From e47cbf3942da373f1b0cba256ad08d38eab1ec6b Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 4 Jul 2025 22:03:37 +0300
Subject: [PATCH 01/51] nixos/systemd/repart: add extraArgs option

There's lots of options regarding dm-crypt, dm-verity and TPMs.
Creating individual NixOS options for all of them would be infeasible.
---
 nixos/modules/system/boot/systemd/repart.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/system/boot/systemd/repart.nix b/nixos/modules/system/boot/systemd/repart.nix
index b7ca00cf6a03..1240ee3244d1 100644
--- a/nixos/modules/system/boot/systemd/repart.nix
+++ b/nixos/modules/system/boot/systemd/repart.nix
@@ -85,6 +85,16 @@ in
         '';
         default = true;
       };
+
+      extraArgs = lib.mkOption {
+        description = ''
+          Extra command-line arguments to pass to systemd-repart.
+
+          See {manpage}`systemd-repart(8)` for all available options.
+        '';
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
     };
 
     systemd.repart = {
@@ -177,6 +187,7 @@ in
                                   --dry-run=no \
                                   --empty=${initrdCfg.empty} \
                                   --discard=${lib.boolToString initrdCfg.discard} \
+                                  ${utils.escapeSystemdExecArgs initrdCfg.extraArgs} \
                                   ${lib.optionalString (initrdCfg.device != null) initrdCfg.device}
               ''
             ];

From 28d41fc5912cc0526e9dae9388f9e7cadf9acb34 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 4 Jul 2025 22:50:49 +0300
Subject: [PATCH 02/51] nixos/tests/systemd-repart: make sizeDiff configurable

The +32M is not sufficient to create additional partitions.
Make it configurable.
---
 nixos/tests/systemd-repart.nix | 53 +++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/nixos/tests/systemd-repart.nix b/nixos/tests/systemd-repart.nix
index ab81ec0f370a..1cd7f85a3e57 100644
--- a/nixos/tests/systemd-repart.nix
+++ b/nixos/tests/systemd-repart.nix
@@ -9,30 +9,37 @@ with pkgs.lib;
 
 let
   # A testScript fragment that prepares a disk with some empty, unpartitioned
-  # space. and uses it to boot the test with. Takes a single argument `machine`
-  # from which the diskImage is extracted.
-  useDiskImage = machine: ''
-    import os
-    import shutil
-    import subprocess
-    import tempfile
+  # space. and uses it to boot the test with.
+  # Takes two arguments, `machine` from which the diskImage is extracted,
+  # as well an optional `sizeDiff` (defaulting to +32M), describing how should
+  # be resized.
+  useDiskImage =
+    {
+      machine,
+      sizeDiff ? "+32M",
+    }:
+    ''
+      import os
+      import shutil
+      import subprocess
+      import tempfile
 
-    tmp_disk_image = tempfile.NamedTemporaryFile()
+      tmp_disk_image = tempfile.NamedTemporaryFile()
 
-    shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
+      shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
 
-    subprocess.run([
-      "${machine.virtualisation.qemu.package}/bin/qemu-img",
-      "resize",
-      "-f",
-      "raw",
-      tmp_disk_image.name,
-      "+32M",
-    ])
+      subprocess.run([
+        "${machine.virtualisation.qemu.package}/bin/qemu-img",
+        "resize",
+        "-f",
+        "raw",
+        tmp_disk_image.name,
+        "${sizeDiff}",
+      ])
 
-    # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
-    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
-  '';
+      # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+    '';
 
   common =
     {
@@ -98,7 +105,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")
@@ -128,7 +135,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")
@@ -196,7 +203,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")

From f1054a79c85b9d3668193b44429036577e7d9a0c Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 4 Jul 2025 22:51:22 +0300
Subject: [PATCH 03/51] nixos/tests/systemd-repart: add Encrypt=tpm2 test

This uses repart to create a encrypted additional disk, configuring a
TPM2 SRK key to bind encryption to, configures it in crypttab, and later
ensures it's mounted.

It is similar to manually invoking systemd-cryptenroll manually, but
more declarative.
---
 nixos/tests/systemd-repart.nix | 65 ++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/nixos/tests/systemd-repart.nix b/nixos/tests/systemd-repart.nix
index 1cd7f85a3e57..96a33633dc46 100644
--- a/nixos/tests/systemd-repart.nix
+++ b/nixos/tests/systemd-repart.nix
@@ -115,6 +115,71 @@ in
       '';
   };
 
+  encrypt-tpm2 = makeTest {
+    name = "systemd-repart-encrypt-tpm2";
+    meta.maintainers = with maintainers; [ flokli ];
+
+    nodes.machine =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        imports = [ common ];
+
+        boot.initrd.systemd.enable = true;
+
+        boot.initrd.availableKernelModules = [ "dm_crypt" ];
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          created-crypt = {
+            device = "/dev/disk/by-partlabel/created-crypt";
+            crypttabExtraOpts = [ "tpm2-device=auto" ];
+          };
+        };
+        boot.initrd.systemd.repart.enable = true;
+        boot.initrd.systemd.repart.extraArgs = [
+          "--tpm2-pcrs=7"
+        ];
+        systemd.repart.partitions = {
+          "10-root" = {
+            Type = "linux-generic";
+          };
+          "10-crypt" = {
+            Type = "var";
+            Label = "created-crypt";
+            Format = "ext4";
+            Encrypt = "tpm2";
+          };
+        };
+        virtualisation.tpm.enable = true;
+        virtualisation.fileSystems = {
+          "/var" = {
+            device = "/dev/mapper/created-crypt";
+            fsType = "ext4";
+          };
+        };
+      };
+
+    testScript =
+      { nodes, ... }:
+      ''
+        ${useDiskImage {
+          inherit (nodes) machine;
+          sizeDiff = "+100M";
+        }}
+
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+
+        systemd_repart_logs = machine.succeed("journalctl --boot --unit systemd-repart.service")
+        assert "Encrypting future partition 2" in systemd_repart_logs
+
+        assert "/dev/mapper/created-crypt" in machine.succeed("mount")
+      '';
+  };
+
   after-initrd = makeTest {
     name = "systemd-repart-after-initrd";
     meta.maintainers = with maintainers; [ nikstur ];

From 58ec43ec22347d368677cb553406bc2b2bddb1a9 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 11 Jul 2025 13:46:07 -0500
Subject: [PATCH 04/51] libphonenumber: 9.0.8 -> 9.0.9

---
 pkgs/by-name/li/libphonenumber/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index f21c0bf91782..cac7299f18d1 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.8";
+  version = "9.0.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-PLQgZdf2As5dwoM/L8SCBCysXUrw56/cn2NDf4jM1ac=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gkmAdiqXaaTzWMaByOKooCI7WnKZCbWi1LYG5AijDhs=";
   };
 
   patches = [

From 39df2b2e8435c8fa4293d3970aca08c00a72c16a Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sun, 13 Jul 2025 23:14:37 +0000
Subject: [PATCH 05/51] mergiraf: 0.11.0 -> 0.12.1

Changelog: https://codeberg.org/mergiraf/mergiraf/releases/tag/v0.12.1
Diff: https://codeberg.org/mergiraf/mergiraf/compare/v0.11.0...v0.12.1
---
 pkgs/by-name/me/mergiraf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index b41bb53baee4..05a16236e6ef 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nzWRMCIeZ1RmZO4v5UqX1JrbN1UjBHkl/bYaERCzfew=";
+    hash = "sha256-09C5A9ToH3zzUlUcLDd/5wOOkWs4jmjaqI9HpzGebUU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9OjcEmed9nLM/fp6Qk/Gh9hTVnn5cqCxTUpAJUkI4/M=";
+  cargoHash = "sha256-TFGFHK35pary9nGG3XB474Bv2B8YW2X06NvInBLmcIA=";
 
   nativeCheckInputs = [ git ];
 

From b3bc1e31d0fc920cc11a79ed4f4bd202961addfb Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Mon, 14 Jul 2025 13:23:16 +0200
Subject: [PATCH 06/51] nixfmt[-rfc-style]: unstable -> 1.0.0

Also:
- Updates the update script to use stable versions going forward
- Make pkgs.nixfmt the -rfc-style version and remove the warning
- Create a (delayed) warning for the -rfc-style version to encourage
  switching to pkgs.nixfmt in a couple releases
- Add a release note for the above
---
 doc/release-notes/rl-2511.section.md          |  1 +
 pkgs/by-name/ni/nixfmt-rfc-style/date.txt     |  1 -
 pkgs/by-name/ni/nixfmt-rfc-style/update.sh    | 33 -------------------
 .../generated-package.nix                     |  6 ++--
 .../{nixfmt-rfc-style => nixfmt}/package.nix  | 20 ++++-------
 pkgs/by-name/ni/nixfmt/update.sh              | 27 +++++++++++++++
 pkgs/top-level/aliases.nix                    |  8 ++++-
 7 files changed, 44 insertions(+), 52 deletions(-)
 delete mode 100644 pkgs/by-name/ni/nixfmt-rfc-style/date.txt
 delete mode 100755 pkgs/by-name/ni/nixfmt-rfc-style/update.sh
 rename pkgs/by-name/ni/{nixfmt-rfc-style => nixfmt}/generated-package.nix (82%)
 rename pkgs/by-name/ni/{nixfmt-rfc-style => nixfmt}/package.nix (53%)
 create mode 100755 pkgs/by-name/ni/nixfmt/update.sh

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 1f28d5222632..cff56cf7cc7d 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -8,6 +8,7 @@
   this release sets the default march level to `la64v1.0`, covering the desktop and server processors of 3X5000
   and newer series. However, embedded chips without LSX (Loongson SIMD eXtension), such as 2K0300 SoC, are not
   supported. `pkgsCross.loongarch64-linux-embedded` can be used to build software and systems for these platforms.
+- The official Nix formatter `nixfmt` is now stable and available as `pkgs.nixfmt`, deprecating the temporary `pkgs.nixfmt-rfc-style` attribute. The classic `nixfmt` will stay available for some more time as `pkgs.nixfmt-classic`.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
 
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
deleted file mode 100644
index 24a34eca600b..000000000000
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ /dev/null
@@ -1 +0,0 @@
-2025-04-04
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/update.sh b/pkgs/by-name/ni/nixfmt-rfc-style/update.sh
deleted file mode 100755
index 9213c7396452..000000000000
--- a/pkgs/by-name/ni/nixfmt-rfc-style/update.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p cabal2nix curl jq
-#
-# This script will update the nixfmt-rfc-style derivation to the latest version using
-# cabal2nix.
-
-set -eo pipefail
-
-# This is the directory of this update.sh script.
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-
-derivation_file="${script_dir}/generated-package.nix"
-date_file="${script_dir}/date.txt"
-
-# This is the latest version of nixfmt-rfc-style branch on GitHub.
-new_version=$(curl --silent https://api.github.com/repos/nixos/nixfmt/git/refs/heads/master | jq '.object.sha' --raw-output)
-new_date=$(curl --silent https://api.github.com/repos/nixos/nixfmt/git/commits/"$new_version" | jq '.committer.date' --raw-output)
-
-echo "Updating nixfmt-rfc-style to version $new_date."
-echo "Running cabal2nix and outputting to ${derivation_file}..."
-
-cat > "$derivation_file" << EOF
-# This file has been autogenerate with cabal2nix.
-# Update via ./update.sh
-EOF
-
-cabal2nix --jailbreak \
-  "https://github.com/nixos/nixfmt/archive/${new_version}.tar.gz" \
-  >> "$derivation_file"
-
-date --date="$new_date" -I > "$date_file"
-
-echo "Finished."
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt/generated-package.nix
similarity index 82%
rename from pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
rename to pkgs/by-name/ni/nixfmt/generated-package.nix
index 1da633e8999d..03e7998038e4 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt/generated-package.nix
@@ -23,10 +23,10 @@
 }:
 mkDerivation {
   pname = "nixfmt";
-  version = "0.6.0";
+  version = "1.0.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/65af4b69133d19f534d97746c97c2d5b464f43b4.tar.gz";
-    sha256 = "0l0w3janvss1n1j7qkcml97zndm2jm2gbrzzs9d8l0ixnrw0cd5r";
+    url = "https://github.com/nixos/nixfmt/archive/v1.0.0.tar.gz";
+    sha256 = "0iy2p893b2b5y4mvhy0d62675a7nd8fc6jm9mr32v9h2baj9ii3p";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/package.nix b/pkgs/by-name/ni/nixfmt/package.nix
similarity index 53%
rename from pkgs/by-name/ni/nixfmt-rfc-style/package.nix
rename to pkgs/by-name/ni/nixfmt/package.nix
index 90e659765b68..93a198f73f2a 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/package.nix
+++ b/pkgs/by-name/ni/nixfmt/package.nix
@@ -3,30 +3,22 @@
   haskellPackages,
   lib,
   runCommand,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   inherit (haskell.lib.compose) overrideCabal justStaticExecutables;
 
-  overrides = rec {
-    version = "unstable-${lib.fileContents ./date.txt}";
-
+  overrides = {
     passthru.updateScript = ./update.sh;
 
     teams = [ lib.teams.formatter ];
 
