From 3d88fa9ca887536d274bb26d23aa250a32908d58 Mon Sep 17 00:00:00 2001
From: shivaraj-bh <me@shivaraj-bh.in>
Date: Wed, 1 Apr 2026 16:24:51 +0530
Subject: [PATCH 01/85] python3Packages.pgvector: use lib.meta.availableOn to
 only run tests when supported

---
 pkgs/development/python-modules/pgvector/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/pgvector/default.nix b/pkgs/development/python-modules/pgvector/default.nix
index 66351f445a6e..ea10cac552ce 100644
--- a/pkgs/development/python-modules/pgvector/default.nix
+++ b/pkgs/development/python-modules/pgvector/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -60,6 +61,8 @@ buildPythonPackage rec {
     sqlmodel
   ];
 
+  doCheck = lib.meta.availableOn stdenv.buildPlatform postgresqlTestHook;
+
   env = {
     PGDATABASE = "pgvector_python_test";
     postgresqlEnableTCP = 1;

From 84b776646baac3cdef24cebf7dcff65417b2e8c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christopher=20M=C3=BChl?= <toki@toph.so>
Date: Mon, 4 May 2026 08:15:19 +0000
Subject: [PATCH 02/85] maintainers: add tophcodes

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b771a590c9dd..7c4d41416184 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27931,6 +27931,12 @@
     githubId = 1486805;
     name = "Toon Nolten";
   };
+  tophcodes = {
+    email = "toki@toph.so";
+    github = "tophcodes";
+    githubId = 3678770;
+    name = "Christopher Mühl";
+  };
   tornax = {
     email = "tornax@pm.me";
     github = "TornaxO7";

From b33dd986040392a9399245b6bdbb96745891abc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christopher=20M=C3=BChl?= <toki@toph.so>
Date: Mon, 4 May 2026 08:15:38 +0000
Subject: [PATCH 03/85] nerdlog: init at 1.10.0

---
 pkgs/by-name/ne/nerdlog/package.nix | 60 +++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 pkgs/by-name/ne/nerdlog/package.nix

diff --git a/pkgs/by-name/ne/nerdlog/package.nix b/pkgs/by-name/ne/nerdlog/package.nix
new file mode 100644
index 000000000000..90c3af05adfd
--- /dev/null
+++ b/pkgs/by-name/ne/nerdlog/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "nerdlog";
+  version = "1.10.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "dimonomid";
+    repo = "nerdlog";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XlzWNeyd+Ar4ArFcN1wkQ0aod6ckAiIb12odK7cf4+s=";
+  };
+
+  vendorHash = "sha256-hvv0dsE1yz85VLaBOE7RWbux8L8kVTihcA1HyyHRYAM=";
+
+  buildInputs = [ libx11 ];
+
+  subPackages = [ "cmd/nerdlog" ];
+
+  ldflags = [
+    "-X github.com/dimonomid/nerdlog/version.version=${finalAttrs.version}"
+    "-X github.com/dimonomid/nerdlog/version.builtBy=nix"
+  ];
+
+  # e2e tests require SSH connections to test hosts
+  checkFlags = [
+    "-skip"
+    "^TestE2E"
+  ];
+
+  doInstallCheck = true;
+  nativeBuildInputs = [ versionCheckHook ];
+
+  # `nerdlog --version` will fail if $HOME is not defined
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/dimonomid/nerdlog/releases/tag/${finalAttrs.src.tag}";
+    description = "Fast, remote-first, multi-host TUI log viewer with timeline histogram";
+    longDescription = ''
+      Nerdlog is a fast, remote-first, multi-host TUI log viewer with timeline histogram
+      and no central server. Loosely inspired by Graylog/Kibana, but without the bloat.
+      Pretty much no setup needed, either.
+    '';
+    homepage = "https://github.com/dimonomid/nerdlog";
+    license = lib.licenses.bsd2;
+    mainProgram = "nerdlog";
+    maintainers = with lib.maintainers; [ tophcodes ];
+  };
+})

From 6d04d8643c699d5bd26fd3adfaca717b59dc58de Mon Sep 17 00:00:00 2001
From: Mr-Stoneman <mrstoneman@sten.rocks>
Date: Tue, 12 May 2026 22:49:56 +0200
Subject: [PATCH 04/85] maintainers: add Mr-Stoneman

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bd3a40644c0e..21efcef72bc1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18438,6 +18438,12 @@
     githubId = 2072185;
     name = "Marc Scholten";
   };
+  Mr-Stoneman = {
+    email = "mrstoneman@sten.rocks";
+    github = "Mr-Stoneman";
+    githubId = 72991726;
+    name = "Mr-Stoneman";
+  };
   mrbenjadmin = {
     email = "mrbenjadmin@gmail.com";
     github = "mrbenjadmin";

From 11a88ed4561e3f078c468dd54a8d082000fd0c46 Mon Sep 17 00:00:00 2001
From: Mr-Stoneman <mrstoneman@sten.rocks>
Date: Tue, 12 May 2026 22:48:13 +0200
Subject: [PATCH 05/85] zapp: init at 1.0.1

---
 pkgs/by-name/za/zapp/package.nix | 49 ++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 pkgs/by-name/za/zapp/package.nix

diff --git a/pkgs/by-name/za/zapp/package.nix b/pkgs/by-name/za/zapp/package.nix
new file mode 100644
index 000000000000..434e70381090
--- /dev/null
+++ b/pkgs/by-name/za/zapp/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  udev,
+  stdenv,
+  pkg-config,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zapp";
+  version = "1.0.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zsa";
+    repo = "zapp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KhWL+SsN1z9qpxwHpaqRo3qAk7xAOHVkRAOa02Q2Myc=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    udev
+  ];
+
+  cargoHash = "sha256-gDyNwHrMdNQdKdr9RGfwFAU8IaUlGrlJxV0WClQ25JM=";
+  passthru.updateScript = nix-update-script { };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Flash ZSA keyboards from your terminal";
+    homepage = "https://github.com/zsa/zapp";
+    license = with lib.licenses; [
+      mit
+      commons-clause
+    ];
+    maintainers = with lib.maintainers; [ Mr-Stoneman ];
+    mainProgram = "zapp";
+  };
+})

From 1c2e62b709f9ef7fd086b4a45ad827c845a0bc1f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 14:06:57 +0000
Subject: [PATCH 06/85] pg_activity: 3.6.1 -> 3.6.2

---
 pkgs/by-name/pg/pg_activity/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pg/pg_activity/package.nix b/pkgs/by-name/pg/pg_activity/package.nix
index ac69363fb152..5ae027cd2668 100644
--- a/pkgs/by-name/pg/pg_activity/package.nix
+++ b/pkgs/by-name/pg/pg_activity/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pg_activity";
-  version = "3.6.1";
+  version = "3.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dalibo";
     repo = "pg_activity";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-TzY+3RE06TxIrhl75wol9CvZDIz25GfgOx11vkREw2c=";
+    sha256 = "sha256-W5R521eyJjblCE5NG546ItMZo0CeBAhFLxMHUrbRGms=";
   };
 
   build-system = with python3Packages; [ setuptools ];

From 43e1e2de66bff3c76c8889716ba38adbde2ddeb0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 18:23:09 +0000
Subject: [PATCH 07/85] pgroll: 0.16.1 -> 0.16.2

---
 pkgs/by-name/pg/pgroll/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pg/pgroll/package.nix b/pkgs/by-name/pg/pgroll/package.nix
index 1166bef016b3..dd928e4e54e3 100644
--- a/pkgs/by-name/pg/pgroll/package.nix
+++ b/pkgs/by-name/pg/pgroll/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pgroll";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "xataio";
     repo = "pgroll";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5mo6USnCzYRNx8i0pjxjfas/iZWFnRh3hY6hf17JAT4=";
+    hash = "sha256-pvc+hKWUY8OPKMU4QNwuTlw8ewhiDrFcS1q/hcOzqSk=";
   };
 
   proxyVendor = true;

From 7af5f08b37fad98116c2b7f9b0f861db942fc66d Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Sat, 23 May 2026 23:41:00 +0200
Subject: [PATCH 08/85] lsplug: init at 7

Replacement for lsusb that shows more useful info and less useless info.

https://youtu.be/nAYND-fDETc
https://git.sr.ht/~martijnbraam/lsplug
---
 pkgs/by-name/ls/lsplug/package.nix | 39 ++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/ls/lsplug/package.nix

diff --git a/pkgs/by-name/ls/lsplug/package.nix b/pkgs/by-name/ls/lsplug/package.nix
new file mode 100644
index 000000000000..23ac2a7f9adc
--- /dev/null
+++ b/pkgs/by-name/ls/lsplug/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  python3Packages,
+  fetchFromSourcehut,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "lsplug";
+  version = "7";
+  pyproject = true;
+
+  src = fetchFromSourcehut {
+    owner = "~martijnbraam";
+    repo = "lsplug";
+    tag = finalAttrs.version;
+    hash = "sha256-eY9XNEdJfQREKroxsuPlv3CKqNX/XiMEnN8TdGYGa+g=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "lsplug"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Replacement for lsusb that shows more useful info and less useless info";
+    homepage = "https://git.sr.ht/~martijnbraam/lsplug";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      Luflosi
+    ];
+    mainProgram = "lsplug";
+  };
+})

From 9cd8c94787e96811757dd5b8ab67b966ad5d72e4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 24 May 2026 23:43:39 +0000
Subject: [PATCH 09/85] pgcenter: 0.9.2 -> 0.10.1

---
 pkgs/by-name/pg/pgcenter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pg/pgcenter/package.nix b/pkgs/by-name/pg/pgcenter/package.nix
index 16d718c020c1..0b39185b3276 100644
--- a/pkgs/by-name/pg/pgcenter/package.nix
+++ b/pkgs/by-name/pg/pgcenter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pgcenter";
-  version = "0.9.2";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "lesovsky";
     repo = "pgcenter";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-xaY01T12/5Peww9scRgfc5yHj7QA8BEwOK5l6OedziY=";
+    sha256 = "sha256-HSSHRMkzb0WkRAPEtG654ngnJw9rjkBq/v2Su4bUO8Y=";
   };
 
-  vendorHash = "sha256-9hYiyZ34atmSL7JvuXyiGU7HR4E6qN7bGZlyU+hP+FU=";
+  vendorHash = "sha256-nHPS/iLHQwM39UYpajQRAbZcK7PxTPU0mO2HapDRFDU=";
 
   subPackages = [ "cmd" ];
 

From 1a74b659f5ef04e0832ff1255d5c10f2c0bf77c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 May 2026 23:57:48 +0000
Subject: [PATCH 10/85] libpg_query: 17-6.1.0 -> 18.0.0

---
 pkgs/by-name/li/libpg_query/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libpg_query/package.nix b/pkgs/by-name/li/libpg_query/package.nix
index 3f78829abccd..7e801d8839b7 100644
--- a/pkgs/by-name/li/libpg_query/package.nix
+++ b/pkgs/by-name/li/libpg_query/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpg_query";
-  version = "17-6.1.0";
+  version = "18.0.0";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     tag = finalAttrs.version;
-    hash = "sha256-UXba2WYyIO7RcFcNZeLL+Q9CwlloMZ5oFfHfL7+j4dU=";
+    hash = "sha256-Fs9SFs8ramKYdkv1gEOMJd9SnLmKDcbf+zYKv1hHBfc=";
   };
 
   nativeBuildInputs = [ which ];

From 7d6b363b76905b6aea72e4313e82fe51c893470d Mon Sep 17 00:00:00 2001
From: ezratweaver <ezratweaver@gmail.com>
Date: Fri, 22 May 2026 02:04:42 -0400
Subject: [PATCH 11/85] adw-bluetooth: 1.0.0 -> 1.1.0

---
 .../services/desktops/adw-bluetooth.nix       | 33 +++++++++++++++++++
 pkgs/by-name/ad/adw-bluetooth/package.nix     | 28 +++++++++++++---
 2 files changed, 56 insertions(+), 5 deletions(-)
 create mode 100644 nixos/modules/services/desktops/adw-bluetooth.nix

diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
new file mode 100644
index 000000000000..ab15b1cdfef4
--- /dev/null
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.adw-bluetooth;
+in
+{
+  meta.maintainers = with lib.maintainers; [ ezratweaver ];
+
+  options.services.adw-bluetooth = {
+    enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.adw-bluetooth ];
+    services.dbus.packages = [ pkgs.adw-bluetooth ];
+
+    systemd.user.services.adw-bluetooth-daemon = {
+      description = "AdwBluetooth Daemon";
+      wantedBy = [ "default.target" ];
+      after = [ "bluetooth.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.ezratweaver.AdwBluetoothDaemon";
+        ExecStart = "${pkgs.adw-bluetooth}/libexec/adw-bluetooth-daemon";
+      };
+    };
+  };
+}
diff --git a/pkgs/by-name/ad/adw-bluetooth/package.nix b/pkgs/by-name/ad/adw-bluetooth/package.nix
index fde7d2367c9a..f0b700ee9c9b 100644
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  buildGoModule,
   meson,
   ninja,
   pkg-config,
@@ -13,17 +14,27 @@
   libadwaita,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "adw-bluetooth";
-  version = "1.0.0";
+let
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
-    tag = finalAttrs.version;
-    hash = "sha256-/KJpB9i6tFDnB3C0tPtJtt8tTDfNftIkHmP1JSVSZNY=";
+    tag = version;
+    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
   };
 
+  daemon = buildGoModule {
+    pname = "adw-bluetooth-daemon";
+    inherit version;
+    src = src + "/daemon";
+    vendorHash = "sha256-7tiSwNhq6e4LEh4lUkfh2i4tEdWWL6TxQpYYwYKsfog=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adw-bluetooth";
+  inherit version src;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -39,6 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
   ];
 
+  mesonFlags = [ "-Dbuild_daemon=false" ];
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s ${daemon}/bin/daemon $out/libexec/adw-bluetooth-daemon
+  '';
+
   meta = {
     description = "GNOME Inspired LibAdwaita Bluetooth Applet";
     homepage = "https://github.com/ezratweaver/adw-bluetooth";

From a875214e7d216c7b8cad254361e76117ae7719e5 Mon Sep 17 00:00:00 2001
From: ezratweaver <ezratweaver@gmail.com>
Date: Fri, 22 May 2026 02:05:04 -0400
Subject: [PATCH 12/85] nixos/adw-bluetooth: init module

---
 nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++
 nixos/modules/module-list.nix                     | 1 +
 nixos/modules/services/desktops/adw-bluetooth.nix | 7 ++++---
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 70c6cdd2d0d6..15a57d19f25c 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -77,6 +77,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as [services.immichframe](#opt-services.immichframe.enable).
 
