YVtO/q9EcFP/sBYkH9leISmbJZ93ef6E=";
   };
 
-  cargoHash = "sha256-Udbf0h8XZ8uD7MLTNRKaIJ8AdTvzq1dDQKPXWXunR/w=";
+  cargoHash = "sha256-KFNFioZ/5moC5FNXw+hA+NrPjsqu+3V8A5mtZ4FZUHw=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option

From b92899478f21f2fd693a7760a37d2ba4ea730713 Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Mon, 27 Apr 2026 17:27:16 +0200
Subject: [PATCH 30/86] victoriametrics: 1.140.0 -> 1.141.0

Release notes: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.141.0
Full changelog: https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.140.0...v1.141.0
---
 pkgs/by-name/vi/victoriametrics/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 4527404d8b23..4a0e3ce6fe63 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.140.0";
+  version = "1.141.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f/qcUSf/JMfe0rTUY5qT9k7MCVqsZCwRzsCv6puz6tw=";
+    hash = "sha256-eMaCChrv3/w7KNlnLdV1/YGGh4ZMGqeNAnMV1OlIQWE=";
   };
 
   vendorHash = null;

From 5ff51b5076f44936cfe1aa54f41256e128b6c304 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 27 Apr 2026 19:09:14 +0200
Subject: [PATCH 31/86] python3Packages.tencentcloud-sdk-python: 3.1.85 ->
 3.1.86

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.85...3.1.86

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.86/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index c4467b850b73..1f8bcd7ed2d7 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.85";
+  version = "3.1.86";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-8uJNo4gDUlY4oX1cMrJtrwGYc0la2nac+rjHBRoPAj8=";
+    hash = "sha256-ah35SS2oruYzC2JTSLWm3MNaRUp8fiwC21KFoNMKt6g=";
   };
 
   build-system = [ setuptools ];

From 208aa2ddf0e389636fb2f20f3baa7b2282fe1715 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 27 Apr 2026 19:01:17 +0000
Subject: [PATCH 32/86] harmonia: 3.0.0 -> 3.1.0

Diff: https://github.com/nix-community/harmonia/compare/harmonia-v3.0.0...harmonia-v3.1.0

Changelog: https://github.com/nix-community/harmonia/releases/tag/harmonia-v3.1.0
---
 pkgs/by-name/ha/harmonia/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harmonia/package.nix b/pkgs/by-name/ha/harmonia/package.nix
index debe7bdd1de0..0d95003187cb 100644
--- a/pkgs/by-name/ha/harmonia/package.nix
+++ b/pkgs/by-name/ha/harmonia/package.nix
@@ -10,16 +10,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harmonia";
-  version = "3.0.0";
+  version = "3.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "harmonia";
     tag = "harmonia-v${finalAttrs.version}";
-    hash = "sha256-BovRI3p2KXwQ6RF49NqLc0uKP/Jk+yA8E0eqScaIP68=";
+    hash = "sha256-fm8PBugKnw72/dAXsRj84jf4EZK1BcVEdEWgtojIuA0=";
   };
 
-  cargoHash = "sha256-X3A+gV32itmt0SqepioT64IGzHfrCdLsQjF6EDwCTbo=";
+  cargoHash = "sha256-qp4frhNsWDma8uYcRe3BXmfIu6btYb8IaoXhk4oI4qM=";
 
   doCheck = false;
 

From 2e6fffc286330619af2ef78528fb315a1408fbff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 20:07:17 +0000
Subject: [PATCH 33/86] chainsaw: 2.14.1 -> 2.15.0

---
 pkgs/by-name/ch/chainsaw/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chainsaw/package.nix b/pkgs/by-name/ch/chainsaw/package.nix
index 3e00f1af14a5..ad27f086988e 100644
--- a/pkgs/by-name/ch/chainsaw/package.nix
+++ b/pkgs/by-name/ch/chainsaw/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chainsaw";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M+gHsh4u5CEZndMn5sUFk/69ojyaL2AftF8Ao0mKmtY=";
+    hash = "sha256-FsetcuVl1JHkVy4Haal6e16NLQz+zS9mFyqH65Qr5zU=";
   };
 
-  cargoHash = "sha256-NFyo6elDsqjFI4Kr9BG2ppM8DXictY+N+D3G5+89TJU=";
+  cargoHash = "sha256-UumlqHRssy401iiZSMq5N5r8a2f6ZLoqPuyBoDHPxYg=";
 
   ldflags = [
     "-w"

From 7088c26f4459a15ec08133c913f1c23c5247fbf5 Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 27 Apr 2026 13:30:14 -0700
Subject: [PATCH 34/86] pypy: Fix changelog URL

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/development/interpreters/python/pypy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index bee93cf1451f..df4de47e13f2 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -390,7 +390,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.pypy.org/";
-    changelog = "https://doc.pypy.org/en/stable/release-v${version}.html";
+    changelog = "https://doc.pypy.org/release-v${version}.html";
     description = "Fast, compliant alternative implementation of the Python language (${pythonVersion})";
     mainProgram = "pypy";
     license = lib.licenses.mit;

From da674fcca14ec05d370ba85e98e1dc2ce2c24049 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 27 Apr 2026 19:35:29 +0000
Subject: [PATCH 35/86] python3Packages.groq: 1.1.2 -> 1.2.0

---
 pkgs/development/python-modules/groq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index 6abb7629726c..d38d2e3ad854 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "1.1.2";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-uOTttpjV2iislaink/0Jewkinyb2hYt0J+sv/OSuhJ4=";
+    hash = "sha256-PisqKpVM2KAlGgZDcCoFJhoib7WhuM1AkJOGYVimW0U=";
   };
 
   postPatch = ''

From 32c74a8cb47201ff36c5ae5d7877db7b0db08382 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 27 Apr 2026 19:35:12 +0000
Subject: [PATCH 36/86] python3Packages.chromadb: 1.5.7 -> 1.5.8

---
 pkgs/development/python-modules/chromadb/default.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 000a11787feb..3a1f93ed3f04 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,19 +68,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "chromadb";
-  version = "1.5.7";
+  version = "1.5.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = finalAttrs.version;
-    hash = "sha256-JrkfLwEL7iTL9P/4UDM4hFQtRL1JYH47dgZ1d+Mphqw=";
+    hash = "sha256-bxRRpwd7pmE+/JMARaqjuE+xFh8Qx70Aon2w56sOi1I=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Szy2mSTriMwMViVTbI+0XaizcQBKh1Ncipf84moDREI=";
+    hash = "sha256-0vuXMxwbbpfMA0UcHcLieTJK6u67o6EYdJLH5Q+wtc8=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
@@ -263,6 +263,11 @@ buildPythonPackage (finalAttrs: {
     "chromadb/test/test_client.py::test_http_client_with_inconsistent_host_settings[async_client]"
     "chromadb/test/test_client.py::test_http_client_with_inconsistent_port_settings[async_client]"
     "chromadb/test/test_client.py::test_http_client[async_client]"
+
+    # ValueError: Could not connect to a Chroma server.
+    "chromadb/test/property/test_add_mcmr.py::test_add_small[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_medium[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_large[single-region]"
   ];
 
   __darwinAllowLocalNetworking = true;

From 6473f534ea52e8d51d9308948539a3593def2950 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 23:15:07 +0000
Subject: [PATCH 37/86] libretro.beetle-gba: 0-unstable-2024-10-21 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/beetle-gba.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/beetle-gba.nix b/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
index ba6f74a5a6a0..c623e7702342 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-gba";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-gba-libretro";
-    rev = "6cee80685f735ea6c2373db2622a1f1ee9f39d39";
-    hash = "sha256-a3XgExXVCUFw3GLCUkEl6now2L8qVdNOaXvrDMcT1ZE=";
+    rev = "145d4884ad246e3c16765f6d69decb2a4359b6ae";
+    hash = "sha256-4LRMPsPrYvdTJGcbbS3ZyimrWKxZSU+bP0SxUMLkYgE=";
   };
 
   makefile = "Makefile";

From ae5011b0337c9fc3f89d3234531c77921e91596f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 23:19:41 +0000
Subject: [PATCH 38/86] inko: 0.19.1 -> 0.20.0

---
 pkgs/by-name/in/inko/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/inko/package.nix b/pkgs/by-name/in/inko/package.nix
index edcfe47691ab..4eec30faba04 100644
--- a/pkgs/by-name/in/inko/package.nix
+++ b/pkgs/by-name/in/inko/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inko";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "inko-lang";
     repo = "inko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZHVOwYvNRL2ObZt2PvayoqvS64MumN4oXQOgeCWbEUM=";
+    hash = "sha256-Bisw84MwdLb2pgzwQ5zpZiyNHSWtdJ2QpaFn40x+SdI=";
   };
 
