From 2e622cfeac3535b13abc14484cd6e3b142c825b4 Mon Sep 17 00:00:00 2001
From: Erik Jensen <erikjensen@rkjnsn.net>
Date: Wed, 29 Apr 2026 17:58:33 -0700
Subject: [PATCH 01/61] llvm: Make llvm_21 etc honor llvmPackages overrides

Instead of referring to llvmPackages_21 et cetera within an anonymous
rec, they now refer to the top-level attributes. This means overriding
llvmPackages_21 will also override llvm_21 and clang_21, not just llvm
and clang.
---
 pkgs/top-level/all-packages.nix | 90 ++++++++++++---------------------
 1 file changed, 32 insertions(+), 58 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3f1e58a148d1..6543af0ed8c7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4343,79 +4343,53 @@ with pkgs;
       llvmPackagesSet = recurseIntoAttrs (callPackages ../development/compilers/llvm { });
 
       llvmPackages_18 = llvmPackagesSet."18";
-      clang_18 = llvmPackages_18.clang;
-      lld_18 = llvmPackages_18.lld;
-      lldb_18 = llvmPackages_18.lldb;
-      llvm_18 = llvmPackages_18.llvm;
-
       llvmPackages_19 = llvmPackagesSet."19";
-      clang_19 = llvmPackages_19.clang;
-      lld_19 = llvmPackages_19.lld;
-      lldb_19 = llvmPackages_19.lldb;
-      llvm_19 = llvmPackages_19.llvm;
-      bolt_19 = llvmPackages_19.bolt;
-
       llvmPackages_20 = llvmPackagesSet."20";
-      clang_20 = llvmPackages_20.clang;
-      lld_20 = llvmPackages_20.lld;
-      lldb_20 = llvmPackages_20.lldb;
-      llvm_20 = llvmPackages_20.llvm;
-      bolt_20 = llvmPackages_20.bolt;
-      flang_20 = llvmPackages_20.flang;
-
       llvmPackages_21 = llvmPackagesSet."21";
-      clang_21 = llvmPackages_21.clang;
-      lld_21 = llvmPackages_21.lld;
-      lldb_21 = llvmPackages_21.lldb;
-      llvm_21 = llvmPackages_21.llvm;
-      bolt_21 = llvmPackages_21.bolt;
-      flang_21 = llvmPackages_21.flang;
-
       llvmPackages_22 = llvmPackagesSet."22";
-      clang_22 = llvmPackages_22.clang;
-      lld_22 = llvmPackages_22.lld;
-      lldb_22 = llvmPackages_22.lldb;
-      llvm_22 = llvmPackages_22.llvm;
-      bolt_22 = llvmPackages_22.bolt;
-      flang_22 = llvmPackages_22.flang;
 
       mkLLVMPackages = llvmPackagesSet.mkPackage;
     })
     llvmPackages_18
-    clang_18
-    lld_18
-    lldb_18
-    llvm_18
     llvmPackages_19
-    clang_19
-    lld_19
-    lldb_19
-    llvm_19
-    bolt_19
     llvmPackages_20
-    clang_20
-    lld_20
-    lldb_20
-    llvm_20
-    bolt_20
-    flang_20
     llvmPackages_21
-    clang_21
-    lld_21
-    lldb_21
-    llvm_21
-    bolt_21
-    flang_21
     llvmPackages_22
-    clang_22
-    lld_22
-    lldb_22
-    llvm_22
-    bolt_22
-    flang_22
     mkLLVMPackages
     ;
 
+  clang_18 = llvmPackages_18.clang;
+  lld_18 = llvmPackages_18.lld;
+  lldb_18 = llvmPackages_18.lldb;
+  llvm_18 = llvmPackages_18.llvm;
+
+  clang_19 = llvmPackages_19.clang;
+  lld_19 = llvmPackages_19.lld;
+  lldb_19 = llvmPackages_19.lldb;
+  llvm_19 = llvmPackages_19.llvm;
+  bolt_19 = llvmPackages_19.bolt;
+
+  clang_20 = llvmPackages_20.clang;
+  lld_20 = llvmPackages_20.lld;
+  lldb_20 = llvmPackages_20.lldb;
+  llvm_20 = llvmPackages_20.llvm;
+  bolt_20 = llvmPackages_20.bolt;
+  flang_20 = llvmPackages_20.flang;
+
+  clang_21 = llvmPackages_21.clang;
+  lld_21 = llvmPackages_21.lld;
+  lldb_21 = llvmPackages_21.lldb;
+  llvm_21 = llvmPackages_21.llvm;
+  bolt_21 = llvmPackages_21.bolt;
+  flang_21 = llvmPackages_21.flang;
+
+  clang_22 = llvmPackages_22.clang;
+  lld_22 = llvmPackages_22.lld;
+  lldb_22 = llvmPackages_22.lldb;
+  llvm_22 = llvmPackages_22.llvm;
+  bolt_22 = llvmPackages_22.bolt;
+  flang_22 = llvmPackages_22.flang;
+
   mitschemeX11 = mitscheme.override {
     enableX11 = true;
   };

From 235a7310bacde3336198300492f28541a727b7e0 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 22 Mar 2026 00:57:13 +0200
Subject: [PATCH 02/61] pkgs/README: explain more accurately
 passthru.updateScript & r-ryantm

---
 pkgs/README.md | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/README.md b/pkgs/README.md
index 8d6ab6e02353..d4ef5c3faebc 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -906,10 +906,14 @@ stdenv.mkDerivation {
 ## Automatic package updates
 [automatic-package-updates]: #automatic-package-updates
 
-Nixpkgs periodically tries to update all packages that have a `passthru.updateScript` attribute.
+The [community bot `r-ryantm`](https://nix-community.org/update-bot/), periodically tries to update all packages in Nixpkgs.
+`r-ryantm` runs the program [`nixpkgs-update`](https://nix-community.github.io/nixpkgs-update/) to find new versions of packages.
+In most cases, `nixpkgs-update` will be capable of finding new versions and perform the update with out any special instructions.
+Putting a `passthru.updateScript` attribute sets an explicit update procedure for `nixpkgs-update`, but this is not required for most cases.
+To learn more about the default update procedures, read their [FAQ for Nixpkgs maintainers](https://nix-community.github.io/nixpkgs-update/nixpkgs-maintainer-faq/).
 
 > [!Note]
-> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
+> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) function provided in Nixpkgs, which makes automatic updates use [`nix-update`](https://github.com/Mic92/nix-update):
 >
 > ```nix
 > { stdenv, nix-update-script }:
@@ -919,9 +923,10 @@ Nixpkgs periodically tries to update all packages that have a `passthru.updateSc
 > }
 > ```
 >
-> For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://github.com/nix-community/nixpkgs-update) when a new version is released.
-> The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set.
-> While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
+> `nix-update` is a little bit more flexible than `nixpkgs-update` in performing updates, so it can be useful for cases such as:
+>
+>  - A `nix-update` CLI flag like `--version branch` or `--version-regex` are needed to make the update work.
+>  - You don't want to rely upon new versions to be listed in [Repology](https://repology.org/), and `nix-update` finds new versions easily (e.g GitLab projects).
 
 The `passthru.updateScript` attribute can contain one of the following:
 

From 6b84b95a9e3cd35661459398fa71c6d7bfece431 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 13:49:52 +0000
Subject: [PATCH 03/61] litmusctl: 1.25.0 -> 1.26.0

---
 pkgs/by-name/li/litmusctl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
index 63179580d54f..b752a5686ce2 100644
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "litmusctl";
-  version = "1.25.0";
+  version = "1.26.0";
 
   nativeBuildInputs = [
     installShellFiles
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     owner = "litmuschaos";
     repo = "litmusctl";
     rev = "${finalAttrs.version}";
-    hash = "sha256-vHvTp6qOFblGbGatQ2YUJQIsJQgFzB/bbnTpMMzE4NY=";
+    hash = "sha256-Zo21QH6uO1uKcLbuirLiIXS4qOI40zbamt1G9sL0IWg=";
   };
 
   vendorHash = "sha256-Lkvc8dBr/nvKczx83/KXKLe5FskGpI/17GIrl2y/E1I=";

From fae2ab3dd73683029c389a43a1edc8dfd406c9cb Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 11 Jun 2026 12:45:27 +0530
Subject: [PATCH 04/61] nixosTests/cosmic: move test into a dedicated directory

---
 nixos/tests/all-tests.nix                      | 8 ++++----
 nixos/tests/{cosmic.nix => cosmic/default.nix} | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename nixos/tests/{cosmic.nix => cosmic/default.nix} (99%)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5b17b838e343..6f6f295a4ec0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -408,25 +408,25 @@ in
   corerad = runTest ./corerad.nix;
   corteza = runTest ./corteza.nix;
   cosmic = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin-noxwayland";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = false;
   };
   cosmic-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-noxwayland";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = false;
diff --git a/nixos/tests/cosmic.nix b/nixos/tests/cosmic/default.nix
similarity index 99%
rename from nixos/tests/cosmic.nix
rename to nixos/tests/cosmic/default.nix
index f7fde6ca0e0f..91f4ebe501ff 100644
--- a/nixos/tests/cosmic.nix
+++ b/nixos/tests/cosmic/default.nix
@@ -13,7 +13,7 @@
   meta.maintainers = lib.teams.cosmic.members;
 
   nodes.machine = {
-    imports = [ ./common/user-account.nix ];
+    imports = [ ../common/user-account.nix ];
 
     services = {
       # For `cosmic-store` to be added to `environment.systemPackages`

From 4ae53d27e507c04be833c57a3d2893262d7c7cc1 Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 11 Jun 2026 12:45:27 +0530
Subject: [PATCH 05/61] empty-pdf: init

---
 pkgs/by-name/em/empty-pdf/package.nix | 39 +++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/em/empty-pdf/package.nix

diff --git a/pkgs/by-name/em/empty-pdf/package.nix b/pkgs/by-name/em/empty-pdf/package.nix
new file mode 100644
index 000000000000..740f459efe1c
--- /dev/null
+++ b/pkgs/by-name/em/empty-pdf/package.nix
@@ -0,0 +1,39 @@
+{
+  stdenvNoCC,
+  imagemagick,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation {
+  name = "empty-pdf";
+  __structuredAttrs = true;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ imagemagick ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    magick xc:none -page Letter empty.pdf
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv empty.pdf $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Empty PDF file intended for testing";
+    maintainers = with lib.maintainers; [
+      pandapip1
+      thefossguy
+    ];
+    platforms = imagemagick.meta.platforms;
+  };
+}

From 0ef60272654cf0c2526891f24b681684b3554f7b Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 11 Jun 2026 12:45:27 +0530
Subject: [PATCH 06/61] nixosTests/cosmic: move core testing logic into a
 dedicated script

---
 nixos/tests/cosmic/default.nix        | 128 +++++++++++---------
 nixos/tests/cosmic/test-script.py     | 166 ++++++++++++++++++++++++++
 pkgs/by-name/em/empty-pdf/package.nix |   2 +
 3 files changed, 237 insertions(+), 59 deletions(-)
 create mode 100644 nixos/tests/cosmic/test-script.py

diff --git a/nixos/tests/cosmic/default.nix b/nixos/tests/cosmic/default.nix
index 91f4ebe501ff..671906f55b8c 100644
--- a/nixos/tests/cosmic/default.nix
+++ b/nixos/tests/cosmic/default.nix
@@ -7,6 +7,30 @@
   ...
 }:
 
+let
+  user = config.nodes.machine.users.users.alice;
+  logFilePath = "/home/${user.name}/${testName}";
+  # Use `writeShellScriptBin` instead of `writeShellScript` so that the
+  # process name in the journald log appears as 'cosmicTest[$pid]'
+  cosmicTest = config.node.pkgs.writeShellScriptBin "cosmicTest" ''
+    exec ${lib.getExe config.node.pkgs.python3Minimal} ${./test-script.py} \
+        --log-file-path ${logFilePath} \
+        --cosmic-reader-pdf ${config.node.pkgs.empty-pdf} \
+        --polkit-agent-helper-path ${config.node.pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1 \
+        --root-user-password ${user.password} \
+        --ydotool-drv-store-path ${config.node.pkgs.ydotool}
+  '';
+  cosmicTestDesktop = config.node.pkgs.makeDesktopItem {
+    name = "cosmicTest";
+    desktopName = "COSMIC NixOS VM test (${testName})";
+    exec = "cosmicTest";
+  };
+  cosmicTestAutostartItem = config.node.pkgs.makeAutostartItem {
+    name = "cosmicTest";
+    package = cosmicTestDesktop;
+  };
+in
+
 {
   name = testName;
 
@@ -30,10 +54,13 @@
 
     services.displayManager.autoLogin = lib.mkIf enableAutologin {
       enable = true;
-      user = "alice";
+      user = user.name;
     };
 
     environment.systemPackages = with config.node.pkgs; [
+      cosmicTest
+      cosmicTestAutostartItem
+
       # These two packages are used to check if a window was opened
       # under the COSMIC session or not. Kinda important.
       # TODO: Move the check from the test module to
@@ -58,27 +85,9 @@
 
   testScript =
     { nodes, ... }:
-    let
-      cfg = nodes.machine;
-      user = cfg.users.users.alice;
-      DISPLAY = lib.strings.optionalString enableXWayland (
-        if enableAutologin then "DISPLAY=:0" else "DISPLAY=:1"
-      );
-      emptyPDF = config.node.pkgs.stdenvNoCC.mkDerivation {
-        name = "empty-pdf";
-        dontUnpack = true;
-        nativeBuildInputs = [ config.node.pkgs.imagemagick ];
-        buildPhase = ''
-          magick xc:none -page Letter empty.pdf
-        '';
-        installPhase = ''
-          mkdir $out
-          mv empty.pdf $out/empty.pdf
-        '';
-      };
-    in
     ''
       #testName: ${testName}
+      import sys
     ''
     + (
       if enableAutologin then
@@ -91,7 +100,7 @@
           from time import sleep
 
           machine.wait_for_unit("graphical.target", timeout=120)
-          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
+          machine.wait_until_succeeds("pgrep --uid ${config.nodes.machine.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
           # Sleep for 10 seconds for ensuring that `greetd` loads the
           # password prompt for the login screen properly.
           sleep(10)
@@ -101,47 +110,48 @@
         ''
     )
     + ''
-          # _One_ of the final processes to start as part of the
-          # `cosmic-session` target is the Workspaces applet. So, wait
-          # for it to start. The process existing means that COSMIC
-          # now handles any opened windows from now on.
-          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'", timeout=30)
+      with subtest("xdg autostart support in cosmic"):
+          # When checking the status of our `cosmicTest` package with:
+          # `machine.wait_for_unit("app-cosmicTest@autostart.service", user="${user.name}")`
+          # We are immediately greeted with the error:
+          # ```
+          # subtest: xdg autostart support in cosmic
+          # machine: waiting for unit app-cosmicTest@autostart.service with user alice
+          # machine # [   26.497516] cosmic-comp[1352]: [EGL] 0x3008 (BAD_DISPLAY) eglCreateSync: _eglCreateSync
+          # machine # [   26.511706] su[1416]: Successful su for alice by root
+          # machine # [   26.528190] su[1416]: pam_unix(su:session): session opened for user alice(uid=1000) by (uid=0)
+          # machine # Failed to connect to user scope bus via local transport: No such file or directory
+          # machine # [   26.599563] su[1416]: pam_unix(su:session): session closed for user alice
+          # !!! Test "xdg autostart support in cosmic" failed with error: "retrieving systemctl property "ActiveState" for unit "app-cosmicTest@autostart.service" under user "alice" failed with exit code 1"
+          # ```
+          # Meaning, our session is extremely new and the D-Bus user
+          # session socket does not yet exist. Instead, lets poll for
+          # the log file that the test is guaranteed to write to, as
+          # soon as it starts.
+          machine.wait_for_file("${logFilePath}.log", timeout=120)
 
-      # The best way to test for Wayland and XWayland is to launch
-      # the GUI applications and see the results yourself.
-      with subtest("Launch applications"):
-          # key: binary_name
-          # value: "app-id" as reported by `lswt`
-          gui_apps_to_launch = {}
+      exit_code = 0
+      try:
+          machine.wait_for_file("${logFilePath}.done", timeout=700)
+      except Exception:
+          exit_code = 1
 