-    preBuild = ''
-      echo -n 'nixpkgs-${version}' > .version
-    '';
-
     # These tests can be run with the following command.
     #
-    # $ nix-build -A nixfmt-rfc-style.tests
-    passthru.tests =
-      runCommand "nixfmt-rfc-style-tests" { nativeBuildInputs = [ nixfmt-rfc-style ]; }
-        ''
-          nixfmt --version > $out
-        '';
+    # $ nix-build -A nixfmt.tests
+    passthru.tests = runCommand "nixfmt-tests" { nativeBuildInputs = [ nixfmt ]; } ''
+      nixfmt --version > $out
+    '';
   };
   raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
 in
diff --git a/pkgs/by-name/ni/nixfmt/update.sh b/pkgs/by-name/ni/nixfmt/update.sh
new file mode 100755
index 000000000000..3a44a0c6279a
--- /dev/null
+++ b/pkgs/by-name/ni/nixfmt/update.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p cabal2nix curl jq
+#
+# This script will update the nixfmt derivation to the latest version using
+# cabal2nix.
+
+set -eo pipefail
+
+# This is the directory of this update.sh script.
+script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+derivation_file="${script_dir}/generated-package.nix"
+
+release_tag=$(curl --silent https://api.github.com/repos/NixOS/nixfmt/releases/latest | jq '.tag_name' --raw-output)
+
+echo "Updating nixfmt to version $release_tag."
+echo "Running cabal2nix and outputting to ${derivation_file}..."
+
+cat > "$derivation_file" << EOF
+# This file has been autogenerate with cabal2nix.
+# Update via ./update.sh
+EOF
+
+cabal2nix --jailbreak \
+  "https://github.com/nixos/nixfmt/archive/${release_tag}.tar.gz" \
+  >> "$derivation_file"
+
+echo "Finished."
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9789bd3c3de6..d2cbe7fd7b27 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1412,7 +1412,13 @@ mapAliases {
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = throw "nixUnstable has been removed. For bleeding edge (Nix master, roughly weekly updated) use nixVersions.git, otherwise use nixVersions.latest."; # Converted to throw 2024-04-22
   nix_2_3 = nixVersions.nix_2_3;
-  nixfmt = lib.warnOnInstantiate "nixfmt was renamed to nixfmt-classic. The nixfmt attribute may be used for the new RFC 166-style formatter in the future, which is currently available as nixfmt-rfc-style" nixfmt-classic; # Added 2024-03-31
+  nixfmt-rfc-style =
+    if lib.oldestSupportedReleaseIsAtLeast 2511 then
+      lib.warnOnInstantiate
+        "nixfmt-rfc-style is now the same as pkgs.nixfmt which should be used instead."
+        nixfmt # Added 2025-07-14
+    else
+      nixfmt;
 
   # When the nixops_unstable alias is removed, nixops_unstable_minimal can be renamed to nixops_unstable.
 

From 0f71d14cdb57160c829eb8d2ae113f859126a523 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 4 Jul 2025 07:44:10 +0200
Subject: [PATCH 07/51] lexbor: init at 2.4.0

---
 pkgs/by-name/le/lexbor/package.nix | 32 ++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 pkgs/by-name/le/lexbor/package.nix

diff --git a/pkgs/by-name/le/lexbor/package.nix b/pkgs/by-name/le/lexbor/package.nix
new file mode 100644
index 000000000000..e88ad0b9e96b
--- /dev/null
+++ b/pkgs/by-name/le/lexbor/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lexbor";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wsm+2L2ar+3LGyBXl39Vp9l1l5JONWvO0QbI87TDfWM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "Lexbor is development of an open source HTML Renderer library";
+    homepage = "https://github.com/lexbor/lexbor";
+    changelog = "https://github.com/lexbor/lexbor/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "lexbor";
+    platforms = lib.platforms.all;
+  };
+})

From d1a4769b38bad1538d8b7aab3d337809f5bb5bd3 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Mon, 14 Jul 2025 16:24:06 +0200
Subject: [PATCH 08/51] treewide: nixfmt-rfc-style -> nixfmt

Except:
- Instances in documentation, because people in older versions
  can't switch to nixfmt yet due to it having pointed to nixfmt-classic
  before
- In code that runs based on a CI Nixpkgs version, which is also a bit
  older still
- In update script shebangs, because many of them don't pin Nixpkgs, and run
  with whatever is in NIX_PATH (and it's not easy to fix this, see
  https://github.com/NixOS/nixpkgs/issues/425551)
---
 ci/default.nix                                                | 2 +-
 maintainers/scripts/auto-rebase/test/default.nix              | 4 ++--
 pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix  | 2 +-
 pkgs/build-support/dotnet/add-nuget-deps/default.nix          | 4 ++--
 pkgs/build-support/vm/default.nix                             | 2 +-
 pkgs/by-name/el/elm-land/package.nix                          | 4 ++--
 pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix             | 4 ++--
 pkgs/by-name/ni/nil/package.nix                               | 4 ++--
 pkgs/by-name/ni/nixfmt-tree/package.nix                       | 4 ++--
 pkgs/by-name/tr/treefmt/tests.nix                             | 4 ++--
 .../ruby-modules/bundler-update-script/default.nix            | 4 ++--
 pkgs/development/tools/build-managers/rebar3/default.nix      | 4 ++--
 pkgs/servers/mobilizon/default.nix                            | 4 ++--
 pkgs/tools/typesetting/tex/texlive/default.nix                | 4 ++--
 pkgs/top-level/release-haskell.nix                            | 2 +-
 15 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/ci/default.nix b/ci/default.nix
index 42eeadc67def..68fce29901a0 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -49,7 +49,7 @@ let
 
         programs.keep-sorted.enable = true;
 
-        # This uses nixfmt-rfc-style underneath,
+        # This uses nixfmt underneath,
         # the default formatter for Nix code.
         # See https://github.com/NixOS/nixfmt
         programs.nixfmt.enable = true;
diff --git a/maintainers/scripts/auto-rebase/test/default.nix b/maintainers/scripts/auto-rebase/test/default.nix
index fd6ce30d24ac..d57a3dabde60 100644
--- a/maintainers/scripts/auto-rebase/test/default.nix
+++ b/maintainers/scripts/auto-rebase/test/default.nix
@@ -9,7 +9,7 @@ let
     stdenvNoCC
     gitMinimal
     treefmt
-    nixfmt-rfc-style
+    nixfmt
     ;
 in
 
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation {
   nativeBuildInputs = [
     gitMinimal
     treefmt
-    nixfmt-rfc-style
+    nixfmt
   ];
   patchPhase = ''
     patchShebangs .
diff --git a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
index 3838271d4924..bf685185c764 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
@@ -13,7 +13,7 @@ pkgs.mkShell {
 
   packages = [
     pkgs.bash
-    pkgs.nixfmt-rfc-style
+    pkgs.nixfmt
   ];
 
   EMACS2NIX = src;
diff --git a/pkgs/build-support/dotnet/add-nuget-deps/default.nix b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
index 7ddd7a556d40..29359fc01a87 100644
--- a/pkgs/build-support/dotnet/add-nuget-deps/default.nix
+++ b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
@@ -5,7 +5,7 @@
   lib,
   replaceVarsWith,
   nuget-to-nix,
-  nixfmt-rfc-style,
+  nixfmt,
   nuget-to-json,
   cacert,
   fetchNupkg,
@@ -90,7 +90,7 @@ attrs
             replacements = {
               binPath = lib.makeBinPath [
                 nuget-to-nix
-                nixfmt-rfc-style
+                nixfmt
                 nuget-to-json
               ];
             };
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 73db05beaa39..ec9782e04b51 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -909,7 +909,7 @@ rec {
         nativeBuildInputs = [
           buildPackages.perl
           buildPackages.dpkg
-          buildPackages.nixfmt-rfc-style
+          buildPackages.nixfmt
         ];
       }
       ''
diff --git a/pkgs/by-name/el/elm-land/package.nix b/pkgs/by-name/el/elm-land/package.nix
index 92c09252b378..07b4c59f6a9b 100644
--- a/pkgs/by-name/el/elm-land/package.nix
+++ b/pkgs/by-name/el/elm-land/package.nix
@@ -7,7 +7,7 @@
   writeShellScript,
   nix-update,
   elm2nix,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 
 buildNpmPackage rec {
@@ -53,7 +53,7 @@ buildNpmPackage rec {
     cp "$(nix-build -A "$UPDATE_NIX_ATTR_PATH".src)/projects/cli/src/codegen/elm.json" elm.json
     trap 'rm -rf elm.json registry.dat &> /dev/null' EXIT
     ${lib.getExe elm2nix} convert > pkgs/by-name/el/elm-land/elm-srcs.nix
-    ${lib.getExe nixfmt-rfc-style} pkgs/by-name/el/elm-land/elm-srcs.nix
+    ${lib.getExe nixfmt} pkgs/by-name/el/elm-land/elm-srcs.nix
     ${lib.getExe elm2nix} snapshot
     cp registry.dat pkgs/by-name/el/elm-land/registry.dat
   '';
diff --git a/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix b/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
index 0b81afcdbd28..fe2fb3cfebc5 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
@@ -8,7 +8,7 @@
   nix-prefetch-git,
   nix,
   coreutils,
-  nixfmt-rfc-style,
+  nixfmt,
   makeWrapper,
 }:
 # Based on https://github.com/milahu/gclient2nix
@@ -19,7 +19,7 @@ let
     nix-prefetch-git
     nix
     coreutils
-    nixfmt-rfc-style
+    nixfmt
   ];
 in
 buildPythonPackage {
diff --git a/pkgs/by-name/ni/nil/package.nix b/pkgs/by-name/ni/nil/package.nix
index 23b85a6dd50e..4a534b06b729 100644
--- a/pkgs/by-name/ni/nil/package.nix
+++ b/pkgs/by-name/ni/nil/package.nix
@@ -3,7 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
   nix-update-script,
 }:
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   env = {
     CFG_RELEASE = version;
-    CFG_DEFAULT_FORMATTER = lib.getExe nixfmt-rfc-style;
+    CFG_DEFAULT_FORMATTER = lib.getExe nixfmt;
   };
 
   # might be related to https://github.com/NixOS/nix/issues/5884
diff --git a/pkgs/by-name/ni/nixfmt-tree/package.nix b/pkgs/by-name/ni/nixfmt-tree/package.nix
index a36a449b3449..d66d23ef3d2e 100644
--- a/pkgs/by-name/ni/nixfmt-tree/package.nix
+++ b/pkgs/by-name/ni/nixfmt-tree/package.nix
@@ -2,14 +2,14 @@
   lib,
   runCommand,
   treefmt,
-  nixfmt-rfc-style,
+  nixfmt,
   nixfmt-tree,
   git,
   writableTmpDirAsHomeHook,
 
   settings ? { },
   runtimeInputs ? [ ],
-  nixfmtPackage ? nixfmt-rfc-style,
+  nixfmtPackage ? nixfmt,
 
   # NOTE: `runtimePackages` is deprecated. Use `nixfmtPackage` and/or `runtimeInputs`.
   runtimePackages ? [ nixfmtPackage ],
diff --git a/pkgs/by-name/tr/treefmt/tests.nix b/pkgs/by-name/tr/treefmt/tests.nix
index 763bb14e5656..fd84f398012b 100644
--- a/pkgs/by-name/tr/treefmt/tests.nix
+++ b/pkgs/by-name/tr/treefmt/tests.nix
@@ -3,7 +3,7 @@
   runCommand,
   testers,
   treefmt,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   inherit (treefmt) buildConfig withConfig;
@@ -29,7 +29,7 @@ let
 
   nixfmtExamplePackage = withConfig {
     settings = nixfmtExampleConfig;
-    runtimeInputs = [ nixfmt-rfc-style ];
+    runtimeInputs = [ nixfmt ];
   };
 in
 {
diff --git a/pkgs/development/ruby-modules/bundler-update-script/default.nix b/pkgs/development/ruby-modules/bundler-update-script/default.nix
index 2135e42a2279..e248851bf7d8 100644
--- a/pkgs/development/ruby-modules/bundler-update-script/default.nix
+++ b/pkgs/development/ruby-modules/bundler-update-script/default.nix
@@ -7,7 +7,7 @@
   coreutils,
   git,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 
 attrPath:
@@ -22,7 +22,7 @@ let
         coreutils
         git
         nix
-        nixfmt-rfc-style
+        nixfmt
       ]
     }
     set -o errexit
diff --git a/pkgs/development/tools/build-managers/rebar3/default.nix b/pkgs/development/tools/build-managers/rebar3/default.nix
index e40040332bd1..db9a1b5986e7 100644
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@@ -12,7 +12,7 @@
   git,
   gnused,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
   rebar3-nix,
 }:
 
@@ -95,7 +95,7 @@ let
           git
           gnused
           nix
-          nixfmt-rfc-style
+          nixfmt
           (rebar3WithPlugins { globalPlugins = [ rebar3-nix ]; })
         ]
       }
diff --git a/pkgs/servers/mobilizon/default.nix b/pkgs/servers/mobilizon/default.nix
index 61dd5c7f8dfa..c62fe672acfc 100644
--- a/pkgs/servers/mobilizon/default.nix
+++ b/pkgs/servers/mobilizon/default.nix
@@ -8,7 +8,7 @@
   git,
   cmake,
   nixosTests,
-  nixfmt-rfc-style,
+  nixfmt,
   mobilizon-frontend,
   ...
 }:
@@ -145,7 +145,7 @@ mixRelease rec {
       set -eou pipefail
 
       ${lib.getExe mix2nix} '${src}/mix.lock' > pkgs/servers/mobilizon/mix.nix
-      ${lib.getExe nixfmt-rfc-style} pkgs/servers/mobilizon/mix.nix
+      ${lib.getExe nixfmt} pkgs/servers/mobilizon/mix.nix
     '';
     elixirPackage = beamPackages.elixir;
   };
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index b836687b7d9c..36435d58ff42 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -43,7 +43,7 @@
   makeFontsConf,
   useFixedHashes ? true,
   recurseIntoAttrs,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   stdenv = gcc12Stdenv;
@@ -151,7 +151,7 @@ let
         tl2nix = ./tl2nix.sed;
       }
       ''
-        xzcat "$tlpdbxz" | sed -rn -f "$tl2nix" | uniq | ${lib.getExe nixfmt-rfc-style} > "$out"
+        xzcat "$tlpdbxz" | sed -rn -f "$tl2nix" | uniq | ${lib.getExe nixfmt} > "$out"
       '';
 
   # map: name -> fixed-output hash
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 9350d267e323..124e77761ad8 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -346,7 +346,7 @@ let
         nix-script
         nix-tree
         nixfmt-classic
-        nixfmt-rfc-style
+        nixfmt
         nota
         nvfetcher
         oama

From b68cc636d3d150925699486e3122a1d8da4e4984 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 15 Jul 2025 22:14:56 +0200
Subject: [PATCH 09/51] treewide: Remove nixfmt-rfc-style from update script
 shebangs

Based on the Nixpkgs used and the version of nixfmt-rfc-style in that
version, it's likely that not the correct version is used.