-  cargoHash = "sha256-BHrbqPMQnhw8pjN8e0/qW1rPe/fMhs2iUbRVPt5ATrg=";
+  cargoHash = "sha256-+3U3rMVF3qwyTIGOb/6NIxSBdiLuf/uY/VL3tYHte+c=";
 
   buildInputs = [
     libffi

From f05de5962541fd2cdc81fcd50bd5a0dedd7bdf55 Mon Sep 17 00:00:00 2001
From: Joseph LaFreniere <git@lafreniere.xyz>
Date: Mon, 27 Apr 2026 18:24:48 -0500
Subject: [PATCH 39/86] tsgolint: 0.22.0 -> 0.22.1

https://github.com/oxc-project/tsgolint/releases/tag/v0.22.1
---
 pkgs/by-name/ts/tsgolint/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ts/tsgolint/package.nix b/pkgs/by-name/ts/tsgolint/package.nix
index cf3c71ec0e5c..47ad1919995a 100644
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -8,13 +8,13 @@
 
 buildGo126Module (finalAttrs: {
   pname = "tsgolint";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "tsgolint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tB+39Z6KpNj6/mejB/+Zxe4evdlGAnQW1LJtH3pQlVw=";
+    hash = "sha256-v6gSUeBcjSx/3/hjBST3ba6N366GQvryVTeAjV5+zEc=";
     fetchSubmodules = true;
   };
 

From 3cd6ad52cdbff8ff70bb467ccfb2ad47a56abc8f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 23:52:33 +0000
Subject: [PATCH 40/86] better-commits: 1.19.1 -> 1.21.0

---
 pkgs/by-name/be/better-commits/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/be/better-commits/package.nix b/pkgs/by-name/be/better-commits/package.nix
index 00428bcb4cad..7615c98783d6 100644
--- a/pkgs/by-name/be/better-commits/package.nix
+++ b/pkgs/by-name/be/better-commits/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "better-commits";
-  version = "1.19.1";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "Everduin94";
     repo = "better-commits";
     tag = "v${version}";
-    hash = "sha256-4akYngeDf7EqLxCzObjb5MUA8Cb3X3jlrvLEM71OcCA=";
+    hash = "sha256-JgAe55aMr6gP9/dEj3rDW5glA+ntftthJSCFYvtmWso=";
   };
 
-  npmDepsHash = "sha256-vtUtdgOJEQk9PzxOz7AlwOxWS6PTjAtrjAugXRXo89c=";
+  npmDepsHash = "sha256-7+WMrkAYKQgUdOBI4jSOTt6gxwfCwft4GcUKMvpTiYc=";
 
   passthru.updateScript = nix-update-script { };
 

From 410789c654a1c4d3845c5d24dc4513f986b6218f Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 27 Apr 2026 19:59:36 -0400
Subject: [PATCH 41/86] river: 0.4.4 -> 0.4.5

Changelog: https://codeberg.org/river/river/releases/tag/v0.4.5
---
 pkgs/by-name/ri/river/build.zig.zon.nix | 28 +++++++++----------------
 pkgs/by-name/ri/river/package.nix       |  4 ++--
 2 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/ri/river/build.zig.zon.nix b/pkgs/by-name/ri/river/build.zig.zon.nix
index 84468fb2d9a4..b032b0550ee9 100644
--- a/pkgs/by-name/ri/river/build.zig.zon.nix
+++ b/pkgs/by-name/ri/river/build.zig.zon.nix
@@ -23,33 +23,25 @@ linkFarm "zig-packages" [
     };
   }
   {
-    name = "translate_c-0.0.0-Q_BUWrT0BgDOFSyiz0UVBIpBe3-CiEqx9ej2EecgKcBD";
+    name = "translate_c-0.0.0-Q_BUWlX1BgCD1wo6uo97prlp9VJ4gxAjwN_vZ7nsSjGN";
     path = fetchgit {
-      url = "https://codeberg.org/ifreund/translate-c";
-      rev = "fdf30e6298cd1184ae6da5602aff0cb5d4cde4cb";
-      hash = "sha256-4ZZZMugHHxUwdot7/lKQe0UDwgZWqiub0bz6jkX2hCY=";
+      url = "https://codeberg.org/ziglang/translate-c/";
+      rev = "57c559cf581b1fcad90494eda219f98abeb155ce";
+      hash = "sha256-7OlW2f5tRc1UZySDcEQERsLGChSxIcJAiVWdvuFUvvY=";
     };
   }
   {
-    name = "wayland-0.4.0-lQa1khbMAQAsLS2eBR7M5lofyEGPIbu2iFDmoz8lPC27";
+    name = "wayland-0.6.0-lQa1kqz8AQADQmdNJsNhLoNHcnEGEUjrOaPV-dtEnEmX";
     path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.4.0.tar.gz";
-      hash = "sha256-ulIII5iJpM/W/VJB0HcdktEO2eb9T9J0ln2A1Z94dU4=";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.6.0.tar.gz";
+      hash = "sha256-3m/ITNhZUJ/5uD/Tqm+0uZSktGoYgWF5oldOqOCUkIE=";
     };
   }
   {
-    name = "wayland-0.6.0-dev-lQa1krD8AQBlMqwuhAMJjPQKXvpRByZBxxqMVAZ7yzbG";
-    path = fetchgit {
-      url = "https://codeberg.org/ifreund/zig-wayland";
-      rev = "4a150a04f76f7329e80280661355c04328369d1f";
-      hash = "sha256-B5nA05xYm6iRDDRFC2KUbhBCtjwmApka+BcDCZRssfw=";
-    };
-  }
-  {
-    name = "wlroots-0.20.0-jmOlcmtCBADS6eoJ6mkeiSNZkibrhD-c5Qwn-LiM86r1";
+    name = "wlroots-0.20.1-jmOlcqNVBAB3uB5oqBTzpRlwu-FmMyyZMVAWCe5kmcSt";
     path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.0.tar.gz";
-      hash = "sha256-QblQBVsDV2kSj31jqmVVi4hQUXuv8bsRgRMaCqlNxNM=";
+      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.1.tar.gz";
+      hash = "sha256-cfzHJ2ziiCkMyNlIo6I9o/NjaZGrsv22hq41WYwCnpk=";
     };
   }
   {
diff --git a/pkgs/by-name/ri/river/package.nix b/pkgs/by-name/ri/river/package.nix
index 1e510da77cac..7e317651dba9 100644
--- a/pkgs/by-name/ri/river/package.nix
+++ b/pkgs/by-name/ri/river/package.nix
@@ -27,7 +27,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.4.4";
+  version = "0.4.5";
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "river";
     repo = "river";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2RmyiwqXCBVN44zsdDKNv/ha08uIuzma3rnY0QhhKy4=";
+    hash = "sha256-q4JAlr9/ex+BEgktBmFwOvZzQEAGvxXPD1QyKqyha4g=";
   };
 
   strictDeps = true;

From fe37a5e03965b69888f6a53cf03955c0994ed44b Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 27 Apr 2026 20:27:23 -0400
Subject: [PATCH 42/86] audiobookshelf: 2.33.2 -> 2.34.0

Changelog: https://github.com/advplyr/audiobookshelf/releases/tag/v2.34.0
---
 pkgs/by-name/au/audiobookshelf/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 5291f1920343..131e32a76126 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -15,10 +15,10 @@
 
 let
   source = {
-    version = "2.33.2";
-    hash = "sha256-YsKUoJ0SlBO3fAbMvzaEEIgo90HclB+0iLVIH4LDmEY=";
-    npmDepsHash = "sha256-h/5brNurUEMHTSu2PGODhRtIenGzhsNM558i85Cs86w=";
-    clientNpmDepsHash = "sha256-EbXkHRjOE1A7Sk4MhbJFuBwG/VY+SHhHYjscsXkSMjU=";
+    version = "2.34.0";
+    hash = "sha256-ZHPrNQ36+bS5wwoiKUQKkGLnKhHKpftI3kQ08ItReWI=";
+    npmDepsHash = "sha256-8y0+3zj3UH5wi9Nbl7X5rne0/tzz6Bf7HrxZpYVYZ3Y=";
+    clientNpmDepsHash = "sha256-xna4tZK40dOew380exp/XR32ekyiFVCTWgWNE9BpTl8=";
   };
 
   src = fetchFromGitHub {

From c9cce7da159136728b119c9d34f8b54b67f0d572 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 00:40:51 +0000
Subject: [PATCH 43/86] tev: 2.10.0 -> 2.11.0

---
 pkgs/by-name/te/tev/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tev/package.nix b/pkgs/by-name/te/tev/package.nix
index 9479653c736f..6f2218c1e56a 100644
--- a/pkgs/by-name/te/tev/package.nix
+++ b/pkgs/by-name/te/tev/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = "tev";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-o8ejMsaiplnTLiWtjaJnV9z2ZNkiOWy3DLU+x49MJrg=";
+    hash = "sha256-o5Yrlt39RGKjtfqMfq3w/JTPORuKbxTIX5uuF4zmGXk=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux (

From 0673d776c763aa584d0340217dba37a3ca03177a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 01:08:54 +0000
Subject: [PATCH 44/86] qovery-cli: 1.157.6 -> 1.158.0

---
 pkgs/by-name/qo/qovery-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index d45a2917a2a7..70896bacfbf8 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.157.6";
+  version = "1.158.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zkTiGo8QtcE4TrmYpuXBzq/b9IJQ4e3T3h11NbuFRM0=";
+    hash = "sha256-b6nvJPLMvqXM+hYJzOG65G15N+ErJnWySQrjJQmsMe8=";
   };
 
   vendorHash = "sha256-kENqEnk5RxN8kJ/dnXtG6ypnb8CPcOsHKid1z6uuKAc=";

From bb60a1acf1fddb9cd95ab2426830470ab0c1c424 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 03:35:53 +0000
Subject: [PATCH 45/86] fosrl-newt: 1.10.4 -> 1.12.0