-          # We want to ensure that the first-party applications
-          # start/launch properly.
-          gui_apps_to_launch['cosmic-edit'] = 'com.system76.CosmicEdit'
-          gui_apps_to_launch['cosmic-files'] = 'com.system76.CosmicFiles'
-          gui_apps_to_launch['cosmic-player'] = 'com.system76.CosmicPlayer'
-          gui_apps_to_launch['cosmic-reader'] = 'com.system76.CosmicReader'
-          gui_apps_to_launch['cosmic-settings'] = 'com.system76.CosmicSettings'
-          gui_apps_to_launch['cosmic-store'] = 'com.system76.CosmicStore'
-          gui_apps_to_launch['cosmic-term'] = 'com.system76.CosmicTerm'
-
-          for gui_app, app_id in gui_apps_to_launch.items():
-              # Don't fail the test if binary is absent
-              if machine.execute(f"su - ${user.name} -c 'command -v {gui_app}'", timeout=5)[0] == 0:
-                  match gui_app:
-                      case 'cosmic-reader':
-                          opt_arg = '${emptyPDF}/empty.pdf'
-                      case _:
-                          opt_arg = ""
-
-                  machine.succeed(f"su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} ${DISPLAY} {gui_app} {opt_arg} >&2 &'", timeout=5)
-                  # Nix builds the following non-commented expression to the following:
-                  #                              `su - alice -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/1000 lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' `
-                  machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=60)
-                  machine.succeed(f"pkill {gui_app}", timeout=5)
-
-      machine.succeed("echo 'test completed succeessfully' > /${testName}", timeout=5)
-      machine.copy_from_machine('/${testName}')
+      # The log file is created in the very beginning of the test
+      # script's execution. If we are here, it means that the
+      # `wait_for_unit`'s "guard" on the test script's autostart unit
+      # plus the 630 second combined timeout of other two
+      # `wait_for_file`s, make it extremely likely for the log file to
+      # be present.
+      machine.copy_from_machine("${logFilePath}.log")
 
       machine.shutdown()
+
+      with open(f"{machine.out_dir}/${testName}.log") as test_log_file:
+          contents = test_log_file.read()
+          print(contents)
+          if any("Z [ERROR] [L:" in line for line in contents.splitlines()):
+              exit_code = 1
+
+      sys.exit(exit_code)
     '';
 }
diff --git a/nixos/tests/cosmic/test-script.py b/nixos/tests/cosmic/test-script.py
new file mode 100644
index 000000000000..be87c1088859
--- /dev/null
+++ b/nixos/tests/cosmic/test-script.py
@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+import argparse
+import logging
+import pathlib
+import subprocess
+import time
+
+
+def parse_cli_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--log-file-path",
+        required=True,
+        type=str,
+        help="The path to the log file (without the '.log' suffix/extension)",
+    )
+    parser.add_argument(
+        "--cosmic-reader-pdf",
+        required=True,
+        type=str,
+        help="The PDF that the `cosmic-reader` should open for testing",
+    )
+    args = parser.parse_args()
+    return args
+
+
+def wait_for_cosmic_de_readiness() -> None:
+    """
+    Wait for the COSMIC DE to be ready, before running the tests. This
+    is done by waiting on the supposedly last component of the COSMIC
+    DE to be "ready." That component is the notification watcher, of
+    the `cosmic-applet` derivation.
+    """
+    logging.info("=" * 80)
+    logging.info("Waiting for COSMIC DE to complete initialization")
+
+    notification_watcher_wait_deadline = time.monotonic() + 360
+    notification_watcher_exists = False
+    while time.monotonic() < notification_watcher_wait_deadline:
+        busctl_process = subprocess.run(
+            ["busctl", "--user", "status", "com.system76.CosmicStatusNotifierWatcher"],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        if busctl_process.returncode == 0:
+            notification_watcher_exists = True
+            break
+        else:
+            time.sleep(1)
+    logging_msg = "The COSMIC DE is "
+    if notification_watcher_exists:
+        logging.info(f"{logging_msg} ready")
+    else:
+        logging.error(f"{logging_msg} not ready")
+    return
+
+
+def perform_gui_application_test(cli_args: argparse.Namespace) -> None:
+    """
+    1. Start one GUI application as a background process.
+    2. Wait unil it has been confimred that the GUI application is
+       running.
+    3. Kill the background process of the GUI application.
+
+    Any breakage in this flow is considered a failure of the test for
+    the GUI application.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing test to launch GUI applications")
+
+    gui_apps_to_test = {
+        "com.system76.CosmicEdit": [
+            "cosmic-edit",
+        ],
+        "com.system76.CosmicFiles": [
+            "cosmic-files",
+        ],
+        "com.system76.CosmicPlayer": [
+            "cosmic-player",
+        ],
+        "com.system76.CosmicReader": [
+            "cosmic-reader",
+            cli_args.cosmic_reader_pdf,
+        ],
+        "com.system76.CosmicSettings": [
+            "cosmic-settings",
+        ],
+        "com.system76.CosmicStore": [
+            "cosmic-store",
+        ],
+        "com.system76.CosmicTerm": [
+            "cosmic-term",
+        ],
+    }
+
+    for gui_app_id, gui_app_command in gui_apps_to_test.items():
+        logging.info(f"Running: {gui_app_command}")
+        gui_app_bg_process = subprocess.Popen(
+            gui_app_command,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        gui_app_bg_process_deadline = time.monotonic() + 30
+        gui_app_is_running = False
+
+        while time.monotonic() < gui_app_bg_process_deadline and not gui_app_is_running:
+            lswt_process = subprocess.run(
+                [
+                    "lswt",
+                    "--custom",
+                    "a",
+                ],
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.DEVNULL,
+            )
+            lswt_process_stdout = lswt_process.stdout.strip()
+            if lswt_process_stdout:
+                if gui_app_id in lswt_process_stdout.splitlines():
+                    gui_app_is_running = True
+            time.sleep(1)
+        pkill_process = subprocess.run(
+            ["pkill", gui_app_command[0]],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
+        )
+
+        log_message = (
+            f"The GUI application test for '{gui_app_command[0]}' ({gui_app_id})"
+        )
+        if gui_app_is_running:
+            logging.info(f"{log_message} passed")
+        else:
+            logging.error(f"{log_message} failed")
+    return
+
+
+def main() -> None:
+    cli_args = parse_cli_args()
+    logging.basicConfig(
+        level=logging.INFO,
+        format=f"%(asctime)sZ [%(levelname)s] [L:%(lineno)d] %(message)s",
+        datefmt="%H:%M:%S",
+        handlers=[
+            logging.StreamHandler(),
+            logging.FileHandler(f"{cli_args.log_file_path}.log", mode="w"),
+        ],
+    )
+    logging.Formatter.converter = time.gmtime
+    logging.info(f"Logging to '{cli_args.log_file_path}.log'")
+
+    # Wait for the DE to be ready
+    wait_for_cosmic_de_readiness()
+
+    # tests go here
+    perform_gui_application_test(cli_args)
+
+    pathlib.Path(f"{cli_args.log_file_path}.done").touch()
+    return
+
+
+if __name__ == "__main__":
+    main()
diff --git a/pkgs/by-name/em/empty-pdf/package.nix b/pkgs/by-name/em/empty-pdf/package.nix
index 740f459efe1c..55b13e079355 100644
--- a/pkgs/by-name/em/empty-pdf/package.nix
+++ b/pkgs/by-name/em/empty-pdf/package.nix
@@ -6,7 +6,9 @@
 
 stdenvNoCC.mkDerivation {
   name = "empty-pdf";
+
   __structuredAttrs = true;
+  strictDeps = true;
 
   dontUnpack = true;
 

From 5b01aec3e870763711f35ef365248ea0772588d1 Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 11 Jun 2026 12:45:28 +0530
Subject: [PATCH 07/61] nixosTests/cosmic: add test for polkit authentication

---
 nixos/tests/cosmic/default.nix    |  15 ++-
 nixos/tests/cosmic/test-script.py | 149 ++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/cosmic/default.nix b/nixos/tests/cosmic/default.nix
index 671906f55b8c..3b6dce9f55a4 100644
--- a/nixos/tests/cosmic/default.nix
+++ b/nixos/tests/cosmic/default.nix
@@ -17,8 +17,7 @@ let
         --log-file-path ${logFilePath} \
         --cosmic-reader-pdf ${config.node.pkgs.empty-pdf} \
         --polkit-agent-helper-path ${config.node.pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1 \
-        --root-user-password ${user.password} \
-        --ydotool-drv-store-path ${config.node.pkgs.ydotool}
+        --root-user-password ${user.password}
   '';
   cosmicTestDesktop = config.node.pkgs.makeDesktopItem {
     name = "cosmicTest";
@@ -57,7 +56,19 @@ in
       user = user.name;
     };
 
+    users.users = {
+      alice.extraGroups = [
+        "uinput" # for ydotoold
+      ];
+
+      root.password = user.password;
+      root.hashedPasswordFile = lib.mkForce null;
+    };
+
+    hardware.uinput.enable = true;
+
     environment.systemPackages = with config.node.pkgs; [
+      ydotool
       cosmicTest
       cosmicTestAutostartItem
 
diff --git a/nixos/tests/cosmic/test-script.py b/nixos/tests/cosmic/test-script.py
index be87c1088859..07377fa95fac 100644
--- a/nixos/tests/cosmic/test-script.py
+++ b/nixos/tests/cosmic/test-script.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import argparse
 import logging
+import os
 import pathlib
 import subprocess
 import time
@@ -20,10 +21,38 @@ def parse_cli_args() -> argparse.Namespace:
         type=str,
         help="The PDF that the `cosmic-reader` should open for testing",
     )
+    parser.add_argument(
+        "--polkit-agent-helper-path",
+        required=True,
+        type=str,
+        help="The path to the polkit agent helper (`${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1`)",
+    )
+    parser.add_argument(
+        "--root-user-password", required=True, type=str, help="The root user's password"
+    )
     args = parser.parse_args()
     return args
 
 
+def start_ydotool_daemon() -> tuple[str, subprocess.Popen]:
+    """
+    The ydotool requires a daemon to be running.
+    """
+    xdg_runtime_dir = os.getenv("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    ydotool_daemon_socket_path = f"{xdg_runtime_dir}/.ydotool_socket"
+    ydotool_daemon_process = subprocess.Popen(
+        [
+            "ydotoold",
+            "--socket-path",
+            ydotool_daemon_socket_path,
+            "--mouse-off",
+        ],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return ydotool_daemon_socket_path, ydotool_daemon_process
+
+
 def wait_for_cosmic_de_readiness() -> None:
     """
     Wait for the COSMIC DE to be ready, before running the tests. This
@@ -56,6 +85,121 @@ def wait_for_cosmic_de_readiness() -> None:
     return
 
 
+def perform_polkit_authentication_test(
+    cli_args: argparse.Namespace,
+    ydotool_daemon_socket_path: str,
+    ydotool_daemon_process: subprocess.Popen,
+) -> None:
+    """
+    1. Run `pkexec` as a background process that produces a specific
+       output to stdout upon successful completion.
+    2. Wait unil it has been confimred that `cosmic-osd` has created
+       a pop-up requesting the root user's password.
+    3. Use ydotool to type the root user's password in the pop-up
+       prompt.
+    4. Ensure that the the `pkexec` background process' stdout matches
+       the output that we expect.
+
+    Any breakage in this flow is considered a failure of the polkit
+    authenticaion test.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing polkit authentication test")
+
+    polkit_test_passed = False
+    polkit_test_command = [
+        "pkexec",
+        "--disable-internal-agent",
+        "bash",
+        "-c",
+        "echo -n 'polkit test was successful'",
+    ]
+    logging.info(f"Running: {polkit_test_command}")
+    polkit_test_process = subprocess.Popen(
+        polkit_test_command,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    polkit_popup_deadline = time.monotonic() + 60
+    pop_up_msg = "the pop-up for polkit password authentication"
+    encountered_polkit_authentication_popup = False
+    while time.monotonic() < polkit_popup_deadline:
+        polkit_popup_check_process = subprocess.run(
+            [
+                "pgrep",
+                "-afx",
+                f"{cli_args.polkit_agent_helper_path} --socket-activated",
+            ],
+            check=False,
+        )
+        if polkit_popup_check_process.returncode == 0:
+            encountered_polkit_authentication_popup = True
+            logging.info(f"Noticed {pop_up_msg}")
+            if ydotool_daemon_process.poll() is None:
+                # The polkit-agent-helper process exists, but that
+                # doesn't necessarily mean that the pop-up is
+                # **rendered** and ready to accept the password. So we
+                # sleep for a few seconds.
+                time.sleep(20)
+                ydotool_process = subprocess.run(
+                    [
+                        "ydotool",
+                        "type",
+                        "--key-delay=500",
+                        f"{cli_args.root_user_password}\n",
+                    ],
+                    env={
+                        **os.environ.copy(),
+                        "YDOTOOL_SOCKET": ydotool_daemon_socket_path,
+                    },
+                    check=False,
+                )
+                ydotool_msg = (
+                    "the root user's password in the pop-up for polkit authentication"
+                )
+                if ydotool_process.returncode == 0:
+                    logging.info(f"ydotool typed {ydotool_msg}")
+                else:
+                    logging.error(f"ydotool did not type {ydotool_msg}")
+            else:
+                logging.error(
+                    "The ydotool daemon exited for some reason before it could be used"
+                )
+            break
+        time.sleep(1)
+    if not encountered_polkit_authentication_popup:
+        logging.error(f"Did not notice {pop_up_msg}")
+
+    polkit_test_process_stdout = ""
+    polkit_test_process_stderr = ""
+    try:
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate(timeout=45)
+        )
+    except subprocess.TimeoutExpired:
+        polkit_test_process.kill()
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate()
+        )
+
+    logging.info(f"polkit stdout: '{polkit_test_process_stdout}'")
+    logging.info(f"polkit stderr: '{polkit_test_process_stderr}'")
+
+    if polkit_test_process_stdout:
+        logging.info(f"pkexec command stdout: {polkit_test_process_stdout}")
+        polkit_test_passed = "polkit test was successful" in polkit_test_process_stdout
+    else:
+        logging.warning("Could not capture stdout from the polkit test command")
+
+    if polkit_test_passed:
+        logging.info("The polkit authentication test passed")
+    else:
+        logging.error("The polkit authentication test failed")
+    return
+
+
 def perform_gui_application_test(cli_args: argparse.Namespace) -> None:
     """
     1. Start one GUI application as a background process.
@@ -152,10 +296,15 @@ def main() -> None:
     logging.Formatter.converter = time.gmtime
     logging.info(f"Logging to '{cli_args.log_file_path}.log'")
 
+    ydotool_daemon_socket_path, ydotool_daemon_process = start_ydotool_daemon()
+
     # Wait for the DE to be ready
     wait_for_cosmic_de_readiness()
 
     # tests go here
+    perform_polkit_authentication_test(
+        cli_args, ydotool_daemon_socket_path, ydotool_daemon_process
+    )
     perform_gui_application_test(cli_args)
 
     pathlib.Path(f"{cli_args.log_file_path}.done").touch()

From 2d5d2d913f1c39ae25b28dad083d4c84449d6ee7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 14 Jun 2026 20:42:39 +0000
Subject: [PATCH 08/61] steam-devices-udev-rules: 1.0.0.61-unstable-2026-04-16
 -> 1.0.0.61-unstable-2026-06-11

---
 pkgs/by-name/st/steam-devices-udev-rules/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/steam-devices-udev-rules/package.nix b/pkgs/by-name/st/steam-devices-udev-rules/package.nix
index b84491ff06d7..1528acb4cd4c 100644
--- a/pkgs/by-name/st/steam-devices-udev-rules/package.nix
+++ b/pkgs/by-name/st/steam-devices-udev-rules/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "steam-devices-udev-rules";
-  version = "1.0.0.61-unstable-2026-04-16";
+  version = "1.0.0.61-unstable-2026-06-11";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "steam-devices";
-    rev = "39e7bd00f7a322e5165fd8f416b31d23daf6d385";
-    hash = "sha256-QjFyzSwqwzPz06Wcj7in91tlhaxgw0DydLgsjC+i6Lo=";
+    rev = "bbf6cf03104aed5f73ac2798bdb09dc63ea3adf8";
+    hash = "sha256-22blCo0NpPE39BevFsj/Xtz2K59eyPW1xjhJMXAoR/k=";
   };
 
   nativeBuildInputs = [

From c10d707d4e7ea63dafb20de52a50819f53842f6c Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Mon, 15 Jun 2026 23:12:21 +0700
Subject: [PATCH 09/61] python3Packages.webrtcvad: migrate to pyproject

---
 pkgs/development/python-modules/webrtcvad/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/webrtcvad/default.nix b/pkgs/development/python-modules/webrtcvad/default.nix
index 2bc09f2e0c57..1f0c6f2decae 100644
--- a/pkgs/development/python-modules/webrtcvad/default.nix
+++ b/pkgs/development/python-modules/webrtcvad/default.nix
@@ -2,18 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "webrtcvad";
   version = "2.0.10";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "f1bed2fb25b63fb7b1a55d64090c993c9c9167b28485ae0bcdd81cf6ede96aea";
   };
 
+  build-system = [ setuptools ];
+
   # required WAV files for testing are not included in the tarball
   doCheck = false;
 

From 36159b76f798fe2cb9de642bcd0952b17ab86589 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Mon, 15 Jun 2026 23:13:44 +0700
Subject: [PATCH 10/61] python3Packages.webrtcvad: modernize

---
 .../development/python-modules/webrtcvad/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/webrtcvad/default.nix b/pkgs/development/python-modules/webrtcvad/default.nix
index 1f0c6f2decae..b18d159fcdd4 100644
--- a/pkgs/development/python-modules/webrtcvad/default.nix
+++ b/pkgs/development/python-modules/webrtcvad/default.nix
@@ -5,14 +5,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "webrtcvad";
   version = "2.0.10";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "f1bed2fb25b63fb7b1a55d64090c993c9c9167b28485ae0bcdd81cf6ede96aea";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-8b7S+yW2P7expV1kCQyZPJyRZ7KEha4Lzdgc9u3pauo=";
   };
 
   build-system = [ setuptools ];
@@ -20,10 +22,12 @@ buildPythonPackage rec {
   # required WAV files for testing are not included in the tarball
   doCheck = false;
 
+  pythonImportsCheck = [ "webrtcvad" ];
+
   meta = {
     description = "Interface to the Google WebRTC Voice Activity Detector (VAD)";
     homepage = "https://github.com/wiseman/py-webrtcvad";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ prusnak ];
   };
-}
+})

From 5c60e5cf4b55539099c200678c01e94fc8ecdb5e Mon Sep 17 00:00:00 2001
From: Manuel Mendez <git@i.m.mmlb.dev>
Date: Tue, 16 Jun 2026 15:53:09 -0400
Subject: [PATCH 11/61] flent: 2.2.0 -> 2.3.0, qt5 -> qt6, add binaries

I decided to add the binaries flent wants instead of leaving it to the
user to ensure they are around because its easier to use that way since
these aren't really optional. flent-gui doesn't always need it but
compared to qt these binaries don't take up much space.