+- [adw-bluetooth](https://github.com/ezratweaver/adw-bluetooth), a GNOME-inspired LibAdwaita Bluetooth applet. Available as [services.adw-bluetooth](#opt-services.adw-bluetooth.enable).
+
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
 - [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index eb21ab718578..afb05adcfb55 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -557,6 +557,7 @@
   ./services/databases/victoriametrics.nix
   ./services/databases/victoriatraces.nix
   ./services/desktops/accountsservice.nix
+  ./services/desktops/adw-bluetooth.nix
   ./services/desktops/ayatana-indicators.nix
   ./services/desktops/bamf.nix
   ./services/desktops/blueman.nix
diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
index ab15b1cdfef4..43c6cfe4e436 100644
--- a/nixos/modules/services/desktops/adw-bluetooth.nix
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -13,11 +13,12 @@ in
 
   options.services.adw-bluetooth = {
     enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+    package = lib.mkPackageOption pkgs "adw-bluetooth" { };
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.adw-bluetooth ];
-    services.dbus.packages = [ pkgs.adw-bluetooth ];
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
 
     systemd.user.services.adw-bluetooth-daemon = {
       description = "AdwBluetooth Daemon";
@@ -26,7 +27,7 @@ in
       serviceConfig = {
         Type = "dbus";
         BusName = "com.ezratweaver.AdwBluetoothDaemon";
-        ExecStart = "${pkgs.adw-bluetooth}/libexec/adw-bluetooth-daemon";
+        ExecStart = "${cfg.package}/libexec/adw-bluetooth-daemon";
       };
     };
   };

From 9b14bd07ee93cc1f1bece1a52d7da5d21e5ce2e5 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Fri, 29 May 2026 23:42:53 +0200
Subject: [PATCH 13/85] glycin-loaders: allow configuring loaders to build via
 override

---
 pkgs/by-name/gl/glycin-loaders/package.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index f9b97462d915..329c0d47ec01 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -20,8 +20,20 @@
   shared-mime-info,
   rustc,
   rustPlatform,
+
+  # List of loaders to build.
+  # https://gitlab.gnome.org/GNOME/glycin/-/blob/2.1.1/meson_options.txt?ref_type=tags#L26-43
+  enabledLoaders ? [
+    "heif"
+    "image-rs"
+    "jxl"
+    "svg"
+  ],
 }:
 
+# Doesn't produce any output if no loaders are enabled
+assert enabledLoaders != [ ];
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
 
@@ -65,6 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dlibglycin-gtk4=false"
     "-Dvapi=false"
     (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonOption "loaders" (
+      lib.concatMapStringsSep "," (loader: "glycin-${loader}") enabledLoaders
+    ))
   ];
 
   strictDeps = true;
@@ -91,6 +106,8 @@ stdenv.mkDerivation (finalAttrs: {
   env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
 
   passthru = {
+    inherit enabledLoaders;
+
     tests = {
       withTests = finalAttrs.finalPackage.overrideAttrs {
         doCheck = true;

From f527f6d8a87c64a49dfda35068a530c4996a5c6a Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 31 May 2026 23:58:10 +0200
Subject: [PATCH 14/85] glycin-loaders: consistently use `lib.mesonBool`

---
 pkgs/by-name/gl/glycin-loaders/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 329c0d47ec01..8d1998e1c3b4 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -71,11 +71,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dglycin-loaders=true"
-    "-Dglycin-thumbnailer=false"
-    "-Dlibglycin=false"
-    "-Dlibglycin-gtk4=false"
-    "-Dvapi=false"
+    (lib.mesonBool "glycin-loaders" true)
+    (lib.mesonBool "glycin-thumbnailer" false)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+    (lib.mesonBool "vapi" false)
     (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
     (lib.mesonOption "loaders" (
       lib.concatMapStringsSep "," (loader: "glycin-${loader}") enabledLoaders

From d4ccc96bfe453bac2bfc6ff0e40a4cee2e8fb70b Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 25 Mar 2026 13:30:21 +0100
Subject: [PATCH 15/85] glycin-thumbnailer: init at 2.1.1

---
 .../by-name/gl/glycin-thumbnailer/package.nix | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 pkgs/by-name/gl/glycin-thumbnailer/package.nix

diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
new file mode 100644
index 000000000000..8ae50e84b7d5
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  cargo,
+  fontconfig,
+  glib,
+  glycin-loaders,
+  libglycin,
+  libseccomp,
+  meson,
+  ninja,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  wrapGAppsNoGuiHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer";
+
+  inherit (libglycin) version src cargoDeps;
+
+  nativeBuildInputs = [
+    cargo
+    libglycin.patchVendorHook
+    meson
+    ninja
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsNoGuiHook
+  ];
+
+  buildInputs = [
+    fontconfig
+    glib
+    glycin-loaders
+    libglycin
+    libglycin.setupHook
+    libseccomp
+  ];
+
+  mesonFlags = [
+    (lib.mesonBool "glycin-loaders" false)
+    (lib.mesonBool "glycin-thumbnailer" true)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # Thumbnailer files are in `glycin-loaders`, but we provide them in this package
+  postInstall = ''
+    mkdir -p $out/share/thumbnailers
+    (
+      shopt -s failglob
+
+      for loader in ${lib.concatStringsSep " " glycin-loaders.passthru.enabledLoaders}; do
+        substitute \
+          "../glycin-loaders/glycin-$loader/glycin-$loader.thumbnailer.in" \
+          "$out/share/thumbnailers/glycin-$loader.thumbnailer" \
+          --subst-var-by "BINDIR" "$out/bin"
+      done
+    )
+  '';
+
+  meta = {
+    description = "Glycin thumbnailers for several formats";
+    homepage = "https://gitlab.gnome.org/GNOME/glycin";
+    changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
+    license = with lib.licenses; [
+      mpl20 # or
+      lgpl21Plus
+    ];
+    maintainers = with lib.maintainers; [ thunze ];
+    teams = [ lib.teams.gnome ];
+    platforms = lib.platforms.linux;
+    mainProgram = "glycin-thumbnailer";
+  };
+})

From 53716654ff45801d54f2a0dda702022e6e993ed5 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 25 Mar 2026 13:40:29 +0100
Subject: [PATCH 16/85] glycin-loaders: don't install thumbnailer files

These are now provided by glycin-thumbnailer.
---
 pkgs/by-name/gl/glycin-loaders/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 8d1998e1c3b4..5d3c419ee496 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -103,6 +103,11 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_CACHE_HOME=$(mktemp -d)
   '';
 
+  # Thumbnailer files are provided by glycin-thumbnailer
+  postInstall = ''
+    rm -r $out/share/thumbnailers
+  '';
+
   env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
 
   passthru = {

From 3298717b08706d9b95577d846bde6c1f414405c1 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 25 Mar 2026 13:41:01 +0100
Subject: [PATCH 17/85] libglycin: add glycin-thumbnailer to `passthru.tests`

---
 pkgs/by-name/li/libglycin/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index b2eeab914a7f..4dc30b8f88a0 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -15,6 +15,7 @@
   glib,
   gobject-introspection,
   glycin-loaders,
+  glycin-thumbnailer,
   libglycin-gtk4,
   fontconfig,
   libseccomp,
@@ -146,6 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit
         glycin-loaders
+        glycin-thumbnailer
         libglycin-gtk4
         ;
     };

From aac10d3941fba7db4901830285dcd51ad165f964 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 25 Mar 2026 13:41:32 +0100
Subject: [PATCH 18/85] glycin-thumbnailer: add thumbnailer package test

---
 .../by-name/gl/glycin-thumbnailer/package.nix |  3 ++
 pkgs/by-name/gl/glycin-thumbnailer/tests.nix  | 44 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/by-name/gl/glycin-thumbnailer/tests.nix

diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
index 8ae50e84b7d5..71587b42237e 100644
--- a/pkgs/by-name/gl/glycin-thumbnailer/package.nix
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  callPackage,
   cargo,
   fontconfig,
   glib,
@@ -65,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
+  passthru.tests.thumbnailer = callPackage ./tests.nix { };
+
   meta = {
     description = "Glycin thumbnailers for several formats";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/tests.nix b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
new file mode 100644
index 000000000000..da7f2a845de1
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  glycin-thumbnailer,
+  shared-mime-info,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer-test";
+  inherit (glycin-thumbnailer) version;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "sophie-h";
+    repo = "test-images";
+    rev = "f7a06d9131a5686c1b58c56f42f9fda9ea5e620d";
+    hash = "sha256-qoteYmliUha3lY21PRM0FaeYu9aD5MsygBTsTYog9SE=";
+  };
+
+  # Fix incorrectly detected MIME types
+  preBuild = ''
+    export XDG_DATA_DIRS=${shared-mime-info}/share:$XDG_DATA_DIRS
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd images/
+    mkdir -p $out
+
+    for image in color/* icon/*; do
+      for size in 128 256 512 1024; do
+        input="file://$(realpath "$image")"
+        output="$out/$(basename "$image")-$size.png"
+
+        ${lib.getExe glycin-thumbnailer} -i "$input" -o "$output" -s $size
+        file -E "$output"
+      done
+    done
+
+    runHook postBuild
+  '';
+})

From c7cd5a89bbae17e0149e09b1a09ebddcaffee3eb Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 30 May 2026 00:02:13 +0200
Subject: [PATCH 19/85] glycin-thumbnailer: add package test for building with
 all loaders

---
 pkgs/by-name/gl/glycin-thumbnailer/package.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
index 71587b42237e..0782d55ddd1b 100644
--- a/pkgs/by-name/gl/glycin-thumbnailer/package.nix
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -6,6 +6,7 @@
   fontconfig,
   glib,
   glycin-loaders,
+  glycin-thumbnailer,
   libglycin,
   libseccomp,
   meson,
@@ -66,7 +67,20 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
-  passthru.tests.thumbnailer = callPackage ./tests.nix { };
+  passthru.tests = {
+    all-loaders = glycin-thumbnailer.override {
+      glycin-loaders = glycin-loaders.override {
+        enabledLoaders = [
+          "heif"
+          "image-rs"
+          "jxl"
+          "raw"
+          "svg"
+        ];
+      };
+    };
+    thumbnailer = callPackage ./tests.nix { };
+  };
 
   meta = {
     description = "Glycin thumbnailers for several formats";

From 25b2bbcaef963eadb35e29867f0f847c266d022f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 22:39:19 +0000
Subject: [PATCH 20/85] barman: 3.19.0 -> 3.19.1

---
 pkgs/by-name/ba/barman/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ba/barman/package.nix b/pkgs/by-name/ba/barman/package.nix
index 0390432c052e..df7e38409bd7 100644
--- a/pkgs/by-name/ba/barman/package.nix
+++ b/pkgs/by-name/ba/barman/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "barman";
-  version = "3.19.0";
+  version = "3.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnterpriseDB";
     repo = "barman";
     tag = "release/${finalAttrs.version}";
-    hash = "sha256-qjde8NdI+/2BH4L3LoxoYqdVwsaBXw1IcxYBx6sYqG8=";
+    hash = "sha256-7K7ibg2/hr5wBzGR8cW5FZNtPPFEBA7xPwmOl2c1fOU=";
   };
 
   patches = [

From 68241438a0197b948d14bbdfc6e8400e34841377 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Mon, 1 Jun 2026 01:08:11 +0200
Subject: [PATCH 21/85] {libglycin{,-gtk4},glycin-{loaders,thumbnailer}}: use
 compound license

---
 pkgs/by-name/gl/glycin-loaders/package.nix     | 10 ++++++----
 pkgs/by-name/gl/glycin-thumbnailer/package.nix | 10 ++++++----
 pkgs/by-name/li/libglycin-gtk4/package.nix     | 10 ++++++----
 pkgs/by-name/li/libglycin/package.nix          | 10 ++++++----
 4 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 5d3c419ee496..bb6e645bb5f1 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -124,10 +124,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Glycin loaders for several formats";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     teams = [ lib.teams.gnome ];
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
index 0782d55ddd1b..f90b4dd1e43e 100644
--- a/pkgs/by-name/gl/glycin-thumbnailer/package.nix
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -86,10 +86,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Glycin thumbnailers for several formats";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     maintainers = with lib.maintainers; [ thunze ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/li/libglycin-gtk4/package.nix b/pkgs/by-name/li/libglycin-gtk4/package.nix
index a7c2b7901ec1..3f9956a3f58a 100644
--- a/pkgs/by-name/li/libglycin-gtk4/package.nix
+++ b/pkgs/by-name/li/libglycin-gtk4/package.nix
@@ -89,10 +89,12 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "C-Bindings to convert glycin frames to GDK Textures";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
     pkgConfigModules = [
diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index 4dc30b8f88a0..52bcf6c6716a 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -157,10 +157,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Sandboxed and extendable image loading library";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     maintainers = [ ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;

From b41d1dbc178d8daf93cdd6aad31f467ef3725754 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 6 Jun 2026 12:38:30 +0000
Subject: [PATCH 22/85] pgpool: 4.7.1 -> 4.7.2

---
 pkgs/by-name/pg/pgpool/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pg/pgpool/package.nix b/pkgs/by-name/pg/pgpool/package.nix
index a6b4b6ea5d11..3f1a7d064bcf 100644
--- a/pkgs/by-name/pg/pgpool/package.nix
+++ b/pkgs/by-name/pg/pgpool/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgpool";
-  version = "4.7.1";
+  version = "4.7.2";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pgpool";
     repo = "pgpool2";
     tag = "V${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-npH4rhRToPVfKk7XyGGzdRSZMQ+APM8MBKHmd0rzlDw=";
+    hash = "sha256-gURWz9NeiHLL5DbUP7WnByHzCrLaI/8HWTRU9xO22EY=";
   };
 
   patches = [

From 92b1f62d02c78638438d9906c57127baf055854d Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Sat, 30 May 2026 07:41:34 -0700
Subject: [PATCH 23/85] xsecurelock: make authproto_{pamtester,htacceess}
 optional

From the README:

>   `authproto_pamtester`: Authenticates via PAM using pamtester. Shouldn't
be required unless you can't compile `authproto_pam`. Only supports simple
password based conversations.

And:

>  `authproto_htpasswd`: Authenticates via a htpasswd style file stored in
`~/.xsecurelock.pw`. To generate this file, run: `( umask 077; htpasswd -cB
~/.xsecurelock.pw "$USER" )` Use this only if you for some reason can't use
PAM!