---
 pkgs/by-name/fo/fosrl-newt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index cd02adca68f6..feaa90c5fab3 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.10.4";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-Dtzx/Rs7aa2GkG7Qq4pvGN4ghfS7EyVhx7rQh8sRlQU=";
+    hash = "sha256-csD7QcSQE4/eRw3EHX0m2nI3JjglFxXlnyuS4xpCmRY=";
   };
 
-  vendorHash = "sha256-vy6Dqjek7pLdASbCrM9snq5Dt9lbwNJ0AuQboy1JWNQ=";
+  vendorHash = "sha256-+zMSzNbqmWm/DXL2xMUd5uPP5tSIybsRokwJ2zd0pf0=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 02f48d0827b14bda3df6c72701594495d747e429 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 04:05:14 +0000
Subject: [PATCH 46/86] python3Packages.llama-index-llms-openai-like: 0.7.1 ->
 0.7.2

---
 .../python-modules/llama-index-llms-openai-like/default.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
index 97016414c49b..37a0fa6ce05e 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-llms-openai-like";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_llms_openai_like";
     inherit (finalAttrs) version;
-    hash = "sha256-znzvNoax5i18CBNLTYylZwbMqBbkxAmOrt4zACgppvk=";
+    hash = "sha256-7Z/3P5ddzkcPmKxhyYIVG6eO7fo/ubA4lLwdExKyE/8=";
   };
 
   build-system = [ hatchling ];

From da2aa63f832c8b89a5087a99d166d8f170ac8f08 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 04:22:09 +0000
Subject: [PATCH 47/86] ocamlPackages.earlybird: 1.3.5 -> 1.3.6

---
 pkgs/development/ocaml-modules/earlybird/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/earlybird/default.nix b/pkgs/development/ocaml-modules/earlybird/default.nix
index d34201eb8414..90c50211c7c4 100644
--- a/pkgs/development/ocaml-modules/earlybird/default.nix
+++ b/pkgs/development/ocaml-modules/earlybird/default.nix
@@ -21,7 +21,7 @@
 
 buildDunePackage (finalAttrs: {
   pname = "earlybird";
-  version = "1.3.5";
+  version = "1.3.6";
 
   minimalOCamlVersion = "4.12";
 
@@ -29,7 +29,7 @@ buildDunePackage (finalAttrs: {
     owner = "hackwaly";
     repo = "ocamlearlybird";
     tag = finalAttrs.version;
-    hash = "sha256-QDRtuphOb02L75JyCF9K1NqvIdtWlfefeLG3HmJVHW4=";
+    hash = "sha256-UtJwb941JEIaE4zUlOWqFX3w0U7gFdYlYpKl+mZ1FNg=";
   };
 
   nativeBuildInputs = [ menhir ];

From 977ccdcad9d9b2966c617ed75f052c0fbf559347 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 04:41:01 +0000
Subject: [PATCH 48/86] libretro.yabause: 0-unstable-2026-04-10 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/yabause.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/yabause.nix b/pkgs/applications/emulators/libretro/cores/yabause.nix
index 9f12cffb3c67..611196f73712 100644
--- a/pkgs/applications/emulators/libretro/cores/yabause.nix
+++ b/pkgs/applications/emulators/libretro/cores/yabause.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "yabause";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "yabause";
-    rev = "76faf7c601359bafc41785325d686644000a7ba9";
-    hash = "sha256-UHmUsqAK+As6qfvhto2aOsW9A/lZMypfn2NxFui2x8c=";
+    rev = "7cb15b8f9eea5a6fa7cae34468a6989522bcba75";
+    hash = "sha256-UWZgt0vdjncM7JCzdSWa4XZMJBJ/pnk4QpSKz459Fq0=";
   };
 
   makefile = "Makefile";

From d97d82b37eeb6876d578df034422d86af0acd9bf Mon Sep 17 00:00:00 2001
From: StealthBadger747 <ac130kire@gmail.com>
Date: Mon, 27 Apr 2026 21:35:14 -0700
Subject: [PATCH 49/86] nixos/headplane: address review feedback

---
 .../modules/services/networking/headplane.nix | 373 ++++++++++--------
 pkgs/by-name/he/headplane-agent/package.nix   |   1 +
 2 files changed, 201 insertions(+), 173 deletions(-)

diff --git a/nixos/modules/services/networking/headplane.nix b/nixos/modules/services/networking/headplane.nix
index ef35f19e4a01..d4cdeac233a5 100644
--- a/nixos/modules/services/networking/headplane.nix
+++ b/nixos/modules/services/networking/headplane.nix
@@ -14,16 +14,31 @@ let
     ;
   inherit (lib.attrsets) filterAttrsRecursive;
   cfg = config.services.headplane;
-  settingsFile = (pkgs.formats.yaml { }).generate "headplane-config.yaml" (
-    # Headplane config can't have `null` values.
-    filterAttrsRecursive (n: v: v != null) cfg.settings
+  settingsFormat = pkgs.formats.yaml { };
+  filterSettings = lib.converge (
+    filterAttrsRecursive (
+      _: v:
+      !lib.elem v [
+        { }
+        null
+      ]
+    )
   );
+  agentSettings = cfg.settings.integration.agent;
+  settings = cfg.settings // {
+    integration = cfg.settings.integration // {
+      agent = if agentSettings == null || !agentSettings.enabled then null else agentSettings;
+    };
+  };
+  settingsFile = settingsFormat.generate "headplane-config.yaml" (filterSettings settings);
 in
 {
   options.services.headplane = {
     enable = mkEnableOption "Headplane";
     package = mkPackageOption pkgs "headplane" { };
 
+    agent.package = mkPackageOption pkgs "headplane-agent" { };
+
     debug = mkEnableOption "Enable debug loggin";
 
     settings = mkOption {
@@ -157,74 +172,74 @@ in
             type = types.submodule {
               options = {
                 agent = mkOption {
-                  type = types.submodule {
-                    options = {
-                      enabled = mkOption {
-                        type = types.bool;
-                        default = false;
-                        description = ''
-                          The Headplane agent allows retrieving information about nodes.
-                          This allows the UI to display version, OS, and connectivity data.
-                          You will see the Headplane agent in your Tailnet as a node when it connects.
-                        '';
-                      };
+                  type = types.nullOr (
+                    types.submodule {
+                      options = {
+                        enabled = mkOption {
+                          type = types.bool;
+                          default = false;
+                          description = ''
+                            The Headplane agent allows retrieving information about nodes.
+                            This allows the UI to display version, OS, and connectivity data.
+                            You will see the Headplane agent in your Tailnet as a node when it connects.
+                          '';
+                        };
 
-                      executable_path = mkOption {
-                        type = types.path;
-                        readOnly = true;
-                        default = "${cfg.settings.integration.agent.package}/bin/hp_agent";
-                        defaultText = lib.literalExpression ''"''\${config.services.headplane.settings.integration.agent.package}/bin/hp_agent"'';
-                        description = ''
-                          Path to the headplane agent binary.
-                        '';
-                      };
+                        executable_path = mkOption {
+                          type = types.path;
+                          readOnly = true;
+                          default = "${cfg.agent.package}/bin/hp_agent";
+                          defaultText = lib.literalExpression ''"''${config.services.headplane.agent.package}/bin/hp_agent"'';
+                          description = ''
+                            Path to the headplane agent binary.
+                          '';
+                        };
 
-                      pre_authkey_path = mkOption {
-                        type = types.nullOr types.path;
-                        default = null;
-                        description = ''
-                          Path to a file containing the agent preauth key.
-                          To connect to your Tailnet, you need to generate a pre-auth key.
-                          This can be done via the web UI or through the `headscale` CLI.
-                        '';
-                        example = "config.sops.secrets.agent_pre_authkey.path";
-                      };
+                        pre_authkey_path = mkOption {
+                          type = types.nullOr types.path;
+                          default = null;
+                          description = ''
+                            Path to a file containing the agent preauth key.
+                            To connect to your Tailnet, you need to generate a pre-auth key.
+                            This can be done via the web UI or through the `headscale` CLI.
+                          '';
+                          example = "config.sops.secrets.agent_pre_authkey.path";
+                        };
 
-                      host_name = mkOption {
-                        type = types.str;
-                        default = "headplane-agent";
-                        description = "Optionally change the name of the agent in the Tailnet";
-                      };
+                        host_name = mkOption {
+                          type = types.str;
+                          default = "headplane-agent";
+                          description = "Optionally change the name of the agent in the Tailnet";
+                        };
 
-                      cache_ttl = mkOption {
-                        type = types.ints.positive;
-                        default = 180000;
-                        description = ''
-                          How long to cache agent information (in milliseconds).
-                          If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
-                        '';
-                      };
+                        cache_ttl = mkOption {
+                          type = types.ints.positive;
+                          default = 180000;
+                          description = ''
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                          '';
+                        };
 
-                      cache_path = mkOption {
-                        type = types.path;
-                        default = "/var/lib/headplane/agent_cache.json";
-                        description = "Where to store the agent cache.";
-                      };
+                        cache_path = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent_cache.json";
+                          description = "Where to store the agent cache.";
+                        };
 