I also switched to using buildPythonApplication's makeWrapperArgs
instead of hacking it in preFixup since this worked fine and seems
better to use the explicitly supported way.
---
 pkgs/by-name/fl/flent/package.nix | 34 +++++++++++++++++++------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/fl/flent/package.nix b/pkgs/by-name/fl/flent/package.nix
index 3c75ba139927..523f72e2659b 100644
--- a/pkgs/by-name/fl/flent/package.nix
+++ b/pkgs/by-name/fl/flent/package.nix
@@ -2,18 +2,21 @@
   lib,
   python3Packages,
   fetchPypi,
+  qt6,
+  irtt,
+  iputils,
+  netperf,
   procps,
-  qt5,
   nix-update-script,
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flent";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-BPwh3oWIY1YEI+ecgi9AUiX4Ka/Y5dYikwmfvvNB+eg=";
+    hash = "sha256-qy+BvMpBDBtBqEEM9yEko/Gb2pusxF/LqiutSKlS2eE=";
   };
 
   build-system = with python3Packages; [
@@ -21,11 +24,23 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sphinx
   ];
 
-  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
+  buildInputs = [ qt6.qtbase ];
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      iputils
+      irtt
+      netperf
+      procps
+    ])
+  ];
 
   dependencies = with python3Packages; [
     matplotlib
-    pyqt5
+    pyqt6
     qtpy
   ];
 
@@ -36,17 +51,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sed -i 's|self.skip|pass; #&|' unittests/test_gui.py
 
     # Dummy qt setup for gui tests
-    export QT_PLUGIN_PATH="${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_PLUGIN_PATH="${qt6.qtbase}/${qt6.qtbase.qtPluginPrefix}"
     export QT_QPA_PLATFORM=offscreen
   '';
 
-  preFixup = ''
-    makeWrapperArgs+=(
-      "''${qtWrapperArgs[@]}"
-      --prefix PATH : ${lib.makeBinPath [ procps ]}
-    )
-  '';
-
   passthru.updateScript = nix-update-script { };
   meta = {
     description = "FLExible Network Tester";

From 815c186941c92a48c8d71f4de3f9568e25114d83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 04:09:54 +0000
Subject: [PATCH 12/61] mcp-grafana: 0.15.2 -> 0.16.0

---
 pkgs/by-name/mc/mcp-grafana/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 1cbef5c243a8..71b4cfbbdc3f 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qjK8v3nUTGcBWdEF1hMKDRQtPKcYbZRU5+O8D89eZHI=";
+    hash = "sha256-/K7m+VexScHppGuxKsGpz18WmJ3Xphmk2/nCHphwL1o=";
   };
 
   vendorHash = "sha256-E7Uh5nG6elUhEa+4RCtgGrle0Py6TjRc+OOvjtik1D8=";

From a722412e20cc483e1e55c8a09ea33ca612b47187 Mon Sep 17 00:00:00 2001
From: algorithmiker <104317939+algorithmiker@users.noreply.github.com>
Date: Sat, 20 Jun 2026 11:29:29 +0200
Subject: [PATCH 13/61] anki-bin: 25.02.5 -> 26.05

There are now separate upstream sources for aarch64-linux and
x86_64-linux, so split them too.
---
 pkgs/by-name/an/anki-bin/package.nix | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/an/anki-bin/package.nix b/pkgs/by-name/an/anki-bin/package.nix
index 8850e149e682..d3f7622c0820 100644
--- a/pkgs/by-name/an/anki-bin/package.nix
+++ b/pkgs/by-name/an/anki-bin/package.nix
@@ -15,22 +15,26 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "25.02.5";
+  version = "26.05";
 
   sources = {
-    linux = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      hash = "sha256-wYFqT1g+rtoqOR7+Bb5mIJLZ5JdT2M1kcHqJUCuNElA=";
+    linux-aarch64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-aarch64.tar.zst";
+      hash = "sha256-z/w7+TKLW+xi/iJMXGOp50Yjwnv7FD5O0lNsu31dfqo=";
+    };
+    linux-x86_64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-x86_64.tar.zst";
+      hash = "sha256-YiPXBVY/catAzgcqXZajkZxUbV3eHkxJ3CeXXnAGcnQ=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      hash = "sha256-PDlu+oFKWHraPdTuGDCUkO0bhPtkNVibo11B1QkCICw=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel.dmg";
+      hash = "sha256-L/TXKh0cmTop7/ROA9YC4dyBz9iAFRhpXuNRbR3wwYk=";
     };
     darwin-aarch64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      hash = "sha256-RqcGHXN29GDGGuFbrQCBmj3cctzoRQZ8svR5hMYPhxs=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple.dmg";
+      hash = "sha256-c5NZf0uWNB7XQDYBDtgrtCU+A5Cuck0rJ1xFG8hY0Sc=";
     };
   };
 
@@ -38,7 +42,7 @@ let
     inherit pname version;
 
     nativeBuildInputs = [ zstd ];
-    src = sources.linux;
+    src = if stdenv.hostPlatform.isAarch64 then sources.linux-aarch64 else sources.linux-x86_64;
 
     installPhase = ''
       runHook preInstall
@@ -64,6 +68,7 @@ let
       ;
     platforms = [
       "x86_64-linux"
+      "aarch64-linux"
       "x86_64-darwin"
       "aarch64-darwin"
     ];

From 213ab67b8aee1d1e0e1425e7d889940fde3b3e29 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 10:50:59 +0000
Subject: [PATCH 14/61] libretro-shaders-slang: 0-unstable-2026-06-10 ->
 0-unstable-2026-06-19

---
 pkgs/by-name/li/libretro-shaders-slang/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index 3baaf9e86f5d..7536aa81085b 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-06-10";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "140d1bcc67a7287670ad6a02fc77e11c10ef5e07";
-    hash = "sha256-EejHojtJDnhgYk5PM8RTiCdV5TCeqcszodHQvs6vVIU=";
+    rev = "8ec4c82cf61a6ce3faae1e6111457d0d31920b60";
+    hash = "sha256-nPmDmuaa64I0QMHoUTr1nD6g3STyx0+cW3tY/q26M4A=";
   };
 
   dontConfigure = true;

From aa7020f8b83af113d4c98f9e0c51e1a83739056c Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sat, 20 Jun 2026 10:45:58 -0500
Subject: [PATCH 15/61] teams-for-linux: 2.11.1 -> 2.12.0

Update teams-for-linux and generate the macOS .icns locally during Darwin builds.

electron-builder 26.15.3 tries to download its icon conversion toolset when only PNG icons are available. Using libicns keeps the build offline and points electron-builder at a prebuilt icon instead.
---
 pkgs/by-name/te/teams-for-linux/package.nix | 40 +++++++++++++++------
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 6533308cff6b..f090d766af06 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -6,6 +6,7 @@
   alsa-utils,
   copyDesktopItems,
   electron_41,
+  libicns,
   makeDesktopItem,
   makeWrapper,
   nix-update-script,
@@ -18,22 +19,23 @@ let
 in
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.11.1";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-XEu0x9g2mEsmY+vZtazTOzW6KNMRbrxlPck/kPNehmo=";
+    hash = "sha256-n9Ibno6NqiZ9W5KpPPZKD5/MTO8CKYdf/fXDf0cGsi4=";
   };
 
-  npmDepsHash = "sha256-urLRj7668NX7CaDWAVxAoOg+c1TmMyvf23Je+RmFwHE=";
+  npmDepsHash = "sha256-euf/6RtAO84ZtbdhglBd6gRCcg2m6a+fhthNvFzMlho=";
 
   nativeBuildInputs = [
     makeWrapper
     versionCheckHook
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ];
+  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ libicns ];
 
   doInstallCheck = stdenv.hostPlatform.isLinux;
 
@@ -48,13 +50,29 @@ buildNpmPackage rec {
     cp -r ${electron.dist}/. "$electron_dist"
     chmod -R u+w "$electron_dist"
 
-    npm exec electron-builder -- \
-        --dir \
-        -c.npmRebuild=true \
-        -c.asarUnpack="**/*.node" \
-        -c.electronDist="$electron_dist" \
-        -c.electronVersion=${electron.version} \
-        -c.mac.identity=null
+    electron_builder_args=(
+      --dir
+      -c.npmRebuild=true
+      -c.asarUnpack="**/*.node"
+      -c.electronDist="$electron_dist"
+      -c.electronVersion=${electron.version}
+      -c.mac.identity=null
+    )
+
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    png2icns build/icon.icns \
+      build/icons/16x16.png \
+      build/icons/32x32.png \
+      build/icons/128x128.png \
+      build/icons/256x256.png \
+      build/icons/512x512.png \
+      build/icons/1024x1024.png
+    electron_builder_args+=(-c.mac.icon=build/icon.icns)
+  ''
+  + ''
+
+    npm exec electron-builder -- "''${electron_builder_args[@]}"
 
     runHook postBuild
   '';

From 1090d5a50487914929e1b2b7c89dccb2c4220705 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 18:33:25 +0000
Subject: [PATCH 16/61] spotatui: 0.38.6 -> 0.39.1

---
 pkgs/by-name/sp/spotatui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 1cb050cda77e..f4877a86c2d3 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.38.6";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2H/HvyGc2xxP1S0eiP2eSiBOjkzKdqyOOD+8mLVLvE0=";
+    hash = "sha256-fuOSJSN5bKKmEVZZnzckNOxGK1+gDC9pU0vO7MHowis=";
   };
 
-  cargoHash = "sha256-3Ht4LjwFmmf07XizPrH66V2yPkOzrY4dVvvA4GRAcTs=";
+  cargoHash = "sha256-fe86HbNckgFruPl8KIW2akW6qFOpR98iCde9kRXthpM=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 

From 2db69915e44c6b7270c4e90516f30f39779ce313 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 19:58:01 +0000
Subject: [PATCH 17/61] rosa: 1.2.63 -> 1.2.64

---
 pkgs/by-name/ro/rosa/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ro/rosa/package.nix b/pkgs/by-name/ro/rosa/package.nix
index 33b7316540a3..377851a1bf19 100644
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rosa";
-  version = "1.2.63";
+  version = "1.2.64";
 
   src = fetchFromGitHub {
     owner = "openshift";
     repo = "rosa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8+4Ip9PGSIIfZ1zfkihrahh/65fBBAYWhVqdpeP0eB0=";
+    hash = "sha256-lvulPx9Vyo84Lt1yo/7LKsWEh0ABkRxhusXyO/aUVrU=";
   };
   vendorHash = null;
 

From c96daf0658bed262e3bf31dfa31d0c249652d48a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 05:18:09 +0000
Subject: [PATCH 18/61] seconlay: 0-unstable-2026-06-09 ->
 0-unstable-2026-06-18

---
 pkgs/by-name/se/seconlay/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/se/seconlay/package.nix b/pkgs/by-name/se/seconlay/package.nix
index 772e9ece00e1..3394ddee73cf 100644
--- a/pkgs/by-name/se/seconlay/package.nix
+++ b/pkgs/by-name/se/seconlay/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "seconlay";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-18";
 
   src = fetchFromGitLab {
     group = "alasca.cloud";
     owner = "scl";
     repo = "scl-management";
-    rev = "1b410ebd9775faa116629a7bec01463ce9038a56";
-    hash = "sha256-Qq7bX1C+QTcYXfn8DGJwZZT0N1YfbywUe9jwqdReNLU=";
+    rev = "bd2d56e3537824537390cb0ba5e9efd4db1410c2";
+    hash = "sha256-f/eySU2lq1DwFPZ1CD8P7EeVO8b26Fz6d3PH3OrTm/0=";
   };
 
-  cargoHash = "sha256-pb9xqdgWrf8Lc10jSkkDb/1n0e15fMQ3AcKNPw6/vi8=";
+  cargoHash = "sha256-aX5HL/zDdrQ+V4vCYZrqlO2vNWuvF4GW2P30jtbv1tE=";
 
   nativeBuildInputs = [
     pkg-config

From c1b4acfe475026e454d3d44b60c8627b252155dc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 11:23:56 +0000
Subject: [PATCH 19/61] rust-rpxy: 0.13.0 -> 0.13.2

---
 pkgs/by-name/ru/rust-rpxy/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-rpxy/package.nix b/pkgs/by-name/ru/rust-rpxy/package.nix
index 9f241b19209c..78b9ce583b12 100644
--- a/pkgs/by-name/ru/rust-rpxy/package.nix
+++ b/pkgs/by-name/ru/rust-rpxy/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-rpxy";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "junkurihara";
     repo = "rust-rpxy";
     tag = finalAttrs.version;
-    hash = "sha256-YGXvRnpDKUi1qGJasTUrfa95AWsHAT+V/La1WOZIUkI=";
+    hash = "sha256-fdpr6HWMuMT0nXj7V5JQbiLVOGoWaTsX1OI+yCEErDA=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-CiauwBhv9Phdlpe7V9KwmgUvMSSFBLYPrlDl1lRT5/c=";
+  cargoHash = "sha256-WsK7eQffO+Ehx6H2Jj99XWON1Wc3Ud5Yaq1Nyz/oeSY=";
 
   meta = {
     description = "Http reverse proxy serving multiple domain names and terminating TLS for http/1.1, 2 and 3, written in Rust";

From 830e3bdc80648d5e37281fa362213646822325b0 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 21 Jun 2026 13:44:20 +0200
Subject: [PATCH 20/61] ci/OWNERS: add rust team as owner of rust related
 packages

---
 ci/OWNERS | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/OWNERS b/ci/OWNERS
index 463c546e695b..7dbf1fa8c203 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -223,10 +223,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
-/pkgs/build-support/rust @winterqt
+/pkgs/development/compilers/rust @NixOS/rust @alyssais
+/pkgs/build-support/rust @NixOS/rust
 /pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @winterqt
+/doc/languages-frameworks/rust.section.md @NixOS/rust
 
 # Tcl
 /pkgs/development/interpreters/tcl  @fgaz

From 856e735777ddcd1be1bd94e5eeca2268060f7ec0 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 21 Jun 2026 22:25:20 +0800
Subject: [PATCH 21/61] xviewer: Use upstream patch for GIR 2.0