Given that this package is built against PAM, there's no good reason to
include these two modules by default.
---
 doc/release-notes/rl-2611.section.md    |  3 +++
 pkgs/by-name/xs/xsecurelock/package.nix | 20 ++++++++++----------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 5e674df1f8da..804409e9503d 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -13,6 +13,9 @@
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
+
+- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
+
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
diff --git a/pkgs/by-name/xs/xsecurelock/package.nix b/pkgs/by-name/xs/xsecurelock/package.nix
index beb5a7f835c8..f326e305b42b 100644
--- a/pkgs/by-name/xs/xsecurelock/package.nix
+++ b/pkgs/by-name/xs/xsecurelock/package.nix
@@ -12,16 +12,18 @@
   libxext,
   libxscrnsaver,
   pam,
-  apacheHttpd,
-  pamtester,
   coreutils,
   makeWrapper,
 
   # boolean flags
   withXscreensaver ? true,
-  xscreensaver ? null,
+  xscreensaver,
   withDocs ? false,
-  pandoc ? null,
+  pandoc,
+  withHtaccess ? false,
+  apacheHttpd,
+  withPamtester ? false,
+  pamtester,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,9 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     makeWrapper
   ]
-  ++ lib.optionals withDocs [
-    pandoc
-  ];
+  ++ lib.optional withDocs pandoc;
 
   buildInputs = [
     libx11
@@ -53,9 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
     libxext
     libxscrnsaver
     pam
-    apacheHttpd
-    pamtester
-  ];
+  ]
+  ++ lib.optional withHtaccess apacheHttpd
+  ++ lib.optional withPamtester pamtester;
 
   configureFlags = [
     "--with-pam-service-name=login"

From dd362928d5035ead19f27802676ea6848090dec4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 14:43:04 +0000
Subject: [PATCH 24/85] althttpd: 0-unstable-2026-03-20 ->
 0-unstable-2026-06-03

---
 pkgs/by-name/al/althttpd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/althttpd/package.nix b/pkgs/by-name/al/althttpd/package.nix
index d9302fb2669a..001d2cdea7e2 100644
--- a/pkgs/by-name/al/althttpd/package.nix
+++ b/pkgs/by-name/al/althttpd/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation {
   pname = "althttpd";
-  version = "0-unstable-2026-03-20";
+  version = "0-unstable-2026-06-03";
 
   src = fetchfossil {
     url = "https://sqlite.org/althttpd/";
-    rev = "a8fac0faaab1f43f";
-    hash = "sha256-Z4kZgCvqY7Kroc6A98s5UH4N8CEUzF+xmdXDRw2Lxtw=";
+    rev = "641e31f18cff7215";
+    hash = "sha256-AMOb1GHI99Plxdry89ynoLNpvFVpUzkdwffKLhJBKYw=";
   };
 
   buildInputs = [ openssl ];

From b3b5f2033ba2503742e2db7573d7421319468e61 Mon Sep 17 00:00:00 2001
From: Andreas Fuchs <asf@boinkor.net>
Date: Thu, 11 Jun 2026 12:49:57 -0400
Subject: [PATCH 25/85] gonic: Set PrivateTmp=true for new go-sqlite3 behavior

When running migrations, the go-sqlite3 library used in v0.22.0 will now open files with names like /tmp/1418313342.db; without a tmp directory, that fails and causes errors on startup of the gonic service.

Giving the unit a private /tmp directory fixes this issue.
---
 nixos/modules/services/audio/gonic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index da259d6957d9..d1b150b6501f 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -93,6 +93,7 @@ in
         ];
         RestrictNamespaces = true;
         PrivateDevices = true;
+        PrivateTmp = true;
         PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = true;

From 8b1a0159c2edca496a908edd8e8d3dca5dc58141 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Fri, 12 Jun 2026 18:27:42 -0400
Subject: [PATCH 26/85] vlc: add libaacs to build and rpath

---
 pkgs/by-name/vl/vlc/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 0f1a3937cabe..c49a83ff4704 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -26,6 +26,7 @@
   libxinerama,
   libxpm,
   libarchive,
+  libaacs,
   libass,
   libbluray-full,
   libcaca,
@@ -152,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libsm
     libarchive
+    libaacs
     libass
     libbluray-full
     libcaca
@@ -299,6 +301,7 @@ stdenv.mkDerivation (finalAttrs: {
   # depends on a qt5.qttranslations that doesn't build, even though it
   # should be the same as pkgsBuildBuild.qt5.qttranslations.
   postFixup = ''
+    patchelf --add-rpath ${libaacs}/lib "$out/lib/vlc/plugins/access/liblibbluray_plugin.so"
     patchelf --add-rpath ${libv4l}/lib "$out/lib/vlc/plugins/access/libv4l2_plugin.so"
     find $out/lib/vlc/plugins -exec touch -d @1 '{}' ';'
     ${

From 98cbdb32153f860fc2a9fc7f1c12734e19bcfe25 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Fri, 12 Jun 2026 18:30:32 -0400
Subject: [PATCH 27/85] vlc: remove unused variables and update --replace

---
 pkgs/by-name/vl/vlc/package.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index c49a83ff4704..070f6c31eaac 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -5,7 +5,6 @@
   avahi,
   bison,
   cairo,
-  curl,
   dbus,
   faad2,
   fetchFromGitLab,
@@ -83,10 +82,8 @@
   wayland-protocols,
   wayland-scanner,
   wrapGAppsHook3,
-  writeShellScript,
   libxcb-keysyms,
   zlib,
-
   chromecastSupport ? true,
   jackSupport ? false,
   onlyLibVLC ? false,
@@ -248,7 +245,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     echo "$version" > src/revision.txt
     substituteInPlace modules/text_renderer/freetype/platform_fonts.h \
-      --replace \
+      --replace-fail \
         /usr/share/fonts/truetype/freefont \
         ${freefont_ttf}/share/fonts/truetype
   ''
@@ -257,7 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
   # https://www.lua.org/wshop13/Jericke.pdf#page=39
   + lib.optionalString (!stdenv.hostPlatform.canExecute stdenv.buildPlatform) ''
     substituteInPlace share/Makefile.am \
-      --replace $'.luac \\\n' $'.lua \\\n'
+      --replace-fail $'.luac \\\n' $'.lua \\\n'
   '';
 
   enableParallelBuilding = true;

From a24a4dcc9789fc41f626bdd6868bda2a22cda123 Mon Sep 17 00:00:00 2001
From: wrench-exile-legacy <user@wrench-exile-legacy.site>
Date: Sun, 14 Jun 2026 15:42:33 +0100
Subject: [PATCH 28/85] mailspring: build from source, 1.21.1 -> 1.22.0

---
 pkgs/by-name/ma/mailspring/darwin.nix    |  34 ------
 pkgs/by-name/ma/mailspring/libetpan.nix  |  49 ++++++++
 pkgs/by-name/ma/mailspring/linux.nix     | 101 ----------------
 pkgs/by-name/ma/mailspring/mailcore2.nix | 106 +++++++++++++++++
 pkgs/by-name/ma/mailspring/mailsync.nix  | 138 +++++++++++++++++++++
 pkgs/by-name/ma/mailspring/package.nix   | 145 +++++++++++++++++++++--
 6 files changed, 428 insertions(+), 145 deletions(-)
 delete mode 100644 pkgs/by-name/ma/mailspring/darwin.nix
 create mode 100644 pkgs/by-name/ma/mailspring/libetpan.nix
 delete mode 100644 pkgs/by-name/ma/mailspring/linux.nix
 create mode 100644 pkgs/by-name/ma/mailspring/mailcore2.nix
 create mode 100644 pkgs/by-name/ma/mailspring/mailsync.nix

diff --git a/pkgs/by-name/ma/mailspring/darwin.nix b/pkgs/by-name/ma/mailspring/darwin.nix
deleted file mode 100644
index 77750ef76453..000000000000
--- a/pkgs/by-name/ma/mailspring/darwin.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  stdenv,
-  fetchurl,
-  pname,
-  version,
-  meta,
-  unzip,
-  makeWrapper,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/Mailspring-AppleSilicon.zip";
-    hash = "sha256-U8yh7Qsxu1AmqMVV2p9MmvNHH922yBEqWA8OsQleoCQ=";
-  };
-  dontUnpack = true;
-
-  nativeBuildInputs = [
-    unzip
-    makeWrapper
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications $out/bin
-    unzip $src -d $out/Applications
-    makeWrapper $out/Applications/Mailspring.app/Contents/MacOS/Mailspring $out/bin/mailspring
-
-    runHook postInstall
-  '';
-})
diff --git a/pkgs/by-name/ma/mailspring/libetpan.nix b/pkgs/by-name/ma/mailspring/libetpan.nix
new file mode 100644
index 000000000000..93341ca2145b
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/libetpan.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+
+  src,
+  version,
+
+  autoreconfHook,
+  pkg-config,
+
+  cyrus_sasl,
+  openssl,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mailspring-libetpan";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync/Vendor/libetpan";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    cyrus_sasl
+    openssl
+    zlib
+  ];
+
+  configureFlags = [
+    "--with-sasl=${cyrus_sasl.dev}"
+    "--with-openssl=${openssl.dev}"
+  ];
+
+  # Prevent GCC 14 from treating pointer type mismatches as fatal build errors
+  env.CFLAGS = toString [
+    "-std=gnu17"
+    "-Wno-error=incompatible-pointer-types"
+  ];
+
+  meta = {
+    description = "Modified fork of the libetpan mail framework";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/linux.nix b/pkgs/by-name/ma/mailspring/linux.nix
deleted file mode 100644
index 54e04eb2e601..000000000000
--- a/pkgs/by-name/ma/mailspring/linux.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  stdenv,
-  lib,
-  pname,
-  version,
-  meta,
-  fetchurl,
-  autoPatchelfHook,
-  alsa-lib,
-  coreutils,
-  curl,
-  db,
-  dpkg,
-  glib,
-  gtk3,
-  wrapGAppsHook3,
-  libkrb5,
-  libsecret,
-  nss,
-  openssl,
-  udev,
-  libxtst,
-  libxscrnsaver,
-  libxdamage,
-  libxshmfence,
-  libxkbfile,
-  libgbm,
-  libdrm,
-  libappindicator,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/mailspring-${finalAttrs.version}-amd64.deb";
-    hash = "sha256-pyEWypqujSYYmbpUgcUMJoew4nIjE/dQWTVdYTxhmN4=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    alsa-lib
-    db
-    glib
-    gtk3
-    libkrb5
-    libsecret
-    nss
-    libxkbfile
-    libxdamage
-    libxscrnsaver
-    libxtst
-    libxshmfence
-    libgbm
-    libdrm
-    openssl
-    curl
-  ];
-
-  runtimeDependencies = [
-    coreutils
-    openssl
-    (lib.getLib udev)
-    libappindicator
-    libsecret
-  ];
-
-  unpackPhase = ''
-    runHook preUnpack
-
-    dpkg -x $src .
-
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib}
-    cp -ar ./usr/share $out
-
-    substituteInPlace $out/share/mailspring/resources/app.asar.unpacked/mailsync \
-      --replace-fail dirname ${coreutils}/bin/dirname
-
-    ln -s $out/share/mailspring/mailspring $out/bin/mailspring
-    ln -s ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
-
-    runHook postInstall
-  '';
-
-  postFixup = # sh
-    ''
-      substituteInPlace $out/share/applications/Mailspring.desktop \
-        --replace-fail Exec=mailspring Exec=$out/bin/mailspring
-    '';
-})
diff --git a/pkgs/by-name/ma/mailspring/mailcore2.nix b/pkgs/by-name/ma/mailspring/mailcore2.nix
new file mode 100644
index 000000000000..aa5c4e4f5ba9
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/mailcore2.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+
+  src,
+  version,
+
+  cmake,
+  pkg-config,
+
+  glib,
+  icu,
+  mailspring-libetpan,
+  pcre2,
+  openssl,
+  cyrus_sasl,
+  html-tidy,
+  libuuid,
+  libctemplate,
+  libsysprof-capture,
+  libxml2,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mailspring-mailcore2";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync/Vendor/mailcore2";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    cyrus_sasl
+    glib
+    html-tidy
+    icu
+    libctemplate
+    libsysprof-capture
+    libuuid
+    libxml2
+    mailspring-libetpan
+    openssl
+    pcre2
+    zlib
+  ];
+
+  # Prevent GCC 14 pointer errors
+  env = {
+    CXXFLAGS = toString [
+      "-std=gnu++17"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+
+    CFLAGS = toString [
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
+
+  # Only build the core library, mimicking ./build.sh
+  buildFlags = [ "MailCore" ];
+
+  postPatch = ''
+    # Fix hardcoded impure paths
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "/usr/include/libxml2" "${lib.getDev libxml2}/include/libxml2" \
+      --replace-fail "/usr/include/tidy" "${lib.getDev html-tidy}/include/tidy"
+
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Tell CMake to build with Objective C if the file is C, otherwise Objective C++ if the file is C++.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "project (mailcore2)" "project (mailcore2 C CXX OBJC OBJCXX)
+    add_compile_options(\"$<$<COMPILE_LANGUAGE:C>:-xobjective-c>\" \"$<$<COMPILE_LANGUAGE:CXX>:-xobjective-c++>\")"
+
+    # Fix old tidy header reference
+    substituteInPlace src/core/basetypes/MCHTMLCleaner.cpp \
+      --replace-fail "buffio.h" "tidybuffio.h"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib $out/include
+
+    cp src/libMailCore.* $out/lib/
+
+    cp -r src/include/MailCore $out/include/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Modified fork of the mailcore2 asynchronous C++ framework";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/mailsync.nix b/pkgs/by-name/ma/mailspring/mailsync.nix
new file mode 100644
index 000000000000..cd112e3b4740
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/mailsync.nix
@@ -0,0 +1,138 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+
+  src,
+  version,
+
+  autoPatchelfHook,
+  cmake,
+  pkg-config,
+
+  c-ares,
+  curl,
+  cyrus_sasl,
+  glib,
+  html-tidy,
+  icu,
+  libctemplate,
+  libiconv,
+  libsysprof-capture,
+  libuuid,
+  libxml2,
+  pcre2,
+  sqlite,
+  xz,
+  zlib,
+}:
+let
+  # libetpan and mailcore2 have both been modified from their upstream sources, so we must provide the vendored derivations
+  # See: https://github.com/Foundry376/Mailspring/blob/master/mailsync/Vendor/README.md
+  mailspring-libetpan = callPackage ./libetpan.nix { inherit src version; };
+  mailspring-mailcore2 = callPackage ./mailcore2.nix { inherit src version mailspring-libetpan; };
+in
+stdenv.mkDerivation {
+  pname = "mailspring-sync";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    c-ares
+    curl
+    cyrus_sasl
+    glib
+    html-tidy
+    icu
+    libctemplate
+    libsysprof-capture
+    libuuid
+    libxml2
+    mailspring-libetpan
+    mailspring-mailcore2
+    pcre2
+    sqlite
+    xz
+    zlib
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
+
+  runtimeDependencies = [
+    html-tidy
+  ];
+
+  env =
+    let
+      FLAGS = toString [
+        "-Wno-error=deprecated-declarations"
+        "-Wno-error=incompatible-pointer-types"
+      ];
+    in
+    {
+      CFLAGS = FLAGS;
+      CXXFLAGS = FLAGS;
+    };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'IF(''${CMAKE_SYSTEM_NAME} MATCHES "Linux")' 'if(TRUE)'
+
+    # Replace hardcoded host paths and vendored dependencies
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "/usr/include/libxml2" "${lib.getDev libxml2}/include/libxml2" \
+      --replace-fail "find_library(RESOLV_LIB NAMES libresolv.a libresolv)" "set(RESOLV_LIB \"resolv\")" \
+      --replace-fail "target_link_libraries(mailsync libetpan.a)" "target_link_libraries(mailsync ${mailspring-libetpan}/lib/libetpan${stdenv.hostPlatform.extensions.sharedLibrary})" \
+      --replace-fail "target_link_libraries(mailsync libMailCore.a)" "target_link_libraries(mailsync ${mailspring-mailcore2}/lib/libMailCore.a)"
+
+    # Replace hardcoded references to archives with library references
+    # Transforms 'NAMES libfoo.a libfoo' into 'NAMES foo'
+    sed -i -E 's/NAMES lib([a-zA-Z0-9]+)\.a lib\1/NAMES \1/g' CMakeLists.txt
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    # UUID_LIB is provided by system frameworks
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "find_library(UUID_LIB NAMES uuid)" "set(UUID_LIB \"\")"
+
+    # Remove GCC related linker flags
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(CMAKE_EXE_LINKER_FLAGS "-static-libgcc -static-libstdc++")' ""
+
+    # Inject system frameworks and dependencies
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'target_link_libraries(mailsync pthread sasl2 ssl crypto curl dl)' \
+      'target_link_libraries(mailsync pthread sasl2 ssl crypto curl dl tidy iconv "-framework Foundation" "-framework CoreFoundation" "-framework Security" "-framework CoreServices" "-framework SystemConfiguration")'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    cp mailsync $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Email synchronization engine for Mailspring";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/package.nix b/pkgs/by-name/ma/mailspring/package.nix
index 37011710992f..d1e320d9d25b 100644
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@@ -1,31 +1,156 @@
 {
   lib,
-  stdenv,
+  buildNpmPackage,
   callPackage,
+  fetchFromGitHub,
+
+  makeBinaryWrapper,
+  pkg-config,
+  wrapGAppsHook3,
+  zip,
+
+  electron_41,
+  html-tidy,
+
+  # Command line arguments which are always set e.g "--password-store=kwallet6"
+  commandLineArgs ? "",
 }:
 let
+  version = "1.22.0";
+
+  src = fetchFromGitHub {
+    owner = "Foundry376";
+    repo = "Mailspring";
+    tag = version;
+    hash = "sha256-32d0WIWqCsZlvuT+RDa3EYxkwTxWzQyLIfASiDfZnL8=";
+    fetchSubmodules = true;
+  };
+
+  electron = electron_41;
+
+  mailspring-sync = callPackage ./mailsync.nix { inherit src version; };
+
+  mailspring-app = buildNpmPackage {
+    pname = "mailspring-app";
+    inherit version src;
+    sourceRoot = "${src.name}/app";
+    npmDepsHash = "sha256-b8CscOVVIbjkdf977LVVzFkWxOwn8XOemYpud5yK6vU=";
+    dontNpmBuild = true;
+    env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    npmFlags = [ "--ignore-scripts" ];
+
+    makeCacheWritable = true;
+    installPhase = ''
+      cp -r . "$out"
+    '';
+
+    meta = {
+      description = "Node dependencies for the Mailspring electron frontend";
+      license = lib.licenses.gpl3Plus;
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+    };
+  };
+in
+buildNpmPackage (finalAttrs: {
   pname = "mailspring";
-  version = "1.21.1";
+  inherit version src;
+
+  npmDepsHash = "sha256-3uidHfxgGONdtwAnoVytIbRqRjwtz3Yu8tNQ0qT8mJQ=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    wrapGAppsHook3
+    zip
+  ];
+
+  npmFlags = [ "--ignore-scripts" ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  # Remove the postinstall script to stop it from downloading a recompiled mailspring-sync binary
+  postPatch = ''
+    echo "" > scripts/postinstall.js
+  '';
+
+  preConfigure = ''
+    chmod +w app
+    cp -r ${mailspring-app}/node_modules app/node_modules
+    chmod -R u+w app/node_modules
+
+    cp ${mailspring-sync}/bin/mailsync app/mailsync
+
+    # Remove nix sandbox violating steps from the build script
+    substituteInPlace app/build/build.js \
+      --replace-fail "runWriteCommitHashIntoPackage," "" \
+      --replace-fail "runUpdateSandboxHelperPermissions," "" \
+      --replace-fail "runCopySymlinkedPackages," "" \
+      --replace-fail "process.argv.includes('--skip-installers')" "true"
+
+    # Use npm env vars to make node-gyp compile against the electron ABI
+    export npm_config_target="${electron.version}"
+    export npm_config_nodedir="${electron.headers}"
+
+    # Create the electron archive to be used by electron-packager
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
+    zip -0Xqr ../electron.zip .
+    popd
+
+    rm -r electron-dist
+
+    # force @electron/packager to use our electron instead of downloading it
+    substituteInPlace \
+      node_modules/@electron/packager/dist/packager.js \
+      --replace-fail "await this.getElectronZipPath(downloadOpts)" "'$(pwd)/electron.zip'"
+
+    pushd app
+    npm rebuild
+    popd
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/mailspring $out/bin
+
+    ASAR_PATH=$(find app/dist -name "app.asar" -print -quit)
+    cp -R "$(dirname "$ASAR_PATH")" $out/share/mailspring/resources
+
+    makeWrapper ${lib.getExe electron} "$out/bin/mailspring" \
+      --add-flags "$out/share/mailspring/resources/app.asar" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ html-tidy ]}" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Beautiful, fast and maintained fork of Nylas Mail by one of the original authors";
-    downloadPage = "https://github.com/Foundry376/Mailspring";
+    downloadPage = "https://github.com/Foundry376/Mailspring/releases";
+    changelog = "https://github.com/Foundry376/Mailspring/releases/tag/${finalAttrs.version}";
     homepage = "https://getmailspring.com";
     license = lib.licenses.gpl3Plus;
     longDescription = ''
       Mailspring is an open-source mail client forked from Nylas Mail and built with Electron.
-      Mailspring's sync engine runs locally, but its source is not open.
+      Mailspring's sync engine is open source and written in C++ and C. It runs locally on your computer.
     '';
     mainProgram = "mailspring";
     maintainers = with lib.maintainers; [ wrench-exile-legacy ];
     platforms = [
       "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-
-  linux = callPackage ./linux.nix { inherit pname version meta; };
-  darwin = callPackage ./darwin.nix { inherit pname version meta; };
-in
-if stdenv.hostPlatform.isDarwin then darwin else linux
+})