-                      work_dir = mkOption {
-                        type = types.path;
-                        default = "/var/lib/headplane/agent";
-                        description = ''
-                          Do not change this unless you are running a custom deployment.
-                          The work_dir represents where the agent will store its data to be able to automatically reauthenticate with your Tailnet.
-                          It needs to be writable by the user running the Headplane process.
-                        '';
+                        work_dir = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent";
+                          description = ''
+                            Do not change this unless you are running a custom deployment.
+                            The work_dir represents where the agent will store its data to be able to automatically reauthenticate with your Tailnet.
+                            It needs to be writable by the user running the Headplane process.
+                          '';
+                        };
                       };
-
-                      package = mkPackageOption pkgs "headplane-agent" { };
-                    };
-                  };
-                  default = { };
+                    }
+                  );
+                  default = null;
                   description = "Agent configuration for the Headplane agent.";
                 };
 
@@ -253,128 +268,127 @@ in
           };
 
           oidc = mkOption {
-            type = types.submodule {
-              options = {
-                issuer = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = "URL to OpenID issuer.";
-                  example = "https://provider.example.com/issuer-url";
-                };
+            type = types.nullOr (
+              types.submodule {
+                options = {
+                  issuer = mkOption {
+                    type = types.str;
+                    description = "URL to OpenID issuer.";
+                    example = "https://provider.example.com/issuer-url";
+                  };
 
-                client_id = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = "The client ID for the OIDC client.";
-                  example = "your-client-id";
-                };
+                  client_id = mkOption {
+                    type = types.str;
+                    description = "The client ID for the OIDC client.";
+                    example = "your-client-id";
+                  };
 
-                client_secret_path = mkOption {
-                  type = types.nullOr types.path;
-                  default = null;
-                  description = ''
-                    Path to a file containing the OIDC client secret.
-                  '';
-                  example = "config.sops.secrets.oidc_client_secret.path";
-                };
+                  client_secret_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the OIDC client secret.
+                    '';
+                    example = "config.sops.secrets.oidc_client_secret.path";
+                  };
 
-                disable_api_key_login = mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = "Whether to disable API key login.";
-                };
+                  disable_api_key_login = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = "Whether to disable API key login.";
+                  };
 
-                token_endpoint_auth_method = mkOption {
-                  type = types.enum [
-                    "client_secret_post"
-                    "client_secret_basic"
-                    "client_secret_jwt"
-                  ];
-                  default = "client_secret_post";
-                  description = "The token endpoint authentication method.";
-                };
+                  token_endpoint_auth_method = mkOption {
+                    type = types.enum [
+                      "client_secret_post"
+                      "client_secret_basic"
+                      "client_secret_jwt"
+                    ];
+                    default = "client_secret_post";
+                    description = "The token endpoint authentication method.";
+                  };
 
-                headscale_api_key_path = mkOption {
-                  type = types.nullOr types.path;
-                  default = null;
-                  description = ''
-                    Path to a file containing the Headscale API key.
-                  '';
-                  example = "config.sops.secrets.headscale_api_key.path";
-                };
+                  headscale_api_key_path = mkOption {
+                    type = types.path;
+                    description = ''
+                      Path to a file containing the Headscale API key.
+                    '';
+                    example = "config.sops.secrets.headscale_api_key.path";
+                  };
 
-                redirect_uri = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = ''
-                    This should point to your publicly accessible URL
-                    for your Headplane instance with /admin/oidc/callback.
-                  '';
-                  example = "https://headscale.example.com/admin/oidc/callback";
-                };
+                  redirect_uri = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = ''
+                      This should point to your publicly accessible URL
+                      for your Headplane instance with /admin/oidc/callback.
+                    '';
+                    example = "https://headscale.example.com/admin/oidc/callback";
+                  };
 
-                user_storage_file = mkOption {
-                  type = types.path;
-                  default = "/var/lib/headplane/users.json";
-                  description = ''
-                    Path to a file containing the users and their permissions for Headplane.
-                  '';
-                  example = "/var/lib/headplane/users.json";
-                };
+                  user_storage_file = mkOption {
+                    type = types.path;
+                    default = "/var/lib/headplane/users.json";
+                    description = ''
+                      Path to a file containing the users and their permissions for Headplane.
+                    '';
+                    example = "/var/lib/headplane/users.json";
+                  };
 
-                profile_picture_source = mkOption {
-                  type = types.enum [
-                    "oidc"
-                    "gravatar"
-                  ];
-                  default = "oidc";
-                  description = "Source for user profile pictures.";
-                };
+                  profile_picture_source = mkOption {
+                    type = types.enum [
+                      "oidc"
+                      "gravatar"
+                    ];
+                    default = "oidc";
+                    description = "Source for user profile pictures.";
+                  };
 
-                strict_validation = mkOption {
-                  type = types.bool;
-                  default = true;
-                  description = "Enable strict validation of OIDC configuration.";
-                };
+                  strict_validation = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = "Enable strict validation of OIDC configuration.";
+                  };
 
-                scope = mkOption {
-                  type = types.str;
-                  default = "openid email profile";
-                  description = "OIDC scope to request.";
-                };
+                  scope = mkOption {
+                    type = types.str;
+                    default = "openid email profile";
+                    description = "OIDC scope to request.";
+                  };
 
-                extra_params = mkOption {
-                  type = types.nullOr (types.attrsOf types.str);
-                  default = null;
-                  description = "Extra parameters to send to the OIDC provider.";
-                  example = {
-                    prompt = "consent";
+                  extra_params = mkOption {
+                    type = types.nullOr (types.attrsOf types.str);
+                    default = null;
+                    description = "Extra parameters to send to the OIDC provider.";
+                    example = {
+                      prompt = "consent";
+                    };
+                  };
+
+                  authorization_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom authorization endpoint URL.";
+                    example = "https://provider.example.com/authorize";
+                  };
+
+                  token_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom token endpoint URL.";
+                    example = "https://provider.example.com/token";
+                  };
+
+                  userinfo_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom userinfo endpoint URL.";
+                    example = "https://provider.example.com/userinfo";
                   };
                 };
-
-                authorization_endpoint = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = "Custom authorization endpoint URL.";
-                  example = "https://provider.example.com/authorize";
-                };
-
-                token_endpoint = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = "Custom token endpoint URL.";
-                  example = "https://provider.example.com/token";
-                };
-
-                userinfo_endpoint = mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = "Custom userinfo endpoint URL.";
-                  example = "https://provider.example.com/userinfo";
-                };
-              };
-            };
-            default = { };
+              }
+            );
+            default = null;
             description = "OIDC Configuration for authentication.";
           };
         };
@@ -384,6 +398,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          cfg.settings.integration.agent == null
+          || !cfg.settings.integration.agent.enabled
+          || cfg.settings.integration.agent.pre_authkey_path != null;
+        message = ''
+          services.headplane.settings.integration.agent.pre_authkey_path must be set
+          when services.headplane.settings.integration.agent.enabled is true.
+        '';
+      }
+    ];
+
     environment = {
       systemPackages = [ cfg.package ];
       etc."headplane/config.yaml".source = "${settingsFile}";
diff --git a/pkgs/by-name/he/headplane-agent/package.nix b/pkgs/by-name/he/headplane-agent/package.nix
index e12db5adecf7..40f3bd7102e7 100644
--- a/pkgs/by-name/he/headplane-agent/package.nix
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@@ -16,6 +16,7 @@ buildGoModule (finalAttrs: {
   };
 
   vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+  subPackages = [ "cmd/hp_agent" ];
 
   ldflags = [
     "-s"

From b0831150852cef68d09b5957297d9a86e52fe13c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 05:46:43 +0000
Subject: [PATCH 50/86] hyprpanel: 0-unstable-2026-03-23 ->
 0-unstable-2026-04-23

---
 pkgs/by-name/hy/hyprpanel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index 5f22894d9556..458773a33908 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -49,7 +49,7 @@ in
 
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2026-03-23";
+  version = "0-unstable-2026-04-23";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,8 +57,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "e919b4a8a8ab5f2a0752f68576ab3eed6993cefd";
-    hash = "sha256-92ZbaBfsEXEE7VaWJjv9aRSk3l9nyoYYyMe2AwTqSZI=";
+    rev = "1961ba86ad5ab880beb639e5454054b2b5037e0d";
+    hash = "sha256-QowlCOrE4jGOTDCUCEx/E8gHjqSx3r25y7v4dEBpBhk=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42

From fc6e4b9d95796faf5f71ea5b82e5b63eda961a6e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 06:02:43 +0000
Subject: [PATCH 51/86] libretro.neocd: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/neocd.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/neocd.nix b/pkgs/applications/emulators/libretro/cores/neocd.nix
index fef03cb990f8..9a5bb699732d 100644
--- a/pkgs/applications/emulators/libretro/cores/neocd.nix
+++ b/pkgs/applications/emulators/libretro/cores/neocd.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "neocd";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "neocd_libretro";
-    rev = "9216ca226f24e01e77fc2670035e97da154f3de4";
-    hash = "sha256-Mq9UOuPwmG2Di68jWUgCbBvG3jUCEMON8Kfly/aCdH4=";
+    rev = "9e9ad181bed60f84f9cff02c03617b41e8a31cfe";
+    hash = "sha256-1rmoV6jxClTSRWNzsYepP8VSHKbSB+HUOLkvRrvYz/c=";
   };
 
   makefile = "Makefile";

From ece75ae39953f0f391c3b54904f5d83a7ae9fc7f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 06:30:28 +0000
Subject: [PATCH 52/86] libretro.beetle-pcfx: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-22