Update scripts should instead run within a Nixpkgs development shell
(`nix-shell`/`nix develop`/`direnv`), where the correct version of
`nixfmt` (although `treefmt` should be preferred) is always available.
---
 maintainers/scripts/haskell/regenerate-hackage-packages.sh | 2 +-
 maintainers/scripts/haskell/update-cabal2nix-unstable.sh   | 2 +-
 pkgs/by-name/br/bruijn/update.sh                           | 2 +-
 pkgs/by-name/cr/creek/update.sh                            | 2 +-
 pkgs/by-name/dp/dprint/plugins/update-plugins.py           | 2 +-
 pkgs/by-name/ej/ejabberd/update.sh                         | 2 +-
 pkgs/by-name/fl/flow-control/update.sh                     | 2 +-
 pkgs/by-name/gr/gren/update.sh                             | 2 +-
 pkgs/by-name/ms/msgraph-cli/update.sh                      | 2 +-
 pkgs/by-name/mu/music-assistant/update-providers.py        | 2 +-
 pkgs/by-name/oa/oama/update.sh                             | 2 +-
 pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh      | 2 +-
 pkgs/by-name/ri/river/update.sh                            | 2 +-
 pkgs/by-name/wa/waylock/update.sh                          | 2 +-
 pkgs/development/beam-modules/elvis-erlang/default.nix     | 2 +-
 pkgs/development/beam-modules/erlang-ls/default.nix        | 2 +-
 pkgs/development/compilers/dotnet/update.sh                | 2 +-
 pkgs/servers/home-assistant/update-component-packages.py   | 2 +-
 18 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/maintainers/scripts/haskell/regenerate-hackage-packages.sh b/maintainers/scripts/haskell/regenerate-hackage-packages.sh
index 3b7c0a8297e1..58bb433f010e 100755
--- a/maintainers/scripts/haskell/regenerate-hackage-packages.sh
+++ b/maintainers/scripts/haskell/regenerate-hackage-packages.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nixfmt-rfc-style -I nixpkgs=.
+#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git -I nixpkgs=.
 
 set -euo pipefail
 
diff --git a/maintainers/scripts/haskell/update-cabal2nix-unstable.sh b/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
index 21c3686ad296..866e7d2a6639 100755
--- a/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
+++ b/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable nixfmt-rfc-style -I nixpkgs=.
+#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable -I nixpkgs=.
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.
diff --git a/pkgs/by-name/br/bruijn/update.sh b/pkgs/by-name/br/bruijn/update.sh
index 40454a4d226c..837a3a680170 100755
--- a/pkgs/by-name/br/bruijn/update.sh
+++ b/pkgs/by-name/br/bruijn/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils cabal2nix curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p coreutils cabal2nix curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/cr/creek/update.sh b/pkgs/by-name/cr/creek/update.sh
index a346ab54c950..566de58e738f 100755
--- a/pkgs/by-name/cr/creek/update.sh
+++ b/pkgs/by-name/cr/creek/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style
+#!nix-shell -i bash -p bash common-updater-scripts gnused
 
 latest_tag=$(list-git-tags --url=https://github.com/nmeum/creek | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/by-name/dp/dprint/plugins/update-plugins.py b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
index f065d673152b..54eab2a67355 100755
--- a/pkgs/by-name/dp/dprint/plugins/update-plugins.py
+++ b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python -p nix nixfmt-rfc-style 'python3.withPackages (pp: [ pp.requests ])'
+#!nix-shell -i python -p nix 'python3.withPackages (pp: [ pp.requests ])'
 
 import json
 import os
diff --git a/pkgs/by-name/ej/ejabberd/update.sh b/pkgs/by-name/ej/ejabberd/update.sh
index af29359a58b3..0db339651212 100755
--- a/pkgs/by-name/ej/ejabberd/update.sh
+++ b/pkgs/by-name/ej/ejabberd/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" erlang autoconf automake nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" erlang autoconf automake
 #shellcheck shell=bash
 
 set -eu -o pipefail
diff --git a/pkgs/by-name/fl/flow-control/update.sh b/pkgs/by-name/fl/flow-control/update.sh
index c48ce524f3ce..4016cee25a7d 100755
--- a/pkgs/by-name/fl/flow-control/update.sh
+++ b/pkgs/by-name/fl/flow-control/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style
+#!nix-shell -i bash -p bash common-updater-scripts gnused
 
 latest_tag=$(list-git-tags --url=https://github.com/neurocyte/flow | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/by-name/gr/gren/update.sh b/pkgs/by-name/gr/gren/update.sh
index 1b697ecb88dd..96133b395b25 100755
--- a/pkgs/by-name/gr/gren/update.sh
+++ b/pkgs/by-name/gr/gren/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p cabal2nix curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p cabal2nix curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/ms/msgraph-cli/update.sh b/pkgs/by-name/ms/msgraph-cli/update.sh
index d1bc45f25dac..66ed99778a18 100755
--- a/pkgs/by-name/ms/msgraph-cli/update.sh
+++ b/pkgs/by-name/ms/msgraph-cli/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nixfmt-rfc-style common-updater-scripts
+#!nix-shell -i bash -p curl gnused common-updater-scripts
 set -eEuo pipefail
 [ -z "${DEBUG:-}" ] || set -x
 cd "${BASH_SOURCE[0]%/*}"
diff --git a/pkgs/by-name/mu/music-assistant/update-providers.py b/pkgs/by-name/mu/music-assistant/update-providers.py
index 1bbb14572e2a..393dbca9500a 100755
--- a/pkgs/by-name/mu/music-assistant/update-providers.py
+++ b/pkgs/by-name/mu/music-assistant/update-providers.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i python3 -p "music-assistant.python.withPackages (ps: music-assistant.dependencies ++ (with ps; [ jinja2 packaging ]))" -p pyright ruff isort nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i python3 -p "music-assistant.python.withPackages (ps: music-assistant.dependencies ++ (with ps; [ jinja2 packaging ]))" -p pyright ruff isort
 import asyncio
 import json
 import os.path
diff --git a/pkgs/by-name/oa/oama/update.sh b/pkgs/by-name/oa/oama/update.sh
index 45af4b99fe59..6d4f581b99ee 100755
--- a/pkgs/by-name/oa/oama/update.sh
+++ b/pkgs/by-name/oa/oama/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p haskell.packages.ghc910.cabal2nix nix-prefetch-git curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p haskell.packages.ghc910.cabal2nix nix-prefetch-git curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh b/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
index ed3e7f9fe855..f28f3ada43bb 100755
--- a/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
+++ b/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash jq nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash jq zon2nix
 
 commit=$(nix-instantiate --eval -A river-bedload.src.rev | jq --raw-output)
 
diff --git a/pkgs/by-name/ri/river/update.sh b/pkgs/by-name/ri/river/update.sh
index 41bbe048223c..7d7875e5c8c6 100755
--- a/pkgs/by-name/ri/river/update.sh
+++ b/pkgs/by-name/ri/river/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash common-updater-scripts gnused zon2nix
 
 latest_tag=$(list-git-tags --url=https://codeberg.org/river/river | sed 's/^v//' | sort --version-sort | tail --lines=1)
 
diff --git a/pkgs/by-name/wa/waylock/update.sh b/pkgs/by-name/wa/waylock/update.sh
index 5caa604fce9f..8ee3e33ad250 100755
--- a/pkgs/by-name/wa/waylock/update.sh
+++ b/pkgs/by-name/wa/waylock/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash common-updater-scripts gnused zon2nix
 
 latest_tag=$(list-git-tags --url=https://codeberg.org/ifreund/waylock | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/development/beam-modules/elvis-erlang/default.nix b/pkgs/development/beam-modules/elvis-erlang/default.nix
index 9599f9f335a3..114df9b06b50 100644
--- a/pkgs/development/beam-modules/elvis-erlang/default.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/default.nix
@@ -29,7 +29,7 @@ rebar3Relx rec {
 
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p bash common-updater-scripts git nix-prefetch-git gnutar gzip "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" nixfmt-rfc-style
+    #!nix-shell -i bash -p bash common-updater-scripts git nix-prefetch-git gnutar gzip "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}"
 
     set -euo pipefail
 
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index 548cb2ee4d06..8372aaccbafb 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -74,7 +74,7 @@ rebar3Relx {
 
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip nixfmt-rfc-style "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"
+    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"
 
     set -ox errexit
     latest=$(list-git-tags | sed -n '/[\d\.]\+/p' | sort -V | tail -1)
diff --git a/pkgs/development/compilers/dotnet/update.sh b/pkgs/development/compilers/dotnet/update.sh
index 2e4b41244d70..8dd35a3bc0bb 100755
--- a/pkgs/development/compilers/dotnet/update.sh
+++ b/pkgs/development/compilers/dotnet/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix gnused nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix gnused
 # shellcheck shell=bash
 
 set -Eeuo pipefail
diff --git a/pkgs/servers/home-assistant/update-component-packages.py b/pkgs/servers/home-assistant/update-component-packages.py
index a6433c9b96b4..c7ff548bd427 100755
--- a/pkgs/servers/home-assistant/update-component-packages.py
+++ b/pkgs/servers/home-assistant/update-component-packages.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort nixfmt-rfc-style
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort
 #
 # This script downloads Home Assistant's source tarball.
 # Inside the homeassistant/components directory, each integration has an associated manifest.json,

From 04453b87c57db33de19b05f148ec8f300dd4a767 Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Thu, 3 Jul 2025 23:06:27 +0200
Subject: [PATCH 10/51] k3s_1_32: 1.32.5+k3s1 -> 1.32.6+k3s1

https://github.com/k3s-io/k3s/releases/tag/v1.32.6%2Bk3s1
---
 .../cluster/k3s/1_32/images-versions.json        | 16 ++++++++--------
 .../networking/cluster/k3s/1_32/versions.nix     | 12 ++++++------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index bd12302b1afe..410a19d952fa 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "ac1f278f1b006851d95cd3236e9b909264872e9f6b5ffcf90d28198c6f2e913c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "11350d97016e084bff9d0410e3abfb0ed5dd5920378565584e88996b0a6e2da4"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c87b652cc8469019668ba5481e00b0d253e7d582e6139cb3a086b01682329f5e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1aa4286b30b5418df7b94782b70bcf79644da6c2d77bc5ab643da9c69e0290ac"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c7ebe524d0d596ff9b45695770cbd76f8fd672236c563da947ca5cb2d0a64aad"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "cff2d5270b5702b5813f662af7e1f0a741ea3a1052cc81629de6eee1d5a767bd"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-images.txt",
-    "sha256": "aa8e10337aef453cb17e6408dbaec9eb2da409ca6ba1f8bc7332fcef97fdaf3a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-images.txt",
+    "sha256": "637ccb5f5a8f4a7d13991cb3060f05b8c7c46e7351e0edae351f9ad23bb51631"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index 4aa03d7f48eb..b8dea807d758 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.32.5+k3s1";
-  k3sCommit = "8e8f2a4726fdb4ca628eb62b2a526b64d0e6a763";
-  k3sRepoSha256 = "02qsw00f0k0kv93xws96np3fj3rdynnhjhk41a58kic1mnbgm8ss";
-  k3sVendorHash = "sha256-BZs3tgUtcLw1mqaAyOCwg6bhmeQbUGCE9wsbPSG61t4=";
+  k3sVersion = "1.32.6+k3s1";
+  k3sCommit = "eb603acd1530edcaf79a4a8ed3da54e9e03d9967";
+  k3sRepoSha256 = "05py458rdrys1hkw8rg62c98lnwjij5zby8n2zkl1kbfqy12adln";
+  k3sVendorHash = "sha256-K8vlX8rucbAOCxHbgrWHsMBWiRc/98IJVCYS8UD+ZsI=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.6.0-k3s1";
-  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  k3sCNIVersion = "1.7.1-k3s1";
+  k3sCNISha256 = "0k1qfmsi5bqgwd5ap8ndimw09hsxn0cqf4m5ad5a4mgl6akw6dqz";
   containerdVersion = "2.0.5-k3s1.32";
   containerdSha256 = "1la7ygx5caqfqk025wyrxmhjb0xbpkzwnxv52338p33g68sb3yb0";
   criCtlVersion = "1.31.0-k3s2";

From f71674b4140d6fe88750401d766e9ab714969a73 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 19:46:21 +0000
Subject: [PATCH 11/51] supersonic-wayland: 0.16.0 -> 0.17.0

---
 pkgs/by-name/su/supersonic/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/su/supersonic/package.nix b/pkgs/by-name/su/supersonic/package.nix
index 635befdf2bd3..9ed08e200f4e 100644
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.hostPlatform.isLinux;
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     rev = "v${version}";
-    hash = "sha256-KC5olxn1+H/Y7HCOvsNPitcGgUgh+Ye2Te1yFffr7cs=";
+    hash = "sha256-+MgDCI/wz5yfdpSy0Gh85ZWUAuL2wijixYskx/jH7Vw=";
   };
 
-  vendorHash = "sha256-uHOeeCtnwZfJ3fHTPL/MtvQZeOQ8NEgMnpiXAPjY6YE=";
+  vendorHash = "sha256-v6tPGjeJhRdSJpVPQAERRM7cpXO7Ut7kLF3EdNcDFgM=";
 
   nativeBuildInputs =
     [

From abcb95b34a0be175b99dfa8ec2d4825792899362 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jul 2025 08:03:32 +0000
Subject: [PATCH 12/51] python3Packages.yosys: 0.54 -> 0.55

---
 pkgs/by-name/yo/yosys/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix
index f42939b2d906..4a765d71b81c 100644
--- a/pkgs/by-name/yo/yosys/package.nix
+++ b/pkgs/by-name/yo/yosys/package.nix
@@ -85,13 +85,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "yosys";
-  version = "0.54";
+  version = "0.55";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "yosys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yEAZvdBc+923a0OTtaCpTbrl33kcmvgwFlL5VEssHkQ=";
+    hash = "sha256-GddNbAtH5SPm7KTa5kCm/vGq4xOczx+jCnOSQl55gUI=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''

From fd33568f8c1c96512c6acbe1e91f0f10d9b8bf39 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jul 2025 10:09:47 +0000
Subject: [PATCH 13/51] bootc: 1.4.0 -> 1.5.0

---
 pkgs/by-name/bo/bootc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bo/bootc/package.nix b/pkgs/by-name/bo/bootc/package.nix
index e0f4f3a0473c..72a4384a9dd5 100644
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bootc";
-  version = "1.4.0";
+  version = "1.5.0";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
+  cargoHash = "sha256-3/Ngq6ZHPoE9BMychv+Jg0LhtJrY8GPrFYu7lRvX1+k=";
   doInstallCheck = true;
 
   src = fetchFromGitHub {
     owner = "bootc-dev";
     repo = "bootc";
     rev = "v${version}";
-    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
+    hash = "sha256-1u4pBiySYzudFVf4bayQ7FbXf4EjA4v1+AOX9E+tjyA=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From ad8aaecc3731f01d6cc2c0ccb5f5656014fc049e Mon Sep 17 00:00:00 2001
From: Patrizio Bekerle <patrizio@bekerle.com>
Date: Thu, 17 Jul 2025 14:59:01 +0200
Subject: [PATCH 14/51] qownnotes: 25.6.5 -> 25.7.7