From 742dca5b347bfb8438071746bfe016e2468e696b Mon Sep 17 00:00:00 2001
From: Vinicius Deolindo <git@vini.cat>
Date: Mon, 15 Jun 2026 20:32:01 -0300
Subject: [PATCH 29/85] mos: 4.2.0 -> 4.2.1

---
 pkgs/by-name/mo/mos/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mo/mos/package.nix b/pkgs/by-name/mo/mos/package.nix
index deaae5b146e1..2ed11eaf8ba9 100644
--- a/pkgs/by-name/mo/mos/package.nix
+++ b/pkgs/by-name/mo/mos/package.nix
@@ -3,15 +3,14 @@
   stdenvNoCC,
   fetchurl,
   unzip,
-  nix-update-script,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mos";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchurl {
-    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260505.1.zip";
-    hash = "sha256-SswAG7V+7LbAbPcHwS4Kr+0TFg6XWhYTEK7lVC3lYCQ=";
+    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260531.1.zip";
+    hash = "sha256-LqaelvCS5E2tqTpVvaHN2rMynFJ7vV8G4A37eOlTlgo=";
   };
   sourceRoot = ".";
 

From 36cb8f71097818ccc5fa2c6c6631c8a8290dae4d Mon Sep 17 00:00:00 2001
From: Srylax <71783705+srylax@users.noreply.github.com>
Date: Tue, 19 May 2026 17:49:48 +0200
Subject: [PATCH 30/85] step-agent: init at 0.67.3

---
 pkgs/by-name/st/step-agent/package.nix | 72 ++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 pkgs/by-name/st/step-agent/package.nix

diff --git a/pkgs/by-name/st/step-agent/package.nix b/pkgs/by-name/st/step-agent/package.nix
new file mode 100644
index 000000000000..bf9570b18b97
--- /dev/null
+++ b/pkgs/by-name/st/step-agent/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchurl,
+  installShellFiles,
+  stdenvNoCC,
+  stdenv,
+  autoPatchelfHook,
+  makeWrapper,
+  p11-kit,
+  polkit,
+  tpm2-openssl,
+  tpm2-tss,
+  nix-update-script,
+}:
+let
+  version = "0.67.3";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/smallstep/step-agent-plugin/releases/download/v${version}/step-agent_${version}_linux_amd64.tar.gz";
+      sha256 = "sha256-sTZ6dNjyRwCWHWROUKCpq1rb8n9lT0cGOUOUpui9NJM=";
+    };
+
+    aarch64-linux = fetchurl {
+      url = "https://github.com/smallstep/step-agent-plugin/releases/download/v${version}/step-agent_${version}_linux_arm64.tar.gz";
+      sha256 = "sha256-0Vefuc+Xnx8x6Gu+WuS4zTHDIMepY593uFi3JKD+hrk=";
+    };
+  };
+in
+stdenvNoCC.mkDerivation {
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  inherit version;
+  pname = "step-agent";
+
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    autoPatchelfHook
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./step-agent $out/bin/step-agent
+    wrapProgram $out/bin/step-agent --prefix PATH : ${
+      lib.makeBinPath [
+        tpm2-tss
+        tpm2-openssl
+        polkit
+        p11-kit
+      ]
+    }
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "step-agent is an automated certificate management agent plugin for step-cli";
+    homepage = "https://github.com/smallstep/step-agent-plugin/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ Srylax ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = lib.platforms.linux;
+    mainProgram = "step-agent";
+  };
+}

From 12c24e84fd561540ba6dc7dba7fbf706a0bcb18a Mon Sep 17 00:00:00 2001
From: Simon <175155691+Simon-Weij@users.noreply.github.com>
Date: Fri, 29 May 2026 16:31:56 +0200
Subject: [PATCH 31/85] concord-tui: init at 2.2.2

---
 pkgs/by-name/co/concord-tui/package.nix | 46 +++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/co/concord-tui/package.nix

diff --git a/pkgs/by-name/co/concord-tui/package.nix b/pkgs/by-name/co/concord-tui/package.nix
new file mode 100644
index 000000000000..b6b1e5b95d29
--- /dev/null
+++ b/pkgs/by-name/co/concord-tui/package.nix
@@ -0,0 +1,46 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  alsa-lib,
+  cmake,
+  opus,
+  lib,
+  stdenv,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "concord-tui";
+  version = "2.2.2";
+
+  src = fetchFromGitHub {
+    owner = "chojs23";
+    repo = "concord";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oKaP5ff19RYg73LsilD1Hxaz7nSr8QK/08jM1TylbWU=";
+  };
+
+  cargoHash = "sha256-jJkAXzmZAUHLIO2uVeR3KNTBYAnp31m49mk66/lKHHY=";
+
+  buildInputs = [
+    opus
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Feature-rich TUI client for Discord, written in Rust";
+    homepage = "https://github.com/chojs23/concord";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ Simon-Weij ];
+    mainProgram = "concord";
+  };
+})

From 62525d0ac3a6a921c1bf4630f415cd36a90381c1 Mon Sep 17 00:00:00 2001
From: Maximilian Marx <mmarx@wh2.tu-dresden.de>
Date: Sat, 20 Jun 2026 17:36:24 +0200
Subject: [PATCH 32/85] mediawiki: fix warning for tablePrefix on non-mysql
 databases

The warning should trigger only when the database type is not `mysql`,
but would currently trigger only if it is indeed `mysql`.
---
 nixos/modules/services/web-apps/mediawiki.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index af1dbcd223a7..b5a3e69209a6 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -616,7 +616,7 @@ in
       ++ lib.optional (cfg.database.type != "sqlite" && cfg.database.path != null) ''
         The services.mediawiki.database.path option will be ignored because services.mediawiki.database.type is not "sqlite".
       ''
-      ++ lib.optional (cfg.database.type == "mysql" && cfg.database.tablePrefix != null) ''
+      ++ lib.optional (cfg.database.type != "mysql" && cfg.database.tablePrefix != null) ''
         The services.mediawiki.database.tablePrefix option has no effect when the services.mediawiki.database.type is not "mysql".
       '';
 

From e8e86c94e71b238b2bff8ca3259afe3e416294b3 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Mon, 1 Jun 2026 11:06:16 -0700
Subject: [PATCH 33/85] nixos/avahi-daemon: disable the full mDNS NSS module by
 default

Previously, enabling nssmdns would enable the full mdns module by
default, as well as the minimal one. Unfortunately, the full mdns module
introduces a 5 second delay whenever it fails to perform a reverse
hostname lookup (`gethostbyaddr`).

For example, this adds a 5 second delay to ping as follows:

1. Ping resolves the hostname (example.com) to an IP address. This query
   is serviced by the user's DNS resolver, so it returns quickly.
2. Ping attempts to resolve the IP address back into a hostname via
   `gethostbyaddr`.
3. If the upstream DNS server fails to resolve the IP address back into
   a hostname (many domain-names lack reverse DNS records), NSS falls
   back on querying via Avahi (via the `mdns` module).
4. mDNS is a broadcast protocol, so Avahi has to wait the full 5 second
   timeout before it can return a failure.

This patch fixes this by disabling the full `mdns` NSS module unless the
new disabled-by-default `nssmdnsFull` option is enabled. The
still-enabled `mdns_minimal` module only performs reverse IP lookups for
`169.254.0.0/16` (link-local IP addresses) so this 5 second delay will
only apply to link-local pings by domain-name.

In practice, this change shouldn't negatively affect the vast majority
of users. The only affected users are those who:

1. Are relying on Avahi to resolve IP addresses into hostnames on their
   local network via `gethostbyaddr`.
2. Are using mDNS hostnames that don't end in `.local`.

The minimal module is sufficient for, e.g., users who just want to
resolve hostnames for local printers and network shares.