---
 pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix b/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
index a5b00be615cd..0f5331ab92a7 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pcfx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pcfx-libretro";
-    rev = "035191393485280cad1866ce3aedd626d4fa09d0";
-    hash = "sha256-jchEbKvHSE4D90ezwi//nl8vefQD4gp6YWb0eb6zkeY=";
+    rev = "650c30ea2203636a1716675854d11c608ed6eacc";
+    hash = "sha256-xB3O7N23bS2IAaWuvxIXfVodua8s1dcbZ2XAB0Lt6gc=";
   };
 
   makefile = "Makefile";

From c23c1407c4d312eafdb919d69732e1b3c98634f2 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Tue, 28 Apr 2026 08:31:11 +0200
Subject: [PATCH 53/86] phpExtensions.spx: fix changelog url

---
 pkgs/development/php-packages/spx/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index a6fb3c8f3563..849e9c23d842 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -25,7 +25,7 @@ buildPecl {
   ];
 
   meta = {
-    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/${version}";
+    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/v${version}";
     description = "Simple & straight-to-the-point PHP profiling extension with its built-in web UI";
     homepage = "https://github.com/NoiseByNorthwest/php-spx";
     license = lib.licenses.php301;

From 9f02827bc1e9af15bb4219a303aae950a27685b5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 06:32:38 +0000
Subject: [PATCH 54/86] pur: 7.3.3 -> 7.4.0

---
 pkgs/by-name/pu/pur/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pu/pur/package.nix b/pkgs/by-name/pu/pur/package.nix
index 08e81672c2a9..ccef7e0df538 100644
--- a/pkgs/by-name/pu/pur/package.nix
+++ b/pkgs/by-name/pu/pur/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "pur";
-  version = "7.3.3";
+  version = "7.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alanhamlett";
     repo = "pip-update-requirements";
     tag = finalAttrs.version;
-    hash = "sha256-zSEzYYpDmu3fennTZNvQjAoMekzxoMDUEqvSjN6hNUk=";
+    hash = "sha256-BxUR4yyT6ipvBozWgat709rNPHELE/PNPVJ4LtfOdfQ=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From c9c75639a8f8092b920e86e75f16ca291137f111 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Tue, 28 Apr 2026 08:35:10 +0200
Subject: [PATCH 55/86] phpExtensions.spx: switch to tag

---
 pkgs/development/php-packages/spx/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index 849e9c23d842..bb6e2b61c95b 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -15,7 +15,7 @@ buildPecl {
   src = fetchFromGitHub {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-P53g/o4i+QETWdErZaGA3AREvnr8kL9h0B1BMQlKdFA=";
   };
 

From aee6662b429cf1d5b349cb6234aeddcaf1eae481 Mon Sep 17 00:00:00 2001
From: StealthBadger747 <ac130kire@gmail.com>
Date: Mon, 27 Apr 2026 22:40:08 -0700
Subject: [PATCH 56/86] nixos/headplane: add config assertions and fix option
 examples

---
 .../modules/services/networking/headplane.nix | 46 ++++++++++++++++---
 pkgs/by-name/he/headplane-agent/package.nix   |  1 +
 pkgs/by-name/he/headplane/package.nix         |  3 ++
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/networking/headplane.nix b/nixos/modules/services/networking/headplane.nix
index d4cdeac233a5..5fac2f04e37d 100644
--- a/nixos/modules/services/networking/headplane.nix
+++ b/nixos/modules/services/networking/headplane.nix
@@ -39,7 +39,7 @@ in
 
     agent.package = mkPackageOption pkgs "headplane-agent" { };
 
-    debug = mkEnableOption "Enable debug loggin";
+    debug = mkEnableOption "debug logging";
 
     settings = mkOption {
       description = ''
@@ -71,7 +71,7 @@ in
                     Path to a file containing the cookie secret.
                     The secret must be exactly 32 characters long.
                   '';
-                  example = "config.sops.secrets.headplane_cookie.path";
+                  example = lib.literalExpression "config.sops.secrets.headplane_cookie.path";
                 };
 
                 cookie_secure = mkOption {
@@ -122,7 +122,7 @@ in
                   description = ''
                     Path to a file containing the TLS certificate.
                   '';
-                  example = "config.sops.secrets.tls_cert.path";
+                  example = lib.literalExpression "config.sops.secrets.tls_cert.path";
                 };
 
                 public_url = mkOption {
@@ -203,7 +203,7 @@ in
                             To connect to your Tailnet, you need to generate a pre-auth key.
                             This can be done via the web UI or through the `headscale` CLI.
                           '';
-                          example = "config.sops.secrets.agent_pre_authkey.path";
+                          example = lib.literalExpression "config.sops.secrets.agent_pre_authkey.path";
                         };
 
                         host_name = mkOption {
@@ -289,7 +289,7 @@ in
                     description = ''
                       Path to a file containing the OIDC client secret.
                     '';
-                    example = "config.sops.secrets.oidc_client_secret.path";
+                    example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
                   disable_api_key_login = mkOption {
@@ -309,11 +309,13 @@ in
                   };
 
                   headscale_api_key_path = mkOption {
-                    type = types.path;
+                    type = types.nullOr types.path;
+                    default = null;
                     description = ''
                       Path to a file containing the Headscale API key.
+                      Required when `services.headplane.settings.oidc` is set.
                     '';
-                    example = "config.sops.secrets.headscale_api_key.path";
+                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
                   };
 
                   redirect_uri = mkOption {
@@ -399,6 +401,27 @@ in
 
   config = mkIf cfg.enable {
     assertions = [
+      {
+        assertion = config.services.headscale.enable;
+        message = ''
+          services.headplane requires services.headscale.enable = true.
+          The headplane module references the headscale systemd unit
+          (in `after`/`requires`) and reads its configFile, port, user,
+          and group. Enable headscale or disable headplane.
+        '';
+      }
+      {
+        assertion = cfg.settings.server.cookie_secret_path != null;
+        message = ''
+          services.headplane.settings.server.cookie_secret_path must be set.
+          Headplane refuses to start without either `cookie_secret` or
+          `cookie_secret_path` (validated at startup, see upstream
+          app/server/config/schema.ts). The NixOS module only exposes the
+          *_path form to keep secrets out of the world-readable /nix/store.
+          Provide a path to a file containing a 32-character secret, e.g.
+          via systemd `LoadCredential` or sops-nix.
+        '';
+      }
       {
         assertion =
           cfg.settings.integration.agent == null
@@ -409,6 +432,15 @@ in
           when services.headplane.settings.integration.agent.enabled is true.
         '';
       }
+      {
+        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        message = ''
+          services.headplane.settings.oidc.headscale_api_key_path must be set
+          when services.headplane.settings.oidc is non-null. Headplane's OIDC
+          flow requires a Headscale API key to mint sessions; upstream config
+          validation rejects an OIDC block without it.
+        '';
+      }
     ];
 
     environment = {
diff --git a/pkgs/by-name/he/headplane-agent/package.nix b/pkgs/by-name/he/headplane-agent/package.nix
index 40f3bd7102e7..a645d2e576f8 100644
--- a/pkgs/by-name/he/headplane-agent/package.nix
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@@ -5,6 +5,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "headplane-agent";
+  __structuredAttrs = true;
   # Note, if you are upgrading this, you should upgrade headplane at the same time
   version = "0.6.1";
 
diff --git a/pkgs/by-name/he/headplane/package.nix b/pkgs/by-name/he/headplane/package.nix
index 51c6b74609a6..bb42ab31bcee 100644
--- a/pkgs/by-name/he/headplane/package.nix
+++ b/pkgs/by-name/he/headplane/package.nix
@@ -65,6 +65,9 @@ in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version src;
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     git
     makeWrapper

From 4c2bf5a3f59aa9a931282f1c3085bcb62cbe2670 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 07:03:40 +0000
Subject: [PATCH 57/86] libretro.tgbdual: 0-unstable-2025-05-10 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/tgbdual.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/tgbdual.nix b/pkgs/applications/emulators/libretro/cores/tgbdual.nix
index 2f54c2ffd9f0..1256fe11673f 100644
--- a/pkgs/applications/emulators/libretro/cores/tgbdual.nix
+++ b/pkgs/applications/emulators/libretro/cores/tgbdual.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "tgbdual";
-  version = "0-unstable-2025-05-10";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "tgbdual-libretro";
-    rev = "933707c0ba8f12360f6d79712f735a917713709a";
-    hash = "sha256-58OLuF14aSJGhmXR0RGgPpuHLXYk9LOz7LX03AEFPr4=";
+    rev = "12540f0b2d3783259a0dce34ac8aa7a86beeaa11";
+    hash = "sha256-l+WiFC5GxbdY9ulmtdqd2iKU7qKoVWqcf4YR/waSVhQ=";
   };
 
   makefile = "Makefile";

From 83fd7bd293ee0b9f22484b0b2823eae2ab734af7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 07:23:39 +0000
Subject: [PATCH 58/86] fosrl-olm: 1.4.4 -> 1.5.0

---
 pkgs/by-name/fo/fosrl-olm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index ea332c138ace..6bd26a00b0bd 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-G2kYzYg4RUFHgW9z44PcQPK85FsD5SVBefpzBKIwUw0=";
+    hash = "sha256-OnHOfP3dCduTe0xnZD77YZcI3GOKxGsen5i7dOiCjy8=";
   };
 