Signed-off-by: Patrizio Bekerle <patrizio@bekerle.com>
---
 nixos/tests/qownnotes.nix             | 4 +++-
 pkgs/by-name/qo/qownnotes/package.nix | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/qownnotes.nix b/nixos/tests/qownnotes.nix
index 3c5de65e5cfc..aafdd080be70 100644
--- a/nixos/tests/qownnotes.nix
+++ b/nixos/tests/qownnotes.nix
@@ -54,7 +54,9 @@
           machine.send_key("ret")
           machine.wait_for_text("Nextcloud")
           machine.send_key("ret")
-          machine.wait_for_text("App metric")
+
+          # OCR can't detect "App metric" anymore, so we will wait for another text
+          machine.wait_for_text("Open network settings")
           machine.send_key("ret")
 
           # Doesn't work for non-root
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 8f943ca004ec..1932047a1b0a 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.6.5";
+  version = "25.7.7";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-P53v7Zcx6TtCRyFUTea9tpYTFx6DpXL5R60uH8qcbXk=";
+    hash = "sha256-9ldUIT3pQlkO2YhQ3cF9H6Soe8IU4AGEGNRWg0LA1MQ=";
   };
 
   nativeBuildInputs =

From 192be5c8f5811752b8134347c312dfcb7d1ef287 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Thu, 17 Jul 2025 15:47:36 +0000
Subject: [PATCH 15/51] anubis: 1.20.0 -> 1.21.0

Changelog: https://github.com/TecharoHQ/anubis/releases/tag/v1.21.0
Diff: https://github.com/TecharoHQ/anubis/compare/v1.20.0...v1.21.0
---
 pkgs/by-name/an/anubis/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/an/anubis/package.nix b/pkgs/by-name/an/anubis/package.nix
index fc026c175bcc..43a00eefe288 100644
--- a/pkgs/by-name/an/anubis/package.nix
+++ b/pkgs/by-name/an/anubis/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "anubis";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "TecharoHQ";
     repo = "anubis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pdfe2D9KAg/vesTgOi+b5ZVkUkuWhmZC/xYXiiYzlPs=";
+    hash = "sha256-FKX8E32unAKK8e/Nlrj24FU1amc7AJw28hzmZDbIcIc=";
   };
 
-  vendorHash = "sha256-cOl+eVnj6aMKIJCjCM0aacp4/Jg5BhZqFwum+u9tOKE=";
+  vendorHash = "sha256-cWkC3Bqut5h3hHh5tPIPeHMnkwoqKMnG1x40uCtUIwI=";
 
   nativeBuildInputs = [
     esbuild
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
     pname = "anubis-xess";
     inherit (finalAttrs) version src;
 
-    npmDepsHash = "sha256-kBnexaBAMgA7QdKevW3mmlSn+QEbkTW//hYVTRFLQeQ=";
+    npmDepsHash = "sha256-jvYmAbbMRy8fK2Y0YC0UJGhNRLzk1kjzGvRbqhWFzS4=";
 
     buildPhase = ''
       runHook preBuild

From f3cb23aadcbba866b5e996aa8a93aa1b5f7eb016 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 17 Jul 2025 17:38:44 +0000
Subject: [PATCH 16/51] erlang_26: 26.2.5.13 -> 26.2.5.14

https://github.com/erlang/otp/releases/tag/OTP-26.2.5.14
---
 pkgs/development/interpreters/erlang/26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/26.nix b/pkgs/development/interpreters/erlang/26.nix
index b18854070055..78891d06af72 100644
--- a/pkgs/development/interpreters/erlang/26.nix
+++ b/pkgs/development/interpreters/erlang/26.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "26.2.5.13";
-  sha256 = "sha256-imgI9qgAi17wN/QHVC3JKrmOArq3i2k+xMg8yBK2VrQ=";
+  version = "26.2.5.14";
+  sha256 = "sha256-/m76FtCJvIjNuvM96XV3ngFMgKF8C5uCH89YQklJKpo=";
 }

From 0c1905e5776fe568f1339fff6b7d41b39d9f54af Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 17 Jul 2025 17:39:20 +0000
Subject: [PATCH 17/51] erlang_27: 27.3.4.1 -> 27.3.4.2

https://github.com/erlang/otp/releases/tag/OTP-27.3.4.2
---
 pkgs/development/interpreters/erlang/27.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 599cebd342bc..bc6b0507aac8 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "27.3.4.1";
-  sha256 = "sha256-L9VgcdO1TyLNm+vke90w6Xuq/T3uKzmU4d0uYEfyQlc=";
+  version = "27.3.4.2";
+  sha256 = "sha256-wbaRSTwTrNADbShNHoWorWyD+2ul6NZbRs6isP3g+OI=";
 }

From f276e9ba3dee7379f948c6f4dd325abd41a5b6a4 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 17 Jul 2025 17:39:52 +0000
Subject: [PATCH 18/51] erlang_28: 28.0.1 -> 28.0.2

https://github.com/erlang/otp/releases/tag/OTP-28.0.2
---
 pkgs/development/interpreters/erlang/28.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 8c6e4ee19148..e9594b18621f 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "28.0.1";
-  sha256 = "sha256-eWDDreijr7RRmr6sVNuGpQ0qmynN4FTsiBXB8DOWKr4=";
+  version = "28.0.2";
+  sha256 = "sha256-4+Jv7MUX4KAwasNyU7AiV9+Qd9NginYXTN0fDteTFEM=";
 }

From ee4bf900d926ea561abd181ce28828f83d94996b Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Sun, 9 Mar 2025 09:54:45 +0100
Subject: [PATCH 19/51] prometheus-cpp: propagate curl and zlib

These are needed when building a downstream package that uses CMake
to find prometheus-cpp as a dependency.
---
 pkgs/by-name/pr/prometheus-cpp/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/prometheus-cpp/package.nix b/pkgs/by-name/pr/prometheus-cpp/package.nix
index 2a0f4a88c5ea..d656565f7bee 100644
--- a/pkgs/by-name/pr/prometheus-cpp/package.nix
+++ b/pkgs/by-name/pr/prometheus-cpp/package.nix
@@ -27,12 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
-    curl
     gbenchmark
     gtest
+  ];
+  propagatedBuildInputs = [
+    civetweb
+    curl
     zlib
   ];
-  propagatedBuildInputs = [ civetweb ];
   strictDeps = true;
 
   cmakeFlags = [

From 701b8c9267de7407955ebfe09b91e28d933c0dbf Mon Sep 17 00:00:00 2001
From: Tobias Mayer <tobim@fastmail.fm>
Date: Sun, 9 Mar 2025 09:56:37 +0100
Subject: [PATCH 20/51] zeek: 6.2.1 -> 7.2.1

---
 ...clude-path-in-exported-CMake-targets.patch | 75 -------------------
 pkgs/by-name/ze/zeek/broker/default.nix       | 33 ++++----
 pkgs/by-name/ze/zeek/fix-installation.patch   |  7 +-
 pkgs/by-name/ze/zeek/package.nix              | 13 ++--
 4 files changed, 27 insertions(+), 101 deletions(-)
 delete mode 100644 pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch

diff --git a/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch b/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
deleted file mode 100644
index 07b95960ef85..000000000000
--- a/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 889ee4dd9e778511e2fb850e6467f55a331cded9 Mon Sep 17 00:00:00 2001
-From: Tobias Mayer <tobim@fastmail.fm>
-Date: Sun, 13 Nov 2022 19:06:00 +0100
-Subject: [PATCH] Fix include path in exported CMake targets
-
----
- CMakeLists.txt | 23 ++++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e22b77aa..77a15314 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -209,7 +209,6 @@ if (CAF_ROOT)
-   else()
-     find_package(CAF REQUIRED COMPONENTS openssl test io core net)
-   endif()
--  list(APPEND LINK_LIBS CAF::core CAF::io CAF::net)
-   set(BROKER_USE_EXTERNAL_CAF ON)
- else ()
-   message(STATUS "Using bundled CAF")
-@@ -243,22 +242,18 @@ endif ()
- 
- # Make sure there are no old header versions on disk.
- install(
--  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_INSTALL_PREFIX}/include/broker\")"
--  CODE "file(REMOVE_RECURSE \"${CMAKE_INSTALL_PREFIX}/include/broker\")")
-+  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")"
-+  CODE "file(REMOVE_RECURSE \"${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")")
- 
- # Install all headers except the files from broker/internal.
- install(DIRECTORY include/broker
--        DESTINATION include
-+        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
-         FILES_MATCHING PATTERN "*.hh"
-                        PATTERN "include/broker/internal" EXCLUDE)
- 
--include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/include)
--
--include_directories(${CMAKE_CURRENT_BINARY_DIR}/include)
--
- configure_file(${CMAKE_CURRENT_SOURCE_DIR}/src/config.hh.in
-                ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh)
--install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION include/broker)
-+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/broker")
- 
- if (NOT BROKER_EXTERNAL_SQLITE_TARGET)
-   include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty)
-@@ -360,6 +355,11 @@ if (ENABLE_SHARED)
-                         OUTPUT_NAME broker)
-   target_link_libraries(broker PUBLIC ${LINK_LIBS})
-   target_link_libraries(broker PRIVATE CAF::core CAF::io CAF::net)
-+  target_include_directories(
-+    broker PUBLIC
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-   install(TARGETS broker
-           EXPORT BrokerTargets
-           DESTINATION ${CMAKE_INSTALL_LIBDIR})
-@@ -373,6 +373,11 @@ if (ENABLE_STATIC)
-   endif()
-   target_link_libraries(broker_static PUBLIC ${LINK_LIBS})
-   target_link_libraries(broker_static PRIVATE CAF::core CAF::io CAF::net)
-+  target_include_directories(
-+    broker_static PUBLIC
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-   install(TARGETS broker_static
-           EXPORT BrokerTargets
-           DESTINATION ${CMAKE_INSTALL_LIBDIR})
--- 
-2.38.1
-
diff --git a/pkgs/by-name/ze/zeek/broker/default.nix b/pkgs/by-name/ze/zeek/broker/default.nix
index bd2591019582..c226782b5b62 100644
--- a/pkgs/by-name/ze/zeek/broker/default.nix
+++ b/pkgs/by-name/ze/zeek/broker/default.nix
@@ -3,32 +3,31 @@
   lib,
   fetchFromGitHub,
   cmake,
+  prometheus-cpp,
   python3,
   caf,
   openssl,
 }:
 let
-  inherit (stdenv.hostPlatform) isStatic;
-
   src-cmake = fetchFromGitHub {
     owner = "zeek";
     repo = "cmake";
-    rev = "1be78cc8a889d95db047f473a0f48e0baee49f33";
-    hash = "sha256-zcXWP8CHx0RSDGpRTrYD99lHlqSbvaliXrtFowPfhBk=";
+    rev = "fd0696f9077933660f7da5f81978e86b3e967647";
+    hash = "sha256-21wZVwoOB05l/WX/VrVbSx+lFKFQ9MHWjQQD4weavFs=";
   };
   src-3rdparty = fetchFromGitHub {
     owner = "zeek";
     repo = "zeek-3rdparty";
-    rev = "eb87829547270eab13c223e6de58b25bc9a0282e";
-    hash = "sha256-AVaKcRjF5ZiSR8aPSLBzSTeWVwGWW/aSyQJcN0Yhza0=";
+    rev = "a6cc3c7603bb535cf3bec7442140e7126e0577a8";
+    hash = "sha256-yzhuTam9zOQ3MP7fk+ACN5P5tHtHXWbyQP73DwISIv8=";
   };
   caf' = caf.overrideAttrs (old: {
-    version = "unstable-2024-01-07-zeek";
+    version = "unstable-2024-09-14-zeek";
     src = fetchFromGitHub {
       owner = "zeek";
       repo = "actor-framework";
-      rev = "e3048cdd13e085c97870a55eb1f9de04e25320f3";
-      hash = "sha256-uisoYXiZbFQa/TfWGRrCJ23MX4bg8Ds86ffC8sZSRNQ=";
+      rev = "10afbbc5ee40263b258b7cf3f0e5abb436f79e89";
+      hash = "sha256-R22eKAFNP2VVA4eL6ycN6aHM0NgDHVll9aFNmOQ/pDc=";
     };
     cmakeFlags = old.cmakeFlags ++ [
       "-DCAF_ENABLE_TESTING=OFF"
@@ -36,9 +35,9 @@ let
     doCheck = false;
   });
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "zeek-broker";
-  version = "6.2.0";
+  version = "2.6.0-unstable-2025-04-23";
   outputs = [
     "out"
     "py"
@@ -49,8 +48,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "zeek";
     repo = "broker";
-    rev = "v${version}";
-    hash = "sha256-SG5TzozKvYc7qcEPJgiEtsxgzdZbbJt90lmuUbCPyv0=";
+    rev = "5b6cbb8c2d9124aa1fb0bea5799433138dc64cf9";
+    hash = "sha256-L6Z+ltX3tJEwZ05zEftrJlOhwbhs06MY9cEJDM2kcck=";
   };
   postUnpack = ''
     rmdir $sourceRoot/cmake $sourceRoot/3rdparty
@@ -62,10 +61,6 @@ stdenv.mkDerivation rec {
     touch $sourceRoot/bindings/python/3rdparty/pybind11/CMakeLists.txt
   '';
 