---
 pkgs/by-name/xv/xviewer/package.nix | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index 9347aed1b81c..3b939468aff0 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   docbook_xsl,
   exempi,
   gdk-pixbuf,
@@ -38,6 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ayd91gVLuSUVlCxaPSBbx7hg4tthVTaBEnl5V9YYbQw=";
   };
 
+  patches = [
+    # build: Add support for GIRepository-2.0.
+    (fetchpatch {
+      url = "https://github.com/linuxmint/xviewer/commit/74d7d4ba2584c658ae6fb87208543671664943cc.patch";
+      hash = "sha256-lL4MTvC2RvdVZ4O5RaYyK+1sHnLGPYzGNbZ99aN22U8=";
+    })
+  ];
+
   nativeBuildInputs = [
     docbook_xsl
     gobject-introspection
@@ -66,18 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     xapp
   ];
 
-  postPatch = ''
-    # Switch to girepository-2.0
-    substituteInPlace src/main.c \
-      --replace-fail "#include <girepository.h>" "#include <girepository/girepository.h>" \
-      --replace-fail "g_irepository_get_option_group" "gi_repository_get_option_group"
-
-    substituteInPlace src/xviewer-plugin-engine.c \
-      --replace-fail "#include <girepository.h>" "#include <girepository/girepository.h>" \
-      --replace-fail "g_irepository_get_default" "gi_repository_dup_default" \
-      --replace-fail "g_irepository_require" "gi_repository_require"
-  '';
-
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"

From 41fd35bd3ee956f21123cd03f65d2475a3496cf7 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 21 Jun 2026 22:26:27 +0800
Subject: [PATCH 22/61] xviewer: Support avif, heif, jxl, webp

Same as Nixpkgs PR 533230.
---
 pkgs/by-name/xv/xviewer/package.nix | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index 3b939468aff0..1d1309d7792b 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -26,6 +26,11 @@
   yelp-tools,
   xapp,
   xapp-symbolic-icons,
+  gnome,
+  libavif,
+  libheif,
+  libjxl,
+  webp-pixbuf-loader,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -75,6 +80,21 @@ stdenv.mkDerivation (finalAttrs: {
     xapp
   ];
 
+  postInstall = ''
+    # In postInstall to run before gappsWrapperArgsHook.
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          libavif
+          libheif.lib
+          libjxl
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"

From 60f399e2721bc57968796d23f11c35bd7ba681ee Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 21 Jun 2026 11:09:06 -0400
Subject: [PATCH 23/61] nixpkgs-vet: 0.3.2 -> 0.3.3

Diff: https://github.com/NixOS/nixpkgs-vet/compare/v0.3.2...v0.3.3

Changelog: https://github.com/NixOS/nixpkgs-vet/blob/refs/tags/v0.3.3/CHANGELOG.md
---
 pkgs/by-name/ni/nixpkgs-vet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixpkgs-vet/package.nix b/pkgs/by-name/ni/nixpkgs-vet/package.nix
index 2901878e9a94..69a65f20052d 100644
--- a/pkgs/by-name/ni/nixpkgs-vet/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-vet/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nixpkgs-vet";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixpkgs-vet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GJhN77zLtV2fUEL5wxjcybtDqUa6ODg39d3UxuOrapo=";
+    hash = "sha256-vOKZ5Da6PMI39WlOS7CXDME3oCvJw64dQDEfaCsDL0A=";
   };
 
-  cargoHash = "sha256-zTh18jec0trJP4q3rYheHZz01lbkhpDaotuPbvgzMpo=";
+  cargoHash = "sha256-9XQvmYO4bw57NoKsXTY281fMQE0vjV3pvoRlrUaRX3o=";
 
   doCheck = false;
 

From fea2a7d572be04b847f355dbb71ad5dc44192f21 Mon Sep 17 00:00:00 2001
From: Jhony Elmer Angulo Fabian <leohjaf@gmail.com>
Date: Wed, 17 Jun 2026 10:25:24 -0500
Subject: [PATCH 24/61] aws-cdk-cli: 2.1116.0 -> 2.1127.0

The upstream project now ships a Yarn Berry lockfile with metadata
version 8. The previous fetchYarnDeps/prefetch-yarn-deps flow only
supports Yarn v1 lockfiles, so it failed before dependency hashes could
be updated.

Switch dependency fetching to yarn-berry_4.fetchYarnBerryDeps and install
dependencies with yarnBerryConfigHook. Add missing-hashes.json for
optional platform packages whose checksums are omitted from yarn.lock, so
the offline cache can still be verified reproducibly.

Keep Yarn from refreshing or migrating the v8 lockfile during the Nix
build, and replace the Yarn v1 build/install hooks with explicit phases
compatible with Yarn Berry. Adjust the manual dependency copies for the
hoisted node_modules layout produced by the Berry node-modules linker.

Assisted-by: Codex (GPT-5.5)
---
 .../aw/aws-cdk-cli/missing-hashes.json        | 57 +++++++++++++++++++
 pkgs/by-name/aw/aws-cdk-cli/package.nix       | 55 +++++++++++++-----
 2 files changed, 98 insertions(+), 14 deletions(-)
 create mode 100644 pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json

diff --git a/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
new file mode 100644
index 000000000000..07816f807684
--- /dev/null
+++ b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
@@ -0,0 +1,57 @@
+{
+  "@esbuild/aix-ppc64@npm:0.28.1": "9b01eaa9c57542436436de762466b9a348b4596aa53dffa6e7034e4180691e1948d33fe34ec302239ab04c280e5166248880f24531011ff419fbec6986a265f3",
+  "@esbuild/android-arm64@npm:0.28.1": "7c977c8d4cea5126df4b298d5c31c3df8d14aa05d7477aa11c4147ec7baff17d25542234eea0134f279191b59cb1af18fee49c6916afda554484464129e4f9c3",
+  "@esbuild/android-arm@npm:0.28.1": "44baed9765216202f71b6aae8d9ddb930efa671d34f63f4220d980662b3df4da7972e965c0a0f12922147aa8428083686f6cb23cd9a4f140eaf922ae0b59c2a0",
+  "@esbuild/android-x64@npm:0.28.1": "1b8183640bef23f41a91598d898a04a6a8e3ca31d0100207c7e75928ee885878c04e3bcf31f27ed9c655d6d8a7c08e35e3afef035aee649488cb2d68e51abf1e",
+  "@esbuild/darwin-arm64@npm:0.28.1": "8ed80a99836df196c2b7996448eabb2d503ec8c71d0a8be59af4eed457b858fa5fd9292528b1967f0e106d2a045387e375207a2cc262cd45f89596681e94e7fd",
+  "@esbuild/darwin-x64@npm:0.28.1": "952b23f33c24aea13f5a78fd41731e06e8c7fa732e10995327fa1289115da6b4123899ca0cdb0cf0a56add29efcb9f7891ad6fda0bfb94541347275537a71e77",
+  "@esbuild/freebsd-arm64@npm:0.28.1": "cc2c4f1f13230607807c3f128680d789e85d4b93309501c4f8d84ed0674f4a2a3e60e279e3b997ee9f797047c1c5b906b25e4fe37de62d19634e4470bcb16f32",
+  "@esbuild/freebsd-x64@npm:0.28.1": "5b99b980599567ee931520a019beaeea4c7ae2874d0bfab79ee4bd6373a869251d2175946478c527490ce155d10a5bcc795e8c986dceb4a36fb6e813513fc54c",
+  "@esbuild/linux-arm64@npm:0.28.1": "9348c6bfc2d878e6213cffe482d4455d817b9e56b3c581a9f68b94aac720cddea5733d963dec57ca273039f3a7ca1714f1ac8e39e2e0f85f1af42f5d05e3ed00",
+  "@esbuild/linux-arm@npm:0.28.1": "654d7af59b4be40f585455e42ecb389657c6f11b1f2be2d5ab04caeac0514574d8b2a28b9f0f9805d92e266a44a5627c5acc8151b0d0379f75ac1490fecc013d",
+  "@esbuild/linux-ia32@npm:0.28.1": "cce27fbd8d74f34bb5507a5db8c0119aa377c7a070fd0be3881a8efddcdb8adeebe24dc97d55784d74a8bf4a60fb55b48899f41b5e931acaa3eb9f90ecc94a01",
+  "@esbuild/linux-loong64@npm:0.28.1": "47c3215d378f5da750300694b273b83db26d3e9ed36553696a1769da6d467e7557e289b46d211c93ab7a2978348b7415b66c7fec31658622f5bd356332b9d5b0",
+  "@esbuild/linux-mips64el@npm:0.28.1": "166d8888e731bdeba0c657382d429c0a979af2136100ee2491ec47b2e2ec55f6924fe2045880b48a6cdaeb3dcc44fc495f3f4b9a5aa3bb8c418d1f53f86b2ba1",
+  "@esbuild/linux-ppc64@npm:0.28.1": "a8eecb9e43a26dcb70a9805e685dec9f0caff0a8bac691b06a6db7c14ba0a69980ef0c01cb3fc1377ad63e2c4945f396fbbeaf008588bb232e9c0c37dcdb557b",
+  "@esbuild/linux-riscv64@npm:0.28.1": "cfde883f336e1811fee019a1df402000c7a8e6dc5a2b3577679fd0d9711d1a774c1faa194cc8954b18ca11f3a380ef32905ea90c241803831b61017d8a667c3b",
+  "@esbuild/linux-s390x@npm:0.28.1": "ea121d2fb6c8f6161312e0239258b584c431b4d23f320ace7cbc18da77034aac5ed383658d2a48fdfa32e38be07126a14aa26802b8e04d0e958e82646fb87f41",
+  "@esbuild/linux-x64@npm:0.28.1": "9b5458cf012247e31c6bf465e37553f2fc5aef3fccc6593bb30fee0c547958f9f00fbedd44e5bc076cf68d6791a4af2ce8714260fe341cb16843a78643773e3d",
+  "@esbuild/netbsd-arm64@npm:0.28.1": "86b5cf33fbad27ea5e7345601e711a26717bdf5ad119efa0b1bb9ad6a75f7cb2658c57ffb80f19491e3c7105f4698e76358ee2b6d57f48c9a230de9f588589c7",
+  "@esbuild/netbsd-x64@npm:0.28.1": "ff24c209715f7f122c711d3c51af099de27659837d3f7bd4cbea9a8868fa99a10b7af785058d18a1e32b2132989d1d1d82b8768df77ff25ab6cf19d58be3697d",
+  "@esbuild/openbsd-arm64@npm:0.28.1": "fe6590621116132baa0a2b9c2dc95c6342f146170ec1ffb343c29936580c369a69061676bef4e654ee27bad6491f531af3ba985aed7133eb16b758fffae6a445",
+  "@esbuild/openbsd-x64@npm:0.28.1": "2600c51c394945654f99b096fccba95e1d34fa3ecf4e78f40a7aee4573bf21dd955c274e0586768e9ebef3bff145ffe30231f1cb281ef5e679f7aa78dcc86687",
+  "@esbuild/openharmony-arm64@npm:0.28.1": "be9e1d1e4af478778ce847e28809fba0b754340a699e37ec03bc1a3cd4e84e4fde30ffea62099757877229b024d50331efd6270580492aa6be38eb2353ef5646",
+  "@esbuild/sunos-x64@npm:0.28.1": "349b9c7d879496456b2eb28f7bb3decc12a906007bb7fb24cb2b269f6b3e5138af109045b216bd0396762e63b802f0233408cc3dce802be5fcf242d4835b6bc8",
+  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
+  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
+  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
+  "@nx/nx-darwin-arm64@npm:22.7.5": "4f8435566c4b7ea0de0c8953f994849b91ad85867f6cdfce67fc0bb7404a760131dad7bdb7c789f82980d349c1a6df255be03807da260cbc5396284395865f28",
+  "@nx/nx-darwin-x64@npm:22.7.5": "3d63123766ce58602f08c5c2e9e896d9bbba402c53f3918a0ea5eebab25cd2f48fb992ac654ea648088564b1347f920509f7a20ad25c538d227a11292024ce64",
+  "@nx/nx-freebsd-x64@npm:22.7.5": "6fa6ba0ab68e6fd9742c5bdc8cacbd67d3be6334b967c9dfa3a3fa5e64b689fa1d7b50f807420227ad470c53ad5cf8343240d35ed89ca8d3e62a921a4857e8b9",
+  "@nx/nx-linux-arm-gnueabihf@npm:22.7.5": "7fd2f207688a8353012f8363cc28868e927840c2378dba466a67dff50eabbf24362e6654e183c1308479d435e8326444ae4ab803e3f5bdf84061915124183f4f",
+  "@nx/nx-linux-arm64-gnu@npm:22.7.5": "03c8fa25e5833fe4746995624b15e72258b7050ee70a6d80ed4c2b0f5e8b740774264d1decf70eea61387028886b2360953675d554f2ee8b4ae784adf738ed7b",
+  "@nx/nx-linux-arm64-musl@npm:22.7.5": "ea449f0b82c027b6eae5f2a060d26624bee91b487b601ccb5ab250ff33140f4bd60cf004e8f5f1e495b9bd391c17bda4758635ddb80f1af29b234eb067517b2c",
+  "@nx/nx-linux-x64-gnu@npm:22.7.5": "96aad2912ef8a607147cb5831ddbfc6f08b3c657c44879c738055fde274259e2dfc7e507485c52c194e79445ca2410cf618e31e2d2af00f7563f04055beea3c7",
+  "@nx/nx-linux-x64-musl@npm:22.7.5": "1f61915a2e93a6b930b81b8205407e2c961f7878a5131f136027b86bd35a579fe65b52a47088c4818c6e6426b3aa79ece8ce30119a3e44dd4d5a681efd7cde4a",
+  "@nx/nx-win32-arm64-msvc@npm:22.7.5": "3f4668ce48fd341f487b99c72e7678ebdfa0964591a58947752bf050a4bb21bf27ee920ac4554433e0efd73beca923a17a6dfc90e35c8b5ee1f92fd4a7f2caa0",
+  "@nx/nx-win32-x64-msvc@npm:22.7.5": "c44700bd537a0f2571d75285302d332c0fa31a648a822937cd81362c7b4fcb8c8ecabb98559c0b7bcdb537acd051b4f3926bcd9e369095260fc6aa8d079e3c04",
+  "@unrs/resolver-binding-android-arm-eabi@npm:1.11.1": "04dd38b694c1680bfec192b499e188700398a414886a08a8a7c72815db56ac147df03d88c73ff6fff7ac3e0a01dc41978054b3622b49463e0d684c5168557fcc",
+  "@unrs/resolver-binding-android-arm64@npm:1.11.1": "763626adc34dd2b4af677b5ced6493e7b2b1935351a5c9137f1c9561d11faf97b94015e6876e57e85c33ff563564314c92c0882a4780a57f2225cbbd779a695d",
+  "@unrs/resolver-binding-darwin-arm64@npm:1.11.1": "03b477fdfec55dbabe488fe0962417bddaa38b028d2670053469f1d24163907b097aac15b565f6974449bee398a38d5e3e1525f2b515ce57e243149021b7aa2f",
+  "@unrs/resolver-binding-darwin-x64@npm:1.11.1": "3aeff9aaf4ef6d786c517d9017b5c41b0af180cdbaf705d08e6e5b5ba9d5410d28ef6754c5f8a865f0bb5efd460dc1c4156b5e2201032c0a604a6c734ddbc848",
+  "@unrs/resolver-binding-freebsd-x64@npm:1.11.1": "b9f7a3e03db9edfc3480db056dd25229f901f21840ee768b69f349b66676a995a404e60617b3bcbd984f57f2199eb352dd6fad0f4420c3084ceef5e3293cdad5",
+  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.11.1": "4d03b8bcef5a90586a846d6d332f39cee211f3d330b6e10036969894b6ecfb70b047265e985d572def93b84f38621dec30e4b4bb42699dd784adbae3ca5e7bea",
+  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.11.1": "9f3a3c2e5e6418a5a78294fa042824f5c270e993c1a99e82dd6b0ee0d2869929bb62dd154a0acc1e4ef16273e8073e0e257901208c062e6bdd49d586d07bb419",
+  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.11.1": "05228d6fd669f404f0e3164ccf2430a52cc7b3bbd211367527b5d726b1220a1816bab70159bed55694d9b7543553f6002379e7e186c605d7055c5156977da022",
+  "@unrs/resolver-binding-linux-arm64-musl@npm:1.11.1": "8115802143396d4992bb2f6f0acb6e8bc141a57864c5fd84cbc70577c25784cb08dd163b753b1fc0decc02582cf4cb1e30d04faaf763048babbbe706bdfa26ea",
+  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.11.1": "50f9f54b2eafb1ea023671cc3070692b2b15f6e49105b08b3f588033e65e8de4183f76e080b798de710f9c41df1bf5515c01868866a21cbd35db179b4ac9f23b",
+  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.11.1": "8f8222f938cc2025ed3971e0e303f4ff5aa5df74474b835442830ebe942d050ba3f8bbb67095da64099e6fc69bb5bb73ca63db54e059c95e51aa8909880fb207",
+  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.11.1": "5c8987f7dcaf38ef27ec67dcf118141502d5ac75d28429da6d1b7037f3e5a5351f32f55094472fde11784e65d01f1da4dafd7c0fdca28423fbc8de2c2c51d16c",
+  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.11.1": "17aed6472880a82e5a05147a55efb6f0d968f5dcb584845addf89acec3824534ee741d4b162686124d17daf9131373c469c57843996a5ee2db4f1b1b55e1d11e",
+  "@unrs/resolver-binding-linux-x64-gnu@npm:1.11.1": "9495c08fc42f2d4a33e33c64adbcbf51588cd7ea07478eacb2e9143d955a760122440f4a3ac48b086cc2563ca2b2464d72ed0336fcc20c0a89ddc356f956eda8",
+  "@unrs/resolver-binding-linux-x64-musl@npm:1.11.1": "c84fadfee66eeebd16eb7cce7c4b5a1ec90260c724d0064111e9f43a1341ebfede61627cb68fd3a9735e4c10b25606fb472a4d13143cc569867b80d85c4a9824",
+  "@unrs/resolver-binding-wasm32-wasi@npm:1.11.1": "655a3990ed9b238e8f0c4858f87ca84bd3d81db300f7730c885162333055170e11207af7789ff38f619e261178718f6977729e42ce7978cc9e6ac7b6d93822d5",
+  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.11.1": "983f800ff8b5181247a7d460ab5c9704cd425d0182e93290f69fb969d93efe17be6a27c22b97546d36e9a9d9aeda96d5f753bc938b3d9a00f32c10fc228ce5a9",
+  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.11.1": "383d639e3b08fc9e4ba18127ef55610172d2d1d6adb83e1466fff2b223552384cdc6217051f749829e0c90a757ea5631e8c4ad2cfeb59bdee2bb033fbd526854",
+  "@unrs/resolver-binding-win32-x64-msvc@npm:1.11.1": "c862561f6495c0dbffb94d421e5727b25c1b61d98e22383bff23e6719a6c0125bb0b7df3be7220f5480bf54f5a605ea572f10fff1cce14fda24d42e396559940"
+}
diff --git a/pkgs/by-name/aw/aws-cdk-cli/package.nix b/pkgs/by-name/aw/aws-cdk-cli/package.nix
index 7124ccac6707..3c6c407e32f8 100644
--- a/pkgs/by-name/aw/aws-cdk-cli/package.nix
+++ b/pkgs/by-name/aw/aws-cdk-cli/package.nix
@@ -2,40 +2,42 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
   nodejs,
-  yarnBuildHook,
-  yarnConfigHook,
-  yarnInstallHook,
+  yarn-berry_4,
   diffutils,
   zip,
   jq,
+  python3,
   unzip,
   testers,
   nix-update-script,
 }:
 