-  vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";
+  vendorHash = "sha256-+KQpYGoyNI2SnEjj23GM0FqZFX6lHx7oNw9qdkkgcPU=";
 
   ldflags = [
     "-s"

From ab2f514873a3665b753a898c90e5036318e49cbc Mon Sep 17 00:00:00 2001
From: Marek Fajkus <marek.faj@gmail.com>
Date: Mon, 27 Apr 2026 21:10:58 +0200
Subject: [PATCH 59/86] elmPackages.elm-review: 2.13.4 -> 2.13.5

and fix changelog url, see #514132
---
 .../compilers/elm/packages/elm-review/default.nix         | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/elm/packages/elm-review/default.nix b/pkgs/development/compilers/elm/packages/elm-review/default.nix
index 8c13a4ec29be..cb2b178dc335 100644
--- a/pkgs/development/compilers/elm/packages/elm-review/default.nix
+++ b/pkgs/development/compilers/elm/packages/elm-review/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "elm-review";
-  version = "2.13.4";
+  version = "2.13.5";
 
   src = fetchFromGitHub {
     owner = "jfmengels";
     repo = "node-elm-review";
     rev = "v${version}";
-    hash = "sha256-rhNLIShZERxrzdTdrPcthTQ+gHUikgR0jchBfcBDGTo=";
+    hash = "sha256-IjaPJ9ic/5Z8pdtziNwLqzXfnSmgkurjC6afmNIX4LU=";
   };
 
-  npmDepsHash = "sha256-mI94fYNKZ9Jx1Iyo/VjZqaXQ64tZA2S8mtn5l6TtCSc=";
+  npmDepsHash = "sha256-eY9U9mLVL9tizN8touWQfLqFAJJ8pHaSHVD//cvNdhE=";
 
   postPatch = ''
     sed -i "s/elm-tooling install/echo 'skipping elm-tooling install'/g" package.json
@@ -32,7 +32,7 @@ buildNpmPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/jfmengels/node-elm-review/blob/v${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/jfmengels/node-elm-review/blob/main/CHANGELOG.md";
     description = "Analyzes Elm projects, to help find mistakes before your users find them";
     mainProgram = "elm-review";
     homepage = "https://github.com/jfmengels/node-elm-review";

From 66f4e5d9886bb7da3055c4f7615f9d093acda60b Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Tue, 28 Apr 2026 10:04:39 +0200
Subject: [PATCH 60/86] Revert "lib/strings.concatLines: call concatStringsSep
 directly"

This reverts commit d7e6988c9b7bd7ada8662752ff654e4fde1a1426.
---
 lib/strings.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/strings.nix b/lib/strings.nix
index d6170fdf39e3..848e61a65ddf 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -337,6 +337,7 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
+    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -360,7 +361,7 @@ rec {
 
     :::
   */
-  concatLines = str: concatStringsSep "\n" str + "\n";
+  concatLines = concatMapStrings (s: s + "\n");
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.

From 5c9f6077a737e503bbbb04ab24ae79c0dcde278d Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Tue, 28 Apr 2026 10:08:32 +0200
Subject: [PATCH 61/86] lib/concatLines: add test for empty list

---
 lib/tests/misc.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 916994152754..f257d9953fc3 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -559,6 +559,10 @@ runTests {
     ];
     expected = "a\nb\nc\n";
   };
+  testConcatLinesEmpty = {
+    expr = concatLines [ ];
+    expected = "";
+  };
 
   testMakeIncludePathWithPkgs = {
     expr = (

From ba93c3b70e3b13c5692771f37e4f01f2a29af704 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 08:33:06 +0000
Subject: [PATCH 62/86] xnldorker: 4.3 -> 4.5

---
 pkgs/by-name/xn/xnldorker/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xn/xnldorker/package.nix b/pkgs/by-name/xn/xnldorker/package.nix
index 81a088bc5788..4c50caf38c94 100644
--- a/pkgs/by-name/xn/xnldorker/package.nix
+++ b/pkgs/by-name/xn/xnldorker/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xnldorker";
-  version = "4.3";
+  version = "4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "xnldorker";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YOYBEoYZBZfGtnJKku88XMj56JSN/EP9jLvqNXNqNJs=";
+    hash = "sha256-2Oh341KTxD47aZVTikDMFs6e4HGfQ77BPptksw+6w7s=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From e3dc2d666d2901cb84a723640459ae04935b7e15 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Fri, 27 Mar 2026 19:22:16 -0400
Subject: [PATCH 63/86] finit: allow configuring the `login` and `sysctl`
 binaries

---
 pkgs/by-name/fi/finit/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/finit/package.nix b/pkgs/by-name/fi/finit/package.nix
index 8d6672388dc5..77bc25ebbd3b 100644
--- a/pkgs/by-name/fi/finit/package.nix
+++ b/pkgs/by-name/fi/finit/package.nix
@@ -7,6 +7,8 @@
   libcap,
   libite,
   libuev,
+  shadow,
+  sysctl,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -60,8 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
-    "-D_PATH_LOGIN=\"/run/current-system/sw/bin/login\""
-    "-DSYSCTL_PATH=\"/run/current-system/sw/bin/sysctl\""
+    "-D_PATH_LOGIN=\"${shadow}/bin/login\""
+    "-DSYSCTL_PATH=\"${sysctl}/bin/sysctl\""
   ];
 
   meta = {

From 00a033102d2d7116b780df996c347674f9d207cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Apr 2026 14:34:28 +0000
Subject: [PATCH 64/86] ocamlPackages.duration: 0.2.1 -> 0.3.1

---
 pkgs/development/ocaml-modules/duration/default.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/ocaml-modules/duration/default.nix b/pkgs/development/ocaml-modules/duration/default.nix
index ba42a8b3af17..ab27a0aa2bd4 100644
--- a/pkgs/development/ocaml-modules/duration/default.nix
+++ b/pkgs/development/ocaml-modules/duration/default.nix
@@ -1,23 +1,20 @@
 {
   lib,
   buildDunePackage,
-  ocaml,
   fetchurl,
   alcotest,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "duration";
-  version = "0.2.1";
-
-  duneVersion = "3";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://github.com/hannesm/duration/releases/download/v${finalAttrs.version}/duration-${finalAttrs.version}.tbz";
-    hash = "sha256-xzjB84z7mYIMEhzT3fgZ3ksiKPDVDqy9HMPOmefHHis=";
+    hash = "sha256-zYjaaTlR4SEuqD4kzhf3Z+laOanOKt2gZUsy11zmjBM=";
   };
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
   checkInputs = [ alcotest ];
 
   meta = {

From 37411ee7f98ea75bb4a8b32705f1e4030b0f56a5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 08:39:59 +0000
Subject: [PATCH 65/86] sparkle: 1.26.3 -> 1.26.4

---
 pkgs/by-name/sp/sparkle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index b813676aea24..17bb24a7275d 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -43,20 +43,20 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchFromGitHub {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-36eqSgXDl3ASDO4wn8cCptSE4qf3FwFyl+TEhCzhGwA=";
+    hash = "sha256-+3MHCy1N1/kOVFYDNvNiP/jkL0HHi2RwfeIqe2Z40O8=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-uiUp2YtPMvG0d9GIedxNzkY0TR/bdbWQv4IFiVZew5s=";
+    hash = "sha256-Us4qsCJdRZKYJQAgcqeStX7MfEqBWr4rKXBqU2K+KZI=";
   };
 
   nativeBuildInputs = [

From 43c30925898dade2815714cb19ed7a8bce2ba7d8 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Fri, 27 Mar 2026 19:24:46 -0400
Subject: [PATCH 66/86] finit: 4.16 -> 4.17

---
 pkgs/by-name/fi/finit/package.nix | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/fi/finit/package.nix b/pkgs/by-name/fi/finit/package.nix
index 77bc25ebbd3b..b9edd713a410 100644
--- a/pkgs/by-name/fi/finit/package.nix
+++ b/pkgs/by-name/fi/finit/package.nix
@@ -9,17 +9,19 @@
   libuev,
   shadow,
   sysctl,
+  plymouth,
+  plymouthSupport ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "finit";
-  version = "4.16";
+  version = "4.17";
 
   src = fetchFromGitHub {
     owner = "finit-project";
     repo = "finit";
     tag = finalAttrs.version;
-    hash = "sha256-DtocGgFvt7RLqwjHczwUbsszBD5MQI5fEuq9EB2tFp4=";
+    hash = "sha256-sH4xZNMEuIS+r6rVQAKnsHtSyTe2B6gdYcmH9J8eSZ0=";
   };
 
   postPatch = ''
@@ -59,12 +61,21 @@ stdenv.mkDerivation (finalAttrs: {
 
     # monitor kernel events, like ac power status
     "--with-keventd"
+  ]
+  ++ lib.optionals plymouthSupport [
+    "--enable-plymouth-plugin=yes"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-D_PATH_LOGIN=\"${shadow}/bin/login\""
-    "-DSYSCTL_PATH=\"${sysctl}/bin/sysctl\""
-  ];
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-D_PATH_LOGIN=\"${shadow}/bin/login\""
+      "-DSYSCTL_PATH=\"${sysctl}/bin/sysctl\""
+    ]
+    ++ lib.optionals plymouthSupport [
+      "-DPLYMOUTH_PATH=\"${plymouth}/bin/plymouth\""
+      "-DPLYMOUTHD_PATH=\"${plymouth}/bin/plymouthd\""
+    ]
+  );
 
   meta = {
     description = "Fast init for Linux";