-  patches = [
-    ./0001-Fix-include-path-in-exported-CMake-targets.patch
-  ];
-
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace bindings/python/CMakeLists.txt --replace " -u -r" ""
   '';
@@ -76,14 +71,16 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     openssl
+    prometheus-cpp
     python3.pkgs.pybind11
   ];
   propagatedBuildInputs = [ caf' ];
 
   cmakeFlags = [
     "-DCAF_ROOT=${caf'}"
-    "-DENABLE_STATIC_ONLY:BOOL=${if isStatic then "ON" else "OFF"}"
+    "-DENABLE_STATIC_ONLY:BOOL=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
     "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
+    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ze/zeek/fix-installation.patch b/pkgs/by-name/ze/zeek/fix-installation.patch
index 135e8c314678..7a1d98c818c3 100644
--- a/pkgs/by-name/ze/zeek/fix-installation.patch
+++ b/pkgs/by-name/ze/zeek/fix-installation.patch
@@ -28,7 +28,7 @@ diff --git a/auxil/zeekctl/CMakeLists.txt b/auxil/zeekctl/CMakeLists.txt
 index 1ebe7c2..1435509 100644
 --- a/auxil/zeekctl/CMakeLists.txt
 +++ b/auxil/zeekctl/CMakeLists.txt
-@@ -9,7 +9,7 @@ file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/VERSION" VERSION LIMIT_COUNT 1)
+@@ -9,7 +9,7 @@
  set(PREFIX "${CMAKE_INSTALL_PREFIX}")
  set(LIBDIR "${CMAKE_INSTALL_FULL_LIBDIR}")
  set(ZEEKSCRIPTDIR "${ZEEK_SCRIPT_INSTALL_PATH}")
@@ -37,7 +37,7 @@ index 1ebe7c2..1435509 100644
  
  ########################################################################
  ## Dependency Configuration
-@@ -186,38 +186,9 @@ else ()
+@@ -186,41 +186,9 @@
      set(LOGS ${VAR}/logs)
  endif ()
  
@@ -56,6 +56,8 @@ index 1ebe7c2..1435509 100644
 -            DIRECTORY_PERMISSIONS ${perms})
 -    install(DIRECTORY DESTINATION ${SPOOL}/brokerstore
 -            DIRECTORY_PERMISSIONS ${perms})
+-    install(DIRECTORY DESTINATION ${SPOOL}/extract_files
+-            DIRECTORY_PERMISSIONS ${perms})
 -    install(DIRECTORY DESTINATION ${LOGS}
 -            DIRECTORY_PERMISSIONS ${perms})
 -    set(EMPTY_WORLD_DIRS
@@ -65,6 +67,7 @@ index 1ebe7c2..1435509 100644
 -    install(DIRECTORY DESTINATION ${SPOOL})
 -    install(DIRECTORY DESTINATION ${SPOOL}/tmp)
 -    install(DIRECTORY DESTINATION ${SPOOL}/brokerstore)
+-    install(DIRECTORY DESTINATION ${SPOOL}/extract_files)
 -    install(DIRECTORY DESTINATION ${LOGS})
 -endif ()
 -
diff --git a/pkgs/by-name/ze/zeek/package.nix b/pkgs/by-name/ze/zeek/package.nix
index 95ae96c323f6..f2040d9ba2da 100644
--- a/pkgs/by-name/ze/zeek/package.nix
+++ b/pkgs/by-name/ze/zeek/package.nix
@@ -28,13 +28,13 @@ let
     p.semantic-version
   ]);
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zeek";
-  version = "6.2.1";
+  version = "7.2.1";
 
   src = fetchurl {
-    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    hash = "sha256-ZOOlK9mfZVrfxvgFREgqcRcSs18EMpADD8Y4Ev391Bw=";
+    url = "https://download.zeek.org/zeek-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nbq25TGq/HubTfAysxuVHU34xp3AkJp8yBHB20FlUC0=";
   };
 
   strictDeps = true;
@@ -110,12 +110,13 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Network analysis framework much different from a typical IDS";
     homepage = "https://www.zeek.org";
-    changelog = "https://github.com/zeek/zeek/blob/v${version}/CHANGES";
+    changelog = "https://github.com/zeek/zeek/blob/v${finalAttrs.version}/CHANGES";
     license = lib.licenses.bsd3;
+    mainProgram = "zeek";
     maintainers = with lib.maintainers; [
       pSub
       tobim
     ];
     platforms = lib.platforms.unix;
   };
-}
+})

From 1d5d60cd29cb8e49e1fc8b01cf87f8c25c9a8135 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 18 Jul 2025 01:24:24 +0200
Subject: [PATCH 21/51] connman-gtk: 1.1.1 -> 1.1.1-unstable-2018-06-26

---
 pkgs/by-name/co/connman-gtk/package.nix | 31 ++++++++++++-------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/co/connman-gtk/package.nix b/pkgs/by-name/co/connman-gtk/package.nix
index fb784c8aae7a..21ed440396f6 100644
--- a/pkgs/by-name/co/connman-gtk/package.nix
+++ b/pkgs/by-name/co/connman-gtk/package.nix
@@ -3,32 +3,36 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  autoconf,
-  automake,
-  intltool,
+  meson,
+  ninja,
   pkg-config,
+  python3,
   gtk3,
   connman,
   openconnect,
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "connman-gtk";
-  version = "1.1.1";
+  version = "1.1.1-unstable-2018-06-26";
 
   src = fetchFromGitHub {
     owner = "jgke";
     repo = "connman-gtk";
-    rev = "v${version}";
-    hash = "sha256-2bfoGXzy4wXRALLXEEa7vPWbsBNUhE31nn7dDkuHYCY=";
+    rev = "b72c6ab3bb19c07325c8e659902b046daa23c506";
+    hash = "sha256-6lX6FYERDgLj9G6nwnP35kF5x8dpRJqfJB/quZFtFzM=";
   };
 
+  postPatch = ''
+    patchShebangs --build data/meson_post_install.py
+  '';
+
   nativeBuildInputs = [
-    autoconf
-    automake
-    intltool
+    meson
+    ninja
     pkg-config
+    python3
     wrapGAppsHook3
   ];
 
@@ -45,12 +49,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  preConfigure = ''
-    # m4/intltool.m4 is an invalid symbolic link
-    rm m4/intltool.m4
-    ln -s ${intltool}/share/aclocal/intltool.m4 m4/
-    ./autogen.sh
-  '';
+  env.MESON_INSTALL_PREFIX = placeholder "out";
 
   meta = with lib; {
     description = "GTK GUI for Connman";

From 36faf36fc395d122aec741802ad230027c2ba915 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 00:32:50 +0000
Subject: [PATCH 22/51] nauty: 2.8.9 -> 2.9.0

---
 pkgs/by-name/na/nauty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/na/nauty/package.nix b/pkgs/by-name/na/nauty/package.nix
index f20c1ff37b67..769c2e121081 100644
--- a/pkgs/by-name/na/nauty/package.nix
+++ b/pkgs/by-name/na/nauty/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nauty";
-  version = "2.8.9";
+  version = "2.9.0";
 
   src = fetchurl {
     url = "https://pallini.di.uniroma1.it/nauty${
       builtins.replaceStrings [ "." ] [ "_" ] version
     }.tar.gz";
-    sha256 = "sha256-yXq0K/SHlqhqWYvOPpJpBHyisywU/CPgcgiiRP5SxO4=";
+    sha256 = "sha256-eziDTHzv4X0l4F7vHvOIL6nNGTP1grnrnedHdBGVYFM=";
   };
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  # HACK: starting from 2.8.9, the makefile tries to copy .libs/*.a files unconditionally
+  # HACK: starting from 2.9.0, the makefile tries to copy .libs/*.a files unconditionally
   dontDisableStatic = true;
 
   configureFlags = [

From 198936a4eccbae1b8cbc6d38be50ab7aff1d4fc9 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 18 Jul 2025 04:39:25 +0200
Subject: [PATCH 23/51] libgpod: fix build with gettext 0.25

---
 pkgs/development/libraries/libgpod/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/libgpod/default.nix b/pkgs/development/libraries/libgpod/default.nix
index eefcb35fca60..87f00bb23df2 100644
--- a/pkgs/development/libraries/libgpod/default.nix
+++ b/pkgs/development/libraries/libgpod/default.nix
@@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
     substituteInPlace configure.ac --replace 'libplist >= 1.0' 'libplist-2.0 >= 2.2'
   '';
 
+  preAutoreconf = ''
+    gettextize --force --copy
+    intltoolize --force --copy
+  '';
+
   configureFlags = [
     "--without-hal"
     "--enable-udev"

From d287c86c08ded17c7cb2659bb78c477e6d2a7f58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Fern=C3=A1ndez=20L=C3=B3pez?=
 <ereslibre@ereslibre.es>
Date: Thu, 17 Jul 2025 09:56:06 +0200
Subject: [PATCH 24/51] nixos/nvidia-container-toolkit: fix tests

---
 .../hardware/nvidia-container-toolkit/cdi-generate.nix |  2 +-
 nixos/tests/nvidia-container-toolkit.nix               | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
index 69b1c52a533e..33a47013bab4 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
@@ -39,7 +39,7 @@ writeScriptBin "nvidia-cdi-generator" ''
       --device-name-strategy ${device-name-strategy} \
       --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
       --library-search-path ${lib.getLib nvidia-driver}/lib \
-      --nvidia-cdi-hook-path ${lib.getExe' nvidia-container-toolkit.tools "nvidia-cdi-hook"} \
+      --nvidia-cdi-hook-path ${lib.getOutput "tools" nvidia-container-toolkit}/bin/nvidia-cdi-hook \
       ${lib.escapeShellArgs extraArgs}
   }
 
diff --git a/nixos/tests/nvidia-container-toolkit.nix b/nixos/tests/nvidia-container-toolkit.nix
index 1b894a1cddd9..a0be2983747f 100644
--- a/nixos/tests/nvidia-container-toolkit.nix
+++ b/nixos/tests/nvidia-container-toolkit.nix
@@ -85,6 +85,7 @@ let
       '';
       meta.mainProgram = "nvidia-ctk";
     };
+    suppressNvidiaDriverAssertion = true;
   };
 in
 {
@@ -100,7 +101,10 @@ in
     {
       environment.systemPackages = with pkgs; [ jq ];
       virtualisation.diskSize = lib.mkDefault 10240;
-      virtualisation.containers.enable = lib.mkDefault true;
+      virtualisation.containers = {
+        containersConf.settings.engine.cdi_spec_dirs = [ "/var/run/cdi" ];
+        enable = lib.mkDefault true;
+      };
       hardware = {
         inherit nvidia-container-toolkit;
         nvidia = {
@@ -113,8 +117,8 @@ in
   nodes = {
     no-gpus = {
       virtualisation.containers.enable = false;
-      hardware.graphics.enable = false;
     };
+
     one-gpu =
       { pkgs, ... }:
       {
@@ -142,7 +146,7 @@ in
       one_gpu.wait_for_unit("nvidia-container-toolkit-cdi-generator.service")
       one_gpu.succeed("cat /var/run/cdi/nvidia-container-toolkit.json | jq")
       one_gpu.succeed("podman load < ${testContainerImage}")
-      print(one_gpu.succeed("podman run --pull=never --device=nvidia.com/gpu=all -v /run/opengl-driver:/run/opengl-driver:ro cdi-test:latest"))
+      one_gpu.succeed("podman run --pull=never --device=nvidia.com/gpu=all -v /run/opengl-driver:/run/opengl-driver:ro cdi-test:latest")
 
     # Issue: https://github.com/NixOS/nixpkgs/issues/319201
     with subtest("The generated CDI spec skips specified non-existant paths in the host"):

From f6200433cc5590032f667f75341749333afb91b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@cachix.org>
Date: Thu, 17 Jul 2025 22:45:26 -0500
Subject: [PATCH 25/51] devenv: 1.7 -> 1.8

---
 pkgs/by-name/de/devenv/package.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 891c0db5ee77..c710775b91c7 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -8,6 +8,7 @@
   cachix,
   nixVersions,
   openssl,
+  dbus,
   pkg-config,
   glibcLocalesUtf8,
   devenv, # required to run version test
@@ -18,8 +19,8 @@ let
     (nixVersions.git.overrideSource (fetchFromGitHub {
       owner = "cachix";
       repo = "nix";
-      rev = "afa41b08df4f67b8d77a8034b037ac28c71c77df";
-      hash = "sha256-IDB/oh/P63ZTdhgSkey2LZHzeNhCdoKk+4j7AaPe1SE=";
+      rev = "031c3cf42d2e9391eee373507d8c12e0f9606779";
+      hash = "sha256-dOi/M6yNeuJlj88exI+7k154z+hAhFcuB8tZktiW7rg=";
     })).overrideAttrs
       (old: {
         version = "2.30-devenv";
@@ -29,7 +30,7 @@ let
         __intentionallyOverridingVersion = true;
       });
 
-  version = "1.7";
+  version = "1.8";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
@@ -39,11 +40,11 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-LzMVgB8izls/22g69KvWPbuQ8C7PRT9PobbvdV3/raI=";
+    hash = "sha256-Cg4DxHCZiXiSlbwveJpyCFzWIblWi467I2/pmsAWiAw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-k/UrnRTI+Z09kdN7PYNOg9+GnumqOdm36F31CKZCGMU=";
+  cargoHash = "sha256-uUI0O60x8AVG85MJYzEbNdsO818yFu4w66WuozboWso=";
 
   buildAndTestSubdir = "devenv";
 
@@ -53,7 +54,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+    dbus
+  ];
 
   postInstall =
     let

From 0ae303fbb61167c06c79f784e60faf45313d39ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 04:11:24 +0000
Subject: [PATCH 26/51] firebase-tools: 14.9.0 -> 14.11.0

---
 pkgs/by-name/fi/firebase-tools/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 2979704c856d..88a10c2ffa41 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.9.0";
+  version = "14.11.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-LUPG0FiwOvC+4ZXkrGGHnayusg06QvIw96Jg0ug+UBQ=";
+    hash = "sha256-yOwIasMJ0kUGUwj1HN2oPIgu/U0PYT+UmoH8LLUh9EQ=";
   };
 
-  npmDepsHash = "sha256-g6tcBNzCr5lOR874qAGPAuG8WBManHYY40GKqsrBEJM=";
+  npmDepsHash = "sha256-eLhlk/9RmyJg9fpFmQ53IE6m2TN46N801n85yeEDG2M=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

From 43a10ca9d4397f4559d37bc098a16d0e4fe272c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@cachix.org>
Date: Wed, 16 Jul 2025 13:23:23 -0500
Subject: [PATCH 27/51] secretspec: init at 0.2.0

---
 pkgs/by-name/se/secretspec/package.nix | 33 ++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 pkgs/by-name/se/secretspec/package.nix

diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
new file mode 100644
index 000000000000..e659f665026f
--- /dev/null
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  dbus,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "secretspec";
+  version = "0.2.0";
+
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-6a3BerjcLn86XCakyYlMm4FUUQTc7iq/hCvZEbHnp4g=";
+  };
+
+  cargoHash = "sha256-4sKja7dED1RuiRYA2BNqvvYlJhPFiM8IzAgQVeSa9Oc=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Declarative secrets, every environment, any provider";
+    homepage = "https://secretspec.dev";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ domenkozar ];
+    mainProgram = "secretspec";
+  };
+})