+let
+  yarn-berry = yarn-berry_4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-cdk-cli";
-  version = "2.1116.0";
+  version = "2.1127.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cdk-cli";
     tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-mRr5G42RrO87AdJOTLaM+EPprTFCI7eVxzUhafrGOxA=";
+    hash = "sha256-d55JNmWi4oTNorunkDwpdfcxHE9UC2fufKDahKgoLvk=";
   };
 
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-cjJBaq65sNWOFMFB1HAgGScxJlBZKnwkGipDd4aXhDE=";
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-eGj2Gx46lyypNz5e0U1AD1dVwOgJK4hkwXp03lR+6sc=";
   };
 
   nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
     nodejs
+    python3
     zip
     jq
     # tests
@@ -49,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     NX_VERBOSE_LOGGING = "true";
     # Needed to properly embed version info
     CODEBUILD_RESOLVED_SOURCE_VERSION = finalAttrs.version;
+    YARN_LOCKFILE_VERSION_OVERRIDE = "8";
   };
 
   # Regular "build" is very heavy and does things we don't need.
@@ -62,6 +65,13 @@ stdenv.mkDerivation (finalAttrs: {
     in
     ''
       echo '${cliVersionJson}' > packages/@aws-cdk/cloud-assembly-schema/cli-version.json
+      cat >> .yarnrc.yml <<'EOF'
+      approvedGitRepositories:
+        - "**"
+      enableScripts: true
+      enableNetwork: false
+      enableHardenedMode: false
+      EOF
     '';
 
   preBuild = ''
@@ -76,10 +86,27 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  buildPhase = ''
+    runHook preBuild
+
+    yarn "$yarnBuildScript"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/aws-cdk-cli
+    cp -r . $out/lib/node_modules/aws-cdk-cli
+
+    runHook postInstall
+  '';
+
   postInstall = ''
     # Manually bundle non-bundled dependencies
-    cp -r packages/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
-    cp -r packages/aws-cdk/node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
+    cp -r node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
+    cp -r node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
 
     patchShebangs "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin"
     ln -s "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin" "$out/bin"

From d9dc832bc54f95adae71b671e6feaed1edd91fd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 27 Feb 2026 02:17:01 +0100
Subject: [PATCH 25/61] python313Packages.bgutil-ytdlp-pot-provider: package
 server

---
 .../bgutil-ytdlp-pot-provider/default.nix     | 49 ++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
index a483b927ef28..9dc0ebb58fe6 100644
--- a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
+++ b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
@@ -1,8 +1,16 @@
 {
   lib,
   buildPythonPackage,
+  cairo,
   fetchFromGitHub,
+  fetchNpmDeps,
+  giflib,
   hatchling,
+  nodejs,
+  npmHooks,
+  pango,
+  pixman,
+  pkg-config,
   yt-dlp,
 }:
 
@@ -18,7 +26,27 @@ buildPythonPackage rec {
     hash = "sha256-dhpataQ1HSCRPnm4k3K/NMaQPQdNrx8C4q855l7kbbQ=";
   };
 
-  sourceRoot = "${src.name}/plugin";
+  npmDeps = fetchNpmDeps {
+    name = "${pname}-${version}-npm-deps";
+    src = src + "/server";
+    npmDepsFetcherVersion = 2;
+    hash = "sha256-Qwwi6W+Oeu6ZeLmZP5vEfAKOJyivbULR5mlk7tcVIE8=";
+  };
+
+  npmRoot = "server";
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+    giflib
+    pango
+    pixman
+  ];
 
   build-system = [ hatchling ];
 
@@ -26,10 +54,29 @@ buildPythonPackage rec {
 
   doCheck = false; # no tests
 
+  preBuild = ''
+    cd server
+    npx tsc
+    npm prune --omit=dev
+    cd ../plugin
+  '';
+
+  postInstall = ''
+    cd ..
+
+    mkdir -p $out/share/bgutil-ytdlp-pot-provider/
+    cp -r server/{build,node_modules} $out/share/bgutil-ytdlp-pot-provider/
+    makeWrapper ${lib.getExe nodejs} $out/bin/bgutil-ytdlp-pot-provider \
+      --add-flags $out/share/bgutil-ytdlp-pot-provider/build/main.js
+
+    cd plugin
+  '';
+
   meta = {
     description = "Proof-of-origin token provider plugin for yt-dlp";
     homepage = "https://github.com/Brainicism/bgutil-ytdlp-pot-provider";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ hexa ];
+    mainProgram = "bgutil-ytdlp-pot-provider";
   };
 }

From 4bc19652e6a96f05c0757c2fc7a347f02eb5f513 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 19:26:16 +0000
Subject: [PATCH 26/61] kiro-cli: 2.7.0 -> 2.8.1

---
 pkgs/by-name/ki/kiro-cli/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ki/kiro-cli/package.nix b/pkgs/by-name/ki/kiro-cli/package.nix
index 1f5dece53dc9..d93e292b1d6b 100644
--- a/pkgs/by-name/ki/kiro-cli/package.nix
+++ b/pkgs/by-name/ki/kiro-cli/package.nix
@@ -14,23 +14,23 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kiro-cli";
-  version = "2.7.0";
+  version = "2.8.1";
 
   src =
     let
       darwinDmg = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/Kiro%20CLI.dmg";
-        hash = "sha256-UkwrchLjdbQ3aWHYG+DcMkbtQyKCEbG6wdNfOpu42TY=";
+        hash = "sha256-nN3GHnAdjgIplKgbPgtis4M1lRhyH5s8ilHMjKAuRJU=";
       };
     in
     {
       x86_64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-x86_64-linux.tar.gz";
-        hash = "sha256-jDpQgcIJfLS+IxPqMsOg9Ydeol2UptXl8ugeIdVe0rg=";
+        hash = "sha256-6HAczZP8cCChkZ4rN3I+15vwABHm1LvSu+CKgIbNqRM=";
       };
       aarch64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-aarch64-linux.tar.gz";
-        hash = "sha256-YYoPWHvmjanHBuZuI+0P8lytURCOwChH7BaSZnQmIJE=";
+        hash = "sha256-dnTr+VGe30hB/LRo7whzRTt1m6cOwsorf7CebN/eock=";
       };
       x86_64-darwin = darwinDmg;
       aarch64-darwin = darwinDmg;

From fa9c5fe9772103a03dcdc3c35abf8f55c7a1cc69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 21:44:53 +0000
Subject: [PATCH 27/61] readest: 0.11.4 -> 0.11.12

---
 pkgs/by-name/re/readest/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index a0b70812e9c5..81f1b00c7297 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.4";
+  version = "0.11.12";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tudx4LLRZXjA5wgfnA7+pBgBIUv1ZOYl2DZbsx7sWr0=";
+    hash = "sha256-3nUmizE5g2ICWd/1rpsq35w8VzKEg8OMuIceNULR6SM=";
     fetchSubmodules = true;
   };
 
@@ -46,11 +46,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-K6KQfXKBopTFJ4LKbFYSe0wVtwWkkhj40nMzYosBeGw=";
+    hash = "sha256-dxcQmbJHWwkPOR9JYMSL8x3Fb4Z65lhVVF5DUDHPOtk=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-HQ7nQvxpfGTudOTGVaXRPqaxFrAOA2HnIcgFpmJsgDI=";
+  cargoHash = "sha256-t7pP3VP80/ex4iKwa0/ogEppeE6zPjEvZp53VwPg/Iw=";
 
   buildAndTestSubdir = "src-tauri";
 

From e2ab375760b26b09064ae8f4cf4a835e97a09dbd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 14:47:37 -0700
Subject: [PATCH 28/61] python3Packages.python-subunit: rename from subunit

The project name (e.g. on PyPI) is python-subunit.
---
 .../python-modules/os-client-config/default.nix           | 4 ++--
 pkgs/development/python-modules/oslotest/default.nix      | 4 ++--
 .../python-modules/python-octaviaclient/tests.nix         | 4 ++--
 .../{subunit => python-subunit}/default.nix               | 2 +-
 pkgs/development/python-modules/stestr/default.nix        | 4 ++--
 pkgs/development/python-modules/tempest/default.nix       | 4 ++--
 .../development/python-modules/testrepository/default.nix | 4 ++--
 pkgs/top-level/python-aliases.nix                         | 1 +
 pkgs/top-level/python-packages.nix                        | 8 ++++----
 9 files changed, 18 insertions(+), 17 deletions(-)
 rename pkgs/development/python-modules/{subunit => python-subunit}/default.nix (97%)

diff --git a/pkgs/development/python-modules/os-client-config/default.nix b/pkgs/development/python-modules/os-client-config/default.nix
index 6b95f5bb3462..9e64f72bd64f 100644
--- a/pkgs/development/python-modules/os-client-config/default.nix
+++ b/pkgs/development/python-modules/os-client-config/default.nix
@@ -10,7 +10,7 @@
   python-glanceclient,
   setuptools,
   stestr,
-  subunit,
+  python-subunit,
   testscenarios,
   testtools,
 }:
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     fixtures
     jsonschema
-    subunit
+    python-subunit
     oslotest
     stestr
     testscenarios
diff --git a/pkgs/development/python-modules/oslotest/default.nix b/pkgs/development/python-modules/oslotest/default.nix
index 66c6b5741d45..292ff2c8a383 100644
--- a/pkgs/development/python-modules/oslotest/default.nix
+++ b/pkgs/development/python-modules/oslotest/default.nix
@@ -5,7 +5,7 @@
   fixtures,
   pbr,
   six,
-  subunit,
+  python-subunit,
   callPackage,
 }:
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     fixtures
     six
-    subunit
+    python-subunit
   ];
 
   # check in passthru.tests.pytest to escape infinite recursion with other oslo components
diff --git a/pkgs/development/python-modules/python-octaviaclient/tests.nix b/pkgs/development/python-modules/python-octaviaclient/tests.nix
index 34a5d74de468..10499d53e417 100644
--- a/pkgs/development/python-modules/python-octaviaclient/tests.nix
+++ b/pkgs/development/python-modules/python-octaviaclient/tests.nix
@@ -7,7 +7,7 @@
   doc8,
   docutils,
   pygments,
-  subunit,
+  python-subunit,
   oslotest,
   stestr,
   testscenarios,
@@ -29,7 +29,7 @@ buildPythonPackage {
     doc8
     docutils
     pygments
-    subunit
+    python-subunit
     oslotest
     stestr
     testscenarios
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/python-subunit/default.nix
similarity index 97%
rename from pkgs/development/python-modules/subunit/default.nix
rename to pkgs/development/python-modules/python-subunit/default.nix
index 810b053d2b00..feb1644030f3 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/python-subunit/default.nix
@@ -18,8 +18,8 @@
 }:
 
 buildPythonPackage {
+  pname = "python-subunit";
   inherit (subunit)
-    pname
     version
     src
     meta
diff --git a/pkgs/development/python-modules/stestr/default.nix b/pkgs/development/python-modules/stestr/default.nix
index 7af5331c3a99..14f79e2ada20 100644
--- a/pkgs/development/python-modules/stestr/default.nix
+++ b/pkgs/development/python-modules/stestr/default.nix
@@ -5,7 +5,7 @@
   cliff,
   fixtures,
   flit-core,
-  subunit,
+  python-subunit,
   testtools,
   tomlkit,
   voluptuous,
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   dependencies = [
     cliff
     fixtures
-    subunit
+    python-subunit
     testtools
     tomlkit
     voluptuous
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index c3e40bd9f4e8..918cabbb3a12 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -24,7 +24,7 @@
   setuptools,
   stestr,
   stevedore,
-  subunit,
+  python-subunit,
   testscenarios,
   testtools,
   urllib3,
@@ -67,7 +67,7 @@ buildPythonPackage rec {
     pyyaml
     stestr
     stevedore
-    subunit
+    python-subunit
     testscenarios
     testtools
     urllib3
diff --git a/pkgs/development/python-modules/testrepository/default.nix b/pkgs/development/python-modules/testrepository/default.nix
index edaaeed18d9d..19af11c17108 100644
--- a/pkgs/development/python-modules/testrepository/default.nix
+++ b/pkgs/development/python-modules/testrepository/default.nix
@@ -5,7 +5,7 @@
   testtools,
   testresources,
   pbr,
-  subunit,
+  python-subunit,
   fixtures,
   python,
 }:
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   buildInputs = [ pbr ];
   propagatedBuildInputs = [
     fixtures
-    subunit
+    python-subunit
     testtools
   ];
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index e99e55652476..885bb235204e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -600,6 +600,7 @@ mapAliases {
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
+  subunit = python-subunit; # added 2026-06-21
   supafunc = throw "'supafunc' has been replaced by 'supabase-functions'"; # Added 2026-03-08
   supervise_api = throw "'supervise_api' has been renamed to/replaced by 'supervise-api'"; # Converted to throw 2025-10-29
   swh-perfecthash = throw "'swh-perfecthash' has been renamed to/replaced by 'swh-shard'"; # added 2025-11-13
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1d0ef73df8c5..2f9d8b4d0030 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16343,6 +16343,10 @@ self: super: with self; {
 
   python-string-utils = callPackage ../development/python-modules/python-string-utils { };
 
+  python-subunit = callPackage ../development/python-modules/python-subunit {
+    inherit (pkgs) subunit cppunit check;
+  };
+
   python-swiftclient = callPackage ../development/python-modules/python-swiftclient { };
 
   python-tado = callPackage ../development/python-modules/python-tado { };
@@ -19204,10 +19208,6 @@ self: super: with self; {
 
   subprocess4 = callPackage ../development/python-modules/subprocess4 { };
 
-  subunit = callPackage ../development/python-modules/subunit {
-    inherit (pkgs) subunit cppunit check;
-  };
-
   subzerod = callPackage ../development/python-modules/subzerod { };
 
   succulent = callPackage ../development/python-modules/succulent { };

From c51d0ad4a8cb32955128256b01ac5649ef215c8c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 22:31:56 +0000
Subject: [PATCH 29/61] vscode-extensions.haskell.haskell: 2.8.0 -> 2.8.1

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6c2dd8cac9d9..fe00f8affbe4 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2184,8 +2184,8 @@ let
         mktplcRef = {
           publisher = "haskell";
           name = "haskell";
-          version = "2.8.0";
-          hash = "sha256-Tp4Ahfp3Ma9aJtghD+mgsCBTMOP1GI1vGE5xzvHO+d4=";
+          version = "2.8.1";
+          hash = "sha256-mAlEy5a83BRhUhA22AKheP6PPpfbrdGT6HsTKbFwJYs=";
         };
         meta = {
           license = lib.licenses.mit;

From b79f6d98b3cf9d0b993e48972568df587e3477d9 Mon Sep 17 00:00:00 2001
From: Bryan Tan <bryantan@technius.net>
Date: Sun, 21 Jun 2026 17:27:45 -0700
Subject: [PATCH 30/61] netbird: fix GUI application's XDG desktop file

The PRs https://github.com/NixOS/nixpkgs/pull/496370 and
https://github.com/NixOS/nixpkgs/pull/499273 updated the netbird-ui
icon location in and removed Exec path from the netbird-ui wrapper,
respectively. However, this resulted in a bug where the both the Icon
and Exec paths pointed to non-existent files.