Note: This patch not fix this by adding [!UNAVAIL=return] after `dns` as
discussed in (#291108) as that would treat mDNS as a fallback for DNS when
DNS is unavailable which, IMO, is incorrect. Whether or not we use mDNS
shouldn't depend on whether or not our DNS server is available.

fixes #291108
---
 .../manual/release-notes/rl-2611.section.md   |  2 ++
 .../services/networking/avahi-daemon.nix      | 33 ++++++++++++++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index b0df63100530..8d0cd236e6c0 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -40,6 +40,8 @@
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
+- When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 6ff86daf6a9e..2e61b39835a2 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -262,6 +262,28 @@ in
       '';
     };
 
+    nssmdnsFull = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable the full mDNS NSS (Name Service Switch) plug-in.
+
+        By default, only the minimal module is enabled. The minimal module
+        will only resolve `.local` domains and only perform reverse hostname
+        lookups for `169.254.0.0/16`. The full module will use mDNS to resolve any
+        domain allowed by [`/etc/mdns.allow`][1] and will perform reverse hostname
+        lookups for any IP address.
+
+        [1]: https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow
+
+        ::: {.note}
+        Enabling this option will introduce a 5 second delay to failed reverse
+        hostname lookups. For example, this will often add a 5 second delay to
+        ping.
+        :::
+      '';
+    };
+
     cacheEntriesMax = lib.mkOption {
       type = lib.types.nullOr lib.types.int;
       default = null;
@@ -287,6 +309,15 @@ in
       (lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
     ];
 
+    assertions = [
+      {
+        assertion = cfg.nssmdnsFull -> (cfg.nssmdns4 || cfg.nssmdns6);
+        message = ''
+          `services.avahi.nssmdnsFull` requires one or both of `services.avahi.nssmdns4` and/or `services.avahi.nssmdns6` to be enabled.
+        '';
+      }
+    ];
+
     users.users.avahi = {
       description = "avahi-daemon privilege separation user";
       home = "/var/empty";
@@ -312,7 +343,7 @@ in
       lib.optionals (cfg.nssmdns4 || cfg.nssmdns6) (
         lib.mkMerge [
           (lib.mkBefore [ "${mdns}_minimal [NOTFOUND=return]" ]) # before resolve
-          (lib.mkAfter [ "${mdns}" ]) # after dns
+          (lib.mkAfter (lib.optional cfg.nssmdnsFull "${mdns}")) # after dns
         ]
       );
 

From c37f5434ddc8eaad0969ca6de8da66d0bbf5c2d8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 04:13:41 +0000
Subject: [PATCH 34/85] postgresqlPackages.timescaledb: 2.27.2 -> 2.28.0

---
 pkgs/servers/sql/postgresql/ext/timescaledb.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 69917cfbd15d..a509153a37ff 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.27.2";
+  version = "2.28.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-/z8qr+56svxnUrnmh0uetPPttXdc1B8aDKZ5mtZpTt4=";
+    hash = "sha256-/m1B74kvYzYElFFP8AgEjhqWNRkNy0/hponuSY09tgs=";
   };
 
   nativeBuildInputs = [ cmake ];

From a90080c1ad94e3a6f4b8d8ee3a8b837e59d1a55c Mon Sep 17 00:00:00 2001
From: Kirill Radzikhovskyy <kirillrdy@gmail.com>
Date: Tue, 23 Jun 2026 20:07:35 +1000
Subject: [PATCH 35/85] postgresqlPackages.timescaledb: mark broken for
 postgresql 19

---
 pkgs/servers/sql/postgresql/ext/timescaledb.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index a509153a37ff..82ca5939ad81 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -101,6 +101,12 @@ postgresqlBuildExtension (finalAttrs: {
     maintainers = with lib.maintainers; [ kirillrdy ];
     platforms = postgresql.meta.platforms;
     license = with lib.licenses; if enableUnfree then tsl else asl20;
-    broken = lib.versionOlder postgresql.version "15";
+    broken =
+      lib.versionOlder postgresql.version "15"
+      ||
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "2.28.0") "Is postgresql19Packages.timescaledb still broken?" (
+          lib.versionAtLeast postgresql.version "19"
+        );
   };
 })

From 28b8da7aa3a3258d966c71e05f979863e56762d7 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Tue, 23 Jun 2026 15:53:32 +0000
Subject: [PATCH 36/85] alac: 0.0.7-unstable-2024-10-16 ->
 0.0.7-unstable-2026-04-10

---
 pkgs/by-name/al/alac/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/alac/package.nix b/pkgs/by-name/al/alac/package.nix
index e46b5443477c..bb2d20b84405 100644
--- a/pkgs/by-name/al/alac/package.nix
+++ b/pkgs/by-name/al/alac/package.nix
@@ -8,7 +8,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "alac";
-  version = "0.0.7-unstable-2024-10-16";
+  version = "0.0.7-unstable-2026-04-10";
 
   outputs = [
     "out"
@@ -18,8 +18,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "mikebrady";
     repo = "alac";
-    rev = "1832544d27d01335d823d639b176d1cae25ecfd4";
-    hash = "sha256-xRWDeqyJ/BEaSWVlDXgaKIKJuBwM8kJDIATVTVaMn2k=";
+    rev = "5d8c5db0dfcadd5872f28e665cf4f4303447352a";
+    hash = "sha256-Wb6I5YHGvBVjVgOutICbRKH96odR3ZgmNS6HQedVahk=";
   };
 
   nativeBuildInputs = [

From f5bfe6aabfa46dbfd9d9da7c39bcbc780b790037 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Tue, 23 Jun 2026 15:55:12 +0000
Subject: [PATCH 37/85] ubuntu-sans-mono: 1.006 -> 1.100

---
 pkgs/by-name/ub/ubuntu-sans-mono/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ub/ubuntu-sans-mono/package.nix b/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
index 59ddf9255242..d35a14500cff 100644
--- a/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
+++ b/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ubuntu-sans-mono";
-  version = "1.006";
+  version = "1.100";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "Ubuntu-Sans-Mono-fonts";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EFZZnMZTQHo2Tr9/rtb7C5gAlQ/0uYT+MQ1gKkqQ5hE=";
+    hash = "sha256-3vHf1e1bHaFCPTYMDldoUPYQvMAW6//MiNiqlCjd7HQ=";
   };
 
   installPhase = ''

From 212ca01d6dcbe70b4867f22bcdcf75257c1094b0 Mon Sep 17 00:00:00 2001
From: Holiu <165534185+Holiu618@users.noreply.github.com>
Date: Wed, 24 Jun 2026 00:51:24 +0800
Subject: [PATCH 38/85] docker-compose: 5.1.4 -> 5.2.0

---
 pkgs/applications/virtualization/docker/compose.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 96820c023507..f1cc52d211f5 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "docker-compose";
-  version = "5.1.4";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     tag = "v${version}";
-    hash = "sha256-sdRxssZ6bRGRB/WPp2BiDTVHQ5LBmNGwXQYBdSpylQg=";
+    hash = "sha256-sKfsPn8CV62TXY0LoquQYEUgSBVDRiKW0Z3/py1RFng=";
   };
 
-  vendorHash = "sha256-hgNboIZx5QOGjPadey4f2TKpPw+b2sja6mcwoMjINuY=";
+  vendorHash = "sha256-1cYmWaj6gvmM6207dj8E7kVKIOJlS4js9EwNXhnv13A=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 60b67eaf9a3a8eb809f307b8085f9d10ca3f4d09 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 20:27:28 +0000
Subject: [PATCH 39/85] python3Packages.gguf: 9538 -> 9775

---
 pkgs/development/python-modules/gguf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index 27f44ca63e40..9b216bc0cf79 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gguf";
-  version = "9538";
+  version = "9775";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-7cE5l+fnVsw72UyqAqKP2UmKg2seMCcqsZSKhHBSKLM=";
+    hash = "sha256-y//hC8lpHjyFA3UK6hmcwkzb99xCZyZRMRILo+Y7Ap4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/gguf-py";

From 2404d6a2e697911b594582d3142e8bb3f7c7669b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 02:33:46 +0000
Subject: [PATCH 40/85] netbird-dashboard: 2.39.0 -> 2.80.0

---
 pkgs/by-name/ne/netbird-dashboard/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/netbird-dashboard/package.nix b/pkgs/by-name/ne/netbird-dashboard/package.nix
index 4e2109b3553f..5d94f97b6df7 100644
--- a/pkgs/by-name/ne/netbird-dashboard/package.nix
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "netbird-dashboard";
-  version = "2.39.0";
+  version = "2.80.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "dashboard";
     rev = "v${version}";
-    hash = "sha256-9sSK9RBbe+u/sNt/5nsYJgS8QdBNdHMFUTrSggZiLos=";
+    hash = "sha256-Z0yE6w7CIBE/JD/JS4ehz+lT2lKoK8U9mjifMaO/joM=";
   };
 
-  npmDepsHash = "sha256-Ze+1r5Uh+wdm3MuVr93oS2itodx9Zdv+JYO6Uji1saw=";
+  npmDepsHash = "sha256-weTRhkPGoNF34iHOITCBhZj9LWwWmemMOng51aAv+BU=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   installPhase = ''

From ff38cf20213982cb3db44c70f98998dd53733511 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 24 Jun 2026 02:25:27 -0400
Subject: [PATCH 41/85] sirius: remove cudaPackages.cudatoolkit

Link: https://github.com/NixOS/nixpkgs/issues/232501

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/si/sirius/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index 3d38dd8b071b..aeeafcfa9b02 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -100,7 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (gpuBackend == "cuda") [
     cudaPackages.cuda_cudart
     cudaPackages.cuda_profiler_api
-    cudaPackages.cudatoolkit
+    cudaPackages.cuda_nvtx
+    cudaPackages.libcufft
+    cudaPackages.libcusolver
     cudaPackages.libcublas
   ]
   ++ lib.optionals (gpuBackend == "rocm") [
@@ -150,7 +152,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (gpuBackend == "cuda") [
     "-DSIRIUS_USE_CUDA=ON"
-    "-DCUDA_TOOLKIT_ROOT_DIR=${cudaPackages.cudatoolkit}"
     (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
   ]
   ++ lib.optionals (gpuBackend == "rocm") [

From d22e5c3c2c487e9c78d5f1bb80c9679545ee7745 Mon Sep 17 00:00:00 2001
From: chillcicada <2210227279@qq.com>
Date: Wed, 24 Jun 2026 19:45:14 +0800
Subject: [PATCH 42/85] spakle: 1.26.4 -> 1.26.5

---
 pkgs/by-name/sp/sparkle/package.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index bd10387d4e03..873c7b9b229c 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   buildGoModule,
   fetchFromGitHub,
-  pnpm_10_29_2,
+  pnpm,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -22,8 +22,6 @@
 }:
 
 let
-  pnpm = pnpm_10_29_2;
-
   sparkle-service = buildGoModule {
     pname = "sparkle-service";
     version = "0-unstable-2025-10-24";
@@ -43,20 +41,20 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.4";
+  version = "1.26.5";
 
   src = fetchFromGitHub {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-+3MHCy1N1/kOVFYDNvNiP/jkL0HHi2RwfeIqe2Z40O8=";
+    hash = "sha256-b4SidOlMDSi+DdbuF3LmOMlQTSBxd2CAf9oshYGXWrQ=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Us4qsCJdRZKYJQAgcqeStX7MfEqBWr4rKXBqU2K+KZI=";
+    hash = "sha256-UrMzBinZsTfZigkPMOySJ/Yjskh6Csna1M6XpBpq0vI=";
   };
 
   nativeBuildInputs = [

From cc8235bc95cdbcd09e02139b9621fa9b76b81722 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 12:41:36 +0000
Subject: [PATCH 43/85] setools: 4.6.0 -> 4.7.0

---
 pkgs/by-name/se/setools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/se/setools/package.nix b/pkgs/by-name/se/setools/package.nix
index 2d73f3bc566f..0f9b2b74b346 100644
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "setools";
-  version = "4.6.0";
+  version = "4.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = "setools";
     tag = finalAttrs.version;
-    hash = "sha256-UZisEbHx3zO92gmRQSYsI8TmY9MjCP7AWNAESYklAkk=";
+    hash = "sha256-Xe+/ZEtSRfBPFcRnyR4igoTJVYBg4jH3Ov76CFVY8+k=";
   };
 
   build-system = with python3Packages; [

From 1d5fe677aaf34eee3e2d310416ac0b2826d80c30 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 24 Jun 2026 16:06:45 +0200
Subject: [PATCH 44/85] python3Packages.scikit-bio: reduce openmp threads
 during tests

The tests finish quickly enough with just a single OpenMP thread and this
prevents it from becoming a scheduling nightmare on hydra.
---
 pkgs/development/python-modules/scikit-bio/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index 1190d875005a..c909d8d66d08 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -62,6 +62,10 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # only the $out dir contains the built cython extensions, so we run the tests inside there
   enabledTestPaths = [ "${placeholder "out"}/${python.sitePackages}/skbio" ];
 

From d7ab41af3fe3af22b78b7d842964abed1b3e3abf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 24 Jun 2026 16:38:22 +0200
Subject: [PATCH 45/85] python3Packages.captum: reduce openmp threads during
 tests

---
 pkgs/development/python-modules/captum/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/captum/default.nix b/pkgs/development/python-modules/captum/default.nix
index 32889473641c..455eac5c5fc1 100644
--- a/pkgs/development/python-modules/captum/default.nix
+++ b/pkgs/development/python-modules/captum/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   buildPythonPackage,
   pytestCheckHook,
   setuptools,
@@ -53,6 +52,10 @@ buildPythonPackage rec {
     scikit-learn
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTestPaths =
     lib.optionals stdenv.hostPlatform.isDarwin [
       # These tests may fail if multiple builds run them at the same time due

From dbb77388c90ee297214b3de8167781f931df2507 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 24 Jun 2026 17:00:27 +0200
Subject: [PATCH 46/85] python3Packages.mace-torch: reduce openmp threads
 during tests

---
 pkgs/development/python-modules/mace-torch/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/mace-torch/default.nix b/pkgs/development/python-modules/mace-torch/default.nix
index 3c8b486f643b..4ed39d479782 100644
--- a/pkgs/development/python-modules/mace-torch/default.nix
+++ b/pkgs/development/python-modules/mace-torch/default.nix
@@ -82,6 +82,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTests = [
     # _pickle.PickleError: ScriptFunction cannot be pickled
     "test_run_eval_fail_with_wrong_model"

From 41c021f78b93f22f983ee8a54f5533fb68f0da71 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Wed, 24 Jun 2026 16:52:39 +0100
Subject: [PATCH 47/85] postgresqlPackages.vectorchord: rename upstream github
 owner

The repository has been moved from tensorchord/VectorChord to
supervc-stack/VectorChord.
---
 .../servers/sql/postgresql/ext/vectorchord/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index c895d8ebe34e..17ffbb6e3dc3 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -15,8 +15,8 @@ buildPgrxExtension (finalAttrs: {
   version = "1.1.1";
 
   src = fetchFromGitHub {
-    owner = "tensorchord";
-    repo = "vectorchord";
+    owner = "supervc-stack";
+    repo = "VectorChord";
     tag = finalAttrs.version;
     hash = "sha256-QL9XGSQFOcrpww03Y5F0JuDbpo0v8oidUqucLxggkqE=";
   };
@@ -24,7 +24,7 @@ buildPgrxExtension (finalAttrs: {
   cargoHash = "sha256-IXOCzKJArNOcb/2TcJbLz1XdCquUpyF/cLHYU5vmlko=";
 
   # Include upgrade scripts in the final package
-  # https://github.com/tensorchord/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
+  # https://github.com/supervc-stack/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
   postInstall = ''
     cp sql/upgrade/* $out/share/postgresql/extension/
   '';
@@ -89,9 +89,9 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/tensorchord/VectorChord/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/supervc-stack/VectorChord/releases/tag/${finalAttrs.version}";
     description = "Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs";
-    homepage = "https://github.com/tensorchord/VectorChord";
+    homepage = "https://github.com/supervc-stack/VectorChord";
     license = lib.licenses.OR [
       lib.licenses.agpl3Only
       lib.licenses.elastic20

From 512bb2bdd0379811c18897ddc4f3d20cd8490b90 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Wed, 24 Jun 2026 17:00:35 +0100
Subject: [PATCH 48/85] postgresqlPackages.vectorchord: mark as broken on pg19