From 9ebfce1f683087424df9a4bd2605461b35d1b6f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 00:30:46 +0000
Subject: [PATCH 28/51] gurobi: 12.0.2 -> 12.0.3

---
 pkgs/by-name/gu/gurobi/package.nix                 |  6 +++---
 .../python-modules/gurobipy/default.nix            | 14 +++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/gu/gurobi/package.nix b/pkgs/by-name/gu/gurobi/package.nix
index fd7f9a9eeb24..26099b0de9fe 100644
--- a/pkgs/by-name/gu/gurobi/package.nix
+++ b/pkgs/by-name/gu/gurobi/package.nix
@@ -16,14 +16,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gurobi";
-  version = "12.0.2";
+  version = "12.0.3";
 
   src = fetchurl {
     url = "https://packages.gurobi.com/${lib.versions.majorMinor version}/gurobi${version}_${platform}.tar.gz";
     hash =
       {
-        aarch64-linux = "sha256-vlhF3OIMCVyS9Y31RS4eVhs4wQ4CUDGQZlNkf98Uji0=";
-        x86_64-linux = "sha256-DMSmk41YzGoonHdX2xLsioU9RTBLn4kQy4v6HgVa08U=";
+        aarch64-linux = "sha256-NrHyudaioPE34qulwQNe3RFk4KnjFTGmLRj8B9jGRu4=";
+        x86_64-linux = "sha256-Ib2ruq+Dzi2kKk8T7N56H9F7buxNdMl7rYoFGIfRECE=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/development/python-modules/gurobipy/default.nix b/pkgs/development/python-modules/gurobipy/default.nix
index 485d26842c77..4c06dc57ddf8 100644
--- a/pkgs/development/python-modules/gurobipy/default.nix
+++ b/pkgs/development/python-modules/gurobipy/default.nix
@@ -18,14 +18,14 @@ let
   };
   platform = platforms.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   hashes = rec {
-    cp312-aarch64-darwin = "sha256-i/0ygF6PxOotAlO1vq7yx2NXAxbyah9PLIbLqg6zqNc=";
-    cp312-aarch64-linux = "sha256-WvK9RiY4T/xwDCmvDh3WnK/m9tvW78045eMoc6RvPRI=";
+    cp312-aarch64-darwin = "sha256-Ag8jJ39jDgeerBFDheq9G9n7SsIvh5btW6bZFc5PFBs=";
+    cp312-aarch64-linux = "sha256-crv1RLwFBgu5OQm3lxWs5MD0FhmPdiKphcq7no6Zqhw=";
     cp312-x86_64-darwin = cp312-aarch64-darwin;
-    cp312-x86_64-linux = "sha256-ER0yOTo5o+Ld1erRdScx04izxoW3NVDGsMqaRdlUw2Q=";
-    cp313-aarch64-darwin = "sha256-V5HcmwKfBrMY1U4N+gf1yWiMJ+XHH3pUvNqv20wJBek=";
-    cp313-aarch64-linux = "sha256-s8rr72p8a6I1WYcqtz3NgEDHFW74DN4LWRGLvf0k53k=";
+    cp312-x86_64-linux = "sha256-s/lxyvJw9nG2/89bk3s8BDClJksPAVKdyGgdYcIh8hU=";
+    cp313-aarch64-darwin = "sha256-qFUuR2c8tvH9NR7fj8rYawL4Msv7V9kO8h4Dl+ltE44=";
+    cp313-aarch64-linux = "sha256-vgXAdBQcihJsiq7MxBeVqwkaZm6rs5yh/5inS96B5mM=";
     cp313-x86_64-darwin = cp313-aarch64-darwin;
-    cp313-x86_64-linux = "sha256-JAqrYPz7/lhvRW1uy8yOyjtapf/nF+agjEHIKWQCYTc=";
+    cp313-x86_64-linux = "sha256-eaMzdm4n/veQLO7vvPAnmhyjk6J6cupi+OMBshqhfVk=";
   };
   hash =
     hashes."${pyShortVersion}-${stdenv.system}"
@@ -33,7 +33,7 @@ let
 in
 buildPythonPackage rec {
   pname = "gurobipy";
-  version = "12.0.2";
+  version = "12.0.3";
   inherit format;
 
   src = fetchPypi {

From ed7b035bfde03f649712bde5ca595e5e40290e47 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 06:40:15 +0000
Subject: [PATCH 29/51] dbgate: 6.4.2 -> 6.5.6

---
 pkgs/by-name/db/dbgate/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/db/dbgate/package.nix b/pkgs/by-name/db/dbgate/package.nix
index 5a2e561cd40e..bc3c376337b6 100644
--- a/pkgs/by-name/db/dbgate/package.nix
+++ b/pkgs/by-name/db/dbgate/package.nix
@@ -8,25 +8,25 @@
 
 let
   pname = "dbgate";
-  version = "6.4.2";
+  version = "6.5.6";
   src =
     fetchurl
       {
         aarch64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_arm64.AppImage";
-          hash = "sha256-GDQCixckbMlEvp77uAdsTtK8CUT02mUpxluLapO0D78=";
+          hash = "sha256-S0xlC0ht6G+RDrsMaMD4nk/vKdLvtvAtUaMaFowT/Gw=";
         };
         x86_64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_x86_64.AppImage";
-          hash = "sha256-5rMkW9VY1NgeGgG37QyMI78I4G90yuWhkP60o2ClAM8=";
+          hash = "sha256-JBE/t/IwFe02LrK4Ci+2KEtAXlH1zr5WcTmQir6yvNc=";
         };
         x86_64-darwin = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-mac_x64.dmg";
-          hash = "sha256-AEYGGT/LIursXtrwVglWvMxYFA9YCqx7q7KXO0q6FZI=";
+          hash = "sha256-EkySGJCHAR/YCS/I6j2LZHA6/L0P8VX2WDPScj58mSg=";
         };
         aarch64-darwin = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-mac_universal.dmg";
-          hash = "sha256-yWDcIXrD85qr+zx5sbtci1Yw/C6gUjW7NNjfu/sClas=";
+          hash = "sha256-isOrajXB+O9y3fiSulhjoSSt/7lgu4xPMXBhUcfgK2Y=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "dbgate: ${stdenv.hostPlatform.system} is unsupported.");

From f405824efe7e49bbe59ee65413797c613344732e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 09:24:53 +0000
Subject: [PATCH 30/51] incus-ui-canonical: 0.17.1.0 -> 0.18.0

---
 pkgs/by-name/in/incus-ui-canonical/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index 0aa7f9292707..767627f63c96 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,19 +20,19 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "incus-ui-canonical";
-  version = "0.17.1.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${version}";
-    hash = "sha256-dAYcput4qGLQT6G10O52UUrQ7HN9kXQFgZlm5QN4xI0=";
+    hash = "sha256-dN/O3UmQfWZ85XQUGXFTF7dhXGW0CLoQ5+16AIDSAzc=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-or/lPf6pamFVJnSWU9CLTss9s6amMNd9A7H8CAFJ6RU=";
+    hash = "sha256-eiK6dyvRbttxC7rESgpYRsYkkrzLZq4RWOiUf7fsAk8=";
   };
 
   patchPhase = ''

From 72b4f827a1a010378477dbd81823438f1f45879b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 10:10:39 +0000
Subject: [PATCH 31/51] memogram: 0.2.6 -> 0.3.0

---
 pkgs/by-name/me/memogram/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/memogram/package.nix b/pkgs/by-name/me/memogram/package.nix
index 017741ca6c72..9856dd9adbbb 100644
--- a/pkgs/by-name/me/memogram/package.nix
+++ b/pkgs/by-name/me/memogram/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "memogram";
-  version = "0.2.6";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "telegram-integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vpDwa5MvNyJUNCdeNK7PhXBoEHtKKsyFdbMsNRBLqW4=";
+    hash = "sha256-yQmdUphgGr/db2FJ5tghUhjWt7QGs0mCAI/NrBNRABk=";
   };
 
-  vendorHash = "sha256-F8JllhYMvBWEeHa4boFbTHLFTa0s+Tarqtf4NfVqK7s=";
+  vendorHash = "sha256-8tQ5MQ0XcBIx74EFAXxXInADFd4BnlTazeIFNXNN/Ww=";
 
   subPackages = [ "bin/memogram" ];
 

From ddcf391ec8e98f9570a32f800e737a0bc2d6513c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 10:31:20 +0000
Subject: [PATCH 32/51] mympd: 22.0.1 -> 22.0.2

---
 pkgs/by-name/my/mympd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index 2b93fff93630..54495d4ca2ec 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "22.0.1";
+  version = "22.0.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JAxmmcbkEZGiMzxVMeWlLnnU/iaVmXEcFESuMAaeXf0=";
+    sha256 = "sha256-wvv4EeV0hLrQ9BhWAyoMnR8tjU67OwahcR+xo10lWE8=";
   };
 
   nativeBuildInputs = [

From 9ee2559b09d0eca1839a5c40dfcaaedca1c89487 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 12:09:46 +0000
Subject: [PATCH 33/51] windsurf: 1.10.8 -> 1.11.0

---
 pkgs/by-name/wi/windsurf/info.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 8773c68b32b7..2e61baac1c6e 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-darwin-arm64-1.10.8.zip",
-    "sha256": "2aa0fda69b442577a4f0b85d2b4437efc9d49be9d7a07a1f15ab8df5b5face5a"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-arm64-1.11.0.zip",
+    "sha256": "eb0f139db3eb30b93e53afb37ec3d52c9881e39fc100287c25c66452dcefa0c8"
   },
   "x86_64-darwin": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-darwin-x64-1.10.8.zip",
-    "sha256": "8564a492699a6225474b82aa1f95d0e400c82d311841afdfaeba2d445be9caf9"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-x64-1.11.0.zip",
+    "sha256": "f020a9e23115043070ac6e4a15614d58967b65c5dc6a09918869ed20e37cddf3"
   },
   "x86_64-linux": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-linux-x64-1.10.8.tar.gz",
-    "sha256": "c68432a5a903a7c18b4a446c24f8dc0728311242ff7c6a5a9b34d15713685063"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-linux-x64-1.11.0.tar.gz",
+    "sha256": "ff1b9a168c0d60be0f6a97ee9d22d443d5bb3384df69182ea485b7403f4f9d02"
   }
 }

From c79fbf83cc69552101333cf043156e42872d1183 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 12:11:54 +0000
Subject: [PATCH 34/51] bitrise: 2.31.3 -> 2.32.0

---
 pkgs/by-name/bi/bitrise/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 955cd6348d56..7d9781f26d7a 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.31.3";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-uy2B2tjtg6/ufMWy9sPoheSw2hxIsl2gUdAKVfixpoM=";
+    hash = "sha256-Qcq96ZA95Tvs/i3MDpTsc2ZY3xSLpf10o3KpWXoJmQo=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

From 24c9f80f7baef47968d9ca156832025b74792921 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 12:17:59 +0000
Subject: [PATCH 35/51] signal-desktop: 7.61.0 -> 7.62.0

---
 pkgs/by-name/si/signal-desktop/package.nix          | 10 +++++-----
 pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 86ec124538fb..c1b088fb3e57 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.61.0";
+  version = "7.62.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-foMzSKm2BROZ8ATCdYx/0sl+4tQfhgoPA4AWSHEKL0Y=";
+    hash = "sha256-79Mh5jx7cSr8AVL/oqjuTWQ+DHmyXL19rKlbyNMySt0=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -122,15 +122,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
+        "sha256-r+MktwnhmZOUc1NMumrfkTpmUUHUXKB10XKSkxg3GYU="
       else
-        "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
+        "sha256-raCVDqhtTTsdIn1vjbKW+ULrBefD8+kgJkKHls90KNs=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1752109090;
+    SOURCE_DATE_EPOCH = 1752702364;
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index a71e8dffdb56..5c4e316c4300 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "2.0.3";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H5/+XcXnINRL5BWItWx6YaPP46+k1xTbyfDqHPCRDXk=";
+    hash = "sha256-JYdc3H8PhDLkJH5ApfReq0e7HgKoJaK01JGuzoqftyc=";
   };
 
   pnpmDeps = pnpm.fetchDeps {

From 64d4284481b8d63a47776628c8de9f0284dcb8d7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 12:52:03 +0000
Subject: [PATCH 36/51] stylelint: 16.21.1 -> 16.22.0

---
 pkgs/by-name/st/stylelint/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stylelint/package.nix b/pkgs/by-name/st/stylelint/package.nix
index db76f5cceceb..8fd72c5826cb 100644
--- a/pkgs/by-name/st/stylelint/package.nix
+++ b/pkgs/by-name/st/stylelint/package.nix
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.21.1";
+  version = "16.22.0";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     tag = version;
-    hash = "sha256-obRxkExrLFLt02L1w9FBHrHgN8n+lRsPuSUra66j8hE=";
+    hash = "sha256-rl+TFRzMRliOKbTJylmflmEZHDplDPtKEVkXlXJG3a4=";
   };
 
-  npmDepsHash = "sha256-t83R9OQnSY7OVEU+TQWQMotsey/XtXIo7NLG9vyiUng=";
+  npmDepsHash = "sha256-3Lfhwv1xwv2JAoZ3DDppUQVFHp9TOMibsGVSIR4xRkA=";
 
   dontNpmBuild = true;
 

From 815ad2015eaa93c5d8e5a04e3aa1679b91ed1f0a Mon Sep 17 00:00:00 2001
From: Emmanuel Rosa <emmanuelrosa@protonmail.com>
Date: Wed, 2 Jul 2025 20:53:56 -0400
Subject: [PATCH 37/51] sparrow: add arch64-linux support

---
 pkgs/by-name/sp/sparrow/package.nix | 30 +++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/sp/sparrow/package.nix b/pkgs/by-name/sp/sparrow/package.nix
index f065426aa2d3..bcdd75194d5c 100644
--- a/pkgs/by-name/sp/sparrow/package.nix
+++ b/pkgs/by-name/sp/sparrow/package.nix
@@ -29,9 +29,22 @@ let
 
   openjdk = jdk23.override { enableJavaFX = true; };
 