From 08bd45f9f158d39a497d911a651d82c552bd7b1b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:47:46 +0200
Subject: [PATCH 67/86] python3Packages.mypy-boto3-billingconductor: 1.42.7 ->
 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 4c4db47e089a..4c7057f799dc 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -167,8 +167,8 @@ in
       "sha256-BpJmc4Dq72eN7RPSpo51FAfpfrYRz7X/p6QBUpj2wuk=";
 
   mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.42.7"
-      "sha256-ZQsHPgnPepj1HbBd37u76Fd1td4M7B5o6kId8FPP5yQ=";
+    buildMypyBoto3Package "billingconductor" "1.42.97"
+      "sha256-CsBeZk3+PmOx8ZLXVZQM/wR9PXsKJ4YD8PqfUjV/2ho=";
 
   mypy-boto3-braket =
     buildMypyBoto3Package "braket" "1.42.85"

From 29e6bc3b2cb84eb6084f58f3347b44210eab2644 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:14 +0200
Subject: [PATCH 68/86] python3Packages.mypy-boto3-glue: 1.42.89 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 4c7057f799dc..877a7585a137 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -571,8 +571,8 @@ in
       "sha256-N0kQ7Fc44SFKXhl4V+oAclPNlWhluOs53NDokiXcSNM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.42.89"
-      "sha256-U+NzY02OyhR/GbZy+2Ye3+FgAVzF/UTNhUH3fy9SmMc=";
+    buildMypyBoto3Package "glue" "1.42.97"
+      "sha256-YtkjsZejVm6IHku0Iz0KYjRIo4LpI/DsYSn77a+O1tE=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.42.51"
       "sha256-QHAuRJrioMD7ASgV1Wobm81Gb+Z87c78yBs9X1+Kz+E=";

From 961fde936241a145382db386fcf6ba7d63c00057 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:23 +0200
Subject: [PATCH 69/86] python3Packages.mypy-boto3-ivs: 1.42.94 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 877a7585a137..4b19e63a86a6 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -694,8 +694,8 @@ in
       "sha256-Q6ypzi2rIhj5oECPe/Xz6GoKU8Uu04PdpdGvMgxjpnc=";
 
   mypy-boto3-ivs =
-    buildMypyBoto3Package "ivs" "1.42.94"
-      "sha256-deZSEEfLk/ml9447Y4G5PPSj3OJHt/XHRfeD1CdBWBE=";
+    buildMypyBoto3Package "ivs" "1.42.97"
+      "sha256-UBVezeWNDLG2drCDZjKR5sgQBmKtZ8wZv1dLvI6OCx0=";
 
   mypy-boto3-ivs-realtime =
     buildMypyBoto3Package "ivs-realtime" "1.42.86"

From 06b6a420cc8b79318d03c13e90399b92292eaafb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:28 +0200
Subject: [PATCH 70/86] python3Packages.mypy-boto3-kms: 1.42.50 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 4b19e63a86a6..a60778b8bef3 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -758,8 +758,8 @@ in
       "sha256-x9ntwcOhUm5Hsd/L+O5N77xJ/NWxgQhNVdtaaShM7p8=";
 
   mypy-boto3-kms =
-    buildMypyBoto3Package "kms" "1.42.50"
-      "sha256-bCVvuhK3mpTeNDYDYaACVWgQMhKR9mIi9BbbCI0ynCA=";
+    buildMypyBoto3Package "kms" "1.42.97"
+      "sha256-VyPK4Jin6POXMX/A0zzOd2Fd9CQyzDqR1qpFprMvxsA=";
 
   mypy-boto3-lakeformation =
     buildMypyBoto3Package "lakeformation" "1.42.79"

From 8e625597cc49c6efc559b4ac9d1e12033d58b401 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:32 +0200
Subject: [PATCH 71/86] python3Packages.mypy-boto3-logs: 1.42.96 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index a60778b8bef3..6828f1216d12 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -806,8 +806,8 @@ in
       "sha256-UBSxl5YmYh3m4gl4iKdDU2McetKuDcLkiR73Yvf0AQQ=";
 
   mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.42.96"
-      "sha256-MU6OS6h65vu4ILnioSVFSjptSkCow4T2qbTky2vo8ao=";
+    buildMypyBoto3Package "logs" "1.42.97"
+      "sha256-Vy973itXZ2B1hsp/f6D8X2QN290L+5QcuelK43H7bNU=";
 
   mypy-boto3-lookoutequipment =
     buildMypyBoto3Package "lookoutequipment" "1.42.3"

From b1b8f2e1f2e2fbabf6ae39554897070b5f92dc48 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:39 +0200
Subject: [PATCH 72/86] python3Packages.mypy-boto3-mgn: 1.42.68 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 6828f1216d12..509063c10664 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -906,8 +906,8 @@ in
       "sha256-kFHGogiCfbftZr67o8zT7eb8na74J4AGneac03q+Pvc=";
 
   mypy-boto3-mgn =
-    buildMypyBoto3Package "mgn" "1.42.68"
-      "sha256-zrUwEeofbz+Tj7GgHzOzodYzsnPKqAISOuRGG6B7rpY=";
+    buildMypyBoto3Package "mgn" "1.42.97"
+      "sha256-45OfbZhzJ6bEZo+qIfvIc++26MeRThRp162iyWWQNEo=";
 
   mypy-boto3-migration-hub-refactor-spaces =
     buildMypyBoto3Package "migration-hub-refactor-spaces" "1.42.3"

From bea488b22bb38e33cc3aadd6b2a719df8a28c76f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:43 +0200
Subject: [PATCH 73/86] python3Packages.mypy-boto3-omics: 1.42.78 -> 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 509063c10664..ed5d3192edca 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -962,8 +962,8 @@ in
       "sha256-CGt/WuKol9nVwLHEwNgEsQDzIBhFarJNbq30OpiK0+I=";
 
   mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.42.78"
-      "sha256-h0urK602L1j2CtD1xsUOMaXizzc2CxbttMlaSNyQNoM=";
+    buildMypyBoto3Package "omics" "1.42.97"
+      "sha256-7eLIW6ucZ/KQ/yGFinkBAPLKXOBKdd9RpxUromwqc6c=";
 
   mypy-boto3-opensearch =
     buildMypyBoto3Package "opensearch" "1.42.95"

From 91ac56ecdb2076424ec6848f63557de72890d389 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:44 +0200
Subject: [PATCH 74/86] python3Packages.mypy-boto3-opensearch: 1.42.95 ->
 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ed5d3192edca..55ca69d4c643 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -966,8 +966,8 @@ in
       "sha256-7eLIW6ucZ/KQ/yGFinkBAPLKXOBKdd9RpxUromwqc6c=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.42.95"
-      "sha256-CGCwYDcgttsyYSKUB2kVVeeOxtT6svLxR+fDFtjZ854=";
+    buildMypyBoto3Package "opensearch" "1.42.97"
+      "sha256-jAtx5h6lBgoBf/nzt7WO/QC+ZGFBGGCC6OF9OmkAqYY=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.42.75"

From 98a840d1c9ff2d4e1dd133f99b071400d1304128 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:48:58 +0200
Subject: [PATCH 75/86] python3Packages.mypy-boto3-sagemaker: 1.42.93 ->
 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 55ca69d4c643..cb65ba40f03c 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1170,8 +1170,8 @@ in
       "sha256-juVfwdjPDNPaT5tvyXpzDtomugqxeu++AERLkVtFIxw=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.42.93"
-      "sha256-ZxPcCnneSMwI0Yl3TiiMxim9FIBzen4hC5X76Dhnd7U=";
+    buildMypyBoto3Package "sagemaker" "1.42.97"
+      "sha256-FGjRmINeQxxdn20Jn7SvjwYfpDZdfDys/VTC6fzGov0=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.42.3"

From a9345d25e62a05d0df222826d1cc29a987dda417 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:49:14 +0200
Subject: [PATCH 76/86] python3Packages.mypy-boto3-workspaces: 1.42.66 ->
 1.42.97

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index cb65ba40f03c..25104ad786cf 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1422,8 +1422,8 @@ in
       "sha256-bxh+mhwsHHwt/cx/njegTa/QGHu+xa7YPg4SRos1deM=";
 
   mypy-boto3-workspaces =
-    buildMypyBoto3Package "workspaces" "1.42.66"
-      "sha256-HFB5MRlLqUlk2KSwh6Fzv352mTR3ComSRK0vwNVxwoQ=";
+    buildMypyBoto3Package "workspaces" "1.42.97"
+      "sha256-WLheY3TM39Li6b6cvzsEgNTMplDikmoh5zuQ0aRLNAk=";
 
   mypy-boto3-workspaces-web =
     buildMypyBoto3Package "workspaces-web" "1.42.51"

From dbc1a755f380feed22be2699f8c0500bd9979d1f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:49:23 +0200
Subject: [PATCH 77/86] python3Packages.boto3-stubs: 1.42.96 -> 1.42.97