---
 pkgs/servers/sql/postgresql/ext/vectorchord/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 17ffbb6e3dc3..1dd1d6283a81 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -89,6 +89,12 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 19 is not yet supported
+    # See https://github.com/supervc-stack/VectorChord/issues/464
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "1.1.1"
+    ) "Is postgresql19Packages.vectorchord still broken?" (lib.versionAtLeast postgresql.version "19");
     changelog = "https://github.com/supervc-stack/VectorChord/releases/tag/${finalAttrs.version}";
     description = "Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs";
     homepage = "https://github.com/supervc-stack/VectorChord";

From a8313436f893cf65cf58399b350e080ceba87796 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 24 Jun 2026 18:24:51 +0200
Subject: [PATCH 49/85] gitlab: 18.11.5 -> 18.11.6

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/?nav=18.11.6
---
 pkgs/by-name/gi/gitaly/package.nix                 |  4 ++--
 pkgs/by-name/gi/gitlab-pages/package.nix           |  4 ++--
 pkgs/by-name/gi/gitlab/data.json                   | 14 +++++++-------
 .../by-name/gi/gitlab/gitlab-workhorse/default.nix |  2 +-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock        |  4 ++--
 pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix          |  4 ++--
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 7143fd093f77..ceb96f569302 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.11.5";
+  version = "18.11.6";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-i2DgcNoGPR/B6qya+jYFU5noOSabSlwu9P7p5KwR6jI=";
+      hash = "sha256-fsr8ttV2q2iedTA5yn4iHry92Mgu775K1GW3JBz5N1U=";
     };
 
     vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 096573d2c5f5..0c6ae216ff5c 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jSTXLbzYCiCpqrbs9kAmW6um2X5hA1OFiA6fSZrQ2RI=";
+    hash = "sha256-D/AlIXbcgvPyP2TX/lXVYlnG2HXKZlxOhqRTfTXsaew=";
   };
 
   vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 3ce73f50325d..2f8606e66e98 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.11.5",
-  "repo_hash": "sha256-/RIUqxfRjq3+TOvapYMfl0uVqQLp1adpE6bR303rH6g=",
+  "version": "18.11.6",
+  "repo_hash": "sha256-bdnBX6M4BtuA03CP/N0teKnuey3V9qHseBoxTIGXE5Q=",
   "yarn_hash": "sha256-og09R28lwYvDk4pe7z1dRMaanYiTsUSx+SUKoWc53do=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.11.5-ee",
+  "rev": "v18.11.6-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.5",
-    "GITLAB_KAS_VERSION": "18.11.5",
-    "GITLAB_PAGES_VERSION": "18.11.5",
+    "GITALY_SERVER_VERSION": "18.11.6",
+    "GITLAB_KAS_VERSION": "18.11.6",
+    "GITLAB_PAGES_VERSION": "18.11.6",
     "GITLAB_SHELL_VERSION": "14.50.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
-    "GITLAB_WORKHORSE_VERSION": "18.11.5"
+    "GITLAB_WORKHORSE_VERSION": "18.11.6"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 5fcf95d2f083..1e60673586d2 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 9e054ba008c9..ef81560ad325 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -537,7 +537,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.5.0)
+    devfile (0.5.2)
     device_detector (1.1.3)
     devise (4.9.4)
       bcrypt (~> 3.0)
@@ -2678,7 +2678,7 @@ CHECKSUMS
   declarative_policy (2.1.0) sha256=f9ab705da726174bde97785c319311a4abf6143c07862f882bd8bc1b69361eea
   derailed_benchmarks (2.2.1) sha256=654280664fded41c9cd8fc27fc0fcfaf096023afab90eb4ac1185ba70c5d4439
   descendants_tracker (0.0.4) sha256=e9c41dd4cfbb85829a9301ea7e7c48c2a03b26f09319db230e6479ccdc780897
-  devfile (0.5.0) sha256=6a7e3be19e3e6b4b698b64ec4d6fd85b6653ce810c65cee611907d47ebb4cccf
+  devfile (0.5.2) sha256=2398cc38726f7bce03088eb74e4157f7839b353e36a488565e3fcc7739cd613d
   device_detector (1.1.3) sha256=c5fe3fe42cab2e8aa01f193b2074b8bb1510373ce47127206f28c7dea75a9c79
   devise (4.9.4) sha256=920042fe5e704c548aa4eb65ebdd65980b83ffae67feb32c697206bfd975a7f8
   devise-pbkdf2-encryptable (0.0.0)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 4ed69ec68a77..4391115257d4 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -1621,10 +1621,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kycnkmlfzch27kcwr8ch7756rjvv1plvv34idllnsrykvhknzka";
+      sha256 = "0gb1rlwpgk1zbrb8i91n7qsrp0zpax0lxdwf101wwyvgf8wcr613";
       type = "gem";
     };
-    version = "0.5.0";
+    version = "0.5.2";
   };
   device_detector = {
     groups = [ "default" ];

From daa11e6f1d483e59eecbd7e4e5e955f6b928a865 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 24 Jun 2026 11:58:04 -0700
Subject: [PATCH 50/85] python3Packages.tinygrad: disable flaky performance
 test

---
 pkgs/development/python-modules/tinygrad/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index f1b3c33ba2ed..6f07836aeec2 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -195,6 +195,8 @@ buildPythonPackage (finalAttrs: {
     # Flaky:
     #   AssertionError: 2.1376906810000946 not less than 2.0
     "test_recursive_pad"
+    # AssertionError: 23476983700 not greater than 60457564575 (performance test)
+    "test_flops"
 
     # Require internet access
     "testCopySHMtoDefault"

From ddd9cfa12061f2c9ec5867df9f0d366b1cd85a5b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 19:04:15 +0000
Subject: [PATCH 51/85] yara-x: 1.18.0 -> 1.19.0

---
 pkgs/by-name/ya/yara-x/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 0cb89701dd05..22807879f612 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4cHCBSmBhjuk8otOB+ykiviaHVDmrguIVCLCRMcq7L4=";
+    hash = "sha256-CokjFTQoFT9k/2/MuQSbfzHonW4V0F8hskhqDvpCesM=";
   };
 
-  cargoHash = "sha256-MMERL3DcOlTEa2S6BMboFi8MfKC8ah2wZtOQRbO6ADg=";
+  cargoHash = "sha256-wMh8F++16tQ0IUhacBPb4rDcydmDKZKzQf8EK/qDJXo=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";

From 44fa15d9b06dec0224656bf23a68a8e6b3a688c8 Mon Sep 17 00:00:00 2001
From: Marc Bornand <dev.mbornand@systemb.ch>
Date: Wed, 24 Jun 2026 17:06:13 +0000
Subject: [PATCH 52/85] librewolf-unwrapped: 152.0.1-2 -> 152.0.2-1

---
 pkgs/by-name/li/librewolf-unwrapped/librewolf.nix |  2 --
 pkgs/by-name/li/librewolf-unwrapped/src.json      | 10 +++++-----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
index 8db148066c60..1e3bf61a2e63 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
@@ -37,8 +37,6 @@ rec {
     cp ${source}/assets/search-config.json services/settings/dumps/main/search-config.json
     sed -i '/MOZ_SERVICES_HEALTHREPORT/ s/True/False/' browser/moz.configure
 
-    sed -i '/# This must remain last./i gkrust_features += ["glean_disable_upload"]\'$'\n' toolkit/library/rust/gkrust-features.mozbuild
-
     cp ${source}/patches/pref-pane/category-librewolf.svg browser/themes/shared/preferences
     cp ${source}/patches/pref-pane/librewolf.css browser/themes/shared/preferences
     cp ${source}/patches/pref-pane/librewolf.inc.xhtml browser/components/preferences
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index d032717d2235..7995f6b699ea 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "152.0.1-2",
+  "packageVersion": "152.0.2-1",
   "source": {
-    "rev": "152.0.1-2",
-    "hash": "sha256-qr0eO+ucXguTb2QDhbsI9jjlx9fzfZVAI++87UfXcXE="
+    "rev": "152.0.2-1",
+    "hash": "sha256-CgH0HOtNbdoHMZ/MJL/zPK0Gn+e+qqtZjqPDSq63gX8="
   },
   "firefox": {
-    "version": "152.0.1",
-    "hash": "sha512-myWVFI7ZdwQOorIefW7OcPDlP6yblrMRWxE76nbq1sBCL26UsVQCg7Qw/tXo6aIndxpjV78W9W1TCn+ufcdVOg=="
+    "version": "152.0.2",
+    "hash": "sha512-5OVM///P1XUerFgXp7dLDvCqQ/wA7yk5fMnfmqUlcrInK5bmA3OnDXEr5NyEkXDY1cG0SfPql4tKso3uGQVrAw=="
   }
 }

From fc77c504209c8552c846dc11ae2c42fe76962685 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 20:41:45 +0000
Subject: [PATCH 53/85] firewalld: 2.4.2 -> 2.4.3

---
 pkgs/by-name/fi/firewalld/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 613a72ead79a..646eae599f4e 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -43,7 +43,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "firewalld";
-  version = "2.4.2";
+  version = "2.4.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "firewalld";
     repo = "firewalld";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM=";
+    hash = "sha256-S7E0szAZ2MEttL4PdBkoOcDGFVCVrwsTKr9xe+DPPgM=";
   };
 
   patches = [

From 081bf1547cbb233843ea58b4e5cc25bae12cc00e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 24 Jun 2026 14:08:45 -0700
Subject: [PATCH 54/85] python3Packages.tinygrad: disable huggingface test that
 loads huge model

---
 pkgs/development/python-modules/tinygrad/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index 6f07836aeec2..43aac9173f64 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -246,6 +246,10 @@ buildPythonPackage (finalAttrs: {
     "test_transcribe_long"
     "test_transcribe_long_no_batch"
     "test_vgg7"
+    # Downloads external model each time.
+    # Skipped when building on Hydra (no network access),
+    # but interferes with local builds
+    "test_xlm_roberta_large"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # Fail with AssertionError

From b153953686370a8dc14231db115b058b137644de Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Jun 2026 00:30:22 +0200
Subject: [PATCH 55/85] python3Packages.torch-geometric: reduce openmp threads
 during tests

---
 pkgs/development/python-modules/torch-geometric/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
index 06863712e7c5..839f5c8e02e5 100644
--- a/pkgs/development/python-modules/torch-geometric/default.nix
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -185,6 +185,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   pytestFlags = [
     # DeprecationWarning: Failing to pass a value to the 'type_params' parameter of
     # 'typing._eval_type' is deprecated, as it leads to incorrect behaviour when calling

From b6e39b216d88ce807410f1e05908d9cdbb4afb39 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Jun 2026 00:44:12 +0200
Subject: [PATCH 56/85] python3Packages.x-transformers: limit openmp threads
 during tests

---
 pkgs/development/python-modules/x-transformers/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 16d3dff4fd61..1496775f5eec 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -42,6 +42,10 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # RuntimeError: torch.compile is not supported on Python 3.14+
   disabledTests = lib.optionals (pythonAtLeast "3.14") [ "test_up" ];
 

From e7420d4ab5b30c2b5d01f45b798ba920b4442ffe Mon Sep 17 00:00:00 2001
From: Xela <git@xela.zone>
Date: Tue, 23 Jun 2026 20:30:39 -0800
Subject: [PATCH 57/85] kdePackages.plasma-workspace-wallpapers: support all
 platforms

---
 pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix b/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
index 5d661c1c94fd..3a9553c7315e 100644
--- a/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
   mkKdeDerivation,
   extra-cmake-modules,
 }:
 mkKdeDerivation {
   pname = "plasma-workspace-wallpapers";
-
   extraBuildInputs = [ extra-cmake-modules ];
+
+  meta.platforms = lib.platforms.all;
 }

From c4270ddad45f8e2eca22bf87068db4b3fd3ef42b Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 24 Jun 2026 03:31:38 -0400
Subject: [PATCH 58/85] cp2k: fix build by adding cudaPackages.libcufft

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/cp/cp2k/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index a89ef4cccf51..45022b18c10c 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -158,7 +158,9 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     gfortran
   ]
-  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
+  ++ lib.optionals (gpuBackend == "cuda") [
+    cudaPackages.cuda_nvcc
+  ];
 
   buildInputs = [
     fftw
@@ -191,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional enableElpa elpa
   ++ lib.optionals (gpuBackend == "cuda") [
     cudaPackages.cuda_cudart
+    cudaPackages.libcufft
     cudaPackages.libcublas
     cudaPackages.cuda_nvrtc
   ]

From 36b683a6df9a8068e987828e3039910792b428da Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 24 Jun 2026 20:24:30 -0400
Subject: [PATCH 59/85] cp2k: enable strictDeps, __structuredAttrs

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/cp/cp2k/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index 45022b18c10c..42775a325526 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -133,6 +133,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "cp2k";
   version = "2026.1-unstable-2026-06-16";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "cp2k";
@@ -157,6 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     pkg-config
     gfortran
+    mpi
   ]
   ++ lib.optionals (gpuBackend == "cuda") [
     cudaPackages.cuda_nvcc

From 48a8ded7480c0f3459bc7ee7759434c4b1fdda4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 00:45:40 +0000
Subject: [PATCH 60/85] cargo-zigbuild: 0.22.3 -> 0.23.0

---
 pkgs/by-name/ca/cargo-zigbuild/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-zigbuild/package.nix b/pkgs/by-name/ca/cargo-zigbuild/package.nix
index 115ef44c1b23..e8327d1ba95f 100644
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
-  version = "0.22.3";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-zigbuild";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f9jmt3UXniXVeX2NyuRx30DrpRtczLO7ZioNi4TI3Zk=";
+    hash = "sha256-Y73aPGsrSAZVxNJ1r1lS9uXmfpAwthq6NW4urKS8ab0=";
   };
 
-  cargoHash = "sha256-7ZQpAePAIqSNiKM8bTAhyx4QyDQda1J8TSnZX0W2tfY=";
+  cargoHash = "sha256-dt2s18B9RVwEBlun5cegoqfW1KYXFqjdScdc/Q2aDlI=";
 
   nativeBuildInputs = [ makeWrapper ];
 

From a7b4a5492cd28ea6dcc24a9df697036d3eb4fbdc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 00:47:30 +0000
Subject: [PATCH 61/85] cargo-tarpaulin: 0.35.4 -> 0.35.5

---
 pkgs/by-name/ca/cargo-tarpaulin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-tarpaulin/package.nix b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
index 3945643395b6..388845f21469 100644
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
-  version = "0.35.4";
+  version = "0.35.5";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     tag = finalAttrs.version;
-    hash = "sha256-fm9q3VTZh5QKXXw4+t4xngz5gyiZqKpUHShpz0nf2Is=";
+    hash = "sha256-m822/s9HBKIxAfzgQEBOZeHcHU57MPGOumqlTc55Ro8=";
   };
 
-  cargoHash = "sha256-4og97E5zdRIO7swsfgh87MdWh4E4onMIcrCb1/KCJEc=";
+  cargoHash = "sha256-Qo06iUy/1ElEe/gkH23JZLw7AKPkBPw6aLXnvx9Hv4g=";
 
   nativeBuildInputs = [
     pkg-config

From d1aec25993af52b6362db008002034a64704edb5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 02:15:42 +0000
Subject: [PATCH 62/85] libretro.genesis-plus-gx: 0-unstable-2026-06-12 ->
 0-unstable-2026-06-19