+  sparrowArch =
+    {
+      x86_64-linux = "x86_64";
+      aarch64-linux = "aarch64";
+    }
+    ."${stdenvNoCC.hostPlatform.system}";
+
+  # nixpkgs-update: no auto update
   src = fetchurl {
-    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/sparrowwallet-${version}-x86_64.tar.gz";
-    hash = "sha256-MsERgfJGpxRkQm4Ww30Tc95kThjlgI+nO4bq2zNGdeU=";
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/sparrowwallet-${version}-${sparrowArch}.tar.gz";
+    hash =
+      {
+        x86_64-linux = "sha256-MsERgfJGpxRkQm4Ww30Tc95kThjlgI+nO4bq2zNGdeU=";
+        aarch64-linux = "sha256-31x4Ck/+Fa6CvBb6o9ncVH99Zeh0DUVv/hqVN31ysHk=";
+      }
+      ."${stdenvNoCC.hostPlatform.system}";
 
     # nativeBuildInputs, downloadToTemp, and postFetch are used to verify the signed upstream package.
     # The signature is not a self-contained file. Instead the SHA256 of the package is added to a manifest file.
@@ -49,7 +62,7 @@ let
       mkdir -m 700 -p $GNUPGHOME
       ln -s ${manifest} ./manifest.txt
       ln -s ${manifestSignature} ./manifest.txt.asc
-      ln -s $downloadedFile ./sparrowwallet-${version}-x86_64.tar.gz
+      ln -s $downloadedFile ./sparrowwallet-${version}-${sparrowArch}.tar.gz
       gpg --import ${publicKey}
       gpg --verify manifest.txt.asc manifest.txt
       sha256sum -c --ignore-missing manifest.txt
@@ -165,7 +178,6 @@ let
 
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
@@ -184,7 +196,6 @@ let
       rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
       rm -fR openpnp.capture.java/darwin-aarch64
       rm -fR openpnp.capture.java/darwin-x86-64
-      rm -fR openpnp.capture.java/linux-aarch64
       rm -fR openpnp.capture.java/win32-x86-64
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
@@ -192,9 +203,9 @@ let
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
-      rm -fR com.sparrowwallet.merged.module/linux-aarch64
       rm -fR com.sparrowwallet.merged.module/linux-arm
       rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm -fR com.fazecast.jSerialComm/FreeBSD
       rm -fR com.fazecast.jSerialComm/OpenBSD
       rm -fR com.fazecast.jSerialComm/Android
       rm -fR com.fazecast.jSerialComm/Solaris
@@ -206,7 +217,7 @@ let
       # Replace the embedded Tor binary (which is in a Tar archive)
       # with one from Nixpkgs.
       gzip -c ${torWrapper}  > tor.gz
-      cp tor.gz modules/io.matthewnelson.kmp.tor.resource.exec.tor/io/matthewnelson/kmp/tor/resource/exec/tor/native/linux-libc/x86_64/tor.gz
+      cp tor.gz modules/io.matthewnelson.kmp.tor.resource.exec.tor/io/matthewnelson/kmp/tor/resource/exec/tor/native/linux-libc/${sparrowArch}/tor.gz
     '';
 
     installPhase = ''
@@ -294,7 +305,10 @@ stdenvNoCC.mkDerivation rec {
       msgilligan
       _1000101
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "sparrow-desktop";
   };
 }

From 334be8b2b6c3798abe74bf6c42f8893bda168d86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Fri, 18 Jul 2025 14:03:12 +0100
Subject: [PATCH 38/51] bash-language-server: remove deletion of nonexistent
 file

---
 pkgs/by-name/ba/bash-language-server/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index ab6279ea88ba..e11f3b35dd7a 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -56,7 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     find node_modules server/node_modules -xtype l -delete
 
     # remove non-deterministic files
-    rm node_modules/{.modules.yaml,.pnpm-workspace-state.json}
+    rm node_modules/.modules.yaml
   '';
 
   installPhase = ''

From e2ce2981bf759faacbd4c20d496e9749b3dfede9 Mon Sep 17 00:00:00 2001
From: Andrew Voynov <andrewvoynov.b@gmail.com>
Date: Fri, 18 Jul 2025 18:24:54 +0500
Subject: [PATCH 39/51] nixos/services: fix Markdown link syntax in
 web-apps/ocis.md

---
 nixos/modules/services/web-apps/ocis.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/ocis.md b/nixos/modules/services/web-apps/ocis.md
index 9a21ca25f14a..43ddd3175c7d 100644
--- a/nixos/modules/services/web-apps/ocis.md
+++ b/nixos/modules/services/web-apps/ocis.md
@@ -104,7 +104,7 @@ values, and
 [`services.ocis.environmentFile`][mod-envFile] for
 sensitive values.
 
-Configuration in (`services.ocis.environment`)[mod-env] overrides those from
+Configuration in [`services.ocis.environment`][mod-env] overrides those from
 [`services.ocis.environmentFile`][mod-envFile] and will have highest
 precedence
 

From 610730340bb0ad942ea4ee95f8799ff65bb1a704 Mon Sep 17 00:00:00 2001
From: Andrew Voynov <andrewvoynov.b@gmail.com>
Date: Fri, 18 Jul 2025 18:26:12 +0500
Subject: [PATCH 40/51] doc: fix Markdown link syntax in
 stdenv/passthru.chapter.md

---
 doc/stdenv/passthru.chapter.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/stdenv/passthru.chapter.md b/doc/stdenv/passthru.chapter.md
index db40d4bbe054..5306e4f158be 100644
--- a/doc/stdenv/passthru.chapter.md
+++ b/doc/stdenv/passthru.chapter.md
@@ -53,7 +53,7 @@ They fall in one of these categories:
 
   These tend to entail support from the derivation or the `passthru` attribute in question.
   Common examples of this type are `passthru.optional-dependencies`, `passthru.withPlugins`, and `passthru.withPackages`.
-  All of those allow associating the package with a set of components built for that specific package, such as when building Python runtime environments using (`python.withPackages`)[#python.withpackages-function].
+  All of those allow associating the package with a set of components built for that specific package, such as when building Python runtime environments using [`python.withPackages`](#python.withpackages-function).
 
 Attributes that apply only to particular [build helpers](#part-builders) or [language ecosystems](#chap-language-support) are documented there.
 

From 882dd365cb55722918cd2de04fadb37a09fcc28e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 13:28:37 +0000
Subject: [PATCH 41/51] antimatter-dimensions: 0-unstable-2025-05-08 ->
 0-unstable-2025-07-15

---
 pkgs/by-name/an/antimatter-dimensions/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/antimatter-dimensions/package.nix b/pkgs/by-name/an/antimatter-dimensions/package.nix
index 2a70d2d9722c..13fec89df4df 100644
--- a/pkgs/by-name/an/antimatter-dimensions/package.nix
+++ b/pkgs/by-name/an/antimatter-dimensions/package.nix
@@ -19,12 +19,12 @@ let
 in
 buildNpmPackage rec {
   pname = "antimatter-dimensions";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-07-15";
   src = fetchFromGitHub {
     owner = "IvarK";
     repo = "AntimatterDimensionsSourceCode";
-    rev = "7b29fa1c0771b93a8bf8198ca04886167ecffc0b";
-    hash = "sha256-z7dVToxu8qWCPajf0vKprXF4zSBCRDquBgjf55ZPgyE=";
+    rev = "01d29026a9d4a85193b563ab0a44b2b3cf02ad6e";
+    hash = "sha256-w66JgLo4SX0b63LjRd1XKDs7O/TpFFJYSbE+dOW1Unw=";
   };
   nativeBuildInputs = [
     copyDesktopItems

From 1041592f129177b8c040746734a47caa4fbedd7d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 13:05:55 +0000
Subject: [PATCH 42/51] gh: 2.75.1 -> 2.76.0

---
 pkgs/by-name/gh/gh/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index cbfb245ffd40..3608a13dd2c3 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.75.1";
+  version = "2.76.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-NZcU7ai/Tvg8j65w7qA5FY21R8M8az9tjDTu8YBhV4w=";
+    hash = "sha256-69vSmV+CKRQOuUxsiBBlZBSRqwEtJil4oAse+RSuSVM=";
   };
 
   vendorHash = "sha256-go5hB6vjZZrTa3PMHWpv+J0yNewijXkRD8iGL6O2GgM=";

From 2050d9646d14a5e217a2d410ae1b28aa45eebc2c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 02:25:28 +0000
Subject: [PATCH 43/51] python3Packages.vector: 1.6.2 -> 1.6.3

---
 pkgs/development/python-modules/vector/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/vector/default.nix b/pkgs/development/python-modules/vector/default.nix
index 36bfa60eb3ea..b2459eed385b 100644
--- a/pkgs/development/python-modules/vector/default.nix
+++ b/pkgs/development/python-modules/vector/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "vector";
-  version = "1.6.2";
+  version = "1.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "vector";
     tag = "v${version}";
-    hash = "sha256-IMr3+YveR/FDQ2MbgbWr1KJFrdH9B+KOFVNGJjz6Zdk=";
+    hash = "sha256-KwxQ2sA8cdHmTRbh23H5iTexMlWK2MxdA8XWpXscpfU=";
   };
 
   build-system = [

From 9f24cfac2f0a8cbe7c57c8a889b11a1030a9aba9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 14:47:15 +0000
Subject: [PATCH 44/51] litellm: 1.74.0 -> 1.74.3

---
 pkgs/development/python-modules/litellm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 644a20626996..bfecda475adb 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.74.0";
+  version = "1.74.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     tag = "v${version}-stable";
-    hash = "sha256-qjr08HHEELIwdL3IZ+GWJWGvIySTTX1nv46tYNBP53Y=";
+    hash = "sha256-wxj9zkaUo5SKbPd2KqEq5r9qPk2ipHr19bIX13/hnGY=";
   };
 
   build-system = [ poetry-core ];

From 7a2dfb7d618316d9df090a6f7f48c1386499b19b Mon Sep 17 00:00:00 2001
From: Darryl Magadzika <135046711+Daru-san@users.noreply.github.com>
Date: Fri, 18 Jul 2025 16:50:52 +0200
Subject: [PATCH 45/51] hyprlandPlugins.hy3: hl0.49.0 -> hl0.50.0 (#426353)

---
 .../window-managers/hyprwm/hyprland-plugins/hy3.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
index 5524e1c1d2dc..ee519e9efb36 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hy3";
-  version = "hl0.49.0";
+  version = "hl0.50.0";
 
   src = fetchFromGitHub {
     owner = "outfoxxed";
     repo = "hy3";
     tag = version;
-    hash = "sha256-dYxkdbg6yj8HhuBkCmklMQVR17N7P32R8ir7b7oNxm4=";
+    hash = "sha256-1BTJSqkj+lkIry27HuqA5UB7uRqAUvGT7LAUDQhKjU0=";
   };
 
   nativeBuildInputs = [ cmake ];

From ff87f295366bf9f6a2047e8839d9e3a8d4797469 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jul 2025 15:30:10 +0000
Subject: [PATCH 46/51] super-productivity: 14.0.5 -> 14.1.0

---
 pkgs/by-name/su/super-productivity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 3be5ecbcb5ef..4b4cd3bf46cf 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -14,13 +14,13 @@
 
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "14.0.5";
+  version = "14.1.0";
 
   src = fetchFromGitHub {
     owner = "johannesjo";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-VoE86uBl6DM6aXz7MLYekEzfixVSLjLL3yYgc2vBhp0=";
+    hash = "sha256-wZQhSQBJPyJPAMZU927Xq9bOxAohSaEg+ylk7DoTJJE=";
 
     postFetch = ''
       find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -63,7 +63,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-Jj7ulTjC19Q9PmOeVui/FAyfpsSviGLHiiz8gwsLXAg=";
+      hash = "sha256-SmA2qTi7tXxUcAlFOI61AW8pimB7YEYe749h5hjtLN8=";
     }
   );
 

From d6b326d6590f23a2fc833e2649f3c7afc77130a4 Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@galowicz.de>
Date: Thu, 3 Jul 2025 09:46:59 +0000
Subject: [PATCH 47/51] test-driver: Implement debugging breakpoint hooks

Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
---
 .../writing-nixos-tests.section.md            | 51 ++++++++++++++++++
 nixos/doc/manual/redirects.json               |  6 +++
 nixos/lib/test-driver/default.nix             |  2 +
 .../test-driver/src/test_driver/__init__.py   | 10 ++++
 .../lib/test-driver/src/test_driver/debug.py  | 53 +++++++++++++++++++
 .../lib/test-driver/src/test_driver/driver.py | 11 ++++
 nixos/lib/test-script-prepend.py              |  2 +
 nixos/lib/testing/run.nix                     | 39 +++++++++++---
 8 files changed, 167 insertions(+), 7 deletions(-)
 create mode 100644 nixos/lib/test-driver/src/test_driver/debug.py

diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index 6dc84e6f7b67..f69ea279abb5 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -340,3 +340,54 @@ id-prefix: test-opt-
 list-id: test-options-list
 source: @NIXOS_TEST_OPTIONS_JSON@
 ```
+
+## Accessing VMs in the sandbox with SSH {#sec-test-sandbox-breakpoint}
+
+As explained in [](#sec-nixos-test-ssh-access), it's possible to configure an
+SSH backdoor based on AF_VSOCK. This can be used to SSH into a VM of a running
+build in a sandbox.
+
+This can be done when something in the test fails, e.g.
+
+```nix
+{
+  nodes.machine = {};
+
+  sshBackdoor.enable = true;
+  enableDebugHook = true;
+
+  testScript = ''
+    start_all()
+    machine.succeed("false") # this will fail
+  '';
+}
+```
+
+For the AF_VSOCK feature to work, `/dev/vhost-vsock` is needed in the sandbox
+which can be done with e.g.
+
+```
+nix-build -A nixosTests.foo --option sandbox-paths /dev/vhost-vsock
+```
+
+This will halt the test execution on a test-failure and print instructions
+on how to enter the sandbox shell of the VM test. Inside, one can log into
+e.g. `machine` with
+
+```
+ssh -F ./ssh_config vsock/3
+```
+
+As described in [](#sec-nixos-test-ssh-access), the numbers for vsock start at
+`3` instead of `1`. So the first VM in the network (sorted alphabetically) can
+be accessed with `vsock/3`.
+
+Alternatively, it's possible to explicitly set a breakpoint with
+`debug.breakpoint()`. This also has the benefit, that one can step through
+`testScript` with `pdb` like this:
+
+```
+$ sudo /nix/store/eeeee-attach <id>
+bash# telnet 127.0.0.1 4444
+pdb$ …
+```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index e7c195379cc7..e08b4d31c36c 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1902,6 +1902,9 @@
   "test-opt-sshBackdoor.vsockOffset": [
     "index.html#test-opt-sshBackdoor.vsockOffset"
   ],
+  "test-opt-enableDebugHook": [
+    "index.html#test-opt-enableDebugHook"
+  ],
   "test-opt-defaults": [
     "index.html#test-opt-defaults"
   ],
@@ -2010,6 +2013,9 @@
   "sec-nixos-test-testing-hardware-features": [
     "index.html#sec-nixos-test-testing-hardware-features"
   ],
+  "sec-test-sandbox-breakpoint": [
+    "index.html#sec-test-sandbox-breakpoint"
+  ],
   "chap-developing-the-test-driver": [
     "index.html#chap-developing-the-test-driver"
   ],
diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 91db5d8be3c2..bb07bba363a1 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -14,6 +14,7 @@
   extraPythonPackages ? (_: [ ]),
   nixosTests,
 }:
+
 python3Packages.buildPythonApplication {
   pname = "nixos-test-driver";
   version = "1.1";
@@ -32,6 +33,7 @@ python3Packages.buildPythonApplication {
       junit-xml
       ptpython
       ipython
+      remote-pdb
     ]
     ++ extraPythonPackages python3Packages;
 
diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
index 86e663da9b7d..823a948bc41b 100755
--- a/nixos/lib/test-driver/src/test_driver/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/__init__.py
@@ -5,6 +5,7 @@ from pathlib import Path
 
 import ptpython.ipython
 
+from test_driver.debug import Debug, DebugAbstract, DebugNop
 from test_driver.driver import Driver
 from test_driver.logger import (
     CompositeLogger,
@@ -65,6 +66,10 @@ def main() -> None:
         help="drop into a python repl and run the tests interactively",
         action=argparse.BooleanOptionalAction,
     )
+    arg_parser.add_argument(
+        "--debug-hook-attach",
+        help="Enable interactive debugging breakpoints for sandboxed runs",
+    )
     arg_parser.add_argument(
         "--start-scripts",
         metavar="START-SCRIPT",
@@ -129,6 +134,10 @@ def main() -> None:
     if not args.keep_vm_state:
         logger.info("Machine state will be reset. To keep it, pass --keep-vm-state")
 
+    debugger: DebugAbstract = DebugNop()
+    if args.debug_hook_attach is not None:
+        debugger = Debug(logger, args.debug_hook_attach)
+
     with Driver(
         args.start_scripts,
         args.vlans,
@@ -137,6 +146,7 @@ def main() -> None:
         logger,
         args.keep_vm_state,
         args.global_timeout,
+        debug=debugger,
     ) as driver:
         if args.interactive:
             history_dir = os.getcwd()
diff --git a/nixos/lib/test-driver/src/test_driver/debug.py b/nixos/lib/test-driver/src/test_driver/debug.py
new file mode 100644
index 000000000000..7f783fe96de8
--- /dev/null
+++ b/nixos/lib/test-driver/src/test_driver/debug.py
@@ -0,0 +1,53 @@
+import logging
+import os
+import random
+import shutil
+import subprocess
+import sys
+from abc import ABC, abstractmethod
+
+from remote_pdb import RemotePdb  # type:ignore
+
+from test_driver.logger import AbstractLogger
+
+
+class DebugAbstract(ABC):
+    @abstractmethod
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        pass
+
+
+class DebugNop(DebugAbstract):
+    def __init__(self) -> None:
+        pass
+
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        pass
+
+
+class Debug(DebugAbstract):
+    def __init__(self, logger: AbstractLogger, attach_command: str) -> None:
+        self.breakpoint_on_failure = False
+        self.logger = logger
+        self.attach = attach_command
+
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        """
+        Call this function to stop execution and put the process on sleep while
+        at the same time have the test driver provide a debug shell on TCP port
+        `port`. This is meant to be used for sandboxed tests that have the test
+        driver feature `enableDebugHook` enabled.
+        """
+        pattern = str(random.randrange(999999, 9999999))
+        self.logger.log_test_error(
+            f"Breakpoint reached, run 'sudo {self.attach} {pattern}'"
+        )
+        os.environ["bashInteractive"] = shutil.which("bash")  # type:ignore
+        if os.fork() == 0:
+            subprocess.run(["sleep", pattern])
+        else:
+            # RemotePdb writes log messages to both stderr AND the logger,
+            # which is the same here. Hence, disabling the remote_pdb logger
+            # to avoid duplicate messages in the build log.
+            logging.root.manager.loggerDict["remote_pdb"].disabled = True  # type:ignore
+            RemotePdb(host=host, port=port).set_trace(sys._getframe().f_back)
diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index 57b434f09e29..361bb1c2a93d 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -13,6 +13,7 @@ from unittest import TestCase
 
 from colorama import Style
 
+from test_driver.debug import DebugAbstract, DebugNop
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine import Machine, NixStartScript, retry
@@ -67,6 +68,7 @@ class Driver:
     global_timeout: int
     race_timer: threading.Timer
     logger: AbstractLogger
+    debug: DebugAbstract
 
     def __init__(
         self,
@@ -77,12 +79,14 @@ class Driver:
         logger: AbstractLogger,
         keep_vm_state: bool = False,
         global_timeout: int = 24 * 60 * 60 * 7,
+        debug: DebugAbstract = DebugNop(),
     ):
         self.tests = tests
         self.out_dir = out_dir
         self.global_timeout = global_timeout
         self.race_timer = threading.Timer(global_timeout, self.terminate_test)
         self.logger = logger
+        self.debug = debug
 
         tmp_dir = get_tmp_dir()
 
@@ -159,6 +163,7 @@ class Driver:
             polling_condition=self.polling_condition,
             Machine=Machine,  # for typing
             t=AssertionTester(),
+            debug=self.debug,
         )
         machine_symbols = {pythonize_name(m.name): m for m in self.machines}
         # If there's exactly one machine, make it available under the name
@@ -224,8 +229,14 @@ class Driver:
                 for line in f"{exc_prefix}: {exc}".splitlines():
                     self.logger.log_test_error(line)
 
+                self.debug.breakpoint()
+
                 sys.exit(1)
 
+            except Exception:
+                self.debug.breakpoint()
+                raise
+
     def run_tests(self) -> None:
         """Run the test script (for non-interactive test runs)"""
         self.logger.info(
diff --git a/nixos/lib/test-script-prepend.py b/nixos/lib/test-script-prepend.py
index 31dad14ef8dd..067fd20fe7c5 100644
--- a/nixos/lib/test-script-prepend.py
+++ b/nixos/lib/test-script-prepend.py
@@ -1,6 +1,7 @@
 # This file contains type hints that can be prepended to Nix test scripts so they can be type
 # checked.
 
+from test_driver.debug import DebugAbstract
 from test_driver.driver import Driver
 from test_driver.vlan import VLan
 from test_driver.machine import Machine
@@ -52,4 +53,5 @@ join_all: Callable[[], None]
 serial_stdout_off: Callable[[], None]
 serial_stdout_on: Callable[[], None]
 polling_condition: PollingConditionProtocol
+debug: DebugAbstract
 t: TestCase
diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index 45ab311cfbc4..ab1dc7733d5f 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -7,6 +7,7 @@
 }:
 let
   inherit (lib) types mkOption;
+  inherit (hostPkgs.stdenv.hostPlatform) isDarwin isLinux;
 
   # TODO (lib): Also use lib equivalent in nodes.nix
   /**
@@ -26,7 +27,6 @@ let
     */
     f:
     lib.mkOverride (opt.highestPrio - 1) (f opt.value);
-
 in
 {
   options = {
@@ -42,6 +42,15 @@ in
       '';
     };
 
+    enableDebugHook = lib.mkEnableOption "" // {
+      description = ''
+        Halt test execution after any test fail and provide the possibility to
+        hook into the sandbox to connect with either the test driver via
+        `telnet localhost 4444` or with the VMs via SSH and vsocks (see also
+        `sshBackdoor.enable`).
+      '';
+    };
+
     rawTestDerivation = mkOption {
       type = types.package;
       description = ''
@@ -74,15 +83,23 @@ in
     rawTestDerivation = hostPkgs.stdenv.mkDerivation config.rawTestDerivationArg;
     rawTestDerivationArg =
       finalAttrs:
-      assert lib.assertMsg (!config.sshBackdoor.enable)
-        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
+      assert lib.assertMsg (
+        config.sshBackdoor.enable -> isLinux
+      ) "The SSH backdoor is not supported for macOS host systems!";
+
+      assert lib.assertMsg (
+        config.enableDebugHook -> isLinux
+      ) "The debugging hook is not supported for macOS host systems!";
       {
         name = "vm-test-run-${config.name}";
 
         requiredSystemFeatures =
-          [ "nixos-test" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+          [ "nixos-test" ] ++ lib.optional isLinux "kvm" ++ lib.optional isDarwin "apple-virt";
+
+        nativeBuildInputs = lib.optionals config.enableDebugHook [
+          hostPkgs.openssh
+          hostPkgs.inetutils
+        ];
 
         buildCommand = ''
           mkdir -p $out
@@ -90,7 +107,15 @@ in
           # effectively mute the XMLLogger
           export LOGFILE=/dev/null
 
-          ${config.driver}/bin/nixos-test-driver -o $out
+          ${lib.optionalString config.enableDebugHook ''
+            ln -sf \
+              ${hostPkgs.systemd}/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf \
+              ssh_config
+          ''}
+
+          ${config.driver}/bin/nixos-test-driver \
+            -o $out \
+            ${lib.optionalString config.enableDebugHook "--debug-hook=${hostPkgs.breakpointHook.attach}"}
         '';
 
         passthru = config.passthru;

From b4b72182545ffc75a041275db17e84f356c9b02e Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 18 Jul 2025 17:23:35 +0200
Subject: [PATCH 48/51] nixos/testing: enable ssh backdoor by default if debug
 hook is enabled

You usually want both, so it makes sense to have the former imply the
latter. If this is not desired, it can still be modified within a test.
---
 nixos/lib/testing/nodes.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index 15bcc464f481..1f562a5f4f26 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -84,7 +84,8 @@ in
   options = {
     sshBackdoor = {
       enable = mkOption {
-        default = false;
+        default = config.enableDebugHook;
+        defaultText = lib.literalExpression "config.enableDebugHook";
         type = types.bool;
         description = "Whether to turn on the VSOCK-based access to all VMs. This provides an unauthenticated access intended for debugging.";
       };

From 3b0cd27a2517c9144f99c2549eada8cff3fc7310 Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Fri, 18 Jul 2025 18:02:17 +0200
Subject: [PATCH 49/51] lasuite-meet: 0.1.29 -> 0.1.30

https://github.com/suitenumerique/meet/compare/v0.1.29..v0.1.30
---
 pkgs/by-name/la/lasuite-meet/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index f68893fd80d8..faddadda77d6 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "0.1.29";
+  version = "0.1.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-dvAPKNsj8ZnH0eLofbkE09hXL1g8YdViX8sQ/9+4L7k=";
+    hash = "sha256-Ow2xi3twW6FeG88Ya5AeRNk6MIY5JGqd7e1qukKTfQs=";
   };
 
   sourceRoot = "source/src/backend";

From ae4c69c89b9580ea9ca8f1458e2741e4df1d9cfb Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Fri, 18 Jul 2025 18:02:43 +0200
Subject: [PATCH 50/51] lasuite-meet-frontend: 0.1.29 -> 0.1.30

https://github.com/suitenumerique/meet/compare/v0.1.29..v0.1.30
---
 pkgs/by-name/la/lasuite-meet-frontend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index 5dcff98c8176..037de4dd5d79 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-dvAPKNsj8ZnH0eLofbkE09hXL1g8YdViX8sQ/9+4L7k=";
+    hash = "sha256-Ow2xi3twW6FeG88Ya5AeRNk6MIY5JGqd7e1qukKTfQs=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-ZEPzSHcp3HZ8mSoFZDUKlTi+gJ2syauJPtSFEfJnJtg=";
+    hash = "sha256-Id4taAuW/tu9YhbGxjNegdSqyNmUFRQOLF3glkFw0Vc=";
   };
 
   buildPhase = ''

From 98169225ad745c2b3c6e37129963b0e93dcde9b8 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 15 Jul 2025 23:12:25 +0200
Subject: [PATCH 51/51] maintainers/scripts/update.nix: Run updateScript in
 development shell

Update scripts aren't always run in the development shell by default,
especially not in the regular automated updates.
The parent commit makes the update scripts depend on running in the
development shell, so let's make sure it's always done.
---
 maintainers/scripts/update.py | 7 ++++++-
 pkgs/README.md                | 3 ++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/maintainers/scripts/update.py b/maintainers/scripts/update.py
index 576332b76607..10d197d5fe78 100644
--- a/maintainers/scripts/update.py
+++ b/maintainers/scripts/update.py
@@ -7,6 +7,7 @@ import contextlib
 import json
 import os
 import re
+import shlex
 import subprocess
 import sys
 import tempfile
@@ -235,7 +236,11 @@ async def run_update_script(
             f"UPDATE_NIX_PNAME={package['pname']}",
             f"UPDATE_NIX_OLD_VERSION={package['oldVersion']}",
             f"UPDATE_NIX_ATTR_PATH={package['attrPath']}",
-            *update_script_command,
+            # Run all update scripts in the Nixpkgs development shell to get access to formatters and co.
+            "nix-shell",
+            nixpkgs_root + "/shell.nix",
+            "--run",
+            " ".join([ shlex.quote(s) for s in update_script_command ]),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             cwd=worktree,
diff --git a/pkgs/README.md b/pkgs/README.md
index 83d264d95085..eff9421efbfb 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -940,7 +940,8 @@ Update scripts are to be invoked by the [automatic package update script](../mai
 You can run `nix-shell maintainers/scripts/update.nix` in the root of Nixpkgs repository for information on how to use it.
 `update.nix` offers several modes for selecting packages to update, and it will execute update scripts for all matched packages that have an `updateScript` attribute.
 
-Each update script will be passed the following environment variables:
+Update scripts will be run inside the [Nixpkgs development shell](../shell.nix), providing access to some useful tools for CI.
+Furthermore each update script will be passed the following environment variables:
 
 - [`UPDATE_NIX_NAME`] – content of the `name` attribute of the updated package
 - [`UPDATE_NIX_PNAME`] – content of the `pname` attribute of the updated package