To address the regression, this PR adjusts the desktop file for the
netbird-ui wrapper to use the correct paths.
---
 nixos/modules/services/networking/netbird.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index d7514f2360d3..c96be69162cf 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -340,7 +340,8 @@ in
                         substitute ${cfg.ui.package}/share/applications/netbird.desktop \
                             "$out/share/applications/${mkBin "netbird"}.desktop" \
                           --replace-fail 'Name=Netbird' "Name=NetBird @ ${client.service.name}" \
-                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/pixmaps/netbird.png"
+                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/icons/hicolor/256x256/apps/netbird.png" \
+                          --replace-fail 'Exec=netbird-ui' "Exec=${mkBin "netbird-ui"}"
                       '')
                     ];
                   };

From 2523e8c86d141289f62589e8513f7900e5f97fc1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 03:52:06 +0000
Subject: [PATCH 31/61] changie: 1.24.1 -> 1.24.2

---
 pkgs/by-name/ch/changie/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/changie/package.nix b/pkgs/by-name/ch/changie/package.nix
index 75fafed8c07f..308f71a99d20 100644
--- a/pkgs/by-name/ch/changie/package.nix
+++ b/pkgs/by-name/ch/changie/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "changie";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "miniscruff";
     repo = "changie";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mstq+iOqPc8rU1lLmS0ZvguxjS0GC8DrS+G4rQVThdg=";
+    hash = "sha256-J71lJq46gSQcAA+agswh0bZ1B97YoFIV2mM0e8A1Dw8=";
   };
 
   vendorHash = "sha256-VoiGg0K89S98j2q68U0oYENgAYjynl3EeFC47l3Hq9Q=";

From 59300481e598c2cc37e58d3dfce4e7031d8c491c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 04:12:50 +0000
Subject: [PATCH 32/61] cursor-cli: 2026.06.12-19-59-36-f6aba9a ->
 2026.06.19-20-24-33-653a7fb

---
 pkgs/by-name/cu/cursor-cli/package.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index f3f8e0d037a8..4bf958f44b12 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -10,26 +10,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-bn8gLdiHW1adZ0VkvmN28Pb7X35F/dlztZuE8zzJoeQ=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-3xHrn1JaG2Leok/CiWtZezERrYqVcpZggXSD/zuWyy4=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-otjrJCOKW+be5QmK+OJkYqJMbTZolVzSVfCsqNs1Otw=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-6iiinIexiEKqXDXOHzKut1d0Mtg89A8zel0zeXna4Qc=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-kTyFA999IZRH3wnlL3kpBD/ch0d+HlkGC2GqrneJ37k=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-HgxyZ1TPLnyJJJuvi8VrQhm33/rzD9kCwxy4Mp0D9C0=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-fgM9Wuw693QhgmgLGbAzyR42ifUSUCaERTMZjPC1o+w=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-Qa22+f5+x5+4sHesqp24d9GlKqPp6xBJG7BFxz6LUVU=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "2026.06.12-19-59-36-f6aba9a";
+  version = "2026.06.19-20-24-33-653a7fb";
 
   src = sources.${hostPlatform.system};
 

From 129034508891f20011878f67ab5d6c74681ad6f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 04:14:32 +0000
Subject: [PATCH 33/61] python3Packages.altcha: 2.0.0 -> 2.0.2

---
 pkgs/development/python-modules/altcha/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/altcha/default.nix b/pkgs/development/python-modules/altcha/default.nix
index bb8b45651ccb..757668cdefc0 100644
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "altcha";
-  version = "2.0.0";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "altcha-org";
     repo = "altcha-lib-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k5vy6lalC3idiquXbDCwF+mObzja/QC3PRBGQJMZ6fA=";
+    hash = "sha256-7KepW5PAl2prWdylBqBM/GDvsLGW+6le/itUiMBvFFU=";
   };
 
   build-system = [ setuptools ];

From f670d66e77157f383785fe7376d00c102f4d2b30 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 05:15:19 +0000
Subject: [PATCH 34/61] acli: 1.3.19-stable -> 1.3.20-stable

---
 pkgs/by-name/ac/acli/sources.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json
index 0a8aa45e4ab9..ebc68bc98fb4 100644
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.19-stable",
+  "version": "1.3.20-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_arm64.tar.gz",
-      "sha256": "c5f1b1f6db63972d126a2f8ac9aca9a199739c7b51ac9e352e8ae3ed2b27131c"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_arm64.tar.gz",
+      "sha256": "5fca5f021b8202f77f60ecc0ded293fb4af67afdb462ed20dce990cfedc49517"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_arm64.tar.gz",
-      "sha256": "72972e74fa9036c5b40175570234a2e79559776c06a3aa29f632a39c7d3674da"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_arm64.tar.gz",
+      "sha256": "2209f6ab1f7fb4c16247e30115d0ff7c1511161aeae4d166e0e79ec81125a4b1"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_amd64.tar.gz",
-      "sha256": "394096ecd5a6082cbbbc8b2f3e1f1fbe694cdb340e25a4014eeb78461b869beb"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_amd64.tar.gz",
+      "sha256": "4b9c4faa0d635b6e9194b101d4826b26cd6a15c46313f6a5f9436e20e8a48b78"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_amd64.tar.gz",
-      "sha256": "f29fa8b7f01710053c2f4e07723501ebfe448672b669d32d83e961686d383a6d"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_amd64.tar.gz",
+      "sha256": "4e0190233a58276001a3cdff23e4be5e30844f98c639c49cfdeb581b9eb147aa"
     }
   }
 }

From 2e23055511238eb824859c8db04a1870c03bd675 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 08:42:37 +0000
Subject: [PATCH 35/61] forgejo-mcp: 2.29.0 -> 2.30.0

---
 pkgs/by-name/fo/forgejo-mcp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index 98ed33f8eca5..cf5cdef3bbc1 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "2.29.0";
+  version = "2.30.0";
 
   src = fetchFromCodeberg {
     owner = "goern";
     repo = "forgejo-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZG8TKcckdyrdVHiNhYK1SvKFZHetg5otEw1ytkCD+Zc=";
+    hash = "sha256-DV8lL6Q/0gD8mFn3q5UusHv8ahNtmk9t9vtbhpvpxBs=";
   };
 
   vendorHash = "sha256-QDJRbF4mZzBv1vxvo1ZQJaUJayRHj1jMgjaRfAmLMik=";

From 3b8f969af2c11261835930f381b89e63cb78709d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= <supermanitu@gmail.com>
Date: Sat, 30 May 2026 09:27:07 +0200
Subject: [PATCH 36/61] stump: init at 0.1.5

---
 pkgs/by-name/st/stump/package.nix | 116 ++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)
 create mode 100644 pkgs/by-name/st/stump/package.nix

diff --git a/pkgs/by-name/st/stump/package.nix b/pkgs/by-name/st/stump/package.nix
new file mode 100644
index 000000000000..7045bcb575d4
--- /dev/null
+++ b/pkgs/by-name/st/stump/package.nix
@@ -0,0 +1,116 @@
+{
+  lib,
+  stdenv,
+  nixosTests,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  rustPlatform,
+  nodejs,
+  pdfium-binaries,
+  openssl,
+  dbus,
+  glib,
+  gtk3,
+  webkitgtk_4_1,
+  cacert,
+  pkg-config,
+  makeWrapper,
+}:
+let
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "stumpapp";
+    repo = "stump";
+    tag = "v${version}";
+    hash = "sha256-kstMk4HJopLHW22ynVZF0itWUixwiDkbsMUpYMvw1Ag=";
+  };
+
+  frontend = stdenv.mkDerivation (finalAttrs: {
+    pname = "stump-frontend";
+    inherit src version;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = finalAttrs.src + "/yarn.lock";
+      hash = "sha256-Zh0GmxzDZ9YkUVK9i4cT4NKm83Rgcdi1qGmvA8RdDUM=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pushd apps/web
+      node ./node_modules/.bin/vite build
+      popd
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mv ./apps/web/dist $out
+    '';
+  });
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stump";
+  inherit src version;
+
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ZFIoxlArbhD+kZfX8K1iWmIaFSPfk9DeO9mL9PUZCnI=";
+
+  cargoBuildFlags = [
+    "--package"
+    "stump_server"
+    "--bin"
+    "stump_server"
+  ];
+
+  env.GIT_REV = "v${version}";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  nativeCheckInputs = [
+    cacert
+  ];
+
+  buildInputs = [
+    openssl
+    dbus
+    glib
+    gtk3
+    webkitgtk_4_1
+  ];
+
+  preCheck = ''
+    export HOME=$TMP
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/stump_server \
+      --set-default STUMP_CONFIG_DIR /var/lib/stump/config \
+      --set-default STUMP_CLIENT_DIR ${frontend} \
+      --set-default STUMP_PORT 10001 \
+      --set-default STUMP_PROFILE release \
+      --set-default PDFIUM_PATH ${pdfium-binaries}/lib/libpdfium.so \
+      --set-default API_VERSION v1
+  '';
+
+  passthru.tests = nixosTests.stump;
+
+  meta = {
+    homepage = "https://stumpapp.dev/";
+    description = "A free and open source comics, manga and digital book server with OPDS support";
+    license = lib.licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "stump_server";
+  };
+})

From e5cfb2c2068f01eb6d66540ec3d8c347ff998690 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= <supermanitu@gmail.com>
Date: Sat, 30 May 2026 10:31:11 +0200
Subject: [PATCH 37/61] nixos/stump: init module

---
 .../manual/release-notes/rl-2611.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/web-apps/stump.nix     | 172 ++++++++++++++++++
 3 files changed, 175 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/stump.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index aaf1554cf398..f54a03330c7b 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -18,6 +18,8 @@
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
+- [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0fd01c232583..9e3d2f772b48 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1798,6 +1798,7 @@
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
   ./services/web-apps/strichliste.nix
+  ./services/web-apps/stump.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix
diff --git a/nixos/modules/services/web-apps/stump.nix b/nixos/modules/services/web-apps/stump.nix
new file mode 100644
index 000000000000..8dbf1dfcb7da
--- /dev/null
+++ b/nixos/modules/services/web-apps/stump.nix
@@ -0,0 +1,172 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.stump;
+
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    ;
+
+  secret = types.nullOr (
+    types.str
+    // {
+      # We don't want users to be able to pass a path literal here but
+      # it should look like a path.
+      check = it: lib.isString it && lib.types.path.check it;
+    }
+  );
+in
+{
+  options.services.stump = {
+    enable = mkEnableOption "Stump";
+    package = lib.mkPackageOption pkgs "stump" { };
+
+    configLocation = mkOption {
+      type = types.path;
+      default = "/var/lib/stump";
+      description = "Directory used to store the database and configuration files. If it is not the default, the directory has to be created manually such that the stump user is able to read and write to it.";
+    };
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        STUMP_VERBOSITY = "2";
+      };
+      description = ''
+        Extra configuration environment variables. Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = secret;
+      example = "/run/secrets/stump";
+      default = null;
+      description = ''
+        Path of a file with extra environment variables to be loaded from disk.
+        This file is not added to the nix store, so it can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    secretFiles = mkOption {
+      type = types.attrsOf secret;
+      example = {
+        STUMP_OIDC_CLIENT_SECRET = "/run/secrets/stump_client_secret";
+      };
+      default = { };
+      description = ''
+        Attribute set containing paths to files to add to the environment of stump.
+        The files are not added to the nix store, so they can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    ip = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "The IP address that Stump will listen on.";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 10001;
+      description = "The port that Stump will listen on.";
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to open the Stump port in the firewall";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The user Stump should run as.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The group stump should run as.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    services.stump.environment = {
+      STUMP_IP = cfg.ip;
+      STUMP_PORT = toString cfg.port;
+      STUMP_CONFIG_DIR = cfg.configLocation;
+    };
+
+    systemd.services.stump = {
+      description = "Stump (A free and open source comics, manga and digital book server with OPDS support)";
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment;
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = 3;
+
+        ExecStart =
+          if cfg.secretFiles == { } then
+            "${lib.getExe cfg.package}"
+          else
+            pkgs.writeShellScript "stump-env" ''
+              ${lib.strings.concatStringsSep "\n" (
+                lib.attrsets.mapAttrsToList (key: path: "export ${key}=$(< \"${path}\")") cfg.secretFiles
+              )}
+              ${lib.getExe cfg.package}
+            '';
+        EnvironmentFile = cfg.environmentFile;
+        StateDirectory = "stump";
+        User = cfg.user;
+        Group = cfg.group;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK" # is used to determine local ip
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+
+    users.users = mkIf (cfg.user == "stump") {
+      stump = {
+        name = "stump";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "stump") { stump = { }; };
+
+    meta.maintainers = with lib.maintainers; [ jvanbruegge ];
+  };
+}

From 90ef12f95a5646e192058a8e263d3a45498f5688 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= <supermanitu@gmail.com>
Date: Sat, 30 May 2026 10:44:04 +0200
Subject: [PATCH 38/61] nixos/tests/stump: init tests

---
 nixos/tests/all-tests.nix      |  1 +
 nixos/tests/web-apps/stump.nix | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 nixos/tests/web-apps/stump.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 24b3d1216af7..d09057fed110 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1579,6 +1579,7 @@ in
   strichliste = runTest ./web-apps/strichliste.nix;
   strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
+  stump = runTest ./web-apps/stump.nix;
   stunnel = import ./stunnel.nix { inherit runTest; };
   sudo = runTest ./sudo.nix;
   sudo-rs = runTest ./sudo-rs.nix;
diff --git a/nixos/tests/web-apps/stump.nix b/nixos/tests/web-apps/stump.nix
new file mode 100644
index 000000000000..ce67647404f0
--- /dev/null
+++ b/nixos/tests/web-apps/stump.nix
@@ -0,0 +1,26 @@
+{ ... }:
+{
+  name = "stump-nixos";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.stump.enable = true;
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("stump.service")
+
+    machine.wait_for_open_port(10001)
+    machine.succeed("curl --fail -s http://localhost:10001/")
+
+    machine.succeed("curl --fail -s --data '{\"username\":\"admin\",\"password\":\"admin\"}' -H 'Content-Type: application/json' -X POST http://localhost:10001/api/v2/auth/register")
+
+    response = machine.succeed("curl --fail -s -X GET http://localhost:10001/api/v2/claim")
+    is_claimed = json.loads(response)['isClaimed']
+
+    assert is_claimed
+  '';
+}

From fb013e1c2ba15693e9c9573717555362b205efc7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 11:13:40 +0000
Subject: [PATCH 39/61] arcdps-log-manager: 1.15.1 -> 1.16