---
 .../emulators/libretro/cores/genesis-plus-gx.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index ad5a4b148996..e88e8d21768b 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "d046ec708d443ec7d9d38f757fa8e01099dd5c5a";
-    hash = "sha256-Q3eqYnoGAUcQOSt33lcQHHDqc7aLGcxaf+gcRUC4FGs=";
+    rev = "f33876ca3e4f021f4b273aeabed42b551243b71c";
+    hash = "sha256-cmA4aBzR33Df3SNyB3e/reQnQmF0alT6RIeXK+ew+us=";
   };
 
   meta = {

From 26bf1a7697fabfbf07787931a1c052e9dd79b2d4 Mon Sep 17 00:00:00 2001
From: Zhaofeng Li <hello@zhaofeng.li>
Date: Wed, 24 Jun 2026 22:40:38 -0400
Subject: [PATCH 63/85] attic-client: Use nixVersions.nix_2_34

Unblocks #513339.
---
 pkgs/by-name/at/attic-client/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 72096bd19636..51fa7cbe75da 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -16,7 +16,7 @@ let
   # Only the attic-client crate builds against the Nix C++ libs
   # This derivation is also used to build the server
   needNixInclude = lib.elem "attic-client" crates;
-  nix = nixVersions.nix_2_28;
+  nix = nixVersions.nix_2_34;
 in
 
 rustPlatform.buildRustPackage {

From 10c068066e87ee97b34ea60d1d72b6ef6dbfef1b Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 24 Jun 2026 22:19:02 -0400
Subject: [PATCH 64/85] sirius: enable strictDeps, __structuredAttrs

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/si/sirius/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index aeeafcfa9b02..f0784fadc7ab 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -55,6 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "SIRIUS";
   version = "7.10.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "electronic-structure";
     repo = "SIRIUS";
@@ -70,9 +73,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     gfortran
+    mpi
     pkg-config
   ]
-  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
+  ++ lib.optionals (gpuBackend == "cuda") [ cudaPackages.cuda_nvcc ]
+  ++ lib.optionals enablePython [ pythonPackages.python ];
 
   buildInputs = [
     blas

From c04d03a64693a896dd6cc0c747df5d699a2e2edc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 05:07:32 +0000
Subject: [PATCH 65/85] thunderbird-latest-unwrapped: 151.0.1 -> 152.0

---
 .../networking/mailreaders/thunderbird/packages.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 71d6cb7a2fa6..d1778223b0b8 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -77,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "151.0.1";
-    sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589";
+    version = "152.0";
+    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

From fe3a142521335e3ae593889ba7733713bcb29fcf Mon Sep 17 00:00:00 2001
From: Samuel Cobb <sjcobb2003@gmail.com>
Date: Sun, 21 Jun 2026 04:16:04 +0100
Subject: [PATCH 66/85] nixos/incus: remove named profile

---
 nixos/modules/virtualisation/incus.nix | 28 ++++++++++++++++----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 83a5a731ccb7..466e359c3147 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -363,21 +363,27 @@ in
           include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
         '';
         "incusd".profile = ''
-          # This profile allows everything and only exists to give the
-          # application a name instead of having the label "unconfined"
+          # incusd is deliberatly left unconfined, with NO named profile attached to the binary.
+          # Incus checks its own confinement at startup by reading /proc/self/attr/current
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/sys/apparmor.go).
+          # Anything other than "unconfined" makes Incus believe that the host process is
+          # itself confined, which sends every container down the "reuse my own profile" branch in
+          # https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go
+          # instead of generating a "proper" per-container profile. Furthermore,
+          # that branch only strips " (enforce)" suffix before handing the string to lxc.apparmor.profile
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go#L96),
+          # so the named profile with flags=(unconfined) produces a literal string
+          # "incusd (unconfined)", which the kernel rejects at change_profile() time
+          # with "label not found", failing every `incus start` when AppArmor is enabled.
+          # This was not caught before as AppArmor was stifled by bpf.
+
+          # We keep this policy to pull in the per-container /
+          # per-archive profiles incusd generates at runtime so
+          # apparmor_parser loads them.
 
           abi <abi/4.0>,
           include <tunables/global>
 
-          profile incusd ${lib.getExe' config.virtualisation.incus.package "incusd"} flags=(unconfined) {
-            userns,
-
-            include "/var/lib/incus/security/apparmor/cache"
-
-            # Site-specific additions and overrides. See local/README for details.
-            include if exists <local/incusd>
-          }
-
           include "/var/lib/incus/security/apparmor/profiles"
         '';
       };

From bd022e3c5a54b5f05eeb92cd02a82d2fc76a65f2 Mon Sep 17 00:00:00 2001
From: Samuel Cobb <sjcobb2003@gmail.com>
Date: Fri, 19 Jun 2026 20:46:31 +0100
Subject: [PATCH 67/85] nixos/apparmor: load bpf last unconditionally

---
 nixos/modules/security/default.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/security/default.nix b/nixos/modules/security/default.nix
index 5170383d6f5e..c1a4f7cf34a1 100644
--- a/nixos/modules/security/default.nix
+++ b/nixos/modules/security/default.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.security;
 in
@@ -16,10 +20,16 @@ in
   config = lib.mkMerge [
     {
       # We set the default LSM's here due to them not being present if set when enabling AppArmor.
-      security.lsm = [
-        "landlock"
-        "yama"
-        "bpf"
+      security.lsm = lib.mkMerge [
+        [
+          "landlock"
+          "yama"
+        ]
+        # Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
+        # Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
+        # It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
+        # passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
+        (lib.mkAfter [ "bpf" ])
       ];
     }
     (lib.mkIf (lib.lists.length cfg.lsm > 0) {

From 1e4dfdfec8fc0eaf6431d33afbdddde2dd696253 Mon Sep 17 00:00:00 2001
From: fliiiix <hi@l33t.name>
Date: Thu, 25 Jun 2026 08:26:03 +0200
Subject: [PATCH 68/85] nrpl: drop

Upstream is abandoned since 11 years.
https://github.com/wheineman/nrpl/pull/17

Either someone would need to fork it or
use alternatives like INim which seems maintained.
---
 pkgs/by-name/nr/nrpl/package.nix | 54 --------------------------------
 pkgs/top-level/aliases.nix       |  1 +
 2 files changed, 1 insertion(+), 54 deletions(-)
 delete mode 100644 pkgs/by-name/nr/nrpl/package.nix

diff --git a/pkgs/by-name/nr/nrpl/package.nix b/pkgs/by-name/nr/nrpl/package.nix
deleted file mode 100644
index c623f3a9da47..000000000000
--- a/pkgs/by-name/nr/nrpl/package.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  buildNimPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  makeWrapper,
-  nim,
-  pcre,
-  tinycc,
-}:
-
-buildNimPackage {
-  pname = "nrpl";
-  version = "20150522";
-
-  src = fetchFromGitHub {
-    owner = "wheineman";
-    repo = "nrpl";
-    rev = "6d6c189ab7d1c905cc29dc678d66e9e132026f69";
-    hash = "sha256-YpP1LJKX3cTPficoBUBGnUETwQX5rDCyIMxylSFNnrI=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pcre ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/wheineman/nrpl/pull/12.patch";
-      name = "update_for_new_nim.patch";
-      hash = "sha256-4fFj1RAxvQC9ysRBFlbEfMRPCzi+Rcu6lYEOC208zv0=";
-    })
-  ];
-
-  env.NIX_LDFLAGS = "-lpcre";
-
-  postFixup = ''
-    wrapProgram $out/bin/nrpl \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          nim
-          tinycc
-        ]
-      }
-  '';
-
-  meta = {
-    description = "REPL for the Nim programming language";
-    mainProgram = "nrpl";
-    homepage = "https://github.com/wheineman/nrpl";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ peterhoeg ];
-    platforms = with lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 560f3407cd17..f1f6a4e1db58 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1658,6 +1658,7 @@ mapAliases {
   notify-sharp = throw "'notify-sharp' has been removed as it was unmaintained and depends on deprecated dbus-sharp versions"; # Added 2025-08-25
   noto-fonts-emoji = throw "'noto-fonts-emoji' has been renamed to/replaced by 'noto-fonts-color-emoji'"; # Converted to throw 2025-10-27
   noto-fonts-extra = throw "'noto-fonts-extra' has been renamed to/replaced by 'noto-fonts'"; # Converted to throw 2025-10-27
+  nrpl = throw "'nrpl' has been removed as it depends on pcre, which is deprecated"; # Added 2026-06-25
   NSPlist = throw "'NSPlist' has been renamed to/replaced by 'nsplist'"; # Converted to throw 2025-10-27
   nuget-to-nix = throw "nuget-to-nix has been removed as it was deprecated in favor of nuget-to-json. Please use nuget-to-json instead"; # Added 2025-08-28
   nushellFull = throw "'nushellFull' has been renamed to/replaced by 'nushell'"; # Converted to throw 2025-10-27

From b2be0d99ea0f88b8251f7133218a77bfe38dc8f1 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Wed, 3 Jun 2026 20:23:09 +0200
Subject: [PATCH 69/85] mail-tlsa-check-exporter: init at 0-unstable-2025-06-12

---
 .../ma/mail-tlsa-check-exporter/package.nix   | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix

diff --git a/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix
new file mode 100644
index 000000000000..05aebe64bae1
--- /dev/null
+++ b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  makeWrapper,
+  nodejs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mail-tlsa-check-exporter";
+  version = "0-unstable-2025-06-12";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ietf-tools";
+    repo = "mail-tlsa-check-exporter";
+    rev = "9843bf85971fbe130e8cd32e6fcf0dfcee92e929";
+    hash = "sha256-5c3epExz3tv6gRiIfpDyV1pkfcRVWjtNpl93LWsYKdk=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/libexec
+    cp $src/index.mjs $out/libexec
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/mail-tlsa-check-exporter \
+      --append-flag $out/libexec/index.mjs
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch=main" ];
+  };
+
+  meta = {
+    description = "Validate SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter";
+    homepage = "https://github.com/ietf-tools/mail-tlsa-check-exporter";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ bartoostveen ];
+    mainProgram = "mail-tlsa-check-exporter";
+    platforms = lib.platforms.all;
+  };
+})

From cd65877bf57c0f6ba19da1578aa1371197990f54 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Wed, 3 Jun 2026 20:23:27 +0200
Subject: [PATCH 70/85] nixos/prometheus-exporters/mail-tlsa-check: init

---
 .../manual/release-notes/rl-2611.section.md   |   2 +
 .../monitoring/prometheus/exporters.nix       |   1 +
 .../prometheus/exporters/mail-tlsa-check.nix  | 164 ++++++++++++++++++
 3 files changed, 167 insertions(+)
 create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 314044b1b2c6..02bd3893ea4b 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -16,6 +16,8 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
+- [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
+
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 96ab896356f6..b1d7f62b582e 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -86,6 +86,7 @@ let
         "lnd"
         "mail"
         "mailman3"
+        "mail-tlsa-check"
         "mikrotik"
         "modemmanager"
         "mongodb"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix
new file mode 100644
index 000000000000..aa66a45daee2
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix
@@ -0,0 +1,164 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.mail-tlsa-check;
+
+  inherit (lib)
+    boolToString
+    collect
+    concatStringsSep
+    getExe
+    isBool
+    isList
+    isString
+    listToAttrs
+    mapAttrsRecursive
+    mkForce
+    mkOption
+    mkPackageOption
+    optionalAttrs
+    pipe
+    toUpper
+    types
+    ;
+
+  environment = pipe cfg.settings [
+    (mapAttrsRecursive (
+      path: value:
+      optionalAttrs (value != null) {
+        name = toUpper "MTCE_${concatStringsSep "_" path}";
+        value =
+          if isList value then
+            concatStringsSep "," value
+          else if isBool value then
+            boolToString value
+          else
+            toString value;
+      }
+    ))
+    (collect (x: isString x.name or false && isString x.value or false))
+    listToAttrs
+  ];
+in
+{
+  port = 19309;
+  extraOpts = {
+    package = mkPackageOption pkgs "mail-tlsa-check-exporter" { };
+    settings = mkOption {
+      description = "Settings for the mail-tlsa-check-exporter";
+      type = types.submodule {
+        freeformType = types.attrs;
+
+        options = {
+          tlsa.record = mkOption {
+            description = "The TLSA record to monitor";
+            type = types.str;
+            example = "_25._tcp.smtp.example.org";
+          };
+          check.timeout = mkOption {
+            description = "Timeout for validation checks to complete before giving up, in milliseconds (e.g. 15000 for 15 seconds)";
+            type = types.ints.positive;
+            default = 15000;
+            example = 10000;
+          };
+          ipv4.enabled = mkOption {
+            description = "Whether to enable monitoring over IPv4";
+            type = types.bool;
+            default = true;
+            example = false;
+          };
+          ipv6.enabled = mkOption {
+            description = "Whether to enable monitoring over IPv6";
+            type = types.bool;
+            default = true;
+            example = false;
+          };
+          server.port = mkOption {
+            description = ''
+              The port that the exporter listens on.
+
+              ::: {.note}
+              This is a read-only option that is read from {option}`services.prometheus.exporters.mail-tlsa-check.port`.
+              :::
+            '';
+            type = types.port;
+            default = cfg.port;
+            defaultText = lib.literalExpression "config.services.prometheus.exporters.mail-tlsa-check.port";
+            readOnly = true;
+          };
+          smtp = {
+            hostname = mkOption {
+              description = "The SMTP hostname to monitor";
+              type = types.nullOr types.str;
+              default = null;
+              example = "smtp.example.org";
+            };
+            port = mkOption {
+              description = ''
+                The SMTP port to monitor
+
+                ::: {.note}
+                The exporter currently only supports explicit TLS (StartTLS), see <https://github.com/ietf-tools/mail-tlsa-check-exporter/issues/6>
+                :::
+              '';
+              type = types.port;
+              default = 587;
+              example = 465;
+            };
+            client = mkOption {
+              description = "The host to send in the SMTP EHLO command (name/domain/IP address)";
+              type = types.str;
+              default = "tlsa-smtp-synthetics-probe";
+              example = "tlsa-exporter";
+            };
+          };
+          imap = {
+            hostname = mkOption {
+              description = "The IMAP hostname to monitor";
+              type = types.nullOr types.str;
+              default = null;
+              example = "imap.example.org";
+            };
+            port = mkOption {
+              description = ''
+                The IMAP port to monitor
+
+                ::: {.note}
+                The exporter currently only supports explicit TLS (StartTLS), see <https://github.com/ietf-tools/mail-tlsa-check-exporter/issues/6>
+                :::
+              '';
+              type = types.port;
+              default = 143;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  assertions = [
+    {
+      assertion = cfg.settings.ipv4.enabled || cfg.ipv6.enabled;
+      message = "Both IPv4 and IPv6 are disabled, this is not possible as it won't monitor anything";
+    }
+    {
+      assertion = cfg.settings.smtp.hostname != null || cfg.settings.imap.hostname != null;
+      message = "Both SMTP and IMAP are disabled, this is not possible as it won't monitor anything";
+    }
+  ];
+
+  serviceOpts = {
+    inherit environment;
+
+    serviceConfig = {
+      ExecStart = getExe cfg.package;
+      MemoryDenyWriteExecute = mkForce false; # because v8 won't start otherwise
+      Restart = "always"; # because apparently, this service crashes and is intended to do so, see the upstream systemd unit
+    };
+  };
+}