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 38a50181c4e5..130dba4d66a8 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.96";
+  version = "1.42.97";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-HngZw00ero5ePPr50UT9ytZarRhLOASIhx3h0LKFGHk=";
+    hash = "sha256-9/R3WwhR/22w4/sJcGSvZDfk3jG3l9h0pzcQSZjgKMY=";
   };
 
   build-system = [ setuptools ];

From 2db211a32443aaa6c83c38e1cf00bde8feb1820c Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 28 Apr 2026 11:01:51 +0200
Subject: [PATCH 78/86] go: use uplosi as tester instead of athens

athens currently pins Go 1.26, making it unusable for the test.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/development/compilers/go/tests.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix
index 3eeaa8b53262..4f433a303f3a 100644
--- a/pkgs/development/compilers/go/tests.nix
+++ b/pkgs/development/compilers/go/tests.nix
@@ -9,11 +9,11 @@
   runCommand,
   bintools,
   # A package with CGO_ENABLED=0
-  athens,
+  uplosi,
 }:
 let
   skopeo' = skopeo.override { buildGoModule = buildGoModule; };
-  athens' = athens.override { buildGoModule = buildGoModule; };
+  uplosi' = uplosi.override { buildGoModule = buildGoModule; };
   expectedCgoEnabledType = "DYN";
   expectedCgoDisabledType = "EXE";
 in
@@ -24,7 +24,7 @@ in
     command = "go version";
     version = "go${go.version}";
   };
-  athens = testers.testVersion { package = athens'; };
+  uplosi = testers.testVersion { package = uplosi'; };
 }
 # bin type tests assume ELF file + linux-specific exe types
 // lib.optionalAttrs stdenv.hostPlatform.isLinux {
@@ -41,13 +41,13 @@ in
       exit 1
     fi
   '';
-  athens-bin-type = runCommand "athens-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
-    bin="${lib.getExe athens'}"
+  uplosi-bin-type = runCommand "uplosi-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
+    bin="${lib.getExe uplosi'}"
     ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) ''
       # For CGO_ENABLED=0 the internal linker should be used, except
       # for cross where we rely on external linking by default
-      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe athens'} | grep -Fq "GCC: (GNU)"; then
-        echo "${lib.getExe athens'} has a GCC .comment, but it should have used the internal go linker"
+      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe uplosi'} | grep -Fq "GCC: (GNU)"; then
+        echo "${lib.getExe uplosi'} has a GCC .comment, but it should have used the internal go linker"
         exit 1
       fi
     ''}

From 1f9b96afaa22d9267e258d89dd638415917437a0 Mon Sep 17 00:00:00 2001
From: Ramses <ramses@well-founded.dev>
Date: Tue, 28 Apr 2026 08:02:14 +0200
Subject: [PATCH 79/86] lilypond: remove empty patches array

Co-authored-by: Thomas Butter <thomas@gmx.net>
---
 pkgs/by-name/li/lilypond/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/li/lilypond/package.nix b/pkgs/by-name/li/lilypond/package.nix
index 011082c5345b..7e1265019c13 100644
--- a/pkgs/by-name/li/lilypond/package.nix
+++ b/pkgs/by-name/li/lilypond/package.nix
@@ -78,8 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "mem=mf2pt1" "mem=$PWD/mf/mf2pt1"
   '';
 
-  patches = [ ];
-
   strictDeps = true;
 
   depsBuildBuild = [

From 1b6c16c33a88b72c9cebb6afb28ac8234269e772 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 11:11:26 +0200
Subject: [PATCH 80/86] python3Packages.iamdata: 0.1.202604271 -> 0.1.202604281

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202604271...v0.1.202604281

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202604281
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 060ad122b126..b32847cf3012 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604271";
+  version = "0.1.202604281";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WKbjXsBprC/z4FFRaEztdGCRKdZ926muGUM6tCxLXu0=";
+    hash = "sha256-8evw78YKTofoMEp+yHdzN0NdMX5aeP63ax3DsBwaSYA=";
   };
 
   __darwinAllowLocalNetworking = true;

From c43d836231ccf64e17ab38dc2b81c67ab9ee60c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 09:11:27 +0000
Subject: [PATCH 81/86] libretro.melonds: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/melonds.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/melonds.nix b/pkgs/applications/emulators/libretro/cores/melonds.nix
index 83e335680e0a..b6846e4d1e89 100644
--- a/pkgs/applications/emulators/libretro/cores/melonds.nix
+++ b/pkgs/applications/emulators/libretro/cores/melonds.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "melonds";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "melonds";
-    rev = "e548eba517ccb964ddba31dcf8f0136041f5bb05";
-    hash = "sha256-4bCunBPpBP0RWwL1vUTQxLPtCBnQ0M5pC3GAX1uTL5A=";
+    rev = "634e51477364edc39aaccd3bebf8bcab5776148c";
+    hash = "sha256-/u6CQKpb9eIls0TYpSpWoIf+IQ0CTIx48oq8LscfhFw=";
   };
 
   extraBuildInputs = [

From 27ec4bd9c5dfbf4d668c2422a289ffe7ceb02aad Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 28 Apr 2026 10:52:32 +0200
Subject: [PATCH 82/86] python3Packages.tencentcloud-sdk-python: 3.1.86 ->
 3.1.87

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.86...3.1.87

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.87/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 1f8bcd7ed2d7..0b082f532648 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.86";
+  version = "3.1.87";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-ah35SS2oruYzC2JTSLWm3MNaRUp8fiwC21KFoNMKt6g=";
+    hash = "sha256-KxKUZNGn3SYxI9W4gJHRcWQMTUAxdgYiwNUbYKYaCp8=";
   };
 
   build-system = [ setuptools ];

From 75ed18ed5c5f1a31771f27ed416a7a456a0b5c93 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 10:05:08 +0000
Subject: [PATCH 83/86] python3Packages.oelint-data: 1.4.11 -> 1.4.12

---
 pkgs/development/python-modules/oelint-data/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index ba54ec5d1ec5..d69acef6d247 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.4.11";
+  version = "1.4.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-zd4SmDIHtOKYK19tr/72CIKAfhWtm7957Ax7b2kAXdw=";
+    hash = "sha256-Q+h5qSCvybxO+RojDNoS6g1Bt/fLpiWVJHRiMkgPpvY=";
   };
 
   build-system = [

From ae103431f00a5e43aea3d859fea5f04954d518b2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 10:14:01 +0000
Subject: [PATCH 84/86] libretro.eightyone: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-20

---
 pkgs/applications/emulators/libretro/cores/eightyone.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/eightyone.nix b/pkgs/applications/emulators/libretro/cores/eightyone.nix
index 21b32cc816ac..d249284baa13 100644
--- a/pkgs/applications/emulators/libretro/cores/eightyone.nix
+++ b/pkgs/applications/emulators/libretro/cores/eightyone.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "81";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "81-libretro";
-    rev = "f9e5fa3bef9a6d6e1e19a4b1c7e5922467b582a2";
-    hash = "sha256-c/0L0NLAFyyjQcPNmmfHW29i1As4Wk2/U3qKtClk1VE=";
+    rev = "fa7094910d040baa5fd8b11dbf6a1a618330ecd9";
+    hash = "sha256-TuAx8frehC9h+s77xcigydMxvHXLzIc/q1y4vK8/WuI=";
   };
 
   meta = {

From 2699e59ed62e9b3b662dfddedda39101d0720cc3 Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@galowicz.de>
Date: Fri, 24 Apr 2026 11:53:49 +0100
Subject: [PATCH 85/86] nixos-test-driver: add release notes for 26.05

---
 nixos/doc/manual/release-notes/rl-2605.section.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index b57dd6e1fa70..050cc4b09193 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -51,6 +51,11 @@
 
   Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`
 
+- The NixOS integration test driver now supports `systemd-nspawn` containers as an alternative backend to QEMU virtual machines ([#470248](https://github.com/NixOS/nixpkgs/pull/470248), [#478109](https://github.com/NixOS/nixpkgs/pull/478109), [#479968](https://github.com/NixOS/nixpkgs/pull/479968)).
+  Most NixOS integration tests do not require a full VM, and switching them to containers can considerably reduce test time and resource usage.
+  Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
+  See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

From 2d128537b873801952987fa446686299c7c0e943 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 19:26:44 +0000
Subject: [PATCH 86/86] ocamlPackages.checkseum: 0.5.2 -> 0.5.3

---
 pkgs/development/ocaml-modules/checkseum/default.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index c1c86eac9df0..f3bb3358a11d 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -2,7 +2,6 @@
   lib,
   fetchurl,
   buildDunePackage,
-  ocaml,
   dune-configurator,
   optint,
   fmt,
@@ -14,14 +13,12 @@
 }:
 
 buildDunePackage (finalAttrs: {
-  version = "0.5.2";
+  version = "0.5.3";
   pname = "checkseum";
 
-  minimalOCamlVersion = "4.07";
-
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${finalAttrs.version}/checkseum-${finalAttrs.version}.tbz";
-    hash = "sha256-nl5P1EBctKi03wCHdUMlGDPgimSZ70LMuNulgt8Nr8g=";
+    hash = "sha256-uIwRmUNBITo1wj80Fou6enS/P4kFH3e+s52COtzhpTE=";
   };
 
   buildInputs = [ dune-configurator ];
@@ -38,7 +35,7 @@ buildDunePackage (finalAttrs: {
     rresult
   ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = {
     description = "ADLER-32 and CRC32C Cyclic Redundancy Check";