---
 pkgs/by-name/ar/arcdps-log-manager/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/arcdps-log-manager/package.nix b/pkgs/by-name/ar/arcdps-log-manager/package.nix
index 1ccbe05a2b3c..25243b0352c0 100644
--- a/pkgs/by-name/ar/arcdps-log-manager/package.nix
+++ b/pkgs/by-name/ar/arcdps-log-manager/package.nix
@@ -13,13 +13,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "arcdps-log-manager";
-  version = "1.15.1";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "gw2scratch";
     repo = "evtc";
     tag = "manager-v${finalAttrs.version}";
-    hash = "sha256-JevVLlWcPu0/inLjzsxyNCcwOTp1jwNMp/rZH9h1wO0=";
+    hash = "sha256-AiIWYb3hwkE20NdmAHlSt55QJ/d3NnQt3ZeX1COUG7k=";
   };
 
   nugetDeps = ./deps.json;

From 058216e4b92586e7c2957c93d9cba6f3243e7217 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 11:33:52 +0000
Subject: [PATCH 40/61] python3Packages.pyanglianwater: 3.2.1 -> 3.2.2

---
 pkgs/development/python-modules/pyanglianwater/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyanglianwater/default.nix b/pkgs/development/python-modules/pyanglianwater/default.nix
index c0707646394f..abc7172cb4cd 100644
--- a/pkgs/development/python-modules/pyanglianwater/default.nix
+++ b/pkgs/development/python-modules/pyanglianwater/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyanglianwater";
-  version = "3.2.1";
+  version = "3.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pantherale0";
     repo = "pyanglianwater";
     tag = version;
-    hash = "sha256-BAP3daKCIu0ANb1eUgElZ+stUt4Z5ffKia4snFXoeTA=";
+    hash = "sha256-u1s/XsNN6AuTzj0jLE7us1Mmoe8r+VuCl0khS5BRxkQ=";
   };
 
   build-system = [ setuptools ];

From 13ea45c841b0d249283f6a78f6dd9c3f29daae29 Mon Sep 17 00:00:00 2001
From: Benedikt Ritter <beneritter@gmail.com>
Date: Mon, 22 Jun 2026 13:56:27 +0200
Subject: [PATCH 41/61] jchempaint: 3.4-SNAPSHOT-2025-10-15 ->
 3.4-SNAPSHOT-2026-04-24

The previously pinned nightly depended on org.openscience.cdk:*:2.12-SNAPSHOT
artifacts, which are no longer published in the upstream Sonatype snapshots
repository, so the fetchedMavenDeps fixed-output derivation could no longer
resolve them and the build failed.

The current nightly bumped CDK to the released 2.12 (available on Maven
Central), so the dependency set is now stable and the build is reproducible.

Assisted-by: Claude Code (Claude Opus 4.8)
---
 pkgs/by-name/jc/jchempaint/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/jc/jchempaint/package.nix b/pkgs/by-name/jc/jchempaint/package.nix
index 179f52abcb5b..f3cc48097538 100644
--- a/pkgs/by-name/jc/jchempaint/package.nix
+++ b/pkgs/by-name/jc/jchempaint/package.nix
@@ -13,16 +13,16 @@
 
 maven.buildMavenPackage {
   pname = "jchempaint";
-  version = "3.4-SNAPSHOT-2025-10-15"; # "3.4-SNAPSHOT" is the version given in the pom.xml
+  version = "3.4-SNAPSHOT-2026-04-24"; # "3.4-SNAPSHOT" is the version given in the pom.xml
 
   src = fetchFromGitHub {
     owner = "JChemPaint";
     repo = "jchempaint";
-    rev = "de023b6ddc1a13f5af48fa2acc8a2633c36a30fa";
-    hash = "sha256-1wcJ1qP8yZg1qe4YkpCRGidHUXc1/1eUabR3NoM6kjc=";
+    rev = "f128d0d15be1bac4d324463f269cf130d2211253";
+    hash = "sha256-pcHX6PdnD/jkLxAMSV/Ts8VVrK9xy2NWiMVVJ7jTrQc=";
   };
 
-  mvnHash = "sha256-AGDyXyEEDMjPHMlbcxninkciZ7V/ALMUS/OkgBnni18=";
+  mvnHash = "sha256-VpYSTN5u9IhCakak48HhbwnT3FhMpPKlwRZztiNGEIw=";
 
   nativeBuildInputs = [
     makeWrapper

From 05191e38ffaaad72aac572d402d0c9b4c8463d11 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Sat, 16 May 2026 18:17:17 +0100
Subject: [PATCH 42/61] maintainers: add Br1ght0ne (back)

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 13178c26a549..5e77665d379f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3946,6 +3946,13 @@
     githubId = 140968250;
     keys = [ { fingerprint = "8321 ED3A 8DB9 99A5 1F3B  F80F F268 2914 EA42 DE26"; } ];
   };
+  Br1ght0ne = {
+    name = "Oleksii Filonenko";
+    email = "nixpkgs@brightone.cloud";
+    matrix = "@br1ght0ne:matrix.org";
+    github = "Br1ght0ne";
+    githubId = 12615679;
+  };
   br337 = {
     email = "brian.porumb@proton.me";
     github = "br337";

From 666fc1934d1c0a2ee7e7bb9994e01d3b8d1add87 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 12:24:41 +0000
Subject: [PATCH 43/61] git-mit: 6.1.0 -> 6.4.3

---
 pkgs/by-name/gi/git-mit/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/git-mit/package.nix b/pkgs/by-name/gi/git-mit/package.nix
index 9f028c9f6a1c..adb4c7f12c76 100644
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "6.1.0";
+  version = "6.4.3";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     tag = "v${version}";
-    hash = "sha256-2ApBtZPfpV5mrvD/6NS+qsA8/WLFZL6OGWnANJBMchI=";
+    hash = "sha256-Id7S0qE1020pPMoyCl8jkHWrbdOb6FZHLNsqRvwjpf8=";
   };
 
-  cargoHash = "sha256-ahT2jMFwU1+xQykqedmhOWjr+6mxpaUpjAMCeBwUTY0=";
+  cargoHash = "sha256-edKtumK9HGIXHy/ZdxZ1+lxYi+cS5G129E+WK9/JE10=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 349e70d195ff1541bff085a155b79ea649bfac15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 12:26:44 +0000
Subject: [PATCH 44/61] shelfmark: 1.3.0 -> 1.3.2

---
 pkgs/by-name/sh/shelfmark/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sh/shelfmark/package.nix b/pkgs/by-name/sh/shelfmark/package.nix
index de0496fab960..1a6f3af13afa 100644
--- a/pkgs/by-name/sh/shelfmark/package.nix
+++ b/pkgs/by-name/sh/shelfmark/package.nix
@@ -37,13 +37,13 @@ let
     apprise
   ];
 
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "calibrain";
     repo = "shelfmark";
     tag = "v${version}";
-    hash = "sha256-rkGz7I3Gb/c4ndoB+YqStEhp0iv3IrB/gwq5gTWm5+c=";
+    hash = "sha256-3Z+e7d8kSckbIfobm8peOlg19IkW7AidJ3wOjz4dEOc=";
   };
 
   frontend = buildNpmPackage (finalAttrs: {
@@ -52,7 +52,7 @@ let
 
     sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
-    npmDepsHash = "sha256-RkhjPdogxnZgaL+DysWO7Iy7EFAifskAxhALWX4n5qI=";
+    npmDepsHash = "sha256-fdocgRnduehA3LKHrVrxGmLEYgZDRTo20HSCh80RJIg=";
 
     installPhase = ''
       runHook preInstall

From 03495efb8b153e8c31a1e2708bfd28becd6221a6 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Sun, 21 Jun 2026 20:07:54 +0300
Subject: [PATCH 45/61] nixos/pocket-id: clarify 'secrets' option

It's not immediately obvious that this takes the keys without the `_KEY`
suffix, so better document it.
---
 nixos/modules/services/security/pocket-id.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 9396185c2469..547b3df6db54 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -70,10 +70,13 @@ in
         ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key";
       };
       description = ''
-        Environment variables which are loaded from the contents of the specified file paths.
+        Credentials which are loaded from the contents of the specified file paths.
+
         This can be used to securely store tokens and secrets outside of the world-readable Nix store.
 
-        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables) (all with the `_FILE` suffix).
+
+        Accepts an attrset mapping from the variable name *without its `_FILE` suffix* to the path on disk.
 
         Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file.
       '';

From b898819b34252fbf48b0f4f7e8d89d3aaa0f4cd9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 12:50:00 +0000
Subject: [PATCH 46/61] mailpit: 1.30.1 -> 1.30.2

---
 pkgs/by-name/ma/mailpit/source.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index d08c094b3283..163ac2f273cb 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.30.1";
-  hash = "sha256-Z/0Lh+2VLB3w4AHNf+imWRgHmarO1MMUmNqrcAVSQ2k=";
-  npmDepsHash = "sha256-eccYGPIbk98+BtNtBAq4G1z/ymj6HHwacuH6ZktuN0U=";
-  vendorHash = "sha256-FgwMdvND7DMrYWp9kB2IB+Gjyo1gm1LtLTeC9SfPw9U=";
+  version = "1.30.2";
+  hash = "sha256-37nJRJL1mxvUdD7L9/yO/Lzyjvn09Tu9xHTEt4pxu2s=";
+  npmDepsHash = "sha256-AApRrIIYC4NtKIFyGQ3lnKIOk7LZNDK8wvUUbSczTrA=";
+  vendorHash = "sha256-em0317Q1u5sl8gws4/qqM8e9H5F4vfBiM7tLCyufgEk=";
 }

From 3424802497d373d509fc75ddb167ed6248da6e7f Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Mon, 22 Jun 2026 15:30:21 +0200
Subject: [PATCH 47/61] lenovo-legion: 0.0.20-unstable-2025-07-11 ->
 0.0.20-unstable-2026-05-12

Closes #525082

Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
---
 pkgs/by-name/le/lenovo-legion/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/le/lenovo-legion/package.nix b/pkgs/by-name/le/lenovo-legion/package.nix
index e712e5e11f47..ca02b32de8ee 100644
--- a/pkgs/by-name/le/lenovo-legion/package.nix
+++ b/pkgs/by-name/le/lenovo-legion/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lenovo-legion-app";
-  version = "0.0.20-unstable-2025-07-11";
+  version = "0.0.20-unstable-2026-05-12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
-    rev = "f559df04cc0705b2b181dfd0404110a4d1d6e2a9";
-    hash = "sha256-WXGDlykH6aBUVotmDcGZ8Y/zC8iBAv57u3hXRnfTaSo=";
+    rev = "7c19579d13ce686cf1e237699b9a78e80d03c977";
+    hash = "sha256-gTlUrbNKCUQ+g70StlqspDn90wKW2scssKPZqaegzTY=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -38,10 +38,6 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     # only fixup application (legion-linux-gui), service (legiond) currently not installed so do not fixup
-    # version
-    substituteInPlace ./setup.cfg \
-      --replace-fail "_VERSION" "${builtins.head (lib.splitString "-" version)}"
-
     # /etc
     substituteInPlace ./legion_linux/legion.py \
       --replace-fail "/etc/legion_linux" "$out/share/legion_linux"

From ec9c385bf2c16f8027f3944843ded797ecbfec5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 14 Jun 2026 23:45:50 +0700
Subject: [PATCH 48/61] mirth: init at 0-unstable-2026-05-28

---
 pkgs/by-name/mi/mirth/package.nix | 106 ++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 pkgs/by-name/mi/mirth/package.nix

diff --git a/pkgs/by-name/mi/mirth/package.nix b/pkgs/by-name/mi/mirth/package.nix
new file mode 100644
index 000000000000..759d556cd217
--- /dev/null
+++ b/pkgs/by-name/mi/mirth/package.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  fetchFromSourcehut,
+  buildPackages,
+  stdenv,
+  makeBinaryWrapper,
+}:
+
+stdenv.mkDerivation {
+  name = "mirth";
+  version = "0-unstable-2026-05-28";
+
+  src = fetchFromSourcehut {
+    owner = "~typeswitch";
+    repo = "mirth";
+    rev = "b180112a547cb803e3bf5720a0bb08f8bffa9742";
+    hash = "sha256-6nd1DrN3sGobmOh+E/8hYUFW2tBSFLdaEPXrViKDVSc=";
+  };
+
+  outputs = [
+    "out"
+    "lib"
+    "bin"
+    "doc"
+    "examples"
+    "vim"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postPatch = ''
+    # Replace hard-coded GCC with stdenv’s C compiler.
+    # NOTE: newer GCC requires optimization level ≥1 to use fortity. -O1 is
+    # fast enough as a default for the compiler stages.
+    substituteInPlace Makefile \
+      --replace-fail "-O0" "-O1" \
+      --replace-fail "CC=gcc \$(C99FLAGS)" "CC=${buildPackages.stdenv.cc.targetPrefix}cc \$(C99FLAGS)"
+
+    # Override the final binary, mirth3, with the target’s C compiler & -O2
+    # optimization for distribution.
+    echo "bin/mirth3: CC := ${stdenv.cc.targetPrefix}cc \$(C99FLAGS) -O2" >>Makefile
+  '';
+
+  buildFlags = [
+    "bin/mirth2"
+    "bin/mirth3"
+  ];
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d "$lib/lib/mirth" "$doc/share/doc/mirth/tutorial" \
+      "$examples/share/mirth/examples" "$vim/share/vim-plugins/mirth"
+
+    cp -Tr lib "$lib/lib/mirth"
+    cp -Tr examples "$examples/share/mirth/examples"
+    cp -Tr tutorial "$doc/share/doc/mirth/tutorial"
+    cp -Tr tools/mirth-vim  "$vim/share/vim-plugins/mirth"
+
+    bin/mirth2 src/main.mth --docs "$doc/share/doc/mirth" -c
+    install -Dm644 LICENSE README.md -t "$doc/share/doc/mirth"
+
+    # stages 0–2 aren’t needed anymore
+    install -Dm755 bin/mirth3 "$bin/bin/mirth"
+
+    runHook postInstall
+  '';
+
+  # The raw binary @ $bin needs wrapping to get the stdlib @ $lib. By wrapping
+  # it here, it will be more flexible towards allowing users to wrap the Mirth
+  # binary with their own stdlib & other packages.
+  postFixup = ''
+    makeBinaryWrapper "$bin/bin/mirth" "$out/bin/mirth" \
+      --add-flags "-P $lib/lib/mirth"
+  '';
+
+  meta = {
+    description = "Concatenative functional programming language with strong static linear types";
+    longDescription = ''
+      Mirth is inspired by Forth, Joy, Haskell, Lisp, and monoidal category theory.
+      Mirth compiles to C99.
+    '';
+    homepage = "https://git.sr.ht/~typeswitch/mirth";
+    license = lib.licenses.bsd0;
+    mainProgram = "mirth";
+    # https://git.sr.ht/~typeswitch/mirth/tree/main/item/src/mirth.h#L4-22
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "aarch64-windows"
+      "i686-linux"
+      "i686-windows"
+      "x86_64-darwin"
+      "x86_64-linux"
+      "x86_64-windows"
+    ];
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}

From ae48e54926c99897a562fa1096aba7c87b9aa83f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Tue, 16 Jun 2026 22:59:26 +0700
Subject: [PATCH 49/61] mirth: patch up st_mode offset on aarch64-linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is out of my wheelhouse but mirrors the Darwin code. It’s either do
this sort of ugly patch, or set a aarch64-linux to broken…

Assisted-by: DeepSeek V4 Flash
---
 pkgs/by-name/mi/mirth/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mi/mirth/package.nix b/pkgs/by-name/mi/mirth/package.nix
index 759d556cd217..23036eac3194 100644
--- a/pkgs/by-name/mi/mirth/package.nix
+++ b/pkgs/by-name/mi/mirth/package.nix
@@ -34,6 +34,14 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ makeBinaryWrapper ];
 
   postPatch = ''
+    ${lib.optionalString (with stdenv.buildPlatform; isAarch64 && isLinux) /* sh */ ''
+      # Bug report: https://todo.sr.ht/~typeswitch/mirth/16
+      substituteInPlace bin/mirth0.c \
+        --replace-fail "WRAP_I63(24LL);" "WRAP_I63(16LL);"
+      substituteInPlace lib/std/world.mth \
+        --replace-fail "Linux -> 24u," "Linux -> running-arch Arch.ARM64 = if(16u, 24u),"
+    ''}
+
     # Replace hard-coded GCC with stdenv’s C compiler.
     # NOTE: newer GCC requires optimization level ≥1 to use fortity. -O1 is
     # fast enough as a default for the compiler stages.
@@ -51,7 +59,8 @@ stdenv.mkDerivation {
     "bin/mirth3"
   ];
 