From b6cc664b526e8fc0967bd29a9c5d38453ea9a46b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 24 Jun 2026 08:46:22 +0200
Subject: [PATCH 71/85] python3Packages.tencentcloud-sdk-python: 3.1.120 ->
 3.1.121

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.120...3.1.121

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.121/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 21a2f7aa0da9..2730b3712475 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.120";
+  version = "3.1.121";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-VJnFj/NeGKT223boJWMZZC/LxHdu+pqNexd+ezuq/js=";
+    hash = "sha256-IHdCEfppGXZ2Q72X4EIt0rmACMl3l129xyhVqXpbZ0A=";
   };
 
   build-system = [ setuptools ];

From 5e4d57e664b9cb7b9d537839b7960c1ad6451937 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 25 Jun 2026 09:13:26 +0200
Subject: [PATCH 72/85] python3Packages.tencentcloud-sdk-python: 3.1.121 ->
 3.1.122

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.121...3.1.122

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.122/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 2730b3712475..198621e34494 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.121";
+  version = "3.1.122";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-IHdCEfppGXZ2Q72X4EIt0rmACMl3l129xyhVqXpbZ0A=";
+    hash = "sha256-7d8WdODzOG+zkz+Y9f2OpdL2z5i12QZFOzOpGrVGUXY=";
   };
 
   build-system = [ setuptools ];

From b83e853c2b86cbfe003ab649cce8e9caba3df75b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 25 Jun 2026 09:14:09 +0200
Subject: [PATCH 73/85] python3Packages.iamdata: 0.1.202606241 -> 0.1.202606251

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202606241...v0.1.202606251

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202606251
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 4e06b6135f5a..ae91f0c8d8f4 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606241";
+  version = "0.1.202606251";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7B6OPBlYW8k9uSuZ86dmY9ROdgKDcsFLjVqesIDb9r8=";
+    hash = "sha256-13k3Z5D181y0Ildl1ZcThA1Z3f69YHux6XN2PlM2MVk=";
   };
 
   __darwinAllowLocalNetworking = true;

From ef31608d466de7e45924ee1e9302fdd1ea962393 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 25 Jun 2026 09:27:36 +0200
Subject: [PATCH 74/85] python3Packages.claude-agent-sdk: 0.2.108 -> 0.2.110

Diff: https://github.com/anthropics/claude-agent-sdk-python/compare/v0.2.108...v0.2.110

Changelog: https://github.com/anthropics/claude-agent-sdk-python/blob/v0.2.110/CHANGELOG.md
---
 pkgs/development/python-modules/claude-agent-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index f977c605e5a0..b9aed7f1f68f 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.2.108";
+  version = "0.2.110";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RL4YtNUoW6YFg/5eM8ZAlUNNDBuZLu01qNShN7Ddlxc=";
+    hash = "sha256-tz26ueGAMFM7sD95FoAzhKHvNo7NV9fYZoKfJy/t8Lw=";
   };
 
   build-system = [ hatchling ];

From deb15e0aff2d0aa1d642b359c7964828e0118614 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 07:28:15 +0000
Subject: [PATCH 75/85] ananicy-rules-cachyos: 0-unstable-2026-06-15 ->
 0-unstable-2026-06-24

---
 pkgs/by-name/an/ananicy-rules-cachyos/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 9f082fd2af32..8cfac9b66729 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "70bc1a2c935518461e4e8d53d7c454489e26565d";
-    hash = "sha256-KJnZRXyl/iagknbFGh06dEtedMzJKZ+uDiXuP2OpMZE=";
+    rev = "c273ac846fade148468bce83d0221ed80d238c57";
+    hash = "sha256-upHgVyGnR6BIgXRzA3FCoryBukqx/CFp/39jKsc7BFo=";
   };
 
   dontConfigure = true;

From 2f707eb5586b6bd598e00671a906ef975ededaa7 Mon Sep 17 00:00:00 2001
From: XlNTARO <dmitrolutianskiy@gmail.com>
Date: Thu, 25 Jun 2026 10:36:43 +0300
Subject: [PATCH 76/85] makemkv: 1.18.3 -> 1.18.4

---
 pkgs/by-name/ma/makemkv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/makemkv/package.nix b/pkgs/by-name/ma/makemkv/package.nix
index 71993f3e84f4..4fa2687716d7 100644
--- a/pkgs/by-name/ma/makemkv/package.nix
+++ b/pkgs/by-name/ma/makemkv/package.nix
@@ -27,19 +27,19 @@ stdenv.mkDerivation (
         "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
       ];
-      hash = "sha256-we5yCukbJ2p8ib6GEUbFuTRjGDHo1sj0U0BkNXJOkr0=";
+      hash = "sha256-zuVt4LqlUxq+0WvYYnQtMI13K0q02uFu6GW/dPBKFgg=";
     };
     srcs.oss = fetchurl {
       urls = [
         "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
       ];
-      hash = "sha256-vIuwhK46q81QPVu5PvwnPgRuT9RmPTmpg2zgwEf+6CM=";
+      hash = "sha256-hZAGNkjULsKpWLdFc9cCLw9MM05OT+fdU7cMbnSLpFM=";
     };
   in
   {
     pname = "makemkv";
-    version = "1.18.3";
+    version = "1.18.4";
 
     srcs = lib.attrValues finalAttrs.passthru.srcs;
     sourceRoot = "makemkv-oss-${version}";

From 145397a6c50b247e9f6198ec53b440047a6e309c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 07:44:47 +0000
Subject: [PATCH 77/85] palemoon-bin: 34.3.0.1 -> 34.3.1

---
 pkgs/by-name/pa/palemoon-bin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/palemoon-bin/package.nix b/pkgs/by-name/pa/palemoon-bin/package.nix
index fbb903774a53..7de709e66c33 100644
--- a/pkgs/by-name/pa/palemoon-bin/package.nix
+++ b/pkgs/by-name/pa/palemoon-bin/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "34.3.0.1";
+  version = "34.3.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -171,11 +171,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-U9OwgiQMVOayt5Krlina2s33wS55HuLN255tkVyQxoY=";
+          hash = "sha256-PFsdDuer6mbxFrcT0rSADcOxunoJIo3Y6O4NG4R8ygY=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-Yzr2ovHKFFNIem1PXTaajlxVKXB5frZQ/kfOL+jsmtE=";
+          hash = "sha256-C48vM0LI6rPSS0wFVnPRlppT4I5EFnWzBFg/Rxw++Bw=";
         };
       };
 

From 45906568b22ea91b80ac4a74da6fcd2e33560bae Mon Sep 17 00:00:00 2001
From: Pierre Roux <pierre.roux@onera.fr>
Date: Wed, 24 Jun 2026 18:05:50 +0200
Subject: [PATCH 78/85] rocqPackages.hierarchy-builder: 1.10.2 -> 1.10.3

---
 pkgs/development/rocq-modules/hierarchy-builder/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/rocq-modules/hierarchy-builder/default.nix b/pkgs/development/rocq-modules/hierarchy-builder/default.nix
index 84f8c41c91ca..25e0621aab3e 100644
--- a/pkgs/development/rocq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/rocq-modules/hierarchy-builder/default.nix
@@ -17,10 +17,12 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
+        (case (range "9.0" "9.2") "1.10.3")
         (case (range "9.0" "9.1") "1.10.2")
         (case (range "9.0" "9.1") "1.10.0")
         (case (range "9.0" "9.1") "1.9.1")
       ] null;
+    release."1.10.3".hash = "sha256-y13KxzLulIu39Ci3aMc1cZG4tw3LL2ab7U9snI6jrXc=";
     release."1.10.2".sha256 = "sha256-Uzni9qrYQP45Tr+JkHs0BuRARwmWSMwA/iHhIzkolxc=";
     release."1.10.0".sha256 = "sha256-c52nS8I0tia7Q8lZTFJyHVPVabW9xv55m7w6B7y3+e8=";
     release."1.9.1".sha256 = "sha256-AiS0ezMyfIYlXnuNsVLz1GlKQZzJX+ilkrKkbo0GrF0=";

From d31f4a19992cc47ada8e7a1961aa302e810e7abb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 08:32:14 +0000
Subject: [PATCH 79/85] ctx7: 0.5.2 -> 0.5.3

---
 pkgs/by-name/ct/ctx7/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ct/ctx7/package.nix b/pkgs/by-name/ct/ctx7/package.nix
index aaa477fc26d0..67cca59a1728 100644
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.2";
+  version = "0.5.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-CAOFt/oKjeFOIesJCTQsAq0miXssEJKNMLcd6Eb9HZs=";
+    hash = "sha256-J3FS0HPpkuriuxEyY1dluwdMovdvgWUTFgBxVUlf+GA=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-C+4QgpSJa5sDZr/0ltxHeaPX7IJTgG957dK/iA5sFXs=";
+    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
   };
 
   buildPhase = ''

From 56913ae775f990b0bc49730e5fad21c64942c917 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Jun 2026 10:38:05 +0200
Subject: [PATCH 80/85] python3Packages.rq: disable racy test

It reaps a worker and checks if it has been removed right after, but this
is apparently racy.
---
 pkgs/development/python-modules/rq/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a53e08d86223..0efb763e3694 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -76,6 +76,10 @@ buildPythonPackage (finalAttrs: {
       # PermissionError: [Errno 13] Permission denied: '/tmp/rq-tests.txt'
       "test_deleted_jobs_arent_executed"
       "test_suspend_worker_execution"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # no delay between reaping worker and checking; racy
+      "test_reap_workers"
     ];
 
   pythonImportsCheck = [ "rq" ];

From 8e4f6c078d1bc0d813a6e6017ce4cfccbd8cc373 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Jun 2026 10:57:56 +0200
Subject: [PATCH 81/85] python3Packages.fusepy: skip imports check on darwin

Importing fusepy in the build sandbox cannot find the required runtime
libraries.
---
 pkgs/development/python-modules/fusepy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/fusepy/default.nix b/pkgs/development/python-modules/fusepy/default.nix
index 492418fdd3aa..51691711da24 100644
--- a/pkgs/development/python-modules/fusepy/default.nix
+++ b/pkgs/development/python-modules/fusepy/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
   # No tests included
   doCheck = false;
 
-  pythonImportsCheck = [ "fuse" ];
+  pythonImportsCheck = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "fuse" ];
 
   meta = {
     description = "Simple ctypes bindings for FUSE";

From d2b1d30e061d4bed4615295b3a226e3807a7f5e4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 25 Jun 2026 11:00:20 +0200
Subject: [PATCH 82/85] nodejs_26: 26.3.1 -> 26.4.0

---
 pkgs/development/web/nodejs/v26.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/web/nodejs/v26.nix b/pkgs/development/web/nodejs/v26.nix
index 500d00eaaef0..3be4bfbc98f9 100644
--- a/pkgs/development/web/nodejs/v26.nix
+++ b/pkgs/development/web/nodejs/v26.nix
@@ -23,13 +23,16 @@ let
       [ ];
 in
 buildNodejs {
-  version = "26.3.1";
-  sha256 = "979b9b8308a8d2d4a27c662ed50448c85f970c0fd4f5ce8b98e8da78c441f2bc";
+  version = "26.4.0";
+  sha256 = "9eceb3621024069d91035b5471d2ebe86aa04d22dbeba72a782eaf36ff9183ac";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
         [
-          ./configure-emulator.patch
+          (fetchpatch2 {
+            url = "https://github.com/nodejs/node/commit/b087e922bde7bfd0cb4b7340bb473ddbbb84ee85.patch?full_index=1";
+            hash = "sha256-338rkBx2OAKyaelFj6jePU+shl+KTAl29a8KBItbDqc=";
+          })
         ]
       else
         [

From bc00d2562d0095193d1707c9a4a382fa059458f6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Jun 2026 11:15:07 +0200
Subject: [PATCH 83/85] python3Packages.linearomdels: reduce openmp threads
 during tests

---
 pkgs/development/python-modules/linearmodels/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
index 9a5ae03ffe5f..d67690e48774 100644
--- a/pkgs/development/python-modules/linearmodels/default.nix
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage (finalAttrs: {
 
   preCheck = ''
     rm linearmodels/__init__.py
+
+    export OMP_NUM_THREADS=1
   '';
 
   disabledTestPaths = [

From af32b5d6aa89e1c116eb1786f1f874f34e94a392 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 09:58:10 +0000
Subject: [PATCH 84/85] tmc-cli: 1.1.2 -> 1.1.3

---
 pkgs/by-name/tm/tmc-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tm/tmc-cli/package.nix b/pkgs/by-name/tm/tmc-cli/package.nix
index 84913922d3d4..83959df50b34 100644
--- a/pkgs/by-name/tm/tmc-cli/package.nix
+++ b/pkgs/by-name/tm/tmc-cli/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tmc-cli";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "rage";
     repo = "tmc-cli-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C7X+XTOqquqf/W29+A4wUUl6aDZYLlc5XokkIOrCbp0=";
+    hash = "sha256-P6jlj9HWZ09vAw7EVT8po49eWGkGv/ppvKwnq06t2A0=";
   };
 
-  cargoHash = "sha256-2KoHKTN1Jvyvk9ravi0a9D+RIFYa1KmHLJQzKT2iP9A=";
+  cargoHash = "sha256-YUIEKr1nQij4f/4kOeJq6AgqeQq+U3bOBTJaJM2Bs2Y=";
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook

From ee20787914a09bae38369609c8c30ca8e5624d88 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 25 Jun 2026 12:53:16 +0200
Subject: [PATCH 85/85] python3Packages.nomadnet: 1.2.0 -> 1.2.6

---
 .../python-modules/nomadnet/default.nix            | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index fead49b3abc9..22abc385601c 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   lxmf,
   msgpack,
   qrcode,
@@ -12,15 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "1.2.0";
+  version = "1.2.6";
   pyproject = true;
+
   __structuredAttrs = true;
 
-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "NomadNet";
-    tag = finalAttrs.version;
-    hash = "sha256-BaRZfqQ9oNpWQc5uQ0PvVduauW3+gTnDljYeBXlmJ9w=";
+  src = fetchPypi {
+    inherit (finalAttrs) version pname;
+    hash = "sha256-XNRs4avq22JslxkSlqgTOj0bKuiVwam3i9bzoMAUjAU=";
   };
 
   build-system = [ setuptools ];
@@ -41,7 +40,6 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Off-grid, resilient mesh communication";
     homepage = "https://github.com/markqvist/NomadNet";
-    changelog = "https://github.com/markqvist/NomadNet/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       drupol