-  doCheck = true;
+  # st_mode substitution intentionally diverges from the pre-generated mirth0.c
+  doCheck = with stdenv.buildPlatform; !(isAarch64 && isLinux);
 
   installPhase = ''
     runHook preInstall

From 0ab8999464e63ba44b322027d18ba96d7e9601d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Mon, 15 Jun 2026 15:39:30 +0700
Subject: [PATCH 50/61] vimPlugins.mirth: init at mirth.version

---
 .../vim/plugins/non-generated/mirth/default.nix   | 15 +++++++++++++++
 pkgs/by-name/mi/mirth/package.nix                 |  4 ++--
 2 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix

diff --git a/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix
new file mode 100644
index 000000000000..3409d9f27312
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix
@@ -0,0 +1,15 @@
+{ vimUtils, mirth }:
+
+vimUtils.buildVimPlugin {
+  pname = "mirth";
+  inherit (mirth) version;
+  src = mirth.vim;
+  meta = {
+    inherit (mirth.meta)
+      homepage
+      license
+      platforms
+      ;
+    description = "Syntax highlighting & filetype detection for the Mirth programming language";
+  };
+}
diff --git a/pkgs/by-name/mi/mirth/package.nix b/pkgs/by-name/mi/mirth/package.nix
index 23036eac3194..a50de7b73adb 100644
--- a/pkgs/by-name/mi/mirth/package.nix
+++ b/pkgs/by-name/mi/mirth/package.nix
@@ -66,12 +66,12 @@ stdenv.mkDerivation {
     runHook preInstall
 
     install -d "$lib/lib/mirth" "$doc/share/doc/mirth/tutorial" \
-      "$examples/share/mirth/examples" "$vim/share/vim-plugins/mirth"
+      "$examples/share/mirth/examples" "$vim"
 
     cp -Tr lib "$lib/lib/mirth"
     cp -Tr examples "$examples/share/mirth/examples"
     cp -Tr tutorial "$doc/share/doc/mirth/tutorial"
-    cp -Tr tools/mirth-vim  "$vim/share/vim-plugins/mirth"
+    cp -Tr tools/mirth-vim  "$vim"
 
     bin/mirth2 src/main.mth --docs "$doc/share/doc/mirth" -c
     install -Dm644 LICENSE README.md -t "$doc/share/doc/mirth"

From d97a5a0742d27ad9d4802ad22f0757a6f95262df Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Mon, 22 Jun 2026 15:56:32 +0200
Subject: [PATCH 51/61] yarn-berry-fetcher: remove yuka from maintainers

I have done enough
---
 pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
index dc24e4e18552..4edc9469e777 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
@@ -44,7 +44,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "yarn-berry-fetcher";
     maintainers = with lib.maintainers; [
-      yuka
       flokli
     ];
   };

From 5ba744c21173a0374711cebf369e94b0f830024e Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Sat, 16 May 2026 18:17:17 +0100
Subject: [PATCH 52/61] thaw: init at 1.2.0

---
 pkgs/by-name/th/thaw/package.nix | 41 ++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 pkgs/by-name/th/thaw/package.nix

diff --git a/pkgs/by-name/th/thaw/package.nix b/pkgs/by-name/th/thaw/package.nix
new file mode 100644
index 000000000000..75b88e6409fd
--- /dev/null
+++ b/pkgs/by-name/th/thaw/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  unzip,
+  fetchurl,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "thaw";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/stonerl/Thaw/releases/download/${finalAttrs.version}/Thaw_${finalAttrs.version}.zip";
+    hash = "sha256-1n9NMe+foFeEmphUC4EM+kLgvGYBnTYFq9CORcaaoG8=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/Applications"
+    cp -r Thaw.app "$out/Applications"
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Menu bar manager for macOS 26";
+    homepage = "https://github.com/stonerl/Thaw";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

From 38f0445e8b71fd94f5a42f0e3738010d5c9f4e69 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 22 Jun 2026 16:14:50 +0100
Subject: [PATCH 53/61] alt-tab-macos: 11.1.0 -> 11.3.1

---
 pkgs/by-name/al/alt-tab-macos/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index a289da289757..53e1f00e4127 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "11.1.0";
+  version = "11.3.1";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-wVg0HjPC4MYOVNDtFdzcG5P8amrjE3tNNccUAPRGZNY=";
+    hash = "sha256-X59sFQWuT9y3/YGfG/lFoXmoeV/BjHPniDZey5Phb4w=";
   };
 
   sourceRoot = ".";

From 46541d94addcf98d94931e1c1fb16e70002f1820 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 22 Jun 2026 16:16:52 +0100
Subject: [PATCH 54/61] alt-tab-macos: update homepage, add Br1ght0ne as
 maintainer

---
 pkgs/by-name/al/alt-tab-macos/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 53e1f00e4127..5a0725b65e46 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -32,11 +32,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Windows alt-tab on macOS";
-    homepage = "https://alt-tab-macos.netlify.app";
+    homepage = "https://alt-tab.app";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       FlameFlag
       emilytrau
+      Br1ght0ne
     ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

From 12b7e11d7b6447cad09bf72ee3b0d413d3553ba4 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Jun 2026 15:22:01 +0000
Subject: [PATCH 55/61] mirth: minor cleanup

---
 pkgs/by-name/mi/mirth/package.nix | 43 ++++++++++++++++---------------
 1 file changed, 22 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/mi/mirth/package.nix b/pkgs/by-name/mi/mirth/package.nix
index a50de7b73adb..ada6e8fada17 100644
--- a/pkgs/by-name/mi/mirth/package.nix
+++ b/pkgs/by-name/mi/mirth/package.nix
@@ -17,6 +17,28 @@ stdenv.mkDerivation {
     hash = "sha256-6nd1DrN3sGobmOh+E/8hYUFW2tBSFLdaEPXrViKDVSc=";
   };
 
+  postPatch =
+    # Bug report: https://todo.sr.ht/~typeswitch/mirth/16
+    lib.optionalString (with stdenv.buildPlatform; isAarch64 && isLinux) ''
+      substituteInPlace bin/mirth0.c \
+        --replace-fail "WRAP_I63(24LL);" "WRAP_I63(16LL);"
+      substituteInPlace lib/std/world.mth \
+        --replace-fail "Linux -> 24u," "Linux -> running-arch Arch.ARM64 = if(16u, 24u),"
+    ''
+    # Replace hard-coded GCC with stdenv’s C compiler.
+    # NOTE: newer GCC requires optimization level ≥1 to use fortity. -O1 is
+    # fast enough as a default for the compiler stages.
+    + ''
+      substituteInPlace Makefile \
+        --replace-fail "-O0" "-O1" \
+        --replace-fail "CC=gcc \$(C99FLAGS)" "CC=${buildPackages.stdenv.cc.targetPrefix}cc \$(C99FLAGS)"
+    ''
+    # Override the final binary, mirth3, with the target’s C compiler & -O2
+    # optimization for distribution.
+    + ''
+      echo "bin/mirth3: CC := ${stdenv.cc.targetPrefix}cc \$(C99FLAGS) -O2" >>Makefile
+    '';
+
   outputs = [
     "out"
     "lib"
@@ -33,27 +55,6 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
-  postPatch = ''
-    ${lib.optionalString (with stdenv.buildPlatform; isAarch64 && isLinux) /* sh */ ''
-      # Bug report: https://todo.sr.ht/~typeswitch/mirth/16
-      substituteInPlace bin/mirth0.c \
-        --replace-fail "WRAP_I63(24LL);" "WRAP_I63(16LL);"
-      substituteInPlace lib/std/world.mth \
-        --replace-fail "Linux -> 24u," "Linux -> running-arch Arch.ARM64 = if(16u, 24u),"
-    ''}
-
-    # Replace hard-coded GCC with stdenv’s C compiler.
-    # NOTE: newer GCC requires optimization level ≥1 to use fortity. -O1 is
-    # fast enough as a default for the compiler stages.
-    substituteInPlace Makefile \
-      --replace-fail "-O0" "-O1" \
-      --replace-fail "CC=gcc \$(C99FLAGS)" "CC=${buildPackages.stdenv.cc.targetPrefix}cc \$(C99FLAGS)"
-
-    # Override the final binary, mirth3, with the target’s C compiler & -O2
-    # optimization for distribution.
-    echo "bin/mirth3: CC := ${stdenv.cc.targetPrefix}cc \$(C99FLAGS) -O2" >>Makefile
-  '';
-
   buildFlags = [
     "bin/mirth2"
     "bin/mirth3"

From 3d2d81354f2db20f5d48c0fc3cf41f41bc3c4c1e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 15:22:39 +0000
Subject: [PATCH 56/61] cdemu-daemon: 3.3.0 -> 3.3.1

---
 pkgs/by-name/cd/cdemu-daemon/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cd/cdemu-daemon/package.nix b/pkgs/by-name/cd/cdemu-daemon/package.nix
index f25748b01c85..95eb42f7e75c 100644
--- a/pkgs/by-name/cd/cdemu-daemon/package.nix
+++ b/pkgs/by-name/cd/cdemu-daemon/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdemu-daemon";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/cdemu-daemon-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AYHjiOAQdu685gc6p0j2QNtCmTYTWix1kzWQZYvGPWU=";
+    hash = "sha256-rkhxivVGQ2lsCUQEXJupDenj74E3shQXExhTWysf+qo=";
   };
 
   nativeBuildInputs = [

From c6dbb12fb3299d3f50d2ca9ed4e6e5d98b375a31 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 15:22:42 +0000
Subject: [PATCH 57/61] image-analyzer: 3.3.0 -> 3.3.1

---
 pkgs/by-name/im/image-analyzer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/image-analyzer/package.nix b/pkgs/by-name/im/image-analyzer/package.nix
index 364286765d26..f35aae5c0e82 100644
--- a/pkgs/by-name/im/image-analyzer/package.nix
+++ b/pkgs/by-name/im/image-analyzer/package.nix
@@ -16,11 +16,11 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "image-analyzer";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/image-analyzer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N2aufwYEBVx7z2Vo7Qi4DP2MsDXXr5LrQdeNYOtNGnU=";
+    hash = "sha256-vsfDmtjrvAC49ynnJ7QguBfSVnt/sBpCy/Eau2l1/jQ=";
   };
 
   buildInputs = [

From 8f26ec5602d481a1137ae683165af637bfff2124 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 22 Jun 2026 15:43:59 +0300
Subject: [PATCH 58/61] pnpmConfigHook: allow opt-out

This is sometimes useful when mixing ecosystems, e.g. in buildGoModule.
---
 doc/languages-frameworks/javascript.section.md              | 2 ++
 pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 7bf9ad661b55..e2ef01141eb9 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -408,6 +408,8 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
index 38f6eb97b56b..4a44775ab7b8 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
+++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
@@ -118,4 +118,6 @@ pnpmConfigHook() {
     echo "Finished pnpmConfigHook"
 }
 
-postConfigureHooks+=(pnpmConfigHook)
+if [ -z "${dontPnpmConfigure-}" ]; then
+  postConfigureHooks+=(pnpmConfigHook)
+fi

From f5ef87603d0d3e088176590195c6fb8e195c83cd Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 22 Jun 2026 16:42:45 +0100
Subject: [PATCH 59/61] raycast-beta: 0.60.0.0 -> 0.65.1.0

---
 pkgs/by-name/ra/raycast-beta/package.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ra/raycast-beta/package.nix b/pkgs/by-name/ra/raycast-beta/package.nix
index acd40a54dc50..862481b3f98d 100644
--- a/pkgs/by-name/ra/raycast-beta/package.nix
+++ b/pkgs/by-name/ra/raycast-beta/package.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast-beta";
-  version = "0.60.0.0";
+  version = "0.65.1.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     {
       aarch64-darwin = fetchurl {
         name = "Raycast_Beta.dmg";
-        url = "https://x-r2.raycast-releases.com/Raycast_Beta_${finalAttrs.version}_2fc04147cc_arm64.dmg";
-        hash = "sha256-PQX5l5UzlphKySIR5QRcJvJLe9NxQrTOPLy3itV0QHU=";
+        url = "https://x-r2.raycast-releases.com/Raycast_Beta_0.65.1.0_66eacbc22e_arm64.dmg";
+        hash = "sha256-K9OuqlUR0E3hIVonSuBYAWFAvQCZQG35fsv5OWO8gKM=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast-beta: ${stdenvNoCC.system} is unsupported.");
@@ -68,10 +68,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Control your tools with a few keystrokes - beta release";
-    homepage = "https://raycast.app/";
+    homepage = "https://raycast.app/new";
+    changelog = "https://www.raycast.com/changelog/macos-beta";
     license = lib.licenses.unfree;
     mainProgram = "raycast-beta";
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      Br1ght0ne
+    ];
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

From 7b8895217b6ad388008218622a69a883a71cd8e0 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Mon, 22 Jun 2026 17:46:54 +0200
Subject: [PATCH 60/61] leviculum: 0.6.0 -> 0.7.0

---
 pkgs/by-name/le/leviculum/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/le/leviculum/package.nix b/pkgs/by-name/le/leviculum/package.nix
index 7b380d466ef2..77b04ab2e892 100644
--- a/pkgs/by-name/le/leviculum/package.nix
+++ b/pkgs/by-name/le/leviculum/package.nix
@@ -4,15 +4,13 @@
   fetchFromGitea,
   pkg-config,
   udev,
-  gitMinimal,
-  writableTmpDirAsHomeHook,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "leviculum";
-  version = "0.6.0";
+  version = "0.7.0";
   __structuredAttrs = true;
 
   src = fetchFromGitea {
@@ -21,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "leviculum";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-pNCTWIGVr0tHrqpisJbAEAyQUW1/mKexu6K+LZ9PWZ4=";
+    hash = "sha256-/ylHrCLs9QSTiox3/JHJtZBYLlysLsezG8iz6C1DtCI=";
   };
 
-  cargoHash = "sha256-pGORaIcRRkJKKcyFnt8Fu9wmhWREwH6Cs8KvlEas/NQ=";
+  cargoHash = "sha256-DfwN4DTWcezcDRkl27cZXQdfXIhxlAj6+2nmYXhxius=";
 
   nativeBuildInputs = [
     pkg-config

From f077693004c97f1b0d3cb1d7edc0bf885cec5125 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 22 Jun 2026 17:15:27 +0100
Subject: [PATCH 61/61] tailscale-gui: 1.92.3 -> 1.98.5

---
 pkgs/by-name/ta/tailscale-gui/package.nix | 28 ++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tailscale-gui/package.nix b/pkgs/by-name/ta/tailscale-gui/package.nix
index 214d6a6d3137..2bdeb434acbc 100644
--- a/pkgs/by-name/ta/tailscale-gui/package.nix
+++ b/pkgs/by-name/ta/tailscale-gui/package.nix
@@ -5,15 +5,20 @@
   xar,
   cpio,
   pbzx,
+  writeShellApplication,
+  cacert,
+  curl,
+  jq,
+  common-updater-scripts,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tailscale-gui";
-  version = "1.92.3";
+  version = "1.98.5";
 
   src = fetchurl {
     url = "https://pkgs.tailscale.com/stable/Tailscale-${finalAttrs.version}-macos.pkg";
-    hash = "sha256-K5tJHyFhqnxV4KHzr7YOHRoH33vk+dq+EVWyUo88nuI=";
+    hash = "sha256-r7e8aKNWaX1psI0a3sohTUv8xmUv8oebH/ndjeHLoVA=";
   };
 
   dontUnpack = true;
@@ -39,13 +44,30 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = lib.getExe (writeShellApplication {
+    name = "tailscale-gui-update-script";
+    runtimeInputs = [
+      cacert
+      curl
+      jq
+      common-updater-scripts
+    ];
+    text = ''
+      version=$(curl --silent "https://pkgs.tailscale.com/stable/?mode=json&os=darwin" | jq -r '.MacZipsVersion')
+      update-source-version tailscale-gui "$version"
+    '';
+  });
+
   meta = {
     description = "Tailscale GUI client for macOS";
     homepage = "https://tailscale.com";
     changelog = "https://tailscale.com/changelog#client";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ anish ];
+    maintainers = with lib.maintainers; [
+      anish
+      Br1ght0ne
+    ];
     platforms = lib.platforms.darwin;
   };
 })